querydig 0.0.0-stage → 0.1.0

package/dist/chunk-VAYEO4RI.js

@@ -0,0 +1,1208 @@
+// src/rules.ts
+var r = (m) => m;
+var RULES = [
+  // ---------- generic (any database) ----------
+  r({
+    id: "QD001",
+    name: "n-plus-one",
+    title: "Query inside a loop (N+1)",
+    severity: "high",
+    db: "any",
+    why: "Each iteration sends a separate round-trip to the database. With N items you run N+1 queries; latency grows linearly with data size and connection pools get exhausted.",
+    fix: "Fetch everything in one query ($in / WHERE id IN (...) / include / populate / select_related / Preload) and join in memory with a Map keyed by id.",
+    example: {
+      bad: "for (const o of orders) {\n  o.user = await User.findById(o.userId);\n}",
+      good: "const users = await User.find({ _id: { $in: orders.map(o => o.userId) } }).lean();\nconst byId = new Map(users.map(u => [String(u._id), u]));\nfor (const o of orders) o.user = byId.get(String(o.userId));"
+    }
+  }),
+  r({
+    id: "QD002",
+    name: "nested-query-over-results",
+    title: "Nested query over another query's results (N\xB2 risk)",
+    severity: "critical",
+    db: "any",
+    why: "The loop iterates the rows returned by an earlier query and issues another query per row. Cost multiplies with every level of nesting and is usually the #1 cause of slow endpoints.",
+    fix: "Replace with a single aggregation ($lookup) / JOIN, or batch the inner query with $in / IN (...) using the ids collected from the outer result.",
+    example: {
+      bad: "const users = await User.find({ active: true });\nfor (const u of users) {\n  u.orders = await Order.find({ userId: u._id });\n}",
+      good: "const users = await User.find({ active: true }).lean();\nconst orders = await Order.find({ userId: { $in: users.map(u => u._id) } }).lean();\n// group orders by userId in memory"
+    }
+  }),
+  r({
+    id: "QD003",
+    name: "write-in-loop",
+    title: "Write operation inside a loop",
+    severity: "high",
+    db: "any",
+    why: "One insert/update/delete per iteration means N round-trips and N separate index updates/journal flushes.",
+    fix: "Use bulk APIs: bulkWrite / insertMany / updateMany (MongoDB), createMany / bulkCreate / multi-row INSERT / executemany / CreateInBatches (SQL).",
+    example: {
+      bad: "for (const item of items) {\n  await Item.updateOne({ _id: item.id }, { $set: { price: item.price } });\n}",
+      good: "await Item.bulkWrite(items.map(i => ({\n  updateOne: { filter: { _id: i.id }, update: { $set: { price: i.price } } },\n})));"
+    }
+  }),
+  // ---------- MongoDB ----------
+  r({
+    id: "MQ001",
+    name: "unbounded-find",
+    title: "Unbounded find with empty filter",
+    severity: "high",
+    db: "mongodb",
+    why: "find({}) without limit reads the entire collection (COLLSCAN) and transfers every document to the app. It gets slower every day the collection grows.",
+    fix: "Add a selective filter backed by an index, a .limit(), and paginate with a range query on an indexed field (e.g. _id > lastId).",
+    example: { bad: "const all = await Product.find({});", good: "const page = await Product.find({ _id: { $gt: lastId } }).sort({ _id: 1 }).limit(50).lean();" }
+  }),
+  r({
+    id: "MQ002",
+    name: "unanchored-regex",
+    title: "Unanchored or case-insensitive $regex",
+    severity: "high",
+    db: "mongodb",
+    why: "Only prefix-anchored, case-sensitive regexes (/^abc/) can use an index efficiently. /abc/ or /abc/i scans every index key or document.",
+    fix: "Anchor the pattern with ^, store a lower-cased copy of the field for case-insensitive matching, or use a text / Atlas Search index.",
+    example: { bad: "User.find({ name: { $regex: search, $options: 'i' } })", good: "User.find({ nameLower: { $regex: '^' + escape(search.toLowerCase()) } })" }
+  }),
+  r({
+    id: "MQ003",
+    name: "server-side-js",
+    title: "$where / $function / mapReduce (JavaScript execution)",
+    severity: "high",
+    db: "mongodb",
+    why: "Server-side JavaScript cannot use indexes, runs per document and is deprecated in recent MongoDB versions.",
+    fix: "Rewrite with standard query operators ($expr) or the aggregation pipeline."
+  }),
+  r({
+    id: "MQ004",
+    name: "skip-pagination",
+    title: "Pagination with skip()",
+    severity: "medium",
+    db: "mongodb",
+    why: "skip(n) still walks n documents/index keys before returning results; deep pages get linearly slower.",
+    fix: "Use range (keyset) pagination: filter on an indexed field greater than the last seen value and .limit(pageSize)."
+  }),
+  r({
+    id: "MQ005",
+    name: "sort-without-limit",
+    title: "sort() without limit()",
+    severity: "medium",
+    db: "mongodb",
+    why: "Sorting a large result without a limit (and without a matching index) triggers a blocking in-memory SORT that can hit the 100MB limit.",
+    fix: "Add .limit() and create an index whose key order matches the sort (ESR rule: Equality, Sort, Range)."
+  }),
+  r({
+    id: "MQ006",
+    name: "lookup-before-match",
+    title: "Aggregation: $lookup/$unwind/$group before $match",
+    severity: "medium",
+    db: "mongodb",
+    why: "Stages before the first $match process every document in the collection. $match placed first can use an index and shrinks the working set.",
+    fix: "Move $match (and $limit when possible) to the start of the pipeline; filter before $lookup and $unwind."
+  }),
+  r({
+    id: "MQ007",
+    name: "deep-populate",
+    title: "Deep or chained populate()",
+    severity: "medium",
+    db: "mongodb",
+    why: "Every populate path is an extra query; nested populate multiplies them and loads full referenced documents.",
+    fix: "Populate only needed paths with select, or replace with a single $lookup aggregation."
+  }),
+  r({
+    id: "MQ008",
+    name: "count-for-existence",
+    title: "countDocuments() used as existence check",
+    severity: "low",
+    db: "mongodb",
+    why: "countDocuments counts all matches; you only need to know whether one exists.",
+    fix: "Use findOne(filter, { _id: 1 }) / exists() / find(filter).limit(1)."
+  }),
+  r({
+    id: "MQ009",
+    name: "negation-operators",
+    title: "Negation operators ($ne / $nin / $not)",
+    severity: "low",
+    db: "mongodb",
+    why: "Negations are not selective; the planner usually has to scan most of the index or collection.",
+    fix: "Rewrite as a positive match ($in of allowed values) or combine with a selective equality filter."
+  }),
+  r({
+    id: "MQ010",
+    name: "no-projection",
+    title: "find() without projection",
+    severity: "low",
+    db: "mongodb",
+    why: "Fetching whole documents increases network transfer, memory and deserialization cost, and prevents covered queries.",
+    fix: 'Select only the fields you need: .select("a b") / { projection: { a: 1, b: 1 } } / SetProjection().'
+  }),
+  r({
+    id: "MQ011",
+    name: "missing-lean",
+    title: "Mongoose read without .lean()",
+    severity: "low",
+    db: "mongodb",
+    why: "Hydrating full Mongoose documents is 3-5x slower and uses more memory than plain objects for read-only paths.",
+    fix: "Append .lean() to read-only queries."
+  }),
+  // ---------- SQL ----------
+  r({
+    id: "SQ001",
+    name: "unbounded-orm-read",
+    title: "Unbounded ORM read (no where / limit)",
+    severity: "high",
+    db: "sql",
+    why: "findMany()/findAll()/objects.all() without a filter or limit loads the whole table into memory.",
+    fix: "Add a where clause and take/limit with cursor-based pagination."
+  }),
+  r({
+    id: "SQ002",
+    name: "select-star",
+    title: "SELECT *",
+    severity: "low",
+    db: "sql",
+    why: "Reads every column (including large TEXT/JSON), prevents index-only scans and breaks when columns change.",
+    fix: "List only the columns you need."
+  }),
+  r({
+    id: "SQ003",
+    name: "leading-wildcard-like",
+    title: "LIKE with leading wildcard ('%...')",
+    severity: "high",
+    db: "sql",
+    why: "A B-tree index cannot be used for LIKE '%term'; the database scans the whole table.",
+    fix: "Use prefix match (LIKE 'term%'), a trigram (pg_trgm) / FULLTEXT index, or a search engine."
+  }),
+  r({
+    id: "SQ004",
+    name: "missing-where",
+    title: "UPDATE/DELETE without WHERE or unbounded SELECT",
+    severity: "high",
+    db: "sql",
+    why: "Touches every row in the table: full scan, heavy locking and replication lag.",
+    fix: "Add a WHERE clause on an indexed column, a LIMIT, or batch the operation."
+  }),
+  r({
+    id: "SQ005",
+    name: "offset-pagination",
+    title: "OFFSET pagination",
+    severity: "medium",
+    db: "sql",
+    why: "OFFSET n reads and discards n rows; deep pages get linearly slower.",
+    fix: "Use keyset pagination: WHERE id > :lastId ORDER BY id LIMIT :n."
+  }),
+  r({
+    id: "SQ006",
+    name: "function-on-column",
+    title: "Function applied to column in WHERE",
+    severity: "medium",
+    db: "sql",
+    why: "WHERE LOWER(col) = ... or DATE(col) = ... makes the condition non-sargable; a normal index on col cannot be used.",
+    fix: "Compare the raw column against a transformed value/range, or create an expression index."
+  }),
+  r({
+    id: "SQ007",
+    name: "order-by-random",
+    title: "ORDER BY RAND()/RANDOM()",
+    severity: "high",
+    db: "sql",
+    why: "Generates a random value for every row and sorts the whole table.",
+    fix: "Pick random ids in the app, use TABLESAMPLE, or a precomputed random column with an index."
+  }),
+  r({
+    id: "SQ008",
+    name: "not-in-subquery",
+    title: "NOT IN (subquery)",
+    severity: "medium",
+    db: "sql",
+    why: "NOT IN with a subquery is often executed as a nested loop and has surprising NULL semantics.",
+    fix: "Rewrite as NOT EXISTS or a LEFT JOIN ... WHERE x IS NULL."
+  })
+];
+var RULE_MAP = new Map(RULES.map((x) => [x.id, x]));
+function findRule(idOrName) {
+  const q = idOrName.toUpperCase();
+  return RULE_MAP.get(q) ?? RULES.find((x) => x.name === idOrName.toLowerCase());
+}
+
+// src/analyzer.ts
+import { createHash } from "crypto";
+
+// src/languages.ts
+var JS_BASE = {
+  call: ["call_expression"],
+  member: { member_expression: ["object", "property"] },
+  loops: ["for_statement", "for_in_statement", "while_statement", "do_statement"],
+  functions: ["function_declaration", "method_definition", "generator_function_declaration", "class_declaration"],
+  lambdas: ["arrow_function", "function_expression", "function"],
+  strings: ["string", "template_string"],
+  regex: "regex",
+  iterMethods: ["map", "forEach", "flatMap", "reduce", "filter", "some", "every", "each", "mapSeries", "eachSeries", "mapLimit", "eachLimit", "forEachOf", "times"]
+};
+var LANGS = {
+  javascript: { id: "javascript", grammar: "tree-sitter-javascript.wasm", ...JS_BASE },
+  typescript: { id: "typescript", grammar: "tree-sitter-typescript.wasm", ...JS_BASE },
+  tsx: { id: "tsx", grammar: "tree-sitter-tsx.wasm", ...JS_BASE },
+  python: {
+    id: "python",
+    grammar: "tree-sitter-python.wasm",
+    call: ["call"],
+    member: { attribute: ["object", "attribute"] },
+    loops: ["for_statement", "while_statement", "list_comprehension", "set_comprehension", "dictionary_comprehension", "generator_expression"],
+    functions: ["function_definition", "class_definition"],
+    lambdas: ["lambda"],
+    strings: ["string"],
+    iterMethods: []
+  },
+  go: {
+    id: "go",
+    grammar: "tree-sitter-go.wasm",
+    call: ["call_expression"],
+    member: { selector_expression: ["operand", "field"] },
+    loops: ["for_statement"],
+    functions: ["function_declaration", "method_declaration"],
+    lambdas: ["func_literal"],
+    strings: ["interpreted_string_literal", "raw_string_literal"],
+    iterMethods: []
+  }
+};
+var EXT = {
+  ".js": "javascript",
+  ".mjs": "javascript",
+  ".cjs": "javascript",
+  ".jsx": "tsx",
+  ".ts": "typescript",
+  ".mts": "typescript",
+  ".cts": "typescript",
+  ".tsx": "tsx",
+  ".py": "python",
+  ".go": "go"
+};
+function langForFile(file) {
+  const i = file.lastIndexOf(".");
+  if (i < 0) return void 0;
+  if (file.endsWith(".d.ts")) return void 0;
+  return EXT[file.slice(i).toLowerCase()];
+}
+var SUPPORTED_EXTENSIONS = Object.keys(EXT);
+
+// src/parser.ts
+import { createRequire } from "module";
+import { existsSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var require2 = createRequire(import.meta.url);
+var Parser = require2("web-tree-sitter");
+function grammarDir() {
+  let dir = dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 4; i++) {
+    const candidate = join(dir, "grammars");
+    if (existsSync(candidate)) return candidate;
+    dir = dirname(dir);
+  }
+  throw new Error("querydig: grammars directory not found");
+}
+var initPromise = null;
+var languages = /* @__PURE__ */ new Map();
+var parsers = /* @__PURE__ */ new Map();
+function initParser() {
+  if (!initPromise) initPromise = Parser.init();
+  return initPromise;
+}
+async function getParser(lang) {
+  await initParser();
+  let p = parsers.get(lang);
+  if (p) return p;
+  let language = languages.get(lang);
+  if (!language) {
+    language = await Parser.Language.load(join(grammarDir(), LANGS[lang].grammar));
+    languages.set(lang, language);
+  }
+  const parser = new Parser();
+  parser.setLanguage(language);
+  p = parser;
+  parsers.set(lang, p);
+  return p;
+}
+
+// src/analyzer.ts
+var op = (kind, db, hint = "none", orm) => ({ kind, db, hint, orm });
+var JS_OPS = {
+  find: op("readMany", "any", "weak"),
+  findOne: op("read", "any", "weak"),
+  findById: op("read", "mongodb", "weak", "mongoose"),
+  exists: op("count", "mongodb", "weak"),
+  countDocuments: op("count", "mongodb"),
+  estimatedDocumentCount: op("count", "mongodb"),
+  count: op("count", "any", "weak"),
+  aggregate: op("aggregate", "any", "weak"),
+  distinct: op("readMany", "mongodb", "weak"),
+  mapReduce: op("aggregate", "mongodb", "weak"),
+  updateOne: op("write", "mongodb"),
+  updateMany: op("write", "any", "weak"),
+  deleteOne: op("write", "mongodb"),
+  deleteMany: op("write", "any", "weak"),
+  insertOne: op("write", "mongodb"),
+  insertMany: op("batchWrite", "mongodb"),
+  replaceOne: op("write", "mongodb"),
+  bulkWrite: op("batchWrite", "mongodb"),
+  findOneAndUpdate: op("write", "mongodb"),
+  findOneAndDelete: op("write", "mongodb"),
+  findOneAndReplace: op("write", "mongodb"),
+  findByIdAndUpdate: op("write", "mongodb", "none", "mongoose"),
+  findByIdAndDelete: op("write", "mongodb", "none", "mongoose"),
+  findByIdAndRemove: op("write", "mongodb", "none", "mongoose"),
+  create: op("write", "any", "weak"),
+  save: op("write", "any", "weak"),
+  insert: op("write", "any", "strong"),
+  update: op("write", "any", "strong"),
+  delete: op("write", "any", "strong"),
+  remove: op("write", "any", "strong"),
+  upsert: op("write", "any", "strong"),
+  // Prisma
+  findUnique: op("read", "sql", "none", "prisma"),
+  findUniqueOrThrow: op("read", "sql", "none", "prisma"),
+  findFirst: op("read", "sql", "none", "prisma"),
+  findFirstOrThrow: op("read", "sql", "none", "prisma"),
+  findMany: op("readMany", "sql", "none", "prisma"),
+  createMany: op("batchWrite", "sql", "none", "prisma"),
+  $queryRaw: op("raw", "sql"),
+  $queryRawUnsafe: op("raw", "sql"),
+  $executeRaw: op("raw", "sql"),
+  $executeRawUnsafe: op("raw", "sql"),
+  // TypeORM
+  findOneBy: op("read", "sql", "none", "typeorm"),
+  findOneOrFail: op("read", "sql", "none", "typeorm"),
+  findOneByOrFail: op("read", "sql", "none", "typeorm"),
+  findBy: op("readMany", "sql", "none", "typeorm"),
+  findAndCount: op("readMany", "sql", "none", "typeorm"),
+  findAndCountBy: op("readMany", "sql", "none", "typeorm"),
+  getMany: op("readMany", "sql", "none", "typeorm"),
+  getOne: op("read", "sql", "none", "typeorm"),
+  getRawMany: op("readMany", "sql", "none", "typeorm"),
+  getRawOne: op("read", "sql", "none", "typeorm"),
+  // Sequelize
+  findAll: op("readMany", "sql", "none", "sequelize"),
+  findByPk: op("read", "sql", "none", "sequelize"),
+  findOrCreate: op("write", "sql", "none", "sequelize"),
+  bulkCreate: op("batchWrite", "sql", "none", "sequelize"),
+  // raw drivers (pg, mysql2, knex.raw, sequelize.query, typeorm query)
+  query: op("raw", "sql", "strong"),
+  execute: op("raw", "sql", "strong"),
+  raw: op("raw", "sql", "strong")
+};
+var PY_OPS = {
+  find: op("readMany", "mongodb", "weak", "pymongo"),
+  find_one: op("read", "mongodb", "none", "pymongo"),
+  count_documents: op("count", "mongodb", "none", "pymongo"),
+  estimated_document_count: op("count", "mongodb", "none", "pymongo"),
+  aggregate: op("aggregate", "mongodb", "weak", "pymongo"),
+  distinct: op("readMany", "mongodb", "weak", "pymongo"),
+  map_reduce: op("aggregate", "mongodb", "weak", "pymongo"),
+  update_one: op("write", "mongodb", "none", "pymongo"),
+  update_many: op("write", "mongodb", "none", "pymongo"),
+  insert_one: op("write", "mongodb", "none", "pymongo"),
+  insert_many: op("batchWrite", "mongodb", "none", "pymongo"),
+  delete_one: op("write", "mongodb", "none", "pymongo"),
+  delete_many: op("write", "mongodb", "none", "pymongo"),
+  replace_one: op("write", "mongodb", "none", "pymongo"),
+  bulk_write: op("batchWrite", "mongodb", "none", "pymongo"),
+  find_one_and_update: op("write", "mongodb", "none", "pymongo"),
+  find_one_and_delete: op("write", "mongodb", "none", "pymongo"),
+  find_one_and_replace: op("write", "mongodb", "none", "pymongo"),
+  // raw DB-API cursors / SQLAlchemy
+  execute: op("raw", "sql", "strong"),
+  executemany: op("raw", "sql", "strong"),
+  scalars: op("raw", "sql", "strong", "sqlalchemy"),
+  scalar: op("raw", "sql", "strong", "sqlalchemy")
+};
+var DJANGO_OPS = {
+  get: "read",
+  first: "read",
+  last: "read",
+  earliest: "read",
+  latest: "read",
+  filter: "readMany",
+  all: "readMany",
+  exclude: "readMany",
+  values: "readMany",
+  values_list: "readMany",
+  count: "count",
+  exists: "count",
+  aggregate: "aggregate",
+  create: "write",
+  update: "write",
+  delete: "write",
+  get_or_create: "write",
+  update_or_create: "write",
+  bulk_create: "batchWrite",
+  bulk_update: "batchWrite"
+};
+var SQLA_OPS = { query: "readMany", get: "read", add: "write", merge: "write", delete: "write" };
+var GO_OPS = {
+  FindOne: op("read", "mongodb", "none", "mongo-go-driver"),
+  CountDocuments: op("count", "mongodb", "none", "mongo-go-driver"),
+  EstimatedDocumentCount: op("count", "mongodb", "none", "mongo-go-driver"),
+  Aggregate: op("aggregate", "mongodb", "none", "mongo-go-driver"),
+  Distinct: op("readMany", "mongodb", "none", "mongo-go-driver"),
+  UpdateOne: op("write", "mongodb", "none", "mongo-go-driver"),
+  UpdateMany: op("write", "mongodb", "none", "mongo-go-driver"),
+  UpdateByID: op("write", "mongodb", "none", "mongo-go-driver"),
+  InsertOne: op("write", "mongodb", "none", "mongo-go-driver"),
+  InsertMany: op("batchWrite", "mongodb", "none", "mongo-go-driver"),
+  DeleteOne: op("write", "mongodb", "none", "mongo-go-driver"),
+  DeleteMany: op("write", "mongodb", "none", "mongo-go-driver"),
+  ReplaceOne: op("write", "mongodb", "none", "mongo-go-driver"),
+  BulkWrite: op("batchWrite", "mongodb", "none", "mongo-go-driver"),
+  FindOneAndUpdate: op("write", "mongodb", "none", "mongo-go-driver"),
+  FindOneAndDelete: op("write", "mongodb", "none", "mongo-go-driver"),
+  FindOneAndReplace: op("write", "mongodb", "none", "mongo-go-driver"),
+  // database/sql, sqlx, pgx
+  Query: op("raw", "sql", "weak"),
+  QueryContext: op("raw", "sql", "weak"),
+  QueryRow: op("raw", "sql", "weak"),
+  QueryRowContext: op("raw", "sql", "weak"),
+  Exec: op("raw", "sql", "weak"),
+  ExecContext: op("raw", "sql", "weak"),
+  Raw: op("raw", "sql", "weak", "gorm"),
+  // gorm
+  First: op("read", "sql", "weak", "gorm"),
+  Take: op("read", "sql", "weak", "gorm"),
+  Last: op("read", "sql", "weak", "gorm"),
+  Create: op("write", "sql", "weak", "gorm"),
+  Save: op("write", "sql", "weak", "gorm"),
+  Updates: op("write", "sql", "weak", "gorm"),
+  CreateInBatches: op("batchWrite", "sql", "weak", "gorm")
+};
+var HINT_RE = /(model|collection|\bcoll\b|repo|repository|\bdb\b|_db\b|db_|database|prisma|session|cursor|\bcur\b|pool|client|\bconn\b|connection|knex|sequelize|objects|\btx\b|\btrx\b|dao|datasource|\bem\b|entitymanager|mongo|gorm|stmt)/i;
+var SQL_RECEIVER_RE = /(prisma|repository|repo\b|objects|session|entitymanager|\bem\b|knex|sequelize|gorm|_set$)/i;
+var SQL_TEXT_RE = /^\s*(select|insert|update|delete|with|replace)\b/i;
+var MONGO_FILE_RE = /\b(mongoose|mongodb|pymongo|motor|mongoengine|go\.mongodb\.org|bson)\b/;
+var SQL_FILE_RE = /(@prisma\/client|\bprisma\b|typeorm|sequelize|\bknex\b|['"]pg['"]|mysql|sqlite|sqlalchemy|\bdjango\b|gorm\.io|database\/sql|sqlx|psycopg|drizzle|kysely|pgx)/;
+var BUILTIN_ROOTS = /* @__PURE__ */ new Set([
+  "Object",
+  "Array",
+  "Promise",
+  "JSON",
+  "Math",
+  "Date",
+  "Reflect",
+  "Number",
+  "String",
+  "Symbol",
+  "Map",
+  "Set",
+  "WeakMap",
+  "Intl",
+  "Buffer",
+  "process",
+  "console",
+  "window",
+  "document",
+  "localStorage",
+  "sessionStorage",
+  "React",
+  "Vue",
+  "URL",
+  "Error",
+  "RegExp",
+  "Proxy",
+  "BigInt",
+  "Atomics",
+  "Event",
+  "Blob",
+  "File",
+  "FormData",
+  "strings",
+  "bytes",
+  "sort",
+  "slices",
+  "maps",
+  "os",
+  "fmt",
+  "re",
+  "json",
+  "math",
+  "time",
+  "path",
+  "filepath"
+]);
+var DEFAULT_TEST_LOOP_BREAKERS = /* @__PURE__ */ new Set(["while_statement", "do_statement"]);
+var same = (a, b) => !!a && !!b && a.startIndex === b.startIndex && a.endIndex === b.endIndex && a.type === b.type;
+var stripQuotes = (s) => s.replace(/^[rRbBuUfF]{0,2}(['"`]{1,3})([\s\S]*?)\1$/, "$2");
+async function analyzeSource(source, opts) {
+  if (/querydig-ignore-file/.test(source.slice(0, 2e3))) return [];
+  const parser = await getParser(opts.lang);
+  const tree = parser.parse(source);
+  try {
+    return new Analyzer(source, opts, LANGS[opts.lang]).run(tree.rootNode);
+  } finally {
+    tree.delete();
+  }
+}
+var Analyzer = class {
+  constructor(src, opts, spec) {
+    this.src = src;
+    this.opts = opts;
+    this.spec = spec;
+    this.lines = src.split("\n");
+    this.hasMongo = MONGO_FILE_RE.test(src);
+    this.hasSql = SQL_FILE_RE.test(src);
+    this.hasMongoose = /\bmongoose\b/.test(src) || /@nestjs\/mongoose|InjectModel/.test(src);
+    this.isJs = spec.id === "javascript" || spec.id === "typescript" || spec.id === "tsx";
+  }
+  src;
+  opts;
+  spec;
+  lines;
+  findings = [];
+  queryVars = /* @__PURE__ */ new Set();
+  hasMongo;
+  hasSql;
+  hasMongoose;
+  isJs;
+  run(root) {
+    this.visit(root, { depth: 0, over: false });
+    return this.applySuppressions();
+  }
+  // ------------------------------------------------------------- traversal
+  visit(node, ctx) {
+    const t = node.type;
+    if (t === "comment") return;
+    if (this.spec.functions.includes(t)) ctx = { depth: 0, over: false };
+    if (this.spec.loops.includes(t)) return this.visitLoop(node, ctx);
+    if (this.spec.call.includes(t)) return this.visitCall(node, ctx);
+    if (this.spec.strings.includes(t)) this.checkSqlString(node);
+    for (const c of node.namedChildren) this.visit(c, ctx);
+  }
+  identsOf(node) {
+    if (!node) return [];
+    const out = [];
+    const stack = [node];
+    while (stack.length) {
+      const n = stack.pop();
+      if (n.type === "identifier" || n.type === "shorthand_property_identifier_pattern") out.push(n.text);
+      else if (n.type !== "type_annotation") stack.push(...n.namedChildren);
+    }
+    return out;
+  }
+  inner(ctx, node, iterable, forceOver = false, vars) {
+    const nextRecv = iterable ? /^([A-Za-z_]\w*)\.Next\(/.exec(iterable.text)?.[1] : void 0;
+    const overVar = nextRecv ?? (iterable ? (this.spec.call.includes(iterable.type) || iterable.type === "await_expression") && iterable.text.length <= 60 ? iterable.text.replace(/\s+/g, " ") : this.rootIdent(iterable) : void 0);
+    const over = ctx.over || forceOver || (iterable ? this.isOverResults(iterable) : false);
+    return {
+      depth: ctx.depth + 1,
+      over,
+      loopLine: node.startPosition.row + 1,
+      overVar: over ? overVar ?? ctx.overVar : ctx.overVar,
+      loopVars: [...ctx.loopVars ?? [], ...this.identsOf(vars)],
+      iterName: iterable ? this.path(iterable) || ctx.iterName : ctx.iterName
+    };
+  }
+  visitLoop(node, ctx) {
+    const t = node.type;
+    const id = this.spec.id;
+    if (DEFAULT_TEST_LOOP_BREAKERS.has(t)) {
+      for (const c of node.namedChildren) this.visit(c, ctx);
+      return;
+    }
+    if (id === "go") {
+      const range = node.namedChildren.find((c) => c.type === "range_clause");
+      const clause = node.namedChildren.find((c) => c.type === "for_clause");
+      const body = node.childForFieldName("body") ?? node.namedChildren.find((c) => c.type === "block");
+      if (range) {
+        const right = range.childForFieldName("right");
+        if (right) this.visit(right, ctx);
+        const inner2 = this.inner(ctx, node, right, false, range.childForFieldName("left"));
+        if (body) this.visit(body, inner2);
+        return;
+      }
+      const cond2 = node.namedChildren.find((c) => c !== body && c.type !== "block" && c.type !== "for_clause");
+      if (cond2 && /\.Next\(/.test(cond2.text)) {
+        const inner2 = this.inner(ctx, node, cond2, true);
+        this.visit(cond2, ctx);
+        if (body) this.visit(body, inner2);
+        return;
+      }
+      if (clause) {
+        this.visit(clause, ctx);
+        if (body) this.visit(body, clause.childForFieldName("condition") ? this.inner(ctx, node, null) : ctx);
+        return;
+      }
+      for (const c of node.namedChildren) this.visit(c, ctx);
+      return;
+    }
+    if (id === "python") {
+      if (t === "for_statement") {
+        const right = node.childForFieldName("right");
+        if (right) this.visit(right, ctx);
+        const inner3 = this.inner(ctx, node, right, false, node.childForFieldName("left"));
+        for (const c of node.namedChildren) if (!same(c, right) && !same(c, node.childForFieldName("left"))) this.visit(c, inner3);
+        return;
+      }
+      const clauses = node.namedChildren.filter((c) => c.type === "for_in_clause");
+      const firstRight = clauses[0]?.childForFieldName("right") ?? null;
+      if (firstRight) this.visit(firstRight, ctx);
+      const inner2 = this.inner(ctx, node, firstRight, false, clauses[0]?.childForFieldName("left"));
+      for (const c of node.namedChildren) {
+        if (c.type === "for_in_clause") {
+          const r2 = c.childForFieldName("right");
+          if (r2 && !same(r2, firstRight)) this.visit(r2, inner2);
+        } else this.visit(c, inner2);
+      }
+      return;
+    }
+    if (t === "for_in_statement") {
+      const right = node.childForFieldName("right");
+      if (right) this.visit(right, ctx);
+      const inner2 = this.inner(ctx, node, right, false, node.childForFieldName("left"));
+      const body = node.childForFieldName("body");
+      if (body) this.visit(body, inner2);
+      return;
+    }
+    const cond = node.childForFieldName("condition");
+    const isInfinite = !cond || cond.text.trim() === ";" || cond.text.trim() === "true;" || cond.text.trim() === "";
+    const inner = isInfinite ? ctx : this.inner(ctx, node, null);
+    for (const c of node.namedChildren) this.visit(c, inner);
+  }
+  visitCall(node, ctx) {
+    const q = this.classify(node);
+    if (q) this.evaluate(q, ctx);
+    const callee = node.childForFieldName("function");
+    const memberFields = callee ? this.spec.member[callee.type] : void 0;
+    if (callee && memberFields && this.spec.iterMethods.length) {
+      const prop = callee.childForFieldName(memberFields[1])?.text ?? "";
+      const args = this.argNodes(node);
+      if (this.spec.iterMethods.includes(prop) && args.some((a) => this.spec.lambdas.includes(a.type))) {
+        const recv = callee.childForFieldName(memberFields[0]);
+        if (recv) this.visit(recv, ctx);
+        for (const a of args) {
+          if (!this.spec.lambdas.includes(a.type)) {
+            this.visit(a, ctx);
+            continue;
+          }
+          const params = a.childForFieldName("parameters") ?? a.childForFieldName("parameter");
+          this.visit(a, this.inner(ctx, node, recv, false, params));
+        }
+        return;
+      }
+    }
+    for (const c of node.namedChildren) this.visit(c, ctx);
+  }
+  // ------------------------------------------------------------- helpers
+  argNodes(call) {
+    const a = call.childForFieldName("arguments");
+    if (!a) return [];
+    if (a.type === "template_string" || a.type === "generator_expression") return [a];
+    return a.namedChildren.filter((c) => c.type !== "comment");
+  }
+  /** Dotted path of an expression without call arguments: `db.collection().find` */
+  path(node, depth = 0) {
+    if (!node || depth > 12) return "";
+    const mf = this.spec.member[node.type];
+    if (mf) return `${this.path(node.childForFieldName(mf[0]), depth + 1)}.${node.childForFieldName(mf[1])?.text ?? ""}`;
+    if (this.spec.call.includes(node.type)) return `${this.path(node.childForFieldName("function"), depth + 1)}()`;
+    switch (node.type) {
+      case "identifier":
+      case "this":
+      case "self":
+      case "property_identifier":
+      case "field_identifier":
+      case "type_identifier":
+        return node.text;
+      case "await_expression":
+      case "parenthesized_expression":
+      case "non_null_expression":
+      case "as_expression":
+      case "await":
+        return this.path(node.namedChildren[0] ?? null, depth + 1);
+      case "subscript":
+      case "subscript_expression":
+      case "index_expression":
+        return `${this.path(node.namedChildren[0] ?? null, depth + 1)}[]`;
+      default:
+        return node.text.length < 40 ? node.text : node.type;
+    }
+  }
+  rootIdent(node) {
+    const p = this.path(node);
+    const m = /^[A-Za-z_$][\w$]*/.exec(p.replace(/^(this|self)\./, ""));
+    return m?.[0];
+  }
+  containsQuery(node, depth = 0) {
+    if (depth > 40) return false;
+    if (this.spec.call.includes(node.type) && this.classify(node, true)) return true;
+    return node.namedChildren.some((c) => this.containsQuery(c, depth + 1));
+  }
+  isOverResults(iterable) {
+    const id = this.rootIdent(iterable);
+    if (id && this.queryVars.has(id)) return true;
+    return this.containsQuery(iterable);
+  }
+  collectionName(receiver) {
+    if (!receiver) return void 0;
+    const txt = receiver.text;
+    const m = /(?:collection|Collection|getCollection)\(\s*['"`]([\w.-]+)['"`]/.exec(txt) ?? /\[\s*['"]([\w.-]+)['"]\s*\]$/.exec(txt);
+    if (m) return m[1];
+    const p = this.path(receiver).split(".").filter(Boolean);
+    const last = p[p.length - 1];
+    if (!last || last.endsWith("()")) return void 0;
+    if (/^(objects|db|this|self|prisma)$/i.test(last)) return p.length > 1 && last === "objects" ? p[p.length - 2] : void 0;
+    return last.replace(/(Model|Repository|Repo|Collection|Coll)$/i, "") || last;
+  }
+  // ------------------------------------------------------------- classification
+  classify(node, quick = false) {
+    const callee = node.childForFieldName("function");
+    if (!callee) return null;
+    const mf = this.spec.member[callee.type];
+    if (!mf) return null;
+    const method = callee.childForFieldName(mf[1])?.text ?? "";
+    const receiverNode = callee.childForFieldName(mf[0]);
+    if (!method || !receiverNode) return null;
+    const receiver = this.path(receiverNode);
+    if (BUILTIN_ROOTS.has(receiver.split(/[.([]/)[0])) return null;
+    const args = this.argNodes(node);
+    const first = args[0];
+    let def;
+    const id = this.spec.id;
+    if (id === "python") {
+      if (/(^|\.)objects(\.|\(|$)|_set$/.test(receiver) && DJANGO_OPS[method]) def = op(DJANGO_OPS[method], "sql", "none", "django");
+      else if (/session|\bdb\b/i.test(receiver) && SQLA_OPS[method] && !/\.objects/.test(receiver)) def = op(SQLA_OPS[method], "sql", "none", "sqlalchemy");
+      else def = PY_OPS[method];
+      if (def && method === "find" && first && first.type === "string") return null;
+    } else if (id === "go") {
+      if (method === "Find") {
+        def = this.hasMongo && first && /\b(ctx|context|Context\(\)|TODO\(\)|Background\(\))/.test(first.text) ? op("readMany", "mongodb", "none", "mongo-go-driver") : op("readMany", "sql", "weak", "gorm");
+      } else def = GO_OPS[method];
+    } else {
+      def = Object.prototype.hasOwnProperty.call(JS_OPS, method) ? JS_OPS[method] : void 0;
+      if (def && first && this.spec.lambdas.includes(first.type)) return null;
+      if (def && (method === "find" || method === "findOne") && first && (first.type === "string" || first.type === "number")) return null;
+    }
+    if (!def) return null;
+    const firstText = first ? stripQuotes(first.text) : "";
+    const sqlArg = SQL_TEXT_RE.test(firstText);
+    const hinted = HINT_RE.test(receiver);
+    const capitalized = /^[A-Z]/.test(receiver.replace(/^(this|self)\./, ""));
+    const isChainedFromCall = receiver.endsWith("()");
+    if (def.kind === "raw") {
+      const plainString = !!first && this.spec.strings.includes(first.type) && !sqlArg;
+      if (!sqlArg && !(hinted && args.length > 0 && !plainString)) return null;
+    } else {
+      if (def.hint === "strong" && !hinted && !sqlArg) return null;
+      const docSave = this.isJs && method === "save" && args.length === 0 && (this.hasMongo || this.hasSql);
+      if (def.hint === "weak" && !hinted && !capitalized && !sqlArg && !docSave && !(id === "go" && isChainedFromCall)) return null;
+    }
+    if (method === "save" && this.isJs && args.length > 1) return null;
+    let down = receiverNode;
+    const downChain = [];
+    while (down && this.spec.call.includes(down.type)) {
+      const f = down.childForFieldName("function");
+      const fm = f ? this.spec.member[f.type] : void 0;
+      if (!f || !fm) break;
+      if (!quick && this.classify(down, true)) return null;
+      downChain.push({ name: f.childForFieldName(fm[1])?.text ?? "", args: down.childForFieldName("arguments")?.text ?? "", node: down });
+      down = f.childForFieldName(fm[0]);
+    }
+    if (quick) return { node, top: node, method, kind: def.kind, db: "unknown", receiver, receiverText: "", args, argsText: "", chain: [], confidence: "low" };
+    const up = [];
+    let top = node;
+    for (; ; ) {
+      const p = top.parent;
+      const pm = p ? this.spec.member[p.type] : void 0;
+      if (!p || !pm || !same(p.childForFieldName(pm[0]), top)) break;
+      const pp = p.parent;
+      if (!pp || !this.spec.call.includes(pp.type) || !same(pp.childForFieldName("function"), p)) {
+        break;
+      }
+      up.push({ name: p.childForFieldName(pm[1])?.text ?? "", args: pp.childForFieldName("arguments")?.text ?? "", node: pp });
+      top = pp;
+    }
+    let db = def.db === "any" ? "unknown" : def.db;
+    if (def.db === "any") {
+      if (SQL_RECEIVER_RE.test(receiver) || sqlArg) db = "sql";
+      else if (/collection|mongo/i.test(receiver)) db = "mongodb";
+      else if (this.hasMongo && !this.hasSql) db = "mongodb";
+      else if (this.hasSql && !this.hasMongo) db = "sql";
+      else if (this.hasMongoose) db = "mongodb";
+    }
+    if (def.kind === "raw") db = "sql";
+    const confidence = def.hint === "none" || sqlArg ? "high" : hinted ? "medium" : "low";
+    const argsNode = node.childForFieldName("arguments");
+    return {
+      node,
+      top,
+      method,
+      kind: def.kind,
+      db,
+      orm: def.orm ?? (this.hasMongoose && db === "mongodb" && this.isJs ? "mongoose" : void 0),
+      receiver,
+      receiverText: receiverNode.text,
+      collection: this.collectionName(receiverNode),
+      args,
+      argsText: argsNode?.text ?? "",
+      chain: [...downChain.reverse(), ...up],
+      confidence
+    };
+  }
+  // ------------------------------------------------------------- rules
+  evaluate(q, ctx) {
+    this.trackAssignment(q);
+    const target = q.collection ? `${q.collection}.${q.method}` : `${q.receiver}.${q.method}`;
+    const loopInfo = ctx.loopLine ? ` (loop at line ${ctx.loopLine})` : "";
+    const paginating = q.chain.some((c) => /^(skip|Skip|offset|Offset)$/.test(c.name) || /^(Limit)$/.test(c.name) && c.args.includes(","));
+    if (ctx.depth > 0 && !paginating && !this.targetVariesPerIteration(q, ctx)) {
+      const rawWrite = q.kind === "raw" && /^\s*(insert|update|delete|replace)\b/i.test(q.args[0] ? stripQuotes(q.args[0].text) : "");
+      const nested = ctx.depth >= 2 ? ` It is nested ${ctx.depth} loops deep, so the number of queries grows multiplicatively.` : "";
+      if (q.kind === "write" || q.kind === "batchWrite" || rawWrite) {
+        this.add("QD003", q.node, q, {
+          severity: q.kind === "batchWrite" ? "medium" : ctx.depth >= 2 ? "critical" : "high",
+          message: `\`${target}()\` runs once per iteration${loopInfo}.${nested}`,
+          fix: q.db === "mongodb" ? "Collect the operations in an array and send them with one bulkWrite()/insertMany() call." : void 0
+        });
+      } else if (ctx.over) {
+        this.add("QD002", q.node, q, {
+          severity: "critical",
+          message: `\`${target}()\` is executed for every row of \`${ctx.overVar ?? "a previous query"}\`, which itself came from the database${loopInfo}.${nested}`,
+          fix: this.batchFix(q)
+        });
+      } else {
+        this.add("QD001", q.node, q, {
+          severity: ctx.depth >= 2 ? "critical" : "high",
+          message: `\`${target}()\` is called inside a loop${loopInfo} \u2014 one round-trip per item.${nested}`,
+          fix: this.batchFix(q)
+        });
+      }
+    }
+    if (q.db === "mongodb") this.mongoRules(q);
+    if (q.db === "sql") this.sqlOrmRules(q);
+  }
+  /** `collections.map(c => c.deleteMany({}))` hits a different collection each time: not N+1. */
+  targetVariesPerIteration(q, ctx) {
+    const vars = ctx.loopVars ?? [];
+    if (!vars.length) return false;
+    const COLLECTIONISH = /(collection|coll\b|model|table|schema|repo|index|db\b|database|tenant|shard)/i;
+    for (const v of vars) {
+      const re = new RegExp(`(^|[^\\w$.])${v.replace(/\$/g, "\\$")}\\b`);
+      if (!re.test(q.receiverText)) continue;
+      if (COLLECTIONISH.test(v) || COLLECTIONISH.test(ctx.iterName ?? "") || /subclasses|models/i.test(ctx.iterName ?? "")) return true;
+      if (/^[A-Z]/.test(v) && q.receiver.split(".")[0] === v) return true;
+      if (new RegExp(`(collection|Collection|model|Model|table|Table)\\([^)]*\\b${v.replace(/\$/g, "\\$")}\\b`).test(q.receiverText)) return true;
+    }
+    return false;
+  }
+  batchFix(q) {
+    if (q.db === "mongodb") {
+      const keys = this.filterKeys(q);
+      const k = keys[0] ?? "_id";
+      return `Collect the ${k} values first and run a single \`${q.collection ?? "Model"}.find({ ${k}: { $in: values } })\`, then match results in memory with a Map. Or use $lookup in one aggregation.`;
+    }
+    if (q.orm === "django") return "Use select_related() / prefetch_related() on the outer queryset, or filter(id__in=ids) once.";
+    if (q.orm === "gorm") return 'Use Preload()/Joins() on the outer query or a single Where("id IN ?", ids).Find().';
+    if (q.orm === "prisma") return "Use include/select relations on the outer query, or findMany({ where: { id: { in: ids } } }).";
+    if (q.db === "sql") return "Use a JOIN or a single `WHERE id IN (...)`/`= ANY($1)` query and group the rows in memory.";
+    return void 0;
+  }
+  trackAssignment(q) {
+    let n = q.top.parent;
+    for (let i = 0; n && i < 4; i++) {
+      if (["await_expression", "parenthesized_expression", "as_expression", "non_null_expression", "expression_list", "await"].includes(n.type)) {
+        n = n.parent;
+        continue;
+      }
+      break;
+    }
+    if (!n) return;
+    let target = null;
+    if (n.type === "variable_declarator") target = n.childForFieldName("name");
+    else if (n.type === "assignment_expression" || n.type === "assignment" || n.type === "augmented_assignment") target = n.childForFieldName("left");
+    else if (n.type === "short_var_declaration" || n.type === "assignment_statement") target = n.childForFieldName("left");
+    if (!target) return;
+    const name = /^[A-Za-z_$][\w$]*/.exec(target.text.replace(/^[\s[{(]+/, "").replace(/^(this|self)\./, ""));
+    if (name) this.queryVars.add(name[0]);
+  }
+  filterNode(q) {
+    if (this.spec.id === "go") return q.args[1];
+    return q.args[0];
+  }
+  filterKeys(q) {
+    const f = this.filterNode(q);
+    return f ? this.objectKeys(f) : [];
+  }
+  objectKeys(node) {
+    const keys = [];
+    const push = (k) => {
+      if (!k) return;
+      const s = stripQuotes(k.trim());
+      if (s && !s.startsWith("$") && /^[\w.]+$/.test(s)) keys.push(s);
+    };
+    if (node.type === "object" || node.type === "dictionary") {
+      for (const c of node.namedChildren) if (c.type === "pair") push(c.childForFieldName("key")?.text);
+      else if (c.type === "shorthand_property_identifier") push(c.text);
+    } else if (node.type === "composite_literal") {
+      const body = node.childForFieldName("body");
+      for (const c of body?.namedChildren ?? []) {
+        if (c.type === "keyed_element") push(c.namedChildren[0]?.text);
+        else if (c.type === "literal_value") push(c.namedChildren[0]?.text);
+      }
+    }
+    return keys;
+  }
+  isEmptyFilter(node) {
+    if (!node) return true;
+    const t = node.text.replace(/\s+/g, "");
+    return /^(\{\}|bson\.(M|D)\{\}|primitive\.(M|D)\{\}|dict\(\)|map\[string\](interface\{\}|any)\{\})$/.test(t);
+  }
+  chainHas(q, re) {
+    return q.chain.some((c) => re.test(c.name));
+  }
+  mongoRules(q) {
+    const filter = this.filterNode(q);
+    const allText = q.argsText + " " + q.chain.map((c) => `${c.name}${c.args}`).join(" ");
+    const hasLimit = this.chainHas(q, /^(limit|Limit|first|next|batch_size)$/) || /\b(limit|SetLimit|\$limit)\b/.test(q.argsText);
+    const isFind = q.method === "find" || q.method === "Find";
+    if (isFind) {
+      const streaming = this.chainHas(q, /^(cursor|stream|eachAsync|batchSize|batch_size)$/);
+      const unknownOpts = this.spec.id === "go" && q.args.slice(2).some((a) => a.type === "identifier");
+      if (this.isEmptyFilter(filter) && !hasLimit && !unknownOpts) {
+        this.add("MQ001", q.node, q, {
+          severity: streaming ? "medium" : "high",
+          message: `\`${q.collection ?? q.receiver}.${q.method}()\` has an empty filter and no limit: it reads the whole collection${streaming ? " (streamed via cursor, but still a full COLLSCAN)" : ""}.`
+        });
+      }
+      const hasProjection = this.chainHas(q, /^(select|project|projection|only)$/) || /projection|SetProjection/.test(allText) || this.isJs && q.orm === "mongoose" && q.args.length >= 2 || this.spec.id === "python" && q.args.length >= 2 || unknownOpts;
+      if (!hasProjection && !this.isEmptyFilter(filter)) {
+        this.add("MQ010", q.node, q, { message: `\`${q.collection ?? q.receiver}.${q.method}()\` returns full documents.` });
+      }
+    }
+    const modelLike = /^[A-Z]/.test(q.receiver.replace(/^this\./, "")) || /model$/i.test(q.receiver);
+    if (this.isJs && q.orm === "mongoose" && modelLike && ["find", "findOne", "findById"].includes(q.method) && !this.chainHas(q, /^lean$/)) {
+      const usesSave = this.chainHas(q, /^(save|populate)$/);
+      if (!usesSave && q.method === "find") this.add("MQ011", q.node, q, { message: `\`${q.collection ?? q.receiver}.find()\` hydrates full Mongoose documents.`, confidence: "low" });
+    }
+    const hasSort = this.chainHas(q, /^(sort|Sort)$/) || /\bSetSort\(|\bsort\s*=/.test(q.argsText);
+    if ((isFind || q.kind === "readMany") && hasSort && !hasLimit) {
+      const keys = this.filterKeys(q);
+      const sortLink = q.chain.find((c) => /^sort$/i.test(c.name));
+      const sortKeys = sortLink ? (/\{([^}]*)\}/.exec(sortLink.args)?.[1] ?? "").split(",").map((s) => {
+        const [k, v] = s.split(":").map((x) => x.trim().replace(/['"]/g, ""));
+        return k ? `${k}: ${v === "-1" || v === "desc" || v === "descending" ? -1 : 1}` : "";
+      }).filter(Boolean) : [];
+      const idx = [...keys.map((k) => `${k}: 1`), ...sortKeys.filter((k) => !keys.includes(k.split(":")[0]))];
+      this.add("MQ005", q.node, q, {
+        message: `\`${q.collection ?? q.receiver}.${q.method}()\` sorts without a limit.`,
+        fix: idx.length ? `Add .limit(n) and an index matching filter + sort (ESR order), e.g. createIndex({ ${idx.join(", ")} }).` : void 0
+      });
+    }
+    const skipLink = q.chain.find((c) => /^(skip|Skip)$/.test(c.name));
+    const skipInArgs = /\bSetSkip\(|\bskip\s*=|["']?\$skip["']?\s*:/.test(q.argsText);
+    if (skipLink || skipInArgs) {
+      const lit = skipLink ? /^\(\s*(\d+)\s*\)$/.exec(skipLink.args) : null;
+      if (!lit || Number(lit[1]) >= 1e3) {
+        this.add("MQ004", skipLink?.node ?? q.node, q, { message: "Offset pagination with skip() gets slower for every page." });
+      }
+    }
+    const regexIssue = this.regexIssue(q);
+    if (regexIssue) this.add("MQ002", q.node, q, { message: regexIssue, severity: regexIssue.startsWith("Case-insensitive") ? "medium" : void 0 });
+    if (/\$where|\$function|\$accumulator/.test(q.argsText) || /^(mapReduce|map_reduce|MapReduce)$/.test(q.method)) {
+      this.add("MQ003", q.node, q, { message: "Executes JavaScript on the server for each document; indexes cannot be used." });
+    }
+    if (q.kind !== "aggregate" && filter && /["']?\$(nin|ne|not)["']?\s*[:,]/.test(filter.text)) {
+      this.add("MQ009", q.node, q, { message: "Filter relies on $ne/$nin/$not, which are not selective." });
+    }
+    if (q.kind === "count" && q.method !== "exists" && this.usedAsBoolean(q.top)) {
+      this.add("MQ008", q.node, q, { message: `\`${q.method}()\` result is only compared against 0.` });
+    }
+    if (q.kind === "aggregate" && filter) {
+      const stages = this.pipelineStages(filter);
+      if (stages) {
+        const firstMatch = stages.findIndex((s) => s === "match" || s === "search" || s === "geoNear");
+        const heavy = stages.findIndex((s) => ["lookup", "unwind", "group", "graphLookup", "facet"].includes(s));
+        if (heavy >= 0 && (firstMatch < 0 || firstMatch > heavy)) {
+          this.add("MQ006", q.node, q, { message: `Pipeline runs $${stages[heavy]} before ${firstMatch < 0 ? "any $match" : "$match"} (stages: ${stages.map((s) => "$" + s).join(" \u2192 ")}).` });
+        }
+        const sortIdx = stages.indexOf("sort");
+        if (sortIdx >= 0 && !stages.slice(sortIdx).includes("limit") && !stages.slice(0, sortIdx).includes("group")) {
+          this.add("MQ005", q.node, q, { message: "Pipeline $sort without a following $limit." });
+        }
+      }
+    }
+    const pops = q.chain.filter((c) => c.name === "populate");
+    if (pops.length >= 3 || pops.some((p) => /populate\s*:/.test(p.args))) {
+      this.add("MQ007", pops[0].node, q, { message: `${pops.length} populate() call(s)${pops.some((p) => /populate\s*:/.test(p.args)) ? " with nested populate" : ""}: each path is an extra query.` });
+    }
+  }
+  regexIssue(q) {
+    const text = q.argsText;
+    for (const a of q.args) {
+      const stack = [a];
+      while (stack.length) {
+        const n = stack.pop();
+        if (n.type === "regex") {
+          const pat = n.childForFieldName("pattern")?.text ?? "";
+          const flags = n.childForFieldName("flags")?.text ?? "";
+          if (!pat.startsWith("^")) return `Regex /${pat}/${flags} is not anchored with ^ \u2014 it scans every key.`;
+          if (flags.includes("i")) return `Case-insensitive regex /${pat}/i cannot use the index efficiently (anchored but case-insensitive).`;
+        }
+        stack.push(...n.namedChildren);
+      }
+    }
+    const caseI = /\$options["']?\s*[:,]\s*["'`][^"'`]*i/.test(text) || /re\.(I|IGNORECASE)\b/.test(text) || /Options:\s*"[^"]*i/.test(text);
+    const m = /["']?\$regex["']?\s*[:,]\s*([^,}\]\n]+)/.exec(text);
+    if (m) {
+      const v = m[1].trim();
+      if (/^["'`]/.test(v)) {
+        if (!/^["'`]\^/.test(v)) return `$regex ${v} is not anchored with ^ \u2014 it scans every key.`;
+        if (caseI) return "Case-insensitive $regex cannot use the index efficiently (anchored but case-insensitive).";
+      } else return `$regex built from a variable (\`${v.slice(0, 40)}\`) \u2014 usually unanchored${caseI ? " and case-insensitive" : ""}; this scans every key.`;
+    }
+    const ctor = /(new RegExp|re\.compile|primitive\.Regex\{\s*Pattern:)\s*\(?\s*([^,)}\n]+)/.exec(text);
+    if (ctor) {
+      const v = ctor[2].trim();
+      if (!/^["'`]\^/.test(v)) return `Regex built with ${ctor[1]}(${v.slice(0, 40)}) is not anchored with ^ \u2014 it scans every key.`;
+      if (caseI || /,\s*["'`][^"'`]*i/.test(text)) return "Case-insensitive regex cannot use the index efficiently (anchored but case-insensitive).";
+    }
+    return null;
+  }
+  pipelineStages(node) {
+    let elems = [];
+    if (node.type === "array" || node.type === "list") elems = node.namedChildren;
+    else if (node.type === "composite_literal") elems = node.childForFieldName("body")?.namedChildren ?? [];
+    else return null;
+    elems = elems.filter((e) => e.type !== "comment");
+    const stages = [];
+    for (const e of elems) {
+      const m = /["']?\$(\w+)["']?\s*[:,]/.exec(e.text);
+      if (!m) return null;
+      stages.push(m[1]);
+    }
+    return stages.length ? stages : null;
+  }
+  usedAsBoolean(top) {
+    let n = top.parent;
+    while (n && ["await_expression", "parenthesized_expression", "await"].includes(n.type)) n = n.parent;
+    if (!n) return false;
+    if (n.type === "unary_expression" && n.text.trim().startsWith("!")) return true;
+    if (n.type === "not_operator") return true;
+    if (n.type === "binary_expression" || n.type === "comparison_operator") {
+      return /(>|>=|===?|!==?|==|!=)\s*[01]\b|\b0\s*(<|===?|!==?)/.test(n.text);
+    }
+    if (n.type === "if_statement" || n.type === "ternary_expression" || n.type === "conditional_expression") return true;
+    return false;
+  }
+  sqlOrmRules(q) {
+    if (q.kind !== "readMany") return;
+    const hasWhere = this.chainHas(q, /^(where|Where|filter|filter_by|exclude|get|Joins)$/) || q.args.some((a) => /\b(where|take|limit|first|cursor)\b/.test(a.text));
+    const hasLimit = this.chainHas(q, /^(limit|Limit|take|first|one|one_or_none|scalar|paginate|get)$/) || q.top.parent?.type === "subscript" || q.top.parent?.type === "slice";
+    let unbounded = false;
+    if (q.orm === "django") unbounded = q.method === "all" && !hasLimit;
+    else if (q.orm === "sqlalchemy") unbounded = q.method === "query" && !hasWhere && !hasLimit && this.chainHas(q, /^all$/);
+    else if (q.orm === "gorm") unbounded = q.chain.length === 0 && /^[a-z]\w*$/.test(q.receiver) && q.args.length <= 1;
+    else if (this.isJs && ["findMany", "findAll", "find", "findBy", "findAndCount", "getMany"].includes(q.method)) {
+      const arg = q.args[0];
+      const argHasFilter = arg && !this.isEmptyFilter(arg) && /\b(where|take|limit|skip|first|last|cursor|id)\b|^\{\s*\w+\s*:/.test(arg.text);
+      unbounded = !argHasFilter && !hasWhere && !hasLimit && q.method !== "getMany";
+    }
+    if (!unbounded) return;
+    const assignedTo = q.top.parent?.type === "assignment" ? q.top.parent.childForFieldName("left")?.text : void 0;
+    if (q.orm === "django" && assignedTo && /^(queryset|self\.queryset|model)$/.test(assignedTo)) return;
+    this.add("SQ001", q.node, q, {
+      message: `\`${q.receiver}.${q.method}()\` has no filter and no limit \u2014 loads the whole table.`,
+      severity: q.orm === "django" ? "medium" : void 0
+    });
+  }
+  // ------------------------------------------------------------- raw SQL strings
+  checkSqlString(node) {
+    let txt = node.text;
+    const dynamic = node.type === "template_string" && /\$\{/.test(txt) || node.namedChildren.some((c) => c.type === "interpolation");
+    if (node.type === "template_string") txt = txt.replace(/\$\{[^}]*\}/g, "?");
+    txt = stripQuotes(txt).replace(/\s+/g, " ").trim();
+    if (!SQL_TEXT_RE.test(txt)) return;
+    if (!/^\s*(SELECT|INSERT|UPDATE|DELETE|WITH|REPLACE)\b/.test(txt) && !/(\bwhere\b|\bjoin\b|\blimit\b|order by|group by|\bvalues\b|\$\d|\?|=|\*|`|"\w+"\.)/i.test(txt)) return;
+    if (/^select\b/i.test(txt) && !/\bfrom\b/i.test(txt)) return;
+    if (/^(update)\b/i.test(txt) && !/\bset\b/i.test(txt)) return;
+    if (/^(delete)\b/i.test(txt) && !/\bfrom\b/i.test(txt)) return;
+    if (/^insert\b/i.test(txt) && !/\binto\b/i.test(txt)) return;
+    const pseudo = { node, top: node, method: "sql", kind: "raw", db: "sql", receiver: "sql", receiverText: "", args: [], argsText: txt, chain: [], confidence: "high" };
+    const concatenated = !!node.parent && ["binary_expression", "concatenated_string", "binary_operator"].includes(node.parent.type);
+    if (/^select\s+(\w+\.)?\*\s+from/i.test(txt)) this.add("SQ002", node, pseudo, { message: `\`${txt.slice(0, 60)}\` selects every column.` });
+    if (/\b(i?like)\s+['"]%/i.test(txt) || /\b(i?like)\s+(concat\(\s*)?['"]%['"]\s*(\|\||,|\+)/i.test(txt)) {
+      this.add("SQ003", node, pseudo, { message: "LIKE pattern starts with % \u2014 no index can be used." });
+    }
+    if (!concatenated && !dynamic) {
+      if (/^(update|delete)\b/i.test(txt) && !/\bwhere\b/i.test(txt)) {
+        this.add("SQ004", node, pseudo, { message: `\`${txt.slice(0, 50)}\` has no WHERE clause \u2014 touches every row.`, severity: "high" });
+      } else if (/^select\b/i.test(txt) && !/\b(where|limit|top|fetch\s+first|group\s+by|join)\b/i.test(txt) && !/^select\s+(count|sum|avg|min|max|exists)\s*\(/i.test(txt) && !/^select\s+\?/.test(txt)) {
+        this.add("SQ004", node, pseudo, { message: `\`${txt.slice(0, 50)}\` has no WHERE and no LIMIT \u2014 full table scan.`, severity: "medium" });
+      }
+    }
+    if (/\boffset\s+(\$\d+|\?|:\w+|@\w+|%s|\d{4,})/i.test(txt) || /\blimit\s+\S+\s*,\s*\S+/i.test(txt)) {
+      this.add("SQ005", node, pseudo, { message: "OFFSET-based pagination reads and discards all skipped rows." });
+    }
+    if (/\b(where|and|or)\s+(lower|upper|date|year|month|day|coalesce|cast|substring|substr|trim|to_char|date_trunc|ifnull|isnull)\s*\(/i.test(txt)) {
+      this.add("SQ006", node, pseudo, { message: "Function wrapped around a column in WHERE makes it non-sargable." });
+    }
+    if (/order\s+by\s+(rand|random|newid)\s*\(\s*\)/i.test(txt)) this.add("SQ007", node, pseudo, { message: "ORDER BY random sorts the entire table." });
+    if (/\bnot\s+in\s*\(\s*select\b/i.test(txt)) this.add("SQ008", node, pseudo, { message: "NOT IN (SELECT ...) \u2014 prefer NOT EXISTS." });
+  }
+  // ------------------------------------------------------------- output
+  add(ruleId, node, q, o) {
+    const rule = RULE_MAP.get(ruleId);
+    const line = node.startPosition.row + 1;
+    const endRow = Math.min(node.endPosition.row, node.startPosition.row + 2);
+    const snippet = this.lines.slice(node.startPosition.row, endRow + 1).map((l) => l.replace(/\s+$/, "")).join("\n").trim();
+    const norm = snippet.replace(/\s+/g, " ");
+    const fingerprint = createHash("sha1").update(`${ruleId}|${this.opts.relPath}|${norm}`).digest("hex").slice(0, 16);
+    if (this.findings.some((f) => f.ruleId === ruleId && f.line === line && f.column === node.startPosition.column + 1)) return;
+    this.findings.push({
+      ruleId,
+      title: rule.title,
+      severity: o.severity ?? rule.severity,
+      db: q.db,
+      lang: this.opts.lang,
+      file: this.opts.relPath,
+      line,
+      column: node.startPosition.column + 1,
+      snippet,
+      message: o.message,
+      fix: o.fix ?? rule.fix,
+      confidence: o.confidence ?? q.confidence,
+      fingerprint
+    });
+  }
+  applySuppressions() {
+    const re = /querydig-ignore(?!-file)(?:[\s:]+((?:[A-Z]{2}\d{3}[\s,]*)+))?/;
+    return this.findings.filter((f) => {
+      for (const ln of [f.line, f.line - 1]) {
+        const m = re.exec(this.lines[ln - 1] ?? "");
+        if (m && (!m[1] || m[1].split(/[\s,]+/).includes(f.ruleId))) return false;
+      }
+      return true;
+    });
+  }
+};
+
+// src/fileAnalyzer.ts
+import { readFile } from "fs/promises";
+import { join as join2 } from "path";
+var MAX_BYTES = 15e5;
+var QUICK_FILTER = /find|aggregate|query|execute|Query|Exec|objects|count|Count|update|Update|insert|Insert|delete|Delete|save|Save|create|Create|select|SELECT|First|Take|remove|upsert|distinct|Distinct/;
+async function analyzeFile(root, rel) {
+  const lang = langForFile(rel);
+  if (!lang) return { file: rel, findings: [] };
+  try {
+    const src = await readFile(join2(root, rel), "utf8");
+    if (src.length > MAX_BYTES || !QUICK_FILTER.test(src)) return { file: rel, findings: [] };
+    const findings = await analyzeSource(src, { relPath: rel, lang });
+    return { file: rel, findings };
+  } catch (e) {
+    return { file: rel, findings: [], error: e.message };
+  }
+}
+
+export {
+  RULES,
+  RULE_MAP,
+  findRule,
+  SUPPORTED_EXTENSIONS,
+  analyzeSource,
+  analyzeFile
+};