Business intelligence as code: build fast, interactive data visualizations in SQL and markdown
This report summarizes scanner evidence for evidence-dev/evidence, a TypeScript project with 7,078 GitHub stars. SynthScan examined 232,824 lines of code across 1618 source files, recording 378 pattern matches distributed across 11 syntactic categories. The legacy adjusted pattern signal is 2.7 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 315 finding(s).
Are imports declared and package/API names verified? 8 finding(s).
Are wrappers, guards, and repeated structures necessary? 208 finding(s).
Which changes need focused human review? 378 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 378 distinct pattern matches across 11 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | core/src/user-components/formatValue.test.ts | 656 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/formatValue.test.ts | 660 | // ───────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/tags/series_charts/combo_chart/label-geometry.test.ts | 162 | // ── Generated scenarios ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/series_charts/combo_chart/x-axis-label-matrix.test.ts | 51 | // ── TIME axis · hour grain (date column) ──────────────────────────────── | COMMENT |
| MEDIUM | …/series_charts/combo_chart/x-axis-label-matrix.test.ts | 101 | // ── TIME axis · day grain ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/series_charts/combo_chart/x-axis-label-matrix.test.ts | 175 | // ── TIME axis · week grain ────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/series_charts/combo_chart/x-axis-label-matrix.test.ts | 225 | // ── TIME axis · month grain ───────────────────────────────────────────── | COMMENT |
| MEDIUM | …/series_charts/combo_chart/x-axis-label-matrix.test.ts | 427 | // ── TIME axis · quarter grain ─────────────────────────────────────────── | COMMENT |
| MEDIUM | …/series_charts/combo_chart/x-axis-label-matrix.test.ts | 725 | // ── VALUE axis · plain numbers (no grain) ─────────────────────────────── | COMMENT |
| MEDIUM | …/series_charts/combo_chart/x-axis-label-matrix.test.ts | 751 | // ── CATEGORY axis · string labels ─────────────────────────────────────── | COMMENT |
| MEDIUM | …ponents/tags/series_charts/combo_chart/x-axis-rules.ts | 20 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ponents/tags/series_charts/combo_chart/x-axis-rules.ts | 25 | // ───────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …/tags/series_charts/combo_chart/x-axis-test-harness.ts | 310 | // ── Dataset builders ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ries_charts/combo_chart/x-axis-rendered-labels.test.ts | 20 | // ── Dataset builders ──────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ries_charts/combo_chart/x-axis-rendered-labels.test.ts | 37 | // ── Tests ─────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ries_charts/combo_chart/x-axis-rendered-labels.test.ts | 518 | // ── Timezone invariance (the reason this PR moved to local-everywhere) ──────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 126 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 128 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 133 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 136 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 141 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 143 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 146 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 148 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 153 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 161 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 185 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 188 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 194 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | core/src/user-components/common/fill-gaps.ts | 196 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 9 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 11 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 61 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 63 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 133 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 135 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 341 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 343 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 388 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 390 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 453 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 455 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 481 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 483 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 567 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | core/src/user-components/common/fill-gaps.test.ts | 570 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/cli/launch.ts | 158 | // ── Stage: auth ────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/cli/launch.ts | 161 | // ── Detect the external repo (required) ──────────────────────────────────── | COMMENT |
| MEDIUM | cli/cli/launch.ts | 186 | // ── Stage: org ───────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/cli/launch.ts | 189 | // ── Auto-detect branch + root directory ──────────────────────────────────── | COMMENT |
| MEDIUM | cli/cli/launch.ts | 201 | // ── Stage: project (reuse repo-linked project → create) ──────────────────── | COMMENT |
| MEDIUM⚡ | cli/cli/launch.ts | 289 | // ── Stage: GitHub App install + repo access ──────────────────────────────── | COMMENT |
| MEDIUM⚡ | cli/cli/launch.ts | 292 | // ── Stage: warehouse credentials ─────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | cli/cli/launch.ts | 295 | // ── Stage: initial sync ──────────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/cli/launch.ts | 320 | // ── Done ─────────────────────────────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/src/interpolate-query-strings.ts | 364 | function shouldIncludeConditionalBlock( | CODE |
| LOW | core/src/readiness.svelte.ts | 72 | export function setupRepeatableRenderReadiness( | CODE |
| LOW | core/src/component-click-to-source.context.svelte.ts | 20 | export function setComponentClickToSourceContext(context: ComponentClickToSourceContext): void { | CODE |
| LOW | core/src/component-click-to-source.context.svelte.ts | 24 | export function getComponentClickToSourceContext(): ComponentClickToSourceContext | undefined { | CODE |
| LOW | core/src/preview-viewport.context.svelte.ts | 12 | export function setPreviewViewportContext(get: () => PreviewViewport) { | CODE |
| LOW | core/src/preview-viewport.context.svelte.ts | 17 | export function getPreviewViewportContext(): (() => PreviewViewport) | undefined { | CODE |
| LOW | core/src/connectors/clickhouse/resolve.ts | 10 | export function resolveClickHouseCredentials(config: ClickHouseConnection): ClickHouseCredentials { | CODE |
| LOW | core/src/connectors/databricks/resolve.ts | 10 | export function resolveDatabricksCredentials(config: DatabricksConnection): DatabricksCredentials { | CODE |
| LOW | core/src/connectors/motherduck/resolve.ts | 15 | export async function resolveMotherduckCredentials( | CODE |
| LOW | core/src/connectors/bigquery/client-options.ts | 17 | export function buildBigQueryClientOptions( | CODE |
| LOW | core/src/connectors/bigquery/resolve.ts | 15 | export async function resolveBigQueryCredentials( | CODE |
| LOW | core/src/connectors/snowflake/resolve.ts | 19 | export async function resolveSnowflakeCredentials( | CODE |
| LOW | core/src/connectors/redshift/resolve.ts | 29 | export async function resolveRedshiftCredentials( | CODE |
| LOW | core/src/connectors/postgres/resolve.ts | 33 | export async function resolvePostgresCredentials( | CODE |
| LOW | core/src/connectors/sqlserver/resolve.ts | 12 | export async function resolveSqlServerCredentials( | CODE |
| LOW | core/src/user-components/filter-input-types.ts | 7 | export function getFilterInputComponentNames(): string[] { | CODE |
| LOW | …er-components/sandbox-runtime-errors-context.svelte.ts | 167 | export function setSandboxRuntimeErrorsContext(): SandboxRuntimeErrorsContext { | CODE |
| LOW | …er-components/sandbox-runtime-errors-context.svelte.ts | 180 | export function getSandboxRuntimeErrorsContext(): SandboxRuntimeErrorsContext | undefined { | CODE |
| LOW | core/src/user-components/formatValue.ts | 12 | function convertSingleQuotesToDouble(formatCode: string): string { | CODE |
| LOW | core/src/user-components/formatValue.ts | 451 | export function canonicalizeTimeAxisValue(value: unknown): unknown { | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 71 | function filterErrorsInsideOpaqueBodies(ast: Node, errors: ValidateError[]): ValidateError[] { | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 194 | function getCustomComponentRegistry( | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 331 | function removeObjectStringFromTree(tree: RenderableTreeNode): RenderableTreeNode { | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 712 | function validateNoNestedInlineQueries(ast: Node): MarkdocStar.ValidateError[] { | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 755 | function validateSharedComponentInputs( | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 880 | function validateQuotedValueInText(ast: Node): ValidateError[] { | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 1078 | function validateAllowedChildrenAndParents(node: Node, parent?: Node): ValidateError[] { | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 1151 | function validateDuplicateFilterIds( | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 1203 | function validateDuplicateFenceNames( | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 1260 | function validateReservedQueryNames( | CODE |
| LOW | …omponents/Renderer/MarkdocProcessor/process-markdoc.ts | 1300 | function collectReferencedPartials( | CODE |
| LOW | …derer/MarkdocProcessor/rewrite-bare-translation-sql.ts | 21 | export function rewriteBareTranslationSqlAccessors( | CODE |
| LOW | …derer/MarkdocProcessor/rewrite-bare-translation-sql.ts | 194 | export function rewriteSqlFenceTranslationTokens( | CODE |
| LOW | …rkdocProcessor/replaceFilterVariablesWithComponents.ts | 17 | export function replaceFilterVariablesWithComponents( | CODE |
| LOW | …rkdocProcessor/replaceFilterVariablesWithComponents.ts | 69 | function splitTextWithFilterVariables(text: string): RenderableTreeNode | RenderableTreeNode[] { | CODE |
| LOW | …mponents/Renderer/MarkdocProcessor/register-filters.ts | 230 | function registerWorkflowPeriodFilter( | CODE |
| LOW | …mponents/Renderer/MarkdocProcessor/register-filters.ts | 287 | function collectNestedComponentTagNodes( | CODE |
| LOW | …mponents/Renderer/MarkdocProcessor/register-filters.ts | 316 | function createComponentScopedConfig( | CODE |
| LOW | …mponents/Renderer/MarkdocProcessor/register-filters.ts | 400 | function collectStaticExternalFilters( | CODE |
| LOW | …mponents/Renderer/MarkdocProcessor/register-filters.ts | 484 | function containsWorkflowPeriodSelector(node: Node): boolean { | CODE |
| LOW | …ponents/custom-components/declared-caller-variables.ts | 15 | export function declaredCallerVariablesFromContent(content: string): Record<string, unknown> { | CODE |
| LOW | …onents/custom-components/component-attribute-schema.ts | 109 | export function parseCustomComponentAttributesWithErrors(raw: unknown): { | CODE |
| LOW | …onents/custom-components/component-attribute-schema.ts | 162 | export function parseCustomComponentAttributes( | CODE |
| LOW | …nents/custom-components/namespace-component-queries.ts | 38 | export function rewriteTemplateReferences( | CODE |
| LOW | …nents/custom-components/namespace-component-queries.ts | 87 | export function rewriteEvidenceQueryCalls( | CODE |
| LOW | …nents/custom-components/namespace-component-queries.ts | 146 | export function namespaceComponentQueries( | CODE |
| LOW | …nents/custom-components/namespace-component-queries.ts | 192 | export function componentQueriesUseDollarVariables(body: Node): boolean { | CODE |
| LOW | …nents/custom-components/namespace-component-queries.ts | 260 | export function applyInstanceScopeToRenderable( | CODE |
| LOW | …user-components/custom-components/build-custom-tags.ts | 66 | function componentBodyErrorsAtCallSite( | CODE |
| LOW | …user-components/custom-components/build-custom-tags.ts | 497 | export function buildCustomComponentRegistry( | CODE |
| LOW | …user-components/custom-components/build-custom-tags.ts | 562 | export function customComponentsAsUserComponents( | CODE |
| LOW | …user-components/custom-components/build-custom-tags.ts | 629 | export function dissolveRemainingSlotPlaceholders( | CODE |
| LOW | …nents/custom-components/detect-misnested-attributes.ts | 30 | export function detectMisnestedAttributeDeclarations( | CODE |
| LOW | …er-components/tags/repeat/build-repeat-query-config.ts | 24 | export function resolveRepeatColumnExpression( | CODE |
| LOW | …src/user-components/tags/funnel_chart/funnel-labels.ts | 123 | export function resolveAutoLabelPlacement(opts: { | CODE |
| LOW | …components/tags/funnel_chart/build-funnel-chart-sql.ts | 22 | export function buildFunnelChartSQLConfig(attrs: FunnelChartSQLAttrs): SQLQueryConfig { | CODE |
| LOW | …components/tags/custom_map/sandbox/sandbox-protocol.ts | 144 | export function validateFilterCreateMessage(message: unknown): FilterCreateMessage | null { | CODE |
| LOW | core/src/user-components/tags/html/schema.ts | 73 | export function collectScriptVariableReads(source: string): Set<string> { | CODE |
| LOW | core/src/user-components/tags/html/link-hosts.ts | 42 | export function extractLinkHostsFromSource(source: string): Set<string> { | CODE |
| LOW | …rc/user-components/tags/html/extract-filter-creates.ts | 61 | export function extractFilterCreatesFromJs(source: string): ExtractedExternalFilter[] { | CODE |
| 93 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | core/src/FILTER_SYSTEM.md | 88 | this.#value = newValue; // Step 1: update reactive state | CODE |
| LOW⚡ | core/src/FILTER_SYSTEM.md | 90 | if (this.opts.dontUseQueryParam) return; // Step 2: opt-out flag | CODE |
| LOW⚡ | core/src/FILTER_SYSTEM.md | 91 | if (!this.deps.updateUrl) return; // Step 3: no write capability (editor, server) | CODE |
| LOW⚡ | core/src/FILTER_SYSTEM.md | 95 | this.#lastSerialized = serialized; // Step 4: snapshot — see Core Principle 5 | CODE |
| LOW⚡ | core/src/FILTER_SYSTEM.md | 96 | if (this.#isInitializing || !changed) return; // Step 5: block during construction / no-op write | CODE |
| LOW⚡ | core/src/FILTER_SYSTEM.md | 100 | const url = new URL(currentUrl); // Step 6: copy (never mutate original) | CODE |
| LOW⚡ | core/src/FILTER_SYSTEM.md | 102 | url.searchParams.set(this.id, serialized); // Step 7: set param | CODE |
| LOW⚡ | core/src/FILTER_SYSTEM.md | 106 | this.deps.updateUrl(url); // Step 8: write to browser URL | CODE |
| LOW⚡ | …gs/series_charts/combo_chart/series/percentageStack.ts | 31 | // Step 1: Calculate totals for each x-value across all series | COMMENT |
| LOW | …gs/series_charts/combo_chart/series/percentageStack.ts | 46 | // Step 2: Transform each series' data to percentages | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 419 | // Step 1: Create a mock processor that simulates filter resolution | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 429 | // Step 2: Define schema with supportsVariables on relevant attributes | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 458 | // Step 3: Component props (as they come from Markdoc) | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 468 | // Step 4: Process all props using schema | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 471 | // Step 5: Verify results | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 619 | // Step 1: Parse user input | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 624 | // Step 2: Apply transformations | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 681 | // Step 3: Handle special alias generation for comparisons and sparklines (after transformations) | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 691 | // Step 4: Format alias for dialect (uppercase for Snowflake, unchanged for ClickHouse) | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 697 | // Step 5: Assemble final SQL (quote alias via the dialect — `"..."` works | COMMENT |
| LOW | core/src/user-components/common/build-comparisons.ts | 192 | // Step 1: Build subject_totals CTE (calculate measures at subject grain) | COMMENT |
| LOW | core/src/user-components/common/build-comparisons.ts | 268 | // Step 2: Build benchmark aggregation | COMMENT |
| LOW⚡ | core/src/user-components/common/COMPARISON_SYSTEM.md | 39 | // Step 1: Resolve variables in comparison props | COMMENT |
| LOW⚡ | core/src/user-components/common/COMPARISON_SYSTEM.md | 48 | // Step 2: Build comparison config | COMMENT |
| LOW⚡ | core/src/user-components/common/COMPARISON_SYSTEM.md | 58 | // Step 3: Include in query config | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 584 | // Step 1: Remove string literals first to avoid parsing inside them | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 587 | // Step 2: Handle quoted identifiers (preserve them as single units) | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 607 | // Step 3: Remove function calls to avoid treating function names as columns | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 613 | // Step 4: Handle PostgreSQL-style type casting with comprehensive patterns | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 616 | // Step 5: Handle aliases - remove "AS alias" constructs | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 619 | // Step 6: Replace operators and punctuation with spaces to isolate identifiers | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 622 | // Step 7: Extract potential column identifiers | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 625 | // Step 8: Convert quoted identifier placeholders back to original names | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 633 | // Step 9: Filter out SQL keywords and validation placeholders (but preserve quoted identifiers even if they match keyw | COMMENT |
| LOW | core/src/filter-variables/VariableProcessor.ts | 76 | // Step 1: Process frontmatter variables ({{ $var }}) if available | COMMENT |
| LOW | core/src/filter-variables/VariableProcessor.ts | 96 | // Step 2: Process filter variables ({{ filter.property }}) if available | COMMENT |
| LOW⚡ | cli/cli/auth.ts | 410 | // Step 1: Request device authorization | COMMENT |
| LOW⚡ | cli/cli/auth.ts | 413 | // Step 2: Display code and open browser | COMMENT |
| LOW⚡ | cli/cli/auth.ts | 421 | // Step 3: Poll for tokens | COMMENT |
| LOW⚡ | cli/cli/auth.ts | 429 | // Step 4: Exchange refresh token for sealed session via Studio API | COMMENT |
| LOW | cli/cli/auth.ts | 459 | // Step 5: Store credentials (with the latest refresh token) | COMMENT |
| LOW | cli/cli/auth.ts | 476 | // Step 6: Create CLI APT token | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/src/Query.svelte.ts | 181 | }); | COMMENT |
| LOW | core/src/Query.svelte.ts | 421 | userLimit, | COMMENT |
| LOW | core/src/Query.svelte.ts | 561 | } | COMMENT |
| LOW | core/src/Query.svelte.ts | 861 | } | COMMENT |
| LOW | core/src/interpolate-query-strings.ts | 521 | COMMENT | |
| LOW | core/src/connectors/postgres/normalize-date-rows.ts | 1 | // Collapse Postgres date/timestamp values to the canonical Evidence date shape | COMMENT |
| LOW | core/src/metrics/resolve-metric.ts | 261 | if (!found) { | COMMENT |
| LOW | …s/Renderer/MarkdocProcessor/MarkdocProcessor.svelte.ts | 281 | #translations = $state<TranslationMap>({}); | COMMENT |
| LOW | …s/Renderer/MarkdocProcessor/MarkdocProcessor.svelte.ts | 301 | // map of name → declared `default:` value (or '' when no default). Empty | COMMENT |
| LOW | …s/Renderer/MarkdocProcessor/MarkdocProcessor.svelte.ts | 401 | // real line + non-empty character range — the editor's decoration | COMMENT |
| LOW | …mponents/Renderer/MarkdocProcessor/register-filters.ts | 101 | } | COMMENT |
| LOW | …user-components/custom-components/build-custom-tags.ts | 421 | : transformChild(body); | COMMENT |
| LOW | …e/src/user-components/tags/dropdown/validation.test.ts | 21 | // On first paint in PDF mode, the options | COMMENT |
| LOW | core/src/user-components/tags/html/schema.ts | 301 | 'canvas', | COMMENT |
| LOW | core/src/user-components/tags/html/Html.svelte | 101 | mutedForeground: surfaceToken('mutedForeground'), | COMMENT |
| LOW | …src/user-components/tags/html/sandbox/runtime-entry.ts | 101 | COMMENT | |
| LOW | …src/user-components/tags/html/sandbox/runtime-entry.ts | 301 | // the failure is invisible to the diagnostics feed and the agent just sees a | COMMENT |
| LOW | core/src/user-components/tags/html/sandbox/html-csp.ts | 141 | // (e.g. `unpkg.com/world-atlas@2/countries-110m.json`, the canonical | COMMENT |
| LOW | core/src/user-components/tags/html/sandbox/html-csp.ts | 201 | // code / WASM from their own CDN at runtime. If we trust the host | COMMENT |
| LOW | …src/user-components/tags/html/sandbox/html-csp.test.ts | 81 | expect(imgSrc).toContain('https://commons.wikimedia.org'); | COMMENT |
| LOW | …c/user-components/tags/html/sandbox/HtmlSandbox.svelte | 201 | // from `state-change` messages (see HtmlMode). Keep this string a literal | COMMENT |
| LOW | …user-components/tags/sparkline/SparklineDisplay.svelte | 61 | }); | COMMENT |
| LOW | …gs/series_charts/combo_chart/format-time-axis-label.ts | 81 | COMMENT | |
| LOW | …gs/series_charts/combo_chart/format-time-axis-label.ts | 141 | } | COMMENT |
| LOW | …gs/series_charts/combo_chart/format-time-axis-label.ts | 181 | // Year rollover uses `yearLabel` — same compact-vs-verbose logic as month | COMMENT |
| LOW | …gs/series_charts/combo_chart/format-time-axis-label.ts | 401 | // read local components below. Any UTC offset is stripped and the wall-clock | COMMENT |
| LOW | …nents/tags/series_charts/combo_chart/ComboChart.svelte | 561 | // Get base axis config, then override for stacking if needed | COMMENT |
| LOW | …nts/tags/series_charts/combo_chart/combo_chart.test.ts | 41 | describe('combo_chart SQL (per-child series queries)', () => { | COMMENT |
| LOW | …nts/tags/series_charts/combo_chart/combo_chart.test.ts | 461 | ); | COMMENT |
| LOW | …ts/tags/series_charts/combo_chart/XAxisModel.svelte.ts | 141 | // True when the axis renders two-tier labels (month/quarter name with the | COMMENT |
| LOW | …ts/tags/series_charts/combo_chart/XAxisModel.svelte.ts | 301 | // non-time / user-fmt'd axes. Time axes without a user `fmt` get the fuller | COMMENT |
| LOW | …ts/tags/series_charts/combo_chart/XAxisModel.svelte.ts | 321 | // lingering tooltips). Reading a derived then triggers Svelte's | COMMENT |
| LOW | …ts/tags/series_charts/combo_chart/XAxisModel.svelte.ts | 481 | isNonTemporalNumericGrain(jsType, this.options.date_grain) || | COMMENT |
| LOW | …ts/tags/series_charts/combo_chart/XAxisModel.svelte.ts | 581 | // so — like chart-area tooltips — it must clear the floating chat pane | COMMENT |
| LOW | …ts/tags/series_charts/combo_chart/XAxisModel.svelte.ts | 601 | // `hideOverlap` is ECharts' greedy collision dropper — only wanted | COMMENT |
| LOW | …ries_charts/combo_chart/x-axis-rendered-labels.test.ts | 641 | if (c.expected) expect(reference).toEqual(c.expected); | COMMENT |
| LOW | …series_charts/combo_chart/series/SeriesModel.svelte.ts | 101 | // participates in `metricCompiled`'s derivation must live here — otherwise | COMMENT |
| LOW | …series_charts/combo_chart/series/SeriesModel.svelte.ts | 221 | const dialect = this.sharedContext.queryDeps.connection.dialect; | COMMENT |
| LOW | …series_charts/combo_chart/series/SeriesModel.svelte.ts | 461 | : (params: { value?: unknown[] }) => { | COMMENT |
| LOW | core/src/user-components/tags/echarts/echarts-themes.ts | 61 | // they don't compete with the plotted data — UI borders (table rows, | COMMENT |
| LOW | …user-components/tags/custom_echart/CustomEChart.svelte | 81 | const resolvedTableName = $derived(resolveText(props.data)); | COMMENT |
| LOW | …components/tags/custom_echart/sandbox/runtime-entry.ts | 61 | // oscillating (mirrors ECharts.svelte's internalExtraHeight trick). | COMMENT |
| LOW | …c/user-components/common/inline-queries.svelte.spec.ts | 1 | // `.svelte.spec.ts` because `SvelteMap` (imported from `svelte/reactivity`) is | COMMENT |
| LOW | …c/user-components/common/inline-queries.svelte.spec.ts | 21 | // change, so setSqlFiles()-with-same-payload happens on every dropdown | COMMENT |
| LOW | core/src/user-components/common/ComponentWrapper.svelte | 341 | COMMENT | |
| LOW | core/src/user-components/common/fill-gaps.ts | 141 | // ────────────────────────────────────────────────────────────────────────── | COMMENT |
| LOW | core/src/user-components/common/inline-queries.ts | 361 | return undefined; | COMMENT |
| LOW | core/src/user-components/sandbox/protocol-base.ts | 81 | type: 'rendered'; | COMMENT |
| LOW | core/src/user-components/sandbox/protocol-base.ts | 121 | // URL (custom_echart via ECharts' chart.getDataURL, html via | COMMENT |
| LOW | …rc/user-components/sandbox/SandboxFrame.svelte.test.ts | 181 | // No onError call means the message was silently ignored, which is the | COMMENT |
| LOW | core/src/user-components/sandbox/SandboxFrame.svelte | 281 | if (iframeEl) unregisterSandboxFrameCapture(iframeEl); | COMMENT |
| LOW | core/src/user-components/validators/tableExists.ts | 121 | const inlineQueryNames = | COMMENT |
| LOW | core/src/filter-variables/frontmatter-variable.ts | 1 | // Canonical grammar for frontmatter variable references ({{ $var }}) and their | COMMENT |
| LOW | core/src/constants/default-theme.ts | 81 | // Off by default: gridlines already establish the axis, and a bottom | COMMENT |
| LOW | core/src/shadcn/index.ts | 1 | // Re-export shadcn utilities | COMMENT |
| LOW | core/src/shadcn/components/ui/command/index.ts | 41 | // downstream packages can grab unwrapped primitives (e.g. `.Input`) | COMMENT |
| LOW | core/src/sql-dialect/cube.ts | 61 | // Cube's SQL API reference has no IS NOT DISTINCT FROM; expand it (as Fabric/BigQuery do). | COMMENT |
| LOW | core/src/sql-dialect/fabric.ts | 121 | applyRowLimit(sql: string, limit: number): string { | COMMENT |
| LOW | core/src/sql-dialect/fabric.ts | 141 | // FROM (body) AS __ev_limit_wrap [suffix]`. Outer TOP clamps. | COMMENT |
| LOW | core/src/theme/build-theme-yaml.ts | 21 | return `# Theme Configuration | COMMENT |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | …gs/series_charts/combo_chart/series/percentageStack.ts | 31 | // Step 1: Calculate totals for each x-value across all series | COMMENT |
| LOW | …gs/series_charts/combo_chart/series/percentageStack.ts | 46 | // Step 2: Transform each series' data to percentages | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 419 | // Step 1: Create a mock processor that simulates filter resolution | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 429 | // Step 2: Define schema with supportsVariables on relevant attributes | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 458 | // Step 3: Component props (as they come from Markdoc) | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 468 | // Step 4: Process all props using schema | COMMENT |
| LOW⚡ | …user-components/common/use-variable-processing.test.ts | 471 | // Step 5: Verify results | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 619 | // Step 1: Parse user input | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 624 | // Step 2: Apply transformations | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 681 | // Step 3: Handle special alias generation for comparisons and sparklines (after transformations) | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 691 | // Step 4: Format alias for dialect (uppercase for Snowflake, unchanged for ClickHouse) | COMMENT |
| LOW⚡ | core/src/user-components/common/sql-expression-utils.ts | 697 | // Step 5: Assemble final SQL (quote alias via the dialect — `"..."` works | COMMENT |
| LOW | core/src/user-components/common/build-comparisons.ts | 192 | // Step 1: Build subject_totals CTE (calculate measures at subject grain) | COMMENT |
| LOW | core/src/user-components/common/build-comparisons.ts | 268 | // Step 2: Build benchmark aggregation | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 584 | // Step 1: Remove string literals first to avoid parsing inside them | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 587 | // Step 2: Handle quoted identifiers (preserve them as single units) | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 607 | // Step 3: Remove function calls to avoid treating function names as columns | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 613 | // Step 4: Handle PostgreSQL-style type casting with comprehensive patterns | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 616 | // Step 5: Handle aliases - remove "AS alias" constructs | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 619 | // Step 6: Replace operators and punctuation with spaces to isolate identifiers | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 622 | // Step 7: Extract potential column identifiers | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 625 | // Step 8: Convert quoted identifier placeholders back to original names | COMMENT |
| LOW⚡ | …rc/user-components/validators/validateSqlExpression.ts | 633 | // Step 9: Filter out SQL keywords and validation placeholders (but preserve quoted identifiers even if they match keyw | COMMENT |
| LOW | core/src/filter-variables/VariableProcessor.ts | 76 | // Step 1: Process frontmatter variables ({{ $var }}) if available | COMMENT |
| LOW | core/src/filter-variables/VariableProcessor.ts | 96 | // Step 2: Process filter variables ({{ filter.property }}) if available | COMMENT |
| LOW⚡ | cli/cli/auth.ts | 410 | // Step 1: Request device authorization | COMMENT |
| LOW⚡ | cli/cli/auth.ts | 413 | // Step 2: Display code and open browser | COMMENT |
| LOW⚡ | cli/cli/auth.ts | 421 | // Step 3: Poll for tokens | COMMENT |
| LOW⚡ | cli/cli/auth.ts | 429 | // Step 4: Exchange refresh token for sealed session via Studio API | COMMENT |
| LOW | cli/cli/auth.ts | 459 | // Step 5: Store credentials (with the latest refresh token) | COMMENT |
| LOW | cli/cli/auth.ts | 476 | // Step 6: Create CLI APT token | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | core/src/user-components/tags/funnel_chart/schema.ts | 45 | // Kept in the slash-command scaffold (raw-mode default) though not required. | COMMENT |
| MEDIUM | core/src/user-components/tags/funnel_chart/schema.ts | 78 | // Kept in the slash-command scaffold (raw-mode default) though not required. | COMMENT |
| MEDIUM | core/src/user-components/tags/pie_chart/schema.ts | 46 | // Kept in the slash-command scaffold (raw-mode default) though not required. | COMMENT |
| MEDIUM | core/src/user-components/tags/pie_chart/schema.ts | 79 | // Kept in the slash-command scaffold (raw-mode default) though not required. | COMMENT |
| MEDIUM | core/src/user-components/tags/table/schema.ts | 49 | // Kept in the slash-command scaffold (raw-mode default) though not required. | COMMENT |
| MEDIUM | core/src/user-components/tags/table/measure/schema.ts | 212 | // Kept in the slash-command scaffold (raw-mode default) though not required. | COMMENT |
| MEDIUM | …user-components/tags/series_charts/bar_chart/schema.ts | 69 | // data/x/y in the slash-command scaffold (the raw-mode starting point). | COMMENT |
| MEDIUM | …er-components/tags/series_charts/combo_chart/schema.ts | 38 | // Kept in the slash-command scaffold as the default authoring pattern; not | COMMENT |
| MEDIUM | …ser-components/tags/series_charts/area_chart/schema.ts | 64 | // data/x/y in the slash-command scaffold (the raw-mode starting point). | COMMENT |
| MEDIUM | …ser-components/tags/series_charts/line_chart/schema.ts | 60 | // data/x/y in the slash-command scaffold (the raw-mode starting point). | COMMENT |
| MEDIUM | core/src/user-components/tags/bigvalue/schema.ts | 146 | // Kept in the slash-command scaffold (raw-mode default) though not required. | COMMENT |
| MEDIUM | core/src/user-components/tags/bigvalue/schema.ts | 167 | // Kept in the slash-command scaffold (raw-mode default) though not required. | COMMENT |
| MEDIUM | core/src/theme/THEMES.md | 601 | ├── build-theme-yaml.ts # Starter theme.yaml scaffold for new projects | CODE |
| MEDIUM | cli/cli/args.ts | 385 | // --force / -f overwrites scaffold files in a non-empty target. | COMMENT |
| MEDIUM | cli/cli/init/init.test.ts | 172 | // scaffold files should NOT have been written | COMMENT |
| MEDIUM | cli/cli/init/init.test.ts | 204 | // Fresh scaffold present | COMMENT |
| MEDIUM | cli/cli/init/init.test.ts | 208 | // .gitignore is the standard scaffold, not the prior custom content | COMMENT |
| MEDIUM | cli/cli/init/init.test.ts | 245 | // The unedited scaffold must NOT load — the placeholder guard blocks a | COMMENT |
| MEDIUM | cli/cli/init/init.test.ts | 270 | // The scaffold (inline password auth) must resolve end-to-end. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …nderer/MarkdocProcessor/process-markdoc.svelte.spec.ts | 637 | expect(treeString).toContain('John Doe'); | CODE |
| LOW | core/src/user-components/tags/custom_echart/schema.ts | 400 | encode: { x: 'step', y: 'placeholder' } }, | CODE |
| LOW | core/src/user-components/common/zod-attribute.test.ts | 24 | name: 'Acme Corp', | CODE |
| LOW | core/src/user-components/common/zod-attribute.test.ts | 34 | expect(result).toBe('Acme Corp'); | CODE |
| LOW | cli/cli/auth.test.ts | 56 | email: 'test@test.com', | CODE |
| LOW | cli/cli/auth.test.ts | 434 | expect(out).toContain('Jane Doe'); | CODE |
| LOW | cli/cli/migrate/transform.ts | 1145 | unsupported: ['row', 'placeholder'], | CODE |
| LOW | cli/src/lib/auth/credentials.server.test.ts | 27 | user: { id: 'u1', email: 'test@test.com' }, | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | core/src/user-components/sandbox/protocol-base.ts | 94 | // runtime bundle, AI-generated author code that constructs bad postMessage | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | core/src/constants/default-theme.ts | 14 | light: '#ffffff', // Match base for seamless cards | CODE |
| MEDIUM | core/src/constants/default-theme.ts | 14 | light: '#ffffff', // Match base for seamless cards | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | core/src/user-components/tags/table/measure/schema.ts | 502 | // TODO: Add validation for scale_column once we determine proper validation strategy for SQL expressions | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/scripts/install.sh | 137 | # Check if it's on PATH | COMMENT |