code-auditor-mcp 3.4.11 → 3.4.13

package/dist/analyzers/crossDomain/CrossDomainAnalyzer.js

@@ -24,20 +24,135 @@ import { UniversalAnalyzer } from '../../languages/UniversalAnalyzer.js';
 import { VALIDATOR_PACKAGES } from '../provenance.js';
 import { makeVisitorStatus } from '../../pipeline.js';
 // ---------------------------------------------------------------------------
+// Call-graph helpers — pure functions with no `this` state, kept off the
+// analyzer class to bound its aggregate cyclomatic complexity.
+// ---------------------------------------------------------------------------
+/**
+ * BFS through the call graph (graph_cache) up to maxDepth to check if
+ * any path from startFuncId reaches a validator function ID.
+ */
+function bfsReachesValidator(indexHandle, startFuncId, validatorIds, maxDepth) {
+    const visited = new Set();
+    let currentLevel = [startFuncId];
+    for (let d = 0; d < maxDepth; d++) {
+        const nextLevel = [];
+        for (const funcId of currentLevel) {
+            if (validatorIds.has(funcId))
+                return true;
+            if (visited.has(funcId))
+                continue;
+            visited.add(funcId);
+            // Get callees from graph_cache call edges
+            const callees = indexHandle
+                .query(`SELECT neighbor_key FROM graph_cache
+           WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
+            for (const callee of callees) {
+                const calleeId = parseInt(callee.neighbor_key, 10);
+                if (!isNaN(calleeId) && !visited.has(calleeId)) {
+                    nextLevel.push(calleeId);
+                }
+            }
+        }
+        currentLevel = nextLevel;
+    }
+    // Check any remaining nodes at the final level
+    for (const funcId of currentLevel) {
+        if (validatorIds.has(funcId))
+            return true;
+    }
+    return false;
+}
+/**
+ * Expand a writer's directly-written table set with the tables written by
+ * functions it calls (depth-1 callee expansion via graph_cache). Requires the
+ * call-graph infrastructure (graph_cache + functions tables, populated by
+ * code-audit index sync); without it, returns the direct write set unchanged.
+ */
+function expandWrittenTables(indexHandle, key, initialTables, graph) {
+    const allTables = new Set(initialTables);
+    const { fnIdLookup, hasGraphData } = graph;
+    if (!fnIdLookup || !hasGraphData)
+        return allTables;
+    const funcId = fnIdLookup.get(key);
+    if (funcId === undefined)
+        return allTables;
+    const calleeRows = indexHandle
+        .query(`SELECT neighbor_key FROM graph_cache
+       WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
+    for (const callee of calleeRows) {
+        const calleeFuncs = indexHandle
+            .query(`SELECT name, file_path FROM functions WHERE id = ?`, [parseInt(callee.neighbor_key, 10)]);
+        for (const cf of calleeFuncs) {
+            const calleeTables = indexHandle
+                .query(`SELECT DISTINCT table_name FROM schema_usage
+           WHERE usage_type IN ('insert', 'update', 'delete', 'create')
+             AND function_name = ? AND file_path = ?`, [cf.name, cf.file_path]);
+            for (const ct of calleeTables) {
+                allTables.add(ct.table_name);
+            }
+        }
+    }
+    return allTables;
+}
+/**
+ * BFS outward from test-file function IDs through the call graph (graph_cache)
+ * up to maxDepth, collecting every function ID reached. Used for the
+ * static-reach fallback: a high-risk function not in this set is uncovered.
+ */
+function collectReachableIds(indexHandle, startIds, maxDepth) {
+    const reachableIds = new Set();
+    for (const startId of startIds) {
+        const visited = new Set();
+        let currentLevel = [startId];
+        for (let d = 0; d < maxDepth; d++) {
+            const nextLevel = [];
+            for (const funcId of currentLevel) {
+                if (visited.has(funcId))
+                    continue;
+                visited.add(funcId);
+                reachableIds.add(funcId);
+                const callees = indexHandle
+                    .query(`SELECT neighbor_key FROM graph_cache
+             WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
+                for (const callee of callees) {
+                    const calleeId = parseInt(callee.neighbor_key, 10);
+                    if (!isNaN(calleeId) && !visited.has(calleeId)) {
+                        nextLevel.push(calleeId);
+                    }
+                }
+            }
+            currentLevel = nextLevel;
+        }
+        // Check the final level's nodes that never got expanded.
+        for (const funcId of currentLevel) {
+            if (!reachableIds.has(funcId))
+                reachableIds.add(funcId);
+        }
+    }
+    return reachableIds;
+}
+// ---------------------------------------------------------------------------
 // Analyzer
 // ---------------------------------------------------------------------------
+const ANALYZER_NAME = 'cross-domain';
+/**
+ * Cross domain analyzer.
+ */
 export class CrossDomainAnalyzer extends UniversalAnalyzer {
-    name = 'cross-domain';
+    name = ANALYZER_NAME;
     description = 'Detects cross-domain issues (schema lifecycle, validation bypass, coverage gaps)';
     category = 'architecture';
     /**
      * Full override: query the code index DB for cross-domain findings.
      * The base-class per-file AST loop is bypassed — all detection is
      * post-analysis across the indexed data.
+     * @param config
+     * @param files
+     * @param options
+     * @returns
      */
     async analyze(files, config = {}, options = {}) {
         const startTime = Date.now();
-        const violations = [];
         const indexHandle = config.indexHandle;
         if (!indexHandle) {
             return {
@@ -45,586 +160,568 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
                 errors: [{ file: '', error: 'Failed to open code index database' }],
                 status: makeVisitorStatus(0),
                 executionTime: Date.now() - startTime,
-                analyzerName: 'cross-domain',
+                analyzerName: ANALYZER_NAME,
                 metrics: { filesAnalyzed: 0, totalViolations: 0, executionTime: Date.now() - startTime },
             };
         }
-        if (!indexHandle) {
-            return {
-                violations: [],
-                errors: [],
-                status: makeVisitorStatus(files.length),
+        const filePathClause = this.resolveFilePathClause(config);
+        const violations = this.runDetectors(indexHandle, config, filePathClause);
+        const uniqueFiles = this.countDistinctFiles(indexHandle, filePathClause);
+        return {
+            violations,
+            errors: [],
+            status: makeVisitorStatus(uniqueFiles || files.length),
+            executionTime: Date.now() - startTime,
+            analyzerName: ANALYZER_NAME,
+            metrics: {
+                filesAnalyzed: uniqueFiles || files.length,
+                totalViolations: violations.length,
                 executionTime: Date.now() - startTime,
-                analyzerName: 'cross-domain',
-                metrics: { filesAnalyzed: files.length, totalViolations: 0, executionTime: Date.now() - startTime },
-            };
-        }
-        // Project root scoping: in test environments the in-memory DB singleton
-        // is shared across tests, so schema_usage entries from previous test
-        // cases leak into subsequent queries. Filter to the current project root.
+            },
+        };
+    }
+    /**
+     * Project root scoping: in test environments the in-memory DB singleton is
+     * shared across tests, so schema_usage entries from previous test cases leak
+     * into subsequent queries. Build a file-path LIKE clause scoped to root.
+     */
+    resolveFilePathClause(config) {
         const projectRoot = config.projectRoot;
         const resolvedRoot = projectRoot ? path.resolve(projectRoot) : undefined;
-        const filePathClause = resolvedRoot
-            ? { prefix: resolvedRoot, clause: 'AND file_path LIKE ?', param: `${resolvedRoot}%` }
+        return resolvedRoot
+            ? { clause: 'AND file_path LIKE ?', param: `${resolvedRoot}%` }
             : undefined;
+    }
+    /** Run the R1/R3/R4 detectors and collect their violations. */
+    runDetectors(indexHandle, config, filePathClause) {
+        const violations = [];
         // R1 — Schema lifecycle detectors
         const lifecycle = config.schemaLifecycle ?? {};
         if (lifecycle.enableWrittenNeverRead !== false) {
-            violations.push(...this.detectWrittenNeverRead(indexHandle, filePathClause));
+            violations.push(...detectWrittenNeverRead(indexHandle, filePathClause));
         }
         if (lifecycle.enableReadNeverWritten !== false) {
-            violations.push(...this.detectReadNeverWritten(indexHandle, filePathClause));
+            violations.push(...detectReadNeverWritten(indexHandle, filePathClause));
         }
         if (lifecycle.enableTransactionBoundaryRisk !== false) {
             const txnTableMax = lifecycle.txnTableMax ?? 4;
-            violations.push(...this.detectTransactionBoundaryRisk(indexHandle, txnTableMax, filePathClause));
+            violations.push(...detectTransactionBoundaryRisk(indexHandle, txnTableMax, filePathClause));
         }
         // R3 — Validation-bypass detection
         const bypass = config.validatorBypass;
         if (bypass) {
-            violations.push(...this.detectValidationBypass(indexHandle, bypass, filePathClause));
+            violations.push(...detectValidationBypass(indexHandle, bypass, filePathClause));
         }
         // R4 — Coverage by importance
         const coverage = config.coverage;
         if (coverage) {
-            violations.push(...this.detectUncoveredRisk(indexHandle, coverage, filePathClause));
+            violations.push(...detectUncoveredRisk(indexHandle, coverage, filePathClause));
         }
-        // Count distinct files with schema_usage entries
-        const fileRows = indexHandle
+        return violations;
+    }
+    /** Count distinct files with schema_usage entries. */
+    countDistinctFiles(indexHandle, filePathClause) {
+        const rows = indexHandle
             .query(filePathClause
             ? `SELECT COUNT(DISTINCT file_path) as cnt FROM schema_usage WHERE 1=1 ${filePathClause.clause}`
             : 'SELECT COUNT(DISTINCT file_path) as cnt FROM schema_usage', (filePathClause ? [filePathClause.param] : []));
-        const uniqueFiles = fileRows[0]?.cnt ?? 0;
-        return {
-            violations,
-            errors: [],
-            status: makeVisitorStatus(uniqueFiles || files.length),
-            executionTime: Date.now() - startTime,
-            analyzerName: 'cross-domain',
-            metrics: {
-                filesAnalyzed: uniqueFiles || files.length,
-                totalViolations: violations.length,
-                executionTime: Date.now() - startTime,
-            },
-        };
+        return rows[0]?.cnt ?? 0;
     }
     /** No-op — all detection is DB-based. */
     async analyzeAST() {
         return [];
     }
-    // ── R1: Written-Never-Read ──────────────────────────────────────────────
-    /**
-     * Detect tables that are written to (INSERT/UPDATE/DELETE/CREATE) but
-     * never read from (SELECT). These might be dead writes or missed read paths.
-     */
-    detectWrittenNeverRead(indexHandle, filePath) {
-        const violations = [];
-        const fpWhere = filePath ? filePath.clause : '';
-        const rows = indexHandle
-            .query(`SELECT DISTINCT table_name, file_path, function_name, line, usage_type
-         FROM schema_usage
-         WHERE usage_type IN ('insert', 'update', 'delete', 'create')
-           ${fpWhere}
-           AND table_name NOT IN (
-             SELECT DISTINCT table_name FROM schema_usage WHERE usage_type = 'select' ${fpWhere}
-           )
-         ORDER BY table_name, file_path`, (filePath ? [filePath.param, filePath.param] : []));
-        // Deduplicate by table_name — one violation per table, anchored to
-        // the first writing file encountered.
-        const seen = new Set();
-        for (const row of rows) {
-            if (seen.has(row.table_name))
-                continue;
-            seen.add(row.table_name);
-            violations.push({
-                file: row.file_path,
+}
+// ── R1: Written-Never-Read ──────────────────────────────────────────────
+/**
+ * Detect tables that are written to (INSERT/UPDATE/DELETE/CREATE) but
+ * never read from (SELECT). These might be dead writes or missed read paths.
+ */
+function detectWrittenNeverRead(indexHandle, filePath) {
+    const violations = [];
+    const fpWhere = filePath ? filePath.clause : '';
+    const rows = indexHandle
+        .query(`SELECT DISTINCT table_name, file_path, function_name, line, usage_type
+       FROM schema_usage
+       WHERE usage_type IN ('insert', 'update', 'delete', 'create')
+         ${fpWhere}
+         AND table_name NOT IN (
+           SELECT DISTINCT table_name FROM schema_usage WHERE usage_type = 'select' ${fpWhere}
+         )
+       ORDER BY table_name, file_path`, (filePath ? [filePath.param, filePath.param] : []));
+    // Deduplicate by table_name — one violation per table, anchored to
+    // the first writing file encountered.
+    const seen = new Set();
+    for (const row of rows) {
+        if (seen.has(row.table_name))
+            continue;
+        seen.add(row.table_name);
+        violations.push({
+            file: row.file_path,
+            line: row.line,
+            column: 0,
+            severity: 'suggestion',
+            message: `Table '${row.table_name}' is written (${row.usage_type}) but never read (SELECT). Consider removing unused writes or adding read paths.`,
+            rule: 'cross-domain/written-never-read',
+            analyzer: ANALYZER_NAME,
+            functionName: row.function_name,
+        });
+    }
+    return violations;
+}
+// ── R1: Read-Never-Written ──────────────────────────────────────────────
+/**
+ * Detect tables that are read from (SELECT) but never written to
+ * (INSERT/UPDATE/DELETE/CREATE). These may be external/managed tables
+ * or indicate missing write coverage.
+ */
+function detectReadNeverWritten(indexHandle, filePath) {
+    const violations = [];
+    const fpWhere = filePath ? filePath.clause : '';
+    const rows = indexHandle
+        .query(`SELECT DISTINCT table_name, file_path, function_name, line, usage_type
+       FROM schema_usage
+       WHERE usage_type = 'select'
+         ${fpWhere}
+         AND table_name NOT IN (
+           SELECT DISTINCT table_name FROM schema_usage
+           WHERE usage_type IN ('insert', 'update', 'delete', 'create') ${fpWhere}
+         )
+       ORDER BY table_name, file_path`, (filePath ? [filePath.param, filePath.param] : []));
+    const seen = new Set();
+    for (const row of rows) {
+        if (seen.has(row.table_name))
+            continue;
+        seen.add(row.table_name);
+        violations.push({
+            file: row.file_path,
+            line: row.line,
+            column: 0,
+            severity: 'suggestion',
+            message: `Table '${row.table_name}' is read (SELECT) but never written (INSERT/UPDATE/DELETE). This may be an external/managed table, or indicate missing write coverage.`,
+            rule: 'cross-domain/read-never-written',
+            analyzer: ANALYZER_NAME,
+            functionName: row.function_name,
+        });
+    }
+    return violations;
+}
+// ── R1: Transaction-Boundary Risk ───────────────────────────────────────
+/**
+ * Detect functions that write to ≥ txnTableMax distinct tables, including
+ * tables written by depth-1 callees via the call graph (graph_cache).
+ *
+ * This surfaces functions that may have transaction-boundary risk:
+ * writing to too many tables in a single logical operation can lead to
+ * long-running transactions, lock contention, and partial-failure complexity.
+ */
+function detectTransactionBoundaryRisk(indexHandle, txnTableMax, filePath) {
+    const fpWhere = filePath ? filePath.clause : '';
+    const fpParams = filePath ? [filePath.param] : [];
+    // Query schema_usage directly (no JOIN on functions) so this detector
+    // works whether or not deepSync has populated the functions table.
+    const writerRows = indexHandle
+        .query(`SELECT su.function_name, su.file_path, su.table_name, MIN(su.line) as line
+       FROM schema_usage su
+       WHERE su.usage_type IN ('insert', 'update', 'delete', 'create')
+       ${fpWhere}
+       GROUP BY su.function_name, su.file_path, su.table_name
+       ORDER BY su.function_name, su.file_path`, fpParams);
+    if (writerRows.length === 0)
+        return [];
+    const funcWrites = groupWriterTables(writerRows);
+    const graph = resolveCallGraphContext(indexHandle);
+    return flagTransactionBoundaryWrites(funcWrites, indexHandle, graph, txnTableMax);
+}
+/** Group written tables by (file_path, function_name) key. */
+function groupWriterTables(writerRows) {
+    const funcWrites = new Map();
+    for (const row of writerRows) {
+        const key = `${row.file_path}::${row.function_name}`;
+        const entry = funcWrites.get(key);
+        if (entry) {
+            entry.tables.add(row.table_name);
+        }
+        else {
+            funcWrites.set(key, {
+                filePath: row.file_path,
                 line: row.line,
-                column: 0,
-                severity: 'suggestion',
-                message: `Table '${row.table_name}' is written (${row.usage_type}) but never read (SELECT). Consider removing unused writes or adding read paths.`,
-                rule: 'cross-domain/written-never-read',
-                analyzer: this.name,
-                functionName: row.function_name,
+                tables: new Set([row.table_name]),
             });
         }
-        return violations;
     }
-    // ── R1: Read-Never-Written ──────────────────────────────────────────────
-    /**
-     * Detect tables that are read from (SELECT) but never written to
-     * (INSERT/UPDATE/DELETE/CREATE). These may be external/managed tables
-     * or indicate missing write coverage.
-     */
-    detectReadNeverWritten(indexHandle, filePath) {
-        const violations = [];
-        const fpWhere = filePath ? filePath.clause : '';
-        const rows = indexHandle
-            .query(`SELECT DISTINCT table_name, file_path, function_name, line, usage_type
-         FROM schema_usage
-         WHERE usage_type = 'select'
-           ${fpWhere}
-           AND table_name NOT IN (
-             SELECT DISTINCT table_name FROM schema_usage
-             WHERE usage_type IN ('insert', 'update', 'delete', 'create') ${fpWhere}
-           )
-         ORDER BY table_name, file_path`, (filePath ? [filePath.param, filePath.param] : []));
-        const seen = new Set();
-        for (const row of rows) {
-            if (seen.has(row.table_name))
-                continue;
-            seen.add(row.table_name);
+    return funcWrites;
+}
+/**
+ * Flag functions whose depth-1-expanded write set reaches txnTableMax.
+ * When graph_cache is unpopulated, expandWrittenTables degrades gracefully
+ * to reporting direct writes only.
+ */
+function flagTransactionBoundaryWrites(funcWrites, indexHandle, graph, txnTableMax) {
+    const violations = [];
+    for (const [key, funcData] of funcWrites) {
+        const allTables = expandWrittenTables(indexHandle, key, funcData.tables, graph);
+        if (allTables.size >= txnTableMax) {
+            const tableList = [...allTables].sort().join(', ');
             violations.push({
-                file: row.file_path,
-                line: row.line,
+                file: funcData.filePath,
+                line: funcData.line,
                 column: 0,
                 severity: 'suggestion',
-                message: `Table '${row.table_name}' is read (SELECT) but never written (INSERT/UPDATE/DELETE). This may be an external/managed table, or indicate missing write coverage.`,
-                rule: 'cross-domain/read-never-written',
-                analyzer: this.name,
-                functionName: row.function_name,
+                message: `Function writes to ${allTables.size} distinct tables (threshold: ${txnTableMax}): ${tableList}. This may indicate transaction-boundary risk — consider splitting writes across smaller transactional scopes.`,
+                rule: 'cross-domain/transaction-boundary',
+                analyzer: ANALYZER_NAME,
+                functionName: key.split('::')[1],
             });
         }
-        return violations;
     }
-    // ── R1: Transaction-Boundary Risk ───────────────────────────────────────
-    /**
-     * Detect functions that write to ≥ txnTableMax distinct tables, including
-     * tables written by depth-1 callees via the call graph (graph_cache).
-     *
-     * This surfaces functions that may have transaction-boundary risk:
-     * writing to too many tables in a single logical operation can lead to
-     * long-running transactions, lock contention, and partial-failure complexity.
-     */
-    detectTransactionBoundaryRisk(indexHandle, txnTableMax, filePath) {
-        const violations = [];
-        const fpWhere = filePath ? filePath.clause : '';
-        const fpParams = filePath ? [filePath.param] : [];
-        // ── 1. Group writes by (function_name, file_path) — no JOIN on functions.
-        //    The functions table is only populated during deepSync (code-audit index
-        //    sync), not during normal audit. We query schema_usage directly so this
-        //    detector works in both modes.
-        const writerRows = indexHandle
-            .query(`SELECT su.function_name, su.file_path, su.table_name, MIN(su.line) as line
-         FROM schema_usage su
-         WHERE su.usage_type IN ('insert', 'update', 'delete', 'create')
-         ${fpWhere}
-         GROUP BY su.function_name, su.file_path, su.table_name
-         ORDER BY su.function_name, su.file_path`, fpParams);
-        if (writerRows.length === 0)
-            return violations;
-        const funcWrites = new Map();
-        for (const row of writerRows) {
-            const key = `${row.file_path}::${row.function_name}`;
-            const entry = funcWrites.get(key);
-            if (entry) {
-                entry.tables.add(row.table_name);
-            }
-            else {
-                funcWrites.set(key, {
-                    filePath: row.file_path,
-                    line: row.line,
-                    tables: new Set([row.table_name]),
-                });
-            }
-        }
-        // ── 2. Attempt callee expansion via graph_cache when the infrastructure
-        //    is populated (requires code-audit index sync). When the functions or
-        //    graph_cache tables are empty/missing, we fall back to reporting on
-        //    direct writes only — the basic signal is still useful without the
-        //    call-graph context.
-        const hasGraphData = (() => {
-            try {
-                const row = indexHandle.query("SELECT COUNT(*) AS n FROM graph_cache WHERE graph_type = 'call'");
-                const cnt = row[0];
-                return (cnt?.n ?? 0) > 0;
-            }
-            catch {
-                return false;
-            }
-        })();
-        // Build a lookup of function IDs from the functions table (only if it
-        // has data — i.e., deepSync has been run).
-        let fnIdLookup = null;
-        if (hasGraphData) {
-            try {
-                const fnRows = indexHandle.query('SELECT id, name, file_path FROM functions');
-                if (fnRows.length > 0) {
-                    fnIdLookup = new Map();
-                    for (const r of fnRows) {
-                        fnIdLookup.set(`${r.file_path}::${r.name}`, r.id);
-                    }
+    return violations;
+}
+/**
+ * Resolve the call-graph infrastructure available for callee expansion:
+ * whether graph_cache has any 'call' edges, and a function key → id lookup
+ * built from the functions table (populated only by deepSync). Any failure
+ * degrades gracefully to direct-write-only detection.
+ */
+function resolveCallGraphContext(indexHandle) {
+    let hasGraphData = false;
+    try {
+        const row = indexHandle.query("SELECT COUNT(*) AS n FROM graph_cache WHERE graph_type = 'call'");
+        const cnt = row[0];
+        hasGraphData = (cnt?.n ?? 0) > 0;
+    }
+    catch {
+        hasGraphData = false;
+    }
+    let fnIdLookup = null;
+    if (hasGraphData) {
+        try {
+            const fnRows = indexHandle.query('SELECT id, name, file_path FROM functions');
+            if (fnRows.length > 0) {
+                fnIdLookup = new Map();
+                for (const r of fnRows) {
+                    fnIdLookup.set(`${r.file_path}::${r.name}`, r.id);
                 }
             }
-            catch {
-                // functions table might not exist or be unpopulated
-            }
         }
-        for (const [key, funcData] of funcWrites) {
-            const allTables = new Set(funcData.tables);
-            // Depth-1 callee expansion: only when graph_cache and functions tables
-            // are both populated. Without deepSync, this is skipped gracefully.
-            if (fnIdLookup && hasGraphData) {
-                const funcId = fnIdLookup.get(key);
-                if (funcId !== undefined) {
-                    const calleeRows = indexHandle
-                        .query(`SELECT neighbor_key FROM graph_cache
-               WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
-                    for (const callee of calleeRows) {
-                        const calleeFuncs = indexHandle
-                            .query(`SELECT name, file_path FROM functions WHERE id = ?`, [parseInt(callee.neighbor_key, 10)]);
-                        for (const cf of calleeFuncs) {
-                            const calleeTables = indexHandle
-                                .query(`SELECT DISTINCT table_name FROM schema_usage
-                   WHERE usage_type IN ('insert', 'update', 'delete', 'create')
-                     AND function_name = ? AND file_path = ?`, [cf.name, cf.file_path]);
-                            for (const ct of calleeTables) {
-                                allTables.add(ct.table_name);
-                            }
-                        }
-                    }
-                }
-            }
-            if (allTables.size >= txnTableMax) {
-                const tableList = [...allTables].sort().join(', ');
-                violations.push({
-                    file: funcData.filePath,
-                    line: funcData.line,
-                    column: 0,
-                    severity: 'suggestion',
-                    message: `Function writes to ${allTables.size} distinct tables (threshold: ${txnTableMax}): ${tableList}. This may indicate transaction-boundary risk — consider splitting writes across smaller transactional scopes.`,
-                    rule: 'cross-domain/transaction-boundary',
-                    analyzer: this.name,
-                    functionName: key.split('::')[1],
-                });
-            }
+        catch {
+            // functions table might not exist or be unpopulated
         }
+    }
+    return { hasGraphData, fnIdLookup };
+}
+// ── R3: Validation-Bypass ────────────────────────────────────────────────
+/**
+ * Detect write functions that don't reach a validator, when a majority of
+ * peer writers in the same directory do (BFS ≤ configurable depth).
+ *
+ * Validator identification (priority order):
+ *   1. User-configured validators list
+ *   2. Provenanced: exported functions in files importing VALIDATOR_PACKAGES
+ *   3. Heuristic fallback: name GLOB 'validate*' OR 'assert*' (when both
+ *      above are silent)
+ */
+function detectValidationBypass(indexHandle, config, filePath) {
+    const violations = [];
+    const { validators: userValidators = [], modeShare = 0.8, minCorpus = 20, depth = 3, } = config;
+    const validatorIds = buildValidatorIds(indexHandle, userValidators);
+    if (validatorIds.size === 0)
+        return violations;
+    const fpAliasWhere = filePath ? `AND su.${filePath.clause.slice(4)}` : '';
+    const writers = indexHandle
+        .query(`SELECT DISTINCT su.function_name, su.file_path, su.line, f.id as function_id
+       FROM schema_usage su
+       JOIN functions f ON f.name = su.function_name
+                        AND f.file_path = su.file_path
+       WHERE su.usage_type IN ('insert', 'update', 'delete', 'create')
+       ${fpAliasWhere}
+       ORDER BY su.file_path, su.function_name`, (filePath ? [filePath.param] : []));
+    if (writers.length === 0)
         return violations;
+    const writerCoverage = computeWriterCoverage(writers, validatorIds, indexHandle, depth);
+    violations.push(...flagUncoveredWriters(writers, writerCoverage, { minCorpus, modeShare, depth }));
+    return violations;
+}
+/** BFS from each writer to check validator reach, deduplicated by key. */
+function computeWriterCoverage(writers, validatorIds, indexHandle, depth) {
+    const writerCoverage = new Map();
+    for (const w of writers) {
+        const key = `${w.file_path}::${w.function_name}`;
+        if (writerCoverage.has(key))
+            continue; // deduplicate
+        const covered = bfsReachesValidator(indexHandle, w.function_id, validatorIds, depth);
+        writerCoverage.set(key, {
+            covered,
+            line: w.line,
+            funcName: w.function_name,
+        });
     }
-    // ── R3: Validation-Bypass ────────────────────────────────────────────────
-    /**
-     * Detect write functions that don't reach a validator, when a majority of
-     * peer writers in the same directory do (BFS ≤ configurable depth).
-     *
-     * Validator identification (priority order):
-     *   1. User-configured validators list
-     *   2. Provenanced: exported functions in files importing VALIDATOR_PACKAGES
-     *   3. Heuristic fallback: name GLOB 'validate*' OR 'assert*' (when both
-     *      above are silent)
-     */
-    detectValidationBypass(indexHandle, config, filePath) {
-        const violations = [];
-        const { validators: userValidators = [], modeShare = 0.8, minCorpus = 20, depth = 3, } = config;
-        // ── 1. Build the validator function ID set ─────────────────────────────
-        const validatorIds = new Set();
-        // 1a. User-configured validators (format: "funcName" or "path#funcName")
-        for (const v of userValidators) {
-            const hashIdx = v.indexOf('#');
-            if (hashIdx >= 0) {
-                const vPath = v.substring(0, hashIdx);
-                const vName = v.substring(hashIdx + 1);
-                const rows = indexHandle
-                    .query('SELECT id FROM functions WHERE name = ? AND file_path = ?', [vName, vPath]);
-                for (const r of rows)
-                    validatorIds.add(r.id);
-            }
-            else {
-                const rows = indexHandle
-                    .query('SELECT id FROM functions WHERE name = ?', [v]);
-                for (const r of rows)
-                    validatorIds.add(r.id);
-            }
-        }
-        // 1b. Provenanced validators: exported functions whose OWN used_imports
-        //     includes a validator package. Per-identifier check — a function in
-        //     a zod-importing file only qualifies if its own body uses the
-        //     validator package, not just because it cohabits the file.
-        if (validatorIds.size === 0) {
-            const likeClauses = [...VALIDATOR_PACKAGES].map(() => 'used_imports LIKE ?');
-            const likeParams = [...VALIDATOR_PACKAGES].map((pkg) => `%"${pkg}"%`);
-            const validatorFuncs = indexHandle
-                .query(`SELECT id FROM functions
-           WHERE used_imports IS NOT NULL
-             AND (${likeClauses.join(' OR ')})
-             AND is_exported = 1`, likeParams);
-            for (const f of validatorFuncs)
-                validatorIds.add(f.id);
-        }
-        // 1c. Heuristic fallback: name-based matching (only when provenance
-        //     found nothing AND no user-configured validators exist).
-        if (validatorIds.size === 0 && userValidators.length === 0) {
-            const heuristicFuncs = indexHandle
-                .query(`SELECT id FROM functions
-           WHERE (name GLOB 'validate*' OR name GLOB 'assert*')
-             AND is_exported = 1`);
-            for (const f of heuristicFuncs)
-                validatorIds.add(f.id);
-        }
-        if (validatorIds.size === 0)
-            return violations;
-        // ── 2. Find all writer functions from schema_usage ─────────────────────
-        const fpAliasWhere = filePath
-            ? `AND su.${filePath.clause.slice(4)}`
-            : '';
-        const writers = indexHandle
-            .query(`SELECT DISTINCT su.function_name, su.file_path, su.line, f.id as function_id
-         FROM schema_usage su
-         JOIN functions f ON f.name = su.function_name
-                          AND f.file_path = su.file_path
-         WHERE su.usage_type IN ('insert', 'update', 'delete', 'create')
-         ${fpAliasWhere}
-         ORDER BY su.file_path, su.function_name`, (filePath ? [filePath.param] : []));
-        if (writers.length === 0)
-            return violations;
-        const writerCoverage = new Map();
-        for (const w of writers) {
-            const key = `${w.file_path}::${w.function_name}`;
-            if (writerCoverage.has(key))
-                continue; // deduplicate
-            const covered = this.bfsReachesValidator(indexHandle, w.function_id, validatorIds, depth);
-            writerCoverage.set(key, {
-                covered,
-                line: w.line,
-                funcName: w.function_name,
-            });
-        }
-        const dirWriters = new Map();
-        const dirSeen = new Set(); // deduplicate writers with multiple schema_usage rows
-        for (const w of writers) {
-            const dir = path.dirname(w.file_path);
-            const key = `${w.file_path}::${w.function_name}`;
-            const dirKey = `${dir}::${key}`;
-            if (dirSeen.has(dirKey))
-                continue;
-            dirSeen.add(dirKey);
-            const cov = writerCoverage.get(key);
-            if (!cov)
-                continue;
-            if (!dirWriters.has(dir))
-                dirWriters.set(dir, []);
-            dirWriters.get(dir).push({
-                key,
-                covered: cov.covered,
-                line: cov.line,
-                funcName: cov.funcName,
-                filePath: w.file_path,
-            });
+    return writerCoverage;
+}
+/**
+ * Build the validator function ID set in priority order: user-configured
+ * validators, then provenanced validators (exported functions whose own
+ * used_imports includes a validator package), then a name-based heuristic
+ * fallback only when both prior sources are silent.
+ */
+function buildValidatorIds(indexHandle, userValidators) {
+    const validatorIds = new Set();
+    // 1a. User-configured validators (format: "funcName" or "path#funcName")
+    for (const v of userValidators) {
+        const hashIdx = v.indexOf('#');
+        if (hashIdx >= 0) {
+            const vPath = v.substring(0, hashIdx);
+            const vName = v.substring(hashIdx + 1);
+            const rows = indexHandle
+                .query('SELECT id FROM functions WHERE name = ? AND file_path = ?', [vName, vPath]);
+            for (const r of rows)
+                validatorIds.add(r.id);
         }
-        // ── 5. Flag uncovered writers in validator-dense directories ───────────
-        for (const [dir, dirWriterList] of dirWriters) {
-            if (dirWriterList.length < minCorpus)
-                continue;
-            const coveredCount = dirWriterList.filter((w) => w.covered).length;
-            const ratio = coveredCount / dirWriterList.length;
-            if (ratio >= modeShare) {
-                for (const w of dirWriterList) {
-                    if (w.covered)
-                        continue;
-                    violations.push({
-                        file: w.filePath,
-                        line: w.line,
-                        column: 0,
-                        severity: 'suggestion',
-                        message: `Function '${w.funcName}' is not validated. ` +
-                            `${coveredCount}/${dirWriterList.length} peer writers in '${dir}' ` +
-                            `reach a validator but this function does not (BFS depth ≤ ${depth}). ` +
-                            `Consider adding input validation.`,
-                        rule: 'cross-domain/validation-bypass',
-                        analyzer: this.name,
-                        functionName: w.funcName,
-                    });
-                }
-            }
+        else {
+            const rows = indexHandle
+                .query('SELECT id FROM functions WHERE name = ?', [v]);
+            for (const r of rows)
+                validatorIds.add(r.id);
         }
-        return violations;
     }
-    // ── R4: Coverage by Importance ──────────────────────────────────────────
-    /**
-     * Detect exported, high-risk functions with no test coverage.
-     * Uses the getUntestedTopDecile() query that joins functions with
-     * hotspot_scores and coverage_data to find untested high-risk functions.
-     *
-     * Static-reach fallback: when no measured coverage exists, falls back
-     * to static reach analysis from test files (BFS from test-file functions
-     * into the call graph).
-     */
-    detectUncoveredRisk(indexHandle, coverage, filePath) {
-        const violations = [];
-        const topRiskDecile = coverage.topRiskDecile ?? 0.1;
-        // Check if any measured coverage exists
-        const measuredCount = indexHandle
-            .query("SELECT COUNT(*) AS cnt FROM coverage_data WHERE basis = 'measured'")[0].cnt;
-        if (measuredCount > 0) {
-            // Use measured coverage data from lcov/istanbul imports
-            const untested = indexHandle.getUntestedTopDecile(topRiskDecile);
-            // Determine source format from existing coverage entries
-            const sourceRow = indexHandle
-                .query("SELECT source, imported_at FROM coverage_data WHERE basis = 'measured' LIMIT 1")[0];
-            const sourceFormat = sourceRow?.source ?? 'unknown';
-            const importedAt = sourceRow?.imported_at ?? null;
-            // Stale-import detection: measured coverage predates last full index sync
-            let staleWarning = null;
-            if (importedAt) {
-                const lastSync = indexHandle.getMeta?.('last_full_sync_timestamp') ?? null;
-                if (lastSync && importedAt < lastSync) {
-                    staleWarning =
-                        ` — WARNING: this coverage data may be stale (imported ${importedAt}, ` +
-                            `last index sync was ${lastSync}). ` +
-                            `Re-import with 'code-audit coverage --import <path>' for accurate results.`;
-                }
-            }
-            for (const fn of untested) {
+    // 1b. Provenanced validators: exported functions whose OWN used_imports
+    //     includes a validator package. Per-identifier check — a function in
+    //     a zod-importing file only qualifies if its own body uses the
+    //     validator package, not just because it cohabits the file.
+    if (validatorIds.size === 0) {
+        const likeClauses = [...VALIDATOR_PACKAGES].map(() => 'used_imports LIKE ?');
+        const likeParams = [...VALIDATOR_PACKAGES].map((pkg) => `%"${pkg}"%`);
+        const validatorFuncs = indexHandle
+            .query(`SELECT id FROM functions
+         WHERE used_imports IS NOT NULL
+           AND (${likeClauses.join(' OR ')})
+           AND is_exported = 1`, likeParams);
+        for (const f of validatorFuncs)
+            validatorIds.add(f.id);
+    }
+    // 1c. Heuristic fallback: name-based matching (only when provenance
+    //     found nothing AND no user-configured validators exist).
+    if (validatorIds.size === 0 && userValidators.length === 0) {
+        const heuristicFuncs = indexHandle
+            .query(`SELECT id FROM functions
+         WHERE (name GLOB 'validate*' OR name GLOB 'assert*')
+           AND is_exported = 1`);
+        for (const f of heuristicFuncs)
+            validatorIds.add(f.id);
+    }
+    return validatorIds;
+}
+/**
+ * Group writers by directory, then flag uncovered writers only in
+ * directories where a mode-share of peers reach a validator.
+ */
+function flagUncoveredWriters(writers, writerCoverage, opts) {
+    const { minCorpus, modeShare, depth } = opts;
+    const dirWriters = groupWritersByDirectory(writers, writerCoverage);
+    return flagUnvalidatedWriters(dirWriters, minCorpus, modeShare, depth);
+}
+/** Group writers by directory, deduplicating multi-row schema_usage entries. */
+function groupWritersByDirectory(writers, writerCoverage) {
+    const dirWriters = new Map();
+    const dirSeen = new Set();
+    for (const w of writers) {
+        const dir = path.dirname(w.file_path);
+        const key = `${w.file_path}::${w.function_name}`;
+        const dirKey = `${dir}::${key}`;
+        if (dirSeen.has(dirKey))
+            continue;
+        dirSeen.add(dirKey);
+        const cov = writerCoverage.get(key);
+        if (!cov)
+            continue;
+        if (!dirWriters.has(dir))
+            dirWriters.set(dir, []);
+        dirWriters.get(dir).push({
+            key,
+            covered: cov.covered,
+            line: cov.line,
+            funcName: cov.funcName,
+            filePath: w.file_path,
+        });
+    }
+    return dirWriters;
+}
+/** Flag uncovered writers in validator-dense directories. */
+function flagUnvalidatedWriters(dirWriters, minCorpus, modeShare, depth) {
+    const violations = [];
+    for (const [dir, dirWriterList] of dirWriters) {
+        if (dirWriterList.length < minCorpus)
+            continue;
+        const coveredCount = dirWriterList.filter((w) => w.covered).length;
+        const ratio = coveredCount / dirWriterList.length;
+        if (ratio >= modeShare) {
+            for (const w of dirWriterList) {
+                if (w.covered)
+                    continue;
                 violations.push({
-                    file: fn.filePath,
-                    line: fn.lineNumber ?? 1,
+                    file: w.filePath,
+                    line: w.line,
                     column: 0,
                     severity: 'suggestion',
-                    message: `Exported function '${fn.functionName}' (risk ${fn.riskScore.toFixed(3)}) has no measured test coverage. ` +
-                        `Top imported functions should have test coverage. Import coverage data with 'code-audit coverage --import <path>'.` +
-                        (staleWarning ?? ''),
-                    rule: 'cross-domain/uncovered-risk',
-                    analyzer: this.name,
-                    functionName: fn.functionName,
-                    basis: fn.basis,
-                    sourceFormat,
-                    ...(staleWarning ? { staleImport: true } : {}),
+                    message: `Function '${w.funcName}' is not validated. ` +
+                        `${coveredCount}/${dirWriterList.length} peer writers in '${dir}' ` +
+                        `reach a validator but this function does not (BFS depth ≤ ${depth}). ` +
+                        `Consider adding input validation.`,
+                    rule: 'cross-domain/validation-bypass',
+                    analyzer: ANALYZER_NAME,
+                    functionName: w.funcName,
                 });
             }
         }
-        else {
-            // Static-reach fallback: use the call graph to determine which
-            // exported high-risk functions are reachable from test files
-            const fpWhere = filePath ? 'AND f.file_path LIKE ?' : '';
-            const params = [topRiskDecile];
-            if (filePath)
-                params.push(filePath.param);
-            const highRiskFns = indexHandle.query(`WITH ranked AS (
-            SELECT
-              f.name,
-              f.file_path,
-              f.line_number,
-              f.id,
-              COALESCE(hs.score, 0.0) as risk_score,
-              PERCENT_RANK() OVER (ORDER BY COALESCE(hs.score, 0.0) DESC) as pct
-            FROM functions f
-            LEFT JOIN hotspot_scores hs ON hs.target = (f.file_path || ':' || f.name)
-              AND hs.type = 'function'
-            WHERE f.is_exported = 1
-              ${fpWhere}
-          )
-          SELECT id, name, file_path, line_number, risk_score
-          FROM ranked
-          WHERE pct <= ?
-          ORDER BY risk_score DESC`, params);
-            if (highRiskFns.length === 0)
-                return violations;
-            // Find test-file functions to use as BFS starting points.
-            const testGlobs = coverage.testGlobs ?? ['**/*.test.*', '**/*.spec.*', '**/__tests__/**'];
-            const testGlobPatterns = testGlobs.map((g) => g.replace(/\*\*/g, '%').replace(/\*/g, '%'));
-            let testFileClause = '';
-            const testFileParams = [];
-            if (testGlobPatterns.length > 0) {
-                testFileClause = testGlobPatterns
-                    .map((_p, i) => `file_path LIKE ?`)
-                    .join(' OR ');
-                for (const p of testGlobPatterns)
-                    testFileParams.push(p);
-            }
-            const testFuncIds = new Set();
-            if (testFileClause) {
-                const testFunctions = indexHandle
-                    .query(`SELECT id FROM functions WHERE ${testFileClause}`, testFileParams);
-                for (const tf of testFunctions)
-                    testFuncIds.add(tf.id);
-            }
-            // BFS from each test-file function through call graph (reverse: test
-            // calls code under test). We traverse the call edges: if testFunc → X,
-            // then X is reachable.
-            const reachableIds = new Set();
-            const maxDepth = coverage.staticReachDepth ?? 2;
-            if (testFuncIds.size > 0) {
-                for (const startId of testFuncIds) {
-                    const visited = new Set();
-                    let currentLevel = [startId];
-                    for (let d = 0; d < maxDepth; d++) {
-                        const nextLevel = [];
-                        for (const funcId of currentLevel) {
-                            if (visited.has(funcId))
-                                continue;
-                            visited.add(funcId);
-                            reachableIds.add(funcId);
-                            const callees = indexHandle
-                                .query(`SELECT neighbor_key FROM graph_cache
-                   WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
-                            for (const callee of callees) {
-                                const calleeId = parseInt(callee.neighbor_key, 10);
-                                if (!isNaN(calleeId) && !visited.has(calleeId)) {
-                                    nextLevel.push(calleeId);
-                                }
-                            }
-                        }
-                        currentLevel = nextLevel;
-                    }
-                    // Check last level
-                    for (const funcId of currentLevel) {
-                        if (!reachableIds.has(funcId))
-                            reachableIds.add(funcId);
-                    }
-                }
-            }
-            // Flag high-risk functions not in the reachable set
-            for (const fn of highRiskFns) {
-                if (!reachableIds.has(fn.id)) {
-                    violations.push({
-                        file: fn.file_path,
-                        line: fn.line_number,
-                        column: 0,
-                        severity: 'suggestion',
-                        message: `Exported function '${fn.name}' (risk ${fn.risk_score.toFixed(3)}) is not reachable from known test files. ` +
-                            `Add test coverage or import measured coverage with 'code-audit coverage --import <path>'.`,
-                        rule: 'cross-domain/uncovered-risk',
-                        analyzer: this.name,
-                        functionName: fn.name,
-                        basis: 'static-reach',
-                    });
-                }
-            }
-        }
-        return violations;
     }
-    /**
-     * BFS through the call graph (graph_cache) up to maxDepth to check if
-     * any path from startFuncId reaches a validator function ID.
-     */
-    bfsReachesValidator(indexHandle, startFuncId, validatorIds, maxDepth) {
-        const visited = new Set();
-        let currentLevel = [startFuncId];
-        for (let d = 0; d < maxDepth; d++) {
-            const nextLevel = [];
-            for (const funcId of currentLevel) {
-                if (validatorIds.has(funcId))
-                    return true;
-                if (visited.has(funcId))
-                    continue;
-                visited.add(funcId);
-                // Get callees from graph_cache call edges
-                const callees = indexHandle
-                    .query(`SELECT neighbor_key FROM graph_cache
-             WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
-                for (const callee of callees) {
-                    const calleeId = parseInt(callee.neighbor_key, 10);
-                    if (!isNaN(calleeId) && !visited.has(calleeId)) {
-                        nextLevel.push(calleeId);
-                    }
-                }
-            }
-            currentLevel = nextLevel;
-        }
-        // Check any remaining nodes at the final level
-        for (const funcId of currentLevel) {
-            if (validatorIds.has(funcId))
-                return true;
+    return violations;
+}
+// ── R4: Coverage by Importance ──────────────────────────────────────────
+/**
+ * Detect exported, high-risk functions with no test coverage.
+ * Uses the getUntestedTopDecile() query that joins functions with
+ * hotspot_scores and coverage_data to find untested high-risk functions.
+ *
+ * Static-reach fallback: when no measured coverage exists, falls back
+ * to static reach analysis from test files (BFS from test-file functions
+ * into the call graph).
+ */
+function detectUncoveredRisk(indexHandle, coverage, filePath) {
+    const topRiskDecile = coverage.topRiskDecile ?? 0.1;
+    // Check if any measured coverage exists
+    const measuredCount = indexHandle
+        .query("SELECT COUNT(*) AS cnt FROM coverage_data WHERE basis = 'measured'")[0].cnt;
+    if (measuredCount > 0) {
+        return detectMeasuredUncovered(indexHandle, topRiskDecile);
+    }
+    return detectStaticReachUncovered(indexHandle, coverage, filePath);
+}
+/**
+ * Flag exported high-risk functions with no measured test coverage, using
+ * lcov/istanbul-imported data with stale-import detection.
+ */
+function detectMeasuredUncovered(indexHandle, topRiskDecile) {
+    const violations = [];
+    const untested = indexHandle.getUntestedTopDecile(topRiskDecile);
+    // Determine source format from existing coverage entries
+    const sourceRow = indexHandle
+        .query("SELECT source, imported_at FROM coverage_data WHERE basis = 'measured' LIMIT 1")[0];
+    const sourceFormat = sourceRow?.source ?? 'unknown';
+    const importedAt = sourceRow?.imported_at ?? null;
+    // Stale-import detection: measured coverage predates last full index sync
+    let staleWarning = null;
+    if (importedAt) {
+        const lastSync = indexHandle.getMeta?.('last_full_sync_timestamp') ?? null;
+        if (lastSync && importedAt < lastSync) {
+            staleWarning =
+                ` — WARNING: this coverage data may be stale (imported ${importedAt}, ` +
+                    `last index sync was ${lastSync}). ` +
+                    `Re-import with 'code-audit coverage --import <path>' for accurate results.`;
         }
-        return false;
     }
+    for (const fn of untested) {
+        violations.push({
+            file: fn.filePath,
+            line: fn.lineNumber ?? 1,
+            column: 0,
+            severity: 'suggestion',
+            message: `Exported function '${fn.functionName}' (risk ${fn.riskScore.toFixed(3)}) has no measured test coverage. ` +
+                `Top imported functions should have test coverage. Import coverage data with 'code-audit coverage --import <path>'.` +
+                (staleWarning ?? ''),
+            rule: 'cross-domain/uncovered-risk',
+            analyzer: ANALYZER_NAME,
+            functionName: fn.functionName,
+            basis: fn.basis,
+            sourceFormat,
+            ...(staleWarning ? { staleImport: true } : {}),
+        });
+    }
+    return violations;
+}
+/**
+ * Static-reach fallback: flag exported high-risk functions that are not
+ * reachable from known test files via BFS through the call graph.
+ */
+function detectStaticReachUncovered(indexHandle, coverage, filePath) {
+    const topRiskDecile = coverage.topRiskDecile ?? 0.1;
+    const highRiskFns = queryHighRiskFunctions(indexHandle, topRiskDecile, filePath);
+    if (highRiskFns.length === 0)
+        return [];
+    const reachableIds = computeTestReachableIds(indexHandle, coverage);
+    return flagUnreachedHighRisk(highRiskFns, reachableIds);
+}
+/** Rank exported functions by hotspot score and take the top decile. */
+function queryHighRiskFunctions(indexHandle, topRiskDecile, filePath) {
+    const fpWhere = filePath ? 'AND f.file_path LIKE ?' : '';
+    const params = [topRiskDecile];
+    if (filePath)
+        params.push(filePath.param);
+    return indexHandle.query(`WITH ranked AS (
+        SELECT
+          f.name,
+          f.file_path,
+          f.line_number,
+          f.id,
+          COALESCE(hs.score, 0.0) as risk_score,
+          PERCENT_RANK() OVER (ORDER BY COALESCE(hs.score, 0.0) DESC) as pct
+        FROM functions f
+        LEFT JOIN hotspot_scores hs ON hs.target = (f.file_path || ':' || f.name)
+          AND hs.type = 'function'
+        WHERE f.is_exported = 1
+          ${fpWhere}
+      )
+      SELECT id, name, file_path, line_number, risk_score
+      FROM ranked
+      WHERE pct <= ?
+      ORDER BY risk_score DESC`, params);
+}
+/** Flag high-risk functions not in the reachable set. */
+function flagUnreachedHighRisk(highRiskFns, reachableIds) {
+    const violations = [];
+    for (const fn of highRiskFns) {
+        if (reachableIds.has(fn.id))
+            continue;
+        violations.push({
+            file: fn.file_path,
+            line: fn.line_number,
+            column: 0,
+            severity: 'suggestion',
+            message: `Exported function '${fn.name}' (risk ${fn.risk_score.toFixed(3)}) is not reachable from known test files. ` +
+                `Add test coverage or import measured coverage with 'code-audit coverage --import <path>'.`,
+            rule: 'cross-domain/uncovered-risk',
+            analyzer: ANALYZER_NAME,
+            functionName: fn.name,
+            basis: 'static-reach',
+        });
+    }
+    return violations;
+}
+/**
+ * Compute the set of function IDs reachable from test-file functions via
+ * BFS through the call graph (reverse direction: test → code under test).
+ */
+function computeTestReachableIds(indexHandle, coverage) {
+    const testFuncIds = collectTestFuncIds(indexHandle, coverage);
+    if (testFuncIds.size === 0)
+        return new Set();
+    const maxDepth = coverage.staticReachDepth ?? 2;
+    return collectReachableIds(indexHandle, testFuncIds, maxDepth);
+}
+/** Find test-file function IDs to use as BFS starting points. */
+function collectTestFuncIds(indexHandle, coverage) {
+    const testGlobs = coverage.testGlobs ?? ['**/*.test.*', '**/*.spec.*', '**/__tests__/**'];
+    const testGlobPatterns = testGlobs.map((g) => g.replace(/\*\*/g, '%').replace(/\*/g, '%'));
+    if (testGlobPatterns.length === 0)
+        return new Set();
+    const testFileClause = testGlobPatterns
+        .map(() => `file_path LIKE ?`)
+        .join(' OR ');
+    const testFileParams = [...testGlobPatterns];
+    const testFuncIds = new Set();
+    const testFunctions = indexHandle
+        .query(`SELECT id FROM functions WHERE ${testFileClause}`, testFileParams);
+    for (const tf of testFunctions)
+        testFuncIds.add(tf.id);
+    return testFuncIds;
 }
 //# sourceMappingURL=CrossDomainAnalyzer.js.map