code-auditor-mcp 4.1.1 → 5.0.2

package/dist/pipeline.js

@@ -15,7 +15,6 @@ import path from 'path';
 import { performance } from 'perf_hooks';
 import { AuditAbortedError, MAX_ORPHAN_SOURCE_BYTES, } from './types.js';
 import { RULE_REGISTRY } from './analyzers/ruleRegistry.js';
-import { evaluateRuleApplicability, scopedWholeProgramApplicability } from './analyzers/applicability.js';
 import { resetRuleTiming, getRuleTimingSortedDesc } from './analyzers/ruleTiming.js';
 import { LanguageRegistry } from './languages/LanguageRegistry.js';
 import { discoverFiles, DEFAULT_EXCLUDED_DIRS } from './utils/fileDiscovery.js';
@@ -29,6 +28,7 @@ import { validateFactsDependencies } from './pipelineTypes.js';
  * File discovery is eager (separate from parsing) so the total count is
  * available for progress reporting throughout the parse + visit loop.
  *
+ * @param config - Pipeline configuration (project root, files, callbacks).
  * @returns generator (yields tuples), total file count, and a closure to
  *          retrieve aggregate parse/read timing after the generator completes.
  */
@@ -214,8 +214,17 @@ export function runStage1(config) {
     };
 }
 // ── Stage 2: Per-file visitors ─────────────────────────────────────────────
+/**
+ * Stream the stage-1 tuples through every per-file visitor, accumulating
+ * per-analyzer results, facts, and index-fact rows.
+ *
+ * @param tuples - The stage-1 stream of parsed file/AST tuples.
+ * @param visitors - The stage-2 visitors to run over each tuple.
+ * @param config - Pipeline configuration (abort signal, progress callback, etc.).
+ * @param totalFiles - Total file count for progress reporting.
+ * @returns Visitor results, facts, index facts, timing, and the processed file count.
+ */
 export async function runStage2(tuples, visitors, config, totalFiles) {
-    const t0 = performance.now();
     const visitorResults = new Map();
     const allFacts = new Map();
     const indexFacts = [];
@@ -377,7 +386,21 @@ export async function runStage2(tuples, visitors, config, totalFiles) {
         i++;
     }
     // Finalize results
-    const totalDuration = performance.now() - t0;
+    finalizeStage2Visitors(visitorResults, timingMap, errors, visitors);
+    return {
+        visitorResults,
+        allFacts,
+        indexFacts,
+        visitorDurationMs: timingMap,
+        fileCount: i,
+    };
+}
+/**
+ * Finalize stage-2 visitor results: attach per-visitor execution time, surface
+ * collected errors, and convert extension-declaring visitors that matched zero
+ * files to `notRun`.
+ */
+function finalizeStage2Visitors(visitorResults, timingMap, errors, visitors) {
     for (const [name, result] of visitorResults) {
         const visitorTime = timingMap.get(name) ?? 0;
         result.executionTime = visitorTime;
@@ -402,15 +425,23 @@ export async function runStage2(tuples, visitors, config, totalFiles) {
             }
         }
     }
+}
+// ── Stage 3: Corpus reducers ───────────────────────────────────────────────
+/**
+ * Builds the common `ReducerContext` fields shared by stage-3 and stage-4
+ * reducers. Stage 3 layers an on-demand `readSource` closure on top; stage 4
+ * uses the base context as-is.
+ */
+function makeReducerContext(config, indexHandle, reducerConfig) {
     return {
-        visitorResults,
-        allFacts,
-        indexFacts,
-        visitorDurationMs: timingMap,
-        fileCount: i,
+        projectRoot: config.projectRoot,
+        config: reducerConfig,
+        indexHandle,
+        abortSignal: config.abortSignal,
+        isScoped: config.isScoped,
+        styleContributingFiles: config.styleContributingFiles,
     };
 }
-// ── Stage 3: Corpus reducers ───────────────────────────────────────────────
 async function runStage3(allFacts, reducers, config, indexHandle) {
     const t0 = performance.now();
     const reducerResults = new Map();
@@ -444,13 +475,8 @@ async function runStage3(allFacts, reducers, config, indexHandle) {
             }
         };
         const reducerContext = {
-            projectRoot: config.projectRoot,
-            config: reducerConfig,
-            indexHandle,
-            abortSignal: config.abortSignal,
+            ...makeReducerContext(config, indexHandle, reducerConfig),
             readSource,
-            isScoped: config.isScoped,
-            styleContributingFiles: config.styleContributingFiles,
         };
         try {
             const r0 = performance.now();
@@ -527,14 +553,7 @@ async function runStage4(allFacts, derivedReducers, config, indexHandle) {
         }
         // Per-reducer namespaced config: analyzer namespace + infrastructure
         const reducerConfig = { ...(rawConfig[dr.name] ?? {}), ...infra };
-        const reducerContext = {
-            projectRoot: config.projectRoot,
-            config: reducerConfig,
-            indexHandle,
-            abortSignal: config.abortSignal,
-            isScoped: config.isScoped,
-            styleContributingFiles: config.styleContributingFiles,
-        };
+        const reducerContext = makeReducerContext(config, indexHandle, reducerConfig);
         try {
             const r0 = performance.now();
             const result = await dr.reduce(allFacts, reducerContext);
@@ -661,7 +680,13 @@ export async function runPipeline(config, indexHandle) {
     // drop conventions and cross-domain results because the post-pipeline
     // writeIndexFactsToDb call at auditRunner.ts:545 happens too late.
     if (indexHandle && stage2.indexFacts.length > 0) {
+        const writeT0 = performance.now();
         writeIndexFactsToDb(indexHandle, stage2.indexFacts);
+        // §6.3 — the parent is the only writer; time the serial write so the
+        // parent-serial-vs-concurrent throughput question is a measured number,
+        // not a claim. Wall-clock, not CPU: SQLite upserts are I/O-bound.
+        stageTiming['index-fact-write'] = performance.now() - writeT0;
+        stageTiming['index-fact-write-count'] = stage2.indexFacts.length;
         // Clear flushed facts so the post-pipeline flush (auditRunner.ts:545)
         // doesn't double-insert them.
         stage2.indexFacts = [];
@@ -709,6 +734,26 @@ export async function runPipeline(config, indexHandle) {
             phase: 'stage4-complete',
         });
     }
+    return buildPipelineResult({
+        config,
+        indexHandle,
+        s1,
+        stage2,
+        stage3,
+        stage4,
+        combinedFacts,
+        stageTiming,
+        totalT0,
+    });
+}
+/**
+ * Assemble the pipeline result from stage outputs: merge per-stage analyzer
+ * results, collect diagnostics, and build the metadata block (input presence,
+ * table catalog, dependency-graph metrics, skipped files, file accounting,
+ * per-rule timing, and gate path-profile re-resolution).
+ */
+function buildPipelineResult(opts) {
+    const { config, indexHandle, s1, stage2, stage3, stage4, combinedFacts, stageTiming, totalT0 } = opts;
     // ── Build result ─────────────────────────────────────────────────────────
     const analyzerResults = {};
     // Stage 2 results
@@ -739,79 +784,9 @@ export async function runPipeline(config, indexHandle) {
             diagnostics.push(...result.diagnostics);
         }
     }
-    // Spec 39 — derived rule applicability. Each rule's predicate is evaluated
-    // over its declared inputs BEFORE findings are surfaced; an inapplicable rule
-    // has its findings removed from the raw analyzer results so they never reach
-    // the report total, and is reported `notApplicable` (with a reason) in
-    // coverage rather than `fired`/`clean`. Runs after Stage 4 so the schema
-    // reducer's `ddlColumns` fact is available.
-    const dataAccessConfig = (config.config ?? {})['data-access'];
-    const schemaReducerFacts = combinedFacts['schema'];
-    // Spec 62 Amendment B — applicability reads the corpus-wide per-table DDL
-    // columns (Tier 3), the same fact the Stage-4 missing-org-filter reducer
-    // consumes, so applicability and firing share one tier picture.
-    const ddlTableColumns = schemaReducerFacts?.tableColumns;
-    // Spec 45 R5 — stylesheet sources the indexer could not read. These do NOT
-    // silence styles/undefined-class; they become reportable context attached to
-    // each undefined-class finding below.
-    let unreadStyleSources = [];
-    if (indexHandle) {
-        try {
-            unreadStyleSources = indexHandle.query('SELECT file_path AS filePath, reason FROM style_unread_sources');
-        }
-        catch {
-            // Table absent (pre-migration DB) — treated as "nothing unread".
-            unreadStyleSources = [];
-        }
-    }
-    const ruleApplicability = new Map();
-    for (const ruleId of Object.keys(RULE_REGISTRY)) {
-        const app = evaluateRuleApplicability(ruleId, dataAccessConfig, ddlTableColumns);
-        if (app)
-            ruleApplicability.set(ruleId, app);
-    }
-    // Spec 52 R3 — whole-program rules are unsound on a scoped run. A partial
-    // file set cannot support a global claim like "table X is never read" or
-    // "table Y is unknown", so on a scoped/diff run each whole-program rule is
-    // suppressed with a `notApplicable` reason naming the scope. The finding is
-    // removed below (same pass as Spec 39) and reported `notApplicable` in
-    // coverage — not a fired global claim, and not silence. (Whole-program rules
-    // that already carry a Spec-39 applicability verdict are left intact.)
-    for (const [ruleId, app] of scopedWholeProgramApplicability(!!config.isScoped, s1.fileCount)) {
-        if (!ruleApplicability.has(ruleId))
-            ruleApplicability.set(ruleId, app);
-    }
-    for (const [ruleId, app] of ruleApplicability) {
-        if (app.applicable)
-            continue;
-        const entry = RULE_REGISTRY[ruleId];
-        const result = analyzerResults[entry.analyzer];
-        if (result?.violations) {
-            result.violations = result.violations.filter((v) => !violationMatchesRule(v, ruleId, entry.field));
-        }
-    }
-    // Spec 45 R5 — undefined-class reports, does not go silent, when stylesheets
-    // were unread. Each finding carries the unread-source list as
-    // `details.incompleteDefinitions` so "undefined" reads as "not defined in any
-    // *read* stylesheet", while the finding itself still fires and blocks.
-    if (unreadStyleSources.length > 0) {
-        const entry = RULE_REGISTRY['styles/undefined-class'];
-        const result = entry ? analyzerResults[entry.analyzer] : undefined;
-        const context = unreadStyleSources.map((s) => s.reason ? `${s.filePath} (${s.reason})` : s.filePath);
-        if (result?.violations) {
-            for (const v of result.violations) {
-                if (!violationMatchesRule(v, 'styles/undefined-class', entry.field))
-                    continue;
-                const existing = typeof v.details === 'object' && v.details !== null ? v.details : {};
-                v.details = { ...existing, incompleteDefinitions: context };
-            }
-        }
-    }
     // Spec 33 Item 14 — per-rule input presence, computed once from the merged
     // facts + index tables, then used to promote zero-violation rules.
     const inputPresence = computeInputPresence(combinedFacts, indexHandle);
-    // Spec 27 — build per-rule coverage from completed pipeline results
-    const coverage = buildCoverageReport(analyzerResults, config, inputPresence, ruleApplicability);
     // Spec 29: Extract table catalog from schema reducer facts for metadata
     const schemaFacts = combinedFacts['schema'];
     const tableCatalog = schemaFacts?.tableCatalog;
@@ -915,14 +890,7 @@ export async function runPipeline(config, indexHandle) {
             stageTiming,
             scoped: config.isScoped,
             diagnostics,
-            coverage,
             inputPresence,
-            ruleApplicability: [...ruleApplicability.entries()].map(([ruleId, app]) => ({
-                ruleId,
-                applicable: app.applicable,
-                reason: app.reason,
-                kind: app.kind,
-            })),
             tableCatalog,
             ...(testCoverage && { testCoverage }),
             ...(deadClusters && deadClusters.length > 0 && { deadClusters }),
@@ -952,31 +920,68 @@ export async function runPipeline(config, indexHandle) {
  *
  * Spec 25 B4 — moved from analyzer-side CodeIndexDB calls to a post-pipeline
  * write step so visitors never open the database directly.
+ *
+ * Spec 68 §6.3 — the parent is the only writer and it writes in *batched
+ * transactions*. Per-fact `handle.run` issues one implicit transaction per
+ * statement (a WAL fsync each), so a full-repo flush of thousands of facts
+ * costs ~0.15–0.22 ms/fact. Wrapping the flush in a single better-sqlite3
+ * transaction amortizes the commit to one fsync; a handle with no `rawDb`
+ * (in-memory overlay) falls back to the per-fact path unchanged.
+ *
+ * @param handle - Index handle to write through (DB or in-memory overlay).
+ * @param facts - Index-fact entries to flush.
  */
 export function writeIndexFactsToDb(handle, facts) {
-    for (const fact of facts) {
-        const data = fact.data;
-        // Special action: clear rows by file path
-        if (data._action === 'clear-by-file') {
-            handle.run(`DELETE FROM ${fact.table} WHERE file_path = ?`, [data.file_path]);
-            continue;
-        }
-        // Normal upsert
-        const columns = Object.keys(data).filter(k => !k.startsWith('_'));
-        const values = columns.map(k => data[k]);
-        const placeholders = columns.map(() => '?').join(', ');
-        if (fact.conflictKey) {
-            const keyCols = fact.conflictKey.split(',').map(s => s.trim());
-            const updateCols = columns.filter(c => !keyCols.includes(c));
-            const updates = updateCols.map(c => `"${c}" = excluded."${c}"`).join(', ');
-            handle.run(`INSERT INTO ${fact.table} ("${columns.join('", "')}") VALUES (${placeholders}) ON CONFLICT (${keyCols.join(', ')}) DO UPDATE SET ${updates}`, values);
-        }
-        else {
-            // Normal insert — no conflictKey (caller handles dedup via clear-by-file or similar)
-            handle.run(`INSERT INTO ${fact.table} ("${columns.join('", "')}") VALUES (${placeholders})`, values);
+    if (facts.length === 0)
+        return;
+    withBatchWrite(handle, () => {
+        for (const fact of facts) {
+            const data = fact.data;
+            // Special action: clear rows by file path
+            if (data._action === 'clear-by-file') {
+                handle.run(`DELETE FROM ${fact.table} WHERE file_path = ?`, [data.file_path]);
+                continue;
+            }
+            // Normal upsert
+            const columns = Object.keys(data).filter(k => !k.startsWith('_'));
+            const values = columns.map(k => data[k]);
+            const placeholders = columns.map(() => '?').join(', ');
+            if (fact.conflictKey) {
+                const keyCols = fact.conflictKey.split(',').map(s => s.trim());
+                const updateCols = columns.filter(c => !keyCols.includes(c));
+                const updates = updateCols.map(c => `"${c}" = excluded."${c}"`).join(', ');
+                handle.run(`INSERT INTO ${fact.table} ("${columns.join('", "')}") VALUES (${placeholders}) ON CONFLICT (${keyCols.join(', ')}) DO UPDATE SET ${updates}`, values);
+            }
+            else {
+                // Normal insert — no conflictKey (caller handles dedup via clear-by-file or similar)
+                handle.run(`INSERT INTO ${fact.table} ("${columns.join('", "')}") VALUES (${placeholders})`, values);
+            }
         }
+    });
+}
+/**
+ * Run a fact-flush body inside a single SQLite transaction when the handle
+ * exposes a better-sqlite3 `rawDb` (its `.transaction` auto-rolls back on a
+ * throw), and otherwise run it directly. §6.3's "batched transactions".
+ */
+function withBatchWrite(handle, write) {
+    const db = handle.rawDb;
+    if (db && typeof db.transaction === 'function') {
+        db.transaction(write)();
+    }
+    else {
+        write();
     }
 }
+/**
+ * Run the pipeline and then flush collected index facts through the supplied
+ * persister, returning both the pipeline result and the facts.
+ *
+ * @param config - Pipeline configuration with visitors, reducers, and derived reducers.
+ * @param indexHandle - Optional DB handle for reducers (in-memory overlay for scoped runs).
+ * @param writeIndexFacts - Optional persister invoked with the collected index facts.
+ * @returns The pipeline result plus the collected index facts.
+ */
 export async function runPipelineWithIndex(config, indexHandle, writeIndexFacts) {
     const result = await runPipeline(config, indexHandle);
     // Spec 25 B4 — Write index facts when a persister is supplied.
@@ -1005,6 +1010,9 @@ export function makeReducerStatus(factsConsumed) {
 /**
  * Accessor: extract filesProcessed from any AnalyzerStatus.
  * Returns 0 for non-visitor statuses (reducer-ran, notRun, etc.).
+ *
+ * @param status - The analyzer status to read.
+ * @returns The filesProcessed count, or 0 for non-visitor statuses.
  */
 export function getFilesProcessed(status) {
     if (status.status === 'visitor-ran') {
@@ -1015,6 +1023,9 @@ export function getFilesProcessed(status) {
 /**
  * Accessor: extract factsConsumed from any AnalyzerStatus.
  * Returns 0 for non-reducer statuses.
+ *
+ * @param status - The analyzer status to read.
+ * @returns The factsConsumed count, or 0 for non-reducer statuses.
  */
 export function getFactsConsumed(status) {
     if (status.status === 'reducer-ran') {
@@ -1072,210 +1083,4 @@ function computeInputPresence(combinedFacts, indexHandle) {
     }
     return { factKeys, indexTables };
 }
-/**
- * Match a violation to a rule id using the rule's declared `field` discriminator.
- * Shared by coverage counting and Spec 39 applicability suppression so the two
- * can never disagree about which violations belong to a rule.
- */
-export function violationMatchesRule(v, ruleId, field) {
-    if (field === 'type')
-        return v.type === ruleId;
-    if (field === 'contractType')
-        return v.contractType === ruleId;
-    if (field === 'principle')
-        return v.principle === ruleId;
-    if (field === 'violationType')
-        return v.violationType === ruleId;
-    if (field === 'ruleId')
-        return v.ruleId === ruleId;
-    return v.rule === ruleId;
-}
-/**
- * Build a per-rule coverage report from completed pipeline results.
- *
- * Iterates every rule in the canonical {@link RULE_REGISTRY}, cross-references
- * with the analyzer-results map to derive a {@link RuleCoverageState} per rule:
- *
- * | Analyzer status                        | Rule state      | Reason                          |
- * |----------------------------------------|-----------------|---------------------------------|
- * | notRun                                 | `notApplicable` | `notRun.reason`                 |
- * | visitor-ran, filesProcessed === 0      | `notApplicable` | "no matching source files"      |
- * | reducer-ran, factsConsumed === 0       | `notApplicable` | "no facts consumed from upstream visitors" |
- * | analyzer ran with input, count > 0     | `fired`         | (none)                          |
- * | analyzer ran with input, count === 0   | `clean`/`notApplicable` | per-rule input mapping    |
- *
- * Spec 33 Item 14: zero-violation rules are promoted from `unassessed` to
- * `clean` (mapped input present) or `notApplicable` (mapped input absent). Only
- * rules with no `input` mapping (non-pipeline analyzers) remain `unassessed`.
- *
- * Rules whose analyzer was not enabled in `config` are omitted entirely
- * (they were not part of this run — distinct from `notRun`).
- */
-export function buildCoverageReport(analyzerResults, config, inputPresence, ruleApplicability) {
-    const coverage = [];
-    for (const [ruleId, entry] of Object.entries(RULE_REGISTRY)) {
-        const { analyzer: analyzerName, field } = entry;
-        // Skip rules whose analyzer wasn't configured for this run
-        if (!(analyzerName in (config.config ?? {}))) {
-            continue;
-        }
-        // Spec 44 bucket 2 — a `cannot-fire` rule is broken in the tool (its
-        // predicate reads a field no extractor populates). That verdict holds on
-        // every run regardless of whether the analyzer found input, so it precedes
-        // the run-status checks below.
-        const cannotFire = ruleApplicability?.get(ruleId);
-        if (cannotFire && !cannotFire.applicable && cannotFire.kind === 'cannot-fire') {
-            coverage.push({
-                ruleId,
-                analyzer: analyzerName,
-                state: 'cannot-fire',
-                count: 0,
-                reason: cannotFire.reason,
-            });
-            continue;
-        }
-        const result = analyzerResults[analyzerName];
-        // Analyzer not in results → notRun-equivalent
-        if (!result) {
-            coverage.push({
-                ruleId,
-                analyzer: analyzerName,
-                state: 'notApplicable',
-                count: 0,
-                reason: `analyzer "${analyzerName}" not in results`,
-            });
-            continue;
-        }
-        const status = result.status;
-        // notRun: all rules notApplicable
-        if (status.status !== 'visitor-ran' && status.status !== 'reducer-ran') {
-            const reason = status.reason;
-            coverage.push({
-                ruleId,
-                analyzer: analyzerName,
-                state: 'notApplicable',
-                count: 0,
-                reason,
-            });
-            continue;
-        }
-        // Visitor with zero input files
-        if (isVisitorStatus(status) && getFilesProcessed(status) === 0) {
-            coverage.push({
-                ruleId,
-                analyzer: analyzerName,
-                state: 'notApplicable',
-                count: 0,
-                reason: 'no matching source files',
-            });
-            continue;
-        }
-        // Reducer with zero facts consumed
-        if (isReducerStatus(status) && getFactsConsumed(status) === 0) {
-            coverage.push({
-                ruleId,
-                analyzer: analyzerName,
-                state: 'notApplicable',
-                count: 0,
-                reason: 'no facts consumed from upstream visitors',
-            });
-            continue;
-        }
-        // Check per-rule config gate (explicitly disabled by config)
-        if (entry.configGate) {
-            const analyzerNs = (config.config ?? {})[analyzerName];
-            const gateValue = analyzerNs?.[entry.configGate];
-            if (gateValue === false) {
-                coverage.push({
-                    ruleId,
-                    analyzer: analyzerName,
-                    state: 'notApplicable',
-                    count: 0,
-                    reason: `disabled by config (${analyzerName}.${entry.configGate}: false)`,
-                });
-                continue;
-            }
-        }
-        // Spec 39 — derived applicability. A rule whose predicate evaluated false is
-        // `notApplicable` with the predicate's reason, before any finding is counted.
-        // (`cannot-fire` was already reported above; only per-corpus `notApplicable`
-        // reaches this branch.)
-        const applicability = ruleApplicability?.get(ruleId);
-        if (applicability && !applicability.applicable) {
-            coverage.push({
-                ruleId,
-                analyzer: analyzerName,
-                state: 'notApplicable',
-                count: 0,
-                reason: applicability.reason,
-            });
-            continue;
-        }
-        // Analyzer ran with input — count violations for this rule
-        const violations = (result.violations ?? []).filter((v) => violationMatchesRule(v, ruleId, field));
-        const count = violations.length;
-        if (count > 0) {
-            coverage.push({
-                ruleId,
-                analyzer: analyzerName,
-                state: 'fired',
-                count,
-            });
-            continue;
-        }
-        // Spec 33 Item 14 — zero-violation rules are now promoted from `unassessed`
-        // to `clean`/`notApplicable` based on whether the rule's mapped input was
-        // present this run. Rules with no mapping (non-pipeline analyzers) stay
-        // `unassessed`.
-        coverage.push(resolveZeroViolationState(ruleId, analyzerName, entry.input, inputPresence));
-    }
-    return coverage;
-}
-/**
- * Spec 33 Item 14 — classify a zero-violation rule by its declared input.
- *
- *   - No `input` mapping → `unassessed` (input provenance unknown; non-pipeline
- *     analyzers only).
- *   - Any input source present → `clean` (the analyzer ran over the rule's real
- *     input and found nothing to flag).
- *   - All input sources absent → `notApplicable` (the input this rule reads was
- *     never produced this run).
- *
- * Spec 62 Amendment B (B4) — `clean` means "could have fired". This function is
- * reached only *after* the derived-applicability branch in
- * {@link buildCoverageReport} has already diverted any rule whose predicate
- * evaluated false (Spec 39) or is structurally unreachable (Spec 44). For the
- * tiered class (`missing-org-filter`) that predicate *is* firing reachability
- * (`hasDeclaredTenancy`), so "input present" here implies "firing was reachable"
- * — a zero-violation result is an honest `clean`, never a false one.
- *
- * An input source is "present" when it is the literal `'files'` (always present
- * at this branch — earlier checks already excluded empty-input analyzers), a
- * fact-key in {@link InputPresence.factKeys}, or an index table in
- * {@link InputPresence.indexTables}.
- */
-function resolveZeroViolationState(ruleId, analyzerName, input, inputPresence) {
-    if (!input || input.length === 0) {
-        return {
-            ruleId,
-            analyzer: analyzerName,
-            state: 'unassessed',
-            count: 0,
-            reason: 'applicability not assessed (no per-rule input mapping)',
-        };
-    }
-    const factKeys = new Set(inputPresence?.factKeys ?? []);
-    const indexTables = new Set(inputPresence?.indexTables ?? []);
-    const anyPresent = input.some((source) => source === 'files' || factKeys.has(source) || indexTables.has(source));
-    if (anyPresent) {
-        return { ruleId, analyzer: analyzerName, state: 'clean', count: 0 };
-    }
-    return {
-        ruleId,
-        analyzer: analyzerName,
-        state: 'notApplicable',
-        count: 0,
-        reason: `rule input absent (none of: ${input.join(', ')})`,
-    };
-}
 //# sourceMappingURL=pipeline.js.map