code-auditor-mcp 4.1.0 → 5.0.1

package/dist/analyzers/universal/UniversalDataAccessAnalyzer.js

@@ -3,21 +3,27 @@
  * Works across multiple programming languages using the adapter pattern
  * Analyzes database access patterns and data layer interactions
  */
-import { UniversalAnalyzer } from '../../languages/UniversalAnalyzer.js';
 import { withRuleTiming } from '../ruleTiming.js';
-import { buildProvenanceContext, isDBProvenanced, getCallExpressionCallee, DB_CALL_METHODS, ORM_METHODS, } from '../provenance.js';
-import { DB_RECEIVER_NAMES, DB_CALL_METHOD_NAMES, DB_BINDING_NAMES, DB_WRAPPER_NAMES, } from './UniversalSchemaAnalyzer.js';
-import { isSqlKeyword, findEnclosingFunctionIdentity, functionIdentityLabel } from './schema/codeAnalysis.js';
-import { isTestOrSpecPath } from '../../languages/testConventions.js';
-import { buildOrgFilterTierSet, tableRequiresOrgFilter } from '../orgFilterTiers.js';
-/**
- * SQL keywords recognized as evidence that a string is a SQL query.
- * Includes DML verbs (SELECT/INSERT/UPDATE/DELETE) and DDL verbs
- * (CREATE/DROP/ALTER/TRUNCATE) so DDL injection — e.g. a raw schema
- * migration built by concatenating an interpolated identifier — is
- * recognized as SQL rather than silently passing the keyword gate.
- * Single source of truth for both containsSQLKeywords and
- * containsSQLStructure to prevent drift.
+import { buildProvenanceContext, getCallExpressionCallee, getMemberExpressionReceiver, extractMemberExpressionProperty, resolveSiteDialect, } from '../provenance.js';
+import { extractStaticSql, extractGoStaticSql, isTemplateLiteral, isTaggedTemplateSqlCall, stripSqlQuotes } from '../sqlLiteral.js';
+import { isOrmMethod, handleTypesForPackage } from '../tsEcosystem.js';
+import { identifyHandle } from '../handleIdentification.js';
+import { buildBindingEnv, extractInterfaceFields, resolveReceiverRoot, isDbShapedRoot, findEnclosingClassHeritage, } from '../receiverRoot.js';
+import { buildGoBindingEnv, buildGoImportMap, classifyGoRootIdentifier, } from '../../languages/go/goResolution.js';
+import { DB_BINDING_NAMES, DB_WRAPPER_NAMES, SQL_TAG_NAMES, } from './UniversalSchemaAnalyzer.js';
+import { findEnclosingFunctionIdentity, functionIdentityLabel } from './schema/codeAnalysis.js';
+import { buildOrgFilterTierSet, tableRequiresOrgFilter, DEFAULT_ORG_PREDICATE_PATTERNS, hasOrganizationFilter, } from '../orgFilterTiers.js';
+import { resolveWhereBinding } from '../../phase/localBinding.js';
+import { parseSql, DEFAULT_SQL_DIALECT, extractTableNames, whereFacts, isWriteStatement, isMassWriteStatement, isUpsertStatement, whereColumnRefs, isDdlStatementKind, } from '../../languages/sql/sqlAst.js';
+/**
+ * SQL keywords recognized as evidence that a *dynamically-constructed* string is
+ * an injection surface — the host-language dataflow gate in `checkQuerySecurity`
+ * (site #11, not converted by R2). This list is NOT the SQL-ness admission gate:
+ * that decision is provenance/shape/tag-based (see `isSqlPosition` in
+ * `buildDatabaseCall`), and a keyword name list must not decide whether a string
+ * is SQL — it would silently drop keyword-less SQL (`PRAGMA`, `VACUUM`,
+ * `ANALYZE`) that provenance already establishes as SQL. `containsSQLStructure`
+ * is gone (R2 site #4); this list now feeds only `checkQuerySecurity`.
  */
 const SQL_KEYWORDS = [
     'SELECT', 'INSERT', 'UPDATE', 'DELETE', 'FROM', 'WHERE', 'JOIN',
@@ -27,39 +33,20 @@ export const DEFAULT_DATA_ACCESS_CONFIG = {
     checkOrgFilters: true,
     checkSQLInjection: true,
     skipTestFiles: true,
-    databases: {
-        'primary': {
-            name: 'Primary Database',
-            importPatterns: ['/database/', '/db/', './db', './schema', 'drizzle', 'prisma', 'typeorm', 'knex', 'sequelize'],
-            queryPatterns: ['select', 'insert', 'update', 'delete', 'query', 'execute'],
-            ormPatterns: ['from', 'where', 'join', 'orderBy', 'groupBy']
-        }
-    },
-    organizationPatterns: [
-        'organizationId',
-        'organization_id',
-        'orgId',
-        'org_id',
-        'tenantId',
-        'tenant_id',
-        'companyId',
-        'company_id'
-    ],
+    organizationPatterns: [...DEFAULT_ORG_PREDICATE_PATTERNS],
     // Spec 21 R6.2: three-tier org-filter detection
     orgFilterTables: [], // Tier 1: empty — user must declare
     orgFilterColumns: ['org_id', 'tenant_id', 'organization_id', 'workspace_id'], // Tier 2
     schemas: [], // Tier 2: schema definitions for column-based inference
     tablePatterns: {
+        // Only the non-structural `table: 'users'` / `table = "users"` shape remains
+        // here as a user-tunable text pattern. The `.from(x)` / join / Kysely-verb
+        // shapes are read structurally by `collectOrmTableReferences`, so they are
+        // NOT duplicated as regexes — a `.from(…)` inside a string argument must not
+        // read as a table.
         orm: [
-            /from\s*\(\s*["'`]?([\p{L}\p{N}_]+)["'`]?\s*\)/giu,
-            /table\s*[:=]\s*["'`]?([\p{L}\p{N}_]+)["'`]?/giu,
-            /\.from\s*\(\s*([\p{L}\p{N}_]+)\s*\)/giu, // Handle .from(users) where users is a variable
-            /join\s*\(\s*([\p{L}\p{N}_]+)\s*,/giu, // Handle joins
-            /leftJoin\s*\(\s*([\p{L}\p{N}_]+)\s*,/giu,
-            /rightJoin\s*\(\s*([\p{L}\p{N}_]+)\s*,/giu,
-            /innerJoin\s*\(\s*([\p{L}\p{N}_]+)\s*,/giu
+            /table\s*[:=]\s*["'`]?([\p{L}\p{N}_]+)["'`]?/giu
         ],
-        sql: [/\b(?:INSERT(?:\s+OR\s+(?:IGNORE|REPLACE))?|REPLACE)\s+INTO\s+["'`]?([\p{L}\p{N}_]+)["'`]?/giu, /DELETE\s+FROM\s+["'`]?([\p{L}\p{N}_]+)["'`]?/giu, /FROM\s+["'`]?([\p{L}\p{N}_]+)["'`]?/giu, /JOIN\s+["'`]?([\p{L}\p{N}_]+)["'`]?/giu, /UPDATE\s+["'`]?([\p{L}\p{N}_]+)["'`]?/giu],
         queryBuilder: [/\.from\s*\(\s*["'`]?([\p{L}\p{N}_]+)["'`]?\s*\)/giu]
     },
     performanceThresholds: {
@@ -77,10 +64,12 @@ export const DEFAULT_DATA_ACCESS_CONFIG = {
     dbWrapperNames: [...DB_WRAPPER_NAMES],
     // DB detection patterns — values shared with the schema analyzer, but owned by
     // THIS analyzer's namespace (no cross-analyzer fallback in analyzeAST).
-    dbReceiverNames: [...DB_RECEIVER_NAMES],
-    dbCallMethods: [...DB_CALL_METHOD_NAMES],
     dbBindingNames: [...DB_BINDING_NAMES],
+    sqlTagNames: [...SQL_TAG_NAMES],
     detection: { mode: 'hybrid' },
+    // Spec 70 R1 — no dialect until the corpus names one; the SQL-content facts
+    // then `cannot-fire` rather than being regex-derived.
+    dialect: null,
     // SQL sanitizer functions — interpolation via escapeSql(x) is not raw.
     sanitizerNames: ['escapeSql'],
 };
@@ -101,47 +90,406 @@ function makeViolation(file, location, message, classification) {
         analyzer: 'data-access'
     };
     if (classification.symbol)
-        v.functionName = classification.symbol;
+        v.symbol = classification.symbol;
     if (classification.resolution)
         v.resolution = classification.resolution;
     return v;
 }
 /**
- * Map imports to database types
+ * The four companion pairs of the query-builder chain grammar (Spec 68 Thing 2,
+ * #312). A verb admits a chain only when one of its required companions appears
+ * LATER in the same callee — this is the Drizzle/Kysely grammar and is pure
+ * syntax (no catalog, no name list).
+ */
+const QUERY_BUILDER_COMPANIONS = [
+    // `.select` also admits Drizzle's `.selectDistinct(…)` / `.selectDistinctOn(…)`
+    // — the same select verb followed by `.from(`; `.select\b` alone would miss the
+    // `Distinct` suffix (a word character breaks the boundary).
+    { verb: /\.select(?:DistinctOn|Distinct)?\b/, companions: [/\.from\b/] },
+    { verb: /\.insert\b/, companions: [/\.values\b/] },
+    { verb: /\.update\b/, companions: [/\.set\b/, /\.where\b/] },
+    { verb: /\.delete\b/, companions: [/\.where\b/] },
+];
+/**
+ * Admitter 1 — verb plus required companion, tested on the CALLEE text. The
+ * callee of the outermost call in a chain carries every earlier verb with its
+ * argument (e.g. `db.select({…}).from(users).where(…)` → callee text
+ * `db.select({…}).from(users).where`), so a single substring scan over the
+ * callee sees the whole grammar. The trailing verb appears without its paren
+ * (the arguments belong to the outermost call), so companions are matched with
+ * a word boundary, not `\(`. `map.delete(k)`, `createHash().update(b)`,
+ * `cookies.delete(n)` and `stripe.customers.update(id, data)` all lack the
+ * companion and fail.
+ */
+/**
+ * Collect the method names of a callee's member chain, left-to-right (base
+ * first), reading each property_identifier node. String arguments and
+ * subscripts are structural — a `.from(…)` inside a string argument is NOT a
+ * chain member, so it is not collected.
  */
-function mapDatabaseImports(imports, config) {
-    const dbImports = new Map();
-    Object.entries(config.databases || {}).forEach(([dbType, dbConfig]) => {
-        const hasImports = imports.some(imp => dbConfig.importPatterns.some(pattern => imp.source.includes(pattern)));
-        dbImports.set(dbType, {
-            hasImports,
-            patterns: [...dbConfig.queryPatterns, ...(dbConfig.ormPatterns || [])]
+function collectChainMethods(node, adapter, sourceCode, out = []) {
+    const t = adapter.getNodeType(node);
+    if (t === 'member_expression' || t === 'selector_expression') {
+        const children = adapter.getChildren(node);
+        const object = children.find((c) => {
+            const ct = adapter.getNodeType(c);
+            return ct !== '.' && ct !== 'property_identifier' && ct !== 'field_identifier';
         });
+        if (object)
+            collectChainMethods(object, adapter, sourceCode, out);
+        const prop = extractMemberExpressionProperty(node, adapter, sourceCode);
+        if (prop)
+            out.push(prop);
+    }
+    else if (t === 'call_expression') {
+        const callee = getCallExpressionCallee(node, adapter);
+        if (callee)
+            collectChainMethods(callee, adapter, sourceCode, out);
+    }
+    else if (t === 'subscript_expression') {
+        const children = adapter.getChildren(node);
+        const object = children.find((c) => {
+            const ct = adapter.getNodeType(c);
+            return ct !== '[' && ct !== ']';
+        });
+        if (object)
+            collectChainMethods(object, adapter, sourceCode, out);
+    }
+    return out;
+}
+function hasChainCompanion(methods) {
+    for (const { verb, companions } of QUERY_BUILDER_COMPANIONS) {
+        const verbIdx = methods.findIndex((m) => verb.test('.' + m));
+        if (verbIdx < 0)
+            continue;
+        const rest = methods.slice(verbIdx + 1);
+        if (rest.some((m) => companions.some((companion) => companion.test('.' + m))))
+            return true;
+    }
+    return false;
+}
+/** Prisma CRUD verbs admitted by the object-form shape (admitter 2). */
+const PRISMA_VERBS = new Set([
+    'create', 'createMany', 'update', 'updateMany', 'upsert',
+    'delete', 'deleteMany', 'findUnique', 'findFirst', 'findMany',
+    'findUniqueOrThrow', 'findFirstOrThrow', 'findRaw', 'count', 'groupBy', 'aggregate',
+]);
+/** Collect the property keys of an object literal, including its nested objects. */
+function collectObjectLiteralKeys(node, adapter, sourceCode) {
+    const keys = [];
+    const stack = [node];
+    while (stack.length) {
+        const n = stack.pop();
+        const t = adapter.getNodeType(n);
+        if (t === 'shorthand_property_identifier' || t === 'property_identifier') {
+            const txt = adapter.getNodeText(n, sourceCode)?.trim();
+            if (txt)
+                keys.push(txt);
+            continue;
+        }
+        for (const c of adapter.getChildren(n) ?? [])
+            stack.push(c);
+    }
+    return keys;
+}
+/**
+ * Admitter 2 — Prisma's object form: `<recv>.<Model>.<verb>({ … })` where the
+ * object-literal argument carries a `where` or `data` key. Option 1 (chained
+ * companions) misses this because the `where`/`data` are keys inside an object
+ * literal, not chained calls (blitz `prisma.user.update({ where, data })`).
+ */
+function isPrismaObjectForm(node, adapter, sourceCode) {
+    const callee = getCallExpressionCallee(node, adapter);
+    if (!callee || adapter.getNodeType(callee) !== 'member_expression')
+        return false;
+    // The chain must be `<recv>.<Model>.<verb>` — at least two member segments
+    // (the Model and the verb) read from their property nodes. A subscript like
+    // `obj["a.b"]` is not a Model segment, so `obj["a.b"].update(…)` has only one
+    // segment and fails.
+    const methods = collectChainMethods(callee, adapter, sourceCode);
+    if (methods.length < 2)
+        return false;
+    if (!PRISMA_VERBS.has(methods[methods.length - 1]))
+        return false;
+    const args = adapter.getChildren(node).find((c) => adapter.getNodeType(c) === 'arguments');
+    if (!args)
+        return false;
+    for (const arg of adapter.getChildren(args)) {
+        const keys = collectObjectLiteralKeys(arg, adapter, sourceCode);
+        if (keys.includes('where') || keys.includes('data'))
+            return true;
+    }
+    return false;
+}
+/**
+ * Spec 68 Thing 2 (#312) — the query-builder shape test.
+ *
+ * Answers "is this a DB query?" structurally, from the call's own grammar,
+ * instead of by the receiver's name. A chain that shapes like a Drizzle/Kysely
+ * builder or a Prisma CRUD call is a query regardless of whether its receiver
+ * is named `db`, `appDb`, `tx`, or `prisma`. This replaces the receiver-name
+ * blind spot (`DB_RECEIVER_NAMES`) without growing the name list — the raw-SQL
+ * path (`db.exec(sql)`) still relies on receiver/import provenance because it
+ * has no chain grammar to lean on.
+ *
+ * Two admitting conditions, union (not intersection):
+ *   1. verb + companion chain grammar — {@link hasChainCompanion};
+ *   2. Prisma object form — {@link isPrismaObjectForm}.
+ *
+ * A third admitter — catalog-resolved argument (a bare `.from(table)` /
+ * `.query(table)` whose verb argument resolves to a `resolution` table) —
+ * was evaluated and REJECTED. The residual gap after admitter 1+2 contains no
+ * such chain: the real misses are *variable-split* builders (the companion verb
+ * lives in a prior statement, e.g. `const q = baseQuery.where(…)`), which
+ * catalog resolution does not address. Gating on an under-discovered catalog
+ * would just rebuild the receiver-name failure one layer up. See the
+ * extraction-completeness gate (scripts/verify-extraction-completeness.ts) for
+ * the pinned residual.
+ *
+ * @param node the candidate call node to classify
+ * @param adapter the language adapter used to read the callee
+ * @param sourceCode the file source text for reading callee text
+ * @returns true when the call is query-builder shaped (chain companion or Prisma object form)
+ */
+export function isQueryBuilderShape(node, adapter, sourceCode) {
+    if (node.type !== 'call_expression')
+        return false;
+    const callee = getCallExpressionCallee(node, adapter);
+    if (!callee)
+        return false;
+    const methods = collectChainMethods(callee, adapter, sourceCode);
+    return hasChainCompanion(methods) || isPrismaObjectForm(node, adapter, sourceCode);
+}
+/**
+ * The single admission seam for a candidate node: resolve its handle-ness through
+ * `identifyHandle` (Spec 70 R1.2) and return the tri-state verdict, or `null`
+ * when the node is not a query-shaped DB/ORM call in the TypeScript family.
+ *
+ * The candidate *filter* (a DB/ORM method, or a provenanced wrapper name) is
+ * query-shape vocabulary — the same surface `isDBMethodCall` admitted — not a
+ * handle test. Handle-ness is decided once, here: a `handle` verdict admits the
+ * site (carrying `via`); `not-handle` rejects it; `unproven` admits it *as
+ * unproven* (carrying the reason) so downstream rules see the site and report
+ * `cannot-fire` rather than never seeing it. Admission is tri-state, not boolean.
+ */
+function handleVerdictForCall(node, scan) {
+    const { adapter, sourceCode, config, provenanceContext, handleEnv } = scan;
+    if (!provenanceContext)
+        return null;
+    // Go: declaration resolution runs through Go's own binding/import environment
+    // (provenance seed + bindings + imports), routed through the same
+    // `identifyHandle` seam. `classifyGoRootIdentifier` checks the provenance seed
+    // first, so a cross-file-resolved `db *sql.DB` proves `handle`; the seed also
+    // carries the receiver's package, so an unrecognized import stays `unproven`
+    // (cannot-fire) rather than being guessed `not-handle` (Spec 70 R4).
+    if (adapter.name === 'go') {
+        return goHandleVerdictForCall(node, scan);
+    }
+    if (!handleEnv)
+        return null;
+    // A template literal is admitted via the call whose argument it is.
+    const callNode = isTemplateLiteral(node, adapter) ? enclosingCallOf(node, adapter) : node;
+    if (!callNode || !isFunctionCall(callNode, adapter))
+        return null;
+    // A constructor call (`new Pool()`) is an instantiation — how a handle is
+    // *created* — not a data-access call itself. Its provenanced constructor
+    // proves the *binding* (`const db = new Pool()`); the constructor expression
+    // is never a query site, so admit nothing here. (Spec 70 R4)
+    if (callNode.type === 'new_expression')
+        return null;
+    const callee = getCallExpressionCallee(callNode, adapter);
+    if (!callee)
+        return null;
+    const dialect = resolveSiteDialect(callNode, adapter, sourceCode, provenanceContext) ??
+        config.dialect ?? null;
+    const facts = () => ({
+        imports: new Map(),
+        typeAnnotations: new Map(),
+        bindings: new Map(),
+        withinFileProvenance: new Map(),
+        sqlDialect: dialect,
+        resolution: { dialect: 'ts', env: handleEnv },
+    });
+    // Bare-identifier call (`query(…)` / `d1(…)`): admit a provenanced wrapper or a
+    // type-annotated handle (`const query: D1Database = …`), and let `identifyHandle`
+    // decide handle / not-handle / unproven on the one entry point. A truly unbound
+    // name (an ambient global like `someFunction`) is rejected here — not because its
+    // name proves non-handle, but because its SQL argument must not be allowed to
+    // *prove* handle-ness (R3) on a name with no DB signal at all. The candidate
+    // filter is a DB/ORM *shape* test (provenance or an explicit type annotation),
+    // never a handle decision.
+    if (callee.type === 'identifier') {
+        const name = adapter.getNodeText(callee, sourceCode);
+        if (!name)
+            return null;
+        const binding = handleEnv.bindings.get(name);
+        const isProvenanced = provenanceContext.dbProvenanced.has(name);
+        const isTypeAnnotated = !!binding &&
+            (binding.kind === 'variable' || binding.kind === 'field' || binding.kind === 'parameter') &&
+            !!binding.typeText;
+        // A named import from a manifest DB package (`import { eq } from
+        // 'drizzle-orm'`) is a DB *signal* even when the name isn't a handle — it
+        // must reach `identifyHandle` so it can be proven `not-handle`, not dropped
+        // here on the negative for want of evidence (Spec 70 — a site that stops
+        // being reported has to be proven not-a-handle).
+        const isDbPackageImport = !!binding && binding.kind === 'import' && handleTypesForPackage(binding.source ?? '') !== undefined;
+        if (!isProvenanced && !isTypeAnnotated && !isDbPackageImport)
+            return null;
+        return identifyHandle({
+            format: 'typescript',
+            root: name,
+            receiver: name,
+            method: name,
+            sqlArgument: extractStaticSql(callNode, adapter, sourceCode),
+            thisField: false,
+        }, facts());
+    }
+    if (callee.type !== 'member_expression' && callee.type !== 'selector_expression') {
+        return null;
+    }
+    const method = extractMemberExpressionProperty(callee, adapter, sourceCode);
+    if (!method)
+        return null;
+    const root = resolveReceiverRoot(callee, adapter, sourceCode);
+    if (root === null)
+        return null;
+    const sqlArg = extractStaticSql(callNode, adapter, sourceCode);
+    const thisRooted = receiverIsThisRooted(callee, adapter);
+    // Candidacy is the package discriminant — the receiver root's disposition, not
+    // the method name (`join` is `Array.prototype.join` and also `SQL JOIN`). A
+    // call is query-shaped when its receiver resolves handle/unproven, OR its
+    // argument is a static SQL literal (which `identifyHandle`'s sql-argument arm
+    // can prove). A provably non-DB receiver (JS global, primitive, Node builtin)
+    // with no static SQL is rejected here. A `this.<field>` root is a field
+    // reference, not an ambient global, so it stays `unproven` (admitted) rather
+    // than dropped as a phantom global.
+    if (sqlArg === null && !isDbShapedRoot(root, handleEnv, { thisField: thisRooted }))
+        return null;
+    const receiver = getMemberExpressionReceiver(callee, adapter, sourceCode) ?? root;
+    return identifyHandle({
+        format: 'typescript',
+        root,
+        receiver,
+        method,
+        sqlArgument: sqlArg,
+        thisField: thisRooted,
+    }, facts());
+}
+/**
+ * The Go arm of the admission seam: resolve a Go `selector_expression` call
+ * (`db.Query(…)`) through `identifyHandle` with Go's own resolution environment,
+ * instead of abstaining. Candidacy is a string-resolvable argument with a
+ * query-shaped-method backstop for the no-argument case; handle-ness is then
+ * decided once by the seam (`handle` via provenance seed, `unproven` via an
+ * unrecognized package, `not-handle` via a non-DB binding), never by a name list
+ * here.
+ */
+function goHandleVerdictForCall(node, scan) {
+    const { adapter, sourceCode, config, goEnv } = scan;
+    if (!goEnv)
+        return null;
+    if (!isFunctionCall(node, adapter))
+        return null;
+    const callee = getCallExpressionCallee(node, adapter);
+    if (!callee || callee.type !== 'selector_expression')
+        return null;
+    const method = extractMemberExpressionProperty(callee, adapter, sourceCode);
+    if (!method)
+        return null;
+    const root = resolveReceiverRoot(callee, adapter, sourceCode);
+    if (root === null)
+        return null;
+    const sqlArg = extractGoStaticSql(node, adapter, sourceCode, goEnv);
+    // Candidacy is the package discriminant — the receiver root's disposition, not
+    // the method name. A call is query-shaped when its receiver resolves
+    // handle/unproven, OR its argument is a static SQL literal (which
+    // `identifyHandle`'s sql-argument arm can prove). A provably non-DB receiver
+    // (stdlib package, primitive, non-DB binding) with no static SQL is rejected.
+    if (sqlArg === null && classifyGoRootIdentifier(root, goEnv) === 'not-handle')
+        return null;
+    const receiver = getMemberExpressionReceiver(callee, adapter, sourceCode) ?? root;
+    return identifyHandle({
+        format: 'go',
+        root,
+        receiver,
+        method,
+        sqlArgument: sqlArg,
+        thisField: false,
+    }, {
+        imports: new Map(),
+        typeAnnotations: new Map(),
+        bindings: new Map(),
+        withinFileProvenance: new Map(),
+        sqlDialect: config.dialect ?? null,
+        resolution: { dialect: 'go', env: goEnv },
     });
-    return dbImports;
+}
+/** Walk parents until an enclosing call/new expression, or null. */
+function enclosingCallOf(node, adapter) {
+    // A template literal is the SQL argument of a call only when it sits directly
+    // in that call's argument list (`db.prepare(\`…\`)`). A literal nested inside an
+    // arrow body, object literal, or array (`{ message: () => \`…is written (…)\` }`)
+    // is prose/config, not a query — walking past those boundaries attributes it to
+    // an unrelated enclosing call (`runUsageDirectionCheck(…, { message: … })`) and
+    // lets human-readable text reach the SQL parser. Only the immediate `arguments`
+    // admits the enclosing call; anything else is not a direct query argument.
+    let cur = adapter.getParent(node);
+    while (cur) {
+        const t = adapter.getNodeType(cur);
+        if (t === 'arguments') {
+            const call = adapter.getParent(cur);
+            return call && (adapter.getNodeType(call) === 'call_expression' || adapter.getNodeType(call) === 'new_expression')
+                ? call
+                : null;
+        }
+        // Tagged templates carry the literal as a direct child of the call (no
+        // `arguments`), but they are admitted separately by `isTaggedTemplateSqlCall`,
+        // never through this path — a literal not directly in `arguments` is not a
+        // positional SQL argument.
+        return null;
+    }
+    return null;
+}
+/** True when a receiver chain bottoms out at `this`/`super` (a field reference). */
+function receiverIsThisRooted(callee, adapter) {
+    let current = callee;
+    while (current.type === 'member_expression' || current.type === 'selector_expression') {
+        const children = adapter.getChildren(current);
+        const firstChild = children.find((c) => c.type !== '.' && c.type !== 'property_identifier' && c.type !== 'field_identifier');
+        if (!firstChild)
+            return false;
+        current = firstChild;
+    }
+    return current.type === 'this' || current.type === 'super';
 }
 /**
  * Predicate for the node-discovery pass of extractDatabaseCalls.  A node is a
- * candidate when it is a DB-provenanced function call, a template literal in a
- * DB-provenanced call's arguments, or a variable assignment holding SQL-shaped
- * text (Spec 17 R2 — content scanning is removed in favour of provenance).
+ * candidate when it is a DB/ORM-method call whose receiver is handle-or-unproven,
+ * a tagged-template SQL call, a variable assignment holding SQL-shaped text
+ * (Spec 17 R2 — content scanning is removed in favour of provenance), or a
+ * query-builder chain discovered by shape (Spec 68 Thing 2, #312).
  */
-function isDbCallCandidate(node, adapter, sourceCode, provenanceContext) {
-    const nodeText = stripComments(adapter.getNodeText(node, sourceCode));
-    // Check if it's a function call whose callee is DB-related
-    if (provenanceContext && isDBProvenancedFunctionCall(node, adapter, sourceCode, provenanceContext)) {
+function isDbCallCandidate(node, scan, tagNames = SQL_TAG_NAMES) {
+    const { adapter, sourceCode } = scan;
+    // Spec 70 R1.2: a DB/ORM-method call whose receiver resolves handle-or-unproven.
+    // `not-handle` (e.g. lodash `get`) and `null` (not query-shaped) are rejected.
+    const verdict = handleVerdictForCall(node, scan);
+    if (verdict !== null && verdict.kind !== 'not-handle')
+        return true;
+    // A query-builder chain is discovered by shape, not receiver name.
+    if (isQueryBuilderShape(node, adapter, sourceCode)) {
         return true;
     }
-    // Spec 17 R2: Template literals are SQL candidates because of where they sit
-    // (DB-provenanced call arguments), not what their body contains.
-    if (isTemplateLiteral(node, adapter)) {
-        return isTemplateInDBProvenancedCall(node, adapter, sourceCode, provenanceContext);
+    // Tagged-template SQL is a data-access call by tag name — no provenance needed.
+    if (isTaggedTemplateSqlCall(node, adapter, sourceCode, tagNames)) {
+        return true;
     }
-    // Variable assignment with SQL structure — no child template check: the
-    // template-literal path is now provenance-only (Spec 17 R2), so there is no
-    // overlap risk from child template detection.
+    // Variable assignment whose RHS is a static string/template literal — the
+    // string parses as a statement or it does not (Spec 70 R2 site #4, obviated):
+    // the candidate check is now the presence of a static literal, and
+    // `buildDatabaseCall` parses it. No SQL-keyword content scan here.
     if (isVariableAssignment(node, adapter)) {
-        return containsSQLStructure(nodeText);
+        return extractStaticSql(node, adapter, sourceCode) !== null;
     }
     return false;
 }
@@ -176,12 +524,60 @@ function dedupeCandidateNodes(nodes, adapter) {
     });
     return uniqueNodes;
 }
+/** The explicit lowercased column list of a raw-SQL INSERT/REPLACE, or null for
+ *  a positional INSERT (`INSERT INTO t VALUES (…)`, no column list). Mirrors
+ *  sqlAst's `insertColumns` but preserves the null-vs-empty distinction the
+ *  tenant-predicate rule needs.
+ * @param sqlAst - The parsed SQL statement to read the column list from.
+ * @returns The lowercased explicit column list, or `null` for a positional
+ *   insert or a non-INSERT/REPLACE statement. */
+export function rawInsertColumnsFromAst(sqlAst) {
+    if (sqlAst.type !== 'insert' && sqlAst.type !== 'replace')
+        return null;
+    const columns = sqlAst.columns;
+    if (!Array.isArray(columns))
+        return null;
+    return columns.filter((c) => typeof c === 'string').map((c) => c.toLowerCase());
+}
+/** The Kysely builder write verb carried as a camelCase method name — a
+ *  host-language chain shape, not SQL.  `selectFrom`/`selectAll` are reads.
+ *  Read from the callee's member chain, not the source text: a `.insertInto(…)`
+ *  inside a string argument (`db.raw(".insertInto(x)")`) is not a chain member.
+ *
+ * @param node the candidate call-expression node
+ * @param adapter the language adapter used to read the member chain
+ * @param sourceCode the file source text for reading node text
+ * @returns the Kysely write verb, or null when the chain is not a write */
+export function builderWriteVerb(node, adapter, sourceCode) {
+    const methods = collectChainMethods(node, adapter, sourceCode);
+    if (methods.includes('insertInto'))
+        return 'insert';
+    if (methods.includes('updateTable'))
+        return 'update';
+    if (methods.includes('deleteFrom'))
+        return 'delete';
+    return null;
+}
+/** True when an ORM chain carries a row-limiting shape (`.where(...)`, `.having(...)`,
+ *  `.limit(...)`, `.andWhere(...)`, `.orWhere(...)`) — the host-language analog of
+ *  SQL's WHERE/HAVING/LIMIT that the AST walk cannot see because there is no SQL.
+ *  Read from the member chain, not the source text: a `.where(…)` inside a string
+ *  argument is a string, not a chain member.
+ *
+ * @param node the candidate call-expression node
+ * @param adapter the language adapter used to read the member chain
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the chain carries a row-limiting shape */
+export function hasOrmFilterShape(node, adapter, sourceCode) {
+    const methods = collectChainMethods(node, adapter, sourceCode);
+    return methods.some((m) => m === 'where' || m === 'andWhere' || m === 'orWhere' || m === 'having' || m === 'limit');
+}
 /**
  * Classify a single candidate node into a DatabaseCall, or null when it does not
  * look like a DB-related query.
  */
 function buildDatabaseCall(node, ast, scan) {
-    const { adapter, sourceCode, dbImports, config } = scan;
+    const { adapter, sourceCode, config, provenanceContext } = scan;
     const nodeText = stripComments(adapter.getNodeText(node, sourceCode));
     if (!nodeText || nodeText.trim().length < 10)
         return null;
@@ -189,15 +585,83 @@ function buildDatabaseCall(node, ast, scan) {
     // its template argument (path 2) — the template string is the precise target.
     if (shouldSkipCallForTemplateArg(node, adapter))
         return null;
-    const isSqlQuery = containsSQLKeywords(nodeText);
+    // The candidate's static SQL argument (unquoted), or null when it has none
+    // or is dynamically interpolated.
+    const sqlArg = extractStaticSql(node, adapter, sourceCode);
+    // Spec 70 R2 — parse the static SQL once and derive every SQL-content fact from
+    // the AST. The dialect is per-call-site (Spec 70): `pool.query(…)` where `pool`
+    // resolves to `pg` parses as postgres even in a repo that also names `mysql2`;
+    // the repo-level detection result is only the fallback when the receiver
+    // doesn't resolve to a single-dialect package. R2 does not condition parsing on
+    // proving the dialect, so when none resolves the static SQL is still attempted
+    // under {@link DEFAULT_SQL_DIALECT}; a literal that parses yields its facts, and
+    // only a genuine parse failure (under the resolved dialect, or the default with
+    // the dialect undetermined) leaves the facts absent (`cannot-fire`).
+    const siteDialect = resolveSiteDialect(node, adapter, sourceCode, provenanceContext);
+    const dialect = siteDialect ?? config.dialect ?? null;
+    const parsed = sqlArg !== null ? parseSql(sqlArg, dialect ?? DEFAULT_SQL_DIALECT) : null;
+    const sqlOk = parsed && parsed.ok ? parsed : null;
+    // DDL statements (CREATE/ALTER/DROP/USE) are schema definition, not a
+    // row-level data-access query: they carry no rows to filter and no tenant
+    // predicate to check. A variable assignment holding a migration body
+    // (`const up = \`CREATE TABLE …\``) must not surface as a data-access call —
+    // schema is read separately by the `.sql` visitor and Durable Object DDL.
+    // Interpolated DDL still parses to null here, so this guard only excludes
+    // *static* schema definitions and leaves the injection surface untouched.
+    if (sqlOk && isDdlStatementKind(sqlOk.kind))
+        return null;
     const isOrmCall = isOrmPattern(nodeText);
+    const tagNames = config.sqlTagNames ?? SQL_TAG_NAMES;
+    // A tagged-template SQL call (`sql\`…\`` / `this.sql\`…\``) is a SQL query by
+    // tag name, whether its template is static or interpolated. Its static body
+    // parses normally; an interpolated body is `cannot-fire` on the SQL facts but
+    // is still the injection surface sql-injection-risk (site #11) reads.
+    const isTaggedSqlCall = isTaggedTemplateSqlCall(node, adapter, sourceCode, tagNames);
+    // A call is a SQL candidate when its static argument parsed as a statement, or
+    // it sits in a SQL position — a handle-or-unproven receiver, a query-builder
+    // chain, or a tagged template — regardless of whether its argument is static or
+    // dynamically interpolated. A parse-failed static argument in a SQL position is
+    // `cannot-fire` (facts absent), never silently dropped. (Spec 70 R2 — the
+    // keyword name-list gate `containsSQLKeywords` is deleted from this decision: it
+    // dropped keyword-less SQL like `PRAGMA`/`VACUUM`/`ANALYZE` that provenance
+    // already establishes as SQL, the opposite of honest `cannot-fire`.)
+    //
+    // Spec 70 R1.2 — handle-ness is decided once, by `identifyHandle`, and the site
+    // is admitted on the tri-state verdict: `handle` and `unproven` both admit (the
+    // latter carrying its reason, recorded on the call below); only `not-handle`
+    // rejects. `null` means "not a query-shaped DB/ORM call", not "not a handle" —
+    // a type-annotated `db: D1Database` with a dynamic template argument now stays
+    // visible instead of being dropped before the rules can see it.
+    const handleVerdict = handleVerdictForCall(node, scan);
+    const handleAdmits = handleVerdict !== null && handleVerdict.kind !== 'not-handle';
+    const isSqlPosition = handleAdmits || isQueryBuilderShape(node, adapter, sourceCode);
+    const isSqlQuery = sqlOk !== null || isSqlPosition || isTaggedSqlCall;
     if (!isSqlQuery && !isOrmCall)
         return null;
-    const tables = extractTables(nodeText, config);
+    const sqlAstNode = sqlOk ? sqlOk.ast : null;
+    const builderVerb = sqlAstNode ? null : builderWriteVerb(node, adapter, sourceCode);
+    // Tables: SQL relations from the AST ∪ ORM-shaped references from the node.
+    const sqlTables = sqlAstNode ? extractTableNames(sqlAstNode) : [];
+    const ormTables = isOrmCall ? extractOrmTables(node, adapter, sourceCode, config) : [];
+    const tables = [...new Set([...sqlTables, ...ormTables])];
+    // Row-limiting filter: SQL WHERE/HAVING/LIMIT from the AST, or the ORM chain
+    // shape when there is no SQL to walk.
+    const facts = sqlAstNode ? whereFacts(sqlAstNode) : null;
+    const hasFilter = (facts
+        ? (facts.hasWhere && !facts.whereIsTautology) || facts.hasHaving || facts.hasLimit
+        : false)
+        || (isOrmCall && hasOrmFilterShape(node, adapter, sourceCode));
     const hasOrgFilter = hasOrganizationFilter(nodeText, config);
-    const hasFilter = hasQueryFilter(nodeText);
     const security = withRuleTiming('sql-injection-risk', () => checkQuerySecurity(node, nodeText, ast, scan));
-    const callType = classifyCallType(isSqlQuery, isOrmCall, dbImports);
+    // Spec 70 R4 — a sql-injection finding asserts the receiver is actually a DB
+    // handle. `unproven` (resolution reached a declaration whose origin it cannot
+    // tie to a database client, e.g. a Worker env binding like `D1Database`) is
+    // `cannot-fire`: the site stays visible but no vulnerability is asserted. Only
+    // a proven `handle` — a parsed SQL argument (R3) or a package in the manifest
+    // (R4) — fires. A type name proves nothing under criterion 9, so there is no
+    // type-annotation signal to consult.
+    const injectionRisk = security.injectionRisk && handleVerdict?.kind === 'handle';
+    const callType = classifyCallType(isSqlQuery, isOrmCall);
     return {
         type: callType,
         method: extractMethodName(node, adapter, sourceCode),
@@ -208,26 +672,33 @@ function buildDatabaseCall(node, ast, scan) {
         queryText: nodeText,
         hasOrganizationFilter: hasOrgFilter,
         hasFilter,
+        isWrite: sqlAstNode ? isWriteStatement(sqlAstNode) : builderVerb !== null,
+        isMassWrite: sqlAstNode ? isMassWriteStatement(sqlAstNode) : builderVerb === 'update',
+        isUpsert: sqlAstNode
+            ? isUpsertStatement(sqlAstNode) || sqlOk?.conflictClauseTruncated === true
+            : false,
+        isRawInsert: sqlAstNode ? (sqlAstNode.type === 'insert' || sqlAstNode.type === 'replace') : false,
+        insertColumns: sqlAstNode ? rawInsertColumnsFromAst(sqlAstNode) : null,
+        sqlWhereColumns: sqlAstNode ? [...whereColumnRefs(sqlAstNode)] : null,
         hasParameterizedQuery: security.parameterized,
-        hasSqlInjectionRisk: security.injectionRisk,
+        hasSqlInjectionRisk: injectionRisk,
         sqlEscaped: security.escaped,
         enclosingFunction: enclosingIdentity(node, adapter, ast.filePath),
+        resolvedWhere: resolveWhereBinding(node, sourceCode, adapter) ?? undefined,
+        handleVerdict: handleVerdict ?? undefined,
     };
 }
 /**
- * Classify a SQL/ORM candidate as the concrete database call type: `sql` for a
- * raw SQL query, or the ORM type name (e.g. `knex`) resolved from the first
- * imported DB driver; `unknown` when neither applies.
+ * Classify a SQL/ORM candidate as a broad call-type label: `sql` for a raw SQL
+ * query, `orm` for a query-builder-shaped call, `unknown` otherwise. This is a
+ * non-decision label (no rule reads it); the receiver's DB provenance — resolved
+ * separately — is what decides whether the call is a data-access violation.
  */
-function classifyCallType(isSqlQuery, isOrmCall, dbImports) {
+function classifyCallType(isSqlQuery, isOrmCall) {
     if (isSqlQuery)
         return 'sql';
-    if (isOrmCall) {
-        for (const [dbType, importInfo] of dbImports) {
-            if (importInfo.hasImports)
-                return dbType;
-        }
-    }
+    if (isOrmCall)
+        return 'orm';
     return 'unknown';
 }
 /**
@@ -246,9 +717,10 @@ function shouldSkipCallForTemplateArg(node, adapter) {
  * Extract database calls from AST
  */
 function extractDatabaseCalls(ast, scan) {
-    const { adapter, sourceCode, provenanceContext } = scan;
+    const { adapter, config } = scan;
+    const tagNames = config.sqlTagNames ?? SQL_TAG_NAMES;
     const allNodes = adapter.findNodes(ast, {
-        custom: (node) => isDbCallCandidate(node, adapter, sourceCode, provenanceContext),
+        custom: (node) => isDbCallCandidate(node, scan, tagNames),
     });
     const uniqueNodes = dedupeCandidateNodes(allNodes, adapter);
     const calls = [];
@@ -311,7 +783,7 @@ function analyzeQuery(call, config) {
 function checkViolations(call, analysis, ctx) {
     const { filePath, config, symbolOrdinals, skipTestRules } = ctx;
     const violations = [];
-    const symbol = nextSymbol(call.enclosingFunction ?? 'top-level', call.method, symbolOrdinals);
+    const symbol = nextSymbol(call.enclosingFunction ?? 'top-level', call.method ?? '', symbolOrdinals);
     const push = (message, opts) => violations.push(makeViolation(filePath, { line: call.line, column: call.column }, message, { ...opts, symbol }));
     // Security: SQL injection.  Raw unescaped interpolation of input is a live
     // vulnerability now → `critical`.  Manual quote-escaping
@@ -327,7 +799,7 @@ function checkViolations(call, analysis, ctx) {
                 resolution: {
                     action: 'parameterize',
                     summary: `The SQL in ${call.method} interpolates a manually quote-escaped value. Quote-doubling defends only the single-quote case (not backslash escapes, unicode quote variants, or numeric/identifier positions) — replace the interpolation with a parameterized query (\`?\`, \`$1\`, or \`:name\`) for a full guarantee.`,
-                    symbols: [call.method],
+                    symbols: [call.method ?? ''],
                     files: [filePath],
                     lines: [call.line],
                 },
@@ -340,7 +812,7 @@ function checkViolations(call, analysis, ctx) {
                 resolution: {
                     action: 'parameterize',
                     summary: `Replace the string-interpolated SQL in ${call.method} with a parameterized query — bind values via the driver's placeholder form (\`?\`, \`$1\`, or \`:name\`) instead of concatenating them into the statement.`,
-                    symbols: [call.method],
+                    symbols: [call.method ?? ''],
                     files: [filePath],
                     lines: [call.line],
                 },
@@ -406,13 +878,27 @@ function isFunctionCall(node, adapter) {
     return node.type === 'call_expression' ||
         node.type === 'new_expression';
 }
-function isTemplateLiteral(node, adapter) {
-    return node.type === 'template_string';
-}
+/**
+ * The node types that name a variable assignment whose RHS could be a static
+ * SQL literal. The previous check compared against `variable_declaration` (TS
+ * `var` only) and `binary_expression` (arithmetic/comparison — never an
+ * assignment), so `const`/`let`/`:=` declarations and every reassignment were
+ * dead. The type is the whole signal; `extractStaticSql` then reads the RHS.
+ */
+const VARIABLE_ASSIGNMENT_TYPES = new Set([
+    // TS/JS
+    'variable_declaration', // var q = …
+    'lexical_declaration', // const/let q = …
+    'variable_declarator', // the declarator inside either
+    'assignment_expression', // q = …
+    // Go
+    'short_var_declaration', // q := …
+    'var_declaration', // var q = …
+    'var_spec', // the spec inside var_declaration
+    'assignment_statement', // q = …
+]);
 function isVariableAssignment(node, adapter) {
-    // Only get the actual variable declaration, not the statement
-    return node.type === 'variable_declaration' ||
-        node.type === 'binary_expression' && (node.children?.some(child => adapter.getNodeText(child, '').includes('=')) ?? false);
+    return VARIABLE_ASSIGNMENT_TYPES.has(adapter.getNodeType(node));
 }
 function containsSQLKeywords(text) {
     const upperText = text.toUpperCase();
@@ -475,54 +961,6 @@ function stripComments(text) {
     }
     return out;
 }
-/**
- * Spec 22 R4.2: Requires ≥2 SQL keywords for variable-assignment detection.
- *
- * Single-keyword substring matches (e.g. "FROM" inside "Array.from") produce
- * ~120 false positives on the recall corpus. Genuine SQL in variable
- * assignments (string literals, ORM chains) almost always has ≥2 keywords
- * (SELECT+FROM, INSERT+INTO, DELETE+FROM, etc.).
- *
- * This is only used for the variable-assignment fallback path — template
- * literals and function calls use separate, context-aware gating.
- */
-function containsSQLStructure(text) {
-    const upperText = text.toUpperCase();
-    const found = SQL_KEYWORDS.filter(keyword => upperText.includes(keyword));
-    return found.length >= 2;
-}
-/**
- * Spec 17 R2 provenance gate: a template literal is a SQL candidate
- * because of where it sits (inside a DB-provenanced call's arguments),
- * NOT because its body contains SQL-shaped substrings.
- *
- * Content scanning with substring matching is removed — template bodies
- * containing natural-language words like "from" or "select" are no longer
- * misclassified. The cost: template literals assigned to variables whose
- * values eventually flow to DB calls are not detected (requires dataflow
- * analysis, which is outside the product's stated scope per Spec 15 R3).
- */
-function isTemplateInDBProvenancedCall(node, adapter, sourceCode, provenanceContext) {
-    const parent = adapter.getParent(node);
-    if (!parent)
-        return false;
-    const parentType = adapter.getNodeType(parent);
-    // Only the arguments-of-DB-call path survives the Spec 17 R2 cut.
-    // Variable-assignment and statement-level conservative passes are
-    // removed — they were the primary source of false positives.
-    if (parentType === 'arguments') {
-        const callExpr = adapter.getParent(parent);
-        if (!callExpr || adapter.getNodeType(callExpr) !== 'call_expression')
-            return false;
-        if (provenanceContext) {
-            return isDBProvenanced(callExpr, { adapter, sourceCode, context: provenanceContext, methods: DB_CALL_METHODS });
-        }
-        // Without provenance context, can't determine DB association —
-        // do not speculate.
-        return false;
-    }
-    return false;
-}
 /**
  * Detect that a node sits inside a D1 .prepare() call — the standard safe
  * pattern for SQL in Cloudflare Workers.
@@ -561,11 +999,14 @@ function isInPrepareBindChain(node, adapter, sourceCode) {
 function findCallFromEntry(node, adapter) {
     const type = adapter.getNodeType(node);
     if (type === 'template_string') {
-        const args = adapter.getParent(node);
-        if (!args || adapter.getNodeType(args) !== 'arguments')
-            return null;
-        const call = adapter.getParent(args);
-        return call && adapter.getNodeType(call) === 'call_expression' ? call : null;
+        // A nested template (`${cond ? \` WHERE x = ?\` : ''}`) is a fragment of its
+        // enclosing query, not a query in its own right. Resolve it through the
+        // substitution/outer-template chain to the enclosing call (as
+        // `enclosingCallOf` does) so it inherits that call's parameterization —
+        // `.query(sql, params)` / `.prepare().bind()` — instead of being re-read as
+        // a bare interpolation whose direct parent is `template_substitution` (not
+        // `arguments`) and therefore wrongly reported as raw injection ("in unknown").
+        return enclosingCallOf(node, adapter);
     }
     if (type === 'call_expression')
         return node;
@@ -597,15 +1038,23 @@ function memberPropertyName(node, adapter, sourceCode) {
  * "all" property for the eager D1 read method (Spec 52 R1). `Promise` is the
  * only collision in the eager set — none of run/first/raw/exec/batch are
  * Promise methods.
+ *
+ * @param memberExpr the member-expression node to classify
+ * @param adapter the language adapter used to read the member property
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the member is the global `Promise.all`
  */
-function isPromiseAllMember(memberExpr, adapter, sourceCode) {
+export function isPromiseAllMember(memberExpr, adapter, sourceCode) {
     if (memberPropertyName(memberExpr, adapter, sourceCode) !== 'all')
         return false;
     const objectNode = adapter.getChildren(memberExpr).find(c => adapter.getNodeType(c) !== 'property_identifier');
     if (!objectNode)
         return false;
-    const text = adapter.getNodeText(objectNode, sourceCode);
-    return text === 'Promise' || text.endsWith('.Promise');
+    // The object must be the bare `Promise` global identifier. `foo.Promise` is a
+    // different binding, so a `.Promise` text suffix must not read as `Promise.all`.
+    if (adapter.getNodeType(objectNode) !== 'identifier')
+        return false;
+    return adapter.getNodeText(objectNode, sourceCode) === 'Promise';
 }
 /**
  * Resolve a db-call node to its call_expression. A template_string db node (the
@@ -643,8 +1092,16 @@ function dbCallMethodName(node, adapter, sourceCode) {
  * DB methods that execute I/O immediately (as opposed to `.prepare()`/`.bind()`,
  * which only construct a statement object). Used to decide whether a
  * prepare/bind call is chained into an eager execution.
+ *
+ * `.get()` is the single-row read shared by better-sqlite3, `node:sqlite`, and
+ * `bun:sqlite` that D1 does not expose (D1's closest is `.first()`). It was
+ * absent, so `db.prepare(…).get(…)` in a loop was misread as statement
+ * construction and skipped — the exact false negative the corpus pins at
+ * `n-plus-one.ts:51`/`:62`. The wider driver-method gap (`.iterate()`, bun's
+ * `.values()`) is documented in specs/rule-evidence-corpus/REPORT.md; it is
+ * deliberately left out until it is measured, not silently dropped.
  */
-const EAGER_DB_METHODS = new Set(['run', 'all', 'first', 'raw', 'exec', 'batch', 'query']);
+const EAGER_DB_METHODS = new Set(['run', 'all', 'first', 'raw', 'exec', 'batch', 'query', 'get']);
 /**
  * True when `node` (a `.prepare()`/`.bind()` call) is chained into an eager
  * method — e.g. `db.prepare(sql).bind(x).run()`. The `.run()` at the end of the
@@ -681,8 +1138,8 @@ function hasEagerMethodInCallChain(node, adapter, sourceCode) {
 /**
  * True when a db-call node is statement construction only — a `.prepare()` /
  * `.bind()` that is not chained into an eager method (`.run()` / `.all()` /
- * `.first()` / `.raw()` / `.exec()` / `.batch()`). Such a call performs no I/O,
- * so it is not a query-in-loop on its own (Spec 52 R1).
+ * `.first()` / `.raw()` / `.exec()` / `.batch()` / `.get()`). Such a call
+ * performs no I/O, so it is not a query-in-loop on its own (Spec 52 R1).
  */
 function isStatementConstructionOnly(node, adapter, sourceCode) {
     const method = dbCallMethodName(node, adapter, sourceCode);
@@ -703,7 +1160,7 @@ function isSqlStringConstruction(node, adapter, sourceCode) {
     const method = dbCallMethodName(node, adapter, sourceCode);
     if (!method || EAGER_DB_METHODS.has(method))
         return false;
-    if (!ORM_METHODS.has(method))
+    if (!isOrmMethod(method))
         return false;
     const call = resolveDbCallNode(node, adapter);
     if (!call)
@@ -795,15 +1252,25 @@ function isInExecChain(node, adapter, sourceCode) {
     return hasSpreadArgument(execCall, adapter);
 }
 /**
- * Detect D1's convenience SQL methods — .all(), .first(), .run() —
- * called with bind parameters as a second argument.
+ * Detect eager execution methods called with bind parameters as a second
+ * argument — D1's `.all()`/`.first()`/`.run()`, plus the parameterized
+ * `.query()`/`.execute()` form shared by node-postgres/mysql2 and the tool's
+ * own `IndexHandle`.
+ *
+ * `db.run(query, ...params)` is shorthand for
+ * `db.prepare(query).bind(...params).run()`.  If there's a second argument
+ * (the bind params), the call is fully parameterized and safe — the `${}`
+ * interpolations in the SQL are structural (placeholder fragments, identifiers,
+ * fixed value-lists), never bound values.
  *
- * `db.all(query, ...params)` is shorthand for
- * `db.prepare(query).bind(...params).all()`.  If there's a second argument
- * (the bind params), the call is fully parameterized and safe.
+ * `IndexHandle.query(sql, params)` (the tool's own parameterized index-query
+ * abstraction, `src/types.ts`) is this exact contract: the interpolations carry
+ * `?`-placeholder clauses (`${fp.clause}`, `${inList(types)}`) and `params`
+ * binds the values out-of-band. A single-arg `.query(\`…${input}\`)` — the raw
+ * injection shape — stays flagged because it carries no bind argument.
  */
 function isD1ConvenienceCall(node, adapter, sourceCode) {
-    const D1_CONVENIENCE = new Set(['all', 'first', 'run']);
+    const D1_CONVENIENCE = new Set(['all', 'first', 'run', 'query', 'execute']);
     const call = findCallFromEntry(node, adapter);
     if (!call)
         return false;
@@ -866,8 +1333,13 @@ function isWrapperFunctionWithBindParams(node, adapter, sourceCode, wrapperNames
  * single-expression form `db.prepare(sql).bind(x).all()`.  This method
  * catches the common idiom where the prepared statement is stored in a local
  * before being bound.
+ *
+ * @param prepareCall the `db.prepare(...)` call-expression node
+ * @param adapter the language adapter used to read the parent assignment
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the prepare result is stored then `.bind()`ed in scope
  */
-function isPrepareAssignedToVariable(prepareCall, adapter, sourceCode) {
+export function isPrepareAssignedToVariable(prepareCall, adapter, sourceCode) {
     // The parent of the prepare call_expression reveals how the result is used.
     const parent = adapter.getParent(prepareCall);
     if (!parent)
@@ -893,14 +1365,30 @@ function isPrepareAssignedToVariable(prepareCall, adapter, sourceCode) {
     }
     if (!varName)
         return false;
-    // Scan the enclosing function scope for `.bind()` on this variable.
+    // Scan the enclosing function scope for a `<varName>.bind(…)` member call.
+    // Walk the subtree structurally: a `.bind(` inside a comment or string is text,
+    // not a member expression, so it is not seen (the old regex over the function
+    // text matched `// stmt.bind(x)` comments).
     const fnNode = findEnclosingFunctionNode(prepareCall, adapter);
     if (!fnNode)
         return false;
-    const fnText = adapter.getNodeText(fnNode, sourceCode);
-    const escaped = varName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-    const bindPattern = new RegExp(String.raw `\b${escaped}\.bind\s*\(`, 'u');
-    return bindPattern.test(fnText);
+    const stack = [fnNode];
+    while (stack.length) {
+        const n = stack.pop();
+        const t = adapter.getNodeType(n);
+        if (t === 'member_expression' || t === 'selector_expression') {
+            if (extractMemberExpressionProperty(n, adapter, sourceCode) === 'bind') {
+                const receiver = memberObjectNode(n, adapter);
+                if (receiver && adapter.getNodeType(receiver) === 'identifier'
+                    && adapter.getNodeText(receiver, sourceCode) === varName) {
+                    return true;
+                }
+            }
+        }
+        for (const c of adapter.getChildren(n) ?? [])
+            stack.push(c);
+    }
+    return false;
 }
 /**
  * Walk up the AST to find the enclosing function node (function_declaration,
@@ -968,7 +1456,17 @@ function isOrmPattern(text) {
         /\.createMany\s*\(/,
         /\.aggregate\s*\(/,
         /\.count\s*\(/,
-        /\.distinct\s*\(/
+        /\.distinct\s*\(/,
+        // Kysely builder verbs (camelCase SQL — not matched by the SQL-keyword path).
+        /\.selectFrom\s*\(/,
+        /\.selectAll\s*\(/,
+        /\.insertInto\s*\(/,
+        /\.updateTable\s*\(/,
+        /\.deleteFrom\s*\(/,
+        /\.executeTakeFirst\s*\(/,
+        /\.executeTakeFirstOrThrow\s*\(/,
+        /\.onConflict\s*\(/,
+        /\.returning\s*\(/
     ];
     return ormPatterns.some(pattern => pattern.test(scrubNonTableCalls(text)));
 }
@@ -982,152 +1480,158 @@ function collectPatternTables(text, patterns, tables) {
         }
     });
 }
+/** The immediate object (receiver) child of a member/selector expression —
+ *  the child that is neither `.` nor the property identifier. */
+function memberObjectNode(node, adapter) {
+    const children = adapter.getChildren(node);
+    return children.find((c) => {
+        const ct = adapter.getNodeType(c);
+        return ct !== '.' && ct !== 'property_identifier' && ct !== 'field_identifier';
+    }) ?? null;
+}
+/** The first real (non-punctuation) argument node of an `arguments` node. */
+function firstArgumentNode(argsNode, adapter) {
+    for (const c of adapter.getChildren(argsNode)) {
+        const ct = adapter.getNodeType(c);
+        if (ct === '(' || ct === ')' || ct === ',')
+            continue;
+        return c;
+    }
+    return null;
+}
+/** The unquoted body of a string/template literal node, or null. */
+function stringLiteralValue(node, adapter, sourceCode) {
+    const t = adapter.getNodeType(node);
+    if (t === 'template_string') {
+        const children = adapter.getChildren(node) ?? [];
+        if (children.some((c) => adapter.getNodeType(c) === 'template_substitution'))
+            return null;
+    }
+    if (t === 'string' || t === 'template_string' ||
+        t === 'interpreted_string_literal' || t === 'raw_string_literal') {
+        const raw = adapter.getNodeText(node, sourceCode);
+        if (raw == null)
+            return null;
+        return stripSqlQuotes(raw, { raw: t === 'raw_string_literal' });
+    }
+    return null;
+}
+/** The table name an ORM table-taking verb's first argument carries: a bare
+ *  identifier's name or an unquoted string literal. Null for anything else (a
+ *  dynamic expression, a template with substitutions, a number, …). */
+function ormTableNameFromArgument(node, adapter, sourceCode) {
+    if (adapter.getNodeType(node) === 'identifier') {
+        const text = adapter.getNodeText(node, sourceCode);
+        return text ? text : null;
+    }
+    const literal = stringLiteralValue(node, adapter, sourceCode);
+    return literal && literal.length > 0 ? literal : null;
+}
+/** Kysely builder verbs whose first argument is the table name. */
+const ORM_TABLE_VERBS = new Set(['selectFrom', 'deleteFrom', 'insertInto', 'updateTable']);
+/** ORM join verbs whose first argument is the joined table. */
+const ORM_JOIN_VERBS = new Set(['join', 'leftJoin', 'rightJoin', 'innerJoin']);
 /**
- * Extract the set of table names referenced in a SQL/ORM fragment, via the
- * configured `tablePatterns` plus the `.from(...)` / `db.<table>.<method>()`
- * ORM shapes. SQL keywords and aggregates captured in passing are filtered out.
+ * Walk the callee chain of an ORM candidate, reading table references from the
+ * *structure* (member names + argument nodes) rather than the source text. A
+ * `.from(…)` / verb / `db.<table>.<method>()` shape inside a string argument is
+ * not a chain member, so it is never read as a table.
+ *
+ * Three shapes are read:
+ *   - `.from(table)` / `.from('table')` (except JS `Array.from`/`Buffer.from`/
+ *     `String.from`/`*Array.from` construction),
+ *   - a Kysely/join verb carrying the table as its first argument,
+ *   - Drizzle's `db.<table>.<method>()` table-access idiom.
  */
-export function extractTables(text, config) {
-    // JS `.from(...)` construction (Array.from / Buffer.from / Uint8Array.from)
-    // and Drizzle `sql.join(...)` are not SQL table references; blank them out
-    // first so their arguments aren't read as tables.
-    const scrubbed = scrubNonTableCalls(text);
-    const tables = new Set();
-    // Check ORM and SQL patterns
-    collectPatternTables(scrubbed, config.tablePatterns?.orm, tables);
-    collectPatternTables(scrubbed, config.tablePatterns?.sql, tables);
-    // Additional check for common ORM patterns that might be missed
-    // Handle patterns like db.select().from(users) where 'users' is a variable
-    const ormVariablePattern = /\.from\s*\(\s*([\p{L}_][\p{L}\p{N}_]*)\s*\)/gu;
-    const ormMatches = scrubbed.matchAll(ormVariablePattern);
-    for (const match of ormMatches) {
-        if (match[1] && !match[1].includes('"') && !match[1].includes("'")) {
-            tables.add(match[1]);
+function collectOrmTableReferences(node, adapter, sourceCode, tables) {
+    const t = adapter.getNodeType(node);
+    if (t === 'call_expression') {
+        const callee = getCallExpressionCallee(node, adapter);
+        if (callee) {
+            const calleeType = adapter.getNodeType(callee);
+            if (calleeType === 'member_expression' || calleeType === 'selector_expression') {
+                const method = extractMemberExpressionProperty(callee, adapter, sourceCode);
+                const receiverNode = memberObjectNode(callee, adapter);
+                const receiverName = receiverNode && adapter.getNodeType(receiverNode) === 'identifier'
+                    ? adapter.getNodeText(receiverNode, sourceCode)
+                    : null;
+                const args = adapter.getChildren(node).find((c) => adapter.getNodeType(c) === 'arguments');
+                const firstArg = args ? firstArgumentNode(args, adapter) : null;
+                if (method && firstArg) {
+                    const isFrom = method === 'from'
+                        && !(receiverName && (receiverName === 'Buffer' || receiverName === 'String'
+                            || receiverName.endsWith('Array')));
+                    const isVerb = ORM_TABLE_VERBS.has(method);
+                    const isJoin = ORM_JOIN_VERBS.has(method) && receiverName !== 'sql';
+                    if (isFrom || isVerb || isJoin) {
+                        const name = ormTableNameFromArgument(firstArg, adapter, sourceCode);
+                        if (name)
+                            tables.add(name);
+                    }
+                }
+            }
+            collectOrmTableReferences(callee, adapter, sourceCode, tables);
         }
     }
-    // Handle patterns like db.users.find() or db.orders.findOne()
-    const dbTablePattern = /db\.([\p{L}_][\p{L}\p{N}_]*)\.\p{L}[\p{L}\p{N}_]*\s*\(/gu;
-    const dbMatches = scrubbed.matchAll(dbTablePattern);
-    for (const match of dbMatches) {
-        if (match[1]) {
-            tables.add(match[1]);
+    else if (t === 'member_expression' || t === 'selector_expression') {
+        // db.<table>.<method>() — Drizzle's table-access idiom. The receiver is the
+        // member `db.<table>`, whose property names the table; the root must be the
+        // bare `db` identifier (not `appDb`/`foo`), mirroring the old `db\.…` regex.
+        const object = memberObjectNode(node, adapter);
+        if (object && (adapter.getNodeType(object) === 'member_expression'
+            || adapter.getNodeType(object) === 'selector_expression')) {
+            const innerProp = extractMemberExpressionProperty(object, adapter, sourceCode);
+            const innerObject = memberObjectNode(object, adapter);
+            if (innerProp && innerObject && adapter.getNodeType(innerObject) === 'identifier'
+                && adapter.getNodeText(innerObject, sourceCode) === 'db') {
+                tables.add(innerProp);
+            }
         }
+        if (object)
+            collectOrmTableReferences(object, adapter, sourceCode, tables);
     }
-    // Drop SQL keywords/aggregates captured as tables — `FROM MIN(...)` in
-    // `EXTRACT(YEAR FROM MIN(...))` yields `MIN`, and `FOR UPDATE SKIP LOCKED`
-    // yields `SKIP`; neither is a table.
-    return Array.from(tables).filter(t => !isSqlKeyword(t));
-}
-function hasOrganizationFilter(text, config) {
-    const patterns = config.organizationPatterns ?? [];
-    // No patterns → hardcoded common fallback set.
-    const candidates = patterns.length
-        ? patterns
-        : ['organizationid', 'organization_id', 'orgid', 'org_id',
-            'tenantid', 'tenant_id', 'companyid', 'company_id'];
-    // An org-scoping column is a *filter* only when it is used as a predicate
-    // operand — the left-hand side of a comparison/IN/IS/LIKE (`org_id = ?`,
-    // `tenant_id IN (...)`), the key side of a filter object (`where({ org_id })`),
-    // or the column argument of a positional where (`where('org_id', x)`).
-    // A column that merely appears in the SELECT list (`SELECT org_id FROM …`) or
-    // an INSERT column list is NOT a filter. This replaces the old substring
-    // proxy that treated any occurrence of the column name — a SELECT column, a
-    // comment, a property name — as evidence of tenant isolation.
-    const alt = candidates.map((c) => c.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('|');
-    // SQL comparison operand / object-literal key.
-    const comparisonRe = new RegExp(`\\b${alt}\\b\\s*(?:=|!=|<>|<=|>=|<|>|\\bIS\\b|\\bIN\\b|\\bLIKE\\b|:)`, 'i');
-    if (comparisonRe.test(text))
-        return true;
-    // Positional ORM where: `.where('org_id', x)` / `.andWhere("org_id", x)`.
-    const positionalRe = new RegExp(`\\b(?:where|andWhere|orWhere|whereEq|whereNot|having|on)\\s*\\(\\s*['"\`]\\s*${alt}\\s*['"\`]`, 'i');
-    return positionalRe.test(text);
-}
-/**
- * True when a query applies a *row-limiting* filter: a WHERE carrying a real
- * predicate, a HAVING, or a LIMIT.  The `unfiltered-query` rule flags a write
- * (DELETE/UPDATE) that lacks such a clause — a mass mutation that touches every
- * row.  A `JOIN ... ON` predicate scopes *how* rows match, not *which* rows come
- * back, so it is not a filter; and a tautological `WHERE 1=1` (the placeholder
- * prepended so callers can append `AND x = ?`) limits nothing, so it is not a
- * filter either.  Evaluated on comment-stripped text so prose in `//` or `/* *`/
- * comments cannot fabricate a filter.
- */
-function hasQueryFilter(text) {
-    const upper = text.toUpperCase();
-    return (/\bWHERE\b/.test(upper) && !whereClauseIsTautology(text))
-        || /\bHAVING\b/.test(upper)
-        || /\bLIMIT\b/.test(upper);
-}
-/**
- * True when the WHERE clause is a bare tautology — `WHERE 1=1` (or `1 = 1`,
- * `TRUE`, or the same repeated under `AND`) — that limits nothing.  A WHERE
- * body carrying any real predicate (`WHERE id = ?`, or `WHERE 1=1 AND
- * active = ?`) is not a tautology.
- */
-function whereClauseIsTautology(text) {
-    const upper = text.toUpperCase();
-    const whereMatch = /\bWHERE\b/.exec(upper);
-    if (!whereMatch)
-        return false;
-    const afterWhere = upper.slice(whereMatch.index + 'WHERE'.length);
-    // Body up to the next row-limiting clause keyword.
-    const body = afterWhere.split(/\b(?:GROUP\s+BY|ORDER\s+BY|HAVING|LIMIT|OFFSET|UNION)\b/)[0];
-    // Drop the SQL-string terminator + call-argument closer (`"), "); …) so the
-    // predicate is judged on the clause text alone.
-    const stripped = body.replace(/["'`)\s;]+$/g, '').replace(/^\s+/, '').replace(/\s+$/, '');
-    // A dangling AND/OR left by a dynamic builder still filters nothing.
-    const clean = stripped.replace(/^(?:AND|OR)\s+/i, '').replace(/\s+(?:AND|OR)$/i, '');
-    const alwaysTrue = '(?:1\\s*=\\s*1|TRUE)';
-    return new RegExp(`^${alwaysTrue}(?:\\s+AND\\s+${alwaysTrue})*$`, 'i').test(clean);
-}
-/**
- * True when a SQL statement carries a write verb (INSERT/DELETE/UPDATE/REPLACE).
- * Spec 52 R2: `REPLACE INTO` is an upsert write — matched as a two-word clause
- * (not a bare `REPLACE` word) so the `REPLACE()` string function is not misread
- * as a write.
- */
-export function hasWriteVerb(text) {
-    const upper = text.toUpperCase();
-    return /\bINSERT\b/.test(upper) || /\bDELETE\b/.test(upper) || /\bUPDATE\b/.test(upper)
-        || /\bREPLACE\s+INTO\b/.test(upper);
-}
-/**
- * True when a statement mutates or deletes existing rows — `DELETE` or `UPDATE`.
- * These are the verbs whose mass effect is a foot-gun when unconstrained;
- * `INSERT` / `REPLACE INTO` always target specific rows and are not "unfiltered"
- * in the dangerous sense.
- */
-function hasMassWriteVerb(text) {
-    const upper = text.toUpperCase();
-    return /\bDELETE\b/.test(upper) || /\bUPDATE\b/.test(upper);
-}
-/**
- * True when a statement is an upsert — one of the four write spellings Spec 52
- * R2 taught the write classifier, plus MySQL's `ON DUPLICATE KEY UPDATE`.  An
- * upsert is keyed by construction: its conflict target / unique key is what
- * scopes the row, and an `INSERT` has no `WHERE` by definition.  So an upsert is
- * never an "unfiltered" mass write, even though `INSERT … ON CONFLICT … DO UPDATE`
- * carries the word `UPDATE` (in `DO UPDATE`) with no WHERE clause.
- */
-function isUpsertForm(text) {
-    const upper = text.toUpperCase();
-    return /\bINSERT\s+OR\s+(?:IGNORE|REPLACE)\b/.test(upper)
-        || /\bREPLACE\s+INTO\b/.test(upper)
-        || /\bON\s+CONFLICT\b/.test(upper)
-        || /\bON\s+DUPLICATE\s+KEY\b/.test(upper);
+    else if (t === 'subscript_expression') {
+        const object = memberObjectNode(node, adapter);
+        if (object)
+            collectOrmTableReferences(object, adapter, sourceCode, tables);
+    }
+}
+/**
+ * Extract the set of table names referenced by the ORM chain shapes — read
+ * structurally from the callee chain ({@link collectOrmTableReferences}) plus
+ * the user-configured `orm` table patterns. This is the host-language shape
+ * detector only; SQL relations are derived structurally by sqlAst's
+ * `extractTableNames`, not here (Spec 70 R2 site #1). The default `orm` patterns
+ * carry only the non-structural `table: 'users'` / `table = "users"` shape; the
+ * `.from(x)` / join / Kysely-verb shapes that used to live there as regexes are
+ * now read structurally, so a `.from(…)` inside a string argument is not a table.
+ * @param node The ORM/query-builder candidate node.
+ * @param adapter The language adapter (drives node traversal).
+ * @param sourceCode The file source text.
+ * @param config The data-access analyzer config holding table patterns.
+ * @returns The set of table names referenced by ORM shapes.
+ */
+export function extractOrmTables(node, adapter, sourceCode, config) {
+    const tables = new Set();
+    collectOrmTableReferences(node, adapter, sourceCode, tables);
+    // User-configured `orm` patterns are arbitrary text shapes with no node to
+    // read (e.g. `table: 'users'`), so they still run over the source text.
+    const nodeText = stripComments(adapter.getNodeText(node, sourceCode));
+    const scrubbed = scrubNonTableCalls(nodeText);
+    collectPatternTables(scrubbed, config.tablePatterns?.orm, tables);
+    return Array.from(tables);
 }
 /**
  * True when a call should be surfaced by the `unfiltered-query` rule (Spec 55
- * R5, Spec 56 R1): a write statement (`DELETE` / `UPDATE`) with no row-limiting
- * clause (WHERE carrying a real predicate, HAVING, or LIMIT).  `DELETE FROM t` or
- * `UPDATE t SET …` with no filter mutates/deletes every row — the classic SQL
- * foot-gun.  Unfiltered *reads* (`SELECT` without WHERE) are often intentional
- * full-set loads and are therefore out of scope, and an upsert (any of the four
- * spellings) is keyed by construction, so it never fires.
+ * R5, Spec 56 R1): a mass-write statement (`UPDATE … SET`) with no row-limiting
+ * clause.  The write/upsert facts are AST-derived (Spec 70 R2 sites #2/#3): a
+ * Kysely `updateTable` builder verb is folded into `isWrite`/`isMassWrite` by
+ * the producer (host-language shape, not SQL).  `DELETE FROM t` is not a mass
+ * write (disposition (a)); an upsert is keyed by construction, so it never fires.
  */
 function isUnfilteredWrite(call) {
-    return !isUpsertForm(call.queryText)
-        && hasMassWriteVerb(call.queryText)
+    return !call.isUpsert
+        && call.isMassWrite
         && !call.hasFilter;
 }
 /**
@@ -1136,14 +1640,12 @@ function isUnfilteredWrite(call) {
  * table that carries declared tenancy.  A filterless full-table read of a
  * tenant table is the same tenant-leak surface the write rule guards — it
  * sweeps every tenant's rows.  Non-tenant tables (lookups, config) stay out of
- * scope, which is precisely what kept the Spec 55 narrowing's false positives
- * (non-tenant full-set loads) from returning.  Reuses `requiresOrgFilter` for
- * the tenancy determination so the write case and this read case cannot drift
- * to two different tenancy definitions.
+ * scope.  Reuses `requiresOrgFilter` for the tenancy determination so the write
+ * case and this read case cannot drift to two different tenancy definitions.
  */
 function isUnfilteredRead(call, config) {
     return !call.hasFilter
-        && !hasWriteVerb(call.queryText)
+        && !call.isWrite
         && requiresOrgFilter(call.tables, config);
 }
 /**
@@ -1186,15 +1688,28 @@ function effectiveWrapperNames(scan) {
  * config-driven sanitizer allowlist, the adapter's cross-function safety
  * analysis, or a static-constant resolution for bare identifiers.  Otherwise
  * the part counts as unresolved (a candidate injection).
+ *
+ * @param part the dynamic interpolation part to classify
+ * @param ast the file's parsed AST
+ * @param scan the data-access scan context (adapter, source, config)
+ * @returns true when the part is provably safe, false when unresolved
  */
-function isSafeDynamicPart(part, ast, scan) {
+export function isSafeDynamicPart(part, ast, scan) {
     const { adapter, sourceCode, config } = scan;
     // Config-driven sanitizer allowlist (escapeSql(x), …) applies to
     // non-identifier expressions — an interpolation wrapped in a known
     // sanitizer isn't raw (same pattern as dbWrapperNames for provenance).
+    // The sanitizer name is read from the part's call node, not from a text
+    // prefix: `mySanitizer  (x)` (two spaces) still names `mySanitizer`, but
+    // `startsWith(name + '(')` would not see it through the extra space.
     if (!part.isIdentifier) {
-        const normalized = part.text.trim();
-        const sanitized = (config.sanitizerNames ?? []).some(name => normalized.startsWith(name + '(') || normalized.startsWith(name + ' ('));
+        const callee = part.node && adapter.getNodeType(part.node) === 'call_expression'
+            ? getCallExpressionCallee(part.node, adapter)
+            : null;
+        const calleeName = callee && adapter.getNodeType(callee) === 'identifier'
+            ? adapter.getNodeText(callee, sourceCode)
+            : null;
+        const sanitized = calleeName != null && (config.sanitizerNames ?? []).includes(calleeName);
         if (sanitized)
             return true;
     }
@@ -1222,6 +1737,54 @@ function isSafeDynamicPart(part, ast, scan) {
     // prove it safe, so treat it as unresolved.
     return false;
 }
+/**
+ * The tagged-template call node when `node` is (or wraps) a drizzle `sql`/`db`
+ * tagged template; null otherwise. Handles both candidate shapes: a bare
+ * `sql\`…\`` (the candidate node IS the tag) and `db.execute(sql\`…\`)` (the
+ * tag is the enclosing call's argument).
+ */
+function findTaggedTemplateCall(node, adapter, sourceCode, tagNames) {
+    if (isTaggedTemplateSqlCall(node, adapter, sourceCode, tagNames))
+        return node;
+    const args = adapter.getChildren(node).find((c) => adapter.getNodeType(c) === 'arguments');
+    if (!args)
+        return null;
+    for (const arg of adapter.getChildren(args)) {
+        const t = adapter.getNodeType(arg);
+        if (t === '(' || t === ')' || t === ',')
+            continue;
+        if (isTaggedTemplateSqlCall(arg, adapter, sourceCode, tagNames))
+            return arg;
+    }
+    return null;
+}
+/**
+ * True when `node` is (or wraps) a drizzle `sql`/`db` tagged template whose
+ * `${…}` interpolations are all bare identifiers — the parameterized-by-
+ * construction form. Drizzle's `sql` tag turns a clean `${id}` into a `?`
+ * placeholder, so a bare-identifier interpolation is not an injection vector.
+ *
+ * A non-identifier interpolation — string concatenation (`${'%' + x + '%'}`), a
+ * call (`${fn(x)}`), a member access (`${session.id}`) — is raw assembly, NOT a
+ * bound parameter, so it is deliberately excluded and falls through to the
+ * dynamic-string construction path (§69 Fix 2).
+ */
+function isParameterizedTaggedTemplate(node, adapter, sourceCode, tagNames) {
+    const tagCall = findTaggedTemplateCall(node, adapter, sourceCode, tagNames);
+    if (!tagCall)
+        return false;
+    const template = adapter.getChildren(tagCall).find((c) => isTemplateLiteral(c, adapter));
+    if (!template)
+        return false;
+    for (const child of adapter.getChildren(template)) {
+        if (adapter.getNodeType(child) !== 'template_substitution')
+            continue;
+        const inner = adapter.getChildren(child).find((c) => adapter.getNodeType(c) !== 'template_substitution');
+        if (!inner || adapter.getNodeType(inner) !== 'identifier')
+            return false;
+    }
+    return true;
+}
 function checkQuerySecurity(node, text, ast, scan) {
     const { adapter, sourceCode, config } = scan;
     // Parameterized chains (.prepare().bind(), .exec() spread, D1 convenience,
@@ -1229,6 +1792,12 @@ function checkQuerySecurity(node, text, ast, scan) {
     if (isParameterizedByChain(node, adapter, sourceCode, config, effectiveWrapperNames(scan))) {
         return { parameterized: true, injectionRisk: false, escaped: false };
     }
+    // A drizzle `sql`/`db` tagged template parameterizes bare `${id}` interpolations
+    // into `?` placeholders by construction — the "right reason" a clean tagged
+    // template is quiet (§69 Fix 2), not the broken recursion that used to hide it.
+    if (isParameterizedTaggedTemplate(node, adapter, sourceCode, config.sqlTagNames ?? SQL_TAG_NAMES)) {
+        return { parameterized: true, injectionRisk: false, escaped: false };
+    }
     if ((config.securityPatterns?.parameterizedQueries || []).some(p => text.includes(p))) {
         return { parameterized: true, injectionRisk: false, escaped: false };
     }
@@ -1256,39 +1825,39 @@ function checkQuerySecurity(node, text, ast, scan) {
     };
 }
 function extractCallExpressionMethod(callExpr, adapter, sourceCode) {
-    // Extract the method name from the callee of a call expression.
-    // For `sql.exec(...)` the callee is a member_expression whose
-    // property_identifier is "exec".  Walking the AST avoids picking up SQL
-    // keywords (COUNT, JOIN, WHERE, ...) that appear inside template literals
-    // in the call arguments, which a regex scan of the full call-expression
-    // text would incorrectly match.
-    // Use the shared callee extractor: it recurses through `await_expression` and
-    // skips `type_arguments`, so `await d1<{...}>(...)` resolves to `d1` rather
-    // than falling through to the "unknown" regex fallback.
+    // Walk the AST to the callee and read the method name as a node. The name is
+    // `property_identifier` on a `member_expression` (or `field_identifier` on a Go
+    // `selector_expression`); a bare `identifier` callee is a named function call.
+    // There is no shape where scanning the call text for `name(` is the right
+    // answer — an unrecognised callee shape is "no method name" (null), never a
+    // guessed name. `getCallExpressionCallee` recurses through `await_expression`
+    // and stops before `arguments`, so a keyword inside a template-literal argument
+    // is never read as the name.
     const callee = getCallExpressionCallee(callExpr, adapter);
-    if (callee) {
-        const calleeType = adapter.getNodeType(callee);
-        if (calleeType === 'member_expression') {
-            const mc = adapter.getChildren(callee);
-            const prop = mc.find(c => adapter.getNodeType(c) === 'property_identifier');
-            if (prop)
-                return adapter.getNodeText(prop, sourceCode);
-        }
-        else {
-            // Bare identifier call (e.g. `exec(...)`)
-            return adapter.getNodeText(callee, sourceCode);
-        }
+    if (!callee)
+        return null;
+    const calleeType = adapter.getNodeType(callee);
+    if (calleeType === 'member_expression') {
+        const prop = adapter.getChildren(callee).find(c => adapter.getNodeType(c) === 'property_identifier');
+        return prop ? adapter.getNodeText(prop, sourceCode) : null;
     }
-    // Fallback: regex on just the callee portion of the text
-    const callText = adapter.getNodeText(callExpr, sourceCode);
-    const m = callText.match(/\.(\w+)\s*[<(]/);
-    return m ? m[1] : 'unknown';
+    if (calleeType === 'selector_expression') {
+        const field = adapter.getChildren(callee).find(c => adapter.getNodeType(c) === 'field_identifier');
+        return field ? adapter.getNodeText(field, sourceCode) : null;
+    }
+    if (calleeType === 'identifier') {
+        return adapter.getNodeText(callee, sourceCode);
+    }
+    if (calleeType === 'call_expression') {
+        return extractCallExpressionMethod(callee, adapter, sourceCode);
+    }
+    return null;
 }
 function extractMethodName(node, adapter, sourceCode) {
     const nodeType = adapter.getNodeType(node);
     // For template literals inside a DB-provenanced call, extract the method
     // name from the enclosing call expression instead of the template body.
-    if (nodeType === 'template_string' || nodeType === 'template_literal') {
+    if (nodeType === 'template_string') {
         const parent = adapter.getParent(node);
         if (parent && adapter.getNodeType(parent) === 'arguments') {
             const callExpr = adapter.getParent(parent);
@@ -1296,17 +1865,15 @@ function extractMethodName(node, adapter, sourceCode) {
                 return extractCallExpressionMethod(callExpr, adapter, sourceCode);
             }
         }
+        return null;
     }
-    // For call expressions themselves, extract from the callee child. The
-    // full node text includes the arguments (which may contain template
-    // literals with SQL keywords), so a naive regex scan of the whole text
-    // can match COUNT, JOIN, WHERE, etc. instead of the real method name.
     if (nodeType === 'call_expression') {
         return extractCallExpressionMethod(node, adapter, sourceCode);
     }
-    const text = adapter.getNodeText(node, sourceCode);
-    const match = text.match(/([\p{L}\p{N}_]+)\s*\(/u);
-    return match ? match[1] : 'unknown';
+    // Any other node shape has no callee to walk to: there is no method name. The
+    // site abstains (null) rather than scanning the node's text for a `name(` that
+    // would turn "I don't recognise this shape" into a confident wrong name.
+    return null;
 }
 /**
  * Spec 21 R6.2 (reworked for Spec 44 — rule authenticity, and Spec 62 Amendment
@@ -1394,14 +1961,32 @@ const MESSAGE_LIFECYCLE_METHODS = new Set(['ack', 'nack', 'acknowledge', 'delete
  * Each finding carries the query call location (never line 1).
  */
 function checkLoopQueries(ast, scan) {
-    const { adapter, sourceCode, provenanceContext } = scan;
-    const violations = [];
+    return collectLoopQueryCandidates(ast, scan).map((c) => {
+        const depthMsg = c.depth > 1 ? ` (nested ${c.depth} levels deep)` : '';
+        return makeViolation(c.file, { line: c.line, column: c.column }, `Database query inside loop${depthMsg} ` +
+            `(loop at line ${c.loopLine}). ` +
+            `This may cause N+1 performance issues. Consider batching queries or using a join.`, { severity: 'severe', rule: 'loop-query', symbol: c.symbol });
+    });
+}
+/**
+ * R4.1: the candidate-collection half of `checkLoopQueries`, factored out so the
+ * `loop-queries` producer projects the same loop→query candidates without
+ * producing violations. Dedup (one candidate per loop, anchored at the first
+ * query) and the LLM/queue suppression live here — they need the AST.
+ */
+function collectLoopQueryCandidates(ast, scan) {
+    const { adapter, sourceCode } = scan;
+    const candidates = [];
     // Spec 21: provenance-gated detection of database calls.
     const dbNodes = adapter.findNodes(ast, {
-        custom: (node) => isDbCallNode(node, adapter, sourceCode, provenanceContext),
+        custom: (node) => isDbCallNode(node, scan),
     });
     const reported = new Set();
     const loopOrdinals = new Map();
+    // §13.1: functions/methods this file invokes inside a `db.transaction(fn)`
+    // callback have their writes already batched by the caller's transaction (see
+    // the helper) — provided their statements were prepared outside the loop.
+    const transactionWrappedFunctions = collectTransactionWrappedFunctions(ast, adapter, sourceCode);
     for (const node of dbNodes) {
         // A DB call and its template-literal SQL argument both satisfy isDbCallNode —
         // the call via provenance, the literal via the template-literal branch — so one
@@ -1424,9 +2009,63 @@ function checkLoopQueries(ast, scan) {
         // fragment, not a query result (knex `sql.push(...this.aggregate(stmt))`).
         if (isSqlStringConstruction(node, adapter, sourceCode))
             continue;
-        const loopInfo = findEnclosingLoop(node, adapter);
+        const loopInfo = findEnclosingLoop(node, adapter, sourceCode);
         if (!loopInfo)
             continue;
+        // §13.3 (for-of-iterable discriminator): a DB call in the iterable/header of
+        // a `for…of` loop — `for (const c of loadCatalog())` where `loadCatalog`
+        // memoizes a single `indexHandle.query` — is evaluated once to produce the
+        // iterated array, then the body iterates it in memory. That is not
+        // per-iteration I/O, so it is not an N+1 — the same subject-vs-callback
+        // distinction `isIteratorCallback` draws for `db.all().map(…)`. (A DB call in
+        // the *body* still fires; only the header position is exempted.)
+        if (isForOfIterableDbCall(node, loopInfo.loopNode, adapter)) {
+            continue;
+        }
+        // §13.1 (hoisted-reuse discriminator): a prepared statement executed inside a
+        // loop is not an N+1 when the statement is prepared *outside* the loop — the
+        // loop re-runs one compiled statement with bound parameters, which is exactly
+        // the "batch the queries" remediation the finding would prescribe, so flagging
+        // it is a false positive. Two shapes of "prepared outside the loop" are
+        // recognized, both keyed on the *prepare* (a relation between two located
+        // facts), never on a property of the call shape:
+        //   (1) transaction-batched — the loop is enclosed by a single
+        //       `db.transaction(fn)` callback (lexically, or via a helper invoked
+        //       inside it), so every write defers to one commit;
+        //   (2) hoisted re-run without a transaction — the loop re-runs a statement
+        //       object prepared outside it (`const stmt = db.prepare(…);
+        //       for (…) stmt.run(x)` or `stmt.bind(x).run()`). The in-loop call must
+        //       be a member call whose base identifier is bound to a `.prepare()`
+        //       result declared *outside* the loop (see `isHoistedStatementReRun`).
+        // Both require the loop body to NOT `.prepare(...)` per iteration — a loop that
+        // still calls `.prepare(...)` re-prepares every pass and remains a genuine N+1,
+        // so it keeps firing. Crucially, shape (2) does NOT key on "no SQL string
+        // argument": an ORM builder chain (`db.select().from(…).where(…)`,
+        // `prisma.user.findUnique({ where: … })`) and a connection call whose SQL is a
+        // hoisted variable both carry no SQL literal, yet the builder is a genuine
+        // per-iteration N+1 and the receiver is not prepare-bound, so neither is a
+        // statement re-run — they keep firing. (A per-iteration
+        // `db.transaction(() => …)` *inside* the loop also still fires — that does not
+        // wrap the loop, and each iteration commits separately.)
+        const enclosingFnName = findEnclosingFunctionIdentity(loopInfo.loopNode, adapter, ast.filePath).name;
+        const transactionEnclosesLoop = isInsideDbTransaction(loopInfo.loopNode, adapter, sourceCode) ||
+            (enclosingFnName !== null && transactionWrappedFunctions.has(enclosingFnName));
+        const preparesInLoop = loopBodyContainsPrepare(loopInfo.loopNode, adapter, sourceCode);
+        const hoistedReuse = !preparesInLoop &&
+            (transactionEnclosesLoop ||
+                isHoistedStatementReRun(node, loopInfo.loopNode, adapter, sourceCode));
+        if (hoistedReuse) {
+            continue;
+        }
+        // §13.2 (per-batch binding discriminator): a DB call whose bound parameters
+        // are a *spread of a collection-derived expression* (a `.slice()`/`.map()`/
+        // chunk of the iterated set) executes one statement per batch, not per row —
+        // a chunked `id IN (…)` write is not an N+1 at any chunk size. Only a scalar
+        // or property read off a single loop element (`run(row.id)`) is per-row. See
+        // `bindsBatchArgument`.
+        if (bindsBatchArgument(node, loopInfo.loopNode, adapter, sourceCode)) {
+            continue;
+        }
         // R4.1 (Spec 46): LLM-pipeline discriminator. A loop whose body invokes an
         // LLM/agent (embedding, model completion, corpus extraction) is an intentional
         // *sequential pipeline* — its per-item DB calls are persistence steps gated by
@@ -1451,13 +2090,25 @@ function checkLoopQueries(ast, scan) {
             continue;
         reported.add(dedupKey);
         const sym = nextSymbol(enclosingIdentity(node, adapter, ast.filePath), 'loop-query', loopOrdinals);
-        // R4.2: Nested-loop attribution.
-        const depthMsg = loopInfo.depth > 1 ? ` (nested ${loopInfo.depth} levels deep)` : '';
-        violations.push(makeViolation(ast.filePath, node.location.start, `Database query inside loop${depthMsg} ` +
-            `(loop at line ${loopInfo.loopNode.location.start.line}). ` +
-            `This may cause N+1 performance issues. Consider batching queries or using a join.`, { severity: 'severe', rule: 'loop-query', symbol: sym }));
+        // Anchor to the resolved callee, not the raw node. For `await db.prepare(…)
+        // .bind(…).all<T>(…)` tree-sitter emits an OUTER call_expression at the `await`
+        // keyword (its function is an await_expression wrapping the chain) alongside the
+        // inner call at `db`. Parent-before-child traversal hands the outer node to this
+        // loop first, so the caret would land on `await` instead of the query. Resolving
+        // the callee (which already recurses through await_expression) re-anchors to the
+        // `db` receiver; for every non-await shape the callee starts at the same column
+        // as the node, so nothing else moves.
+        const anchor = getCallExpressionCallee(node, adapter) ?? node;
+        candidates.push({
+            file: ast.filePath,
+            line: anchor.location.start.line,
+            column: anchor.location.start.column,
+            symbol: sym,
+            loopLine: loopInfo.loopNode.location.start.line,
+            depth: loopInfo.depth,
+        });
     }
-    return violations;
+    return candidates;
 }
 /**
  * R4.1 (Spec 46): True when the loop's subtree contains an LLM/agent invocation.
@@ -1498,36 +2149,587 @@ function loopBodyContainsMessageLifecycleCall(loopNode, adapter, sourceCode) {
     });
     return found;
 }
-/** Depth-first walk over an ASTNode subtree (children only, no parent links). */
-function walkSubtree(node, adapter, visitor) {
-    visitor(node);
-    for (const child of adapter.getChildren(node)) {
-        walkSubtree(child, adapter, visitor);
+/**
+ * §13.1 (prepare-outside-loop guard): true when the loop's subtree issues a
+ * `.prepare(...)` call — i.e. the statement is (re)built on every iteration, not
+ * prepared once outside the loop. This is the second half of the
+ * transaction-batched discriminator: a loop wrapped in a transaction is only a
+ * non-N+1 when it reuses a statement prepared outside; a per-iteration
+ * `db.prepare(sql).run(…)` (or `const stmt = db.prepare(…); stmt.run(…)`) still
+ * re-prepares every pass and remains a genuine N+1 under a transaction. Walking
+ * the whole loop subtree (header + body) is safe: a `.prepare` is only ever in
+ * the body, never the header.
+ */
+function loopBodyContainsPrepare(loopNode, adapter, sourceCode) {
+    let found = false;
+    walkSubtree(loopNode, adapter, (node) => {
+        if (found || adapter.getNodeType(node) !== 'call_expression')
+            return;
+        if (dbCallMethodName(node, adapter, sourceCode) === 'prepare')
+            found = true;
+    });
+    return found;
+}
+/**
+ * §13.1 (hoisted-reuse discriminator, non-transaction shape): true when the
+ * in-loop DB call re-runs a statement object prepared *outside* the loop —
+ * `const stmt = db.prepare(…); for (…) stmt.run(x)` or `stmt.bind(x).run()`.
+ *
+ * The signal is the *prepare* — a relation between two located facts — not a
+ * property of the call shape. The in-loop eager call's member chain must be
+ * rooted at an identifier (`stmt`) that is declared, in an enclosing scope
+ * *outside* the loop, with a `.prepare()` initializer. An ORM builder chain
+ * (`db.select().from(…).where(…)`, `prisma.user.findUnique({ where: … })`),
+ * a direct connection call (`db.exec("…")`), a bare DB-provenanced helper
+ * (`resolveHero(db, slug)`), and a Map/Array method that provenance over-matched
+ * (`counts.get(x)`, `adjudication.find(x)`) are all rooted at an identifier that
+ * is NOT prepare-bound, so none of them reads as a statement re-run and each
+ * keeps firing.
+ */
+function isHoistedStatementReRun(node, loopNode, adapter, sourceCode) {
+    const base = memberChainBaseIdentifier(node, adapter, sourceCode);
+    if (base && identifierBoundToPrepareOutsideLoop(base, loopNode, adapter, sourceCode)) {
+        return true;
     }
+    return isBarePrepareBoundHelperCall(node, loopNode, adapter, sourceCode);
 }
 /**
- * Classify a call_expression as an LLM/agent invocation via three unambiguous
- * signals: a provider/SDK namespace in the callee text, an LLM action verb in the
- * callee text, or a model-client identifier passed as an argument / used as the
- * member-callee object.
+ * §13.1 (hoisted-reuse discriminator, bare-wrapper shape): true when the in-loop
+ * DB call is a bare local-helper invocation (`deleteFileEntries(clears, path)`)
+ * whose argument is an identifier bound, outside the loop, to a prepare result —
+ * `clears = prepareStyleClearStatements(rawDb)`, then the loop body forwards
+ * `clears` into a helper that runs `clears.decl.run(path)` on every pass. The
+ * helper re-runs pre-prepared statements; the prepare is the signal, located via
+ * the *argument's* binding rather than the call's own member chain (a bare
+ * identifier callee has none). Member-shape re-runs are handled above; this is
+ * the bare-call complement.
  */
-function isLlmCallNode(node, adapter, sourceCode) {
-    const children = adapter.getChildren(node);
-    const callee = children.find(c => adapter.getNodeType(c) !== 'arguments');
-    if (callee) {
-        const calleeText = adapter.getNodeText(callee, sourceCode);
-        if (LLM_PROVIDER_RE.test(calleeText) || LLM_ACTION_RE.test(calleeText))
+function isBarePrepareBoundHelperCall(node, loopNode, adapter, sourceCode) {
+    const call = resolveDbCallNode(node, adapter);
+    if (!call)
+        return false;
+    const callee = getCallExpressionCallee(call, adapter);
+    if (!callee || adapter.getNodeType(callee) !== 'identifier')
+        return false;
+    const argsNode = adapter.getChildren(call).find((c) => adapter.getNodeType(c) === 'arguments');
+    if (!argsNode)
+        return false;
+    for (const arg of adapter.getChildren(argsNode)) {
+        if (adapter.getNodeType(arg) !== 'identifier')
+            continue;
+        if (identifierBoundToPrepareOutsideLoop(adapter.getNodeText(arg, sourceCode), loopNode, adapter, sourceCode)) {
             return true;
-        // Member callee whose object is an LLM client: `model.chat(…)`, `llm.invoke(…)`.
-        if (adapter.getNodeType(callee) === 'member_expression') {
-            const obj = adapter.getChildren(callee).find(c => adapter.getNodeType(c) === 'identifier');
-            if (obj && LLM_CLIENT_ARG_NAMES.has(adapter.getNodeText(obj, sourceCode)))
-                return true;
         }
     }
-    // Argument signal: an LLM client identifier passed into the call, e.g.
-    // `extractBuildsFromCorpus(db, model, …)`.
-    const args = children.find(c => adapter.getNodeType(c) === 'arguments');
+    return false;
+}
+/**
+ * The base identifier a member-call chain is rooted at — `stmt` for `stmt.run(x)`
+ * and for `stmt.bind(x).run()` (the `.bind()` call's receiver), `db` for
+ * `db.select().from(…).where(…)`, `prisma` for `prisma.user.findUnique(…)`.
+ * Returns null when the chain is not a member call (a bare `helper(db, …)`) or
+ * has no identifier root (an indexed access `x[i]()`).
+ */
+function memberChainBaseIdentifier(node, adapter, sourceCode) {
+    const eagerCall = findEagerExecutionCall(node, adapter, sourceCode);
+    if (!eagerCall)
+        return null;
+    const memberExpr = findMemberCallee(eagerCall, adapter);
+    if (!memberExpr)
+        return null;
+    return baseIdentifierOfMemberExpr(memberExpr, adapter, sourceCode);
+}
+/**
+ * Recurse down a member_expression's object side to the base identifier: the
+ * object of `a.b.c` is `a.b`, whose object is `a`; the object of `stmt.bind(x)`
+ * is the call, whose own member callee is `stmt.bind`, whose object is `stmt`.
+ */
+function baseIdentifierOfMemberExpr(memberExpr, adapter, sourceCode) {
+    const object = adapter.getChildren(memberExpr).find((c) => {
+        const t = adapter.getNodeType(c);
+        return t !== 'property_identifier' && t !== 'field_identifier' && t !== '.';
+    });
+    if (!object)
+        return null;
+    const type = adapter.getNodeType(object);
+    if (type === 'identifier')
+        return adapter.getNodeText(object, sourceCode);
+    if (type === 'member_expression')
+        return baseIdentifierOfMemberExpr(object, adapter, sourceCode);
+    if (type === 'call_expression') {
+        const inner = findMemberCallee(object, adapter);
+        return inner ? baseIdentifierOfMemberExpr(inner, adapter, sourceCode) : null;
+    }
+    return null;
+}
+/**
+ * True when `name` is declared, in the enclosing function (or program), with a
+ * `.prepare()` initializer, at a position *outside* the loop. Walking the whole
+ * enclosing function is safe for this signal: the caller has already established
+ * `preparesInLoop` is false, so the only `.prepare()` sites are outside the loop,
+ * and requiring the declarator to sit before the loop excludes any same-named
+ * declaration in a sibling scope after it. (A same-named variable in a *nested*
+ * function would be a false match; that shadowing shape is not present in the
+ * measured corpora and is recorded here rather than silently dropped.)
+ */
+function identifierBoundToPrepareOutsideLoop(name, loopNode, adapter, sourceCode) {
+    const scope = findEnclosingFunctionNode(loopNode, adapter) ?? loopNode;
+    const loopStart = loopNode.range[0];
+    let found = false;
+    walkSubtree(scope, adapter, (n) => {
+        if (found)
+            return;
+        if (n === loopNode)
+            return;
+        if (adapter.getNodeType(n) !== 'variable_declarator')
+            return;
+        if (n.range[0] >= loopStart)
+            return;
+        const { name: declaredName, value } = splitDeclarator(n, adapter, sourceCode);
+        if (declaredName !== name)
+            return;
+        if (value && subtreeContainsPrepare(value, adapter, sourceCode))
+            found = true;
+    });
+    if (found)
+        return true;
+    // A parameter typed as a prepared-statement bundle (`stmts: StyleStatements`,
+    // `stmt: SqliteStatement`) is prepare-bound by construction — its members are
+    // the `.prepare()` results the caller hoisted before the loop. Re-running
+    // `stmts.decl.run(x)` is therefore the same hoisted-reuse signal as a local
+    // `const stmt = db.prepare(…)` re-run. A handle parameter (`SqliteDatabase`,
+    // `IndexHandle`, `any`) does not name a Statement type and keeps firing.
+    return scope !== loopNode && parameterBoundToStatementType(name, scope, adapter, sourceCode);
+}
+/**
+ * True when `name` is a parameter of `fnNode` whose type annotation names a
+ * prepared-statement type. The type is the signal (mirroring how a local
+ * declarator's `.prepare()` initializer is), never the parameter's name: a
+ * `*Statement`/`*Statements` annotation means the value is a compiled statement
+ * (or a bundle of them), so a loop that re-runs it re-runs pre-prepared SQL.
+ *
+ * @param name the parameter name to match
+ * @param fnNode the function node whose parameters are inspected
+ * @param adapter the language adapter used to read parameter nodes
+ * @param sourceCode the file source text for reading node text
+ * @returns true when the named parameter is annotated with a statement type
+ */
+export function parameterBoundToStatementType(name, fnNode, adapter, sourceCode) {
+    const params = adapter.getChildren(fnNode).find((c) => adapter.getNodeType(c) === 'formal_parameters');
+    if (!params)
+        return false;
+    for (const p of adapter.getChildren(params)) {
+        const t = adapter.getNodeType(p);
+        if (t !== 'required_parameter' && t !== 'optional_parameter')
+            continue;
+        // The parameter name is the `identifier` child; the type is the
+        // `type_annotation` child's text, read structurally (not by regex over the
+        // whole parameter text, which split `x: StatementFactory` into a name/type
+        // pair but then matched any `Statement…` prefix).
+        const nameNode = adapter.getChildren(p).find((c) => adapter.getNodeType(c) === 'identifier');
+        if (!nameNode)
+            continue;
+        if (adapter.getNodeText(nameNode, sourceCode) !== name)
+            continue;
+        const typeAnn = adapter.getChildren(p).find((c) => adapter.getNodeType(c) === 'type_annotation');
+        if (!typeAnn)
+            continue;
+        const typeText = adapter.getNodeText(typeAnn, sourceCode)?.trim() ?? '';
+        // A statement type *ends* in `Statement`/`Statements` (`SqliteStatement`,
+        // `StyleStatements`). `StatementFactory` embeds "Statement" but is a factory,
+        // not a statement type, so it does not qualify.
+        if (/Statement(s)?$/.test(typeText))
+            return true;
+    }
+    return false;
+}
+/** True when a subtree contains a `.prepare()` call (an initializer that is or
+ *  chains into `db.prepare(…)`, e.g. `db.prepare(sql).bind(…)`) or a `prepare*`
+ *  factory call (`prepareStyleClearStatements(rawDb)`) — a function whose whole
+ *  job is to return pre-prepared statement objects, so its name carries the same
+ *  "statement prepared here" signal the `.prepare()` member call does. */
+function subtreeContainsPrepare(node, adapter, sourceCode) {
+    let found = false;
+    walkSubtree(node, adapter, (n) => {
+        if (found || adapter.getNodeType(n) !== 'call_expression')
+            return;
+        if (dbCallMethodName(n, adapter, sourceCode) === 'prepare') {
+            found = true;
+            return;
+        }
+        const callee = getCallExpressionCallee(n, adapter);
+        if (callee && adapter.getNodeType(callee) === 'identifier') {
+            const name = adapter.getNodeText(callee, sourceCode);
+            if (name && /^prepare/i.test(name))
+                found = true;
+        }
+    });
+    return found;
+}
+/**
+ * §13.1: True when `node` sits inside a `db.transaction(fn)` callback. Walks the
+ * parent chain looking for a `call_expression` whose callee is a
+ * `member_expression` with a `transaction` property. The loop is the input (not
+ * the DB call) so a transaction that wraps only a single per-iteration call —
+ * `for (…) { db.transaction(() => run()) }` — does not read as "batched": there
+ * the loop itself is outside the transaction and every iteration commits
+ * separately, so it must still fire.
+ */
+function isInsideDbTransaction(node, adapter, sourceCode) {
+    let current = node;
+    while (current) {
+        const parent = adapter.getParent(current);
+        if (!parent)
+            break;
+        if (adapter.getNodeType(parent) === 'call_expression') {
+            const callee = adapter.getChildren(parent).find((c) => adapter.getNodeType(c) === 'member_expression');
+            if (callee && memberPropertyName(callee, adapter, sourceCode) === 'transaction') {
+                return true;
+            }
+        }
+        current = parent;
+    }
+    return false;
+}
+/**
+ * §13.1 (transaction-wrapped-helper discriminator): names of the functions this
+ * file invokes *inside* a `db.transaction(fn)` callback — either as a
+ * `this.method(...)` call (`this.db.transaction(() => this.syncFileIndexRow(...))`)
+ * or as a free function reference/call (`rawDb.transaction(insertAll)`, or
+ * `rawDb.transaction(() => { … insertOne(…) })`). A private helper written to run
+ * inside the caller's transaction has its per-iteration writes already batched
+ * into the caller's single commit, so its internal loops are not a batchable N+1
+ * *provided their statements are prepared outside the loop* (see the
+ * no-`.prepare()`-in-loop guard at the call site). This mirrors the textual
+ * {@link isInsideDbTransaction} check but bridges the call boundary: the loop
+ * lives in the helper's body while the transaction wraps the *call*, which the
+ * purely lexical check cannot see. A per-iteration `db.transaction(() => …)`
+ * *inside* a loop is unaffected — the helper is only recognized when it is the
+ * thing being invoked within a transaction callback.
+ */
+function collectTransactionWrappedFunctions(ast, adapter, sourceCode) {
+    const wrapped = new Set();
+    for (const callNode of adapter.findNodes(ast, {
+        custom: (n) => adapter.getNodeType(n) === 'call_expression',
+    })) {
+        const callee = adapter.getChildren(callNode).find((c) => adapter.getNodeType(c) === 'member_expression');
+        if (!callee || memberPropertyName(callee, adapter, sourceCode) !== 'transaction')
+            continue;
+        // (1) A bare function reference handed straight to `transaction` — the
+        // reducer shape `rawDb.transaction(insertAll)()`. The callback argument is
+        // the helper's name, not a call inside it.
+        const args = adapter.getChildren(callNode).find((c) => adapter.getNodeType(c) === 'arguments');
+        if (args) {
+            for (const arg of adapter.getChildren(args)) {
+                if (adapter.getNodeType(arg) !== 'identifier')
+                    continue;
+                const name = adapter.getNodeText(arg, sourceCode);
+                if (name)
+                    wrapped.add(name);
+            }
+        }
+        // (2) Calls inside the callback: `this.method(...)` and free-function calls
+        // (`insertOne(...)`).
+        walkSubtree(callNode, adapter, (n) => {
+            if (n === callNode)
+                return;
+            if (adapter.getNodeType(n) !== 'call_expression')
+                return;
+            const innerCallee = getCallExpressionCallee(n, adapter);
+            if (!innerCallee)
+                return;
+            if (adapter.getNodeType(innerCallee) === 'identifier') {
+                const name = adapter.getNodeText(innerCallee, sourceCode);
+                if (name)
+                    wrapped.add(name);
+                return;
+            }
+            if (adapter.getNodeType(innerCallee) !== 'member_expression')
+                return;
+            const obj = adapter.getChildren(innerCallee).find((c) => adapter.getNodeType(c) !== 'property_identifier');
+            const objText = obj ? adapter.getNodeText(obj, sourceCode) : '';
+            if (objText !== 'this')
+                return;
+            const prop = memberPropertyName(innerCallee, adapter, sourceCode);
+            if (prop)
+                wrapped.add(prop);
+        });
+    }
+    return wrapped;
+}
+/** Depth-first walk over an ASTNode subtree (children only, no parent links). */
+function walkSubtree(node, adapter, visitor) {
+    visitor(node);
+    for (const child of adapter.getChildren(node)) {
+        walkSubtree(child, adapter, visitor);
+    }
+}
+/**
+ * Array methods that transform one collection into another collection (a batch):
+ * the elements of a `.slice()`/`.splice()`/`.map()`/`.filter()`/`.concat()`/
+ * `.flatMap()` result are a *sub*-collection, not a single row.
+ */
+const COLLECTION_TRANSFORM_METHODS = new Set(['slice', 'splice', 'map', 'filter', 'concat', 'flatMap']);
+/**
+ * Free-function callee names that chunk a collection into batches — `chunk(ids,
+ * n)`, `chunkArray(ids, n)`, `partition(rows, p)`. Recognized by name (not by a
+ * slice call) because a chunking helper is a user-written function whose internal
+ * shape the analyzer cannot see; the name is the only stable signal.
+ */
+const CHUNK_HELPER_RE = /^(chunk|chunks|chunkArray|chunkBy|partition|paginate|paged)$/i;
+/** Split a `variable_declarator` into its name text and initializer (value) node. */
+function splitDeclarator(node, adapter, sourceCode) {
+    let name = null;
+    let value = null;
+    let pastEquals = false;
+    for (const child of adapter.getChildren(node)) {
+        const t = adapter.getNodeType(child);
+        if (t === '=' || t === 'equals') {
+            pastEquals = true;
+            continue;
+        }
+        if (t === ':' || t === 'type_annotation')
+            continue;
+        if (!pastEquals && !name && (t === 'identifier' || t === 'object_pattern' || t === 'array_pattern')) {
+            name = adapter.getNodeText(child, sourceCode);
+            continue;
+        }
+        if ((pastEquals || name) && !value)
+            value = child;
+    }
+    return { name, value };
+}
+/**
+ * §13.2: resolve a bare identifier to the initializer of the `const`/`let` that
+ * declares it inside the loop subtree (`const chunk = ids.slice(…)` → the slice
+ * call). Scoped to the loop so a same-named variable elsewhere in the function is
+ * not mistaken for the loop's chunk. Returns null when the identifier is the
+ * loop's own element (declared in a `for…of` header, not a `variable_declarator`).
+ */
+function resolveLoopLocalBinding(identifierNode, loopNode, adapter, sourceCode) {
+    const target = adapter.getNodeText(identifierNode, sourceCode);
+    if (!target)
+        return null;
+    let result = null;
+    walkSubtree(loopNode, adapter, (n) => {
+        if (result)
+            return;
+        if (adapter.getNodeType(n) !== 'variable_declarator')
+            return;
+        const { name, value } = splitDeclarator(n, adapter, sourceCode);
+        if (name === target)
+            result = value;
+    });
+    return result;
+}
+/**
+ * §13.2: true when `expr` denotes a collection-derived array — a batch of rows —
+ * rather than a single row's scalar. Three shapes qualify:
+ *   (a) a call to an array-transform method (`ids.slice(…)`, `rows.map(…)`);
+ *   (b) a call to a chunking helper (`chunkArray(ids, n)`);
+ *   (c) a local `const chunk = <one of the above>` bound inside the loop.
+ */
+function isCollectionDerivedExpression(expr, loopNode, adapter, sourceCode) {
+    const type = adapter.getNodeType(expr);
+    if (type === 'call_expression') {
+        const memberExpr = findMemberCallee(expr, adapter);
+        if (memberExpr) {
+            const method = memberPropertyName(memberExpr, adapter, sourceCode);
+            if (method && COLLECTION_TRANSFORM_METHODS.has(method))
+                return true;
+        }
+        const callee = getCallExpressionCallee(expr, adapter);
+        if (callee && adapter.getNodeType(callee) === 'identifier') {
+            const name = adapter.getNodeText(callee, sourceCode);
+            if (name && CHUNK_HELPER_RE.test(name))
+                return true;
+        }
+        return false;
+    }
+    if (type === 'identifier') {
+        const value = resolveLoopLocalBinding(expr, loopNode, adapter, sourceCode);
+        return value !== null && isCollectionDerivedExpression(value, loopNode, adapter, sourceCode);
+    }
+    return false;
+}
+/**
+ * §13.3: true when a DB call sits in the iterable/header of a `for…of` loop
+ * rather than its body. `for (const c of loadCatalog())` runs `loadCatalog` once
+ * (it memoizes the query) and iterates the returned array in memory — the query
+ * is not per-iteration. Only the header position qualifies; a DB call in the
+ * `statement_block` body still executes once per pass and keeps firing.
+ */
+function isForOfIterableDbCall(node, loopNode, adapter) {
+    if (adapter.getNodeType(loopNode) !== 'for_in_statement')
+        return false;
+    let body = null;
+    for (const child of adapter.getChildren(loopNode)) {
+        if (adapter.getNodeType(child) === 'statement_block') {
+            body = child;
+            break;
+        }
+    }
+    if (!body)
+        return false;
+    return !isDescendantOf(node, body, adapter);
+}
+/** True when `node` is `ancestor` or a descendant of it (parent-chain walk). */
+function isDescendantOf(node, ancestor, adapter) {
+    let cur = node;
+    while (cur) {
+        if (cur === ancestor)
+            return true;
+        cur = adapter.getParent(cur);
+    }
+    return false;
+}
+/**
+ * §13.2: the element and iterated-collection shape of a `for…of` loop. Needed to
+ * distinguish `for (const chunk of chunkArray(ids)) { run(…chunk) }` — spreading
+ * the loop element is a *batch* here because the collection itself is chunked —
+ * from `for (const row of rows) { run(…row) }` — spreading the element is a
+ * per-row write because the collection is a plain array.
+ */
+function forOfIteration(loopNode, adapter, sourceCode) {
+    const elementNames = new Set();
+    let iteratesChunkedCollection = false;
+    if (adapter.getNodeType(loopNode) !== 'for_in_statement') {
+        return { elementNames, iteratesChunkedCollection };
+    }
+    let element = null;
+    let collection = null;
+    for (const child of adapter.getChildren(loopNode)) {
+        const t = adapter.getNodeType(child);
+        if (t === 'statement_block')
+            break; // the body — nothing after it matters
+        if (!element && (t === 'identifier' || t === 'object_pattern' || t === 'array_pattern')) {
+            element = child;
+        }
+        else if (element && !collection) {
+            collection = child;
+        }
+    }
+    if (element) {
+        const name = adapter.getNodeText(element, sourceCode);
+        if (name)
+            elementNames.add(name);
+    }
+    if (collection) {
+        iteratesChunkedCollection = isCollectionDerivedExpression(collection, loopNode, adapter, sourceCode);
+    }
+    return { elementNames, iteratesChunkedCollection };
+}
+/**
+ * §13.2 (per-batch binding discriminator): true when the DB call executes I/O
+ * that binds a *batch* — a spread of a collection-derived expression — rather
+ * than per-row scalars, so it is not an N+1. The eager call (`stmt.run(…)`, or
+ * the `.run(…)` chained off `db.prepare(…)`) is where parameters are bound; its
+ * arguments decide the row-vs-batch question.
+ */
+function bindsBatchArgument(node, loopNode, adapter, sourceCode) {
+    const eagerCall = findEagerExecutionCall(node, adapter, sourceCode);
+    if (!eagerCall)
+        return false;
+    const argsNode = adapter.getChildren(eagerCall).find((c) => adapter.getNodeType(c) === 'arguments');
+    if (!argsNode)
+        return false;
+    const { elementNames, iteratesChunkedCollection } = forOfIteration(loopNode, adapter, sourceCode);
+    for (const arg of adapter.getChildren(argsNode)) {
+        if (adapter.getNodeType(arg) === 'spread_element') {
+            const operand = adapter.getChildren(arg).find((c) => adapter.getNodeType(c) !== '...');
+            if (!operand)
+                continue;
+            // Spreading the loop's own element is per-row (`…row`) unless the element
+            // is itself a chunk of a chunked collection (`for (const chunk of chunkArray(ids))`).
+            if (adapter.getNodeType(operand) === 'identifier' &&
+                elementNames.has(adapter.getNodeText(operand, sourceCode))) {
+                if (iteratesChunkedCollection)
+                    return true;
+                continue;
+            }
+            if (isCollectionDerivedExpression(operand, loopNode, adapter, sourceCode))
+                return true;
+            continue;
+        }
+        // A bare collection-derived argument (no spread) is also a batch:
+        // `run(rows.map(…))`, or a chunk bound inside the loop (`const chunk =
+        // rows.slice(…)` then `run(chunk)` — the identifier resolves to the slice).
+        // A bare loop-element identifier (`for (const row of rows) run(row)`) is NOT
+        // collection-derived: `resolveLoopLocalBinding` only sees `variable_declarator`
+        // bindings, and a `for…of` element is declared in the header, so `row` stays
+        // unresolved and the call keeps firing as per-row.
+        if ((adapter.getNodeType(arg) === 'call_expression' ||
+            adapter.getNodeType(arg) === 'identifier') &&
+            isCollectionDerivedExpression(arg, loopNode, adapter, sourceCode)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * §13.2: the eager I/O call that actually binds parameters for a DB call — the
+ * call itself when it is eager (`stmt.run(…)`, `db.query(…)`), or the eager call
+ * chained off a statement-construction call (`db.prepare(sql).run(…)`). Returns
+ * null when the call never executes I/O (already filtered upstream).
+ */
+function findEagerExecutionCall(node, adapter, sourceCode) {
+    const call = resolveDbCallNode(node, adapter);
+    if (!call)
+        return null;
+    const direct = dbCallMethodName(call, adapter, sourceCode);
+    if (direct && EAGER_DB_METHODS.has(direct)) {
+        const memberExpr = findMemberCallee(call, adapter);
+        if (!(memberExpr && isPromiseAllMember(memberExpr, adapter, sourceCode)))
+            return call;
+    }
+    let cur = adapter.getParent(call);
+    while (cur) {
+        const type = adapter.getNodeType(cur);
+        if (type === 'call_expression') {
+            const memberExpr = findMemberCallee(cur, adapter);
+            const name = memberExpr ? memberPropertyName(memberExpr, adapter, sourceCode) : null;
+            if (name && EAGER_DB_METHODS.has(name) && !isPromiseAllMember(memberExpr, adapter, sourceCode)) {
+                return cur;
+            }
+        }
+        if (type === 'expression_statement' ||
+            type === 'variable_declarator' ||
+            type === 'return_statement' ||
+            type === 'lexical_declaration' ||
+            type === 'for_statement' ||
+            type === 'for_in_statement' ||
+            type === 'while_statement' ||
+            type === 'statement_block' ||
+            type === 'block') {
+            break;
+        }
+        cur = adapter.getParent(cur);
+    }
+    return null;
+}
+/**
+ * Classify a call_expression as an LLM/agent invocation via three unambiguous
+ * signals: a provider/SDK namespace in the callee text, an LLM action verb in the
+ * callee text, or a model-client identifier passed as an argument / used as the
+ * member-callee object.
+ */
+function isLlmCallNode(node, adapter, sourceCode) {
+    const children = adapter.getChildren(node);
+    const callee = children.find(c => adapter.getNodeType(c) !== 'arguments');
+    if (callee) {
+        const calleeText = adapter.getNodeText(callee, sourceCode);
+        if (LLM_PROVIDER_RE.test(calleeText) || LLM_ACTION_RE.test(calleeText))
+            return true;
+        // Member callee whose object is an LLM client: `model.chat(…)`, `llm.invoke(…)`.
+        if (adapter.getNodeType(callee) === 'member_expression') {
+            const obj = adapter.getChildren(callee).find(c => adapter.getNodeType(c) === 'identifier');
+            if (obj && LLM_CLIENT_ARG_NAMES.has(adapter.getNodeText(obj, sourceCode)))
+                return true;
+        }
+    }
+    // Argument signal: an LLM client identifier passed into the call, e.g.
+    // `extractBuildsFromCorpus(db, model, …)`.
+    const args = children.find(c => adapter.getNodeType(c) === 'arguments');
     if (args) {
         for (const arg of adapter.getChildren(args)) {
             if (adapter.getNodeType(arg) === 'identifier' &&
@@ -1544,48 +2746,31 @@ function isLlmCallNode(node, adapter, sourceCode) {
     }
     return false;
 }
-/** True when `node` is a function call whose callee is DB-provenanced. */
-function isDBProvenancedFunctionCall(node, adapter, sourceCode, provenanceContext) {
-    return isFunctionCall(node, adapter) &&
-        isDBProvenanced(node, { adapter, sourceCode, context: provenanceContext, methods: DB_CALL_METHODS });
-}
 /**
  * R4.1: Determine if a node is a database call expression.
- * Spec 21: When provenance context is available, uses provenance-based detection
- * (conjunctive guard — never name alone). In names mode or without context,
- * falls back to the legacy dbPatterns text match.
+ * Spec 21: provenance-based detection (conjunctive guard — never name alone).
+ *
+ * Spec 70 R3/R4: handle-ness is decided once, by `identifyHandle` (via
+ * `handleVerdictForCall`); only a proven `handle` — a parsed SQL argument (R3)
+ * or a package in the manifest (R4) — is a DB node for the loop walk. `unproven`
+ * is `cannot-fire` (visible, never a finding), so a `map.delete()` / `set.join()`
+ * on an unresolved receiver does not read as a DB call inside a loop.
+ *
+ * The legacy `dbPatterns` substring fallback (a call whose *text* contained
+ * `select`/`insert`/`delete`/…) is deleted, not fixed: `buildDataAccessScan`
+ * always provides a provenance context (`mode` defaults to `'hybrid'`), so the
+ * no-context / `names`-mode arm was unreachable in a default run. Without
+ * provenance there is no honest handle verdict, so the node is not a DB call.
+ *
+ * @param node the candidate call node to classify
+ * @param scan the data-access scan context (adapter, source, provenance)
+ * @returns true when the node's handle verdict is `handle`
  */
-function isDbCallNode(node, adapter, sourceCode, provenanceContext) {
-    // Spec 21: Provenance-first detection when context is available
+export function isDbCallNode(node, scan) {
+    const { provenanceContext } = scan;
     if (provenanceContext && provenanceContext.mode !== 'names') {
-        // In provenance or hybrid mode, use provenance check
-        if (isDBProvenancedFunctionCall(node, adapter, sourceCode, provenanceContext)) {
-            return true;
-        }
-        // Spec 17 R2: Template literal is a DB node only when it sits
-        // inside a DB-provenanced call's arguments — no content scan.
-        if (isTemplateLiteral(node, adapter)) {
-            const parent = adapter.getParent(node);
-            if (parent && adapter.getNodeType(parent) === 'arguments') {
-                const callExpr = adapter.getParent(parent);
-                if (callExpr && adapter.getNodeType(callExpr) === 'call_expression') {
-                    return isDBProvenancedFunctionCall(callExpr, adapter, sourceCode, provenanceContext);
-                }
-            }
-            return false;
-        }
-        return false;
-    }
-    // Legacy fallback: name-based matching for names mode / no context.
-    // Template-literal content scanning is removed (Spec 17 R2) — without
-    // provenance context, we can't determine if a template literal is SQL;
-    // function-call-based SQL detection still works via dbPatterns match.
-    const nodeText = adapter.getNodeText(node, sourceCode);
-    if (isFunctionCall(node, adapter)) {
-        const dbPatterns = ['select', 'insert', 'update', 'delete', 'from', 'where', 'execute', 'query', 'find', 'aggregate', 'count', 'distinct'];
-        if (dbPatterns.some(pattern => nodeText.toLowerCase().includes(pattern))) {
-            return true;
-        }
+        const verdict = handleVerdictForCall(node, scan);
+        return verdict !== null && verdict.kind === 'handle';
     }
     return false;
 }
@@ -1597,7 +2782,7 @@ function isDbCallNode(node, adapter, sourceCode, provenanceContext) {
  *   - for / while / do loops via adapter.isLoop()
  *   - .forEach / .map / .filter callbacks via AST pattern matching
  */
-function findEnclosingLoop(node, adapter) {
+function findEnclosingLoop(node, adapter, sourceCode) {
     let current = node;
     let depth = 0;
     const foundLoops = [];
@@ -1610,7 +2795,7 @@ function findEnclosingLoop(node, adapter) {
             foundLoops.push(parent);
         }
         // Check for iterator callbacks (.forEach, .map, .filter, etc.)
-        if (isIteratorCallback(parent, adapter)) {
+        if (isIteratorCallback(parent, current, adapter, sourceCode)) {
             foundLoops.push(parent);
         }
         current = parent;
@@ -1628,47 +2813,46 @@ function findEnclosingLoop(node, adapter) {
  * R4.1: Check if a node is a call_expression invoking an iterator method
  * (.forEach, .map, .filter, .reduce, .some, .every) — these create
  * implicit loops where a DB query inside the callback is an N+1 risk.
+ *
+ * `child` is the node one level below `node` on the walk-up path from the query.
+ * An iterator call only encloses the query when the query sits *inside the
+ * callback argument* (an arrow/function expression), not when the query is the
+ * *subject* the method is called on. `this.db.prepare(sql).all().map(r => …)`
+ * runs the query once and maps the rows in memory — a single query, not an N+1
+ * — yet without this check the `.map` call would read as an enclosing loop
+ * because the query is a descendant of the call expression. Only a query inside
+ * the callback body executes once per iteration.
  */
-function isIteratorCallback(node, adapter) {
+function isIteratorCallback(node, child, adapter, sourceCode) {
     // Must be a call_expression
-    if (node.type !== 'call_expression')
+    if (adapter.getNodeType(node) !== 'call_expression')
         return false;
     // Callee must be a member_expression whose property matches iterator method names
     const children = adapter.getChildren(node);
-    const callee = children.find(c => c.type === 'member_expression');
+    const callee = children.find(c => adapter.getNodeType(c) === 'member_expression');
     if (!callee)
         return false;
     const calleeChildren = adapter.getChildren(callee);
-    const propertyNode = calleeChildren.find(c => c.type === 'property_identifier' || c.type === 'string');
+    const propertyNode = calleeChildren.find(c => adapter.getNodeType(c) === 'property_identifier' || adapter.getNodeType(c) === 'string');
     if (!propertyNode)
         return false;
-    const methodName = adapter.getNodeType(propertyNode) === 'property_identifier'
-        ? propertyNode.text ?? adapter.getNodeText(propertyNode, '')
-        : '';
-    // Normalize: the method name might come from the node type or need text extraction
     const iteratorMethods = ['forEach', 'map', 'filter', 'reduce', 'some', 'every', 'find', 'findIndex', 'flatMap'];
-    // Try multiple ways to get the method name
-    const propText = methodName || getPropertyName(propertyNode, adapter);
-    return iteratorMethods.includes(propText);
-}
-/**
- * Extract the property name from a property_identifier node.
- */
-function getPropertyName(node, adapter) {
-    // Try named children
-    if (node.name)
-        return node.name;
-    if (node.text)
-        return node.text;
-    // Try to get it from children
-    const children = adapter.getChildren(node);
-    for (const child of children) {
-        if (child.name)
-            return child.name;
-        if (child.text)
-            return child.text;
-    }
-    return '';
+    // The property text must come from the source slice (web-tree-sitter nodes
+    // carry no `.text`/`.name` payload; `getNodeText` with the real source is the
+    // established extraction — cf. `memberPropertyName`). Passing an empty string
+    // here returned '' for every node, so iterator callbacks were never matched.
+    const propText = adapter.getNodeText(propertyNode, sourceCode);
+    if (!iteratorMethods.includes(propText))
+        return false;
+    // The direct child on the path from the query must be the call's `arguments`
+    // list (the callback), not the callee/subject the method is invoked on. The
+    // child is the immediate descendant of the call_expression that the query sits
+    // under: `arguments` when the query is inside the callback, the `member_expression`
+    // callee when the query is the *subject* (`db.prepare(sql).all().map(r => …)`
+    // runs once and maps rows in memory). Checking the child's node type directly —
+    // rather than the callback function's — is what survives the `arguments` node
+    // tree-sitter inserts between the call and its arrow/function argument.
+    return adapter.getNodeType(child) === 'arguments';
 }
 /**
  * The enclosing-function identity used for stable fingerprint symbols. The
@@ -1676,74 +2860,508 @@ function getPropertyName(node, adapter) {
  * definition lives in codeAnalysis.ts (Spec 61 Amendment A).
  */
 const enclosingIdentity = (node, adapter, filePath) => functionIdentityLabel(findEnclosingFunctionIdentity(node, adapter, filePath));
+/** Build the shared data-access scan context (config + provenance + imports). */
 /**
- * Universal data access analyzer.
- */
-export class UniversalDataAccessAnalyzer extends UniversalAnalyzer {
-    name = 'data-access';
-    description = 'Analyzes database access patterns and data layer interactions';
-    category = 'security';
-    async analyzeAST(ast, adapter, config, sourceCode) {
-        return (await this.analyzeWithFacts(ast, adapter, config, sourceCode)).violations;
-    }
-    /**
-     * Spec 62 Amendment B — run the full data-access scan and return BOTH the
-     * violations and the extracted query facts (`DatabaseCall[]`). The pipeline's
-     * data-access visitor emits the calls as facts for the Stage-4
-     * `missing-org-filter` derived reducer to join against the declared + DDL
-     * tenant tiers; the remaining rules (sql-injection, loop-query,
-     * unfiltered-query, hardcoded-connection, complex-query) fire here at Stage 2
-     * exactly as before. Emitting the calls as a by-product of this one scan
-     * avoids a second traversal or re-parse.
-     */
-    async analyzeWithFacts(ast, adapter, config, sourceCode) {
-        const violations = [];
-        const finalConfig = { ...DEFAULT_DATA_ACCESS_CONFIG, ...config };
-        // Spec 21 R1: provenance-primary detection (names owned by THIS analyzer).
-        const detectionMode = finalConfig.detection?.mode ?? 'hybrid';
-        const p0 = performance.now();
-        const provenanceContext = buildProvenanceContext(ast, adapter, sourceCode, {
-            mode: detectionMode,
-            dbReceiverNames: finalConfig.dbReceiverNames,
-            dbBindingNames: finalConfig.dbBindingNames,
-            dbCallMethods: finalConfig.dbCallMethods,
-            dbWrapperNames: finalConfig.dbWrapperNames,
-        });
-        const timingAcc = config._provenanceTiming;
-        if (timingAcc)
-            timingAcc.totalMs += performance.now() - p0;
-        // Spec 34: bundle per-file context to stay under the 4-parameter gate.
-        const scan = {
-            adapter,
-            sourceCode,
-            dbImports: mapDatabaseImports(adapter.extractImports(ast), finalConfig),
-            config: finalConfig,
-            provenanceContext,
-        };
-        // Spec 55 R3 — test/spec files are excluded from the query-shape rules
-        // (loop-query, unfiltered-query). Security and org-filter rules still fire:
-        // a test with a hardcoded connection string or an injected query is as real
-        // a signal as in production code. `skipTestFiles: false` overrides (oracle
-        // fixtures assert positive loop-query detections on files under __tests__).
-        const skipTestRules = finalConfig.skipTestFiles !== false && isTestOrSpecPath(ast.filePath);
-        // Analyze each database call, tracking symbol ordinals for stable fingerprints.
-        const calls = extractDatabaseCalls(ast, scan);
-        const symbolOrdinals = new Map();
-        for (const call of calls) {
-            const analysis = analyzeQuery(call, finalConfig);
-            violations.push(...checkViolations(call, analysis, {
-                filePath: ast.filePath,
-                config: finalConfig,
-                symbolOrdinals,
-                skipTestRules,
-            }));
-        }
-        // R4.1: loop-query (N+1) detection + general patterns.
-        if (!skipTestRules) {
-            violations.push(...checkLoopQueries(ast, scan));
+ * Build the TypeScript binding environment `identifyHandle` reads for declaration
+ * resolution, keyed to the file's own imports/declarations plus the within-file
+ * provenance set. Absent (undefined) for Go, which resolves cross-file and has no
+ * `RootResolutionEnv`.
+ */
+function buildHandleEnv(ast, adapter, sourceCode, provenanceContext) {
+    if (adapter.name === 'go')
+        return undefined;
+    return {
+        provenance: provenanceContext.dbProvenanced,
+        bindings: buildBindingEnv(ast, adapter, sourceCode),
+        interfaceFields: extractInterfaceFields(ast, adapter, sourceCode),
+        adapter,
+        sourceCode,
+    };
+}
+/** Build the Go binding environment `identifyHandle` reads for Go declaration
+ *  resolution. The provenance seed (cross-file `db *sql.DB` resolution) is what
+ *  proves `handle`; bindings + imports let `classifyGoRootIdentifier` dispose a
+ *  non-seeded receiver (`unproven` for an unrecognized package, `not-handle` for
+ *  a non-DB binding). Absent (undefined) for non-Go formats. */
+function buildGoEnv(ast, adapter, sourceCode, provenanceContext) {
+    if (adapter.name !== 'go')
+        return undefined;
+    return {
+        provenance: provenanceContext.dbProvenanced,
+        bindings: buildGoBindingEnv(ast, adapter, sourceCode),
+        imports: buildGoImportMap(ast, adapter),
+        adapter,
+        sourceCode,
+    };
+}
+function buildDataAccessScan(ast, adapter, sourceCode, config) {
+    const finalConfig = { ...DEFAULT_DATA_ACCESS_CONFIG, ...config };
+    const detectionMode = finalConfig.detection?.mode ?? 'hybrid';
+    const seedProvenance = config?._receiverProvenance;
+    const provenanceContext = buildProvenanceContext(ast, adapter, sourceCode, {
+        mode: detectionMode,
+        dbBindingNames: finalConfig.dbBindingNames,
+        dbWrapperNames: finalConfig.dbWrapperNames,
+        seedProvenance,
+        // Spec 70 criterion 8 — thread the corpus's dialect so R3 proves a receiver
+        // whose (now-deleted) type annotation was its only signal, and so wrapper
+        // detection (detectDbWrappers) sees the proven receiver in helper bodies.
+        sqlDialect: finalConfig.dialect ?? null,
+    });
+    return {
+        adapter,
+        sourceCode,
+        config: finalConfig,
+        ast,
+        provenanceContext,
+        handleEnv: buildHandleEnv(ast, adapter, sourceCode, provenanceContext),
+        goEnv: buildGoEnv(ast, adapter, sourceCode, provenanceContext),
+    };
+}
+/**
+ * Spec 68 §3.2 — the `data-access-calls` FileProcessor extraction, factored out
+ * of `analyzeWithFacts` so the phase-model producer can obtain the per-file
+ * resolved calls synchronously (the analyzer method is `async` but does no real
+ * awaits — its body is entirely synchronous). Returns the `DatabaseCall[]` the
+ * missing-org-filter / unfiltered-query / sql-injection-risk rules read, with no
+ * violation production and no side effects. Config is the §10 tuning surface;
+ * omitted here, the extraction runs on {@link DEFAULT_DATA_ACCESS_CONFIG}.
+ * @param ast The parsed file AST.
+ * @param adapter The language adapter for the file's syntax.
+ * @param sourceCode The raw source text.
+ * @param config The data-access analyzer config (defaults when omitted).
+ * @returns The database calls extracted from the file.
+ */
+export function extractDataAccessCalls(ast, adapter, sourceCode, config) {
+    return extractDatabaseCalls(ast, buildDataAccessScan(ast, adapter, sourceCode, config));
+}
+/**
+ * Extract the loop-query candidates (loops whose body issues a DB call) as the
+ * serializable `LoopQueryCandidate[]` the `loop-queries` producer projects. The
+ * candidate set is exactly what `checkLoopQueries` reduces to findings, computed
+ * on the same provenance context — so detection parity holds by construction,
+ * not by re-implementation. Config is the §10 tuning surface; omitted here, the
+ * extraction runs on {@link DEFAULT_DATA_ACCESS_CONFIG}.
+ * @param ast The parsed file AST.
+ * @param adapter The language adapter for the file's syntax.
+ * @param sourceCode The raw source text.
+ * @param config The data-access analyzer config (defaults when omitted).
+ * @returns The loop-query candidates extracted from the file.
+ */
+export function extractLoopQueries(ast, adapter, sourceCode, config) {
+    return collectLoopQueryCandidates(ast, buildDataAccessScan(ast, adapter, sourceCode, config));
+}
+// ── Spec 70 Item 4 (step 3) — raw candidate extractors ───────────────────────
+//
+// The two remaining receiver consumers (`data-access-calls`, `loop-queries`) are
+// converted to corpus producers: while the AST lives, these extractors project the
+// *provenance-free* half of `buildDatabaseCall` / `collectLoopQueryCandidates` into
+// serializable candidates, and the corpus producers re-fold the provenance-dependent
+// half (the `identifyHandle` verdict → admission + injection-risk gate, the site
+// dialect → the SQL parse, and the loop dedup) over the re-derived `dbProvenanced`.
+// They run on an EMPTY-provenance scan so `checkQuerySecurity`'s wrapper arm sees
+// only `config.dbWrapperNames` (the learned wrappers are corrected corpus-side).
+/** Build a scan with an empty provenance context — the raw producer's discovery and
+ *  static-security arms must not read the cross-file seed (which only the corpus
+ *  producer sees), so every provenance-dependent signal is captured as an identity
+ *  and re-folded later. `handleEnv`/`goEnv` still build their provenance-free
+ *  bindings/imports, which the structural discovery predicates read. */
+function buildCandidateScan(ast, adapter, sourceCode, config) {
+    const finalConfig = { ...DEFAULT_DATA_ACCESS_CONFIG, ...config };
+    const provenanceContext = {
+        dbProvenanced: new Map(),
+        validatorProvenanced: new Map(),
+        mode: finalConfig.detection?.mode ?? 'hybrid',
+        dbActivity: new Set(),
+    };
+    return {
+        adapter,
+        sourceCode,
+        config: finalConfig,
+        ast,
+        provenanceContext,
+        handleEnv: buildHandleEnv(ast, adapter, sourceCode, provenanceContext),
+        goEnv: buildGoEnv(ast, adapter, sourceCode, provenanceContext),
+    };
+}
+// ── Structural discovery (empty-provenance supersets) ────────────────────────
+/** True when `node` is a bare-identifier call whose callee name has any binding —
+ *  the raw-side superset of `handleVerdictForCall`'s identifier arm. A provenanced
+ *  wrapper, a type-annotated handle, or a propagated local are all *bound*, so a
+ *  name with no binding is provably not a handle candidate and is dropped here. */
+function isBoundIdentifierCall(node, scan) {
+    const { adapter, sourceCode, handleEnv } = scan;
+    if (!handleEnv)
+        return false;
+    if (adapter.getNodeType(node) !== 'call_expression')
+        return false;
+    const callee = getCallExpressionCallee(node, adapter);
+    if (!callee || callee.type !== 'identifier')
+        return false;
+    const name = adapter.getNodeText(callee, sourceCode);
+    return !!name && handleEnv.bindings.has(name);
+}
+/** True when `node` is a member/selector call whose receiver root is DB-shaped
+ *  (handle or unproven) or that carries a static SQL argument — the structural
+ *  superset of `handleVerdictForCall`'s member arm (and Go's selector arm, which
+ *  is the same shape). The package discriminant — not the method name — admits a
+ *  receiver (`join` is `Array.prototype.join` and also `SQL JOIN`); the empty
+ *  provenance of the candidate scan makes more roots `unproven`, so this stays a
+ *  strict superset of the corpus-side re-fold. */
+function isMemberShapeCall(node, scan) {
+    const { adapter, sourceCode, handleEnv, goEnv } = scan;
+    if (adapter.getNodeType(node) !== 'call_expression')
+        return false;
+    const callee = getCallExpressionCallee(node, adapter);
+    if (!callee || (callee.type !== 'member_expression' && callee.type !== 'selector_expression'))
+        return false;
+    const root = resolveReceiverRoot(callee, adapter, sourceCode);
+    if (root === null)
+        return false;
+    const sqlArg = adapter.name === 'go'
+        ? extractGoStaticSql(node, adapter, sourceCode, goEnv)
+        : extractStaticSql(node, adapter, sourceCode);
+    if (sqlArg === null) {
+        return adapter.name === 'go'
+            ? !!goEnv && classifyGoRootIdentifier(root, goEnv) !== 'not-handle'
+            : !!handleEnv && isDbShapedRoot(root, handleEnv, { thisField: receiverIsThisRooted(callee, adapter) });
+    }
+    return true;
+}
+/** True when `node` is a template literal whose enclosing call is a bound-identifier
+ *  or member-shape call — the raw-side superset of `handleVerdictForCall`'s template
+ *  branch (`callNode = enclosingCallOf(template)`). */
+function isTemplateOfDbCall(node, scan) {
+    const { adapter, sourceCode, config } = scan;
+    if (!isTemplateLiteral(node, adapter))
+        return false;
+    const callNode = enclosingCallOf(node, adapter);
+    if (!callNode)
+        return false;
+    // A tagged template (`this.sql`…``, `sql`…``) carries its template as its own
+    // body, not as a template *argument* to a DB call. The tag is already a
+    // candidate via `isTaggedTemplateSqlCall`; re-admitting the body here would
+    // double-discover the site and let the body (method `unknown`) shadow the tag
+    // (method `sql`) in line dedup.
+    const tagNames = config.sqlTagNames ?? SQL_TAG_NAMES;
+    if (isTaggedTemplateSqlCall(callNode, adapter, sourceCode, tagNames))
+        return false;
+    return isBoundIdentifierCall(callNode, scan) || isMemberShapeCall(callNode, scan);
+}
+/** The broadened data-access discovery — a strict superset of `isDbCallCandidate`
+ *  over the same pre-order. The three shape arms (query-builder, tagged template,
+ *  variable assignment) are provenance-free; the identifier/member/template arms
+ *  cover every `handleVerdictForCall` shape with the empty seed. */
+function isBroadenedDataAccessCandidate(node, scan, tagNames) {
+    const { adapter, sourceCode } = scan;
+    if (isQueryBuilderShape(node, adapter, sourceCode))
+        return true;
+    if (isTaggedTemplateSqlCall(node, adapter, sourceCode, tagNames))
+        return true;
+    if (isVariableAssignment(node, adapter) && extractStaticSql(node, adapter, sourceCode) !== null)
+        return true;
+    if (isBoundIdentifierCall(node, scan))
+        return true;
+    if (isMemberShapeCall(node, scan))
+        return true;
+    if (isTemplateOfDbCall(node, scan))
+        return true;
+    return false;
+}
+/** The broadened loop-query discovery — a strict superset of `isDbCallNode` (which
+ *  is `handleVerdictForCall(node).kind === 'handle'`). The template-literal branch is
+ *  skipped later (as in `collectLoopQueryCandidates`), so only the two structural
+ *  call arms remain. */
+function isBroadenedLoopCandidate(node, scan) {
+    return isBoundIdentifierCall(node, scan) || isMemberShapeCall(node, scan);
+}
+const NULL_HANDLE_IDENTITY = {
+    calleeType: null, name: null, root: null, receiver: null, method: null,
+    thisField: false, thisHeritage: null, sqlArg: null, siteReceiver: null, scope: 0,
+};
+/** Project `handleVerdictForCall`'s structural gates (without `identifyHandle`) into
+ *  the identity the corpus producer re-folds. Mirrors the TS identifier/member arms
+ *  and the Go selector arm exactly — same method/root gates, same template → enclosing
+ *  call resolution, same `extractStaticSql(callNode)` argument. */
+function handleCallSiteIdentity(node, scan) {
+    const { adapter, sourceCode } = scan;
+    if (adapter.name === 'go') {
+        // Go selector arm (goHandleVerdictForCall) — node is always a call_expression.
+        if (!isFunctionCall(node, adapter))
+            return NULL_HANDLE_IDENTITY;
+        const callee = getCallExpressionCallee(node, adapter);
+        if (!callee || callee.type !== 'selector_expression')
+            return NULL_HANDLE_IDENTITY;
+        const method = extractMemberExpressionProperty(callee, adapter, sourceCode);
+        if (!method)
+            return NULL_HANDLE_IDENTITY;
+        const root = resolveReceiverRoot(callee, adapter, sourceCode);
+        if (root === null)
+            return NULL_HANDLE_IDENTITY;
+        const sqlArg = extractGoStaticSql(node, adapter, sourceCode, scan.goEnv);
+        if (sqlArg === null && (!scan.goEnv || classifyGoRootIdentifier(root, scan.goEnv) === 'not-handle')) {
+            return NULL_HANDLE_IDENTITY;
         }
-        violations.push(...checkGeneralPatterns(ast, adapter, sourceCode, finalConfig));
-        return { violations, calls };
+        const receiver = getMemberExpressionReceiver(callee, adapter, sourceCode) ?? root;
+        return {
+            calleeType: 'member', name: null, root, receiver, method, thisField: false,
+            thisHeritage: null,
+            sqlArg,
+            siteReceiver: getMemberExpressionReceiver(callee, adapter, sourceCode),
+            scope: 0,
+        };
+    }
+    const callNode = isTemplateLiteral(node, adapter) ? enclosingCallOf(node, adapter) : node;
+    if (!callNode || !isFunctionCall(callNode, adapter))
+        return NULL_HANDLE_IDENTITY;
+    if (callNode.type === 'new_expression')
+        return NULL_HANDLE_IDENTITY;
+    const callee = getCallExpressionCallee(callNode, adapter);
+    if (!callee)
+        return NULL_HANDLE_IDENTITY;
+    if (callee.type === 'identifier') {
+        const name = adapter.getNodeText(callee, sourceCode);
+        if (!name)
+            return NULL_HANDLE_IDENTITY;
+        return {
+            calleeType: 'identifier', name, root: name, receiver: name, method: name,
+            thisField: false,
+            thisHeritage: null,
+            sqlArg: extractStaticSql(callNode, adapter, sourceCode),
+            siteReceiver: null,
+            scope: findEnclosingFunctionNode(callNode, adapter)?.range[0] ?? 0,
+        };
+    }
+    if (callee.type !== 'member_expression' && callee.type !== 'selector_expression') {
+        return NULL_HANDLE_IDENTITY;
+    }
+    const method = extractMemberExpressionProperty(callee, adapter, sourceCode);
+    if (!method)
+        return NULL_HANDLE_IDENTITY;
+    const root = resolveReceiverRoot(callee, adapter, sourceCode);
+    if (root === null)
+        return NULL_HANDLE_IDENTITY;
+    const sqlArg = extractStaticSql(callNode, adapter, sourceCode);
+    const thisRooted = receiverIsThisRooted(callee, adapter);
+    if (sqlArg === null && (!scan.handleEnv || !isDbShapedRoot(root, scan.handleEnv, { thisField: thisRooted }))) {
+        return NULL_HANDLE_IDENTITY;
+    }
+    const receiver = getMemberExpressionReceiver(callee, adapter, sourceCode) ?? root;
+    // Spec 70 Q3 — a `this.<root>` receiver resolves to the enclosing class's
+    // base-class field type (`extends WorkflowEntrypoint<Env>` → `this.env` is
+    // `Env`), re-folded through the member path by the same heritage seam as the
+    // build side. The raw `extends` text is carried, resolved at fold time; null
+    // when not `this`-rooted or the class has no base class.
+    const thisHeritage = thisRooted
+        ? findEnclosingClassHeritage(scan.ast, adapter, callNode, sourceCode)
+        : null;
+    return {
+        calleeType: 'member', name: null, root, receiver, method,
+        thisField: thisRooted,
+        thisHeritage,
+        sqlArg,
+        siteReceiver: getMemberExpressionReceiver(callee, adapter, sourceCode),
+        scope: findEnclosingFunctionNode(callNode, adapter)?.range[0] ?? 0,
+    };
+}
+function siteDialectIdentity(node, scan) {
+    const { adapter, sourceCode } = scan;
+    const callee = getCallExpressionCallee(node, adapter);
+    if (!callee)
+        return { calleeType: null, name: null, receiver: null };
+    if (callee.type === 'identifier') {
+        return { calleeType: 'identifier', name: adapter.getNodeText(callee, sourceCode) || null, receiver: null };
+    }
+    if (callee.type === 'member_expression' || callee.type === 'selector_expression') {
+        return { calleeType: 'member', name: null, receiver: getMemberExpressionReceiver(callee, adapter, sourceCode) };
+    }
+    return { calleeType: null, name: null, receiver: null };
+}
+/** The bare-identifier callee name of a template's enclosing call, only when the
+ *  call carries ≥2 real args — the `isWrapperFunctionWithBindParams` shape's identity
+ *  (arm 4). Captured raw-side so the corpus producer can correct the static-security
+ *  result once it learns the name as a DB wrapper (`reason: 'wrapper'`). */
+function wrapperCalleeNameForTemplate(node, adapter, sourceCode) {
+    if (adapter.getNodeType(node) !== 'template_string')
+        return null;
+    const args = adapter.getParent(node);
+    if (!args || adapter.getNodeType(args) !== 'arguments')
+        return null;
+    const call = adapter.getParent(args);
+    if (!call || adapter.getNodeType(call) !== 'call_expression')
+        return null;
+    const callee = getCallExpressionCallee(call, adapter);
+    if (!callee || adapter.getNodeType(callee) !== 'identifier')
+        return null;
+    const realArgs = adapter.getChildren(args).filter((c) => !['(', ')', ','].includes(adapter.getNodeType(c)));
+    if (realArgs.length < 2)
+        return null;
+    return adapter.getNodeText(callee, sourceCode) || null;
+}
+// ── The `data-access-calls-candidates` extractor ─────────────────────────────
+/** Project one broadened candidate into the raw, provenance-free `DataAccessCallCandidate`
+ *  the corpus `data-access-calls` producer re-folds. The static-security arms run here
+ *  on the empty-provenance scan; only `arm4CalleeName` is corrected corpus-side. */
+function buildDataAccessCallCandidate(node, ast, scan) {
+    const { adapter, sourceCode, config } = scan;
+    const nodeText = stripComments(adapter.getNodeText(node, sourceCode));
+    if (!nodeText || nodeText.trim().length < 10)
+        return null;
+    const sqlArg = adapter.name === 'go'
+        ? extractGoStaticSql(node, adapter, sourceCode, scan.goEnv)
+        : extractStaticSql(node, adapter, sourceCode);
+    const isOrmCall = isOrmPattern(nodeText);
+    const tagNames = config.sqlTagNames ?? SQL_TAG_NAMES;
+    const isTaggedSqlCall = isTaggedTemplateSqlCall(node, adapter, sourceCode, tagNames);
+    const isQueryBuilder = isQueryBuilderShape(node, adapter, sourceCode);
+    const isVariableAssignmentSql = isVariableAssignment(node, adapter) && sqlArg !== null;
+    const isTemplate = isTemplateLiteral(node, adapter);
+    const handle = handleCallSiteIdentity(node, scan);
+    const site = siteDialectIdentity(node, scan);
+    const security = checkQuerySecurity(node, nodeText, ast, scan);
+    return {
+        file: ast.filePath,
+        line: node.location.start.line,
+        column: node.location.start.column,
+        format: adapter.name === 'go' ? 'go' : 'typescript',
+        nodeText,
+        method: extractMethodName(node, adapter, sourceCode),
+        sqlArg,
+        isOrmCall,
+        isTaggedSqlCall,
+        isQueryBuilderShape: isQueryBuilder,
+        isVariableAssignmentSql,
+        isTemplateLiteral: isTemplate,
+        handleCalleeType: handle.calleeType,
+        handleName: handle.name,
+        handleRoot: handle.root,
+        handleReceiver: handle.receiver,
+        handleMethod: handle.method,
+        handleThisField: handle.thisField,
+        handleThisHeritage: handle.thisHeritage,
+        handleSqlArg: handle.sqlArg,
+        handleSiteReceiver: handle.siteReceiver,
+        handleRootScope: handle.scope,
+        skipCallForTemplateArg: shouldSkipCallForTemplateArg(node, adapter),
+        siteCalleeType: site.calleeType,
+        siteName: site.name,
+        siteReceiver: site.receiver,
+        hasOrganizationFilter: hasOrganizationFilter(nodeText, config),
+        enclosingFunction: enclosingIdentity(node, adapter, ast.filePath),
+        resolvedWhere: resolveWhereBinding(node, sourceCode, adapter),
+        ormTables: isOrmCall ? extractOrmTables(node, adapter, sourceCode, config) : [],
+        builderVerb: builderWriteVerb(node, adapter, sourceCode),
+        ormHasFilter: hasOrmFilterShape(node, adapter, sourceCode),
+        staticParameterized: security.parameterized,
+        staticInjectionRisk: security.injectionRisk,
+        staticEscaped: security.escaped,
+        arm4CalleeName: wrapperCalleeNameForTemplate(node, adapter, sourceCode),
+    };
+}
+/**
+ * Extract the raw, provenance-free `data-access-calls-candidates` for one file —
+ * the extract half of the corpus `data-access-calls` reduction (Spec 70 Item 4,
+ * step 3). No dedup happens here: the broadened discovery can perturb line-dedup
+ * (a bound bare call and a member call on the same line), so the corpus producer
+ * dedups after re-folding admission. Config is the §10 tuning surface; omitted
+ * here, extraction runs on {@link DEFAULT_DATA_ACCESS_CONFIG}.
+ * @param ast - The file's parsed AST.
+ * @param adapter - The language adapter (drives node discovery + text reads).
+ * @param sourceCode - The file's source text.
+ * @param config - Optional data-access config; defaults to the shared config.
+ * @returns The raw, provenance-free `data-access-calls-candidates`.
+ */
+export function extractDataAccessCallCandidates(ast, adapter, sourceCode, config) {
+    const scan = buildCandidateScan(ast, adapter, sourceCode, config);
+    const tagNames = scan.config.sqlTagNames ?? SQL_TAG_NAMES;
+    const nodes = adapter.findNodes(ast, {
+        custom: (node) => isBroadenedDataAccessCandidate(node, scan, tagNames),
+    });
+    const out = [];
+    for (const node of nodes) {
+        const cand = buildDataAccessCallCandidate(node, ast, scan);
+        if (cand)
+            out.push(cand);
+    }
+    return out;
+}
+// ── The `loop-query-candidates` extractor ────────────────────────────────────
+/**
+ * Extract the raw, provenance-free `loop-query-candidates` for one file — the
+ * extract half of the corpus `loop-queries` reduction. Mirrors `collectLoopQueryCandidates`
+ * with the broadened discovery and without the three provenance-dependent steps
+ * (the strict-handle filter, the per-loop dedup, the stable symbol), which the
+ * corpus producer re-folds once `dbProvenanced` is re-derived. The provenance-free
+ * discriminators (statement-construction, sql-string-construction, for-of-iterable,
+ * hoisted-reuse, batch-argument, LLM/queue suppression) already ran here.
+ * @param ast - The file's parsed AST.
+ * @param adapter - The language adapter (drives node discovery + text reads).
+ * @param sourceCode - The file's source text.
+ * @param config - Optional data-access config; defaults to the shared config.
+ * @returns The raw, provenance-free `loop-query-candidates`.
+ */
+export function extractLoopQueryRawCandidates(ast, adapter, sourceCode, config) {
+    const scan = buildCandidateScan(ast, adapter, sourceCode, config);
+    const candidates = [];
+    const dbNodes = adapter.findNodes(ast, {
+        custom: (node) => isBroadenedLoopCandidate(node, scan),
+    });
+    const transactionWrappedFunctions = collectTransactionWrappedFunctions(ast, adapter, sourceCode);
+    for (const node of dbNodes) {
+        // A DB call and its template-literal SQL argument both satisfy the structural
+        // discovery — collapse to the call node, exactly as `collectLoopQueryCandidates`
+        // does (isDbCallNode only admits a literal whose enclosing call is provenanced,
+        // so skipping the literal loses nothing).
+        if (isTemplateLiteral(node, adapter))
+            continue;
+        const nodeText = adapter.getNodeText(node, sourceCode);
+        if (!nodeText || nodeText.trim().length < 10)
+            continue;
+        if (isStatementConstructionOnly(node, adapter, sourceCode))
+            continue;
+        if (isSqlStringConstruction(node, adapter, sourceCode))
+            continue;
+        const loopInfo = findEnclosingLoop(node, adapter, sourceCode);
+        if (!loopInfo)
+            continue;
+        if (isForOfIterableDbCall(node, loopInfo.loopNode, adapter))
+            continue;
+        const enclosingFnName = findEnclosingFunctionIdentity(loopInfo.loopNode, adapter, ast.filePath).name;
+        const transactionEnclosesLoop = isInsideDbTransaction(loopInfo.loopNode, adapter, sourceCode) ||
+            (enclosingFnName !== null && transactionWrappedFunctions.has(enclosingFnName));
+        const preparesInLoop = loopBodyContainsPrepare(loopInfo.loopNode, adapter, sourceCode);
+        const hoistedReuse = !preparesInLoop &&
+            (transactionEnclosesLoop || isHoistedStatementReRun(node, loopInfo.loopNode, adapter, sourceCode));
+        if (hoistedReuse)
+            continue;
+        if (bindsBatchArgument(node, loopInfo.loopNode, adapter, sourceCode))
+            continue;
+        if (loopBodyContainsLlmCall(loopInfo.loopNode, adapter, sourceCode))
+            continue;
+        if (loopBodyContainsMessageLifecycleCall(loopInfo.loopNode, adapter, sourceCode))
+            continue;
+        const handle = handleCallSiteIdentity(node, scan);
+        const anchor = getCallExpressionCallee(node, adapter) ?? node;
+        candidates.push({
+            file: ast.filePath,
+            line: anchor.location.start.line,
+            column: anchor.location.start.column,
+            enclosingFunction: enclosingIdentity(node, adapter, ast.filePath),
+            loopStartOffset: loopInfo.loopNode.range[0],
+            loopLine: loopInfo.loopNode.location.start.line,
+            depth: loopInfo.depth,
+            handleCalleeType: handle.calleeType,
+            handleName: handle.name,
+            handleRoot: handle.root,
+            handleReceiver: handle.receiver,
+            handleMethod: handle.method,
+            handleThisField: handle.thisField,
+            handleThisHeritage: handle.thisHeritage,
+            handleSiteReceiver: handle.siteReceiver,
+            sqlArg: handle.sqlArg,
+            handleRootScope: handle.scope,
+        });
     }
+    return candidates;
 }
 //# sourceMappingURL=UniversalDataAccessAnalyzer.js.map