@backbencher/brain 0.0.0-stage → 0.1.1

package/dist/regex-search-NJKHMZNO.js

@@ -0,0 +1,239 @@
+import {
+  readSymbolSnippet
+} from "./chunk-3CTFIJJB.js";
+import {
+  checkResultsFreshness
+} from "./chunk-QLK6ED4Q.js";
+import {
+  BrainDatabase
+} from "./chunk-QKTRECYS.js";
+import "./chunk-2BSKD7O3.js";
+import {
+  analysis_exclusions_exports
+} from "./chunk-SM7RFQRO.js";
+import "./chunk-L5TDYKYK.js";
+import "./chunk-ROMM6KMC.js";
+import "./chunk-MLKGABMK.js";
+
+// src/intelligence/search/regex-scan-worker.ts
+import { Worker, parentPort, workerData } from "worker_threads";
+function matchNames(request) {
+  const expression = new RegExp(request.pattern, request.caseSensitive ? "" : "i");
+  const matched = [];
+  const names = request.names;
+  for (let i = 0; i < names.length; i++) {
+    if (expression.test(names[i])) matched.push(i);
+  }
+  return matched;
+}
+if (parentPort && workerData && workerData.__regexScanWorker) {
+  const request = workerData.request;
+  try {
+    const matchedIndexes = matchNames(request);
+    parentPort.postMessage({ ok: true, matchedIndexes, scanned: request.names.length });
+  } catch (error) {
+    parentPort.postMessage({ ok: false, error: error?.message ?? String(error) });
+  }
+}
+function scanWithDeadline(request, timeoutMs) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let worker = null;
+    let budgetTimer = null;
+    const timers = [];
+    const finish = (outcome) => {
+      if (settled) return;
+      settled = true;
+      for (const timer of timers) clearTimeout(timer);
+      try {
+        worker?.terminate();
+      } catch {
+      }
+      resolve(outcome);
+    };
+    const runInline = () => {
+      if (settled) return;
+      try {
+        const matchedIndexes = matchNames(request);
+        finish({ matchedIndexes, scanned: request.names.length, timedOut: false, inline: true });
+      } catch {
+        finish({ matchedIndexes: [], scanned: 0, timedOut: false, inline: true });
+      }
+    };
+    try {
+      worker = new Worker(new URL(import.meta.url), {
+        workerData: { __regexScanWorker: true, request },
+        // A catastrophic regex can exhaust the stack, and an uncaught exception
+        // in a worker must not take the server with it.
+        stdout: true,
+        stderr: true
+      });
+    } catch {
+      runInline();
+      return;
+    }
+    const startBudget = () => {
+      if (settled || budgetTimer !== null) return;
+      budgetTimer = setTimeout(
+        () => finish({ matchedIndexes: [], scanned: 0, timedOut: true, inline: false }),
+        timeoutMs
+      );
+      timers.push(budgetTimer);
+    };
+    worker.on("online", startBudget);
+    worker.on("message", (message) => {
+      if (message?.ok) finish({ matchedIndexes: message.matchedIndexes, scanned: message.scanned, timedOut: false, inline: false });
+      else runInline();
+    });
+    worker.on("error", () => runInline());
+    worker.on("exit", () => {
+      if (!settled) runInline();
+    });
+    timers.push(
+      setTimeout(() => {
+        if (!settled && budgetTimer === null) runInline();
+      }, Math.max(1e3, timeoutMs))
+    );
+  });
+}
+
+// src/intelligence/search/regex-search.ts
+var REGEX_SCAN_CAP = 2e4;
+var REGEX_TIME_BUDGET_MS = 2e3;
+var PROJECTION_MAX = 5e4;
+var InvalidRegexError = class extends Error {
+  constructor(pattern, cause) {
+    super('invalid regex "' + pattern + '": ' + cause);
+    this.name = "InvalidRegexError";
+  }
+};
+function compileRegex(pattern, caseSensitive) {
+  try {
+    return new RegExp(pattern, caseSensitive ? "" : "i");
+  } catch (error) {
+    throw new InvalidRegexError(pattern, error instanceof Error ? error.message : String(error));
+  }
+}
+function compilePatternForTests(pattern, caseSensitive) {
+  return compileRegex(pattern, caseSensitive);
+}
+function normalizePageSize(value) {
+  if (value === void 0 || value === null) return 100;
+  const n = Math.trunc(Number(value));
+  if (!Number.isFinite(n) || n < 0) return 100;
+  return n;
+}
+function normalizeOffset(value) {
+  if (value === void 0 || value === null) return 0;
+  const n = Math.trunc(Number(value));
+  if (!Number.isFinite(n) || n < 0) return 0;
+  return n;
+}
+function compareCodeUnits(a, b) {
+  return a < b ? -1 : a > b ? 1 : 0;
+}
+async function searchRegex(projectId, rawPattern, options = {}) {
+  const pattern = String(rawPattern ?? "").trim();
+  const maxResults = normalizePageSize(options.maxResults);
+  const offset = normalizeOffset(options.offset);
+  if (!pattern) {
+    const empty = [];
+    empty.searchMode = "regex";
+    empty.staleCount = 0;
+    empty.freshCount = 0;
+    empty.totalMatches = 0;
+    return empty;
+  }
+  const expression = compileRegex(pattern, options.caseSensitive === true);
+  const raw = await BrainDatabase.getRawInstance(projectId, { readonly: true });
+  const params = [projectId];
+  let filters = "";
+  if (options.languages?.length) {
+    filters += " AND s.file_id IN (SELECT id FROM brain_file WHERE project_id = ? AND language COLLATE NOCASE IN (" + options.languages.map(() => "?").join(",") + "))";
+    params.push(projectId, ...options.languages);
+  }
+  if (options.symbolKind) {
+    filters += " AND s.symbol_type COLLATE NOCASE = ?";
+    params.push(options.symbolKind);
+  }
+  const workerExtraParams = [...params.slice(1)];
+  const candidates = raw.prepare(
+    "SELECT s.id AS id, s.name AS name FROM brain_symbol s WHERE s.project_id = ? AND COALESCE(s.line_start, 0) > 0 AND s.name NOT LIKE '/%/%'" + filters + " LIMIT ?"
+  ).all(...params, REGEX_SCAN_CAP + 1);
+  const rowCapReached = candidates.length > REGEX_SCAN_CAP;
+  const rows = rowCapReached ? candidates.slice(0, REGEX_SCAN_CAP) : candidates;
+  const scan = await scanWithDeadline(
+    { pattern, caseSensitive: options.caseSensitive === true, names: rows.map((row) => row.name) },
+    REGEX_TIME_BUDGET_MS
+  );
+  const timeBudgetReached = scan.timedOut;
+  const unisolated = scan.inline;
+  const matchedIds = scan.matchedIndexes.map((index) => rows[index].id);
+  const matched = [];
+  const PROJECTION_CHUNK = 500;
+  const projectionCapReached = matchedIds.length > PROJECTION_MAX;
+  const projectable = projectionCapReached ? matchedIds.slice(0, PROJECTION_MAX) : matchedIds;
+  const matchedRowCount = matchedIds.length;
+  for (let start = 0; start < projectable.length; start += PROJECTION_CHUNK) {
+    const chunk = projectable.slice(start, start + PROJECTION_CHUNK);
+    const rows2 = raw.prepare(
+      "SELECT s.id, s.file_id AS fileId, s.name, s.symbol_type AS symbolType, COALESCE(s.line_start, 0) AS line, COALESCE(s.line_end, 0) AS lineEnd, COALESCE(s.complexity, 0) AS complexity, f.relative_path AS relativePath, f.path AS filePath, COALESCE(f.language, 'unknown') AS language FROM brain_symbol s JOIN brain_file f ON f.id = s.file_id WHERE s.id IN (" + chunk.map(() => "?").join(",") + ")"
+    ).all(...chunk);
+    for (const row of rows2) {
+      if (analysis_exclusions_exports.isHardNoisePath(row.relativePath) || analysis_exclusions_exports.isNoiseSymbolName(row.name)) continue;
+      matched.push(row);
+    }
+  }
+  matched.sort(
+    (a, b) => (analysis_exclusions_exports.isTestPath(a.relativePath) ? 1 : 0) - (analysis_exclusions_exports.isTestPath(b.relativePath) ? 1 : 0) || b.complexity - a.complexity || compareCodeUnits(a.relativePath, b.relativePath) || compareCodeUnits(a.name, b.name)
+  );
+  const page = matched.slice(offset, offset + maxResults);
+  const results = [];
+  results.searchMode = "regex";
+  results.truncated = rowCapReached || timeBudgetReached || projectionCapReached;
+  const reasons = [];
+  if (rowCapReached) reasons.push("scan-cap");
+  if (timeBudgetReached) reasons.push("time-budget");
+  if (projectionCapReached) reasons.push("projection-cap");
+  if (unisolated) reasons.push("unisolated-scan");
+  if (reasons.length) results.truncationReason = reasons.join(",");
+  results.totalMatches = matchedRowCount;
+  results.rankedMatches = matched.length;
+  if (timeBudgetReached) results.scannedRows = rows.length;
+  for (const row of page) {
+    results.push({
+      file: row.relativePath,
+      fileId: row.fileId,
+      line: row.line,
+      column: 0,
+      context: row.symbolType + ": " + row.name,
+      symbolName: row.name,
+      symbolType: row.symbolType,
+      language: row.language,
+      matchType: "symbol",
+      snippet: options.includeContent ? await readSymbolSnippet(row.filePath, row.line, row.lineEnd) || row.name : row.name,
+      complexity: row.complexity,
+      _relevance: 1
+    });
+  }
+  try {
+    const freshness = checkResultsFreshness(raw, results.map((result) => ({ fileId: result.fileId })));
+    let staleCount = 0;
+    for (const result of results) {
+      if (["stale", "missing"].includes(freshness.get(result.fileId) ?? "")) {
+        result.stale = true;
+        staleCount++;
+      }
+    }
+    results.staleCount = staleCount;
+    results.freshCount = results.length - staleCount;
+  } catch {
+    results.freshnessError = true;
+  }
+  return results;
+}
+export {
+  InvalidRegexError,
+  compilePatternForTests,
+  searchRegex
+};

package/dist/rules-ACHPB7QU.js

@@ -0,0 +1,152 @@
+import {
+  BrainDatabase
+} from "./chunk-QKTRECYS.js";
+import "./chunk-2BSKD7O3.js";
+import {
+  nonCodeLanguageSQL
+} from "./chunk-SM7RFQRO.js";
+import "./chunk-L5TDYKYK.js";
+import "./chunk-ROMM6KMC.js";
+import "./chunk-MLKGABMK.js";
+
+// src/intelligence/patterns/rules.ts
+var COMPLEXITY_THRESHOLD = 15;
+var PARAMETER_THRESHOLD = 7;
+var GOD_CLASS_MEMBER_THRESHOLD = 10;
+async function detectIndexRules(projectId, options) {
+  const findings = [];
+  const raw = await BrainDatabase.getRawInstance(projectId, { readonly: true });
+  const budget = Math.max(0, options.maxResults);
+  const nonCode = nonCodeLanguageSQL("f");
+  const nonCodeClause = ` AND ${nonCode.sql}`;
+  if (options.includeAntiPatterns) {
+    const complex = raw.prepare(
+      "SELECT s.name, s.complexity, f.relative_path AS file, COALESCE(s.line_start, 0) AS line FROM brain_symbol s JOIN brain_file f ON f.id = s.file_id WHERE s.project_id = ? AND s.complexity IS NOT NULL AND s.complexity >= ?" + nonCodeClause + " ORDER BY s.complexity DESC, s.id"
+    ).all(projectId, COMPLEXITY_THRESHOLD, ...nonCode.params);
+    let shown = 0;
+    for (const row of complex) {
+      const confidence = Math.min(0.9, 0.5 + row.complexity / 100);
+      if (confidence < options.confidenceThreshold) continue;
+      if (shown >= budget) {
+        findings.push({
+          type: "high-complexity-function",
+          confidence,
+          location: { file: row.file, line: row.line, symbol: row.name },
+          description: `Function '${row.name}' has complexity ${row.complexity} (threshold ${COMPLEXITY_THRESHOLD}).`,
+          severity: "warning",
+          suggestion: "Split the function into smaller units and reduce nesting depth.",
+          evidence: [{ type: "indexed-complexity", description: `complexity=${row.complexity} (from brain_symbol.complexity)` }],
+          truncatedByDisplayLimit: true
+        });
+        continue;
+      }
+      shown++;
+      findings.push({
+        type: "high-complexity-function",
+        confidence,
+        location: { file: row.file, line: row.line, symbol: row.name },
+        description: `Function '${row.name}' has complexity ${row.complexity} (threshold ${COMPLEXITY_THRESHOLD}).`,
+        severity: "warning",
+        suggestion: "Split the function into smaller units and reduce nesting depth.",
+        evidence: [{ type: "indexed-complexity", description: `complexity=${row.complexity} (from brain_symbol.complexity)` }]
+      });
+    }
+    const paramRows = raw.prepare(
+      "SELECT s.name, s.parameters, f.relative_path AS file, COALESCE(s.line_start, 0) AS line, json_array_length(s.parameters) AS paramCount FROM brain_symbol s JOIN brain_file f ON f.id = s.file_id WHERE s.project_id = ? AND s.parameters IS NOT NULL AND s.parameters != '[]' AND json_valid(s.parameters) AND length(s.parameters) >= 17 AND json_array_length(s.parameters) > ?" + nonCodeClause + " ORDER BY s.id"
+    ).all(projectId, PARAMETER_THRESHOLD, ...nonCode.params);
+    let shownParams = 0;
+    for (const row of paramRows) {
+      const confidence = 0.7;
+      if (confidence < options.confidenceThreshold) continue;
+      const params = JSON.parse(row.parameters);
+      if (shownParams >= budget) {
+        findings.push({
+          type: "long-parameter-list",
+          confidence,
+          location: { file: row.file, line: row.line, symbol: row.name },
+          description: `Function '${row.name}' has ${row.paramCount} parameters (threshold ${PARAMETER_THRESHOLD}).`,
+          severity: "warning",
+          suggestion: "Group related parameters into a single options/configuration object.",
+          evidence: [{ type: "indexed-parameters", description: `parameters=${params.slice(0, 12).join(", ")}` }],
+          truncatedByDisplayLimit: true
+        });
+        continue;
+      }
+      shownParams++;
+      findings.push({
+        type: "long-parameter-list",
+        confidence,
+        location: { file: row.file, line: row.line, symbol: row.name },
+        description: `Function '${row.name}' has ${row.paramCount} parameters (threshold ${PARAMETER_THRESHOLD}).`,
+        severity: "warning",
+        suggestion: "Group related parameters into a single options/configuration object.",
+        evidence: [{ type: "indexed-parameters", description: `parameters=${params.slice(0, 12).join(", ")}` }]
+      });
+    }
+    const godClasses = raw.prepare(
+      "SELECT s.id, s.name, f.relative_path AS file, COALESCE(s.line_start, 0) AS line, (SELECT COUNT(*) FROM brain_symbol m WHERE m.owner_symbol_id = s.id) AS members FROM brain_symbol s JOIN brain_file f ON f.id = s.file_id WHERE s.project_id = ? AND s.symbol_type IN ('class','interface','struct','trait','enum') AND (SELECT COUNT(*) FROM brain_symbol m WHERE m.owner_symbol_id = s.id) > ?" + nonCodeClause + " ORDER BY members DESC, s.id"
+    ).all(projectId, GOD_CLASS_MEMBER_THRESHOLD, ...nonCode.params);
+    let shownGod = 0;
+    for (const row of godClasses) {
+      const confidence = Math.min(0.9, 0.5 + row.members / 40);
+      if (confidence < options.confidenceThreshold) continue;
+      const finding = {
+        type: "god-class",
+        confidence,
+        location: { file: row.file, line: row.line, symbol: row.name },
+        description: `Type '${row.name}' has ${row.members} direct members (threshold ${GOD_CLASS_MEMBER_THRESHOLD}).`,
+        severity: "warning",
+        suggestion: "Split the type by responsibility; extract cohesive subsets into focused types.",
+        evidence: [{ type: "indexed-members", description: `direct members=${row.members} (via owner_symbol_id)` }]
+      };
+      if (shownGod >= budget) {
+        finding.truncatedByDisplayLimit = true;
+        findings.push(finding);
+        continue;
+      }
+      shownGod++;
+      findings.push(finding);
+    }
+  }
+  if (options.includeFramework) {
+    const frameworks = raw.prepare(
+      "SELECT framework_type, COUNT(*) c FROM brain_file WHERE project_id = ? AND framework_type IS NOT NULL AND framework_type NOT IN ('', 'unknown') GROUP BY framework_type ORDER BY c DESC, framework_type"
+    ).all(projectId);
+    let shownFw = 0;
+    for (const fw of frameworks) {
+      const confidence = 0.6;
+      if (confidence < options.confidenceThreshold) continue;
+      if (shownFw >= budget && budget > 0 && frameworks.length > budget) {
+        findings.push({
+          type: "framework-detected",
+          confidence: 0.6,
+          location: { file: "", line: 0 },
+          description: `Framework '${fw.framework_type}' detected in ${fw.c} indexed file(s).`,
+          severity: "info",
+          suggestion: "Framework usage is static index evidence; verify actual runtime wiring before drawing conclusions.",
+          evidence: [],
+          truncatedByDisplayLimit: true
+        });
+        continue;
+      }
+      shownFw++;
+      const files = raw.prepare(
+        "SELECT relative_path FROM brain_file WHERE project_id = ? AND framework_type = ? LIMIT 10"
+      ).all(projectId, fw.framework_type);
+      const first = files[0];
+      findings.push({
+        type: "framework-detected",
+        confidence: 0.6,
+        location: { file: first?.relative_path ?? "", line: 0 },
+        description: `Framework '${fw.framework_type}' detected in ${fw.c} indexed file(s).`,
+        severity: "info",
+        suggestion: "Framework usage is static index evidence; verify actual runtime wiring before drawing conclusions.",
+        evidence: files.slice(0, 5).map((f) => ({ type: "indexed-file", description: f.relative_path }))
+      });
+    }
+  }
+  return findings;
+}
+export {
+  detectIndexRules
+};

package/dist/scoped-path-MJYWJZQX.js

@@ -0,0 +1,11 @@
+import {
+  canonicalProjectRoot,
+  describeScopedPathRefusal,
+  resolveScopedProjectFile
+} from "./chunk-D2Q4Y47A.js";
+import "./chunk-MLKGABMK.js";
+export {
+  canonicalProjectRoot,
+  describeScopedPathRefusal,
+  resolveScopedProjectFile
+};

package/dist/setup-show-NT5ZHYNE.js

@@ -0,0 +1,15 @@
+import {
+  describeEmbeddingConfig,
+  renderSetupShow
+} from "./chunk-DWKXZ6IF.js";
+import "./chunk-2RRBMNBQ.js";
+import "./chunk-B5GEAAYF.js";
+import "./chunk-7AN7U5IZ.js";
+import "./chunk-UGR4QIGS.js";
+import "./chunk-BQ3OVQ3P.js";
+import "./chunk-2BSKD7O3.js";
+import "./chunk-MLKGABMK.js";
+export {
+  describeEmbeddingConfig,
+  renderSetupShow
+};

package/dist/setup-wizard-G5YYR5T6.js

@@ -0,0 +1,24 @@
+import {
+  PROVIDERS,
+  fingerprintKey,
+  fixConfigMode,
+  hasEmbeddingConfig,
+  mapValidationError,
+  maybeRunFirstRunSetup,
+  runSetupWizard,
+  saveEmbeddingConfig,
+  validateKey
+} from "./chunk-2RRBMNBQ.js";
+import "./chunk-2BSKD7O3.js";
+import "./chunk-MLKGABMK.js";
+export {
+  PROVIDERS,
+  fingerprintKey,
+  fixConfigMode,
+  hasEmbeddingConfig,
+  mapValidationError,
+  maybeRunFirstRunSetup,
+  runSetupWizard,
+  saveEmbeddingConfig,
+  validateKey
+};

package/dist/symbol-search-GZJIM2J2.js

@@ -0,0 +1,16 @@
+import {
+  searchSymbols,
+  symbolSearchPhases
+} from "./chunk-AHDWGM7Q.js";
+import "./chunk-3CTFIJJB.js";
+import "./chunk-QLK6ED4Q.js";
+import "./chunk-QKTRECYS.js";
+import "./chunk-2BSKD7O3.js";
+import "./chunk-SM7RFQRO.js";
+import "./chunk-L5TDYKYK.js";
+import "./chunk-ROMM6KMC.js";
+import "./chunk-MLKGABMK.js";
+export {
+  searchSymbols,
+  symbolSearchPhases
+};

package/dist/taint-KXUHHPIE.js

@@ -0,0 +1,202 @@
+import {
+  makeProvenance
+} from "./chunk-UUNHHX4M.js";
+import {
+  BrainDatabase
+} from "./chunk-QKTRECYS.js";
+import "./chunk-2BSKD7O3.js";
+import "./chunk-ROMM6KMC.js";
+import "./chunk-MLKGABMK.js";
+
+// src/intelligence/security/taint.ts
+var ENGINE = "taint@intelligence";
+var VULN_ALIASES = {
+  sqli: "sql_injection",
+  sql: "sql_injection",
+  "sql-injection": "sql_injection",
+  cmd_injection: "command_injection",
+  cmdi: "command_injection",
+  rce: "code_injection",
+  xss_reflected: "xss",
+  xss_stored: "xss",
+  path_traversal: "path_traversal",
+  lfi: "path_traversal",
+  pii: "pii_leak"
+};
+var VULN_LABELS = {
+  sql_injection: "SQL injection",
+  command_injection: "Command injection",
+  code_injection: "Code injection",
+  xss: "Cross-site scripting (XSS)",
+  path_traversal: "Path traversal",
+  ssrf: "Server-side request forgery (SSRF)",
+  open_redirect: "Open redirect",
+  weak_crypto: "Weak cryptography",
+  insecure_deserialization: "Insecure deserialization",
+  pii_leak: "PII leak"
+};
+function normalizeType(t) {
+  const key = (t ?? "unknown").toLowerCase();
+  return VULN_ALIASES[key] ?? key;
+}
+var SEVERITIES = ["critical", "high", "medium", "low", "unknown"];
+function normalizeSeverity(value) {
+  const key = typeof value === "string" ? value.trim().toLowerCase() : "";
+  return SEVERITIES.includes(key) ? key : "unknown";
+}
+function severityRank(s) {
+  return { critical: 0, high: 1, medium: 2, low: 3, unknown: 4 }[s];
+}
+function parseFlowPath(value) {
+  if (Array.isArray(value)) return value.filter(Boolean).map(String);
+  if (typeof value !== "string" || !value) return [];
+  const trimmed = value.trim();
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (Array.isArray(parsed)) return parsed.filter(Boolean).map(String);
+  } catch {
+  }
+  if (trimmed.includes("|||")) return trimmed.split("|||").filter(Boolean);
+  return trimmed ? [trimmed] : [];
+}
+async function analyzeTaintFlows(projectId, options = {}) {
+  const raw = await BrainDatabase.getRawInstance(projectId, { readonly: true });
+  const minConfidence = options.minConfidence ?? 0;
+  const includeMitigated = options.includeMitigated ?? true;
+  const includeUnresolved = options.includeUnresolved ?? true;
+  const maxResults = options.maxResults ?? 500;
+  const rows = raw.prepare(
+    "SELECT t.id, t.vulnerability_type, t.severity, t.source_type, t.sink_type, t.is_mitigated, t.flow_path, t.cross_language_boundaries, t.source_symbol_id, t.sink_symbol_id, src.name AS src_name, src.line_start AS src_line, srcf.relative_path AS src_file, srcf.language AS src_lang, snk.name AS snk_name, snk.line_start AS snk_line, snkf.relative_path AS snk_file, snkf.language AS snk_lang FROM brain_taint_flow t LEFT JOIN brain_symbol src ON src.id = t.source_symbol_id LEFT JOIN brain_file srcf ON srcf.id = src.file_id LEFT JOIN brain_symbol snk ON snk.id = t.sink_symbol_id LEFT JOIN brain_file snkf ON snkf.id = snk.file_id WHERE t.project_id = ? ORDER BY t.id"
+  ).all(projectId);
+  const pathCache = new Array(rows.length);
+  const neededIds = /* @__PURE__ */ new Set();
+  for (let i = 0; i < rows.length; i++) {
+    const r = rows[i];
+    if (r.source_symbol_id) neededIds.add(r.source_symbol_id);
+    if (r.sink_symbol_id) neededIds.add(r.sink_symbol_id);
+    const path = parseFlowPath(r.flow_path);
+    pathCache[i] = path;
+    for (const id of path) neededIds.add(id);
+  }
+  const symById = /* @__PURE__ */ new Map();
+  const ids = [...neededIds];
+  const CHUNK = 500;
+  for (let i = 0; i < ids.length; i += CHUNK) {
+    const chunk = ids.slice(i, i + CHUNK);
+    const stmt = "SELECT s.id, s.project_id, s.name, s.line_start AS line, f.relative_path AS file FROM brain_symbol s LEFT JOIN brain_file f ON f.id = s.file_id WHERE s.id IN (" + chunk.map(() => "?").join(",") + ")";
+    for (const s of raw.prepare(stmt).all(...chunk)) {
+      if (s.project_id !== projectId) continue;
+      symById.set(s.id, { name: s.name, file: s.file, line: s.line });
+    }
+  }
+  const resolveNode = (symbolId) => {
+    if (!symbolId) return { symbolId: null, name: null, file: null, line: null };
+    const meta = symById.get(symbolId);
+    if (meta) return { symbolId, name: meta.name, file: meta.file, line: meta.line };
+    const parts = symbolId.split(":");
+    return { symbolId, name: parts.length >= 3 ? parts[parts.length - 2] : symbolId, file: null, line: null };
+  };
+  const findingByKey = /* @__PURE__ */ new Map();
+  let scannedFlows = 0;
+  for (let rowIndex = 0; rowIndex < rows.length; rowIndex++) {
+    const row = rows[rowIndex];
+    scannedFlows++;
+    const vulnerabilityType = normalizeType(row.vulnerability_type);
+    const severity = normalizeSeverity(row.severity);
+    const source = resolveNode(row.source_symbol_id);
+    const sink = resolveNode(row.sink_symbol_id);
+    const path = (pathCache[rowIndex] ?? []).map(resolveNode);
+    const mitigated = !!row.is_mitigated;
+    const sourceResolved = !!row.source_symbol_id && !!source.file;
+    const sinkResolved = !!row.sink_symbol_id && !!sink.file;
+    const state = !sinkResolved ? "source_only" : !sourceResolved ? "unresolved" : mitigated ? "mitigated" : "confirmed";
+    if (!includeMitigated && state === "mitigated") continue;
+    if (!includeUnresolved && (state === "unresolved" || state === "source_only")) continue;
+    const confidence = state === "confirmed" ? 0.7 : state === "mitigated" ? 0.3 : 0.4;
+    if (confidence < minConfidence) continue;
+    const file = sink.file ?? source.file;
+    const line = sink.line ?? source.line;
+    const symbol = sink.name ?? source.name;
+    const language = row.snk_lang ?? row.src_lang ?? null;
+    const key = `${vulnerabilityType}|${row.sink_symbol_id ?? ""}|${row.sink_type ?? ""}|${file ?? ""}:${line ?? ""}|${state}`;
+    const existing = findingByKey.get(key);
+    if (existing) {
+      if (path.length > existing.path.length) existing.path = path;
+      continue;
+    }
+    findingByKey.set(key, {
+      id: row.id,
+      vulnerabilityType,
+      label: VULN_LABELS[vulnerabilityType] ?? vulnerabilityType,
+      severity,
+      confidence,
+      state,
+      file,
+      line,
+      symbol,
+      language,
+      sourceType: row.source_type ?? null,
+      sinkType: row.sink_type ?? null,
+      source,
+      sink,
+      path,
+      crossLanguage: (row.cross_language_boundaries ?? 0) > 0,
+      mitigated,
+      evidence: [
+        { kind: "taint_flow", description: `${row.source_type ?? "source"} -> ${row.sink_type ?? "sink"} taint flow (${state})` }
+      ],
+      limitations: [
+        "Flows are indexer heuristics; parameterized/escaped sinks may still be reported.",
+        state === "source_only" ? "Source-only observation: no confirmed sink flow." : "",
+        state === "unresolved" ? "One endpoint could not be resolved to an indexed symbol." : "",
+        state === "mitigated" && (!sourceResolved || !sinkResolved) ? "Mitigation flag is not trusted until both endpoints resolve." : ""
+      ].filter(Boolean)
+    });
+  }
+  let findings = Array.from(findingByKey.values());
+  findings.sort(
+    (a, b) => severityRank(a.severity) - severityRank(b.severity) || b.confidence - a.confidence || (a.file ?? "").localeCompare(b.file ?? "") || a.id.localeCompare(b.id)
+  );
+  const deduplicatedFlows = findings.length;
+  const truncatedFindings = Math.max(0, deduplicatedFlows - maxResults);
+  findings = findings.slice(0, maxResults);
+  const bySeverity = {};
+  const byType = {};
+  const byState = { confirmed: 0, mitigated: 0, unresolved: 0, source_only: 0 };
+  let crossLanguage = 0;
+  for (const f of findings) {
+    bySeverity[f.severity] = (bySeverity[f.severity] ?? 0) + 1;
+    byType[f.vulnerabilityType] = (byType[f.vulnerabilityType] ?? 0) + 1;
+    byState[f.state]++;
+    if (f.crossLanguage) crossLanguage++;
+  }
+  const fileCounts = /* @__PURE__ */ new Map();
+  const symCounts = /* @__PURE__ */ new Map();
+  const worse = (a, b) => severityRank(a) <= severityRank(b) ? a : b;
+  for (const f of findings) {
+    if (f.file) {
+      const cur = fileCounts.get(f.file) ?? { n: 0, sev: "unknown" };
+      fileCounts.set(f.file, { n: cur.n + 1, sev: worse(cur.sev, f.severity) });
+    }
+    if (f.symbol) {
+      const key = f.file ? `${f.file}::${f.symbol}` : `::${f.symbol}`;
+      const cur = symCounts.get(key) ?? { n: 0, sev: "unknown", name: f.symbol };
+      symCounts.set(key, { n: cur.n + 1, sev: worse(cur.sev, f.severity), name: cur.name });
+    }
+  }
+  const hotspots = [
+    ...Array.from(fileCounts.entries()).map(([key, v]) => ({ key, kind: "file", findings: v.n, maxSeverity: v.sev })),
+    // The KEY is the qualified form (that is the identity); `name` carries the
+    // bare symbol for a reader who wants to search on it.
+    ...Array.from(symCounts.entries()).map(([key, v]) => ({ key, kind: "symbol", name: v.name, findings: v.n, maxSeverity: v.sev }))
+  ].sort((a, b) => b.findings - a.findings || severityRank(a.maxSeverity) - severityRank(b.maxSeverity)).slice(0, 20);
+  return {
+    findings,
+    summary: { total: findings.length, bySeverity, byType, byState, crossLanguage, scannedFlows, deduplicatedFlows, truncatedFindings },
+    hotspots,
+    provenance: makeProvenance({ evidenceClass: "static_finding", engine: ENGINE, engineVersion: "m10.02", projectId, source: "brain_taint_flow", limitations: ["Static taint flows can contain false positives and false negatives and are not runtime exploit proofs."], truncated: truncatedFindings > 0, unknowns: truncatedFindings > 0 ? [`${truncatedFindings} deduplicated finding(s) omitted by the maxResults cap (${maxResults}); summary counts describe the returned window, deduplicatedFlows is the pre-cap census`] : [] })
+  };
+}
+export {
+  analyzeTaintFlows
+};