code-auditor-mcp 3.4.9 → 3.4.11

package/dist/analyzers/universal/UniversalSchemaAnalyzer.js

@@ -8,10 +8,30 @@
  * R2.5: Legacy scan-all-strings path DELETED.
  * R7:   schema/unknown-table severity is "suggestion".
  */
+import fs from 'fs/promises';
+import path from 'path';
 import { UniversalAnalyzer } from '../../languages/UniversalAnalyzer.js';
 import picomatch from 'picomatch';
 import { buildProvenanceContext, isDBProvenanced, DB_CALL_METHODS, } from '../provenance.js';
 import { OrmAdapterRegistry } from '../orm/index.js';
+import { makeVisitorStatus } from '../../pipeline.js';
+/**
+ * Single-source constants for SQL context detection.
+ *
+ * These are the ground-truth defaults. DEFAULT_SCHEMA_CONFIG references them,
+ * and every inline fallback dereferences them directly — so ?? narrowing works
+ * (TypeScript infers `string[]`, not `string[] | undefined` from the optional
+ * SchemaAnalyzerConfig fields).
+ *
+ * Trimmed to D1/Workers DB patterns only (4 receivers, 6 methods).
+ * Broader entries like 'connection'/'client'/'query'/'get'/'each' matched
+ * non-DB code (WebSocket, Map, jQuery, vector stores), causing phantom
+ * cross-domain lifecycle violations. See CHANGELOG 3.4.9 accuracy fix.
+ */
+export const DB_RECEIVER_NAMES = ['db', 'database', 'sql', 'stmt'];
+export const DB_CALL_METHOD_NAMES = ['exec', 'prepare', 'batch', 'run', 'all', 'first'];
+export const DB_BINDING_NAMES = ['env.DB'];
+export const SQL_TAG_NAMES = ['sql', 'db'];
 export const DEFAULT_SCHEMA_CONFIG = {
     enableTableUsageTracking: true,
     checkMissingReferences: true,
@@ -29,53 +49,79 @@ export const DEFAULT_SCHEMA_CONFIG = {
     strictMode: false,
     allowAdditionalProperties: true,
     // Spec-17 R2 defaults
-    sqlTagNames: ['sql', 'db'],
-    dbReceiverNames: ['db', 'database', 'sql', 'stmt', 'connection', 'pool', 'client'],
-    dbCallMethods: ['exec', 'prepare', 'batch', 'run', 'all', 'first', 'query', 'get', 'each'],
-    dbBindingNames: ['env.DB'],
+    sqlTagNames: [...SQL_TAG_NAMES],
+    dbReceiverNames: [...DB_RECEIVER_NAMES],
+    dbCallMethods: [...DB_CALL_METHOD_NAMES],
+    dbBindingNames: [...DB_BINDING_NAMES],
     fileGateGlobs: ['**/*.sql', '**/migrations/**'],
     schemaFiles: [],
 };
-import { promises as fs } from 'fs';
-import * as path from 'path';
-import { CodeIndexDB } from '../../codeIndexDB.js';
 export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
     name = 'schema';
     description = 'Analyzes code against database schemas and validates JSON schemas';
     category = 'database';
     // Track references across files
     tableReferences = new Map();
-    // Project root for DB scoping (Bug #4 / Item 1)
+    // Spec 25 B4 — Queue schema records for the pipeline to write after stage 2.
+    // Was: direct CodeIndexDB.getInstance() call in recordTableUsage.
+    _pendingSchemaRecords = { clearFiles: [], usages: [] };
     projectRoot;
+    /**
+     * Strip SQL identifier delimiters: backticks or double-quotes.
+     */
+    stripIdentifier(name) {
+        if ((name.startsWith('`') && name.endsWith('`')) ||
+            (name.startsWith('"') && name.endsWith('"'))) {
+            return name.slice(1, -1);
+        }
+        return name;
+    }
+    /**
+     * Parse a migration SQL source and apply stateful CREATE/DROP/RENAME
+     * operations to the given table set in migration order.
+     */
+    processMigrationSource(source, tables) {
+        // Sequential state machine: apply CREATE/DROP/RENAME in statement order
+        // within each migration file. Fixes the rename-replay bug where CREATE
+        // after RENAME in the same file was silently deleted by the old three-pass
+        // approach (all CREATE then all DROP then all RENAME).
+        const ddlRe = /(CREATE)\s+(?:VIRTUAL\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)|(DROP)\s+TABLE\s+(?:IF\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)|(ALTER)\s+TABLE\s+(`[^`]+`|"[^"]+"|\w+)\s+RENAME\s+TO\s+(`[^`]+`|"[^"]+"|\w+)/gi;
+        let match;
+        while ((match = ddlRe.exec(source)) !== null) {
+            const op = match[1] || match[3] || match[5];
+            if (op === 'CREATE') {
+                tables.add(this.stripIdentifier(match[2]));
+            }
+            else if (op === 'DROP') {
+                tables.delete(this.stripIdentifier(match[4]));
+            }
+            else if (op === 'ALTER') {
+                tables.delete(this.stripIdentifier(match[6]));
+                tables.add(this.stripIdentifier(match[7]));
+            }
+        }
+    }
+    /**
+     * Standalone analyze() override for backward compatibility with direct analyzer
+     * calls (e.g., tests and non-pipeline audit paths). All production analysis now
+     * flows through the pipeline visitors, but this method is preserved so tests
+     * that call analyzer.analyze([file], config) continue to work.
+     */
     async analyze(files, config) {
         const jsonFiles = files.filter(f => f.endsWith('.json'));
         const codeFiles = files.filter(f => !f.endsWith('.json'));
-        // Spec 22 Item 2 — Auto-discover known tables from migration/SQL files
-        // when no schemas are configured.
-        //
-        // Spec 24 Item 2 — wrangler.toml is the external authority for D1 projects:
-        // parse [[d1_databases]] migration_dir, walk .sql files statefully with
-        // CREATE/DROP/RENAME to derive the current table catalog.
-        //
-        // Spec 24 Item 3 — schemaFiles config lets users point at a full snapshot
-        // (e.g., snapshots/schema.sql) for easy mode.
-        //
-        // Spec 24 Item 4 — Auto-discover from ORM schema definitions (Drizzle
-        // pgTable/mysqlTable/sqliteTable calls and Prisma schema.prisma model blocks)
-        // via import provenance.
-        //
-        // Discovery priority: wrangler.toml > schemaFiles > migration glob walk > ORM.
+        // Auto-discover known tables when no schemas are configured.
         const schemas = config.schemas;
         const projectRoot = config.projectRoot || process.cwd();
         this.projectRoot = projectRoot;
         if (!schemas || schemas.length === 0) {
-            const fromWrangler = await this.discoverTablesFromWrangler(projectRoot);
+            const fromWrangler = await this._discoverTablesFromWrangler(projectRoot);
             const schemaFiles = config.schemaFiles;
             const fromSchemaFiles = schemaFiles && schemaFiles.length > 0
-                ? await this.discoverTablesFromSchemaFiles(schemaFiles, projectRoot)
+                ? await this._discoverTablesFromSchemaFiles(schemaFiles, projectRoot)
                 : new Set();
-            const fromMigrations = await this.discoverTablesFromMigrations(projectRoot, config);
-            const fromOrm = await this.discoverTablesFromOrmSchemas(codeFiles);
+            const fromMigrations = await this._discoverTablesFromMigrations(projectRoot, config);
+            const fromOrm = await this._discoverTablesFromOrmSchemas(codeFiles);
             const discovered = new Set([
                 ...fromWrangler,
                 ...fromSchemaFiles,
@@ -94,57 +140,127 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         const codeResult = codeFiles.length > 0 ? await super.analyze(codeFiles, config) : {
             violations: [],
+            executionTime: 0,
+            status: makeVisitorStatus(0),
+            analyzerName: this.name,
+            errors: [],
+            filesProcessed: 0,
+        };
+        // Adapt JSON handling to the pipeline-style analyzeJsonSchemas(Map) signature.
+        let jsonResult = {
+            violations: [],
+            executionTime: 0,
+            status: makeVisitorStatus(0),
+            analyzerName: this.name,
             errors: [],
             filesProcessed: 0,
-            executionTime: 0
         };
-        const jsonResult = await this.analyzeJsonSchemas(jsonFiles, config);
+        if (jsonFiles.length > 0) {
+            const jsonContents = new Map();
+            for (const file of jsonFiles) {
+                try {
+                    const raw = await fs.readFile(file, 'utf8');
+                    let parsed = null;
+                    try {
+                        parsed = JSON.parse(raw);
+                    }
+                    catch { /* not valid JSON */ }
+                    jsonContents.set(file, { parsed, raw });
+                }
+                catch {
+                    // Skip unreadable files
+                }
+            }
+            jsonResult = this.analyzeJsonSchemas(jsonContents, config);
+        }
         return {
             violations: [...codeResult.violations, ...jsonResult.violations],
+            executionTime: (codeResult.executionTime || 0) + (jsonResult.executionTime || 0),
+            status: makeVisitorStatus((codeResult.filesProcessed ?? 0) + (jsonResult.filesProcessed ?? 0)),
+            analyzerName: this.name,
             errors: [...(codeResult.errors || []), ...(jsonResult.errors || [])],
-            filesProcessed: codeResult.filesProcessed + jsonResult.filesProcessed,
-            executionTime: (codeResult.executionTime || 0) + (jsonResult.executionTime || 0)
+            filesProcessed: (codeResult.filesProcessed ?? 0) + (jsonResult.filesProcessed ?? 0),
         };
     }
-    /**
-     * Spec 22 Item 2 — Auto-discover known tables from migration/SQL files.
-     *
-     * When config.schemas is empty, scans files matching fileGateGlobs for
-     * CREATE TABLE statements and returns the set of discovered table names.
-     * These are injected as a synthetic schema so the unknown-table detector
-     * has a reference set to check against.
-     *
-     * Only extracts `create`-type references (CREATE TABLE ...), since those
-     * define tables — SELECT/INSERT/UPDATE references to an unknown table are
-     * the violations we're trying to avoid flagging.
-     */
-    async discoverTablesFromMigrations(projectRoot, config) {
-        const tables = new Set();
-        const gateGlobs = config.fileGateGlobs ?? ['**/*.sql', '**/migrations/**'];
-        // Own glob walk — does NOT depend on codeFiles from the caller pipeline.
-        // Walks projectRoot recursively, matching files against fileGateGlobs via picomatch.
-        const walkedFiles = await this.walkFiles(projectRoot, gateGlobs);
-        // Sort for deterministic processing (migrations are often ordered by filename)
-        walkedFiles.sort();
-        // Sequential state-machine replay over the migration ledger:
-        // CREATE adds, DROP removes, RENAME moves — each at its position
-        // within the file (processMigrationSource applies them inline).
-        for (const file of walkedFiles) {
-            try {
-                const source = await fs.readFile(file, 'utf8');
-                this.processMigrationSource(source, tables);
+    // analyzeAST is required by the protected abstract in UniversalAnalyzer.
+    // In production, all schema analysis flows through the pipeline visitors.
+    // This method is preserved for backward compatibility with direct test calls.
+    async analyzeAST(ast, adapter, config, sourceCode) {
+        const violations = [];
+        const finalConfig = { ...DEFAULT_SCHEMA_CONFIG, ...config };
+        // Spec 21: Build provenance context for this file (R1 — provenance-primary detection)
+        const detectionMode = config.detection?.mode ?? 'hybrid';
+        const provenanceContext = buildProvenanceContext(ast, adapter, sourceCode, {
+            mode: detectionMode,
+            dbReceiverNames: finalConfig.dbReceiverNames ?? DEFAULT_SCHEMA_CONFIG.dbReceiverNames,
+            dbBindingNames: finalConfig.dbBindingNames ?? DEFAULT_SCHEMA_CONFIG.dbBindingNames,
+            dbCallMethods: finalConfig.dbCallMethods ?? DEFAULT_SCHEMA_CONFIG.dbCallMethods,
+        });
+        // R2.2 — File gate: only analyze files with DB context (Spec 21: provenance-based)
+        if (!this.passesFileGate(ast.filePath, sourceCode, finalConfig, provenanceContext)) {
+            return violations;
+        }
+        // Get available schemas
+        const schemas = finalConfig.schemas || [];
+        const allTables = new Set();
+        for (const schema of schemas) {
+            for (const table of schema.tables) {
+                allTables.add(table.name);
             }
-            catch {
-                // Skip unreadable files — discovery is best-effort
+        }
+        if (finalConfig.requiredSchemas && finalConfig.requiredSchemas.length > 0 && schemas.length === 0) {
+            violations.push(this.createViolation(ast.filePath, { line: 1, column: 1 }, 'No database schemas loaded for analysis', 'warning', 'missing-schemas', undefined, 'top-level:missing-schemas'));
+            return violations;
+        }
+        // R2.1 — AST-based table reference extraction (replaces legacy regex scan-all-strings)
+        // Spec 21: Uses provenance context for DB-call pattern detection
+        const tableRefs = this.findTableReferences(ast, adapter, sourceCode, finalConfig, provenanceContext, allTables);
+        // Spec 15 R1 — Record schema usage for cross-domain lifecycle analysis.
+        // Idempotent per-file: clear stale entries before inserting fresh references.
+        if (finalConfig.enableTableUsageTracking) {
+            this.recordTableUsage(ast, adapter, ast.filePath, tableRefs);
+        }
+        // Check for missing table references — R2.4: Levenshtein suggestions
+        if (finalConfig.checkMissingReferences) {
+            // Spec 24 Item 4 Part B — 10:1 fail-open ratio.
+            const unknownRefs = tableRefs.filter(ref => !allTables.has(ref.table) && !this.isSystemTable(ref.table));
+            const knownCount = allTables.size;
+            const unknownCount = unknownRefs.length;
+            if (knownCount === 0 || unknownCount / Math.max(knownCount, 1) > 10) {
+                const displayRatio = knownCount === 0 ? '∞' : (unknownCount / Math.max(knownCount, 1)).toFixed(1);
+                // Silently skip — in direct test mode we don't emit console warnings
+            }
+            else {
+                for (const ref of unknownRefs) {
+                    const suggestions = this.getNearestTableSuggestions(ref.table, allTables, 2);
+                    const msg = suggestions.length > 0
+                        ? `Reference to unknown table '${ref.table}' (${ref.type}). Did you mean: ${suggestions.join(', ')}?`
+                        : `Reference to unknown table '${ref.table}' (${ref.type})`;
+                    violations.push(this.createViolation(ast.filePath, ref.location, msg, 'suggestion', 'unknown-table', undefined, ref.table));
+                }
             }
         }
-        return tables;
+        // Check naming conventions
+        if (finalConfig.checkNamingConventions) {
+            violations.push(...this.checkNamingConventions(tableRefs, ast.filePath));
+        }
+        // Check query patterns
+        if (finalConfig.validateQueryPatterns) {
+            violations.push(...this.checkQueryPatterns(ast, adapter, sourceCode, finalConfig));
+        }
+        // Check for SQL injection patterns
+        violations.push(...this.checkSQLInjection(ast, adapter, sourceCode));
+        return violations;
     }
+    // ---------------------------------------------------------------------------
+    // Auto-discovery helpers — used by the standalone analyze() override and
+    // the pre-pipeline discovery phase in auditRunner.
+    // ---------------------------------------------------------------------------
     /**
      * Walk project root recursively, returning files matching any of the given
      * picomatch globs. Skips node_modules and dot-directories.
      */
-    async walkFiles(root, globs) {
+    async _walkFiles(root, globs) {
         const results = [];
         async function walk(dir) {
             let names;
@@ -170,7 +286,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     await walk(fullPath);
                 }
                 else if (stat.isFile()) {
-                    // Check picomatch against the path relative to root
                     const relative = path.relative(root, fullPath);
                     const matched = globs.some(g => picomatch.isMatch(relative, g));
                     if (matched) {
@@ -182,115 +297,32 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         await walk(root);
         return results;
     }
-    /**
-     * Strip SQL identifier delimiters: backticks or double-quotes.
-     */
-    stripIdentifier(name) {
-        if ((name.startsWith('`') && name.endsWith('`')) ||
-            (name.startsWith('"') && name.endsWith('"'))) {
-            return name.slice(1, -1);
-        }
-        return name;
-    }
-    /**
-     * Parse a migration SQL source and apply stateful CREATE/DROP/RENAME
-     * operations to the given table set in migration order.
-     */
-    processMigrationSource(source, tables) {
-        // Sequential state machine: apply CREATE/DROP/RENAME in statement order
-        // within each migration file. Fixes the rename-replay bug where CREATE
-        // after RENAME in the same file was silently deleted by the old three-pass
-        // approach (all CREATE then all DROP then all RENAME).
-        const ddlRe = /(CREATE)\s+(?:VIRTUAL\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)|(DROP)\s+TABLE\s+(?:IF\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)|(ALTER)\s+TABLE\s+(`[^`]+`|"[^"]+"|\w+)\s+RENAME\s+TO\s+(`[^`]+`|"[^"]+"|\w+)/gi;
-        let match;
-        while ((match = ddlRe.exec(source)) !== null) {
-            const op = match[1] || match[3] || match[5];
-            if (op === 'CREATE') {
-                tables.add(this.stripIdentifier(match[2]));
-            }
-            else if (op === 'DROP') {
-                tables.delete(this.stripIdentifier(match[4]));
-            }
-            else if (op === 'ALTER') {
-                tables.delete(this.stripIdentifier(match[6]));
-                tables.add(this.stripIdentifier(match[7]));
-            }
-        }
-    }
-    /**
-     * Spec 24 Item 4 — Auto-discover known tables from ORM schema definitions.
-     *
-     * Uses import provenance to identify schema files (files importing Drizzle
-     * table constructors from drizzle-orm) and Prisma's canonical schema.prisma
-     * filename. Extracts table/model names and feeds them into allTables so the
-     * unknown-table detector works without explicit user config.
-     *
-     * Drizzle: scans .ts/.tsx/.js/.jsx files that import from drizzle-orm for
-     *   pgTable/mysqlTable/sqliteTable('tableName', ...) calls.
-     * Prisma: scans schema.prisma files for model Name { ... } blocks.
-     */
-    async discoverTablesFromOrmSchemas(files) {
+    async _discoverTablesFromMigrations(projectRoot, config) {
         const tables = new Set();
-        for (const file of files) {
-            const lowerFile = file.toLowerCase();
-            // ── Drizzle: import provenance — files importing drizzle-orm table builders ──
-            if (/\.(ts|tsx|js|jsx)$/i.test(file)) {
-                try {
-                    const source = await fs.readFile(file, 'utf8');
-                    // Import provenance: only scan files that import from drizzle-orm
-                    if (/from\s+['"]drizzle-orm/.test(source)) {
-                        const builderRegex = /(?:pgTable|mysqlTable|sqliteTable)\s*\(\s*['"]([^'"]+)['"]/g;
-                        let match;
-                        while ((match = builderRegex.exec(source)) !== null) {
-                            tables.add(match[1]);
-                        }
-                    }
-                }
-                catch {
-                    // Skip unreadable files — discovery is best-effort
-                }
+        const gateGlobs = config.fileGateGlobs ?? ['**/*.sql', '**/migrations/**'];
+        const walkedFiles = await this._walkFiles(projectRoot, gateGlobs);
+        walkedFiles.sort();
+        for (const file of walkedFiles) {
+            try {
+                const source = await fs.readFile(file, 'utf8');
+                this.processMigrationSource(source, tables);
             }
-            // ── Prisma: canonical schema.prisma filename ──
-            if (file.endsWith('schema.prisma') || file.endsWith('\\schema.prisma')) {
-                try {
-                    const source = await fs.readFile(file, 'utf8');
-                    const modelRegex = /model\s+(\w+)\s*\{/g;
-                    let match;
-                    while ((match = modelRegex.exec(source)) !== null) {
-                        tables.add(match[1]);
-                    }
-                }
-                catch {
-                    // Skip unreadable files — discovery is best-effort
-                }
+            catch {
+                // Skip unreadable files
             }
         }
         return tables;
     }
-    /**
-     * Spec 24 Item 2 — Discover tables from wrangler.toml for D1/Cloudflare Workers projects.
-     *
-     * wrangler.toml is the external authority declaring where D1 migrations live.
-     * Parses it for [[d1_databases]] blocks with migrations_dir, then walks the
-     * migration directory reading .sql files in alphanumeric order (migration
-     * order). Processes statefully in migration order: CREATE adds, DROP removes,
-     * RENAME moves inline (delete old + add new) so recreated tables survive.
-     *
-     * Returns only the current table set — not historical/transient names.
-     */
-    async discoverTablesFromWrangler(projectRoot) {
+    async _discoverTablesFromWrangler(projectRoot) {
         const tables = new Set();
-        // 1. Look for wrangler.toml in project root
         const wranglerPath = path.join(projectRoot, 'wrangler.toml');
         let wranglerContent;
         try {
             wranglerContent = await fs.readFile(wranglerPath, 'utf8');
         }
         catch {
-            return tables; // No wrangler.toml — nothing to discover
+            return tables; // No wrangler.toml
         }
-        // 2. Parse [[d1_databases]] blocks for migrations_dir
-        // Simple TOML section parser — no dependency needed for this narrow use case
         const migrationDirs = [];
         let inD1Block = false;
         for (const line of wranglerContent.split('\n')) {
@@ -300,7 +332,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 continue;
             }
             if (inD1Block && trimmed.startsWith('[')) {
-                // Next TOML section — exit d1_databases block
                 inD1Block = false;
                 continue;
             }
@@ -311,7 +342,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 }
             }
         }
-        // 3. Walk each migration directory, read .sql files in alphanumeric order
         for (const migDir of migrationDirs) {
             const absDir = path.resolve(projectRoot, migDir);
             let entries;
@@ -320,10 +350,10 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 entries = dirents
                     .filter(e => e.isFile() && e.name.endsWith('.sql'))
                     .map(e => e.name)
-                    .sort(); // Alphanumeric = chronological migration order
+                    .sort();
             }
             catch {
-                continue; // Non-existent directory — skip
+                continue;
             }
             for (const entry of entries) {
                 const filePath = path.join(absDir, entry);
@@ -338,23 +368,12 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         return tables;
     }
-    /**
-     * Spec 24 Item 3 — Discover tables from explicit schema file paths.
-     *
-     * Reads each file path (resolved against projectRoot) and extracts
-     * CREATE TABLE [IF NOT EXISTS] name statements. Supports the common
-     * D1 pattern where users snapshot their full schema to a single .sql file
-     * (e.g., snapshots/schema.sql).
-     */
-    async discoverTablesFromSchemaFiles(schemaFiles, projectRoot) {
+    async _discoverTablesFromSchemaFiles(schemaFiles, projectRoot) {
         const tables = new Set();
         for (const file of schemaFiles) {
             const absPath = path.resolve(projectRoot, file);
             try {
                 const source = await fs.readFile(absPath, 'utf8');
-                // Only extract CREATE TABLE — these are snapshots, not migration streams,
-                // so no stateful DROP/RENAME processing needed.
-                // v3.4.8: Added VIRTUAL TABLE support (FTS tables) and quoted/backtick identifiers
                 const createRe = /CREATE\s+(?:VIRTUAL\s+)?TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(`[^`]+`|"[^"]+"|\w+)/gi;
                 let match;
                 while ((match = createRe.exec(source)) !== null) {
@@ -362,94 +381,45 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 }
             }
             catch {
-                // Skip unreadable/missing files — best-effort
+                // Skip unreadable files
             }
         }
         return tables;
     }
-    async analyzeAST(ast, adapter, config, sourceCode) {
-        const violations = [];
-        const finalConfig = { ...DEFAULT_SCHEMA_CONFIG, ...config };
-        // Spec 21: Build provenance context for this file (R1 — provenance-primary detection)
-        const detectionMode = config.detection?.mode ?? 'hybrid';
-        const p0 = performance.now();
-        const provenanceContext = buildProvenanceContext(ast, adapter, sourceCode, {
-            mode: detectionMode,
-            dbReceiverNames: finalConfig.dbReceiverNames ?? DEFAULT_SCHEMA_CONFIG.dbReceiverNames,
-            dbBindingNames: finalConfig.dbBindingNames ?? DEFAULT_SCHEMA_CONFIG.dbBindingNames,
-            dbCallMethods: finalConfig.dbCallMethods ?? DEFAULT_SCHEMA_CONFIG.dbCallMethods,
-        });
-        const timingAcc = config._provenanceTiming;
-        if (timingAcc)
-            timingAcc.totalMs += performance.now() - p0;
-        // R2.2 — File gate: only analyze files with DB context (Spec 21: provenance-based)
-        if (!this.passesFileGate(ast.filePath, sourceCode, finalConfig, provenanceContext)) {
-            return violations;
-        }
-        // Get available schemas
-        const schemas = finalConfig.schemas || [];
-        const allTables = new Set();
-        for (const schema of schemas) {
-            for (const table of schema.tables) {
-                allTables.add(table.name);
-            }
-        }
-        if (finalConfig.requiredSchemas && finalConfig.requiredSchemas.length > 0 && schemas.length === 0) {
-            violations.push(this.createViolation(ast.filePath, { line: 1, column: 1 }, 'No database schemas loaded for analysis', 'warning', 'missing-schemas', undefined, 'top-level:missing-schemas'));
-            return violations;
-        }
-        // R2.1 — AST-based table reference extraction (replaces legacy regex scan-all-strings)
-        // Spec 21: Uses provenance context for DB-call pattern detection
-        const tableRefs = this.findTableReferences(ast, adapter, sourceCode, finalConfig, provenanceContext, allTables);
-        // Spec 15 R1 — Record schema usage for cross-domain lifecycle analysis.
-        // Idempotent per-file: clear stale entries before inserting fresh references.
-        if (finalConfig.enableTableUsageTracking) {
-            this.recordTableUsage(ast, adapter, ast.filePath, tableRefs);
-        }
-        // Check for missing table references — R2.4: Levenshtein suggestions
-        if (finalConfig.checkMissingReferences) {
-            // Spec 24 Item 4 Part B — 10:1 fail-open ratio.
-            // When unknown table references vastly outnumber known tables, the
-            // schema catalog is likely incomplete (e.g. external/managed tables).
-            // Disable the rule with a warning instead of flooding the output with
-            // false positives.
-            const unknownRefs = tableRefs.filter(ref => !allTables.has(ref.table) && !this.isSystemTable(ref.table));
-            const knownCount = allTables.size;
-            const unknownCount = unknownRefs.length;
-            // Spec 24 Item 4 Part B — 10:1 fail-open ratio.
-            // When zero known tables: a detector that knows zero tables may not
-            // call anything unknown — every reference is "unknown" by construction.
-            // When known tables exist: disable if unknown:known ratio exceeds 10:1.
-            if (knownCount === 0 || unknownCount / Math.max(knownCount, 1) > 10) {
-                const displayRatio = knownCount === 0 ? '∞' : (unknownCount / Math.max(knownCount, 1)).toFixed(1);
-                console.error(`[code-auditor] unknown-table rule disabled: ` +
-                    `${unknownCount} unknown refs vs ${knownCount} known tables ` +
-                    `(ratio ${displayRatio}:1 exceeds 10:1). ` +
-                    `Add schemas to .codeauditor.json or ORM schema files.`);
-                // Skip unknown-table findings — fall through to column refs below
+    async _discoverTablesFromOrmSchemas(files) {
+        const tables = new Set();
+        for (const file of files) {
+            const lowerFile = file.toLowerCase();
+            if (/\.(ts|tsx|js|jsx)$/i.test(file)) {
+                try {
+                    const source = await fs.readFile(file, 'utf8');
+                    if (/from\s+['"]drizzle-orm/.test(source)) {
+                        const builderRegex = /(?:pgTable|mysqlTable|sqliteTable)\s*\(\s*['"]([^'"]+)['"]/g;
+                        let match;
+                        while ((match = builderRegex.exec(source)) !== null) {
+                            tables.add(match[1]);
+                        }
+                    }
+                }
+                catch {
+                    // Skip unreadable files
+                }
             }
-            else {
-                for (const ref of unknownRefs) {
-                    const suggestions = this.getNearestTableSuggestions(ref.table, allTables, 2);
-                    const msg = suggestions.length > 0
-                        ? `Reference to unknown table '${ref.table}' (${ref.type}). Did you mean: ${suggestions.join(', ')}?`
-                        : `Reference to unknown table '${ref.table}' (${ref.type})`;
-                    violations.push(this.createViolation(ast.filePath, ref.location, msg, 'suggestion', // R7
-                    'unknown-table', undefined, ref.table));
+            if (file.endsWith('schema.prisma') || file.endsWith('\\schema.prisma')) {
+                try {
+                    const source = await fs.readFile(file, 'utf8');
+                    const modelRegex = /model\s+(\w+)\s*\{/g;
+                    let match;
+                    while ((match = modelRegex.exec(source)) !== null) {
+                        tables.add(match[1]);
+                    }
+                }
+                catch {
+                    // Skip unreadable files
                 }
             }
         }
-        // Check naming conventions
-        if (finalConfig.checkNamingConventions) {
-            violations.push(...this.checkNamingConventions(tableRefs, ast.filePath));
-        }
-        // Check query patterns
-        if (finalConfig.validateQueryPatterns) {
-            violations.push(...this.checkQueryPatterns(ast, adapter, sourceCode, finalConfig));
-        }
-        // Check for SQL injection patterns — R7: no critical by default
-        violations.push(...this.checkSQLInjection(ast, adapter, sourceCode));
-        return violations;
+        return tables;
     }
     // ---------------------------------------------------------------------------
     // R2.2 — File gate
@@ -492,14 +462,14 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     return true;
             }
             // Check for env-binding patterns (e.g., env.DB in Cloudflare Workers)
-            const bindingNames = config.dbBindingNames ?? ['env.DB'];
+            const bindingNames = config.dbBindingNames ?? [...DB_BINDING_NAMES];
             for (const binding of bindingNames) {
                 if (sourceCode.includes(binding))
                     return true;
             }
             // Check for DB call patterns (receiver.method)
-            const receivers = config.dbReceiverNames ?? ['db', 'database', 'sql', 'stmt'];
-            const methods = config.dbCallMethods ?? ['exec', 'prepare', 'batch', 'run', 'all', 'first'];
+            const receivers = config.dbReceiverNames ?? [...DB_RECEIVER_NAMES];
+            const methods = config.dbCallMethods ?? [...DB_CALL_METHOD_NAMES];
             for (const receiver of receivers) {
                 for (const method of methods) {
                     const pattern = new RegExp(`\\b${escapeRegex(receiver)}\\.${escapeRegex(method)}\\s*\\(`);
@@ -509,7 +479,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             }
         }
         // Check for SQL tagged template literals (syntax feature, not naming convention)
-        const sqlTags = config.sqlTagNames ?? ['sql', 'db'];
+        const sqlTags = config.sqlTagNames ?? [...SQL_TAG_NAMES];
         for (const tag of sqlTags) {
             const pattern = new RegExp(`\\b${escapeRegex(tag)}\`\\s*SELECT|\\b${escapeRegex(tag)}\`\\s*INSERT|\\b${escapeRegex(tag)}\`\\s*UPDATE|\\b${escapeRegex(tag)}\`\\s*DELETE|\\b${escapeRegex(tag)}\`\\s*CREATE`, 'i');
             if (pattern.test(sourceCode))
@@ -527,7 +497,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
      */
     findTableReferences(ast, adapter, sourceCode, config, provenanceContext, allTables) {
         const references = [];
-        const sqlTags = config.sqlTagNames ?? ['sql', 'db'];
+        const sqlTags = config.sqlTagNames ?? [...SQL_TAG_NAMES];
         // (1) Tagged template SQL — e.g. sql`SELECT * FROM heroes`
         // This is a syntax feature, not a naming convention — keep the sqlTagNames gate.
         const taggedTemplates = adapter.findNodes(ast, {
@@ -564,8 +534,8 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                 const callee = this.getCallee(node, adapter, sourceCode);
                 if (!callee)
                     return false;
-                const dbMethods = config.dbCallMethods ?? ['exec', 'prepare', 'batch', 'run', 'all', 'first', 'query'];
-                const dbReceivers = config.dbReceiverNames ?? ['db', 'database', 'sql', 'stmt'];
+                const dbMethods = config.dbCallMethods ?? [...DB_CALL_METHOD_NAMES];
+                const dbReceivers = config.dbReceiverNames ?? [...DB_RECEIVER_NAMES];
                 return this.isDbMemberCall(node, callee, dbMethods, dbReceivers, adapter, sourceCode);
             },
         });
@@ -619,8 +589,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
      */
     recordTableUsage(ast, adapter, filePath, references) {
         try {
-            const db = CodeIndexDB.getInstance(undefined, this.projectRoot);
-            db.clearSchemaUsageForFile(filePath);
+            this._pendingSchemaRecords.clearFiles.push(filePath);
             for (const ref of references) {
                 // Find enclosing function from the AST position
                 const node = this.findClosestNodeAt(ast.root, ref.location, adapter);
@@ -629,7 +598,7 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     : ast.filePath.endsWith('.sql') || ast.filePath.includes('/migrations/')
                         ? 'schema-file'
                         : 'top-level';
-                const usage = {
+                this._pendingSchemaRecords.usages.push({
                     tableName: ref.table,
                     filePath,
                     functionName,
@@ -637,14 +606,19 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
                     line: ref.location.line,
                     column: ref.location.column,
                     rawQuery: ref.context,
-                };
-                db.recordSchemaUsage(usage);
+                });
             }
         }
         catch {
             // Schema recording is best-effort — failures don't block analysis.
         }
     }
+    /** Spec 25 B4 — Drain pending schema records for the pipeline to write. */
+    getPendingSchemaRecords() {
+        const records = this._pendingSchemaRecords;
+        this._pendingSchemaRecords = { clearFiles: [], usages: [] };
+        return records;
+    }
     /**
      * Parse SQL table names from a SQL text string.
      * R2.3: Template expressions (${...}) resolve portions to wildcards.
@@ -1164,23 +1138,68 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
     // ---------------------------------------------------------------------------
     // JSON Schema validation (unchanged from original)
     // ---------------------------------------------------------------------------
-    async analyzeJsonSchemas(files, config) {
+    /**
+     * Analyze JSON schemas and validate data files against them.
+     *
+     * Pipeline-refactored: accepts a Map of pre-loaded JSON contents instead of
+     * reading from the filesystem, so this can run inside a Stage 3 reducer.
+     *
+     * @param jsonContents Map from filePath → { parsed: pre-parsed object or null, raw: string }
+     * @param config Schema analyzer configuration
+     */
+    analyzeJsonSchemas(jsonContents, config) {
         const violations = [];
         const errors = [];
         let filesProcessed = 0;
         const startTime = Date.now();
         const finalConfig = { ...DEFAULT_SCHEMA_CONFIG, ...config };
         if (!finalConfig.validateJsonSchemas) {
-            return { violations, errors, filesProcessed, executionTime: 0 };
+            return { violations, errors, status: makeVisitorStatus(filesProcessed), executionTime: 0, analyzerName: this.name };
         }
+        const files = Array.from(jsonContents.keys());
         const schemaFiles = this.identifySchemaFiles(files, finalConfig);
         const dataFiles = this.identifyDataFiles(files, finalConfig);
         const unknownJsonFiles = files.filter(f => !schemaFiles.includes(f) && !dataFiles.includes(f));
+        // Helper: parse from Map content (with fallback)
+        const getParsed = (filePath) => {
+            const entry = jsonContents.get(filePath);
+            if (!entry)
+                return null;
+            if (entry.parsed !== null)
+                return entry.parsed;
+            try {
+                return JSON.parse(entry.raw);
+            }
+            catch {
+                return null;
+            }
+        };
         const schemas = new Map();
         for (const file of schemaFiles) {
             try {
-                const content = await fs.readFile(file, 'utf8');
-                const schema = JSON.parse(content);
+                const entry = jsonContents.get(file);
+                const content = entry?.raw;
+                if (!content) {
+                    violations.push({
+                        file,
+                        line: 1,
+                        column: 1,
+                        severity: 'warning',
+                        message: `Content not available for schema file`,
+                        rule: 'file-error',
+                        analyzer: 'schema'
+                    });
+                    filesProcessed++;
+                    continue;
+                }
+                const schema = entry.parsed ?? (() => { try {
+                    return JSON.parse(content);
+                }
+                catch {
+                    return null;
+                } })();
+                if (schema === null)
+                    throw new SyntaxError('JSON parse failed');
                 schemas.set(file, schema);
                 const fileViolations = this.validateJsonSchema(schema, file, finalConfig);
                 violations.push(...fileViolations);
@@ -1209,13 +1228,28 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         if (finalConfig.schemaDataPairs) {
             for (const pair of finalConfig.schemaDataPairs) {
-                const schema = schemas.get(pair.schema) || await this.loadSchema(pair.schema);
+                const schema = schemas.get(pair.schema) ?? getParsed(pair.schema);
                 if (schema) {
                     const dataFiles = Array.isArray(pair.data) ? pair.data : [pair.data];
                     for (const dataFile of dataFiles) {
                         if (files.includes(dataFile)) {
-                            const dataViolations = await this.validateDataAgainstSchema(dataFile, schema, finalConfig);
-                            violations.push(...dataViolations);
+                            const parsed = getParsed(dataFile);
+                            if (parsed !== null) {
+                                const dataViolations = [];
+                                this.validateAgainstSchema(parsed, schema, dataFile, dataViolations, finalConfig);
+                                violations.push(...dataViolations);
+                            }
+                            else {
+                                violations.push({
+                                    file: dataFile,
+                                    line: 1,
+                                    column: 1,
+                                    severity: 'warning',
+                                    message: 'Invalid JSON in data file',
+                                    rule: 'invalid-json',
+                                    analyzer: 'schema'
+                                });
+                            }
                             filesProcessed++;
                         }
                     }
@@ -1226,21 +1260,22 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             for (const dataFile of [...dataFiles, ...unknownJsonFiles]) {
                 const matchedSchema = this.findMatchingSchema(dataFile, schemas, finalConfig);
                 if (matchedSchema) {
-                    const dataViolations = await this.validateDataAgainstSchema(dataFile, matchedSchema, finalConfig);
-                    violations.push(...dataViolations);
+                    const parsed = getParsed(dataFile);
+                    if (parsed !== null) {
+                        const dataViolations = [];
+                        this.validateAgainstSchema(parsed, matchedSchema, dataFile, dataViolations, finalConfig);
+                        violations.push(...dataViolations);
+                    }
                 }
                 else if (unknownJsonFiles.includes(dataFile)) {
-                    try {
-                        const content = await fs.readFile(dataFile, 'utf8');
-                        JSON.parse(content);
-                    }
-                    catch (error) {
+                    const parsed = getParsed(dataFile);
+                    if (parsed === null) {
                         violations.push({
                             file: dataFile,
                             line: 1,
                             column: 1,
                             severity: 'warning',
-                            message: `Invalid JSON: ${error instanceof Error ? error.message : 'Parse error'}`,
+                            message: `Invalid JSON: Parse error`,
                             rule: 'invalid-json',
                             analyzer: 'schema'
                         });
@@ -1252,8 +1287,9 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         return {
             violations,
             errors,
-            filesProcessed,
-            executionTime: Date.now() - startTime
+            status: makeVisitorStatus(filesProcessed),
+            executionTime: Date.now() - startTime,
+            analyzerName: this.name,
         };
     }
     validateJsonSchema(schema, filePath, config) {
@@ -1357,15 +1393,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
             });
         });
     }
-    async loadSchema(schemaPath) {
-        try {
-            const content = await fs.readFile(schemaPath, 'utf8');
-            return JSON.parse(content);
-        }
-        catch {
-            return null;
-        }
-    }
     findMatchingSchema(dataFile, schemas, config) {
         const dataFileName = dataFile.split('/').pop() || '';
         const dataBaseName = dataFileName.replace(/\.(data|example|test)\.json$/, '');
@@ -1381,39 +1408,6 @@ export class UniversalSchemaAnalyzer extends UniversalAnalyzer {
         }
         return null;
     }
-    async validateDataAgainstSchema(dataFile, schema, config) {
-        const violations = [];
-        try {
-            const content = await fs.readFile(dataFile, 'utf8');
-            const data = JSON.parse(content);
-            this.validateAgainstSchema(data, schema, dataFile, violations, config);
-        }
-        catch (error) {
-            if (error instanceof SyntaxError) {
-                violations.push({
-                    file: dataFile,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `Invalid JSON: ${error.message}`,
-                    rule: 'invalid-json',
-                    analyzer: 'schema'
-                });
-            }
-            else {
-                violations.push({
-                    file: dataFile,
-                    line: 1,
-                    column: 1,
-                    severity: 'warning',
-                    message: `Error reading file: ${error instanceof Error ? error.message : 'Unknown error'}`,
-                    rule: 'file-error',
-                    analyzer: 'schema'
-                });
-            }
-        }
-        return violations;
-    }
     validateAgainstSchema(data, schema, filePath, violations, config, path = '') {
         if (schema.type) {
             const actualType = Array.isArray(data) ? 'array' :