circle-ir 3.152.0 → 3.154.0

package/dist/analysis/passes/library-profile-sink-gate-pass.d.ts

@@ -1,11 +1,24 @@
 /**
  * LibraryProfileSinkGatePass — cognium-dev #232
+ * LibraryProfileCwe22PathGatePass — cognium-dev #245 RC1 (belt-and-suspenders)
  *
  * Sink-side companion to `LibraryProfileSourceGatePass` (#236,
  * shipped 3.151.0). Under the `library/*` project profile, drops
  * sinks whose entire vulnerability class is off-topic for library
  * code — currently just `log_injection` (CWE-117).
  *
+ * The second (companion) class `LibraryProfileCwe22PathGatePass`
+ * runs post-`InterproceduralPass` and filters `graph.ir.taint.flows`
+ * for CWE-22 (`path_traversal`) flows whose source shape is
+ * speculative (`interprocedural_param` / `constructor_field`).
+ * `LibraryProfileSourceGatePass` already drops those `SourceType`s
+ * from `graph.ir.taint.sources` under `library/*`, but this
+ * companion catches any residual flows synthesised downstream that
+ * bypassed the source-list mutation (belt-and-suspenders).
+ * Empirically 170/246 CWE-22 H+C findings on the Tier 2 10-repo
+ * cohort carried an `interprocedural_param` source with empty
+ * `source.code` (cognium-ai#189 §4).
+ *
  * Motivation:
  *
  *   `log_injection` requires a downstream log-viewer that interprets
@@ -56,7 +69,7 @@
  * residuals; the Tier 2 8-repo cohort is Java-heavy.
  */
 import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
-import type { ProjectProfile, SinkType } from '../../types/index.js';
+import type { ProjectProfile, SinkType, SourceType } from '../../types/index.js';
 export interface LibraryProfileSinkGateResult {
     /**
      * Resolved `ProjectProfile` observed on `graph.ir.meta.projectProfile`
@@ -86,4 +99,33 @@ export declare class LibraryProfileSinkGatePass implements AnalysisPass<LibraryP
     readonly category: "security";
     run(ctx: PassContext): LibraryProfileSinkGateResult;
 }
+export interface LibraryProfileCwe22PathGateResult {
+    /**
+     * Resolved `ProjectProfile` observed on `graph.ir.meta.projectProfile`
+     * at the time this pass ran. `undefined` when no profile was
+     * supplied by the caller.
+     */
+    profile: ProjectProfile | undefined;
+    /**
+     * Whether the profile matched the library-shape trigger and the
+     * gate was applied. `false` for every non-library shape and for
+     * `'unknown'` / absent profiles.
+     */
+    applied: boolean;
+    /**
+     * Number of CWE-22 flows removed from `graph.ir.taint.flows`.
+     * Zero when `applied === false` or when no matching flow existed.
+     */
+    dropped: number;
+    /**
+     * Breakdown of drops by speculative source shape. Empty object
+     * when `applied === false` or when no drops fired.
+     */
+    droppedBySourceType: Partial<Record<SourceType, number>>;
+}
+export declare class LibraryProfileCwe22PathGatePass implements AnalysisPass<LibraryProfileCwe22PathGateResult> {
+    readonly name = "library-profile-cwe22-path-gate";
+    readonly category: "security";
+    run(ctx: PassContext): LibraryProfileCwe22PathGateResult;
+}
 //# sourceMappingURL=library-profile-sink-gate-pass.d.ts.map

package/dist/analysis/passes/library-profile-sink-gate-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"library-profile-sink-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-sink-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAa,MAAM,sBAAsB,CAAC;AAYhF,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAaD,qBAAa,0BACX,YAAW,YAAY,CAAC,4BAA4B,CAAC;IAErD,QAAQ,CAAC,IAAI,+BAA+B;IAC5C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,4BAA4B;CA0DpD"}
+{"version":3,"file":"library-profile-sink-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-sink-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAA4B,MAAM,sBAAsB,CAAC;AAY3G,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAaD,qBAAa,0BACX,YAAW,YAAY,CAAC,4BAA4B,CAAC;IAErD,QAAQ,CAAC,IAAI,+BAA+B;IAC5C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,4BAA4B;CA0DpD;AAcD,MAAM,WAAW,iCAAiC;IAChD;;;;OAIG;IACH,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;CAC1D;AAED,qBAAa,+BACX,YAAW,YAAY,CAAC,iCAAiC,CAAC;IAE1D,QAAQ,CAAC,IAAI,qCAAqC;IAClD,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,iCAAiC;CAuDzD"}

package/dist/analysis/passes/library-profile-sink-gate-pass.js

@@ -1,11 +1,24 @@
 /**
  * LibraryProfileSinkGatePass — cognium-dev #232
+ * LibraryProfileCwe22PathGatePass — cognium-dev #245 RC1 (belt-and-suspenders)
  *
  * Sink-side companion to `LibraryProfileSourceGatePass` (#236,
  * shipped 3.151.0). Under the `library/*` project profile, drops
  * sinks whose entire vulnerability class is off-topic for library
  * code — currently just `log_injection` (CWE-117).
  *
+ * The second (companion) class `LibraryProfileCwe22PathGatePass`
+ * runs post-`InterproceduralPass` and filters `graph.ir.taint.flows`
+ * for CWE-22 (`path_traversal`) flows whose source shape is
+ * speculative (`interprocedural_param` / `constructor_field`).
+ * `LibraryProfileSourceGatePass` already drops those `SourceType`s
+ * from `graph.ir.taint.sources` under `library/*`, but this
+ * companion catches any residual flows synthesised downstream that
+ * bypassed the source-list mutation (belt-and-suspenders).
+ * Empirically 170/246 CWE-22 H+C findings on the Tier 2 10-repo
+ * cohort carried an `interprocedural_param` source with empty
+ * `source.code` (cognium-ai#189 §4).
+ *
  * Motivation:
  *
  *   `log_injection` requires a downstream log-viewer that interprets
@@ -129,4 +142,66 @@ export class LibraryProfileSinkGatePass {
         };
     }
 }
+/**
+ * `SourceType`s eligible for the CWE-22 belt-and-suspenders drop.
+ * These are the same speculative shapes that `LibraryProfileSourceGatePass`
+ * drops from `graph.ir.taint.sources` under `library/*`. Listed
+ * here so the post-flow companion catches any flow that made it
+ * past the source-list mutation.
+ */
+const CWE22_SPECULATIVE_SOURCE_TYPES = new Set([
+    'interprocedural_param',
+    'constructor_field',
+]);
+export class LibraryProfileCwe22PathGatePass {
+    name = 'library-profile-cwe22-path-gate';
+    category = 'security';
+    run(ctx) {
+        const { graph } = ctx;
+        const profile = graph.ir.meta.projectProfile;
+        if (!isLibraryShape(profile)) {
+            return {
+                profile,
+                applied: false,
+                dropped: 0,
+                droppedBySourceType: {},
+            };
+        }
+        // `TaintPropagationPass` / `InterproceduralPass` populate
+        // `graph.ir.taint.flows`. Nothing to filter if no flow ever ran.
+        const flows = graph.ir.taint.flows;
+        if (!flows || flows.length === 0) {
+            return {
+                profile,
+                applied: true,
+                dropped: 0,
+                droppedBySourceType: {},
+            };
+        }
+        const droppedBySourceType = {};
+        const kept = [];
+        for (const flow of flows) {
+            if (flow.sink_type === 'path_traversal' &&
+                CWE22_SPECULATIVE_SOURCE_TYPES.has(flow.source_type)) {
+                droppedBySourceType[flow.source_type] =
+                    (droppedBySourceType[flow.source_type] ?? 0) + 1;
+                continue;
+            }
+            kept.push(flow);
+        }
+        const dropped = flows.length - kept.length;
+        // Mutate the flow array in place so downstream consumers
+        // (`CrossFilePass`, SARIF writer) see the filtered list.
+        if (dropped > 0) {
+            flows.length = 0;
+            flows.push(...kept);
+        }
+        return {
+            profile,
+            applied: true,
+            dropped,
+            droppedBySourceType,
+        };
+    }
+}
 //# sourceMappingURL=library-profile-sink-gate-pass.js.map

package/dist/analysis/passes/library-profile-sink-gate-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"library-profile-sink-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-sink-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAMH;;;;GAIG;AACH,MAAM,kBAAkB,GAA0B,IAAI,GAAG,CAAW;IAClE,eAAe;CAChB,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAmC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,0BAA0B;IAG5B,IAAI,GAAG,2BAA2B,CAAC;IACnC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;QAE7C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,6DAA6D;QAC7D,8DAA8D;QAC9D,4DAA4D;QAC5D,mCAAmC;QACnC,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAsC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAgB,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3C,yDAAyD;QACzD,gEAAgE;QAChE,6CAA6C;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,OAAO;YACP,aAAa;SACd,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"library-profile-sink-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-sink-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAMH;;;;GAIG;AACH,MAAM,kBAAkB,GAA0B,IAAI,GAAG,CAAW;IAClE,eAAe;CAChB,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAmC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,0BAA0B;IAG5B,IAAI,GAAG,2BAA2B,CAAC;IACnC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;QAE7C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,6DAA6D;QAC7D,8DAA8D;QAC9D,4DAA4D;QAC5D,mCAAmC;QACnC,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAsC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAgB,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC/D,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3C,yDAAyD;QACzD,gEAAgE;QAChE,6CAA6C;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,OAAO;YACP,aAAa;SACd,CAAC;IACJ,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,8BAA8B,GAA4B,IAAI,GAAG,CAAa;IAClF,uBAAuB;IACvB,mBAAmB;CACpB,CAAC,CAAC;AA2BH,MAAM,OAAO,+BAA+B;IAGjC,IAAI,GAAG,iCAAiC,CAAC;IACzC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;QAE7C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,mBAAmB,EAAE,EAAE;aACxB,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,iEAAiE;QACjE,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,mBAAmB,EAAE,EAAE;aACxB,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAAwC,EAAE,CAAC;QACpE,MAAM,IAAI,GAAoB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IACE,IAAI,CAAC,SAAS,KAAK,gBAAgB;gBACnC,8BAA8B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,EACpD,CAAC;gBACD,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC;oBACnC,CAAC,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnD,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3C,yDAAyD;QACzD,yDAAyD;QACzD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,OAAO;YACP,mBAAmB;SACpB,CAAC;IACJ,CAAC;CACF"}

package/dist/analysis/passes/library-profile-xss-gate-pass.d.ts

@@ -0,0 +1,104 @@
+/**
+ * LibraryProfileXssGatePass — cognium-dev #244
+ *
+ * Sink-side companion to `LibraryProfileSinkGatePass` (#232, canonical
+ * #112, shipped 3.152.0). Where #112 drops entire `SinkType`s under
+ * `library/*` (currently `log_injection`), this pass narrows the
+ * `xss` `SinkType` on a per-receiver-class basis: `TaintSink`s whose
+ * simple-name receiver class is in `XSS_NON_HTML_OUTPUT_CLASSES` are
+ * dropped before flow generation.
+ *
+ * Motivation:
+ *
+ *   The current `xss` sink class treats any `String`-valued method
+ *   receiver as a potential CWE-79 sink. Under `library/*` this
+ *   over-collects by ~100x. A 10-repo Tier 2 library-profile audit
+ *   (cognium-ai#189 §3, 2026-07) surfaced 507 H+C findings across
+ *   hutool, xdocreport, languagetool, AndroidAsync, Sentinel,
+ *   mybatis-plus, flyingsaucer, jedis — **zero** of which are actual
+ *   HTML-output sinks. The 507 decompose as:
+ *
+ *     - 149 (29.4%) `StringBuilder.append` / `StringBuffer.append` —
+ *       in-memory buffers, not HTML output.
+ *     - 66  (13.0%) `PrintStream.println` on `System.out` / `System.err` —
+ *       CLI stdio, not HTML output.
+ *     - 43  ( 8.5%) `response.body()` on `HttpRequest` / `HttpResponse` —
+ *       outbound HTTP client body READ — a taint SOURCE, not sink.
+ *     - 27  ( 5.3%) `response.end()` header terminator (AndroidAsync).
+ *     - 26  ( 5.1%) `HttpSession.setAttribute` — session store IO.
+ *     - 33  ( 6.5%) `write` on jedis wire-protocol writers.
+ *     - 91  (17.9%) other (Loggers, JSON parsers, Netflix Zuul
+ *       `RequestContext`, Sentinel `Context`).
+ *
+ *   All eight buckets are `library/*` internal buffer / IO / logger /
+ *   HTTP-client / router / JSON-parser plumbing. No web-app response
+ *   writes reach `HttpServletResponse.getWriter().println(taint)` or
+ *   a template renderer.
+ *
+ * Where #112 targets the whole vulnerability class (`log_injection`
+ * is off-topic for every library), CWE-79 is legitimate for library
+ * code that writes HTML (Thymeleaf, FreeMarker, Velocity, JSP
+ * fragments); it is only the RECEIVER SHAPE that is off-topic.
+ * Hence a class-level allowlist would over-drop and a class-level
+ * denylist is the calibrated response.
+ *
+ * Pipeline slot: runs immediately after `LibraryProfileSinkGatePass`
+ * (#112) and before `TaintPropagationPass` (so no dropped sink ever
+ * reaches the flow generators). Ordering ensures both library-profile
+ * gates fire under the same predicate before flow synthesis.
+ *
+ * Guardrails:
+ *   - Pass is a no-op when `graph.ir.meta.projectProfile` is absent,
+ *     `'unknown'`, or does not start with `library/`. Callers that do
+ *     not opt in to profile detection get the unmodified sink list.
+ *   - Only `xss`-type sinks are eligible; every other `SinkType`
+ *     (`sql_injection`, `command_injection`, `path_traversal`,
+ *     `deserialization`, …) is preserved unconditionally.
+ *   - The class denylist is intentionally conservative: it only
+ *     targets classes measured with zero HTML-output flows across the
+ *     10-repo cohort. `HttpServletResponse`, `JspWriter`,
+ *     `ServletOutputStream`, `PrintWriter` (in servlet context),
+ *     template engines (Thymeleaf `SpringWebContext`, FreeMarker
+ *     `Environment`, Velocity `VelocityContext`) are **not** on the
+ *     denylist and continue to fire.
+ *   - Guarded on `disabledPasses.has('library-profile-xss-gate')` at
+ *     the pipeline registration site.
+ *
+ * Reference:
+ *   - cognium-dev#244 — this ticket.
+ *   - cognium-dev#232 (#112, 3.152.0) — sink-side profile gate template.
+ *   - cognium-ai#189 §3 — Tier 2 library-profile CWE-79 audit.
+ *   - `docs/ARCHITECTURE.md` ADR-011.
+ */
+import type { AnalysisPass, PassContext } from '../../graph/analysis-pass.js';
+import type { ProjectProfile } from '../../types/index.js';
+export interface LibraryProfileXssGateResult {
+    /**
+     * Resolved `ProjectProfile` observed on `graph.ir.meta.projectProfile`
+     * at the time this pass ran. `undefined` when no profile was
+     * supplied by the caller.
+     */
+    profile: ProjectProfile | undefined;
+    /**
+     * Whether the profile matched the library-shape trigger and the
+     * gate was applied. `false` for every non-library shape and for
+     * `'unknown'` / absent profiles.
+     */
+    applied: boolean;
+    /**
+     * Number of `xss` sinks removed from the authoritative sink list.
+     * Zero when `applied === false`.
+     */
+    dropped: number;
+    /**
+     * Breakdown of drops by receiver class (simple name). Empty object
+     * when `applied === false` or when no drops fired.
+     */
+    droppedByClass: Record<string, number>;
+}
+export declare class LibraryProfileXssGatePass implements AnalysisPass<LibraryProfileXssGateResult> {
+    readonly name = "library-profile-xss-gate";
+    readonly category: "security";
+    run(ctx: PassContext): LibraryProfileXssGateResult;
+}
+//# sourceMappingURL=library-profile-xss-gate-pass.d.ts.map

package/dist/analysis/passes/library-profile-xss-gate-pass.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-profile-xss-gate-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-xss-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAa,MAAM,sBAAsB,CAAC;AA6DtE,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,OAAO,EAAE,cAAc,GAAG,SAAS,CAAC;IACpC;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAaD,qBAAa,yBACX,YAAW,YAAY,CAAC,2BAA2B,CAAC;IAEpD,QAAQ,CAAC,IAAI,8BAA8B;IAC3C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,2BAA2B;CA0DnD"}

package/dist/analysis/passes/library-profile-xss-gate-pass.js

@@ -0,0 +1,196 @@
+/**
+ * LibraryProfileXssGatePass — cognium-dev #244
+ *
+ * Sink-side companion to `LibraryProfileSinkGatePass` (#232, canonical
+ * #112, shipped 3.152.0). Where #112 drops entire `SinkType`s under
+ * `library/*` (currently `log_injection`), this pass narrows the
+ * `xss` `SinkType` on a per-receiver-class basis: `TaintSink`s whose
+ * simple-name receiver class is in `XSS_NON_HTML_OUTPUT_CLASSES` are
+ * dropped before flow generation.
+ *
+ * Motivation:
+ *
+ *   The current `xss` sink class treats any `String`-valued method
+ *   receiver as a potential CWE-79 sink. Under `library/*` this
+ *   over-collects by ~100x. A 10-repo Tier 2 library-profile audit
+ *   (cognium-ai#189 §3, 2026-07) surfaced 507 H+C findings across
+ *   hutool, xdocreport, languagetool, AndroidAsync, Sentinel,
+ *   mybatis-plus, flyingsaucer, jedis — **zero** of which are actual
+ *   HTML-output sinks. The 507 decompose as:
+ *
+ *     - 149 (29.4%) `StringBuilder.append` / `StringBuffer.append` —
+ *       in-memory buffers, not HTML output.
+ *     - 66  (13.0%) `PrintStream.println` on `System.out` / `System.err` —
+ *       CLI stdio, not HTML output.
+ *     - 43  ( 8.5%) `response.body()` on `HttpRequest` / `HttpResponse` —
+ *       outbound HTTP client body READ — a taint SOURCE, not sink.
+ *     - 27  ( 5.3%) `response.end()` header terminator (AndroidAsync).
+ *     - 26  ( 5.1%) `HttpSession.setAttribute` — session store IO.
+ *     - 33  ( 6.5%) `write` on jedis wire-protocol writers.
+ *     - 91  (17.9%) other (Loggers, JSON parsers, Netflix Zuul
+ *       `RequestContext`, Sentinel `Context`).
+ *
+ *   All eight buckets are `library/*` internal buffer / IO / logger /
+ *   HTTP-client / router / JSON-parser plumbing. No web-app response
+ *   writes reach `HttpServletResponse.getWriter().println(taint)` or
+ *   a template renderer.
+ *
+ * Where #112 targets the whole vulnerability class (`log_injection`
+ * is off-topic for every library), CWE-79 is legitimate for library
+ * code that writes HTML (Thymeleaf, FreeMarker, Velocity, JSP
+ * fragments); it is only the RECEIVER SHAPE that is off-topic.
+ * Hence a class-level allowlist would over-drop and a class-level
+ * denylist is the calibrated response.
+ *
+ * Pipeline slot: runs immediately after `LibraryProfileSinkGatePass`
+ * (#112) and before `TaintPropagationPass` (so no dropped sink ever
+ * reaches the flow generators). Ordering ensures both library-profile
+ * gates fire under the same predicate before flow synthesis.
+ *
+ * Guardrails:
+ *   - Pass is a no-op when `graph.ir.meta.projectProfile` is absent,
+ *     `'unknown'`, or does not start with `library/`. Callers that do
+ *     not opt in to profile detection get the unmodified sink list.
+ *   - Only `xss`-type sinks are eligible; every other `SinkType`
+ *     (`sql_injection`, `command_injection`, `path_traversal`,
+ *     `deserialization`, …) is preserved unconditionally.
+ *   - The class denylist is intentionally conservative: it only
+ *     targets classes measured with zero HTML-output flows across the
+ *     10-repo cohort. `HttpServletResponse`, `JspWriter`,
+ *     `ServletOutputStream`, `PrintWriter` (in servlet context),
+ *     template engines (Thymeleaf `SpringWebContext`, FreeMarker
+ *     `Environment`, Velocity `VelocityContext`) are **not** on the
+ *     denylist and continue to fire.
+ *   - Guarded on `disabledPasses.has('library-profile-xss-gate')` at
+ *     the pipeline registration site.
+ *
+ * Reference:
+ *   - cognium-dev#244 — this ticket.
+ *   - cognium-dev#232 (#112, 3.152.0) — sink-side profile gate template.
+ *   - cognium-ai#189 §3 — Tier 2 library-profile CWE-79 audit.
+ *   - `docs/ARCHITECTURE.md` ADR-011.
+ */
+/**
+ * Simple-name receiver classes for which `xss` sinks are dropped
+ * under `library/*` profile. Each entry was measured with zero
+ * true-positive HTML-output flows across the 10-repo Tier 2 cohort
+ * (cognium-ai#189 §3, 2026-07).
+ *
+ * Extending this set is a deliberate, reviewable change. Adding an
+ * entry risks false-negative regressions on the OWASP Benchmark
+ * Java, SecuriBench Micro, and Juliet CWE-79 recall guards.
+ */
+const XSS_NON_HTML_OUTPUT_CLASSES = new Set([
+    // In-memory buffers — no HTML output surface.
+    'StringBuilder',
+    'StringBuffer',
+    'CharArrayWriter',
+    'ByteArrayOutputStream',
+    // CLI stdio — CLI apps, not web response bodies.
+    'PrintStream',
+    'System',
+    // HTTP client builders — these are taint SOURCES (outbound reads),
+    // not XSS sinks. `response.body()`, `.post()`, `.get()` on
+    // hutool `HttpRequest` / `HttpResponse` reach us as sink
+    // matches only because xss.yaml catches String-valued receivers.
+    'HttpRequest',
+    'HttpRequestBuilder',
+    'HttpResponse',
+    // Servlet non-body IO. `HttpSession.setAttribute`, `HttpSession.putValue`,
+    // `HttpServletRequest.setAttribute` are session/request attribute
+    // IO, not HTML output. Under `library/*` there is no JSP renderer
+    // reflecting them back. `HttpServletResponse` itself is NOT on
+    // this list — its writers are genuine XSS sinks.
+    'HttpSession',
+    'ServletRequest',
+    'HttpServletRequest',
+    // Wire-protocol writers (jedis internal).
+    'RedisOutputStream',
+    'SafeEncoder',
+    'RESP2',
+    'Protocol',
+    // JSON parsers — these read JSON into POJOs. Source, not sink.
+    'JSONUtil',
+    'JSON',
+    'ObjectMapper',
+    'JsonReader',
+    // Loggers — log injection is CWE-117 (already covered by #112);
+    // these appear here because xss.yaml has a String-valued catch-all
+    // that hits Logger receivers.
+    'Logger',
+    'LoggerFactory',
+    'Log',
+    'Slf4jLogger',
+    // Router / interceptor context stores. Zuul `RequestContext`,
+    // Sentinel `Context` are internal request-processing state, not
+    // HTML output.
+    'RequestContext',
+    'Context',
+]);
+/**
+ * Returns true when the resolved profile begins with `library/`
+ * (i.e. any `library/production`, `library/dev`, `library/sample`,
+ * `library/benchmark`, `library/test` environment binding).
+ * `'unknown'` and non-library shapes return false.
+ */
+function isLibraryShape(profile) {
+    if (!profile || profile === 'unknown')
+        return false;
+    return profile.startsWith('library/');
+}
+export class LibraryProfileXssGatePass {
+    name = 'library-profile-xss-gate';
+    category = 'security';
+    run(ctx) {
+        const { graph } = ctx;
+        const profile = graph.ir.meta.projectProfile;
+        if (!isLibraryShape(profile)) {
+            return {
+                profile,
+                applied: false,
+                dropped: 0,
+                droppedByClass: {},
+            };
+        }
+        // Authoritative sink list mirrors the fetch pattern in
+        // `LibraryProfileSinkGatePass` and `SinkSemanticsPass`: prefer
+        // `SinkFilterResult.sinks` (what `analyzer.ts` assembles the
+        // final `taint.sinks` from), fall back to `graph.ir.taint.sinks`
+        // for stand-alone unit tests that don't run `SinkFilterPass`.
+        const sinks = ctx.hasResult('sink-filter')
+            ? ctx.getResult('sink-filter').sinks
+            : graph.ir.taint.sinks;
+        if (sinks.length === 0) {
+            return {
+                profile,
+                applied: true,
+                dropped: 0,
+                droppedByClass: {},
+            };
+        }
+        const droppedByClass = {};
+        const kept = [];
+        for (const sink of sinks) {
+            if (sink.type === 'xss' && sink.class && XSS_NON_HTML_OUTPUT_CLASSES.has(sink.class)) {
+                droppedByClass[sink.class] = (droppedByClass[sink.class] ?? 0) + 1;
+                continue;
+            }
+            kept.push(sink);
+        }
+        const dropped = sinks.length - kept.length;
+        // Mutate the array in place so downstream passes see the
+        // filtered list. Preserves array identity for any consumer that
+        // captured a reference before this pass ran.
+        if (dropped > 0) {
+            sinks.length = 0;
+            sinks.push(...kept);
+        }
+        return {
+            profile,
+            applied: true,
+            dropped,
+            droppedByClass,
+        };
+    }
+}
+//# sourceMappingURL=library-profile-xss-gate-pass.js.map

package/dist/analysis/passes/library-profile-xss-gate-pass.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-profile-xss-gate-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/library-profile-xss-gate-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAMH;;;;;;;;;GASG;AACH,MAAM,2BAA2B,GAAwB,IAAI,GAAG,CAAS;IACvE,8CAA8C;IAC9C,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,uBAAuB;IACvB,iDAAiD;IACjD,aAAa;IACb,QAAQ;IACR,mEAAmE;IACnE,2DAA2D;IAC3D,yDAAyD;IACzD,iEAAiE;IACjE,aAAa;IACb,oBAAoB;IACpB,cAAc;IACd,2EAA2E;IAC3E,kEAAkE;IAClE,kEAAkE;IAClE,+DAA+D;IAC/D,iDAAiD;IACjD,aAAa;IACb,gBAAgB;IAChB,oBAAoB;IACpB,0CAA0C;IAC1C,mBAAmB;IACnB,aAAa;IACb,OAAO;IACP,UAAU;IACV,+DAA+D;IAC/D,UAAU;IACV,MAAM;IACN,cAAc;IACd,YAAY;IACZ,gEAAgE;IAChE,mEAAmE;IACnE,8BAA8B;IAC9B,QAAQ;IACR,eAAe;IACf,KAAK;IACL,aAAa;IACb,8DAA8D;IAC9D,gEAAgE;IAChE,eAAe;IACf,gBAAgB;IAChB,SAAS;CACV,CAAC,CAAC;AA2BH;;;;;GAKG;AACH,SAAS,cAAc,CAAC,OAAmC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,OAAO,yBAAyB;IAG3B,IAAI,GAAG,0BAA0B,CAAC;IAClC,QAAQ,GAAG,UAAmB,CAAC;IAExC,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC;QACtB,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC;QAE7C,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE,CAAC;gBACV,cAAc,EAAE,EAAE;aACnB,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,+DAA+D;QAC/D,6DAA6D;QAC7D,iEAAiE;QACjE,8DAA8D;QAC9D,MAAM,KAAK,GAAgB,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC;YACrD,CAAC,CAAC,GAAG,CAAC,SAAS,CAAmB,aAAa,CAAC,CAAC,KAAK;YACtD,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;QAEzB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,CAAC;gBACV,cAAc,EAAE,EAAE;aACnB,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAA2B,EAAE,CAAC;QAClD,MAAM,IAAI,GAAgB,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrF,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACnE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAE3C,yDAAyD;QACzD,gEAAgE;QAChE,6CAA6C;QAC7C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtB,CAAC;QAED,OAAO;YACL,OAAO;YACP,OAAO,EAAE,IAAI;YACb,OAAO;YACP,cAAc;SACf,CAAC;IACJ,CAAC;CACF"}

package/dist/analysis/require-entry-path.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Require-entry-path anchor (cognium-dev#234, ships 3.153.0).
+ *
+ * Post-pipeline, project-level helper that:
+ *   1. Annotates high+critical (H+C) taint findings with an
+ *      `entryPath[]` chain of methods traversed from a classified
+ *      Tier-1 entry point (Spring MVC handler, JAX-RS resource,
+ *      Servlet lifecycle method, Netty channel handler, `main(String[])`,
+ *      …) down to the finding's sink method.
+ *   2. Drops H+C findings under `application` / `server` / `cli` /
+ *      `plugin` / `unknown` project profiles when the reverse-BFS
+ *      conclusively returns no such chain — i.e. the finding lives on a
+ *      method that no HTTP / RPC / lifecycle entry point in the scan can
+ *      reach.
+ *
+ * # Why
+ *
+ * cognium-ai#189 §1 (2026-07 Tier-2 Java cohort — hutool, Sentinel,
+ * plantuml, mockserver) surfaced 1942 H+C findings on hutool with
+ * *zero* classified HTTP/RPC entry point and no reachable path from
+ * `main`. #236 (source-side profile gate, 3.151.0) and #232
+ * (sink-side profile gate, 3.152.0) each attacked the problem via
+ * profile-conditional per-file drops, but both leave the residual
+ * signal on files whose profile is `application/*` or `unknown` even
+ * though the enclosing method is manifestly unreachable from any
+ * classified boundary.
+ *
+ * This helper closes that hole: no entry point → no path from an
+ * entry point → no H+C finding. Every remaining H+C finding under
+ * `application/*` carries a demonstrable call chain from a real
+ * boundary as evidence, materialised on `entryPath[]` for consumers
+ * (CLI, SARIF, cognium-ai) to display.
+ *
+ * # Scope
+ *
+ * - Java only (relies on `classifyEntryPointTier`, which is Java-primary).
+ *   Non-Java files: pass-through, no annotation, no drop.
+ * - Project-level only. Per-file `analyze()` never runs this helper —
+ *   the reachability question is meaningful only across a full scan.
+ * - Only H+C findings from taint passes are candidates for drop. Metric
+ *   findings, `medium` / `low` taint findings, and findings without a
+ *   resolved containing method are always preserved.
+ *
+ * # Interaction with #236 / #232
+ *
+ * Both #236 and #232 fire when `projectProfile` starts with `library/`:
+ * the source / sink is dropped BEFORE the flow is materialised. This
+ * helper therefore no-ops under `library/*` (an already-dropped flow
+ * never reaches us) but still ANNOTATES findings with `entryPath[]`
+ * whenever a chain is available, so downstream consumers can see the
+ * anchor regardless of the drop decision.
+ *
+ * # Reference
+ *
+ * - cognium-dev#234 — this ticket.
+ * - cognium-dev#128 — entry-point tier classifier.
+ * - cognium-dev#236 (3.151.0) — source-side library-profile gate.
+ * - cognium-dev#232 (3.152.0) — sink-side library-profile gate.
+ * - cognium-ai#189  — Tier-2 Java cohort audit.
+ * - `docs/ARCHITECTURE.md` ADR-010.
+ */
+import type { CircleIR, ProjectProfile } from '../types/index.js';
+/** Rule identifier used for `disabledPasses` lookups. */
+export declare const RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
+export interface ApplyRequireEntryPathOptions {
+    /**
+     * Caller-resolved profile for each file. Same semantics as
+     * `AnalyzerOptions.projectProfile`. When absent, the helper treats
+     * every file as `'unknown'` — i.e. drops still apply.
+     */
+    projectProfile?: ProjectProfile | Map<string, ProjectProfile>;
+    /**
+     * Set of disabled pass ids (from `AnalyzerOptions.disabledPasses`).
+     * If it contains `'require-entry-path'`, the helper is a full no-op
+     * (no annotation, no drop).
+     */
+    disabledPasses?: ReadonlySet<string> | ReadonlyArray<string>;
+}
+/**
+ * Apply the entry-path gate + annotation to every file's findings in
+ * `fileAnalyses`, mutating each `analysis.findings` array in place.
+ *
+ * The mutation is idempotent — running twice produces the same result
+ * (BFS is deterministic; annotation always overwrites prior fields
+ * with the same values).
+ */
+export declare function applyRequireEntryPath(fileAnalyses: ReadonlyArray<{
+    file: string;
+    analysis: CircleIR;
+}>, options?: ApplyRequireEntryPathOptions): void;
+//# sourceMappingURL=require-entry-path.d.ts.map

package/dist/analysis/require-entry-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-entry-path.d.ts","sourceRoot":"","sources":["../../src/analysis/require-entry-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4DG;AAEH,OAAO,KAAK,EACV,QAAQ,EAER,cAAc,EAIf,MAAM,mBAAmB,CAAC;AAO3B,yDAAyD;AACzD,eAAO,MAAM,0BAA0B,uBAAuB,CAAC;AAe/D,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC9D;;;;OAIG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;CAC9D;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC,EACjE,OAAO,GAAE,4BAAiC,GACzC,IAAI,CA6CN"}