cognium-dev 4.9.9 → 4.9.10

package/dist/cli.js

@@ -3232,7 +3232,7 @@ var Query = class {
   }
 };
 
-// ../circle-ir/dist/core/parser.js
+// node_modules/circle-ir/dist/core/parser.js
 var nodeModules = null;
 var moduleDir = null;
 async function getNodeModules() {
@@ -3472,7 +3472,7 @@ async function getDefaultLanguagePath(language) {
   }
   return `wasm/tree-sitter-${language}.wasm`;
 }
-// ../circle-ir/dist/core/extractors/meta.js
+// node_modules/circle-ir/dist/core/extractors/meta.js
 function extractMeta(code, tree, filePath, language) {
   const loc = countLinesOfCode(code);
   const hash = computeHash(code);
@@ -3554,7 +3554,7 @@ function extractPackage(tree, language) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/types.js
+// node_modules/circle-ir/dist/core/extractors/types.js
 function detectLanguage(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -5222,7 +5222,7 @@ function findChildByType(node, type) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/calls.js
+// node_modules/circle-ir/dist/core/extractors/calls.js
 function detectLanguageFromTree(tree, cache) {
   const rustStructs = getNodesFromCache(tree.rootNode, "struct_item", cache);
   const rustImpls = getNodesFromCache(tree.rootNode, "impl_item", cache);
@@ -7274,7 +7274,7 @@ function extractGoTypeLastSegment(typeNode) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/imports.js
+// node_modules/circle-ir/dist/core/extractors/imports.js
 function detectLanguage2(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -7961,7 +7961,7 @@ function findGoChildByType(node, type) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/exports.js
+// node_modules/circle-ir/dist/core/extractors/exports.js
 function extractExports(types) {
   const exports = [];
   for (const type of types) {
@@ -8014,7 +8014,7 @@ function getVisibilityFromModifiers(modifiers) {
   }
   return "package";
 }
-// ../circle-ir/dist/core/extractors/cfg.js
+// node_modules/circle-ir/dist/core/extractors/cfg.js
 function detectLanguage3(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -8663,7 +8663,7 @@ function isGoStatement(node) {
   ]);
   return goStatementTypes.has(node.type);
 }
-// ../circle-ir/dist/core/extractors/dfg.js
+// node_modules/circle-ir/dist/core/extractors/dfg.js
 function detectLanguage4(tree) {
   const root = tree.rootNode;
   const jsNodeTypes = new Set([
@@ -10184,7 +10184,7 @@ function extractGoAddressableVarName(node) {
   }
   return null;
 }
-// ../circle-ir/dist/core/extractors/runtime-registrations.js
+// node_modules/circle-ir/dist/core/extractors/runtime-registrations.js
 var HTTP_VERB_METHODS = new Set([
   "get",
   "post",
@@ -10932,7 +10932,7 @@ function parseDistributedSliceAttribute(attrItem) {
     }
   };
 }
-// ../circle-ir/dist/analysis/config-loader.js
+// node_modules/circle-ir/dist/analysis/config-loader.js
 var DEFAULT_SOURCES = [
   { method: "getParameter", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
   { method: "getParameterValues", class: "HttpServletRequest", type: "http_param", severity: "high", return_tainted: true },
@@ -13011,7 +13011,7 @@ var DEFAULT_HEADER_RULES = [
     note: "Fires when the value is not a string literal (likely reflected from request)"
   }
 ];
-// ../circle-ir/dist/analysis/arg-type-resolver.js
+// node_modules/circle-ir/dist/analysis/arg-type-resolver.js
 function findEnclosingType(callInMethod, types) {
   if (!callInMethod)
     return null;
@@ -13089,7 +13089,7 @@ function isArgvContainerType(rawType) {
   return /^(?:List|ArrayList|LinkedList|Collection|Iterable|Deque|Queue)\s*<\s*(?:String|CharSequence|java\.lang\.String)\b/.test(s);
 }
 
-// ../circle-ir/dist/analysis/taint-matcher.js
+// node_modules/circle-ir/dist/analysis/taint-matcher.js
 var PYTHON_TAINTED_PATTERNS = [
   { pattern: /\brequest\.args\b/, sourceType: "http_param" },
   { pattern: /\brequest\.form\b/, sourceType: "http_body" },
@@ -15094,7 +15094,7 @@ function formatSanitizerMethod(call) {
   return `${call.method_name}()`;
 }
 
-// ../circle-ir/dist/analysis/unresolved.js
+// node_modules/circle-ir/dist/analysis/unresolved.js
 function detectUnresolved(calls, types, dfg) {
   const unresolved = [];
   unresolved.push(...detectVirtualDispatch(calls));
@@ -15258,7 +15258,7 @@ function formatCallCode(call) {
   }
   return `${call.method_name}(${args2})`;
 }
-// ../circle-ir/dist/analysis/non-executable-lines.js
+// node_modules/circle-ir/dist/analysis/non-executable-lines.js
 function isNonExecutableSourceLine(sourceCode, line, language) {
   if (!sourceCode || line < 1)
     return false;
@@ -15318,7 +15318,7 @@ function isNonExecutablePython(trimmed) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/sanitizer-index.js
+// node_modules/circle-ir/dist/analysis/sanitizer-index.js
 var SANITIZER_SET_CACHE = new WeakMap;
 function getSanitizesSet(san) {
   let s = SANITIZER_SET_CACHE.get(san);
@@ -15332,7 +15332,7 @@ function sanitizerCoversSink(san, sinkType) {
   return getSanitizesSet(san).has(sinkType);
 }
 
-// ../circle-ir/dist/analysis/dfg-walk.js
+// node_modules/circle-ir/dist/analysis/dfg-walk.js
 var walkBackwardDefsMemo = new WeakMap;
 function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   const maxHops = options.maxHops ?? 32;
@@ -15385,7 +15385,7 @@ function walkBackwardDefs(startDefId, chainsByToDef, defById, options = {}) {
   return result;
 }
 
-// ../circle-ir/dist/analysis/findings.js
+// node_modules/circle-ir/dist/analysis/findings.js
 function canSourceReachSink(sourceType, sinkType) {
   const sourceToSinkMapping = {
     http_param: ["sql_injection", "command_injection", "path_traversal", "xss", "xpath_injection", "ldap_injection", "ssrf", "mybatis_mapper_call", "code_injection", "crlf", "mass_assignment", "open_redirect", "trust_boundary", "deserialization", "log_injection", "format_string", "nosql_injection", "prompt_injection"],
@@ -15416,7 +15416,7 @@ function sourceSemanticsAllowed(source, sinkType) {
   return true;
 }
 
-// ../circle-ir/dist/analysis/findings-instrumentation.js
+// node_modules/circle-ir/dist/analysis/findings-instrumentation.js
 var instrumentEnabled = false;
 function setFindingsInstrumentation(enabled) {
   instrumentEnabled = enabled;
@@ -15479,7 +15479,7 @@ function emitFindingsInstrumentation(filePath, findings, taint) {
   };
   console.error(`[findings-summary] ${JSON.stringify(summary)}`);
 }
-// ../circle-ir/dist/graph/code-graph.js
+// node_modules/circle-ir/dist/graph/code-graph.js
 class CodeGraph {
   ir;
   constructor(ir) {
@@ -15689,7 +15689,7 @@ class CodeGraph {
     return result;
   }
 }
-// ../circle-ir/dist/resolution/type-hierarchy.js
+// node_modules/circle-ir/dist/resolution/type-hierarchy.js
 class TypeHierarchyResolver {
   types = new Map;
   nameToFqn = new Map;
@@ -16261,7 +16261,7 @@ function registerCommonLibraries(resolver) {
   resolver.registerFactoryReturnType("HttpClients", "createSystem", "org.apache.http.impl.client.CloseableHttpClient");
   resolver.registerFactoryReturnType("HttpClients", "createMinimal", "org.apache.http.impl.client.MinimalHttpClient");
 }
-// ../circle-ir/dist/resolution/symbol-table.js
+// node_modules/circle-ir/dist/resolution/symbol-table.js
 class SymbolTable {
   exports = new Map;
   nameToFqns = new Map;
@@ -16484,7 +16484,7 @@ class SymbolTable {
     return "package";
   }
 }
-// ../circle-ir/dist/resolution/cross-file.js
+// node_modules/circle-ir/dist/resolution/cross-file.js
 function buildFileIndex(ir) {
   const callsByLine = new Map;
   for (const c of ir.calls) {
@@ -17572,7 +17572,7 @@ class CrossFileResolver {
     return this.fieldTaintInfo.get(`${typeFqn}.${fieldName}`);
   }
 }
-// ../circle-ir/dist/graph/project-graph.js
+// node_modules/circle-ir/dist/graph/project-graph.js
 class ProjectGraph {
   files = new Map;
   _symbolTable = null;
@@ -17624,7 +17624,7 @@ class ProjectGraph {
     return this._resolver;
   }
 }
-// ../circle-ir/dist/graph/analysis-pass.js
+// node_modules/circle-ir/dist/graph/analysis-pass.js
 class AnalysisPipeline {
   passes = [];
   add(pass) {
@@ -17671,7 +17671,7 @@ class AnalysisPipeline {
     return { results, findings };
   }
 }
-// ../circle-ir/dist/analysis/taint-propagation.js
+// node_modules/circle-ir/dist/analysis/taint-propagation.js
 function buildSanitizersByLine(sanitizers) {
   const out2 = new Map;
   for (const san of sanitizers) {
@@ -17970,7 +17970,7 @@ function buildTaintFlow(source, sink, taintInfo) {
     confidence: taintInfo.confidence * 0.9
   };
 }
-// ../circle-ir/dist/analysis/constant-propagation/ast-utils.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/ast-utils.js
 function isKnown(cv) {
   return cv.type !== "unknown";
 }
@@ -17987,7 +17987,7 @@ function getNodeLine(node) {
   return node.startPosition.row + 1;
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/evaluator.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/evaluator.js
 class ExpressionEvaluator {
   source;
   getSymbol;
@@ -18257,7 +18257,7 @@ class ExpressionEvaluator {
   }
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/patterns.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/patterns.js
 var TAINT_PATTERNS = [
   "request.getParameter",
   "request.getHeader",
@@ -18452,7 +18452,7 @@ var PROPAGATOR_METHODS = new Set([
   "decodeRequestString"
 ]);
 
-// ../circle-ir/dist/analysis/constant-propagation/propagator.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/propagator.js
 class ConstantPropagator {
   symbols = new Map;
   tainted = new Set;
@@ -20309,7 +20309,7 @@ class ConstantPropagator {
   }
 }
 
-// ../circle-ir/dist/analysis/constant-propagation/index.js
+// node_modules/circle-ir/dist/analysis/constant-propagation/index.js
 function analyzeConstantPropagation(tree, sourceCode, options = {}) {
   const propagator = new ConstantPropagator;
   return propagator.analyze(tree, sourceCode, options.additionalTaintPatterns ?? [], options.sanitizerMethods ?? [], options.taintedParameters ?? []);
@@ -20397,7 +20397,7 @@ function normalizeCondition(cond) {
   }
   return normalized;
 }
-// ../circle-ir/dist/utils/logger.js
+// node_modules/circle-ir/dist/utils/logger.js
 var LOG_LEVELS = {
   trace: 0,
   debug: 1,
@@ -20469,7 +20469,7 @@ var logger = {
   }
 };
 
-// ../circle-ir/dist/analysis/per-file-finding-cap.js
+// node_modules/circle-ir/dist/analysis/per-file-finding-cap.js
 var DEFAULT_PER_FILE_FINDING_CAP = 1000;
 var SATURATED_FILE_RULE_ID = "saturated-file";
 function applyPerFileFindingCap(filePath, findings, cap) {
@@ -20505,7 +20505,7 @@ function applyPerFileFindingCap(filePath, findings, cap) {
   return [advisory];
 }
 
-// ../circle-ir/dist/analysis/confidence-filter.js
+// node_modules/circle-ir/dist/analysis/confidence-filter.js
 function applyConfidenceFilter(findings, includeSpeculative) {
   if (includeSpeculative)
     return findings;
@@ -20515,7 +20515,7 @@ function isHighConfidence(finding) {
   return finding.confidence === undefined || finding.confidence === "high";
 }
 
-// ../circle-ir/dist/analysis/library-api-surface-downgrade.js
+// node_modules/circle-ir/dist/analysis/library-api-surface-downgrade.js
 var LIBRARY_API_SURFACE_TAG = "library-api-surface:caller-responsibility";
 function applyLibraryApiSurfaceDowngrade(findings) {
   return findings.map((f) => {
@@ -20532,7 +20532,7 @@ function applyLibraryApiSurfaceDowngrade(findings) {
   });
 }
 
-// ../circle-ir/dist/analysis/note-coalescer.js
+// node_modules/circle-ir/dist/analysis/note-coalescer.js
 var CLICKJACKING_PAIR = new Set(["missing-x-frame-options", "missing-csp-frame-ancestors"]);
 function levelRank(level) {
   return level === "error" ? 0 : level === "warning" ? 1 : 2;
@@ -20596,7 +20596,7 @@ function coalesceNoteLevelFindings(findings) {
   return out2;
 }
 
-// ../circle-ir/dist/analysis/entry-point-detection.js
+// node_modules/circle-ir/dist/analysis/entry-point-detection.js
 var TIER_1_METHOD_ANNOTATIONS = new Set([
   "RequestMapping",
   "GetMapping",
@@ -21253,7 +21253,7 @@ function methodIsRuntimeRegistrationHandler(method, regs) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/require-entry-path.js
+// node_modules/circle-ir/dist/analysis/require-entry-path.js
 var RULE_ID_REQUIRE_ENTRY_PATH = "require-entry-path";
 var MAX_VISITED_METHODS = 2000;
 var TAINT_FLOW_RULE_IDS = new Set([
@@ -21642,7 +21642,7 @@ function normalizeDisabled(input) {
   return new Set(input);
 }
 
-// ../circle-ir/dist/analysis/project-profile-transform.js
+// node_modules/circle-ir/dist/analysis/project-profile-transform.js
 var DOWNGRADE_ELIGIBLE_RULE_IDS = new Set([
   "code_injection",
   "template_injection",
@@ -21704,7 +21704,7 @@ function applyProjectProfileTransform(findings, resolveProfile) {
   });
 }
 
-// ../circle-ir/dist/languages/registry.js
+// node_modules/circle-ir/dist/languages/registry.js
 class DefaultLanguageRegistry {
   plugins = new Map;
   extensionMap = new Map;
@@ -21751,7 +21751,7 @@ function registerLanguage(plugin) {
 function getLanguagePlugin(language) {
   return getLanguageRegistry().get(language);
 }
-// ../circle-ir/dist/languages/plugins/base.js
+// node_modules/circle-ir/dist/languages/plugins/base.js
 class BaseLanguagePlugin {
   parser = null;
   async initialize(parser) {
@@ -21812,7 +21812,7 @@ class BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/java.js
+// node_modules/circle-ir/dist/languages/plugins/java.js
 class JavaPlugin extends BaseLanguagePlugin {
   id = "java";
   name = "Java";
@@ -22069,7 +22069,7 @@ class JavaPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/javascript.js
+// node_modules/circle-ir/dist/languages/plugins/javascript.js
 class JavaScriptPlugin extends BaseLanguagePlugin {
   id = "javascript";
   name = "JavaScript/TypeScript";
@@ -22735,7 +22735,7 @@ class JavaScriptPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/python.js
+// node_modules/circle-ir/dist/languages/plugins/python.js
 class PythonPlugin extends BaseLanguagePlugin {
   id = "python";
   name = "Python";
@@ -23011,7 +23011,7 @@ class PythonPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/rust.js
+// node_modules/circle-ir/dist/languages/plugins/rust.js
 class RustPlugin extends BaseLanguagePlugin {
   id = "rust";
   name = "Rust";
@@ -23251,7 +23251,7 @@ class RustPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/bash.js
+// node_modules/circle-ir/dist/languages/plugins/bash.js
 class BashPlugin extends BaseLanguagePlugin {
   id = "bash";
   name = "Bash/Shell";
@@ -23457,7 +23457,7 @@ class BashPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/html.js
+// node_modules/circle-ir/dist/languages/plugins/html.js
 class HtmlPlugin extends BaseLanguagePlugin {
   id = "html";
   name = "HTML";
@@ -23522,7 +23522,7 @@ class HtmlPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/vue.js
+// node_modules/circle-ir/dist/languages/plugins/vue.js
 class VuePlugin extends BaseLanguagePlugin {
   id = "vue";
   name = "Vue";
@@ -23587,7 +23587,7 @@ class VuePlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/go.js
+// node_modules/circle-ir/dist/languages/plugins/go.js
 class GoPlugin extends BaseLanguagePlugin {
   id = "go";
   name = "Go";
@@ -24236,7 +24236,7 @@ class GoPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/csharp.js
+// node_modules/circle-ir/dist/languages/plugins/csharp.js
 class CSharpPlugin extends BaseLanguagePlugin {
   id = "csharp";
   name = "C#";
@@ -24295,7 +24295,7 @@ class CSharpPlugin extends BaseLanguagePlugin {
   }
 }
 
-// ../circle-ir/dist/languages/plugins/index.js
+// node_modules/circle-ir/dist/languages/plugins/index.js
 function registerBuiltinPlugins() {
   registerLanguage(new JavaPlugin);
   registerLanguage(new JavaScriptPlugin);
@@ -24307,7 +24307,7 @@ function registerBuiltinPlugins() {
   registerLanguage(new GoPlugin);
   registerLanguage(new CSharpPlugin);
 }
-// ../circle-ir/dist/analysis/passes/cross-file-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cross-file-pass.js
 class CrossFilePass {
   run(projectGraph, sourceLines, options = {}) {
     const resolver = projectGraph.resolver;
@@ -24633,7 +24633,7 @@ function findCrossInstanceAliasingPaths(projectGraph, _sourceLines) {
   return paths;
 }
 
-// ../circle-ir/dist/analysis/html/html-extractor.js
+// node_modules/circle-ir/dist/analysis/html/html-extractor.js
 var EVENT_HANDLER_ATTRS = new Set([
   "onclick",
   "ondblclick",
@@ -24788,7 +24788,7 @@ function stripQuotes2(text) {
   return text;
 }
 
-// ../circle-ir/dist/analysis/html/html-attribute-security-pass.js
+// node_modules/circle-ir/dist/analysis/html/html-attribute-security-pass.js
 function runHtmlAttributeSecurityChecks(rootNode, filePath) {
   const findings = [];
   walkForSecurityChecks(rootNode, filePath, findings);
@@ -25014,7 +25014,7 @@ function truncate(s, maxLen) {
   return s.length > maxLen ? s.slice(0, maxLen) + "..." : s;
 }
 
-// ../circle-ir/dist/analysis/html/vue-template-xss-pass.js
+// node_modules/circle-ir/dist/analysis/html/vue-template-xss-pass.js
 var DANGEROUS_BINDINGS = new Set([
   "v-html",
   "v-bind:innerhtml",
@@ -25134,7 +25134,7 @@ function collectTaintedNames(blocks) {
   return names;
 }
 
-// ../circle-ir/dist/analysis/html/html-merge.js
+// node_modules/circle-ir/dist/analysis/html/html-merge.js
 function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   const allTypes = [];
   const allCalls = [];
@@ -25284,7 +25284,7 @@ function mergeHtmlResults(htmlMeta, scriptResults, attributeFindings) {
   };
 }
 
-// ../circle-ir/dist/analysis/passes/taint-matcher-pass.js
+// node_modules/circle-ir/dist/analysis/passes/taint-matcher-pass.js
 class TaintMatcherPass {
   name = "taint-matcher";
   category = "security";
@@ -25345,7 +25345,7 @@ class TaintMatcherPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/constant-propagation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/constant-propagation-pass.js
 class ConstantPropagationPass {
   tree;
   name = "constant-propagation";
@@ -25375,7 +25375,7 @@ class ConstantPropagationPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/language-sources-pass.js
+// node_modules/circle-ir/dist/analysis/passes/language-sources-pass.js
 var JS_DOM_XSS_SINKS = [
   { pattern: /\.innerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
   { pattern: /\.outerHTML\s*=/, type: "xss", cwe: "CWE-79", severity: "critical" },
@@ -32423,7 +32423,7 @@ function findJsTemplateInjectionSstiFindings(code, file) {
   return findings;
 }
 
-// ../circle-ir/dist/analysis/passes/source-semantics-pass.js
+// node_modules/circle-ir/dist/analysis/passes/source-semantics-pass.js
 var DEMO_PATH_RE = /(?:^|\/)(?:demo|example|examples|samples|integration-tests|integration_tests)(?:\/|$)/i;
 var CONST_STRING_ASSIGN_RE = /^\s*(?:final\s+|static\s+final\s+)?[A-Za-z_][\w.<>\[\]]*\s+[A-Za-z_]\w*\s*=\s*"[^"]*"\s*;?\s*$/;
 var STATIC_FINAL_RE = /^\s*(?:public\s+|private\s+|protected\s+)?static\s+final\s+/;
@@ -32511,7 +32511,7 @@ class SourceSemanticsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-source-gate-pass.js
 var SPECULATIVE_SOURCE_TYPES = new Set([
   "interprocedural_param",
   "constructor_field"
@@ -32566,7 +32566,7 @@ class LibraryProfileSourceGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
+// node_modules/circle-ir/dist/analysis/passes/mybatis-annotation-sql-sink-pass.js
 var MYBATIS_SQL_ANNOTATIONS = new Set([
   "Select",
   "Update",
@@ -32793,7 +32793,7 @@ class MyBatisAnnotationSqlSinkPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/sink-filter-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sink-filter-pass.js
 function escapeReSf(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -34597,7 +34597,7 @@ function isXPathQuoteEscapedOnLine(lineText, varName) {
   return seen > 0;
 }
 
-// ../circle-ir/dist/analysis/passes/sink-semantics-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sink-semantics-pass.js
 function buildRegistry(entries) {
   const registry = new Map;
   for (const entry of entries) {
@@ -34645,7 +34645,7 @@ class SinkSemanticsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/dependency-versions.js
+// node_modules/circle-ir/dist/analysis/dependency-versions.js
 function resolveFastjsonFromPom(pomXml) {
   if (!pomXml)
     return null;
@@ -34823,7 +34823,7 @@ function fileConfiguresSnakeYamlSafely(source) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/deserialization-safety-gate-pass.js
 var FASTJSON_METHODS = new Set(["parseObject", "parse"]);
 var FASTJSON_CLASSES = new Set(["JSON", "JSONObject"]);
 var JACKSON_METHODS = new Set(["readValue", "convertValue", "treeToValue"]);
@@ -34900,7 +34900,7 @@ class DeserializationSafetyGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/prompt-injection-safety-gate-pass.js
 function isDelimiterLiteral(lit) {
   const s = lit.trim();
   if (s.length === 0)
@@ -35143,7 +35143,7 @@ class PromptInjectionSafetyGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
+// node_modules/circle-ir/dist/analysis/passes/speculative-prompt-param-source-pass.js
 function returnOrAssignRhs(text) {
   const t = text.trim();
   const ret = t.match(/^return\s+(.+?);?$/);
@@ -35269,7 +35269,7 @@ class SpeculativePromptParamSourcePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cli-main-reflection-suppress-pass.js
 var REFLECTION_SINK_METHODS = new Set([
   "forName",
   "newInstance",
@@ -35457,7 +35457,7 @@ class CliMainReflectionSuppressPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-sink-gate-pass.js
 var DROPPED_SINK_TYPES = new Set([
   "log_injection"
 ]);
@@ -35563,7 +35563,7 @@ class LibraryProfileCwe22PathGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/library-profile-xss-gate-pass.js
 var XSS_NON_HTML_OUTPUT_CLASSES = new Set([
   "StringBuilder",
   "StringBuffer",
@@ -35644,7 +35644,7 @@ class LibraryProfileXssGatePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/taint-propagation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/taint-propagation-pass.js
 class TaintPropagationPass {
   name = "taint-propagation";
   category = "security";
@@ -36874,7 +36874,7 @@ function pickScopedSource(sources, sinkLine, methodName, types, taintedVar) {
   return sources[0];
 }
 
-// ../circle-ir/dist/analysis/interprocedural.js
+// node_modules/circle-ir/dist/analysis/interprocedural.js
 function analyzeInterprocedural2(graphOrTypes, callsOrSources, dfgOrSinks, sourcesOrSanitizers, sinksOrOptions, sanitizersArg, optionsArg = {}) {
   let graph;
   let sources;
@@ -37388,7 +37388,7 @@ function findTaintBridges2(result) {
   return bridges;
 }
 
-// ../circle-ir/dist/analysis/passes/interprocedural-pass.js
+// node_modules/circle-ir/dist/analysis/passes/interprocedural-pass.js
 class InterproceduralPass {
   name = "interprocedural";
   category = "security";
@@ -37594,7 +37594,7 @@ class InterproceduralPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/dead-code-pass.js
+// node_modules/circle-ir/dist/analysis/passes/dead-code-pass.js
 class DeadCodePass {
   name = "dead-code";
   category = "reliability";
@@ -37670,7 +37670,7 @@ class DeadCodePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-await-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-await-pass.js
 var ASYNC_METHODS = new Set([
   "readFile",
   "writeFile",
@@ -37749,7 +37749,7 @@ class MissingAwaitPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/n-plus-one-pass.js
+// node_modules/circle-ir/dist/analysis/passes/n-plus-one-pass.js
 var HIGH_CONFIDENCE_DB_METHODS = new Set([
   "executeQuery",
   "executeUpdate",
@@ -37872,7 +37872,7 @@ class NPlusOnePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-public-doc-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-public-doc-pass.js
 var TEST_PATH_RE = /[/._](test|tests|spec|specs|__tests?__|__mocks?__)[/._]/i;
 var UTIL_DIR_RE = /[/](utils?|helpers?|internal|private|common|shared)[/]/i;
 function hasDocCommentBefore(lines, startLine) {
@@ -37979,7 +37979,7 @@ class MissingPublicDocPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/todo-in-prod-pass.js
+// node_modules/circle-ir/dist/analysis/passes/todo-in-prod-pass.js
 var TEST_PATH_RE2 = /[/._](test|tests|spec|specs|__tests?__|__mocks?__)[/._]/i;
 var MARKER_RE = /(?:\/\/|#|--|^\s*\*)\s*(TODO|FIXME|HACK|XXX)\b/i;
 function markerSeverity(marker) {
@@ -38025,7 +38025,7 @@ class TodoInProdPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/string-concat-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/string-concat-loop-pass.js
 var CONCAT_RE = /\b([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\+=/;
 var NUMERIC_VAR_RE = /^(i|j|k|n|m|x|y|z|count|sum|total|size|index|len|length|num|idx|score|counter|offset|pos|col|row|result|ret|value|acc|bits|byte|bytes|flag|flags|step|delta|diff|dist|min|max|avg|mean|page|line|err|error)$/i;
 var NUMERIC_SUFFIX_RE = /(Count|Sum|Total|Size|Index|Length|Offset|Position|Score|Counter|Num|Amount|Val|Idx|Len|Max|Min|Avg|Delta|Diff|Step|Flag|Flags|Bits|Byte|Bytes|Calls|Items|Nodes|Edges|Blocks|Lines|Chars|Entries|Records|Rows)$/;
@@ -38088,7 +38088,7 @@ class StringConcatLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/sync-io-async-pass.js
+// node_modules/circle-ir/dist/analysis/passes/sync-io-async-pass.js
 var BLOCKING_METHODS = new Set([
   "sleep"
 ]);
@@ -38149,7 +38149,7 @@ class SyncIoAsyncPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unchecked-return-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unchecked-return-pass.js
 var MUST_CHECK_HIGH = new Set([
   "createNewFile",
   "mkdir",
@@ -38222,7 +38222,7 @@ class UncheckedReturnPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/null-deref-pass.js
+// node_modules/circle-ir/dist/analysis/passes/null-deref-pass.js
 var NULL_EXPR_RE = /^\s*(null|None|undefined)\s*$/;
 function escRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -38304,7 +38304,7 @@ class NullDerefPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/resource-leak-pass.js
+// node_modules/circle-ir/dist/analysis/passes/resource-leak-pass.js
 function escapeRegex2(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -38581,7 +38581,7 @@ class ResourceLeakPass {
   }
 }
 
-// ../circle-ir/dist/graph/scope-graph.js
+// node_modules/circle-ir/dist/graph/scope-graph.js
 function hasDeclKeyword(lineText, language) {
   switch (language) {
     case "java":
@@ -38621,7 +38621,7 @@ class ScopeGraph {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/variable-shadowing-pass.js
+// node_modules/circle-ir/dist/analysis/passes/variable-shadowing-pass.js
 var SKIP_NAMES = new Set([
   "let",
   "const",
@@ -38779,7 +38779,7 @@ class VariableShadowingPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/leaked-global-pass.js
+// node_modules/circle-ir/dist/analysis/passes/leaked-global-pass.js
 var SKIP_NAMES2 = new Set([
   "_",
   "e",
@@ -38866,7 +38866,7 @@ class LeakedGlobalPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unused-variable-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unused-variable-pass.js
 var SKIP_NAMES3 = new Set([
   "_",
   "unused",
@@ -39011,7 +39011,7 @@ class UnusedVariablePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/dependency-fan-out-pass.js
+// node_modules/circle-ir/dist/analysis/passes/dependency-fan-out-pass.js
 var DEFAULT_THRESHOLD = 20;
 
 class DependencyFanOutPass {
@@ -39043,7 +39043,7 @@ class DependencyFanOutPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/stale-doc-ref-pass.js
+// node_modules/circle-ir/dist/analysis/passes/stale-doc-ref-pass.js
 var DOC_BLOCK_RE = /\/\*\*([\s\S]*?)\*\//g;
 var LINK_RE = /\{@link\s+([\w.#]+)/g;
 var SEE_RE = /@see\s+([\w.#]+)/g;
@@ -39122,7 +39122,7 @@ class StaleDocRefPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/infinite-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/infinite-loop-pass.js
 var EXIT_KEYWORDS = /\b(return|throw|raise|break|System\.exit|process\.exit|os\._exit|exit!\()\b/;
 var ITERATOR_LOOP_PATTERNS = [
   /\bfor\s*\([^)]*\s+of\s+/,
@@ -39241,7 +39241,7 @@ class InfiniteLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/deep-inheritance-pass.js
+// node_modules/circle-ir/dist/analysis/passes/deep-inheritance-pass.js
 var DEPTH_THRESHOLD = 5;
 var CYCLE_GUARD = 20;
 
@@ -39304,7 +39304,7 @@ class DeepInheritancePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/redundant-loop-pass.js
+// node_modules/circle-ir/dist/analysis/passes/redundant-loop-pass.js
 var LENGTH_PATTERN = /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:length|size\(\)|count\(\))/g;
 var LENGTH_PATTERN_METHODS = /\b([A-Za-z_$][A-Za-z0-9_$]*)\s*\.\s*(?:size\(\)|count\(\))/g;
 var OBJECT_STATIC_PATTERN = /\bObject\s*\.\s*(?:keys|values|entries)\s*\(\s*([A-Za-z_$][A-Za-z0-9_$]*)\s*\)/g;
@@ -39427,7 +39427,7 @@ class RedundantLoopPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unbounded-collection-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unbounded-collection-pass.js
 var GROW_METHODS = {
   java: new Set(["add", "put", "offer", "push", "addAll", "addFirst", "addLast", "enqueue", "insert"]),
   javascript: new Set(["push", "set", "add", "unshift", "append", "prepend"]),
@@ -39551,7 +39551,7 @@ class UnboundedCollectionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/serial-await-pass.js
+// node_modules/circle-ir/dist/analysis/passes/serial-await-pass.js
 var AWAIT_ASSIGN_RE = /(?:const|let|var)?\s*(\w+)\s*=\s*await\s/;
 var AWAIT_RE = /\bawait\s/;
 
@@ -39647,7 +39647,7 @@ class SerialAwaitPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/react-inline-jsx-pass.js
+// node_modules/circle-ir/dist/analysis/passes/react-inline-jsx-pass.js
 var JSX_COMPONENT_RE = /<[A-Z][A-Za-z0-9]*/;
 var INLINE_OBJECT_RE = /\s([A-Za-z][A-Za-z0-9_]*)=\{\{/g;
 var INLINE_ARROW_RE = /\s([A-Za-z][A-Za-z0-9_]*)=\{(?:\(|[A-Za-z_$]).*?=>/g;
@@ -39751,7 +39751,7 @@ class ReactInlineJsxPass {
   }
 }
 
-// ../circle-ir/dist/graph/exception-flow-graph.js
+// node_modules/circle-ir/dist/graph/exception-flow-graph.js
 class ExceptionFlowGraph2 {
   pairs;
   catchEntryIds;
@@ -39802,7 +39802,7 @@ class ExceptionFlowGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/swallowed-exception-pass.js
+// node_modules/circle-ir/dist/analysis/passes/swallowed-exception-pass.js
 var MEANINGFUL_ACTION_RE = /\b(throw|raise|log|logger|console\.(error|warn|log|debug|info)|System\.(out|err)\.|print(?:ln|f)?|warn|error|debug|info|fatal|LOGGER|LOG|logging\.(warning|error|debug|info|critical))\b|\breturn\s+\S/;
 
 class SwallowedExceptionPass {
@@ -39900,7 +39900,7 @@ class SwallowedExceptionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/broad-catch-pass.js
+// node_modules/circle-ir/dist/analysis/passes/broad-catch-pass.js
 var JAVA_BROAD_RE = /catch\s*\(\s*(Exception|Throwable|RuntimeException|Error)\s/;
 var PYTHON_BROAD_RE = /^\s*except\s*:|except\s+(Exception|BaseException)\b/;
 
@@ -39956,7 +39956,7 @@ class BroadCatchPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unhandled-exception-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unhandled-exception-pass.js
 var JS_THROW_RE = /^\s*throw\s+/;
 var PYTHON_RAISE_RE = /^\s*raise\b/;
 function isValidationThrow(lines, throwLine) {
@@ -40126,7 +40126,7 @@ class UnhandledExceptionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/double-close-pass.js
+// node_modules/circle-ir/dist/analysis/passes/double-close-pass.js
 var RESOURCE_CTORS2 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40241,7 +40241,7 @@ class DoubleClosePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/use-after-close-pass.js
+// node_modules/circle-ir/dist/analysis/passes/use-after-close-pass.js
 var RESOURCE_CTORS3 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40349,7 +40349,7 @@ class UseAfterClosePass {
   }
 }
 
-// ../circle-ir/dist/graph/dominator-graph.js
+// node_modules/circle-ir/dist/graph/dominator-graph.js
 function computeRPO(cfg, entryId) {
   const outgoing = new Map;
   for (const edge of cfg.edges) {
@@ -40514,7 +40514,7 @@ class DominatorGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cleanup-verify-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cleanup-verify-pass.js
 var RESOURCE_CTORS4 = new Set([
   "FileInputStream",
   "FileOutputStream",
@@ -40639,7 +40639,7 @@ class CleanupVerifyPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-override-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-override-pass.js
 class MissingOverridePass {
   name = "missing-override";
   category = "maintainability";
@@ -40726,7 +40726,7 @@ class MissingOverridePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unused-interface-method-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unused-interface-method-pass.js
 class UnusedInterfaceMethodPass {
   name = "unused-interface-method";
   category = "maintainability";
@@ -40769,7 +40769,7 @@ class UnusedInterfaceMethodPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/blocking-main-thread-pass.js
+// node_modules/circle-ir/dist/analysis/passes/blocking-main-thread-pass.js
 var HTTP_DECORATORS = new Set([
   "Get",
   "Post",
@@ -40872,7 +40872,7 @@ class BlockingMainThreadPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/excessive-allocation-pass.js
+// node_modules/circle-ir/dist/analysis/passes/excessive-allocation-pass.js
 var ALLOC_PATTERNS = {
   javascript: /\bnew\s+(Array|Map|Set|Object|WeakMap|WeakSet|Error|RegExp|Date|Buffer|Uint8Array|Int8Array|Float32Array|ArrayBuffer)\s*[(<]|\bArray\.from\s*\(|\bstructuredClone\s*\(|\bObject\.create\s*\(/,
   typescript: /\bnew\s+(Array|Map|Set|Object|WeakMap|WeakSet|Error|RegExp|Date|Buffer|Uint8Array|Int8Array|Float32Array|ArrayBuffer)\s*[(<]|\bArray\.from\s*\(|\bstructuredClone\s*\(|\bObject\.create\s*\(/,
@@ -40939,7 +40939,7 @@ class ExcessiveAllocationPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-stream-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-stream-pass.js
 var JS_WHOLE_LOAD_RE = /\b(?:readFileSync|fs\.readFile\b|response\.text\b|response\.json\b|res\.text\b|res\.json\b|body\.text\b|body\.json\b)\s*\(/;
 var JS_STREAM_RE = /\.pipe\s*\(|\.on\s*\(\s*['"]data['"]|for\s+await\s*\(|\bcreateReadStream\b|\bstream\b/i;
 var JAVA_WHOLE_READ_RE = /\bFiles\.readAllBytes\s*\(|\bFiles\.readAllLines\s*\(|\bFiles\.readString\s*\(|\bnew\s+BufferedReader\s*\(|\bFileInputStream\b/;
@@ -41086,7 +41086,7 @@ class MissingStreamPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/god-class-pass.js
+// node_modules/circle-ir/dist/analysis/passes/god-class-pass.js
 var WMC_THRESHOLD = 47;
 var LCOM2_THRESHOLD = 0.8;
 var CBO_THRESHOLD = 14;
@@ -41252,7 +41252,7 @@ class GodClassPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/naming-convention-pass.js
+// node_modules/circle-ir/dist/analysis/passes/naming-convention-pass.js
 var PASCAL_CASE_RE = /^[A-Z][A-Za-z0-9]*$/;
 var CAMEL_CASE_RE = /^[a-z][a-zA-Z0-9]*$/;
 var SNAKE_CASE_RE = /^[a-z_][a-z0-9_]*$/;
@@ -41392,7 +41392,7 @@ class NamingConventionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/security-headers-pass.js
+// node_modules/circle-ir/dist/analysis/passes/security-headers-pass.js
 var HEADER_WRITE_METHODS = new Set([
   "setHeader",
   "addHeader",
@@ -41853,7 +41853,7 @@ function mapReturnValueToCorsRule(returnValue) {
   };
 }
 
-// ../circle-ir/dist/analysis/passes/_fp-allowlists.js
+// node_modules/circle-ir/dist/analysis/passes/_fp-allowlists.js
 var PEM_BODY_RE = /[A-Za-z0-9+/]{30,}/;
 function pemHasInlineBody(lines, hitLineIdx) {
   const end = Math.min(hitLineIdx + 5, lines.length);
@@ -41880,7 +41880,7 @@ function isProtocolMandatedCryptoFile(file, code) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/scan-secrets-pass.js
+// node_modules/circle-ir/dist/analysis/passes/scan-secrets-pass.js
 function applyDemoDowngrade(demoPath, severity, level) {
   if (!demoPath)
     return { severity, level };
@@ -42458,7 +42458,7 @@ class ScanSecretsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
+// node_modules/circle-ir/dist/analysis/passes/python-receiver-taint-format-pass.js
 class PythonReceiverTaintFormatPass {
   name = "python-receiver-taint-format";
   category = "security";
@@ -42510,7 +42510,7 @@ class PythonReceiverTaintFormatPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/spring4shell-pass.js
+// node_modules/circle-ir/dist/analysis/passes/spring4shell-pass.js
 var CONTROLLER_ANNOTATIONS = new Set([
   "Controller",
   "RestController",
@@ -42718,7 +42718,7 @@ function isPotentialPojo(type) {
   return first >= 65 && first <= 90;
 }
 
-// ../circle-ir/dist/analysis/passes/insecure-cookie-pass.js
+// node_modules/circle-ir/dist/analysis/passes/insecure-cookie-pass.js
 var COOKIE_RESPONSE_RECEIVERS = new Set([
   "res",
   "response",
@@ -42954,7 +42954,7 @@ class InsecureCookiePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-hash-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-hash-pass.js
 var WEAK_HASH_NAMES = new Set([
   "md2",
   "md4",
@@ -43174,7 +43174,7 @@ class WeakHashPass {
   }
 }
 
-// ../circle-ir/dist/analysis/path-classification.js
+// node_modules/circle-ir/dist/analysis/path-classification.js
 var TEST_PATH_PATTERNS = [
   /(^|\/)test\//i,
   /(^|\/)tests\//i,
@@ -43211,7 +43211,7 @@ function isTestPath(filepath) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/weak-crypto-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-crypto-pass.js
 var WEAK_CIPHER_BASES = new Set([
   "des",
   "3des",
@@ -43716,7 +43716,7 @@ class WeakCryptoPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-random-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-random-pass.js
 var JAVA_RANDOM_METHODS = new Set([
   "nextInt",
   "nextLong",
@@ -43889,7 +43889,7 @@ class WeakRandomPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/_credential-helpers.js
+// node_modules/circle-ir/dist/analysis/passes/_credential-helpers.js
 var CRED_KEYWORD_RE2 = /(?:password|passwd|pwd|secret|api[_-]?key|auth[_-]?token|private[_-]?key|access[_-]?key|credential)/i;
 function isCredentialIdentifier(name2) {
   if (!name2)
@@ -43982,7 +43982,7 @@ function priorHashOf(varName, priorCalls) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/weak-password-hash-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-password-hash-pass.js
 var FAST_HASH_NAMES = new Set([
   "sha224",
   "sha-224",
@@ -44141,7 +44141,7 @@ class WeakPasswordHashPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/weak-password-encoding-pass.js
+// node_modules/circle-ir/dist/analysis/passes/weak-password-encoding-pass.js
 function isBasicAuthContext(call, code) {
   const line = call.location.line;
   if (line < 1)
@@ -44253,7 +44253,7 @@ class WeakPasswordEncodingPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/info-disclosure-stacktrace-pass.js
+// node_modules/circle-ir/dist/analysis/passes/info-disclosure-stacktrace-pass.js
 var RESPONSE_RECEIVER_RE = /^(res|response|w|writer|ctx|c)$/i;
 var LOGGER_RECEIVER_RE = /^(log|logger|slog|console|pino|winston|sentry)$/i;
 var RESPONSE_SEND_METHODS = new Set([
@@ -44439,7 +44439,7 @@ class InfoDisclosureStacktracePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
+// node_modules/circle-ir/dist/analysis/passes/unrestricted-file-upload-pass.js
 var UPLOAD_NAME_RE = /(?:getOriginalFilename|getSubmittedFileName|originalname|originalName|\.filename|\.Filename|FileHeader\.Filename|UploadFile)/;
 var FILE_SAFE_CALL_RE = /(?:secure_filename|FilenameUtils\.getExtension|\.lastIndexOf\(['"]\.['"]\)|ALLOWED_EXT|ALLOWED_EXTENSIONS|allowedExtensions|\bfileFilter\b|filepath\.Ext|path\.extname)/;
 function lineWindow(lines, startLine, endLine) {
@@ -44590,7 +44590,7 @@ class UnrestrictedFileUploadPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
+// node_modules/circle-ir/dist/analysis/passes/missing-sanitizer-gate-pass.js
 var HTML_OUTPUT_SINKS = new Set([
   "addAttribute",
   "setAttribute",
@@ -44738,7 +44738,7 @@ function methodAcceptsHtmlShapedParam(method) {
   return false;
 }
 
-// ../circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
+// node_modules/circle-ir/dist/analysis/passes/insecure-deserialization-config-pass.js
 var ANY_TYPE_PERMISSION_RE = /\bAnyTypePermission\b/;
 
 class InsecureDeserializationConfigPass {
@@ -44816,7 +44816,7 @@ class InsecureDeserializationConfigPass {
 }
 var INSECURE_TYPE_NAME_HANDLING_RE = /\bTypeNameHandling\s*=\s*(?:Newtonsoft\.Json\.)?TypeNameHandling\.(All|Auto|Objects|Arrays)\b/;
 
-// ../circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
+// node_modules/circle-ir/dist/analysis/passes/plaintext-password-storage-pass.js
 function isWriteStorageCall(call, language) {
   const method = call.method_name ?? "";
   const receiver = call.receiver ?? "";
@@ -44927,7 +44927,7 @@ class PlaintextPasswordStoragePass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cleartext-credential-transport-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cleartext-credential-transport-pass.js
 var LOCALHOST_RE = /^(?:localhost|127\.0\.0\.1|0\.0\.0\.0)(?::\d+)?$/i;
 function isInsecureHttpUrl(urlLiteral) {
   if (!urlLiteral)
@@ -45055,7 +45055,7 @@ class CleartextCredentialTransportPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/tls-verify-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/tls-verify-disabled-pass.js
 var PY_HTTP_METHODS = new Set([
   "get",
   "post",
@@ -45268,7 +45268,7 @@ class TlsVerifyDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/module-side-effect-pass.js
+// node_modules/circle-ir/dist/analysis/passes/module-side-effect-pass.js
 var JS_EXEC_METHODS = new Set([
   "exec",
   "spawn",
@@ -45499,7 +45499,7 @@ class ModuleSideEffectPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/cache-no-vary-pass.js
+// node_modules/circle-ir/dist/analysis/passes/cache-no-vary-pass.js
 function isSharedCacheable(value) {
   const v = value.toLowerCase();
   if (/\b(private|no-store|no-cache)\b/.test(v))
@@ -45786,7 +45786,7 @@ class CacheNoVaryPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/jwt-verify-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/jwt-verify-disabled-pass.js
 var PY_VERIFY_SIGNATURE_FALSE_RE = /["']verify_signature["']\s*:\s*False\b/;
 var PY_VERIFY_KW_FALSE_RE = /\bverify\s*=\s*False\b/;
 var PY_ALG_NONE_RE = /\balgorithms\s*=\s*[\[\(]\s*["']none["']/i;
@@ -45911,7 +45911,7 @@ class JwtVerifyDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/csrf-protection-disabled-pass.js
+// node_modules/circle-ir/dist/analysis/passes/csrf-protection-disabled-pass.js
 var JAVA_CSRF_DISABLE_RE = /\.csrf\s*\([^)]*\)\s*\.\s*disable\b/;
 var JAVA_CSRF_LAMBDA_DISABLE_RE = /\bcsrf\s*\(\s*\w+\s*->\s*\w+\s*\.\s*disable\s*\(/;
 var JAVA_CSRF_METHODREF_RE = /\bcsrf\s*\(\s*[\w.]+::disable\s*\)/;
@@ -46047,7 +46047,7 @@ class CsrfProtectionDisabledPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/xml-entity-expansion-pass.js
+// node_modules/circle-ir/dist/analysis/passes/xml-entity-expansion-pass.js
 var JAVA_FACTORIES = new Set([
   "SAXParserFactory",
   "DocumentBuilderFactory",
@@ -46187,7 +46187,7 @@ class XmlEntityExpansionPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/mass-assignment-pass.js
+// node_modules/circle-ir/dist/analysis/passes/mass-assignment-pass.js
 var PY_KWARGS_SPLAT_RE = /\*\*\s*(?:request|self\.request|flask\.request|ctx|self)\s*\.\s*(?:form|args|values|json|get_json\s*\(\s*\)|files|data)/;
 var JS_OBJECT_SPREAD_RE = /\{\s*\.\.\.\s*(?:req|request|ctx|context)(?:\.request)?\s*\.\s*(?:body|query|params|form)\b/;
 
@@ -46271,7 +46271,7 @@ class MassAssignmentPass {
   }
 }
 
-// ../circle-ir/dist/graph/import-graph.js
+// node_modules/circle-ir/dist/graph/import-graph.js
 function dirname(filePath) {
   const idx = filePath.lastIndexOf("/");
   return idx >= 0 ? filePath.slice(0, idx) : "";
@@ -46404,7 +46404,7 @@ class ImportGraph2 {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/circular-dependency-pass.js
+// node_modules/circle-ir/dist/analysis/passes/circular-dependency-pass.js
 class CircularDependencyPass {
   run(_projectGraph, importGraph) {
     const findings = [];
@@ -46431,7 +46431,7 @@ class CircularDependencyPass {
   }
 }
 
-// ../circle-ir/dist/analysis/passes/orphan-module-pass.js
+// node_modules/circle-ir/dist/analysis/passes/orphan-module-pass.js
 class OrphanModulePass {
   run(_projectGraph, importGraph) {
     const findings = [];
@@ -46455,7 +46455,7 @@ class OrphanModulePass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/size-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/size-metrics-pass.js
 class SizeMetricsPass {
   name = "size-metrics";
   run(ctx) {
@@ -46511,7 +46511,7 @@ class SizeMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/complexity-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/complexity-metrics-pass.js
 class ComplexityMetricsPass {
   name = "complexity-metrics";
   run(ctx) {
@@ -46575,7 +46575,7 @@ class ComplexityMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/halstead-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/halstead-metrics-pass.js
 var KEYWORDS = new Set([
   "if",
   "else",
@@ -46730,7 +46730,7 @@ class HalsteadMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/data-flow-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/data-flow-metrics-pass.js
 class DataFlowMetricsPass {
   name = "data-flow-metrics";
   run(ctx) {
@@ -46748,7 +46748,7 @@ class DataFlowMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/coupling-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/coupling-metrics-pass.js
 class CouplingMetricsPass {
   name = "coupling-metrics";
   run(ctx) {
@@ -46826,7 +46826,7 @@ class CouplingMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/inheritance-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/inheritance-metrics-pass.js
 class InheritanceMetricsPass {
   name = "inheritance-metrics";
   run(ctx) {
@@ -46886,7 +46886,7 @@ class InheritanceMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/cohesion-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/cohesion-metrics-pass.js
 class CohesionMetricsPass {
   name = "cohesion-metrics";
   run(ctx) {
@@ -46969,7 +46969,7 @@ class CohesionMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/documentation-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/documentation-metrics-pass.js
 class DocumentationMetricsPass {
   name = "documentation-metrics";
   run(ctx) {
@@ -47022,7 +47022,7 @@ class DocumentationMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/passes/composite-metrics-pass.js
+// node_modules/circle-ir/dist/analysis/metrics/passes/composite-metrics-pass.js
 class CompositeMetricsPass {
   name = "composite-metrics";
   run(ctx) {
@@ -47081,7 +47081,7 @@ class CompositeMetricsPass {
   }
 }
 
-// ../circle-ir/dist/analysis/metrics/metric-runner.js
+// node_modules/circle-ir/dist/analysis/metrics/metric-runner.js
 class MetricRunner {
   passes = [
     new SizeMetricsPass,
@@ -47103,7 +47103,7 @@ class MetricRunner {
     return accumulated;
   }
 }
-// ../circle-ir/dist/analyzer.js
+// node_modules/circle-ir/dist/analyzer.js
 var initialized = false;
 async function initAnalyzer(options = {}) {
   if (initialized)
@@ -47775,7 +47775,7 @@ function deriveProjectRoot(paths) {
   }
   return common.join("/") || "/";
 }
-// ../circle-ir/dist/analysis/sbom.js
+// node_modules/circle-ir/dist/analysis/sbom.js
 function purlVersion(spec) {
   const stripped = spec.trim().replace(/^[\s^~=<>]+/, "");
   if (/^v?[0-9][\w.\-+]*$/.test(stripped))
@@ -48821,7 +48821,7 @@ var colors = {
 };
 
 // src/version.ts
-var version = "4.9.9";
+var version = "4.9.10";
 
 // src/formatters.ts
 var LIBRARY_API_SURFACE_TAG2 = "library-api-surface:caller-responsibility";
@@ -49374,8 +49374,8 @@ function generateSarifResults(results, crossFileData) {
 
 // src/build-info.ts
 var buildInfo = {
-  gitSha: "5c476ca",
-  builtAt: "2026-08-26T20:08:56.375Z"
+  gitSha: "132eaf6",
+  builtAt: "2026-09-02T06:21:26.855Z"
 };
 
 // src/utils/args.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognium-dev",
-  "version": "4.9.9",
+  "version": "4.9.10",
   "description": "Static Application Security Testing CLI for detecting security vulnerabilities via taint tracking",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -14,7 +14,7 @@
     "test": "bun test",
     "clean": "rm -rf dist cognium-dev cognium-dev-* *.bun-build wasm",
     "typecheck": "tsc --noEmit",
-    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually \u2014 use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
+    "version": "node -e \"const v = require('./package.json').version; require('fs').writeFileSync('src/version.ts', '/**\\n * Version information\\n *\\n * Kept in sync with package.json via the \\`version\\` npm lifecycle script.\\n * Do not edit manually — use \\`npm version patch|minor|major\\` instead.\\n */\\nexport const version = \\x27' + v + '\\x27;\\n')\" && git add src/version.ts",
     "dogfood": "bun run src/cli.ts scan src/ -q",
     "prepublishOnly": "bun run build"
   },
@@ -66,7 +66,7 @@
   },
   "dependencies": {
     "@cognium/project-profile-detect": "1.1.0",
-    "circle-ir": "4.9.9"
+    "circle-ir": "4.9.10"
   },
   "devDependencies": {
     "@types/node": "^25.5.0",