circle-ir 4.16.1 → 4.18.1

package/dist/path-set/finding-diff.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Finding diff of a version pair: the lines a change touched, and the
+ * findings at the new version whose source or sink sits on a touched line and
+ * that have no match at the old version.
+ *
+ * Findings are the engine's own: taint flows (per-file flows and cross-file
+ * paths) and the pass findings. A finding is matched at the old version by
+ * stable declaration ids where `ids@0.1` covers both versions of its files,
+ * otherwise by rule × file × line mapped through the line diff; each new
+ * finding says which. Facts only: whether a new finding matters is the
+ * caller's to decide.
+ *
+ * Pure: IR and file text in, values out. Browser and Node compatible.
+ */
+import type { StableIdFile } from '../stable-ids/types.js';
+import type { ProjectAnalysis } from '../types/index.js';
+export interface FindingDiffSide {
+    project: ProjectAnalysis;
+    /** File text by repository-relative path, for every file of the tree the caller read. */
+    texts: Record<string, string>;
+    /** `ids@0.1` per file, where the ids cover the language. */
+    stableIds?: Record<string, StableIdFile>;
+}
+export type MatchedBy = 'stable-id' | 'rule-file-line';
+export interface NewFinding {
+    /** Sink type for a flow, `rule_id` for a pass finding. */
+    rule: string;
+    cwe?: string;
+    /** The sink's file and line for a flow; the finding's for a pass finding. */
+    file: string;
+    line: number;
+    kind: 'flow' | 'pass';
+    /** Which ends sit on a changed line: `source` and/or `sink` for a flow, `line` for a pass finding. */
+    onChangedLine: Array<'source' | 'sink' | 'line'>;
+    /** For a flow: where its source is. */
+    source?: {
+        file: string;
+        line: number;
+    };
+    matchedBy: MatchedBy;
+}
+export interface FindingDiff {
+    /** 1-based lines of the new version not carried over from the old one, per file; files with none omitted. */
+    changedLines: Record<string, number[]>;
+    /** Sorted by file, line, rule. */
+    newFindings: NewFinding[];
+    /** What the comparison could not cover, sorted. */
+    partial: Array<{
+        file?: string;
+        reason: string;
+    }>;
+    /** The match methods used, sorted. */
+    matchedBy: MatchedBy[];
+}
+/**
+ * The finding diff of a version pair. `maxDiff` bounds the line-diff edit
+ * distance per file; past it the whole file counts as changed and the file is
+ * listed in `partial`.
+ */
+export declare function findingDiff(before: FindingDiffSide, after: FindingDiffSide, options?: {
+    maxDiff?: number;
+}): FindingDiff;
+//# sourceMappingURL=finding-diff.d.ts.map

package/dist/path-set/finding-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-diff.d.ts","sourceRoot":"","sources":["../../src/path-set/finding-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAY,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAInE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,eAAe,CAAC;IACzB,yFAAyF;IACzF,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CAC1C;AAED,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,gBAAgB,CAAC;AAEvD,MAAM,WAAW,UAAU;IACzB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,sGAAsG;IACtG,aAAa,EAAE,KAAK,CAAC,QAAQ,GAAG,MAAM,GAAG,MAAM,CAAC,CAAC;IACjD,uCAAuC;IACvC,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxC,SAAS,EAAE,SAAS,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,6GAA6G;IAC7G,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,kCAAkC;IAClC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,mDAAmD;IACnD,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,sCAAsC;IACtC,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB;AAyDD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,CAuE5H"}

package/dist/path-set/finding-diff.js

@@ -0,0 +1,150 @@
+/**
+ * Finding diff of a version pair: the lines a change touched, and the
+ * findings at the new version whose source or sink sits on a touched line and
+ * that have no match at the old version.
+ *
+ * Findings are the engine's own: taint flows (per-file flows and cross-file
+ * paths) and the pass findings. A finding is matched at the old version by
+ * stable declaration ids where `ids@0.1` covers both versions of its files,
+ * otherwise by rule × file × line mapped through the line diff; each new
+ * finding says which. Facts only: whether a new finding matters is the
+ * caller's to decide.
+ *
+ * Pure: IR and file text in, values out. Browser and Node compatible.
+ */
+import { diffLines, splitLines } from './line-diff.js';
+import { declAt, normalizeCwe } from './path-set.js';
+function cweOf(ir, line, type) {
+    const s = ir.taint.sinks.find(x => x.line === line && x.type === type);
+    return s ? normalizeCwe(s.cwe) : undefined;
+}
+function findingsOf(project) {
+    const out = [];
+    const seen = new Set();
+    const add = (f) => {
+        const k = `${f.kind}|${f.rule}|${f.file}:${f.line}|${f.source?.file}:${f.source?.line}`;
+        if (seen.has(k))
+            return;
+        seen.add(k);
+        out.push(f);
+    };
+    for (const { file, analysis: ir } of project.files) {
+        for (const fl of ir.taint.flows ?? []) {
+            const cwe = cweOf(ir, fl.sink_line, fl.sink_type);
+            add({ rule: fl.sink_type, ...(cwe ? { cwe } : {}), kind: 'flow', file, line: fl.sink_line, source: { file, line: fl.source_line } });
+        }
+        for (const f of ir.findings ?? []) {
+            add({ rule: f.rule_id, ...(f.cwe ? { cwe: f.cwe } : {}), kind: 'pass', file: f.file || file, line: f.line });
+        }
+    }
+    for (const p of project.taint_paths ?? []) {
+        if (!p.path_exists)
+            continue;
+        add({ rule: p.sink.type, cwe: normalizeCwe(p.sink.cwe), kind: 'flow', file: p.sink.file, line: p.sink.line, source: { file: p.source.file, line: p.source.line } });
+    }
+    return out;
+}
+/** A finding's identity across versions by stable declaration ids (no line numbers). */
+function stableKey(f, side, all) {
+    const ir = (file) => side.project.files.find(x => x.file === file)?.analysis;
+    const ids = side.stableIds ?? {};
+    const files = [f.file, ...(f.source ? [f.source.file] : [])];
+    if (!files.every(x => ids[x] && ir(x)))
+        return null;
+    const decl = (file, line) => declAt(file, ir(file), line, ids[file]).id;
+    const d = decl(f.file, f.line);
+    const s = f.source ? decl(f.source.file, f.source.line) : '';
+    // ordinal among findings of the same rule and kind in the same declarations, by position
+    const peers = all
+        .filter(o => o.kind === f.kind && o.rule === f.rule && decl(o.file, o.line) === d && (o.source ? decl(o.source.file, o.source.line) : '') === s)
+        .sort((a, b) => a.line - b.line || (a.source?.line ?? 0) - (b.source?.line ?? 0));
+    return `${f.kind}|${f.rule}|${s}|${d}|#${peers.indexOf(f)}`;
+}
+/**
+ * The finding diff of a version pair. `maxDiff` bounds the line-diff edit
+ * distance per file; past it the whole file counts as changed and the file is
+ * listed in `partial`.
+ */
+export function findingDiff(before, after, options = {}) {
+    const partial = [];
+    const diffs = new Map();
+    const changedLines = {};
+    for (const file of Object.keys(after.texts).sort()) {
+        const newLines = splitLines(after.texts[file]);
+        const oldText = before.texts[file];
+        let d = diffLines(oldText === undefined ? [] : splitLines(oldText), newLines, options.maxDiff);
+        if (d === null) {
+            partial.push({ file, reason: 'diff-too-large' });
+            d = { changed: newLines.map((_, i) => i + 1), toOld: new Map() };
+        }
+        diffs.set(file, d);
+        if (d.changed.length > 0)
+            changedLines[file] = d.changed;
+    }
+    // what the analysis did not cover
+    const analysed = new Set(after.project.files.map(f => f.file));
+    for (const file of Object.keys(changedLines))
+        if (!analysed.has(file))
+            partial.push({ file, reason: 'not-analysed' });
+    for (const f of after.project.files) {
+        if (f.analysis.parse_status && !f.analysis.parse_status.success && changedLines[f.file])
+            partial.push({ file: f.file, reason: 'parse-error' });
+    }
+    if (after.project.cross_file_budget_exceeded)
+        partial.push({ reason: 'cross_file_budget_exceeded' });
+    if (after.project.per_file_budget_exceeded)
+        partial.push({ reason: 'per_file_budget_exceeded' });
+    if (after.project.project_size_budget_exceeded)
+        partial.push({ reason: 'project_size_budget_exceeded' });
+    const isChanged = (file, line) => diffs.get(file)?.changed.includes(line) ?? false;
+    const toOld = (file, line) => diffs.get(file)?.toOld.get(line);
+    const afterFindings = findingsOf(after.project);
+    const beforeFindings = findingsOf(before.project);
+    const beforeKeys = new Set(beforeFindings.map(f => stableKey(f, before, beforeFindings)).filter((k) => k !== null));
+    const newFindings = [];
+    const used = new Set();
+    for (const f of afterFindings) {
+        const on = [];
+        if (f.kind === 'pass') {
+            if (isChanged(f.file, f.line))
+                on.push('line');
+        }
+        else {
+            if (f.source && isChanged(f.source.file, f.source.line))
+                on.push('source');
+            if (isChanged(f.file, f.line))
+                on.push('sink');
+        }
+        if (on.length === 0)
+            continue;
+        const key = stableKey(f, after, afterFindings);
+        const beforeCovered = [f.file, ...(f.source ? [f.source.file] : [])].every(x => before.stableIds?.[x] || before.texts[x] === undefined);
+        let matched;
+        let by;
+        if (key !== null && beforeCovered) {
+            by = 'stable-id';
+            matched = beforeKeys.has(key);
+        }
+        else {
+            by = 'rule-file-line';
+            const sinkOld = toOld(f.file, f.line);
+            const srcOld = f.source ? toOld(f.source.file, f.source.line) : undefined;
+            matched = (sinkOld !== undefined || srcOld !== undefined) && beforeFindings.some(o => o.kind === f.kind && o.rule === f.rule && o.file === f.file &&
+                (sinkOld === undefined || o.line === sinkOld) &&
+                (!f.source || (o.source?.file === f.source.file && (srcOld === undefined || o.source.line === srcOld))));
+        }
+        used.add(by);
+        if (matched)
+            continue;
+        const nf = { rule: f.rule, file: f.file, line: f.line, kind: f.kind, onChangedLine: on, matchedBy: by };
+        if (f.cwe)
+            nf.cwe = f.cwe;
+        if (f.source)
+            nf.source = f.source;
+        newFindings.push(nf);
+    }
+    newFindings.sort((a, b) => (a.file < b.file ? -1 : a.file > b.file ? 1 : a.line - b.line || a.rule.localeCompare(b.rule)));
+    partial.sort((a, b) => ((a.file ?? '') < (b.file ?? '') ? -1 : (a.file ?? '') > (b.file ?? '') ? 1 : a.reason.localeCompare(b.reason)));
+    return { changedLines, newFindings, partial, matchedBy: [...used].sort() };
+}
+//# sourceMappingURL=finding-diff.js.map

package/dist/path-set/finding-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-diff.js","sourceRoot":"","sources":["../../src/path-set/finding-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAiB,MAAM,gBAAgB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AA+CrD,SAAS,KAAK,CAAC,EAAY,EAAE,IAAY,EAAE,IAAY;IACrD,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,OAAwB;IAC1C,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,CAAU,EAAQ,EAAE;QAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;QACxF,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO;QACxB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACnD,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACvI,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/G,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,CAAC,CAAC,CAAC,WAAW;YAAE,SAAS;QAC7B,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtK,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,SAAS,SAAS,CAAC,CAAU,EAAE,IAAqB,EAAE,GAAc;IAClE,MAAM,EAAE,GAAG,CAAC,IAAY,EAAwB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,QAAQ,CAAC;IAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAa,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5G,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,yFAAyF;IACzF,MAAM,KAAK,GAAG,GAAG;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;SAC/I,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAuB,EAAE,KAAsB,EAAE,OAAO,GAAyB,EAAE;IAC7G,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC1C,MAAM,YAAY,GAA6B,EAAE,CAAC;IAClD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,GAAoB,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAChH,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACjD,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;QACnE,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;IAC3D,CAAC;IAED,kCAAkC;IAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IACtH,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACjJ,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,0BAA0B;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;IACrG,IAAI,KAAK,CAAC,OAAO,CAAC,wBAAwB;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;IACjG,IAAI,KAAK,CAAC,OAAO,CAAC,4BAA4B;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAC;IAEzG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,IAAY,EAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;IAC5G,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAEnG,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAEjI,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAa,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAgC,EAAE,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAE9B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QACxI,IAAI,OAAgB,CAAC;QACrB,IAAI,EAAa,CAAC;QAClB,IAAI,GAAG,KAAK,IAAI,IAAI,aAAa,EAAE,CAAC;YAClC,EAAE,GAAG,WAAW,CAAC;YACjB,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,gBAAgB,CAAC;YACtB,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CACnF,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI;gBAC3D,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;gBAC7C,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7G,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,OAAO;YAAE,SAAS;QACtB,MAAM,EAAE,GAAe,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACpH,IAAI,CAAC,CAAC,GAAG;YAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM;YAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QACnC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxI,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC7E,CAAC"}

package/dist/path-set/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Path sets: every source-to-sink path of one CWE in an analysed tree, keyed
+ * so a path is found again in another version of the tree, and the
+ * difference between two versions with unresolved edges counted.
+ */
+export { pathSetOf, pathSetDiff, diffPathSets, pinFacts, pathKey, declAt, changeOf, normalizeCwe, lineDominates, handedNames, } from './path-set.js';
+export { deriveBranchFacts, sideOf } from './branches.js';
+export { findingDiff } from './finding-diff.js';
+export type { FindingDiff, FindingDiffSide, NewFinding, MatchedBy } from './finding-diff.js';
+export { diffLines, splitLines } from './line-diff.js';
+export type { LineDiff } from './line-diff.js';
+export { deriveTemplateFacts, templateEngineOf, expressionNames } from './templates.js';
+export type { TemplateFact, TemplateEngine } from './templates.js';
+export type { BranchFact, BranchCall, BranchRange, BranchSide } from './branches.js';
+export type { PathSetInput, PathSetOptions } from './path-set.js';
+export { PATH_KEY_SCHEME } from './types.js';
+export type { DeclKeyScheme, DeclRef, PathHop, PathEnd, PathSource, PathSink, PathGuard, PathUnresolved, UnresolvedSite, TemplateUse, PathState, PathEntry, PathSet, PathChange, PathDiffEntry, PinFacts, PathSetDiff, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/path-set/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/path-set/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACvD,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACnE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACrF,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,YAAY,EACV,aAAa,EACb,OAAO,EACP,OAAO,EACP,OAAO,EACP,UAAU,EACV,QAAQ,EACR,SAAS,EACT,cAAc,EACd,cAAc,EACd,WAAW,EACX,SAAS,EACT,SAAS,EACT,OAAO,EACP,UAAU,EACV,aAAa,EACb,QAAQ,EACR,WAAW,GACZ,MAAM,YAAY,CAAC"}

package/dist/path-set/index.js

@@ -0,0 +1,12 @@
+/**
+ * Path sets: every source-to-sink path of one CWE in an analysed tree, keyed
+ * so a path is found again in another version of the tree, and the
+ * difference between two versions with unresolved edges counted.
+ */
+export { pathSetOf, pathSetDiff, diffPathSets, pinFacts, pathKey, declAt, changeOf, normalizeCwe, lineDominates, handedNames, } from './path-set.js';
+export { deriveBranchFacts, sideOf } from './branches.js';
+export { findingDiff } from './finding-diff.js';
+export { diffLines, splitLines } from './line-diff.js';
+export { deriveTemplateFacts, templateEngineOf, expressionNames } from './templates.js';
+export { PATH_KEY_SCHEME } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/path-set/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/path-set/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,MAAM,EACN,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAIxF,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/path-set/line-diff.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Line diff of two versions of a file (Myers' O((N+M)·D) algorithm): which
+ * lines of the new version were inserted or changed, and, for every other new
+ * line, the old line it was carried over from.
+ */
+export interface LineDiff {
+    /** 1-based lines of the new version that are not carried over from the old one. */
+    changed: number[];
+    /** New line (1-based) → old line (1-based); absent for changed lines. */
+    toOld: Map<number, number>;
+}
+/** Split text into lines the way an editor counts them (a trailing newline adds no line). */
+export declare function splitLines(text: string): string[];
+/**
+ * Diff `oldLines` against `newLines`. Returns `null` when the edit distance
+ * exceeds `maxD` (the caller then treats the whole file as changed).
+ */
+export declare function diffLines(oldLines: readonly string[], newLines: readonly string[], maxD?: number): LineDiff | null;
+//# sourceMappingURL=line-diff.d.ts.map

package/dist/path-set/line-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"line-diff.d.ts","sourceRoot":"","sources":["../../src/path-set/line-diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,yEAAyE;IACzE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,6FAA6F;AAC7F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAKjD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,SAAO,GAAG,QAAQ,GAAG,IAAI,CAwEhH"}

package/dist/path-set/line-diff.js

@@ -0,0 +1,98 @@
+/**
+ * Line diff of two versions of a file (Myers' O((N+M)·D) algorithm): which
+ * lines of the new version were inserted or changed, and, for every other new
+ * line, the old line it was carried over from.
+ */
+/** Split text into lines the way an editor counts them (a trailing newline adds no line). */
+export function splitLines(text) {
+    if (text === '')
+        return [];
+    const lines = text.split(/\r\n|\n|\r/);
+    if (lines[lines.length - 1] === '')
+        lines.pop();
+    return lines;
+}
+/**
+ * Diff `oldLines` against `newLines`. Returns `null` when the edit distance
+ * exceeds `maxD` (the caller then treats the whole file as changed).
+ */
+export function diffLines(oldLines, newLines, maxD = 4000) {
+    const n = oldLines.length;
+    const m = newLines.length;
+    // trim the common prefix and suffix: most edits are small
+    let pre = 0;
+    while (pre < n && pre < m && oldLines[pre] === newLines[pre])
+        pre++;
+    let suf = 0;
+    while (suf < n - pre && suf < m - pre && oldLines[n - 1 - suf] === newLines[m - 1 - suf])
+        suf++;
+    const a = oldLines.slice(pre, n - suf);
+    const b = newLines.slice(pre, m - suf);
+    const toOld = new Map();
+    for (let i = 0; i < pre; i++)
+        toOld.set(i + 1, i + 1);
+    for (let k = 0; k < suf; k++)
+        toOld.set(m - k, n - k);
+    const N = a.length;
+    const M = b.length;
+    const changed = [];
+    if (N === 0 || M === 0) {
+        if (N + M > maxD)
+            return null; // the edit distance here is every line on one side
+        for (let j = 0; j < M; j++)
+            changed.push(pre + j + 1);
+        return { changed, toOld };
+    }
+    const max = N + M;
+    const off = max;
+    let v = new Int32Array(2 * max + 2);
+    const trace = [];
+    let found = -1;
+    for (let d = 0; d <= Math.min(max, maxD); d++) {
+        trace.push(v.slice());
+        for (let k = -d; k <= d; k += 2) {
+            let x = k === -d || (k !== d && v[off + k - 1] < v[off + k + 1]) ? v[off + k + 1] : v[off + k - 1] + 1;
+            let y = x - k;
+            while (x < N && y < M && a[x] === b[y]) {
+                x++;
+                y++;
+            }
+            v[off + k] = x;
+            if (x >= N && y >= M) {
+                found = d;
+                break;
+            }
+        }
+        if (found >= 0)
+            break;
+    }
+    if (found < 0)
+        return null;
+    // walk the trace back, recording the diagonal (matching) moves
+    let x = N;
+    let y = M;
+    for (let d = found; d > 0; d--) {
+        v = trace[d];
+        const k = x - y;
+        const prevK = k === -d || (k !== d && v[off + k - 1] < v[off + k + 1]) ? k + 1 : k - 1;
+        const prevX = v[off + prevK];
+        const prevY = prevX - prevK;
+        while (x > prevX && y > prevY) {
+            toOld.set(pre + y, pre + x);
+            x--;
+            y--;
+        }
+        if (prevK === k + 1)
+            changed.push(pre + y);
+        x = prevX;
+        y = prevY;
+    }
+    while (x > 0 && y > 0) {
+        toOld.set(pre + y, pre + x);
+        x--;
+        y--;
+    }
+    changed.sort((p, q) => p - q);
+    return { changed, toOld };
+}
+//# sourceMappingURL=line-diff.js.map

package/dist/path-set/line-diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"line-diff.js","sourceRoot":"","sources":["../../src/path-set/line-diff.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,6FAA6F;AAC7F,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,QAA2B,EAAE,QAA2B,EAAE,IAAI,GAAG,IAAI;IAC7F,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC1B,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC1B,0DAA0D;IAC1D,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,GAAG,CAAC;QAAE,GAAG,EAAE,CAAC;IACpE,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAAE,GAAG,EAAE,CAAC;IAChG,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAEtD,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;QAClF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,IAAI,CAAC,GAAe,IAAI,UAAU,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACvG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,CAAC,EAAE,CAAC;gBACJ,CAAC,EAAE,CAAC;YACN,CAAC;YACD,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,KAAK,GAAG,CAAC,CAAC;gBACV,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM;IACxB,CAAC;IACD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE3B,+DAA+D;IAC/D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/B,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;QAC5B,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;YAC9B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;QACN,CAAC;QACD,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC3C,CAAC,GAAG,KAAK,CAAC;QACV,CAAC,GAAG,KAAK,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5B,CAAC,EAAE,CAAC;QACJ,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/path-set/path-set.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Path sets of one weakness class, and their difference between two versions
+ * of a tree.
+ *
+ * `pathSetOf` collects every source-to-sink path whose sink carries the given
+ * CWE from an already analysed project (per-file `taint.flows` and project
+ * `taint_paths`) and gives each a **pin-independent key**: no line number
+ * takes part, so an edit that only shifts lines keeps every key. The key is
+ * built from the declaration that holds each end (a stable id where the
+ * caller supplies `ids@0.1` for the file, else a qualified name built from the
+ * IR), the call shape of the end, and its ordinal among same-shape ends in
+ * that declaration.
+ *
+ * `diffPathSets` compares two sets as a set operation and counts, per version,
+ * the unresolved edges and the analysis budgets hit, so an empty set on a
+ * partly analysed tree is never read as clean. Neither function judges a
+ * change: they report which paths exist where.
+ *
+ * Pure: IR in, values out. Browser and Node compatible.
+ */
+import { type BranchFact } from './branches.js';
+import type { TemplateFact } from './templates.js';
+import type { StableIdFile } from '../stable-ids/types.js';
+import type { CallInfo, CircleIR, ProjectAnalysis, TypeInfo } from '../types/index.js';
+import { type DeclRef, type PathChange, type PathSet, type PathSetDiff, type PathState, type PinFacts } from './types.js';
+/** What `pathSetOf` reads: the per-file IR and, when present, cross-file paths. */
+export type PathSetInput = Pick<ProjectAnalysis, 'files'> & Partial<Pick<ProjectAnalysis, 'taint_paths' | 'cross_file_calls'>>;
+export interface PathSetOptions {
+    /** The weakness class, `CWE-89` or `89`. */
+    cwe: string | number;
+    /** `ids@0.1` per repository-relative file path, for files the ids cover. */
+    stableIds?: Record<string, StableIdFile>;
+    /**
+     * Branch facts per file (`deriveBranchFacts`). With them a path whose endpoint
+     * runs only on one side of a check of the path's own data is reported
+     * `guarded`; without them no path is.
+     */
+    branches?: Record<string, BranchFact[]>;
+    /**
+     * Template facts per template file (`deriveTemplateFacts`). With them a sink
+     * call that hands a value to a view under a literal name (`addAttribute("q", q)`)
+     * carries the template constructs that render that name (`sink.templates`).
+     */
+    templates?: Record<string, TemplateFact[]>;
+}
+/** `CWE-089`, `cwe-89` and `89` all normalise to `CWE-89`. */
+export declare function normalizeCwe(cwe: string | number): string;
+/** `package.Type$Inner` — the qualified@0.1 name of a type. */
+export declare function typePath(t: TypeInfo): string;
+/** `package.Type$Inner.method(T1,T2)` — the qualified@0.1 name of a method. */
+export declare function qualifiedMethodName(type: TypeInfo, method: TypeInfo['methods'][number]): string;
+/** The declaration that holds `line` in `file`. */
+export declare function declAt(file: string, ir: CircleIR, line: number, ids?: StableIdFile): DeclRef;
+/** Names a sink call hands on as string literals (`addAttribute("q", q)` → `q`). */
+export declare function handedNames(c: CallInfo | undefined): string[];
+/** Does the CFG block holding line `a` dominate the block holding line `b` (same method)? */
+export declare function lineDominates(ir: CircleIR, a: number, b: number): boolean;
+/** The pin-independent key of a path. */
+export declare function pathKey(cwe: string, sourceAnchor: string, sinkAnchor: string): string;
+/** Every path of class `cwe` in one analysed tree, keyed and sorted by key. */
+export declare function pathSetOf(project: PathSetInput, options: PathSetOptions): PathSet;
+/** The set change between two states. */
+export declare function changeOf(before: PathState, after: PathState): PathChange;
+/** Unresolved edges, budget flags and parse health of one analysed tree. */
+export declare function pinFacts(project: ProjectAnalysis, pathFiles: ReadonlySet<string>, pathCount: number): PinFacts;
+/** Compare two path sets of the same class. */
+export declare function diffPathSets(before: PathSet, after: PathSet): Pick<PathSetDiff, 'entries' | 'counts'>;
+/**
+ * Every path of class `cwe` at two versions of a tree, the change per key,
+ * and per version the unresolved edges and budget flags. Path files are the
+ * union over both versions, so both pins are counted over the same region.
+ */
+export declare function pathSetDiff(before: ProjectAnalysis, after: ProjectAnalysis, options: {
+    cwe: string | number;
+    stableIds?: {
+        before?: Record<string, StableIdFile>;
+        after?: Record<string, StableIdFile>;
+    };
+    branches?: {
+        before?: Record<string, BranchFact[]>;
+        after?: Record<string, BranchFact[]>;
+    };
+    templates?: {
+        before?: Record<string, TemplateFact[]>;
+        after?: Record<string, TemplateFact[]>;
+    };
+}): PathSetDiff;
+//# sourceMappingURL=path-set.d.ts.map

package/dist/path-set/path-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-set.d.ts","sourceRoot":"","sources":["../../src/path-set/path-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EACV,QAAQ,EACR,QAAQ,EACR,eAAe,EAGf,QAAQ,EACT,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,OAAO,EACZ,KAAK,UAAU,EAKf,KAAK,OAAO,EACZ,KAAK,WAAW,EAGhB,KAAK,SAAS,EAId,KAAK,QAAQ,EACd,MAAM,YAAY,CAAC;AAEpB,mFAAmF;AACnF,MAAM,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,GAAG,kBAAkB,CAAC,CAAC,CAAC;AAE/H,MAAM,WAAW,cAAc;IAC7B,4CAA4C;IAC5C,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IACxC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;CAC5C;AAED,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAIzD;AAMD,+DAA+D;AAC/D,wBAAgB,QAAQ,CAAC,CAAC,EAAE,QAAQ,GAAG,MAAM,CAG5C;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAE/F;AAMD,mDAAmD;AACnD,wBAAgB,MAAM,CACpB,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,QAAQ,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,YAAY,GACjB,OAAO,CAgCT;AAiOD,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,EAAE,CAG7D;AAgCD,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CASzE;AAsBD,yCAAyC;AACzC,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAErF;AA8FD,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAiIjF;AAMD,yCAAyC;AACzC,wBAAgB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,GAAG,UAAU,CAQxE;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAiC9G;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,QAAQ,CAAC,CAuBrG;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE;IACP,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;KAAE,CAAC;IAC5F,QAAQ,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;KAAE,CAAC;IAC3F,SAAS,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAA;KAAE,CAAC;CACjG,GACA,WAAW,CAyBb"}