@lbroth/rothunter 1.0.0-rc.1

package/dist/extraction/shared-db-write-confirmer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared-db-write-confirmer.js","sourceRoot":"","sources":["../../src/extraction/shared-db-write-confirmer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAa,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAkBH,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgEd,CAAC;AAEF,SAAS,WAAW,CAAC,KAAkC;IACrD,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACjG,OAAO,GAAG,MAAM,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;IAC3C,CAAC,CAAC;SACD,IAAI,CAAC,SAAS,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,OAAO,sBAAsB;IACzB,GAAG,CAAY;IACf,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEnD,YAAY,GAAe;QACzB,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,KAAK;aAChF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;aACjC,IAAI,EAAE;aACN,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAExC,uEAAuE;QACvE,sDAAsD;QACtD,MAAM,eAAe,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,OAA+B,CAAC;QACpC,IAAI,eAAe,IAAI,mBAAmB,EAAE,CAAC;YAC3C,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,QAAQ,CACpB,KAAyB,EACzB,KAAoB;QAEpB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;aACtD,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC;aACnC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC;aACvC,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAC7B,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EACnC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CACnC,CAAC;YACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAC3E,+CAA+C,CAChD,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,KAAyB,EACzB,KAAoB;QAEpB,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,aAAa,GAAsB,EAAE,CAAC;QAC5C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5C,OAAO,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAC/C,CAAC;CACF"}

package/dist/extraction/triage-confirmer.d.ts

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+import { LlmClient } from '../adapters/llm.js';
+/**
+ * Generic single-finding triage confirmer. Used by detectors whose
+ * findings have a high false-positive rate but no detector-specific
+ * confirmer of their own (silent-catch, public-any, mutable-globals,
+ * …). Asks the LLM: "given this code and the static analyzer's
+ * suspicion, is this a real defect worth fixing — or an intentional
+ * pattern the project relies on?"
+ *
+ * Verdict shape matches the cluster confirmers so the orchestrator's
+ * shared `applyClusterVerdict` helper can drive severity / confidence
+ * adjustments without a per-detector branch:
+ *
+ *   { real: boolean, confidence: number 0..1, reason: string }
+ *
+ * `real: true`  → keep severity, bump confidence (genuine defect).
+ * `real: false` → drop severity to 'low', deflate confidence
+ *                 (intentional pattern / framework convention).
+ */
+declare const VerdictSchema: z.ZodObject<{
+    real: z.ZodBoolean;
+    confidence: z.ZodNumber;
+    reason: z.ZodString;
+}, z.core.$strip>;
+export type TriageVerdict = z.infer<typeof VerdictSchema>;
+export interface TriageCheckInput {
+    /** Detector id — included in the prompt so the LLM applies the right rubric. */
+    detectorId: string;
+    /** Human-facing severity ('low' | 'medium' | 'high') from the deterministic pass. */
+    severity: string;
+    /** Finding title verbatim. */
+    title: string;
+    /** Finding description verbatim. */
+    description: string;
+    /** Detector-emitted suggestion, if any. */
+    suggestion?: string;
+    /** First evidence file + line range + snippet. */
+    evidenceFile: string;
+    evidenceStartLine: number;
+    evidenceEndLine: number;
+    evidenceSnippet: string;
+    /**
+     * Optional structural context the orchestrator can pass alongside the
+     * raw evidence — siblings, importer counts, package.json hits, etc.
+     * Kept opaque (free-form text) so detector-specific enrichment can
+     * evolve without breaking the schema. Truncated server-side to keep
+     * the prompt under the LLM context window.
+     */
+    extraContext?: string;
+}
+export declare class TriageConfirmer {
+    private llm;
+    private cache;
+    constructor(llm?: LlmClient);
+    confirm(input: TriageCheckInput): Promise<TriageVerdict | null>;
+}
+export {};
+//# sourceMappingURL=triage-confirmer.d.ts.map

package/dist/extraction/triage-confirmer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-confirmer.d.ts","sourceRoot":"","sources":["../../src/extraction/triage-confirmer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAA0B,MAAM,oBAAoB,CAAC;AAIvE;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAA,MAAM,aAAa;;;;iBAIjB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AA0CD,qBAAa,eAAe;IAC1B,OAAO,CAAC,GAAG,CAAY;IACvB,OAAO,CAAC,KAAK,CAAoC;gBAErC,GAAG,CAAC,EAAE,SAAS;IAIrB,OAAO,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAoCtE"}

package/dist/extraction/triage-confirmer.js

@@ -0,0 +1,104 @@
+import { z } from 'zod';
+import { createDefaultLlmClient } from '../adapters/llm.js';
+import { parseLlmJsonResponse } from '../utils/llm-json.js';
+import { logger } from '../utils/logger.js';
+/**
+ * Generic single-finding triage confirmer. Used by detectors whose
+ * findings have a high false-positive rate but no detector-specific
+ * confirmer of their own (silent-catch, public-any, mutable-globals,
+ * …). Asks the LLM: "given this code and the static analyzer's
+ * suspicion, is this a real defect worth fixing — or an intentional
+ * pattern the project relies on?"
+ *
+ * Verdict shape matches the cluster confirmers so the orchestrator's
+ * shared `applyClusterVerdict` helper can drive severity / confidence
+ * adjustments without a per-detector branch:
+ *
+ *   { real: boolean, confidence: number 0..1, reason: string }
+ *
+ * `real: true`  → keep severity, bump confidence (genuine defect).
+ * `real: false` → drop severity to 'low', deflate confidence
+ *                 (intentional pattern / framework convention).
+ */
+const VerdictSchema = z.object({
+    real: z.boolean(),
+    confidence: z.number().min(0).max(1),
+    reason: z.string(),
+});
+const PROMPT = `You are reviewing a TypeScript / JavaScript static-analysis finding. Decide: is this a REAL defect the project should fix, or a FALSE POSITIVE the detector flagged but the code is intentionally written this way (framework convention, builder pattern, project-specific exception)?
+
+Output ONE compact JSON object and STOP:
+{"real": boolean, "confidence": <0..1>, "reason": "<max 20 words>"}
+
+Heuristics by detector:
+
+- **silent-catch**: REAL when the catch swallows errors that the operator would want to see (network, parse, DB). FALSE when the catch is documented as deliberate (comment explaining), the surrounding code already logs to a reporter, or the body is "return null" with a documented caller contract that treats null as "missing".
+- **public-any**: REAL when an exported API surface uses \`any\` where a concrete type or a generic would convey the contract. FALSE when the \`any\` is at a third-party adapter boundary, in a generated type, or annotated with a comment explaining the deliberate widening.
+- **mutable-globals**: REAL when a module-scope \`let\`/\`var\` is mutated from request-time code (shared across importers). FALSE when the mutation is bootstrap / one-shot init / lazy-cache with single-flight guards.
+- **magic-numbers**: REAL when the literal carries domain meaning the reader has to guess (timeouts, retry counts, column counts). FALSE for: math constants (0/1/2/-1/π/τ), array indices, version numbers in package.json reads, HTTP status codes (200/404/500) used with descriptive variable names already in scope.
+- **bad-config**: REAL when the disabled rule materially loosens safety (strict / noImplicitAny / no-explicit-any). FALSE when the rule is off behind a documented project-wide exception OR when the file is a build target intentionally relaxed (e.g. tsconfig.build.json with project references).
+- **long-function**: REAL when the function mixes unrelated concerns. FALSE for React page components that act as composition roots and JSX layout — a 300+ line page is typical and refactor signals are already covered by other detectors. FALSE for linear HTTP handlers / streaming relays where extraction obscures flow.
+- **long-file**: REAL when the file accumulates unrelated concerns across many features. FALSE for recognizer / config / pattern tables — single-table modules of 600+ lines are deliberate locality, not accumulation.
+- **hot-hub-file**: REAL when a file accumulates unrelated re-exports / utilities. FALSE for a deliberate single type-surface module / barrel that the project explicitly maintains as the public import path.
+- **dead-export**: REAL when the export is unused AND has no plausible public-API reason to exist. FALSE when: (a) the symbol IS the published-library type surface for an Apache/MIT npm package, (b) the export is consumed by another exported symbol's signature within the same module (interface used as return / param type), (c) it's a framework convention (Next route handler, etc.).
+- **dead-module**: REAL when the file is genuinely unreachable. FALSE when: package.json scripts reference it (\`tsx watch src/dev.ts\`), it's loaded by convention (Next route, Vite plugin), or it's a dev-only entry point.
+- **dead-handler / dead-api**: REAL when no client / route table references it. FALSE when the handler is registered dynamically (decorator + reflection, route table built at runtime).
+- **todo-comments**: REAL only for actionable TODO / FIXME / HACK / XXX markers ("TODO: refactor", "FIXME before ship"). FALSE for explanatory NOTE comments documenting a deliberate design decision — those are documentation, not technical debt.
+- **duplicate-function / duplicate-type / similar-functions**: REAL when two symbols implement the same concept with different code (true duplication). FALSE when they share a SKELETON but have unrelated semantics — \`registerDoctor\` vs \`registerPrefetch\`, \`getUserById\` vs \`getOrderById\`, framework-idiom command registrations.
+
+Confidence calibration:
+- Clear intentional pattern with explicit comment / framework idiom → real: false, confidence ≥ 0.85.
+- Clear defect (no comment, obvious bug shape) → real: true, confidence ≥ 0.85.
+- Genuinely ambiguous → real: true, confidence 0.6 (preserve the deterministic signal at low confidence).
+
+If the "Project conventions" block in extra context contains a rule that DIRECTLY justifies the pattern under review (e.g. "three similar lines better than premature abstraction" → applies to duplicate-function / long-function on framework-idiom call sites; "default to writing no comments" → applies to silent-catch with explanatory comment), treat that as authoritative and verdict real: false, confidence ≥ 0.85. The project's own rules override generic best-practice — that is the whole point of including them.
+
+Detector: {{DETECTOR}}
+Severity (deterministic): {{SEVERITY}}
+Title: {{TITLE}}
+Description: {{DESCRIPTION}}
+Suggested direction: {{SUGGESTION}}
+
+Code evidence ({{FILE}}:{{START}}-{{END}}):
+\`\`\`
+{{SNIPPET}}
+\`\`\`
+{{EXTRA_CONTEXT}}`;
+export class TriageConfirmer {
+    llm;
+    cache = new Map();
+    constructor(llm) {
+        this.llm = llm ?? createDefaultLlmClient();
+    }
+    async confirm(input) {
+        const cacheKey = `${input.detectorId}::${input.evidenceFile}:${input.evidenceStartLine}-${input.evidenceEndLine}`;
+        const cached = this.cache.get(cacheKey);
+        if (cached)
+            return cached;
+        const extraBlock = input.extraContext
+            ? `\nExtra structural context:\n${input.extraContext.slice(0, 1600)}\n`
+            : '';
+        const prompt = PROMPT.replace('{{DETECTOR}}', input.detectorId)
+            .replace('{{SEVERITY}}', input.severity)
+            .replace('{{TITLE}}', input.title)
+            .replace('{{DESCRIPTION}}', input.description.slice(0, 800))
+            .replace('{{SUGGESTION}}', input.suggestion ?? '(none)')
+            .replace('{{FILE}}', input.evidenceFile)
+            .replace('{{START}}', String(input.evidenceStartLine))
+            .replace('{{END}}', String(input.evidenceEndLine))
+            .replace('{{SNIPPET}}', input.evidenceSnippet.slice(0, 1600))
+            .replace('{{EXTRA_CONTEXT}}', extraBlock);
+        try {
+            const raw = await this.llm.chat([{ role: 'user', content: prompt }], { temperature: 0, maxTokens: 128 });
+            const parsed = parseLlmJsonResponse(raw);
+            const verdict = VerdictSchema.parse(parsed);
+            this.cache.set(cacheKey, verdict);
+            return verdict;
+        }
+        catch (err) {
+            logger.warn({ err: err.message, detector: input.detectorId, file: input.evidenceFile }, 'TriageConfirmer failed; returning null');
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=triage-confirmer.js.map

package/dist/extraction/triage-confirmer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-confirmer.js","sourceRoot":"","sources":["../../src/extraction/triage-confirmer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAa,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AA8BH,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAsCG,CAAC;AAEnB,MAAM,OAAO,eAAe;IAClB,GAAG,CAAY;IACf,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAEjD,YAAY,GAAe;QACzB,IAAI,CAAC,GAAG,GAAG,GAAG,IAAI,sBAAsB,EAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAuB;QACnC,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAClH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY;YACnC,CAAC,CAAC,gCAAgC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI;YACvE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC;aAC5D,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC;aACvC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC;aACjC,OAAO,CAAC,iBAAiB,EAAE,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3D,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,UAAU,IAAI,QAAQ,CAAC;aACvD,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC;aACvC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;aACrD,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;aACjD,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;aAC5D,OAAO,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC;QAE5C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAC7B,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EACnC,EAAE,WAAW,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CACnC,CAAC;YACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAClC,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,YAAY,EAAE,EACrF,wCAAwC,CACzC,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/graph/cfg.d.ts

@@ -0,0 +1,45 @@
+import { Node } from 'ts-morph';
+/**
+ * Basic-block control-flow graph for an async function body. The race-
+ * condition detector previously used source-line ordering as a proxy for
+ * execution order — that misfires on conditional reads (`if (cond) { read }
+ * await x; write`) because the analyzer cannot tell whether `read` actually
+ * happened on a given execution. With a CFG we ask the precise question:
+ * "Does any execution path reach `read`, then `await`, then `write` of the
+ * same target?". If no such path exists → no race candidate.
+ *
+ * The graph is intentionally coarse: each node is a sequence of statements
+ * with no internal branch. Branch / loop / try-catch / switch produce
+ * separate nodes joined by `succ` edges. Statements that terminate a path
+ * (`return`, `throw`, `break`, `continue`) end the block with no successor
+ * to the synthetic exit. Reachability is plain forward BFS.
+ *
+ * Caveats:
+ *   - Switch fall-through across cases is modelled correctly only when the
+ *     case body ends with `break` / `return`. Implicit fall-through joins
+ *     the next case's entry.
+ *   - Labeled break/continue is reduced to plain break/continue (good
+ *     enough for race-condition use; very rare in practice).
+ *   - Nested function declarations / arrow functions are NOT followed —
+ *     they have their own CFG built by the caller when needed.
+ */
+export interface CfgBlock {
+    id: number;
+    stmts: Node[];
+    succ: number[];
+}
+export interface Cfg {
+    blocks: CfgBlock[];
+    entry: number;
+    exit: number;
+}
+export declare function buildCfg(body: Node): Cfg;
+/**
+ * Return the CFG block id whose statement set contains `node` (walking up
+ * parents until a tracked statement is found). Returns -1 when `node`
+ * lives outside the CFG (nested function body, dead block, …).
+ */
+export declare function blockOf(cfg: Cfg, node: Node): number;
+/** Forward reachability over the CFG: is `to` reachable from `from`? */
+export declare function reachable(cfg: Cfg, from: number, to: number): boolean;
+//# sourceMappingURL=cfg.d.ts.map

package/dist/graph/cfg.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cfg.d.ts","sourceRoot":"","sources":["../../src/graph/cfg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAc,MAAM,UAAU,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,GAAG;IAClB,MAAM,EAAE,QAAQ,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAcD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,IAAI,GAAG,GAAG,CAmKxC;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,CASpD;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAgBrE"}

package/dist/graph/cfg.js

@@ -0,0 +1,198 @@
+import { SyntaxKind } from 'ts-morph';
+const TERMINATING_KINDS = new Set([
+    SyntaxKind.ReturnStatement,
+    SyntaxKind.ThrowStatement,
+    SyntaxKind.BreakStatement,
+    SyntaxKind.ContinueStatement,
+]);
+export function buildCfg(body) {
+    const blocks = [];
+    const newBlock = () => {
+        const b = { id: blocks.length, stmts: [], succ: [] };
+        blocks.push(b);
+        return b;
+    };
+    const entry = newBlock();
+    const exit = newBlock();
+    const visitStmts = (stmts, cur, ctx) => {
+        let block = cur;
+        for (const s of stmts) {
+            block = visitStmt(s, block, ctx);
+            // After a terminator we keep a sink block so subsequent statements
+            // still have a CFG node — but with no successor to the exit, the
+            // reachability analysis correctly skips them.
+            if (TERMINATING_KINDS.has(s.getKind())) {
+                block = newBlock(); // dead block; intentionally unreachable
+            }
+        }
+        return block;
+    };
+    const stmtArray = (n) => {
+        if (!n)
+            return [];
+        const blockNode = n.asKind(SyntaxKind.Block);
+        if (blockNode)
+            return blockNode.getStatements();
+        return [n];
+    };
+    const bodyStmts = stmtArray(body);
+    const visitStmt = (s, cur, ctx) => {
+        cur.stmts.push(s);
+        const k = s.getKind();
+        if (k === SyntaxKind.IfStatement) {
+            const ifn = s.asKindOrThrow(SyntaxKind.IfStatement);
+            const thenB = newBlock();
+            const elseB = newBlock();
+            const join = newBlock();
+            cur.succ.push(thenB.id, elseB.id);
+            const endThen = visitStmts(stmtArray(ifn.getThenStatement()), thenB, ctx);
+            endThen.succ.push(join.id);
+            const elseStmt = ifn.getElseStatement();
+            if (elseStmt) {
+                const endElse = visitStmts(stmtArray(elseStmt), elseB, ctx);
+                endElse.succ.push(join.id);
+            }
+            else {
+                elseB.succ.push(join.id);
+            }
+            return join;
+        }
+        if (k === SyntaxKind.WhileStatement || k === SyntaxKind.DoStatement) {
+            const loopNode = s.asKindOrThrow(k === SyntaxKind.WhileStatement ? SyntaxKind.WhileStatement : SyntaxKind.DoStatement);
+            const header = newBlock();
+            const bodyB = newBlock();
+            const afterB = newBlock();
+            cur.succ.push(header.id);
+            header.succ.push(bodyB.id, afterB.id);
+            const endBody = visitStmts(stmtArray(loopNode.getStatement()), bodyB, {
+                breakTarget: afterB,
+                continueTarget: header,
+            });
+            endBody.succ.push(header.id);
+            return afterB;
+        }
+        if (k === SyntaxKind.ForStatement ||
+            k === SyntaxKind.ForOfStatement ||
+            k === SyntaxKind.ForInStatement) {
+            const loopNode = s;
+            const header = newBlock();
+            const bodyB = newBlock();
+            const afterB = newBlock();
+            cur.succ.push(header.id);
+            header.succ.push(bodyB.id, afterB.id);
+            const endBody = visitStmts(stmtArray(loopNode.getStatement()), bodyB, {
+                breakTarget: afterB,
+                continueTarget: header,
+            });
+            endBody.succ.push(header.id);
+            return afterB;
+        }
+        if (k === SyntaxKind.TryStatement) {
+            const tryNode = s.asKindOrThrow(SyntaxKind.TryStatement);
+            const tryB = newBlock();
+            const catchB = newBlock();
+            const finallyB = newBlock();
+            const after = newBlock();
+            cur.succ.push(tryB.id);
+            // Any point in the try block can throw, so the catch is potentially
+            // reachable from the try entry. We approximate with edge tryB → catchB.
+            tryB.succ.push(catchB.id);
+            const endTry = visitStmts(tryNode.getTryBlock().getStatements(), tryB, ctx);
+            endTry.succ.push(finallyB.id);
+            const catchClause = tryNode.getCatchClause();
+            if (catchClause) {
+                const endCatch = visitStmts(catchClause.getBlock().getStatements(), catchB, ctx);
+                endCatch.succ.push(finallyB.id);
+            }
+            else {
+                catchB.succ.push(finallyB.id);
+            }
+            const fin = tryNode.getFinallyBlock();
+            if (fin) {
+                const endFin = visitStmts(fin.getStatements(), finallyB, ctx);
+                endFin.succ.push(after.id);
+            }
+            else {
+                finallyB.succ.push(after.id);
+            }
+            return after;
+        }
+        if (k === SyntaxKind.SwitchStatement) {
+            const sw = s.asKindOrThrow(SyntaxKind.SwitchStatement);
+            const after = newBlock();
+            const cases = sw.getCaseBlock().getClauses();
+            let prev = null;
+            for (const c of cases) {
+                const cb = newBlock();
+                cur.succ.push(cb.id);
+                if (prev)
+                    prev.succ.push(cb.id); // implicit fall-through
+                const stmts = c.getStatements?.() ?? [];
+                const endCase = visitStmts(stmts, cb, { breakTarget: after, continueTarget: ctx.continueTarget });
+                endCase.succ.push(after.id);
+                prev = endCase;
+            }
+            cur.succ.push(after.id); // path with no matching case
+            return after;
+        }
+        if (k === SyntaxKind.BreakStatement && ctx.breakTarget) {
+            cur.succ.push(ctx.breakTarget.id);
+            return cur;
+        }
+        if (k === SyntaxKind.ContinueStatement && ctx.continueTarget) {
+            cur.succ.push(ctx.continueTarget.id);
+            return cur;
+        }
+        if (k === SyntaxKind.ReturnStatement || k === SyntaxKind.ThrowStatement) {
+            // No successor — path ends here.
+            return cur;
+        }
+        if (k === SyntaxKind.Block) {
+            // Nested block — recurse into its statements but stay in the same
+            // logical block-list path (no branching).
+            return visitStmts(s.asKindOrThrow(SyntaxKind.Block).getStatements(), cur, ctx);
+        }
+        return cur;
+    };
+    const last = visitStmts(bodyStmts, entry, {});
+    last.succ.push(exit.id);
+    return { blocks, entry: entry.id, exit: exit.id };
+}
+/**
+ * Return the CFG block id whose statement set contains `node` (walking up
+ * parents until a tracked statement is found). Returns -1 when `node`
+ * lives outside the CFG (nested function body, dead block, …).
+ */
+export function blockOf(cfg, node) {
+    let cur = node;
+    while (cur) {
+        for (const b of cfg.blocks) {
+            if (b.stmts.includes(cur))
+                return b.id;
+        }
+        cur = cur.getParent();
+    }
+    return -1;
+}
+/** Forward reachability over the CFG: is `to` reachable from `from`? */
+export function reachable(cfg, from, to) {
+    if (from < 0 || to < 0)
+        return false;
+    if (from === to)
+        return true;
+    const visited = new Set([from]);
+    const queue = [from];
+    while (queue.length > 0) {
+        const id = queue.shift();
+        for (const s of cfg.blocks[id].succ) {
+            if (s === to)
+                return true;
+            if (!visited.has(s)) {
+                visited.add(s);
+                queue.push(s);
+            }
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=cfg.js.map

package/dist/graph/cfg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cfg.js","sourceRoot":"","sources":["../../src/graph/cfg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,UAAU,EAAE,MAAM,UAAU,CAAC;AA2C5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAa;IAC5C,UAAU,CAAC,eAAe;IAC1B,UAAU,CAAC,cAAc;IACzB,UAAU,CAAC,cAAc;IACzB,UAAU,CAAC,iBAAiB;CAC7B,CAAC,CAAC;AAEH,MAAM,UAAU,QAAQ,CAAC,IAAU;IACjC,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,GAAa,EAAE;QAC9B,MAAM,CAAC,GAAa,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;IAExB,MAAM,UAAU,GAAG,CAAC,KAA0B,EAAE,GAAa,EAAE,GAAY,EAAY,EAAE;QACvF,IAAI,KAAK,GAAG,GAAG,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACjC,mEAAmE;YACnE,iEAAiE;YACjE,8CAA8C;YAC9C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACvC,KAAK,GAAG,QAAQ,EAAE,CAAC,CAAC,wCAAwC;YAC9D,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,CAAC,CAAmB,EAAU,EAAE;QAChD,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAClB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC,aAAa,EAAE,CAAC;QAChD,OAAO,CAAC,CAAC,CAAC,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,SAAS,GAAG,CAAC,CAAO,EAAE,GAAa,EAAE,GAAY,EAAY,EAAE;QACnE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAEtB,IAAI,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YAClC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,MAAM,QAAQ,GAAG,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACxC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC5D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,KAAK,UAAU,CAAC,cAAc,IAAI,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC;YACpE,MAAM,QAAQ,GAAG,CAAC,CAAC,aAAa,CAC9B,CAAC,KAAK,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CACrF,CAAC;YACF,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE;gBACpE,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,MAAM;aACvB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IACE,CAAC,KAAK,UAAU,CAAC,YAAY;YAC7B,CAAC,KAAK,UAAU,CAAC,cAAc;YAC/B,CAAC,KAAK,UAAU,CAAC,cAAc,EAC/B,CAAC;YACD,MAAM,QAAQ,GAAG,CAAoD,CAAC;YACtE,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE;gBACpE,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,MAAM;aACvB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7B,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,KAAK,UAAU,CAAC,YAAY,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;YACzD,MAAM,IAAI,GAAG,QAAQ,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvB,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5E,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;YAC7C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;gBACjF,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAChC,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;YACtC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC9D,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,UAAU,CAAC,eAAe,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,IAAI,GAAoB,IAAI,CAAC;YACjC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;gBACtB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBACrB,IAAI,IAAI;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,wBAAwB;gBACzD,MAAM,KAAK,GAAI,CAAsC,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC9E,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;gBAClG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC5B,IAAI,GAAG,OAAO,CAAC;YACjB,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,6BAA6B;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,KAAK,UAAU,CAAC,cAAc,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAClC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,KAAK,UAAU,CAAC,iBAAiB,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACrC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,CAAC,KAAK,UAAU,CAAC,eAAe,IAAI,CAAC,KAAK,UAAU,CAAC,cAAc,EAAE,CAAC;YACxE,iCAAiC;YACjC,OAAO,GAAG,CAAC;QACb,CAAC;QAED,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;YAC3B,kEAAkE;YAClE,0CAA0C;YAC1C,OAAO,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACjF,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,GAAQ,EAAE,IAAU;IAC1C,IAAI,GAAG,GAAqB,IAAI,CAAC;IACjC,OAAO,GAAG,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,EAAE,CAAC;QACzC,CAAC;QACD,GAAG,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS,CAAC,GAAQ,EAAE,IAAY,EAAE,EAAU;IAC1D,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,MAAM,KAAK,GAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,EAAG,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAE,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACf,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/graph/decorator-entries.d.ts

@@ -0,0 +1,2 @@
+export declare function resolveDecoratorEntryFiles(workspaceRoot: string, files: ReadonlyArray<string>): Set<string>;
+//# sourceMappingURL=decorator-entries.d.ts.map

package/dist/graph/decorator-entries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorator-entries.d.ts","sourceRoot":"","sources":["../../src/graph/decorator-entries.ts"],"names":[],"mappings":"AAmDA,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,GAC3B,GAAG,CAAC,MAAM,CAAC,CAgBb"}

package/dist/graph/decorator-entries.js

@@ -0,0 +1,89 @@
+import * as path from 'node:path';
+import { Project, SyntaxKind } from 'ts-morph';
+// Files with framework decorators (NestJS, Angular, TypeGraphQL, Inversify,
+// TypeORM, tsoa) are entry points — DI / ORM discovers them at runtime.
+// Textual match; over-match is safe direction (protects from dead-module).
+const FRAMEWORK_DECORATOR_NAMES = new Set([
+    // NestJS class-level
+    'Controller',
+    'Module',
+    'Injectable',
+    'Catch',
+    'Pipe',
+    'WebSocketGateway',
+    'Resolver',
+    // NestJS method-level
+    'Get',
+    'Post',
+    'Put',
+    'Patch',
+    'Delete',
+    'All',
+    'Options',
+    'Head',
+    'Sse',
+    'MessagePattern',
+    'EventPattern',
+    'SubscribeMessage',
+    // GraphQL (TypeGraphQL / Nest-graphql)
+    'Query',
+    'Mutation',
+    'FieldResolver',
+    'Subscription',
+    'ObjectType',
+    'InputType',
+    // Angular
+    'Component',
+    'NgModule',
+    'Directive',
+    // ORM auto-discovery
+    'Entity',
+    'ViewEntity',
+    'Schema',
+    // InversifyJS DI
+    'injectable',
+    'inject',
+    // tsoa / route-decorator HTTP frameworks
+    'Route',
+    'Tags',
+]);
+export function resolveDecoratorEntryFiles(workspaceRoot, files) {
+    const project = new Project({
+        skipAddingFilesFromTsConfig: true,
+        skipFileDependencyResolution: true,
+    });
+    for (const rel of files) {
+        project.addSourceFileAtPathIfExists(path.join(workspaceRoot, rel));
+    }
+    const out = new Set();
+    for (const sf of project.getSourceFiles()) {
+        if (fileHasFrameworkDecorator(sf)) {
+            out.add(path.relative(workspaceRoot, sf.getFilePath()));
+        }
+    }
+    return out;
+}
+function fileHasFrameworkDecorator(sf) {
+    // Class-level + method-level decorators. We use the Decorator AST kind so
+    // we catch both `@Decorator()` and `@Decorator` invocation shapes.
+    for (const dec of sf.getDescendantsOfKind(SyntaxKind.Decorator)) {
+        const expr = dec.getExpression();
+        let name = null;
+        const callShape = expr.asKind(SyntaxKind.CallExpression);
+        if (callShape) {
+            name = callShape.getExpression().getText();
+        }
+        else if (expr.getKind() === SyntaxKind.Identifier) {
+            name = expr.getText();
+        }
+        if (!name)
+            continue;
+        // Decorators are often imported with their bare name (e.g. `@Controller`),
+        // sometimes namespaced (`@nestjs.Controller`). Pick the last segment.
+        const baseName = name.split('.').pop() ?? name;
+        if (FRAMEWORK_DECORATOR_NAMES.has(baseName))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=decorator-entries.js.map

package/dist/graph/decorator-entries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decorator-entries.js","sourceRoot":"","sources":["../../src/graph/decorator-entries.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE/C,4EAA4E;AAC5E,wEAAwE;AACxE,2EAA2E;AAC3E,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,qBAAqB;IACrB,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,OAAO;IACP,MAAM;IACN,kBAAkB;IAClB,UAAU;IACV,sBAAsB;IACtB,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,KAAK;IACL,SAAS;IACT,MAAM;IACN,KAAK;IACL,gBAAgB;IAChB,cAAc;IACd,kBAAkB;IAClB,uCAAuC;IACvC,OAAO;IACP,UAAU;IACV,eAAe;IACf,cAAc;IACd,YAAY;IACZ,WAAW;IACX,UAAU;IACV,WAAW;IACX,UAAU;IACV,WAAW;IACX,qBAAqB;IACrB,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,iBAAiB;IACjB,YAAY;IACZ,QAAQ;IACR,yCAAyC;IACzC,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,0BAA0B,CACxC,aAAqB,EACrB,KAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;QAC1B,2BAA2B,EAAE,IAAI;QACjC,4BAA4B,EAAE,IAAI;KACnC,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1C,IAAI,yBAAyB,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,yBAAyB,CAAC,EAAiD;IAClF,0EAA0E;IAC1E,mEAAmE;IACnE,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,oBAAoB,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,GAAG,CAAC,aAAa,EAAE,CAAC;QACjC,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;QACzD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC;QAC7C,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,EAAE,KAAK,UAAU,CAAC,UAAU,EAAE,CAAC;YACpD,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,2EAA2E;QAC3E,sEAAsE;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;QAC/C,IAAI,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/graph/entry-points.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Decide whether the workspace at `root` describes a published npm
+ * library. Heuristic: top-level `package.json` has a name + version,
+ * is NOT marked private, AND declares one of the standard package
+ * entry fields (main / module / exports / bin). When this is true,
+ * downstream consumers can import individual files and dead-export
+ * verdicts need to lean toward FALSE-POSITIVE for any symbol that
+ * looks like a utility / config / type-surface helper.
+ */
+export declare function isPublishedLibrary(root: string): boolean;
+export declare function discoverEntryPoints(workspaceRoot: string, knownFiles: ReadonlySet<string>): Set<string>;
+//# sourceMappingURL=entry-points.d.ts.map

package/dist/graph/entry-points.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-points.d.ts","sourceRoot":"","sources":["../../src/graph/entry-points.ts"],"names":[],"mappings":"AAMA;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAiBxD;AAED,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAevG"}