code-auditor-mcp 3.4.12 → 3.4.13

package/dist/analyzers/universal/UniversalSchemaAnalyzer.js

@@ -8,173 +8,49 @@
  * R2.5: Legacy scan-all-strings path DELETED.
  * R7:   schema/unknown-table severity is "suggestion".
  */
-import fs from 'fs/promises';
-import path from 'path';
+import { readFileSync } from 'node:fs';
 import { UniversalAnalyzer } from '../../languages/UniversalAnalyzer.js';
-import picomatch from 'picomatch';
-import { buildProvenanceContext, isDBProvenanced, DB_CALL_METHODS, } from '../provenance.js';
-import { OrmAdapterRegistry } from '../orm/index.js';
+import { withRuleTiming } from '../ruleTiming.js';
+import { buildProvenanceContext, } from '../provenance.js';
 import { makeVisitorStatus } from '../../pipeline.js';
+// Spec 34 — schema analyzer split (Step 0 reconciliation): shared types,
+// SQL-context constants, and migration/DDL helpers now live in schema/
+// submodules. Imported here for the class + standalone JSON-schema functions,
+// then re-exported to preserve this file's public surface (pipelineAdapters.ts
+// and UniversalDataAccessAnalyzer.ts import from this module).
+import { parseMigrationOps, extractReExports, sqlFileHasDdl, extractMigrationOpsFromFile, } from './schema/migrations.js';
+import { DB_RECEIVER_NAMES, DB_CALL_METHOD_NAMES, DB_BINDING_NAMES, DB_WRAPPER_NAMES, SQL_TAG_NAMES, DEFAULT_SCHEMA_CONFIG, } from './schema/config.js';
+import { findTableReferences, checkMissingReferences, checkNamingConventions, checkQueryPatterns, checkSQLInjection, findClosestNodeAt, findEnclosingFunctionName, } from './schema/codeAnalysis.js';
+import { discoverTablesFromMigrations, discoverTablesFromWrangler, discoverTablesFromSchemaFiles, discoverTablesFromOrmSchemas, passesFileGate, } from './schema/discovery.js';
+export { parseMigrationOps, extractReExports, sqlFileHasDdl, extractMigrationOpsFromFile, DB_RECEIVER_NAMES, DB_CALL_METHOD_NAMES, DB_BINDING_NAMES, DB_WRAPPER_NAMES, SQL_TAG_NAMES, DEFAULT_SCHEMA_CONFIG, };
 /**
- * Single-source constants for SQL context detection.
- *
- * These are the ground-truth defaults. DEFAULT_SCHEMA_CONFIG references them,
- * and every inline fallback dereferences them directly — so ?? narrowing works
- * (TypeScript infers `string[]`, not `string[] | undefined` from the optional
- * SchemaAnalyzerConfig fields).
- *
- * Trimmed to D1/Workers DB patterns only (4 receivers, 6 methods).
- * Broader entries like 'connection'/'client'/'query'/'get'/'each' matched
- * non-DB code (WebSocket, Map, jQuery, vector stores), causing phantom
- * cross-domain lifecycle violations. See CHANGELOG 3.4.9 accuracy fix.
+ * Universal schema analyzer.
  */
-export const DB_RECEIVER_NAMES = ['db', 'database', 'sql', 'stmt'];
-export const DB_CALL_METHOD_NAMES = ['exec', 'prepare', 'batch', 'run', 'all', 'first'];
-export const DB_BINDING_NAMES = ['env.DB'];
-export const DB_WRAPPER_NAMES = ['d1Query', 'd1Exec'];
-export const SQL_TAG_NAMES = ['sql', 'db'];
-export const DEFAULT_SCHEMA_CONFIG = {
-    enableTableUsageTracking: true,
-    checkMissingReferences: true,
-    checkNamingConventions: true,
-    detectUnusedTables: false,
-    validateQueryPatterns: true,
-    maxQueriesPerFunction: 5,
-    requiredSchemas: [],
-    schemas: [],
-    validateJsonSchemas: true,
-    jsonSchemaVersion: 'draft-07',
-    allowedJsonTypes: ['string', 'number', 'integer', 'boolean', 'array', 'object', 'null'],
-    schemaFilePatterns: ['*.schema.json', '*-schema.json'],
-    dataFilePatterns: ['*.data.json', '*.example.json'],
-    strictMode: false,
-    allowAdditionalProperties: true,
-    // Spec-17 R2 defaults
-    sqlTagNames: [...SQL_TAG_NAMES],
-    dbReceiverNames: [...DB_RECEIVER_NAMES],
-    dbCallMethods: [...DB_CALL_METHOD_NAMES],
-    dbBindingNames: [...DB_BINDING_NAMES],
-    dbWrapperNames: [...DB_WRAPPER_NAMES],
-    fileGateGlobs: ['**/*.sql', '**/migrations/**'],
-    schemaFiles: [],
-};
 export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
     name = 'schema';
     description = 'Analyzes code against database schemas and validates JSON schemas';
     category = 'database';
-    // Track references across files
-    tableReferences = new Map();
     // Spec 25 B4 — Queue schema records for the pipeline to write after stage 2.
     // Was: direct CodeIndexDB.getInstance() call in recordTableUsage.
     _pendingSchemaRecords = { clearFiles: [], usages: [] };
-    projectRoot;
-    /**
-     * Strip SQL identifier delimiters: backticks or double-quotes.
-     */
-    stripIdentifier(name) {
-        if ((name.startsWith('`') && name.endsWith('`')) ||
-            (name.startsWith('"') && name.endsWith('"'))) {
-            return name.slice(1, -1);
-        }
-        return name;
-    }
-    /**
-     * Parse a migration SQL source and apply stateful CREATE/DROP/RENAME
-     * operations to the given table set in migration order.
-     */
-    processMigrationSource(source, tables) {
-        // Sequential state machine: apply CREATE/DROP/RENAME in statement order
-        // within each migration file. Fixes the rename-replay bug where CREATE
-        // after RENAME in the same file was silently deleted by the old three-pass
-        // approach (all CREATE then all DROP then all RENAME).
-        const ddlRe = /(CREATE)\s+(?:VIRTUAL\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)|(DROP)\s+TABLE\s+(?:IF\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)|(ALTER)\s+TABLE\s+(`[^`]+`|"[^"]+"|\w+)\s+RENAME\s+TO\s+(`[^`]+`|"[^"]+"|\w+)/gi;
-        let match;
-        while ((match = ddlRe.exec(source)) !== null) {
-            const op = match[1] || match[3] || match[5];
-            if (op === 'CREATE') {
-                tables.add(this.stripIdentifier(match[2]));
-            }
-            else if (op === 'DROP') {
-                tables.delete(this.stripIdentifier(match[4]));
-            }
-            else if (op === 'ALTER') {
-                tables.delete(this.stripIdentifier(match[6]));
-                tables.add(this.stripIdentifier(match[7]));
-            }
-        }
-    }
     /**
      * Standalone analyze() override for backward compatibility with direct analyzer
      * calls (e.g., tests and non-pipeline audit paths). All production analysis now
      * flows through the pipeline visitors, but this method is preserved so tests
      * that call analyzer.analyze([file], config) continue to work.
+     * @param config
+     * @param files
+     * @returns
      */
     async analyze(files, config) {
         const jsonFiles = files.filter(f => f.endsWith('.json'));
         const codeFiles = files.filter(f => !f.endsWith('.json'));
         // Auto-discover known tables when no schemas are configured.
-        const schemas = config.schemas;
-        const projectRoot = config.projectRoot || process.cwd();
-        this.projectRoot = projectRoot;
-        if (!schemas || schemas.length === 0) {
-            const fromWrangler = await this._discoverTablesFromWrangler(projectRoot);
-            const schemaFiles = config.schemaFiles;
-            const fromSchemaFiles = schemaFiles && schemaFiles.length > 0
-                ? await this._discoverTablesFromSchemaFiles(schemaFiles, projectRoot)
-                : new Set();
-            const fromMigrations = await this._discoverTablesFromMigrations(projectRoot, config);
-            const fromOrm = await this._discoverTablesFromOrmSchemas(codeFiles);
-            const discovered = new Set([
-                ...fromWrangler,
-                ...fromSchemaFiles,
-                ...fromMigrations,
-                ...fromOrm,
-            ]);
-            if (discovered.size > 0) {
-                config = {
-                    ...config,
-                    schemas: [{
-                            name: 'auto-discovered',
-                            tables: [...discovered].map(name => ({ name, columns: [] })),
-                        }],
-                };
-            }
-        }
-        const codeResult = codeFiles.length > 0 ? await super.analyze(codeFiles, config) : {
-            violations: [],
-            executionTime: 0,
-            status: makeVisitorStatus(0),
-            analyzerName: this.name,
-            errors: [],
-            filesProcessed: 0,
-        };
-        // Adapt JSON handling to the pipeline-style analyzeJsonSchemas(Map) signature.
-        let jsonResult = {
-            violations: [],
-            executionTime: 0,
-            status: makeVisitorStatus(0),
-            analyzerName: this.name,
-            errors: [],
-            filesProcessed: 0,
-        };
-        if (jsonFiles.length > 0) {
-            const jsonContents = new Map();
-            for (const file of jsonFiles) {
-                try {
-                    const raw = await fs.readFile(file, 'utf8');
-                    let parsed = null;
-                    try {
-                        parsed = JSON.parse(raw);
-                    }
-                    catch { /* not valid JSON */ }
-                    jsonContents.set(file, { parsed, raw });
-                }
-                catch {
-                    // Skip unreadable files
-                }
-            }
-            jsonResult = this.analyzeJsonSchemas(jsonContents, config);
-        }
+        config = await resolveSchemasViaAutoDiscovery(config, codeFiles);
+        const codeResult = codeFiles.length > 0
+            ? await super.analyze(codeFiles, config)
+            : emptySchemaResult(this.name);
+        const jsonResult = analyzeJsonFiles(jsonFiles, config, this.name);
         return {
             violations: [...codeResult.violations, ...jsonResult.violations],
             executionTime: (codeResult.executionTime || 0) + (jsonResult.executionTime || 0),
@@ -190,396 +66,32 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
     async analyzeAST(ast, adapter, config, sourceCode) {
         const violations = [];
         const finalConfig = { ...DEFAULT_SCHEMA_CONFIG, ...config };
-        // Spec 21: Build provenance context for this file (R1 — provenance-primary detection)
-        const detectionMode = config.detection?.mode ?? 'hybrid';
-        const provenanceContext = buildProvenanceContext(ast, adapter, sourceCode, {
-            mode: detectionMode,
-            dbReceiverNames: finalConfig.dbReceiverNames ?? DEFAULT_SCHEMA_CONFIG.dbReceiverNames,
-            dbBindingNames: finalConfig.dbBindingNames ?? DEFAULT_SCHEMA_CONFIG.dbBindingNames,
-            dbCallMethods: finalConfig.dbCallMethods ?? DEFAULT_SCHEMA_CONFIG.dbCallMethods,
-            dbWrapperNames: finalConfig.dbWrapperNames ?? DEFAULT_SCHEMA_CONFIG.dbWrapperNames,
-        });
+        const provenanceContext = buildSchemaProvenanceContext(ast, adapter, sourceCode, finalConfig);
         // R2.2 — File gate: only analyze files with DB context (Spec 21: provenance-based)
-        if (!this.passesFileGate(ast.filePath, sourceCode, finalConfig, provenanceContext)) {
+        if (!passesFileGate(ast.filePath, sourceCode, finalConfig, provenanceContext)) {
             return violations;
         }
-        // Get available schemas
         const schemas = finalConfig.schemas || [];
-        const allTables = new Set();
-        for (const schema of schemas) {
-            for (const table of schema.tables) {
-                allTables.add(table.name);
-            }
-        }
+        const allTables = collectAllTableNames(schemas);
         if (finalConfig.requiredSchemas && finalConfig.requiredSchemas.length > 0 && schemas.length === 0) {
-            violations.push(this.createViolation(ast.filePath, { line: 1, column: 1 }, 'No database schemas loaded for analysis', 'warning', 'missing-schemas', undefined, 'top-level:missing-schemas'));
+            violations.push(this.createViolation(ast.filePath, { line: 1, column: 1 }, 'No database schemas loaded for analysis', { severity: 'warning', rule: 'missing-schemas', symbol: 'top-level:missing-schemas' }));
             return violations;
         }
         // R2.1 — AST-based table reference extraction (replaces legacy regex scan-all-strings)
-        // Spec 21: Uses provenance context for DB-call pattern detection
-        const tableRefs = this.findTableReferences(ast, adapter, sourceCode, finalConfig, provenanceContext, allTables);
+        const tableRefs = findTableReferences(ast, adapter, sourceCode, { config: finalConfig, provenanceContext, allTables });
         // Spec 15 R1 — Record schema usage for cross-domain lifecycle analysis.
-        // Idempotent per-file: clear stale entries before inserting fresh references.
         if (finalConfig.enableTableUsageTracking) {
             this.recordTableUsage(ast, adapter, ast.filePath, tableRefs);
         }
-        // Check for missing table references — R2.4: Levenshtein suggestions
-        if (finalConfig.checkMissingReferences) {
-            // Spec 24 Item 4 Part B — 10:1 fail-open ratio.
-            const unknownRefs = tableRefs.filter(ref => !allTables.has(ref.table) && !this.isSystemTable(ref.table));
-            const knownCount = allTables.size;
-            const unknownCount = unknownRefs.length;
-            if (knownCount === 0 || unknownCount / Math.max(knownCount, 1) > 10) {
-                const displayRatio = knownCount === 0 ? '∞' : (unknownCount / Math.max(knownCount, 1)).toFixed(1);
-                // Silently skip — in direct test mode we don't emit console warnings
-            }
-            else {
-                for (const ref of unknownRefs) {
-                    const suggestions = this.getNearestTableSuggestions(ref.table, allTables, 2);
-                    const msg = suggestions.length > 0
-                        ? `Reference to unknown table '${ref.table}' (${ref.type}). Did you mean: ${suggestions.join(', ')}?`
-                        : `Reference to unknown table '${ref.table}' (${ref.type})`;
-                    violations.push(this.createViolation(ast.filePath, ref.location, msg, 'suggestion', 'unknown-table', undefined, ref.table));
-                }
-            }
-        }
-        // Check naming conventions
-        if (finalConfig.checkNamingConventions) {
-            violations.push(...this.checkNamingConventions(tableRefs, ast.filePath));
-        }
-        // Check query patterns
-        if (finalConfig.validateQueryPatterns) {
-            violations.push(...this.checkQueryPatterns(ast, adapter, sourceCode, finalConfig));
-        }
-        // Check for SQL injection patterns
-        violations.push(...this.checkSQLInjection(ast, adapter, sourceCode));
-        return violations;
-    }
-    // ---------------------------------------------------------------------------
-    // Auto-discovery helpers — used by the standalone analyze() override and
-    // the pre-pipeline discovery phase in auditRunner.
-    // ---------------------------------------------------------------------------
-    /**
-     * Walk project root recursively, returning files matching any of the given
-     * picomatch globs. Skips node_modules and dot-directories.
-     */
-    async _walkFiles(root, globs) {
-        const results = [];
-        async function walk(dir) {
-            let names;
-            try {
-                names = await fs.readdir(dir);
-            }
-            catch {
-                return; // Skip unreadable directories
-            }
-            for (const name of names) {
-                const fullPath = path.join(dir, name);
-                // Skip node_modules and dot-directories
-                if (name === 'node_modules' || name.startsWith('.'))
-                    continue;
-                let stat;
-                try {
-                    stat = await fs.stat(fullPath);
-                }
-                catch {
-                    continue; // Skip unstatable
-                }
-                if (stat.isDirectory()) {
-                    await walk(fullPath);
-                }
-                else if (stat.isFile()) {
-                    const relative = path.relative(root, fullPath);
-                    const matched = globs.some(g => picomatch.isMatch(relative, g));
-                    if (matched) {
-                        results.push(fullPath);
-                    }
-                }
-            }
-        }
-        await walk(root);
-        return results;
-    }
-    async _discoverTablesFromMigrations(projectRoot, config) {
-        const tables = new Set();
-        const gateGlobs = config.fileGateGlobs ?? ['**/*.sql', '**/migrations/**'];
-        const walkedFiles = await this._walkFiles(projectRoot, gateGlobs);
-        walkedFiles.sort();
-        for (const file of walkedFiles) {
-            try {
-                const source = await fs.readFile(file, 'utf8');
-                this.processMigrationSource(source, tables);
-            }
-            catch {
-                // Skip unreadable files
-            }
-        }
-        return tables;
-    }
-    async _discoverTablesFromWrangler(projectRoot) {
-        const tables = new Set();
-        const wranglerPath = path.join(projectRoot, 'wrangler.toml');
-        let wranglerContent;
-        try {
-            wranglerContent = await fs.readFile(wranglerPath, 'utf8');
-        }
-        catch {
-            return tables; // No wrangler.toml
-        }
-        const migrationDirs = [];
-        let inD1Block = false;
-        for (const line of wranglerContent.split('\n')) {
-            const trimmed = line.trim();
-            if (/^\[\[d1_databases\]\]/i.test(trimmed)) {
-                inD1Block = true;
-                continue;
-            }
-            if (inD1Block && trimmed.startsWith('[')) {
-                inD1Block = false;
-                continue;
-            }
-            if (inD1Block) {
-                const m = trimmed.match(/^migrations_dir\s*=\s*['"](.+?)['"]/);
-                if (m) {
-                    migrationDirs.push(m[1]);
-                }
-            }
-        }
-        for (const migDir of migrationDirs) {
-            const absDir = path.resolve(projectRoot, migDir);
-            let entries;
-            try {
-                const dirents = await fs.readdir(absDir, { withFileTypes: true });
-                entries = dirents
-                    .filter(e => e.isFile() && e.name.endsWith('.sql'))
-                    .map(e => e.name)
-                    .sort();
-            }
-            catch {
-                continue;
-            }
-            for (const entry of entries) {
-                const filePath = path.join(absDir, entry);
-                try {
-                    const source = await fs.readFile(filePath, 'utf8');
-                    this.processMigrationSource(source, tables);
-                }
-                catch {
-                    // Skip unreadable files
-                }
-            }
-        }
-        return tables;
-    }
-    async _discoverTablesFromSchemaFiles(schemaFiles, projectRoot) {
-        const tables = new Set();
-        for (const file of schemaFiles) {
-            const absPath = path.resolve(projectRoot, file);
-            try {
-                const source = await fs.readFile(absPath, 'utf8');
-                const createRe = /CREATE\s+(?:VIRTUAL\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)/gi;
-                let match;
-                while ((match = createRe.exec(source)) !== null) {
-                    tables.add(this.stripIdentifier(match[1]));
-                }
-            }
-            catch {
-                // Skip unreadable files
-            }
-        }
-        return tables;
-    }
-    async _discoverTablesFromOrmSchemas(files) {
-        const tables = new Set();
-        for (const file of files) {
-            const lowerFile = file.toLowerCase();
-            if (/\.(ts|tsx|js|jsx)$/i.test(file)) {
-                try {
-                    const source = await fs.readFile(file, 'utf8');
-                    if (/from\s+['"]drizzle-orm/.test(source)) {
-                        const builderRegex = /(?:pgTable|mysqlTable|sqliteTable)\s*\(\s*['"]([^'"]+)['"]/g;
-                        let match;
-                        while ((match = builderRegex.exec(source)) !== null) {
-                            tables.add(match[1]);
-                        }
-                    }
-                }
-                catch {
-                    // Skip unreadable files
-                }
-            }
-            if (file.endsWith('schema.prisma') || file.endsWith('\\schema.prisma')) {
-                try {
-                    const source = await fs.readFile(file, 'utf8');
-                    const modelRegex = /model\s+(\w+)\s*\{/g;
-                    let match;
-                    while ((match = modelRegex.exec(source)) !== null) {
-                        tables.add(match[1]);
-                    }
-                }
-                catch {
-                    // Skip unreadable files
-                }
-            }
-        }
-        return tables;
-    }
-    // ---------------------------------------------------------------------------
-    // R2.2 — File gate
-    // ---------------------------------------------------------------------------
-    /**
-     * Pre-filter: only analyze files that show DB usage.
-     * Checks: .sql/migration glob, D1/SQL imports, env-binding patterns, DB calls.
-     */
-    passesFileGate(filePath, sourceCode, config, provenanceContext) {
-        // Always pass .sql files and migration directories
-        const gateGlobs = config.fileGateGlobs ?? ['**/*.sql', '**/migrations/**'];
-        for (const glob of gateGlobs) {
-            if (picomatch.isMatch(filePath, glob)) {
-                return true;
-            }
-        }
-        // Spec 21: Provenance-first DB detection — if any identifier is DB-provenanced,
-        // this file passes the gate. This replaces the regex patterns for import/environment/
-        // receiver.method checks in hybrid and provenance modes.
-        if (provenanceContext && provenanceContext.mode !== 'names') {
-            if (provenanceContext.dbProvenanced.size > 0) {
-                return true;
-            }
-        }
-        // Legacy name-based detection — used in 'names' mode or when no provenance context
-        if (!provenanceContext || provenanceContext.mode === 'names') {
-            // Check for D1 or SQL API imports
-            const importPatterns = [
-                /import\s+.*\b(D1Database|D1PreparedStatement|D1Result)\b/,
-                /import\s+.*from\s+['"].*d1['"]/,
-                /import\s+.*from\s+['"].*pg['"]/,
-                /import\s+.*from\s+['"].*mysql['"]/,
-                /import\s+.*from\s+['"].*sqlite['"]/,
-                /import\s+.*from\s+['"].*knex['"]/,
-                /import\s+.*from\s+['"].*drizzle['"]/,
-                /import\s+.*from\s+['"].*prisma['"]/,
-            ];
-            for (const pat of importPatterns) {
-                if (pat.test(sourceCode))
-                    return true;
-            }
-            // Check for env-binding patterns (e.g., env.DB in Cloudflare Workers)
-            const bindingNames = config.dbBindingNames ?? [...DB_BINDING_NAMES];
-            for (const binding of bindingNames) {
-                if (sourceCode.includes(binding))
-                    return true;
-            }
-            // Check for DB call patterns (receiver.method)
-            const receivers = config.dbReceiverNames ?? [...DB_RECEIVER_NAMES];
-            const methods = config.dbCallMethods ?? [...DB_CALL_METHOD_NAMES];
-            for (const receiver of receivers) {
-                for (const method of methods) {
-                    const pattern = new RegExp(`\\b${escapeRegex(receiver)}\\.${escapeRegex(method)}\\s*\\(`);
-                    if (pattern.test(sourceCode))
-                        return true;
-                }
-            }
-        }
-        // Check for SQL tagged template literals (syntax feature, not naming convention)
-        const sqlTags = config.sqlTagNames ?? [...SQL_TAG_NAMES];
-        for (const tag of sqlTags) {
-            const pattern = new RegExp(`\\b${escapeRegex(tag)}\`\\s*SELECT|\\b${escapeRegex(tag)}\`\\s*INSERT|\\b${escapeRegex(tag)}\`\\s*UPDATE|\\b${escapeRegex(tag)}\`\\s*DELETE|\\b${escapeRegex(tag)}\`\\s*CREATE`, 'i');
-            if (pattern.test(sourceCode))
-                return true;
-        }
-        return false;
-    }
-    // ---------------------------------------------------------------------------
-    // R2.1 — AST-based table reference extraction (replaces legacy regex)
-    // ---------------------------------------------------------------------------
-    /**
-     * Extract table references exclusively from SQL contexts in the AST.
-     * R2.1: Only tagged template SQL and DB-call patterns produce candidates.
-     * R2.3: Template expressions (${var}) resolved to wildcards.
-     */
-    findTableReferences(ast, adapter, sourceCode, config, provenanceContext, allTables) {
-        const references = [];
-        const sqlTags = config.sqlTagNames ?? [...SQL_TAG_NAMES];
-        // (1) Tagged template SQL — e.g. sql`SELECT * FROM heroes`
-        // This is a syntax feature, not a naming convention — keep the sqlTagNames gate.
-        const taggedTemplates = adapter.findNodes(ast, {
-            custom: (node) => {
-                if (node.type !== 'call_expression')
-                    return false;
-                // Callee must be an identifier matching sqlTagNames
-                const callee = this.getCallee(node, adapter, sourceCode);
-                if (!callee || !sqlTags.includes(callee))
-                    return false;
-                // Must have a template string argument
-                return this.hasTemplateArgument(node, adapter);
-            },
+        appendSchemaViolations(violations, {
+            ast,
+            adapter,
+            sourceCode,
+            config: finalConfig,
+            tableRefs,
+            allTables,
         });
-        for (const callNode of taggedTemplates) {
-            const templateText = this.getTemplateText(callNode, adapter, sourceCode);
-            if (!templateText)
-                continue;
-            const location = this.getCallLocation(callNode);
-            const tableRefs = this.parseSqlTables(templateText, location, sourceCode, allTables);
-            references.push(...tableRefs);
-        }
-        // (2) DB-call patterns — e.g. db.exec("SELECT * FROM heroes")
-        // Spec 21: Replace name-based isDbMemberCall with provenance-based isDBProvenanced.
-        const dbCalls = adapter.findNodes(ast, {
-            custom: (node) => {
-                if (node.type !== 'call_expression')
-                    return false;
-                // Spec 21: Use provenance when available, fall back to name-based check
-                if (provenanceContext && provenanceContext.mode !== 'names') {
-                    return isDBProvenanced(node, adapter, sourceCode, provenanceContext, DB_CALL_METHODS);
-                }
-                // Legacy name-based check for names mode / no context
-                const callee = this.getCallee(node, adapter, sourceCode);
-                if (!callee)
-                    return false;
-                const dbMethods = config.dbCallMethods ?? [...DB_CALL_METHOD_NAMES];
-                const dbReceivers = config.dbReceiverNames ?? [...DB_RECEIVER_NAMES];
-                return this.isDbMemberCall(node, callee, dbMethods, dbReceivers, adapter, sourceCode);
-            },
-        });
-        for (const callNode of dbCalls) {
-            const firstArg = this.getFirstStringArgument(callNode, adapter, sourceCode);
-            if (!firstArg)
-                continue;
-            const location = this.getCallLocation(callNode);
-            const tableRefs = this.parseSqlTables(firstArg, location, sourceCode, allTables);
-            references.push(...tableRefs);
-        }
-        // (3) .sql files and migration directories — scan the entire source
-        if (ast.filePath.endsWith('.sql') ||
-            ast.filePath.includes('/migrations/') ||
-            ast.filePath.includes('\\migrations\\')) {
-            const fileRefs = this.parseSqlTables(sourceCode, { line: 1, column: 1 }, sourceCode, allTables);
-            references.push(...fileRefs);
-        }
-        // (4) Spec 15 R2 — ORM-aware extraction (Drizzle + Prisma)
-        // Run ORM adapter extraction for files that match a registered adapter.
-        // This complements raw-SQL extraction by picking up ORM-specific patterns
-        // like db.select().from(users) and prisma.user.findMany().
-        const ormRegistry = OrmAdapterRegistry.getInstance();
-        const ormAdapter = ormRegistry.getAdapterForFile(ast.filePath);
-        if (ormAdapter) {
-            try {
-                const ormRefs = ormAdapter.extractTableReferences(ast, adapter, sourceCode);
-                for (const ormRef of ormRefs) {
-                    references.push({
-                        table: ormRef.table,
-                        type: ormRef.type,
-                        location: ormRef.location,
-                        context: ormRef.context,
-                    });
-                }
-            }
-            catch {
-                // ORM extraction is best-effort — failures don't block raw-SQL extraction.
-            }
-        }
-        return references;
+        return violations;
     }
     /**
      * Spec 15 R1 — Record extracted table references to schema_usage for
@@ -589,15 +101,21 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
      * Idempotent per-file: stale entries are cleared before fresh references
      * are inserted. For .sql/migration files, uses "schema-file" as the
      * function name since there's no AST function context.
+     * @returns
+     * @param adapter
+     * @param ast
+     * @param filePath
+     * @param references
+     * @returns
      */
     recordTableUsage(ast, adapter, filePath, references) {
         try {
             this._pendingSchemaRecords.clearFiles.push(filePath);
             for (const ref of references) {
                 // Find enclosing function from the AST position
-                const node = this.findClosestNodeAt(ast.root, ref.location, adapter);
+                const node = findClosestNodeAt(ast.root, ref.location, adapter);
                 const functionName = node
-                    ? this.findEnclosingFunctionName(node, adapter)
+                    ? findEnclosingFunctionName(node, adapter)
                     : ast.filePath.endsWith('.sql') || ast.filePath.includes('/migrations/')
                         ? 'schema-file'
                         : 'top-level';
@@ -616,1015 +134,115 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             // Schema recording is best-effort — failures don't block analysis.
         }
     }
-    /** Spec 25 B4 — Drain pending schema records for the pipeline to write. */
+    /**
+     * Spec 25 B4 — Drain pending schema records for the pipeline to write.
+     * @returns
+     */
     getPendingSchemaRecords() {
         const records = this._pendingSchemaRecords;
         this._pendingSchemaRecords = { clearFiles: [], usages: [] };
         return records;
     }
-    /**
-     * Parse SQL table names from a SQL text string.
-     * R2.3: Template expressions (${...}) resolve portions to wildcards.
-     */
-    parseSqlTables(sqlText, baseLocation, sourceCode, allTables) {
-        let references = [];
-        // R2.3: Strip template expressions — `${prefix}_builds` → `_builds`
-        // (the prefix is replaced with empty, the suffix remains for matching)
-        const cleaned = this.resolveTemplateExpressions(sqlText);
-        // SQL patterns anchored to SQL keywords (not arbitrary substrings).
-        // Uses Unicode-aware \p{L} so non-Latin table names (日, 注文, пользователи)
-        // are correctly matched — \w is ASCII-only. Spec 21 R5.
-        const sqlPatterns = [
-            // Note: no trailing \b — greedy [\p{L}\p{N}_]* consumes the full identifier and
-            // \b after a closing quote (non-word char) fails, blocking quoted-table extraction.
-            { regex: /\bFROM\s+([`"']?)([\p{L}_][\p{L}\p{N}_]*)\1/giu, type: 'select' },
-            { regex: /\bJOIN\s+([`"']?)([\p{L}_][\p{L}\p{N}_]*)\1/giu, type: 'select' },
-            { regex: /\bINSERT\s+INTO\s+([`"']?)([\p{L}_][\p{L}\p{N}_]*)\1/giu, type: 'insert' },
-            { regex: /\bUPDATE\s+([`"']?)([\p{L}_][\p{L}\p{N}_]*)\1/giu, type: 'update' },
-            { regex: /\bDELETE\s+FROM\s+([`"']?)([\p{L}_][\p{L}\p{N}_]*)\1/giu, type: 'delete' },
-            { regex: /\bCREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([`"']?)([\p{L}_][\p{L}\p{N}_]*)\1/giu, type: 'create' },
-        ];
-        for (const { regex, type } of sqlPatterns) {
-            let match;
-            // Create fresh regex since we might consume with exec
-            const re = new RegExp(regex.source, regex.flags);
-            while ((match = re.exec(cleaned)) !== null) {
-                const table = match[2]; // The table name (capture group 2)
-                if (!table || this.isSystemTable(table))
-                    continue;
-                // v3.4.8: Skip very short identifiers (likely CTE names like 'x', 't',
-                // aliases like 'o', 'c') unless they are known table names.
-                // Single-char identifiers matched by FROM/JOIN regex capture short
-                // CTE names that extractAliasIdentifiers() may miss (WITH x AS (...));
-                // subquery bare aliases (FROM (SELECT ...) t) likewise. The guard
-                // catches false positives from both gaps.
-                if (!this.isSqlKeyword(table) && table.length < 3 && !allTables?.has(table.toLowerCase()))
-                    continue;
-                // Skip common false positives: common variable names, keywords
-                if (this.isSqlKeyword(table))
-                    continue;
-                // Calculate position in original source
-                const offset = sqlText.indexOf(match[0]);
-                const location = offset >= 0
-                    ? this.offsetToLocation(sourceCode, sourceCode.indexOf(cleaned) + offset, baseLocation)
-                    : baseLocation;
-                references.push({
-                    table,
-                    type,
-                    location,
-                    context: match[0].trim(),
-                });
-            }
-        }
-        // Template sentinel filter: resolveTemplateExpressions() replaces
-        // ${...} with __TMPL__. Strip these before alias extraction and
-        // before returning — __TMPL__ is never a real table name.
-        references = references.filter(ref => !ref.table.startsWith('__TMPL__'));
-        // Spec 22 R4.3: Filter out alias identifiers.
-        // "FROM x AS t" defines t as an alias; later references like "JOIN t.posts"
-        // would capture t via the JOIN regex. Scan for explicit AS aliases.
-        const aliasIds = this.extractAliasIdentifiers(cleaned);
-        if (aliasIds.size > 0) {
-            return references.filter(ref => !aliasIds.has(ref.table.toLowerCase()));
-        }
-        return references;
-    }
-    /**
-     * Spec 22 R4.3: Extract alias identifiers from SQL text.
-     *
-     * Detects both explicit (`FROM x AS t`) and bare (`FROM x t`) aliases
-     * so they can be filtered from table-references in parseSqlTables().
-     * Without this, "JOIN t.posts" captures t via the JOIN regex when t is
-     * an alias for the real table x.
-     */
-    extractAliasIdentifiers(sqlText) {
-        const aliases = new Set();
-        // CTE: WITH <name> AS ( — the CTE name is an alias, not a real table.
-        // Without this, "WITH fresh AS (SELECT ...)" causes 'fresh' to be
-        // captured by FROM/JOIN/subquery patterns and flagged as unknown-table.
-        const cteRe = /\bWITH\s+([\p{L}_][\p{L}\p{N}_]*)\s+AS\s*\(/giu;
-        let m;
-        while ((m = cteRe.exec(sqlText)) !== null) {
-            aliases.add(m[1].toLowerCase());
-        }
-        // Explicit: FROM/JOIN <table> AS <alias>
-        const explicitRe = /\b(?:FROM|JOIN)\s+[\p{L}_][\p{L}\p{N}_]*\s+AS\s+([\p{L}_][\p{L}\p{N}_]*)\b/giu;
-        while ((m = explicitRe.exec(sqlText)) !== null) {
-            aliases.add(m[1].toLowerCase());
-        }
-        // Subquery bare alias: FROM (SELECT ...) <alias>
-        // The '(' stops the bare FROM/JOIN regex below because \w+ can't match it.
-        // Pattern: FROM/JOIN \s* \( ... \) \s* <alias>
-        const subqueryRe = /\b(?:FROM|JOIN)\s*\([^)]*\)\s+([\p{L}_][\p{L}\p{N}_]*)\b/giu;
-        while ((m = subqueryRe.exec(sqlText)) !== null) {
-            const alias = m[1];
-            if (!this.isSqlKeyword(alias)) {
-                aliases.add(alias.toLowerCase());
-            }
-        }
-        // Bare: FROM/JOIN <table> <alias> (alias is a bare identifier, not a keyword)
-        // Pattern: keyword + table + word — the third word is the alias if it's
-        // not a SQL keyword and not followed by '.' (table.column reference).
-        const bareRe = /\b(?:FROM|JOIN)\s+([\p{L}_][\p{L}\p{N}_]*)\s+([\p{L}_][\p{L}\p{N}_]*)\b/giu;
-        while ((m = bareRe.exec(sqlText)) !== null) {
-            const alias = m[2];
-            // Don't add if it looks like a keyword or is followed by '.' (table ref)
-            if (!this.isSqlKeyword(alias)) {
-                const afterMatch = sqlText.substring(m.index + m[0].length);
-                if (!/^\s*\./.test(afterMatch)) {
-                    aliases.add(alias.toLowerCase());
-                }
-            }
-        }
-        return aliases;
-    }
-    /**
-     * R2.3: Resolve template expressions in SQL text.
-     *
-     * Uses the sentinel `__TMPL__` instead of an empty string. An empty
-     * replacement produces whitespace artifacts (e.g. `FROM   t WHERE`
-     * when `${tableName}` is stripped), which causes the bare-alias regex
-     * in extractAliasIdentifiers() to misalign: `t` lands in the table-name
-     * capture group instead of the alias group, and is never denylisted.
-     *
-     * `__TMPL__` keeps the token boundaries intact so alias extraction
-     * correctly identifies `t` as the alias. `__TMPL__` table references
-     * are filtered in parseSqlTables().
-     */
-    resolveTemplateExpressions(text) {
-        return text.replace(/\$\{[^}]+\}/g, '__TMPL__');
-    }
-    // ---------------------------------------------------------------------------
-    // R2.4 — Levenshtein suggestions
-    // ---------------------------------------------------------------------------
-    /**
-     * Return known table names within edit distance ≤ maxDist.
-     */
-    getNearestTableSuggestions(name, knownTables, maxDist) {
-        const results = [];
-        for (const known of knownTables) {
-            const dist = this.levenshteinDistance(name.toLowerCase(), known.toLowerCase());
-            if (dist <= maxDist) {
-                results.push({ table: known, distance: dist });
-            }
-        }
-        // Sort by distance ascending
-        results.sort((a, b) => a.distance - b.distance);
-        return results.slice(0, 3).map(r => `'${r.table}'`);
-    }
-    levenshteinDistance(a, b) {
-        const m = a.length;
-        const n = b.length;
-        // Optimize: early exit if length difference exceeds threshold
-        if (Math.abs(m - n) > 3)
-            return Infinity;
-        const dp = Array.from({ length: m + 1 }, () => Array(n + 1).fill(0));
-        for (let i = 0; i <= m; i++)
-            dp[i][0] = i;
-        for (let j = 0; j <= n; j++)
-            dp[0][j] = j;
-        for (let i = 1; i <= m; i++) {
-            for (let j = 1; j <= n; j++) {
-                if (a[i - 1] === b[j - 1]) {
-                    dp[i][j] = dp[i - 1][j - 1];
-                }
-                else {
-                    dp[i][j] = 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
-                }
-            }
-        }
-        return dp[m][n];
-    }
-    // ---------------------------------------------------------------------------
-    // Naming conventions
-    // ---------------------------------------------------------------------------
-    checkNamingConventions(references, filePath) {
-        const violations = [];
-        for (const ref of references) {
-            if (/[A-Z]/.test(ref.table) && !ref.table.endsWith('Table')) {
-                violations.push(this.createViolation(filePath, ref.location, `Table name '${ref.table}' should use snake_case convention`, 'suggestion', 'naming-convention', undefined, ref.table));
-            }
-            const reserved = ['user', 'order', 'group', 'table', 'column', 'index'];
-            if (reserved.includes(ref.table.toLowerCase())) {
-                violations.push(this.createViolation(filePath, ref.location, `Table name '${ref.table}' is a reserved word. Consider using a different name.`, 'warning', 'reserved-word', undefined, ref.table));
-            }
-        }
-        return violations;
-    }
-    // ---------------------------------------------------------------------------
-    // Query patterns
-    // ---------------------------------------------------------------------------
-    checkQueryPatterns(ast, adapter, sourceCode, config) {
-        const violations = [];
-        const functions = adapter.extractFunctions(ast);
-        for (const func of functions) {
-            const funcNode = this.findNodeByLocation(ast.root, func.location.start);
-            if (!funcNode)
-                continue;
-            const funcText = adapter.getNodeText(funcNode, sourceCode);
-            const queryCount = this.countQueries(funcText);
-            if (queryCount > (config.maxQueriesPerFunction || 5)) {
-                violations.push(this.createViolation(ast.filePath, func.location.start, `Function '${func.name}' has ${queryCount} queries, exceeding the maximum of ${config.maxQueriesPerFunction}`, 'warning', 'too-many-queries', undefined, func.name));
-            }
-        }
-        // N+1 query detection is handled by the data-access analyzer (loop-query rule).
-        // The two were consolidated in Spec-19 Corrective Batch Item 3 — see CHANGELOG.
-        return violations;
-    }
-    // ---------------------------------------------------------------------------
-    // SQL injection — R7: severity changed from critical to warning
-    // ---------------------------------------------------------------------------
-    // ---------------------------------------------------------------------------
-    // SQL injection — per-call-site with enclosing-function + ordinal symbols
-    // ---------------------------------------------------------------------------
-    checkSQLInjection(ast, adapter, sourceCode) {
-        const violations = [];
-        const symbolOrdinals = new Map();
-        // Use regex with global flag to find individual call sites
-        const dangerousPatterns = [
-            /query\s*\(\s*`[^`]*\$\{[^}]+\}[^`]*`/g,
-            /query\s*\(\s*['"][^'"]*['"]?\s*\+/g,
-            /execute\s*\(\s*['"][^'"]*['"]?\s*\+/g,
-        ];
-        for (const pattern of dangerousPatterns) {
-            // Clone regex to reset state (global regexes track lastIndex)
-            const re = new RegExp(pattern.source, pattern.flags);
-            let match;
-            while ((match = re.exec(sourceCode)) !== null) {
-                const location = this.offsetToLocation(sourceCode, match.index, { line: 1, column: 1 });
-                // Find enclosing function from the AST at this position
-                const node = this.findClosestNodeAt(ast.root, location, adapter);
-                const enclosingFn = node ? this.findEnclosingFunctionName(node, adapter) : 'top-level';
-                const baseSymbol = `${enclosingFn}:sql-injection`;
-                const ordinal = (symbolOrdinals.get(baseSymbol) ?? 0) + 1;
-                symbolOrdinals.set(baseSymbol, ordinal);
-                const symbol = ordinal > 1 ? `${baseSymbol}:${ordinal}` : baseSymbol;
-                violations.push(this.createViolation(ast.filePath, location, 'Potential SQL injection vulnerability. Use parameterized queries.', 'suggestion', // Spec 11 R4 blanket demotion: all survivors → suggestion
-                'sql-injection', undefined, symbol));
-            }
-        }
-        return violations;
-    }
-    // ---------------------------------------------------------------------------
-    // AST helpers for R2.1
-    // ---------------------------------------------------------------------------
-    /**
-     * Extract the callee text from a call_expression node.
-     */
-    getCallee(node, adapter, sourceCode) {
-        // For db.exec() → callee is "db.exec"
-        if (!node.children)
-            return null;
-        for (const child of node.children) {
-            const type = adapter.getNodeType(child);
-            if (type === 'identifier' ||
-                type === 'member_expression' ||
-                type === 'call_expression') {
-                return adapter.getNodeText(child, sourceCode).trim();
-            }
-        }
-        return null;
-    }
-    /**
-     * Check if call_expression has a template string argument.
-     */
-    hasTemplateArgument(node, adapter) {
-        if (!node.children)
-            return false;
-        for (const child of node.children) {
-            const type = adapter.getNodeType(child);
-            if (type === 'template_string' || type === 'template_literal') {
-                return true;
-            }
-        }
-        return false;
+}
+// ── Spec 34 — analyze()/analyzeAST() extraction helpers ────────────────
+// Extracted from the two methods above to keep them under the 50-line
+// function-length gate. Pure module-level functions (no `this`), consistent
+// with the functional-analyzer pattern.
+/**
+ * Auto-discover known tables when no schemas are configured, returning the
+ * (possibly augmented) config. When schemas are already present, returns the
+ * config unchanged.
+ */
+async function resolveSchemasViaAutoDiscovery(config, codeFiles) {
+    const schemas = config.schemas;
+    if (schemas && schemas.length > 0) {
+        return config;
+    }
+    const projectRoot = config.projectRoot || process.cwd();
+    const fromWrangler = await discoverTablesFromWrangler(projectRoot);
+    const schemaFiles = config.schemaFiles;
+    const fromSchemaFiles = schemaFiles && schemaFiles.length > 0
+        ? await discoverTablesFromSchemaFiles(schemaFiles, projectRoot)
+        : new Set();
+    const fromMigrations = await discoverTablesFromMigrations(projectRoot, config);
+    const fromOrm = await discoverTablesFromOrmSchemas(codeFiles);
+    const discovered = new Set([
+        ...fromWrangler,
+        ...fromSchemaFiles,
+        ...fromMigrations,
+        ...fromOrm,
+    ]);
+    if (discovered.size === 0) {
+        return config;
+    }
+    return {
+        ...config,
+        schemas: [{
+                name: 'auto-discovered',
+                tables: [...discovered].map(name => ({ name, columns: [] })),
+            }],
+    };
+}
+function emptySchemaResult(analyzerName) {
+    return {
+        violations: [],
+        executionTime: 0,
+        status: makeVisitorStatus(0),
+        analyzerName,
+        errors: [],
+        filesProcessed: 0,
+    };
+}
+function analyzeJsonFiles(jsonFiles, config, analyzerName) {
+    if (jsonFiles.length === 0) {
+        return emptySchemaResult(analyzerName);
     }
-    /**
-     * Get the text of the first template string argument.
-     */
-    getTemplateText(node, adapter, sourceCode) {
-        if (!node.children)
-            return null;
-        for (const child of node.children) {
-            const type = adapter.getNodeType(child);
-            if (type === 'template_string' || type === 'template_literal') {
-                return adapter.getNodeText(child, sourceCode).trim();
-            }
+    const readJson = (file) => {
+        try {
+            const raw = readFileSync(file, 'utf8');
+            const parsed = JSON.parse(raw);
+            return parsed !== null && typeof parsed === 'object' ? parsed : null;
         }
-        return null;
-    }
-    /**
-     * Get the first string/template argument from a call expression.
-     */
-    getFirstStringArgument(node, adapter, sourceCode) {
-        if (!node.children)
+        catch {
             return null;
-        // Look for 'arguments' child first
-        for (const child of node.children) {
-            const type = adapter.getNodeType(child);
-            if (type === 'arguments' && child.children) {
-                for (const arg of child.children) {
-                    const argType = adapter.getNodeType(arg);
-                    if (argType === 'string' ||
-                        argType === 'template_string' ||
-                        argType === 'template_literal') {
-                        const text = adapter.getNodeText(arg, sourceCode).trim();
-                        // Strip surrounding quotes from string literals
-                        if ((text.startsWith("'") && text.endsWith("'")) ||
-                            (text.startsWith('"') && text.endsWith('"')) ||
-                            (text.startsWith('`') && text.endsWith('`'))) {
-                            return text.slice(1, -1);
-                        }
-                        return text;
-                    }
-                }
-            }
         }
-        return null;
-    }
-    /**
-     * Check if a callee is a DB member call like db.exec, database.query, etc.
-     */
-    isDbMemberCall(node, calleeText, methods, receivers, adapter, sourceCode) {
-        // calleeText might be like "db.exec"
-        const dotIdx = calleeText.indexOf('.');
-        if (dotIdx === -1)
-            return false;
-        const receiver = calleeText.substring(0, dotIdx);
-        const method = calleeText.substring(dotIdx + 1);
-        return receivers.includes(receiver) && methods.includes(method);
-    }
-    /**
-     * Get the line/column location of the call expression.
-     */
-    getCallLocation(node) {
-        return node.location.start;
-    }
-    /**
-     * Convert a character offset to a line/column location.
-     */
-    offsetToLocation(sourceCode, offset, base) {
-        if (offset < 0 || offset >= sourceCode.length)
-            return base;
-        const before = sourceCode.substring(0, offset);
-        const lineOffset = before.split('\n').length - 1;
-        const lastNewline = before.lastIndexOf('\n');
-        const column = lastNewline >= 0 ? offset - lastNewline : offset + 1;
-        // offset is absolute in sourceCode — lineOffset is 0-based, so +1 gives
-        // the correct 1-based line. base.line is the fallback guard only.
-        return { line: lineOffset + 1, column };
-    }
-    // ---------------------------------------------------------------------------
-    // General helpers
-    // ---------------------------------------------------------------------------
-    isSystemTable(table) {
-        const systemTables = [
-            'information_schema',
-            'pg_catalog',
-            'mysql',
-            'performance_schema',
-            'sys',
-            'sqlite_master',
-            'sqlite_sequence',
-        ];
-        return systemTables.some(st => table.toLowerCase() === st || table.toLowerCase().startsWith(st + '.'));
-    }
-    /**
-     * Common SQL keywords and identifiers that are not real table names.
-     */
-    isSqlKeyword(word) {
-        const keywords = new Set([
-            'select', 'from', 'where', 'join', 'inner', 'outer', 'left', 'right',
-            'full', 'cross', 'on', 'and', 'or', 'not', 'in', 'as', 'is', 'null',
-            'like', 'between', 'order', 'group', 'by', 'having', 'limit', 'offset',
-            'union', 'all', 'distinct', 'case', 'when', 'then', 'else', 'end',
-            'insert', 'into', 'values', 'update', 'set', 'delete', 'create',
-            'table', 'alter', 'drop', 'index', 'view', 'if', 'exists', 'primary',
-            'key', 'foreign', 'references', 'constraint', 'default', 'unique',
-            'check', 'asc', 'desc', 'count', 'sum', 'avg', 'min', 'max',
-            'integer', 'text', 'varchar', 'text', 'boolean', 'float', 'blob',
-            'real', 'timestamp', 'date', 'time', 'datetime', 'serial', 'bigint',
-            'the', 'a', 'an',
-        ]);
-        return keywords.has(word.toLowerCase());
-    }
-    getQueryType(context) {
-        const upper = context.toUpperCase();
-        if (upper.includes('SELECT'))
-            return 'select';
-        if (upper.includes('INSERT'))
-            return 'insert';
-        if (upper.includes('UPDATE'))
-            return 'update';
-        if (upper.includes('DELETE'))
-            return 'delete';
-        if (upper.includes('CREATE'))
-            return 'create';
-        return 'reference';
-    }
-    countQueries(text) {
-        const patterns = [
-            /\.query\s*\(/g,
-            /\.execute\s*\(/g,
-            /SELECT\s+/gi,
-            /INSERT\s+INTO/gi,
-            /UPDATE\s+/gi,
-            /DELETE\s+FROM/gi,
-        ];
-        let count = 0;
-        for (const pattern of patterns) {
-            const matches = text.match(pattern);
-            if (matches)
-                count += matches.length;
-        }
-        return count;
-    }
-    findNodeByLocation(root, location) {
-        const queue = [root];
-        while (queue.length > 0) {
-            const node = queue.shift();
-            if (node.location.start.line === location.line &&
-                node.location.start.column === location.column) {
-                return node;
-            }
-            if (node.children) {
-                queue.push(...node.children);
-            }
-        }
-        return null;
-    }
-    /**
-     * Find the nearest AST node at a source location — walks the tree looking
-     * for the deepest node that contains the given line/column.
-     */
-    findClosestNodeAt(root, location, adapter) {
-        let best = null;
-        let bestDepth = -1;
-        const walk = (node, depth) => {
-            const start = node.location.start;
-            const end = node.location.end;
-            // Check if node contains the location
-            if ((start.line < location.line ||
-                (start.line === location.line && start.column <= location.column)) &&
-                (end.line > location.line ||
-                    (end.line === location.line && end.column >= location.column))) {
-                if (depth > bestDepth) {
-                    best = node;
-                    bestDepth = depth;
-                }
-                if (node.children) {
-                    for (const child of node.children) {
-                        walk(child, depth + 1);
-                    }
-                }
-            }
-        };
-        walk(root, 0);
-        return best;
-    }
-    /**
-     * Walk up the AST from a node to find the enclosing function or method name.
-     * Matches the same scheme as UniversalDataAccessAnalyzer.findEnclosingFunctionName.
-     */
-    findEnclosingFunctionName(node, adapter) {
-        let current = node;
-        while (current) {
-            const type = adapter.getNodeType(current);
-            if (type === 'arrow_function' ||
-                type === 'function_declaration' ||
-                type === 'function_expression' ||
-                type === 'generator_function_declaration' ||
-                type === 'generator_function_expression' ||
-                type === 'method_definition') {
-                const name = this.getNodeName(current, adapter);
-                if (name)
-                    return name;
-            }
-            if (adapter.isMethod(current)) {
-                const name = this.getNodeName(current, adapter);
-                if (name)
-                    return name;
-            }
-            current = adapter.getParent(current);
-        }
-        return 'top-level';
-    }
-    /**
-     * Extract a human-readable name from an AST node.
-     * Matches the same scheme as UniversalDataAccessAnalyzer.getNodeName.
-     */
-    getNodeName(node, adapter) {
-        // Try explicit name/text on the converted ASTNode (some adapters set it)
-        if (node.name && typeof node.name === 'string') {
-            return node.name;
-        }
-        if (node.text && typeof node.text === 'string') {
-            return node.text;
-        }
-        // Fall back to the raw tree-sitter node's text content (leaf identifiers etc.)
-        const rawText = node.raw?.text;
-        if (typeof rawText === 'string' && rawText.length > 0) {
-            return rawText;
-        }
-        if (node.children) {
-            for (const child of node.children) {
-                const childType = adapter.getNodeType(child);
-                if (childType === 'identifier' || childType === 'property_identifier') {
-                    const name = this.getNodeName(child, adapter);
-                    if (name)
-                        return name;
-                }
-            }
-        }
-        return '';
-    }
-    // ---------------------------------------------------------------------------
-    // JSON Schema validation (unchanged from original)
-    // ---------------------------------------------------------------------------
-    /**
-     * Analyze JSON schemas and validate data files against them.
-     *
-     * Pipeline-refactored: accepts a Map of pre-loaded JSON contents instead of
-     * reading from the filesystem, so this can run inside a Stage 3 reducer.
-     *
-     * @param jsonContents Map from filePath → { parsed: pre-parsed object or null, raw: string }
-     * @param config Schema analyzer configuration
-     */
-    analyzeJsonSchemas(jsonContents, config) {
-        const violations = [];
-        const errors = [];
-        let filesProcessed = 0;
-        const startTime = Date.now();
-        const finalConfig = { ...DEFAULT_SCHEMA_CONFIG, ...config };
-        if (!finalConfig.validateJsonSchemas) {
-            return { violations, errors, status: makeVisitorStatus(filesProcessed), executionTime: 0, analyzerName: this.name };
-        }
-        const files = Array.from(jsonContents.keys());
-        const schemaFiles = this.identifySchemaFiles(files, finalConfig);
-        const dataFiles = this.identifyDataFiles(files, finalConfig);
-        const unknownJsonFiles = files.filter(f => !schemaFiles.includes(f) && !dataFiles.includes(f));
-        // Helper: parse from Map content (with fallback)
-        const getParsed = (filePath) => {
-            const entry = jsonContents.get(filePath);
-            if (!entry)
-                return null;
-            if (entry.parsed !== null)
-                return entry.parsed;
-            try {
-                return JSON.parse(entry.raw);
-            }
-            catch {
-                return null;
-            }
-        };
-        const schemas = new Map();
-        for (const file of schemaFiles) {
-            try {
-                const entry = jsonContents.get(file);
-                const content = entry?.raw;
-                if (!content) {
-                    violations.push({
-                        file,
-                        line: 1,
-                        column: 1,
-                        severity: 'warning',
-                        message: `Content not available for schema file`,
-                        rule: 'file-error',
-                        analyzer: 'schema'
-                    });
-                    filesProcessed++;
-                    continue;
-                }
-                const schema = entry.parsed ?? (() => { try {
-                    return JSON.parse(content);
-                }
-                catch {
-                    return null;
-                } })();
-                if (schema === null)
-                    throw new SyntaxError('JSON parse failed');
-                schemas.set(file, schema);
-                const fileViolations = this.validateJsonSchema(schema, file, finalConfig);
-                violations.push(...fileViolations);
-                filesProcessed++;
-            }
-            catch (error) {
-                if (error instanceof SyntaxError) {
-                    violations.push({
-                        file,
-                        line: 1,
-                        column: 1,
-                        severity: 'warning',
-                        message: `Invalid JSON: ${error.message}`,
-                        rule: 'invalid-json',
-                        analyzer: 'schema'
-                    });
-                }
-                else {
-                    errors.push({
-                        file,
-                        error: error instanceof Error ? error.message : String(error)
-                    });
-                }
-                filesProcessed++;
-            }
-        }
-        if (finalConfig.schemaDataPairs) {
-            for (const pair of finalConfig.schemaDataPairs) {
-                const schema = schemas.get(pair.schema) ?? getParsed(pair.schema);
-                if (schema) {
-                    const dataFiles = Array.isArray(pair.data) ? pair.data : [pair.data];
-                    for (const dataFile of dataFiles) {
-                        if (files.includes(dataFile)) {
-                            const parsed = getParsed(dataFile);
-                            if (parsed !== null) {
-                                const dataViolations = [];
-                                this.validateAgainstSchema(parsed, schema, dataFile, dataViolations, finalConfig);
-                                violations.push(...dataViolations);
-                            }
-                            else {
-                                violations.push({
-                                    file: dataFile,
-                                    line: 1,
-                                    column: 1,
-                                    severity: 'warning',
-                                    message: 'Invalid JSON in data file',
-                                    rule: 'invalid-json',
-                                    analyzer: 'schema'
-                                });
-                            }
-                            filesProcessed++;
-                        }
-                    }
-                }
-            }
-        }
-        else {
-            for (const dataFile of [...dataFiles, ...unknownJsonFiles]) {
-                const matchedSchema = this.findMatchingSchema(dataFile, schemas, finalConfig);
-                if (matchedSchema) {
-                    const parsed = getParsed(dataFile);
-                    if (parsed !== null) {
-                        const dataViolations = [];
-                        this.validateAgainstSchema(parsed, matchedSchema, dataFile, dataViolations, finalConfig);
-                        violations.push(...dataViolations);
-                    }
-                }
-                else if (unknownJsonFiles.includes(dataFile)) {
-                    const parsed = getParsed(dataFile);
-                    if (parsed === null) {
-                        violations.push({
-                            file: dataFile,
-                            line: 1,
-                            column: 1,
-                            severity: 'warning',
-                            message: `Invalid JSON: Parse error`,
-                            rule: 'invalid-json',
-                            analyzer: 'schema'
-                        });
-                    }
-                }
-                filesProcessed++;
-            }
-        }
-        return {
-            violations,
-            errors,
-            status: makeVisitorStatus(filesProcessed),
-            executionTime: Date.now() - startTime,
-            analyzerName: this.name,
-        };
-    }
-    validateJsonSchema(schema, filePath, config) {
-        const violations = [];
-        if (!schema.$schema && config.jsonSchemaVersion) {
-            violations.push({
-                file: filePath,
-                line: 1,
-                column: 1,
-                severity: 'suggestion',
-                message: 'JSON Schema missing $schema declaration',
-                rule: 'missing-schema-declaration',
-                analyzer: 'schema'
-            });
-        }
-        this.validateSchemaTypes(schema, filePath, config, violations);
-        if (schema.type === 'object' && schema.properties) {
-            if (schema.required && Array.isArray(schema.required)) {
-                for (const field of schema.required) {
-                    if (!schema.properties[field]) {
-                        violations.push({
-                            file: filePath,
-                            line: 1,
-                            column: 1,
-                            severity: 'warning',
-                            message: `Required field "${field}" not defined in properties`,
-                            rule: 'undefined-required-field',
-                            analyzer: 'schema'
-                        });
-                    }
-                }
-            }
-        }
-        return violations;
-    }
-    validateSchemaTypes(schema, filePath, config, violations, path = '') {
-        if (!schema || typeof schema !== 'object')
-            return;
-        if (schema.type && config.allowedJsonTypes) {
-            const types = Array.isArray(schema.type) ? schema.type : [schema.type];
-            for (const type of types) {
-                if (!config.allowedJsonTypes.includes(type)) {
-                    violations.push({
-                        file: filePath,
-                        line: 1,
-                        column: 1,
-                        severity: 'warning',
-                        message: `Invalid type "${type}" at ${path || 'root'}. Allowed types: ${config.allowedJsonTypes.join(', ')}`,
-                        rule: 'invalid-type',
-                        analyzer: 'schema'
-                    });
-                }
-            }
-        }
-        if (schema.type === 'integer' || schema.type === 'number') {
-            if (schema.minimum !== undefined && schema.maximum !== undefined) {
-                if (schema.minimum > schema.maximum) {
-                    violations.push({
-                        file: filePath,
-                        line: 1,
-                        column: 1,
-                        severity: 'warning',
-                        message: `Invalid range at ${path}: minimum (${schema.minimum}) > maximum (${schema.maximum})`,
-                        rule: 'invalid-range',
-                        analyzer: 'schema'
-                    });
-                }
-            }
-        }
-        if (schema.properties) {
-            for (const [key, value] of Object.entries(schema.properties)) {
-                this.validateSchemaTypes(value, filePath, config, violations, `${path}.${key}`);
-            }
-        }
-        if (schema.items) {
-            this.validateSchemaTypes(schema.items, filePath, config, violations, `${path}[items]`);
-        }
-        if (schema.additionalProperties && typeof schema.additionalProperties === 'object') {
-            this.validateSchemaTypes(schema.additionalProperties, filePath, config, violations, `${path}[additionalProperties]`);
+    };
+    return analyzeJsonSchemas(jsonFiles, readJson, config);
+}
+function buildSchemaProvenanceContext(ast, adapter, sourceCode, config) {
+    const detectionMode = config.detection?.mode ?? 'hybrid';
+    return buildProvenanceContext(ast, adapter, sourceCode, {
+        mode: detectionMode,
+        dbReceiverNames: config.dbReceiverNames ?? DEFAULT_SCHEMA_CONFIG.dbReceiverNames,
+        dbBindingNames: config.dbBindingNames ?? DEFAULT_SCHEMA_CONFIG.dbBindingNames,
+        dbCallMethods: config.dbCallMethods ?? DEFAULT_SCHEMA_CONFIG.dbCallMethods,
+        dbWrapperNames: config.dbWrapperNames ?? DEFAULT_SCHEMA_CONFIG.dbWrapperNames,
+    });
+}
+function collectAllTableNames(schemas) {
+    const allTables = new Set();
+    for (const schema of schemas ?? []) {
+        for (const table of schema.tables) {
+            allTables.add(table.name);
         }
     }
-    identifySchemaFiles(files, config) {
-        if (!config.schemaFilePatterns)
-            return [];
-        return files.filter(file => {
-            const fileName = file.split('/').pop() || '';
-            return config.schemaFilePatterns.some(pattern => {
-                const regex = new RegExp(pattern.replace('*', '.*'));
-                return regex.test(fileName);
-            });
-        });
-    }
-    identifyDataFiles(files, config) {
-        if (!config.dataFilePatterns)
-            return [];
-        return files.filter(file => {
-            const fileName = file.split('/').pop() || '';
-            return config.dataFilePatterns.some(pattern => {
-                const regex = new RegExp(pattern.replace('*', '.*'));
-                return regex.test(fileName);
-            });
-        });
+    return allTables;
+}
+function appendSchemaViolations(violations, ctx) {
+    const { ast, adapter, sourceCode, config, tableRefs, allTables } = ctx;
+    // Check for missing table references — R2.4: Levenshtein suggestions
+    if (config.checkMissingReferences) {
+        violations.push(...withRuleTiming('unknown-table', () => checkMissingReferences(tableRefs, allTables, ast.filePath)));
     }
-    findMatchingSchema(dataFile, schemas, config) {
-        const dataFileName = dataFile.split('/').pop() || '';
-        const dataBaseName = dataFileName.replace(/\.(data|example|test)\.json$/, '');
-        for (const [schemaFile, schema] of schemas) {
-            const schemaFileName = schemaFile.split('/').pop() || '';
-            const schemaBaseName = schemaFileName.replace(/[.-]?schema\.json$/, '');
-            if (dataBaseName === schemaBaseName) {
-                return schema;
-            }
-        }
-        if (schemas.size === 1) {
-            return schemas.values().next().value;
-        }
-        return null;
+    if (config.checkNamingConventions) {
+        violations.push(...checkNamingConventions(tableRefs, ast.filePath));
     }
-    validateAgainstSchema(data, schema, filePath, violations, config, path = '') {
-        if (schema.type) {
-            const actualType = Array.isArray(data) ? 'array' :
-                data === null ? 'null' :
-                    typeof data;
-            const allowedTypes = Array.isArray(schema.type) ? schema.type : [schema.type];
-            const isValidType = allowedTypes.some((type) => {
-                if (type === 'integer') {
-                    return typeof data === 'number' && Number.isInteger(data);
-                }
-                return type === actualType;
-            });
-            if (!isValidType) {
-                violations.push({
-                    file: filePath,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `Type mismatch at ${path || 'root'}: expected ${allowedTypes.join(' | ')}, got ${actualType}`,
-                    rule: 'type-mismatch',
-                    analyzer: 'schema'
-                });
-                return;
-            }
-        }
-        if (schema.type === 'string' && typeof data === 'string') {
-            if (schema.minLength !== undefined && data.length < schema.minLength) {
-                violations.push({
-                    file: filePath,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `String at ${path} too short: ${data.length} < ${schema.minLength}`,
-                    rule: 'string-too-short',
-                    analyzer: 'schema'
-                });
-            }
-            if (schema.maxLength !== undefined && data.length > schema.maxLength) {
-                violations.push({
-                    file: filePath,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `String at ${path} too long: ${data.length} > ${schema.maxLength}`,
-                    rule: 'string-too-long',
-                    analyzer: 'schema'
-                });
-            }
-            if (schema.pattern) {
-                const regex = new RegExp(schema.pattern);
-                if (!regex.test(data)) {
-                    violations.push({
-                        file: filePath,
-                        line: 1,
-                        column: 1,
-                        severity: 'warning',
-                        message: `String at ${path} doesn't match pattern: ${schema.pattern}`,
-                        rule: 'pattern-mismatch',
-                        analyzer: 'schema'
-                    });
-                }
-            }
-            if (schema.format) {
-                switch (schema.format) {
-                    case 'email':
-                        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(data)) {
-                            violations.push({
-                                file: filePath,
-                                line: 1,
-                                column: 1,
-                                severity: 'warning',
-                                message: `Invalid email format at ${path}`,
-                                rule: 'invalid-format',
-                                analyzer: 'schema'
-                            });
-                        }
-                        break;
-                    case 'uuid':
-                        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(data)) {
-                            violations.push({
-                                file: filePath,
-                                line: 1,
-                                column: 1,
-                                severity: 'warning',
-                                message: `Invalid UUID format at ${path}`,
-                                rule: 'invalid-format',
-                                analyzer: 'schema'
-                            });
-                        }
-                        break;
-                }
-            }
-        }
-        if ((schema.type === 'number' || schema.type === 'integer') && typeof data === 'number') {
-            if (schema.minimum !== undefined && data < schema.minimum) {
-                violations.push({
-                    file: filePath,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `Value at ${path} below minimum: ${data} < ${schema.minimum}`,
-                    rule: 'below-minimum',
-                    analyzer: 'schema'
-                });
-            }
-            if (schema.maximum !== undefined && data > schema.maximum) {
-                violations.push({
-                    file: filePath,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `Value at ${path} above maximum: ${data} > ${schema.maximum}`,
-                    rule: 'above-maximum',
-                    analyzer: 'schema'
-                });
-            }
-        }
-        if (schema.type === 'array' && Array.isArray(data)) {
-            if (schema.minItems !== undefined && data.length < schema.minItems) {
-                violations.push({
-                    file: filePath,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `Array at ${path} has too few items: ${data.length} < ${schema.minItems}`,
-                    rule: 'too-few-items',
-                    analyzer: 'schema'
-                });
-            }
-            if (schema.maxItems !== undefined && data.length > schema.maxItems) {
-                violations.push({
-                    file: filePath,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `Array at ${path} has too many items: ${data.length} > ${schema.maxItems}`,
-                    rule: 'too-many-items',
-                    analyzer: 'schema'
-                });
-            }
-            if (schema.items) {
-                data.forEach((item, index) => {
-                    this.validateAgainstSchema(item, schema.items, filePath, violations, config, `${path}[${index}]`);
-                });
-            }
-        }
-        if (schema.type === 'object' && typeof data === 'object' && data !== null) {
-            if (schema.required && Array.isArray(schema.required)) {
-                for (const requiredField of schema.required) {
-                    if (!(requiredField in data)) {
-                        violations.push({
-                            file: filePath,
-                            line: 1,
-                            column: 1,
-                            severity: 'warning',
-                            message: `Missing required field "${requiredField}" at ${path}`,
-                            rule: 'missing-required-field',
-                            analyzer: 'schema'
-                        });
-                    }
-                }
-            }
-            if (schema.properties) {
-                for (const [key, propSchema] of Object.entries(schema.properties)) {
-                    if (key in data) {
-                        this.validateAgainstSchema(data[key], propSchema, filePath, violations, config, path ? `${path}.${key}` : key);
-                    }
-                }
-            }
-            if (schema.additionalProperties === false || (config.strictMode && !schema.additionalProperties)) {
-                const definedKeys = new Set(Object.keys(schema.properties || {}));
-                const actualKeys = Object.keys(data);
-                for (const key of actualKeys) {
-                    if (!definedKeys.has(key)) {
-                        violations.push({
-                            file: filePath,
-                            line: 1,
-                            column: 1,
-                            severity: 'warning',
-                            message: `Unexpected property "${key}" at ${path}`,
-                            rule: 'unexpected-property',
-                            analyzer: 'schema'
-                        });
-                    }
-                }
-            }
-            else if (typeof schema.additionalProperties === 'object') {
-                const definedKeys = new Set(Object.keys(schema.properties || {}));
-                for (const [key, value] of Object.entries(data)) {
-                    if (!definedKeys.has(key)) {
-                        this.validateAgainstSchema(value, schema.additionalProperties, filePath, violations, config, path ? `${path}.${key}` : key);
-                    }
-                }
-            }
-        }
-        if (schema.enum && Array.isArray(schema.enum)) {
-            if (!schema.enum.includes(data)) {
-                violations.push({
-                    file: filePath,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `Value at ${path} not in enum: ${JSON.stringify(data)}. Allowed: ${schema.enum.join(', ')}`,
-                    rule: 'enum-mismatch',
-                    analyzer: 'schema'
-                });
-            }
-        }
+    if (config.validateQueryPatterns) {
+        violations.push(...checkQueryPatterns(ast, adapter, sourceCode, config));
     }
+    // Check for SQL injection patterns
+    violations.push(...checkSQLInjection(ast, adapter, sourceCode));
 }
-/**
- * Escape regex special characters in a string.
- */
-function escapeRegex(s) {
-    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
+import { analyzeJsonSchemas } from './schema/jsonSchema.js';
+export { analyzeJsonSchemas };
 //# sourceMappingURL=UniversalSchemaAnalyzer.js.map