circle-ir 3.147.0 → 3.149.0

package/dist/analysis/passes/cli-main-reflection-suppress-pass.d.ts

@@ -0,0 +1,94 @@
+/**
+ * CliMainReflectionSuppressPass — cognium-dev #162 Option B
+ *
+ * Drops Java reflection `code_injection` sinks in files that look like
+ * a fat-jar CLI tool's own artifact — files that ship a `main(String[])`
+ * entry point AND carry no web-framework entry-point signal anywhere
+ * in the file. The `main(String[])` on the same compilation unit *is*
+ * the trust boundary; the caller is the OS shell that invoked the jar.
+ *
+ * Motivation (from the ticket):
+ *
+ *     // antlr/tool/.../TestRig.java — 5 reflection sinks reported HIGH
+ *     public static void main(String[] args) throws Exception {
+ *         TestRig testRig = new TestRig(args);
+ *         ...
+ *     }
+ *     public void process() throws Exception {
+ *         String lexerName = grammarName + "Lexer";
+ *         ClassLoader cl = Thread.currentThread().getContextClassLoader();
+ *         Class<? extends Lexer> lexerClass =
+ *             cl.loadClass(lexerName).asSubclass(Lexer.class);   // sink
+ *         Constructor<? extends Lexer> lexerCtor =
+ *             lexerClass.getConstructor(CharStream.class);
+ *         Lexer lexer = lexerCtor.newInstance((CharStream)null);  // sink
+ *         ...
+ *     }
+ *
+ * This is documented behaviour of ANTLR's `TestRig` developer CLI —
+ * same shape as `javac`, `java -jar`, `python -m`. The tool's whole
+ * purpose is "give me a grammar name from the command line and I'll
+ * run it." Blocked 5/49 HIGH FPs in the top-100 Java harness.
+ *
+ * ## Signal
+ *
+ * Language MUST be Java. Per-file signal (all must hold):
+ *
+ *   1. Some type in the file declares a `main(String[])` method
+ *      (matches `looksLikeMainMethod` in `entry-point-detection.ts`).
+ *   2. NO type in the file carries a Tier-1 class-level web-framework
+ *      annotation (`@RestController`, `@Controller`, `@Service`,
+ *      `@Component`, `@Path`, `@WebServlet`, `@ServerEndpoint`,
+ *      `@FeignClient`, `@Repository`).
+ *   3. NO method in the file carries a Tier-1 method-level
+ *      web-framework annotation (Spring `@*Mapping`, `@KafkaListener`,
+ *      `@JmsListener`, JAX-RS `@GET/@POST/…`, `@Scheduled`, `@Path`,
+ *      `@DataBoundConstructor`/`@DataBoundSetter`).
+ *   4. NO type in the file extends a Tier-1 supertype (HttpServlet,
+ *      GenericServlet, Filter, HandlerInterceptor, CommandLineRunner,
+ *      SimpleChannelInboundHandler, etc.).
+ *
+ * ## Action
+ *
+ * When the signal fires, drop from the `SinkFilterResult.sinks` list
+ * (the authoritative sink array consumed by `TaintPropagationPass` and
+ * folded into `taint.sinks` by `analyzer.ts`) every sink whose
+ * `type === 'code_injection'` AND `method` is a Java reflection
+ * / ClassLoader surface method. The gate does NOT touch other
+ * `code_injection` shapes: ScriptEngine.eval / GroovyShell.evaluate /
+ * SpEL `parseExpression` remain flagged in CLI tools because they
+ * evaluate scripts (a genuinely dangerous CLI misuse), not just class
+ * names.
+ *
+ * ## Pipeline slot
+ *
+ * Runs after `SinkSemanticsPass` (so its curated-registry drops have
+ * already fired) and before `TaintPropagationPass` (so the flow
+ * generators never see the dropped sinks). Emits no findings.
+ *
+ * ## Pillar I / safety
+ *
+ * - Pure per-file heuristic; no LLM, no filesystem, no config knobs.
+ * - False-negative-safe: any web-framework signal in the file
+ *   (annotation OR supertype OR Tier-1 method annotation) disables
+ *   the gate. Recall preserved for `@RestController` classes,
+ *   `HttpServlet` subclasses, Netty handlers, Jenkins plugins, and
+ *   Kafka/JMS listeners that happen to also expose a `main`.
+ * - Reflection-only: `Runtime.exec`, `ProcessBuilder.start`,
+ *   `Statement.execute`, `ObjectInputStream.readObject`, SpEL,
+ *   Groovy, ScriptEngine — all unaffected.
+ * - Java-only: non-Java sources fall through untouched.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+export interface CliMainReflectionSuppressResult {
+    /** Whether the fat-jar CLI signal fired for this file. */
+    cliMainSignal: boolean;
+    /** Number of reflection `code_injection` sinks dropped. */
+    droppedCount: number;
+}
+export declare class CliMainReflectionSuppressPass implements AnalysisPass<CliMainReflectionSuppressResult> {
+    readonly name = "cli-main-reflection-suppress";
+    readonly category: "security";
+    run(ctx: PassContext): CliMainReflectionSuppressResult;
+}
+//# sourceMappingURL=cli-main-reflection-suppress-pass.d.ts.map

package/dist/analysis/passes/cli-main-reflection-suppress-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-main-reflection-suppress-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/cli-main-reflection-suppress-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAG9E,MAAM,WAAW,+BAA+B;IAC9C,0DAA0D;IAC1D,aAAa,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC;CACtB;AAiKD,qBAAa,6BACX,YAAW,YAAY,CAAC,+BAA+B,CAAC;IAExD,QAAQ,CAAC,IAAI,kCAAkC;IAC/C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,+BAA+B;CA+FvD"}

package/dist/analysis/passes/cli-main-reflection-suppress-pass.js

@@ -0,0 +1,337 @@
+/**
+ * CliMainReflectionSuppressPass — cognium-dev #162 Option B
+ *
+ * Drops Java reflection `code_injection` sinks in files that look like
+ * a fat-jar CLI tool's own artifact — files that ship a `main(String[])`
+ * entry point AND carry no web-framework entry-point signal anywhere
+ * in the file. The `main(String[])` on the same compilation unit *is*
+ * the trust boundary; the caller is the OS shell that invoked the jar.
+ *
+ * Motivation (from the ticket):
+ *
+ *     // antlr/tool/.../TestRig.java — 5 reflection sinks reported HIGH
+ *     public static void main(String[] args) throws Exception {
+ *         TestRig testRig = new TestRig(args);
+ *         ...
+ *     }
+ *     public void process() throws Exception {
+ *         String lexerName = grammarName + "Lexer";
+ *         ClassLoader cl = Thread.currentThread().getContextClassLoader();
+ *         Class<? extends Lexer> lexerClass =
+ *             cl.loadClass(lexerName).asSubclass(Lexer.class);   // sink
+ *         Constructor<? extends Lexer> lexerCtor =
+ *             lexerClass.getConstructor(CharStream.class);
+ *         Lexer lexer = lexerCtor.newInstance((CharStream)null);  // sink
+ *         ...
+ *     }
+ *
+ * This is documented behaviour of ANTLR's `TestRig` developer CLI —
+ * same shape as `javac`, `java -jar`, `python -m`. The tool's whole
+ * purpose is "give me a grammar name from the command line and I'll
+ * run it." Blocked 5/49 HIGH FPs in the top-100 Java harness.
+ *
+ * ## Signal
+ *
+ * Language MUST be Java. Per-file signal (all must hold):
+ *
+ *   1. Some type in the file declares a `main(String[])` method
+ *      (matches `looksLikeMainMethod` in `entry-point-detection.ts`).
+ *   2. NO type in the file carries a Tier-1 class-level web-framework
+ *      annotation (`@RestController`, `@Controller`, `@Service`,
+ *      `@Component`, `@Path`, `@WebServlet`, `@ServerEndpoint`,
+ *      `@FeignClient`, `@Repository`).
+ *   3. NO method in the file carries a Tier-1 method-level
+ *      web-framework annotation (Spring `@*Mapping`, `@KafkaListener`,
+ *      `@JmsListener`, JAX-RS `@GET/@POST/…`, `@Scheduled`, `@Path`,
+ *      `@DataBoundConstructor`/`@DataBoundSetter`).
+ *   4. NO type in the file extends a Tier-1 supertype (HttpServlet,
+ *      GenericServlet, Filter, HandlerInterceptor, CommandLineRunner,
+ *      SimpleChannelInboundHandler, etc.).
+ *
+ * ## Action
+ *
+ * When the signal fires, drop from the `SinkFilterResult.sinks` list
+ * (the authoritative sink array consumed by `TaintPropagationPass` and
+ * folded into `taint.sinks` by `analyzer.ts`) every sink whose
+ * `type === 'code_injection'` AND `method` is a Java reflection
+ * / ClassLoader surface method. The gate does NOT touch other
+ * `code_injection` shapes: ScriptEngine.eval / GroovyShell.evaluate /
+ * SpEL `parseExpression` remain flagged in CLI tools because they
+ * evaluate scripts (a genuinely dangerous CLI misuse), not just class
+ * names.
+ *
+ * ## Pipeline slot
+ *
+ * Runs after `SinkSemanticsPass` (so its curated-registry drops have
+ * already fired) and before `TaintPropagationPass` (so the flow
+ * generators never see the dropped sinks). Emits no findings.
+ *
+ * ## Pillar I / safety
+ *
+ * - Pure per-file heuristic; no LLM, no filesystem, no config knobs.
+ * - False-negative-safe: any web-framework signal in the file
+ *   (annotation OR supertype OR Tier-1 method annotation) disables
+ *   the gate. Recall preserved for `@RestController` classes,
+ *   `HttpServlet` subclasses, Netty handlers, Jenkins plugins, and
+ *   Kafka/JMS listeners that happen to also expose a `main`.
+ * - Reflection-only: `Runtime.exec`, `ProcessBuilder.start`,
+ *   `Statement.execute`, `ObjectInputStream.readObject`, SpEL,
+ *   Groovy, ScriptEngine — all unaffected.
+ * - Java-only: non-Java sources fall through untouched.
+ */
+/**
+ * Java reflection + ClassLoader methods that produce `code_injection`
+ * sinks via `configs/sinks/code_injection.yaml`. Simple-name match on
+ * `sink.method`. Kept intentionally narrow — script-engine /
+ * expression-language sinks (`eval`, `evaluate`, `parseExpression`,
+ * `getBeanInfo`, `getEngineByName`) are NOT in this set, so those
+ * still fire in CLI artifacts.
+ */
+const REFLECTION_SINK_METHODS = new Set([
+    'forName',
+    'newInstance',
+    'invoke',
+    'getMethod',
+    'getDeclaredMethod',
+    'getConstructor',
+    'getDeclaredConstructor',
+    'loadClass',
+    'defineClass',
+]);
+/**
+ * Tier-1 class-level web-framework annotations. Simple-name match
+ * (annotation strings in `TypeInfo.annotations` may include the `@`
+ * prefix and generic args — we strip both). Any single match kills
+ * the gate for this file.
+ */
+const TIER_1_CLASS_ANNOTATIONS = new Set([
+    // Spring MVC
+    'RestController',
+    'Controller',
+    // Spring stereotype beans
+    'Service',
+    'Repository',
+    'Component',
+    // JAX-RS resource class
+    'Path',
+    // Servlet 3.0 annotation-based servlet
+    'WebServlet',
+    // JSR-356 WebSocket endpoint
+    'ServerEndpoint',
+    // Declarative HTTP client
+    'FeignClient',
+]);
+/**
+ * Tier-1 method-level web-framework annotations. Any single match
+ * kills the gate.
+ */
+const TIER_1_METHOD_ANNOTATIONS = new Set([
+    // Spring MVC
+    'RequestMapping',
+    'GetMapping',
+    'PostMapping',
+    'PutMapping',
+    'DeleteMapping',
+    'PatchMapping',
+    // Spring messaging / WebSocket
+    'MessageMapping',
+    'SubscribeMapping',
+    // Spring messaging listeners
+    'KafkaListener',
+    'KafkaHandler',
+    'RabbitListener',
+    'RabbitHandler',
+    'JmsListener',
+    'StreamListener',
+    // Spring Cloud AWS
+    'SqsListener',
+    'SqsHandler',
+    // Spring application events
+    'EventListener',
+    // CRON / scheduled
+    'Scheduled',
+    // JAX-RS
+    'Path',
+    'GET',
+    'POST',
+    'PUT',
+    'DELETE',
+    'PATCH',
+    'HEAD',
+    'OPTIONS',
+    // Jenkins Stapler form-binding
+    'DataBoundConstructor',
+    'DataBoundSetter',
+]);
+/**
+ * Tier-1 supertypes whose subclasses declare framework entry points
+ * via lifecycle methods (HttpServlet.doGet, ChannelHandler.channelRead,
+ * CommandLineRunner.run, etc.). Simple-name match on
+ * `TypeInfo.extends` and each `TypeInfo.implements[]` entry (generics
+ * stripped).
+ */
+const TIER_1_SUPERTYPES = new Set([
+    'HttpServlet',
+    'GenericServlet',
+    'Filter',
+    'HandlerInterceptor',
+    'AsyncHandlerInterceptor',
+    'CommandLineRunner',
+    'ApplicationRunner',
+    'SimpleChannelInboundHandler',
+    'ChannelInboundHandler',
+    'ChannelInboundHandlerAdapter',
+    'ChannelDuplexHandler',
+    'NettyRequestProcessor',
+    'Converter',
+    'SingleValueConverter',
+    'ConverterMatcher',
+    'AbstractReflectionConverter',
+    'AbstractSingleValueConverter',
+    'AbstractCollectionConverter',
+]);
+/**
+ * Normalize an annotation string to its simple name. Handles `@Foo`,
+ * `Foo`, `@Foo(...)`, `pkg.Foo`, and `Foo<T>` shapes. Returns the
+ * bare identifier (`Foo`) for the lookup.
+ */
+function normalizeAnnotation(raw) {
+    let s = raw.trim();
+    if (s.startsWith('@'))
+        s = s.slice(1);
+    const parenIdx = s.indexOf('(');
+    if (parenIdx >= 0)
+        s = s.slice(0, parenIdx);
+    const genericIdx = s.indexOf('<');
+    if (genericIdx >= 0)
+        s = s.slice(0, genericIdx);
+    const dotIdx = s.lastIndexOf('.');
+    if (dotIdx >= 0)
+        s = s.slice(dotIdx + 1);
+    return s.trim();
+}
+/** Strip generics + package qualifier from a supertype reference. */
+function normalizeSupertype(raw) {
+    let s = raw.trim();
+    const genericIdx = s.indexOf('<');
+    if (genericIdx >= 0)
+        s = s.slice(0, genericIdx);
+    const dotIdx = s.lastIndexOf('.');
+    if (dotIdx >= 0)
+        s = s.slice(dotIdx + 1);
+    return s.trim();
+}
+/**
+ * Detect the `main(String[] args)` entry-point shape. Static isn't
+ * required by the JVM launcher spec strictly (some launchers accept
+ * instance mains), but every real Java CLI uses `public static void
+ * main(String[])`. We match on the parameter shape only — one string
+ * array — matching `looksLikeMainMethod` in
+ * `src/analysis/entry-point-detection.ts`.
+ */
+function isMainMethod(name, paramTypes) {
+    if (name !== 'main')
+        return false;
+    if (paramTypes.length !== 1)
+        return false;
+    const t = paramTypes[0];
+    if (!t)
+        return false;
+    const bare = t.replace(/\s+/g, '');
+    return bare === 'String[]' || bare === 'java.lang.String[]';
+}
+export class CliMainReflectionSuppressPass {
+    name = 'cli-main-reflection-suppress';
+    category = 'security';
+    run(ctx) {
+        const { graph, language } = ctx;
+        // Java-only gate. Non-Java IR falls through untouched.
+        if (language !== 'java') {
+            return { cliMainSignal: false, droppedCount: 0 };
+        }
+        const types = graph.ir.types;
+        if (!types || types.length === 0) {
+            return { cliMainSignal: false, droppedCount: 0 };
+        }
+        // Signal condition (1): main(String[]) present anywhere in file.
+        let hasMain = false;
+        // Disqualifiers (2), (3), (4): any Tier-1 web-framework signal.
+        let hasFrameworkSignal = false;
+        for (const type of types) {
+            // (2) class-level annotations
+            for (const ann of type.annotations) {
+                if (TIER_1_CLASS_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+                    hasFrameworkSignal = true;
+                    break;
+                }
+            }
+            if (hasFrameworkSignal)
+                break;
+            // (4) supertype match — `extends` slot + every `implements` slot.
+            if (type.extends && TIER_1_SUPERTYPES.has(normalizeSupertype(type.extends))) {
+                hasFrameworkSignal = true;
+                break;
+            }
+            for (const impl of type.implements) {
+                if (TIER_1_SUPERTYPES.has(normalizeSupertype(impl))) {
+                    hasFrameworkSignal = true;
+                    break;
+                }
+            }
+            if (hasFrameworkSignal)
+                break;
+            for (const method of type.methods) {
+                // (3) method-level annotations
+                for (const ann of method.annotations) {
+                    if (TIER_1_METHOD_ANNOTATIONS.has(normalizeAnnotation(ann))) {
+                        hasFrameworkSignal = true;
+                        break;
+                    }
+                }
+                if (hasFrameworkSignal)
+                    break;
+                // (1) main(String[]) shape
+                if (!hasMain) {
+                    const paramTypes = method.parameters.map((p) => p.type);
+                    if (isMainMethod(method.name, paramTypes)) {
+                        hasMain = true;
+                    }
+                }
+            }
+            if (hasFrameworkSignal)
+                break;
+        }
+        const cliMainSignal = hasMain && !hasFrameworkSignal;
+        if (!cliMainSignal) {
+            return { cliMainSignal: false, droppedCount: 0 };
+        }
+        // Drop reflection code_injection sinks in place. The authoritative
+        // sink list in the real pipeline is `SinkFilterResult.sinks` — that
+        // is what `analyzer.ts` assembles the final `taint.sinks` from and
+        // what `TaintPropagationPass` / `InterproceduralPass` consume.
+        // `graph.ir.taint.sinks` starts empty and is never populated by the
+        // pipeline, so mutating it alone would be a no-op. Prefer the
+        // sink-filter result; fall back to `graph.ir.taint.sinks` for
+        // stand-alone unit-test harnesses that don't run `SinkFilterPass`.
+        const sinks = ctx.hasResult('sink-filter')
+            ? ctx.getResult('sink-filter').sinks
+            : graph.ir.taint.sinks;
+        let droppedCount = 0;
+        const kept = sinks.filter((sink) => {
+            if (sink.type !== 'code_injection')
+                return true;
+            if (!sink.method)
+                return true;
+            if (!REFLECTION_SINK_METHODS.has(sink.method))
+                return true;
+            droppedCount++;
+            return false;
+        });
+        if (droppedCount > 0) {
+            sinks.length = 0;
+            sinks.push(...kept);
+        }
+        return { cliMainSignal: true, droppedCount };
+    }
+}
+//# sourceMappingURL=cli-main-reflection-suppress-pass.js.map

package/dist/analysis/passes/cli-main-reflection-suppress-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-main-reflection-suppress-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/cli-main-reflection-suppress-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAYH;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,SAAS;IACT,aAAa;IACb,QAAQ;IACR,WAAW;IACX,mBAAmB;IACnB,gBAAgB;IAChB,wBAAwB;IACxB,WAAW;IACX,aAAa;CACd,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,wBAAwB,GAAwB,IAAI,GAAG,CAAC;IAC5D,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,0BAA0B;IAC1B,SAAS;IACT,YAAY;IACZ,WAAW;IACX,wBAAwB;IACxB,MAAM;IACN,uCAAuC;IACvC,YAAY;IACZ,6BAA6B;IAC7B,gBAAgB;IAChB,0BAA0B;IAC1B,aAAa;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC;IAC7D,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,4BAA4B;IAC5B,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,+BAA+B;IAC/B,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,aAAa;IACb,gBAAgB;IAChB,QAAQ;IACR,oBAAoB;IACpB,yBAAyB;IACzB,mBAAmB;IACnB,mBAAmB;IACnB,6BAA6B;IAC7B,uBAAuB;IACvB,8BAA8B;IAC9B,sBAAsB;IACtB,uBAAuB;IACvB,WAAW;IACX,sBAAsB;IACtB,kBAAkB;IAClB,6BAA6B;IAC7B,8BAA8B;IAC9B,6BAA6B;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,UAAU,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,UAAU,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,MAAM,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,IAAY,EAAE,UAAsC;IACxE,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,oBAAoB,CAAC;AAC9D,CAAC;AAED,MAAM,OAAO,6BAA6B;IAG/B,IAAI,GAAG,8BAA8B,CAAC;IACtC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;QAEhC,uDAAuD;QACvD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACnD,CAAC;QAED,iEAAiE;QACjE,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,gEAAgE;QAChE,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,8BAA8B;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnC,IAAI,wBAAwB,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3D,kBAAkB,GAAG,IAAI,CAAC;oBAC1B,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB;gBAAE,MAAM;YAE9B,kEAAkE;YAClE,IAAI,IAAI,CAAC,OAAO,IAAI,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAC5E,kBAAkB,GAAG,IAAI,CAAC;gBAC1B,MAAM;YACR,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACnC,IAAI,iBAAiB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACpD,kBAAkB,GAAG,IAAI,CAAC;oBAC1B,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB;gBAAE,MAAM;YAE9B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,+BAA+B;gBAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBACrC,IAAI,yBAAyB,CAAC,GAAG,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;wBAC5D,kBAAkB,GAAG,IAAI,CAAC;wBAC1B,MAAM;oBACR,CAAC;gBACH,CAAC;gBACD,IAAI,kBAAkB;oBAAE,MAAM;gBAE9B,2BAA2B;gBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBACxD,IAAI,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC;wBAC1C,OAAO,GAAG,IAAI,CAAC;oBACjB,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,kBAAkB;gBAAE,MAAM;QAChC,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,IAAI,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;QACnD,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,mEAAmE;QACnE,+DAA+D;QAC/D,oEAAoE;QACpE,8DAA8D;QAC9D,8DAA8D;QAC9D,mEAAmE;QACnE,MAAM,KAAK,GAA+C,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACpF,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;YACjC,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;gBAAE,OAAO,IAAI,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YAC9B,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3D,YAAY,EAAE,CAAC;YACf,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC/C,CAAC;CACF"}

package/dist/analysis/passes/language-sources-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAge7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAuDrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAynED,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgGf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2If;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Kf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Jf;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwFf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Ef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Ef;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiFf"}
+{"version":3,"file":"language-sources-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/language-sources-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAwB,WAAW,EAAO,MAAM,sBAAsB,CAAC;AAC3H,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAqB9E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0C/B,CAAC;AAiCF,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACjC,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B;;;;OAIG;IACH,oBAAoB,EAAE,cAAc,EAAE,CAAC;IACvC;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC;;;OAGG;IACH,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7B;;;OAGG;IACH,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAMD,qBAAa,mBAAoB,YAAW,YAAY,CAAC,qBAAqB,CAAC;IAC7E,QAAQ,CAAC,IAAI,sBAAsB;IACnC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,qBAAqB;CAge7C;AAgkBD,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAkG9E;AAED,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAwC5G;AAED,wBAAgB,iCAAiC,CAC/C,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,KAAK,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBjD;AAyKD,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmBpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAmCrB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GACpB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAuDrB;AA+MD,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CAsKvF;AAynED,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,WAAW,EAAE,CAcf;AAoLD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+HnF;AAMD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA2BjF;AAOD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgCf;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Bf;AAED;;;;;GAKG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Bf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoCf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgDf;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Bf;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,EAAE,CA+C3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoFf;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Gf;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoDf;AAED;;;;;;;;GAQG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiGf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqDf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wCAAwC,CACtD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA0Df;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,8CAA8C,CAC5D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA4Df;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6CAA6C,CAC3D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmFf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwKf;AAaD;;;;;;;GAOG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Gf;AAED;;;;;;;;GAQG;AACH,wBAAgB,uCAAuC,CACrD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAqHf;AAED;;;;;;;GAOG;AACH,wBAAgB,qDAAqD,CACnE,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAuGf;AAED;;;;;;;;;GASG;AACH,wBAAgB,sCAAsC,CACpD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkKf;AAED;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiHf;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Ef;AAED;;;;;;GAMG;AACH,wBAAgB,gDAAgD,CAC9D,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAmGf;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAkHf;AAED;;;;;GAKG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAoEf;AAED;;;;GAIG;AACH,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA8Ff;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAgGf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2If;AAED;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA+Kf;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Jf;AAED;;;;;;;;;GASG;AACH,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAwFf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA2Ef;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAyEf;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAsDf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CA6Ef;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CACjD,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,WAAW,EAAE,CAiFf"}

package/dist/analysis/passes/language-sources-pass.js

@@ -4741,6 +4741,22 @@ export function findJavaResponseWriterXssFindings(code, file) {
     if (respNames.size === 0)
         return out;
     const safeWrapRe = /\b(?:Encode\.(?:forHtml|forHtmlAttribute|forHtmlContent|forJavaScript)|StringEscapeUtils\.escape(?:Html3|Html4|EcmaScript|Xml)|HtmlUtils\.htmlEscape(?:Decimal|Hex)?|Escaper\.escapeHtml|HtmlEscapers\.(?:escapeHtml|htmlEscaper)|Encoder\.encodeForHTML(?:Attribute)?|Jsoup\.clean)\s*\(/;
+    // cognium-dev#153 — same-file sanitized-variable tracking.
+    // Collect names of local variables that were assigned from a recognized
+    // HTML/attribute encoder in this file. When ALL non-literal identifiers
+    // in the sink args are in this set, the write is treated as sanitized.
+    const sanitizedVars = new Set();
+    const sanAssignRe = /(?:^|[\s;{},(])(?:final\s+)?(?:[A-Za-z_][\w.<>\[\]]*\s+)?([A-Za-z_]\w*)\s*=\s*[^=]/;
+    for (const line of lines) {
+        const t = line.trim();
+        if (!t || t.startsWith('//') || t.startsWith('*'))
+            continue;
+        if (!safeWrapRe.test(t))
+            continue;
+        const am = t.match(sanAssignRe);
+        if (am)
+            sanitizedVars.add(am[1]);
+    }
     for (let i = 0; i < lines.length; i++) {
         const raw = lines[i];
         const trimmed = raw.trim();
@@ -4764,6 +4780,17 @@ export function findJavaResponseWriterXssFindings(code, file) {
             continue;
         if (!/[A-Za-z_]\w*/.test(argsTrim))
             continue;
+        // cognium-dev#153 — if every non-literal identifier in the args is a
+        // locally-sanitized var, the concatenation was pre-encoded. Skip.
+        if (sanitizedVars.size > 0) {
+            const stripped = argsTrim.replace(/"(?:\\.|[^"\\])*"/g, '');
+            const idents = stripped.match(/\b[A-Za-z_]\w*\b/g) ?? [];
+            const nonKeyword = idents.filter((x) => x !== 'null' && x !== 'true' && x !== 'false');
+            if (nonKeyword.length > 0 &&
+                nonKeyword.every((x) => sanitizedVars.has(x))) {
+                continue;
+            }
+        }
         out.push({
             id: `xss-${file}-${i + 1}`,
             pass: 'language-sources',