code-auditor-mcp 4.1.0 → 5.0.1

package/dist/analyzers/crossDomain/CrossDomainAnalyzer.js

@@ -46,6 +46,10 @@ function usageIdentityLabel(functionName, startLine, startColumn) {
         return `fn:${startLine}:${startColumn}`;
     return functionName ?? `fn:${startLine}:${startColumn}`;
 }
+/** Coordinate key `${file_path}::${function_name}` — the cross-domain identity key. */
+function funcTableKey(filePath, functionName) {
+    return `${filePath}::${functionName}`;
+}
 /** Chunked IN-clause bound (SQLite max host params, conservative). */
 const SQLITE_MAX_VARIABLES = 900;
 function resolveFileScope(config) {
@@ -79,16 +83,17 @@ function resolveFileScope(config) {
 // analyzer class to bound its aggregate cyclomatic complexity.
 // ---------------------------------------------------------------------------
 /**
- * Advance a call-graph BFS frontier by one node: query `funcId`'s call
- * neighbors and enqueue any not yet visited. Shared by the two BFS walks.
+ * Advance a call-graph BFS frontier by one node: read `funcId`'s call
+ * neighbors from the preloaded adjacency map and enqueue any not yet visited.
+ * Shared by the two BFS walks. The adjacency read replaced a per-node
+ * `graph_cache` query, the BFS N+1.
  */
-function enqueueCallNeighbors(indexHandle, nextLevel, funcId, visited) {
-    const callees = indexHandle
-        .query(`SELECT neighbor_key FROM graph_cache
-       WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
-    for (const callee of callees) {
-        const calleeId = parseInt(callee.neighbor_key, 10);
-        if (!isNaN(calleeId) && !visited.has(calleeId)) {
+function enqueueCallNeighbors(callEdges, nextLevel, funcId, visited) {
+    const callees = callEdges.get(funcId);
+    if (!callees)
+        return;
+    for (const calleeId of callees) {
+        if (!visited.has(calleeId)) {
             nextLevel.push(calleeId);
         }
     }
@@ -97,7 +102,7 @@ function enqueueCallNeighbors(indexHandle, nextLevel, funcId, visited) {
  * BFS through the call graph (graph_cache) up to maxDepth to check if
  * any path from startFuncId reaches a validator function ID.
  */
-function bfsReachesValidator(indexHandle, startFuncId, validatorIds, maxDepth) {
+function bfsReachesValidator(callEdges, startFuncId, validatorIds, maxDepth) {
     const visited = new Set();
     let currentLevel = [startFuncId];
     for (let d = 0; d < maxDepth; d++) {
@@ -108,8 +113,8 @@ function bfsReachesValidator(indexHandle, startFuncId, validatorIds, maxDepth) {
             if (visited.has(funcId))
                 continue;
             visited.add(funcId);
-            // Get callees from graph_cache call edges
-            enqueueCallNeighbors(indexHandle, nextLevel, funcId, visited);
+            // Get callees from the preloaded call edges
+            enqueueCallNeighbors(callEdges, nextLevel, funcId, visited);
         }
         currentLevel = nextLevel;
     }
@@ -126,29 +131,26 @@ function bfsReachesValidator(indexHandle, startFuncId, validatorIds, maxDepth) {
  * call-graph infrastructure (graph_cache + functions tables, populated by
  * code-audit index sync); without it, returns the direct write set unchanged.
  */
-function expandWrittenTables(indexHandle, key, initialTables, graph) {
+function expandWrittenTables(key, initialTables, graph) {
     const allTables = new Set(initialTables);
-    const { fnIdLookup, hasGraphData } = graph;
-    if (!fnIdLookup || !hasGraphData)
+    const { fnIdLookup, hasGraphData, callEdges, fnInfo, fnWriteTables } = graph;
+    if (!hasGraphData)
         return allTables;
     const funcId = fnIdLookup.get(key);
     if (funcId === undefined)
         return allTables;
-    const calleeRows = indexHandle
-        .query(`SELECT neighbor_key FROM graph_cache
-       WHERE graph_type = 'call' AND node_key = ?`, [String(funcId)]);
-    for (const callee of calleeRows) {
-        const calleeFuncs = indexHandle
-            .query(`SELECT name, file_path FROM functions WHERE id = ?`, [parseInt(callee.neighbor_key, 10)]);
-        for (const cf of calleeFuncs) {
-            const calleeTables = indexHandle
-                .query(`SELECT DISTINCT table_name FROM schema_usage
-           WHERE usage_type IN ('insert', 'update', 'delete', 'create')
-             AND function_name = ? AND file_path = ?`, [cf.name, cf.file_path]);
-            for (const ct of calleeTables) {
-                allTables.add(ct.table_name);
-            }
-        }
+    const calleeIds = callEdges.get(funcId);
+    if (!calleeIds)
+        return allTables;
+    for (const calleeId of calleeIds) {
+        const cf = fnInfo.get(calleeId);
+        if (!cf)
+            continue;
+        const calleeTables = fnWriteTables.get(`${cf.file_path}::${cf.name}`);
+        if (!calleeTables)
+            continue;
+        for (const tableName of calleeTables)
+            allTables.add(tableName);
     }
     return allTables;
 }
@@ -157,7 +159,7 @@ function expandWrittenTables(indexHandle, key, initialTables, graph) {
  * up to maxDepth, collecting every function ID reached. Used for the
  * static-reach fallback: a high-risk function not in this set is uncovered.
  */
-function collectReachableIds(indexHandle, startIds, maxDepth) {
+function collectReachableIds(callEdges, startIds, maxDepth) {
     const reachableIds = new Set();
     for (const startId of startIds) {
         const visited = new Set();
@@ -169,7 +171,7 @@ function collectReachableIds(indexHandle, startIds, maxDepth) {
                     continue;
                 visited.add(funcId);
                 reachableIds.add(funcId);
-                enqueueCallNeighbors(indexHandle, nextLevel, funcId, visited);
+                enqueueCallNeighbors(callEdges, nextLevel, funcId, visited);
             }
             currentLevel = nextLevel;
         }
@@ -233,6 +235,12 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
     /** Run the R1/R3/R4 detectors and collect their violations. */
     runDetectors(indexHandle, config, scope) {
         const violations = [];
+        // Preload the call-graph adjacency, function identity, and per-function write
+        // tables once and share across every detector that walks the graph. Each
+        // detector previously re-queried `graph_cache` (and, for callee expansion,
+        // `functions` + `schema_usage`) once per BFS node / callee — the N+1 that
+        // dominated cross-domain time on full audits.
+        const graph = loadCallGraphData(indexHandle);
         // R1 — Schema lifecycle detectors
         const lifecycle = config.schemaLifecycle ?? {};
         if (lifecycle.enableWrittenNeverRead !== false) {
@@ -243,17 +251,17 @@ export class CrossDomainAnalyzer extends UniversalAnalyzer {
         }
         if (lifecycle.enableTransactionBoundaryRisk !== false) {
             const txnTableMax = lifecycle.txnTableMax ?? 4;
-            violations.push(...detectTransactionBoundaryRisk(indexHandle, txnTableMax, scope));
+            violations.push(...detectTransactionBoundaryRisk(indexHandle, txnTableMax, scope, graph));
         }
         // R3 — Validation-bypass detection
         const bypass = config.validatorBypass;
         if (bypass) {
-            violations.push(...detectValidationBypass(indexHandle, bypass, scope));
+            violations.push(...detectValidationBypass(indexHandle, bypass, scope, graph));
         }
         // R4 — Coverage by importance
         const coverage = config.coverage;
         if (coverage) {
-            violations.push(...detectUncoveredRisk(indexHandle, coverage, scope));
+            violations.push(...detectUncoveredRisk(indexHandle, coverage, scope, graph));
         }
         return violations;
     }
@@ -287,27 +295,13 @@ function nonQueryBuilderTableFilter(fp) {
         params: fp.params,
     };
 }
-/**
- * Detect tables that are written to (INSERT/UPDATE/DELETE/CREATE) but
- * never read from (SELECT). These might be dead writes or missed read paths.
- */
-function detectWrittenNeverRead(indexHandle, scope) {
-    const violations = [];
-    const fp = scope.apply('file_path');
-    const qb = nonQueryBuilderTableFilter(fp);
-    const rows = indexHandle
-        .query(`SELECT DISTINCT table_name, file_path, function_name, function_start_line, function_start_column, line, usage_type
-       FROM schema_usage
-       WHERE usage_type IN ('insert', 'update', 'delete', 'create')
-         ${fp.clause}
-         ${qb.clause}
-         AND table_name NOT IN (
-           SELECT DISTINCT table_name FROM schema_usage WHERE usage_type = 'select' ${fp.clause}
-         )
-       ORDER BY table_name, file_path`, [...fp.params, ...qb.params, ...fp.params]);
-    // Deduplicate by table_name — one violation per table, anchored to
-    // the first writing file encountered.
+/** Deduplicate query rows by table and emit one violation per unique table,
+ *  anchored to the first row encountered. The two read/write-mismatch detectors
+ *  share this tail: their SQL and message/severity/rule differ, but the
+ *  dedup + violation construction is identical. */
+function emitTableViolations(rows, rule, severity, message) {
     const seen = new Set();
+    const violations = [];
     for (const row of rows) {
         if (seen.has(row.table_name))
             continue;
@@ -316,53 +310,75 @@ function detectWrittenNeverRead(indexHandle, scope) {
             file: row.file_path,
             line: row.line,
             column: 0,
-            severity: 'high',
-            message: `Table '${row.table_name}' is written (${row.usage_type}) but never read (SELECT). Consider removing unused writes or adding read paths.`,
-            rule: 'cross-domain/written-never-read',
+            severity,
+            message: message(row),
+            rule,
             analyzer: ANALYZER_NAME,
-            functionName: usageIdentityLabel(row.function_name, row.function_start_line, row.function_start_column),
+            symbol: usageIdentityLabel(row.function_name, row.function_start_line, row.function_start_column),
         });
     }
     return violations;
 }
-// ── R1: Read-Never-Written ──────────────────────────────────────────────
-/**
- * Detect tables that are read from (SELECT) but never written to
- * (INSERT/UPDATE/DELETE/CREATE). These may be external/managed tables
- * or indicate missing write coverage.
- */
-function detectReadNeverWritten(indexHandle, scope) {
-    const violations = [];
+/** Run one usage-direction check: tables used with `writeTypes` but never with
+ *  `readTypes` (optionally requiring membership in `requireTypes`), emitted as
+ *  per-table violations. Written-never-read and read-never-written are this one
+ *  shape with the two type sets swapped, so the shared SELECT list, scope/QB
+ *  filters, ORDER BY, dedup, and emit live here once. `usage_type IN ('select')`
+ *  is equivalent to `usage_type = 'select'`, so one IN path covers both. */
+function runUsageDirectionCheck(indexHandle, scope, check) {
     const fp = scope.apply('file_path');
     const qb = nonQueryBuilderTableFilter(fp);
+    const inList = (types) => types.map((t) => `'${t}'`).join(', ');
+    const requireClause = check.requireTypes
+        ? `\n         AND table_name IN (\n           SELECT DISTINCT table_name FROM schema_usage WHERE usage_type IN (${inList(check.requireTypes)}) ${fp.clause}\n         )`
+        : '';
     const rows = indexHandle
         .query(`SELECT DISTINCT table_name, file_path, function_name, function_start_line, function_start_column, line, usage_type
        FROM schema_usage
-       WHERE usage_type = 'select'
+       WHERE usage_type IN (${inList(check.writeTypes)})
          ${fp.clause}
          ${qb.clause}
          AND table_name NOT IN (
-           SELECT DISTINCT table_name FROM schema_usage
-           WHERE usage_type IN ('insert', 'update', 'delete', 'create') ${fp.clause}
-         )
-       ORDER BY table_name, file_path`, [...fp.params, ...qb.params, ...fp.params]);
-    const seen = new Set();
-    for (const row of rows) {
-        if (seen.has(row.table_name))
-            continue;
-        seen.add(row.table_name);
-        violations.push({
-            file: row.file_path,
-            line: row.line,
-            column: 0,
-            severity: 'severe',
-            message: `Table '${row.table_name}' is read (SELECT) but never written (INSERT/UPDATE/DELETE). This may be an external/managed table, or indicate missing write coverage.`,
-            rule: 'cross-domain/read-never-written',
-            analyzer: ANALYZER_NAME,
-            functionName: usageIdentityLabel(row.function_name, row.function_start_line, row.function_start_column),
-        });
-    }
-    return violations;
+           SELECT DISTINCT table_name FROM schema_usage WHERE usage_type IN (${inList(check.readTypes)}) ${fp.clause}
+         )${requireClause}
+       ORDER BY table_name, file_path`, [...fp.params, ...qb.params, ...fp.params, ...(check.requireTypes ? fp.params : [])]);
+    return emitTableViolations(rows, check.rule, check.severity, check.message);
+}
+/**
+ * Detect tables that are written to (INSERT/UPDATE/DELETE/CREATE) but
+ * never read from (SELECT). These might be dead writes or missed read paths.
+ *
+ * A table must have at least one `insert`/`update` ("data flows in") usage to
+ * qualify — a table whose only visible writes are `create` (DDL) or `delete`
+ * (truncate) is not a dead write path, because its `insert`/`select` live in a
+ * file the extractor does not scan (an out-of-scope receiver) or a dynamic-SQL
+ * read. The anchor still sorts the full write set, so `delete` keeps its
+ * byte-order edge over `insert` and a mixed write table anchors on the `delete`.
+ */
+function detectWrittenNeverRead(indexHandle, scope) {
+    return runUsageDirectionCheck(indexHandle, scope, {
+        writeTypes: ['insert', 'update', 'delete', 'create'],
+        readTypes: ['select'],
+        requireTypes: ['insert', 'update'],
+        rule: 'cross-domain/written-never-read',
+        severity: 'high',
+        message: (row) => `Table '${row.table_name}' is written (${row.usage_type}) but never read (SELECT). Consider removing unused writes or adding read paths.`,
+    });
+}
+// ── R1: Read-Never-Written ──────────────────────────────────────────────
+/**
+ * Detect tables that are read from (SELECT) but never written to
+ * (INSERT/UPDATE/DELETE/CREATE). These may be external/managed tables
+ * or indicate missing write coverage.
+ */
+function detectReadNeverWritten(indexHandle, scope) {
+    return runUsageDirectionCheck(indexHandle, scope, {
+        writeTypes: ['select'],
+        readTypes: ['insert', 'update', 'delete', 'create'],
+        rule: 'cross-domain/read-never-written',
+        severity: 'severe',
+        message: (row) => `Table '${row.table_name}' is read (SELECT) but never written (INSERT/UPDATE/DELETE). This may be an external/managed table, or indicate missing write coverage.`,
+    });
 }
 // ── R1: Transaction-Boundary Risk ───────────────────────────────────────
 /**
@@ -373,7 +389,7 @@ function detectReadNeverWritten(indexHandle, scope) {
  * writing to too many tables in a single logical operation can lead to
  * long-running transactions, lock contention, and partial-failure complexity.
  */
-function detectTransactionBoundaryRisk(indexHandle, txnTableMax, scope) {
+function detectTransactionBoundaryRisk(indexHandle, txnTableMax, scope, graph) {
     const fp = scope.apply('su.file_path');
     // Query schema_usage directly (no JOIN on functions) so this detector
     // works whether or not deepSync has populated the functions table.
@@ -390,8 +406,7 @@ function detectTransactionBoundaryRisk(indexHandle, txnTableMax, scope) {
     if (writerRows.length === 0)
         return [];
     const funcWrites = groupWriterTables(writerRows);
-    const graph = resolveCallGraphContext(indexHandle);
-    return flagTransactionBoundaryWrites(funcWrites, indexHandle, graph, txnTableMax);
+    return flagTransactionBoundaryWrites(funcWrites, graph, txnTableMax);
 }
 /** Group written tables by coordinate-identity key (display name is the label). */
 function groupWriterTables(writerRows) {
@@ -448,7 +463,7 @@ function enclosingFunctionBatches(filePath, writeLine) {
         'arrow_function',
         'function_expression',
         'generator_function_declaration',
-        'generator_function_expression',
+        'generator_function',
     ]);
     // Collect the enclosing function nodes (outermost first) that span the write
     // line. Checking any ancestor handles the accumulate-in-an-inner-callback /
@@ -479,10 +494,10 @@ function enclosingFunctionBatches(filePath, writeLine) {
  * When graph_cache is unpopulated, expandWrittenTables degrades gracefully
  * to reporting direct writes only.
  */
-function flagTransactionBoundaryWrites(funcWrites, indexHandle, graph, txnTableMax) {
+function flagTransactionBoundaryWrites(funcWrites, graph, txnTableMax) {
     const violations = [];
     for (const [key, funcData] of funcWrites) {
-        const allTables = expandWrittenTables(indexHandle, key, funcData.tables, graph);
+        const allTables = expandWrittenTables(key, funcData.tables, graph);
         if (allTables.size >= txnTableMax) {
             // A single `.batch()` commit is the transaction scope — no risk to flag.
             if (enclosingFunctionBatches(funcData.filePath, funcData.line))
@@ -496,44 +511,83 @@ function flagTransactionBoundaryWrites(funcWrites, indexHandle, graph, txnTableM
                 message: `Function writes to ${allTables.size} distinct tables (threshold: ${txnTableMax}): ${tableList}. This may indicate transaction-boundary risk — consider splitting writes across smaller transactional scopes.`,
                 rule: 'cross-domain/multi-table-write',
                 analyzer: ANALYZER_NAME,
-                functionName: key.split('::')[1],
+                symbol: key.split('::')[1],
             });
         }
     }
     return violations;
 }
 /**
- * Resolve the call-graph infrastructure available for callee expansion:
- * whether graph_cache has any 'call' edges, and a function key → id lookup
- * built from the functions table (populated only by deepSync). Any failure
- * degrades gracefully to direct-write-only detection.
+ * Load the call-graph infrastructure in three reads, reused by every detector
+ * that walks the graph. Previously each BFS node re-queried `graph_cache`, and
+ * depth-1 callee expansion re-queried `functions` + `schema_usage` per callee —
+ * an N+1 on full audits. One read each of the edge list, the function identity,
+ * and the per-function write tables collapses that to a constant number of
+ * queries. Any failure (or an empty graph) returns the empty structure and each
+ * consumer degrades to its no-graph path.
  */
-function resolveCallGraphContext(indexHandle) {
-    let hasGraphData = false;
+function loadCallGraphData(indexHandle) {
+    const empty = {
+        hasGraphData: false,
+        fnIdLookup: new Map(),
+        fnInfo: new Map(),
+        callEdges: new Map(),
+        fnWriteTables: new Map(),
+    };
+    let edgeRows;
     try {
-        const row = indexHandle.query("SELECT COUNT(*) AS n FROM graph_cache WHERE graph_type = 'call'");
-        const cnt = row[0];
-        hasGraphData = (cnt?.n ?? 0) > 0;
+        edgeRows = indexHandle.query("SELECT node_key, neighbor_key FROM graph_cache WHERE graph_type = 'call'");
     }
     catch {
-        hasGraphData = false;
-    }
-    let fnIdLookup = null;
-    if (hasGraphData) {
-        try {
-            const fnRows = indexHandle.query('SELECT id, name, file_path FROM functions');
-            if (fnRows.length > 0) {
-                fnIdLookup = new Map();
-                for (const r of fnRows) {
-                    fnIdLookup.set(`${r.file_path}::${r.name}`, r.id);
-                }
-            }
-        }
-        catch {
-            // functions table might not exist or be unpopulated
-        }
+        return empty;
+    }
+    if (edgeRows.length === 0)
+        return empty;
+    const callEdges = new Map();
+    for (const e of edgeRows) {
+        const src = parseInt(e.node_key, 10);
+        const dst = parseInt(e.neighbor_key, 10);
+        if (isNaN(src) || isNaN(dst))
+            continue;
+        const list = callEdges.get(src);
+        if (list)
+            list.push(dst);
+        else
+            callEdges.set(src, [dst]);
+    }
+    let fnRows;
+    try {
+        fnRows = indexHandle.query('SELECT id, name, file_path FROM functions');
+    }
+    catch {
+        fnRows = [];
+    }
+    const fnIdLookup = new Map();
+    const fnInfo = new Map();
+    for (const r of fnRows) {
+        fnIdLookup.set(`${r.file_path}::${r.name}`, r.id);
+        fnInfo.set(r.id, { name: r.name, file_path: r.file_path });
     }
-    return { hasGraphData, fnIdLookup };
+    let writeRows;
+    try {
+        writeRows = indexHandle.query(`SELECT DISTINCT file_path, function_name, table_name FROM schema_usage
+       WHERE usage_type IN ('insert', 'update', 'delete', 'create')`);
+    }
+    catch {
+        writeRows = [];
+    }
+    const fnWriteTables = new Map();
+    for (const w of writeRows) {
+        if (w.function_name == null)
+            continue;
+        const key = funcTableKey(w.file_path, w.function_name);
+        const set = fnWriteTables.get(key);
+        if (set)
+            set.add(w.table_name);
+        else
+            fnWriteTables.set(key, new Set([w.table_name]));
+    }
+    return { hasGraphData: true, fnIdLookup, fnInfo, callEdges, fnWriteTables };
 }
 // ── R3: Validation-Bypass ────────────────────────────────────────────────
 /**
@@ -546,7 +600,7 @@ function resolveCallGraphContext(indexHandle) {
  *   3. Heuristic fallback: name GLOB 'validate*' OR 'assert*' (when both
  *      above are silent)
  */
-function detectValidationBypass(indexHandle, config, scope) {
+function detectValidationBypass(indexHandle, config, scope, graph) {
     const violations = [];
     const { validators: userValidators = [], modeShare = 0.8, minCorpus = 20, depth = 3, } = config;
     const validatorIds = buildValidatorIds(indexHandle, userValidators);
@@ -563,18 +617,18 @@ function detectValidationBypass(indexHandle, config, scope) {
        ORDER BY su.file_path, su.function_name`, fp.params);
     if (writers.length === 0)
         return violations;
-    const writerCoverage = computeWriterCoverage(writers, validatorIds, indexHandle, depth);
+    const writerCoverage = computeWriterCoverage(writers, validatorIds, graph.callEdges, depth);
     violations.push(...flagUncoveredWriters(writers, writerCoverage, { minCorpus, modeShare, depth }));
     return violations;
 }
 /** BFS from each writer to check validator reach, deduplicated by key. */
-function computeWriterCoverage(writers, validatorIds, indexHandle, depth) {
+function computeWriterCoverage(writers, validatorIds, callEdges, depth) {
     const writerCoverage = new Map();
     for (const w of writers) {
-        const key = `${w.file_path}::${w.function_name}`;
+        const key = funcTableKey(w.file_path, w.function_name);
         if (writerCoverage.has(key))
             continue; // deduplicate
-        const covered = bfsReachesValidator(indexHandle, w.function_id, validatorIds, depth);
+        const covered = bfsReachesValidator(callEdges, w.function_id, validatorIds, depth);
         writerCoverage.set(key, {
             covered,
             line: w.line,
@@ -591,24 +645,32 @@ function computeWriterCoverage(writers, validatorIds, indexHandle, depth) {
  */
 function buildValidatorIds(indexHandle, userValidators) {
     const validatorIds = new Set();
-    // 1a. User-configured validators (format: "funcName" or "path#funcName")
+    // 1a. User-configured validators (format: "funcName" or "path#funcName").
+    //     Batched into chunked `IN`/composite-OR reads instead of one query per
+    //     entry (the per-validator query was an N+1 on the small user list).
+    const plainNames = [];
+    const namePathPairs = [];
     for (const v of userValidators) {
         const hashIdx = v.indexOf('#');
         if (hashIdx >= 0) {
-            const vPath = v.substring(0, hashIdx);
-            const vName = v.substring(hashIdx + 1);
-            const rows = indexHandle
-                .query('SELECT id FROM functions WHERE name = ? AND file_path = ?', [vName, vPath]);
-            for (const r of rows)
-                validatorIds.add(r.id);
+            namePathPairs.push([v.substring(hashIdx + 1), v.substring(0, hashIdx)]);
         }
         else {
-            const rows = indexHandle
-                .query('SELECT id FROM functions WHERE name = ?', [v]);
-            for (const r of rows)
-                validatorIds.add(r.id);
+            plainNames.push(v);
         }
     }
+    for (let i = 0; i < plainNames.length; i += SQLITE_MAX_VARIABLES) {
+        const chunk = plainNames.slice(i, i + SQLITE_MAX_VARIABLES);
+        const rows = indexHandle.query(`SELECT id FROM functions WHERE name IN (${chunk.map(() => '?').join(', ')})`, chunk);
+        for (const r of rows)
+            validatorIds.add(r.id);
+    }
+    for (let i = 0; i < namePathPairs.length; i += Math.floor(SQLITE_MAX_VARIABLES / 2)) {
+        const chunk = namePathPairs.slice(i, i + Math.floor(SQLITE_MAX_VARIABLES / 2));
+        const rows = indexHandle.query(`SELECT id FROM functions WHERE ${chunk.map(() => '(name = ? AND file_path = ?)').join(' OR ')}`, chunk.flatMap(([n, p]) => [n, p]));
+        for (const r of rows)
+            validatorIds.add(r.id);
+    }
     // 1b. Provenanced validators: exported functions whose OWN used_imports
     //     includes a validator package. Per-identifier check — a function in
     //     a zod-importing file only qualifies if its own body uses the
@@ -651,7 +713,7 @@ function groupWritersByDirectory(writers, writerCoverage) {
     const dirSeen = new Set();
     for (const w of writers) {
         const dir = path.dirname(w.file_path);
-        const key = `${w.file_path}::${w.function_name}`;
+        const key = funcTableKey(w.file_path, w.function_name);
         const dirKey = `${dir}::${key}`;
         if (dirSeen.has(dirKey))
             continue;
@@ -693,7 +755,7 @@ function flagUnvalidatedWriters(dirWriters, minCorpus, modeShare, depth) {
                         `Consider adding input validation.`,
                     rule: 'cross-domain/no-validator-reachable',
                     analyzer: ANALYZER_NAME,
-                    functionName: w.funcName,
+                    symbol: w.funcName,
                 });
             }
         }
@@ -710,7 +772,7 @@ function flagUnvalidatedWriters(dirWriters, minCorpus, modeShare, depth) {
  * to static reach analysis from test files (BFS from test-file functions
  * into the call graph).
  */
-function detectUncoveredRisk(indexHandle, coverage, scope) {
+function detectUncoveredRisk(indexHandle, coverage, scope, graph) {
     const topRiskDecile = coverage.topRiskDecile ?? 0.1;
     // Check if any measured coverage exists
     const measuredCount = indexHandle
@@ -718,7 +780,7 @@ function detectUncoveredRisk(indexHandle, coverage, scope) {
     if (measuredCount > 0) {
         return detectMeasuredUncovered(indexHandle, topRiskDecile);
     }
-    return detectStaticReachUncovered(indexHandle, coverage, scope);
+    return detectStaticReachUncovered(indexHandle, coverage, scope, graph);
 }
 /**
  * Flag exported high-risk functions with no measured test coverage, using
@@ -754,7 +816,7 @@ function detectMeasuredUncovered(indexHandle, topRiskDecile) {
                 (staleWarning ?? ''),
             rule: 'cross-domain/uncovered-risk',
             analyzer: ANALYZER_NAME,
-            functionName: fn.functionName,
+            symbol: fn.functionName,
             basis: fn.basis,
             sourceFormat,
             ...(staleWarning ? { staleImport: true } : {}),
@@ -766,12 +828,12 @@ function detectMeasuredUncovered(indexHandle, topRiskDecile) {
  * Static-reach fallback: flag exported high-risk functions that are not
  * reachable from known test files via BFS through the call graph.
  */
-function detectStaticReachUncovered(indexHandle, coverage, scope) {
+function detectStaticReachUncovered(indexHandle, coverage, scope, graph) {
     const topRiskDecile = coverage.topRiskDecile ?? 0.1;
     const highRiskFns = queryHighRiskFunctions(indexHandle, topRiskDecile, scope);
     if (highRiskFns.length === 0)
         return [];
-    const reachableIds = computeTestReachableIds(indexHandle, coverage);
+    const reachableIds = computeTestReachableIds(indexHandle, coverage, graph.callEdges);
     return flagUnreachedHighRisk(highRiskFns, reachableIds);
 }
 /** Rank exported functions by hotspot score and take the top decile. */
@@ -813,7 +875,7 @@ function flagUnreachedHighRisk(highRiskFns, reachableIds) {
                 `Add test coverage or import measured coverage with 'code-audit coverage --import <path>'.`,
             rule: 'cross-domain/uncovered-risk',
             analyzer: ANALYZER_NAME,
-            functionName: fn.name,
+            symbol: fn.name,
             basis: 'static-reach',
         });
     }
@@ -823,12 +885,12 @@ function flagUnreachedHighRisk(highRiskFns, reachableIds) {
  * Compute the set of function IDs reachable from test-file functions via
  * BFS through the call graph (reverse direction: test → code under test).
  */
-function computeTestReachableIds(indexHandle, coverage) {
+function computeTestReachableIds(indexHandle, coverage, callEdges) {
     const testFuncIds = collectTestFuncIds(indexHandle, coverage);
     if (testFuncIds.size === 0)
         return new Set();
     const maxDepth = coverage.staticReachDepth ?? 2;
-    return collectReachableIds(indexHandle, testFuncIds, maxDepth);
+    return collectReachableIds(callEdges, testFuncIds, maxDepth);
 }
 /** Find test-file function IDs to use as BFS starting points. */
 function collectTestFuncIds(indexHandle, coverage) {