code-auditor-mcp 3.4.12 → 3.4.14

package/dist/analyzers/universal/schema/migrations.js

@@ -0,0 +1,238 @@
+/**
+ * Migration/DDL replay + one-hop barrel re-export resolution.
+ *
+ * Spec 33 item 15 — extracted from UniversalSchemaAnalyzer.ts so the DDL
+ * state machine, barrel reader, and streaming DDL-presence detection are
+ * importable and testable independently of the analyzer class.
+ */
+import fs from 'fs/promises';
+import { readFileSync, statSync } from 'node:fs';
+import path from 'path';
+import { MAX_ORPHAN_SOURCE_BYTES } from '../../../types.js';
+/**
+ * Strip SQL identifier delimiters: backticks or double-quotes.
+ * @param name
+ * @returns
+ */
+export function stripIdentifier(name) {
+    if ((name.startsWith('`') && name.endsWith('`')) ||
+        (name.startsWith('"') && name.endsWith('"'))) {
+        return name.slice(1, -1);
+    }
+    return name;
+}
+/**
+ * Apply pre-extracted DDL operations to a table set in migration order.
+ * Strips identifier delimiters (backticks/quotes) and performs the
+ * CREATE/DROP/RENAME state transitions. Callable from the schema reducer
+ * without re-parsing raw SQL.
+ * @param ops
+ * @param tables
+ */
+export function applyMigrationOps(ops, tables) {
+    for (const { op, table, newTable } of ops) {
+        if (op === 'CREATE') {
+            tables.add(stripIdentifier(table));
+        }
+        else if (op === 'DROP') {
+            tables.delete(stripIdentifier(table));
+        }
+        else {
+            tables.delete(stripIdentifier(table));
+            tables.add(stripIdentifier(newTable));
+        }
+    }
+}
+/**
+ * Parse a migration SQL source and apply stateful CREATE/DROP/RENAME
+ * operations to the given table set in migration order.
+ * @param source
+ * @param tables
+ */
+export function processMigrationSource(source, tables) {
+    applyMigrationOps(parseMigrationOps(source), tables);
+}
+/**
+ * The DDL state-machine regex shared by the standalone analyze() path and the
+ * pipeline's schema-sql visitor. Single ordered pass — applies CREATE/DROP/
+ * RENAME in statement order within each migration file (fixes the rename-replay
+ * bug where CREATE after RENAME in the same file was silently dropped).
+ */
+const DDL_RE = /(CREATE)\s+(?:VIRTUAL\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)|(DROP)\s+TABLE\s+(?:IF\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)|(ALTER)\s+TABLE\s+(`[^`]+`|"[^"]+"|\w+)\s+RENAME\s+TO\s+(`[^`]+`|"[^"]+"|\w+)/gi;
+/**
+ * Extract ordered DDL operations from migration SQL text. Emitted by the
+ * schema-sql visitor instead of raw source so the reducer only retains the
+ * extracted state transitions, not the full file text.
+ * @param source
+ * @returns
+ */
+export function parseMigrationOps(source) {
+    const ops = [];
+    let match;
+    DDL_RE.lastIndex = 0;
+    while ((match = DDL_RE.exec(source)) !== null) {
+        const op = match[1] || match[3] || match[5];
+        if (op === 'CREATE') {
+            ops.push({ op: 'CREATE', table: match[2] });
+        }
+        else if (op === 'DROP') {
+            ops.push({ op: 'DROP', table: match[4] });
+        }
+        else if (op === 'ALTER') {
+            ops.push({ op: 'RENAME', table: match[6], newTable: match[7] });
+        }
+    }
+    return ops;
+}
+// ── One-hop barrel re-export resolution (Spec 33 item 9) ─────────────────────
+/**
+ * Extract `export * from 'x'` and `export { a, b as c } from 'x'` statements
+ * from barrel source.  Regex-based — matches the analyzer's existing
+ * migration/ORM discovery idiom and avoids a tree-sitter round-trip per barrel.
+ * Local re-exports without a `from` clause are not re-exports and are skipped.
+ * @param source
+ * @returns
+ */
+export function extractReExports(source) {
+    const results = [];
+    const starRe = /export\s*\*\s*from\s*(['"])([^'"]+)\1/g;
+    let m;
+    while ((m = starRe.exec(source)) !== null) {
+        results.push({ source: m[2], star: true, renamed: new Map() });
+    }
+    const namedRe = /export\s*\{([^}]*)\}\s*from\s*(['"])([^'"]+)\2/g;
+    while ((m = namedRe.exec(source)) !== null) {
+        const renamed = new Map();
+        for (const raw of m[1].split(',')) {
+            const spec = raw.trim();
+            if (!spec)
+                continue;
+            const asMatch = /^(\w+)\s+as\s+(\w+)$/.exec(spec);
+            if (asMatch) {
+                // `export { original as local } from 'x'`
+                renamed.set(asMatch[2], asMatch[1]);
+            }
+            else {
+                const name = /^(\w+)$/.exec(spec);
+                if (name)
+                    renamed.set(name[1], name[1]);
+            }
+        }
+        results.push({ source: m[3], star: false, renamed });
+    }
+    return results;
+}
+/**
+ * Resolve a relative module specifier to a file on disk, trying common source
+ * extensions and index files.  Returns the resolved path (absolute or relative
+ * to the importing file's directory) or null when the file cannot be found.
+ *
+ * @param fromFile The importing file (its directory is the resolution base).
+ * @param specifier The relative module specifier to resolve.
+ * @returns The resolved file path, or null when not found.
+ */
+export function resolveBarrelModulePath(fromFile, specifier) {
+    const fromDir = path.dirname(fromFile);
+    const base = path.resolve(fromDir, specifier);
+    const candidates = [
+        base,
+        ...['.ts', '.tsx', '.js', '.jsx'].map(ext => base + ext),
+        ...['.ts', '.tsx', '.js', '.jsx'].map(ext => path.join(base, 'index' + ext)),
+    ];
+    for (const candidate of candidates) {
+        try {
+            // Cheap existence check without throwing on directory candidates.
+            const stat = statSync(candidate);
+            if (stat.isFile())
+                return candidate;
+        }
+        catch {
+            // continue
+        }
+    }
+    return null;
+}
+/**
+ * Default barrel reader — resolves the specifier relative to `fromFile` on disk.
+ *
+ * @param fromFile The importing file (its directory is the resolution base).
+ * @param specifier The relative module specifier to read.
+ * @returns The resolved file's source text, or null when unreadable.
+ */
+export function readModuleFromDisk(fromFile, specifier) {
+    const resolved = resolveBarrelModulePath(fromFile, specifier);
+    if (!resolved)
+        return null;
+    try {
+        return readFileSync(resolved, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+/** Lightweight DDL presence marker — detection only, no capture groups. */
+const DDL_PRESENCE_RE = /(?:CREATE|DROP|ALTER)\s+(?:VIRTUAL\s+)?TABLE/i;
+/**
+ * Detect whether an SQL file contains any DDL statement without materializing
+ * the whole file. Streams in 1 MB chunks, carrying a small tail across chunk
+ * boundaries so a marker split at "CREATE TA/BLE" is still caught. Used by the
+ * schema-sql visitor for oversized orphans yielded with empty source by stage 1.
+ * @param filePath
+ * @returns
+ */
+export async function sqlFileHasDdl(filePath) {
+    const CHUNK = 1024 * 1024; // 1 MB
+    const CARRY = 32; // "ALTER VIRTUAL TABLE IF NOT EXISTS" — enough to bridge a boundary
+    const handle = await fs.open(filePath, 'r');
+    try {
+        const buffer = Buffer.alloc(CHUNK);
+        let carry = '';
+        let pos = 0;
+        for (;;) {
+            const { bytesRead } = await handle.read(buffer, 0, CHUNK, pos);
+            if (bytesRead === 0)
+                break;
+            const text = carry + buffer.toString('utf8', 0, bytesRead);
+            if (DDL_PRESENCE_RE.test(text))
+                return true;
+            carry = text.slice(-CARRY);
+            pos += bytesRead;
+        }
+        return false;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Extract migration ops from an SQL file, honoring stage-1 streaming: when
+ * `sourceCode` is empty the file was too large to materialize, so DDL presence
+ * is detected by streaming; only a real oversized migration is read in full
+ * (rare). Returns a `skipped` flag so the pipeline can surface the skip in
+ * coverage without emitting a violation.
+ * @param filePath
+ * @param sourceCode
+ * @returns
+ */
+export async function extractMigrationOpsFromFile(filePath, sourceCode) {
+    if (sourceCode !== '') {
+        return { ops: parseMigrationOps(sourceCode), skipped: false, bytes: Buffer.byteLength(sourceCode) };
+    }
+    let size = 0;
+    try {
+        size = (await fs.stat(filePath)).size;
+    }
+    catch {
+        size = 0;
+    }
+    if (size <= MAX_ORPHAN_SOURCE_BYTES) {
+        // Empty or small file whose read produced an empty string — nothing to do.
+        return { ops: [], skipped: false, bytes: size };
+    }
+    if (!(await sqlFileHasDdl(filePath))) {
+        return { ops: [], skipped: true, bytes: size };
+    }
+    const full = await fs.readFile(filePath, 'utf-8');
+    return { ops: parseMigrationOps(full), skipped: false, bytes: size };
+}
+//# sourceMappingURL=migrations.js.map

package/dist/analyzers/universal/schema/migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../../../src/analyzers/universal/schema/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAG5D;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC5C,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAkB,EAAE,MAAmB;IACvE,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC;QAC1C,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;aAAM,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzB,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACtC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,QAAS,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,MAAmB;IAEnB,iBAAiB,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,MAAM,GAAG,4NAA4N,CAAC;AAE5O;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,KAA6B,CAAC;IAClC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;IACrB,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5C,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,MAAM,MAAM,GAAG,wCAAwC,CAAC;IACxD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,iDAAiD,CAAC;IAClE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,OAAO,EAAE,CAAC;gBACZ,0CAA0C;gBAC1C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClC,IAAI,IAAI;oBAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB,EAAE,SAAiB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAE9C,MAAM,UAAU,GAAG;QACjB,IAAI;QACJ,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC;QACxD,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,GAAG,GAAG,CAAC,CAAC;KAC7E,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,kEAAkE;YAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjC,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,OAAO,SAAS,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,SAAiB;IACpE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,eAAe,GAAG,+CAA+C,CAAC;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO;IAClC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,oEAAoE;IACtF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,SAAS,CAAC;YACR,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC/D,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,MAAM,IAAI,GAAG,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;YAC3D,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5C,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3B,GAAG,IAAI,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,QAAgB,EAChB,UAAkB;IAElB,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,IAAI,uBAAuB,EAAE,CAAC;QACpC,2EAA2E;QAC3E,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,EAAE,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvE,CAAC"}

package/dist/analyzers/universal/schema/types.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Shared types for the schema analyzer family.
+ *
+ * Split out of UniversalSchemaAnalyzer.ts (Spec 33 item 15) so the
+ * migration/DDL, discovery, table-analysis, and JSON-schema modules can each
+ * import what they need without dragging in the whole analyzer — and without
+ * creating a circular import through the class.
+ */
+import type { AST, LanguageAdapter } from '../../../languages/types.js';
+/**
+ * Configuration for Schema analyzer
+ */
+export interface SchemaAnalyzerConfig {
+    enableTableUsageTracking?: boolean;
+    checkMissingReferences?: boolean;
+    checkNamingConventions?: boolean;
+    detectUnusedTables?: boolean;
+    validateQueryPatterns?: boolean;
+    maxQueriesPerFunction?: number;
+    requiredSchemas?: string[];
+    schemas?: Array<{
+        name: string;
+        tables: Array<{
+            name: string;
+            columns: Array<{
+                name: string;
+                type: string;
+            }>;
+        }>;
+    }>;
+    validateJsonSchemas?: boolean;
+    jsonSchemaVersion?: 'draft-04' | 'draft-06' | 'draft-07' | '2019-09' | '2020-12';
+    allowedJsonTypes?: string[];
+    schemaFilePatterns?: string[];
+    dataFilePatterns?: string[];
+    schemaDataPairs?: Array<{
+        schema: string;
+        data: string | string[];
+    }>;
+    strictMode?: boolean;
+    allowAdditionalProperties?: boolean;
+    sqlTagNames?: string[];
+    dbReceiverNames?: string[];
+    dbCallMethods?: string[];
+    dbBindingNames?: string[];
+    dbWrapperNames?: string[];
+    fileGateGlobs?: string[];
+    schemaFiles?: string[];
+    /** Spec 29: Declarative table-source registry for Tier 2 ORM detection */
+    tableSources?: TableSourceEntry[];
+}
+export interface TableReference {
+    table: string;
+    type: 'select' | 'insert' | 'update' | 'delete' | 'create' | 'reference';
+    location: {
+        line: number;
+        column: number;
+    };
+    context: string;
+}
+/**
+ * Registry entry for declarative table-source detection.
+ * Adding an ORM becomes a config entry, not code.
+ */
+export interface TableSourceEntry {
+    /** Type discriminator for the match shape */
+    kind: 'callee' | 'decorator';
+    /** The function/method/decorator name to match */
+    name: string;
+    /** Which argument (0-indexed) holds the table name as a string literal */
+    arg: number;
+    /** Human-readable description for provenance display */
+    description?: string;
+    /**
+     * Optional: required module path. When set, the call/decorator is only
+     * considered if the identifier originates from an import matching this
+     * specifier. Example: 'knex' prevents matching a local function also
+     * named createTable.
+     */
+    module?: string;
+}
+/**
+ * Per-table origin record — tracks which tier and source file contributed
+ * a table to the catalog.
+ */
+export interface TableProvenance {
+    table: string;
+    tier: 'sql-migration' | 'orm-registry' | 'prisma-model' | 'external-config';
+    sourceFile?: string;
+    description?: string;
+}
+/**
+ * A complete catalog entry: one table name with all its known sources.
+ */
+export interface TableCatalogEntry {
+    table: string;
+    sources: TableProvenance[];
+}
+/**
+ * Resolution context threaded through the registry table extractors. Bundling
+ * the AST + adapter + source + file-path + module-reader tuple keeps the
+ * extractor signatures at three positional parameters (target + context +
+ * accumulator) instead of six.
+ *
+ * `importMap` is populated by `extractTablesFromRegistry` before dispatch —
+ * callers build the context without it.
+ */
+export interface RegistryExtractionContext {
+    ast: AST;
+    adapter: LanguageAdapter;
+    sourceCode: string;
+    filePath: string;
+    importMap?: Map<string, Map<string, string>>;
+    readModule?: (fromFile: string, specifier: string) => string | null;
+}
+/** A single DDL state transition parsed from migration SQL. */
+export type MigrationOp = {
+    op: 'CREATE' | 'DROP' | 'RENAME';
+    table: string;
+    newTable?: string;
+};
+/** A single re-export statement from a barrel file. */
+export interface ReExport {
+    /** The module the statement re-exports from. */
+    source: string;
+    /** True for `export * from 'x'` (every name maps to itself). */
+    star: boolean;
+    /** For named re-exports: local export name → original package name. */
+    renamed: Map<string, string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/analyzers/universal/schema/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/analyzers/universal/schema/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,GAAG,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAExE;;GAEG;AACH,MAAM,WAAW,oBAAoB;IAEnC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,OAAO,CAAC,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,KAAK,CAAC;YACZ,IAAI,EAAE,MAAM,CAAC;YACb,OAAO,EAAE,KAAK,CAAC;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;aAAE,CAAC,CAAC;SACjD,CAAC,CAAC;KACJ,CAAC,CAAC;IAGH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iBAAiB,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;IACjF,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAG5B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAIpC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IACzE,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,iBAAiB,CAAC;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,yBAAyB;IACxC,GAAG,EAAE,GAAG,CAAC;IACT,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7C,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACrE;AAED,+DAA+D;AAC/D,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,uDAAuD;AACvD,MAAM,WAAW,QAAQ;IACvB,gDAAgD;IAChD,MAAM,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,IAAI,EAAE,OAAO,CAAC;IACd,uEAAuE;IACvE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B"}

package/dist/analyzers/universal/schema/types.js

@@ -0,0 +1,10 @@
+/**
+ * Shared types for the schema analyzer family.
+ *
+ * Split out of UniversalSchemaAnalyzer.ts (Spec 33 item 15) so the
+ * migration/DDL, discovery, table-analysis, and JSON-schema modules can each
+ * import what they need without dragging in the whole analyzer — and without
+ * creating a circular import through the class.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/analyzers/universal/schema/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/analyzers/universal/schema/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/analyzers/universal/schema/violations.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Schema violation builders — module-level equivalents of the base
+ * UniversalAnalyzer.createViolation with `analyzer: 'schema'` hardcoded, so
+ * extracted free functions (Spec 34) can construct violations without a `this`
+ * reference back through the analyzer class.
+ */
+import type { Violation } from '../../../types.js';
+/**
+ * Bundled classification for a schema violation — `severity`, `rule`, and an
+ * optional `symbol` travel together so `createSchemaViolation` stays a 4-arg
+ * call rather than a 6-arg one.
+ */
+export interface SchemaViolationClassification {
+    severity: 'critical' | 'warning' | 'suggestion';
+    rule: string;
+    symbol?: string;
+}
+/**
+ * Module-level equivalent of `UniversalAnalyzer.createViolation`. `rule`
+ * identity is preserved exactly; `location` and optional `symbol` are kept,
+ * while `analyzer` is hardcoded to `'schema'` instead of `this.name`.
+ *
+ * @param file The file the violation occurred in.
+ * @param location The 1-based line/column of the violation.
+ * @param message The human-readable violation message.
+ * @param classification Bundled severity/rule/symbol classification.
+ * @returns A schema analyzer violation.
+ */
+export declare function createSchemaViolation(file: string, location: {
+    line: number;
+    column: number;
+}, message: string, classification: SchemaViolationClassification): Violation;
+/**
+ * Single-line JSON validation violation — hardcoded `line: 1` / `column: 1`
+ * (JSON files have no AST positions). Used by the JSON-schema helpers.
+ *
+ * @param file The JSON file the violation occurred in.
+ * @param severity The violation severity.
+ * @param message The human-readable violation message.
+ * @param rule The rule identifier.
+ * @returns A schema analyzer violation anchored at 1:1.
+ */
+export declare function emitViolation(file: string, severity: Violation['severity'], message: string, rule: string): Violation;
+//# sourceMappingURL=violations.d.ts.map

package/dist/analyzers/universal/schema/violations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"violations.d.ts","sourceRoot":"","sources":["../../../../src/analyzers/universal/schema/violations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC1C,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,6BAA6B,GAC5C,SAAS,CAcX;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC,EAC/B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,SAAS,CAUX"}

package/dist/analyzers/universal/schema/violations.js

@@ -0,0 +1,54 @@
+/**
+ * Schema violation builders — module-level equivalents of the base
+ * UniversalAnalyzer.createViolation with `analyzer: 'schema'` hardcoded, so
+ * extracted free functions (Spec 34) can construct violations without a `this`
+ * reference back through the analyzer class.
+ */
+/**
+ * Module-level equivalent of `UniversalAnalyzer.createViolation`. `rule`
+ * identity is preserved exactly; `location` and optional `symbol` are kept,
+ * while `analyzer` is hardcoded to `'schema'` instead of `this.name`.
+ *
+ * @param file The file the violation occurred in.
+ * @param location The 1-based line/column of the violation.
+ * @param message The human-readable violation message.
+ * @param classification Bundled severity/rule/symbol classification.
+ * @returns A schema analyzer violation.
+ */
+export function createSchemaViolation(file, location, message, classification) {
+    const v = {
+        file,
+        line: location.line,
+        column: location.column,
+        severity: classification.severity,
+        message,
+        rule: classification.rule,
+        analyzer: 'schema'
+    };
+    if (classification.symbol) {
+        v.functionName = classification.symbol;
+    }
+    return v;
+}
+/**
+ * Single-line JSON validation violation — hardcoded `line: 1` / `column: 1`
+ * (JSON files have no AST positions). Used by the JSON-schema helpers.
+ *
+ * @param file The JSON file the violation occurred in.
+ * @param severity The violation severity.
+ * @param message The human-readable violation message.
+ * @param rule The rule identifier.
+ * @returns A schema analyzer violation anchored at 1:1.
+ */
+export function emitViolation(file, severity, message, rule) {
+    return {
+        file,
+        line: 1,
+        column: 1,
+        severity,
+        message,
+        rule,
+        analyzer: 'schema',
+    };
+}
+//# sourceMappingURL=violations.js.map

package/dist/analyzers/universal/schema/violations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"violations.js","sourceRoot":"","sources":["../../../../src/analyzers/universal/schema/violations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAY,EACZ,QAA0C,EAC1C,OAAe,EACf,cAA6C;IAE7C,MAAM,CAAC,GAAc;QACnB,IAAI;QACJ,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,QAAQ,EAAE,cAAc,CAAC,QAAQ;QACjC,OAAO;QACP,IAAI,EAAE,cAAc,CAAC,IAAI;QACzB,QAAQ,EAAE,QAAQ;KACnB,CAAC;IACF,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;QAC1B,CAAC,CAAC,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,QAA+B,EAC/B,OAAe,EACf,IAAY;IAEZ,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,QAAQ;QACR,OAAO;QACP,IAAI;QACJ,QAAQ,EAAE,QAAQ;KACnB,CAAC;AACJ,CAAC"}

package/dist/auditRunner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auditRunner.d.ts","sourceRoot":"","sources":["../src/auditRunner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EAQf,MAAM,YAAY,CAAC;AA0DpB;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB;oCAiBnB,MAAM,KAAG,OAAO,CAAC,kBAAkB,CAAC;uBAQjD,kBAAkB,KAAG,OAAO,CAAC,WAAW,CAAC;6BAg4B1B,WAAW,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;EAS7F;AAyQD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,GAAG,YAAY,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAC/C,UAAU,CAAC,EAAE,MAAM,GAClB,iBAAiB,EAAE,CA0CrB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAGjF;AAED,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"auditRunner.d.ts","sourceRoot":"","sources":["../src/auditRunner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,cAAc,EASf,MAAM,YAAY,CAAC;AA4DpB;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB;oCAiBnB,MAAM,KAAG,OAAO,CAAC,kBAAkB,CAAC;uBAQjD,kBAAkB,KAAG,OAAO,CAAC,WAAW,CAAC;6BA29B1B,WAAW,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC;EAS7F;AAyQD,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,WAAW,GAAG,YAAY,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,gBAAgB,EAAE,MAAM,EAAE,EAC1B,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EAC/C,UAAU,CAAC,EAAE,MAAM,GAClB,iBAAiB,EAAE,CA0CrB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,WAAW,CAAC,CAGjF;AAED,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}