circle-ir 4.16.1 → 4.18.1

package/dist/analysis/maven-declared.js

@@ -0,0 +1,216 @@
+/**
+ * The version a Maven project's own build files declare for a coordinate,
+ * and where that declaration comes from.
+ *
+ * A resolved dependency set says which version the build used; this says
+ * which version the POMs ask for, read from the raw POM of a module and its
+ * parents found among the POMs the caller supplies. The two differ when a
+ * parent's `<dependencyManagement>` or an imported BOM overrides a module's
+ * own bump, which is exactly what a dependency fix has to rule out.
+ *
+ * Origins, in the order Maven applies them:
+ *   - `direct` — a literal `<version>` on a `<dependency>` of the module or of
+ *     a parent (inherited); an explicit version beats `<dependencyManagement>`;
+ *   - `property` — a `${name}` on it, resolved along the module → parent chain;
+ *   - `dependencyManagement` — the module's own `<dependencyManagement>`;
+ *   - `parent-dependencyManagement` — a parent's in the supplied set;
+ *   - `bom` — managed by an imported BOM (`<scope>import</scope>`): the BOM's
+ *     content is not in the source tree, so `version` is null unless an
+ *     effective POM is supplied;
+ *   - `external-parent` — the module names it without a version and its
+ *     parent is not in the supplied set (e.g. a framework parent POM);
+ *   - `unknown` — named without a version and nothing above explains it.
+ * A coordinate no POM in the chain names gives `null` (a plain transitive).
+ *
+ * Regex-scoped XML reading, like the rest of the SBOM module: comments,
+ * `<build>`, `<profiles>` and `<reporting>` are set aside, so plugin
+ * dependencies and profile-only declarations are not read. Pure; the caller
+ * supplies file text and repository-relative paths.
+ */
+const tag = (block, name) => new RegExp(`<${name}>\\s*([^<]*?)\\s*</${name}>`).exec(block)?.[1];
+function stripSection(xml, name) {
+    return xml.replace(new RegExp(`<${name}>[\\s\\S]*?</${name}>`, 'g'), '');
+}
+function readDeps(block) {
+    const out = [];
+    const re = /<dependency>([\s\S]*?)<\/dependency>/g;
+    let m;
+    while ((m = re.exec(block)) !== null) {
+        const b = m[1];
+        const g = tag(b, 'groupId');
+        const a = tag(b, 'artifactId');
+        if (!g || !a)
+            continue;
+        out.push({ name: `${g}:${a}`, version: tag(b, 'version'), scope: tag(b, 'scope'), type: tag(b, 'type') });
+    }
+    return out;
+}
+function parsePom(file) {
+    let xml = file.content.replace(/<!--[\s\S]*?-->/g, '');
+    for (const s of ['build', 'profiles', 'reporting'])
+        xml = stripSection(xml, s);
+    const managedBlock = /<dependencyManagement>([\s\S]*?)<\/dependencyManagement>/.exec(xml)?.[1] ?? '';
+    xml = stripSection(xml, 'dependencyManagement');
+    const parentBlock = /<parent>([\s\S]*?)<\/parent>/.exec(xml)?.[1];
+    let parent;
+    if (parentBlock) {
+        const g = tag(parentBlock, 'groupId');
+        const a = tag(parentBlock, 'artifactId');
+        if (g && a) {
+            parent = { groupId: g, artifactId: a, version: tag(parentBlock, 'version'), relativePath: tag(parentBlock, 'relativePath') ?? '../pom.xml' };
+        }
+        xml = stripSection(xml, 'parent');
+    }
+    const properties = new Map();
+    const propsBlock = /<properties>([\s\S]*?)<\/properties>/.exec(xml)?.[1];
+    if (propsBlock) {
+        const re = /<([A-Za-z0-9._-]+)>\s*([^<]*?)\s*<\/\1>/g;
+        let m;
+        while ((m = re.exec(propsBlock)) !== null)
+            properties.set(m[1], m[2]);
+    }
+    xml = stripSection(xml, 'properties');
+    const depsBlock = /<dependencies>([\s\S]*?)<\/dependencies>/.exec(xml)?.[1] ?? '';
+    const head = stripSection(xml, 'dependencies');
+    return {
+        path: file.path,
+        coord: { groupId: tag(head, 'groupId') ?? parent?.groupId, artifactId: tag(head, 'artifactId'), version: tag(head, 'version') ?? parent?.version },
+        parent,
+        properties,
+        dependencies: readDeps(depsBlock),
+        managed: readDeps(managedBlock),
+    };
+}
+/** POSIX-style join and normalisation of repository-relative paths. */
+function joinPath(dir, rel) {
+    const parts = (dir ? `${dir}/${rel}` : rel).split('/');
+    const out = [];
+    for (const p of parts) {
+        if (p === '' || p === '.')
+            continue;
+        if (p === '..')
+            out.pop();
+        else
+            out.push(p);
+    }
+    return out.join('/');
+}
+const dirOf = (p) => (p.includes('/') ? p.slice(0, p.lastIndexOf('/')) : '');
+/**
+ * Index of the POMs of one source tree, answering the declared version of a
+ * coordinate for any module in it.
+ */
+export class MavenDeclaredIndex {
+    poms = new Map();
+    effective;
+    /**
+     * @param poms every POM of the tree, with repository-relative paths
+     * @param effectivePom optional `mvn help:effective-pom` output for a module:
+     *   used only to fill in a version the raw POMs leave null (a BOM-managed
+     *   or external-parent-managed coordinate); the origin still comes from
+     *   the raw POMs.
+     */
+    constructor(poms, effectivePom) {
+        for (const p of poms)
+            this.poms.set(joinPath('', p.path), parsePom(p));
+        if (effectivePom)
+            this.effective = parsePom({ path: '(effective)', content: effectivePom });
+    }
+    /** The module POM followed by every ancestor found in the supplied set. */
+    chain(modulePath) {
+        const chain = [];
+        let cur = this.poms.get(joinPath('', modulePath));
+        const visited = new Set();
+        while (cur && !visited.has(cur.path)) {
+            visited.add(cur.path);
+            chain.push(cur);
+            const parent = cur.parent;
+            if (!parent)
+                return { chain };
+            const byPath = this.poms.get(joinPath(dirOf(cur.path), parent.relativePath.endsWith('.xml') ? parent.relativePath : `${parent.relativePath}/pom.xml`));
+            const matches = (p) => !!p && p.coord.artifactId === parent.artifactId && (p.coord.groupId ?? parent.groupId) === parent.groupId;
+            let next = matches(byPath) ? byPath : undefined;
+            if (!next)
+                for (const p of this.poms.values())
+                    if (matches(p)) {
+                        next = p;
+                        break;
+                    }
+            if (!next)
+                return { chain, externalParent: `${parent.groupId}:${parent.artifactId}${parent.version ? `:${parent.version}` : ''}` };
+            cur = next;
+        }
+        return { chain };
+    }
+    /**
+     * The declared version of `name` (`groupId:artifactId`) for the module whose
+     * POM is at `modulePath`, or null when no POM in its chain names it.
+     */
+    declared(modulePath, name) {
+        const { chain, externalParent } = this.chain(modulePath);
+        if (chain.length === 0)
+            return null;
+        const module = chain[0];
+        const resolve = (raw) => {
+            const m = /^\$\{([^}]+)\}$/.exec(raw.trim());
+            if (!m)
+                return { version: raw.trim() };
+            const prop = m[1];
+            if (prop === 'project.version' || prop === 'pom.version') {
+                return { version: module.coord.version ?? null, property: prop };
+            }
+            for (const p of chain) {
+                const v = p.properties.get(prop);
+                if (v !== undefined)
+                    return /\$\{/.test(v) ? { version: null, property: prop } : { version: v, property: prop };
+            }
+            return { version: null, property: prop };
+        };
+        const boms = [];
+        for (const p of chain) {
+            for (const d of p.managed) {
+                if (d.scope === 'import' && d.type === 'pom')
+                    boms.push(`${d.name}${d.version ? `:${resolve(d.version).version ?? d.version}` : ''}`);
+            }
+        }
+        const fillFromEffective = (r) => {
+            if (r.version !== null || !this.effective)
+                return r;
+            const hit = [...this.effective.dependencies, ...this.effective.managed].find((d) => d.name === name && d.version);
+            return hit?.version ? { ...r, version: hit.version } : r;
+        };
+        // A versioned <dependency> (in the module or inherited from a parent's
+        // <dependencies>) beats <dependencyManagement> for that coordinate.
+        for (const p of chain) {
+            const own = p.dependencies.find((d) => d.name === name && d.version);
+            if (!own?.version)
+                continue;
+            const r = resolve(own.version);
+            return r.property
+                ? { version: r.version, origin: 'property', file: p.path, property: r.property }
+                : { version: r.version, origin: 'direct', file: p.path };
+        }
+        for (let i = 0; i < chain.length; i++) {
+            const managed = chain[i].managed.find((d) => d.name === name && d.scope !== 'import');
+            if (managed?.version) {
+                const r = resolve(managed.version);
+                return {
+                    version: r.version,
+                    origin: i === 0 ? 'dependencyManagement' : 'parent-dependencyManagement',
+                    file: chain[i].path,
+                    ...(r.property ? { property: r.property } : {}),
+                };
+            }
+        }
+        // Named without a version (or not named at all) and not managed in the tree.
+        const namedHere = chain.find((p) => p.dependencies.some((d) => d.name === name));
+        if (boms.length > 0 && namedHere)
+            return fillFromEffective({ version: null, origin: 'bom', file: namedHere.path, boms });
+        if (externalParent && namedHere)
+            return fillFromEffective({ version: null, origin: 'external-parent', file: namedHere.path, parent: externalParent });
+        if (namedHere)
+            return fillFromEffective({ version: null, origin: 'unknown', file: namedHere.path, ...(boms.length ? { boms } : {}) });
+        return null;
+    }
+}
+//# sourceMappingURL=maven-declared.js.map

package/dist/analysis/maven-declared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven-declared.js","sourceRoot":"","sources":["../../src/analysis/maven-declared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA+CH,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,IAAY,EAAsB,EAAE,CAC9D,IAAI,MAAM,CAAC,IAAI,IAAI,sBAAsB,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAErE,SAAS,YAAY,CAAC,GAAW,EAAE,IAAY;IAC7C,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,gBAAgB,IAAI,GAAG,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,uCAAuC,CAAC;IACnD,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACvB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC;QAAE,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAE/E,MAAM,YAAY,GAAG,0DAA0D,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrG,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAEhD,MAAM,WAAW,GAAG,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,MAA2B,CAAC;IAChC,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,WAAW,EAAE,cAAc,CAAC,IAAI,YAAY,EAAE,CAAC;QAC/I,CAAC;QACD,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,UAAU,GAAG,sCAAsC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,0CAA0C,CAAC;QACtD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClF,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,EAAE,OAAO,EAAE;QAClJ,MAAM;QACN,UAAU;QACV,YAAY,EAAE,QAAQ,CAAC,SAAS,CAAC;QACjC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAS,QAAQ,CAAC,GAAW,EAAE,GAAW;IACxC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG;YAAE,SAAS;QACpC,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,GAAG,EAAE,CAAC;;YACrB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,OAAO,kBAAkB;IACZ,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IACpC,SAAS,CAAa;IAEvC;;;;;;OAMG;IACH,YAAY,IAAe,EAAE,YAAqB;QAChD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,YAAY;YAAE,IAAI,CAAC,SAAS,GAAG,QAAQ,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,UAAkB;QAC9B,MAAM,KAAK,GAAgB,EAAE,CAAC;QAC9B,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,YAAY,UAAU,CAAC,CAAC,CAAC;YACvJ,MAAM,OAAO,GAAG,CAAC,CAAwB,EAAW,EAAE,CACpD,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;YAC5G,IAAI,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAChD,IAAI,CAAC,IAAI;gBAAE,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;oBAAE,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;wBAAC,IAAI,GAAG,CAAC,CAAC;wBAAC,MAAM;oBAAC,CAAC;YACnF,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACnI,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,UAAkB,EAAE,IAAY;QACvC,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAExB,MAAM,OAAO,GAAG,CAAC,GAAW,EAAiD,EAAE;YAC7E,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;gBACzD,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YACnE,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,KAAK,SAAS;oBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAClH,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC3C,CAAC,CAAC;QAEF,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;oBAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxI,CAAC;QACH,CAAC;QACD,MAAM,iBAAiB,GAAG,CAAC,CAAkB,EAAmB,EAAE;YAChE,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,CAAC;YACpD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAClH,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3D,CAAC,CAAC;QAEF,uEAAuE;QACvE,oEAAoE;QACpE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YACrE,IAAI,CAAC,GAAG,EAAE,OAAO;gBAAE,SAAS;YAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO,CAAC,CAAC,QAAQ;gBACf,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;gBAChF,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;YACtF,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACnC,OAAO;oBACL,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,6BAA6B;oBACxE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;oBACnB,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;QACjF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS;YAAE,OAAO,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACzH,IAAI,cAAc,IAAI,SAAS;YAAE,OAAO,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACtJ,IAAI,SAAS;YAAE,OAAO,iBAAiB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACtI,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/analysis/maven-version.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Maven version ordering — the ordering Maven itself uses to compare
+ * artifact versions (`org.apache.maven.artifact.versioning.ComparableVersion`),
+ * reimplemented from its documented rules so advisory ranges keyed on Maven
+ * versions (`introduced` / `fixed` / `last_affected`) are evaluated the way
+ * the build resolves them.
+ *
+ * Rules:
+ *   - case-insensitive; items are separated by `.` and `-`, and a transition
+ *     between digits and letters splits an item too (`1rc2` = `1-rc-2`);
+ *   - `-` (and a digit/letter transition) opens a nested sub-list, `.` does not,
+ *     except before a qualifier (`1.RC1` = `1-RC1`, as Maven 3.9 orders it);
+ *   - an empty item is `0`;
+ *   - "null" items — `0`, `""`, `final`, `ga`, `release` — are trimmed from the
+ *     end of every list, so `1.0.0` = `1` = `1.0-final` = `1-ga`;
+ *   - qualifiers order `alpha < beta < milestone < rc (= cr) < snapshot <
+ *     "" (release) < sp`; `a`, `b`, `m` directly followed by a digit mean
+ *     `alpha`, `beta`, `milestone`; any other qualifier sorts after all known
+ *     ones, lexically;
+ *   - a number is greater than any qualifier, and greater than a sub-list.
+ *
+ * Pure and synchronous; numbers of any length are compared exactly.
+ */
+/** Compare two Maven versions: negative, zero or positive, as Maven orders them. */
+export declare function compareMavenVersions(a: string, b: string): number;
+/** The canonical form Maven compares by (useful in tests and diagnostics). */
+export declare function canonicalMavenVersion(version: string): string;
+//# sourceMappingURL=maven-version.d.ts.map

package/dist/analysis/maven-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven-version.d.ts","sourceRoot":"","sources":["../../src/analysis/maven-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA8HH,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU7D"}

package/dist/analysis/maven-version.js

@@ -0,0 +1,172 @@
+/**
+ * Maven version ordering — the ordering Maven itself uses to compare
+ * artifact versions (`org.apache.maven.artifact.versioning.ComparableVersion`),
+ * reimplemented from its documented rules so advisory ranges keyed on Maven
+ * versions (`introduced` / `fixed` / `last_affected`) are evaluated the way
+ * the build resolves them.
+ *
+ * Rules:
+ *   - case-insensitive; items are separated by `.` and `-`, and a transition
+ *     between digits and letters splits an item too (`1rc2` = `1-rc-2`);
+ *   - `-` (and a digit/letter transition) opens a nested sub-list, `.` does not,
+ *     except before a qualifier (`1.RC1` = `1-RC1`, as Maven 3.9 orders it);
+ *   - an empty item is `0`;
+ *   - "null" items — `0`, `""`, `final`, `ga`, `release` — are trimmed from the
+ *     end of every list, so `1.0.0` = `1` = `1.0-final` = `1-ga`;
+ *   - qualifiers order `alpha < beta < milestone < rc (= cr) < snapshot <
+ *     "" (release) < sp`; `a`, `b`, `m` directly followed by a digit mean
+ *     `alpha`, `beta`, `milestone`; any other qualifier sorts after all known
+ *     ones, lexically;
+ *   - a number is greater than any qualifier, and greater than a sub-list.
+ *
+ * Pure and synchronous; numbers of any length are compared exactly.
+ */
+const QUALIFIERS = ['alpha', 'beta', 'milestone', 'rc', 'snapshot', '', 'sp'];
+const RELEASE_INDEX = String(QUALIFIERS.indexOf(''));
+const ALIASES = { ga: '', final: '', release: '', cr: 'rc' };
+function comparableQualifier(q) {
+    const i = QUALIFIERS.indexOf(q);
+    return i === -1 ? `${QUALIFIERS.length}-${q}` : String(i);
+}
+function stringItem(value, followedByDigit) {
+    let v = value;
+    if (followedByDigit && v.length === 1) {
+        if (v === 'a')
+            v = 'alpha';
+        else if (v === 'b')
+            v = 'beta';
+        else if (v === 'm')
+            v = 'milestone';
+    }
+    return { kind: 'string', value: ALIASES[v] ?? v };
+}
+function parseItem(buf, isDigit, followedByDigit) {
+    if (isDigit)
+        return { kind: 'int', value: BigInt(buf) };
+    return stringItem(buf, followedByDigit);
+}
+function isNull(item) {
+    if (item.kind === 'int')
+        return item.value === 0n;
+    if (item.kind === 'string')
+        return comparableQualifier(item.value) === RELEASE_INDEX;
+    return item.items.length === 0;
+}
+function normalize(list) {
+    for (let i = list.items.length - 1; i >= 0; i--) {
+        const last = list.items[i];
+        if (isNull(last))
+            list.items.splice(i, 1);
+        else if (last.kind !== 'list')
+            break;
+    }
+}
+function parse(version) {
+    // Maven 3.9 (MNG-7644): a qualifier after `.` sorts as if after `-`, so
+    // `1.0.0.RC1` = `1.0.0-RC1` and `1.foo` = `1-foo`.
+    const v = version.trim().toLowerCase().replace(/\.(?=[a-z])/g, '-');
+    const root = { kind: 'list', items: [] };
+    let list = root;
+    const stack = [root];
+    let isDigit = false;
+    let start = 0;
+    const isDigitAt = (i) => i < v.length && v[i] >= '0' && v[i] <= '9';
+    const pushSubList = () => {
+        const sub = { kind: 'list', items: [] };
+        list.items.push(sub);
+        list = sub;
+        stack.push(sub);
+    };
+    for (let i = 0; i < v.length; i++) {
+        const c = v[i];
+        if (c === '.' || c === '-') {
+            if (i === start)
+                list.items.push({ kind: 'int', value: 0n });
+            else
+                list.items.push(parseItem(v.slice(start, i), isDigit, isDigitAt(i + 1)));
+            start = i + 1;
+            if (c === '-')
+                pushSubList();
+            isDigit = false;
+        }
+        else if (c >= '0' && c <= '9') {
+            if (!isDigit && i > start) {
+                list.items.push(stringItem(v.slice(start, i), true));
+                start = i;
+                pushSubList();
+            }
+            isDigit = true;
+        }
+        else {
+            if (isDigit && i > start) {
+                list.items.push(parseItem(v.slice(start, i), true, false));
+                start = i;
+                pushSubList();
+            }
+            isDigit = false;
+        }
+    }
+    if (v.length > start)
+        list.items.push(parseItem(v.slice(start), isDigit, false));
+    while (stack.length > 0)
+        normalize(stack.pop());
+    return root;
+}
+function compareItem(a, b) {
+    if (a === undefined) {
+        if (b === undefined)
+            return 0;
+        return -compareItem(b, undefined);
+    }
+    switch (a.kind) {
+        case 'int':
+            if (b === undefined)
+                return a.value === 0n ? 0 : 1;
+            if (b.kind === 'int')
+                return a.value < b.value ? -1 : a.value > b.value ? 1 : 0;
+            return 1; // a number beats a qualifier and a sub-list
+        case 'string': {
+            if (b === undefined)
+                return cmpStr(comparableQualifier(a.value), RELEASE_INDEX);
+            if (b.kind === 'int' || b.kind === 'list')
+                return -1;
+            return cmpStr(comparableQualifier(a.value), comparableQualifier(b.value));
+        }
+        case 'list': {
+            if (b === undefined)
+                return a.items.length === 0 ? 0 : compareItem(a.items[0], undefined);
+            if (b.kind === 'int')
+                return -1;
+            if (b.kind === 'string')
+                return 1;
+            const n = Math.max(a.items.length, b.items.length);
+            for (let i = 0; i < n; i++) {
+                const r = compareItem(a.items[i], b.items[i]);
+                if (r !== 0)
+                    return r;
+            }
+            return 0;
+        }
+    }
+}
+function cmpStr(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+/** Compare two Maven versions: negative, zero or positive, as Maven orders them. */
+export function compareMavenVersions(a, b) {
+    return Math.sign(compareItem(parse(a), parse(b)));
+}
+/** The canonical form Maven compares by (useful in tests and diagnostics). */
+export function canonicalMavenVersion(version) {
+    const render = (list) => {
+        let out = '';
+        for (const item of list.items) {
+            if (out.length > 0)
+                out += item.kind === 'list' ? '-' : '.';
+            out += item.kind === 'int' ? item.value.toString() : item.kind === 'string' ? item.value : render(item);
+        }
+        return out;
+    };
+    return render(parse(version));
+}
+//# sourceMappingURL=maven-version.js.map

package/dist/analysis/maven-version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven-version.js","sourceRoot":"","sources":["../../src/analysis/maven-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;AAC9E,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AACrD,MAAM,OAAO,GAA2B,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAErF,SAAS,mBAAmB,CAAC,CAAS;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,eAAwB;IACzD,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,IAAI,eAAe,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,KAAK,GAAG;YAAE,CAAC,GAAG,OAAO,CAAC;aACtB,IAAI,CAAC,KAAK,GAAG;YAAE,CAAC,GAAG,MAAM,CAAC;aAC1B,IAAI,CAAC,KAAK,GAAG;YAAE,CAAC,GAAG,WAAW,CAAC;IACtC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,OAAgB,EAAE,eAAwB;IACxE,IAAI,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACxD,OAAO,UAAU,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,MAAM,CAAC,IAAU;IACxB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,aAAa,CAAC;IACrF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACrC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,MAAM;IACvC,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,wEAAwE;IACxE,mDAAmD;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACnD,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,MAAM,KAAK,GAAe,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;IAErF,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,MAAM,GAAG,GAAa,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,GAAG,GAAG,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;;gBACxD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9E,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,KAAK,GAAG;gBAAE,WAAW,EAAE,CAAC;YAC7B,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;aAAM,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;gBACrD,KAAK,GAAG,CAAC,CAAC;gBACV,WAAW,EAAE,CAAC;YAChB,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;gBAC3D,KAAK,GAAG,CAAC,CAAC;gBACV,WAAW,EAAE,CAAC;YAChB,CAAC;YACD,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,GAAG,KAAK;QAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,SAAS,CAAC,KAAK,CAAC,GAAG,EAAc,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,CAAmB,EAAE,CAAmB;IAC3D,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACpC,CAAC;IACD,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,KAAK;YACR,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,CAAC,4CAA4C;QACxD,KAAK,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;YAChF,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;gBAAE,OAAO,CAAC,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,CAAC,CAAC,CAAC;YAChC,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACnD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK,CAAC;oBAAE,OAAO,CAAC,CAAC;YACxB,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,EAAE,CAAS;IAClC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAAC,CAAS,EAAE,CAAS;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,MAAM,GAAG,CAAC,IAAc,EAAU,EAAE;QACxC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;gBAAE,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YAC5D,GAAG,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/dist/analysis/passes/constant-propagation-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constant-propagation-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/constant-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAA8B,KAAK,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAGvG,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,qBAAa,uBAAwB,YAAW,YAAY,CAAC,wBAAwB,CAAC;IAIxE,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,YAA6B,IAAI,EAAE,IAAI,EAAI;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB,CAwB9C;CACF"}
+{"version":3,"file":"constant-propagation-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/constant-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC9E,OAAO,EAA8B,KAAK,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAGvG,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,qBAAa,uBAAwB,YAAW,YAAY,CAAC,wBAAwB,CAAC;IAIxE,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;IAExC,YAA6B,IAAI,EAAE,IAAI,EAAI;IAE3C,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,wBAAwB,CA0B9C;CACF"}

package/dist/analysis/passes/constant-propagation-pass.js

@@ -35,10 +35,38 @@ export class ConstantPropagationPass {
                 }
             }
         }
-        return analyzeConstantPropagation(this.tree, code, {
+        const result = analyzeConstantPropagation(this.tree, code, {
             sanitizerMethods: taintMatcher.sanitizerMethods,
             taintedParameters,
         });
+        if (ctx.language === 'java')
+            pruneDeadChains(ctx, result.unreachableLines);
+        return result;
     }
 }
+/**
+ * Java: a def on a line const-prop proved unreachable (`else bar = param;`
+ * under a constant-true condition) propagates nothing. Drop its DFG chains so
+ * every chain walker — notably the cross-file interprocedural phase, which
+ * has no const-prop of its own — sees only live paths (#976: the try defs
+ * exposed OWASP dead-branch helpers whose source is in another file).
+ */
+function pruneDeadChains(ctx, unreachable) {
+    if (unreachable.size === 0)
+        return;
+    const dfg = ctx.graph.ir.dfg;
+    if (!dfg.chains || dfg.chains.length === 0)
+        return;
+    // Unreachable lines are line-granular: a ternary's dead arm marks the line of
+    // a live def (`bar = c ? "never" : param;`), so such lines are left alone.
+    const lines = ctx.code.split('\n');
+    const dead = new Set();
+    for (const d of dfg.defs) {
+        if (unreachable.has(d.line) && !/\?[^?.:]*:/.test(lines[d.line - 1] ?? ''))
+            dead.add(d.id);
+    }
+    if (dead.size === 0)
+        return;
+    dfg.chains = dfg.chains.filter(c => !dead.has(c.from_def) && !dead.has(c.to_def));
+}
 //# sourceMappingURL=constant-propagation-pass.js.map

package/dist/analysis/passes/constant-propagation-pass.js.map

@@ -1 +1 @@
-{"version":3,"file":"constant-propagation-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/constant-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,0BAA0B,EAAiC,MAAM,4BAA4B,CAAC;AAKvG,MAAM,OAAO,uBAAuB;IAIL,IAAI;IAHxB,IAAI,GAAG,sBAAsB,CAAC;IAC9B,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,IAAU;oBAAV,IAAI;IAAS,CAAC;IAE3C,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACrB,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAqB,eAAe,CAAC,CAAC;QAExE,iFAAiF;QACjF,gFAAgF;QAChF,MAAM,iBAAiB,GAAqD,EAAE,CAAC;QAC/E,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBAC5C,uDAAuD;gBACvD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAClE,IAAI,KAAK,EAAE,CAAC;oBACV,iBAAiB,CAAC,IAAI,CAAC;wBACrB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;wBACpB,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;YACjD,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"constant-propagation-pass.js","sourceRoot":"","sources":["../../../src/analysis/passes/constant-propagation-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,0BAA0B,EAAiC,MAAM,4BAA4B,CAAC;AAKvG,MAAM,OAAO,uBAAuB;IAIL,IAAI;IAHxB,IAAI,GAAG,sBAAsB,CAAC;IAC9B,QAAQ,GAAG,UAAmB,CAAC;IAExC,YAA6B,IAAU;oBAAV,IAAI;IAAS,CAAC;IAE3C,GAAG,CAAC,GAAgB;QAClB,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACrB,MAAM,YAAY,GAAG,GAAG,CAAC,SAAS,CAAqB,eAAe,CAAC,CAAC;QAExE,iFAAiF;QACjF,gFAAgF;QAChF,MAAM,iBAAiB,GAAqD,EAAE,CAAC;QAC/E,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;gBAC5C,uDAAuD;gBACvD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;gBAClE,IAAI,KAAK,EAAE,CAAC;oBACV,iBAAiB,CAAC,IAAI,CAAC;wBACrB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;wBACpB,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;qBACpB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE;YACzD,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,iBAAiB;SAClB,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,GAAgB,EAAE,WAAgC;IACzE,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC;IAC7B,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACnD,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAC5B,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpF,CAAC"}

package/dist/analysis/passes/cross-file-pass.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cross-file-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/cross-file-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,SAAS,EACT,aAAa,EAKd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAOjE,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,8CAA8C;IAC9C,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,uCAAuC;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,aAAa;IACxB,GAAG,CACD,YAAY,EAAE,YAAY;IAC1B,2EAA2E;IAC3E,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAClC,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CA6RrB;CACF"}
+{"version":3,"file":"cross-file-pass.d.ts","sourceRoot":"","sources":["../../../src/analysis/passes/cross-file-pass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,SAAS,EACT,aAAa,EAKd,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAOjE,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,8CAA8C;IAC9C,UAAU,EAAE,SAAS,EAAE,CAAC;IACxB,uCAAuC;IACvC,aAAa,EAAE,aAAa,CAAC;IAC7B;;;;OAIG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,aAAa;IACxB,GAAG,CACD,YAAY,EAAE,YAAY;IAC1B,2EAA2E;IAC3E,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EAClC,OAAO,GAAE,oBAAyB,GACjC,mBAAmB,CAoSrB;CACF"}

package/dist/analysis/passes/cross-file-pass.js

@@ -13,7 +13,7 @@
 import { logger } from '../../utils/logger.js';
 import { sanitizerCoversSink } from '../sanitizer-index.js';
 import { CSharpCredit } from './csharp-sanitizer-credit.js';
-import { csharpParamReachesSink } from './interprocedural-pass.js';
+import { calleeReturnMayCarryParam, csharpParamReachesSink } from './interprocedural-pass.js';
 export class CrossFilePass {
     run(projectGraph, 
     /** Raw source lines per file (used to populate `code` fields in paths). */
@@ -130,8 +130,10 @@ export class CrossFilePass {
             logger.debug('cross-file: phase 3/4 starting (findFieldBindingTaintPaths)');
             const phase3 = resolver.findFieldBindingTaintPaths(budgetExceeded);
             ipPaths.push(...phase3);
+            const phase3b = resolver.findCSharpStaticFieldTaintPaths(budgetExceeded);
+            ipPaths.push(...phase3b);
             logger.info('cross-file: phase 3/4 done', {
-                paths: phase3.length, elapsedMs: Date.now() - phase3Start,
+                paths: phase3.length + phase3b.length, elapsedMs: Date.now() - phase3Start,
             });
         }
         if (!exceeded && budgetExceeded()) {
@@ -163,6 +165,10 @@ export class CrossFilePass {
                 !csharpCalleeReachesSink(sinkIR, sourceLines.get(p.sink.file) ?? [], sinkHop.method, p.calleeArgPositions, matchedSink, callHop?.kind === 'sink_call' ? sourceLines.get(callHop.file)?.[callHop.line - 1] : undefined)) {
                 continue;
             }
+            if (sinkIR.meta.language === 'java' &&
+                javaHelperStopsCallerPath(sinkIR, sourceLines.get(p.sink.file) ?? [], p)) {
+                continue;
+            }
             const srcLines = sourceLines.get(p.source.file) ?? [];
             const tgtLines = sourceLines.get(p.sink.file) ?? [];
             // Dedup against any direct cross-file taint already emitted at the same
@@ -466,4 +472,80 @@ function findCrossInstanceAliasingPaths(projectGraph, _sourceLines) {
     }
     return paths;
 }
+/**
+ * Java (#976): the interprocedural walker follows the caller's DFG chains
+ * through `bar = new Test().doSomething(request, param)` without asking whether
+ * that same-file helper can return its argument. Re-walk the caller side from
+ * the last hop before the sink, stopping at defs assigned from a same-file
+ * method that #1010's helper-return gate shows returns no parameter (a
+ * constant-folding ternary, a list read of a safe slot). True when the sink is
+ * then no longer reached. Without chains, or with nothing to stop, nothing changes.
+ */
+function javaHelperStopsCallerPath(ir, lines, p) {
+    const chains = ir.dfg.chains;
+    if (!chains || chains.length === 0 || lines.length === 0)
+        return false;
+    const hops = p.hops;
+    const before = hops.length >= 2 ? hops[hops.length - 2] : undefined;
+    if (!before || before.file !== p.sink.file || before.line >= p.sink.line)
+        return false;
+    const code = lines.join('\n');
+    const localMethods = new Map();
+    for (const t of ir.types)
+        for (const m of t.methods) {
+            const arr = localMethods.get(m.name) ?? [];
+            arr.push({ start: m.start_line, end: m.end_line });
+            localMethods.set(m.name, arr);
+        }
+    const blockedLine = new Map();
+    const isBlocked = (line) => {
+        let b = blockedLine.get(line);
+        if (b !== undefined)
+            return b;
+        b = false;
+        for (const c of ir.calls) {
+            if (c.location.line !== line)
+                continue;
+            const ms = localMethods.get(c.method_name);
+            if (!ms || ms.length !== 1)
+                continue;
+            if (!calleeReturnMayCarryParam(code, ms[0].start, ms[0].end, [])) {
+                b = true;
+                break;
+            }
+        }
+        blockedLine.set(line, b);
+        return b;
+    };
+    const lineOf = new Map();
+    for (const d of ir.dfg.defs)
+        lineOf.set(d.id, d.line);
+    const seeds = ir.dfg.defs.filter(d => d.line === before.line && d.kind === 'local').map(d => d.id);
+    if (seeds.length === 0)
+        return false;
+    let stopped = false;
+    const reached = new Set(seeds);
+    const frontier = [...seeds];
+    while (frontier.length > 0) {
+        const cur = frontier.pop();
+        for (const ch of chains) {
+            if (ch.from_def !== cur || reached.has(ch.to_def))
+                continue;
+            const l = lineOf.get(ch.to_def);
+            if (l !== undefined && l !== before.line && isBlocked(l)) {
+                stopped = true;
+                continue;
+            }
+            reached.add(ch.to_def);
+            frontier.push(ch.to_def);
+        }
+    }
+    if (!stopped)
+        return false;
+    // The sink statement may wrap: its arguments can sit on later lines.
+    let end = p.sink.line;
+    while (end < lines.length && !/[;{}]\s*$/.test((lines[end - 1] ?? '').replace(/\/\/.*$/, '').trimEnd()))
+        end++;
+    return !ir.dfg.uses.some(u => u.line >= p.sink.line && u.line <= end && u.def_id !== null && reached.has(u.def_id));
+}
 //# sourceMappingURL=cross-file-pass.js.map