code-auditor-mcp 3.9.0 → 3.9.2

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "code-auditor",
       "source": "./plugin",
       "description": "Diff-scoped code quality auditing on every edit. Indexes your codebase, enforces invariants, and feeds violations back to the agent so fixes happen inline.",
-      "version": "3.9.0",
+      "version": "3.9.2",
       "author": {
         "name": "Ben Hammond"
       },

package/CHANGELOG.md

@@ -2,6 +2,101 @@
 
 All notable changes to the Code Auditor MCP project.
 
+## [3.9.2] — 2026-09-11
+
+### Severity as urgency, not permission (Spec 54)
+
+The severity vocabulary is relabeled from `critical` / `warning` / `suggestion`
+to **`critical`** / **`severe`** / **`high`**. Every level is now a defect; the
+axis is *how fast it bites you*, not how optional the fix is:
+
+- **`critical`** — exploitable or broken now.
+- **`severe`** — wrong, and it will surface.
+- **`high`** — wrong, and it has not bitten yet.
+
+There is no fourth rung below `high`; the advisory `suggestion` tier is gone,
+and a `high` finding now blocks the gate with exit 2. Every reading is a defect
+and the severity is only the order to act.
+
+- **Old-scheme machinery removed** — `gateSeverities`, `severityOverrides`, and
+  path-profile severity capping are gone; `excludeFromGate` remains.
+- **SARIF** maps all three levels to `error` (the lower two no longer downgrade).
+- **Every surface updated** — CLI, JSON/HTML/CSV/SARIF reports, SKILL docs,
+  the rule registry, message templates, and the six-locale docs site.
+- **Full ledger** — every rule reassigned from scratch in
+  `specs/severity-assignment-ledger.md`: 111 rules at 8 `critical` / 37 `severe` /
+  56 `high`.
+- **No detection change** — corpus baselines re-measured and unchanged; this is
+  a relabel only, not a behavior change.
+
+## [3.9.1] — 2026-09-11
+
+### Findings from a real D1/Workers audit (Spec 52)
+
+Three defects surfaced by auditing an unseen Cloudflare D1 project, each fixed
+with a false-positive / true-positive two-direction proof:
+
+- **`loop-query` treated statement construction as execution (R1).** `.prepare()` /
+  `.bind()` build a statement object with no I/O; execution happens only at
+  `.run()` / `.all()` / `.first()` / `.raw()` / `.exec()` / `.batch()`. The
+  accumulate-then-batch shape (`stmts.push(db.prepare(sql).bind(x))` consumed by
+  a single `.batch()` after the loop) is no longer flagged, while a genuine N+1 —
+  an eager call in a loop, *including* `db.prepare(sql).bind(x).run()` — still
+  fires. `too-many-queries` no longer counts `.prepare()` SQL, but now counts the
+  eager execution methods (`.run()` / `.all()` / `.first()` / `.raw()` /
+  `.batch()`, including the typed D1 forms `.all<T>()` / `.first<T>()`), so a
+  genuine `db.prepare(sql).bind(x).all<Row>()` chain is still counted while a
+  pure statement factory is not. `Promise.all(...)` is excluded and `.exec()` is
+  deliberately not counted (indistinguishable from `regex.exec()` in a text
+  heuristic).
+- **`INSERT OR IGNORE` and friends were not recognized as writes (R2).** The write
+  classifier now matches `INSERT OR IGNORE INTO`, `INSERT OR REPLACE INTO`,
+  `REPLACE INTO`, and `INSERT … ON CONFLICT … DO UPDATE`, so the write set that
+  `written-never-read` / `read-never-written` / `multi-table-write` /
+  `unknown-table` read is correct.
+- **Whole-program rules were unsound under a scoped run (R3).**
+  `written-never-read`, `read-never-written`, `no-validator-reachable`, and
+  `unknown-table` draw a global conclusion that a partial file set cannot
+  support, so a scoped/diff run now reports them `notApplicable` ("requires
+  whole-project analysis; this run was scoped to N file(s)") rather than firing
+  an unqualified global claim. Full runs are unchanged.
+
+Edge-case follow-up (same pass): `loop-query`'s `Promise.all` guard now also
+crosses an arrow function — `Promise.all(rows.map(r => db.prepare(sql).bind(r)))`
+in a loop is statement construction (not N+1), while
+`Promise.all(rows.map(r => db.prepare(sql).bind(r).all()))` still fires. And
+`countQueries` no longer double-counts the `DO UPDATE` / `KEY UPDATE` clause of
+an upsert as a second query (knex `too-many-queries` 196 → 193).
+
+### ZCode installation support
+Added first-class ZCode (Z.AI's agentic AI coding IDE) support:
+- `code-audit install --agent zcode` installs the skill (ZCode reads the `.agents`
+  skills convention).
+- The `generate` MCP tool now emits ZCode MCP config — `.zcode/config.json`
+  (project scope) or `~/.zcode/cli/config.json` (user scope), using ZCode's
+  native `mcp.servers` key.
+
+### `solid/dependency-inversion` — escapes-vs-held false positive
+An external audit found the rule firing on `new AppError(...)` thrown from a
+Durable Object method — a *value type*, not a collaborator the class holds. The
+predicate now distinguishes **escapes** from **held**: a construction whose value
+is thrown or returned is a value type (not a dependency); one assigned to a field
+or captured as state is a dependency. The escape check walks through transparent
+wrappers (`parenthesized_expression`, `as_expression`, `type_assertion`,
+`satisfies_expression`, `non_null_expression`), so `return new Foo() as Bar` and
+`throw (new AppError())` are also cleared. This clears `throw new AppError(...)`
+and `return new Foo(...)` factory values while every held-collaborator positive
+still fires. Corpus deltas (only this rule moved): knex 20 → 12 (−8, dialect/Client
+factory accessors that `return new QueryBuilder(this)` etc.), blitz 12 → 11
+(−1, a `return new Response(...)` value). recall-protocol (3), hhra-org (8),
+primer-css (0) unchanged — no weakening to zero. Survivors sampled and confirmed
+field-held collaborators: `GuildAgent` (`this.#migrations = new SQLSchemaMigrations(...)`),
+`StrategistManager` (`this.reconnect = new ReconnectController(...)`),
+`OrgTrackerDatabase` (`this.pool = new Pool(...)`), `Client`
+(`this.logger = new Logger(...)` / `this.pool = new KnexPool(...)` — fires despite
+its many `return new X()` factory accessors), `Generator`
+(`this.enquirer = new Enquirer()`).
+
 ## [3.9.0] — 2026-09-09
 
 ### SQLite without a native install (Spec 51)

package/README.md

@@ -79,6 +79,7 @@ One skill, one CLI, one MCP server. Every agent gets the same audit engine — t
 | Gemini CLI | `code-audit install --agent gemini` | No | Yes | 2026-07-19 |
 | VS Code / Copilot | `code-audit install --agent agents` | No | Yes | 2026-07-19 |
 | Other SKILL.md tools | `code-audit install --agent agents` | No | Yes | 2026-07-19 |
+| ZCode | `code-audit install --agent zcode` | No (plugin-scoped) | Yes | 2026-09-10 |
 
 Hook behavior: **Blocking** means the diff-scoped `changed` gate is tripped — an invariant rule that declares `gating: true` (a binary, per-rule flag, independent of severity) blocks the edit from landing (the agent sees the violation and fixes inline). **Advisory** means violations are reported through the strongest available feedback channel but the edit has already occurred. Cursor's `afterFileEdit` hook is fire-and-forget with no output consumption. MCP is available everywhere for shell-less use.
 

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Spec-52 R1 item 1 — loop-query FALSE positive (oracle: MUST NOT fire).
+ *
+ * `db.prepare(sql)` inside a loop builds a statement object; it performs no I/O.
+ * The statements are accumulated and executed once by a single `.batch()` after
+ * the loop. This is the `mod.ts:213/218/223/266` shape — not an N+1.
+ */
+interface Row {
+    id: number;
+    name: string;
+}
+export declare function insertMany(db: any, rows: Row[]): Promise<void>;
+export {};
+//# sourceMappingURL=item-01-prepare-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-01-prepare-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-01-prepare-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,GAAG;IACX,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAOpE"}

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.js

@@ -0,0 +1,16 @@
+/**
+ * Spec-52 R1 item 1 — loop-query FALSE positive (oracle: MUST NOT fire).
+ *
+ * `db.prepare(sql)` inside a loop builds a statement object; it performs no I/O.
+ * The statements are accumulated and executed once by a single `.batch()` after
+ * the loop. This is the `mod.ts:213/218/223/266` shape — not an N+1.
+ */
+export async function insertMany(db, rows) {
+    const stmts = [];
+    for (const row of rows) {
+        const stmt = db.prepare('INSERT INTO items (id, name) VALUES (?, ?)');
+        stmts.push(stmt);
+    }
+    await db.batch(stmts);
+}
+//# sourceMappingURL=item-01-prepare-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-01-prepare-in-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-01-prepare-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-01-prepare-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAO,EAAE,IAAW;IACnD,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC;QACtE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Spec-52 R1 item 2 — accumulate-then-batch (oracle: MUST NOT fire).
+ *
+ * The explicit accumulate-then-batch shape: each loop iteration prepares and
+ * binds a statement (statement construction — no I/O), pushes it to an array,
+ * and a single `.batch()` after the loop executes them all. The eager call sits
+ * outside the loop, so this is not an N+1.
+ */
+interface ScoreRow {
+    id: number;
+    score: number;
+}
+export declare function rescoreMany(db: any, items: ScoreRow[]): Promise<void>;
+export {};
+//# sourceMappingURL=item-02-prepare-bind-accumulate-batch.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-02-prepare-bind-accumulate-batch.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,QAAQ;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAO3E"}

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.js

@@ -0,0 +1,17 @@
+/**
+ * Spec-52 R1 item 2 — accumulate-then-batch (oracle: MUST NOT fire).
+ *
+ * The explicit accumulate-then-batch shape: each loop iteration prepares and
+ * binds a statement (statement construction — no I/O), pushes it to an array,
+ * and a single `.batch()` after the loop executes them all. The eager call sits
+ * outside the loop, so this is not an N+1.
+ */
+export async function rescoreMany(db, items) {
+    const stmts = [];
+    for (const item of items) {
+        const stmt = db.prepare('UPDATE scores SET score = ? WHERE id = ?').bind(item.score, item.id);
+        stmts.push(stmt);
+    }
+    await db.batch(stmts);
+}
+//# sourceMappingURL=item-02-prepare-bind-accumulate-batch.js.map

package/dist/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-02-prepare-bind-accumulate-batch.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-02-prepare-bind-accumulate-batch.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAO,EAAE,KAAiB;IAC1D,MAAM,KAAK,GAAc,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Spec-52 R1 item 3 — loop-query TRUE positive (oracle: MUST fire).
+ *
+ * `db.exec(sql)` inside a loop is an eager member call — immediate I/O on every
+ * iteration. This is the simplest genuine-N+1 positive arm: the prepare/bind
+ * skip must be surgical and leave eager member methods firing.
+ */
+interface ItemRow {
+    id: number;
+    name: string;
+}
+export declare function renameAll(db: any, items: ItemRow[]): Promise<void>;
+export {};
+//# sourceMappingURL=item-03-exec-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-03-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxE"}

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.js

@@ -0,0 +1,13 @@
+/**
+ * Spec-52 R1 item 3 — loop-query TRUE positive (oracle: MUST fire).
+ *
+ * `db.exec(sql)` inside a loop is an eager member call — immediate I/O on every
+ * iteration. This is the simplest genuine-N+1 positive arm: the prepare/bind
+ * skip must be surgical and leave eager member methods firing.
+ */
+export async function renameAll(db, items) {
+    for (const item of items) {
+        db.exec(`UPDATE items SET name = 'renamed' WHERE id = ${item.id}`);
+    }
+}
+//# sourceMappingURL=item-03-exec-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-03-exec-in-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-03-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-03-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAO,EAAE,KAAgB;IACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,EAAE,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Spec-52 R1 item 4 — loop-query TRUE positive (oracle: MUST fire).
+ *
+ * The `Leaderboard.ts:113` discriminating positive: `this.ctx.storage.sql.exec(...)`
+ * inside a loop. `.exec()` is an eager method (immediate I/O), so this is a real
+ * N+1 that must keep firing — the two-direction proof's positive arm.
+ */
+interface RankRow {
+    id: number;
+    rank: number;
+}
+export declare class Leaderboard {
+    private ctx;
+    constructor(ctx: {
+        storage: {
+            sql: {
+                exec: (query: string, ...bind: unknown[]) => void;
+            };
+        };
+    });
+    applyRanks(rows: RankRow[]): Promise<void>;
+}
+export {};
+//# sourceMappingURL=item-04-storage-sql-exec-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-04-storage-sql-exec-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,GAAG,CAA8E;IAEzF,YAAY,GAAG,EAAE;QAAE,OAAO,EAAE;YAAE,GAAG,EAAE;gBAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAA;aAAE,CAAA;SAAE,CAAA;KAAE,EAE3F;IAEK,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/C;CACF"}

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.js

@@ -0,0 +1,19 @@
+/**
+ * Spec-52 R1 item 4 — loop-query TRUE positive (oracle: MUST fire).
+ *
+ * The `Leaderboard.ts:113` discriminating positive: `this.ctx.storage.sql.exec(...)`
+ * inside a loop. `.exec()` is an eager method (immediate I/O), so this is a real
+ * N+1 that must keep firing — the two-direction proof's positive arm.
+ */
+export class Leaderboard {
+    ctx;
+    constructor(ctx) {
+        this.ctx = ctx;
+    }
+    async applyRanks(rows) {
+        for (const row of rows) {
+            this.ctx.storage.sql.exec('UPDATE leaderboard SET rank = ? WHERE id = ?', row.rank, row.id);
+        }
+    }
+}
+//# sourceMappingURL=item-04-storage-sql-exec-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-04-storage-sql-exec-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-04-storage-sql-exec-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,OAAO,WAAW;IACd,GAAG,CAA8E;IAEzF,YAAY,GAAgF;QAC1F,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;CACF"}

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Spec-52 R2 — the four SQLite/Postgres upsert write forms (oracle: all MUST be
+ * classified as `insert` writes).
+ *
+ * `INSERT OR IGNORE INTO`, `INSERT OR REPLACE INTO`, `REPLACE INTO`, and
+ * `INSERT INTO ... ON CONFLICT ... DO UPDATE` all mutate the target table; the
+ * write classifier previously only matched `INSERT INTO`, so every rule reading
+ * the write set (written-never-read, multi-table-write) missed them.
+ *
+ * This fixture is exercised by the spec-52 test through `parseSqlTables`, which
+ * is the table-extraction path that feeds `schema_usage.usage_type`.
+ */
+export declare const UPSERT_QUERIES: {
+    readonly insertOrIgnore: 'INSERT OR IGNORE INTO feature_flags (key, enabled) VALUES (?, ?)';
+    readonly insertOrReplace: 'INSERT OR REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)';
+    readonly replaceInto: 'REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)';
+    readonly onConflictDoUpdate: 'INSERT INTO feature_flags (key, enabled) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET enabled = excluded.enabled';
+};
+//# sourceMappingURL=item-05-upsert-forms.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-05-upsert-forms.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-05-upsert-forms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,cAAc;aACzB,cAAc,EACZ,kEAAkE;aACpE,eAAe,EACb,mEAAmE;aACrE,WAAW,EACT,yDAAyD;aAC3D,kBAAkB,EAChB,mHAAmH;CAC7G,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.js

@@ -0,0 +1,19 @@
+/**
+ * Spec-52 R2 — the four SQLite/Postgres upsert write forms (oracle: all MUST be
+ * classified as `insert` writes).
+ *
+ * `INSERT OR IGNORE INTO`, `INSERT OR REPLACE INTO`, `REPLACE INTO`, and
+ * `INSERT INTO ... ON CONFLICT ... DO UPDATE` all mutate the target table; the
+ * write classifier previously only matched `INSERT INTO`, so every rule reading
+ * the write set (written-never-read, multi-table-write) missed them.
+ *
+ * This fixture is exercised by the spec-52 test through `parseSqlTables`, which
+ * is the table-extraction path that feeds `schema_usage.usage_type`.
+ */
+export const UPSERT_QUERIES = {
+    insertOrIgnore: 'INSERT OR IGNORE INTO feature_flags (key, enabled) VALUES (?, ?)',
+    insertOrReplace: 'INSERT OR REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)',
+    replaceInto: 'REPLACE INTO feature_flags (key, enabled) VALUES (?, ?)',
+    onConflictDoUpdate: 'INSERT INTO feature_flags (key, enabled) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET enabled = excluded.enabled',
+};
+//# sourceMappingURL=item-05-upsert-forms.js.map

package/dist/__tests__/fixtures/spec-52/item-05-upsert-forms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-05-upsert-forms.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-05-upsert-forms.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,cAAc,EACZ,kEAAkE;IACpE,eAAe,EACb,mEAAmE;IACrE,WAAW,EACT,yDAAyD;IAC3D,kBAAkB,EAChB,mHAAmH;CAC7G,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Spec-52 R1 item 6 — chained prepare→bind→run in a loop (oracle: MUST fire).
+ *
+ * `db.prepare(sql).bind(x).run()` executes I/O on every iteration. Unlike the
+ * accumulate-then-batch shape (where the statement is pushed to an array and a
+ * single `.batch()` runs after the loop), the eager `.run()` sits *inside* the
+ * loop here, so this is a genuine N+1. The prepare/bind skip must be surgical:
+ * it skips standalone construction but leaves a prepare/bind that is chained
+ * into an eager call firing.
+ */
+interface SyncJob {
+    id: number;
+    slug: string;
+}
+export declare function syncBuildsForHeroes(db: any, jobs: SyncJob[]): Promise<void>;
+export {};
+//# sourceMappingURL=item-06-chained-prepare-run-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-06-chained-prepare-run-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CASjF"}

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.js

@@ -0,0 +1,19 @@
+/**
+ * Spec-52 R1 item 6 — chained prepare→bind→run in a loop (oracle: MUST fire).
+ *
+ * `db.prepare(sql).bind(x).run()` executes I/O on every iteration. Unlike the
+ * accumulate-then-batch shape (where the statement is pushed to an array and a
+ * single `.batch()` runs after the loop), the eager `.run()` sits *inside* the
+ * loop here, so this is a genuine N+1. The prepare/bind skip must be surgical:
+ * it skips standalone construction but leaves a prepare/bind that is chained
+ * into an eager call firing.
+ */
+export async function syncBuildsForHeroes(db, jobs) {
+    for (const job of jobs) {
+        await db
+            .prepare(`UPDATE sync_jobs SET status = 'running', started_at = datetime('now') WHERE id = ?`)
+            .bind(job.id)
+            .run();
+    }
+}
+//# sourceMappingURL=item-06-chained-prepare-run-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-06-chained-prepare-run-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-06-chained-prepare-run-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAO,EAAE,IAAe;IAChE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,EAAE;aACL,OAAO,CACN,oFAAoF,CACrF;aACA,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;aACZ,GAAG,EAAE,CAAC;IACX,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Spec-52 R1 item 7 — chained prepare→bind→first<Row>() in a loop (oracle: MUST fire).
+ *
+ * The typed-read N+1: `.first<Row>()` (and `.all<Row>()`) is the D1 read idiom.
+ * The generic type argument must not hide the eager method from detection — the
+ * same gap that bit `too-many-queries`'s text regex. The AST path reads the
+ * property name directly, so `first` is visible regardless of `<Row>`.
+ */
+interface HeroRow {
+    id: number;
+    name: string;
+}
+interface Statement {
+    bind(...args: unknown[]): Statement;
+    first<T>(): T | null;
+    all<T>(): T[];
+    run(): unknown;
+}
+interface Db {
+    prepare(sql: string): Statement;
+    batch(stmts: unknown[]): unknown;
+}
+export declare function fetchHeroById(db: Db, ids: number[]): Promise<HeroRow[]>;
+export {};
+//# sourceMappingURL=item-07-chained-prepare-bind-first-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-07-chained-prepare-bind-first-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAID,UAAU,SAAS;IACjB,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC;IACpC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACrB,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACd,GAAG,IAAI,OAAO,CAAC;CAChB;AACD,UAAU,EAAE;IACV,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,KAAK,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;CAClC;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAU7E"}

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.js

@@ -0,0 +1,21 @@
+/**
+ * Spec-52 R1 item 7 — chained prepare→bind→first<Row>() in a loop (oracle: MUST fire).
+ *
+ * The typed-read N+1: `.first<Row>()` (and `.all<Row>()`) is the D1 read idiom.
+ * The generic type argument must not hide the eager method from detection — the
+ * same gap that bit `too-many-queries`'s text regex. The AST path reads the
+ * property name directly, so `first` is visible regardless of `<Row>`.
+ */
+export async function fetchHeroById(db, ids) {
+    const out = [];
+    for (const id of ids) {
+        const row = await db
+            .prepare('SELECT id, name FROM heroes WHERE id = ?')
+            .bind(id)
+            .first();
+        if (row)
+            out.push(row);
+    }
+    return out;
+}
+//# sourceMappingURL=item-07-chained-prepare-bind-first-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-07-chained-prepare-bind-first-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-07-chained-prepare-bind-first-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAoBH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAM,EAAE,GAAa;IACvD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,OAAO,CAAC,0CAA0C,CAAC;aACnD,IAAI,CAAC,EAAE,CAAC;aACR,KAAK,EAAW,CAAC;QACpB,IAAI,GAAG;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Spec-52 R1 item 8 — Promise.all of plain statements in a loop (oracle: MUST NOT fire).
+ *
+ * `Promise.all([db.prepare(sql).bind(x), …])` wraps *statement objects* (no
+ * `.run()`/`.all()`/`.first()`), so nothing executes inside the loop. This is
+ * construction, not an N+1. `Promise.all` must not be misread as the eager D1
+ * `.all()` method just because its property name is "all".
+ */
+interface ItemRow {
+    id: number;
+    name: string;
+}
+export declare function stageMany(db: any, items: ItemRow[]): Promise<unknown[]>;
+export {};
+//# sourceMappingURL=item-08-promise-all-of-statements-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-08-promise-all-of-statements-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAW7E"}

package/dist/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.js

@@ -0,0 +1,19 @@
+/**
+ * Spec-52 R1 item 8 — Promise.all of plain statements in a loop (oracle: MUST NOT fire).
+ *
+ * `Promise.all([db.prepare(sql).bind(x), …])` wraps *statement objects* (no
+ * `.run()`/`.all()`/`.first()`), so nothing executes inside the loop. This is
+ * construction, not an N+1. `Promise.all` must not be misread as the eager D1
+ * `.all()` method just because its property name is "all".
+ */
+export async function stageMany(db, items) {
+    const staged = [];
+    for (const item of items) {
+        staged.push(await Promise.all([
+            db.prepare('SELECT id FROM items WHERE id = ?').bind(item.id),
+            db.prepare('SELECT name FROM items WHERE id = ?').bind(item.id),
+        ]));
+    }
+    return staged;
+}
+//# sourceMappingURL=item-08-promise-all-of-statements-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-08-promise-all-of-statements-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-08-promise-all-of-statements-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAO,EAAE,KAAgB;IACvD,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,EAAE,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;SAChE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Spec-52 R1 item 9 — Promise.all of a .map() of plain statements (oracle: MUST NOT fire).
+ *
+ * `Promise.all(rows.map(r => db.prepare(sql).bind(r)))` wraps *statement
+ * objects* (no `.run()`/`.all()`/`.first()`), so nothing executes inside the
+ * loop. The walk-up must cross the arrow function boundary and still recognise
+ * `Promise.all` as the promise combinator, not the eager D1 `.all()`.
+ */
+interface ItemRow {
+    id: number;
+}
+export declare function stageMapped(db: any, rows: ItemRow[]): Promise<void>;
+export {};
+//# sourceMappingURL=item-09-promise-all-map-of-statements-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-09-promise-all-map-of-statements-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzE"}

package/dist/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.js

@@ -0,0 +1,14 @@
+/**
+ * Spec-52 R1 item 9 — Promise.all of a .map() of plain statements (oracle: MUST NOT fire).
+ *
+ * `Promise.all(rows.map(r => db.prepare(sql).bind(r)))` wraps *statement
+ * objects* (no `.run()`/`.all()`/`.first()`), so nothing executes inside the
+ * loop. The walk-up must cross the arrow function boundary and still recognise
+ * `Promise.all` as the promise combinator, not the eager D1 `.all()`.
+ */
+export async function stageMapped(db, rows) {
+    for (const row of rows) {
+        await Promise.all(rows.map((r) => db.prepare('SELECT id FROM items WHERE id = ?').bind(r.id)));
+    }
+}
+//# sourceMappingURL=item-09-promise-all-map-of-statements-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-09-promise-all-map-of-statements-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-09-promise-all-map-of-statements-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAO,EAAE,IAAe;IACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Spec-52 R1 item 10 — Promise.all of a .map() of eager `.all()` calls (oracle: MUST fire).
+ *
+ * The discriminating positive for the Promise.all guard: `Promise.all` is a
+ * promise combinator and must be *skipped*, but the eager D1 `.all()` on each
+ * mapped statement still executes per row — a genuine N+1. Crossing the arrow
+ * function to reach the eager method (and skip the combinator on the way) is
+ * exactly what the guard must get right.
+ */
+interface ItemRow {
+    id: number;
+}
+export declare function fetchMapped(db: any, rows: ItemRow[]): Promise<unknown[]>;
+export {};
+//# sourceMappingURL=item-10-promise-all-map-of-eager-all-in-loop.d.ts.map

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-10-promise-all-map-of-eager-all-in-loop.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,UAAU,OAAO;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAsB,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAO9E"}

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.js

@@ -0,0 +1,16 @@
+/**
+ * Spec-52 R1 item 10 — Promise.all of a .map() of eager `.all()` calls (oracle: MUST fire).
+ *
+ * The discriminating positive for the Promise.all guard: `Promise.all` is a
+ * promise combinator and must be *skipped*, but the eager D1 `.all()` on each
+ * mapped statement still executes per row — a genuine N+1. Crossing the arrow
+ * function to reach the eager method (and skip the combinator on the way) is
+ * exactly what the guard must get right.
+ */
+export async function fetchMapped(db, rows) {
+    for (const row of rows) {
+        await Promise.all(rows.map((r) => db.prepare('SELECT id FROM items WHERE id = ?').bind(r.id).all()));
+    }
+    return [];
+}
+//# sourceMappingURL=item-10-promise-all-map-of-eager-all-in-loop.js.map

package/dist/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"item-10-promise-all-map-of-eager-all-in-loop.js","sourceRoot":"","sources":["../../../../src/__tests__/fixtures/spec-52/item-10-promise-all-map-of-eager-all-in-loop.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,EAAO,EAAE,IAAe;IACxD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,CAAC,GAAG,CACf,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/analyzers/analyzerUtils.js

@@ -146,7 +146,7 @@ export function filterViolationsBySeverity(violations, minSeverity) {
     if (!minSeverity) {
         return violations;
     }
-    const severityOrder = { critical: 3, warning: 2, suggestion: 1, off: 0 };
+    const severityOrder = { critical: 3, severe: 2, high: 1 };
     const minLevel = severityOrder[minSeverity] || 0;
     return violations.filter(v => severityOrder[v.severity] >= minLevel);
 }
@@ -158,7 +158,7 @@ export function filterViolationsBySeverity(violations, minSeverity) {
 export function sortViolations(violations) {
     return violations.sort((a, b) => {
         // Sort by severity first
-        const severityOrder = { critical: 3, warning: 2, suggestion: 1, off: 0 };
+        const severityOrder = { critical: 3, severe: 2, high: 1 };
         const severityDiff = severityOrder[b.severity] - severityOrder[a.severity];
         if (severityDiff !== 0)
             return severityDiff;