pipeline

const (
	// CallerKindFunction — caller is a free function body (Go func, Python
	// def at module level, Rust fn, etc.). Default for non-method callable.
	CallerKindFunction = "function-body"

	// CallerKindMethod — caller is a method body (struct receiver, Python
	// class method, Rust impl block fn, Java/Kotlin class method).
	CallerKindMethod = "method-body"

	// CallerKindPackageInit — caller is an explicit package initializer
	// (Go `func init()`, Python `__init__.py` module body's init-time
	// statements, Rust `#[ctor]`-style). The resolver currently lumps
	// these into the synthetic-module-caller path; we use this kind when
	// the caller QN's last segment is literally "init".
	CallerKindPackageInit = "package-init-block"

	// CallerKindFileBlock — caller is the synthetic module-level caller
	// (`EnclosingFuncQN == ""` at the C-side extractor, resolved to
	// moduleQN + edgeType=CALLS_PSEUDO on the Go side). Top-level
	// function-call statements that aren't inside any callable scope.
	CallerKindFileBlock = "file-block"

	// CallerKindTypeDecl — caller is a type declaration (Go method on a
	// type, Rust impl block header, Python class body before any def).
	// Currently rare; reserved for future extractor enhancements.
	CallerKindTypeDecl = "type-decl"

	// CallerKindVarInit — caller is a package-level variable initializer
	// (`var x = expensive()` in Go, module-level `X = compute()` in
	// Python). Detected via the same module-level synthetic-caller path
	// as file-block; distinguishing requires extractor support that
	// doesn't yet exist, so for now var-init flows through
	// CallerKindFileBlock. Reserved for resolver enhancement.
	CallerKindVarInit = "var-init"

	// CallerKindTest — caller is a test function body. Detected via
	// IsTest on the caller's Definition (set by the CBM extractor from
	// `_test.go` / TestXxx / pytest discovery).
	CallerKindTest = "test-body"

	// CallerKindClosure — caller is an anonymous function / lambda /
	// closure expression. Reserved; the CBM extractor does not currently
	// emit a stable QN for closures, so this kind is unused today.
	CallerKindClosure = "closure"

	// CallerKindUnknown — fallback when no classification rule fires.
	// Should be 0% on healthy inputs; non-zero counts indicate either
	// a registry-lookup miss or a new caller shape we haven't covered.
	CallerKindUnknown = "unknown"
)

const (
	// CandidateSetPropertyName is the JSON key in edge properties that
	// stores the resolver's pre-tie-break candidate-set cardinality.
	// Pinned string — harness baselines and the generated column
	// definition reference it by name.
	CandidateSetPropertyName = "candidate_set_size"

	// CandidateSetSizeUnknown sentinel — used when a code path emits an
	// edge without going through a resolution step that exposes its
	// candidate count. Stored as -1 (rather than 0 or NULL) to keep the
	// "unknown" signal greppable and distinguishable from "1 candidate"
	// in queries. NULL would alias with pre-migration rows; 0 would
	// alias with "resolver found nothing but emitted anyway" which is a
	// real bug class we want surfaced. -1 is the explicit sentinel.
	CandidateSetSizeUnknown = -1

	// CandidateSetSizeLSPDefault — LSP-resolved calls carry size=1 by
	// definition. The C-side LSP returns one resolved target per call
	// site; we cannot enumerate alternates without invasive C-side
	// refactoring. Documented as a limitation in the package comment.
	CandidateSetSizeLSPDefault = 1
)

const (
	// NixServiceOptionPrefixEnv overrides the option-set prefix that service
	// declarations live under (default "services" → options.services.<name>).
	NixServiceOptionPrefixEnv = "CODE_GRAPH_NIX_SERVICE_OPTION_PREFIX"
	// NixPkgsPrefixEnv overrides the package-set prefix used to detect the
	// binary a service runs (default "pkgs" → ${pkgs.<pkg>}/bin/<binary>).
	NixPkgsPrefixEnv = "CODE_GRAPH_NIX_PKGS_PREFIX"
)

const (
	// ResolverRuleExactQN — direct fully-qualified-name match. Today only
	// the LSP-resolved path (collectLSPResolvedEdges) when the LSP
	// strategy is neither receiver- nor interface-dispatch labels here.
	// Strategy strings: anything from cbm.ResolvedCall.Strategy that
	// doesn't start with "lsp_type_", "lsp_embed_", or "lsp_interface_".
	ResolverRuleExactQN = "exact-qn-match"

	// ResolverRuleReceiverQualified — method call resolved via receiver
	// type. LSP strategies "lsp_type_dispatch" and "lsp_embed_dispatch"
	// route here (the C-side LSP resolves the obj's type then looks up
	// method on the type, embedded type included).
	ResolverRuleReceiverQualified = "receiver-qualified"

	// ResolverRuleInterfaceDispatch — Go interface-satisfaction or
	// type-dispatch path. LSP strategies "lsp_interface_dispatch" and
	// "lsp_interface_resolve" route here. Also: the Go-side
	// `resolveCallWithTypes` "type_dispatch" strategy (TypeMap lookup
	// produces classQN+method that exists in the registry).
	ResolverRuleInterfaceDispatch = "interface-dispatch"

	// ResolverRuleSelfMethod — method call on the same instance, e.g.
	// Python's `self.x()` resolved against the enclosing class QN. Fires
	// in resolveCallEdge when calleeName starts with "self.".
	ResolverRuleSelfMethod = "self-method"

	// ResolverRuleSamePackageShadow — same-package symbol resolution.
	// Registry "same_module" strategy: callee was found at moduleQN +
	// "." + name (the caller's own module).
	ResolverRuleSamePackageShadow = "same-package-shadow"

	// ResolverRuleCrossPackageImportMap — registry "import_map" strategy.
	// Resolved through an EXPLICIT import: the imported alias was looked
	// up in the per-file import-map and the alias' definition was found.
	// This is the precise sub-bucket of the cross-package family;
	// 2026-05-06 baselines show 0.88-0.95 precision on Go fixtures.
	ResolverRuleCrossPackageImportMap = "cross-package-import-map"

	// ResolverRuleCrossPackageUniqueName — registry "unique_name" strategy.
	// Resolved by project-wide unique-name lookup (callee's simple name
	// has exactly one definition project-wide). Distinct from
	// import-map because it doesn't require the call site to import the
	// definition's module — the uniqueness of the name is the only
	// resolution signal.
	ResolverRuleCrossPackageUniqueName = "cross-package-unique-name"

	// ResolverRuleCrossPackageSuffix — registry "suffix_match" or
	// "import_map_suffix" strategies. The DANGEROUS sub-bucket: the
	// resolver matched the callee's simple name against the suffix of a
	// project-wide qualified name. This is the fall-through path that
	// produced the PR #165 phantom regression class (155+ phantom edges
	// from normalized Rust `Foo::new` matching against unrelated `.new`
	// methods). Drop-on-no-match is the targeted Rec 1 fix for this
	// sub-bucket. 2026-05-06 baselines show this bucket has 0.07-0.23
	// precision on Python adversarial fixtures (essentially noise).
	ResolverRuleCrossPackageSuffix = "cross-package-suffix"

	// ResolverRuleCrossPackageHeuristic — DEPRECATED 2026-05-06. The
	// original lumped bucket was split into ImportMap / UniqueName /
	// Suffix because per-fixture precision varied by an order of
	// magnitude (0.07 on flask vs 0.95 on code-graph), which the lumped
	// bucket couldn't surface. New code should NOT emit this string;
	// existing code paths that historically referenced it have been
	// updated to use the appropriate sub-bucket. Constant retained as
	// a compile-time anchor for legacy baselines (which carry the old
	// string in their JSON dumps) and as the canonical name for the
	// FAMILY across all three sub-buckets in helper predicates like
	// `isCrossPackageRule`.
	ResolverRuleCrossPackageHeuristic = "cross-package-heuristic"

	// ResolverRulePackageBlockFallback — emission where the caller is a
	// package- or file-level block rather than a real function scope.
	// Today this case is fully subsumed by ResolverRuleModalPseudo
	// (which fires when edgeType == CALLS_PSEUDO). Reserved for future
	// extractor enhancements (e.g. var-init or type-decl emission paths
	// that don't go through CALLS_PSEUDO).
	ResolverRulePackageBlockFallback = "package-block-fallback"

	// ResolverRuleFuzzyResolve — last-resort name match via
	// FunctionRegistry.FuzzyResolve (registry "fuzzy" strategy). Fires
	// when neither the type-dispatch path nor the structured registry
	// strategies produced a candidate — the resolver falls back to
	// matching purely on simple name and picks the best candidate by
	// import distance. Lowest pre-emit confidence; a high share of FPs
	// here is a known failure mode.
	ResolverRuleFuzzyResolve = "fuzzy-resolve"

	// ResolverRuleModalExternal — CALLS_EXTERNAL emission (LSP-resolved
	// external symbol; target is a synthesized stub). Set in
	// buildEdgesFromResults when the stub-target check upgrades a CALLS
	// edge to CALLS_EXTERNAL. Overrides the original rule because the
	// "external" modal classification is the dominant signal.
	ResolverRuleModalExternal = "modal-external"

	// ResolverRuleModalPseudo — CALLS_PSEUDO emission (synthetic
	// module-default caller). Set when the resolver substitutes
	// moduleQN for an empty EnclosingFuncQN. Overrides whatever the
	// underlying registry/LSP rule would have chosen because the
	// pseudo-caller property is the dominant signal.
	ResolverRuleModalPseudo = "modal-pseudo"

	// ResolverRuleUnresolvedEmitted — emitted despite no confident
	// resolution path firing. Reserved for diagnostics; today the
	// emission paths all bail out before reaching this state (no
	// ambiguous emits). Non-zero counts in production indicate a
	// resolver bug.
	ResolverRuleUnresolvedEmitted = "unresolved-emitted"

	// ResolverRuleUnknown — fallback when no classification rule fires.
	// Should be 0% on healthy inputs; non-zero counts indicate either a
	// new emit path we haven't covered or an unexpected strategy string
	// from CBM/LSP. Acts as the safe default for future extractor
	// changes.
	ResolverRuleUnknown = "unknown"
)

const (
	RoleAuthBoundary        = "auth_boundary"
	RoleInputEntryPoint     = "input_entry_point"
	RoleSensitiveSink       = "sensitive_sink"
	RoleCryptoOperation     = "crypto_operation"
	RolePrivilegeEscalation = "privilege_escalation"
	RoleSessionManagement   = "session_management"
	RoleAuditLogging        = "audit_logging"
	RoleSanitizer           = "sanitizer"
)

const (
	// input_entry_point subtypes
	SubtypeHTTPHandler      = "http_handler"
	SubtypeCLIEntry         = "cli_entry"
	SubtypeGRPCHandler      = "grpc_handler"
	SubtypeWebSocketHandler = "websocket_handler"

	// sensitive_sink subtypes
	SubtypeSQLQuery    = "sql_query"
	SubtypeShellExec   = "shell_exec"
	SubtypeFileWrite   = "file_write"
	SubtypeNetworkSend = "network_send"
	SubtypeHardwareIO  = "hardware_io"

	// crypto_operation subtypes
	SubtypeEncryption    = "encryption"
	SubtypeHashing       = "hashing"
	SubtypeSigning       = "signing"
	SubtypeKeyGeneration = "key_generation"

	// auth_boundary subtypes
	SubtypeAuthCheck = "auth_check"

	// sanitizer subtypes
	SubtypeInputValidation = "input_validation"
	SubtypeTypeCheck       = "type_check"
	SubtypeEscapeEncode    = "escape_encode"
	SubtypeBoundsCheck     = "bounds_check"
)

const EnrichmentVersion = "2026.03.16.1"