@next-secure-check/rules 0.4.0 → 0.5.0

package/dist/analysis-facts.d.ts

@@ -0,0 +1,62 @@
+import ts from "typescript";
+export type BoundedFlowSourceFact = {
+    readonly node: ts.Node;
+    readonly path: string;
+    readonly scope: ts.Node;
+};
+export type BoundedFlowSinkFact = {
+    readonly node: ts.CallExpression;
+    readonly scope: ts.Node;
+    readonly kind?: string;
+};
+export type BoundedFlowGuardFact = {
+    readonly node: ts.CallExpression;
+    readonly scope: ts.Node;
+    readonly kind: string;
+    readonly identifier?: string;
+};
+export type BoundedFlowAliasFact = {
+    readonly node: ts.VariableDeclaration | ts.BinaryExpression;
+    readonly scope: ts.Node;
+    readonly from: string;
+    readonly to: string;
+    readonly depth: number;
+    readonly path?: string;
+};
+export type BoundedFlowInvalidationReason = "reassignment" | "mutation" | "call-escape";
+export type BoundedFlowInvalidationFact = {
+    readonly node: ts.Node;
+    readonly scope: ts.Node;
+    readonly identifier: string;
+    readonly reason: BoundedFlowInvalidationReason;
+};
+export type BoundedFlowFunctionBoundaryFact = {
+    readonly node: ts.Node;
+};
+export type BoundedFlowEvidencePathFact = {
+    readonly sink: ts.Node;
+    readonly path: string;
+};
+export type BoundedFlowFacts = {
+    readonly sources: readonly BoundedFlowSourceFact[];
+    readonly sinks: readonly BoundedFlowSinkFact[];
+    readonly guards: readonly BoundedFlowGuardFact[];
+    readonly aliases: readonly BoundedFlowAliasFact[];
+    readonly invalidations: readonly BoundedFlowInvalidationFact[];
+    readonly functionBoundaries: readonly BoundedFlowFunctionBoundaryFact[];
+    readonly evidencePaths: ReadonlyMap<ts.Node, string>;
+    readonly guardedSinks: ReadonlySet<ts.CallExpression>;
+};
+export type BoundedFlowFactsBuilder = {
+    readonly sourceFacts: Map<ts.Node, BoundedFlowSourceFact>;
+    readonly sinkFacts: Map<ts.CallExpression, BoundedFlowSinkFact>;
+    readonly guardFacts: Map<ts.CallExpression, BoundedFlowGuardFact>;
+    readonly aliasFacts: BoundedFlowAliasFact[];
+    readonly invalidationFacts: BoundedFlowInvalidationFact[];
+    readonly functionBoundaryFacts: BoundedFlowFunctionBoundaryFact[];
+    readonly evidencePaths: Map<ts.Node, string>;
+    readonly guardedSinks: Set<ts.CallExpression>;
+};
+export declare function createBoundedFlowFactsBuilder(): BoundedFlowFactsBuilder;
+export declare function finalizeBoundedFlowFacts(builder: BoundedFlowFactsBuilder): BoundedFlowFacts;
+//# sourceMappingURL=analysis-facts.d.ts.map

package/dist/analysis-facts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-facts.d.ts","sourceRoot":"","sources":["../src/analysis-facts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,GAAG,EAAE,CAAC,gBAAgB,CAAC;IAC5D,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG,cAAc,GAAG,UAAU,GAAG,aAAa,CAAC;AAExF,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,6BAA6B,CAAC;CAChD,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAClD,QAAQ,CAAC,aAAa,EAAE,SAAS,2BAA2B,EAAE,CAAC;IAC/D,QAAQ,CAAC,kBAAkB,EAAE,SAAS,+BAA+B,EAAE,CAAC;IACxE,QAAQ,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;CACvD,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG;IACpC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IAC1D,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,cAAc,EAAE,mBAAmB,CAAC,CAAC;IAChE,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;IAClE,QAAQ,CAAC,UAAU,EAAE,oBAAoB,EAAE,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,CAAC;IAC1D,QAAQ,CAAC,qBAAqB,EAAE,+BAA+B,EAAE,CAAC;IAClE,QAAQ,CAAC,aAAa,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;CAC/C,CAAC;AAEF,wBAAgB,6BAA6B,IAAI,uBAAuB,CAWvE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,uBAAuB,GAAG,gBAAgB,CAmB3F"}

package/dist/analysis-facts.js

@@ -0,0 +1,29 @@
+export function createBoundedFlowFactsBuilder() {
+    return {
+        sourceFacts: new Map(),
+        sinkFacts: new Map(),
+        guardFacts: new Map(),
+        aliasFacts: [],
+        invalidationFacts: [],
+        functionBoundaryFacts: [],
+        evidencePaths: new Map(),
+        guardedSinks: new Set()
+    };
+}
+export function finalizeBoundedFlowFacts(builder) {
+    const invalidations = new Map();
+    for (const invalidation of builder.invalidationFacts) {
+        invalidations.set(`${invalidation.node.pos}:${invalidation.node.end}:${invalidation.identifier}:${invalidation.reason}`, invalidation);
+    }
+    return {
+        sources: Object.freeze([...builder.sourceFacts.values()]),
+        sinks: Object.freeze([...builder.sinkFacts.values()]),
+        guards: Object.freeze([...builder.guardFacts.values()]),
+        aliases: Object.freeze([...builder.aliasFacts]),
+        invalidations: Object.freeze([...invalidations.values()]),
+        functionBoundaries: Object.freeze([...builder.functionBoundaryFacts]),
+        evidencePaths: new Map(builder.evidencePaths),
+        guardedSinks: new Set(builder.guardedSinks)
+    };
+}
+//# sourceMappingURL=analysis-facts.js.map

package/dist/analysis-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analysis-facts.js","sourceRoot":"","sources":["../src/analysis-facts.ts"],"names":[],"mappings":"AAsEA,MAAM,UAAU,6BAA6B;IAC3C,OAAO;QACL,WAAW,EAAE,IAAI,GAAG,EAAE;QACtB,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,UAAU,EAAE,IAAI,GAAG,EAAE;QACrB,UAAU,EAAE,EAAE;QACd,iBAAiB,EAAE,EAAE;QACrB,qBAAqB,EAAE,EAAE;QACzB,aAAa,EAAE,IAAI,GAAG,EAAE;QACxB,YAAY,EAAE,IAAI,GAAG,EAAE;KACxB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgC;IACvE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;IACrE,KAAK,MAAM,YAAY,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACrD,aAAa,CAAC,GAAG,CACf,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,MAAM,EAAE,EACrG,YAAY,CACb,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/C,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACrE,aAAa,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,YAAY,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/ast-utils.d.ts

@@ -1,6 +1,7 @@
 import type { Severity, SourceFile } from "@next-secure-check/core";
 import ts from "typescript";
 import { type AnalysisCacheStats } from "./analysis-cache.js";
+import type { BoundedFlowFacts } from "./analysis-facts.js";
 export type AstMatch = {
     line: number;
     column: number;
@@ -13,6 +14,7 @@ export type DangerouslySetInnerHtmlMatch = AstMatch & {
 };
 export type AnalysisFacts = {
     sourceFile: ts.SourceFile;
+    boundedFlow: BoundedFlowFacts;
     commandIdentifiers: ReadonlySet<string>;
     childProcessNamespaces: ReadonlySet<string>;
     commandDeclarationNodes: readonly ts.Node[];
@@ -20,9 +22,11 @@ export type AnalysisFacts = {
     safeCommandCalls: ReadonlySet<ts.CallExpression>;
     routeHandlerNodes: readonly ts.Node[];
     sanitizerIdentifiers: ReadonlySet<string>;
+    untrustedSanitizerIdentifiers: ReadonlySet<string>;
     safeHtmlIdentifiers: ReadonlySet<string>;
     hasPasswordHashing: boolean;
     hasAuthIntent: boolean;
+    hasRateLimitIntent: boolean;
     hasValidationIntent: boolean;
     hasUploadHandling: boolean;
 };
@@ -36,6 +40,7 @@ export declare function findDangerouslySetInnerHtmlMatches(file: SourceFile): Da
 export declare function findPasswordHandlingMatches(file: SourceFile): AstMatch[];
 export declare function findRouteHandlerExports(file: SourceFile): AstMatch[];
 export declare function hasAuthIntentSignal(file: SourceFile): boolean;
+export declare function hasRateLimitIntentSignal(file: SourceFile): boolean;
 export declare function hasValidationIntentSignal(file: SourceFile): boolean;
 export declare function findUploadRouteHandlerMatches(file: SourceFile): AstMatch[];
 //# sourceMappingURL=ast-utils.d.ts.map

package/dist/ast-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ast-utils.d.ts","sourceRoot":"","sources":["../src/ast-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAenF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,GAAG;IACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,uBAAuB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5C,kBAAkB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3D,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IACjD,iBAAiB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAIzD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAWhE;AAED,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAmBxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAGpE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,UAAU,GAAG,4BAA4B,EAAE,CAQnG;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAOxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAGpE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAE7D;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEnE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAc1E"}
+{"version":3,"file":"ast-utils.d.ts","sourceRoot":"","sources":["../src/ast-utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAgB5D,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG,QAAQ,GAAG;IACpD,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC;IAC1B,WAAW,EAAE,gBAAgB,CAAC;IAC9B,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC5C,uBAAuB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5C,kBAAkB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3D,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IACjD,iBAAiB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC;IACtC,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC1C,6BAA6B,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACnD,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAIzD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAWhE;AAED,wBAAgB,0BAA0B,IAAI,uBAAuB,CAEpE;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAmBxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAepE;AAED,wBAAgB,kCAAkC,CAAC,IAAI,EAAE,UAAU,GAAG,4BAA4B,EAAE,CAenG;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAOxE;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAGpE;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAE7D;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAElE;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAEnE;AAED,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,UAAU,GAAG,QAAQ,EAAE,CAc1E"}

package/dist/ast-utils.js

@@ -3,8 +3,8 @@ import { SourceAnalysisCache } from "./analysis-cache.js";
 import { collectCommandDiscovery } from "./command-discovery.js";
 import { collectCommandFlowFacts, isAnalyzableCommandExecutionCall } from "./command-flow.js";
 import { findPasswordHandlingNodes, hasPasswordHashingCall } from "./password-ast.js";
-import { findRawSqlConcatNodes } from "./sql-ast.js";
-import { ROUTE_HANDLER_NAMES, exportedRouteHandlerName, hasAuthIntentInSource, hasValidationIntentInSource, isApiRouteFilePath, isUploadHandlingNode } from "./route-ast.js";
+import { createRawSqlFlowCallbacks, findRawSqlConcatNodes } from "./sql-ast.js";
+import { ROUTE_HANDLER_NAMES, exportedRouteHandlerName, hasAuthIntentInSource, hasRateLimitIntentInSource, hasValidationIntentInSource, isApiRouteFilePath, isUploadHandlingNode } from "./route-ast.js";
 import { createXssAnalysisFacts, findDangerouslySetInnerHtmlNodes } from "./xss-ast.js";
 const analysisFactsCache = new SourceAnalysisCache();
 export function getAnalysisFacts(file) {
@@ -35,14 +35,24 @@ export function findCommandExecutionMatches(file) {
     return dedupeMatches(matches);
 }
 export function findRawSqlConcatMatches(file) {
-    const { sourceFile } = getAnalysisFacts(file);
-    return dedupeMatches(findRawSqlConcatNodes(sourceFile).map((node) => matchFromNode(file, sourceFile, node)));
+    const { sourceFile, boundedFlow } = getAnalysisFacts(file);
+    const directMatches = findRawSqlConcatNodes(sourceFile);
+    const boundedMatches = boundedFlow.sinks
+        .filter((sink) => sink.kind === "raw-sql")
+        .map((sink) => sink.node);
+    const nodes = [...directMatches, ...boundedMatches];
+    return dedupeMatches(nodes.map((node) => {
+        const match = matchFromNode(file, sourceFile, node);
+        const evidencePath = boundedFlow.evidencePaths.get(node);
+        return evidencePath ? { ...match, evidencePath } : match;
+    }));
 }
 export function findDangerouslySetInnerHtmlMatches(file) {
-    const { sourceFile, sanitizerIdentifiers, safeHtmlIdentifiers } = getAnalysisFacts(file);
-    return dedupeMatches(findDangerouslySetInnerHtmlNodes(sourceFile, sanitizerIdentifiers, safeHtmlIdentifiers).map(({ node, severity }) => ({
+    const { sourceFile, boundedFlow, sanitizerIdentifiers, untrustedSanitizerIdentifiers, safeHtmlIdentifiers } = getAnalysisFacts(file);
+    return dedupeMatches(findDangerouslySetInnerHtmlNodes(sourceFile, sanitizerIdentifiers, safeHtmlIdentifiers, boundedFlow, untrustedSanitizerIdentifiers).map(({ node, severity, evidencePath }) => ({
         ...matchFromNode(file, sourceFile, node),
-        severity
+        severity,
+        ...(evidencePath ? { evidencePath } : {})
     })));
 }
 export function findPasswordHandlingMatches(file) {
@@ -59,6 +69,9 @@ export function findRouteHandlerExports(file) {
 export function hasAuthIntentSignal(file) {
     return getAnalysisFacts(file).hasAuthIntent;
 }
+export function hasRateLimitIntentSignal(file) {
+    return getAnalysisFacts(file).hasRateLimitIntent;
+}
 export function hasValidationIntentSignal(file) {
     return getAnalysisFacts(file).hasValidationIntent;
 }
@@ -77,7 +90,7 @@ export function findUploadRouteHandlerMatches(file) {
 }
 function createAnalysisFacts(sourceFile) {
     const commandDiscovery = collectCommandDiscovery(sourceFile);
-    const commandFlow = collectCommandFlowFacts(sourceFile, commandDiscovery.commandIdentifiers, commandDiscovery.childProcessNamespaces);
+    const commandFlow = collectCommandFlowFacts(sourceFile, commandDiscovery.commandIdentifiers, commandDiscovery.childProcessNamespaces, createRawSqlFlowCallbacks());
     const routeHandlerNodes = [];
     let hasUploadHandling = false;
     visit(sourceFile, (node) => {
@@ -92,6 +105,7 @@ function createAnalysisFacts(sourceFile) {
     const xssFacts = createXssAnalysisFacts(sourceFile);
     return {
         sourceFile,
+        boundedFlow: commandFlow.boundedFlow,
         commandIdentifiers: commandDiscovery.commandIdentifiers,
         childProcessNamespaces: commandDiscovery.childProcessNamespaces,
         commandDeclarationNodes: commandDiscovery.commandDeclarationNodes,
@@ -99,9 +113,11 @@ function createAnalysisFacts(sourceFile) {
         safeCommandCalls: commandFlow.safeCommandCalls,
         routeHandlerNodes,
         sanitizerIdentifiers: xssFacts.sanitizerIdentifiers,
+        untrustedSanitizerIdentifiers: xssFacts.untrustedSanitizerIdentifiers,
         safeHtmlIdentifiers: xssFacts.safeHtmlIdentifiers,
         hasPasswordHashing: hasPasswordHashingCall(sourceFile),
         hasAuthIntent: hasAuthIntentInSource(sourceFile),
+        hasRateLimitIntent: hasRateLimitIntentInSource(sourceFile),
         hasValidationIntent: hasValidationIntentInSource(sourceFile),
         hasUploadHandling
     };

package/dist/ast-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"ast-utils.js","sourceRoot":"","sources":["../src/ast-utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAA2B,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,MAAM,cAAc,CAAC;AAgCxF,MAAM,kBAAkB,GAAG,IAAI,mBAAmB,EAAiB,CAAC;AAEpE,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;QACvC,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CACpC,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,OAAO,EACZ,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7B,CAAC;QACF,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,kBAAkB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAgB;IAC1D,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzJ,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7F,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,IACE,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAC1B,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAC1B,CAAC,gCAAgC,CAAC,IAAI,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,EACnF,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAgB;IACtD,MAAM,EAAE,UAAU,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,aAAa,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,IAAgB;IACjE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzF,OAAO,aAAa,CAClB,gCAAgC,CAAC,UAAU,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACnH,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC;QACxC,QAAQ;KACT,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAgB;IAC1D,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,aAAa,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAgB;IACtD,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAgB;IACxD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAAgB;IAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpF,MAAM,mBAAmB,GAAG,iBAAiB;SAC1C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IACrF,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IAExD,OAAO,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAyB;IACpD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,uBAAuB,CACzC,UAAU,EACV,gBAAgB,CAAC,kBAAkB,EACnC,gBAAgB,CAAC,sBAAsB,CACxC,CAAC;IACF,MAAM,iBAAiB,GAAc,EAAE,CAAC;IACxC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACjF,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,iBAAiB,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAEpD,OAAO;QACL,UAAU;QACV,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;QACvD,sBAAsB,EAAE,gBAAgB,CAAC,sBAAsB;QAC/D,uBAAuB,EAAE,gBAAgB,CAAC,uBAAuB;QACjE,kBAAkB,EAAE,WAAW,CAAC,WAAW;QAC3C,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;QAC9C,iBAAiB;QACjB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,kBAAkB,EAAE,sBAAsB,CAAC,UAAU,CAAC;QACtD,aAAa,EAAE,qBAAqB,CAAC,UAAU,CAAC;QAChD,mBAAmB,EAAE,2BAA2B,CAAC,UAAU,CAAC;QAC5D,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB,EAAE,UAAyB,EAAE,IAAa;IAC/E,MAAM,QAAQ,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEnD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;QACvB,MAAM,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC;QAC9B,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE;QAC3B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAA0B,OAAiB;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,KAAK,CAAC,IAAa,EAAE,QAAiC;IAC7D,QAAQ,CAAC,IAAI,CAAC,CAAC;IACf,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"ast-utils.js","sourceRoot":"","sources":["../src/ast-utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAA2B,MAAM,qBAAqB,CAAC;AAEnF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,gCAAgC,EAAE,MAAM,mBAAmB,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,EACL,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,sBAAsB,EAAE,gCAAgC,EAAE,MAAM,cAAc,CAAC;AAmCxF,MAAM,kBAAkB,GAAG,IAAI,mBAAmB,EAAiB,CAAC;AAEpE,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE;QACvC,MAAM,UAAU,GAAG,EAAE,CAAC,gBAAgB,CACpC,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,OAAO,EACZ,EAAE,CAAC,YAAY,CAAC,MAAM,EACtB,IAAI,EACJ,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC7B,CAAC;QACF,OAAO,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,kBAAkB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,kBAAkB,CAAC,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAgB;IAC1D,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzJ,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IAE7F,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,IACE,CAAC,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC;YAC1B,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAC1B,CAAC,gCAAgC,CAAC,IAAI,EAAE,kBAAkB,EAAE,sBAAsB,CAAC,EACnF,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAgB;IACtD,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,WAAW,CAAC,KAAK;SACrC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC;SACzC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC;IAEpD,OAAO,aAAa,CAClB,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACjB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,WAAW,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,IAAgB;IACjE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrI,OAAO,aAAa,CAClB,gCAAgC,CAC9B,UAAU,EACV,oBAAoB,EACpB,mBAAmB,EACnB,WAAW,EACX,6BAA6B,CAC9B,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC;QACxC,QAAQ;QACR,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,IAAgB;IAC1D,MAAM,EAAE,UAAU,EAAE,kBAAkB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,aAAa,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAgB;IACtD,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,aAAa,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAgB;IACvD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,kBAAkB,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAgB;IACxD,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,mBAAmB,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,IAAgB;IAC5D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACpF,MAAM,mBAAmB,GAAG,iBAAiB;SAC1C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QAC5C,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,CAAC;IACrF,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;IAExD,OAAO,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAyB;IACpD,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,uBAAuB,CACzC,UAAU,EACV,gBAAgB,CAAC,kBAAkB,EACnC,gBAAgB,CAAC,sBAAsB,EACvC,yBAAyB,EAAE,CAC5B,CAAC;IACF,MAAM,iBAAiB,GAAc,EAAE,CAAC;IACxC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,KAAK,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE;QACzB,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,SAAS,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;YACjF,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,iBAAiB,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAEpD,OAAO;QACL,UAAU;QACV,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,kBAAkB,EAAE,gBAAgB,CAAC,kBAAkB;QACvD,sBAAsB,EAAE,gBAAgB,CAAC,sBAAsB;QAC/D,uBAAuB,EAAE,gBAAgB,CAAC,uBAAuB;QACjE,kBAAkB,EAAE,WAAW,CAAC,WAAW;QAC3C,gBAAgB,EAAE,WAAW,CAAC,gBAAgB;QAC9C,iBAAiB;QACjB,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;QACnD,6BAA6B,EAAE,QAAQ,CAAC,6BAA6B;QACrE,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,kBAAkB,EAAE,sBAAsB,CAAC,UAAU,CAAC;QACtD,aAAa,EAAE,qBAAqB,CAAC,UAAU,CAAC;QAChD,kBAAkB,EAAE,0BAA0B,CAAC,UAAU,CAAC;QAC1D,mBAAmB,EAAE,2BAA2B,CAAC,UAAU,CAAC;QAC5D,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAgB,EAAE,UAAyB,EAAE,IAAa;IAC/E,MAAM,QAAQ,GAAG,UAAU,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAEnD,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC;QACvB,MAAM,EAAE,QAAQ,CAAC,SAAS,GAAG,CAAC;QAC9B,QAAQ,EAAE,UAAU,CAAC,IAAI,EAAE;QAC3B,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAA0B,OAAiB;IAC/D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,KAAK,CAAC,IAAa,EAAE,QAAiC;IAC7D,QAAQ,CAAC,IAAI,CAAC,CAAC;IACf,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/command-flow.d.ts

@@ -1,9 +1,25 @@
 import ts from "typescript";
+import { type BoundedFlowFacts, type BoundedFlowInvalidationReason } from "./analysis-facts.js";
 export type CommandFlowFacts = {
     sourcePaths: ReadonlyMap<ts.CallExpression, string>;
     safeCommandCalls: ReadonlySet<ts.CallExpression>;
+    boundedFlow: BoundedFlowFacts;
+};
+export type BoundedFlowContext = {
+    readonly scopeRoot: ts.Node;
+    readonly findSourcePathInExpression: (node: ts.Node) => string | undefined;
+    readonly findSourcePathInArguments: (node: ts.CallExpression) => string | undefined;
+    readonly recordSink: (node: ts.CallExpression, kind?: string) => void;
+    readonly recordEvidencePath: (node: ts.Node, path: string) => void;
+};
+export type BoundedFlowCallbacks = {
+    readonly onVariableDeclaration?: (node: ts.VariableDeclaration, context: BoundedFlowContext) => void;
+    readonly onAssignment?: (node: ts.BinaryExpression, context: BoundedFlowContext) => void;
+    readonly onCall?: (node: ts.CallExpression, context: BoundedFlowContext) => void;
+    readonly onTaggedTemplate?: (node: ts.TaggedTemplateExpression, context: BoundedFlowContext) => void;
+    readonly onInvalidation?: (identifier: string, reason: BoundedFlowInvalidationReason, context: BoundedFlowContext) => void;
 };
 export declare function isAnalyzableCommandExecutionCall(node: ts.CallExpression, commandIdentifiers: ReadonlySet<string>, childProcessNamespaces: ReadonlySet<string>): boolean;
 export declare function collectCommandSourcePaths(sourceFile: ts.SourceFile, commandIdentifiers: ReadonlySet<string>, childProcessNamespaces: ReadonlySet<string>): ReadonlyMap<ts.CallExpression, string>;
-export declare function collectCommandFlowFacts(sourceFile: ts.SourceFile, commandIdentifiers: ReadonlySet<string>, childProcessNamespaces: ReadonlySet<string>): CommandFlowFacts;
+export declare function collectCommandFlowFacts(sourceFile: ts.SourceFile, commandIdentifiers: ReadonlySet<string>, childProcessNamespaces: ReadonlySet<string>, callbacks?: BoundedFlowCallbacks): CommandFlowFacts;
 //# sourceMappingURL=command-flow.d.ts.map

package/dist/command-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-flow.d.ts","sourceRoot":"","sources":["../src/command-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAgB5B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACpD,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;CAClD,CAAC;AAEF,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,EAAE,CAAC,cAAc,EACvB,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,EACvC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1C,OAAO,CAET;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,EACvC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1C,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAExC;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,EACvC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1C,gBAAgB,CAiBlB"}
+{"version":3,"file":"command-flow.d.ts","sourceRoot":"","sources":["../src/command-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,YAAY,CAAC;AAc5B,OAAO,EAGL,KAAK,gBAAgB,EAErB,KAAK,6BAA6B,EACnC,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACpD,gBAAgB,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC;IACjD,WAAW,EAAE,gBAAgB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC;IAC5B,QAAQ,CAAC,0BAA0B,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,MAAM,GAAG,SAAS,CAAC;IAC3E,QAAQ,CAAC,yBAAyB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,KAAK,MAAM,GAAG,SAAS,CAAC;IACpF,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACtE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACpE,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACrG,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACzF,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACjF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACrG,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,6BAA6B,EACrC,OAAO,EAAE,kBAAkB,KACxB,IAAI,CAAC;CACX,CAAC;AAEF,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,EAAE,CAAC,cAAc,EACvB,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,EACvC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1C,OAAO,CAET;AAED,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,EACvC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,GAC1C,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC,CAExC;AAED,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,EAAE,CAAC,UAAU,EACzB,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,EACvC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,EAC3C,SAAS,GAAE,oBAAyB,GACnC,gBAAgB,CA6BlB"}

package/dist/command-flow.js

@@ -1,5 +1,6 @@
 import ts from "typescript";
 import { COMMAND_ALIAS_LIMIT, REQUEST_SOURCE_NAMES, ROUTE_PARAMS_NAMES, SEARCH_PARAMS_NAME, bindingElementLocalName, bindingElementName, commandExecutionName, isCommandAssignmentOperator, isCommandExecutionCall, isCommandMutationOperator } from "./command-ast.js";
+import { createBoundedFlowFactsBuilder, finalizeBoundedFlowFacts } from "./analysis-facts.js";
 import { hasCommandAllowlistGuard, isCommandAllowlistMembershipCall } from "./command-guards.js";
 export function isAnalyzableCommandExecutionCall(node, commandIdentifiers, childProcessNamespaces) {
     return isCommandExecutionCall(node.expression, commandIdentifiers, childProcessNamespaces) && !isSafeStaticSpawnCall(node);
@@ -7,20 +8,31 @@ export function isAnalyzableCommandExecutionCall(node, commandIdentifiers, child
 export function collectCommandSourcePaths(sourceFile, commandIdentifiers, childProcessNamespaces) {
     return collectCommandFlowFacts(sourceFile, commandIdentifiers, childProcessNamespaces).sourcePaths;
 }
-export function collectCommandFlowFacts(sourceFile, commandIdentifiers, childProcessNamespaces) {
-    const sourcePaths = new Map();
-    const safeCommandCalls = new Set();
-    analyzeCommandScope(sourceFile, sourceFile, commandIdentifiers, childProcessNamespaces, sourcePaths, safeCommandCalls);
+export function collectCommandFlowFacts(sourceFile, commandIdentifiers, childProcessNamespaces, callbacks = {}) {
+    const factsBuilder = createBoundedFlowFactsBuilder();
+    collectFunctionBoundaryFacts(sourceFile, factsBuilder);
+    analyzeCommandScope(sourceFile, sourceFile, commandIdentifiers, childProcessNamespaces, factsBuilder, callbacks);
     visitCommandNodes(sourceFile, (node) => {
         if (!isCommandFunctionLike(node)) {
             return;
         }
         const body = commandFunctionBody(node);
         if (body) {
-            analyzeCommandScope(body, body, commandIdentifiers, childProcessNamespaces, sourcePaths, safeCommandCalls);
+            analyzeCommandScope(body, body, commandIdentifiers, childProcessNamespaces, factsBuilder, callbacks);
         }
     });
-    return { sourcePaths, safeCommandCalls };
+    const boundedFlow = finalizeBoundedFlowFacts(factsBuilder);
+    const sourcePaths = new Map();
+    for (const [node, path] of boundedFlow.evidencePaths) {
+        if (ts.isCallExpression(node)) {
+            sourcePaths.set(node, path);
+        }
+    }
+    return {
+        sourcePaths,
+        safeCommandCalls: boundedFlow.guardedSinks,
+        boundedFlow
+    };
 }
 function isSafeStaticSpawnCall(node) {
     const methodName = commandExecutionName(node.expression);
@@ -59,53 +71,69 @@ function isSafeStaticSpawnCall(node) {
         return property.initializer.kind === ts.SyntaxKind.FalseKeyword;
     });
 }
-function analyzeCommandScope(scopeRoot, node, commandIdentifiers, childProcessNamespaces, sourcePaths, safeCommandCalls, state = createCommandFlowState()) {
+function analyzeCommandScope(scopeRoot, node, commandIdentifiers, childProcessNamespaces, factsBuilder, callbacks, state = createCommandFlowState(factsBuilder, scopeRoot, callbacks)) {
     if (node !== scopeRoot && isCommandFunctionLike(node)) {
         return;
     }
     if (ts.isVariableDeclaration(node)) {
         recordCommandDeclaration(node, state);
+        state.callbacks.onVariableDeclaration?.(node, createBoundedFlowContext(state));
     }
     if (ts.isBinaryExpression(node) && isCommandAssignmentOperator(node.operatorToken.kind)) {
         recordCommandAssignment(node, state);
+        state.callbacks.onAssignment?.(node, createBoundedFlowContext(state));
     }
     if (ts.isPrefixUnaryExpression(node) && isCommandMutationOperator(node.operator)) {
-        invalidateCommandTarget(node.operand, state);
+        invalidateCommandTarget(node.operand, state, "mutation");
     }
     if (ts.isPostfixUnaryExpression(node) && isCommandMutationOperator(node.operator)) {
-        invalidateCommandTarget(node.operand, state);
+        invalidateCommandTarget(node.operand, state, "mutation");
+    }
+    if (ts.isTaggedTemplateExpression(node)) {
+        state.callbacks.onTaggedTemplate?.(node, createBoundedFlowContext(state));
     }
     if (ts.isCallExpression(node)) {
+        state.callbacks.onCall?.(node, createBoundedFlowContext(state));
         if (isAnalyzableCommandExecutionCall(node, commandIdentifiers, childProcessNamespaces)) {
+            state.factsBuilder.sinkFacts.set(node, { node, scope: scopeRoot, kind: commandExecutionName(node.expression) });
             const sourcePath = findCommandSourcePathInArguments(node, state);
             if (sourcePath) {
-                if (isGuardedCommandSink(node, state)) {
-                    safeCommandCalls.add(node);
+                const guardIdentifier = guardedCommandIdentifier(node, state);
+                if (guardIdentifier) {
+                    state.factsBuilder.guardedSinks.add(node);
+                    state.factsBuilder.guardFacts.set(node, {
+                        node,
+                        scope: scopeRoot,
+                        kind: "command-allowlist",
+                        identifier: guardIdentifier
+                    });
                 }
                 else {
-                    sourcePaths.set(node, sourcePath);
+                    state.factsBuilder.evidencePaths.set(node, sourcePath);
                 }
             }
             else {
-                invalidateTaintedReferences(node, state);
+                invalidateTaintedReferences(node, state, "call-escape");
             }
         }
         else if (!isCommandAllowlistMembershipCall(node) && !sourcePathForExpression(node, state)) {
-            invalidateTaintedReferences(node, state);
+            invalidateTaintedReferences(node, state, "call-escape");
         }
     }
-    ts.forEachChild(node, (child) => analyzeCommandScope(scopeRoot, child, commandIdentifiers, childProcessNamespaces, sourcePaths, safeCommandCalls, state));
+    ts.forEachChild(node, (child) => analyzeCommandScope(scopeRoot, child, commandIdentifiers, childProcessNamespaces, factsBuilder, callbacks, state));
 }
-function isGuardedCommandSink(node, state) {
+function guardedCommandIdentifier(node, state) {
     const [commandArgument] = node.arguments;
     if (!commandArgument) {
-        return false;
+        return undefined;
     }
     const normalized = unwrapCommandExpression(commandArgument);
     if (!ts.isIdentifier(normalized) || !sourcePathForExpression(normalized, state)) {
-        return false;
+        return undefined;
     }
-    return hasCommandAllowlistGuard(node, normalized.text) && !hasUntrustedSpawnArguments(node, state);
+    return hasCommandAllowlistGuard(node, normalized.text) && !hasUntrustedSpawnArguments(node, state)
+        ? normalized.text
+        : undefined;
 }
 function hasUntrustedSpawnArguments(node, state) {
     const methodName = commandExecutionName(node.expression);
@@ -114,14 +142,30 @@ function hasUntrustedSpawnArguments(node, state) {
     }
     return node.arguments.slice(1).some((argument) => Boolean(findCommandSourcePathInExpression(argument, state)));
 }
-function createCommandFlowState() {
+function createCommandFlowState(factsBuilder, scopeRoot, callbacks) {
     return {
+        factsBuilder,
+        scopeRoot,
+        callbacks,
         declared: new Set(),
         initialized: new Set(),
         invalidated: new Set(),
         tracked: new Map()
     };
 }
+function createBoundedFlowContext(state) {
+    return {
+        scopeRoot: state.scopeRoot,
+        findSourcePathInExpression: (node) => findCommandSourcePathInExpression(node, state),
+        findSourcePathInArguments: (node) => findCommandSourcePathInArguments(node, state),
+        recordSink: (node, kind) => {
+            state.factsBuilder.sinkFacts.set(node, { node, scope: state.scopeRoot, kind });
+        },
+        recordEvidencePath: (node, path) => {
+            state.factsBuilder.evidencePaths.set(node, path);
+        }
+    };
+}
 function recordCommandDeclaration(node, state) {
     if (ts.isIdentifier(node.name)) {
         state.declared.add(node.name.text);
@@ -129,7 +173,9 @@ function recordCommandDeclaration(node, state) {
             return;
         }
         state.initialized.add(node.name.text);
-        trackCommandValue(node.name.text, sourcePathForAssignment(node.initializer, state, node.name.text), state);
+        const value = sourcePathForAssignment(node.initializer, state, node.name.text);
+        recordIdentifierAlias(node, node.name.text, node.initializer, value, state);
+        trackCommandValue(node.name.text, value, state);
         return;
     }
     if (!ts.isObjectBindingPattern(node.name) || !node.initializer) {
@@ -150,20 +196,36 @@ function recordCommandDeclaration(node, state) {
 function recordCommandAssignment(node, state) {
     const target = commandTargetIdentifier(node.left);
     if (!target) {
-        invalidateTaintedReferences(node.left, state);
+        invalidateTaintedReferences(node.left, state, "reassignment");
         return;
     }
     if (node.operatorToken.kind !== ts.SyntaxKind.EqualsToken) {
-        invalidateCommandTarget(node.left, state);
+        invalidateCommandTarget(node.left, state, "mutation");
         return;
     }
     if (state.invalidated.has(target) || state.initialized.has(target)) {
-        invalidateCommandTarget(node.left, state);
+        invalidateCommandTarget(node.left, state, "reassignment");
         return;
     }
     state.declared.add(target);
     state.initialized.add(target);
-    trackCommandValue(target, sourcePathForAssignment(node.right, state, target), state);
+    const value = sourcePathForAssignment(node.right, state, target);
+    recordIdentifierAlias(node, target, node.right, value, state);
+    trackCommandValue(target, value, state);
+}
+function recordIdentifierAlias(node, target, expression, value, state) {
+    const normalized = unwrapCommandExpression(expression);
+    if (!value || value.aliasDepth > COMMAND_ALIAS_LIMIT || !ts.isIdentifier(normalized) || normalized.text === target) {
+        return;
+    }
+    state.factsBuilder.aliasFacts.push({
+        node,
+        scope: state.scopeRoot,
+        from: normalized.text,
+        to: target,
+        depth: value.aliasDepth,
+        path: value.path
+    });
 }
 function trackCommandValue(name, value, state) {
     if (!value || value.aliasDepth > COMMAND_ALIAS_LIMIT || state.invalidated.has(name)) {
@@ -209,7 +271,7 @@ function sourcePathForExpression(expression, state) {
             return tracked;
         }
         if (ROUTE_PARAMS_NAMES.test(normalized.text)) {
-            return { path: normalized.text, aliasDepth: 0 };
+            return recordDirectSource(normalized, { path: normalized.text, aliasDepth: 0 }, state);
         }
         return undefined;
     }
@@ -231,12 +293,19 @@ function sourcePathForReference(expression, state) {
         if (state.invalidated.has(normalized.text)) {
             return undefined;
         }
-        return state.tracked.get(normalized.text) ?? (ROUTE_PARAMS_NAMES.test(normalized.text) ? { path: normalized.text, aliasDepth: 0 } : undefined);
+        const tracked = state.tracked.get(normalized.text);
+        if (tracked) {
+            return tracked;
+        }
+        if (ROUTE_PARAMS_NAMES.test(normalized.text)) {
+            return recordDirectSource(normalized, { path: normalized.text, aliasDepth: 0 }, state);
+        }
+        return undefined;
     }
     if (ts.isPropertyAccessExpression(normalized)) {
         const directSource = directCommandPropertySource(normalized);
         if (directSource) {
-            return directSource;
+            return recordDirectSource(normalized, directSource, state);
         }
         const base = sourcePathForReference(normalized.expression, state);
         return base ? commandProperty(base, normalized.name.text) : undefined;
@@ -248,7 +317,7 @@ function sourcePathForReference(expression, state) {
         }
         const directSource = directCommandElementSource(normalized, propertyName);
         if (directSource) {
-            return directSource;
+            return recordDirectSource(normalized, directSource, state);
         }
         const base = sourcePathForReference(normalized.expression, state);
         return base ? commandProperty(base, propertyName) : undefined;
@@ -257,11 +326,11 @@ function sourcePathForReference(expression, state) {
         const methodName = normalized.expression.name.text;
         const receiver = normalized.expression.expression;
         if ((methodName === "json" || methodName === "formData") && isRequestSourceReceiver(receiver)) {
-            return { path: `${commandExpressionLabel(receiver)}.${methodName}()`, aliasDepth: 0 };
+            return recordDirectSource(normalized, { path: `${commandExpressionLabel(receiver)}.${methodName}()`, aliasDepth: 0 }, state);
         }
         if (methodName === "get") {
             if (isSearchParamsReceiver(receiver)) {
-                return { path: `${commandExpressionLabel(receiver)}.get()`, aliasDepth: 0 };
+                return recordDirectSource(normalized, { path: `${commandExpressionLabel(receiver)}.get()`, aliasDepth: 0 }, state);
             }
             const base = sourcePathForReference(receiver, state);
             return base ? commandProperty(base, "get()") : undefined;
@@ -269,6 +338,14 @@ function sourcePathForReference(expression, state) {
     }
     return undefined;
 }
+function recordDirectSource(node, value, state) {
+    state.factsBuilder.sourceFacts.set(node, {
+        node,
+        path: value.path,
+        scope: state.scopeRoot
+    });
+    return value;
+}
 function directCommandPropertySource(node) {
     if (!isRequestSourceReceiver(node.expression) || (node.name.text !== "body" && node.name.text !== "query")) {
         return undefined;
@@ -293,15 +370,16 @@ function commandAlias(value, aliasName) {
         aliasDepth: value.aliasDepth + 1
     };
 }
-function invalidateCommandTarget(node, state) {
+function invalidateCommandTarget(node, state, reason) {
     const target = commandTargetIdentifier(node);
     if (target) {
+        recordInvalidation(node, target, reason, state);
         state.tracked.delete(target);
         state.invalidated.add(target);
     }
-    invalidateTaintedReferences(node, state);
+    invalidateTaintedReferences(node, state, reason);
 }
-function invalidateTaintedReferences(node, state) {
+function invalidateTaintedReferences(node, state, reason) {
     const identifiers = new Set();
     visitCommandNodes(node, (child) => {
         if (!ts.isIdentifier(child) || !state.tracked.has(child.text)) {
@@ -313,10 +391,15 @@ function invalidateTaintedReferences(node, state) {
         identifiers.add(child.text);
     });
     for (const identifier of identifiers) {
+        recordInvalidation(node, identifier, reason, state);
         state.tracked.delete(identifier);
         state.invalidated.add(identifier);
     }
 }
+function recordInvalidation(node, identifier, reason, state) {
+    state.factsBuilder.invalidationFacts.push({ node, scope: state.scopeRoot, identifier, reason });
+    state.callbacks.onInvalidation?.(identifier, reason, createBoundedFlowContext(state));
+}
 function commandTargetIdentifier(node) {
     if (ts.isIdentifier(node)) {
         return node.text;
@@ -367,6 +450,13 @@ function isCommandFunctionLike(node) {
         ts.isMethodDeclaration(node) ||
         ts.isSetAccessorDeclaration(node));
 }
+function collectFunctionBoundaryFacts(sourceFile, factsBuilder) {
+    visitCommandNodes(sourceFile, (node) => {
+        if (isCommandFunctionLike(node)) {
+            factsBuilder.functionBoundaryFacts.push({ node });
+        }
+    });
+}
 function commandFunctionBody(node) {
     return node.body;
 }