circle-ir 4.9.20 → 4.9.22

package/dist/browser/circle-ir.js

@@ -122,6 +122,18 @@ function setModule(module2) {
 }
 __name(setModule, "setModule");
 var C;
+function newFinalizer(handler) {
+  try {
+    return new FinalizationRegistry(handler);
+  } catch (e) {
+    console.error("Unsupported FinalizationRegistry:", e);
+    return;
+  }
+}
+__name(newFinalizer, "newFinalizer");
+var finalizer = newFinalizer((address) => {
+  C._ts_lookahead_iterator_delete(address);
+});
 var LookaheadIterator = class {
   static {
     __name(this, "LookaheadIterator");
@@ -132,21 +144,39 @@ var LookaheadIterator = class {
   /** @internal */
   language;
   /** @internal */
+  positioned = false;
+  /** @internal */
   constructor(internal, address, language) {
     assertInternal(internal);
     this[0] = address;
     this.language = language;
+    finalizer?.register(this, address, this);
   }
-  /** Get the current symbol of the lookahead iterator. */
+  /**
+   * Get the current symbol of the lookahead iterator.
+   *
+   * Returns `null` if the iterator is not positioned on a symbol:
+   *
+   * - Before the first iteration step
+   * - After the iterator is exhausted
+   * - After a {@link reset} or {@link resetState} call
+   */
   get currentTypeId() {
-    return C._ts_lookahead_iterator_current_symbol(this[0]);
+    return this.positioned ? C._ts_lookahead_iterator_current_symbol(this[0]) : null;
   }
-  /** Get the current symbol name of the lookahead iterator. */
+  /**
+   * Get the current symbol name of the lookahead iterator.
+   *
+   * Returns `null` if the iterator is not positioned on a symbol.
+   */
   get currentType() {
-    return this.language.types[this.currentTypeId] || "ERROR";
+    const id = this.currentTypeId;
+    if (id === null) return null;
+    return this.language.types[id] ?? C.UTF8ToString(C._ts_language_symbol_name(this.language[0], id));
   }
   /** Delete the lookahead iterator, freeing its resources. */
   delete() {
+    finalizer?.unregister(this);
     C._ts_lookahead_iterator_delete(this[0]);
     this[0] = 0;
   }
@@ -159,6 +189,7 @@ var LookaheadIterator = class {
   reset(language, stateId) {
     if (C._ts_lookahead_iterator_reset(this[0], language[0], stateId)) {
       this.language = language;
+      this.positioned = false;
       return true;
     }
     return false;
@@ -170,7 +201,9 @@ var LookaheadIterator = class {
    * `false` otherwise.
    */
   resetState(stateId) {
-    return Boolean(C._ts_lookahead_iterator_reset_state(this[0], stateId));
+    if (!C._ts_lookahead_iterator_reset_state(this[0], stateId)) return false;
+    this.positioned = false;
+    return true;
   }
   /**
    * Returns an iterator that iterates over the symbols of the lookahead iterator.
@@ -181,10 +214,9 @@ var LookaheadIterator = class {
   [Symbol.iterator]() {
     return {
       next: /* @__PURE__ */ __name(() => {
-        if (C._ts_lookahead_iterator_next(this[0])) {
-          return { done: false, value: this.currentType };
-        }
-        return { done: true, value: "" };
+        this.positioned = Boolean(C._ts_lookahead_iterator_next(this[0]));
+        const value = this.currentType;
+        return value === null ? { done: true, value: "" } : { done: false, value };
       }, "next")
     };
   }
@@ -210,6 +242,9 @@ function getText(tree, startIndex, endIndex, startPosition) {
   return result ?? "";
 }
 __name(getText, "getText");
+var finalizer2 = newFinalizer((address) => {
+  C._ts_tree_delete(address);
+});
 var Tree = class _Tree {
   static {
     __name(this, "Tree");
@@ -227,6 +262,7 @@ var Tree = class _Tree {
     this[0] = address;
     this.language = language;
     this.textCallback = textCallback;
+    finalizer2?.register(this, address, this);
   }
   /** Create a shallow copy of the syntax tree. This is very fast. */
   copy() {
@@ -235,6 +271,7 @@ var Tree = class _Tree {
   }
   /** Delete the syntax tree, freeing its resources. */
   delete() {
+    finalizer2?.unregister(this);
     C._ts_tree_delete(this[0]);
     this[0] = 0;
   }
@@ -315,6 +352,9 @@ var Tree = class _Tree {
     return result;
   }
 };
+var finalizer3 = newFinalizer((address) => {
+  C._ts_tree_cursor_delete_wasm(address);
+});
 var TreeCursor = class _TreeCursor {
   static {
     __name(this, "TreeCursor");
@@ -342,6 +382,7 @@ var TreeCursor = class _TreeCursor {
     assertInternal(internal);
     this.tree = tree;
     unmarshalTreeCursor(this);
+    finalizer3?.register(this, this.tree[0], this);
   }
   /** Creates a deep copy of the tree cursor. This allocates new memory. */
   copy() {
@@ -352,6 +393,7 @@ var TreeCursor = class _TreeCursor {
   }
   /** Delete the tree cursor, freeing its resources. */
   delete() {
+    finalizer3?.unregister(this);
     marshalTreeCursor(this);
     C._ts_tree_cursor_delete_wasm(this.tree[0]);
     this[0] = this[1] = this[2] = 0;
@@ -1446,8 +1488,9 @@ var Language = class _Language {
    * This returns `null` if state is invalid for this language.
    *
    * Iterating {@link LookaheadIterator} will yield valid symbols in the given
-   * parse state. Newly created lookahead iterators will return the `ERROR`
-   * symbol from {@link LookaheadIterator#currentType}.
+   * parse state. A newly created iterator is not positioned on a symbol, so
+   * {@link LookaheadIterator#currentType} returns `null` until the first
+   * iteration step.
    *
    * Lookahead iterators can be useful for generating suggestions and improving
    * syntax error diagnostics. To get symbols valid in an `ERROR` node, use the
@@ -1462,7 +1505,8 @@ var Language = class _Language {
   }
   /**
    * Load a language from a WebAssembly module.
-   * The module can be provided as a path to a file or as a buffer.
+   * The module can be provided as a path to a file, a `URL` to a file, or as a
+   * buffer.
    */
   static async load(input) {
     let binary2;
@@ -1489,16 +1533,27 @@ ${body2}`);
       }
     }
     const mod = await C.loadWebAssemblyModule(binary2, { loadAsync: true });
+    return _Language.loadFromWasmExports(mod, { sync: false });
+  }
+  static loadFromWasmExports(mod, { sync }) {
     const symbolNames = Object.keys(mod);
     const functionName = symbolNames.find((key) => LANGUAGE_FUNCTION_REGEX.test(key) && !key.includes("external_scanner_"));
     if (!functionName) {
       console.log(`Couldn't find language function in Wasm file. Symbols:
 ${JSON.stringify(symbolNames, null, 2)}`);
-      throw new Error("Language.load failed: no language function found in Wasm file");
+      throw new Error(`Language.${sync ? "loadSync" : "load"} failed: no language function found in Wasm file`);
     }
     const languageAddress = mod[functionName]();
     return new _Language(INTERNAL, languageAddress);
   }
+  /**
+   * Load a language synchronously from a pre-compiled WebAssembly module.
+   * Use this when the host environment provides a `WebAssembly.Module` directly.
+   */
+  static loadSync(wasmModule) {
+    const mod = C.loadWebAssemblyModule(wasmModule, { loadAsync: false });
+    return _Language.loadFromWasmExports(mod, { sync: true });
+  }
 };
 async function Module2(moduleArg = {}) {
   var moduleRtn;
@@ -2021,7 +2076,7 @@ async function Module2(moduleArg = {}) {
       newDSO("__main__", 0, wasmImports);
     }
   };
-  var ___heap_base = 78240;
+  var ___heap_base = 82240;
   var alignMemory = /* @__PURE__ */ __name((size, alignment) => Math.ceil(size / alignment) * alignment, "alignMemory");
   var getMemory = /* @__PURE__ */ __name((size) => {
     if (runtimeInitialized) {
@@ -2586,12 +2641,12 @@ async function Module2(moduleArg = {}) {
     "value": "i32",
     "mutable": false
   }, 1024);
-  var ___stack_high = 78240;
-  var ___stack_low = 12704;
+  var ___stack_high = 82240;
+  var ___stack_low = 16704;
   var ___stack_pointer = new WebAssembly.Global({
     "value": "i32",
     "mutable": true
-  }, 78240);
+  }, 82240);
   var ___table_base = new WebAssembly.Global({
     "value": "i32",
     "mutable": false
@@ -2852,7 +2907,7 @@ async function Module2(moduleArg = {}) {
   Module["loadWebAssemblyModule"] = loadWebAssemblyModule;
   Module["LE_HEAP_STORE_I64"] = LE_HEAP_STORE_I64;
   var ASM_CONSTS = {};
-  var _malloc, _calloc, _realloc, _free, _ts_range_edit, _memcmp, _ts_language_symbol_count, _ts_language_state_count, _ts_language_abi_version, _ts_language_name, _ts_language_field_count, _ts_language_next_state, _ts_language_symbol_name, _ts_language_symbol_for_name, _strncmp, _ts_language_symbol_type, _ts_language_field_name_for_id, _ts_lookahead_iterator_new, _ts_lookahead_iterator_delete, _ts_lookahead_iterator_reset_state, _ts_lookahead_iterator_reset, _ts_lookahead_iterator_next, _ts_lookahead_iterator_current_symbol, _ts_point_edit, _ts_parser_delete, _ts_parser_reset, _ts_parser_set_language, _ts_parser_set_included_ranges, _ts_query_new, _ts_query_delete, _iswspace, _iswalnum, _ts_query_pattern_count, _ts_query_capture_count, _ts_query_string_count, _ts_query_capture_name_for_id, _ts_query_capture_quantifier_for_id, _ts_query_string_value_for_id, _ts_query_predicates_for_pattern, _ts_query_start_byte_for_pattern, _ts_query_end_byte_for_pattern, _ts_query_is_pattern_rooted, _ts_query_is_pattern_non_local, _ts_query_is_pattern_guaranteed_at_step, _ts_query_disable_capture, _ts_query_disable_pattern, _ts_tree_copy, _ts_tree_delete, _ts_init, _ts_parser_new_wasm, _ts_parser_enable_logger_wasm, _ts_parser_parse_wasm, _ts_parser_included_ranges_wasm, _ts_language_type_is_named_wasm, _ts_language_type_is_visible_wasm, _ts_language_metadata_wasm, _ts_language_supertypes_wasm, _ts_language_subtypes_wasm, _ts_tree_root_node_wasm, _ts_tree_root_node_with_offset_wasm, _ts_tree_edit_wasm, _ts_tree_included_ranges_wasm, _ts_tree_get_changed_ranges_wasm, _ts_tree_cursor_new_wasm, _ts_tree_cursor_copy_wasm, _ts_tree_cursor_delete_wasm, _ts_tree_cursor_reset_wasm, _ts_tree_cursor_reset_to_wasm, _ts_tree_cursor_goto_first_child_wasm, _ts_tree_cursor_goto_last_child_wasm, _ts_tree_cursor_goto_first_child_for_index_wasm, _ts_tree_cursor_goto_first_child_for_position_wasm, _ts_tree_cursor_goto_next_sibling_wasm, _ts_tree_cursor_goto_previous_sibling_wasm, _ts_tree_cursor_goto_descendant_wasm, _ts_tree_cursor_goto_parent_wasm, _ts_tree_cursor_current_node_type_id_wasm, _ts_tree_cursor_current_node_state_id_wasm, _ts_tree_cursor_current_node_is_named_wasm, _ts_tree_cursor_current_node_is_missing_wasm, _ts_tree_cursor_current_node_id_wasm, _ts_tree_cursor_start_position_wasm, _ts_tree_cursor_end_position_wasm, _ts_tree_cursor_start_index_wasm, _ts_tree_cursor_end_index_wasm, _ts_tree_cursor_current_field_id_wasm, _ts_tree_cursor_current_depth_wasm, _ts_tree_cursor_current_descendant_index_wasm, _ts_tree_cursor_current_node_wasm, _ts_node_symbol_wasm, _ts_node_field_name_for_child_wasm, _ts_node_field_name_for_named_child_wasm, _ts_node_children_by_field_id_wasm, _ts_node_first_child_for_byte_wasm, _ts_node_first_named_child_for_byte_wasm, _ts_node_grammar_symbol_wasm, _ts_node_child_count_wasm, _ts_node_named_child_count_wasm, _ts_node_child_wasm, _ts_node_named_child_wasm, _ts_node_child_by_field_id_wasm, _ts_node_next_sibling_wasm, _ts_node_prev_sibling_wasm, _ts_node_next_named_sibling_wasm, _ts_node_prev_named_sibling_wasm, _ts_node_descendant_count_wasm, _ts_node_parent_wasm, _ts_node_child_with_descendant_wasm, _ts_node_descendant_for_index_wasm, _ts_node_named_descendant_for_index_wasm, _ts_node_descendant_for_position_wasm, _ts_node_named_descendant_for_position_wasm, _ts_node_start_point_wasm, _ts_node_end_point_wasm, _ts_node_start_index_wasm, _ts_node_end_index_wasm, _ts_node_to_string_wasm, _ts_node_children_wasm, _ts_node_named_children_wasm, _ts_node_descendants_of_type_wasm, _ts_node_is_named_wasm, _ts_node_has_changes_wasm, _ts_node_has_error_wasm, _ts_node_is_error_wasm, _ts_node_is_missing_wasm, _ts_node_is_extra_wasm, _ts_node_parse_state_wasm, _ts_node_next_parse_state_wasm, _ts_query_matches_wasm, _ts_query_captures_wasm, _memset, _memcpy, _memmove, _iswalpha, _iswblank, _iswdigit, _iswlower, _iswupper, _iswxdigit, _memchr, _strlen, _strcmp, _strncat, _strncpy, _towlower, _towupper, _setThrew, __emscripten_stack_restore, __emscripten_stack_alloc, _emscripten_stack_get_current, ___wasm_apply_data_relocs;
+  var _malloc, _calloc, _realloc, _free, _ts_range_edit, _memcmp, _ts_language_symbol_count, _ts_language_state_count, _ts_language_abi_version, _ts_language_name, _ts_language_field_count, _ts_language_next_state, _ts_language_symbol_name, _ts_language_symbol_for_name, _strncmp, _ts_language_symbol_type, _ts_language_field_name_for_id, _ts_lookahead_iterator_new, _ts_lookahead_iterator_delete, _ts_lookahead_iterator_reset_state, _ts_lookahead_iterator_reset, _ts_lookahead_iterator_next, _ts_lookahead_iterator_current_symbol, _ts_point_edit, _ts_parser_delete, _ts_parser_reset, _ts_parser_set_language, _ts_parser_set_included_ranges, _ts_query_new, _ts_query_delete, _iswspace, _iswalnum, _ts_query_copy, _ts_query_pattern_count, _ts_query_capture_count, _ts_query_string_count, _ts_query_capture_name_for_id, _ts_query_capture_quantifier_for_id, _ts_query_string_value_for_id, _ts_query_predicates_for_pattern, _ts_query_start_byte_for_pattern, _ts_query_end_byte_for_pattern, _ts_query_is_pattern_rooted, _ts_query_is_pattern_non_local, _ts_query_is_pattern_guaranteed_at_step, _ts_query_disable_capture, _ts_query_disable_pattern, _ts_tree_copy, _ts_tree_delete, _ts_init, _ts_parser_new_wasm, _ts_parser_enable_logger_wasm, _ts_parser_parse_wasm, _ts_parser_included_ranges_wasm, _ts_language_type_is_named_wasm, _ts_language_type_is_visible_wasm, _ts_language_metadata_wasm, _ts_language_supertypes_wasm, _ts_language_subtypes_wasm, _ts_tree_root_node_wasm, _ts_tree_root_node_with_offset_wasm, _ts_tree_edit_wasm, _ts_tree_included_ranges_wasm, _ts_tree_get_changed_ranges_wasm, _ts_tree_cursor_new_wasm, _ts_tree_cursor_copy_wasm, _ts_tree_cursor_delete_wasm, _ts_tree_cursor_reset_wasm, _ts_tree_cursor_reset_to_wasm, _ts_tree_cursor_goto_first_child_wasm, _ts_tree_cursor_goto_last_child_wasm, _ts_tree_cursor_goto_first_child_for_index_wasm, _ts_tree_cursor_goto_first_child_for_position_wasm, _ts_tree_cursor_goto_next_sibling_wasm, _ts_tree_cursor_goto_previous_sibling_wasm, _ts_tree_cursor_goto_descendant_wasm, _ts_tree_cursor_goto_parent_wasm, _ts_tree_cursor_current_node_type_id_wasm, _ts_tree_cursor_current_node_state_id_wasm, _ts_tree_cursor_current_node_is_named_wasm, _ts_tree_cursor_current_node_is_missing_wasm, _ts_tree_cursor_current_node_id_wasm, _ts_tree_cursor_start_position_wasm, _ts_tree_cursor_end_position_wasm, _ts_tree_cursor_start_index_wasm, _ts_tree_cursor_end_index_wasm, _ts_tree_cursor_current_field_id_wasm, _ts_tree_cursor_current_depth_wasm, _ts_tree_cursor_current_descendant_index_wasm, _ts_tree_cursor_current_node_wasm, _ts_node_symbol_wasm, _ts_node_field_name_for_child_wasm, _ts_node_field_name_for_named_child_wasm, _ts_node_children_by_field_id_wasm, _ts_node_first_child_for_byte_wasm, _ts_node_first_named_child_for_byte_wasm, _ts_node_grammar_symbol_wasm, _ts_node_child_count_wasm, _ts_node_named_child_count_wasm, _ts_node_child_wasm, _ts_node_named_child_wasm, _ts_node_child_by_field_id_wasm, _ts_node_next_sibling_wasm, _ts_node_prev_sibling_wasm, _ts_node_next_named_sibling_wasm, _ts_node_prev_named_sibling_wasm, _ts_node_descendant_count_wasm, _ts_node_parent_wasm, _ts_node_child_with_descendant_wasm, _ts_node_descendant_for_index_wasm, _ts_node_named_descendant_for_index_wasm, _ts_node_descendant_for_position_wasm, _ts_node_named_descendant_for_position_wasm, _ts_node_start_point_wasm, _ts_node_end_point_wasm, _ts_node_start_index_wasm, _ts_node_end_index_wasm, _ts_node_to_string_wasm, _ts_node_children_wasm, _ts_node_named_children_wasm, _ts_node_descendants_of_type_wasm, _ts_node_is_named_wasm, _ts_node_has_changes_wasm, _ts_node_has_error_wasm, _ts_node_is_error_wasm, _ts_node_is_missing_wasm, _ts_node_is_extra_wasm, _ts_node_parse_state_wasm, _ts_node_next_parse_state_wasm, _ts_query_matches_wasm, _ts_query_captures_wasm, _memset, _memcpy, _memmove, _iswalpha, _iswblank, _iswdigit, _iswlower, _iswpunct, _iswupper, _iswxdigit, _memchr, _strlen, _strcmp, _strncat, _strncpy, _towlower, _towupper, _setThrew, __emscripten_stack_restore, __emscripten_stack_alloc, _emscripten_stack_get_current, ___wasm_apply_data_relocs;
   function assignWasmExports(wasmExports2) {
     Module["_malloc"] = _malloc = wasmExports2["malloc"];
     Module["_calloc"] = _calloc = wasmExports2["calloc"];
@@ -2886,6 +2941,7 @@ async function Module2(moduleArg = {}) {
     Module["_ts_query_delete"] = _ts_query_delete = wasmExports2["ts_query_delete"];
     Module["_iswspace"] = _iswspace = wasmExports2["iswspace"];
     Module["_iswalnum"] = _iswalnum = wasmExports2["iswalnum"];
+    Module["_ts_query_copy"] = _ts_query_copy = wasmExports2["ts_query_copy"];
     Module["_ts_query_pattern_count"] = _ts_query_pattern_count = wasmExports2["ts_query_pattern_count"];
     Module["_ts_query_capture_count"] = _ts_query_capture_count = wasmExports2["ts_query_capture_count"];
     Module["_ts_query_string_count"] = _ts_query_string_count = wasmExports2["ts_query_string_count"];
@@ -2991,6 +3047,7 @@ async function Module2(moduleArg = {}) {
     Module["_iswblank"] = _iswblank = wasmExports2["iswblank"];
     Module["_iswdigit"] = _iswdigit = wasmExports2["iswdigit"];
     Module["_iswlower"] = _iswlower = wasmExports2["iswlower"];
+    Module["_iswpunct"] = _iswpunct = wasmExports2["iswpunct"];
     Module["_iswupper"] = _iswupper = wasmExports2["iswupper"];
     Module["_iswxdigit"] = _iswxdigit = wasmExports2["iswxdigit"];
     Module["_memchr"] = _memchr = wasmExports2["memchr"];
@@ -3128,6 +3185,10 @@ __name(checkModule, "checkModule");
 var TRANSFER_BUFFER;
 var LANGUAGE_VERSION;
 var MIN_COMPATIBLE_VERSION;
+var finalizer4 = newFinalizer((addresses) => {
+  C._ts_parser_delete(addresses[0]);
+  C._free(addresses[1]);
+});
 var Parser = class {
   static {
     __name(this, "Parser");
@@ -3159,6 +3220,7 @@ var Parser = class {
    */
   constructor() {
     this.initialize();
+    finalizer4?.register(this, [this[0], this[1]], this);
   }
   /** @internal */
   initialize() {
@@ -3171,6 +3233,7 @@ var Parser = class {
   }
   /** Delete the parser, freeing its resources. */
   delete() {
+    finalizer4?.unregister(this);
     C._ts_parser_delete(this[0]);
     C._free(this[1]);
     this[0] = 0;
@@ -3346,6 +3409,10 @@ var QueryError = class _QueryError extends Error {
     this.length = length;
     this.name = "QueryError";
   }
+  kind;
+  info;
+  index;
+  length;
   static {
     __name(this, "QueryError");
   }
@@ -3541,6 +3608,9 @@ function parsePattern(index, stepType, stepValueId, captureNames, stringValues,
   }
 }
 __name(parsePattern, "parsePattern");
+var finalizer5 = newFinalizer((address) => {
+  C._ts_query_delete(address);
+});
 var Query = class {
   static {
     __name(this, "Query");
@@ -3695,9 +3765,11 @@ var Query = class {
     this.assertedProperties = assertedProperties;
     this.refutedProperties = refutedProperties;
     this.exceededMatchLimit = false;
+    finalizer5?.register(this, address, this);
   }
   /** Delete the query, freeing its resources. */
   delete() {
+    finalizer5?.unregister(this);
     C._ts_query_delete(this[0]);
     this[0] = 0;
   }
@@ -9153,7 +9225,7 @@ function buildBashCFG(tree, startId, cache) {
       allEdges.push({ from: entryBlock.id, to: firstBlockId, type: "sequential" });
     }
     const exitBlock = {
-      id: blockIdCounter++,
+      id: blockIdCounter,
       type: "exit",
       start_line: topLevelStatements[topLevelStatements.length - 1].endPosition.row + 1,
       end_line: topLevelStatements[topLevelStatements.length - 1].endPosition.row + 1
@@ -9271,7 +9343,7 @@ function buildGoCFG(tree, blockIdCounter, cache) {
   );
   if (hasTopLevelDecls) {
     const block = {
-      id: blockIdCounter++,
+      id: blockIdCounter,
       type: "normal",
       start_line: 1,
       end_line: tree.rootNode.endPosition.row + 1
@@ -10290,7 +10362,7 @@ function buildRustDFG(tree, cache) {
   const defs = [];
   const uses = [];
   let defIdCounter = 1;
-  let useIdCounter = 1;
+  const useIdCounter = 1;
   const scopeStack = [/* @__PURE__ */ new Map()];
   const functions = findNodes(tree.rootNode, "function_item");
   for (const func2 of functions) {
@@ -11169,7 +11241,7 @@ function parsePythonDecorator(dec) {
     const fnNode = target.childForFieldName("function");
     if (!fnNode) return null;
     let receiver = "";
-    let method = "";
+    let method;
     if (fnNode.type === "identifier") {
       method = getNodeText(fnNode);
     } else if (fnNode.type === "attribute") {
@@ -11235,7 +11307,7 @@ function classifyPythonDecorator(receiver, method, imp) {
   if (receiver && PY_HTTP_ROUTE_METHODS.has(method)) {
     const isRoutey = isPyRouterReceiver(receiver);
     if (isRoutey) {
-      let framework = "unknown";
+      let framework;
       if (imp.hasFlask) framework = "flask";
       else if (imp.hasFastApi) framework = "fastapi";
       else if (method === "route") framework = "flask";
@@ -21568,7 +21640,7 @@ var ConstantPropagator = class _ConstantPropagator {
         }
       }
       const startIdx = matchingIdx >= 0 ? matchingIdx : defaultIdx;
-      for (let i2 = 0; i2 < startIdx && startIdx >= 0; i2++) {
+      for (let i2 = 0; i2 < startIdx; i2++) {
         this.markUnreachable(caseGroups[i2]);
       }
       if (startIdx >= 0) {
@@ -26374,16 +26446,21 @@ var CSharpPlugin = class extends BaseLanguagePlugin {
 };
 
 // src/languages/plugins/index.ts
+function createBuiltinPlugins() {
+  return [
+    new JavaPlugin(),
+    new JavaScriptPlugin(),
+    new PythonPlugin(),
+    new RustPlugin(),
+    new BashPlugin(),
+    new HtmlPlugin(),
+    new VuePlugin(),
+    new GoPlugin(),
+    new CSharpPlugin()
+  ];
+}
 function registerBuiltinPlugins() {
-  registerLanguage(new JavaPlugin());
-  registerLanguage(new JavaScriptPlugin());
-  registerLanguage(new PythonPlugin());
-  registerLanguage(new RustPlugin());
-  registerLanguage(new BashPlugin());
-  registerLanguage(new HtmlPlugin());
-  registerLanguage(new VuePlugin());
-  registerLanguage(new GoPlugin());
-  registerLanguage(new CSharpPlugin());
+  for (const plugin of createBuiltinPlugins()) registerLanguage(plugin);
 }
 
 // src/analysis/html/html-extractor.ts
@@ -29525,16 +29602,12 @@ function findPythonRegexAllowlistWrapperSanitizers(code) {
     const argName = m[3];
     let foundGuard = false;
     let returnsArg = false;
-    let blockEnd = -1;
     const maxScan = Math.min(lines.length, i2 + 40);
     for (let j = i2 + 1; j < maxScan; j++) {
       const line = lines[j];
       if (line.trim() === "") continue;
       const indent = line.length - line.trimStart().length;
-      if (indent <= defIndent) {
-        blockEnd = j - 1;
-        break;
-      }
+      if (indent <= defIndent) break;
       if (!foundGuard) {
         const guard = new RegExp(
           `if\\s+not\\s+re\\.(?:fullmatch|match)\\s*\\(\\s*(${tightRegex.source})\\s*,\\s*${argName}\\s*\\)\\s*:`
@@ -29554,7 +29627,6 @@ function findPythonRegexAllowlistWrapperSanitizers(code) {
         returnsArg = true;
       }
     }
-    if (blockEnd === -1) blockEnd = Math.min(lines.length - 1, i2 + 39);
     if (!foundGuard || !returnsArg) continue;
     wrappers.push({ name: wrapperName, defLine: i2, defIndent });
   }
@@ -32271,7 +32343,7 @@ function findRustEvalCrateCodeInjectionFindings(code, file) {
       }
       if (arg === null) continue;
       if (arg.length === 0) continue;
-      let unwrapped = arg.replace(/^&\s*/, "").trim();
+      const unwrapped = arg.replace(/^&\s*/, "").trim();
       if (/^"[^"]*"$/.test(unwrapped)) continue;
       let tainted = false;
       for (const v of fn.tainted) {
@@ -32884,7 +32956,7 @@ function findJsLdapInjectionFindings(code, file) {
   for (let i2 = 0; i2 < lines.length; i2++) {
     const line = lines[i2];
     const fm = line.match(filterPropRe);
-    let expr = null;
+    let expr;
     if (fm) {
       expr = fm[1].trim();
     } else if (filterShorthandRe.test(line)) {
@@ -35345,7 +35417,7 @@ var SinkFilterPass = class {
           if (/^-?\d+$/.test(t) || /^"(?:[^"\\]|\\.)*"$/.test(t) || /^'(?:[^'\\]|\\.)*'$/.test(t)) {
             continue;
           }
-          let helperName = null;
+          let helperName;
           const directCall = t.match(/^([A-Za-z_]\w*)\s*\(/);
           if (directCall) {
             helperName = directCall[1] ?? null;
@@ -40631,7 +40703,7 @@ function buildSourceCoveredRanges(codeLines, language) {
 function buildJsCoveredRanges(codeLines) {
   const ranges = [];
   const tryStack = [];
-  let braceDepthAtTry = [];
+  const braceDepthAtTry = [];
   let braceDepth = 0;
   for (let i2 = 0; i2 < codeLines.length; i2++) {
     const line = codeLines[i2];
@@ -40703,12 +40775,6 @@ var UnhandledExceptionPass = class {
         coveredRanges.push(range);
       }
     }
-    const catchStarts = new Set(
-      exGraph.pairs.map((p) => p.catchBlock.start_line)
-    );
-    for (const range of coveredRanges) {
-      catchStarts.add(range.end + 1);
-    }
     const throwRe = language === "python" ? PYTHON_RAISE_RE : JS_THROW_RE;
     const unhandled = [];
     const reportedMethods = /* @__PURE__ */ new Set();
@@ -40716,13 +40782,6 @@ var UnhandledExceptionPass = class {
       const lineText = codeLines[ln - 1] ?? "";
       if (!throwRe.test(lineText)) continue;
       let inCatch = false;
-      for (const cs of catchStarts) {
-        if (ln >= cs) {
-          inCatch = true;
-          break;
-        }
-      }
-      inCatch = false;
       for (const pair of exGraph.pairs) {
         if (ln >= pair.catchBlock.start_line) {
           const mThrow = graph.methodAtLine(ln);
@@ -46187,6 +46246,8 @@ var JAVA_XML_OUTPUT_ONLY_RE = /\bnew\s+(?:DOMSource|StreamResult)\s*\(/;
 var JAVA_XML_PARSE_INPUT_RE = /\bnew\s+(?:StreamSource|SAXSource|InputSource)\s*\(/;
 var JAVA_DOC_BUILDER_NEW_DOCUMENT_RE = /\.\s*newDocument\s*\(\s*\)/;
 var JAVA_DOC_BUILDER_PARSE_RE = /(?:DocumentBuilder|builder)\s*\.\s*parse\s*\(/;
+var JAVA_HARDENING_SETTER_RE = /\.\s*(?:setFeature|setAttribute|setProperty|setXIncludeAware|setExpandEntityReferences)\s*\(/;
+var JAVA_FACTORY_CHAINED_RE = /\bnewInstance\s*\([^()]*\)\s*\.\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\s*\(/;
 var PY_LXML_PARSER_INSECURE_DEFAULT_RE = /\bresolve_entities\s*=\s*False\b/;
 var XmlEntityExpansionPass = class {
   name = "xml-entity-expansion";
@@ -46198,7 +46259,9 @@ var XmlEntityExpansionPass = class {
     const code = ctx.code ?? "";
     if (language === "java") {
       const safeInFile = JAVA_SAFE_EVIDENCE_RE.test(code);
-      if (safeInFile) return { findings };
+      const processWide = safeInFile && /jdk\.xml\./.test(code);
+      const lines = safeInFile ? code.split("\n") : [];
+      const methodRanges = safeInFile ? this.methodRanges(graph.ir.types) : [];
       const isXmlOutputOnly = JAVA_XML_OUTPUT_ONLY_RE.test(code) && !JAVA_XML_PARSE_INPUT_RE.test(code);
       const isDocumentBuilderEmptyOnly = JAVA_DOC_BUILDER_NEW_DOCUMENT_RE.test(code) && !JAVA_DOC_BUILDER_PARSE_RE.test(code);
       for (const call of graph.ir.calls) {
@@ -46208,6 +46271,8 @@ var XmlEntityExpansionPass = class {
         if (det.api === "DocumentBuilderFactory" && isDocumentBuilderEmptyOnly)
           continue;
         const line = call.location.line;
+        if (safeInFile && (processWide || !this.isProvablyUnhardened(lines, line, methodRanges, det.api)))
+          continue;
         findings.push({ line, language, ...det });
         ctx.addFinding({
           id: `${this.name}-${file}-${line}-${det.api}`,
@@ -46217,11 +46282,11 @@ var XmlEntityExpansionPass = class {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} created without disabling DTD / external-entity processing. Vulnerable to billion-laughs / quadratic blow-up DoS (CWE-776) and external-entity disclosure (CWE-611). Add \`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)\` (or the equivalent) before parsing.`,
+          message: `${det.api} created without disabling DTD / external-entity processing. Vulnerable to external-entity disclosure (CWE-611) and billion-laughs / quadratic blow-up DoS (CWE-776). Add \`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)\` (or the equivalent) before parsing.`,
           file,
           line,
           fix: this.fixForJava(det.api),
-          evidence: { ...det, language, safeFeatureInFile: false }
+          evidence: { ...det, language, safeFeatureInFile: safeInFile }
         });
       }
       return { findings };
@@ -46242,7 +46307,7 @@ var XmlEntityExpansionPass = class {
           cwe: det.cwe,
           severity: "high",
           level: "error",
-          message: `${det.api} called without an entity-safe parser. Vulnerable to billion-laughs / quadratic blow-up DoS (CWE-776) and external-entity disclosure (CWE-611). Use \`defusedxml\` or pass an \`XMLParser(resolve_entities=False)\` to lxml.`,
+          message: `${det.api} called without an entity-safe parser. Vulnerable ` + (det.cwe === "CWE-611" ? "to external-entity disclosure (CWE-611) and billion-laughs / quadratic blow-up DoS (CWE-776). " : "to billion-laughs / quadratic blow-up DoS (CWE-776). ") + "Use `defusedxml` or pass an `XMLParser(resolve_entities=False)` to lxml.",
           file,
           line,
           fix: this.fixForPython(det.api),
@@ -46253,6 +46318,78 @@ var XmlEntityExpansionPass = class {
     }
     return { findings };
   }
+  methodRanges(types) {
+    const out2 = [];
+    for (const t of types ?? []) {
+      for (const m of t.methods ?? []) {
+        if (typeof m.start_line === "number" && typeof m.end_line === "number")
+          out2.push([m.start_line, m.end_line]);
+      }
+    }
+    return out2;
+  }
+  /**
+   * In a file that DOES contain hardening evidence, is the factory created on
+   * `line` one that provably never receives it?
+   *
+   * Deliberately one-sided. It answers true for exactly two shapes:
+   *
+   *   1. CHAINED — `Factory.newInstance().newDocumentBuilder()`, where the
+   *      product is not handed on or returned either.
+   *   2. LOCAL — `Factory f = Factory.newInstance();` where the enclosing method
+   *      builds a parser from `f`, never hands `f` to another call, and never
+   *      returns it.
+   *
+   * and in both only when the enclosing method contains NO hardening-capable
+   * setter on ANY receiver, since hardening may land on the factory's product
+   * (`parser.getXMLReader().setFeature(…)`) rather than the factory.
+   *
+   * Every other shape — a field, a helper that takes the factory, a caller that
+   * receives it — may be hardened somewhere this check cannot see, so it keeps
+   * the previous file-level silence.
+   *
+   * A TransformerFactory additionally needs a `StreamSource` in its method: that
+   * is the input the transformer parses with its OWN parser. Fed a `DOMSource`
+   * it parses nothing, and fed a `SAXSource` it uses the reader it was given —
+   * whose hardening is that reader's business, not this factory's.
+   */
+  isProvablyUnhardened(lines, line, methodRanges, api) {
+    let range = null;
+    for (const r of methodRanges) {
+      if (line < r[0] || line > r[1]) continue;
+      if (!range || r[1] - r[0] < range[1] - range[0]) range = r;
+    }
+    if (!range) return false;
+    let decl = "";
+    let declEnd = line;
+    for (; declEnd <= Math.min(line + 3, range[1]); declEnd++) {
+      decl += " " + (lines[declEnd - 1] ?? "").trim();
+      if (decl.includes(";")) break;
+    }
+    const body2 = lines.slice(line - 1, range[1]).join("\n");
+    if (api === "TransformerFactory" && !/\bnew\s+StreamSource\s*\(/.test(body2))
+      return false;
+    if (JAVA_HARDENING_SETTER_RE.test(body2)) return false;
+    const chained = JAVA_FACTORY_CHAINED_RE.exec(decl);
+    if (chained) {
+      const prod = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=/.exec(decl);
+      if (!prod) return true;
+      const pn = prod[1].replace(/\$/g, "\\$");
+      const after = lines.slice(declEnd, range[1]).join("\n");
+      return !new RegExp(`[(,]\\s*${pn}\\s*[,)]|\\breturn\\s+${pn}\\s*;`).test(after);
+    }
+    const m = /[\w>\]]\s+([A-Za-z_$][\w$]*)\s*=\s*[\w.]*\bnewInstance\s*\([^()]*\)\s*;/.exec(decl);
+    if (!m) return false;
+    const name2 = m[1].replace(/\$/g, "\\$");
+    const rest = lines.slice(declEnd, range[1]).join("\n");
+    const builds = new RegExp(
+      `\\b${name2}\\s*\\.\\s*(?:newDocumentBuilder|newSAXParser|newTransformer|newTemplates|newSchema|createXMLStreamReader|createXMLEventReader)\\s*\\(`
+    );
+    if (!builds.test(rest)) return false;
+    const escapes = new RegExp(`[(,]\\s*${name2}\\s*[,)]|\\breturn\\s+${name2}\\s*;`);
+    if (escapes.test(rest)) return false;
+    return true;
+  }
   detectJavaCall(call) {
     if (call.method_name !== "newInstance") return null;
     const recv = call.receiver ?? "";
@@ -46262,7 +46399,7 @@ var XmlEntityExpansionPass = class {
         return {
           pattern: `${factory}.newInstance()`,
           api: factory,
-          cwe: "CWE-776"
+          cwe: "CWE-611"
         };
       }
     }
@@ -46275,7 +46412,7 @@ var XmlEntityExpansionPass = class {
       return {
         pattern: `etree.${method}`,
         api: `lxml.etree.${method}`,
-        cwe: "CWE-776"
+        cwe: "CWE-611"
       };
     }
     if ((method === "parse" || method === "fromstring") && (recv === "ET" || recv === "ElementTree" || recv.endsWith(".ElementTree"))) {

package/dist/browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,qBAAqB,GAEtB,MAAM,eAAe,CAAC;AAkBvB;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAA+B;IACxD,MAAM,WAAW,GAAuC;QACtD,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IAEF,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,WAAW,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,KAAK,GAA+C,EAAE,CAAC;QAC7D,MAAM,OAAO,GAA2D,EAAE,CAAC;QAE3E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAyB,CAAC,GAAG,KAAK,CAAC;YAC3C,CAAC;iBAAM,IAAI,KAAK,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAyB,CAAC,GAAG,KAAK,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,aAAa,GAAG,KAAK,CAAC;QACrE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,eAAe,GAAG,OAAO,CAAC;IAC7E,CAAC;IAED,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,UAGI,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAE5C,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,UAGI,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAE5C,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC"}
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../src/browser.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,YAAY,EACZ,OAAO,EACP,aAAa,EACb,qBAAqB,GAEtB,MAAM,eAAe,CAAC;AAkBvB;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAA+B;IACxD,MAAM,WAAW,GAAuC;QACtD,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IAEF,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxC,WAAW,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IACzC,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAC3C,CAAC;IAED,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,KAAK,GAA+C,EAAE,CAAC;QAC7D,MAAM,OAAO,GAA2D,EAAE,CAAC;QAE3E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,KAAK,CAAC,IAAyB,CAAC,GAAG,KAAK,CAAC;YAC3C,CAAC;iBAAM,IAAI,KAAK,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAyB,CAAC,GAAG,KAAK,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,aAAa,GAAG,KAAK,CAAC;QACrE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,WAAW,CAAC,eAAe,GAAG,OAAO,CAAC;IAC7E,CAAC;IAED,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAY,EACZ,OAAO,GAGH,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAE5C,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAY,EACZ,OAAO,GAGH,EAAE;IAEN,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;IAE5C,IAAI,CAAC,qBAAqB,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC"}