code-auditor-mcp 4.1.1 → 5.0.2

package/dist/phase/rules/registry.js

@@ -0,0 +1,103 @@
+/**
+ * Spec 68 §2.1 — the migrated-rules registry.
+ *
+ * A rule enters this array only when it satisfies all four migration
+ * conditions: it is a `RuleDefinition` with `analyze(ctx)`; every fact it
+ * declares has a live producer; the old analyzer path for it is deleted; and a
+ * parity test pins its findings against the pre-migration output on a fixture.
+ * Partial states are zero — a rule with `analyze(ctx)` written but its old path
+ * still live, or with no parity test, is not listed here.
+ *
+ * The single failing assertion that drives the migration is the size of this
+ * array against 100 (spec68-registry-size.spec.ts): it reads 0 today and goes
+ * green at 100. A rule is added here in the same edit that deletes its old path
+ * and pins its parity test — never before, and never as a placeholder.
+ */
+import { solidRules } from './solid.js';
+import { dataAccessRules, loopQueryRules } from './dataAccess.js';
+import { dependencyGraphRules } from './dependencyGraph.js';
+import { schemaValidatorRules } from './schemaValidator.js';
+import { documentationRules } from './documentation.js';
+import { stylesRules, undefinedClassRule } from './styles.js';
+import { crossDomainRules, multiTableWriteRule, noValidatorReachableRule, uncoveredRiskRule } from './crossDomain.js';
+import { schemaRules, dynamicSqlRules } from './schema.js';
+import { schemaJsonRules } from './schemaJson.js';
+import { conventionsRules, conventionsExportShapeRules, conventionsImportFormRules } from './conventions.js';
+import { dryRules } from './dry.js';
+import { securityRules } from './security.js';
+import { secretsRules } from './secrets.js';
+import { securityDefectRules } from './securityDefects.js';
+import { querySiteRules } from './querySites.js';
+import { reactRules } from './react.js';
+import { fileDocumentationRules } from './fileDocumentation.js';
+import { unreferencedModuleRule } from './unreferencedModule.js';
+import { goRules } from './goRules.js';
+/**
+ * The 12 already-pinned rules that are parity-clean on the *full* pipeline
+ * (Spec 68 §11.2): 9 SOLID + 3 data-access. Each has `analyze(ctx)`, live
+ * producers for every declared fact, and a green parity test pinned on
+ * `(file, line, column, rule, severity)`, and flipping it changes nothing a
+ * full-pipeline audit reports (composite-fixtures pins the complete set by
+ * equality, so a rule whose phase output diverges anywhere stays off this list).
+ *
+ * The 2 schema rules (`unknown-table`, `table-naming-convention`) land once the
+ * `.sql` DDL source (§5) and the provenance-aware `db.query("SELECT …")` string-
+ * argument extraction are in: `unknown-table` reads `resolution` (now fed by
+ * `.sql` migration files via the `ddl-declarations.sql` producer), and
+ * `table-naming-convention` reads `schema-usage` (now extracting string-arg
+ * references). Their bucket is the one rule-level override in the both-paths
+ * re-emission (`table-naming-convention → schema-code`), matching the legacy
+ * schema-code visitor's result key.
+ *
+ * The 6 dependency-graph rules (`circular-dependency`, `break-cycles`,
+ * `tight-coupling`, `reduce-coupling`, `orphaned-nodes`, `review-orphans`)
+ * read the `cross-language-entities` fact
+ * through `DependencyGraphBuilder` — the same class the legacy Stage-4 reducer
+ * ran — so their full-pipeline output is byte-for-byte the reducer's.
+ *
+ * The 3 schema-validator rules (`schema-field-mismatch`, `missing-field`,
+ * `extra-field`) read the same fact through `SchemaValidator`/`extractSchemas`
+ * — the same class the legacy Stage-4 reducer ran, and the producer already
+ * emits the `parameters`/`metadata.fields` they read, so they need no shape
+ * enrichment.
+ *
+ * The 7th dependency-graph rule, `unreferenced-module` (file-level
+ * imports/reachability — RENEW, §8), reads the `file-imports` + `reachability`
+ * facts and lands as its own rule in `unreferencedModule.ts`.
+ *
+ * The remaining 74 land one fact kind at a time (§11.3), and the size drives
+ * spec68-registry-size.spec.ts (0 → … → 97).
+ */
+export const MIGRATED_RULES = [
+    ...solidRules,
+    ...dataAccessRules,
+    ...loopQueryRules,
+    ...dependencyGraphRules,
+    ...schemaValidatorRules,
+    ...documentationRules,
+    ...stylesRules,
+    undefinedClassRule,
+    ...crossDomainRules,
+    multiTableWriteRule,
+    noValidatorReachableRule,
+    uncoveredRiskRule,
+    ...schemaRules,
+    ...schemaJsonRules,
+    ...dynamicSqlRules,
+    ...conventionsRules,
+    ...conventionsExportShapeRules,
+    ...conventionsImportFormRules,
+    ...dryRules,
+    ...securityRules,
+    ...secretsRules,
+    ...securityDefectRules,
+    ...querySiteRules,
+    ...reactRules,
+    ...fileDocumentationRules,
+    unreferencedModuleRule,
+    ...goRules,
+];
+/** Rule id → analyzer namespace, a pure projection of `MIGRATED_RULES` (§15 —
+ *  replaces the deleted `RuleRegistryEntry.analyzer` cross-reference). */
+export const RULE_ANALYZER = new Map(MIGRATED_RULES.map((r) => [r.id, r.analyzer]));
+//# sourceMappingURL=registry.js.map

package/dist/phase/rules/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/phase/rules/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACtH,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC7G,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,GAAG,UAAU;IACb,GAAG,eAAe;IAClB,GAAG,cAAc;IACjB,GAAG,oBAAoB;IACvB,GAAG,oBAAoB;IACvB,GAAG,kBAAkB;IACrB,GAAG,WAAW;IACd,kBAAkB;IAClB,GAAG,gBAAgB;IACnB,mBAAmB;IACnB,wBAAwB;IACxB,iBAAiB;IACjB,GAAG,WAAW;IACd,GAAG,eAAe;IAClB,GAAG,eAAe;IAClB,GAAG,gBAAgB;IACnB,GAAG,2BAA2B;IAC9B,GAAG,0BAA0B;IAC7B,GAAG,QAAQ;IACX,GAAG,aAAa;IAChB,GAAG,YAAY;IACf,GAAG,mBAAmB;IACtB,GAAG,cAAc;IACjB,GAAG,UAAU;IACb,GAAG,sBAAsB;IACzB,sBAAsB;IACtB,GAAG,OAAO;CACX,CAAC;AAEF;0EAC0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAgC,IAAI,GAAG,CAC/D,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAU,CAAC,CACvD,CAAC"}

package/dist/phase/rules/schema.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Spec 68 §3.2 — the schema rules that are pure over extracted facts.
+ *
+ * Two of the five `schema` rules are a clean reduction over facts the producers
+ * already extract: `unknown-table` (schema-usage × resolution) and
+ * `table-naming-convention` (schema-usage alone). Their violation logic is
+ * re-homed verbatim from `UniversalSchemaAnalyzer`'s `checkMissingReferences`
+ * and `checkNamingConventions` (in `codeAnalysis.ts`), which are pure functions
+ * over a table-reference list and a known-table set — exactly the two facts, so
+ * `analyze` never touches a tree, an adapter, or source text.
+ *
+ * The `needs` declarations here CORRECT the registry's placeholder entries,
+ * which said `schema-code` for both: the analyzer walked *references* (usages),
+ * not DDL declarations. `unknown-table` reads the known-table catalog too, so
+ * it declares `resolution` — the §5 corpus fact — alongside `schema-usage`.
+ * `unknown-table`'s registry entry also claimed `go`; the Node implementation
+ * is TypeScript-shaped and cannot evaluate a Go AST, so this declaration omits
+ * `'go'` and the rule reports the honest `notApplicable` on a Go corpus (§9).
+ *
+ * The pure helpers `isSystemTable` / `isTableValuedFunction` /
+ * `getNearestTableSuggestions` are imported from `codeAnalysis.ts` — a Spec-34
+ * helper module that, like `orgFilterTiers.ts`, survives §15 because it imports
+ * no analyzer class and no pipeline.
+ *
+ * Not here, by design:
+ *   - `too-many-queries` — walks function *bodies* to count raw `query(`/
+ *     `execute(` call sites, a per-function signal `schema-usage` doesn't carry.
+ *   - The unregistered `reserved-word` emission inside the old
+ *     `checkNamingConventions` is dropped: it has no registry entry (no
+ *     message/docs/thresholds/samples), so it is an emission with no rule
+ *     definition — the inverse of §0's "no emission site", to be disposed in
+ *     §13 rather than silently re-homed into the unified `ruleId` model.
+ *
+ * `dynamic-sql-construction` lives below in a *separate* array: it reads the
+ * `dynamic-sql` fact (dangerous query/execute call sites), not `schema-usage`,
+ * so its context carries `dynamic-sql` alone — the same producer-before-rule
+ * split as `loop-query` next to `data-access`.
+ */
+import type { RuleDefinition } from '../types.js';
+/** The shared declaration for the TS schema rules in this slice. */
+type SchemaUsageNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['schema-usage'];
+};
+/** `unknown-table` additionally reads the known-table catalog (§5) and the
+ *  migration-history corpus fact (§5) so it can hand dropped tables to
+ *  `stale-table-reference` instead of mislabeling them as never-existed. */
+type UnknownTableNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['schema-usage', 'resolution', 'migration-history'];
+};
+/** `stale-table-reference` additionally reads the migration-history corpus fact
+ *  (§5) to distinguish "dropped in a migration" from "never existed". */
+type StaleTableReferenceNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['schema-usage', 'resolution', 'migration-history'];
+};
+/** The three TypeScript schema rules this slice migrates, in registry order. */
+export declare const schemaRules: readonly RuleDefinition<SchemaUsageNeeds | UnknownTableNeeds | StaleTableReferenceNeeds>[];
+/**
+ * `dynamic-sql-construction` reads the `dynamic-sql` fact (a flat array of
+ * `DynamicSqlFact`, one per dangerous query/execute call site) — not
+ * `schema-usage`. It is exported in a *separate* array from `schemaRules`
+ * because the two fact kinds are distinct: the schema slice context carries
+ * `schema-usage` + `resolution`, while this rule's context carries
+ * `dynamic-sql` alone.
+ *
+ * Detection is the producer's — `collectDynamicSqlCandidates` in `codeAnalysis.ts`,
+ * shared with the legacy `checkSQLInjection` — so `analyze` is a pure projection
+ * of the pre-computed anchor/enclosingFn/symbol, and parity holds by construction.
+ */
+type DynamicSqlNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['dynamic-sql'];
+};
+/** The dynamic-sql-construction rule this slice migrates (reads `dynamic-sql`). */
+export declare const dynamicSqlRules: readonly RuleDefinition<DynamicSqlNeeds>[];
+export {};
+//# sourceMappingURL=schema.d.ts.map

package/dist/phase/rules/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/phase/rules/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EACV,cAAc,EAMf,MAAM,aAAa,CAAC;AASrB,oEAAoE;AACpE,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;CAC3C,CAAC;AAEF;;4EAE4E;AAC5E,KAAK,iBAAiB,GAAG;IACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;CAC9E,CAAC;AAEF;yEACyE;AACzE,KAAK,wBAAwB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,cAAc,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC;CAC9E,CAAC;AA+NF,gFAAgF;AAChF,eAAO,MAAM,WAAW,EAAE,SAAS,cAAc,CAC/C,gBAAgB,GAAG,iBAAiB,GAAG,wBAAwB,CAChE,EAA+D,CAAC;AAIjE;;;;;;;;;;;GAWG;AACH,KAAK,eAAe,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC;CAC1C,CAAC;AAwBF,mFAAmF;AACnF,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,CAAC,eAAe,CAAC,EAA6B,CAAC"}

package/dist/phase/rules/schema.js

@@ -0,0 +1,273 @@
+/**
+ * Spec 68 §3.2 — the schema rules that are pure over extracted facts.
+ *
+ * Two of the five `schema` rules are a clean reduction over facts the producers
+ * already extract: `unknown-table` (schema-usage × resolution) and
+ * `table-naming-convention` (schema-usage alone). Their violation logic is
+ * re-homed verbatim from `UniversalSchemaAnalyzer`'s `checkMissingReferences`
+ * and `checkNamingConventions` (in `codeAnalysis.ts`), which are pure functions
+ * over a table-reference list and a known-table set — exactly the two facts, so
+ * `analyze` never touches a tree, an adapter, or source text.
+ *
+ * The `needs` declarations here CORRECT the registry's placeholder entries,
+ * which said `schema-code` for both: the analyzer walked *references* (usages),
+ * not DDL declarations. `unknown-table` reads the known-table catalog too, so
+ * it declares `resolution` — the §5 corpus fact — alongside `schema-usage`.
+ * `unknown-table`'s registry entry also claimed `go`; the Node implementation
+ * is TypeScript-shaped and cannot evaluate a Go AST, so this declaration omits
+ * `'go'` and the rule reports the honest `notApplicable` on a Go corpus (§9).
+ *
+ * The pure helpers `isSystemTable` / `isTableValuedFunction` /
+ * `getNearestTableSuggestions` are imported from `codeAnalysis.ts` — a Spec-34
+ * helper module that, like `orgFilterTiers.ts`, survives §15 because it imports
+ * no analyzer class and no pipeline.
+ *
+ * Not here, by design:
+ *   - `too-many-queries` — walks function *bodies* to count raw `query(`/
+ *     `execute(` call sites, a per-function signal `schema-usage` doesn't carry.
+ *   - The unregistered `reserved-word` emission inside the old
+ *     `checkNamingConventions` is dropped: it has no registry entry (no
+ *     message/docs/thresholds/samples), so it is an emission with no rule
+ *     definition — the inverse of §0's "no emission site", to be disposed in
+ *     §13 rather than silently re-homed into the unified `ruleId` model.
+ *
+ * `dynamic-sql-construction` lives below in a *separate* array: it reads the
+ * `dynamic-sql` fact (dangerous query/execute call sites), not `schema-usage`,
+ * so its context carries `dynamic-sql` alone — the same producer-before-rule
+ * split as `loop-query` next to `data-access`.
+ */
+import { RULE_REGISTRY } from '../../analyzers/ruleRegistry.js';
+import { isTestOrSpecPath } from '../../languages/testConventions.js';
+import { isSystemTable, isTableValuedFunction, getNearestTableSuggestions, } from '../../analyzers/universal/schema/codeAnalysis.js';
+/** Join a list of names as prose: "a", "a and b", "a, b and c". Mirrors the
+ *  legacy `joinEnglish` in pipelineAdapters.ts (not exported). */
+function joinEnglish(names) {
+    if (names.length === 0)
+        return '';
+    if (names.length === 1)
+        return names[0];
+    return `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
+}
+const META = RULE_REGISTRY;
+/** The known-table set from the corpus catalog (case-sensitive, as the old
+ *  `collectAllTableNames` built it). */
+function knownTableSet(catalog) {
+    const names = new Set();
+    for (const t of catalog.tables)
+        names.add(t.name);
+    return names;
+}
+/** A usage is a candidate when it is a real table reference, not a fluent
+ *  query-builder selector, a system/table-valued function, or a host-language
+ *  template substitution. The `${…}` form is a table name filled in at
+ *  query-composition time (`FROM "${this.tableName}"`), not a literal name the
+ *  catalog can resolve — the same carve-out `table-naming-convention` already
+ *  draws, so a dynamic table name is not misreported as unknown/stale. */
+function isRealTableRef(u) {
+    return u.origin !== 'query-builder'
+        && !isSystemTable(u.tableName)
+        && !isTableValuedFunction(u.tableName)
+        && !u.tableName.includes('${');
+}
+/**
+ * The shared unknown-reference set + fail-open guard that BOTH `unknown-table`
+ * and `stale-table-reference` compute identically, so a reference lands in
+ * exactly one rule: dropped tables partition to `stale-table-reference`, the
+ * rest to `unknown-table`. The guard (R2.4) is the legacy fail-open — at 0
+ * known tables, or an unknown:known ratio above 10, the catalog is not
+ * trustworthy enough to flag individual references, so neither rule fires.
+ */
+function unknownRefs(usages, catalog) {
+    const known = knownTableSet(catalog);
+    // Symmetric scoping (#408): a file excluded from schema *declaration* is
+    // excluded from schema *reference*. The DDL replay drops `isTestOrSpecPath`
+    // files from the known-table set, so a table declared only in a test/spec file
+    // reads as unknown; references in those same test/spec files must not then
+    // fire `unknown-table`/`stale-table-reference`. Same predicate, both directions.
+    const refs = usages.filter((u) => isRealTableRef(u) && !isTestOrSpecPath(u.filePath) && !known.has(u.tableName));
+    const knownCount = known.size;
+    const failOpen = knownCount === 0 || refs.length / Math.max(knownCount, 1) > 10;
+    return { refs, knownCount, failOpen };
+}
+// ── unknown-table ───────────────────────────────────────────────────────────
+const unknownTable = {
+    id: 'unknown-table',
+    analyzer: 'schema',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['schema-usage', 'resolution', 'migration-history'] },
+    severity: 'critical',
+    message: META['unknown-table'].message,
+    docs: META['unknown-table'].docs,
+    thresholds: META['unknown-table'].thresholds,
+    samples: META['unknown-table'].samples,
+    analyze(ctx) {
+        const known = knownTableSet(ctx.facts['resolution']);
+        const { refs, failOpen } = unknownRefs(ctx.facts['schema-usage'], ctx.facts['resolution']);
+        // R2.4 fail-open: at 0 known tables, or an unknown:known ratio above 10,
+        // the catalog is not trustworthy enough to flag individual references.
+        if (failOpen) {
+            return [];
+        }
+        // Dropped tables are `stale-table-reference`'s, not this rule's: the two
+        // rules partition the unknown set by the migration-history provenance.
+        const dropped = ctx.facts['migration-history'].dropped;
+        const out = [];
+        for (const ref of refs) {
+            if (dropped[ref.tableName])
+                continue;
+            const suggestions = getNearestTableSuggestions(ref.tableName, known, 2);
+            const suggestionNames = suggestions.map((s) => s.replace(/^'|'$/g, ''));
+            const message = suggestions.length > 0
+                ? `Reference to unknown table '${ref.tableName}' (${ref.usageType}). Did you mean: ${suggestions.join(', ')}?`
+                : `Reference to unknown table '${ref.tableName}' (${ref.usageType})`;
+            out.push({
+                ruleId: 'unknown-table',
+                severity: 'critical',
+                message,
+                file: ref.filePath,
+                line: ref.line,
+                column: ref.column,
+                symbol: ref.tableName,
+                resolution: {
+                    action: suggestionNames.length > 0 ? 'use-known-table' : 'register-or-fix-table',
+                    summary: suggestionNames.length > 0
+                        ? `Rename the table reference '${ref.tableName}' to the nearest known table: ${suggestions.join(', ')}.`
+                        : `The table '${ref.tableName}' is not in the known catalog — register it, or fix the reference to a known table.`,
+                    symbols: suggestionNames.length > 0 ? suggestionNames : [ref.tableName],
+                    files: [ref.filePath],
+                    lines: ref.line != null ? [ref.line] : undefined,
+                },
+            });
+        }
+        return out;
+    },
+};
+// ── table-naming-convention ─────────────────────────────────────────────────
+const tableNamingConvention = {
+    id: 'table-naming-convention',
+    analyzer: 'schema',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['schema-usage'] },
+    severity: 'high',
+    message: META['table-naming-convention'].message,
+    docs: META['table-naming-convention'].docs,
+    thresholds: META['table-naming-convention'].thresholds,
+    samples: META['table-naming-convention'].samples,
+    analyze(ctx) {
+        const out = [];
+        for (const ref of ctx.facts['schema-usage']) {
+            // Fluent-builder references carry a dynamic table string; naming
+            // conformance is a property of the schema, not the call.
+            if (ref.origin === 'query-builder')
+                continue;
+            // A `${…}` template substitution is a host-language table name filled in
+            // at query-composition time (`FROM "${this.tableName}"`), not a literal
+            // name. The producer reports it accurately; naming conformance is a
+            // property of the schema, not the substitution — same carve-out rationale
+            // as `query-builder` origin above.
+            if (ref.tableName.includes('${'))
+                continue;
+            const isSnakeCase = /^[a-z][a-z0-9_]*$/.test(ref.tableName);
+            const isTableSuffix = ref.tableName.endsWith('Table');
+            if (isSnakeCase || isTableSuffix)
+                continue;
+            out.push({
+                ruleId: 'table-naming-convention',
+                severity: 'high',
+                message: `Table name '${ref.tableName}' should use snake_case convention`,
+                file: ref.filePath,
+                line: ref.line,
+                column: ref.column,
+                symbol: ref.tableName,
+            });
+        }
+        return out;
+    },
+};
+// ── stale-table-reference ────────────────────────────────────────────────────
+/**
+ * `stale-table-reference` reads the `migration-history` corpus fact (§5) — the
+ * drop-provenance map built by the shared `buildDropProvenance` the legacy
+ * schema reducer called — alongside `schema-usage` + `resolution`. It is the
+ * partition of the unknown-reference set that `unknown-table` hands off: a
+ * reference whose table a migration dropped is a stale code reference (the
+ * message names the dropping migration and the tables it introduced as
+ * evidence, not proof, of a successor), not a typo.
+ *
+ * Parity holds by construction: `buildDropProvenance` is the identical pure
+ * function the legacy reducer ran, and the message/resolution here are the
+ * verbatim emission from `UniversalSchemaAnalyzer` (pipelineAdapters.ts).
+ */
+const staleTableReference = {
+    id: 'stale-table-reference',
+    analyzer: 'schema',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['schema-usage', 'resolution', 'migration-history'] },
+    severity: 'critical',
+    message: META['stale-table-reference'].message,
+    docs: META['stale-table-reference'].docs,
+    thresholds: META['stale-table-reference'].thresholds,
+    samples: META['stale-table-reference'].samples,
+    analyze(ctx) {
+        const dropped = ctx.facts['migration-history'].dropped;
+        const { refs, failOpen } = unknownRefs(ctx.facts['schema-usage'], ctx.facts['resolution']);
+        if (failOpen)
+            return [];
+        const out = [];
+        for (const ref of refs) {
+            const drop = dropped[ref.tableName];
+            if (!drop)
+                continue;
+            const migrationName = drop.migrationFile.split('/').pop() ?? drop.migrationFile;
+            const created = [...drop.createdInSameMigration];
+            const message = created.length > 0
+                ? `${ref.tableName} was dropped in ${migrationName}; that migration creates ${joinEnglish(created)}.`
+                : `${ref.tableName} was dropped in ${migrationName} and was not recreated.`;
+            out.push({
+                ruleId: 'stale-table-reference',
+                severity: 'critical',
+                message,
+                file: ref.filePath,
+                line: ref.line,
+                column: ref.column,
+                symbol: ref.tableName,
+                resolution: {
+                    action: 'update-stale-reference',
+                    // `created` are evidence the migration replaced the dropped table, not
+                    // proof of a drop-in successor — the summary names them as context and
+                    // leaves update-vs-remove to the reviewer.
+                    summary: created.length > 0
+                        ? `The table '${ref.tableName}' was dropped in ${migrationName}. That migration introduces ${joinEnglish(created)} — review this reference and update or remove it.`
+                        : `The table '${ref.tableName}' was dropped in ${migrationName} and was not recreated — update or remove this reference.`,
+                    symbols: created.length > 0 ? created : [ref.tableName],
+                    files: [ref.filePath],
+                    lines: ref.line != null ? [ref.line] : undefined,
+                },
+            });
+        }
+        return out;
+    },
+};
+/** The three TypeScript schema rules this slice migrates, in registry order. */
+export const schemaRules = [unknownTable, tableNamingConvention, staleTableReference];
+const dynamicSqlConstruction = {
+    id: 'dynamic-sql-construction',
+    analyzer: 'schema',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['dynamic-sql'] },
+    severity: 'critical',
+    message: META['dynamic-sql-construction'].message,
+    docs: META['dynamic-sql-construction'].docs,
+    thresholds: META['dynamic-sql-construction'].thresholds,
+    samples: META['dynamic-sql-construction'].samples,
+    analyze(ctx) {
+        return ctx.facts['dynamic-sql'].map((c) => ({
+            ruleId: 'dynamic-sql-construction',
+            severity: 'critical',
+            message: `SQL query built via string interpolation or concatenation in ${c.enclosingFn}; use parameterized queries.`,
+            file: c.file,
+            line: c.line,
+            column: c.column,
+            symbol: c.symbol,
+        }));
+    },
+};
+/** The dynamic-sql-construction rule this slice migrates (reads `dynamic-sql`). */
+export const dynamicSqlRules = [dynamicSqlConstruction];
+//# sourceMappingURL=schema.js.map

package/dist/phase/rules/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/phase/rules/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAUH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,0BAA0B,GAC3B,MAAM,kDAAkD,CAAC;AAuB1D;kEACkE;AAClE,SAAS,WAAW,CAAC,KAAwB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,CAAE,CAAC;IACzC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,IAAI,GAAG,aAAa,CAAC;AAE3B;wCACwC;AACxC,SAAS,aAAa,CAAC,OAAuB;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;0EAK0E;AAC1E,SAAS,cAAc,CAAC,CAAkB;IACxC,OAAO,CAAC,CAAC,MAAM,KAAK,eAAe;WAC9B,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;WAC3B,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;WACnC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,WAAW,CAClB,MAAkC,EAClC,OAAuB;IAEvB,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,yEAAyE;IACzE,4EAA4E;IAC5E,+EAA+E;IAC/E,2EAA2E;IAC3E,iFAAiF;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CACxB,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CACrF,CAAC;IACF,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;IAC9B,MAAM,QAAQ,GAAG,UAAU,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAChF,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AACxC,CAAC;AAED,+EAA+E;AAE/E,MAAM,YAAY,GAAsC;IACtD,EAAE,EAAE,eAAe;IACnB,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,mBAAmB,CAAC,EAAE;IACnH,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO;IACtC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI;IAChC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,UAAU;IAC5C,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO;IACtC,OAAO,CAAC,GAAG;QACT,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QACrD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAE3F,yEAAyE;QACzE,uEAAuE;QACvE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC;QAEvD,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,SAAS;YACrC,MAAM,WAAW,GAAG,0BAA0B,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,eAAe,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YACxE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC;gBACpC,CAAC,CAAC,+BAA+B,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,SAAS,oBAAoB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;gBAC9G,CAAC,CAAC,+BAA+B,GAAG,CAAC,SAAS,MAAM,GAAG,CAAC,SAAS,GAAG,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,eAAe;gBACvB,QAAQ,EAAE,UAAU;gBACpB,OAAO;gBACP,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,SAAS;gBACrB,UAAU,EAAE;oBACV,MAAM,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB;oBAChF,OAAO,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC;wBACjC,CAAC,CAAC,+BAA+B,GAAG,CAAC,SAAS,iCAAiC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBACxG,CAAC,CAAC,cAAc,GAAG,CAAC,SAAS,qFAAqF;oBACpH,OAAO,EAAE,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;oBACvE,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACrB,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;iBACjD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF,+EAA+E;AAE/E,MAAM,qBAAqB,GAAqC;IAC9D,EAAE,EAAE,yBAAyB;IAC7B,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,CAAC,EAAE;IAChF,QAAQ,EAAE,MAAM;IAChB,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO;IAChD,IAAI,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,IAAI;IAC1C,UAAU,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,UAAU;IACtD,OAAO,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,OAAO;IAChD,OAAO,CAAC,GAAG;QACT,MAAM,GAAG,GAAc,EAAE,CAAC;QAE1B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5C,iEAAiE;YACjE,yDAAyD;YACzD,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe;gBAAE,SAAS;YAC7C,yEAAyE;YACzE,wEAAwE;YACxE,oEAAoE;YACpE,0EAA0E;YAC1E,mCAAmC;YACnC,IAAI,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,SAAS;YAE3C,MAAM,WAAW,GAAG,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5D,MAAM,aAAa,GAAG,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACtD,IAAI,WAAW,IAAI,aAAa;gBAAE,SAAS;YAE3C,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,yBAAyB;gBACjC,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,eAAe,GAAG,CAAC,SAAS,oCAAoC;gBACzE,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,SAAS;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF,gFAAgF;AAEhF;;;;;;;;;;;;GAYG;AACH,MAAM,mBAAmB,GAA6C;IACpE,EAAE,EAAE,uBAAuB;IAC3B,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,mBAAmB,CAAC,EAAE;IACnH,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO;IAC9C,IAAI,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,IAAI;IACxC,UAAU,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,UAAU;IACpD,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO;IAC9C,OAAO,CAAC,GAAG;QACT,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC;QACvD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3F,IAAI,QAAQ;YAAE,OAAO,EAAE,CAAC;QAExB,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI;gBAAE,SAAS;YAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,aAAa,CAAC;YAChF,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC;gBAChC,CAAC,CAAC,GAAG,GAAG,CAAC,SAAS,mBAAmB,aAAa,4BAA4B,WAAW,CAAC,OAAO,CAAC,GAAG;gBACrG,CAAC,CAAC,GAAG,GAAG,CAAC,SAAS,mBAAmB,aAAa,yBAAyB,CAAC;YAC9E,GAAG,CAAC,IAAI,CAAC;gBACP,MAAM,EAAE,uBAAuB;gBAC/B,QAAQ,EAAE,UAAU;gBACpB,OAAO;gBACP,IAAI,EAAE,GAAG,CAAC,QAAQ;gBAClB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,SAAS;gBACrB,UAAU,EAAE;oBACV,MAAM,EAAE,wBAAwB;oBAChC,uEAAuE;oBACvE,uEAAuE;oBACvE,2CAA2C;oBAC3C,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;wBACzB,CAAC,CAAC,cAAc,GAAG,CAAC,SAAS,oBAAoB,aAAa,+BAA+B,WAAW,CAAC,OAAO,CAAC,mDAAmD;wBACpK,CAAC,CAAC,cAAc,GAAG,CAAC,SAAS,oBAAoB,aAAa,2DAA2D;oBAC3H,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;oBACvD,KAAK,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC;oBACrB,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;iBACjD;aACF,CAAC,CAAC;QACL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAElB,CAAC,YAAY,EAAE,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AAqBjE,MAAM,sBAAsB,GAAoC;IAC9D,EAAE,EAAE,0BAA0B;IAC9B,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE;IAC/E,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO;IACjD,IAAI,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,IAAI;IAC3C,UAAU,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,UAAU;IACvD,OAAO,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,OAAO;IACjD,OAAO,CAAC,GAAG;QACT,OAAO,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1C,MAAM,EAAE,0BAA0B;YAClC,QAAQ,EAAE,UAAU;YACpB,OAAO,EAAE,gEAAgE,CAAC,CAAC,WAAW,8BAA8B;YACpH,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC,CAAC;IACN,CAAC;CACF,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAA+C,CAAC,sBAAsB,CAAC,CAAC"}

package/dist/phase/rules/schemaJson.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Spec 68 §3.2 — the schema-json rules, migrated to `analyze(ctx)`.
+ *
+ * The legacy JSON-schema validation was one monolithic free function
+ * (`analyzeJsonSchemas` in `jsonSchema.ts`) that emitted 17 distinct rule ids
+ * with hardcoded `line:1, column:1` anchors (JSON files have no AST position
+ * the old path read). The phase model splits that into:
+ *
+ *   - a `json-document` producer (the parsed value of each `.json` file);
+ *   - the `schema-validations` corpus processor (the one `analyzeJsonSchemas`
+ *     call, projected onto `SchemaValidationFact` — the classification of which
+ *     rule fired, at what severity, with what message is the processor's);
+ *   - these 17 rules, each a thin filter over the fact by its own rule id.
+ *
+ * Because the processor re-homes the validation verbatim, each rule's `analyze`
+ * is a pure projection: it does not re-validate, it just names the rule whose
+ * findings it owns. The severity is the fact's (the legacy emit carried it per
+ * violation, e.g. `invalid-json` is `critical`, `missing-schema-declaration` is
+ * `high`, the rest `severe`), so the static `severity` below is the rule's
+ * default and the finding's severity is the fact's — identical on every path.
+ */
+import type { RuleDefinition } from '../types.js';
+/** The shared declaration for all 17 schema-json rules: they evaluate JSON
+ *  files and read the one corpus fact the processor reduces from them. */
+type SchemaJsonNeeds = {
+    readonly formats: readonly ['json'];
+    readonly facts: readonly ['schema-validations'];
+};
+/** The 17 schema-json rules this slice migrates, in registry order. */
+export declare const schemaJsonRules: readonly RuleDefinition<SchemaJsonNeeds>[];
+export {};
+//# sourceMappingURL=schemaJson.d.ts.map

package/dist/phase/rules/schemaJson.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaJson.d.ts","sourceRoot":"","sources":["../../../src/phase/rules/schemaJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAiC,MAAM,aAAa,CAAC;AAMjF;0EAC0E;AAC1E,KAAK,eAAe,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC;CACjD,CAAC;AA2DF,uEAAuE;AACvE,eAAO,MAAM,eAAe,EAAE,SAAS,cAAc,CAAC,eAAe,CAAC,EACK,CAAC"}

package/dist/phase/rules/schemaJson.js

@@ -0,0 +1,81 @@
+/**
+ * Spec 68 §3.2 — the schema-json rules, migrated to `analyze(ctx)`.
+ *
+ * The legacy JSON-schema validation was one monolithic free function
+ * (`analyzeJsonSchemas` in `jsonSchema.ts`) that emitted 17 distinct rule ids
+ * with hardcoded `line:1, column:1` anchors (JSON files have no AST position
+ * the old path read). The phase model splits that into:
+ *
+ *   - a `json-document` producer (the parsed value of each `.json` file);
+ *   - the `schema-validations` corpus processor (the one `analyzeJsonSchemas`
+ *     call, projected onto `SchemaValidationFact` — the classification of which
+ *     rule fired, at what severity, with what message is the processor's);
+ *   - these 17 rules, each a thin filter over the fact by its own rule id.
+ *
+ * Because the processor re-homes the validation verbatim, each rule's `analyze`
+ * is a pure projection: it does not re-validate, it just names the rule whose
+ * findings it owns. The severity is the fact's (the legacy emit carried it per
+ * violation, e.g. `invalid-json` is `critical`, `missing-schema-declaration` is
+ * `high`, the rest `severe`), so the static `severity` below is the rule's
+ * default and the finding's severity is the fact's — identical on every path.
+ */
+import { RULE_REGISTRY } from '../../analyzers/ruleRegistry.js';
+const META = RULE_REGISTRY;
+/** The 17 registry rule ids, in registry order, each mapped to its fixed
+ *  severity (the value the legacy `emit`/`emitViolation` carried for that id). */
+const SCHEMA_JSON_RULES = [
+    { id: 'invalid-json', severity: 'critical' },
+    { id: 'missing-schema-declaration', severity: 'high' },
+    { id: 'undefined-required-field', severity: 'severe' },
+    { id: 'invalid-type', severity: 'severe' },
+    { id: 'invalid-range', severity: 'severe' },
+    { id: 'type-mismatch', severity: 'severe' },
+    { id: 'string-too-short', severity: 'severe' },
+    { id: 'string-too-long', severity: 'severe' },
+    { id: 'pattern-mismatch', severity: 'severe' },
+    { id: 'invalid-format', severity: 'severe' },
+    { id: 'below-minimum', severity: 'severe' },
+    { id: 'above-maximum', severity: 'severe' },
+    { id: 'too-few-items', severity: 'severe' },
+    { id: 'too-many-items', severity: 'severe' },
+    { id: 'missing-required-field', severity: 'severe' },
+    { id: 'unexpected-property', severity: 'severe' },
+    { id: 'enum-mismatch', severity: 'severe' },
+];
+/** Project one rule's slice of the fact onto its findings, re-homed verbatim
+ *  from the legacy violation fields (anchor always 1:1). */
+function findingsFor(validations, ruleId) {
+    const out = [];
+    for (const v of validations) {
+        if (v.rule !== ruleId)
+            continue;
+        out.push({
+            ruleId,
+            severity: v.severity,
+            message: v.message,
+            file: v.file,
+            line: v.line,
+            column: v.column,
+        });
+    }
+    return out;
+}
+/** Build one thin rule definition for a schema-json rule id. */
+function schemaJsonRule(id, severity) {
+    return {
+        id,
+        analyzer: 'schema',
+        needs: { formats: ['json'], facts: ['schema-validations'] },
+        severity,
+        message: META[id].message,
+        docs: META[id].docs,
+        thresholds: META[id].thresholds,
+        samples: META[id].samples,
+        analyze(ctx) {
+            return findingsFor(ctx.facts['schema-validations'], id);
+        },
+    };
+}
+/** The 17 schema-json rules this slice migrates, in registry order. */
+export const schemaJsonRules = SCHEMA_JSON_RULES.map(({ id, severity }) => schemaJsonRule(id, severity));
+//# sourceMappingURL=schemaJson.js.map

package/dist/phase/rules/schemaJson.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaJson.js","sourceRoot":"","sources":["../../../src/phase/rules/schemaJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,MAAM,IAAI,GAAG,aAAa,CAAC;AAS3B;kFACkF;AAClF,MAAM,iBAAiB,GAAsD;IAC3E,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE;IAC5C,EAAE,EAAE,EAAE,4BAA4B,EAAE,QAAQ,EAAE,MAAM,EAAE;IACtD,EAAE,EAAE,EAAE,0BAA0B,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACtD,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1C,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3C,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3C,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC9C,EAAE,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC7C,EAAE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC9C,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC5C,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3C,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3C,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3C,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC5C,EAAE,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACpD,EAAE,EAAE,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACjD,EAAE,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,EAAE;CAC5C,CAAC;AAEF;4DAC4D;AAC5D,SAAS,WAAW,CAAC,WAA4C,EAAE,MAAc;IAC/E,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gEAAgE;AAChE,SAAS,cAAc,CAAC,EAAU,EAAE,QAAkB;IACpD,OAAO;QACL,EAAE;QACF,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,EAAE;QAC3D,QAAQ;QACR,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO;QACzB,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI;QACnB,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,UAAU;QAC/B,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO;QACzB,OAAO,CAAC,GAAG;YACT,OAAO,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,eAAe,GAC1B,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC"}

package/dist/phase/rules/schemaValidator.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Spec 68 §3.2 — the schema-validator rules, migrated to `analyze(ctx)`.
+ *
+ * The three rules here (`schema-field-mismatch`, `missing-field`, `extra-field`)
+ * read the `cross-language-entities` fact and reduce it through
+ * `SchemaValidator` — the same pure class the legacy Stage-4 reducer ran. The
+ * reducer (`createSchemaValidatorReducer` in pipelineAdapters.ts) called
+ * `extractSchemas(entities)` then `new SchemaValidator().validateSchemas(schemas)`
+ * and returned the resulting `SchemaViolation[]`; each violation already carries
+ * its own `rule` (`schema-field-mismatch` | `missing-field` | `extra-field`), so
+ * the migration is a filter: one rule per violation type, re-homed verbatim.
+ *
+ * `extractSchemas` and `SchemaValidator` are imported (not re-homed) because —
+ * like `DependencyGraphBuilder` — they import no analyzer class and no pipeline,
+ * so §15 keeps them. The reducer's two guards are dropped here by construction:
+ *   - the `isScoped` early-return is a *stage* concern (scoped runs never reach
+ *     a full-corpus reducer), not a rule concern — the phase model hands a rule
+ *     whatever facts it declared and the rule evaluates them;
+ *   - the `countCrossLanguagePairs === 0` notRunReason is a *coverage* signal
+ *     (§8), not a finding — `validateSchemas` on a single-language corpus
+ *     returns `[]` because every name-group has `byLanguage.size < 2`, so the
+ *     rules already emit nothing (the empty multiset the parity test pins).
+ *
+ * The `cross-language-entities` producer (`extractCrossLanguageEntities`) emits
+ * full `CrossLanguageEntity` values whose `parameters` (TS interfaces) and
+ * `metadata.fields` (Go structs) already carry `description`/`tag`, so
+ * `extractSchemas` works over the fact as-is — no shape enrichment is required.
+ */
+import type { RuleDefinition } from '../types.js';
+/** The shared declaration for the three schema-validator rules. */
+type SchemaValidatorNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript', 'go'];
+    readonly facts: readonly ['cross-language-entities'];
+};
+/** The three schema-validator rules this slice migrates, in registry order. */
+export declare const schemaValidatorRules: readonly RuleDefinition<SchemaValidatorNeeds>[];
+export {};
+//# sourceMappingURL=schemaValidator.d.ts.map