tova 0.10.3 → 0.11.12

package/src/analyzer/analyzer.js

@@ -1319,818 +1319,9 @@ export class Analyzer {
     return best;
   }
 
-  visitSecurityBlock(node) {
-    // Per-block: only check for duplicate role names within this block
-    const localRoles = new Set();
-    for (const stmt of node.body) {
-      if (stmt.type === 'SecurityRoleDeclaration') {
-        if (localRoles.has(stmt.name)) {
-          this.warnings.push({
-            message: `Duplicate role definition: '${stmt.name}'`,
-            loc: stmt.loc,
-            code: 'W_DUPLICATE_ROLE',
-            category: 'security',
-          });
-        }
-        localRoles.add(stmt.name);
-      }
-    }
-  }
-
-  visitCliBlock(node) {
-    const validKeys = new Set(['name', 'version', 'description']);
-
-    // Validate config keys
-    for (const field of node.config) {
-      if (!validKeys.has(field.key)) {
-        this.warnings.push({
-          message: `Unknown cli config key '${field.key}' — valid keys are: ${[...validKeys].join(', ')}`,
-          loc: field.loc,
-          code: 'W_UNKNOWN_CLI_CONFIG',
-        });
-      }
-    }
-
-    // Validate commands
-    const commandNames = new Set();
-    for (const cmd of node.commands) {
-      // Duplicate command names
-      if (commandNames.has(cmd.name)) {
-        this.warnings.push({
-          message: `Duplicate cli command '${cmd.name}'`,
-          loc: cmd.loc,
-          code: 'W_DUPLICATE_CLI_COMMAND',
-        });
-      }
-      commandNames.add(cmd.name);
-
-      // Check for positional args after flags
-      let seenFlag = false;
-      for (const param of cmd.params) {
-        if (param.isFlag) {
-          seenFlag = true;
-        } else if (seenFlag) {
-          this.warnings.push({
-            message: `Positional argument '${param.name}' after flag in command '${cmd.name}' — positionals should come before flags`,
-            loc: param.loc,
-            code: 'W_POSITIONAL_AFTER_FLAG',
-          });
-        }
-      }
-
-      // Visit command body with params in scope
-      this.pushScope('function');
-      for (const param of cmd.params) {
-        this.currentScope.define(param.name,
-          new Symbol(param.name, 'parameter', null, false, param.loc));
-      }
-      this.visitNode(cmd.body);
-      this.popScope();
-    }
-  }
-
-  visitConcurrentBlock(node) {
-    // Validate mode
-    const validModes = new Set(['all', 'cancel_on_error', 'first', 'timeout']);
-    if (!validModes.has(node.mode)) {
-      this.warn(`Unknown concurrent block mode '${node.mode}'`, node.loc, null, {
-        code: 'W_UNKNOWN_CONCURRENT_MODE',
-      });
-    }
-
-    // Validate timeout
-    if (node.mode === 'timeout' && !node.timeout) {
-      this.warn("concurrent timeout mode requires a timeout value", node.loc, null, {
-        code: 'W_MISSING_TIMEOUT',
-      });
-    }
-
-    // Warn on empty block
-    if (node.body.length === 0) {
-      this.warn("Empty concurrent block", node.loc, null, {
-        code: 'W_EMPTY_CONCURRENT',
-      });
-    }
-
-    // Track concurrent depth for spawn validation
-    this._concurrentDepth = (this._concurrentDepth || 0) + 1;
-
-    // Visit body statements (concurrent block does NOT create a new scope —
-    // variables assigned inside should be visible after the block)
-    for (const stmt of node.body) {
-      this.visitNode(stmt);
-    }
-
-    // Check spawned functions for WASM compatibility — warn if mixed WASM/non-WASM
-    let hasWasm = false;
-    let hasNonWasm = false;
-    for (const stmt of node.body) {
-      const spawn = (stmt.type === 'Assignment' && stmt.values && stmt.values[0] && stmt.values[0].type === 'SpawnExpression')
-        ? stmt.values[0]
-        : (stmt.type === 'ExpressionStatement' && stmt.expression && stmt.expression.type === 'SpawnExpression')
-          ? stmt.expression
-          : null;
-      if (!spawn) continue;
-      const calleeName = spawn.callee && spawn.callee.type === 'Identifier' ? spawn.callee.name : null;
-      if (calleeName) {
-        const sym = this.currentScope.lookup(calleeName);
-        if (sym && sym.isWasm) {
-          hasWasm = true;
-        } else {
-          hasNonWasm = true;
-        }
-      } else {
-        // Lambda or complex expression — always non-WASM
-        hasNonWasm = true;
-      }
-    }
-    if (hasWasm && hasNonWasm) {
-      this.warn(
-        "concurrent block mixes @wasm and non-WASM tasks — non-WASM tasks will fall back to async JS execution",
-        node.loc, null, { code: 'W_SPAWN_WASM_FALLBACK' }
-      );
-    }
-
-    this._concurrentDepth--;
-  }
-
-  visitSelectStatement(node) {
-    if (node.cases.length === 0) {
-      this.warn("Empty select block", node.loc, null, {
-        code: 'W_EMPTY_SELECT',
-      });
-    }
-
-    let defaultCount = 0;
-    let timeoutCount = 0;
-    for (const c of node.cases) {
-      if (c.kind === 'default') defaultCount++;
-      if (c.kind === 'timeout') timeoutCount++;
-    }
-
-    if (defaultCount > 1) {
-      this.warn("select block has multiple default cases", node.loc, null, {
-        code: 'W_DUPLICATE_SELECT_DEFAULT',
-      });
-    }
-    if (timeoutCount > 1) {
-      this.warn("select block has multiple timeout cases", node.loc, null, {
-        code: 'W_DUPLICATE_SELECT_TIMEOUT',
-      });
-    }
-    if (defaultCount > 0 && timeoutCount > 0) {
-      this.warn("select block has both default and timeout — default makes timeout unreachable", node.loc, null, {
-        code: 'W_SELECT_DEFAULT_TIMEOUT',
-      });
-    }
-
-    // Visit each case's expressions and body
-    for (const c of node.cases) {
-      if (c.channel) this.visitNode(c.channel);
-      if (c.value) this.visitNode(c.value);
-
-      if (c.kind === 'receive' && c.binding) {
-        // Create scope for the binding variable
-        this.pushScope('select-case');
-        this.currentScope.define(c.binding,
-          new Symbol(c.binding, 'variable', null, false, c.loc));
-        for (const stmt of c.body) {
-          this.visitNode(stmt);
-        }
-        this.popScope();
-      } else {
-        for (const stmt of c.body) {
-          this.visitNode(stmt);
-        }
-      }
-    }
-  }
-
-  _validateCliCrossBlock() {
-    const cliBlocks = this.ast.body.filter(n => n.type === 'CliBlock');
-    if (cliBlocks.length === 0) return;
-
-    // Warn if cli + server coexist
-    const hasServer = this.ast.body.some(n => n.type === 'ServerBlock');
-    if (hasServer) {
-      this.warnings.push({
-        message: 'cli {} and server {} blocks in the same file — cli produces a standalone executable, not a web server',
-        loc: cliBlocks[0].loc,
-        code: 'W_CLI_WITH_SERVER',
-      });
-    }
-
-    // Check for missing name across all cli blocks
-    let hasName = false;
-    for (const block of cliBlocks) {
-      for (const field of block.config) {
-        if (field.key === 'name') hasName = true;
-      }
-    }
-    if (!hasName) {
-      this.warnings.push({
-        message: 'cli block has no name: field — consider adding name: "your-tool"',
-        loc: cliBlocks[0].loc,
-        code: 'W_CLI_MISSING_NAME',
-      });
-    }
-  }
-
-  visitEdgeBlock(node) {
-    const validTargets = new Set(['cloudflare', 'deno', 'vercel', 'lambda', 'bun']);
-    const validConfigKeys = new Set(['target']);
-    const bindingNames = new Set();
-
-    // Binding support matrix per target
-    const BINDING_SUPPORT = {
-      cloudflare: { kv: true, sql: true, storage: true, queue: true },
-      deno:       { kv: true, sql: false, storage: false, queue: false },
-      vercel:     { kv: false, sql: false, storage: false, queue: false },
-      lambda:     { kv: false, sql: false, storage: false, queue: false },
-      bun:        { kv: false, sql: true, storage: false, queue: false },
-    };
-
-    // Targets that support schedule/consume/middleware
-    const SCHEDULE_TARGETS = new Set(['cloudflare', 'deno']);
-    const CONSUME_TARGETS = new Set(['cloudflare']);
-
-    // Determine target from config fields
-    let target = 'cloudflare';
-    for (const stmt of node.body) {
-      if (stmt.type === 'EdgeConfigField' && stmt.key === 'target' && stmt.value.type === 'StringLiteral') {
-        target = stmt.value.value;
-      }
-    }
-
-    this.pushScope('edge');
-
-    let kvCount = 0;
-    const queueNames = new Set();
-    const consumers = [];
-
-    for (const stmt of node.body) {
-      // Validate config fields
-      if (stmt.type === 'EdgeConfigField') {
-        if (!validConfigKeys.has(stmt.key)) {
-          this.warnings.push({
-            message: `Unknown edge config key '${stmt.key}' — valid keys are: ${[...validConfigKeys].join(', ')}`,
-            loc: stmt.loc,
-            code: 'W_UNKNOWN_EDGE_CONFIG',
-          });
-        }
-        if (stmt.key === 'target' && stmt.value.type === 'StringLiteral') {
-          if (!validTargets.has(stmt.value.value)) {
-            this.warnings.push({
-              message: `Unknown edge target '${stmt.value.value}' — valid targets are: ${[...validTargets].join(', ')}`,
-              loc: stmt.loc,
-              code: 'W_UNKNOWN_EDGE_TARGET',
-            });
-          }
-        }
-        continue;
-      }
-
-      // Check for duplicate binding names
-      if (stmt.type === 'EdgeKVDeclaration' || stmt.type === 'EdgeSQLDeclaration' ||
-          stmt.type === 'EdgeStorageDeclaration' || stmt.type === 'EdgeQueueDeclaration') {
-        if (bindingNames.has(stmt.name)) {
-          this.warnings.push({
-            message: `Duplicate edge binding '${stmt.name}'`,
-            loc: stmt.loc,
-            code: 'W_DUPLICATE_EDGE_BINDING',
-          });
-        }
-        bindingNames.add(stmt.name);
-      }
-
-      // Track queue names for consume validation
-      if (stmt.type === 'EdgeQueueDeclaration') {
-        queueNames.add(stmt.name);
-      }
-
-      // Check for duplicate env/secret names
-      if (stmt.type === 'EdgeEnvDeclaration' || stmt.type === 'EdgeSecretDeclaration') {
-        if (bindingNames.has(stmt.name)) {
-          this.warnings.push({
-            message: `Duplicate edge binding '${stmt.name}'`,
-            loc: stmt.loc,
-            code: 'W_DUPLICATE_EDGE_BINDING',
-          });
-        }
-        bindingNames.add(stmt.name);
-      }
-
-      // Unsupported binding warnings (per target)
-      const support = BINDING_SUPPORT[target] || BINDING_SUPPORT.cloudflare;
-      if (stmt.type === 'EdgeKVDeclaration' && !support.kv) {
-        this.warnings.push({
-          message: `KV binding '${stmt.name}' is not supported on target '${target}' — it will be stubbed as null`,
-          loc: stmt.loc,
-          code: 'W_UNSUPPORTED_KV',
-        });
-      }
-      if (stmt.type === 'EdgeSQLDeclaration' && !support.sql) {
-        this.warnings.push({
-          message: `SQL binding '${stmt.name}' is not supported on target '${target}' — it will be stubbed as null`,
-          loc: stmt.loc,
-          code: 'W_UNSUPPORTED_SQL',
-        });
-      }
-      if (stmt.type === 'EdgeStorageDeclaration' && !support.storage) {
-        this.warnings.push({
-          message: `Storage binding '${stmt.name}' is not supported on target '${target}' — it will be stubbed as null`,
-          loc: stmt.loc,
-          code: 'W_UNSUPPORTED_STORAGE',
-        });
-      }
-      if (stmt.type === 'EdgeQueueDeclaration' && !support.queue) {
-        this.warnings.push({
-          message: `Queue binding '${stmt.name}' is not supported on target '${target}' — it will be stubbed as null`,
-          loc: stmt.loc,
-          code: 'W_UNSUPPORTED_QUEUE',
-        });
-      }
-
-      // Deno multi-KV warning
-      if (stmt.type === 'EdgeKVDeclaration') {
-        kvCount++;
-        if (kvCount > 1 && target === 'deno') {
-          this.warnings.push({
-            message: `Deno Deploy supports only one KV store — '${stmt.name}' will share the same store as the first KV binding`,
-            loc: stmt.loc,
-            code: 'W_DENO_MULTI_KV',
-          });
-        }
-      }
-
-      // Validate schedule cron expressions + target support
-      if (stmt.type === 'EdgeScheduleDeclaration') {
-        const parts = stmt.cron.split(/\s+/);
-        if (parts.length < 5 || parts.length > 6) {
-          this.warnings.push({
-            message: `Invalid cron expression '${stmt.cron}' — expected 5 or 6 space-separated fields`,
-            loc: stmt.loc,
-            code: 'W_INVALID_CRON',
-          });
-        }
-        if (!SCHEDULE_TARGETS.has(target)) {
-          this.warnings.push({
-            message: `Scheduled tasks are not supported on target '${target}' — schedule '${stmt.name}' will be ignored. Supported targets: ${[...SCHEDULE_TARGETS].join(', ')}`,
-            loc: stmt.loc,
-            code: 'W_UNSUPPORTED_SCHEDULE',
-          });
-        }
-      }
-
-      // Collect consume declarations for post-loop validation
-      if (stmt.type === 'EdgeConsumeDeclaration') {
-        consumers.push(stmt);
-        if (!CONSUME_TARGETS.has(target)) {
-          this.warnings.push({
-            message: `Queue consumers are not supported on target '${target}' — consume '${stmt.queue}' will be ignored. Supported targets: ${[...CONSUME_TARGETS].join(', ')}`,
-            loc: stmt.loc,
-            code: 'W_UNSUPPORTED_CONSUME',
-          });
-        }
-      }
-
-      // Visit child nodes — edge-specific types are noop in the registry,
-      // so explicitly visit bodies that contain statements
-      if (stmt.type === 'EdgeScheduleDeclaration' && stmt.body) {
-        for (const s of stmt.body.body || []) this.visitNode(s);
-      } else if (stmt.type === 'FunctionDeclaration' || stmt.type === 'RouteDeclaration') {
-        this.visitNode(stmt);
-      }
-    }
-
-    // Post-loop: validate consume references a declared queue
-    for (const consumer of consumers) {
-      if (!queueNames.has(consumer.queue)) {
-        this.warnings.push({
-          message: `consume '${consumer.queue}' references undeclared queue binding — add 'queue ${consumer.queue}' to the edge block`,
-          loc: consumer.loc,
-          code: 'W_CONSUME_UNKNOWN_QUEUE',
-        });
-      }
-    }
-
-    // Warn if edge block has no route or schedule handlers
-    const hasRoutes = node.body.some(s => s.type === 'RouteDeclaration');
-    const hasSchedules = node.body.some(s => s.type === 'EdgeScheduleDeclaration');
-    const hasConsumers = consumers.length > 0;
-    if (!hasRoutes && !hasSchedules && !hasConsumers) {
-      this.warnings.push({
-        message: 'edge block has no routes, schedules, or consumers — it will produce no handlers',
-        loc: node.loc,
-        code: 'W_EDGE_NO_HANDLERS',
-      });
-    }
-
-    this.popScope();
-  }
-
-  _validateEdgeCrossBlock() {
-    const edgeBlocks = this.ast.body.filter(n => n.type === 'EdgeBlock');
-    if (edgeBlocks.length === 0) return;
-
-    // Warn if edge + cli coexist (cli takes over with earlyReturn)
-    const hasCli = this.ast.body.some(n => n.type === 'CliBlock');
-    if (hasCli) {
-      this.warnings.push({
-        message: 'edge {} and cli {} blocks in the same file — cli produces a standalone executable, edge block will be ignored',
-        loc: edgeBlocks[0].loc,
-        code: 'W_EDGE_WITH_CLI',
-      });
-    }
-  }
-
-  _validateSecurityCrossBlock() {
-    // W_NO_SECURITY_BLOCK: server/edge block without security block
-    const hasServerOrEdge = this.ast.body.some(n => n.type === 'ServerBlock' || n.type === 'EdgeBlock');
-    const hasSecurityBlock = this.ast.body.some(n => n.type === 'SecurityBlock');
-    if (hasServerOrEdge && !hasSecurityBlock) {
-      const block = this.ast.body.find(n => n.type === 'ServerBlock' || n.type === 'EdgeBlock');
-      this.warnings.push({
-        message: 'Server/edge block defined without a security block — consider adding security { ... } for auth, CORS, and CSRF protection',
-        loc: block.loc,
-        code: 'W_NO_SECURITY_BLOCK',
-        category: 'security',
-      });
-    }
-
-    // Collect ALL security declarations across ALL security blocks in the AST
-    const allRoles = new Set();
-    const allProtects = [];
-    const allSensitives = [];
-    let hasAuth = false;
-    let hasProtect = false;
-    let authDecl = null;
-    let corsDecl = null;
-    let rateLimitDecl = null;
-    let csrfDecl = null;
-
-    // Check for top-level AuthBlock (independent auth block, not security sub-block)
-    for (const node of this.ast.body) {
-      if (node.type === 'AuthBlock') { hasAuth = true; authDecl = node; break; }
-    }
-
-    const roleDecls = []; // track all role declarations for cross-block duplicate detection
-    for (const node of this.ast.body) {
-      if (node.type !== 'SecurityBlock') continue;
-      for (const stmt of node.body) {
-        if (stmt.type === 'SecurityRoleDeclaration') {
-          roleDecls.push(stmt);
-          allRoles.add(stmt.name);
-        } else if (stmt.type === 'SecurityProtectDeclaration') {
-          allProtects.push(stmt);
-          hasProtect = true;
-        } else if (stmt.type === 'SecuritySensitiveDeclaration') {
-          allSensitives.push(stmt);
-        } else if (stmt.type === 'SecurityAuthDeclaration') {
-          hasAuth = true;
-          authDecl = stmt;
-        } else if (stmt.type === 'SecurityCorsDeclaration') {
-          corsDecl = stmt;
-        } else if (stmt.type === 'SecurityRateLimitDeclaration') {
-          rateLimitDecl = stmt;
-        } else if (stmt.type === 'SecurityCsrfDeclaration') {
-          csrfDecl = stmt;
-        }
-      }
-    }
-
-    // W_DUPLICATE_ROLE across blocks: detect roles with same name in different security blocks
-    const seenRoleNames = new Map(); // name -> first declaration
-    for (const decl of roleDecls) {
-      const prev = seenRoleNames.get(decl.name);
-      if (prev && prev.loc !== decl.loc) {
-        // Only warn if this is from a different block (same-block dupes handled by visitSecurityBlock)
-        const prevInSameBlock = this.ast.body.some(b =>
-          b.type === 'SecurityBlock' && b.body.includes(prev) && b.body.includes(decl)
-        );
-        if (!prevInSameBlock) {
-          this.warnings.push({
-            message: `Role '${decl.name}' is defined in multiple security blocks — later definition overwrites earlier one`,
-            loc: decl.loc,
-            code: 'W_DUPLICATE_ROLE',
-            category: 'security',
-          });
-        }
-      }
-      seenRoleNames.set(decl.name, decl);
-    }
-
-    // W_UNKNOWN_AUTH_TYPE — validate auth type is a known value
-    if (authDecl && authDecl.authType) {
-      const validAuthTypes = ['jwt', 'api_key'];
-      if (!validAuthTypes.includes(authDecl.authType)) {
-        this.warnings.push({
-          message: `Unknown auth type '${authDecl.authType}' — supported types are: ${validAuthTypes.join(', ')}`,
-          loc: authDecl.loc,
-          code: 'W_UNKNOWN_AUTH_TYPE',
-          category: 'security',
-        });
-      }
-    }
-
-    // Fix 2: W_HARDCODED_SECRET — warn if auth secret is a string literal
-    // Only check SecurityAuthDeclaration (which has .config), not top-level AuthBlock
-    if (authDecl && authDecl.config && authDecl.config.secret) {
-      const secretNode = authDecl.config.secret;
-      if (secretNode.type === 'StringLiteral') {
-        this.warnings.push({
-          message: 'Auth secret is hardcoded as a string literal — use env("SECRET_NAME") instead',
-          loc: authDecl.loc,
-          code: 'W_HARDCODED_SECRET',
-          category: 'security',
-        });
-      }
-    }
-
-    // Fix 7: W_CORS_WILDCARD — warn if cors origins contains "*"
-    if (corsDecl && corsDecl.config.origins) {
-      const originsNode = corsDecl.config.origins;
-      if (originsNode.elements) {
-        for (const elem of originsNode.elements) {
-          if (elem.type === 'StringLiteral' && elem.value === '*') {
-            this.warnings.push({
-              message: 'CORS origins contains wildcard "*" — consider restricting to specific origins',
-              loc: corsDecl.loc,
-              code: 'W_CORS_WILDCARD',
-              category: 'security',
-            });
-            break;
-          }
-        }
-      }
-    }
-
-    // W_INVALID_RATE_LIMIT — validate rate limit max/window are positive numbers
-    const _rlNumericValue = (node) => {
-      if (!node) return null;
-      if (node.type === 'NumberLiteral') return node.value;
-      if (node.type === 'UnaryExpression' && node.operator === '-' && node.operand && node.operand.type === 'NumberLiteral') return -node.operand.value;
-      return null;
-    };
-    if (rateLimitDecl && rateLimitDecl.config) {
-      const rlMaxVal = _rlNumericValue(rateLimitDecl.config.max);
-      const rlWindowVal = _rlNumericValue(rateLimitDecl.config.window);
-      if (rlMaxVal !== null && rlMaxVal <= 0) {
-        this.warnings.push({
-          message: `Rate limit max must be a positive number, got ${rlMaxVal}`,
-          loc: rateLimitDecl.loc,
-          code: 'W_INVALID_RATE_LIMIT',
-          category: 'security',
-        });
-      }
-      if (rlWindowVal !== null && rlWindowVal <= 0) {
-        this.warnings.push({
-          message: `Rate limit window must be a positive number, got ${rlWindowVal}`,
-          loc: rateLimitDecl.loc,
-          code: 'W_INVALID_RATE_LIMIT',
-          category: 'security',
-        });
-      }
-    }
-
-    // W_CSRF_DISABLED — warn when CSRF is explicitly disabled
-    if (csrfDecl && csrfDecl.config && csrfDecl.config.enabled) {
-      const enabledNode = csrfDecl.config.enabled;
-      if ((enabledNode.type === 'BooleanLiteral' && enabledNode.value === false) ||
-          (enabledNode.type === 'Identifier' && enabledNode.name === 'false')) {
-        this.warnings.push({
-          message: 'CSRF protection is explicitly disabled — this increases vulnerability to cross-site request forgery attacks',
-          loc: csrfDecl.loc,
-          code: 'W_CSRF_DISABLED',
-          category: 'security',
-        });
-      }
-    }
-
-    // W_LOCALSTORAGE_TOKEN — warn when auth uses default localStorage storage (XSS-vulnerable)
-    if (authDecl && authDecl.authType === 'jwt' && authDecl.config) {
-      const storageNode = authDecl.config.storage;
-      const isCookieAuth = storageNode && storageNode.type === 'StringLiteral' && storageNode.value === 'cookie';
-      if (!isCookieAuth) {
-        this.warnings.push({
-          message: 'Auth tokens stored in localStorage are vulnerable to XSS attacks — consider using storage: "cookie" for HttpOnly cookie storage',
-          loc: authDecl.loc,
-          code: 'W_LOCALSTORAGE_TOKEN',
-          category: 'security',
-        });
-      }
-    }
-
-    // Fix 5: W_INMEMORY_RATELIMIT — warn that rate limiting is in-memory only
-    if (rateLimitDecl) {
-      this.warnings.push({
-        message: 'Rate limiting uses in-memory storage — not shared across server instances. Consider an external store for production multi-instance deployments',
-        loc: rateLimitDecl.loc,
-        code: 'W_INMEMORY_RATELIMIT',
-        category: 'security',
-      });
-    }
-
-    // Fix 6: W_NO_AUTH_RATELIMIT — warn when auth exists but no rate limiting protects against brute-force
-    if (hasAuth && !rateLimitDecl) {
-      const hasAuthRateLimit = allProtects.some(p => p.config && p.config.rate_limit);
-      if (!hasAuthRateLimit) {
-        this.warnings.push({
-          message: 'Auth is configured without rate limiting — consider adding rate_limit to protect against brute-force attacks',
-          loc: authDecl.loc,
-          code: 'W_NO_AUTH_RATELIMIT',
-          category: 'security',
-        });
-      }
-    }
-
-    // Fix 7: W_HASH_NOT_ENFORCED — warn when sensitive declares hash but it's not auto-enforced
-    for (const s of allSensitives) {
-      if (s.config && s.config.hash) {
-        const hashVal = s.config.hash.value || s.config.hash;
-        this.warnings.push({
-          message: `sensitive ${s.typeName}.${s.fieldName} declares hash: "${hashVal}" but hashing is not automatically enforced — use hash_password() in your write handlers`,
-          loc: s.loc,
-          code: 'W_HASH_NOT_ENFORCED',
-          category: 'security',
-        });
-      }
-    }
-
-    // No security blocks → nothing to validate (but allow auth/cors checks above)
-    if (!hasProtect && allSensitives.length === 0) return;
-
-    // W_PROTECT_WITHOUT_AUTH: protect rules exist but no auth configured
-    if (hasProtect && !hasAuth) {
-      // Find first protect for location
-      this.warnings.push({
-        message: 'Route protection rules exist but no auth is configured — all protected routes will be inaccessible',
-        loc: allProtects[0].loc,
-        code: 'W_PROTECT_WITHOUT_AUTH',
-        category: 'security',
-      });
-    }
-
-    // W_UNDEFINED_ROLE: protect rules reference roles not defined anywhere
-    for (const protect of allProtects) {
-      const requireExpr = protect.config.require;
-      if (!requireExpr) {
-        // W_PROTECT_NO_REQUIRE: protect rule has no require key
-        this.warnings.push({
-          message: `Protect rule for "${protect.pattern}" has no 'require' — route is unprotected`,
-          loc: protect.loc,
-          code: 'W_PROTECT_NO_REQUIRE',
-          category: 'security',
-        });
-        continue;
-      }
-      if (requireExpr.type === 'Identifier' && requireExpr.name !== 'authenticated') {
-        if (!allRoles.has(requireExpr.name)) {
-          this.warnings.push({
-            message: `Protect rule references undefined role '${requireExpr.name}'`,
-            loc: protect.loc,
-            code: 'W_UNDEFINED_ROLE',
-            category: 'security',
-          });
-        }
-      }
-    }
-
-    // W_UNDEFINED_ROLE: sensitive visible_to references roles not defined anywhere
-    for (const sensitive of allSensitives) {
-      const visibleTo = sensitive.config.visible_to;
-      if (visibleTo && (visibleTo.type === 'ArrayExpression' || visibleTo.type === 'ArrayLiteral')) {
-        for (const elem of visibleTo.elements) {
-          if (elem.type === 'Identifier' && elem.name !== 'self') {
-            if (!allRoles.has(elem.name)) {
-              this.warnings.push({
-                message: `Sensitive field '${sensitive.typeName}.${sensitive.fieldName}' visible_to references undefined role '${elem.name}'`,
-                loc: sensitive.loc,
-                code: 'W_UNDEFINED_ROLE',
-                category: 'security',
-              });
-            }
-          }
-        }
-      }
-    }
-  }
-
-  visitAuthBlock(node) {
-    const validHookEvents = new Set(['signup', 'login', 'logout', 'oauth_link']);
-    const providerTypes = new Set();
-    let hasProvider = false;
-
-    for (const stmt of node.body) {
-      if (stmt.type === 'AuthConfigField') {
-        if (stmt.key === 'secret' && stmt.value.type === 'StringLiteral') {
-          this.warnings.push({
-            message: 'Auth secret should use env() — hardcoded secrets are insecure',
-            loc: stmt.loc, code: 'W_AUTH_HARDCODED_SECRET', category: 'auth',
-          });
-        }
-        if (stmt.key === 'token_expires' && stmt.value.type === 'NumberLiteral' && stmt.value.value < 300) {
-          this.warnings.push({
-            message: 'Access token expires too quickly (< 5 minutes) — may cause frequent logouts',
-            loc: stmt.loc, code: 'W_AUTH_SHORT_TOKEN', category: 'auth',
-          });
-        }
-        if (stmt.key === 'refresh_expires' && stmt.value.type === 'NumberLiteral' && stmt.value.value > 2592000) {
-          this.warnings.push({
-            message: 'Refresh token lives longer than 30 days — consider shorter lifetime',
-            loc: stmt.loc, code: 'W_AUTH_LONG_REFRESH', category: 'auth',
-          });
-        }
-        if (stmt.key === 'storage' && stmt.value.type === 'StringLiteral' && stmt.value.value === 'local') {
-          this.warnings.push({
-            message: 'localStorage tokens are vulnerable to XSS — prefer storage: "cookie"',
-            loc: stmt.loc, code: 'W_AUTH_LOCAL_STORAGE', category: 'auth',
-          });
-        }
-      }
-
-      if (stmt.type === 'AuthProviderDeclaration') {
-        hasProvider = true;
-        const key = stmt.providerType + (stmt.name ? ':' + stmt.name : '');
-        if (providerTypes.has(key)) {
-          this.warnings.push({
-            message: `Duplicate auth provider '${key}'`,
-            loc: stmt.loc, code: 'W_AUTH_DUPLICATE_PROVIDER', category: 'auth',
-          });
-        }
-        providerTypes.add(key);
-
-        if (stmt.providerType === 'email') {
-          if (!stmt.config.confirm_email) {
-            this.warnings.push({
-              message: 'Email provider without confirm_email — consider requiring email verification',
-              loc: stmt.loc, code: 'W_AUTH_NO_CONFIRM', category: 'auth',
-            });
-          }
-          if (stmt.config.password_min && stmt.config.password_min.type === 'NumberLiteral' && stmt.config.password_min.value < 8) {
-            this.warnings.push({
-              message: 'Minimum password length less than 8 — weak passwords allowed',
-              loc: stmt.loc, code: 'W_AUTH_WEAK_PASSWORD', category: 'auth',
-            });
-          }
-        }
-      }
-
-      if (stmt.type === 'AuthHookDeclaration') {
-        if (!validHookEvents.has(stmt.event)) {
-          this.warnings.push({
-            message: `Unknown auth hook event '${stmt.event}' — valid: ${[...validHookEvents].join(', ')}`,
-            loc: stmt.loc, code: 'W_AUTH_UNKNOWN_HOOK', category: 'auth',
-          });
-        }
-      }
-
-      if (stmt.type === 'AuthProtectedRoute') {
-        if (!stmt.config.redirect) {
-          this.warnings.push({
-            message: `Protected route '${stmt.pattern}' has no redirect`,
-            loc: stmt.loc, code: 'W_AUTH_PROTECTED_NO_REDIRECT', category: 'auth',
-          });
-        }
-      }
-    }
-
-    if (!hasProvider) {
-      this.warnings.push({
-        message: 'Auth block has no providers — add at least one',
-        loc: node.loc, code: 'W_AUTH_MISSING_PROVIDER', category: 'auth',
-      });
-    }
-  }
-
-  _validateAuthCrossBlock() {
-    const securityRoles = new Set();
-    for (const node of this.ast.body) {
-      if (node.type === 'SecurityBlock') {
-        for (const stmt of node.body) {
-          if (stmt.type === 'SecurityRoleDeclaration') {
-            securityRoles.add(stmt.name);
-          }
-        }
-      }
-    }
-
-    for (const node of this.ast.body) {
-      if (node.type === 'AuthBlock') {
-        for (const stmt of node.body) {
-          if (stmt.type === 'AuthProtectedRoute' && stmt.config.require) {
-            const roleName = stmt.config.require.type === 'Identifier' ? stmt.config.require.name : null;
-            if (roleName && securityRoles.size > 0 && !securityRoles.has(roleName)) {
-              this.warnings.push({
-                message: `Protected route requires role '${roleName}' not defined in security block`,
-                loc: stmt.loc, code: 'W_AUTH_UNKNOWN_ROLE', category: 'auth',
-              });
-            }
-          }
-        }
-      }
-    }
-  }
+  // visitSecurityBlock, visitCliBlock, visitConcurrentBlock, visitSelectStatement,
+  // visitEdgeBlock, visitAuthBlock and their cross-block validators are in their
+  // respective *-analyzer.js files (lazy-loaded via plugins)
 
   // visitBrowserBlock and other browser visitors are in browser-analyzer.js (lazy-loaded)