@timo9378/flow2code 0.1.6 → 0.1.8

package/CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.1.8] — 2026-03-05
+
+### Security
+- **HTTP server request timeout** — Added `headersTimeout` (30s) and `requestTimeout` (60s) to prevent Slowloris-style DoS attacks (#16)
+- **Server `headersSent` guard** — Error handler now checks `res.headersSent` before writing 500 response, preventing `ERR_HTTP_HEADERS_SENT` crash (#14)
+- **Validate IR from server** — `handleDecompileTS` and `handleSelectOpenAPIFlow` now call `validateFlowIR()` before `loadIR()`, matching `handleLoadIRFromJSON` behavior (#22)
+
+### Fixed
+- **Validator iterative DFS** — Replaced recursive `dfs()` with explicit stack-based iteration to prevent stack overflow on deep graphs (5000+ nodes) (#11)
+- **`isFetchCall` AST-based detection** — Replaced `text.includes("fetch(")` string matching with proper AST walk using `CallExpression` + `Identifier` node types (#12)
+- **`hasAwaitExpression` AST walk** — Replaced `text.startsWith("await ")` fallback with recursive `forEachChild` AST traversal to detect nested awaits (#23)
+- **`trackVariableUses` strip strings** — Expression string now has string literals (`"..."`, `'...'`, `` `...` ``) stripped before identifier regex scan, preventing false-positive variable references (#13)
+- **`_nodeCounter` max ID parse** — After `loadIR`, counter is set to max numeric ID from existing node IDs (not `nodes.length`), preventing ID collisions (#15)
+- **`resolveTriggerRef` cache** — Trigger node lookup cached per IR reference, eliminating O(N) linear scan on every `$trigger` expression evaluation (#17)
+- **`$input` ambiguity warning** — `resolveInputRef` now emits `console.warn` when a node has multiple non-trigger upstream edges, identifying which source is used (#18)
+- **OpenAPI tags filter** — `handleImportOpenAPI` now implements `filter.tags` (case-insensitive match against `meta.tags`), which was previously accepted but silently ignored (#20)
+- **Clipboard fallback** — `handleExportIR` now catches clipboard write errors gracefully instead of letting promise rejection propagate (#21)
+
+### Added
+- **`createPlatformRegistry` factory** — New function for creating isolated platform registry instances, enabling safe test parallelism and concurrent compilation (#19)
+
+### Tests
+- Added iterative DFS deep graph test (5000 nodes, verifies no stack overflow)
+- Test count: 411 tests / 33 test files
+
+## [0.1.7] — 2026-03-05
+
+### Performance
+- **Precompute `edgeSuccessors` map** — Eliminated O(N×E) per-call rebuild in `generateBlockContinuation`; successor lookup is now O(1) via pre-built map in `CompilerContext`
+- **Reuse `nodeMap` in control-flow analysis** — `computeControlFlowDescendants` now receives the existing `nodeMap` instead of rebuilding a redundant `new Map()` each call
+
+### Fixed
+- **Decompiler `processForStatement` AST correctness** — Replaced fragile `.split("{")` string hack with proper AST methods (`getInitializer()`, `getCondition()`, `getIncrementor()`); fixes incorrect parsing when loop body contains object literals
+- **OpenAPI YAML import** — `handleImportOpenAPI` now supports `.yaml`/`.yml` files via dynamic `import("yaml")` instead of silently failing with `JSON.parse`
+- **`revokeObjectURL` download race** — Deferred `URL.revokeObjectURL` by 10 seconds after `click()` to prevent Safari/slow-browser download failures
+- **CLI watch mode async I/O** — New `loadFlowProjectAsync` reads flow projects with `fs/promises` (`readFile`/`readdir`); `compileFlowDirAsync` no longer blocks the event loop with sync file I/O
+
+### Tests
+- Added `loadFlowProjectAsync` parity tests (split + JSON + error case)
+- Test count: 410 tests / 33 test files
+
 ## [0.1.6] — 2026-03-05
 
 ### Fixed (Critical)

package/dist/cli.js

@@ -218,25 +218,32 @@ function detectCycles(nodes, edges) {
   for (const node of nodes) {
     color.set(node.id, WHITE);
   }
-  function dfs(nodeId) {
-    color.set(nodeId, GRAY);
-    for (const neighbor of adjacency.get(nodeId) ?? []) {
+  for (const node of nodes) {
+    if (color.get(node.id) !== WHITE) continue;
+    const stack = [[node.id, 0]];
+    color.set(node.id, GRAY);
+    while (stack.length > 0) {
+      const top = stack[stack.length - 1];
+      const [currentId, idx] = top;
+      const neighbors = adjacency.get(currentId) ?? [];
+      if (idx >= neighbors.length) {
+        color.set(currentId, BLACK);
+        stack.pop();
+        continue;
+      }
+      top[1] = idx + 1;
+      const neighbor = neighbors[idx];
       if (color.get(neighbor) === GRAY) {
         errors.push({
           code: "CYCLE_DETECTED",
-          message: `Cycle detected: node "${nodeId}" \u2192 "${neighbor}"`,
-          nodeId
+          message: `Cycle detected: node "${currentId}" \u2192 "${neighbor}"`,
+          nodeId: currentId
         });
       } else if (color.get(neighbor) === WHITE) {
-        dfs(neighbor);
+        color.set(neighbor, GRAY);
+        stack.push([neighbor, 0]);
       }
     }
-    color.set(nodeId, BLACK);
-  }
-  for (const node of nodes) {
-    if (color.get(node.id) === WHITE) {
-      dfs(node.id);
-    }
   }
   return errors;
 }
@@ -450,10 +457,16 @@ function resolveInputRef(path, context) {
   const incoming = context.ir.edges.filter(
     (e) => e.targetNodeId === context.currentNodeId
   );
-  const dataSource = incoming.find((e) => {
+  const nonTriggerIncoming = incoming.filter((e) => {
     const src = context.nodeMap.get(e.sourceNodeId);
     return src && src.category !== "trigger" /* TRIGGER */;
-  }) || incoming[0];
+  });
+  if (nonTriggerIncoming.length > 1 && typeof console !== "undefined") {
+    console.warn(
+      `[flow2code] $input is ambiguous: node "${context.currentNodeId}" has ${nonTriggerIncoming.length} non-trigger upstream edges. Using first match "${nonTriggerIncoming[0].sourceNodeId}".`
+    );
+  }
+  const dataSource = nonTriggerIncoming[0] || incoming[0];
   if (dataSource) {
     const srcId = dataSource.sourceNodeId;
     if (context.blockScopedNodeIds?.has(srcId)) {
@@ -469,21 +482,27 @@ function resolveInputRef(path, context) {
   );
 }
 function resolveTriggerRef(path, context) {
-  const trigger = context.ir.nodes.find(
-    (n) => n.category === "trigger" /* TRIGGER */
-  );
-  if (trigger) {
-    if (context.symbolTable?.hasVar(trigger.id)) {
-      return `${context.symbolTable.getVarName(trigger.id)}${path}`;
+  if (_cachedTriggerIR !== context.ir) {
+    _cachedTriggerIR = context.ir;
+    const trigger = context.ir.nodes.find(
+      (n) => n.category === "trigger" /* TRIGGER */
+    );
+    _cachedTriggerId = trigger?.id ?? null;
+  }
+  if (_cachedTriggerId) {
+    if (context.symbolTable?.hasVar(_cachedTriggerId)) {
+      return `${context.symbolTable.getVarName(_cachedTriggerId)}${path}`;
     }
-    return `flowState['${trigger.id}']${path}`;
+    return `flowState['${_cachedTriggerId}']${path}`;
   }
   return "undefined";
 }
-var ExpressionParseError;
+var _cachedTriggerIR, _cachedTriggerId, ExpressionParseError;
 var init_expression_parser = __esm({
   "src/lib/compiler/expression-parser.ts"() {
     "use strict";
+    _cachedTriggerIR = null;
+    _cachedTriggerId = null;
     ExpressionParseError = class extends Error {
       constructor(message, expression, position) {
         super(message);
@@ -1852,10 +1871,18 @@ function compile(ir, options) {
     dagMode: false,
     symbolTableExclusions: /* @__PURE__ */ new Set(),
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
-    pluginRegistry
+    pluginRegistry,
+    edgeSuccessors: (() => {
+      const map = /* @__PURE__ */ new Map();
+      for (const edge of workingIR.edges) {
+        if (!map.has(edge.sourceNodeId)) map.set(edge.sourceNodeId, []);
+        map.get(edge.sourceNodeId).push(edge.targetNodeId);
+      }
+      return map;
+    })()
   };
   const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id, nodeMap);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1935,8 +1962,7 @@ function isControlFlowEdge(edge, nodeMap) {
   const controlPorts = CONTROL_FLOW_PORT_MAP[sourceNode.nodeType];
   return controlPorts !== void 0 && controlPorts.has(edge.sourcePortId);
 }
-function computeControlFlowDescendants(ir, triggerId) {
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+function computeControlFlowDescendants(ir, triggerId, nodeMap) {
   const strippedSuccessors = /* @__PURE__ */ new Map();
   for (const node of ir.nodes) {
     strippedSuccessors.set(node.id, /* @__PURE__ */ new Set());
@@ -1969,13 +1995,7 @@ function computeControlFlowDescendants(ir, triggerId) {
 function generateBlockContinuation(writer, fromNodeId, context) {
   const reachable = /* @__PURE__ */ new Set();
   const bfsQueue = [fromNodeId];
-  const edgeSuccessors = /* @__PURE__ */ new Map();
-  for (const edge of context.ir.edges) {
-    if (!edgeSuccessors.has(edge.sourceNodeId)) {
-      edgeSuccessors.set(edge.sourceNodeId, []);
-    }
-    edgeSuccessors.get(edge.sourceNodeId).push(edge.targetNodeId);
-  }
+  const edgeSuccessors = context.edgeSuccessors;
   while (bfsQueue.length > 0) {
     const id = bfsQueue.shift();
     if (reachable.has(id)) continue;
@@ -2764,7 +2784,10 @@ function processForInStatement(stmt, _prevNodeId, ctx, line) {
 }
 function processForStatement(stmt, _prevNodeId, ctx, line) {
   const nodeId = ctx.nextId("loop");
-  const fullText = stmt.getText().split("{")[0].trim();
+  const initText = stmt.getInitializer()?.getText() ?? "";
+  const condText = stmt.getCondition()?.getText() ?? "";
+  const incrText = stmt.getIncrementor()?.getText() ?? "";
+  const fullText = `for (${initText}; ${condText}; ${incrText})`;
   ctx.addNode({
     id: nodeId,
     nodeType: "for_loop" /* FOR_LOOP */,
@@ -2983,12 +3006,18 @@ function computeAuditHints(ctx) {
   return hints;
 }
 function isFetchCall(node) {
-  const text = node.getText();
-  return text.includes("fetch(") && (text.includes("await") || node.getKind() === SyntaxKind.AwaitExpression);
+  if (node.getKind() === SyntaxKind.CallExpression) {
+    const expr = node.getExpression();
+    if (expr.getKind() === SyntaxKind.Identifier && expr.getText() === "fetch") return true;
+  }
+  if (node.getKind() === SyntaxKind.AwaitExpression) {
+    return isFetchCall(node.getChildAtIndex(1) ?? node);
+  }
+  return node.forEachChild((child) => isFetchCall(child) || void 0) ?? false;
 }
 function hasAwaitExpression(node) {
   if (node.getKind() === SyntaxKind.AwaitExpression) return true;
-  return node.getText().startsWith("await ");
+  return node.forEachChild((child) => hasAwaitExpression(child) || void 0) ?? false;
 }
 function extractAwaitedExpression(node) {
   const text = node.getText();
@@ -3058,7 +3087,8 @@ function inferLabel(code, varName) {
   return truncate(code, 30);
 }
 function trackVariableUses(nodeId, expression, ctx) {
-  const identifiers = expression.match(/\b([a-zA-Z_]\w*)\b/g);
+  const stripped = expression.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, "");
+  const identifiers = stripped.match(/\b([a-zA-Z_]\w*)\b/g);
   if (!identifiers) return;
   const uses = [];
   const seen = /* @__PURE__ */ new Set();
@@ -3864,6 +3894,13 @@ function handleImportOpenAPI(body) {
         (flow) => paths.some((p) => flow.meta.name.includes(p))
       );
     }
+    if (body.filter?.tags && Array.isArray(body.filter.tags)) {
+      const tags = body.filter.tags.map((t) => t.toLowerCase());
+      filteredFlows = filteredFlows.filter((flow) => {
+        const flowTags = flow.meta.tags ?? [];
+        return flowTags.some((t) => tags.includes(t.toLowerCase()));
+      });
+    }
     return {
       status: 200,
       body: {
@@ -3946,7 +3983,7 @@ __export(server_exports, {
   startServer: () => startServer
 });
 import { createServer } from "http";
-import { readFile, stat } from "fs/promises";
+import { readFile as readFile2, stat } from "fs/promises";
 import { join as join3, extname as extname2, dirname as dirname3, resolve as resolve2 } from "path";
 import { fileURLToPath } from "url";
 import { existsSync as existsSync3 } from "fs";
@@ -4044,7 +4081,7 @@ async function serveStatic(staticDir, pathname, res) {
     if (!s.isFile()) return false;
     const ext = extname2(filePath).toLowerCase();
     const contentType = MIME_TYPES[ext] || "application/octet-stream";
-    const content = await readFile(filePath);
+    const content = await readFile2(filePath);
     res.writeHead(200, { "Content-Type": contentType });
     res.end(content);
     return true;
@@ -4108,7 +4145,7 @@ async function handleRequest(req, res, staticDir, projectRoot) {
   if (served) return;
   const indexPath = join3(staticDir, "index.html");
   try {
-    const content = await readFile(indexPath, "utf-8");
+    const content = await readFile2(indexPath, "utf-8");
     res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
     res.end(content);
   } catch {
@@ -4124,10 +4161,14 @@ function startServer(options = {}) {
   const server = createServer((req, res) => {
     handleRequest(req, res, staticDir, projectRoot).catch((err) => {
       logger.error("Internal error:", err);
-      res.writeHead(500, { "Content-Type": "text/plain" });
-      res.end("Internal Server Error");
+      if (!res.headersSent) {
+        res.writeHead(500, { "Content-Type": "text/plain" });
+        res.end("Internal Server Error");
+      }
     });
   });
+  server.headersTimeout = 3e4;
+  server.requestTimeout = 6e4;
   const hasUI = existsSync3(join3(staticDir, "index.html"));
   server.listen(port, host, () => {
     const url = `http://localhost:${port}`;
@@ -4190,7 +4231,7 @@ init_logger();
 init_validator();
 import { Command } from "commander";
 import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3, existsSync as existsSync4, readdirSync as readdirSync2, rmSync as rmSync2 } from "fs";
-import { readFile as readFile2, writeFile, mkdir } from "fs/promises";
+import { readFile as readFile3, writeFile, mkdir } from "fs/promises";
 import { join as join4, dirname as dirname4, resolve as resolve3, basename as basename2 } from "path";
 import { watch } from "chokidar";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -4329,6 +4370,7 @@ function sanitizeFilename(id) {
 
 // src/lib/storage/flow-project.ts
 import { readFileSync, writeFileSync, mkdirSync, existsSync, readdirSync, rmSync, statSync } from "fs";
+import { readFile, readdir } from "fs/promises";
 import { join, dirname } from "path";
 function detectFormat(inputPath) {
   if (inputPath.endsWith(".flow.json") && existsSync(inputPath)) {
@@ -4379,6 +4421,37 @@ function loadFlowProject(inputPath) {
   const ir = mergeIR({ meta, edges, nodes });
   return { path: resolvedPath, format, ir };
 }
+async function loadFlowProjectAsync(inputPath) {
+  const { resolvedPath, format } = detectFormat(inputPath);
+  if (format === "json") {
+    if (!existsSync(resolvedPath)) {
+      throw new Error(`Flow file not found: ${resolvedPath}`);
+    }
+    const raw = await readFile(resolvedPath, "utf-8");
+    const ir2 = JSON.parse(raw);
+    return { path: resolvedPath, format, ir: ir2 };
+  }
+  if (!existsSync(resolvedPath)) {
+    throw new Error(`Flow directory not found: ${resolvedPath}`);
+  }
+  const metaPath = join(resolvedPath, "meta.yaml");
+  if (!existsSync(metaPath)) {
+    throw new Error(`meta.yaml not found in ${resolvedPath} \u2014 not a valid Flow directory`);
+  }
+  const meta = await readFile(metaPath, "utf-8");
+  const edgesPath = join(resolvedPath, "edges.yaml");
+  const edges = existsSync(edgesPath) ? await readFile(edgesPath, "utf-8") : "";
+  const nodesDir = join(resolvedPath, "nodes");
+  const nodes = /* @__PURE__ */ new Map();
+  if (existsSync(nodesDir)) {
+    const nodeFiles = (await readdir(nodesDir)).filter((f) => f.endsWith(".yaml"));
+    for (const file of nodeFiles) {
+      nodes.set(file, await readFile(join(nodesDir, file), "utf-8"));
+    }
+  }
+  const ir = mergeIR({ meta, edges, nodes });
+  return { path: resolvedPath, format, ir };
+}
 function saveFlowProject(ir, outputPath, options = {}) {
   const { format = "split", cleanOrphanNodes = true } = options;
   if (format === "json") {
@@ -5310,7 +5383,7 @@ function generateEnvExample() {
 async function compileFileAsync(filePath, projectRoot) {
   const startTime = Date.now();
   try {
-    const raw = await readFile2(filePath, "utf-8");
+    const raw = await readFile3(filePath, "utf-8");
     const ir = JSON.parse(raw);
     const validation = validateFlowIR(ir);
     if (!validation.valid) {
@@ -5345,7 +5418,7 @@ async function compileFileAsync(filePath, projectRoot) {
 async function compileFlowDirAsync(dirPath, projectRoot) {
   const startTime = Date.now();
   try {
-    const project = loadFlowProject(dirPath);
+    const project = await loadFlowProjectAsync(dirPath);
     const ir = project.ir;
     const validation = validateFlowIR(ir);
     if (!validation.valid) {

package/dist/compiler.cjs

@@ -294,25 +294,32 @@ function detectCycles(nodes, edges) {
   for (const node of nodes) {
     color.set(node.id, WHITE);
   }
-  function dfs(nodeId) {
-    color.set(nodeId, GRAY);
-    for (const neighbor of adjacency.get(nodeId) ?? []) {
+  for (const node of nodes) {
+    if (color.get(node.id) !== WHITE) continue;
+    const stack = [[node.id, 0]];
+    color.set(node.id, GRAY);
+    while (stack.length > 0) {
+      const top = stack[stack.length - 1];
+      const [currentId, idx] = top;
+      const neighbors = adjacency.get(currentId) ?? [];
+      if (idx >= neighbors.length) {
+        color.set(currentId, BLACK);
+        stack.pop();
+        continue;
+      }
+      top[1] = idx + 1;
+      const neighbor = neighbors[idx];
       if (color.get(neighbor) === GRAY) {
         errors.push({
           code: "CYCLE_DETECTED",
-          message: `Cycle detected: node "${nodeId}" \u2192 "${neighbor}"`,
-          nodeId
+          message: `Cycle detected: node "${currentId}" \u2192 "${neighbor}"`,
+          nodeId: currentId
         });
       } else if (color.get(neighbor) === WHITE) {
-        dfs(neighbor);
+        color.set(neighbor, GRAY);
+        stack.push([neighbor, 0]);
       }
     }
-    color.set(nodeId, BLACK);
-  }
-  for (const node of nodes) {
-    if (color.get(node.id) === WHITE) {
-      dfs(node.id);
-    }
   }
   return errors;
 }
@@ -514,10 +521,16 @@ function resolveInputRef(path, context) {
   const incoming = context.ir.edges.filter(
     (e) => e.targetNodeId === context.currentNodeId
   );
-  const dataSource = incoming.find((e) => {
+  const nonTriggerIncoming = incoming.filter((e) => {
     const src = context.nodeMap.get(e.sourceNodeId);
     return src && src.category !== "trigger" /* TRIGGER */;
-  }) || incoming[0];
+  });
+  if (nonTriggerIncoming.length > 1 && typeof console !== "undefined") {
+    console.warn(
+      `[flow2code] $input is ambiguous: node "${context.currentNodeId}" has ${nonTriggerIncoming.length} non-trigger upstream edges. Using first match "${nonTriggerIncoming[0].sourceNodeId}".`
+    );
+  }
+  const dataSource = nonTriggerIncoming[0] || incoming[0];
   if (dataSource) {
     const srcId = dataSource.sourceNodeId;
     if (context.blockScopedNodeIds?.has(srcId)) {
@@ -532,15 +545,21 @@ function resolveInputRef(path, context) {
     `Expression parser error: Node "${context.currentNodeId}" has no input connected`
   );
 }
+var _cachedTriggerIR = null;
+var _cachedTriggerId = null;
 function resolveTriggerRef(path, context) {
-  const trigger = context.ir.nodes.find(
-    (n) => n.category === "trigger" /* TRIGGER */
-  );
-  if (trigger) {
-    if (context.symbolTable?.hasVar(trigger.id)) {
-      return `${context.symbolTable.getVarName(trigger.id)}${path}`;
+  if (_cachedTriggerIR !== context.ir) {
+    _cachedTriggerIR = context.ir;
+    const trigger = context.ir.nodes.find(
+      (n) => n.category === "trigger" /* TRIGGER */
+    );
+    _cachedTriggerId = trigger?.id ?? null;
+  }
+  if (_cachedTriggerId) {
+    if (context.symbolTable?.hasVar(_cachedTriggerId)) {
+      return `${context.symbolTable.getVarName(_cachedTriggerId)}${path}`;
     }
-    return `flowState['${trigger.id}']${path}`;
+    return `flowState['${_cachedTriggerId}']${path}`;
   }
   return "undefined";
 }
@@ -1861,10 +1880,18 @@ function compile(ir, options) {
     dagMode: false,
     symbolTableExclusions: /* @__PURE__ */ new Set(),
     generatedBlockNodeIds: /* @__PURE__ */ new Set(),
-    pluginRegistry
+    pluginRegistry,
+    edgeSuccessors: (() => {
+      const map = /* @__PURE__ */ new Map();
+      for (const edge of workingIR.edges) {
+        if (!map.has(edge.sourceNodeId)) map.set(edge.sourceNodeId, []);
+        map.get(edge.sourceNodeId).push(edge.targetNodeId);
+      }
+      return map;
+    })()
   };
   const trigger = workingIR.nodes.find((n) => n.category === "trigger" /* TRIGGER */);
-  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id);
+  const preComputedBlockNodes = computeControlFlowDescendants(workingIR, trigger.id, nodeMap);
   for (const nodeId of preComputedBlockNodes) {
     context.childBlockNodeIds.add(nodeId);
     context.symbolTableExclusions.add(nodeId);
@@ -1949,8 +1976,7 @@ function isControlFlowEdge(edge, nodeMap) {
   const controlPorts = CONTROL_FLOW_PORT_MAP[sourceNode.nodeType];
   return controlPorts !== void 0 && controlPorts.has(edge.sourcePortId);
 }
-function computeControlFlowDescendants(ir, triggerId) {
-  const nodeMap = new Map(ir.nodes.map((n) => [n.id, n]));
+function computeControlFlowDescendants(ir, triggerId, nodeMap) {
   const strippedSuccessors = /* @__PURE__ */ new Map();
   for (const node of ir.nodes) {
     strippedSuccessors.set(node.id, /* @__PURE__ */ new Set());
@@ -1983,13 +2009,7 @@ function computeControlFlowDescendants(ir, triggerId) {
 function generateBlockContinuation(writer, fromNodeId, context) {
   const reachable = /* @__PURE__ */ new Set();
   const bfsQueue = [fromNodeId];
-  const edgeSuccessors = /* @__PURE__ */ new Map();
-  for (const edge of context.ir.edges) {
-    if (!edgeSuccessors.has(edge.sourceNodeId)) {
-      edgeSuccessors.set(edge.sourceNodeId, []);
-    }
-    edgeSuccessors.get(edge.sourceNodeId).push(edge.targetNodeId);
-  }
+  const edgeSuccessors = context.edgeSuccessors;
   while (bfsQueue.length > 0) {
     const id = bfsQueue.shift();
     if (reachable.has(id)) continue;
@@ -2818,7 +2838,10 @@ function processForInStatement(stmt, _prevNodeId, ctx, line) {
 }
 function processForStatement(stmt, _prevNodeId, ctx, line) {
   const nodeId = ctx.nextId("loop");
-  const fullText = stmt.getText().split("{")[0].trim();
+  const initText = stmt.getInitializer()?.getText() ?? "";
+  const condText = stmt.getCondition()?.getText() ?? "";
+  const incrText = stmt.getIncrementor()?.getText() ?? "";
+  const fullText = `for (${initText}; ${condText}; ${incrText})`;
   ctx.addNode({
     id: nodeId,
     nodeType: "for_loop" /* FOR_LOOP */,
@@ -3037,12 +3060,18 @@ function computeAuditHints(ctx) {
   return hints;
 }
 function isFetchCall(node) {
-  const text = node.getText();
-  return text.includes("fetch(") && (text.includes("await") || node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression);
+  if (node.getKind() === import_ts_morph2.SyntaxKind.CallExpression) {
+    const expr = node.getExpression();
+    if (expr.getKind() === import_ts_morph2.SyntaxKind.Identifier && expr.getText() === "fetch") return true;
+  }
+  if (node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression) {
+    return isFetchCall(node.getChildAtIndex(1) ?? node);
+  }
+  return node.forEachChild((child) => isFetchCall(child) || void 0) ?? false;
 }
 function hasAwaitExpression(node) {
   if (node.getKind() === import_ts_morph2.SyntaxKind.AwaitExpression) return true;
-  return node.getText().startsWith("await ");
+  return node.forEachChild((child) => hasAwaitExpression(child) || void 0) ?? false;
 }
 function extractAwaitedExpression(node) {
   const text = node.getText();
@@ -3112,7 +3141,8 @@ function inferLabel(code, varName) {
   return truncate2(code, 30);
 }
 function trackVariableUses(nodeId, expression, ctx) {
-  const identifiers = expression.match(/\b([a-zA-Z_]\w*)\b/g);
+  const stripped = expression.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, "");
+  const identifiers = stripped.match(/\b([a-zA-Z_]\w*)\b/g);
   if (!identifiers) return;
   const uses = [];
   const seen = /* @__PURE__ */ new Set();
@@ -3767,6 +3797,7 @@ function sanitizeFilename(id) {
 
 // src/lib/storage/flow-project.ts
 var import_node_fs = require("fs");
+var import_promises = require("fs/promises");
 var import_node_path = require("path");
 function detectFormat(inputPath) {
   if (inputPath.endsWith(".flow.json") && (0, import_node_fs.existsSync)(inputPath)) {