circle-ir 3.85.1 → 3.88.0

package/dist/analysis/entry-point-detection.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Entry-point tier classifier (cognium-dev#128).
+ *
+ * Deterministic, AST-based classification of a method's position relative
+ * to a program's *real* entry points (HTTP handlers, message-queue
+ * listeners, scheduled jobs, CLI main, etc.). Designed to drive the
+ * `interprocedural_param` source-suppression gate in `taint-matcher.ts`
+ * and `interprocedural-pass.ts` — preventing the speculative
+ * engine-emitted sources on Tier 3 (library API) methods from
+ * propagating through verification.
+ *
+ * # Why
+ *
+ * `taint-matcher.ts:218-237` currently emits an `interprocedural_param`
+ * source for every parameter of every method in a file, regardless of
+ * whether that method is reachable from a program entry point. On the
+ * top-25 Java OSS corpus this produces ~1,768 of 1,968 high-severity
+ * findings against `redis/jedis`'s `UnifiedJedis.executeCommand` /
+ * `Jedis.executeCommand` facade methods — pure signature amplification
+ * on a library that is called *by* its users, never *by* a network
+ * boundary.
+ *
+ * This classifier returns the tier of the enclosing method so callers
+ * (taint-matcher, interprocedural-pass) can drop the speculative source
+ * before it reaches the verifier.
+ *
+ * # Provenance
+ *
+ * Ported verbatim from
+ * `cognium-ai/circle-ir-ai/src/analysis/entry-point-detection.ts`
+ * (shipped in `circle-ir-ai@2.14.0`, 2026-06-21) — the same classifier
+ * that currently runs as a downstream `runMerge` gate in the
+ * cognium-ai stack. The downstream gate becomes a no-op once this
+ * pass is wired into `taint-matcher.ts:findSinks()`, after which it
+ * will be retired in a follow-up cognium-ai bump.
+ *
+ * No behavioral wiring in this commit — the file lands as a no-op
+ * (not yet consumed by any pass). Wiring + heuristic gap-closures
+ * (`*Util` / `*Utils` / `*Helper`, `*.template.*` / `*.engine.*`,
+ * JDK facade interface-implements via `TypeHierarchyResolver`) come
+ * in follow-up commits per the cognium-dev#128 Sprint 35 plan.
+ *
+ * # Tiers
+ *
+ * - **TIER_1_ENTRY_POINT** — Method itself is annotated as an entry
+ *   point (`@RequestMapping`, `@KafkaListener`, etc.), is a method of
+ *   an entry-point class (`@RestController`, JAX-RS `@Path` resource,
+ *   `extends HttpServlet`), or matches the `main(String[])` signature.
+ *   These methods *are* the trust boundary.
+ *
+ * - **TIER_2_REACHABLE** — Method called by a Tier 1 method (1-hop).
+ *   Not implemented in ship 1; requires `ProjectGraph` call-graph
+ *   traversal. Reserved by the `ctx.callGraph` parameter so the
+ *   classifier surface does not change when Tier 2 ships. Ship 1
+ *   classifies every non-Tier-1 Java method as Tier 3.
+ *
+ * - **TIER_3_LIBRARY_API** — Public method, no entry-point annotation,
+ *   no entry-point class context, no `main` signature. Library API
+ *   surface — callers validate, not us.
+ *
+ * - **TIER_UNKNOWN** — Non-Java language, or insufficient AST info to
+ *   classify. Callers should treat UNKNOWN as pass-through (no
+ *   filtering), so ship 1's Java-only scope does not affect Python /
+ *   Node / Go / Rust / Bash analysis.
+ *
+ * # Reference
+ *
+ * - cognium-dev#128 — entry-point-anchored taint sources.
+ * - `taint-matcher.ts:218-237` — speculative source emission site.
+ * - `interprocedural-pass.ts:137-146` — engine's awareness comment.
+ */
+import type { TypeInfo, MethodInfo } from '../types/index.js';
+export type EntryPointTier = 'TIER_1_ENTRY_POINT' | 'TIER_2_REACHABLE' | 'TIER_3_LIBRARY_API' | 'TIER_UNKNOWN';
+export interface EntryPointContext {
+    /** All TypeInfo records in this file. */
+    types?: ReadonlyArray<TypeInfo> | null;
+    /** Language from CircleIR.language (e.g. 'java', 'python'). */
+    language?: string | null;
+    /**
+     * Project-wide call graph — Tier 2 reachability. Reserved for a
+     * follow-up; ship 1 classifies every non-Tier-1 method as Tier 3.
+     */
+    callGraph?: unknown;
+}
+/**
+ * Classify a method's entry-point tier.
+ *
+ * Order:
+ *   1. UNKNOWN short-circuit for non-Java languages (ship 1 scope).
+ *   2. Library-facade short-circuit (#128 step 2) — `*Util` / `*Utils`
+ *      / `*Helper(s)` class name, `*.template|engine.*` package, or
+ *      direct JDK-facade `implements` → TIER_3, overriding any
+ *      spurious framework-shaped annotations on the type.
+ *   3. Method-level annotation match → TIER_1.
+ *   4. Class-level annotation match → TIER_1.
+ *   5. Supertype lifecycle method match → TIER_1.
+ *   6. `main(String[])` signature → TIER_1.
+ *   7. Tier 2 reachability (not implemented in ship 1).
+ *   8. Fallback → TIER_3_LIBRARY_API.
+ */
+export declare function classifyEntryPointTier(method: MethodInfo | undefined, enclosingType: TypeInfo | undefined, ctx: EntryPointContext): EntryPointTier;
+/**
+ * Source-suppression predicate for callers that emit speculative taint
+ * sources from method-parameter shape alone.
+ *
+ * Returns true iff the source should be DROPPED. Only fires on
+ * `interprocedural_param` sources whose enclosing method classifies
+ * as TIER_3_LIBRARY_API. LLM-discovered sources (which carry other
+ * type tags) and statically-confirmed framework sources are never
+ * gated by this predicate.
+ *
+ * Intentionally narrow: post-verify severity rubrics elsewhere in the
+ * pipeline still apply to whatever passes this gate. The two filters
+ * are layered, not overlapping.
+ */
+export declare function shouldGateInterproceduralParam(sourceType: string | null | undefined, enclosingMethod: MethodInfo | undefined, enclosingType: TypeInfo | undefined, ctx: EntryPointContext): boolean;
+//# sourceMappingURL=entry-point-detection.d.ts.map

package/dist/analysis/entry-point-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-point-detection.d.ts","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM9D,MAAM,MAAM,cAAc,GACtB,oBAAoB,GACpB,kBAAkB,GAClB,oBAAoB,GACpB,cAAc,CAAC;AAEnB,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACvC,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAmQD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,UAAU,GAAG,SAAS,EAC9B,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,iBAAiB,GACrB,cAAc,CAsChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,UAAU,GAAG,SAAS,EACvC,aAAa,EAAE,QAAQ,GAAG,SAAS,EACnC,GAAG,EAAE,iBAAiB,GACrB,OAAO,CAKT"}

package/dist/analysis/entry-point-detection.js

@@ -0,0 +1,395 @@
+/**
+ * Entry-point tier classifier (cognium-dev#128).
+ *
+ * Deterministic, AST-based classification of a method's position relative
+ * to a program's *real* entry points (HTTP handlers, message-queue
+ * listeners, scheduled jobs, CLI main, etc.). Designed to drive the
+ * `interprocedural_param` source-suppression gate in `taint-matcher.ts`
+ * and `interprocedural-pass.ts` — preventing the speculative
+ * engine-emitted sources on Tier 3 (library API) methods from
+ * propagating through verification.
+ *
+ * # Why
+ *
+ * `taint-matcher.ts:218-237` currently emits an `interprocedural_param`
+ * source for every parameter of every method in a file, regardless of
+ * whether that method is reachable from a program entry point. On the
+ * top-25 Java OSS corpus this produces ~1,768 of 1,968 high-severity
+ * findings against `redis/jedis`'s `UnifiedJedis.executeCommand` /
+ * `Jedis.executeCommand` facade methods — pure signature amplification
+ * on a library that is called *by* its users, never *by* a network
+ * boundary.
+ *
+ * This classifier returns the tier of the enclosing method so callers
+ * (taint-matcher, interprocedural-pass) can drop the speculative source
+ * before it reaches the verifier.
+ *
+ * # Provenance
+ *
+ * Ported verbatim from
+ * `cognium-ai/circle-ir-ai/src/analysis/entry-point-detection.ts`
+ * (shipped in `circle-ir-ai@2.14.0`, 2026-06-21) — the same classifier
+ * that currently runs as a downstream `runMerge` gate in the
+ * cognium-ai stack. The downstream gate becomes a no-op once this
+ * pass is wired into `taint-matcher.ts:findSinks()`, after which it
+ * will be retired in a follow-up cognium-ai bump.
+ *
+ * No behavioral wiring in this commit — the file lands as a no-op
+ * (not yet consumed by any pass). Wiring + heuristic gap-closures
+ * (`*Util` / `*Utils` / `*Helper`, `*.template.*` / `*.engine.*`,
+ * JDK facade interface-implements via `TypeHierarchyResolver`) come
+ * in follow-up commits per the cognium-dev#128 Sprint 35 plan.
+ *
+ * # Tiers
+ *
+ * - **TIER_1_ENTRY_POINT** — Method itself is annotated as an entry
+ *   point (`@RequestMapping`, `@KafkaListener`, etc.), is a method of
+ *   an entry-point class (`@RestController`, JAX-RS `@Path` resource,
+ *   `extends HttpServlet`), or matches the `main(String[])` signature.
+ *   These methods *are* the trust boundary.
+ *
+ * - **TIER_2_REACHABLE** — Method called by a Tier 1 method (1-hop).
+ *   Not implemented in ship 1; requires `ProjectGraph` call-graph
+ *   traversal. Reserved by the `ctx.callGraph` parameter so the
+ *   classifier surface does not change when Tier 2 ships. Ship 1
+ *   classifies every non-Tier-1 Java method as Tier 3.
+ *
+ * - **TIER_3_LIBRARY_API** — Public method, no entry-point annotation,
+ *   no entry-point class context, no `main` signature. Library API
+ *   surface — callers validate, not us.
+ *
+ * - **TIER_UNKNOWN** — Non-Java language, or insufficient AST info to
+ *   classify. Callers should treat UNKNOWN as pass-through (no
+ *   filtering), so ship 1's Java-only scope does not affect Python /
+ *   Node / Go / Rust / Bash analysis.
+ *
+ * # Reference
+ *
+ * - cognium-dev#128 — entry-point-anchored taint sources.
+ * - `taint-matcher.ts:218-237` — speculative source emission site.
+ * - `interprocedural-pass.ts:137-146` — engine's awareness comment.
+ */
+// ---------------------------------------------------------------------------
+// Tier 1 annotation tables (Java, ship 1)
+// ---------------------------------------------------------------------------
+/**
+ * Method-level annotations that make the method itself an entry point.
+ * Simple-name match; any args / generics are stripped before lookup.
+ */
+const TIER_1_METHOD_ANNOTATIONS = new Set([
+    // Spring MVC
+    'RequestMapping',
+    'GetMapping',
+    'PostMapping',
+    'PutMapping',
+    'DeleteMapping',
+    'PatchMapping',
+    // Spring messaging / WebSocket
+    'MessageMapping',
+    'SubscribeMapping',
+    // Spring messaging listeners
+    'KafkaListener',
+    'KafkaHandler',
+    'RabbitListener',
+    'RabbitHandler',
+    'JmsListener',
+    'StreamListener',
+    // Spring Cloud AWS
+    'SqsListener',
+    'SqsHandler',
+    // Spring application events (borderline — inclusive in ship 1)
+    'EventListener',
+    // CRON / scheduled
+    'Scheduled',
+    // JAX-RS
+    'Path',
+    'GET',
+    'POST',
+    'PUT',
+    'DELETE',
+    'PATCH',
+    'HEAD',
+    'OPTIONS',
+]);
+/**
+ * Class-level annotations that make every public method of the class
+ * a Tier 1 entry point. Spring MVC / JAX-RS / Servlet 3 conventions.
+ */
+const TIER_1_CLASS_ANNOTATIONS = new Set([
+    // Spring MVC
+    'RestController',
+    'Controller',
+    // JAX-RS resource class
+    'Path',
+    // Servlet 3.0 annotation-based servlet
+    'WebServlet',
+    // JSR-356 WebSocket endpoint
+    'ServerEndpoint',
+    // Declarative HTTP client (borderline — inclusive in ship 1; contract-defined
+    // parameter shapes are downstream-relevant trust boundaries)
+    'FeignClient',
+]);
+/**
+ * Class names (matched via `implements` or `extends`) whose lifecycle
+ * methods are Tier 1. For each, the set of lifecycle method names that
+ * qualify.
+ */
+const TIER_1_BY_SUPERTYPE = new Map([
+    // Servlet API
+    ['HttpServlet', new Set(['doGet', 'doPost', 'doPut', 'doDelete', 'doHead', 'doOptions', 'doTrace', 'service'])],
+    ['GenericServlet', new Set(['service'])],
+    ['Filter', new Set(['doFilter'])],
+    // Spring web
+    ['HandlerInterceptor', new Set(['preHandle', 'postHandle', 'afterCompletion'])],
+    ['AsyncHandlerInterceptor', new Set(['preHandle', 'postHandle', 'afterCompletion', 'afterConcurrentHandlingStarted'])],
+    // Spring boot CLI entry points
+    ['CommandLineRunner', new Set(['run'])],
+    ['ApplicationRunner', new Set(['run'])],
+]);
+// ---------------------------------------------------------------------------
+// Tier 3 strengthening — library-facade shape heuristics
+// (cognium-dev#128 step 2)
+// ---------------------------------------------------------------------------
+/**
+ * Class-name suffixes that mark a type as a static-utility / helper
+ * facade. Hutool's `RuntimeUtil`, Apache Commons' `StringUtils`,
+ * custom `*Helper` wrappers — all called BY user code, never invoked
+ * AT a network trust boundary. Their parameters are not
+ * entry-point-anchored taint sources.
+ *
+ * Matched case-sensitively against the suffix of `TypeInfo.name` with
+ * a length guard (suffix length must be strictly less than class
+ * name length) so a bare-suffix class like `Util` itself is not
+ * caught.
+ */
+const TIER_3_CLASS_SUFFIXES = [
+    'Util', 'Utils', 'Helper', 'Helpers',
+];
+/**
+ * Package fragments that mark a type as part of a templating / engine
+ * library surface. FreeMarker's `freemarker.template.*`, Apache
+ * Velocity's `org.apache.velocity.template`, custom `*.engine.*`
+ * wrappers — facades over user-supplied template content, not
+ * network entry points.
+ *
+ * Matched against the dotted package name with sentinel dots on both
+ * sides so `.template.` matches `freemarker.template.Configuration`
+ * but not a hypothetical `freemarker.templatemap.Foo`.
+ */
+const TIER_3_PACKAGE_FRAGMENTS = [
+    '.template.', '.templates.', '.engine.', '.engines.',
+];
+/**
+ * JDK collection / iterator / serialization interfaces. A type that
+ * directly implements one of these is a library data-structure facade
+ * — its methods are invoked BY user code, not AT a trust boundary.
+ *
+ * Direct-`implements` only — no transitive `TypeHierarchyResolver`
+ * traversal in ship 1; that variant is deferred. The current
+ * predicate is sufficient for the #128 cluster and avoids dragging
+ * the resolver into a leaf classifier.
+ */
+const TIER_3_JDK_FACADE_INTERFACES = new Set([
+    // Collection root + common containers
+    'Collection', 'List', 'Set', 'Map', 'Queue', 'Deque',
+    'SortedSet', 'SortedMap', 'NavigableSet', 'NavigableMap',
+    // Iteration / ordering / equality contracts
+    'Iterator', 'Iterable', 'ListIterator',
+    'Comparator', 'Comparable',
+    // Serialization / cloning contracts
+    'Serializable', 'Externalizable', 'Cloneable',
+]);
+function classNameLooksLikeUtility(name) {
+    if (!name)
+        return false;
+    for (const suffix of TIER_3_CLASS_SUFFIXES) {
+        if (name.length > suffix.length && name.endsWith(suffix))
+            return true;
+    }
+    return false;
+}
+function packageLooksLikeTemplateOrEngine(pkg) {
+    if (!pkg)
+        return false;
+    const padded = `.${pkg}.`;
+    for (const frag of TIER_3_PACKAGE_FRAGMENTS) {
+        if (padded.includes(frag))
+            return true;
+    }
+    return false;
+}
+function implementsJdkFacade(t) {
+    if (!t)
+        return false;
+    for (const impl of t.implements ?? []) {
+        if (TIER_3_JDK_FACADE_INTERFACES.has(simpleTypeName(impl)))
+            return true;
+    }
+    return false;
+}
+/**
+ * Returns true if the enclosing type's shape (class name suffix,
+ * package fragment, direct JDK-facade `implements`) is unmistakably
+ * a library / utility / engine facade.
+ *
+ * Used as a TIER_3 short-circuit that runs BEFORE Tier-1 annotation
+ * detection — conservative FP-reducing choice for the #128 cluster
+ * (`RuntimeUtil.exec` ×3 + `FreemarkerEngine` slipping through the
+ * downstream gate). Any one of the three predicates flips the
+ * classification.
+ *
+ * Trade-off: a real entry point class accidentally named with a
+ * `*Util` suffix AND carrying a Tier-1 annotation would be
+ * incorrectly downgraded. This pattern is vanishingly rare in
+ * practice (utility classes don't carry `@RestController`); the
+ * false-positive reduction on the real cluster outweighs the
+ * theoretical recall loss.
+ */
+function classShapeIsLibraryFacade(enclosingType) {
+    if (!enclosingType)
+        return false;
+    if (classNameLooksLikeUtility(enclosingType.name))
+        return true;
+    if (packageLooksLikeTemplateOrEngine(enclosingType.package))
+        return true;
+    if (implementsJdkFacade(enclosingType))
+        return true;
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Returns true if `annotations` contains any of the targets. Tolerates
+ * the `@Annotation(args)` and `Annotation<T>` forms.
+ */
+function annotationsInclude(annotations, targets) {
+    if (!annotations || annotations.length === 0)
+        return false;
+    for (const raw of annotations) {
+        const simple = raw
+            .replace(/^@/, '')
+            .replace(/[<(].*$/, '')
+            .trim();
+        if (targets.has(simple))
+            return true;
+    }
+    return false;
+}
+/**
+ * Strip generic parameters from a type reference (`Foo<Bar>` → `Foo`).
+ */
+function simpleTypeName(ref) {
+    return ref.replace(/<.*$/, '').trim();
+}
+/**
+ * Returns true if the method signature looks like `public static void main(String[])`.
+ * We don't have full signature info on every codebase, so this is best-effort
+ * based on name + a single `String[]` / `String...` parameter.
+ */
+function looksLikeMainMethod(method) {
+    if (method.name !== 'main')
+        return false;
+    const params = method.parameters ?? [];
+    if (params.length !== 1)
+        return false;
+    const t = (params[0].type ?? '').replace(/\s+/g, '');
+    return t === 'String[]' || t === 'String...' || t === 'java.lang.String[]';
+}
+/**
+ * Returns true if the enclosing type is a Servlet / Filter / Interceptor
+ * subclass AND the method name matches a lifecycle entry-point of that
+ * supertype.
+ */
+function methodIsSupertypeLifecycleEntryPoint(method, enclosingType) {
+    if (!method.name)
+        return false;
+    if (!enclosingType)
+        return false;
+    const candidates = [];
+    if (enclosingType.extends)
+        candidates.push(simpleTypeName(enclosingType.extends));
+    for (const i of enclosingType.implements ?? [])
+        candidates.push(simpleTypeName(i));
+    for (const supertype of candidates) {
+        const lifecycleMethods = TIER_1_BY_SUPERTYPE.get(supertype);
+        if (lifecycleMethods?.has(method.name))
+            return true;
+    }
+    return false;
+}
+// ---------------------------------------------------------------------------
+// Public classifier
+// ---------------------------------------------------------------------------
+/**
+ * Classify a method's entry-point tier.
+ *
+ * Order:
+ *   1. UNKNOWN short-circuit for non-Java languages (ship 1 scope).
+ *   2. Library-facade short-circuit (#128 step 2) — `*Util` / `*Utils`
+ *      / `*Helper(s)` class name, `*.template|engine.*` package, or
+ *      direct JDK-facade `implements` → TIER_3, overriding any
+ *      spurious framework-shaped annotations on the type.
+ *   3. Method-level annotation match → TIER_1.
+ *   4. Class-level annotation match → TIER_1.
+ *   5. Supertype lifecycle method match → TIER_1.
+ *   6. `main(String[])` signature → TIER_1.
+ *   7. Tier 2 reachability (not implemented in ship 1).
+ *   8. Fallback → TIER_3_LIBRARY_API.
+ */
+export function classifyEntryPointTier(method, enclosingType, ctx) {
+    // Ship 1: Java only. Other languages route via UNKNOWN = pass-through.
+    const language = (ctx.language ?? '').toLowerCase();
+    if (language !== 'java')
+        return 'TIER_UNKNOWN';
+    if (!method)
+        return 'TIER_UNKNOWN';
+    // 2. Library-facade short-circuit. Runs BEFORE Tier-1 annotation
+    // detection — see `classShapeIsLibraryFacade` for the trade-off.
+    if (classShapeIsLibraryFacade(enclosingType)) {
+        return 'TIER_3_LIBRARY_API';
+    }
+    // 3. Method-level annotation
+    if (annotationsInclude(method.annotations, TIER_1_METHOD_ANNOTATIONS)) {
+        return 'TIER_1_ENTRY_POINT';
+    }
+    // 4. Class-level annotation (every public method of a controller is TIER_1)
+    if (enclosingType && annotationsInclude(enclosingType.annotations, TIER_1_CLASS_ANNOTATIONS)) {
+        return 'TIER_1_ENTRY_POINT';
+    }
+    // 5. Supertype lifecycle method
+    if (methodIsSupertypeLifecycleEntryPoint(method, enclosingType)) {
+        return 'TIER_1_ENTRY_POINT';
+    }
+    // 6. `public static void main(String[])`
+    if (looksLikeMainMethod(method)) {
+        return 'TIER_1_ENTRY_POINT';
+    }
+    // 7. Tier 2 reachability — deferred. See header doc.
+    // (Intentionally no fall-through here; ctx.callGraph is reserved.)
+    // 8. Fallback
+    return 'TIER_3_LIBRARY_API';
+}
+/**
+ * Source-suppression predicate for callers that emit speculative taint
+ * sources from method-parameter shape alone.
+ *
+ * Returns true iff the source should be DROPPED. Only fires on
+ * `interprocedural_param` sources whose enclosing method classifies
+ * as TIER_3_LIBRARY_API. LLM-discovered sources (which carry other
+ * type tags) and statically-confirmed framework sources are never
+ * gated by this predicate.
+ *
+ * Intentionally narrow: post-verify severity rubrics elsewhere in the
+ * pipeline still apply to whatever passes this gate. The two filters
+ * are layered, not overlapping.
+ */
+export function shouldGateInterproceduralParam(sourceType, enclosingMethod, enclosingType, ctx) {
+    if (sourceType !== 'interprocedural_param')
+        return false;
+    if (!enclosingMethod)
+        return false; // can't classify → preserve recall
+    const tier = classifyEntryPointTier(enclosingMethod, enclosingType, ctx);
+    return tier === 'TIER_3_LIBRARY_API';
+}
+//# sourceMappingURL=entry-point-detection.js.map

package/dist/analysis/entry-point-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-point-detection.js","sourceRoot":"","sources":["../../src/analysis/entry-point-detection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsEG;AA0BH,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,cAAc;IACd,+BAA+B;IAC/B,gBAAgB;IAChB,kBAAkB;IAClB,6BAA6B;IAC7B,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,mBAAmB;IACnB,aAAa;IACb,YAAY;IACZ,+DAA+D;IAC/D,eAAe;IACf,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,wBAAwB;IACxB,MAAM;IACN,uCAAuC;IACvC,YAAY;IACZ,6BAA6B;IAC7B,gBAAgB;IAChB,8EAA8E;IAC9E,6DAA6D;IAC7D,aAAa;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,mBAAmB,GAA6C,IAAI,GAAG,CAAC;IAC5E,cAAc;IACd,CAAC,aAAa,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/G,CAAC,gBAAgB,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACjC,aAAa;IACb,CAAC,oBAAoB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/E,CAAC,yBAAyB,EAAE,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,gCAAgC,CAAC,CAAC,CAAC;IACtH,+BAA+B;IAC/B,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC,mBAAmB,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;CACxC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,yDAAyD;AACzD,2BAA2B;AAC3B,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,qBAAqB,GAA0B;IACnD,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS;CACrC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,wBAAwB,GAA0B;IACtD,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW;CACrD,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IAChE,sCAAsC;IACtC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO;IACpD,WAAW,EAAE,WAAW,EAAE,cAAc,EAAE,cAAc;IACxD,4CAA4C;IAC5C,UAAU,EAAE,UAAU,EAAE,cAAc;IACtC,YAAY,EAAE,YAAY;IAC1B,oCAAoC;IACpC,cAAc,EAAE,gBAAgB,EAAE,WAAW;CAC9C,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,IAAwB;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,gCAAgC,CAAC,GAA8B;IACtE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,GAAG,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,wBAAwB,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,CAAuB;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,4BAA4B,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,yBAAyB,CAAC,aAAmC;IACpE,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,yBAAyB,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,IAAI,gCAAgC,CAAC,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACzE,IAAI,mBAAmB,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CACzB,WAA8C,EAC9C,OAA4B;IAE5B,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,GAAG;aACf,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;aACjB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;aACtB,IAAI,EAAE,CAAC;QACV,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,MAAkB;IAC7C,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,oBAAoB,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,oCAAoC,CAC3C,MAAkB,EAClB,aAAmC;IAEnC,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACjC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,aAAa,CAAC,OAAO;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,UAAU,IAAI,EAAE;QAAE,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,aAAmC,EACnC,GAAsB;IAEtB,uEAAuE;IACvE,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,IAAI,QAAQ,KAAK,MAAM;QAAE,OAAO,cAAc,CAAC;IAE/C,IAAI,CAAC,MAAM;QAAE,OAAO,cAAc,CAAC;IAEnC,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,yBAAyB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC7C,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,6BAA6B;IAC7B,IAAI,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE,CAAC;QACtE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,4EAA4E;IAC5E,IAAI,aAAa,IAAI,kBAAkB,CAAC,aAAa,CAAC,WAAW,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC7F,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,gCAAgC;IAChC,IAAI,oCAAoC,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAChE,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,yCAAyC;IACzC,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,qDAAqD;IACrD,mEAAmE;IAEnE,cAAc;IACd,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAAqC,EACrC,eAAuC,EACvC,aAAmC,EACnC,GAAsB;IAEtB,IAAI,UAAU,KAAK,uBAAuB;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAC,CAAC,mCAAmC;IACvE,MAAM,IAAI,GAAG,sBAAsB,CAAC,eAAe,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,IAAI,KAAK,oBAAoB,CAAC;AACvC,CAAC"}

package/dist/analysis/findings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,GAAG,EAEH,OAAO,EAEP,QAAQ,EACT,MAAM,mBAAmB,CAAC;AAQ3B;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,GACf,OAAO,EAAE,CAkGX;AAiCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CA4BlF"}
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,SAAS,EACT,GAAG,EAEH,OAAO,EAEP,QAAQ,EACT,MAAM,mBAAmB,CAAC;AAQ3B;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,WAAW,EAAE,EACtB,KAAK,EAAE,SAAS,EAAE,EAClB,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,GACf,OAAO,EAAE,CAuGX;AAiCD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CA4BlF"}

package/dist/analysis/findings.js

@@ -33,12 +33,17 @@ export function generateFindings(sources, sinks, dfg, fileName) {
                     cwe: sink.cwe,
                     severity,
                     confidence,
+                    // #134: canonical "go-to-line" coordinate. For taint findings
+                    // this is the sink line (primary actionable location).
+                    line: sink.line,
                     source: {
+                        type: source.type,
                         file: fileName,
                         line: source.line,
                         code: source.location,
                     },
                     sink: {
+                        type: sink.type,
                         file: fileName,
                         line: sink.line,
                         code: sink.location,

package/dist/analysis/findings.js.map

@@ -1 +1 @@
-{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,EACL,iBAAiB,IAAI,YAAY,EACjC,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,KAAkB,EAClB,GAAQ,EACR,QAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,qDAAqD;YACrD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAEpD,IAAI,UAAU,CAAC,UAAU,IAAI,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBACpE,MAAM,QAAQ,GAAG,YAAY,CAAC;oBAC5B,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,UAAU,EAAE,UAAU,CAAC,UAAU;iBAClC,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBAEjE,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ;oBACR,UAAU;oBACV,MAAM,EAAE;wBACN,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ;qBACtB;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,QAAQ;qBACpB;oBACD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC9D,WAAW,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU,GAAG,GAAG;oBACtD,WAAW,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;oBAC1D,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,YAAY,EAAE;wBACZ,iBAAiB,EAAE,UAAU,CAAC,UAAU;wBACxC,YAAY,EAAE,KAAK;wBACnB,cAAc,EAAE,CAAC;wBACjB,eAAe,EAAE,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,CAAC,CAAC,QAAQ,GAAG;gBACX,GAAG,CAAC,CAAC,QAAQ;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAE,QAAQ,CAAC,QAAQ,EAAE,OAAiD,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,QAAQ,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,eAAe,GAAG,oBAAoB,CAC1C,QAAQ,CAAC,YAAY,CAAC,eAAe,EACrC,CAAC,CAAC,YAAY,CAAC,eAAe,CAC/B,CAAC;YACF,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACvC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;gBACnC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC3B,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;gBACvC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACjC,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C,kCAAkC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,IAAe;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC7C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,CAAyC,EACzC,CAAyC;IAEzC,MAAM,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC5B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAkB;IACvE,MAAM,mBAAmB,GAA+B;QACtD,yEAAyE;QACzE,yFAAyF;QACzF,8DAA8D;QAC9D,yEAAyE;QACzE,gFAAgF;QAChF,6CAA6C;QAC7C,kFAAkF;QAClF,kCAAkC;QAClC,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,CAAC;QAC5L,SAAS,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,CAAC;QACtJ,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,CAAC;QAC9F,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,CAAC;QACtF,SAAS,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,CAAC;QAC7E,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,CAAC;QACrI,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC;QACpG,SAAS,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAClD,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,yBAAyB;QAC7D,UAAU,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAC/F,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,CAAC;QACpE,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,sBAAsB;QAC7G,qBAAqB,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,qBAAqB;QAC9N,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,2BAA2B;KAC7H,CAAC;IAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAQD;;GAEG;AACH,SAAS,aAAa,CAAC,MAAmB,EAAE,IAAe,EAAE,GAAQ;IACnE,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,wCAAwC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CACvD,CAAC;IAEF,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CACnD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAEhC,yDAAyD;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,uBAAuB;gBACvB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;oBAC/C,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,EAAE,EAAE,2BAA2B;4BACrC,MAAM,EAAE,EAAE;4BACV,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,QAAQ;4BAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;yBACvB,CAAC,CAAC;wBACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,6DAA6D;IAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,aAAa;oBACvB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,QAAQ,CAAC,GAAG;oBAClB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,OAAsB,EACtB,MAAkB,EAClB,GAAQ,EACR,UAAuB,IAAI,GAAG,EAAE,EAChC,OAAiB,EAAE;IAEnB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErB,uCAAuC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,MAAmB,EAAE,IAAe;IACpE,8DAA8D;IAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAGD;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,kBAAkB;IAExC,+BAA+B;IAC/B,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAE9D,kBAAkB;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;SAAM,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1B,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,UAAU,6BAA6B,IAAI,QAAQ,QAAQ,+BAA+B,CAAC;IACvG,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,GAAG,UAAU,aAAa,QAAQ,+BAA+B,CAAC;IAC3E,CAAC;IAED,OAAO,GAAG,UAAU,cAAc,QAAQ,oCAAoC,CAAC;AACjF,CAAC"}
+{"version":3,"file":"findings.js","sourceRoot":"","sources":["../../src/analysis/findings.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,OAAO,EACL,iBAAiB,IAAI,YAAY,EACjC,cAAc,EACd,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAsB,EACtB,KAAkB,EAClB,GAAQ,EACR,QAAgB;IAEhB,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,iDAAiD;IACjD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,qDAAqD;YACrD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,SAAS;YACX,CAAC;YAED,qCAAqC;YACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAEpD,IAAI,UAAU,CAAC,UAAU,IAAI,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBACpE,MAAM,QAAQ,GAAG,YAAY,CAAC;oBAC5B,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,UAAU,EAAE,UAAU,CAAC,UAAU;iBAClC,CAAC,CAAC;gBACH,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;gBAEjE,QAAQ,CAAC,IAAI,CAAC;oBACZ,EAAE,EAAE,OAAO,SAAS,EAAE,EAAE;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ;oBACR,UAAU;oBACV,8DAA8D;oBAC9D,uDAAuD;oBACvD,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE;wBACN,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ;qBACtB;oBACD,IAAI,EAAE;wBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,IAAI,EAAE,IAAI,CAAC,QAAQ;qBACpB;oBACD,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBAC9D,WAAW,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU,GAAG,GAAG;oBACtD,WAAW,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC;oBAC1D,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;oBACtC,YAAY,EAAE;wBACZ,iBAAiB,EAAE,UAAU,CAAC,UAAU;wBACxC,YAAY,EAAE,KAAK;wBACnB,cAAc,EAAE,CAAC;wBACjB,eAAe,EAAE,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC;qBACtD;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,CAAC,CAAC,QAAQ,GAAG;gBACX,GAAG,CAAC,CAAC,QAAQ;gBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;aACxD,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,CAAE,QAAQ,CAAC,QAAQ,EAAE,OAAiD,IAAI,EAAE,CAAC,CAAC;YAC9F,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3D,QAAQ,CAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC;YACtD,MAAM,eAAe,GAAG,oBAAoB,CAC1C,QAAQ,CAAC,YAAY,CAAC,eAAe,EACrC,CAAC,CAAC,YAAY,CAAC,eAAe,CAC/B,CAAC;YACF,IAAI,CAAC,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACvC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;gBACnC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;gBAC3B,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBACvB,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,YAAY,GAAG,CAAC,CAAC,YAAY,CAAC;gBACvC,QAAQ,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC;gBACrC,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YACjC,CAAC;YACD,QAAQ,CAAC,YAAY,CAAC,eAAe,GAAG,eAAe,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C,kCAAkC;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACpB,MAAM,aAAa,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3E,IAAI,YAAY,KAAK,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5C,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,sBAAsB,CAC7B,MAAmB,EACnB,IAAe;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,IAAI,QAAQ,CAAC;IAC7C,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAC5B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAC3B,CAAyC,EACzC,CAAyC;IAEzC,MAAM,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC5B,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAkB;IACvE,MAAM,mBAAmB,GAA+B;QACtD,yEAAyE;QACzE,yFAAyF;QACzF,8DAA8D;QAC9D,yEAAyE;QACzE,gFAAgF;QAChF,6CAA6C;QAC7C,kFAAkF;QAClF,kCAAkC;QAClC,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,CAAC;QAC5L,SAAS,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,CAAC;QACtJ,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,CAAC;QAC9F,WAAW,EAAE,CAAC,eAAe,EAAE,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,CAAC;QACtF,SAAS,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,MAAM,EAAE,qBAAqB,CAAC;QAC7E,UAAU,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,EAAE,iBAAiB,CAAC;QACrI,QAAQ,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,CAAC;QACpG,SAAS,EAAE,CAAC,mBAAmB,EAAE,gBAAgB,CAAC;QAClD,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,CAAC,EAAE,yBAAyB;QAC7D,UAAU,EAAE,CAAC,iBAAiB,EAAE,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;QAC/F,aAAa,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,CAAC;QACpE,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,sBAAsB;QAC7G,qBAAqB,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,qBAAqB;QAC9N,YAAY,EAAE,CAAC,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,2BAA2B;KAC7H,CAAC;IAEF,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAQD;;GAEG;AACH,SAAS,aAAa,CAAC,MAAmB,EAAE,IAAe,EAAE,GAAQ;IACnE,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,wCAAwC;IACxC,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACrC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CACvD,CAAC;IAEF,+BAA+B;IAC/B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CACnC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CACnD,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,8BAA8B;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAEhC,yDAAyD;IACzD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;YAC9E,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,uBAAuB;gBACvB,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;oBAC/C,IAAI,GAAG,EAAE,CAAC;wBACR,IAAI,CAAC,IAAI,CAAC;4BACR,IAAI,EAAE,EAAE,EAAE,2BAA2B;4BACrC,MAAM,EAAE,EAAE;4BACV,IAAI,EAAE,GAAG,CAAC,IAAI;4BACd,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,QAAQ;4BAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;yBACvB,CAAC,CAAC;wBACH,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,6DAA6D;IAC7D,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,4BAA4B;QAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAExD,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,IAAI,EAAE,GAAG,CAAC,aAAa;oBACvB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC;oBACR,IAAI,EAAE,EAAE;oBACR,MAAM,EAAE,EAAE;oBACV,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,IAAI,EAAE,QAAQ,CAAC,GAAG;oBAClB,QAAQ,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAC5B,SAAiB,EACjB,OAAsB,EACtB,MAAkB,EAClB,GAAQ,EACR,UAAuB,IAAI,GAAG,EAAE,EAChC,OAAiB,EAAE;IAEnB,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAErB,uCAAuC;IACvC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEpE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,MAAmB,EAAE,IAAe;IACpE,8DAA8D;IAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAGD;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,IAAI,UAAU,GAAG,GAAG,CAAC,CAAC,kBAAkB;IAExC,+BAA+B;IAC/B,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;IAED,0CAA0C;IAC1C,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,6BAA6B;IAC7B,UAAU,GAAG,UAAU,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAE9D,kBAAkB;IAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAClB,UAAU,IAAI,GAAG,CAAC;IACpB,CAAC;SAAM,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1B,UAAU,IAAI,IAAI,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,MAAmB,EAAE,IAAe,EAAE,UAAsB;IACvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,GAAG,UAAU,6BAA6B,IAAI,QAAQ,QAAQ,+BAA+B,CAAC;IACvG,CAAC;IAED,IAAI,UAAU,CAAC,UAAU,EAAE,CAAC;QAC1B,OAAO,GAAG,UAAU,aAAa,QAAQ,+BAA+B,CAAC;IAC3E,CAAC;IAED,OAAO,GAAG,UAAU,cAAc,QAAQ,oCAAoC,CAAC;AACjF,CAAC"}

package/dist/analysis/passes/interprocedural-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interprocedural-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/interprocedural-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAO9E,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B,8DAA8D;IAC9D,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED,qBAAa,mBAAoB,YAAW,YAAY,CAAC,yBAAyB,CAAC;IACjF,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,yBAAyB;CAiOjD"}
+{"version":3,"file":"interprocedural-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/interprocedural-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,mBAAmB,EAAwB,MAAM,sBAAsB,CAAC;AAChH,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAQ9E,MAAM,WAAW,yBAAyB;IACxC,8DAA8D;IAC9D,eAAe,EAAE,SAAS,EAAE,CAAC;IAC7B,8DAA8D;IAC9D,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,6DAA6D;IAC7D,eAAe,CAAC,EAAE,mBAAmB,CAAC;CACvC;AAED,qBAAa,mBAAoB,YAAW,YAAY,CAAC,yBAAyB,CAAC;IACjF,QAAQ,CAAC,IAAI,qBAAqB;IAClC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,yBAAyB;CAmQjD"}

package/dist/analysis/passes/interprocedural-pass.js

@@ -14,6 +14,7 @@
  */
 import { analyzeInterprocedural, findTaintBridges } from '../interprocedural.js';
 import { attachSourceLineCode } from '../taint-matcher.js';
+import { shouldGateInterproceduralParam } from '../entry-point-detection.js';
 export class InterproceduralPass {
     name = 'interprocedural';
     category = 'security';
@@ -32,6 +33,21 @@ export class InterproceduralPass {
         const additionalSinks = [];
         const additionalFlows = [...taintProp.flows];
         let interprocedural;
+        // cognium-dev #128 — build a method-name → {method, type} lookup for the
+        // entry-point classifier gate. Used in Scenario A below to drop speculative
+        // `interprocedural_param` sources whose enclosing method classifies as
+        // TIER_3_LIBRARY_API (e.g. `RuntimeUtil.exec`, `FreemarkerEngine.render`).
+        // Built once per pass; O(types * methods) but only consulted for
+        // interprocedural_param sources, which are the FP cluster being suppressed.
+        const methodNameIndex = new Map();
+        for (const type of graph.ir.types ?? []) {
+            for (const method of type.methods ?? []) {
+                if (method.name && !methodNameIndex.has(method.name)) {
+                    methodNameIndex.set(method.name, { method, type });
+                }
+            }
+        }
+        const language = graph.ir.meta.language;
         // --- Scenario A: sources AND sinks present --------------------------------
         if (sinks.length > 0) {
             const interProc = analyzeInterprocedural(graph, sources, sinks, sanitizers, {
@@ -72,6 +88,19 @@ export class InterproceduralPass {
                                 continue;
                             if (source.type === 'interprocedural_param' && source.confidence < 0.6)
                                 continue;
+                            // cognium-dev #128 — drop `interprocedural_param` sources whose
+                            // enclosing method is a TIER_3_LIBRARY_API surface (utility/helper
+                            // classes, template/engine packages, JDK facade implementers, or
+                            // any non-entry-point Java method). Preserves recall for
+                            // entry-point-anchored sources (Spring @RequestMapping, JAX-RS,
+                            // Servlet doGet, `main`, etc.) and for non-Java languages
+                            // (UNKNOWN tier → pass-through).
+                            if (source.type === 'interprocedural_param' && source.in_method) {
+                                const enclosing = methodNameIndex.get(source.in_method);
+                                if (shouldGateInterproceduralParam(source.type, enclosing?.method, enclosing?.type, { language, types: graph.ir.types })) {
+                                    continue;
+                                }
+                            }
                             if (additionalFlows.some(f => f.source_line === source.line && f.sink_line === sink.line))
                                 continue;
                             additionalFlows.push({