code-auditor-mcp 5.0.1 → 5.2.0

package/dist/pipelineAdapters.js

@@ -26,7 +26,7 @@ import { findTableReferences, checkNamingConventions, checkQueryPatterns, checkS
 import { passesFileGate, extractTablesFromRegistry, } from './analyzers/universal/schema/discovery.js';
 import { buildBindingEnv } from './analyzers/receiverRoot.js';
 import { applyMigrationOps, stripIdentifier } from './analyzers/universal/schema/migrations.js';
-import { buildOrgFilterTierSet, tableRequiresOrgFilter, } from './analyzers/orgFilterTiers.js';
+import { harvestDefinedClasses } from './styles/definedClasses.js';
 // ── Rule ID helpers ──────────────────────────────────────────────────────────
 function getRuleIdsFor(name) {
     return MIGRATED_RULES.filter((r) => r.analyzer === name).map((r) => r.id);
@@ -48,181 +48,6 @@ function lazySingleton(loader) {
         return promise;
     };
 }
-function createAnalyzerAstVisitor(spec) {
-    return {
-        name: spec.name,
-        stage: 'visitor',
-        getRuleIds: () => getRuleIdsFor(spec.name),
-        async visit(ast, adapter, context, sourceCode) {
-            const a = await spec.getAnalyzer();
-            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
-            return { violations, facts: {} };
-        },
-        defaultConfig: {},
-        description: spec.description,
-        category: spec.category,
-    };
-}
-/** Read the analyzer's accumulated samples/pairs, swallowing a load failure. */
-async function readAccumulated(getAnalyzer, pick) {
-    try {
-        const a = await getAnalyzer();
-        return pick(a) ?? [];
-    }
-    catch {
-        return [];
-    }
-}
-/** A bundle visitor: an analyzeAST visitor plus a getter for the analyzer's
- *  accumulated samples/pairs. The bundle creators (SOLID, DRY) share one lazy
- *  analyzer instance between the visitor and the getter. */
-function createAnalyzerBundle(spec) {
-    const getAnalyzer = lazySingleton(spec.loader);
-    return {
-        visitor: createAnalyzerAstVisitor({
-            name: spec.name,
-            getAnalyzer,
-            description: spec.description,
-            category: spec.category,
-        }),
-        getAccumulated: () => readAccumulated(getAnalyzer, spec.pick),
-    };
-}
-/**
- * Create the SOLID stage-2 visitor, which lazily loads the SOLID analyzer and
- * also exposes its accumulated size samples.
- *
- * @returns The SOLID visitor bundle.
- */
-export function createSolidVisitor() {
-    const { visitor, getAccumulated } = createAnalyzerBundle({
-        name: 'solid',
-        loader: () => import('./analyzers/universal/UniversalSOLIDAnalyzer.js').then((m) => new m.UniversalSOLIDAnalyzer()),
-        description: 'Detects violations of SOLID principles',
-        category: 'architecture',
-        pick: (a) => a.sizeSamples,
-    });
-    return { visitor, getSizeSamples: getAccumulated };
-}
-// ── Data-Access org-filter reducer (Spec 62 Amendment B) ─────────────────────
-/**
- * Stage-4 derived reducer for `missing-org-filter`. It joins the data-access
- * visitor's per-query facts (resolved tables + org-filter presence + query-site
- * location) against the tenant tiers resolved from config + the schema
- * reducer's corpus-wide DDL column catalog. Moving the rule here (out of the
- * Stage-2 analyzer) is the fix for the Amendment B defect: the firing predicate
- * needed the DDL tier only Stage 3 produces, but the Stage-2 analyzer could only
- * read config tiers — so a DDL-declared multi-tenant codebase was un-suppressed
- * without ever firing, and reported `clean` on a real leak.
- *
- * Firing and applicability both derive from {@link buildOrgFilterTierSet}, so
- * they read the identical tier set (Tier 1 config / Tier 2 schema / Tier 3 DDL).
- *
- * @returns The data-access org-filter stage-4 reducer.
- */
-export function createOrgFilterReducer() {
-    return {
-        name: 'data-access-org-filter',
-        stage: 'derivedReducer',
-        // Hard dependency on the data-access visitor's per-query facts. The schema
-        // table catalog (`allFacts['schema'].tableColumns`) is read opportunistically
-        // so a run without `schema` facts degrades to Tier 1–2 (config-only) instead
-        // of throwing — see buildOrgFilterTierSet.
-        getRuleIds: () => getRuleIdsFor('data-access-org-filter'),
-        async reduce(allFacts, context) {
-            const violations = [];
-            const schemaFacts = allFacts['schema'];
-            const ddlTableColumns = schemaFacts?.tableColumns;
-            // One tier source of truth — the same function the applicability predicate
-            // reads, so firing and applicability cannot drift to different tier sets.
-            const tierSet = buildOrgFilterTierSet(context.config, ddlTableColumns);
-            const daFacts = (allFacts['data-access'] ?? {});
-            for (const fileFacts of Object.values(daFacts)) {
-                for (const call of fileFacts.calls ?? []) {
-                    if (call.hasOrganizationFilter)
-                        continue;
-                    if (!call.tables || call.tables.length === 0)
-                        continue;
-                    if (!tableRequiresOrgFilter(call.tables, tierSet))
-                        continue;
-                    const symbol = `${call.enclosingFunction ?? 'top-level'}:${call.method}`;
-                    violations.push({
-                        file: call.file,
-                        line: call.line,
-                        column: call.column,
-                        severity: 'critical',
-                        message: `Query on ${call.tables.join(', ')} has no organization/tenant predicate`,
-                        suggestion: 'Add the tenant column (organization_id / org_id) to the WHERE predicate so this query is scoped to the current organization, not just by primary key.',
-                        // Structured next action (Spec 37 R1) — the rule is `resolvable`, so
-                        // the gate requires a `resolution`, not just the `suggestion` string.
-                        resolution: {
-                            action: 'add-tenant-predicate',
-                            summary: `Add the tenant column (organization_id / org_id) to the WHERE predicate on ${call.tables.join(', ')} so this query is scoped to the current organization, not just by primary key.`,
-                            symbols: call.tables,
-                        },
-                        rule: 'missing-org-filter',
-                        analyzer: 'data-access',
-                        symbol,
-                    });
-                }
-            }
-            return { violations, facts: {} };
-        },
-        defaultConfig: {},
-        description: 'Detects queries on tenant-scoped tables that omit an organization/tenant predicate',
-        category: 'security',
-    };
-}
-// ── Secrets visitor ──────────────────────────────────────────────────────────
-/**
- * Create the secrets stage-2 visitor, which detects hardcoded credentials,
- * API keys, and tokens.
- *
- * @returns The secrets stage-2 visitor.
- */
-export function createSecretsVisitor() {
-    return createAnalyzerAstVisitor({
-        name: 'secrets',
-        getAnalyzer: lazySingleton(() => import('./analyzers/universal/UniversalSecretsAnalyzer.js').then((m) => new m.UniversalSecretsAnalyzer())),
-        description: 'Detects hardcoded credentials, API keys, and tokens',
-        category: 'security',
-    });
-}
-// ── Security visitor (Spec 61 R6) ────────────────────────────────────────────
-/**
- * Create the security stage-2 visitor, which detects command injection,
- * dynamic require of project paths, and unescaped HTML interpolation.
- *
- * @returns The security stage-2 visitor.
- */
-export function createSecurityVisitor() {
-    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSecurityAnalyzer.js').then((m) => new m.UniversalSecurityAnalyzer()));
-    return {
-        name: 'security',
-        stage: 'visitor',
-        getRuleIds: () => getRuleIdsFor('security'),
-        async visit(ast, adapter, context, sourceCode) {
-            const a = await getAnalyzer();
-            const violations = await a.analyzeAST(ast, adapter, context.config, sourceCode);
-            // Emit a fact per trigger construct the file contained. These fold
-            // corpus-wide (only keys seen in ≥1 file survive the spread-merge) and
-            // feed securityInputApplicability, so a rule whose construct is absent
-            // reads `notApplicable` instead of `clean`.
-            const saw = a.inputPresence;
-            const facts = {};
-            if (saw.shellProcess)
-                facts.shellProcessSeen = true;
-            if (saw.dynamicRequire)
-                facts.dynamicRequireSeen = true;
-            if (saw.htmlSink)
-                facts.htmlSinkSeen = true;
-            return { violations, facts };
-        },
-        defaultConfig: {},
-        description: 'Detects command injection, dynamic require of project paths, and unescaped HTML interpolation',
-        category: 'security',
-    };
-}
 /**
  * Collect function/method/component entries from an AST in three passes:
  * (1) named function declarations and methods, (2) arrow functions assigned
@@ -576,87 +401,6 @@ export function createFunctionIndexVisitor() {
         category: 'infrastructure',
     };
 }
-/**
- * Create the React stage-2 visitor, which scans React components and exposes
- * cross-component checks to run after stage 2 completes.
- *
- * @returns The React visitor bundle.
- */
-export function createReactVisitor() {
-    const scanResults = [];
-    const visitor = {
-        name: 'react',
-        stage: 'visitor',
-        getRuleIds: () => getRuleIdsFor('react'),
-        async visit(_ast, _adapter, context, _sourceCode) {
-            const filePath = context.filePath;
-            if (!filePath)
-                return { violations: [], facts: {} };
-            try {
-                const { scanFile } = await import('./componentScanner.js');
-                const { analyzeComponent: analyzeComp, DEFAULT_REACT_CONFIG } = await import('./analyzers/reactAnalyzer.js');
-                // Merge with defaults so partial configs get all required fields
-                const cfg = { ...DEFAULT_REACT_CONFIG, ...context.config };
-                const sr = await scanFile(filePath, {
-                    includeTests: false,
-                    includeStories: false,
-                    extractProps: true,
-                    extractHooks: cfg.checkHooksRules,
-                    extractImports: true,
-                    detectComplexity: true,
-                });
-                scanResults.push(sr);
-                if (sr.parseErrors && sr.parseErrors.length > 0) {
-                    return { violations: [], facts: {} };
-                }
-                // Per-component checks — same logic as reactAnalyzer.analyze()
-                const violations = [];
-                for (const comp of sr.components ?? []) {
-                    violations.push(...analyzeComp(comp, cfg, sr));
-                }
-                return { violations, facts: {} };
-            }
-            catch {
-                return { violations: [], facts: {} };
-            }
-        },
-        defaultConfig: {},
-        description: 'Analyzes React components for best practices and performance',
-        category: 'frontend',
-    };
-    return {
-        visitor,
-        finalizeCrossComponent: async (config) => {
-            if (scanResults.length === 0)
-                return [];
-            const violations = [];
-            try {
-                const { checkCircularDependencies, checkErrorBoundaryUsage, checkRawElements, DEFAULT_REACT_CONFIG, } = await import('./analyzers/reactAnalyzer.js');
-                // Merge with defaults — mirrors the visitor's
-                // `{ ...DEFAULT_REACT_CONFIG, ...context.config }` so a partial config
-                // still yields every required field, and so the `react.*` flags set in
-                // .codeauditor.json reach the cross-component checks.
-                const cfg = { ...DEFAULT_REACT_CONFIG, ...(config ?? {}) };
-                // Build component tree and check for circular dependencies
-                const { buildComponentTree } = await import('./componentScanner.js');
-                const tree = buildComponentTree(scanResults);
-                violations.push(...checkCircularDependencies(tree));
-                // Check for missing error boundaries
-                if (cfg.requireErrorBoundaries !== false) {
-                    violations.push(...checkErrorBoundaryUsage(scanResults));
-                }
-                // Check for raw element usage (Spec 10 R4)
-                if (cfg.rawElementCheck !== false) {
-                    violations.push(...checkRawElements(scanResults, cfg));
-                }
-            }
-            catch {
-                // Cross-component checks are high
-            }
-            return violations;
-        },
-    };
-}
 // ── Styles reducer (stage 3) ─────────────────────────────────────────────────
 // ── Styles CSS visitor (Spec 26 Phase 2) ───────────────────────────────────────
 /**
@@ -723,6 +467,7 @@ export function createStylesSourceVisitor() {
             // Lazy-load to avoid circular dependency issues at module load time.
             const { extractDeclarations } = await import('./styles/styleExtractor.js');
             const { extractClassUsage } = await import('./styles/styleIndexer.js');
+            const { harvestCssInJsStyleClasses } = await import('./styles/cssInJsHarvest.js');
             const { loadTailwindConfig } = await import('./styles/tailwindConfigLoader.js');
             const tsAst = ast;
             const tsAdapter = adapter;
@@ -733,6 +478,10 @@ export function createStylesSourceVisitor() {
             const tailwindTokens = tailwindConfig.tokens;
             const declarations = extractDeclarations(filePath, tsAdapter, sourceCode, tsAst, tailwindTokens);
             const classUsage = extractClassUsage(filePath, sourceCode);
+            // Defined classes come from the CSS parser over each CSS-in-JS template
+            // body — the same parser path markup `<style>` blocks use, so keyframes are
+            // excluded structurally rather than scanned out of the selector `context`.
+            const definedClasses = harvestCssInJsStyleClasses(filePath, sourceCode, tsAst);
             const contentHash = createHash('sha256').update(sourceCode).digest('hex');
             const diagnostic = tailwindConfig.diagnostic && !emittedTailwindDiagnostic
                 ? tailwindConfig.diagnostic
@@ -742,7 +491,7 @@ export function createStylesSourceVisitor() {
             return {
                 violations: [],
                 facts: {
-                    [filePath]: { declarations, classUsage, contentHash },
+                    [filePath]: { declarations, classUsage, definedClasses, contentHash },
                 },
                 ...(diagnostic ? { diagnostics: [diagnostic] } : {}),
             };
@@ -834,11 +583,12 @@ function insertSourceStyleFacts(indexHandle, sourceFacts, isScoped) {
         // Insert declarations (and their defined-class catalog entries).
         for (const decl of facts.declarations) {
             runStyleWrite(stmts, 'insDecl', [decl.property, decl.rawValue, decl.normalizedValue ? JSON.stringify(decl.normalizedValue) : null, decl.mechanism, decl.filePath, decl.line, decl.context, decl.variantContext, decl.tokenRef, facts.contentHash]);
-            if (decl.context) {
-                for (const m of decl.context.matchAll(/\.([a-zA-Z0-9_-]+)/g)) {
-                    runStyleWrite(stmts, 'insClass', [m[1], decl.filePath]);
-                }
-            }
+        }
+        // Defined classes come from the CSS parser over each CSS-in-JS template body
+        // (harvested by the visitor and carried on the fact) — not a selector scan
+        // over `declarations[].context`, so keyframes are excluded structurally.
+        for (const ref of facts.definedClasses) {
+            runStyleWrite(stmts, 'insClass', [ref.className, ref.filePath]);
         }
         // Insert class usage.
         for (const cu of facts.classUsage) {
@@ -917,15 +667,12 @@ export function createStylesReducer() {
                             // Insert declarations
                             for (const decl of facts.declarations) {
                                 runStyleWrite(stmts, 'insDecl', [decl.property, decl.rawValue, JSON.stringify(decl.normalizedValue), decl.mechanism, decl.filePath, decl.line, decl.context, decl.variantContext, decl.tokenRef, contentHash]);
-                                // Populate the defined-class catalog (Spec 45) from any class
-                                // selectors in the rule's context so styles/undefined-class can
-                                // resolve names via `style_defined_classes` instead of a
-                                // full-corpus regex scan over every declaration.
-                                if (decl.context) {
-                                    for (const m of decl.context.matchAll(/\.([a-zA-Z0-9_-]+)/g)) {
-                                        runStyleWrite(stmts, 'insClass', [m[1], decl.filePath]);
-                                    }
-                                }
+                            }
+                            // Populate the defined-class catalog (Spec 45) from the CSS parser's
+                            // class-selector harvest (`classUsage`) — keyframes and pseudo-classes
+                            // are excluded structurally, so no selector scrape over `context`.
+                            for (const ref of harvestDefinedClasses(facts.declarations, facts.classUsage, true)) {
+                                runStyleWrite(stmts, 'insClass', [ref.className, ref.filePath]);
                             }
                             // Insert tokens
                             for (const tok of facts.tokens) {
@@ -968,125 +715,6 @@ export function createStylesReducer() {
         category: 'style',
     };
 }
-// ── Conventions reducer (stage 3) ────────────────────────────────────────────
-/**
- * Builds the shared analyzer-config bag for reducers that query the code
- * index: the reducer's own namespaced config spread over the index handle,
- * project root, in-scope file set, and scope flag. Reducers that need extra
- * inputs (`readSource`, `exportsMap`) spread this and layer them on top.
- *
- * Scoped/diff audits thread `_infra.files` (absolute) as `scopedFiles` so the
- * analyzer scopes its function/file queries to only the changed files;
- * `functions.file_path` is also absolute, so the IN clause matches directly.
- */
-function makeIndexAnalyzerConfig(context) {
-    const scopedFiles = context.isScoped ? (context.config.files ?? []) : undefined;
-    return {
-        ...context.config,
-        indexHandle: context.indexHandle,
-        projectRoot: context.projectRoot,
-        scopedFiles,
-        isScoped: context.isScoped,
-    };
-}
-/**
- * Conventions reducer — queries conventions table and flags deviations
- * (usage-pair, import-form, error-handling, export-shape, naming).
- * Uses analyzer.analyze([]) with rawDb injected.
- *
- * @returns The conventions stage-3 reducer.
- */
-export function createConventionsReducer() {
-    return {
-        name: 'conventions',
-        stage: 'reducer',
-        consumes: [],
-        getRuleIds: () => getRuleIdsFor('conventions'),
-        async reduce(_allFacts, context) {
-            if (!context.indexHandle)
-                return { violations: [], facts: {} };
-            try {
-                const { UniversalConventionsAnalyzer } = await import('./analyzers/universal/UniversalConventionsAnalyzer.js');
-                const analyzer = new UniversalConventionsAnalyzer();
-                // B2: Build exports map from function-index visitor facts (AST-extracted)
-                const functionIndexFacts = _allFacts['function-index'];
-                const exportsMap = functionIndexFacts
-                    ? new Map(Object.entries(functionIndexFacts)
-                        .filter(([, data]) => data?.exports?.length)
-                        .map(([filePath, data]) => [filePath, data.exports]))
-                    : undefined;
-                const config = { ...makeIndexAnalyzerConfig(context), readSource: context.readSource, exportsMap };
-                const result = await analyzer.analyze([], config);
-                // Count the INPUT the conventions analyzer reads (the function index the
-                // function-index visitor populated), not the derived `conventions` table it
-                // writes. `conventions` is an output cache (mineAllConventions) that can be
-                // empty when `minCorpus` is unmet even though thousands of functions fed the
-                // analyzer — counting it as "facts consumed" misreports a present input as
-                // notApplicable. (Spec 39 R2/R3 bug B)
-                const factsConsumed = context.indexHandle.count('functions');
-                return {
-                    violations: result.violations ?? [],
-                    facts: {},
-                    factsConsumed,
-                    ...(result.diagnostics && result.diagnostics.length > 0 && { diagnostics: result.diagnostics }),
-                };
-            }
-            catch {
-                return { violations: [], facts: {} };
-            }
-        },
-        defaultConfig: {},
-        description: 'Mines codebase conventions and flags deviations',
-        category: 'style',
-    };
-}
-// ── Cross-Domain reducer (stage 4) ───────────────────────────────────────────
-/**
- * Cross-domain reducer — runs written-never-read, read-never-written,
- * transaction-boundary risk, no-validator-reachable, and uncovered-risk detectors.
- * Uses analyzer.analyze([]) with rawDb injected.
- *
- * @returns The cross-domain stage-4 reducer.
- */
-export function createCrossDomainReducer() {
-    return {
-        name: 'cross-domain',
-        stage: 'derivedReducer',
-        getRuleIds: () => getRuleIdsFor('cross-domain'),
-        async reduce(_allFacts, context) {
-            if (!context.indexHandle)
-                return { violations: [], facts: {} };
-            try {
-                const { CrossDomainAnalyzer } = await import('./analyzers/crossDomain/CrossDomainAnalyzer.js');
-                const analyzer = new CrossDomainAnalyzer();
-                const config = makeIndexAnalyzerConfig(context);
-                const result = await analyzer.analyze([], config);
-                // Count DB rows consumed across primary cross-domain tables
-                let factsConsumed = 0;
-                try {
-                    factsConsumed += context.indexHandle.count('schema_usage');
-                }
-                catch { /* table may not exist */ }
-                // `indexed_functions` is not a real table — the function index lives in
-                // `functions`. The old name made this term silently no-op (swallowed by the
-                // catch), undercounting the input for read/write coverage detectors.
-                // (Spec 39 R2/R3 bug C)
-                try {
-                    factsConsumed += context.indexHandle.count('functions');
-                }
-                catch { /* table may not exist */ }
-                return { violations: result.violations ?? [], facts: {}, factsConsumed };
-            }
-            catch (e) {
-                console.error('[cross-domain reducer] error:', e.message);
-                return { violations: [], facts: {} };
-            }
-        },
-        defaultConfig: {},
-        description: 'Detects cross-domain issues (schema lifecycle, validation bypass, coverage gaps)',
-        category: 'architecture',
-    };
-}
 // ── Cross-language entity extraction + Stage-4 reducers ──────────────────────
 //
 // The three cross-language analyzers (SchemaValidator, APIContractAnalyzer,
@@ -1150,6 +778,32 @@ function clCollectCallees(node, sourceCode) {
     walk(node);
     return [...names];
 }
+/**
+ * Whether a function node is lexically nested inside another function body.
+ *
+ * A nested function (a closure) is only reachable from its enclosing scope, not
+ * from module top-level, so a flat name-based call graph cannot observe its use
+ * the way it observes a top-level symbol's callers. The cross-language entity
+ * extractor records this flag so orphan detection can treat a closure's "no
+ * connections" as unproven rather than as evidence of dead code. Go named
+ * functions are never nested (Go only admits anonymous function *literals*
+ * inside a body, and those are not `function_declaration` nodes), so this is a
+ * TS/JS-family signal.
+ */
+function clIsNestedFunction(node) {
+    let p = node.parent ?? null;
+    while (p) {
+        const t = p.type;
+        if (t === 'function_declaration' ||
+            t === 'method_definition' ||
+            t === 'arrow_function' ||
+            t === 'function_expression') {
+            return true;
+        }
+        p = p.parent ?? null;
+    }
+    return false;
+}
 /**
  * Collect every reference name in a file's AST, independent of entity
  * boundaries. Orphan detection needs the complete same-file reference set —
@@ -1237,107 +891,6 @@ function clMakeFunction(opts) {
         metadata: { callees, isMethod },
     };
 }
-/**
- * Detect a dynamic `import('…')`/`require('…')` call expression.
- *
- * Returns `{ specifier }` for a static-string argument (resolvable into an
- * import edge), `{ computed, expression }` for a computed specifier
- * (`import(someVariable)` — unresolvable, reported rather than silenced), or
- * `null` when the call is not a dynamic import/require.
- */
-function clDynamicImport(node, sourceCode) {
-    if (node.type !== 'call_expression')
-        return null;
-    const fn = node.children?.[0];
-    const isImport = fn?.type === 'import';
-    const isRequire = fn?.type === 'identifier' && getNodeText(fn, sourceCode) === 'require';
-    if (!isImport && !isRequire)
-        return null;
-    const args = node.children?.find((c) => c.type === 'arguments');
-    const stringNode = args?.children?.find((c) => c.type === 'string');
-    if (stringNode) {
-        const text = getNodeText(stringNode, sourceCode);
-        if (text.length >= 2) {
-            return { specifier: text.slice(1, -1) };
-        }
-    }
-    // A template literal with no `${…}` substitution is a compile-time constant,
-    // not a computed specifier — `import(\`@babel/plugin-syntax-jsx\`)` resolves
-    // to an edge just like `import('@babel/plugin-syntax-jsx')`. Only an
-    // interpolated template (`` import(`./${name}.js`) ``) is genuinely computed.
-    const templateNode = args?.children?.find((c) => c.type === 'template_string');
-    if (templateNode) {
-        const hasSubstitution = (templateNode.children ?? []).some((c) => c.type === 'template_substitution');
-        if (!hasSubstitution) {
-            const t = getNodeText(templateNode, sourceCode);
-            if (t.length >= 2 && t.startsWith('`') && t.endsWith('`')) {
-                return { specifier: t.slice(1, -1) };
-            }
-        }
-    }
-    // Computed specifier — the target module cannot be resolved statically.
-    const named = args?.children?.[0];
-    const expression = named
-        ? getNodeText(named, sourceCode)
-        : getNodeText(args, sourceCode).replace(/^\(|\)$/g, '').trim();
-    return { computed: true, expression };
-}
-/**
- * Collect a file's import specifiers and whether it declares any exports.
- *
- * Feeds file-level reachability: an `import_statement` (TS/JS) or
- * `import_declaration` (Go) records a dependency; an `export_statement`
- * (TS/JS) records that the file exposes symbols to importers. Go exports are
- * computed separately from the extracted entities (capitalized top-level
- * names), since Go has no `export` keyword. Dynamic `import()`/`require()`
- * with a static string argument also record an import edge (Spec 58 R2).
- */
-function clCollectFileInfo(root, lang, sourceCode) {
-    const imports = new Set();
-    const unresolvedDynamicImports = [];
-    let hasExports = false;
-    walkAST(root, (node) => {
-        if (node.type === 'import_statement') {
-            const source = getFieldNode(node, 'source');
-            if (source) {
-                const text = getNodeText(source, sourceCode);
-                imports.add(text.replace(/^['"]|['"]$/g, ''));
-            }
-        }
-        else if (node.type === 'import_declaration') {
-            for (const spec of node.children ?? []) {
-                if (spec.type === 'import_spec') {
-                    const p = getFieldNode(spec, 'path');
-                    if (p) {
-                        const text = getNodeText(p, sourceCode);
-                        imports.add(text.replace(/^['"]|['"]$/g, ''));
-                    }
-                }
-            }
-        }
-        else if (node.type === 'export_statement') {
-            hasExports = true;
-            // Re-exports (`export { x } from './y'`, `export * from './y'`) are import
-            // edges for reachability: a barrel re-exporting a module marks it live,
-            // not dead. The `source` field is present only on the `from` form.
-            const source = getFieldNode(node, 'source');
-            if (source) {
-                const text = getNodeText(source, sourceCode);
-                imports.add(text.replace(/^['"]|['"]$/g, ''));
-            }
-        }
-        else if (node.type === 'call_expression') {
-            const dyn = clDynamicImport(node, sourceCode);
-            if (dyn && 'specifier' in dyn) {
-                imports.add(dyn.specifier);
-            }
-            else if (dyn) {
-                unresolvedDynamicImports.push({ line: node.location.start.line, expression: dyn.expression });
-            }
-        }
-    });
-    return { imports: [...imports], hasExports, unresolvedDynamicImports };
-}
 // ── TS/JS extraction ─────────────────────────────────────────────────────────
 function clExtractTSParams(node, sourceCode) {
     const params = [];
@@ -1406,6 +959,7 @@ function clExtractTSEntities(root, filePath, sourceCode, lang, out) {
                 isMethod: node.type === 'method_definition',
             });
             entity.metadata.fileReferences = fileReferences;
+            entity.metadata.isNested = clIsNestedFunction(node);
             out.push(entity);
             return;
         }
@@ -1428,6 +982,7 @@ function clExtractTSEntities(root, filePath, sourceCode, lang, out) {
                 complexity: calculateComplexity(node),
             });
             entity.metadata.fileReferences = fileReferences;
+            entity.metadata.isNested = clIsNestedFunction(node);
             out.push(entity);
             return;
         }
@@ -1611,638 +1166,6 @@ export function extractCrossLanguageEntities(ast, filePath, sourceCode, lang) {
     }
     return entities;
 }
-/**
- * Create the cross-language-entities stage-2 visitor, which extracts entities
- * and import/export info for the cross-language analyzers.
- *
- * @returns The cross-language-entities stage-2 visitor.
- */
-export function createCrossLanguageEntityVisitor() {
-    return {
-        name: 'cross-language-entities',
-        stage: 'visitor',
-        extensions: ['.ts', '.tsx', '.js', '.jsx', '.mts', '.cts', '.mjs', '.cjs', '.go'],
-        getRuleIds: () => [],
-        async visit(ast, _adapter, context, sourceCode) {
-            const filePath = context.filePath;
-            if (!filePath)
-                return { violations: [], facts: {} };
-            const lang = getLanguageFromPath(filePath);
-            if (lang !== 'typescript' && lang !== 'javascript' && lang !== 'go')
-                return { violations: [], facts: {} };
-            const root = ast.root;
-            const entities = [];
-            if (lang === 'go') {
-                clExtractGoEntities(root, filePath, sourceCode, entities);
-            }
-            else {
-                clExtractTSEntities(root, filePath, sourceCode, lang, entities);
-            }
-            const fileInfo = clCollectFileInfo(root, lang, sourceCode);
-            // Go has no `export` keyword — an exported symbol is a capitalized
-            // top-level name, which the entity extractor already records as public.
-            const hasExports = lang === 'go'
-                ? entities.some((e) => e.visibility === 'public')
-                : fileInfo.hasExports;
-            return {
-                violations: [],
-                facts: { [filePath]: { entities, imports: fileInfo.imports, hasExports, unresolvedDynamicImports: fileInfo.unresolvedDynamicImports } },
-            };
-        },
-        defaultConfig: {},
-        description: 'Extracts cross-language entities (functions, structs, interfaces) for the cross-language analyzers',
-        category: 'infrastructure',
-    };
-}
-// ── Shared flatten + reference building ──────────────────────────────────────
-function clFlattenEntities(allFacts) {
-    const facts = allFacts['cross-language-entities'];
-    if (!facts)
-        return [];
-    const entities = [];
-    for (const data of Object.values(facts)) {
-        if (data?.entities)
-            entities.push(...data.entities);
-    }
-    return entities;
-}
-/** Extract per-file `{ imports, hasExports }` from the cross-language facts. */
-function clFileFacts(allFacts) {
-    const facts = allFacts['cross-language-entities'];
-    const map = new Map();
-    if (!facts)
-        return map;
-    for (const [filePath, data] of Object.entries(facts)) {
-        if (!data)
-            continue;
-        map.set(filePath, {
-            imports: data.imports ?? [],
-            hasExports: data.hasExports ?? false,
-            unresolvedDynamicImports: data.unresolvedDynamicImports ?? [],
-        });
-    }
-    return map;
-}
-function clIsTestFile(fp) {
-    const lower = fp.toLowerCase();
-    return lower.includes('.test.') || lower.includes('.spec.') ||
-        lower.includes('__tests__') || lower.includes('/test/') || lower.includes('/tests/') ||
-        lower.endsWith('_test.go');
-}
-// Files the framework loads directly rather than via an import from sibling
-// code. Skipped when flagging unreferenced modules — a route/page/entry file
-// that nothing imports is an entry point, not dead code.
-const CL_ENTRY_BASENAMES = new Set([
-    'route', 'page', 'layout', 'loading', 'error', 'not-found', 'template', 'default',
-    'middleware', 'instrumentation', 'server', 'client', 'cli', 'main', 'app', 'index', 'worker',
-    'setup', 'seed',
-]);
-function clIsEntryPointFile(fp) {
-    const segments = fp.replace(/\\/g, '/').split('/').filter(Boolean);
-    const base = segments[segments.length - 1] ?? '';
-    const stem = base.replace(/\.[^.]+$/, '');
-    if (CL_ENTRY_BASENAMES.has(stem))
-        return true;
-    if (stem.endsWith('.config'))
-        return true; // next.config, vite.config, tailwind.config, …
-    const joined = '/' + segments.join('/') + '/';
-    if (joined.includes('/app/api/') || joined.includes('/pages/api/'))
-        return true;
-    if (joined.includes('/scripts/') || joined.includes('/bin/') || joined.includes('/cmd/'))
-        return true;
-    return false;
-}
-/** Resolve one import specifier to zero or one internal file via the classifier. */
-function clResolveImport(dep, sourceFile, options) {
-    const { classification, resolvedPath } = classifyImportSpecifier(dep, sourceFile, options.corpusFiles, {
-        virtualModules: options.virtualModules,
-        aliasPatterns: options.tsconfigAliases?.pathPatterns ?? [],
-        pathMappings: options.tsconfigAliases?.paths ?? {},
-        baseUrl: options.tsconfigAliases?.baseUrl,
-        projectRoot: options.projectRoot,
-    });
-    if (classification === 'internal-resolved' && resolvedPath)
-        return [resolvedPath];
-    return [];
-}
-/**
- * Compute file-level reachability from per-file imports.
- *
- * A file is a framework entry point (live → 1.0), imported by another file
- * (live → 0.5), or referenced by nothing (dead → 0.0). Resolution goes through
- * `classifyImportSpecifier` (relative paths and tsconfig `paths` aliases like
- * `@/`) instead of the legacy basename/fuzzy matcher, so an alias import creates
- * a real edge and a bare package import never fabricates a local one.
- */
-function clComputeReachability(fileFacts, options) {
-    const filePaths = new Set(fileFacts.keys());
-    const packageEntries = options.packageEntryPoints ?? new Set();
-    const importersOf = new Map();
-    for (const [fp, info] of fileFacts) {
-        for (const dep of info.imports) {
-            const targets = clResolveImport(dep, fp, options);
-            for (const t of targets) {
-                if (t === fp)
-                    continue;
-                if (!importersOf.has(t))
-                    importersOf.set(t, new Set());
-                importersOf.get(t).add(fp);
-            }
-        }
-    }
-    const reachability = new Map();
-    for (const fp of filePaths) {
-        const entry = clIsEntryPointFile(fp) || packageEntries.has(fp);
-        const imported = (importersOf.get(fp)?.size ?? 0) > 0;
-        reachability.set(fp, entry ? 1 : imported ? 0.5 : 0);
-    }
-    return { reachability, importersOf };
-}
-/**
- * Spec 60 R1 — classify every non-test source module as `tested`,
- * `untested-live`, or `untested-dead` off the file-level import edges
- * (`importersOf`), not `function_dependencies`.
- *
- * A module is `tested` when a test file imports it *directly* (the edge set is
- * alias-aware — built by `clResolveImport` through `classifyImportSpecifier`).
- * `untested-dead` is the *post*-exception dead bucket: a file imported by
- * nothing *and* not a framework entry point. `deadPreException` is the
- * empty-importers count before the entry-point exception, so the drop
- * (`deadPreException - untestedDead`) attributes the entry points exempted.
- *
- * @param fileFacts - Per-file import/export info keyed by project-relative path.
- * @param importersOf - Map of file to the set of files that import it.
- * @param packageEntrySet - Framework/package entry points exempted from the dead bucket.
- * @returns The test-coverage classification report.
- */
-export function classifyTestCoverage(fileFacts, importersOf, packageEntrySet) {
-    const result = {
-        tested: 0,
-        untestedLive: 0,
-        untestedDead: 0,
-        total: 0,
-        deadPreException: 0,
-        deadPostException: 0,
-        deadDrop: 0,
-        entryPointExemptions: [],
-        testedFiles: [],
-        untestedLiveFiles: [],
-        untestedDeadFiles: [],
-    };
-    for (const fp of fileFacts.keys()) {
-        if (clIsTestFile(fp))
-            continue;
-        result.total++;
-        const importers = importersOf.get(fp);
-        if (!importers || importers.size === 0) {
-            // Imported by nothing — dead *unless* it is a framework entry point.
-            result.deadPreException++;
-            const isPackageEntry = packageEntrySet.has(fp);
-            const isEntry = isPackageEntry || clIsEntryPointFile(fp);
-            if (isEntry) {
-                result.untestedLive++;
-                result.untestedLiveFiles.push(fp);
-                result.entryPointExemptions.push({
-                    file: fp,
-                    kind: isPackageEntry ? 'package-entry' : 'entry-point',
-                });
-            }
-            else {
-                result.untestedDead++;
-                result.untestedDeadFiles.push(fp);
-            }
-            continue;
-        }
-        let hasTestImporter = false;
-        for (const importer of importers) {
-            if (clIsTestFile(importer)) {
-                hasTestImporter = true;
-                break;
-            }
-        }
-        if (hasTestImporter) {
-            result.tested++;
-            result.testedFiles.push(fp);
-        }
-        else {
-            result.untestedLive++;
-            result.untestedLiveFiles.push(fp);
-        }
-    }
-    result.deadPostException = result.untestedDead;
-    result.deadDrop = result.deadPreException - result.untestedDead;
-    return result;
-}
-/**
- * Spec 60 R3 — group unreferenced modules by basename, surfacing the pattern of
- * the same file name appearing in several sibling directories (e.g. two
- * `ErrorState.tsx`, three `services.ts` under separate `reports` folders). Only
- * basenames with ≥2 files become clusters; a singleton dead file is not a duplicate.
- *
- * @param deadFiles - Unreferenced module paths to cluster by basename.
- * @returns Dead-module clusters (only basenames with two or more files).
- */
-export function clusterDeadModules(deadFiles) {
-    const byBasename = new Map();
-    for (const fp of deadFiles) {
-        const segments = fp.replace(/\\/g, '/').split('/').filter(Boolean);
-        const basename = segments[segments.length - 1] ?? fp;
-        const list = byBasename.get(basename) ?? [];
-        list.push(fp);
-        byBasename.set(basename, list);
-    }
-    const clusters = [];
-    for (const [basename, files] of byBasename) {
-        if (files.length >= 2) {
-            clusters.push({ basename, count: files.length, files });
-        }
-    }
-    clusters.sort((a, b) => b.count - a.count || a.basename.localeCompare(b.basename));
-    return clusters;
-}
-/**
- * Build `calls` cross-references by resolving each entity's extracted callee
- * names against the corpus entity name index. Library calls (fetch, map, …)
- * resolve to nothing and are dropped — only real intra-corpus call edges become
- * references.
- */
-function clBuildReferences(entities) {
-    const byName = new Map();
-    for (const e of entities) {
-        const key = e.name.toLowerCase();
-        const list = byName.get(key) ?? [];
-        list.push(e);
-        byName.set(key, list);
-    }
-    const refs = [];
-    for (const e of entities) {
-        const callees = e.metadata?.callees ?? [];
-        const eDir = e.file.split('/').slice(0, -1).join('/');
-        for (const callee of callees) {
-            const name = (callee.split('.').pop() ?? callee).toLowerCase();
-            // A free function that calls itself by bare name is recursing. Resolving
-            // that name to a *different* same-named entity (a second `dfs` helper in
-            // the same file) fabricates a spurious mutual-recursion cycle between two
-            // unrelated functions and reports it as a circular dependency. Recursion
-            // is a self-reference, not a module cycle — drop it rather than resolve
-            // it sideways. (Methods are named `Class.method`, so a bare callee never
-            // matches their own name and this only affects free functions.)
-            if (name === e.name.toLowerCase())
-                continue;
-            const others = (byName.get(name) ?? []).filter((t) => t.id !== e.id);
-            if (others.length === 0)
-                continue;
-            // A bare call-expression name (`log`) can collide with many entities
-            // across the corpus. Resolving it to *every* entity of that name
-            // fabricates a dense graph (125k edges / 5.9k false cycles on a ~7.8k
-            // node corpus) that corrupts cycle/hub/coupling detection. Narrow the
-            // resolution to an unambiguous match — same file, then same directory,
-            // then a unique global match — and drop the edge when the name is still
-            // ambiguous: a missing edge is safer than a fabricated one for
-            // structural analysis.
-            const sameFile = others.filter((t) => t.file === e.file);
-            const sameDir = sameFile.length === 0
-                ? others.filter((t) => t.file.split('/').slice(0, -1).join('/') === eDir)
-                : [];
-            const uniqueGlobal = others.length === 1 ? others : [];
-            const chosen = sameFile.length === 1
-                ? sameFile
-                : sameDir.length === 1
-                    ? sameDir
-                    : uniqueGlobal;
-            for (const t of chosen) {
-                refs.push({
-                    sourceId: e.id,
-                    targetId: t.id,
-                    type: 'calls',
-                    sourceLanguage: e.language,
-                    targetLanguage: t.language,
-                    confidence: 0.7,
-                });
-            }
-        }
-    }
-    return refs;
-}
-// ── schema-validator reducer (Stage 4) ───────────────────────────────────────
-/**
- * Create the schema-validator stage-4 reducer, which compares schemas across
- * language boundaries (TS interfaces vs Go structs).
- *
- * @returns The schema-validator stage-4 reducer.
- */
-export function createSchemaValidatorReducer() {
-    return {
-        name: 'schema-validator',
-        stage: 'derivedReducer',
-        getRuleIds: () => getRuleIdsFor('schema-validator'),
-        async reduce(allFacts, context) {
-            if (context.isScoped) {
-                return {
-                    violations: [],
-                    facts: {},
-                    notRunReason: 'schema-validator requires a full-corpus audit (cross-language schema comparison is unavailable on scoped/diff runs)',
-                };
-            }
-            const entities = clFlattenEntities(allFacts);
-            if (entities.length === 0)
-                return { violations: [], facts: {}, factsConsumed: 0 };
-            try {
-                const { SchemaValidator, extractSchemas, countCrossLanguagePairs, getUnimplementedSchemaExtractions } = await import('./analyzers/cross-language/SchemaValidator.js');
-                const schemas = extractSchemas(entities);
-                const unimplemented = getUnimplementedSchemaExtractions(entities);
-                // A zero here would otherwise surface as `clean` in coverage — which
-                // reads as "compared everything and found no mismatch" when the truth
-                // is "there is nothing to compare". Distinguish the two: no schemas at
-                // all, or schemas all in one language, is `notApplicable`, not `clean`.
-                // Fold in any schema languages that are present but not extracted, so
-                // "protobuf extraction not implemented" reaches the report rather than
-                // silently collapsing into a zero.
-                const gapReason = unimplemented.map(u => u.reason).join(', ');
-                if (schemas.length === 0) {
-                    const reason = gapReason
-                        ? `${gapReason} (no interfaces/structs to compare)`
-                        : 'no schema definitions found (no interfaces/structs to compare)';
-                    return { violations: [], facts: {}, notRunReason: reason };
-                }
-                if (countCrossLanguagePairs(schemas) === 0) {
-                    const reason = gapReason
-                        ? `no cross-language pairs found (${gapReason}; schema comparison requires ≥2 languages)`
-                        : 'no cross-language pairs found (schema comparison requires ≥2 languages)';
-                    return { violations: [], facts: {}, notRunReason: reason };
-                }
-                const validator = new SchemaValidator();
-                const violations = await validator.validateSchemas(schemas);
-                return { violations, facts: {}, factsConsumed: schemas.length };
-            }
-            catch (e) {
-                console.error('[schema-validator reducer] error:', e.message);
-                return { violations: [], facts: {}, factsConsumed: 0 };
-            }
-        },
-        defaultConfig: {},
-        description: 'Validates schema consistency across language boundaries (TS interfaces vs Go structs)',
-        category: 'cross-language',
-    };
-}
-// ── api-contract reducer (Stage 4) ───────────────────────────────────────────
-/**
- * Create the api-contract stage-4 reducer, which compares frontend API calls
- * against backend endpoints across languages.
- *
- * @returns The api-contract stage-4 reducer.
- */
-export function createAPIContractReducer() {
-    return {
-        name: 'api-contract',
-        stage: 'derivedReducer',
-        getRuleIds: () => getRuleIdsFor('api-contract'),
-        async reduce(allFacts, context) {
-            if (context.isScoped) {
-                return {
-                    violations: [],
-                    facts: {},
-                    notRunReason: 'api-contract requires a full-corpus audit (cross-language API comparison is unavailable on scoped/diff runs)',
-                };
-            }
-            const entities = clFlattenEntities(allFacts);
-            if (entities.length === 0)
-                return { violations: [], facts: {}, factsConsumed: 0 };
-            try {
-                const { APIContractAnalyzer, extractEndpoints, extractAPICalls } = await import('./analyzers/cross-language/APIContractAnalyzer.js');
-                const endpoints = extractEndpoints(entities);
-                const calls = extractAPICalls(entities);
-                const analyzer = new APIContractAnalyzer();
-                const violations = await analyzer.analyzeContracts(endpoints, calls);
-                return { violations, facts: {}, factsConsumed: endpoints.length + calls.length };
-            }
-            catch (e) {
-                console.error('[api-contract reducer] error:', e.message);
-                return { violations: [], facts: {}, factsConsumed: 0 };
-            }
-        },
-        defaultConfig: {},
-        description: 'Validates API contracts between frontend calls and backend endpoints across languages',
-        category: 'cross-language',
-    };
-}
-// ── dependency-graph reducer (Stage 4) ───────────────────────────────────────
-/**
- * Persist a `graph_cache` edge set in one transaction: delete the graph's
- * existing rows, then insert `rows` as (node_key, neighbor_key, weight).
- * Advisory — a failure here only degrades the post-pipeline hotspot ranking,
- * so it is swallowed rather than surfaced as an audit error.
- */
-function persistGraphEdges(rawDb, graphType, rows) {
-    try {
-        const db = rawDb;
-        const del = db.prepare(`DELETE FROM graph_cache WHERE graph_type = '${graphType}'`);
-        const ins = db.prepare(`INSERT OR REPLACE INTO graph_cache (graph_type, node_key, neighbor_key, weight) VALUES ('${graphType}', ?, ?, ?)`);
-        const tx = db.transaction(() => {
-            del.run();
-            for (const [nodeKey, neighborKey, weight] of rows) {
-                ins.run(nodeKey, neighborKey, weight);
-            }
-        });
-        tx();
-    }
-    catch {
-        // Advisory persistence — ranking falls back to a neutral default without it.
-    }
-}
-/**
- * Create the dependency-graph stage-4 reducer, which detects dependency cycles,
- * hubs, and orphaned nodes.
- *
- * @returns The dependency-graph stage-4 reducer.
- */
-export function createDependencyGraphReducer() {
-    return {
-        name: 'dependency-graph',
-        stage: 'derivedReducer',
-        getRuleIds: () => getRuleIdsFor('dependency-graph'),
-        async reduce(allFacts, context) {
-            if (context.isScoped) {
-                return {
-                    violations: [],
-                    facts: {},
-                    notRunReason: 'dependency-graph requires a full-corpus audit (cycle/SCC/hub/orphan detection is unavailable on scoped/diff runs)',
-                };
-            }
-            const entities = clFlattenEntities(allFacts);
-            if (entities.length === 0)
-                return { violations: [], facts: {}, factsConsumed: 0 };
-            try {
-                const { DependencyGraphBuilder } = await import('./analyzers/cross-language/DependencyGraphBuilder.js');
-                const builder = new DependencyGraphBuilder({ includeTestFiles: false });
-                const references = clBuildReferences(entities);
-                const graph = await builder.buildGraph(entities, references);
-                const health = await builder.analyzeDependencyHealth(graph);
-                const idToEntity = new Map(entities.map((e) => [e.id, e]));
-                const violations = [];
-                const diagnostics = [];
-                for (const issue of health.issues) {
-                    if (issue.type === 'orphaned-nodes') {
-                        // Emit one violation per orphan so each is attributed to its own
-                        // file/line. The aggregated form anchored every orphan to the first
-                        // node's location while the message listed all of them — foreign
-                        // symbols leaked into the wrong file.
-                        for (const id of issue.affectedNodes) {
-                            const orphan = idToEntity.get(id);
-                            if (!orphan)
-                                continue;
-                            violations.push({
-                                file: orphan.file,
-                                line: orphan.startLine,
-                                severity: issue.severity,
-                                message: `Orphaned node "${orphan.name}" has no connections.`,
-                                rule: issue.type,
-                                type: issue.type, // dependency-graph rules match on field: 'type'
-                                analyzer: 'dependency-graph',
-                                category: 'cross-language-dependency',
-                                symbol: orphan.name,
-                                details: { orphanId: id },
-                            });
-                        }
-                        continue;
-                    }
-                    const anchor = issue.affectedNodes.map((id) => idToEntity.get(id)).find(Boolean);
-                    violations.push({
-                        file: anchor?.file ?? '(unknown)',
-                        line: anchor?.startLine ?? 0,
-                        severity: issue.severity,
-                        message: issue.description,
-                        rule: issue.type,
-                        type: issue.type, // dependency-graph rules match on field: 'type'
-                        analyzer: 'dependency-graph',
-                        category: 'cross-language-dependency',
-                        details: issue.details,
-                    });
-                }
-                // ── File-level reachability: unreferenced modules + ranking axis ──
-                const fileFacts = clFileFacts(allFacts);
-                let testCoverage;
-                let deadClusters = [];
-                if (fileFacts.size > 0) {
-                    // `context.config` is the reducer's merged config (namespace + `_infra`);
-                    // a bare reducer context in a unit test omits it, so fall back to the
-                    // file facts themselves as the corpus and a no-alias classification.
-                    const infraConfig = (context.config ?? {});
-                    const packageEntrySet = new Set(infraConfig.packageEntryPoints ?? []);
-                    const { reachability, importersOf } = clComputeReachability(fileFacts, {
-                        corpusFiles: new Set(infraConfig.corpusFiles ?? [...fileFacts.keys()]),
-                        virtualModules: infraConfig.importVirtualModules ?? DEFAULT_VIRTUAL_MODULES,
-                        tsconfigAliases: infraConfig.tsconfigAliases,
-                        packageEntryPoints: packageEntrySet,
-                        projectRoot: context.projectRoot ?? '',
-                    });
-                    // Persist reachability to graph_cache so the post-pipeline reorder
-                    // (auditRunner hotspot block) can rank every finding by live/dead.
-                    if (context.indexHandle?.rawDb) {
-                        const reachabilityRows = [...reachability].map(([fp, score]) => [fp, '', score]);
-                        persistGraphEdges(context.indexHandle.rawDb, 'reachability', reachabilityRows);
-                    }
-                    // Spec 60 R1 — persist the file-level import edges (reverse adjacency:
-                    // module → its direct importers) so "what tests exercise this module"
-                    // is answerable downstream from `importersOf`, not the symbol-level
-                    // `function_dependencies` table.
-                    if (context.indexHandle?.rawDb) {
-                        const importerRows = [];
-                        for (const [fp, importers] of importersOf) {
-                            for (const importer of importers) {
-                                importerRows.push([fp, importer, 1]);
-                            }
-                        }
-                        persistGraphEdges(context.indexHandle.rawDb, 'importers', importerRows);
-                    }
-                    // Flag files that export symbols yet are imported by nothing and are
-                    // not framework entry points — a dead module. This is the signal the
-                    // orphaned-nodes check missed: a whole unreferenced file whose every
-                    // internal symbol still forms a connected component.
-                    const deadModuleFiles = [];
-                    for (const [fp, info] of fileFacts) {
-                        if (!info.hasExports)
-                            continue;
-                        if (clIsTestFile(fp))
-                            continue;
-                        if (clIsEntryPointFile(fp) || packageEntrySet.has(fp))
-                            continue;
-                        if ((importersOf.get(fp)?.size ?? 0) > 0)
-                            continue;
-                        deadModuleFiles.push(fp);
-                        violations.push({
-                            file: fp,
-                            line: 1,
-                            // A module that exports and is imported by nothing is a genuine
-                            // dead-code signal — anchored severe. Validated across four corpora.
-                            severity: 'severe',
-                            message: 'Module is not imported by any other file and is not a framework entry point — dead code candidate.',
-                            rule: 'unreferenced-module',
-                            type: 'unreferenced-module',
-                            analyzer: 'dependency-graph',
-                            category: 'cross-language-dependency',
-                            details: { imports: info.imports },
-                        });
-                    }
-                    // Spec 60 R1 — classify each non-test module off the import edge set.
-                    testCoverage = classifyTestCoverage(fileFacts, importersOf, packageEntrySet);
-                    // Spec 60 R3 — cluster the unreferenced modules by basename so the
-                    // "dead-and-duplicated" pattern (same file name in sibling dirs) is
-                    // visible as a cluster rather than scattered one-per-file findings.
-                    deadClusters = clusterDeadModules(deadModuleFiles);
-                    // Spec 58 R2 — computed-specifier dynamic imports. `import(someVar)`
-                    // cannot be resolved into an edge, so any module in this corpus could
-                    // be its target and `unreferenced-module` is therefore not exhaustive.
-                    // This is a coverage diagnostic (the analyzer can't resolve the target),
-                    // not a finding (the code isn't wrong) — surfaced, not gated.
-                    for (const [fp, info] of fileFacts) {
-                        for (const dyn of info.unresolvedDynamicImports) {
-                            diagnostics.push({
-                                analyzerName: 'dependency-graph',
-                                kind: 'unresolved-dynamic-import',
-                                message: `Dynamic import/require has a computed specifier (${dyn.expression || '…'}) that cannot be resolved — its target module is unknown, so unreferenced-module may miss a live dependency.`,
-                                file: fp,
-                                line: dyn.line,
-                                details: { expression: dyn.expression },
-                            });
-                        }
-                    }
-                }
-                const HEALTH_SEVERITY = {
-                    'break-cycles': 'severe',
-                    'reduce-coupling': 'high',
-                    'review-orphans': 'severe',
-                };
-                for (const s of health.suggestions) {
-                    violations.push({
-                        file: '(multiple)',
-                        line: 0,
-                        severity: HEALTH_SEVERITY[s.type] ?? 'high',
-                        message: s.description,
-                        rule: s.type,
-                        type: s.type,
-                        analyzer: 'dependency-graph',
-                        category: 'cross-language-dependency',
-                        details: s.affectedNodes ? { affectedNodes: s.affectedNodes } : undefined,
-                    });
-                }
-                const facts = {};
-                if (testCoverage)
-                    facts.testCoverage = testCoverage;
-                if (deadClusters.length > 0)
-                    facts.deadClusters = deadClusters;
-                return { violations, facts, factsConsumed: entities.length, ...(diagnostics.length > 0 && { diagnostics }) };
-            }
-            catch (e) {
-                console.error('[dependency-graph reducer] error:', e.message);
-                return { violations: [], facts: {}, factsConsumed: 0 };
-            }
-        },
-        defaultConfig: {},
-        description: 'Builds a cross-language dependency graph and detects cycles, hubs, orphans, and tight coupling',
-        category: 'cross-language',
-    };
-}
 // ── Invariants reducer (stage 3) ──────────────────────────────────────────────
 /**
  * Invariants reducer — enforces user-defined invariant rules from .codeauditor.json.
@@ -2329,41 +1252,6 @@ async function _getProvenanceModule() {
     }
     return _provenanceModule;
 }
-/**
- * Schema SQL visitor (.sql files) — extracts ordered DDL operations for the
- * Stage 3 reducer to replay into the known-tables catalog. Emits the parsed
- * ops, not raw source, so the reducer retains only state transitions.
- *
- * @returns The schema-sql stage-2 visitor.
- */
-export function createSchemaSqlVisitor() {
-    const getMigrationExtractor = lazySingleton(() => import('./analyzers/universal/UniversalSchemaAnalyzer.js'));
-    return {
-        name: 'schema-sql',
-        stage: 'visitor',
-        extensions: ['.sql'],
-        getRuleIds: () => [],
-        async visit(_ast, _adapter, context, sourceCode) {
-            const { extractMigrationOpsFromFile } = await getMigrationExtractor();
-            const dialect = context.config.sqlDialect;
-            const { ops, columns, tableColumns, skipped, bytes } = await extractMigrationOpsFromFile(context.filePath, sourceCode, dialect ?? null);
-            return {
-                violations: [],
-                facts: {
-                    [context.filePath]: {
-                        ddlOps: ops,
-                        ...(columns.length > 0 && { ddlColumns: columns }),
-                        ...(Object.keys(tableColumns).length > 0 && { ddlTableColumns: tableColumns }),
-                        ...(skipped && { skipped: true, bytes }),
-                    },
-                },
-            };
-        },
-        defaultConfig: {},
-        description: 'Extracts SQL DDL operations for known-table catalog',
-        category: 'database',
-    };
-}
 /** The shared lazy `UniversalSchemaAnalyzer` for the schema-code visitor. Hoisted
  *  to module scope so the factory below stays a thin descriptor and the analyzer
  *  is constructed once, not per factory call. */
@@ -2540,75 +1428,6 @@ export function createSchemaCodeVisitor() {
         category: 'database',
     };
 }
-/**
- * Schema Prisma visitor (.prisma files) — extracts model names for known-table catalog.
- *
- * @returns The schema-prisma stage-2 visitor.
- */
-export function createSchemaPrismaVisitor() {
-    return {
-        name: 'schema-prisma',
-        stage: 'visitor',
-        extensions: ['.prisma'],
-        getRuleIds: () => [],
-        async visit(_ast, _adapter, context, sourceCode) {
-            const models = [];
-            const modelRe = /model\s+(\w+)\s*\{/g;
-            let m;
-            while ((m = modelRe.exec(sourceCode)) !== null) {
-                const modelName = m[1];
-                // Scope @@map to this model's block by matching braces.
-                // Depth starts at 1 for the opening { already consumed by the regex.
-                const blockStart = m.index + m[0].length;
-                let depth = 1;
-                let blockEnd = blockStart;
-                for (; blockEnd < sourceCode.length && depth > 0; blockEnd++) {
-                    if (sourceCode[blockEnd] === '{')
-                        depth++;
-                    else if (sourceCode[blockEnd] === '}')
-                        depth--;
-                }
-                const blockContent = sourceCode.slice(blockStart, blockEnd - 1);
-                // @@map (block-level, double @) renames the table. @map (single @)
-                // is field-level — column rename — and must not be treated as a table name.
-                const mapMatch = blockContent.match(/@@map\s*\(\s*"([^"]+)"\s*\)/);
-                models.push(mapMatch ? mapMatch[1] : modelName);
-            }
-            return {
-                violations: [],
-                facts: { [context.filePath]: { prismaModels: models } },
-            };
-        },
-        defaultConfig: {},
-        description: 'Extracts Prisma model names for known-table catalog',
-        category: 'database',
-    };
-}
-/**
- * Schema JSON visitor (.json files) — parses JSON for the Stage 3 reducer to validate.
- *
- * @returns The schema-json stage-2 visitor.
- */
-export function createSchemaJsonVisitor() {
-    return {
-        name: 'schema-json',
-        stage: 'visitor',
-        extensions: ['.json'],
-        getRuleIds: () => [],
-        async visit(_ast, _adapter, context, _sourceCode) {
-            // Emit only a lightweight marker — the Stage 3 reducer reads and parses
-            // each JSON file on demand via context.readSource, so parsed objects are
-            // transient rather than retained in allFacts through stage 4.
-            return {
-                violations: [],
-                facts: { [context.filePath]: { isJson: true } },
-            };
-        },
-        defaultConfig: {},
-        description: 'Parses JSON files for schema validation',
-        category: 'database',
-    };
-}
 /**
  * Flatten `allFacts` (keyed by visitor name, each value `{ [filePath]: facts }`)
  * into per-file `[filePath, fact]` pairs.
@@ -2925,57 +1744,4 @@ function validateJsonSchemas(opts) {
     }
     return violations;
 }
-/**
- * Schema Stage 3 reducer — cross-file unknown-table detection and JSON schema validation.
- *
- * Consumes facts from schema-sql, schema-code, schema-prisma, and schema-json visitors.
- * Builds the complete known-tables catalog and checks all table references against it.
- *
- * @returns The schema stage-3 reducer.
- */
-export function createSchemaReducer() {
-    const getAnalyzer = lazySingleton(() => import('./analyzers/universal/UniversalSchemaAnalyzer.js').then((m) => ({
-        analyzer: new m.UniversalSchemaAnalyzer(),
-        defaults: m.DEFAULT_SCHEMA_CONFIG,
-        analyzeJsonSchemas: m.analyzeJsonSchemas,
-    })));
-    return {
-        name: 'schema',
-        stage: 'reducer',
-        consumes: [],
-        getRuleIds: () => getRuleIdsFor('schema'),
-        async reduce(allFacts, context) {
-            const { analyzer: a, analyzeJsonSchemas } = await getAnalyzer();
-            const violations = [];
-            const schemaConfig = (context.config ?? {});
-            const { knownTables, tableProvenances, dropProvenance, ddlColumns, tableColumns } = buildSchemaCatalog(allFacts);
-            violations.push(...detectUnknownTables({
-                knownTables,
-                tableProvenances,
-                dropProvenance,
-                allFacts,
-                schemaConfig,
-            }));
-            violations.push(...validateJsonSchemas({
-                schemaConfig,
-                allFacts,
-                context,
-                analyzeJsonSchemas,
-            }));
-            // ── 4. Build table catalog for metadata ───────────────────────────────
-            const catalogEntries = [];
-            for (const [table, sources] of tableProvenances) {
-                catalogEntries.push({ table, sources });
-            }
-            return {
-                violations,
-                facts: { tableCatalog: catalogEntries, ddlColumns: [...ddlColumns].sort(), tableColumns },
-                factsConsumed: [...iteratePerFileFacts(allFacts)].length,
-            };
-        },
-        defaultConfig: {},
-        description: 'Cross-file schema analysis: unknown-table detection and JSON schema validation',
-        category: 'database',
-    };
-}
 //# sourceMappingURL=pipelineAdapters.js.map