Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="src/index.ts">

<violation number="1" location="src/index.ts:156">
P2: Rule violated: **Flag Security Vulnerabilities**

Logging full error objects during initialization can expose sensitive data (connection strings, credentials) in production logs. Consider sanitizing the error output or using a structured logger that filters sensitive information.</violation>

<violation number="2" location="src/index.ts:210">
P1: Rule violated: **Check System Design and Architectural Patterns**

The condition `Date.now() &gt; 0` is always true and appears to be a debugging hack rather than a proper feature flag. This architectural anti-pattern:
- Forces the new code path without proper configuration controls
- Makes the branching logic meaningless (always takes new path when surrealDBClient exists)
- Bypasses existing `runQueryMachine` entirely without a proper toggle mechanism

Consider using a proper feature flag via configuration (e.g., `qConfig.useSurrealDbQueryMachine2`) or environment variable to control this behavior.</violation>
</file>

<file name="src/stateMachine/query/surql2/optimize.ts">

<violation number="1" location="src/stateMachine/query/surql2/optimize.ts:96">
P2: Rule violated: **Check System Design and Architectural Patterns**

DRY violation: Role field validation logic is duplicated in `convertRefFilterToRelationshipTraversal` (lines 85-94) and `convertNestedFilterToRelationshipTraversal` (lines 119-128). Extract this into a helper function like `validateRoleFieldForTraversal` to avoid maintenance issues.</violation>

<violation number="2" location="src/stateMachine/query/surql2/optimize.ts:160">
P2: Rule violated: **Check System Design and Architectural Patterns**

Dead code: `optimizeProjection` and `optimizeProjectionField` are defined but never called. The main entry point `optimizeLogicalQuery` passes through `query.projection` without optimization (line 14). Either wire up the projection optimization or remove these unused functions to avoid maintenance burden.</violation>

<violation number="3" location="src/stateMachine/query/surql2/optimize.ts:173">
P2: Wrong `thing` passed for nested reference optimization. The parent `thing` is used instead of resolving the nested field&#39;s target from the schema. This would cause incorrect filter optimization for nested references.</violation>
</file>

<file name="benches/v2.bench.ts">

<violation number="1" location="benches/v2.bench.ts:12">
P2: Rule violated: **Flag Security Vulnerabilities**

Hardcoded credentials detected. Even in benchmark/test code, database credentials should be loaded from environment variables to prevent accidental exposure in version control and to follow security best practices. Use `process.env` with dotenv to load these values.</violation>

<violation number="2" location="benches/v2.bench.ts:73">
P2: Comment says &quot;+ 2&quot; but code uses `+ 1`. This appears to be a copy-paste error from the previous bench test. Both tests will query the same element, which may not be the intended behavior.</violation>

<violation number="3" location="benches/v2.bench.ts:101">
P2: Rule violated: **Check System Design and Architectural Patterns**

DRY violation: The `createSurql`, `connect`, and `createSurqlBaseSet` functions are duplicated from `v2-2.bench.ts`. Extract these shared benchmark utilities to a common module (e.g., `benches/utils/surrealdb-helpers.ts`) to avoid maintenance burden and ensure consistency across benchmark files.</violation>
</file>

<file name="src/enrichSchema.draft.ts">

<violation number="1" location="src/enrichSchema.draft.ts:227">
P2: Bug: `oppositeRole` is an object, so this error message will display `[object Object]`. Use `lf.targetRole` to show the role name instead.</violation>

<violation number="2" location="src/enrichSchema.draft.ts:258">
P1: Rule violated: **Check System Design and Architectural Patterns**

This fallback logic is documented as incorrect in the TODO comment above it. The code knowingly implements behavior that will cause bugs in query transformations (as noted: queries using this will produce incorrect results). Either fix the implementation or throw an error when `targetingRelation` is not found, rather than falling back to `targetingRole` which produces semantically incorrect queries.</violation>

<violation number="3" location="src/enrichSchema.draft.ts:281">
P2: Rule violated: **Check System Design and Architectural Patterns**

Console.log statements violate proper architectural layering. Include this diagnostic information in the error message instead, or use a proper logging abstraction. This debug output will pollute stdout in production.</violation>
</file>

<file name="benches/insertData.v3.ts">

<violation number="1" location="benches/insertData.v3.ts:6">
P1: Rule violated: **Flag Security Vulnerabilities**

Hardcoded database credentials detected. Use environment variables instead (the project has `dotenv` as a dependency). Credentials in source code can be exposed through version control history.</violation>

<violation number="2" location="benches/insertData.v3.ts:24">
P2: Database connection is never closed. After the query completes, call `db.close()` to release the WebSocket connection and prevent resource leaks.</violation>

<violation number="3" location="benches/insertData.v3.ts:41">
P1: Rule violated: **Check System Design and Architectural Patterns**

This file duplicates code that already exists in `./generateData.ts`. The project has an established pattern where `insertData.v2.ts` imports shared types and the `generateData` function from that module. Instead of duplicating ~70 lines of code (interfaces `Base`, `A`, `B`, `generateData` function, and `uid` function), import them from the existing shared module to maintain consistency and reduce maintenance burden.</violation>

<violation number="4" location="benches/insertData.v3.ts:119">
P2: Rule violated: **Ensure all TypeScript code adheres to ECMAScript 2025 standards**

Use `nanoid` instead of custom `uid()` with `Math.random()`. The project already has `nanoid@^5.1.5` as a dependency, which is more secure (uses `crypto.getRandomValues`), more performant, and follows modern best practices for ID generation. `Math.random()` is not cryptographically secure and is considered a risky pattern for generating unique identifiers.</violation>
</file>

<file name="benches/rundb.v3.sh">

<violation number="1" location="benches/rundb.v3.sh:1">
P1: Add `set -euo pipefail` after the shebang to ensure the script exits on errors. This is a critical best practice for shell scripts to prevent silent failures.</violation>

<violation number="2" location="benches/rundb.v3.sh:5">
P1: Rule violated: **Flag Security Vulnerabilities**

Hardcoded credentials detected. The username and password (`borm_bench/borm_bench`) are hardcoded in the script. Even for benchmarking scripts, credentials should be sourced from environment variables (e.g., `${DB_USER:-default}`) to prevent accidental exposure and allow secure configuration.</violation>

<violation number="3" location="benches/rundb.v3.sh:49">
P3: Add a newline at the end of the file. POSIX requires text files to end with a newline character.</violation>
</file>

<file name="benches/insertData.v2.ts">

<violation number="1" location="benches/insertData.v2.ts:8">
P1: Rule violated: **Flag Security Vulnerabilities**

Hardcoded credentials detected. Even in benchmark files, passwords should not be committed to source control. Use environment variables with dotenv (already a project dependency) instead:
```typescript
const USERNAME = process.env.SURREAL_USERNAME ?? &#39;borm_bench&#39;;
const PASSWORD = process.env.SURREAL_PASSWORD ?? &#39;borm_bench&#39;;
```</violation>

<violation number="2" location="benches/insertData.v2.ts:22">
P2: Database connection is never closed after use. Consider calling `db.close()` after the query completes to properly release resources.</violation>
</file>

<file name="benches/rundb.v2.sh">

<violation number="1" location="benches/rundb.v2.sh:5">
P1: Rule violated: **Flag Security Vulnerabilities**

Hardcoded credentials detected. Even for benchmark/test scripts, credentials should be loaded from environment variables or a `.env` file (not committed to version control) rather than hardcoded in the script. This prevents accidental exposure and makes the script more secure.

Consider using:
```bash
USER=${SURREAL_USER:-borm_bench}
PASSWORD=${SURREAL_PASSWORD:-borm_bench}
```</violation>

<violation number="2" location="benches/rundb.v2.sh:22">
P2: Rule violated: **Flag Security Vulnerabilities**

The `--allow-all` flag grants all capabilities to SurrealDB, which is overly permissive. Even for benchmarking, consider specifying only the required capabilities explicitly to follow the principle of least privilege.</violation>

<violation number="3" location="benches/rundb.v2.sh:50">
P3: File is missing a newline at the end. POSIX requires text files to end with a newline character.</violation>
</file>

<file name="src/helpers.ts">

<violation number="1" location="src/helpers.ts:439">
P1: `Object.keys()` only returns string keys, never symbol keys. This filter will always return an empty array, so symbols will never be deleted. Use `Object.getOwnPropertySymbols(value)` instead.</violation>
</file>

<file name="benches/generateData.ts">

<violation number="1" location="benches/generateData.ts:27">
P2: Rule violated: **Ensure all TypeScript code adheres to ECMAScript 2025 standards**

String concatenation in loops is a less performant older pattern. Consider using `Array.from()` with `.join()` for more idiomatic modern JavaScript.</violation>

<violation number="2" location="benches/generateData.ts:60">
P1: Potential infinite loop: if `params.few.max` or `params.many.max` exceeds `params.records`, these while loops will never terminate because the Set cannot contain more unique IDs than exist in array `b`. Consider adding a guard condition or capping the length to `Math.min(fewLength, b.length)`.</violation>

<violation number="3" location="benches/generateData.ts:79">
P2: Rule violated: **Ensure all TypeScript code adheres to ECMAScript 2025 standards**

Use `nanoid` instead of custom `uid()` implementation. The project already has `nanoid@^5.1.5` as a dependency, which is a modern, cryptographically secure, and performant unique ID generator. The custom implementation using `Math.random()` is an older pattern that&#39;s less reliable.</violation>
</file>

<file name="src/stateMachine/query/surql2/buildLogical.ts">

<violation number="1" location="src/stateMachine/query/surql2/buildLogical.ts:72">
P2: Error message will display `[object Object]` because `field` is an object at this point. Use `field.$path` for a meaningful error message.</violation>

<violation number="2" location="src/stateMachine/query/surql2/buildLogical.ts:497">
P1: Incorrect operator mapping for `$contains` - it maps to `&#39;NOT IN&#39;` instead of a containment operator. The ternary `op === &#39;$eq&#39; ? &#39;IN&#39; : &#39;NOT IN&#39;` doesn&#39;t properly handle `$contains` and `$containsNot` cases.</violation>
</file>

<file name="benches/query.v3.ts">

<violation number="1" location="benches/query.v3.ts:8">
P2: Rule violated: **Flag Security Vulnerabilities**

Hardcoded credentials in source code. Even for benchmark files, use environment variables to avoid accidentally exposing secrets. Since the project includes `dotenv`, credentials should be loaded from environment variables (e.g., `process.env.USERNAME`).</violation>

<violation number="2" location="benches/query.v3.ts:22">
P2: Database connection is never closed after use. Call `db.close()` to properly release the connection resources before exiting. This prevents potential resource leaks, especially important if this benchmark pattern is reused elsewhere.</violation>
</file>

<file name="benches/schema.v2.surql">

<violation number="1" location="benches/schema.v2.surql:14">
P2: Type inconsistency: `array::first()` returns a single value, but fallback `|| []` returns an empty array. Consider using `|| NONE` instead to maintain consistent typing for a singular field.</violation>

<violation number="2" location="benches/schema.v2.surql:85">
P2: Logic bug: When `$var` is NONE/null, this returns `[null]` instead of an empty array `[]`. Consider adding a null check: `IF $var IS NONE THEN [] ELSE ...`</violation>
</file>

<file name="src/stateMachine/query/surql2/logical.ts">

<violation number="1" location="src/stateMachine/query/surql2/logical.ts:37">
P2: Misplaced JSDoc comment: This comment describes cardinality behavior but is positioned above the `filter` field instead of `cardinality`. Additionally, the actual `cardinality` field has an incomplete JSDoc comment that cuts off mid-sentence.</violation>
</file>

<file name="src/stateMachine/query/surql2/buildSurql.ts">

<violation number="1" location="src/stateMachine/query/surql2/buildSurql.ts:218">
P1: Bug: Double parameterization. `right[0]` is already a formatted string like `type::record($key)` from line 221, but it&#39;s being inserted as a parameter value again. This should directly use `right[0]` instead of re-parameterizing it.</violation>

<violation number="2" location="src/stateMachine/query/surql2/buildSurql.ts:286">
P1: Potential bug: `buildFilter` can return `undefined`, which would result in `NOT(undefined)` - invalid SQL. Add a null check before wrapping in NOT().</violation>

<violation number="3" location="src/stateMachine/query/surql2/buildSurql.ts:324">
P1: Rule violated: **Ensure all TypeScript code adheres to ECMAScript 2025 standards**

Replace custom `Math.random()`-based key generation with `nanoid`. The project already has `nanoid` as a dependency, which is a modern, secure, and performant solution for generating unique strings. `Math.random()` is not cryptographically secure and is considered a risky pattern for unique key generation.</violation>

<violation number="4" location="src/stateMachine/query/surql2/buildSurql.ts:337">
P1: Rule violated: **Flag Security Vulnerabilities**

Query injection vulnerability: The `esc` function does not escape the closing delimiter `⟩` within identifiers. An attacker-controlled identifier like `field⟩; DELETE * FROM users; --` would be wrapped as `⟨field⟩; DELETE * FROM users; --⟩`, breaking out of the escaping. Consider sanitizing `⟩` characters within identifiers (e.g., by escaping or rejecting them).</violation>
</file>

<file name="benches/v2-2.bench.ts">

<violation number="1" location="benches/v2-2.bench.ts:12">
P2: Rule violated: **Flag Security Vulnerabilities**

Hardcoded database credentials should be loaded from environment variables instead of being committed to source code. Even for benchmarks/tests, use `process.env` to avoid credential exposure in version control.</violation>

<violation number="2" location="benches/v2-2.bench.ts:175">
P2: Rule violated: **Flag Security Vulnerabilities**

Potential SurrealQL injection vulnerability: `data.string_1` is directly interpolated into the query without escaping special characters like quotes. Consider using parameterized queries or properly escaping string values.</violation>
</file>