cognium-dev 4.9.8 → 4.9.10

package/dist/cli.js

@@ -3232,7 +3232,7 @@ var Query = class {
   }
 };
 
-// ../circle-ir/dist/core/parser.js
+// node_modules/circle-ir/dist/core/parser.js
 var nodeModules = null;
 var moduleDir = null;
 async function getNodeModules() {
@@ -3472,7 +3472,7 @@ async function getDefaultLanguagePath(language) {
   }
   return `wasm/tree-sitter-${language}.wasm`;
 }
-// ../circle-ir/dist/core/extractors/meta.js
+// node_modules/circle-ir/dist/core/extractors/meta.js
 function extractMeta(code, tree, filePath, language) {
   const loc = countLinesOfCode(code);
   const hash = computeHash(code);
@@ -3554,7 +3554,7 @@ function extractPackage(tree, language) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/types.js
+// node_modules/circle-ir/dist/core/extractors/types.js
 function detectLanguage(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -5222,7 +5222,7 @@ function findChildByType(node, type) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/calls.js
+// node_modules/circle-ir/dist/core/extractors/calls.js
 function detectLanguageFromTree(tree, cache) {
   const rustStructs = getNodesFromCache(tree.rootNode, "struct_item", cache);
   const rustImpls = getNodesFromCache(tree.rootNode, "impl_item", cache);
@@ -7274,7 +7274,7 @@ function extractGoTypeLastSegment(typeNode) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/imports.js
+// node_modules/circle-ir/dist/core/extractors/imports.js
 function detectLanguage2(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -7961,7 +7961,7 @@ function findGoChildByType(node, type) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/exports.js
+// node_modules/circle-ir/dist/core/extractors/exports.js
 function extractExports(types) {
   const exports = [];
   for (const type of types) {
@@ -8014,7 +8014,7 @@ function getVisibilityFromModifiers(modifiers) {
   }
   return "package";
 }
-// ../circle-ir/dist/core/extractors/cfg.js
+// node_modules/circle-ir/dist/core/extractors/cfg.js
 function detectLanguage3(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -8663,7 +8663,7 @@ function isGoStatement(node) {
   ]);
   return goStatementTypes.has(node.type);
 }
-// ../circle-ir/dist/core/extractors/dfg.js
+// node_modules/circle-ir/dist/core/extractors/dfg.js
 function detectLanguage4(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -10184,7 +10184,7 @@ function extractGoAddressableVarName(node) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/runtime-registrations.js
+// node_modules/circle-ir/dist/core/extractors/runtime-registrations.js
 var HTTP_VERB_METHODS = new Set([
   "get",
   "post",
@@ -10932,7 +10932,7 @@ function parseDistributedSliceAttribute(attrItem) {
     }
   };
 }
-// ../circle-ir/dist/analysis/config-loader.js
+// node_modules/circle-ir/dist/analysis/config-loader.js
 var DEFAULT_SOURCES = [
   { method: "getParameter", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
   { method: "getParameterValues", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
@@ -13011,7 +13011,7 @@ var DEFAULT_HEADER_RULES = [
     note: "Fires when the value is not a string literal (likely reflected from request)"
   }
 ];
-// ../circle-ir/dist/analysis/arg-type-resolver.js
+// node_modules/circle-ir/dist/analysis/arg-type-resolver.js
 function findEnclosingType(callInMethod, types) {
   if (!callInMethod)
     return null;
@@ -13089,7 +13089,7 @@ function isArgvContainerType(rawType) {
   return /^(?:List|ArrayList|LinkedList|Collection|Iterable|Deque|Queue)\s*<\s*(?:String|CharSequence|java\.lang\.String)\b/.test(s);
 }
 
-// ../circle-ir/dist/analysis/taint-matcher.js
+// node_modules/circle-ir/dist/analysis/taint-matcher.js
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
   { pattern: /\brequest\.form\b/, sourceType: "http_body" },
@@ -13764,17 +13764,27 @@ function isSafeCSharpProcessStartCall(call, pattern, language, sourceLines) {
 function stripCsLiterals(line) {
   return line.replace(/\/\/.*$/, "").replace(/@?"(?:[^"\\]|\\.)*"/g, '""').replace(/'(?:[^'\\]|\\.)'/g, "''");
 }
+var _csDepthLines;
+var _csDepthPrefix;
 function csBraceDepthBefore(lines, idx) {
-  let depth = 0;
-  for (let i2 = 0;i2 < idx && i2 < lines.length; i2++) {
-    for (const ch of stripCsLiterals(lines[i2])) {
-      if (ch === "{")
-        depth++;
-      else if (ch === "}")
-        depth--;
+  if (lines !== _csDepthLines) {
+    const pref = new Int32Array(lines.length + 1);
+    let depth = 0;
+    for (let i2 = 0;i2 < lines.length; i2++) {
+      pref[i2] = depth;
+      for (const ch of stripCsLiterals(lines[i2])) {
+        if (ch === "{")
+          depth++;
+        else if (ch === "}")
+          depth--;
+      }
     }
+    pref[lines.length] = depth;
+    _csDepthLines = lines;
+    _csDepthPrefix = pref;
   }
-  return depth;
+  const clamped = idx < 0 ? 0 : idx > lines.length ? lines.length : idx;
+  return _csDepthPrefix[clamped];
 }
 function netBraces(fragment) {
   let n = 0;
@@ -13885,6 +13895,33 @@ function csThenBlock(lines, ifIdx, rest) {
   }
   return { start: ifIdx, end: firstIdx, earlyExit: isExit(firstText.trim()) };
 }
+var _csGuardLines;
+var _csGuardMap;
+function csEqualityGuardIndex(lines) {
+  if (lines === _csGuardLines && _csGuardMap)
+    return _csGuardMap;
+  const map = new Map;
+  for (let i2 = 0;i2 < lines.length; i2++) {
+    const parts2 = splitCsIf(lines[i2]);
+    if (!parts2)
+      continue;
+    const guard = csEqualityGuard(parts2.cond);
+    if (!guard)
+      continue;
+    const entry = { i: i2, rest: parts2.rest, ifCol: parts2.ifCol, op: guard.op };
+    for (const id of csIdentifiers(guard.exprSide)) {
+      let arr = map.get(id);
+      if (!arr) {
+        arr = [];
+        map.set(id, arr);
+      }
+      arr.push(entry);
+    }
+  }
+  _csGuardLines = lines;
+  _csGuardMap = map;
+  return map;
+}
 function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines) {
   if (language !== "csharp")
     return false;
@@ -13903,24 +13940,25 @@ function isCSharpSsrfHostAllowlistGuarded(call, pattern, language, sourceLines)
     return false;
   const sinkIdx = call.location.line - 1;
   const sinkDepth = csBraceDepthBefore(sourceLines, sinkIdx);
-  for (let i2 = 0;i2 < sinkIdx; i2++) {
-    const parts2 = splitCsIf(sourceLines[i2]);
-    if (!parts2)
-      continue;
-    const guard = csEqualityGuard(parts2.cond);
-    if (!guard)
-      continue;
-    const guardIds = csIdentifiers(guard.exprSide);
-    if (![...guardIds].some((id) => candidates.has(id)))
-      continue;
-    const block = csThenBlock(sourceLines, i2, parts2.rest);
-    if (guard.op === "==") {
-      if (sinkIdx >= block.start && sinkIdx <= block.end)
-        return true;
-    } else {
-      const guardDepth = csBraceDepthBefore(sourceLines, i2) + netBraces(stripCsLiterals(sourceLines[i2]).slice(0, parts2.ifCol));
-      if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
-        return true;
+  const guardMap = csEqualityGuardIndex(sourceLines);
+  const checked = new Set;
+  for (const cand of candidates) {
+    const guards = guardMap.get(cand);
+    if (!guards)
+      continue;
+    for (const g of guards) {
+      if (g.i >= sinkIdx || checked.has(g))
+        continue;
+      checked.add(g);
+      const block = csThenBlock(sourceLines, g.i, g.rest);
+      if (g.op === "==") {
+        if (sinkIdx >= block.start && sinkIdx <= block.end)
+          return true;
+      } else {
+        const guardDepth = csBraceDepthBefore(sourceLines, g.i) + netBraces(stripCsLiterals(sourceLines[g.i]).slice(0, g.ifCol));
+        if (block.earlyExit && sinkIdx > block.end && guardDepth === sinkDepth) {
+          return true;
+        }
       }
     }
   }
@@ -15056,7 +15094,7 @@ function formatSanitizerMethod(call) {
   return `${call.method_name}()`;
 }
 
-// ../circle-ir/dist/analysis/unresolved.js
+// node_modules/circle-ir/dist/analysis/unresolved.js
 function detectUnresolved(calls, types, dfg) {
   const unresolved = [];
   unresolved.push(...detectVirtualDispatch(calls));
@@ -15220,7 +15258,7 @@ function formatCallCode(call) {
   }
   return `${call.method_name}(${args2})`;
 }
-// ../circle-ir/dist/analysis/non-executable-lines.js
+// node_modules/circle-ir/dist/analysis/non-executable-lines.js
 function isNonExecutableSourceLine(sourceCode, line, language) {
   if (!sourceCode || line < 1)
     return false;
@@ -15280,7 +15318,7 @@ function isNonExecutablePython(trimmed) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/sanitizer-index.js
+// node_modules/circle-ir/dist/analysis/sanitizer-index.js
 var SANITIZER_SET_CACHE = new WeakMap;
 function getSanitizesSet(san) {
   let s = SANITIZER_SET_CACHE.get(san);
@@ -15294,7 +15332,7 @@ function sanitizerCoversSink(san, sinkType) {
   return getSanitizesSet(san).has(sinkType);
 }
 
-// ../circle-ir/dist/analysis/dfg-walk.js
+// node_modules/circle-ir/dist/analysis/dfg-walk.js
 var walkBackwardDefsMemo = new WeakMap;
 function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   const maxHops = options.maxHops ?? 32;
@@ -15347,7 +15385,7 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   return result;
 }
 
-// ../circle-ir/dist/analysis/findings.js
+// node_modules/circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
     http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
@@ -15378,7 +15416,7 @@ function sourceSemanticsAllowed(source, sinkType) {
   return true;
 }
 
-// ../circle-ir/dist/analysis/findings-instrumentation.js
+// node_modules/circle-ir/dist/analysis/findings-instrumentation.js
 var instrumentEnabled = false;
 function setFindingsInstrumentation(enabled) {
   instrumentEnabled = enabled;
@@ -15441,7 +15479,7 @@ function emitFindingsInstrumentation(filePath, findings, taint) {
   };
   console.error(`[findings-summary] ${JSON.stringify(summary)}`);
 }
-// ../circle-ir/dist/graph/code-graph.js
+// node_modules/circle-ir/dist/graph/code-graph.js
 class CodeGraph {
   ir;
   constructor(ir) {
@@ -15651,7 +15689,7 @@ class CodeGraph {
     return result;
   }
 }
-// ../circle-ir/dist/resolution/type-hierarchy.js
+// node_modules/circle-ir/dist/resolution/type-hierarchy.js
 class TypeHierarchyResolver {
   types = new Map;
   nameToFqn = new Map;
@@ -16223,7 +16261,7 @@ function registerCommonLibraries(resolver) {
   resolver.registerFactoryReturnType("HttpClients", "createSystem", "org.apache.http.impl.client.CloseableHttpClient");
   resolver.registerFactoryReturnType("HttpClients", "createMinimal", "org.apache.http.impl.client.MinimalHttpClient");
 }
-// ../circle-ir/dist/resolution/symbol-table.js
+// node_modules/circle-ir/dist/resolution/symbol-table.js
 class SymbolTable {
   exports = new Map;
   nameToFqns = new Map;
@@ -16446,7 +16484,7 @@ class SymbolTable {
     return "package";
   }
 }
-// ../circle-ir/dist/resolution/cross-file.js
+// node_modules/circle-ir/dist/resolution/cross-file.js
 function buildFileIndex(ir) {
   const callsByLine = new Map;
   for (const c of ir.calls) {
@@ -17534,7 +17572,7 @@ class CrossFileResolver {
     return this.fieldTaintInfo.get(`${typeFqn}.${fieldName}`);
   }
 }
-// ../circle-ir/dist/graph/project-graph.js
+// node_modules/circle-ir/dist/graph/project-graph.js
 class ProjectGraph {
   files = new Map;
   _symbolTable = null;
@@ -17586,7 +17624,7 @@ class ProjectGraph {
     return this._resolver;
   }
 }
-// ../circle-ir/dist/graph/analysis-pass.js
+// node_modules/circle-ir/dist/graph/analysis-pass.js
 class AnalysisPipeline {
   passes = [];
   add(pass) {
@@ -17633,7 +17671,7 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
-// ../circle-ir/dist/analysis/taint-propagation.js
+// node_modules/circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
   for (const san of sanitizers) {
@@ -17932,7 +17970,7 @@ function buildTaintFlow(source, sink, taintInfo) {
     confidence: taintInfo.confidence * 0.9
   };
 }
-// ../circle-ir/dist/analysis/constant-propagation/ast-utils.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/ast-utils.js
 function isKnown(cv) {
   return cv.type !== "unknown";
 }
@@ -17949,7 +17987,7 @@ function getNodeLine(node) {
   return node.startPosition.row + 1;
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/evaluator.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/evaluator.js
 class ExpressionEvaluator {
   source;
   getSymbol;
@@ -18219,7 +18257,7 @@ class ExpressionEvaluator {
   }
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/patterns.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/patterns.js
 var TAINT_PATTERNS = [
   "request.getParameter",
   "request.getHeader",
@@ -18414,7 +18452,7 @@ var PROPAGATOR_METHODS = new Set([
   "decodeRequestString"
 ]);
 
-// ../circle-ir/dist/analysis/constant-propagation/propagator.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/propagator.js
 class ConstantPropagator {
   symbols = new Map;
   tainted = new Set;
@@ -20271,7 +20309,7 @@ class ConstantPropagator {
   }
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/index.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/index.js
 function analyzeConstantPropagation(tree, sourceCode, options = {}) {
   const propagator = new ConstantPropagator;
   return propagator.analyze(tree, sourceCode, options.additionalTaintPatterns ?? [], options.sanitizerMethods ?? [], options.taintedParameters ?? []);
@@ -20359,7 +20397,7 @@ function normalizeCondition(cond) {
   }
   return normalized;
 }
-// ../circle-ir/dist/utils/logger.js
+// node_modules/circle-ir/dist/utils/logger.js
 var LOG_LEVELS = {
   trace: 0,
   debug: 1,
@@ -20431,7 +20469,7 @@ var logger = {
   }
 };
 
-// ../circle-ir/dist/analysis/per-file-finding-cap.js
+// node_modules/circle-ir/dist/analysis/per-file-finding-cap.js
 var DEFAULT_PER_FILE_FINDING_CAP = 1000;
 var SATURATED_FILE_RULE_ID = "saturated-file";
 function applyPerFileFindingCap(filePath, findings, cap) {
@@ -20467,7 +20505,7 @@ function applyPerFileFindingCap(filePath, findings, cap) {
   return [advisory];
 }
 
-// ../circle-ir/dist/analysis/confidence-filter.js
+// node_modules/circle-ir/dist/analysis/confidence-filter.js
 function applyConfidenceFilter(findings, includeSpeculative) {
   if (includeSpeculative)
     return findings;
@@ -20477,7 +20515,7 @@ function isHighConfidence(finding) {
   return finding.confidence === undefined || finding.confidence === "high";
 }
 
-// ../circle-ir/dist/analysis/library-api-surface-downgrade.js
+// node_modules/circle-ir/dist/analysis/library-api-surface-downgrade.js
 var LIBRARY_API_SURFACE_TAG = "library-api-surface:caller-responsibility";
 function applyLibraryApiSurfaceDowngrade(findings) {
   return findings.map((f) => {
@@ -20494,7 +20532,7 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
-// ../circle-ir/dist/analysis/note-coalescer.js
+// node_modules/circle-ir/dist/analysis/note-coalescer.js
 var CLICKJACKING_PAIR = new Set(["missing-x-frame-options", "missing-csp-frame-ancestors"]);
 function levelRank(level) {
   return level === "error" ? 0 : level === "warning" ? 1 : 2;
@@ -20558,7 +20596,7 @@ function coalesceNoteLevelFindings(findings) {
   return out2;
 }
 
-// ../circle-ir/dist/analysis/entry-point-detection.js
+// node_modules/circle-ir/dist/analysis/entry-point-detection.js
 var TIER_1_METHOD_ANNOTATIONS = new Set([
   "RequestMapping",
   "GetMapping",
@@ -21215,7 +21253,7 @@ function methodIsRuntimeRegistrationHandler(method, regs) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/require-entry-path.js
+// node_modules/circle-ir/dist/analysis/require-entry-path.js
 var RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
 var MAX_VISITED_METHODS = 2000;
 var TAINT_FLOW_RULE_IDS = new Set([
@@ -21604,7 +21642,7 @@ function normalizeDisabled(input) {
   return new Set(input);
 }
 
-// ../circle-ir/dist/analysis/project-profile-transform.js
+// node_modules/circle-ir/dist/analysis/project-profile-transform.js
 var DOWNGRADE_ELIGIBLE_RULE_IDS = new Set([
   "code_injection",
   "template_injection",
@@ -21666,7 +21704,7 @@ function applyProjectProfileTransform(findings, resolveProfile) {
   });
 }
 
-// ../circle-ir/dist/languages/registry.js
+// node_modules/circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
   extensionMap = new Map;
@@ -21713,7 +21751,7 @@ function registerLanguage(plugin) {
 function getLanguagePlugin(language) {
   return getLanguageRegistry().get(language);
 }
-// ../circle-ir/dist/languages/plugins/base.js
+// node_modules/circle-ir/dist/languages/plugins/base.js
 class BaseLanguagePlugin {
   parser = null;
   async initialize(parser) {
@@ -21774,7 +21812,7 @@ class BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/java.js
+// node_modules/circle-ir/dist/languages/plugins/java.js
 class JavaPlugin extends BaseLanguagePlugin {
   id = "java";
   name = "Java";
@@ -22031,7 +22069,7 @@ class JavaPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/javascript.js
+// node_modules/circle-ir/dist/languages/plugins/javascript.js
 class JavaScriptPlugin extends BaseLanguagePlugin {
   id = "javascript";
   name = "JavaScript/TypeScript";
@@ -22697,7 +22735,7 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/python.js
+// node_modules/circle-ir/dist/languages/plugins/python.js
 class PythonPlugin extends BaseLanguagePlugin {
   id = "python";
   name = "Python";
@@ -22973,7 +23011,7 @@ class PythonPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/rust.js
+// node_modules/circle-ir/dist/languages/plugins/rust.js
 class RustPlugin extends BaseLanguagePlugin {
   id = "rust";
   name = "Rust";
@@ -23213,7 +23251,7 @@ class RustPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/bash.js
+// node_modules/circle-ir/dist/languages/plugins/bash.js
 class BashPlugin extends BaseLanguagePlugin {
   id = "bash";
   name = "Bash/Shell";
@@ -23419,7 +23457,7 @@ class BashPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/html.js
+// node_modules/circle-ir/dist/languages/plugins/html.js
 class HtmlPlugin extends BaseLanguagePlugin {
   id = "html";
   name = "HTML";
@@ -23484,7 +23522,7 @@ class HtmlPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/vue.js
+// node_modules/circle-ir/dist/languages/plugins/vue.js
 class VuePlugin extends BaseLanguagePlugin {
   id = "vue";
   name = "Vue";
@@ -23549,7 +23587,7 @@ class VuePlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/go.js
+// node_modules/circle-ir/dist/languages/plugins/go.js
 class GoPlugin extends BaseLanguagePlugin {
   id = "go";
   name = "Go";
@@ -24198,7 +24236,7 @@ class GoPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/csharp.js
+// node_modules/circle-ir/dist/languages/plugins/csharp.js
 class CSharpPlugin extends BaseLanguagePlugin {
   id = "csharp";
   name = "C#";
@@ -24257,7 +24295,7 @@ class CSharpPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/index.js
+// node_modules/circle-ir/dist/languages/plugins/index.js
 function registerBuiltinPlugins() {
   registerLanguage(new JavaPlugin);
   registerLanguage(new JavaScriptPlugin);
@@ -24269,7 +24307,7 @@ function registerBuiltinPlugins() {
   registerLanguage(new GoPlugin);
   registerLanguage(new CSharpPlugin);
 }
-// ../circle-ir/dist/analysis/passes/cross-file-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
   run(projectGraph, sourceLines, options = {}) {
     const resolver = projectGraph.resolver;
@@ -24595,7 +24633,7 @@ function findCrossInstanceAliasingPaths(projectGraph, _sourceLines) {
   return paths;
 }
 
-// ../circle-ir/dist/analysis/html/html-extractor.js
+// node_modules/circle-ir/dist/analysis/html/html-extractor.js
 var EVENT_HANDLER_ATTRS = new Set([
   "onclick",
   "ondblclick",
@@ -24750,7 +24788,7 @@ function stripQuotes2(text) {
   return text;
 }
 
-// ../circle-ir/dist/analysis/html/html-attribute-security-pass.js
+// node_modules/circle-ir/dist/analysis/html/html-attribute-security-pass.js
 function runHtmlAttributeSecurityChecks(rootNode, filePath) {
   const findings = [];
   walkForSecurityChecks(rootNode, filePath, findings);
@@ -24976,7 +25014,7 @@ function truncate(s, maxLen) {
   return s.length > maxLen ? s.slice(0, maxLen) + "..." : s;
 }
 
-// ../circle-ir/dist/analysis/html/vue-template-xss-pass.js
+// node_modules/circle-ir/dist/analysis/html/vue-template-xss-pass.js
 var DANGEROUS_BINDINGS = new Set([
   "v-html",
   "v-bind:innerhtml",
@@ -25096,7 +25134,7 @@ function collectTaintedNames(blocks) {
   return names;
 }
 
-// ../circle-ir/dist/analysis/html/html-merge.js
+// node_modules/circle-ir/dist/analysis/html/html-merge.js
 function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   const allTypes = [];
   const allCalls = [];
@@ -25246,7 +25284,7 @@ function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   };
 }
 
-// ../circle-ir/dist/analysis/passes/taint-matcher-pass.js
+// node_modules/circle-ir/dist/analysis/passes/taint-matcher-pass.js
 class TaintMatcherPass {
   name = "taint-matcher";
   category = "security";
@@ -25307,7 +25345,7 @@ class TaintMatcherPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/constant-propagation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/constant-propagation-pass.js
 class ConstantPropagationPass {
   tree;
   name = "constant-propagation";
@@ -25337,7 +25375,7 @@ class ConstantPropagationPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/language-sources-pass.js
+// node_modules/circle-ir/dist/analysis/passes/language-sources-pass.js
 var JS_DOM_XSS_SINKS = [
   { pattern: /\.innerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
   { pattern: /\.outerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
@@ -26939,6 +26977,13 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
     "interface",
     "enum"
   ]);
+  const complexTaintedRes = [];
+  for (const v of knownTainted) {
+    if (!/^[\p{L}\p{N}_]+$/u.test(v)) {
+      const esc = v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      complexTaintedRes.push(new RegExp(`(?<![\\p{L}\\p{N}_])${esc}(?![\\p{L}\\p{N}_])`, "u"));
+    }
+  }
   let changed = true;
   let guard = 0;
   while (changed && guard < lines.length + 2) {
@@ -26960,9 +27005,9 @@ function buildJavaTaintedVars(sourceCode, seedVars) {
         continue;
       if (knownTainted.has(lhs))
         continue;
-      const escaped = (v) => v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
       const rhsCode = rhs.replace(/\$@?"(?:[^"\\]|\\.)*"/g, (lit) => " " + [...lit.matchAll(/\{([^}]*)\}/g)].map((x) => x[1]).join(" ") + " ").replace(/@?"(?:[^"\\]|\\.)*"/g, " ").replace(/'(?:[^'\\]|\\.)'/g, " ");
-      const ref = [...knownTainted].some((v) => new RegExp(`(?<![\\p{L}\\p{N}_])${escaped(v)}(?![\\p{L}\\p{N}_])`, "u").test(rhsCode));
+      const rhsIdents = rhsCode.match(/[\p{L}\p{N}_]+/gu);
+      const ref = rhsIdents !== null && rhsIdents.some((t) => knownTainted.has(t)) || complexTaintedRes.length > 0 && complexTaintedRes.some((re) => re.test(rhsCode));
       if (ref) {
         derived.set(lhs, i2 + 1);
         knownTainted.add(lhs);
@@ -32378,7 +32423,7 @@ function findJsTemplateInjectionSstiFindings(code, file) {
   return findings;
 }
 
-// ../circle-ir/dist/analysis/passes/source-semantics-pass.js
+// node_modules/circle-ir/dist/analysis/passes/source-semantics-pass.js
 var DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
 var CONST_STRING_ASSIGN_RE = /^\s*(?:final\s+|static\s+final\s+)?[A-Za-z_][\w.<>\[\]]*\s+[A-Za-z_]\w*\s*=\s*"[^"]*"\s*;?\s*$/;
 var STATIC_FINAL_RE = /^\s*(?:public\s+|private\s+|protected\s+)?static\s+final\s+/;
@@ -32466,7 +32511,7 @@ class SourceSemanticsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
 var SPECULATIVE_SOURCE_TYPES = new Set([
   "interprocedural_param",
   "constructor_field"
@@ -32521,7 +32566,7 @@ class LibraryProfileSourceGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
+// node_modules/circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
 var MYBATIS_SQL_ANNOTATIONS = new Set([
   "Select",
   "Update",
@@ -32748,7 +32793,7 @@ class MyBatisAnnotationSqlSinkPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/sink-filter-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sink-filter-pass.js
 function escapeReSf(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -34552,7 +34597,7 @@ function isXPathQuoteEscapedOnLine(lineText, varName) {
   return seen > 0;
 }
 
-// ../circle-ir/dist/analysis/passes/sink-semantics-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sink-semantics-pass.js
 function buildRegistry(entries) {
   const registry = new Map;
   for (const entry of entries) {
@@ -34600,7 +34645,7 @@ class SinkSemanticsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/dependency-versions.js
+// node_modules/circle-ir/dist/analysis/dependency-versions.js
 function resolveFastjsonFromPom(pomXml) {
   if (!pomXml)
     return null;
@@ -34778,7 +34823,7 @@ function fileConfiguresSnakeYamlSafely(source) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
 var FASTJSON_METHODS = new Set(["parseObject", "parse"]);
 var FASTJSON_CLASSES = new Set(["JSON", "JSONObject"]);
 var JACKSON_METHODS = new Set(["readValue", "convertValue", "treeToValue"]);
@@ -34855,7 +34900,7 @@ class DeserializationSafetyGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
 function isDelimiterLiteral(lit) {
   const s = lit.trim();
   if (s.length === 0)
@@ -35098,7 +35143,7 @@ class PromptInjectionSafetyGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
+// node_modules/circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
 function returnOrAssignRhs(text) {
   const t = text.trim();
   const ret = t.match(/^return\s+(.+?);?$/);
@@ -35224,7 +35269,7 @@ class SpeculativePromptParamSourcePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
   "newInstance",
@@ -35412,7 +35457,7 @@ class CliMainReflectionSuppressPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
 var DROPPED_SINK_TYPES = new Set([
   "log_injection"
 ]);
@@ -35518,7 +35563,7 @@ class LibraryProfileCwe22PathGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
 var XSS_NON_HTML_OUTPUT_CLASSES = new Set([
   "StringBuilder",
   "StringBuffer",
@@ -35599,7 +35644,7 @@ class LibraryProfileXssGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
   category = "security";
@@ -36283,13 +36328,22 @@ function detectParameterSinkFlows(types, calls, sources, sinks, unreachableLines
   }
   return flows;
 }
+var _reassignSplitCode;
+var _reassignSplitLines;
+function splitLinesCached(code) {
+  if (code === _reassignSplitCode && _reassignSplitLines)
+    return _reassignSplitLines;
+  _reassignSplitCode = code;
+  _reassignSplitLines = code.split(`
+`);
+  return _reassignSplitLines;
+}
 function isReassignedToLiteralBetween(code, variable, srcLine, sinkLine) {
   if (!variable || sinkLine - srcLine < 2)
     return false;
   if (!/^[A-Za-z_][\w]*$/.test(variable))
     return false;
-  const lines = code.split(`
-`);
+  const lines = splitLinesCached(code);
   const lo = Math.max(0, srcLine);
   const hi = Math.min(lines.length, sinkLine - 1);
   const strLit = `(?:"[^"\\\\]*(?:\\\\.[^"\\\\]*)*"|'[^'\\\\]*(?:\\\\.[^'\\\\]*)*'|\`[^\`\\\\]*(?:\\\\.[^\`\\\\]*)*\`)`;
@@ -36627,9 +36681,10 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
       }
     }
   }
+  const SIMPLE_IDENT = /^[\p{L}\p{N}_]+$/u;
   const reCache = new Map;
   for (const s of sourcesWithVar) {
-    if (reCache.has(s.variable))
+    if (SIMPLE_IDENT.test(s.variable) || reCache.has(s.variable))
       continue;
     const escaped = s.variable.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     reCache.set(s.variable, new RegExp(`(?<![\\p{L}\\p{N}_])${escaped}(?![\\p{L}\\p{N}_])`, "u"));
@@ -36640,6 +36695,23 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
     existing.push(call);
     callsByLine.set(call.location.line, existing);
   }
+  const sourcesByVar = new Map;
+  const complexSources = [];
+  sourcesWithVar.forEach((source, ord) => {
+    const complex = !SIMPLE_IDENT.test(source.variable);
+    const entry = { source, ord, complex };
+    if (!complex) {
+      let list = sourcesByVar.get(source.variable);
+      if (!list) {
+        list = [];
+        sourcesByVar.set(source.variable, list);
+      }
+      list.push(entry);
+    } else {
+      complexSources.push(entry);
+    }
+  });
+  const flowKeys = new Set;
   for (const sink of sinks) {
     if (unreachableLines.has(sink.line))
       continue;
@@ -36652,18 +36724,35 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
         const expr = arg.expression;
         if (!expr)
           continue;
-        for (const source of sourcesWithVar) {
+        const exprIdentMatches = expr.match(/[\p{L}\p{N}_]+/gu);
+        let candidates = complexSources.length > 0 ? complexSources.slice() : null;
+        if (exprIdentMatches) {
+          for (const id of new Set(exprIdentMatches)) {
+            const list = sourcesByVar.get(id);
+            if (!list)
+              continue;
+            (candidates ??= []).push(...list);
+          }
+        }
+        if (!candidates)
+          continue;
+        if (candidates.length > 1)
+          candidates.sort((a, b) => a.ord - b.ord);
+        for (const { source, complex } of candidates) {
           if (source.line >= sink.line)
             continue;
           if (source.in_method && call.in_method && source.in_method !== call.in_method) {
             continue;
           }
-          const re = reCache.get(source.variable);
-          if (!re || !re.test(expr))
-            continue;
+          if (complex) {
+            const re = reCache.get(source.variable);
+            if (!re || !re.test(expr))
+              continue;
+          }
           if (!sourceSemanticsAllowed(source, sink.type))
             continue;
-          if (flows.some((f) => f.source_line === source.line && f.sink_line === sink.line && f.sink_type === sink.type))
+          const dedupKey = `${source.line}:${sink.line}:${sink.type}`;
+          if (flowKeys.has(dedupKey))
             continue;
           if (aliasSanitizedFor.get(source.variable)?.has(sink.type)) {
             break;
@@ -36683,6 +36772,7 @@ function detectExpressionScanFlows(calls, sources, sinks, sanitizers, unreachabl
             confidence: source.confidence * sink.confidence * 0.7,
             sanitized: false
           });
+          flowKeys.add(dedupKey);
           break;
         }
       }
@@ -36784,7 +36874,7 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
   return sources[0];
 }
 
-// ../circle-ir/dist/analysis/interprocedural.js
+// node_modules/circle-ir/dist/analysis/interprocedural.js
 function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
   let graph;
   let sources;
@@ -37298,7 +37388,7 @@ function findTaintBridges2(result) {
   return bridges;
 }
 
-// ../circle-ir/dist/analysis/passes/interprocedural-pass.js
+// node_modules/circle-ir/dist/analysis/passes/interprocedural-pass.js
 class InterproceduralPass {
   name = "interprocedural";
   category = "security";
@@ -37504,7 +37594,7 @@ class InterproceduralPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/dead-code-pass.js
+// node_modules/circle-ir/dist/analysis/passes/dead-code-pass.js
 class DeadCodePass {
   name = "dead-code";
   category = "reliability";
@@ -37580,7 +37670,7 @@ class DeadCodePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-await-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-await-pass.js
 var ASYNC_METHODS = new Set([
   "readFile",
   "writeFile",
@@ -37659,7 +37749,7 @@ class MissingAwaitPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/n-plus-one-pass.js
+// node_modules/circle-ir/dist/analysis/passes/n-plus-one-pass.js
 var HIGH_CONFIDENCE_DB_METHODS = new Set([
   "executeQuery",
   "executeUpdate",
@@ -37782,7 +37872,7 @@ class NPlusOnePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-public-doc-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-public-doc-pass.js
 var TEST_PATH_RE = /[/._](test|tests|spec|specs|__tests?__|__mocks?__)[/._]/i;
 var UTIL_DIR_RE = /[/](utils?|helpers?|internal|private|common|shared)[/]/i;
 function hasDocCommentBefore(lines, startLine) {
@@ -37889,7 +37979,7 @@ class MissingPublicDocPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/todo-in-prod-pass.js
+// node_modules/circle-ir/dist/analysis/passes/todo-in-prod-pass.js
 var TEST_PATH_RE2 = /[/._](test|tests|spec|specs|__tests?__|__mocks?__)[/._]/i;
 var MARKER_RE = /(?:\/\/|#|--|^\s*\*)\s*(TODO|FIXME|HACK|XXX)\b/i;
 function markerSeverity(marker) {
@@ -37935,7 +38025,7 @@ class TodoInProdPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/string-concat-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/string-concat-loop-pass.js
 var CONCAT_RE = /\b([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\+=/;
 var NUMERIC_VAR_RE = /^(i|j|k|n|m|x|y|z|count|sum|total|size|index|len|length|num|idx|score|counter|offset|pos|col|row|result|ret|value|acc|bits|byte|bytes|flag|flags|step|delta|diff|dist|min|max|avg|mean|page|line|err|error)$/i;
 var NUMERIC_SUFFIX_RE = /(Count|Sum|Total|Size|Index|Length|Offset|Position|Score|Counter|Num|Amount|Val|Idx|Len|Max|Min|Avg|Delta|Diff|Step|Flag|Flags|Bits|Byte|Bytes|Calls|Items|Nodes|Edges|Blocks|Lines|Chars|Entries|Records|Rows)$/;
@@ -37998,7 +38088,7 @@ class StringConcatLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/sync-io-async-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sync-io-async-pass.js
 var BLOCKING_METHODS = new Set([
   "sleep"
 ]);
@@ -38059,7 +38149,7 @@ class SyncIoAsyncPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unchecked-return-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unchecked-return-pass.js
 var MUST_CHECK_HIGH = new Set([
   "createNewFile",
   "mkdir",
@@ -38132,7 +38222,7 @@ class UncheckedReturnPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/null-deref-pass.js
+// node_modules/circle-ir/dist/analysis/passes/null-deref-pass.js
 var NULL_EXPR_RE = /^\s*(null|None|undefined)\s*$/;
 function escRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -38214,7 +38304,7 @@ class NullDerefPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/resource-leak-pass.js
+// node_modules/circle-ir/dist/analysis/passes/resource-leak-pass.js
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -38491,7 +38581,7 @@ class ResourceLeakPass {
   }
 }
 
-// ../circle-ir/dist/graph/scope-graph.js
+// node_modules/circle-ir/dist/graph/scope-graph.js
 function hasDeclKeyword(lineText, language) {
   switch (language) {
     case "java":
@@ -38531,7 +38621,7 @@ class ScopeGraph {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/variable-shadowing-pass.js
+// node_modules/circle-ir/dist/analysis/passes/variable-shadowing-pass.js
 var SKIP_NAMES = new Set([
   "let",
   "const",
@@ -38689,7 +38779,7 @@ class VariableShadowingPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/leaked-global-pass.js
+// node_modules/circle-ir/dist/analysis/passes/leaked-global-pass.js
 var SKIP_NAMES2 = new Set([
   "_",
   "e",
@@ -38776,7 +38866,7 @@ class LeakedGlobalPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unused-variable-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unused-variable-pass.js
 var SKIP_NAMES3 = new Set([
   "_",
   "unused",
@@ -38921,7 +39011,7 @@ class UnusedVariablePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/dependency-fan-out-pass.js
+// node_modules/circle-ir/dist/analysis/passes/dependency-fan-out-pass.js
 var DEFAULT_THRESHOLD = 20;
 
 class DependencyFanOutPass {
@@ -38953,7 +39043,7 @@ class DependencyFanOutPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/stale-doc-ref-pass.js
+// node_modules/circle-ir/dist/analysis/passes/stale-doc-ref-pass.js
 var DOC_BLOCK_RE = /\/\*\*([\s\S]*?)\*\//g;
 var LINK_RE = /\{@link\s+([\w.#]+)/g;
 var SEE_RE = /@see\s+([\w.#]+)/g;
@@ -39032,7 +39122,7 @@ class StaleDocRefPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/infinite-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/infinite-loop-pass.js
 var EXIT_KEYWORDS = /\b(return|throw|raise|break|System\.exit|process\.exit|os\._exit|exit!\()\b/;
 var ITERATOR_LOOP_PATTERNS = [
   /\bfor\s*\([^)]*\s+of\s+/,
@@ -39151,7 +39241,7 @@ class InfiniteLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/deep-inheritance-pass.js
+// node_modules/circle-ir/dist/analysis/passes/deep-inheritance-pass.js
 var DEPTH_THRESHOLD = 5;
 var CYCLE_GUARD = 20;
 
@@ -39214,7 +39304,7 @@ class DeepInheritancePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/redundant-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/redundant-loop-pass.js
 var LENGTH_PATTERN = /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:length|size\(\)|count\(\))/g;
 var LENGTH_PATTERN_METHODS = /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:size\(\)|count\(\))/g;
 var OBJECT_STATIC_PATTERN = /\bObject\s*\.\s*(?:keys|values|entries)\s*\(\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*\)/g;
@@ -39337,7 +39427,7 @@ class RedundantLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unbounded-collection-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unbounded-collection-pass.js
 var GROW_METHODS = {
   java: new Set(["add", "put", "offer", "push", "addAll", "addFirst", "addLast", "enqueue", "insert"]),
   javascript: new Set(["push", "set", "add", "unshift", "append", "prepend"]),
@@ -39461,7 +39551,7 @@ class UnboundedCollectionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/serial-await-pass.js
+// node_modules/circle-ir/dist/analysis/passes/serial-await-pass.js
 var AWAIT_ASSIGN_RE = /(?:const|let|var)?\s*(\w+)\s*=\s*await\s/;
 var AWAIT_RE = /\bawait\s/;
 
@@ -39557,7 +39647,7 @@ class SerialAwaitPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/react-inline-jsx-pass.js
+// node_modules/circle-ir/dist/analysis/passes/react-inline-jsx-pass.js
 var JSX_COMPONENT_RE = /<[A-Z][A-Za-z0-9]*/;
 var INLINE_OBJECT_RE = /\s([A-Za-z][A-Za-z0-9_]*)=\{\{/g;
 var INLINE_ARROW_RE = /\s([A-Za-z][A-Za-z0-9_]*)=\{(?:\(|[A-Za-z_$]).*?=>/g;
@@ -39661,7 +39751,7 @@ class ReactInlineJsxPass {
   }
 }
 
-// ../circle-ir/dist/graph/exception-flow-graph.js
+// node_modules/circle-ir/dist/graph/exception-flow-graph.js
 class ExceptionFlowGraph2 {
   pairs;
   catchEntryIds;
@@ -39712,7 +39802,7 @@ class ExceptionFlowGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/swallowed-exception-pass.js
+// node_modules/circle-ir/dist/analysis/passes/swallowed-exception-pass.js
 var MEANINGFUL_ACTION_RE = /\b(throw|raise|log|logger|console\.(error|warn|log|debug|info)|System\.(out|err)\.|print(?:ln|f)?|warn|error|debug|info|fatal|LOGGER|LOG|logging\.(warning|error|debug|info|critical))\b|\breturn\s+\S/;
 
 class SwallowedExceptionPass {
@@ -39810,7 +39900,7 @@ class SwallowedExceptionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/broad-catch-pass.js
+// node_modules/circle-ir/dist/analysis/passes/broad-catch-pass.js
 var JAVA_BROAD_RE = /catch\s*\(\s*(Exception|Throwable|RuntimeException|Error)\s/;
 var PYTHON_BROAD_RE = /^\s*except\s*:|except\s+(Exception|BaseException)\b/;
 
@@ -39866,7 +39956,7 @@ class BroadCatchPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unhandled-exception-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unhandled-exception-pass.js
 var JS_THROW_RE = /^\s*throw\s+/;
 var PYTHON_RAISE_RE = /^\s*raise\b/;
 function isValidationThrow(lines, throwLine) {
@@ -40036,7 +40126,7 @@ class UnhandledExceptionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/double-close-pass.js
+// node_modules/circle-ir/dist/analysis/passes/double-close-pass.js
 var RESOURCE_CTORS2 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40151,7 +40241,7 @@ class DoubleClosePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/use-after-close-pass.js
+// node_modules/circle-ir/dist/analysis/passes/use-after-close-pass.js
 var RESOURCE_CTORS3 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40259,7 +40349,7 @@ class UseAfterClosePass {
   }
 }
 
-// ../circle-ir/dist/graph/dominator-graph.js
+// node_modules/circle-ir/dist/graph/dominator-graph.js
 function computeRPO(cfg, entryId) {
   const outgoing = new Map;
   for (const edge of cfg.edges) {
@@ -40424,7 +40514,7 @@ class DominatorGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cleanup-verify-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cleanup-verify-pass.js
 var RESOURCE_CTORS4 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40549,7 +40639,7 @@ class CleanupVerifyPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-override-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-override-pass.js
 class MissingOverridePass {
   name = "missing-override";
   category = "maintainability";
@@ -40636,7 +40726,7 @@ class MissingOverridePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unused-interface-method-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unused-interface-method-pass.js
 class UnusedInterfaceMethodPass {
   name = "unused-interface-method";
   category = "maintainability";
@@ -40679,7 +40769,7 @@ class UnusedInterfaceMethodPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/blocking-main-thread-pass.js
+// node_modules/circle-ir/dist/analysis/passes/blocking-main-thread-pass.js
 var HTTP_DECORATORS = new Set([
   "Get",
   "Post",
@@ -40782,7 +40872,7 @@ class BlockingMainThreadPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/excessive-allocation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/excessive-allocation-pass.js
 var ALLOC_PATTERNS = {
   javascript: /\bnew\s+(Array|Map|Set|Object|WeakMap|WeakSet|Error|RegExp|Date|Buffer|Uint8Array|Int8Array|Float32Array|ArrayBuffer)\s*[(<]|\bArray\.from\s*\(|\bstructuredClone\s*\(|\bObject\.create\s*\(/,
   typescript: /\bnew\s+(Array|Map|Set|Object|WeakMap|WeakSet|Error|RegExp|Date|Buffer|Uint8Array|Int8Array|Float32Array|ArrayBuffer)\s*[(<]|\bArray\.from\s*\(|\bstructuredClone\s*\(|\bObject\.create\s*\(/,
@@ -40849,7 +40939,7 @@ class ExcessiveAllocationPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-stream-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-stream-pass.js
 var JS_WHOLE_LOAD_RE = /\b(?:readFileSync|fs\.readFile\b|response\.text\b|response\.json\b|res\.text\b|res\.json\b|body\.text\b|body\.json\b)\s*\(/;
 var JS_STREAM_RE = /\.pipe\s*\(|\.on\s*\(\s*['"]data['"]|for\s+await\s*\(|\bcreateReadStream\b|\bstream\b/i;
 var JAVA_WHOLE_READ_RE = /\bFiles\.readAllBytes\s*\(|\bFiles\.readAllLines\s*\(|\bFiles\.readString\s*\(|\bnew\s+BufferedReader\s*\(|\bFileInputStream\b/;
@@ -40996,7 +41086,7 @@ class MissingStreamPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/god-class-pass.js
+// node_modules/circle-ir/dist/analysis/passes/god-class-pass.js
 var WMC_THRESHOLD = 47;
 var LCOM2_THRESHOLD = 0.8;
 var CBO_THRESHOLD = 14;
@@ -41162,7 +41252,7 @@ class GodClassPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/naming-convention-pass.js
+// node_modules/circle-ir/dist/analysis/passes/naming-convention-pass.js
 var PASCAL_CASE_RE = /^[A-Z][A-Za-z0-9]*$/;
 var CAMEL_CASE_RE = /^[a-z][a-zA-Z0-9]*$/;
 var SNAKE_CASE_RE = /^[a-z_][a-z0-9_]*$/;
@@ -41302,7 +41392,7 @@ class NamingConventionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/security-headers-pass.js
+// node_modules/circle-ir/dist/analysis/passes/security-headers-pass.js
 var HEADER_WRITE_METHODS = new Set([
   "setHeader",
   "addHeader",
@@ -41763,7 +41853,7 @@ function mapReturnValueToCorsRule(returnValue) {
   };
 }
 
-// ../circle-ir/dist/analysis/passes/_fp-allowlists.js
+// node_modules/circle-ir/dist/analysis/passes/_fp-allowlists.js
 var PEM_BODY_RE = /[A-Za-z0-9+/]{30,}/;
 function pemHasInlineBody(lines, hitLineIdx) {
   const end = Math.min(hitLineIdx + 5, lines.length);
@@ -41790,7 +41880,7 @@ function isProtocolMandatedCryptoFile(file, code) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
+// node_modules/circle-ir/dist/analysis/passes/scan-secrets-pass.js
 function applyDemoDowngrade(demoPath, severity, level) {
   if (!demoPath)
     return { severity, level };
@@ -42368,7 +42458,7 @@ class ScanSecretsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
+// node_modules/circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
 class PythonReceiverTaintFormatPass {
   name = "python-receiver-taint-format";
   category = "security";
@@ -42420,7 +42510,7 @@ class PythonReceiverTaintFormatPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/spring4shell-pass.js
+// node_modules/circle-ir/dist/analysis/passes/spring4shell-pass.js
 var CONTROLLER_ANNOTATIONS = new Set([
   "Controller",
   "RestController",
@@ -42628,7 +42718,7 @@ function isPotentialPojo(type) {
   return first >= 65 && first <= 90;
 }
 
-// ../circle-ir/dist/analysis/passes/insecure-cookie-pass.js
+// node_modules/circle-ir/dist/analysis/passes/insecure-cookie-pass.js
 var COOKIE_RESPONSE_RECEIVERS = new Set([
   "res",
   "response",
@@ -42864,7 +42954,7 @@ class InsecureCookiePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-hash-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-hash-pass.js
 var WEAK_HASH_NAMES = new Set([
   "md2",
   "md4",
@@ -43084,7 +43174,7 @@ class WeakHashPass {
   }
 }
 
-// ../circle-ir/dist/analysis/path-classification.js
+// node_modules/circle-ir/dist/analysis/path-classification.js
 var TEST_PATH_PATTERNS = [
   /(^|\/)test\//i,
   /(^|\/)tests\//i,
@@ -43121,7 +43211,7 @@ function isTestPath(filepath) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/weak-crypto-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-crypto-pass.js
 var WEAK_CIPHER_BASES = new Set([
   "des",
   "3des",
@@ -43626,7 +43716,7 @@ class WeakCryptoPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-random-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-random-pass.js
 var JAVA_RANDOM_METHODS = new Set([
   "nextInt",
   "nextLong",
@@ -43799,7 +43889,7 @@ class WeakRandomPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/_credential-helpers.js
+// node_modules/circle-ir/dist/analysis/passes/_credential-helpers.js
 var CRED_KEYWORD_RE2 = /(?:password|passwd|pwd|secret|api[_-]?key|auth[_-]?token|private[_-]?key|access[_-]?key|credential)/i;
 function isCredentialIdentifier(name2) {
   if (!name2)
@@ -43892,7 +43982,7 @@ function priorHashOf(varName, priorCalls) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/weak-password-hash-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-password-hash-pass.js
 var FAST_HASH_NAMES = new Set([
   "sha224",
   "sha-224",
@@ -44051,7 +44141,7 @@ class WeakPasswordHashPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-password-encoding-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-password-encoding-pass.js
 function isBasicAuthContext(call, code) {
   const line = call.location.line;
   if (line < 1)
@@ -44163,7 +44253,7 @@ class WeakPasswordEncodingPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/info-disclosure-stacktrace-pass.js
+// node_modules/circle-ir/dist/analysis/passes/info-disclosure-stacktrace-pass.js
 var RESPONSE_RECEIVER_RE = /^(res|response|w|writer|ctx|c)$/i;
 var LOGGER_RECEIVER_RE = /^(log|logger|slog|console|pino|winston|sentry)$/i;
 var RESPONSE_SEND_METHODS = new Set([
@@ -44349,7 +44439,7 @@ class InfoDisclosureStacktracePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
 function lineWindow(lines, startLine, endLine) {
@@ -44500,7 +44590,7 @@ class UnrestrictedFileUploadPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
 var HTML_OUTPUT_SINKS = new Set([
   "addAttribute",
   "setAttribute",
@@ -44648,7 +44738,7 @@ function methodAcceptsHtmlShapedParam(method) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
+// node_modules/circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
 var ANY_TYPE_PERMISSION_RE = /\bAnyTypePermission\b/;
 
 class InsecureDeserializationConfigPass {
@@ -44726,7 +44816,7 @@ class InsecureDeserializationConfigPass {
 }
 var INSECURE_TYPE_NAME_HANDLING_RE = /\bTypeNameHandling\s*=\s*(?:Newtonsoft\.Json\.)?TypeNameHandling\.(All|Auto|Objects|Arrays)\b/;
 
-// ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
+// node_modules/circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
   const receiver = call.receiver ?? "";
@@ -44837,7 +44927,7 @@ class PlaintextPasswordStoragePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cleartext-credential-transport-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cleartext-credential-transport-pass.js
 var LOCALHOST_RE = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0)(?::\d+)?$/i;
 function isInsecureHttpUrl(urlLiteral) {
   if (!urlLiteral)
@@ -44965,7 +45055,7 @@ class CleartextCredentialTransportPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/tls-verify-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/tls-verify-disabled-pass.js
 var PY_HTTP_METHODS = new Set([
   "get",
   "post",
@@ -45178,7 +45268,7 @@ class TlsVerifyDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/module-side-effect-pass.js
+// node_modules/circle-ir/dist/analysis/passes/module-side-effect-pass.js
 var JS_EXEC_METHODS = new Set([
   "exec",
   "spawn",
@@ -45409,7 +45499,7 @@ class ModuleSideEffectPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cache-no-vary-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cache-no-vary-pass.js
 function isSharedCacheable(value) {
   const v = value.toLowerCase();
   if (/\b(private|no-store|no-cache)\b/.test(v))
@@ -45696,7 +45786,7 @@ class CacheNoVaryPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/jwt-verify-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/jwt-verify-disabled-pass.js
 var PY_VERIFY_SIGNATURE_FALSE_RE = /["']verify_signature["']\s*:\s*False\b/;
 var PY_VERIFY_KW_FALSE_RE = /\bverify\s*=\s*False\b/;
 var PY_ALG_NONE_RE = /\balgorithms\s*=\s*[\[\(]\s*["']none["']/i;
@@ -45821,7 +45911,7 @@ class JwtVerifyDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/csrf-protection-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/csrf-protection-disabled-pass.js
 var JAVA_CSRF_DISABLE_RE = /\.csrf\s*\([^)]*\)\s*\.\s*disable\b/;
 var JAVA_CSRF_LAMBDA_DISABLE_RE = /\bcsrf\s*\(\s*\w+\s*->\s*\w+\s*\.\s*disable\s*\(/;
 var JAVA_CSRF_METHODREF_RE = /\bcsrf\s*\(\s*[\w.]+::disable\s*\)/;
@@ -45957,7 +46047,7 @@ class CsrfProtectionDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/xml-entity-expansion-pass.js
+// node_modules/circle-ir/dist/analysis/passes/xml-entity-expansion-pass.js
 var JAVA_FACTORIES = new Set([
   "SAXParserFactory",
   "DocumentBuilderFactory",
@@ -46097,7 +46187,7 @@ class XmlEntityExpansionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/mass-assignment-pass.js
+// node_modules/circle-ir/dist/analysis/passes/mass-assignment-pass.js
 var PY_KWARGS_SPLAT_RE = /\*\*\s*(?:request|self\.request|flask\.request|ctx|self)\s*\.\s*(?:form|args|values|json|get_json\s*\(\s*\)|files|data)/;
 var JS_OBJECT_SPREAD_RE = /\{\s*\.\.\.\s*(?:req|request|ctx|context)(?:\.request)?\s*\.\s*(?:body|query|params|form)\b/;
 
@@ -46181,7 +46271,7 @@ class MassAssignmentPass {
   }
 }
 
-// ../circle-ir/dist/graph/import-graph.js
+// node_modules/circle-ir/dist/graph/import-graph.js
 function dirname(filePath) {
   const idx = filePath.lastIndexOf("/");
   return idx >= 0 ? filePath.slice(0, idx) : "";
@@ -46314,7 +46404,7 @@ class ImportGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/circular-dependency-pass.js
+// node_modules/circle-ir/dist/analysis/passes/circular-dependency-pass.js
 class CircularDependencyPass {
   run(_projectGraph, importGraph) {
     const findings = [];
@@ -46341,7 +46431,7 @@ class CircularDependencyPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/orphan-module-pass.js
+// node_modules/circle-ir/dist/analysis/passes/orphan-module-pass.js
 class OrphanModulePass {
   run(_projectGraph, importGraph) {
     const findings = [];
@@ -46365,7 +46455,7 @@ class OrphanModulePass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/size-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/size-metrics-pass.js
 class SizeMetricsPass {
   name = "size-metrics";
   run(ctx) {
@@ -46421,7 +46511,7 @@ class SizeMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/complexity-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/complexity-metrics-pass.js
 class ComplexityMetricsPass {
   name = "complexity-metrics";
   run(ctx) {
@@ -46485,7 +46575,7 @@ class ComplexityMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/halstead-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/halstead-metrics-pass.js
 var KEYWORDS = new Set([
   "if",
   "else",
@@ -46640,7 +46730,7 @@ class HalsteadMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/data-flow-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/data-flow-metrics-pass.js
 class DataFlowMetricsPass {
   name = "data-flow-metrics";
   run(ctx) {
@@ -46658,7 +46748,7 @@ class DataFlowMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/coupling-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/coupling-metrics-pass.js
 class CouplingMetricsPass {
   name = "coupling-metrics";
   run(ctx) {
@@ -46736,7 +46826,7 @@ class CouplingMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/inheritance-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/inheritance-metrics-pass.js
 class InheritanceMetricsPass {
   name = "inheritance-metrics";
   run(ctx) {
@@ -46796,7 +46886,7 @@ class InheritanceMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/cohesion-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/cohesion-metrics-pass.js
 class CohesionMetricsPass {
   name = "cohesion-metrics";
   run(ctx) {
@@ -46879,7 +46969,7 @@ class CohesionMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/documentation-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/documentation-metrics-pass.js
 class DocumentationMetricsPass {
   name = "documentation-metrics";
   run(ctx) {
@@ -46932,7 +47022,7 @@ class DocumentationMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/composite-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/composite-metrics-pass.js
 class CompositeMetricsPass {
   name = "composite-metrics";
   run(ctx) {
@@ -46991,7 +47081,7 @@ class CompositeMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/metric-runner.js
+// node_modules/circle-ir/dist/analysis/metrics/metric-runner.js
 class MetricRunner {
   passes = [
     new SizeMetricsPass,
@@ -47013,7 +47103,7 @@ class MetricRunner {
     return accumulated;
   }
 }
-// ../circle-ir/dist/analyzer.js
+// node_modules/circle-ir/dist/analyzer.js
 var initialized = false;
 async function initAnalyzer(options = {}) {
   if (initialized)
@@ -47685,7 +47775,7 @@ function deriveProjectRoot(paths) {
   }
   return common.join("/") || "/";
 }
-// ../circle-ir/dist/analysis/sbom.js
+// node_modules/circle-ir/dist/analysis/sbom.js
 function purlVersion(spec) {
   const stripped = spec.trim().replace(/^[\s^~=<>]+/, "");
   if (/^v?[0-9][\w.\-+]*$/.test(stripped))
@@ -48731,7 +48821,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.8";
+var version = "4.9.10";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49284,8 +49374,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "5e6bcc1",
-  builtAt: "2026-08-25T19:50:02.936Z"
+  gitSha: "132eaf6",
+  builtAt: "2026-09-02T06:21:26.855Z"
 };
 
 // src/utils/args.ts