blitzstrike 1.0.91 → 1.0.93

package/dist/index.js

@@ -14898,8 +14898,8 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync4, rmSync as rmSync3 } from "node:fs";
-import { join as join13 } from "node:path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync5, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { join as join14 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -14916,7 +14916,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync6(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join13(d, e.name));
+          walk(join14(d, e.name));
         else
           n++;
       }
@@ -14930,8 +14930,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync3(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join13(DATA_ROOT2, "payloads");
-  const templatesPath = join13(DATA_ROOT2, "templates");
+  const payloadsPath = join14(DATA_ROOT2, "payloads");
+  const templatesPath = join14(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -14941,8 +14941,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join13(ROOT7, "payloads");
-  const localTemplates = join13(ROOT7, "templates");
+  const localPayloads = join14(ROOT7, "payloads");
+  const localTemplates = join14(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -14955,23 +14955,23 @@ function syncData() {
   }
   const gitOk = spawnSync2("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join13(DATA_ROOT2, ".tmp-clone");
+    const tmp = join14(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
-      rmSync3(tmp, { recursive: true, force: true });
+      rmSync4(tmp, { recursive: true, force: true });
     const r = spawnSync2("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
       const sparse = spawnSync2("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join13(tmp, "payloads"), payloadsPath);
+          copyDir(join14(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join13(tmp, "templates"), templatesPath);
+          copyDir(join14(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
-      rmSync3(tmp, { recursive: true, force: true });
+      rmSync4(tmp, { recursive: true, force: true });
     }
   }
   return {
@@ -14989,18 +14989,18 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync3(dst, { recursive: true });
   for (const e of readdirSync6(src, { withFileTypes: true })) {
-    const s = join13(src, e.name);
-    const d = join13(dst, e.name);
+    const s = join14(src, e.name);
+    const d = join14(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync4(d, readFileSync17(s));
+      writeFileSync5(d, readFileSync17(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join13(fileURLToPath8(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join13(homedir4(), ".blitzstrike", "data");
+  ROOT7 = join14(fileURLToPath8(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join14(homedir4(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -31917,6 +31917,16 @@ function engagementStatus() {
   };
 }
 
+// src/incremental.ts
+import { execSync } from "node:child_process";
+import { writeFileSync as writeFileSync2, mkdtempSync, rmSync } from "node:fs";
+import { join as join9 } from "node:path";
+import { tmpdir } from "node:os";
+
+// src/eagle2.ts
+var import_php_parser2 = __toESM(require_src(), 1);
+import { readFileSync as readFileSync11 } from "node:fs";
+
 // src/dataflow.ts
 init_scanner();
 import { readFileSync as readFileSync9 } from "node:fs";
@@ -32080,8 +32090,10 @@ function groupVariants(results) {
   return [...groups.values()].sort((a, b) => b.occurrences - a.occurrences);
 }
 
-// src/taint.ts
+// src/eagle2.ts
 init_scanner();
+
+// src/callgraph.ts
 var import_php_parser = __toESM(require_src(), 1);
 import { readFileSync as readFileSync10 } from "node:fs";
 var parser = new import_php_parser.Engine({
@@ -32089,7 +32101,7 @@ var parser = new import_php_parser.Engine({
   ast: { withPositions: true, withSource: false }
 });
 function isNode(v) {
-  return v && typeof v === "object" && typeof v.kind === "string";
+  return !!v && typeof v === "object" && typeof v.kind === "string";
 }
 function children(node) {
   const out = [];
@@ -32107,410 +32119,12 @@ function children(node) {
   }
   return out;
 }
-function findKind(node, kind, out = []) {
-  if (!isNode(node))
-    return out;
-  if (node.kind === kind)
-    out.push(node);
-  for (const c of children(node))
-    findKind(c, kind, out);
-  return out;
-}
-function rootVarName(node) {
-  if (!isNode(node))
-    return null;
-  if (node.kind === "variable")
-    return node.name ?? null;
-  if (node.kind === "name")
-    return typeof node.name === "string" ? node.name : node.name?.name ?? null;
-  if (node.kind === "offsetlookup" || node.kind === "propertylookup")
-    return rootVarName(node.what);
-  return null;
-}
-function sourceOf(node) {
-  if (!isNode(node))
-    return null;
-  if (node.kind === "offsetlookup" && node.what?.kind === "variable") {
-    const n = node.what.name;
-    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
-      return "$" + n;
-  }
-  if (node.kind === "variable") {
-    const n = node.name;
-    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
-      return "$" + n;
-  }
-  if (node.kind === "call") {
-    const n = rootVarName(node.what);
-    if (n === "getallheaders")
-      return "getallheaders";
-    if (n === "file_get_contents" && JSON.stringify(node).includes("php://input"))
-      return "php://input";
-  }
-  return null;
-}
-function sinkClassOf(call) {
-  const what = call.what;
-  if (!isNode(what))
-    return null;
-  let token = "";
-  if (what.kind === "propertylookup") {
-    const base = rootVarName(what.what);
-    const method = what.offset?.name ?? what.offset?.value;
-    token = `${base}->${method}(`;
-  } else if (what.kind === "name") {
-    token = `${what.name}(`;
-  }
-  if (!token)
-    return null;
-  const cls = classifySink2(token) ?? classifySink2(what.name ?? "");
-  if (!cls)
-    return null;
-  return { token, cls };
-}
-function analyzeBlock(statements, env, summaries, findings, suppressed, params = [], file) {
-  for (const stmt of statements) {
-    if (!isNode(stmt))
-      continue;
-    const kind = stmt.kind;
-    if (kind === "expressionstatement") {
-      const expr = stmt.expression;
-      walkExpression(expr, env, summaries, findings, suppressed, file);
-    } else if (kind === "if") {
-      const ifEnv = new Map(env);
-      const bodyStmts = stmt.body?.kind === "block" ? stmt.body.children : [stmt.body];
-      analyzeBlock(bodyStmts, ifEnv, summaries, findings, suppressed, params, file);
-      if (stmt.alternate) {
-        const altEnv = new Map(env);
-        const altStmts = stmt.alternate.kind === "block" ? stmt.alternate.children : [stmt.alternate];
-        analyzeBlock(altStmts, altEnv, summaries, findings, suppressed, params, file);
-      }
-    } else if (kind === "block") {
-      analyzeBlock(stmt.children ?? [], env, summaries, findings, suppressed, params, file);
-    } else if (kind === "return" || kind === "echo" || kind === "print") {
-      walkExpression(stmt, env, summaries, findings, suppressed, file);
-    } else {
-      for (const c of children(stmt)) {
-        if (c.kind === "block" || c.kind === "if") {
-          analyzeBlock([c], new Map(env), summaries, findings, suppressed, params, file);
-        }
-      }
-    }
-  }
-}
-function walkExpression(node, env, summaries, findings, suppressed, file) {
-  if (!isNode(node))
-    return;
-  if (node.kind === "assign") {
-    const varName = rootVarName(node.left);
-    const taint = evalTaint(node.right, env, summaries);
-    if (varName) {
-      env.set(varName, taint);
-    }
-    return;
-  }
-  if (node.kind === "call") {
-    const sink = sinkClassOf(node);
-    if (sink) {
-      const argTaints = node.arguments.map((a) => {
-        return evalTaint(a, env, summaries);
-      });
-      const tainted = argTaints.filter((t) => t.tainted);
-      if (tainted.length > 0) {
-        const sanitizers = tainted.flatMap((t) => t.sanitizers);
-        const inlineSan = findSanitizers(JSON.stringify(node));
-        const san = [...sanitizers, ...inlineSan].filter((s, i, arr) => arr.indexOf(s) === i);
-        const cls = sink.cls;
-        if (!isSanitized(san, cls.id)) {
-          findings.push({
-            sink: sink.token,
-            sink_line: node.loc?.start?.line ?? 0,
-            category: cls.category,
-            cwe: cls.cwe,
-            variables: tainted.map((t) => t.source ?? "var"),
-            source: tainted[0].source,
-            source_line: tainted[0].sourceLine,
-            sanitized: false,
-            sanitizers: san.map((s) => s.id),
-            auth_gated: false,
-            interprocedural: false
-          });
-        } else {
-          suppressed.n += 1;
-        }
-      }
-      for (const a of node.arguments)
-        walkExpression(a, env, summaries, findings, suppressed, file);
-      return;
-    }
-    const fnName = rootVarName(node.what);
-    if (fnName && summaries.has(fnName)) {
-      const sum = summaries.get(fnName);
-      const argTaints = node.arguments.map((a) => {
-        const v = a;
-        return evalTaint(v, env, summaries);
-      });
-      const taintedArgs = argTaints.filter((t) => t.tainted);
-      if (taintedArgs.length > 0 && sum.sinkParams.size > 0) {
-        const firstSink = [...sum.sinkParams.values()][0];
-        const cls = classifySink2(firstSink.sink);
-        if (cls) {
-          const san = [
-            ...taintedArgs.flatMap((t) => t.sanitizers),
-            ...[...sum.sanitizedParams.values()].flat()
-          ];
-          if (!isSanitized(san, cls.id)) {
-            findings.push({
-              sink: firstSink.sink,
-              sink_line: firstSink.line,
-              category: cls.category,
-              cwe: cls.cwe,
-              variables: taintedArgs.map((t) => t.source ?? "var"),
-              source: taintedArgs[0].source,
-              source_line: taintedArgs[0].sourceLine,
-              sanitized: false,
-              sanitizers: san.map((s) => s.id),
-              auth_gated: false,
-              interprocedural: true
-            });
-          } else {
-            suppressed.n += 1;
-          }
-        }
-      }
-      return;
-    }
-    for (const c of children(node))
-      walkExpression(c, env, summaries, findings, suppressed, file);
-    return;
-  }
-  if (node.kind === "echo" || node.kind === "print") {
-    const exprs = node.expressions ?? [node.expression];
-    for (const e of exprs) {
-      const cls = classifySink2(node.kind === "echo" ? "echo " : "print ");
-      const t = evalTaint(e, env, summaries);
-      if (t.tainted && cls) {
-        const san = [...t.sanitizers, ...findSanitizers(JSON.stringify(e))];
-        if (!isSanitized(san, cls.id)) {
-          findings.push({
-            sink: node.kind + " ",
-            sink_line: node.loc?.start?.line ?? 0,
-            category: cls.category,
-            cwe: cls.cwe,
-            variables: [t.source ?? "var"],
-            source: t.source,
-            source_line: t.sourceLine,
-            sanitized: false,
-            sanitizers: san.map((s) => s.id),
-            auth_gated: false,
-            interprocedural: false
-          });
-        } else {
-          suppressed.n += 1;
-        }
-      }
-    }
-    return;
-  }
-  for (const c of children(node))
-    walkExpression(c, env, summaries, findings, suppressed, file);
-}
-function evalTaint(node, env, summaries) {
-  if (!isNode(node))
-    return { tainted: false, sanitizers: [] };
-  const src = sourceOf(node);
-  if (src)
-    return { tainted: true, sanitizers: [], source: src, sourceLine: node.loc?.start?.line };
-  if (node.kind === "variable" || node.kind === "offsetlookup") {
-    const root = rootVarName(node);
-    if (root) {
-      const st = env.get(root);
-      if (st)
-        return { ...st };
-    }
-    if (node.kind === "offsetlookup") {
-      const whatTaint = evalTaint(node.what, env, summaries);
-      if (whatTaint.tainted)
-        return whatTaint;
-    }
-    return { tainted: false, sanitizers: [] };
-  }
-  if (node.kind === "call") {
-    const fnName = rootVarName(node.what);
-    const san = findSanitizers(fnName ? fnName + "(" : "");
-    if (san.length > 0) {
-      const inner = node.arguments.map((a) => evalTaint(a, env, summaries));
-      const tainted = inner.some((t) => t.tainted);
-      return {
-        tainted,
-        sanitizers: tainted ? [...inner.flatMap((t) => t.sanitizers), ...san] : [],
-        source: tainted ? inner.find((t) => t.tainted)?.source : undefined,
-        sourceLine: tainted ? inner.find((t) => t.tainted)?.sourceLine : undefined
-      };
-    }
-    if (fnName && summaries.has(fnName)) {
-      const sum = summaries.get(fnName);
-      const argTaints = node.arguments.map((a) => evalTaint(a, env, summaries));
-      const tainted = argTaints.filter((t) => t.tainted);
-      if (tainted.length > 0) {
-        const helperSan = [...sum.sanitizedParams.values()].flat();
-        return {
-          tainted: true,
-          sanitizers: [...tainted.flatMap((t) => t.sanitizers), ...helperSan],
-          source: tainted[0].source,
-          sourceLine: tainted[0].sourceLine
-        };
-      }
-    }
-    return { tainted: false, sanitizers: [] };
-  }
-  if (node.kind === "bin" || node.kind === "concat" || node.kind === "encapsed") {
-    const parts = children(node);
-    const taints = parts.map((p) => evalTaint(p, env, summaries));
-    const tainted = taints.find((t) => t.tainted);
-    if (tainted)
-      return { ...tainted, sanitizers: taints.flatMap((t) => t.sanitizers) };
-    return { tainted: false, sanitizers: [] };
-  }
-  if (node.kind === "encapsedpart") {
-    return evalTaint(node.expression, env, summaries);
-  }
-  return { tainted: false, sanitizers: [] };
-}
-function analyzeTaint(path) {
-  const result = { file: path, findings: [], suppressed: 0 };
-  let code;
-  try {
-    code = readFileSync10(path, "utf8");
-  } catch {
-    return result;
-  }
-  let ast;
-  try {
-    ast = parser.parseCode(code, path);
-  } catch {
-    return result;
-  }
-  const functions = findKind(ast, "function");
-  const summaries = new Map;
-  for (const fn of functions) {
-    const name = typeof fn.name === "string" ? fn.name : fn.name?.name ?? "<anonymous>";
-    const params = (fn.arguments ?? []).map((a) => typeof a === "string" ? a : typeof a.name === "string" ? a.name : a.name?.name ?? "?");
-    const summary = { name, params, sinkParams: new Map, sanitizedParams: new Map };
-    const env = new Map;
-    for (const p of params)
-      env.set(p, { tainted: false, sanitizers: [] });
-    const calls = findKind(fn, "call");
-    for (const call of calls) {
-      const sink = sinkClassOf(call);
-      if (!sink)
-        continue;
-      const line = call.loc?.start?.line ?? 0;
-      const varsInCall = findKind(call, "variable").map((v) => v.name).filter(Boolean);
-      for (const v of varsInCall) {
-        if (params.includes(v))
-          summary.sinkParams.set(v, { sink: sink.token, line });
-      }
-      const san = findSanitizers(JSON.stringify(call));
-      for (const v of varsInCall) {
-        if (params.includes(v) && san.length > 0) {
-          summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
-        }
-      }
-    }
-    for (const ek of ["echo", "print"]) {
-      for (const en of findKind(fn, ek)) {
-        const line = en.loc?.start?.line ?? 0;
-        const vars = findKind(en, "variable").map((v) => v.name).filter(Boolean);
-        const san = findSanitizers(JSON.stringify(en));
-        for (const v of vars) {
-          if (params.includes(v)) {
-            summary.sinkParams.set(v, { sink: ek + " ", line });
-            if (san.length > 0) {
-              summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
-            }
-          }
-        }
-      }
-    }
-    const assigns = findKind(fn, "assign");
-    for (const a of assigns) {
-      const san = findSanitizers(JSON.stringify(a.right));
-      if (san.length > 0) {
-        const lv = rootVarName(a.left);
-        if (lv && params.includes(lv)) {
-          summary.sanitizedParams.set(lv, [...summary.sanitizedParams.get(lv) ?? [], ...san]);
-        }
-      }
-    }
-    for (const ek of ["echo", "print"]) {
-      for (const en of findKind(fn, ek)) {
-        const san = findSanitizers(JSON.stringify(en));
-        if (san.length > 0) {
-          for (const v of findKind(en, "variable").map((v2) => v2.name).filter(Boolean)) {
-            if (params.includes(v)) {
-              summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
-            }
-          }
-        }
-      }
-    }
-    summaries.set(name, summary);
-  }
-  const topStmts = [];
-  const body = ast.children ?? [];
-  for (const s of body) {
-    if (isNode(s) && s.kind !== "function")
-      topStmts.push(s);
-  }
-  const globalEnv = new Map;
-  const suppressRef = { n: 0 };
-  analyzeBlock(topStmts, globalEnv, summaries, result.findings, suppressRef, [], path);
-  result.suppressed = suppressRef.n;
-  return result;
-}
-function taintTree(root, maxFiles = 2000) {
-  const files = iterSourceFiles(root, maxFiles);
-  return files.map((f) => analyzeTaint(f));
-}
-
-// src/eagle2.ts
-var import_php_parser3 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync12 } from "node:fs";
-init_scanner();
-
-// src/callgraph.ts
-var import_php_parser2 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync11 } from "node:fs";
-var parser2 = new import_php_parser2.Engine({
-  parser: { extractDoc: false, php7: true },
-  ast: { withPositions: true, withSource: false }
-});
-function isNode2(v) {
-  return !!v && typeof v === "object" && typeof v.kind === "string";
-}
-function children2(node) {
-  const out = [];
-  for (const k of Object.keys(node)) {
-    if (k === "loc")
-      continue;
-    const v = node[k];
-    if (Array.isArray(v)) {
-      for (const c of v)
-        if (isNode2(c))
-          out.push(c);
-    } else if (isNode2(v)) {
-      out.push(v);
-    }
-  }
-  return out;
-}
 function nameOf(node) {
-  if (!isNode2(node))
+  if (!isNode(node))
     return null;
   if (typeof node.name === "string")
     return node.name;
-  if (isNode2(node.name))
+  if (isNode(node.name))
     return nameOf(node.name);
   return null;
 }
@@ -32542,13 +32156,13 @@ function buildCallGraph(path) {
   const g = { nodes: new Map, edges: [] };
   let code;
   try {
-    code = readFileSync11(path, "utf8");
+    code = readFileSync10(path, "utf8");
   } catch {
     return g;
   }
   let ast;
   try {
-    ast = parser2.parseCode(code, path);
+    ast = parser.parseCode(code, path);
   } catch {
     return g;
   }
@@ -32585,7 +32199,7 @@ function buildCallGraph(path) {
   return g;
 }
 function walk(node, file, visit, ctx = {}) {
-  if (!isNode2(node))
+  if (!isNode(node))
     return;
   let childCtx = ctx;
   if (node.kind === "class") {
@@ -32598,12 +32212,12 @@ function walk(node, file, visit, ctx = {}) {
     childCtx = { ...ctx, enclosing: name ? nodeId("method", name, ctx.className) : ctx.enclosing };
   }
   visit(node, ctx);
-  for (const c of children2(node))
+  for (const c of children(node))
     walk(c, file, visit, childCtx);
 }
 function resolveCall(g, call, callerId, ctx, file, line) {
   const what = call.what;
-  if (!isNode2(what))
+  if (!isNode(what))
     return;
   if (what.kind === "name") {
     const fn = nameOf(what);
@@ -32619,7 +32233,7 @@ function resolveCall(g, call, callerId, ctx, file, line) {
   }
   if (what.kind === "staticlookup") {
     const base = what.what;
-    const baseName = nameOf(base) ?? (isNode2(base) && base.kind === "variable" ? base.name : null);
+    const baseName = nameOf(base) ?? (isNode(base) && base.kind === "variable" ? base.name : null);
     const method = nameOf(what.offset);
     if (!method)
       return;
@@ -32638,7 +32252,7 @@ function resolveCall(g, call, callerId, ctx, file, line) {
     const method = nameOf(what.offset);
     if (!method)
       return;
-    if (isNode2(base) && base.kind === "variable" && base.name === "this") {
+    if (isNode(base) && base.kind === "variable" && base.name === "this") {
       if (ctx.className) {
         const id = nodeId("method", method, ctx.className);
         if (g.nodes.has(id))
@@ -32707,14 +32321,14 @@ function setCache(kind, source, value) {
 }
 
 // src/eagle2.ts
-var parser3 = new import_php_parser3.Engine({
+var parser2 = new import_php_parser2.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
 });
-function isNode3(v) {
+function isNode2(v) {
   return !!v && typeof v === "object" && typeof v.kind === "string";
 }
-function children3(node) {
+function children2(node) {
   const out = [];
   for (const k of Object.keys(node)) {
     if (k === "loc")
@@ -32722,45 +32336,45 @@ function children3(node) {
     const v = node[k];
     if (Array.isArray(v)) {
       for (const c of v)
-        if (isNode3(c))
+        if (isNode2(c))
           out.push(c);
-    } else if (isNode3(v)) {
+    } else if (isNode2(v)) {
       out.push(v);
     }
   }
   return out;
 }
-function findKind2(node, kind, out = []) {
-  if (!isNode3(node))
+function findKind(node, kind, out = []) {
+  if (!isNode2(node))
     return out;
   if (node.kind === kind)
     out.push(node);
-  for (const c of children3(node))
-    findKind2(c, kind, out);
+  for (const c of children2(node))
+    findKind(c, kind, out);
   return out;
 }
 function nameOf2(node) {
-  if (!isNode3(node))
+  if (!isNode2(node))
     return null;
   if (typeof node.name === "string")
     return node.name;
-  if (isNode3(node.name))
+  if (isNode2(node.name))
     return nameOf2(node.name);
   return null;
 }
-function rootVarName2(node) {
-  if (!isNode3(node))
+function rootVarName(node) {
+  if (!isNode2(node))
     return null;
   if (node.kind === "variable")
     return node.name ?? null;
   if (node.kind === "name")
     return typeof node.name === "string" ? node.name : node.name?.name ?? null;
   if (node.kind === "offsetlookup" || node.kind === "propertylookup")
-    return rootVarName2(node.what);
+    return rootVarName(node.what);
   return null;
 }
 function calleeName(what) {
-  if (!isNode3(what))
+  if (!isNode2(what))
     return null;
   if (what.kind === "name")
     return typeof what.name === "string" ? what.name : what.name?.name ?? null;
@@ -32795,8 +32409,8 @@ var TAINT_PROPAGATING_BUILTINS = new Set([
   "preg_quote",
   "nl2br"
 ]);
-function sourceOf2(node) {
-  if (!isNode3(node))
+function sourceOf(node) {
+  if (!isNode2(node))
     return null;
   if (node.kind === "offsetlookup" && node.what?.kind === "variable") {
     const n = node.what.name;
@@ -32809,14 +32423,14 @@ function sourceOf2(node) {
       return "$" + n;
   }
   if (node.kind === "call") {
-    const n = rootVarName2(node.what);
+    const n = rootVarName(node.what);
     if (n === "getallheaders")
       return "getallheaders";
     if (n === "file_get_contents" && JSON.stringify(node).includes("php://input"))
       return "php://input";
     if (node.what?.kind === "propertylookup") {
       const method = node.what.offset?.name ?? node.what.offset?.value;
-      const base = rootVarName2(node.what.what);
+      const base = rootVarName(node.what.what);
       const reqMethods = ["input", "query", "get", "post", "all", "json", "cookie", "file", "header", "only", "except", "server"];
       if (base && /^(request|req)$/i.test(base) && reqMethods.includes(String(method))) {
         return `$${base}->${method}()`;
@@ -32825,16 +32439,16 @@ function sourceOf2(node) {
   }
   return null;
 }
-function sinkClassOf2(call) {
+function sinkClassOf(call) {
   const what = call.what;
-  if (!isNode3(what))
+  if (!isNode2(what))
     return null;
   let token = "";
   if (what.kind === "propertylookup") {
     const baseNode = what.what;
-    const base = rootVarName2(baseNode);
+    const base = rootVarName(baseNode);
     const method = what.offset?.name ?? what.offset?.value;
-    const baseStr = isNode3(baseNode) && (baseNode.kind === "variable" || baseNode.kind === "offsetlookup") ? `$${base}` : base;
+    const baseStr = isNode2(baseNode) && (baseNode.kind === "variable" || baseNode.kind === "offsetlookup") ? `$${base}` : base;
     token = `${baseStr}->${method}(`;
   } else if (what.kind === "name") {
     token = `${what.name}(`;
@@ -32907,7 +32521,7 @@ function summarizeFunction(fn, id, name, summaries) {
 }
 function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating = false) {
   for (const stmt of statements) {
-    if (!isNode3(stmt))
+    if (!isNode2(stmt))
       continue;
     const kind = stmt.kind;
     if (kind === "expressionstatement") {
@@ -32944,7 +32558,7 @@ function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeA
     } else if (kind === "echo" || kind === "print") {
       analyzeExpr(stmt, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     } else {
-      for (const c of children3(stmt)) {
+      for (const c of children2(stmt)) {
         if (c.kind === "block" || c.kind === "if") {
           analyzeBody([c], env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
         } else {
@@ -32955,9 +32569,9 @@ function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeA
   }
 }
 function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating = false) {
-  if (!isNode3(node))
+  if (!isNode2(node))
     return CLEAN;
-  const src = sourceOf2(node);
+  const src = sourceOf(node);
   if (src)
     return { tainted: true, sources: [src], sanitizers: [], sourceLine: node.loc?.start?.line };
   if (node.kind === "cast") {
@@ -32972,10 +32586,10 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
     const byref = node.operator === "=&";
     const rhs = analyzeExpr(node.right, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     const lhs = node.left;
-    if (isNode3(lhs) && lhs.kind === "variable") {
+    if (isNode2(lhs) && lhs.kind === "variable") {
       const varName = lhs.name;
       if (byref) {
-        const refVar = rootVarName2(node.right);
+        const refVar = rootVarName(node.right);
         if (refVar) {
           const refTaint = env.get(refVar) ?? rhs;
           env.set(varName, refTaint);
@@ -32986,8 +32600,8 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
       } else {
         env.set(varName, rhs);
       }
-    } else if (isNode3(lhs) && lhs.kind === "propertylookup") {
-      const objName = rootVarName2(lhs.what);
+    } else if (isNode2(lhs) && lhs.kind === "propertylookup") {
+      const objName = rootVarName(lhs.what);
       const propName = lhs.offset?.name ?? "?";
       if (objName) {
         let oprops = props.get(objName);
@@ -33001,7 +32615,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
     return rhs;
   }
   if (node.kind === "call") {
-    const sink = sinkClassOf2(node);
+    const sink = sinkClassOf(node);
     const argTaints = node.arguments.map((a) => analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating));
     const taintedArgs = argTaints.filter((t) => t.tainted);
     if (sink) {
@@ -33028,7 +32642,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         return CLEAN;
       }
       for (let i = 0;i < node.arguments.length; i++) {
-        const argVar = rootVarName2(node.arguments[i]);
+        const argVar = rootVarName(node.arguments[i]);
         if (argVar === taintedParam) {
           ctx.calls.push({ callee: fnName, argIndex: i, line: node.loc?.start?.line ?? 0 });
         }
@@ -33050,7 +32664,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
           const paramName = helperSum.params[i];
           if (!paramName || !helperSum.paramWrites.has(paramName))
             continue;
-          const argVar = rootVarName2(node.arguments[i]);
+          const argVar = rootVarName(node.arguments[i]);
           const written = helperSum.paramWrites.get(paramName);
           if (argVar) {
             env.set(argVar, { tainted: true, sources: written, sanitizers: [] });
@@ -33058,7 +32672,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         }
       }
     }
-    if (isNode3(node.what) && node.what.kind === "propertylookup") {
+    if (isNode2(node.what) && node.what.kind === "propertylookup") {
       analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     }
     return CLEAN;
@@ -33068,7 +32682,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
     return t ? { ...t } : CLEAN;
   }
   if (node.kind === "offsetlookup") {
-    const root = rootVarName2(node);
+    const root = rootVarName(node);
     if (root) {
       const t = env.get(root);
       if (t)
@@ -33077,7 +32691,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
     return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
   }
   if (node.kind === "propertylookup") {
-    const objName = rootVarName2(node.what);
+    const objName = rootVarName(node.what);
     const propName = node.offset?.name ?? "?";
     if (objName) {
       const pt = props.get(objName)?.get(propName);
@@ -33092,7 +32706,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
     return mergeTaint(t, f);
   }
   if (node.kind === "bin" || node.kind === "concat" || node.kind === "encapsed") {
-    const parts = children3(node);
+    const parts = children2(node);
     const taints = parts.map((p) => analyzeExpr(p, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating));
     return mergeTaint(...taints);
   }
@@ -33151,13 +32765,13 @@ function mergeCtx(ctx, other) {
   ctx.calls.push(...other.calls);
 }
 function authGatesOf(node) {
-  if (!isNode3(node))
+  if (!isNode2(node))
     return [];
   return AUTH_GATES.filter((g) => JSON.stringify(node).includes(g));
 }
 var VALIDATION_GATES = ["in_array", "preg_match", "ctype_digit", "ctype_alnum", "is_numeric"];
 function validationGatesOf(node) {
-  if (!isNode3(node))
+  if (!isNode2(node))
     return false;
   const text = JSON.stringify(node);
   return VALIDATION_GATES.some((g) => text.includes(g));
@@ -33166,7 +32780,7 @@ function collectDecls(ast, out) {
   walkDecls(ast, out);
 }
 function walkDecls(node, out, className) {
-  if (!isNode3(node))
+  if (!isNode2(node))
     return;
   if (node.kind === "function") {
     const name = nameOf2(node.name);
@@ -33174,7 +32788,7 @@ function walkDecls(node, out, className) {
       out.push({ id: `func:${name}`, name, node, kind: "function" });
   } else if (node.kind === "class") {
     const cn = nameOf2(node.name);
-    for (const c of children3(node)) {
+    for (const c of children2(node)) {
       if (c.kind === "method") {
         const mn = nameOf2(c.name);
         if (mn && cn)
@@ -33188,7 +32802,7 @@ function walkDecls(node, out, className) {
       out.push({ id: `method:${className}::${mn}`, name: mn, node, kind: "method" });
   }
   const childCtx = node.kind === "class" ? nameOf2(node.name) ?? className : className;
-  for (const c of children3(node))
+  for (const c of children2(node))
     walkDecls(c, out, childCtx);
 }
 function resolveFuncId(name, summaries) {
@@ -33203,7 +32817,7 @@ function resolveFuncId(name, summaries) {
 function analyzeDataFlow2(path) {
   let cacheCode = "";
   try {
-    cacheCode = readFileSync12(path, "utf8");
+    cacheCode = readFileSync11(path, "utf8");
   } catch {}
   if (cacheCode) {
     const cached = getCache("eagle2", cacheCode);
@@ -33225,13 +32839,13 @@ function analyzeDataFlow2(path) {
   };
   let code;
   try {
-    code = cacheCode || readFileSync12(path, "utf8");
+    code = cacheCode || readFileSync11(path, "utf8");
   } catch {
     return result;
   }
   let ast;
   try {
-    ast = parser3.parseCode(code, path);
+    ast = parser2.parseCode(code, path);
   } catch {
     return result;
   }
@@ -33247,7 +32861,7 @@ function analyzeDataFlow2(path) {
   }
   const topStmts = [];
   for (const s of ast.children ?? []) {
-    if (isNode3(s) && s.kind !== "function" && s.kind !== "class")
+    if (isNode2(s) && s.kind !== "function" && s.kind !== "class")
       topStmts.push(s);
   }
   const mainSummary = { id: "main", name: "main", params: [], byrefParams: new Set, paramSinks: new Map, paramReturns: new Set, paramCalls: new Map, paramWrites: new Map, internalSinks: [] };
@@ -33277,10 +32891,10 @@ function analyzeDataFlow2(path) {
   }
   const queue = [];
   const seen = new Set;
-  const mainCalls = topStmts.flatMap((s) => findKind2(s, "call"));
+  const mainCalls = topStmts.flatMap((s) => findKind(s, "call"));
   for (const call of mainCalls) {
     const fnName = calleeName(call.what);
-    if (!fnName || sinkClassOf2(call))
+    if (!fnName || sinkClassOf(call))
       continue;
     const target = resolveFuncId(fnName, summaries);
     if (!target)
@@ -33367,12 +32981,6 @@ function analyzeDataFlow2(path) {
   return result;
 }
 
-// src/differential.ts
-import { writeFileSync as writeFileSync2, rmSync, mkdtempSync, readFileSync as readFileSync13 } from "node:fs";
-import { join as join9 } from "node:path";
-import { tmpdir } from "node:os";
-import { execSync } from "node:child_process";
-
 // src/universal-taint.ts
 function runTaintEngine(adapter, code, file) {
   const result = { file, language: adapter.language, findings: [], suppressed: 0 };
@@ -33474,7 +33082,7 @@ function analyzeTaintUniversal(code, file) {
 }
 
 // src/adapters.ts
-var import_php_parser4 = __toESM(require_src(), 1);
+var import_php_parser3 = __toESM(require_src(), 1);
 
 // node_modules/@babel/parser/lib/index.js
 class Position {
@@ -51253,7 +50861,7 @@ var pythonHighlighting = styleTags({
   ", ;": tags.separator
 });
 var spec_identifier = { __proto__: null, await: 44, or: 54, and: 56, in: 60, not: 62, is: 64, if: 70, else: 72, lambda: 76, yield: 94, from: 96, async: 102, for: 104, None: 162, True: 164, False: 164, del: 178, pass: 182, break: 186, continue: 190, return: 194, raise: 202, import: 206, as: 208, global: 212, nonlocal: 214, assert: 218, type: 223, elif: 236, while: 240, try: 246, except: 248, finally: 250, with: 254, def: 258, class: 268, match: 279, case: 285 };
-var parser4 = LRParser.deserialize({
+var parser3 = LRParser.deserialize({
   version: 14,
   states: "##jQ`QeOOP$}OSOOO&WQtO'#HUOOQS'#Co'#CoOOQS'#Cp'#CpO'vQdO'#CnO*UQtO'#HTOOQS'#HU'#HUOOQS'#DU'#DUOOQS'#HT'#HTO*rQdO'#D_O+VQdO'#DfO+gQdO'#DjO+zOWO'#DuO,VOWO'#DvO.[QtO'#GuOOQS'#Gu'#GuO'vQdO'#GtO0ZQtO'#GtOOQS'#Eb'#EbO0rQdO'#EcOOQS'#Gs'#GsO0|QdO'#GrOOQV'#Gr'#GrO1XQdO'#FYOOQS'#G^'#G^O1^QdO'#FXOOQV'#IS'#ISOOQV'#Gq'#GqOOQV'#Fq'#FqQ`QeOOO'vQdO'#CqO1lQdO'#C}O1sQdO'#DRO2RQdO'#HYO2cQtO'#EVO'vQdO'#EWOOQS'#EY'#EYOOQS'#E['#E[OOQS'#E^'#E^O2wQdO'#E`O3_QdO'#EdO3rQdO'#EfO3zQtO'#EfO1XQdO'#EiO0rQdO'#ElO1XQdO'#EnO0rQdO'#EtO0rQdO'#EwO4VQdO'#EyO4^QdO'#FOO4iQdO'#EzO0rQdO'#FOO1XQdO'#FQO1XQdO'#FVO4nQdO'#F[P4uOdO'#GpPOOO)CBd)CBdOOQS'#Ce'#CeOOQS'#Cf'#CfOOQS'#Cg'#CgOOQS'#Ch'#ChOOQS'#Ci'#CiOOQS'#Cj'#CjOOQS'#Cl'#ClO'vQdO,59OO'vQdO,59OO'vQdO,59OO'vQdO,59OO'vQdO,59OO'vQdO,59OO5TQdO'#DoOOQS,5:Y,5:YO5hQdO'#HdOOQS,5:],5:]O5uQ!fO,5:]O5zQtO,59YO1lQdO,59bO1lQdO,59bO1lQdO,59bO8jQdO,59bO8oQdO,59bO8vQdO,59jO8}QdO'#HTO:TQdO'#HSOOQS'#HS'#HSOOQS'#D['#D[O:lQdO,59aO'vQdO,59aO:zQdO,59aOOQS,59y,59yO;PQdO,5:RO'vQdO,5:ROOQS,5:Q,5:QO;_QdO,5:QO;dQdO,5:XO'vQdO,5:XO'vQdO,5:VOOQS,5:U,5:UO;uQdO,5:UO;zQdO,5:WOOOW'#Fy'#FyO<POWO,5:aOOQS,5:a,5:aO<[QdO'#HwOOOW'#Dw'#DwOOOW'#Fz'#FzO<lOWO,5:bOOQS,5:b,5:bOOQS'#F}'#F}O<zQtO,5:iO?lQtO,5=`O@VQ#xO,5=`O@vQtO,5=`OOQS,5:},5:}OA_QeO'#GWOBqQdO,5;^OOQV,5=^,5=^OB|QtO'#IPOCkQdO,5;tOOQS-E:[-E:[OOQV,5;s,5;sO4dQdO'#FQOOQV-E9o-E9oOCsQtO,59]OEzQtO,59iOFeQdO'#HVOFpQdO'#HVO1XQdO'#HVOF{QdO'#DTOGTQdO,59mOGYQdO'#HZO'vQdO'#HZO0rQdO,5=tOOQS,5=t,5=tO0rQdO'#EROOQS'#ES'#ESOGwQdO'#GPOHXQdO,58|OHXQdO,58|O*xQdO,5:oOHgQtO'#H]OOQS,5:r,5:rOOQS,5:z,5:zOHzQdO,5;OOI]QdO'#IOO1XQdO'#H}OOQS,5;Q,5;QOOQS'#GT'#GTOIqQtO,5;QOJPQdO,5;QOJUQdO'#IQOOQS,5;T,5;TOJdQdO'#H|OOQS,5;W,5;WOJuQdO,5;YO4iQdO,5;`O4iQdO,5;cOJ}QtO'#ITO'vQdO'#ITOKXQdO,5;eO4VQdO,5;eO0rQdO,5;jO1XQdO,5;lOK^QeO'#EuOLjQgO,5;fO!!kQdO'#IUO4iQdO,5;jO!!vQdO,5;lO!#OQdO,5;qO!#ZQtO,5;vO'vQdO,5;vPOOO,5=[,5=[P!#bOSO,5=[P!#jOdO,5=[O!&bQtO1G.jO!&iQtO1G.jO!)YQtO1G.jO!)dQtO1G.jO!+}QtO1G.jO!,bQtO1G.jO!,uQdO'#HcO!-TQtO'#GuO0rQdO'#HcO!-_QdO'#HbOOQS,5:Z,5:ZO!-gQdO,5:ZO!-lQdO'#HeO!-wQdO'#HeO!.[QdO,5>OOOQS'#Ds'#DsOOQS1G/w1G/wOOQS1G.|1G.|O!/[QtO1G.|O!/cQtO1G.|O1lQdO1G.|O!0OQdO1G/UOOQS'#DZ'#DZO0rQdO,59tOOQS1G.{1G.{O!0VQdO1G/eO!0gQdO1G/eO!0oQdO1G/fO'vQdO'#H[O!0tQdO'#H[O!0yQtO1G.{O!1ZQdO,59iO!2aQdO,5=zO!2qQdO,5=zO!2yQdO1G/mO!3OQtO1G/mOOQS1G/l1G/lO!3`QdO,5=uO!4VQdO,5=uO0rQdO1G/qO!4tQdO1G/sO!4yQtO1G/sO!5ZQtO1G/qOOQS1G/p1G/pOOQS1G/r1G/rOOOW-E9w-E9wOOQS1G/{1G/{O!5kQdO'#HxO0rQdO'#HxO!5|QdO,5>cOOOW-E9x-E9xOOQS1G/|1G/|OOQS-E9{-E9{O!6[Q#xO1G2zO!6{QtO1G2zO'vQdO,5<jOOQS,5<j,5<jOOQS-E9|-E9|OOQS,5<r,5<rOOQS-E:U-E:UOOQV1G0x1G0xO1XQdO'#GRO!7dQtO,5>kOOQS1G1`1G1`O!8RQdO1G1`OOQS'#DV'#DVO0rQdO,5=qOOQS,5=q,5=qO!8WQdO'#FrO!8cQdO,59oO!8kQdO1G/XO!8uQtO,5=uOOQS1G3`1G3`OOQS,5:m,5:mO!9fQdO'#GtOOQS,5<k,5<kOOQS-E9}-E9}O!9wQdO1G.hOOQS1G0Z1G0ZO!:VQdO,5=wO!:gQdO,5=wO0rQdO1G0jO0rQdO1G0jO!:xQdO,5>jO!;ZQdO,5>jO1XQdO,5>jO!;lQdO,5>iOOQS-E:R-E:RO!;qQdO1G0lO!;|QdO1G0lO!<RQdO,5>lO!<aQdO,5>lO!<oQdO,5>hO!=VQdO,5>hO!=hQdO'#EpO0rQdO1G0tO!=sQdO1G0tO!=xQgO1G0zO!AvQgO1G0}O!EqQdO,5>oO!E{QdO,5>oO!FTQtO,5>oO0rQdO1G1PO!F_QdO1G1PO4iQdO1G1UO!!vQdO1G1WOOQV,5;a,5;aO!FdQfO,5;aO!FiQgO1G1QO!JjQdO'#GZO4iQdO1G1QO4iQdO1G1QO!JzQdO,5>pO!KXQdO,5>pO1XQdO,5>pOOQV1G1U1G1UO!KaQdO'#FSO!KrQ!fO1G1WO!KzQdO1G1WOOQV1G1]1G1]O4iQdO1G1]O!LPQdO1G1]O!LXQdO'#F^OOQV1G1b1G1bO!#ZQtO1G1bPOOO1G2v1G2vP!L^OSO1G2vOOQS,5=},5=}OOQS'#Dp'#DpO0rQdO,5=}O!LfQdO,5=|O!LyQdO,5=|OOQS1G/u1G/uO!MRQdO,5>PO!McQdO,5>PO!MkQdO,5>PO!NOQdO,5>PO!N`QdO,5>POOQS1G3j1G3jOOQS7+$h7+$hO!8kQdO7+$pO#!RQdO1G.|O#!YQdO1G.|OOQS1G/`1G/`OOQS,5<`,5<`O'vQdO,5<`OOQS7+%P7+%PO#!aQdO7+%POOQS-E9r-E9rOOQS7+%Q7+%QO#!qQdO,5=vO'vQdO,5=vOOQS7+$g7+$gO#!vQdO7+%PO##OQdO7+%QO##TQdO1G3fOOQS7+%X7+%XO##eQdO1G3fO##mQdO7+%XOOQS,5<_,5<_O'vQdO,5<_O##rQdO1G3aOOQS-E9q-E9qO#$iQdO7+%]OOQS7+%_7+%_O#$wQdO1G3aO#%fQdO7+%_O#%kQdO1G3gO#%{QdO1G3gO#&TQdO7+%]O#&YQdO,5>dO#&sQdO,5>dO#&sQdO,5>dOOQS'#Dx'#DxO#'UO&jO'#DzO#'aO`O'#HyOOOW1G3}1G3}O#'fQdO1G3}O#'nQdO1G3}O#'yQ#xO7+(fO#(jQtO1G2UP#)TQdO'#GOOOQS,5<m,5<mOOQS-E:P-E:POOQS7+&z7+&zOOQS1G3]1G3]OOQS,5<^,5<^OOQS-E9p-E9pOOQS7+$s7+$sO#)bQdO,5=`O#){QdO,5=`O#*^QtO,5<aO#*qQdO1G3cOOQS-E9s-E9sOOQS7+&U7+&UO#+RQdO7+&UO#+aQdO,5<nO#+uQdO1G4UOOQS-E:Q-E:QO#,WQdO1G4UOOQS1G4T1G4TOOQS7+&W7+&WO#,iQdO7+&WOOQS,5<p,5<pO#,tQdO1G4WOOQS-E:S-E:SOOQS,5<l,5<lO#-SQdO1G4SOOQS-E:O-E:OO1XQdO'#EqO#-jQdO'#EqO#-uQdO'#IRO#-}QdO,5;[OOQS7+&`7+&`O0rQdO7+&`O#.SQgO7+&fO!JmQdO'#GXO4iQdO7+&fO4iQdO7+&iO#2QQtO,5<tO'vQdO,5<tO#2[QdO1G4ZOOQS-E:W-E:WO#2fQdO1G4ZO4iQdO7+&kO0rQdO7+&kOOQV7+&p7+&pO!KrQ!fO7+&rO!KzQdO7+&rO`QeO1G0{OOQV-E:X-E:XO4iQdO7+&lO4iQdO7+&lOOQV,5<u,5<uO#2nQdO,5<uO!JmQdO,5<uOOQV7+&l7+&lO#2yQgO7+&lO#6tQdO,5<vO#7PQdO1G4[OOQS-E:Y-E:YO#7^QdO1G4[O#7fQdO'#IWO#7tQdO'#IWO1XQdO'#IWOOQS'#IW'#IWO#8PQdO'#IVOOQS,5;n,5;nO#8XQdO,5;nO0rQdO'#FUOOQV7+&r7+&rO4iQdO7+&rOOQV7+&w7+&wO4iQdO7+&wO#8^QfO,5;xOOQV7+&|7+&|POOO7+(b7+(bO#8cQdO1G3iOOQS,5<c,5<cO#8qQdO1G3hOOQS-E9u-E9uO#9UQdO,5<dO#9aQdO,5<dO#9tQdO1G3kOOQS-E9v-E9vO#:UQdO1G3kO#:^QdO1G3kO#:nQdO1G3kO#:UQdO1G3kOOQS<<H[<<H[O#:yQtO1G1zOOQS<<Hk<<HkP#;WQdO'#FtO8vQdO1G3bO#;eQdO1G3bO#;jQdO<<HkOOQS<<Hl<<HlO#;zQdO7+)QOOQS<<Hs<<HsO#<[QtO1G1yP#<{QdO'#FsO#=YQdO7+)RO#=jQdO7+)RO#=rQdO<<HwO#=wQdO7+({OOQS<<Hy<<HyO#>nQdO,5<bO'vQdO,5<bOOQS-E9t-E9tOOQS<<Hw<<HwOOQS,5<g,5<gO0rQdO,5<gO#>sQdO1G4OOOQS-E9y-E9yO#?^QdO1G4OO<[QdO'#H{OOOO'#D{'#D{OOOO'#F|'#F|O#?oO&jO,5:fOOOW,5>e,5>eOOOW7+)i7+)iO#?zQdO7+)iO#@SQdO1G2zO#@mQdO1G2zP'vQdO'#FuO0rQdO<<IpO1XQdO1G2YP1XQdO'#GSO#AOQdO7+)pO#AaQdO7+)pOOQS<<Ir<<IrP1XQdO'#GUP0rQdO'#GQOOQS,5;],5;]O#ArQdO,5>mO#BQQdO,5>mOOQS1G0v1G0vOOQS<<Iz<<IzOOQV-E:V-E:VO4iQdO<<JQOOQV,5<s,5<sO4iQdO,5<sOOQV<<JQ<<JQOOQV<<JT<<JTO#BYQtO1G2`P#BdQdO'#GYO#BkQdO7+)uO#BuQgO<<JVO4iQdO<<JVOOQV<<J^<<J^O4iQdO<<J^O!KrQ!fO<<J^O#FpQgO7+&gOOQV<<JW<<JWO#FzQgO<<JWOOQV1G2a1G2aO1XQdO1G2aO#JuQdO1G2aO4iQdO<<JWO1XQdO1G2bP0rQdO'#G[O#KQQdO7+)vO#K_QdO7+)vOOQS'#FT'#FTO0rQdO,5>rO#KgQdO,5>rO#KrQdO,5>rO#K}QdO,5>qO#L`QdO,5>qOOQS1G1Y1G1YOOQS,5;p,5;pOOQV<<Jc<<JcO#LhQdO1G1dOOQS7+)T7+)TP#LmQdO'#FwO#L}QdO1G2OO#MbQdO1G2OO#MrQdO1G2OP#M}QdO'#FxO#N[QdO7+)VO#NlQdO7+)VO#NlQdO7+)VO#NtQdO7+)VO$ UQdO7+(|O8vQdO7+(|OOQSAN>VAN>VO$ oQdO<<LmOOQSAN>cAN>cO0rQdO1G1|O$!PQtO1G1|P$!ZQdO'#FvOOQS1G2R1G2RP$!hQdO'#F{O$!uQdO7+)jO$#`QdO,5>gOOOO-E9z-E9zOOOW<<MT<<MTO$#nQdO7+(fOOQSAN?[AN?[OOQS7+'t7+'tO$$XQdO<<M[OOQS,5<q,5<qO$$jQdO1G4XOOQS-E:T-E:TOOQVAN?lAN?lOOQV1G2_1G2_O4iQdOAN?qO$$xQgOAN?qOOQVAN?xAN?xO4iQdOAN?xOOQV<<JR<<JRO4iQdOAN?rO4iQdO7+'{OOQV7+'{7+'{O1XQdO7+'{OOQVAN?rAN?rOOQS7+'|7+'|O$(sQdO<<MbOOQS1G4^1G4^O0rQdO1G4^OOQS,5<w,5<wO$)QQdO1G4]OOQS-E:Z-E:ZOOQU'#G_'#G_O$)cQfO7+'OO$)nQdO'#F_O$*uQdO7+'jO$+VQdO7+'jOOQS7+'j7+'jO$+bQdO<<LqO$+rQdO<<LqO$+rQdO<<LqO$+zQdO'#H^OOQS<<Lh<<LhO$,UQdO<<LhOOQS7+'h7+'hOOQS'#D|'#D|OOOO1G4R1G4RO$,oQdO1G4RO$,wQdO1G4RP!=hQdO'#GVOOQVG25]G25]O4iQdOG25]OOQVG25dG25dOOQVG25^G25^OOQV<<Kg<<KgO4iQdO<<KgOOQS7+)x7+)xP$-SQdO'#G]OOQU-E:]-E:]OOQV<<Jj<<JjO$-vQtO'#FaOOQS'#Fc'#FcO$.WQdO'#FbO$.xQdO'#FbOOQS'#Fb'#FbO$.}QdO'#IYO$)nQdO'#FiO$)nQdO'#FiO$/fQdO'#FjO$)nQdO'#FkO$/mQdO'#IZOOQS'#IZ'#IZO$0[QdO,5;yOOQS<<KU<<KUO$0dQdO<<KUO$0tQdOANB]O$1UQdOANB]O$1^QdO'#H_OOQS'#H_'#H_O1sQdO'#DcO$1wQdO,5=xOOQSANBSANBSOOOO7+)m7+)mO$2`QdO7+)mOOQVLD*wLD*wOOQVANARANARO5uQ!fO'#GaO$2hQtO,5<SO$)nQdO'#FmOOQS,5<W,5<WOOQS'#Fd'#FdO$3YQdO,5;|O$3_QdO,5;|OOQS'#Fg'#FgO$)nQdO'#G`O$4PQdO,5<QO$4kQdO,5>tO$4{QdO,5>tO1XQdO,5<PO$5^QdO,5<TO$5cQdO,5<TO$)nQdO'#I[O$5hQdO'#I[O$5mQdO,5<UOOQS,5<V,5<VO0rQdO'#FpOOQU1G1e1G1eO4iQdO1G1eOOQSAN@pAN@pO$5rQdOG27wO$6SQdO,59}OOQS1G3d1G3dOOOO<<MX<<MXOOQS,5<{,5<{OOQS-E:_-E:_O$6XQtO'#FaO$6`QdO'#I]O$6nQdO'#I]O$6vQdO,5<XOOQS1G1h1G1hO$6{QdO1G1hO$7QQdO,5<zOOQS-E:^-E:^O$7lQdO,5=OO$8TQdO1G4`OOQS-E:b-E:bOOQS1G1k1G1kOOQS1G1o1G1oO$8eQdO,5>vO$)nQdO,5>vOOQS1G1p1G1pOOQS,5<[,5<[OOQU7+'P7+'PO$+zQdO1G/iO$)nQdO,5<YO$8sQdO,5>wO$8zQdO,5>wOOQS1G1s1G1sOOQS7+'S7+'SP$)nQdO'#GdO$9SQdO1G4bO$9^QdO1G4bO$9fQdO1G4bOOQS7+%T7+%TO$9tQdO1G1tO$:SQtO'#FaO$:ZQdO,5<}OOQS,5<},5<}O$:iQdO1G4cOOQS-E:a-E:aO$)nQdO,5<|O$:pQdO,5<|O$:uQdO7+)|OOQS-E:`-E:`O$;PQdO7+)|O$)nQdO,5<ZP$)nQdO'#GcO$;XQdO1G2hO$)nQdO1G2hP$;gQdO'#GbO$;nQdO<<MhO$;xQdO1G1uO$<WQdO7+(SO8vQdO'#C}O8vQdO,59bO8vQdO,59bO8vQdO,59bO$<fQtO,5=`O8vQdO1G.|O0rQdO1G/XO0rQdO7+$pP$<yQdO'#GOO'vQdO'#GtO$=WQdO,59bO$=]QdO,59bO$=dQdO,59mO$=iQdO1G/UO1sQdO'#DRO8vQdO,59j",
   stateData: "$>S~O%cOS%^OSSOS%]PQ~OPdOVaOfoOhYOopOs!POvqO!PrO!Q{O!T!SO!U!RO!XZO!][O!h`O!r`O!s`O!t`O!{tO!}uO#PvO#RwO#TxO#XyO#ZzO#^|O#_|O#a}O#c!OO#l!QO#o!TO#s!UO#u!VO#z!WO#}hO$P!XO%oRO%pRO%tSO%uWO&Z]O&[]O&]]O&^]O&_]O&`]O&a]O&b]O&c^O&d^O&e^O&f^O&g^O&h^O&i^O&j^O~O%]!YO~OV!aO_!aOa!bOh!iO!X!kO!f!mO%j![O%k!]O%l!^O%m!_O%n!_O%o!`O%p!`O%q!aO%r!aO%s!aO~Ok%xXl%xXm%xXn%xXo%xXp%xXs%xXz%xX{%xX!x%xX#g%xX%[%xX%_%xX%z%xXg%xX!T%xX!U%xX%{%xX!W%xX![%xX!Q%xX#[%xXt%xX!m%xX~P%SOfoOhYO!XZO!][O!h`O!r`O!s`O!t`O%oRO%pRO%tSO%uWO&Z]O&[]O&]]O&^]O&_]O&`]O&a]O&b]O&c^O&d^O&e^O&f^O&g^O&h^O&i^O&j^O~Oz%wX{%wX#g%wX%[%wX%_%wX%z%wX~Ok!pOl!qOm!oOn!oOo!rOp!sOs!tO!x%wX~P)pOV!zOg!|Oo0cOv0qO!PrO~P'vOV#OOo0cOv0qO!W#PO~P'vOV#SOa#TOo0cOv0qO![#UO~P'vOQ#XO%`#XO%a#ZO~OQ#^OR#[O%`#^O%a#`O~OV%iX_%iXa%iXh%iXk%iXl%iXm%iXn%iXo%iXp%iXs%iXz%iX!X%iX!f%iX%j%iX%k%iX%l%iX%m%iX%n%iX%o%iX%p%iX%q%iX%r%iX%s%iXg%iX!T%iX!U%iX~O&Z]O&[]O&]]O&^]O&_]O&`]O&a]O&b]O&c^O&d^O&e^O&f^O&g^O&h^O&i^O&j^O{%iX!x%iX#g%iX%[%iX%_%iX%z%iX%{%iX!W%iX![%iX!Q%iX#[%iXt%iX!m%iX~P,eOz#dO{%hX!x%hX#g%hX%[%hX%_%hX%z%hX~Oo0cOv0qO~P'vO#g#gO%[#iO%_#iO~O%uWO~O!T#nO#u!VO#z!WO#}hO~OopO~P'vOV#sOa#tO%uWO{wP~OV#xOo0cOv0qO!Q#yO~P'vO{#{O!x$QO%z#|O#g!yX%[!yX%_!yX~OV#xOo0cOv0qO#g#SX%[#SX%_#SX~P'vOo0cOv0qO#g#WX%[#WX%_#WX~P'vOh$WO%uWO~O!f$YO!r$YO%uWO~OV$eO~P'vO!U$gO#s$hO#u$iO~O{$jO~OV$qO~P'vOS$sO%[$rO%_$rO%c$tO~OV$}Oa$}Og%POo0cOv0qO~P'vOo0cOv0qO{%SO~P'vO&Y%UO~Oa!bOh!iO!X!kO!f!mOVba_bakbalbambanbaobapbasbazba{ba!xba#gba%[ba%_ba%jba%kba%lba%mba%nba%oba%pba%qba%rba%sba%zbagba!Tba!Uba%{ba!Wba![ba!Qba#[batba!mba~On%ZO~Oo%ZO~P'vOo0cO~P'vOk0eOl0fOm0dOn0dOo0mOp0nOs0rOg%wX!T%wX!U%wX%{%wX!W%wX![%wX!Q%wX#[%wX!m%wX~P)pO%{%]Og%vXz%vX!T%vX!U%vX!W%vX{%vX~Og%_Oz%`O!T%dO!U%cO~Og%_O~Oz%gO!T%dO!U%cO!W&SX~O!W%kO~Oz%lO{%nO!T%dO!U%cO![%}X~O![%rO~O![%sO~OQ#XO%`#XO%a%uO~OV%wOo0cOv0qO!PrO~P'vOQ#^OR#[O%`#^O%a%zO~OV!qa_!qaa!qah!qak!qal!qam!qan!qao!qap!qas!qaz!qa{!qa!X!qa!f!qa!x!qa#g!qa%[!qa%_!qa%j!qa%k!qa%l!qa%m!qa%n!qa%o!qa%p!qa%q!qa%r!qa%s!qa%z!qag!qa!T!qa!U!qa%{!qa!W!qa![!qa!Q!qa#[!qat!qa!m!qa~P#yOz%|O{%ha!x%ha#g%ha%[%ha%_%ha%z%ha~P%SOV&OOopOvqO{%ha!x%ha#g%ha%[%ha%_%ha%z%ha~P'vOz%|O{%ha!x%ha#g%ha%[%ha%_%ha%z%ha~OPdOVaOopOvqO!PrO!Q{O!{tO!}uO#PvO#RwO#TxO#XyO#ZzO#^|O#_|O#a}O#c!OO#g$zX%[$zX%_$zX~P'vO#g#gO%[&TO%_&TO~O!f&UOh&sX%[&sXz&sX#[&sX#g&sX%_&sX#Z&sXg&sX~Oh!iO%[&WO~Okealeameaneaoeapeaseazea{ea!xea#gea%[ea%_ea%zeagea!Tea!Uea%{ea!Wea![ea!Qea#[eatea!mea~P%SOsqazqa{qa#gqa%[qa%_qa%zqa~Ok!pOl!qOm!oOn!oOo!rOp!sO!xqa~PEcO%z&YOz%yX{%yX~O%uWOz%yX{%yX~Oz&]O{wX~O{&_O~Oz%lO#g%}X%[%}X%_%}Xg%}X{%}X![%}X!m%}X%z%}X~OV0lOo0cOv0qO!PrO~P'vO%z#|O#gUa%[Ua%_Ua~Oz&hO#g&PX%[&PX%_&PXn&PX~P%SOz&kO!Q&jO#g#Wa%[#Wa%_#Wa~Oz&lO#[&nO#g&rX%[&rX%_&rXg&rX~O!f$YO!r$YO#Z&qO%uWO~O#Z&qO~Oz&sO#g&tX%[&tX%_&tX~Oz&uO#g&pX%[&pX%_&pX{&pX~O!X&wO%z&xO~Oz&|On&wX~P%SOn'PO~OPdOVaOopOvqO!PrO!Q{O!{tO!}uO#PvO#RwO#TxO#XyO#ZzO#^|O#_|O#a}O#c!OO%['UO~P'vOt'YO#p'WO#q'XOP#naV#naf#nah#nao#nas#nav#na!P#na!Q#na!T#na!U#na!X#na!]#na!h#na!r#na!s#na!t#na!{#na!}#na#P#na#R#na#T#na#X#na#Z#na#^#na#_#na#a#na#c#na#l#na#o#na#s#na#u#na#z#na#}#na$P#na%X#na%o#na%p#na%t#na%u#na&Z#na&[#na&]#na&^#na&_#na&`#na&a#na&b#na&c#na&d#na&e#na&f#na&g#na&h#na&i#na&j#na%Z#na%_#na~Oz'ZO#[']O{&xX~Oh'_O!X&wO~Oh!iO{$jO!X&wO~O{'eO~P%SO%['hO%_'hO~OS'iO%['hO%_'hO~OV!aO_!aOa!bOh!iO!X!kO!f!mO%l!^O%m!_O%n!_O%o!`O%p!`O%q!aO%r!aO%s!aOkWilWimWinWioWipWisWizWi{Wi!xWi#gWi%[Wi%_Wi%jWi%zWigWi!TWi!UWi%{Wi!WWi![Wi!QWi#[WitWi!mWi~O%k!]O~P!#uO%kWi~P!#uOV!aO_!aOa!bOh!iO!X!kO!f!mO%o!`O%p!`O%q!aO%r!aO%s!aOkWilWimWinWioWipWisWizWi{Wi!xWi#gWi%[Wi%_Wi%jWi%kWi%lWi%zWigWi!TWi!UWi%{Wi!WWi![Wi!QWi#[WitWi!mWi~O%m!_O%n!_O~P!&pO%mWi%nWi~P!&pOa!bOh!iO!X!kO!f!mOkWilWimWinWioWipWisWizWi{Wi!xWi#gWi%[Wi%_Wi%jWi%kWi%lWi%mWi%nWi%oWi%pWi%zWigWi!TWi!UWi%{Wi!WWi![Wi!QWi#[WitWi!mWi~OV!aO_!aO%q!aO%r!aO%s!aO~P!)nOVWi_Wi%qWi%rWi%sWi~P!)nO!T%dO!U%cOg&VXz&VX~O%z'kO%{'kO~P,eOz'mOg&UX~Og'oO~Oz'pO{'rO!W&XX~Oo0cOv0qOz'pO{'sO!W&XX~P'vO!W'uO~Om!oOn!oOo!rOp!sOkjisjizji{ji!xji#gji%[ji%_ji%zji~Ol!qO~P!.aOlji~P!.aOk0eOl0fOm0dOn0dOo0mOp0nO~Ot'wO~P!/jOV'|Og'}Oo0cOv0qO~P'vOg'}Oz(OO~Og(QO~O!U(SO~Og(TOz(OO!T%dO!U%cO~P%SOk0eOl0fOm0dOn0dOo0mOp0nOgqa!Tqa!Uqa%{qa!Wqa![qa!Qqa#[qatqa!mqa~PEcOV'|Oo0cOv0qO!W&Sa~P'vOz(WO!W&Sa~O!W(XO~Oz(WO!T%dO!U%cO!W&Sa~P%SOV(]Oo0cOv0qO![%}a#g%}a%[%}a%_%}ag%}a{%}a!m%}a%z%}a~P'vOz(^O![%}a#g%}a%[%}a%_%}ag%}a{%}a!m%}a%z%}a~O![(aO~Oz(^O!T%dO!U%cO![%}a~P%SOz(dO!T%dO!U%cO![&Ta~P%SOz(gO{&lX![&lX!m&lX%z&lX~O{(kO![(mO!m(nO%z(jO~OV&OOopOvqO{%hi!x%hi#g%hi%[%hi%_%hi%z%hi~P'vOz(pO{%hi!x%hi#g%hi%[%hi%_%hi%z%hi~O!f&UOh&sa%[&saz&sa#[&sa#g&sa%_&sa#Z&sag&sa~O%[(uO~OV#sOa#tO%uWO~Oz&]O{wa~OopOvqO~P'vOz(^O#g%}a%[%}a%_%}ag%}a{%}a![%}a!m%}a%z%}a~P%SOz(zO#g%hX%[%hX%_%hX%z%hX~O%z#|O#gUi%[Ui%_Ui~O#g&Pa%[&Pa%_&Pan&Pa~P'vOz(}O#g&Pa%[&Pa%_&Pan&Pa~O%uWO#g&ra%[&ra%_&rag&ra~Oz)SO#g&ra%[&ra%_&rag&ra~Og)VO~OV)WOh$WO%uWO~O#Z)XO~O%uWO#g&ta%[&ta%_&ta~Oz)ZO#g&ta%[&ta%_&ta~Oo0cOv0qO#g&pa%[&pa%_&pa{&pa~P'vOz)^O#g&pa%[&pa%_&pa{&pa~OV)`Oa)`O%uWO~O%z)eO~Ot)hO#j)gOP#hiV#hif#hih#hio#his#hiv#hi!P#hi!Q#hi!T#hi!U#hi!X#hi!]#hi!h#hi!r#hi!s#hi!t#hi!{#hi!}#hi#P#hi#R#hi#T#hi#X#hi#Z#hi#^#hi#_#hi#a#hi#c#hi#l#hi#o#hi#s#hi#u#hi#z#hi#}#hi$P#hi%X#hi%o#hi%p#hi%t#hi%u#hi&Z#hi&[#hi&]#hi&^#hi&_#hi&`#hi&a#hi&b#hi&c#hi&d#hi&e#hi&f#hi&g#hi&h#hi&i#hi&j#hi%Z#hi%_#hi~Ot)iOP#kiV#kif#kih#kio#kis#kiv#ki!P#ki!Q#ki!T#ki!U#ki!X#ki!]#ki!h#ki!r#ki!s#ki!t#ki!{#ki!}#ki#P#ki#R#ki#T#ki#X#ki#Z#ki#^#ki#_#ki#a#ki#c#ki#l#ki#o#ki#s#ki#u#ki#z#ki#}#ki$P#ki%X#ki%o#ki%p#ki%t#ki%u#ki&Z#ki&[#ki&]#ki&^#ki&_#ki&`#ki&a#ki&b#ki&c#ki&d#ki&e#ki&f#ki&g#ki&h#ki&i#ki&j#ki%Z#ki%_#ki~OV)kOn&wa~P'vOz)lOn&wa~Oz)lOn&wa~P%SOn)pO~O%Y)tO~Ot)wO#p'WO#q)vOP#niV#nif#nih#nio#nis#niv#ni!P#ni!Q#ni!T#ni!U#ni!X#ni!]#ni!h#ni!r#ni!s#ni!t#ni!{#ni!}#ni#P#ni#R#ni#T#ni#X#ni#Z#ni#^#ni#_#ni#a#ni#c#ni#l#ni#o#ni#s#ni#u#ni#z#ni#}#ni$P#ni%X#ni%o#ni%p#ni%t#ni%u#ni&Z#ni&[#ni&]#ni&^#ni&_#ni&`#ni&a#ni&b#ni&c#ni&d#ni&e#ni&f#ni&g#ni&h#ni&i#ni&j#ni%Z#ni%_#ni~OV)zOo0cOv0qO{$jO~P'vOo0cOv0qO{&xa~P'vOz*OO{&xa~OV*SOa*TOg*WO%q*UO%uWO~O{$jO&{*YO~Oh'_O~Oh!iO{$jO~O%[*_O~O%[*aO%_*aO~OV$}Oa$}Oo0cOv0qOg&Ua~P'vOz*dOg&Ua~Oo0cOv0qO{*gO!W&Xa~P'vOz*hO!W&Xa~Oo0cOv0qOz*hO{*kO!W&Xa~P'vOo0cOv0qOz*hO!W&Xa~P'vOz*hO{*kO!W&Xa~Om0dOn0dOo0mOp0nOgjikjisjizji!Tji!Uji%{ji!Wji{ji![ji#gji%[ji%_ji!Qji#[jitji!mji%zji~Ol0fO~P!NkOlji~P!NkOV'|Og*pOo0cOv0qO~P'vOn*rO~Og*pOz*tO~Og*uO~OV'|Oo0cOv0qO!W&Si~P'vOz*vO!W&Si~O!W*wO~OV(]Oo0cOv0qO![%}i#g%}i%[%}i%_%}ig%}i{%}i!m%}i%z%}i~P'vOz*zO!T%dO!U%cO![&Ti~Oz*}O![%}i#g%}i%[%}i%_%}ig%}i{%}i!m%}i%z%}i~O![+OO~Oa+QOo0cOv0qO![&Ti~P'vOz*zO![&Ti~O![+SO~OV+UOo0cOv0qO{&la![&la!m&la%z&la~P'vOz+VO{&la![&la!m&la%z&la~O!]+YO&n+[O![!nX~O![+^O~O{(kO![+_O~O{(kO![+_O!m+`O~OV&OOopOvqO{%hq!x%hq#g%hq%[%hq%_%hq%z%hq~P'vOz$ri{$ri!x$ri#g$ri%[$ri%_$ri%z$ri~P%SOV&OOopOvqO~P'vOV&OOo0cOv0qO#g%ha%[%ha%_%ha%z%ha~P'vOz+aO#g%ha%[%ha%_%ha%z%ha~Oz$ia#g$ia%[$ia%_$ian$ia~P%SO#g&Pi%[&Pi%_&Pin&Pi~P'vOz+dO#g#Wq%[#Wq%_#Wq~O#[+eOz$va#g$va%[$va%_$vag$va~O%uWO#g&ri%[&ri%_&rig&ri~Oz+gO#g&ri%[&ri%_&rig&ri~OV+iOh$WO%uWO~O%uWO#g&ti%[&ti%_&ti~Oo0cOv0qO#g&pi%[&pi%_&pi{&pi~P'vO{#{Oz#eX!W#eX~Oz+mO!W&uX~O!W+oO~Ot+rO#j)gOP#hqV#hqf#hqh#hqo#hqs#hqv#hq!P#hq!Q#hq!T#hq!U#hq!X#hq!]#hq!h#hq!r#hq!s#hq!t#hq!{#hq!}#hq#P#hq#R#hq#T#hq#X#hq#Z#hq#^#hq#_#hq#a#hq#c#hq#l#hq#o#hq#s#hq#u#hq#z#hq#}#hq$P#hq%X#hq%o#hq%p#hq%t#hq%u#hq&Z#hq&[#hq&]#hq&^#hq&_#hq&`#hq&a#hq&b#hq&c#hq&d#hq&e#hq&f#hq&g#hq&h#hq&i#hq&j#hq%Z#hq%_#hq~On$|az$|a~P%SOV)kOn&wi~P'vOz+yOn&wi~Oz,TO{$jO#[,TO~O#q,VOP#nqV#nqf#nqh#nqo#nqs#nqv#nq!P#nq!Q#nq!T#nq!U#nq!X#nq!]#nq!h#nq!r#nq!s#nq!t#nq!{#nq!}#nq#P#nq#R#nq#T#nq#X#nq#Z#nq#^#nq#_#nq#a#nq#c#nq#l#nq#o#nq#s#nq#u#nq#z#nq#}#nq$P#nq%X#nq%o#nq%p#nq%t#nq%u#nq&Z#nq&[#nq&]#nq&^#nq&_#nq&`#nq&a#nq&b#nq&c#nq&d#nq&e#nq&f#nq&g#nq&h#nq&i#nq&j#nq%Z#nq%_#nq~O#[,WOz%Oa{%Oa~Oo0cOv0qO{&xi~P'vOz,YO{&xi~O{#{O%z,[Og&zXz&zX~O%uWOg&zXz&zX~Oz,`Og&yX~Og,bO~O%Y,eO~O!T%dO!U%cOg&Viz&Vi~OV$}Oa$}Oo0cOv0qOg&Ui~P'vO{,hOz$la!W$la~Oo0cOv0qO{,iOz$la!W$la~P'vOo0cOv0qO{*gO!W&Xi~P'vOz,lO!W&Xi~Oo0cOv0qOz,lO!W&Xi~P'vOz,lO{,oO!W&Xi~Og$hiz$hi!W$hi~P%SOV'|Oo0cOv0qO~P'vOn,qO~OV'|Og,rOo0cOv0qO~P'vOV'|Oo0cOv0qO!W&Sq~P'vOz$gi![$gi#g$gi%[$gi%_$gig$gi{$gi!m$gi%z$gi~P%SOV(]Oo0cOv0qO~P'vOa+QOo0cOv0qO![&Tq~P'vOz,sO![&Tq~O![,tO~OV(]Oo0cOv0qO![%}q#g%}q%[%}q%_%}qg%}q{%}q!m%}q%z%}q~P'vO{,uO~OV+UOo0cOv0qO{&li![&li!m&li%z&li~P'vOz,zO{&li![&li!m&li%z&li~O!]+YO&n+[O![!na~O{(kO![,}O~OV&OOo0cOv0qO#g%hi%[%hi%_%hi%z%hi~P'vOz-OO#g%hi%[%hi%_%hi%z%hi~O%uWO#g&rq%[&rq%_&rqg&rq~Oz-RO#g&rq%[&rq%_&rqg&rq~OV)`Oa)`O%uWO!W&ua~Oz-TO!W&ua~On$|iz$|i~P%SOV)kO~P'vOV)kOn&wq~P'vOt-XOP#myV#myf#myh#myo#mys#myv#my!P#my!Q#my!T#my!U#my!X#my!]#my!h#my!r#my!s#my!t#my!{#my!}#my#P#my#R#my#T#my#X#my#Z#my#^#my#_#my#a#my#c#my#l#my#o#my#s#my#u#my#z#my#}#my$P#my%X#my%o#my%p#my%t#my%u#my&Z#my&[#my&]#my&^#my&_#my&`#my&a#my&b#my&c#my&d#my&e#my&f#my&g#my&h#my&i#my&j#my%Z#my%_#my~O%Z-]O%_-]O~P`O#q-^OP#nyV#nyf#nyh#nyo#nys#nyv#ny!P#ny!Q#ny!T#ny!U#ny!X#ny!]#ny!h#ny!r#ny!s#ny!t#ny!{#ny!}#ny#P#ny#R#ny#T#ny#X#ny#Z#ny#^#ny#_#ny#a#ny#c#ny#l#ny#o#ny#s#ny#u#ny#z#ny#}#ny$P#ny%X#ny%o#ny%p#ny%t#ny%u#ny&Z#ny&[#ny&]#ny&^#ny&_#ny&`#ny&a#ny&b#ny&c#ny&d#ny&e#ny&f#ny&g#ny&h#ny&i#ny&j#ny%Z#ny%_#ny~Oz-aO{$jO#[-aO~Oo0cOv0qO{&xq~P'vOz-dO{&xq~O%z,[Og&zaz&za~O{#{Og&zaz&za~OV*SOa*TO%q*UO%uWOg&ya~Oz-hOg&ya~O$S-lO~OV$}Oa$}Oo0cOv0qO~P'vOo0cOv0qO{-mOz$li!W$li~P'vOo0cOv0qOz$li!W$li~P'vO{-mOz$li!W$li~Oo0cOv0qO{*gO~P'vOo0cOv0qO{*gO!W&Xq~P'vOz-pO!W&Xq~Oo0cOv0qOz-pO!W&Xq~P'vOs-sO!T%dO!U%cOg&Oq!W&Oq![&Oqz&Oq~P!/jOa+QOo0cOv0qO![&Ty~P'vOz$ji![$ji~P%SOa+QOo0cOv0qO~P'vOV+UOo0cOv0qO~P'vOV+UOo0cOv0qO{&lq![&lq!m&lq%z&lq~P'vO{(kO![-xO!m-yO%z-wO~OV&OOo0cOv0qO#g%hq%[%hq%_%hq%z%hq~P'vO%uWO#g&ry%[&ry%_&ryg&ry~OV)`Oa)`O%uWO!W&ui~Ot-}OP#m!RV#m!Rf#m!Rh#m!Ro#m!Rs#m!Rv#m!R!P#m!R!Q#m!R!T#m!R!U#m!R!X#m!R!]#m!R!h#m!R!r#m!R!s#m!R!t#m!R!{#m!R!}#m!R#P#m!R#R#m!R#T#m!R#X#m!R#Z#m!R#^#m!R#_#m!R#a#m!R#c#m!R#l#m!R#o#m!R#s#m!R#u#m!R#z#m!R#}#m!R$P#m!R%X#m!R%o#m!R%p#m!R%t#m!R%u#m!R&Z#m!R&[#m!R&]#m!R&^#m!R&_#m!R&`#m!R&a#m!R&b#m!R&c#m!R&d#m!R&e#m!R&f#m!R&g#m!R&h#m!R&i#m!R&j#m!R%Z#m!R%_#m!R~Oo0cOv0qO{&xy~P'vOV*SOa*TO%q*UO%uWOg&yi~O$S-lO%Z.VO%_.VO~OV.aOh._O!X.^O!].`O!h.YO!s.[O!t.[O%p.XO%uWO&Z]O&[]O&]]O&^]O&_]O&`]O&a]O&b]O~Oo0cOv0qOz$lq!W$lq~P'vO{.fOz$lq!W$lq~Oo0cOv0qO{*gO!W&Xy~P'vOz.gO!W&Xy~Oo0cOv.kO~P'vOs-sO!T%dO!U%cOg&Oy!W&Oy![&Oyz&Oy~P!/jO{(kO![.nO~O{(kO![.nO!m.oO~OV*SOa*TO%q*UO%uWO~Oh.tO!f.rOz$TX#[$TX%j$TXg$TX~Os$TX{$TX!W$TX![$TX~P$-bO%o.vO%p.vOs$UXz$UX{$UX#[$UX%j$UX!W$UXg$UX![$UX~O!h.xO~Oz.|O#[/OO%j.yOs&|X{&|X!W&|Xg&|X~Oa/RO~P$)zOh.tOs&}Xz&}X{&}X#[&}X%j&}X!W&}Xg&}X![&}X~Os/VO{$jO~Oo0cOv0qOz$ly!W$ly~P'vOo0cOv0qO{*gO!W&X!R~P'vOz/ZO!W&X!R~Og&RXs&RX!T&RX!U&RX!W&RX![&RXz&RX~P!/jOs-sO!T%dO!U%cOg&Qa!W&Qa![&Qaz&Qa~O{(kO![/^O~O!f.rOh$[as$[az$[a{$[a#[$[a%j$[a!W$[ag$[a![$[a~O!h/eO~O%o.vO%p.vOs$Uaz$Ua{$Ua#[$Ua%j$Ua!W$Uag$Ua![$Ua~O%j.yOs$Yaz$Ya{$Ya#[$Ya!W$Yag$Ya![$Ya~Os&|a{&|a!W&|ag&|a~P$)nOz/jOs&|a{&|a!W&|ag&|a~O!W/mO~Og/mO~O{/oO~O![/pO~Oo0cOv0qO{*gO!W&X!Z~P'vO{/sO~O%z/tO~P$-bOz/uO#[/OO%j.yOg'PX~Oz/uOg'PX~Og/wO~O!h/xO~O#[/OOs%Saz%Sa{%Sa%j%Sa!W%Sag%Sa![%Sa~O#[/OO%j.yOs%Waz%Wa{%Wa!W%Wag%Wa~Os&|i{&|i!W&|ig&|i~P$)nOz/zO#[/OO%j.yO!['Oa~Og'Pa~P$)nOz0SOg'Pa~Oa0UO!['Oi~P$)zOz0WO!['Oi~Oz0WO#[/OO%j.yO!['Oi~O#[/OO%j.yOg$biz$bi~O%z0ZO~P$-bO#[/OO%j.yOg%Vaz%Va~Og'Pi~P$)nO{0^O~Oa0UO!['Oq~P$)zOz0`O!['Oq~O#[/OO%j.yOz%Ui![%Ui~Oa0UO~P$)zOa0UO!['Oy~P$)zO#[/OO%j.yOg$ciz$ci~O#[/OO%j.yOz%Uq![%Uq~Oz+aO#g%ha%[%ha%_%ha%z%ha~P%SOV&OOo0cOv0qO~P'vOn0hO~Oo0hO~P'vO{0iO~Ot0jO~P!/jO&]&Z&j&h&i&g&f&d&e&c&b&`&a&_&^&[%u~",
@@ -51278,7 +50886,7 @@ var parser4 = LRParser.deserialize({
 });
 
 // src/adapters.ts
-var phpEngine = new import_php_parser4.Engine({ parser: { extractDoc: false, php7: true }, ast: { withPositions: true, withSource: false } });
+var phpEngine = new import_php_parser3.Engine({ parser: { extractDoc: false, php7: true }, ast: { withPositions: true, withSource: false } });
 var PHP_SOURCES = [
   ["_GET", "http_parameter"],
   ["_POST", "http_body"],
@@ -51613,7 +51221,7 @@ var pythonAdapter = {
   language: "python",
   extensions: [".py", ".pyw"],
   parse(code, _file) {
-    const tree = parser4.parse(code);
+    const tree = parser3.parse(code);
     const sources = [];
     const sinks = [];
     const sanitizers = [];
@@ -51807,18 +51415,454 @@ registerLanguage(jsAdapter);
 registerLanguage(pythonAdapter);
 registerLanguage(javaAdapter);
 
+// src/incremental.ts
+var SOURCE_EXTS = [".php", ".phtml", ".js", ".mjs", ".ts", ".tsx", ".py", ".pyw", ".java"];
+function git(repo, args) {
+  try {
+    return execSync(`git ${args}`, { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+  } catch {
+    return "";
+  }
+}
+function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
+  const changed = git(repo, `diff --name-only ${base} ${head}`).split(`
+`).filter((f) => f && SOURCE_EXTS.some((e) => f.endsWith(e)));
+  const findings = [];
+  for (const file of changed) {
+    const code = git(repo, `show ${head}:${file}`);
+    if (!code)
+      continue;
+    const lang = detectLanguage(file)?.language;
+    if (lang === "php") {
+      const dir = mkdtempSync(join9(tmpdir(), "blitz-incr-"));
+      const tmp = join9(dir, "changed.php");
+      writeFileSync2(tmp, code);
+      try {
+        const r = analyzeDataFlow2(tmp);
+        for (const f of r.findings)
+          findings.push({ file, sink: f.sink, line: f.sink_line, category: f.category, cwe: f.cwe });
+      } finally {
+        rmSync(dir, { recursive: true, force: true });
+      }
+    } else if (lang) {
+      const r = analyzeTaintUniversal(code, file);
+      for (const f of r.findings)
+        findings.push({ file, sink: f.sink, line: f.sink_line, category: f.sink, cwe: f.cwe });
+    }
+  }
+  return { repo, base, head, changed_files: changed, files_scanned: changed.length, findings };
+}
+
+// src/taint.ts
+init_scanner();
+var import_php_parser4 = __toESM(require_src(), 1);
+import { readFileSync as readFileSync12 } from "node:fs";
+var parser4 = new import_php_parser4.Engine({
+  parser: { extractDoc: false, php7: true },
+  ast: { withPositions: true, withSource: false }
+});
+function isNode3(v) {
+  return v && typeof v === "object" && typeof v.kind === "string";
+}
+function children3(node) {
+  const out = [];
+  for (const k of Object.keys(node)) {
+    if (k === "loc")
+      continue;
+    const v = node[k];
+    if (Array.isArray(v)) {
+      for (const c of v)
+        if (isNode3(c))
+          out.push(c);
+    } else if (isNode3(v)) {
+      out.push(v);
+    }
+  }
+  return out;
+}
+function findKind2(node, kind, out = []) {
+  if (!isNode3(node))
+    return out;
+  if (node.kind === kind)
+    out.push(node);
+  for (const c of children3(node))
+    findKind2(c, kind, out);
+  return out;
+}
+function rootVarName2(node) {
+  if (!isNode3(node))
+    return null;
+  if (node.kind === "variable")
+    return node.name ?? null;
+  if (node.kind === "name")
+    return typeof node.name === "string" ? node.name : node.name?.name ?? null;
+  if (node.kind === "offsetlookup" || node.kind === "propertylookup")
+    return rootVarName2(node.what);
+  return null;
+}
+function sourceOf2(node) {
+  if (!isNode3(node))
+    return null;
+  if (node.kind === "offsetlookup" && node.what?.kind === "variable") {
+    const n = node.what.name;
+    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
+      return "$" + n;
+  }
+  if (node.kind === "variable") {
+    const n = node.name;
+    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
+      return "$" + n;
+  }
+  if (node.kind === "call") {
+    const n = rootVarName2(node.what);
+    if (n === "getallheaders")
+      return "getallheaders";
+    if (n === "file_get_contents" && JSON.stringify(node).includes("php://input"))
+      return "php://input";
+  }
+  return null;
+}
+function sinkClassOf2(call) {
+  const what = call.what;
+  if (!isNode3(what))
+    return null;
+  let token = "";
+  if (what.kind === "propertylookup") {
+    const base = rootVarName2(what.what);
+    const method = what.offset?.name ?? what.offset?.value;
+    token = `${base}->${method}(`;
+  } else if (what.kind === "name") {
+    token = `${what.name}(`;
+  }
+  if (!token)
+    return null;
+  const cls = classifySink2(token) ?? classifySink2(what.name ?? "");
+  if (!cls)
+    return null;
+  return { token, cls };
+}
+function analyzeBlock(statements, env, summaries, findings, suppressed, params = [], file) {
+  for (const stmt of statements) {
+    if (!isNode3(stmt))
+      continue;
+    const kind = stmt.kind;
+    if (kind === "expressionstatement") {
+      const expr = stmt.expression;
+      walkExpression(expr, env, summaries, findings, suppressed, file);
+    } else if (kind === "if") {
+      const ifEnv = new Map(env);
+      const bodyStmts = stmt.body?.kind === "block" ? stmt.body.children : [stmt.body];
+      analyzeBlock(bodyStmts, ifEnv, summaries, findings, suppressed, params, file);
+      if (stmt.alternate) {
+        const altEnv = new Map(env);
+        const altStmts = stmt.alternate.kind === "block" ? stmt.alternate.children : [stmt.alternate];
+        analyzeBlock(altStmts, altEnv, summaries, findings, suppressed, params, file);
+      }
+    } else if (kind === "block") {
+      analyzeBlock(stmt.children ?? [], env, summaries, findings, suppressed, params, file);
+    } else if (kind === "return" || kind === "echo" || kind === "print") {
+      walkExpression(stmt, env, summaries, findings, suppressed, file);
+    } else {
+      for (const c of children3(stmt)) {
+        if (c.kind === "block" || c.kind === "if") {
+          analyzeBlock([c], new Map(env), summaries, findings, suppressed, params, file);
+        }
+      }
+    }
+  }
+}
+function walkExpression(node, env, summaries, findings, suppressed, file) {
+  if (!isNode3(node))
+    return;
+  if (node.kind === "assign") {
+    const varName = rootVarName2(node.left);
+    const taint = evalTaint(node.right, env, summaries);
+    if (varName) {
+      env.set(varName, taint);
+    }
+    return;
+  }
+  if (node.kind === "call") {
+    const sink = sinkClassOf2(node);
+    if (sink) {
+      const argTaints = node.arguments.map((a) => {
+        return evalTaint(a, env, summaries);
+      });
+      const tainted = argTaints.filter((t) => t.tainted);
+      if (tainted.length > 0) {
+        const sanitizers = tainted.flatMap((t) => t.sanitizers);
+        const inlineSan = findSanitizers(JSON.stringify(node));
+        const san = [...sanitizers, ...inlineSan].filter((s, i, arr) => arr.indexOf(s) === i);
+        const cls = sink.cls;
+        if (!isSanitized(san, cls.id)) {
+          findings.push({
+            sink: sink.token,
+            sink_line: node.loc?.start?.line ?? 0,
+            category: cls.category,
+            cwe: cls.cwe,
+            variables: tainted.map((t) => t.source ?? "var"),
+            source: tainted[0].source,
+            source_line: tainted[0].sourceLine,
+            sanitized: false,
+            sanitizers: san.map((s) => s.id),
+            auth_gated: false,
+            interprocedural: false
+          });
+        } else {
+          suppressed.n += 1;
+        }
+      }
+      for (const a of node.arguments)
+        walkExpression(a, env, summaries, findings, suppressed, file);
+      return;
+    }
+    const fnName = rootVarName2(node.what);
+    if (fnName && summaries.has(fnName)) {
+      const sum = summaries.get(fnName);
+      const argTaints = node.arguments.map((a) => {
+        const v = a;
+        return evalTaint(v, env, summaries);
+      });
+      const taintedArgs = argTaints.filter((t) => t.tainted);
+      if (taintedArgs.length > 0 && sum.sinkParams.size > 0) {
+        const firstSink = [...sum.sinkParams.values()][0];
+        const cls = classifySink2(firstSink.sink);
+        if (cls) {
+          const san = [
+            ...taintedArgs.flatMap((t) => t.sanitizers),
+            ...[...sum.sanitizedParams.values()].flat()
+          ];
+          if (!isSanitized(san, cls.id)) {
+            findings.push({
+              sink: firstSink.sink,
+              sink_line: firstSink.line,
+              category: cls.category,
+              cwe: cls.cwe,
+              variables: taintedArgs.map((t) => t.source ?? "var"),
+              source: taintedArgs[0].source,
+              source_line: taintedArgs[0].sourceLine,
+              sanitized: false,
+              sanitizers: san.map((s) => s.id),
+              auth_gated: false,
+              interprocedural: true
+            });
+          } else {
+            suppressed.n += 1;
+          }
+        }
+      }
+      return;
+    }
+    for (const c of children3(node))
+      walkExpression(c, env, summaries, findings, suppressed, file);
+    return;
+  }
+  if (node.kind === "echo" || node.kind === "print") {
+    const exprs = node.expressions ?? [node.expression];
+    for (const e of exprs) {
+      const cls = classifySink2(node.kind === "echo" ? "echo " : "print ");
+      const t = evalTaint(e, env, summaries);
+      if (t.tainted && cls) {
+        const san = [...t.sanitizers, ...findSanitizers(JSON.stringify(e))];
+        if (!isSanitized(san, cls.id)) {
+          findings.push({
+            sink: node.kind + " ",
+            sink_line: node.loc?.start?.line ?? 0,
+            category: cls.category,
+            cwe: cls.cwe,
+            variables: [t.source ?? "var"],
+            source: t.source,
+            source_line: t.sourceLine,
+            sanitized: false,
+            sanitizers: san.map((s) => s.id),
+            auth_gated: false,
+            interprocedural: false
+          });
+        } else {
+          suppressed.n += 1;
+        }
+      }
+    }
+    return;
+  }
+  for (const c of children3(node))
+    walkExpression(c, env, summaries, findings, suppressed, file);
+}
+function evalTaint(node, env, summaries) {
+  if (!isNode3(node))
+    return { tainted: false, sanitizers: [] };
+  const src = sourceOf2(node);
+  if (src)
+    return { tainted: true, sanitizers: [], source: src, sourceLine: node.loc?.start?.line };
+  if (node.kind === "variable" || node.kind === "offsetlookup") {
+    const root = rootVarName2(node);
+    if (root) {
+      const st = env.get(root);
+      if (st)
+        return { ...st };
+    }
+    if (node.kind === "offsetlookup") {
+      const whatTaint = evalTaint(node.what, env, summaries);
+      if (whatTaint.tainted)
+        return whatTaint;
+    }
+    return { tainted: false, sanitizers: [] };
+  }
+  if (node.kind === "call") {
+    const fnName = rootVarName2(node.what);
+    const san = findSanitizers(fnName ? fnName + "(" : "");
+    if (san.length > 0) {
+      const inner = node.arguments.map((a) => evalTaint(a, env, summaries));
+      const tainted = inner.some((t) => t.tainted);
+      return {
+        tainted,
+        sanitizers: tainted ? [...inner.flatMap((t) => t.sanitizers), ...san] : [],
+        source: tainted ? inner.find((t) => t.tainted)?.source : undefined,
+        sourceLine: tainted ? inner.find((t) => t.tainted)?.sourceLine : undefined
+      };
+    }
+    if (fnName && summaries.has(fnName)) {
+      const sum = summaries.get(fnName);
+      const argTaints = node.arguments.map((a) => evalTaint(a, env, summaries));
+      const tainted = argTaints.filter((t) => t.tainted);
+      if (tainted.length > 0) {
+        const helperSan = [...sum.sanitizedParams.values()].flat();
+        return {
+          tainted: true,
+          sanitizers: [...tainted.flatMap((t) => t.sanitizers), ...helperSan],
+          source: tainted[0].source,
+          sourceLine: tainted[0].sourceLine
+        };
+      }
+    }
+    return { tainted: false, sanitizers: [] };
+  }
+  if (node.kind === "bin" || node.kind === "concat" || node.kind === "encapsed") {
+    const parts = children3(node);
+    const taints = parts.map((p) => evalTaint(p, env, summaries));
+    const tainted = taints.find((t) => t.tainted);
+    if (tainted)
+      return { ...tainted, sanitizers: taints.flatMap((t) => t.sanitizers) };
+    return { tainted: false, sanitizers: [] };
+  }
+  if (node.kind === "encapsedpart") {
+    return evalTaint(node.expression, env, summaries);
+  }
+  return { tainted: false, sanitizers: [] };
+}
+function analyzeTaint(path) {
+  const result = { file: path, findings: [], suppressed: 0 };
+  let code;
+  try {
+    code = readFileSync12(path, "utf8");
+  } catch {
+    return result;
+  }
+  let ast;
+  try {
+    ast = parser4.parseCode(code, path);
+  } catch {
+    return result;
+  }
+  const functions = findKind2(ast, "function");
+  const summaries = new Map;
+  for (const fn of functions) {
+    const name = typeof fn.name === "string" ? fn.name : fn.name?.name ?? "<anonymous>";
+    const params = (fn.arguments ?? []).map((a) => typeof a === "string" ? a : typeof a.name === "string" ? a.name : a.name?.name ?? "?");
+    const summary = { name, params, sinkParams: new Map, sanitizedParams: new Map };
+    const env = new Map;
+    for (const p of params)
+      env.set(p, { tainted: false, sanitizers: [] });
+    const calls = findKind2(fn, "call");
+    for (const call of calls) {
+      const sink = sinkClassOf2(call);
+      if (!sink)
+        continue;
+      const line = call.loc?.start?.line ?? 0;
+      const varsInCall = findKind2(call, "variable").map((v) => v.name).filter(Boolean);
+      for (const v of varsInCall) {
+        if (params.includes(v))
+          summary.sinkParams.set(v, { sink: sink.token, line });
+      }
+      const san = findSanitizers(JSON.stringify(call));
+      for (const v of varsInCall) {
+        if (params.includes(v) && san.length > 0) {
+          summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
+        }
+      }
+    }
+    for (const ek of ["echo", "print"]) {
+      for (const en of findKind2(fn, ek)) {
+        const line = en.loc?.start?.line ?? 0;
+        const vars = findKind2(en, "variable").map((v) => v.name).filter(Boolean);
+        const san = findSanitizers(JSON.stringify(en));
+        for (const v of vars) {
+          if (params.includes(v)) {
+            summary.sinkParams.set(v, { sink: ek + " ", line });
+            if (san.length > 0) {
+              summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
+            }
+          }
+        }
+      }
+    }
+    const assigns = findKind2(fn, "assign");
+    for (const a of assigns) {
+      const san = findSanitizers(JSON.stringify(a.right));
+      if (san.length > 0) {
+        const lv = rootVarName2(a.left);
+        if (lv && params.includes(lv)) {
+          summary.sanitizedParams.set(lv, [...summary.sanitizedParams.get(lv) ?? [], ...san]);
+        }
+      }
+    }
+    for (const ek of ["echo", "print"]) {
+      for (const en of findKind2(fn, ek)) {
+        const san = findSanitizers(JSON.stringify(en));
+        if (san.length > 0) {
+          for (const v of findKind2(en, "variable").map((v2) => v2.name).filter(Boolean)) {
+            if (params.includes(v)) {
+              summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
+            }
+          }
+        }
+      }
+    }
+    summaries.set(name, summary);
+  }
+  const topStmts = [];
+  const body = ast.children ?? [];
+  for (const s of body) {
+    if (isNode3(s) && s.kind !== "function")
+      topStmts.push(s);
+  }
+  const globalEnv = new Map;
+  const suppressRef = { n: 0 };
+  analyzeBlock(topStmts, globalEnv, summaries, result.findings, suppressRef, [], path);
+  result.suppressed = suppressRef.n;
+  return result;
+}
+function taintTree(root, maxFiles = 2000) {
+  const files = iterSourceFiles(root, maxFiles);
+  return files.map((f) => analyzeTaint(f));
+}
+
 // src/differential.ts
+import { writeFileSync as writeFileSync3, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync13 } from "node:fs";
+import { join as join10 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import { execSync as execSync2 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
-    const dir = mkdtempSync(join9(tmpdir(), "blitz-diff-"));
-    const tmp = join9(dir, "old.php");
-    writeFileSync2(tmp, code);
+    const dir = mkdtempSync2(join10(tmpdir2(), "blitz-diff-"));
+    const tmp = join10(dir, "old.php");
+    writeFileSync3(tmp, code);
     try {
       const r = analyzeDataFlow2(tmp);
       return r.findings.map((f) => ({ sink: f.sink, sink_line: f.sink_line, category: f.category, source: f.source, cwe: f.cwe }));
     } finally {
-      rmSync(dir, { recursive: true, force: true });
+      rmSync2(dir, { recursive: true, force: true });
     }
   }
   const extMap = { javascript: ".js", typescript: ".ts", python: ".py", java: ".java" };
@@ -51971,17 +52015,17 @@ function analyzeDifferentialFiles(oldPath, newPath, language) {
   const lang = language ?? languageOf(newPath);
   return analyzeDifferential(oldCode, newCode, lang, newPath);
 }
-var SOURCE_EXTS = [".php", ".phtml", ".php5", ".js", ".mjs", ".ts", ".tsx", ".py", ".pyw", ".java"];
+var SOURCE_EXTS2 = [".php", ".phtml", ".php5", ".js", ".mjs", ".ts", ".tsx", ".py", ".pyw", ".java"];
 function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
   const git = (args) => {
     try {
-      return execSync(`git ${args}`, { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+      return execSync2(`git ${args}`, { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
     } catch {
       return "";
     }
   };
   const changed = git(`diff --name-only ${base} ${head}`).split(`
-`).filter((f) => f && SOURCE_EXTS.some((e) => f.endsWith(e)));
+`).filter((f) => f && SOURCE_EXTS2.some((e) => f.endsWith(e)));
   const files = [];
   for (const file of changed) {
     const oldCode = git(`show ${base}:${file}`);
@@ -51998,15 +52042,15 @@ function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
 
 // src/frameworks.ts
 import { readFileSync as readFileSync14, existsSync as existsSync6 } from "node:fs";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
-var ROOT4 = join10(fileURLToPath6(new URL(".", import.meta.url)), "..");
-var INTEL2 = join10(ROOT4, "intelligence");
+var ROOT4 = join11(fileURLToPath6(new URL(".", import.meta.url)), "..");
+var INTEL2 = join11(ROOT4, "intelligence");
 var cache = null;
 function load() {
   if (cache)
     return cache;
-  const p = join10(INTEL2, "frameworks.json");
+  const p = join11(INTEL2, "frameworks.json");
   if (!existsSync6(p))
     return null;
   try {
@@ -53191,12 +53235,12 @@ async function liveRecon(target, includeActive = false) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync15, readdirSync as readdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "node:fs";
-import { join as join11 } from "node:path";
+import { readFileSync as readFileSync15, readdirSync as readdirSync4, writeFileSync as writeFileSync4, rmSync as rmSync3 } from "node:fs";
+import { join as join12 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
-import { tmpdir as tmpdir2 } from "node:os";
-var ROOT5 = join11(fileURLToPath7(new URL(".", import.meta.url)), "..");
-var CORPUS = join11(ROOT5, "bench", "corpus");
+import { tmpdir as tmpdir3 } from "node:os";
+var ROOT5 = join12(fileURLToPath7(new URL(".", import.meta.url)), "..");
+var CORPUS = join12(ROOT5, "bench", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
@@ -53250,7 +53294,7 @@ function loadCorpus() {
     for (const f of readdirSync4(CORPUS)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join11(CORPUS, f));
+      const e = parseCorpusFile(join12(CORPUS, f));
       if (e)
         entries.push(e);
     }
@@ -53262,10 +53306,10 @@ function loadCorpus() {
 function detect(entry) {
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join11(tmpdir2(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
-    writeFileSync3(tmp, entry.code);
+    const tmp = join12(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    writeFileSync4(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
-    rmSync2(tmp, { force: true });
+    rmSync3(tmp, { force: true });
     if (r.findings.length > 0)
       return { detected: true, sinkKind: r.findings[0].sink };
     return { detected: false };
@@ -53306,15 +53350,15 @@ function runBenchmark() {
 
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync7, readFileSync as readFileSync16, readdirSync as readdirSync5, statSync as statSync3 } from "node:fs";
-import { join as join12, resolve } from "node:path";
+import { join as join13, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join12(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join12(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join12(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join12(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join12(ROOT6, "wp-batch-route"), expected_vulns: 1 },
-  { id: "php-complex", dir: join12(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join13(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join13(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join13(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join13(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join13(ROOT6, "wp-batch-route"), expected_vulns: 1 },
+  { id: "php-complex", dir: join13(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -53326,7 +53370,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join12(dir, e);
+      const p = join13(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -53533,7 +53577,7 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE lookup + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (57) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. Reach for them at that moment.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- Only surface to the user when: scope/authorization is genuinely unclear, a " + "  destructive or DoS action needs explicit consent, or the engagement is complete.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE lookup + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- CATALOG = external tools (130: sqlmap, nmap, nuclei, ffuf, ysoserial, ...). " + "  Blitz Strike's OWN tools find + verify; the catalog is for deeper EXTERNAL " + "  exploitation/enumeration. After your own analysis confirms a finding, run " + "  tool_lookup -> ensure_tool (auto-install) -> read_tool_manual to drive the " + "  external tool that demonstrates impact.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (57) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. Reach for them at that moment.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- Only surface to the user when: scope/authorization is genuinely unclear, a " + "  destructive or DoS action needs explicit consent, or the engagement is complete.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
 ` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding may escalate — do not assume it is the " + "  end of the story. list_chains / chain_links show whether it composes into a " + "  multi-stage chain (e.g. SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell). " + "  Check before concluding, and do not overclaim an escalation that is not there.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "HYPOTHESIS EXPANSION (from each finding, enumerate + verify every follow-up):\\n" + "- A confirmed finding is the START, not the end. From each one, enumerate " + "  the follow-ups: ESCALATE (list_chains + chain_links), CHAIN (chain_links " + "  from->to), BYPASS (bypass_lookup), PIVOT (new endpoints/sinks now reachable).\\n" + "- Every follow-up (this might happen, this could chain, maybe bypassable) is " + "  a HYPOTHESIS, not a finding. Verify EACH via strike_verify (marker + negative " + "  control) before it enters the report.\\n" + "- Never report speculation: might / could / possibly live in the " + "  hypothesis list, never in the report. Every report line is a verified fact.\\n\\n" + "PROFESSIONAL JUDGMENT (act like a senior tester, not a checklist runner):\\n" + "- PRIORITIZE by severity, computed deterministically with cvss_score (impact x " + "  exploitability) and weighted by escalation potential (chain_links). Do NOT rank " + "  by bug class - a critical stored XSS that yields account takeover outranks an " + "  unreachable blind RCE. Weight by the engagement context (which asset/data is " + "  most sensitive for THIS target).\\n" + "- Recognize dead ends: if a branch yields nothing after a few varied probes, " + "  note it and move on. Do not tunnel-vision one sink at the expense of the rest.\\n" + "- Live-test with care: respect rate limits, do not lock accounts, do not " + "  trigger DoS. Test non-destructively and prove impact with the smallest payload.\\n" + "- Know when done: stop when the termination criteria are met, not when you feel " + "  tired. A thorough audit over a rushed one, every time.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
@@ -53899,7 +53943,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("read_tool_manual", {
     title: "Read a tool manual",
-    description: "Read the full deep reference manual for a security tool (270+ manuals from kali-pentest, Apache-2.0).",
+    description: "Read the full deep reference manual for a security tool (317 manuals from kali-pentest, Apache-2.0).",
     inputSchema: {
       name: string2().describe("Tool name (e.g. sqlmap, ffuf, nmap, ghidra)")
     }
@@ -54352,6 +54396,17 @@ ${statusLine}` : statusLine },
     }
     return { content: [{ type: "text", text: JSON.stringify(result) }] };
   });
+  server.registerTool("incremental_scan", {
+    title: "Incremental scan (CI)",
+    description: "EAGLE-EYE: analyze only the files changed between two git refs (default HEAD~1..HEAD) — the fast CI pass. Runs the taint + data-flow engine on just the changed source files and skips unchanged ones; the full-scan path (run_engagement / enrich_scan) remains authoritative.",
+    inputSchema: {
+      repo: string2().describe("Path to the git repo."),
+      base: string2().optional().describe("Base ref (default HEAD~1)."),
+      head: string2().optional().describe("Head ref (default HEAD).")
+    }
+  }, async ({ repo, base, head }) => {
+    return { content: [{ type: "text", text: JSON.stringify(analyzeChangedFiles(repo, base ?? "HEAD~1", head ?? "HEAD")) }] };
+  });
   server.registerTool("list_frameworks", {
     title: "List supported frameworks",
     description: "PHASE 5: list the web frameworks Blitz Strike understands for framework-aware security analysis (Laravel, WordPress, Express, Next.js, Django, FastAPI, Spring)."
@@ -54602,23 +54657,23 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync21, existsSync as existsSync9, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join16, dirname as dirname2 } from "node:path";
+import { readFileSync as readFileSync21, existsSync as existsSync9, writeFileSync as writeFileSync6, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join17, dirname as dirname2 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 
 // src/release.ts
 import { readFileSync as readFileSync19, existsSync as existsSync8 } from "node:fs";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
-import { execSync as execSync2 } from "node:child_process";
-var ROOT8 = join14(fileURLToPath9(new URL(".", import.meta.url)), "..");
+import { execSync as execSync3 } from "node:child_process";
+var ROOT8 = join15(fileURLToPath9(new URL(".", import.meta.url)), "..");
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync19(join14(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync19(join15(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -54630,13 +54685,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync2("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8" }).trim();
+    const tag = execSync3("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8" }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git)", soft: true });
   }
   try {
-    const published = execSync2("npm view blitzstrike version", { encoding: "utf8", timeout: 8000 }).trim();
+    const published = execSync3("npm view blitzstrike version", { encoding: "utf8", timeout: 8000 }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -54650,18 +54705,18 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync8(join14(ROOT8, "package-lock.json")) || existsSync8(join14(ROOT8, "bun.lock")) || existsSync8(join14(ROOT8, "bun.lockb"));
+  return existsSync8(join15(ROOT8, "package-lock.json")) || existsSync8(join15(ROOT8, "bun.lock")) || existsSync8(join15(ROOT8, "bun.lockb"));
 }
 
 // src/dependency.ts
 import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
-var ROOT9 = join15(fileURLToPath10(new URL(".", import.meta.url)), "..");
+var ROOT9 = join16(fileURLToPath10(new URL(".", import.meta.url)), "..");
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync20(join15(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync20(join16(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -54684,7 +54739,7 @@ function checkDependencies() {
 }
 
 // src/cli.ts
-var ROOT10 = join16(fileURLToPath11(new URL(".", import.meta.url)), "..");
+var ROOT10 = join17(fileURLToPath11(new URL(".", import.meta.url)), "..");
 function which(cmd) {
   return spawnSync3(`command -v ${cmd}`, { shell: true }).status === 0;
 }
@@ -54719,7 +54774,7 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync9(join16(ROOT10, "chains.json")) && existsSync9(join16(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync9(join17(ROOT10, "chains.json")) && existsSync9(join17(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -54761,14 +54816,14 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join16(ROOT10, "src", "index.ts");
+  const src = join17(ROOT10, "src", "index.ts");
   if (which("bun") && existsSync9(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join16(ROOT10, "dist", "index.js");
+  const dist = join17(ROOT10, "dist", "index.js");
   if (existsSync9(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
@@ -54790,7 +54845,7 @@ function jsonMcpServersWrite(p) {
       ...existing.mcpServers ?? {},
       blitzstrike: { command, args }
     };
-    writeFileSync5(p, JSON.stringify(existing, null, 2));
+    writeFileSync6(p, JSON.stringify(existing, null, 2));
   };
 }
 function opencodeWrite(p) {
@@ -54803,22 +54858,22 @@ function opencodeWrite(p) {
       ...existing.mcp ?? {},
       blitzstrike: { type: "local", command: ["npx", "-y", "blitzstrike", "serve", "--mcp"], enabled: true }
     };
-    writeFileSync5(p, JSON.stringify(existing, null, 2));
+    writeFileSync6(p, JSON.stringify(existing, null, 2));
     copyOpenCodeAgents();
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join16(ROOT10, "opencode-agents");
-  const dstDir = join16(homedir5(), ".config", "opencode", "agents");
+  const srcDir = join17(ROOT10, "opencode-agents");
+  const dstDir = join17(homedir5(), ".config", "opencode", "agents");
   if (!existsSync9(srcDir))
     return;
   if (!existsSync9(dstDir))
     mkdirSync4(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join16(srcDir, f);
-    const dst = join16(dstDir, f);
+    const src = join17(srcDir, f);
+    const dst = join17(dstDir, f);
     if (existsSync9(src)) {
-      writeFileSync5(dst, readFileSync21(src, "utf8"));
+      writeFileSync6(dst, readFileSync21(src, "utf8"));
     }
   }
 }
@@ -54838,7 +54893,7 @@ function codexWrite(p) {
 command = "${command}"
 args = ${JSON.stringify(args)}
 `;
-    writeFileSync5(p, existing);
+    writeFileSync6(p, existing);
   };
 }
 function hermesWrite(p) {
@@ -54867,80 +54922,80 @@ mcp_servers:
     args: ${JSON.stringify(args)}
 `;
     }
-    writeFileSync5(p, existing);
+    writeFileSync6(p, existing);
   };
 }
 function detectAgents() {
   const home = homedir5();
   const agents = [];
-  const claudeJson = join16(home, ".claude.json");
+  const claudeJson = join17(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
     installed: () => existsSync9(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join16(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join17(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
     installed: () => existsSync9(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join16(home, ".cursor", "mcp.json");
+  const cursor = join17(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync9(join16(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync9(join17(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join16(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join17(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync9(join16(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync9(join17(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join16(home, ".codex", "config.toml");
+  const codex = join17(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync9(join16(home, ".codex")) || which("codex"),
+    installed: () => existsSync9(join17(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join16(home, ".hermes", "config.yaml");
+  const hermes = join17(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync9(join16(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync9(join17(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join16(home, ".gemini", "settings.json");
+  const gemini = join17(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync9(join16(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync9(join17(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join16(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join17(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync9(join16(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync9(join17(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join16(home, ".copilot", "mcp.json");
+  const copilot = join17(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync9(join16(home, ".copilot")),
+    installed: () => existsSync9(join17(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join16(home, ".cline", "mcp_settings.json");
+  const cline = join17(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync9(join16(home, ".cline")),
+    installed: () => existsSync9(join17(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -54985,12 +55040,12 @@ Registered with ${ok}/${installed.length} agent(s).`);
 
 // src/index.ts
 import { readFileSync as readFileSync22, existsSync as existsSync10 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
-var ROOT11 = join17(fileURLToPath12(new URL(".", import.meta.url)), "..");
+var ROOT11 = join18(fileURLToPath12(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join17(ROOT11, "package.json");
+    const p = join18(ROOT11, "package.json");
     if (existsSync10(p))
       return JSON.parse(readFileSync22(p, "utf8")).version ?? "1.0.0";
   } catch {}