circle-ir-ai 1.8.0 → 1.13.0

package/CHANGELOG.md

@@ -5,6 +5,116 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.13.0] - 2026-03-28
+
+### Changed
+
+- **Phase 4 Completion: Dedup Performance Passes + Surface Circle-IR Findings**
+  - Replaced P30-P32 (blocking-main-thread, excessive-allocation, missing-stream) with **CircleIR findings adapter** — zero-cost extraction from `ir.findings` instead of redundant re-analysis
+  - Added **god-class** and **naming-convention** trust passes via findings adapter (surfacing circle-ir 3.14.0 passes #39, #40)
+  - New generic `adaptCircleIRFindings()` function for converting circle-ir `SastFinding[]` → `TrustPassResult`
+  - Removed ~300 LOC of redundant P30-P32 analysis logic
+  - 10 new tests in `tests/circlir-findings-adapter.test.ts`
+
+- Trust score now has 26 passes (24 → 26)
+- PASS_CATEGORY_MAP expanded from 29 to 31 entries
+- PASS_COMPONENT_MAP expanded from 25 to 27 entries
+
+## [1.12.0] - 2026-03-28
+
+### Added
+
+- **Phase 3 Completion: LLM-Enhanced Replacement Passes**
+  - **missing-guard-dom** (`src/trust/passes/missing-guard-dom.ts`): LLM-enhanced auth guard dominator analysis. Uses `DominatorGraph` from circle-ir to verify sensitive operations are dominated by auth checks. Recognizes annotation-based guards (`@PreAuthorize`, `@Secured`, `@RolesAllowed`, `@login_required`). Optional LLM to detect framework-level guards (Spring Security, middleware). Regex fallback for non-CircleIR mode.
+  - **feature-envy** (`src/trust/passes/feature-envy.ts`): LLM-enhanced design intent detection. Same call-count heuristic as circle-ir (external ≥ 4, margin > 2) with static filters for delegation patterns (Controller, Facade, Service, Handler classes; handle*, delegate*, process* methods). Optional LLM to distinguish true envy from legitimate orchestration.
+  - 16 new tests across 2 test files
+  - Upgraded `circle-ir` from 3.12.0 to 3.14.0 (removed passes now replaced by circle-ir-ai)
+
+### Changed
+
+- Trust score now has 24 passes (22 → 24)
+- PASS_CATEGORY_MAP expanded from 27 to 29 entries
+- PASS_COMPONENT_MAP expanded from 23 to 25 entries
+
+## [1.11.0] - 2026-03-28
+
+### Added
+
+- **Phase 4: Performance Trust Passes (P30-P33)**
+  - **P30 blocking-main-thread** (`src/trust/passes/performance-passes.ts`): Detects sync I/O calls (readFileSync, execSync, etc.) in async contexts. CircleIR-first with regex fallback. Severity: high in async, medium otherwise.
+  - **P31 excessive-allocation**: Detects object allocation (`new ...()`) inside hot loops. CircleIR mode uses CFG loop blocks + constructor calls. Nested loops → high severity.
+  - **P32 missing-stream**: Detects readFile/readFileSync usage without streaming alternatives (createReadStream/pipeline/pipe). Severity: medium.
+  - **P33 cache-invalidation**: Detects cache-like Map/Set variables without delete/clear/TTL patterns. Severity: low.
+  - **performance_score** component added to TrustScoreResult (13 total score components)
+  - 14 new tests in `tests/performance-passes.test.ts`
+
+### Changed
+
+- Trust score now has 22 passes (18 → 22) with 13 score components (12 → 13)
+- PASS_CATEGORY_MAP expanded from 23 to 27 entries
+- PASS_COMPONENT_MAP expanded from 19 to 23 entries
+
+## [1.10.0] - 2026-03-28
+
+### Added
+
+- **Phase 3: LLM Infrastructure + Passes**
+  - **Classification Cache** (`src/cache/classification-cache.ts`): LLM result caching with composite key (content + classifier), 24h TTL, hit/miss tracking
+  - **CGS Serializer** (`src/llm/cgs-serializer.ts`): Compact Graph Summary — serialize CircleIR to compact text for LLM prompts (~85% token reduction), priority-based budget allocation
+  - **A2 Tool-Poisoning Pass** (`src/trust/passes/tool-poisoning.ts`): Detect undeclared tool behavior (network, exec, file_write) by comparing tool schemas vs actual code. Static heuristics + optional LLM. Graceful degradation without schemas.
+  - **A3 AI-Generated Fingerprint Pass** (`src/trust/passes/ai-generated-fingerprint.ts`): 7-signal heuristic detector for LLM-generated code (over-commenting, generic naming, placeholders, uniform formatting, excessive docstrings, boilerplate, repetitive structure)
+  - **Batch Classifier** (`src/llm/batch-classifier.ts`): Orchestrates multiple LLM classification passes with p-queue concurrency, classification cache, CGS integration, Zod validation. Graceful degradation without LLM.
+  - **5 Doc/Pattern LLM Passes** (`src/llm/doc-pattern-passes.ts`): doc-param-mismatch, return-type-mismatch, doc-wrong-behavior, inconsistent-error-handling, magic-numbers. All with LLM + static fallback where applicable.
+  - **2 new score components**: `poisoning_score` and `provenance_score` added to TrustScoreResult (12 total)
+  - **23 new pass registrations**: 7 passes added to PASS_CATEGORY_MAP and PASS_COMPONENT_MAP
+  - **Trust CLI updated**: 2 new Sprint 6 passes (tool-poisoning, ai-generated-fingerprint) in trust command output
+
+### Changed
+
+- Trust score now has 18 passes (16 → 18) with 12 score components (10 → 12)
+- PASS_CATEGORY_MAP expanded from 16 to 23 entries
+- PASS_COMPONENT_MAP expanded from 12 to 19 entries
+
+## [1.9.0] - 2026-03-28
+
+### Changed
+
+- **Major dependency upgrades:**
+  - `circle-ir` 3.9.7 → 3.12.0 (36-pass pipeline, TypeHierarchy, DominatorGraph)
+  - `@ax-llm/ax` 16.0.13 → 19.0.37
+  - `@mastra/core` 1.1.0 → 1.17.0
+  - `typescript` 5.9.3 → 6.0.2 (target ES2025, types: ["node"])
+  - `vitest` 3.2.4 → 4.1.2
+  - `@vitest/coverage-v8` 3.2.4 → 4.1.2
+  - `@types/node` 25.1.0 → 25.5.0
+  - `tsx` 4.19.0 → 4.21.0
+  - `web-tree-sitter` 0.26.6 → 0.26.7
+
+### Fixed
+
+- TypeScript 6.0 compatibility: added explicit `types: ["node"]` to tsconfig.json (TS6 defaults types to `[]`)
+
+### Benchmark Improvements
+
+- **OWASP Benchmark**: 97.4% → **100.0%** (1415/1415 perfect) — circle-ir 3.12 fixed all 37 command injection false negatives
+- **Rust Benchmark**: expanded from 30 to 50 tests, TPR improved from 77.8% to 86.5%
+
+## [1.8.0] - 2026-03-27
+
+### Added
+
+- **Trust Score v2**: Weighted category-based scoring engine (supply_chain, code_security, ai_safety, compliance, artifacts)
+- **EU AI Act Flags pass**: Static analysis for EU AI Act compliance indicators (Art. 9, 10, 12, 13, 14)
+- **Compare CLI command**: Compare trust scores between two codebases with delta analysis
+- **Quality Score engine**: 5-pass quality scoring (code complexity, test coverage, documentation, maintainability, performance)
+- **Trust scoring module** (`src/trust/scoring.ts`): configurable weights, 10 score components, tier derivation
+- **Trust comparison** (`src/trust/compare.ts`): finding diff, trend detection (improved/degraded/stable)
+
+### Changed
+
+- Trust score now uses weighted categories instead of simple average across passes
+- `circle-ir` upgraded from 3.9.7 to 3.11.0
+
 ## [1.3.0] - 2026-03-08
 
 ### Added

package/dist/agents/mastra/agents.d.ts

@@ -30,11 +30,11 @@ export declare const enrichmentAgent: Agent<"enrichment-agent", {
         methodCode: string;
     }, {
         sources: {
-            line: number;
-            variable: string;
-            type: string;
             confidence: number;
             reasoning: string;
+            type: string;
+            line: number;
+            variable: string;
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
     discoverSinks: import("@mastra/core/tools").Tool<{
@@ -44,13 +44,13 @@ export declare const enrichmentAgent: Agent<"enrichment-agent", {
         methodCode: string;
     }, {
         sinks: {
+            confidence: number;
+            reasoning: string;
+            type: string;
             line: number;
             method: string;
-            type: string;
             cwe: string;
             argPositions: number[];
-            confidence: number;
-            reasoning: string;
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
 }, undefined, unknown>;
@@ -74,9 +74,9 @@ export declare const verificationAgent: Agent<"verification-agent", {
         sinkType: string;
         sanitizersInPath: string[];
     }, {
-        verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
         confidence: number;
         reasoning: string;
+        verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
         exploitability: "high" | "medium" | "low" | "none";
         sanitizersFound: string[];
         attackVector: string;
@@ -100,13 +100,13 @@ export declare const crossFileAgent: Agent<"cross-file-agent", {
         targetCode: string;
         importedSymbols: string[];
     }, {
-        taintFlows: Array<{
+        reasoning: string;
+        taintFlows: {
+            confidence: number;
             sourceSymbol: string;
             targetSymbol: string;
             flowType: "direct" | "transitive" | "conditional";
-            confidence: number;
-        }>;
-        reasoning: string;
+        }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
 }, undefined, unknown>;
 /**
@@ -133,11 +133,11 @@ export declare const orchestratorAgent: Agent<"orchestrator-agent", {
         methodCode: string;
     }, {
         sources: {
-            line: number;
-            variable: string;
-            type: string;
             confidence: number;
             reasoning: string;
+            type: string;
+            line: number;
+            variable: string;
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
     discoverSinks: import("@mastra/core/tools").Tool<{
@@ -147,13 +147,13 @@ export declare const orchestratorAgent: Agent<"orchestrator-agent", {
         methodCode: string;
     }, {
         sinks: {
+            confidence: number;
+            reasoning: string;
+            type: string;
             line: number;
             method: string;
-            type: string;
             cwe: string;
             argPositions: number[];
-            confidence: number;
-            reasoning: string;
         }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
     verifyVulnerability: import("@mastra/core/tools").Tool<{
@@ -169,9 +169,9 @@ export declare const orchestratorAgent: Agent<"orchestrator-agent", {
         sinkType: string;
         sanitizersInPath: string[];
     }, {
-        verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
         confidence: number;
         reasoning: string;
+        verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
         exploitability: "high" | "medium" | "low" | "none";
         sanitizersFound: string[];
         attackVector: string;
@@ -188,13 +188,13 @@ export declare const orchestratorAgent: Agent<"orchestrator-agent", {
         targetCode: string;
         importedSymbols: string[];
     }, {
-        taintFlows: Array<{
+        reasoning: string;
+        taintFlows: {
+            confidence: number;
             sourceSymbol: string;
             targetSymbol: string;
             flowType: "direct" | "transitive" | "conditional";
-            confidence: number;
-        }>;
-        reasoning: string;
+        }[];
     }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
 }, undefined, unknown>;
 export declare const agents: {
@@ -217,11 +217,11 @@ export declare const agents: {
             methodCode: string;
         }, {
             sources: {
-                line: number;
-                variable: string;
-                type: string;
                 confidence: number;
                 reasoning: string;
+                type: string;
+                line: number;
+                variable: string;
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
         discoverSinks: import("@mastra/core/tools").Tool<{
@@ -231,13 +231,13 @@ export declare const agents: {
             methodCode: string;
         }, {
             sinks: {
+                confidence: number;
+                reasoning: string;
+                type: string;
                 line: number;
                 method: string;
-                type: string;
                 cwe: string;
                 argPositions: number[];
-                confidence: number;
-                reasoning: string;
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
     }, undefined, unknown>;
@@ -255,9 +255,9 @@ export declare const agents: {
             sinkType: string;
             sanitizersInPath: string[];
         }, {
-            verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
             confidence: number;
             reasoning: string;
+            verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
             exploitability: "high" | "medium" | "low" | "none";
             sanitizersFound: string[];
             attackVector: string;
@@ -276,13 +276,13 @@ export declare const agents: {
             targetCode: string;
             importedSymbols: string[];
         }, {
-            taintFlows: Array<{
+            reasoning: string;
+            taintFlows: {
+                confidence: number;
                 sourceSymbol: string;
                 targetSymbol: string;
                 flowType: "direct" | "transitive" | "conditional";
-                confidence: number;
-            }>;
-            reasoning: string;
+            }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
     }, undefined, unknown>;
     orchestrator: Agent<"orchestrator-agent", {
@@ -304,11 +304,11 @@ export declare const agents: {
             methodCode: string;
         }, {
             sources: {
-                line: number;
-                variable: string;
-                type: string;
                 confidence: number;
                 reasoning: string;
+                type: string;
+                line: number;
+                variable: string;
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
         discoverSinks: import("@mastra/core/tools").Tool<{
@@ -318,13 +318,13 @@ export declare const agents: {
             methodCode: string;
         }, {
             sinks: {
+                confidence: number;
+                reasoning: string;
+                type: string;
                 line: number;
                 method: string;
-                type: string;
                 cwe: string;
                 argPositions: number[];
-                confidence: number;
-                reasoning: string;
             }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
         verifyVulnerability: import("@mastra/core/tools").Tool<{
@@ -340,9 +340,9 @@ export declare const agents: {
             sinkType: string;
             sanitizersInPath: string[];
         }, {
-            verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
             confidence: number;
             reasoning: string;
+            verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
             exploitability: "high" | "medium" | "low" | "none";
             sanitizersFound: string[];
             attackVector: string;
@@ -359,13 +359,13 @@ export declare const agents: {
             targetCode: string;
             importedSymbols: string[];
         }, {
-            taintFlows: Array<{
+            reasoning: string;
+            taintFlows: {
+                confidence: number;
                 sourceSymbol: string;
                 targetSymbol: string;
                 flowType: "direct" | "transitive" | "conditional";
-                confidence: number;
-            }>;
-            reasoning: string;
+            }[];
         }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
     }, undefined, unknown>;
 };

package/dist/agents/mastra/instance.d.ts

@@ -39,11 +39,11 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 methodCode: string;
             }, {
                 sources: {
-                    line: number;
-                    variable: string;
-                    type: string;
                     confidence: number;
                     reasoning: string;
+                    type: string;
+                    line: number;
+                    variable: string;
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
             discoverSinks: import("@mastra/core/tools").Tool<{
@@ -53,13 +53,13 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 methodCode: string;
             }, {
                 sinks: {
+                    confidence: number;
+                    reasoning: string;
+                    type: string;
                     line: number;
                     method: string;
-                    type: string;
                     cwe: string;
                     argPositions: number[];
-                    confidence: number;
-                    reasoning: string;
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
         }, undefined, unknown>;
@@ -77,9 +77,9 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 sinkType: string;
                 sanitizersInPath: string[];
             }, {
-                verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
                 confidence: number;
                 reasoning: string;
+                verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
                 exploitability: "high" | "medium" | "low" | "none";
                 sanitizersFound: string[];
                 attackVector: string;
@@ -98,13 +98,13 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 targetCode: string;
                 importedSymbols: string[];
             }, {
-                taintFlows: Array<{
+                reasoning: string;
+                taintFlows: {
+                    confidence: number;
                     sourceSymbol: string;
                     targetSymbol: string;
                     flowType: "direct" | "transitive" | "conditional";
-                    confidence: number;
-                }>;
-                reasoning: string;
+                }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
         }, undefined, unknown>;
         orchestrator: import("@mastra/core/agent").Agent<"orchestrator-agent", {
@@ -126,11 +126,11 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 methodCode: string;
             }, {
                 sources: {
-                    line: number;
-                    variable: string;
-                    type: string;
                     confidence: number;
                     reasoning: string;
+                    type: string;
+                    line: number;
+                    variable: string;
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
             discoverSinks: import("@mastra/core/tools").Tool<{
@@ -140,13 +140,13 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 methodCode: string;
             }, {
                 sinks: {
+                    confidence: number;
+                    reasoning: string;
+                    type: string;
                     line: number;
                     method: string;
-                    type: string;
                     cwe: string;
                     argPositions: number[];
-                    confidence: number;
-                    reasoning: string;
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
             verifyVulnerability: import("@mastra/core/tools").Tool<{
@@ -162,9 +162,9 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 sinkType: string;
                 sanitizersInPath: string[];
             }, {
-                verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
                 confidence: number;
                 reasoning: string;
+                verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
                 exploitability: "high" | "medium" | "low" | "none";
                 sanitizersFound: string[];
                 attackVector: string;
@@ -181,16 +181,16 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 targetCode: string;
                 importedSymbols: string[];
             }, {
-                taintFlows: Array<{
+                reasoning: string;
+                taintFlows: {
+                    confidence: number;
                     sourceSymbol: string;
                     targetSymbol: string;
                     flowType: "direct" | "transitive" | "conditional";
-                    confidence: number;
-                }>;
-                reasoning: string;
+                }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
         }, undefined, unknown>;
-    }, Record<string, import("@mastra/core/workflows").Workflow<any, any, any, any, any, any, any, unknown>>, Record<string, import("@mastra/core/vector").MastraVector<any>>, Record<string, import("@mastra/core/tts").MastraTTS>, import("@mastra/core/logger").IMastraLogger, Record<string, import("@mastra/core/mcp").MCPServerBase<any>>, Record<string, import("@mastra/core/evals").MastraScorer<any, any, any, any>>, Record<string, import("@mastra/core/tools").ToolAction<any, any, any, any, any, any, unknown>>, Record<string, import("@mastra/core/processors").Processor<any, unknown>>, Record<string, import("@mastra/core/memory").MastraMemory>>;
+    }, Record<string, import("@mastra/core/workflows").AnyWorkflow>, Record<string, import("@mastra/core/vector").MastraVector<any>>, Record<string, import("@mastra/core/tts").MastraTTS>, import("@mastra/core/logger").IMastraLogger, Record<string, import("@mastra/core/mcp").MCPServerBase<any>>, Record<string, import("@mastra/core/evals").MastraScorer<any, any, any, any>>, Record<string, import("@mastra/core/tools").ToolAction<any, any, any, any, any, any, unknown>>, Record<string, import("@mastra/core/processors").Processor<any, unknown>>, Record<string, import("@mastra/core/memory").MastraMemory>>;
     agents: {
         enrichment: import("@mastra/core/agent").Agent<"enrichment-agent", {
             classifyRole: import("@mastra/core/tools").Tool<{
@@ -211,11 +211,11 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 methodCode: string;
             }, {
                 sources: {
-                    line: number;
-                    variable: string;
-                    type: string;
                     confidence: number;
                     reasoning: string;
+                    type: string;
+                    line: number;
+                    variable: string;
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
             discoverSinks: import("@mastra/core/tools").Tool<{
@@ -225,13 +225,13 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 methodCode: string;
             }, {
                 sinks: {
+                    confidence: number;
+                    reasoning: string;
+                    type: string;
                     line: number;
                     method: string;
-                    type: string;
                     cwe: string;
                     argPositions: number[];
-                    confidence: number;
-                    reasoning: string;
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
         }, undefined, unknown>;
@@ -249,9 +249,9 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 sinkType: string;
                 sanitizersInPath: string[];
             }, {
-                verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
                 confidence: number;
                 reasoning: string;
+                verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
                 exploitability: "high" | "medium" | "low" | "none";
                 sanitizersFound: string[];
                 attackVector: string;
@@ -270,13 +270,13 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 targetCode: string;
                 importedSymbols: string[];
             }, {
-                taintFlows: Array<{
+                reasoning: string;
+                taintFlows: {
+                    confidence: number;
                     sourceSymbol: string;
                     targetSymbol: string;
                     flowType: "direct" | "transitive" | "conditional";
-                    confidence: number;
-                }>;
-                reasoning: string;
+                }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
         }, undefined, unknown>;
         orchestrator: import("@mastra/core/agent").Agent<"orchestrator-agent", {
@@ -298,11 +298,11 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 methodCode: string;
             }, {
                 sources: {
-                    line: number;
-                    variable: string;
-                    type: string;
                     confidence: number;
                     reasoning: string;
+                    type: string;
+                    line: number;
+                    variable: string;
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sources", unknown>;
             discoverSinks: import("@mastra/core/tools").Tool<{
@@ -312,13 +312,13 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 methodCode: string;
             }, {
                 sinks: {
+                    confidence: number;
+                    reasoning: string;
+                    type: string;
                     line: number;
                     method: string;
-                    type: string;
                     cwe: string;
                     argPositions: number[];
-                    confidence: number;
-                    reasoning: string;
                 }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "discover-sinks", unknown>;
             verifyVulnerability: import("@mastra/core/tools").Tool<{
@@ -334,9 +334,9 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 sinkType: string;
                 sanitizersInPath: string[];
             }, {
-                verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
                 confidence: number;
                 reasoning: string;
+                verdict: "TRUE_POSITIVE" | "FALSE_POSITIVE" | "UNCERTAIN";
                 exploitability: "high" | "medium" | "low" | "none";
                 sanitizersFound: string[];
                 attackVector: string;
@@ -353,13 +353,13 @@ export declare function createMastraInstance(options?: MastraInstanceOptions): {
                 targetCode: string;
                 importedSymbols: string[];
             }, {
-                taintFlows: Array<{
+                reasoning: string;
+                taintFlows: {
+                    confidence: number;
                     sourceSymbol: string;
                     targetSymbol: string;
                     flowType: "direct" | "transitive" | "conditional";
-                    confidence: number;
-                }>;
-                reasoning: string;
+                }[];
             }, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "cross-file-taint", unknown>;
         }, undefined, unknown>;
     };