@kernlang/review 3.1.6 → 3.1.8

package/dist/suppression/parse-directives.js.map

@@ -1 +1 @@
-{"version":3,"file":"parse-directives.js","sourceRoot":"","sources":["../../src/suppression/parse-directives.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,kBAAkB;IAClB,oBAAoB;IACpB,eAAe;IACf,mBAAmB;IACnB,oBAAoB;CACrB,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,YAAY,GAAG,mDAAmD,CAAC;AACzE,iDAAiD;AACjD,MAAM,YAAY,GAAG,gDAAgD,CAAC;AACtE,iDAAiD;AACjD,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;IAChE,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACjD,MAAM,aAAa,GAAG,QAAQ;QAC5B,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACpD,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtB,yDAAyD;QACzD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,kBAAkB;gBAC1B,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,4EAA4E;gBACrF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;gBACvG,WAAW,EAAE,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC;aAC/D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEvE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,yDAAyD;QACzD,IAAI,WAAW,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,sBAAsB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,gFAAgF,OAAO,GAAG;gBACnG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;gBACvG,WAAW,EAAE,iBAAiB,CAAC,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACnD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,gBAAgB,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,+BAA+B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;oBAC/N,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;oBACvG,WAAW,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC;iBAClE,CAAC,CAAC;gBACH,+CAA+C;gBAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACtC,2CAA2C;gBAC3C,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,MAAM;gBACZ,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,OAAO;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,kFAAkF;YAClF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,QAAQ;gBAC5B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;gBAC/D,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAE7B,IAAI,UAAkB,CAAC;YACvB,IAAI,aAAa,EAAE,CAAC;gBAClB,wCAAwC;gBACxC,UAAU,GAAG,OAAO,CAAC,CAAC,WAAW;gBACjC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjC,IAAI,QAAQ,KAAK,EAAE;wBAAE,SAAS;oBAC9B,IAAI,aAAa,CAAC,QAAQ,CAAC;wBAAE,SAAS;oBACtC,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,UAAU,GAAG,OAAO,CAAC;YACvB,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,MAAM;gBACZ,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,OAAO;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAuB;IACtD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,CAAC;YACN,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"parse-directives.js","sourceRoot":"","sources":["../../src/suppression/parse-directives.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,yEAAyE;AACzE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,kBAAkB;IAClB,oBAAoB;IACpB,eAAe;IACf,mBAAmB;IACnB,oBAAoB;CACrB,CAAC,CAAC;AAEH,kDAAkD;AAClD,MAAM,YAAY,GAAG,mDAAmD,CAAC;AACzE,iDAAiD;AACjD,MAAM,YAAY,GAAG,gDAAgD,CAAC;AACtE,iDAAiD;AACjD,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,QAAgB;IAEhB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,gBAAgB,GAAG,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;IAChE,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACjD,MAAM,aAAa,GAAG,QAAQ;QAC5B,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACpD,CAAC,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAExD,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QAEtB,yDAAyD;QACzD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,kBAAkB;gBAC1B,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,4EAA4E;gBACrF,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;gBACvG,WAAW,EAAE,iBAAiB,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC;aAC/D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEnC,yDAAyD;QACzD,IAAI,WAAW,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,sBAAsB;gBAC9B,QAAQ,EAAE,SAAS;gBACnB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,gFAAgF,OAAO,GAAG;gBACnG,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;gBACvG,WAAW,EAAE,iBAAiB,CAAC,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC;aACnE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,+EAA+E;QAC/E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACnD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,QAAQ,EAAE,SAAS;oBACnB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,gBAAgB,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,+BAA+B,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC;oBAC/N,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;oBACvG,WAAW,EAAE,iBAAiB,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC;iBAClE,CAAC,CAAC;gBACH,+CAA+C;gBAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBACtC,2CAA2C;gBAC3C,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,MAAM;gBACZ,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,OAAO;aACrB,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,kEAAkE;YAClE,kFAAkF;YAClF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;YACjC,MAAM,aAAa,GAAG,QAAQ;gBAC5B,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;gBAC/D,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAE7B,IAAI,UAAkB,CAAC;YACvB,IAAI,aAAa,EAAE,CAAC;gBAClB,wCAAwC;gBACxC,UAAU,GAAG,OAAO,CAAC,CAAC,WAAW;gBACjC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC1C,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;oBACjC,IAAI,QAAQ,KAAK,EAAE;wBAAE,SAAS;oBAC9B,IAAI,aAAa,CAAC,QAAQ,CAAC;wBAAE,SAAS;oBACtC,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;oBACnB,MAAM;gBACR,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,UAAU,GAAG,OAAO,CAAC;YACvB,CAAC;YAED,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,MAAM;gBACZ,OAAO;gBACP,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,QAAQ;gBAChB,WAAW,EAAE,OAAO;aACrB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,aAAuB;IACtD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO;QACL;YACE,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,aAAa;YACtB,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,QAAQ;SACjB;KACF,CAAC;AACJ,CAAC"}

package/dist/taint-ast.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Taint Tracking — AST-based engine using ts-morph.
+ *
+ * Handles destructuring, method chains, computed property access,
+ * and interprocedural taint through intra-file call graph.
+ */
+import { type SourceFile } from 'ts-morph';
+import type { InternalSinkFunction, TaintResult } from './taint-types.js';
+import type { InferResult } from './types.js';
+/**
+ * Build a map of internal functions that contain sinks.
+ * For each function, determine which parameters flow to sinks.
+ * This enables interprocedural taint: processInput(req.body) → exec() is now visible.
+ */
+export declare function buildInternalSinkMap(sourceFile: SourceFile): Map<string, InternalSinkFunction>;
+/**
+ * AST-based taint analysis — walks real ts-morph AST nodes instead of regex on strings.
+ * Handles destructuring, method chains, computed property access.
+ */
+export declare function analyzeTaintAST(_inferred: InferResult[], filePath: string, sourceFile: SourceFile): TaintResult[];

package/dist/taint-ast.js

@@ -0,0 +1,427 @@
+/**
+ * Taint Tracking — AST-based engine using ts-morph.
+ *
+ * Handles destructuring, method chains, computed property access,
+ * and interprocedural taint through intra-file call graph.
+ */
+import { SyntaxKind, } from 'ts-morph';
+import { HTTP_PARAM_NAMES, HTTP_PARAM_TYPES, isSanitizerSufficient, SANITIZER_PATTERN_NAMES, SINK_NAMES, } from './taint-types.js';
+// ── Intra-File Sink Map ─────────────────────────────────────────────────
+/**
+ * Build a map of internal functions that contain sinks.
+ * For each function, determine which parameters flow to sinks.
+ * This enables interprocedural taint: processInput(req.body) → exec() is now visible.
+ */
+export function buildInternalSinkMap(sourceFile) {
+    const sinkMap = new Map();
+    const allFns = [];
+    for (const fn of sourceFile.getFunctions()) {
+        const name = fn.getName();
+        if (name)
+            allFns.push({ name, node: fn });
+    }
+    for (const stmt of sourceFile.getVariableStatements()) {
+        for (const decl of stmt.getDeclarations()) {
+            const init = decl.getInitializer();
+            if (init && (init.getKindName() === 'ArrowFunction' || init.getKindName() === 'FunctionExpression')) {
+                allFns.push({ name: decl.getName(), node: init });
+            }
+        }
+    }
+    for (const { name, node: fn } of allFns) {
+        const params = fn.getParameters();
+        const body = fn.getBody();
+        if (!body || params.length === 0)
+            continue;
+        // Collect all calls in the body that hit a known sink
+        const calls = [];
+        body.forEachDescendant((n) => {
+            if (n.getKindName() === 'CallExpression')
+                calls.push(n);
+        });
+        const taintedParamIndices = new Set();
+        const sinkCategories = new Map();
+        for (const call of calls) {
+            const calleeName = getCalleeBaseName(call);
+            const sinkDef = SINK_NAMES.get(calleeName);
+            if (!sinkDef)
+                continue;
+            // Check which parameter names appear in the sink's arguments
+            for (const arg of call.getArguments()) {
+                const argText = arg.getText();
+                for (let i = 0; i < params.length; i++) {
+                    const paramName = params[i].getName();
+                    if (argText === paramName || argText.startsWith(`${paramName}.`) || argText.startsWith(`${paramName}[`)) {
+                        taintedParamIndices.add(i);
+                        if (!sinkCategories.has(i))
+                            sinkCategories.set(i, new Set());
+                        sinkCategories.get(i).add(sinkDef);
+                    }
+                }
+            }
+            // Also check template literal arguments
+            for (const arg of call.getArguments()) {
+                if (arg.getKindName() === 'TemplateExpression') {
+                    for (const tplSpan of arg.getTemplateSpans()) {
+                        const expr = tplSpan.getExpression();
+                        const exprText = expr.getText();
+                        for (let i = 0; i < params.length; i++) {
+                            const paramName = params[i].getName();
+                            if (exprText === paramName || exprText.startsWith(`${paramName}.`)) {
+                                taintedParamIndices.add(i);
+                                if (!sinkCategories.has(i))
+                                    sinkCategories.set(i, new Set());
+                                sinkCategories.get(i).add(sinkDef);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        if (taintedParamIndices.size > 0) {
+            sinkMap.set(name, { name, taintedParamIndices, sinkCategories });
+        }
+    }
+    return sinkMap;
+}
+// ── Main AST Analysis ───────────────────────────────────────────────────
+/**
+ * AST-based taint analysis — walks real ts-morph AST nodes instead of regex on strings.
+ * Handles destructuring, method chains, computed property access.
+ */
+export function analyzeTaintAST(_inferred, filePath, sourceFile) {
+    const results = [];
+    // Build intra-file call graph: which internal functions contain sinks?
+    const internalSinkMap = buildInternalSinkMap(sourceFile);
+    // Collect all function-like AST nodes from the SourceFile
+    const allFns = [];
+    for (const fn of sourceFile.getFunctions())
+        allFns.push({ node: fn, startLine: fn.getStartLineNumber() });
+    for (const stmt of sourceFile.getVariableStatements()) {
+        for (const decl of stmt.getDeclarations()) {
+            const init = decl.getInitializer();
+            if (init) {
+                const initKind = init.getKindName();
+                if (initKind === 'ArrowFunction' || initKind === 'FunctionExpression') {
+                    allFns.push({ node: init, startLine: stmt.getStartLineNumber() });
+                }
+            }
+        }
+    }
+    for (const cls of sourceFile.getClasses()) {
+        for (const method of cls.getMethods()) {
+            allFns.push({ node: method, startLine: method.getStartLineNumber() });
+        }
+    }
+    for (const { node: fn, startLine } of allFns) {
+        const params = fn.getParameters();
+        const fnName = 'getName' in fn && typeof fn.getName === 'function' ? fn.getName() || 'anonymous' : 'anonymous';
+        // Step 1: Classify params as tainted using type info
+        const taintedParams = [];
+        for (const param of params) {
+            const name = param.getName();
+            const typeText = param.getType().getText(param);
+            if (HTTP_PARAM_NAMES.test(name) || HTTP_PARAM_TYPES.test(typeText)) {
+                taintedParams.push({ name, origin: `${name} (HTTP input)` });
+            }
+        }
+        if (taintedParams.length === 0)
+            continue;
+        // Step 2: AST-based taint propagation through the function body
+        const body = fn.getBody();
+        if (!body)
+            continue;
+        const taintedNames = new Set(taintedParams.map((p) => p.name));
+        const taintedVars = new Map();
+        for (const p of taintedParams)
+            taintedVars.set(p.name, p);
+        // Walk ALL variable declarations including nested scopes (if/for/while)
+        // forEachDescendant visits in document order = parent-before-child
+        const varDecls = [];
+        body.forEachDescendant((node) => {
+            if (node.getKind() === SyntaxKind.VariableDeclaration) {
+                varDecls.push(node);
+            }
+        });
+        // Multiple passes to handle forward dependencies (max 3 hops)
+        for (let hop = 0; hop < 3; hop++) {
+            for (const decl of varDecls) {
+                const nameNode = decl.getNameNode();
+                const nameKind = nameNode.getKindName();
+                // Simple name binding: const id = parseInt(req.body.id)
+                if (nameKind === 'Identifier') {
+                    const declName = nameNode.getText();
+                    if (taintedNames.has(declName))
+                        continue;
+                    const init = decl.getInitializer();
+                    if (!init)
+                        continue;
+                    if (astExprRefersToTainted(init, taintedNames)) {
+                        taintedNames.add(declName);
+                        const srcName = findTaintedIdentifier(init, taintedNames);
+                        const srcVar = srcName ? taintedVars.get(srcName) : undefined;
+                        const srcOrigin = srcVar?.origin;
+                        taintedVars.set(declName, { name: declName, origin: srcOrigin || 'derived' });
+                    }
+                }
+                // Object destructuring: const { x, y } = taintedObj
+                if (nameKind === 'ObjectBindingPattern') {
+                    const init = decl.getInitializer();
+                    if (!init || !astExprRefersToTainted(init, taintedNames))
+                        continue;
+                    const srcName = findTaintedIdentifier(init, taintedNames);
+                    const srcVar2 = srcName ? taintedVars.get(srcName) : undefined;
+                    const srcOrigin = srcVar2?.origin;
+                    for (const element of nameNode.getElements()) {
+                        const elName = element.getName();
+                        if (!taintedNames.has(elName)) {
+                            taintedNames.add(elName);
+                            taintedVars.set(elName, { name: elName, origin: srcOrigin || 'destructured' });
+                        }
+                    }
+                }
+                // Array destructuring: const [a, b] = taintedArr
+                if (nameKind === 'ArrayBindingPattern') {
+                    const init = decl.getInitializer();
+                    if (!init || !astExprRefersToTainted(init, taintedNames))
+                        continue;
+                    const srcName = findTaintedIdentifier(init, taintedNames);
+                    const srcVar3 = srcName ? taintedVars.get(srcName) : undefined;
+                    const srcOrigin = srcVar3?.origin;
+                    for (const element of nameNode.getElements()) {
+                        if (element.getKindName() === 'BindingElement') {
+                            const elName = element.getName();
+                            if (!taintedNames.has(elName)) {
+                                taintedNames.add(elName);
+                                taintedVars.set(elName, { name: elName, origin: srcOrigin || 'destructured' });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+        // Step 3: Find sinks via AST CallExpression walk
+        const sinks = [];
+        const calls = [];
+        body.forEachDescendant((n) => {
+            if (n.getKindName() === 'CallExpression')
+                calls.push(n);
+        });
+        for (const call of calls) {
+            const calleeName = getCalleeBaseName(call);
+            const sinkDef = SINK_NAMES.get(calleeName);
+            if (!sinkDef)
+                continue;
+            // Check if any argument references a tainted variable
+            for (const arg of call.getArguments()) {
+                const taintedArg = findTaintedIdentifier(arg, taintedNames);
+                if (taintedArg) {
+                    sinks.push({
+                        name: calleeName,
+                        category: sinkDef,
+                        taintedArg,
+                        line: call.getStartLineNumber(),
+                    });
+                    break;
+                }
+            }
+            // Also check template literal arguments
+            const templateArgs = call.getArguments().filter((a) => {
+                const k = a.getKindName();
+                return k === 'TemplateExpression' || k === 'NoSubstitutionTemplateLiteral';
+            });
+            for (const tpl of templateArgs) {
+                if (tpl.getKindName() === 'TemplateExpression') {
+                    for (const span of tpl.getTemplateSpans()) {
+                        const expr = span.getExpression();
+                        const taintedArg = findTaintedIdentifier(expr, taintedNames);
+                        if (taintedArg) {
+                            sinks.push({
+                                name: `${calleeName} (template)`,
+                                category: sinkDef,
+                                taintedArg,
+                                line: call.getStartLineNumber(),
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        // Step 3b: Interprocedural — check calls to internal functions that contain sinks
+        for (const call of calls) {
+            const calleeName = getCalleeBaseName(call);
+            // Skip if it's already a known sink (handled above)
+            if (SINK_NAMES.has(calleeName))
+                continue;
+            const internalFn = internalSinkMap.get(calleeName);
+            if (!internalFn)
+                continue;
+            // Check if tainted data is passed to a parameter that reaches a sink
+            const callArgs = call.getArguments();
+            for (const [paramIdx, categories] of internalFn.sinkCategories) {
+                if (paramIdx >= callArgs.length)
+                    continue;
+                const arg = callArgs[paramIdx];
+                const taintedArg = findTaintedIdentifier(arg, taintedNames);
+                if (taintedArg) {
+                    // Emit one sink per category (a param may reach both exec() and query())
+                    for (const sinkCategory of categories) {
+                        sinks.push({
+                            name: `${calleeName} → sink`,
+                            category: sinkCategory,
+                            taintedArg,
+                            line: call.getStartLineNumber(),
+                        });
+                    }
+                }
+            }
+        }
+        if (sinks.length === 0)
+            continue;
+        // Step 4: Check for sanitizers (AST-based)
+        const foundSanitizers = findSanitizersAST(body, taintedNames);
+        // Build paths
+        const paths = [];
+        for (const sink of sinks) {
+            const source = taintedVars.get(sink.taintedArg) || taintedParams[0];
+            // Subtree matching: sanitize(req.query) covers req.query.id but not req.body.cmd
+            // parseInt(req.query.id) does NOT cover exec(req) — only the specific property is safe
+            const sanitizer = foundSanitizers.find((s) => {
+                for (const sv of s.sanitizedVars) {
+                    if (sv === sink.taintedArg)
+                        return true;
+                    // Sanitized path is a prefix → covers all sub-properties
+                    if (sink.taintedArg.startsWith(`${sv}.`))
+                        return true;
+                }
+                return false;
+            });
+            const hasSanitizer = sanitizer != null;
+            const sufficient = sanitizer != null ? isSanitizerSufficient(sanitizer.name, sink.category) : false;
+            paths.push({
+                source,
+                sink,
+                sanitized: hasSanitizer && sufficient,
+                sanitizer: sanitizer?.name,
+                insufficientSanitizer: hasSanitizer && !sufficient ? sanitizer.name : undefined,
+            });
+        }
+        if (paths.length > 0) {
+            results.push({ fnName, filePath, startLine, paths });
+        }
+    }
+    return results;
+}
+// ── AST Helpers ─────────────────────────────────────────────────────────
+/** Check if an expression references any tainted variable name */
+function astExprRefersToTainted(expr, taintedNames) {
+    const k = expr.getKindName();
+    if (k === 'Identifier' && taintedNames.has(expr.getText()))
+        return true;
+    if (k === 'PropertyAccessExpression') {
+        return astExprRefersToTainted(expr.getExpression(), taintedNames);
+    }
+    if (k === 'ElementAccessExpression') {
+        return astExprRefersToTainted(expr.getExpression(), taintedNames);
+    }
+    if (k === 'CallExpression') {
+        if (astExprRefersToTainted(expr.getExpression(), taintedNames))
+            return true;
+        for (const arg of expr.getArguments()) {
+            if (astExprRefersToTainted(arg, taintedNames))
+                return true;
+        }
+        return false;
+    }
+    if (k === 'AwaitExpression') {
+        return astExprRefersToTainted(expr.getExpression(), taintedNames);
+    }
+    // Check all children for complex expressions
+    for (const child of expr.getChildren()) {
+        if (astExprRefersToTainted(child, taintedNames))
+            return true;
+    }
+    return false;
+}
+/** Get the base name of a callee (e.g., exec from child_process.exec, or db.query) */
+function getCalleeBaseName(call) {
+    const expr = call.getExpression();
+    const k = expr.getKindName();
+    if (k === 'Identifier')
+        return expr.getText();
+    if (k === 'PropertyAccessExpression')
+        return expr.getName();
+    return '';
+}
+/** Get the full static access path (e.g., req.query.id). Returns undefined for dynamic access. */
+function getStaticAccessPath(expr) {
+    const k = expr.getKindName();
+    if (k === 'Identifier')
+        return expr.getText();
+    if (k === 'PropertyAccessExpression') {
+        const obj = getStaticAccessPath(expr.getExpression());
+        if (obj)
+            return `${obj}.${expr.getName()}`;
+    }
+    return undefined;
+}
+/** Find the first tainted identifier in an expression tree */
+function findTaintedIdentifier(expr, taintedNames) {
+    const k = expr.getKindName();
+    if (k === 'Identifier' && taintedNames.has(expr.getText()))
+        return expr.getText();
+    if (k === 'PropertyAccessExpression') {
+        return findTaintedIdentifier(expr.getExpression(), taintedNames);
+    }
+    // Check binary expressions (string concatenation: 'cmd ' + userInput)
+    if (k === 'BinaryExpression') {
+        return (findTaintedIdentifier(expr.getLeft(), taintedNames) ||
+            findTaintedIdentifier(expr.getRight(), taintedNames));
+    }
+    for (const child of expr.getChildren()) {
+        const found = findTaintedIdentifier(child, taintedNames);
+        if (found)
+            return found;
+    }
+    return undefined;
+}
+/** AST-based sanitizer detection */
+function findSanitizersAST(body, taintedNames) {
+    const sanitizers = [];
+    const allCalls = [];
+    body.forEachDescendant((n) => {
+        if (n.getKindName() === 'CallExpression')
+            allCalls.push(n);
+    });
+    for (const call of allCalls) {
+        const calleeName = getCalleeBaseName(call);
+        const matchedSanitizer = SANITIZER_PATTERN_NAMES.find((s) => calleeName.includes(s));
+        if (!matchedSanitizer)
+            continue;
+        // Track which tainted vars are sanitized by this call
+        const sanitizedVars = new Set();
+        for (const arg of call.getArguments()) {
+            // Track the FULL access path so parseInt(req.query.id) sanitizes 'req.query.id', not 'req'
+            const fullPath = getStaticAccessPath(arg);
+            if (fullPath && findTaintedIdentifier(arg, taintedNames)) {
+                sanitizedVars.add(fullPath);
+            }
+            else {
+                const tainted = findTaintedIdentifier(arg, taintedNames);
+                if (tainted)
+                    sanitizedVars.add(tainted);
+            }
+        }
+        // Also check if the result is assigned to a variable (replacing the tainted value)
+        const parent = call.getParent();
+        if (parent && parent.getKindName() === 'VariableDeclaration') {
+            const declName = parent.getName();
+            sanitizedVars.add(declName);
+        }
+        if (sanitizedVars.size > 0) {
+            sanitizers.push({ name: matchedSanitizer, sanitizedVars });
+        }
+    }
+    return sanitizers;
+}
+//# sourceMappingURL=taint-ast.js.map

package/dist/taint-ast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taint-ast.js","sourceRoot":"","sources":["../src/taint-ast.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAOL,UAAU,GACX,MAAM,UAAU,CAAC;AAElB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAG1B,2EAA2E;AAE3E;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAsB;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAExD,MAAM,MAAM,GAGP,EAAE,CAAC;IACR,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,YAAY,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACnC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,oBAAoB,CAAC,EAAE,CAAC;gBACpG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAW,EAAE,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE3C,sDAAsD;QACtD,MAAM,KAAK,GAAwC,EAAE,CAAC;QACtD,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAsC,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;QAC9C,MAAM,cAAc,GAAG,IAAI,GAAG,EAAsC,CAAC;QAErE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,6DAA6D;YAC7D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;gBAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACvC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;oBACtC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;wBACxG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;4BAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;wBAC7D,cAAc,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBACtC,CAAC;gBACH,CAAC;YACH,CAAC;YAED,wCAAwC;YACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,KAAK,MAAM,OAAO,IAAK,GAAW,CAAC,gBAAgB,EAAE,EAAE,CAAC;wBACtD,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;wBACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;wBAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;4BACvC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;4BACtC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,EAAE,CAAC;gCACnE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gCAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;oCAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;gCAC7D,cAAc,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;4BACtC,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,mBAAmB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,cAAc,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAE3E;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,SAAwB,EAAE,QAAgB,EAAE,UAAsB;IAChG,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,uEAAuE;IACvE,MAAM,eAAe,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEzD,0DAA0D;IAC1D,MAAM,MAAM,GAGP,EAAE,CAAC;IACR,KAAK,MAAM,EAAE,IAAI,UAAU,CAAC,YAAY,EAAE;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC1G,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,qBAAqB,EAAE,EAAE,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;YACnC,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,IAAI,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,oBAAoB,EAAE,CAAC;oBACtE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAW,EAAE,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1C,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,EAAE,CAAC;YACtC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,MAAM,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,SAAS,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;QAE/G,qDAAqD;QACrD,MAAM,aAAa,GAAkB,EAAE,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnE,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEzC,gEAAgE;QAChE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,aAAa;YAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAE1D,wEAAwE;QACxE,mEAAmE;QACnE,MAAM,QAAQ,GAA6C,EAAE,CAAC;QAC9D,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,EAAE;YAC9B,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,UAAU,CAAC,mBAAmB,EAAE,CAAC;gBACtD,QAAQ,CAAC,IAAI,CAAC,IAA8C,CAAC,CAAC;YAChE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,8DAA8D;QAC9D,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAExC,wDAAwD;gBACxD,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;oBACpC,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC;wBAAE,SAAS;oBACzC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI;wBAAE,SAAS;oBACpB,IAAI,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC;wBAC/C,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;wBAC3B,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;wBAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;wBAC9D,MAAM,SAAS,GAAG,MAAM,EAAE,MAAM,CAAC;wBACjC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;oBAChF,CAAC;gBACH,CAAC;gBAED,oDAAoD;gBACpD,IAAI,QAAQ,KAAK,sBAAsB,EAAE,CAAC;oBACxC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;wBAAE,SAAS;oBACnE,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;oBAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/D,MAAM,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC;oBAClC,KAAK,MAAM,OAAO,IAAK,QAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;wBACtD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;wBACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;4BAC9B,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;4BACzB,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,IAAI,cAAc,EAAE,CAAC,CAAC;wBACjF,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,iDAAiD;gBACjD,IAAI,QAAQ,KAAK,qBAAqB,EAAE,CAAC;oBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;oBACnC,IAAI,CAAC,IAAI,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,CAAC;wBAAE,SAAS;oBACnE,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;oBAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC/D,MAAM,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC;oBAClC,KAAK,MAAM,OAAO,IAAK,QAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;wBACtD,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,gBAAgB,EAAE,CAAC;4BAC/C,MAAM,MAAM,GAAI,OAAe,CAAC,OAAO,EAAE,CAAC;4BAC1C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gCAC9B,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gCACzB,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,IAAI,cAAc,EAAE,CAAC,CAAC;4BACjF,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,iDAAiD;QACjD,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAwC,EAAE,CAAC;QACtD,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAsC,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3C,IAAI,CAAC,OAAO;gBAAE,SAAS;YAEvB,sDAAsD;YACtD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;gBACtC,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC5D,IAAI,UAAU,EAAE,CAAC;oBACf,KAAK,CAAC,IAAI,CAAC;wBACT,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,OAAO;wBACjB,UAAU;wBACV,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE;qBAChC,CAAC,CAAC;oBACH,MAAM;gBACR,CAAC;YACH,CAAC;YAED,wCAAwC;YACxC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACpD,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,oBAAoB,IAAI,CAAC,KAAK,+BAA+B,CAAC;YAC7E,CAAC,CAAC,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;gBAC/B,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,oBAAoB,EAAE,CAAC;oBAC/C,KAAK,MAAM,IAAI,IAAK,GAAW,CAAC,gBAAgB,EAAE,EAAE,CAAC;wBACnD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;wBAClC,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;wBAC7D,IAAI,UAAU,EAAE,CAAC;4BACf,KAAK,CAAC,IAAI,CAAC;gCACT,IAAI,EAAE,GAAG,UAAU,aAAa;gCAChC,QAAQ,EAAE,OAAO;gCACjB,UAAU;gCACV,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE;6BAChC,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,kFAAkF;QAClF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,oDAAoD;YACpD,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YACzC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,UAAU;gBAAE,SAAS;YAE1B,qEAAqE;YACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC/D,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM;oBAAE,SAAS;gBAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC/B,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBAC5D,IAAI,UAAU,EAAE,CAAC;oBACf,yEAAyE;oBACzE,KAAK,MAAM,YAAY,IAAI,UAAU,EAAE,CAAC;wBACtC,KAAK,CAAC,IAAI,CAAC;4BACT,IAAI,EAAE,GAAG,UAAU,SAAS;4BAC5B,QAAQ,EAAE,YAAY;4BACtB,UAAU;4BACV,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE;yBAChC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEjC,2CAA2C;QAC3C,MAAM,eAAe,GAAG,iBAAiB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QAE9D,cAAc;QACd,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC;YACpE,iFAAiF;YACjF,uFAAuF;YACvF,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3C,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;oBACjC,IAAI,EAAE,KAAK,IAAI,CAAC,UAAU;wBAAE,OAAO,IAAI,CAAC;oBACxC,yDAAyD;oBACzD,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACxD,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,SAAS,IAAI,IAAI,CAAC;YACvC,MAAM,UAAU,GAAG,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAEpG,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM;gBACN,IAAI;gBACJ,SAAS,EAAE,YAAY,IAAI,UAAU;gBACrC,SAAS,EAAE,SAAS,EAAE,IAAI;gBAC1B,qBAAqB,EAAE,YAAY,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAChF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAE3E,kEAAkE;AAClE,SAAS,sBAAsB,CAAC,IAAU,EAAE,YAAyB;IACnE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,CAAC,KAAK,0BAA0B,EAAE,CAAC;QACrC,OAAO,sBAAsB,CAAE,IAAY,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,KAAK,yBAAyB,EAAE,CAAC;QACpC,OAAO,sBAAsB,CAAE,IAAY,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAC3B,IAAI,sBAAsB,CAAE,IAAY,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;QACrF,KAAK,MAAM,GAAG,IAAK,IAAY,CAAC,YAAY,EAAE,EAAE,CAAC;YAC/C,IAAI,sBAAsB,CAAC,GAAG,EAAE,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK,iBAAiB,EAAE,CAAC;QAC5B,OAAO,sBAAsB,CAAE,IAAY,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC,CAAC;IAC7E,CAAC;IACD,6CAA6C;IAC7C,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,IAAI,sBAAsB,CAAC,KAAK,EAAE,YAAY,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,SAAS,iBAAiB,CAAC,IAAuC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,0BAA0B;QAAE,OAAQ,IAAY,CAAC,OAAO,EAAE,CAAC;IACrE,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,IAAU;IACrC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9C,IAAI,CAAC,KAAK,0BAA0B,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,mBAAmB,CAAE,IAAY,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/D,IAAI,GAAG;YAAE,OAAO,GAAG,GAAG,IAAK,IAAY,CAAC,OAAO,EAAE,EAAE,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8DAA8D;AAC9D,SAAS,qBAAqB,CAAC,IAAU,EAAE,YAAyB;IAClE,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;IAClF,IAAI,CAAC,KAAK,0BAA0B,EAAE,CAAC;QACrC,OAAO,qBAAqB,CAAE,IAAY,CAAC,aAAa,EAAE,EAAE,YAAY,CAAC,CAAC;IAC5E,CAAC;IACD,sEAAsE;IACtE,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;QAC7B,OAAO,CACL,qBAAqB,CAAE,IAAY,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC;YAC5D,qBAAqB,CAAE,IAAY,CAAC,QAAQ,EAAE,EAAE,YAAY,CAAC,CAC9D,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,qBAAqB,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACzD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oCAAoC;AACpC,SAAS,iBAAiB,CAAC,IAAU,EAAE,YAAyB;IAC9D,MAAM,UAAU,GAAwD,EAAE,CAAC;IAE3E,MAAM,QAAQ,GAAwC,EAAE,CAAC;IACzD,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,gBAAgB;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAsC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,gBAAgB;YAAE,SAAS;QAEhC,sDAAsD;QACtD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACtC,2FAA2F;YAC3F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,QAAQ,IAAI,qBAAqB,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,CAAC;gBACzD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,qBAAqB,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;gBACzD,IAAI,OAAO;oBAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,mFAAmF;QACnF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,qBAAqB,EAAE,CAAC;YAC7D,MAAM,QAAQ,GAAI,MAAc,CAAC,OAAO,EAAE,CAAC;YAC3C,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YAC3B,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/taint-crossfile.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Taint Tracking — cross-file analysis.
+ *
+ * Traces tainted data across import boundaries:
+ *   handler(req) → importedFn(req.body) → exec() in another file.
+ */
+import type { CrossFileTaintResult, ExportedFunction } from './taint-types.js';
+import type { InferResult } from './types.js';
+/**
+ * Build a map of exported functions across all files.
+ * Maps "filePath::fnName" → ExportedFunction with sink info.
+ */
+export declare function buildExportMap(inferredPerFile: Map<string, InferResult[]>): Map<string, ExportedFunction>;
+/**
+ * Build import→function resolution map.
+ * Maps "importingFile::importedName" → absolute file path of the definition.
+ */
+export declare function buildImportMap(inferredPerFile: Map<string, InferResult[]>, graphImports: Map<string, string[]>): Map<string, string>;
+/**
+ * Cross-file taint analysis.
+ *
+ * For each handler function with tainted params:
+ *   1. Find calls to imported functions in the handler body
+ *   2. Check if tainted data is passed as an argument
+ *   3. Look up the target function — does it have a dangerous sink?
+ *   4. If yes and no sanitizer in between → cross-file taint path
+ */
+export declare function analyzeTaintCrossFile(inferredPerFile: Map<string, InferResult[]>, graphImports: Map<string, string[]>): CrossFileTaintResult[];