guardlink 1.0.0

package/dist/parser/parse-line.js

@@ -0,0 +1,230 @@
+/**
+ * GuardLink — Line-level annotation parser.
+ * Parses a single comment line into a typed Annotation.
+ *
+ * @exposes #parser to #redos [medium] cwe:CWE-1333 -- "Complex regex patterns run against untrusted annotation content"
+ * @mitigates #parser against #redos using #regex-anchoring -- "All patterns use ^ anchor and defined character classes"
+ * @comment -- "PATTERNS object contains all annotation regex; patterns are pre-compiled for performance"
+ */
+import { normalizeName, resolveSeverity, unescapeDescription } from './normalize.js';
+// ─── Shared regex fragments ──────────────────────────────────────────
+const COMPONENT = String.raw `[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*`;
+const ASSET_REF = String.raw `(?:#[a-zA-Z0-9_-]+|[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*)`; // #id or Dotted.Path
+const NAME = String.raw `[A-Za-z]\w*(?:[_\- ][A-Za-z]\w*)*`;
+const ID_DEF = String.raw `\(#([a-zA-Z0-9_-]+)\)`;
+const ID_REF = String.raw `#([a-zA-Z0-9_-]+)`;
+const THREAT_REF = String.raw `(?:#[a-zA-Z0-9_-]+|[A-Za-z]\w*(?:[_\- ][A-Za-z]\w*)*)`;
+const SEVERITY = String.raw `\[(P[0-3]|critical|high|medium|low)\]`;
+const EXT_REF = String.raw `([a-zA-Z]+:[A-Za-z0-9_:.\-]+)`;
+const DESC = String.raw `--\s*"((?:[^"\\]|\\.)*)"`;
+// Capture external refs (0 or more, space-separated)
+const EXT_REFS_OPT = String.raw `((?:\s+[a-zA-Z]+:[A-Za-z0-9_:.\-]+)*)`;
+// ─── Verb-specific patterns ──────────────────────────────────────────
+const PATTERNS = {
+    // Definition — asset path must be dotted COMPONENT
+    asset: new RegExp(String.raw `^@asset\s+(${COMPONENT})(?:\s+${ID_DEF})?(?:\s+${DESC})?$`),
+    threat: new RegExp(String.raw `^@threat\s+(${NAME})(?:\s+${ID_DEF})?(?:\s+${SEVERITY})?${EXT_REFS_OPT}(?:\s+${DESC})?$`),
+    control: new RegExp(String.raw `^@control\s+(${NAME})(?:\s+${ID_DEF})?(?:\s+${DESC})?$`),
+    // Relationship — asset positions accept #id OR Dotted.Path via ASSET_REF
+    mitigates: new RegExp(String.raw `^@mitigates\s+(${ASSET_REF})\s+against\s+(${THREAT_REF})(?:\s+using\s+(${THREAT_REF}))?(?:\s+${DESC})?$`),
+    mitigates_v1: new RegExp(String.raw `^@mitigates\s+(${ASSET_REF})\s+against\s+(${THREAT_REF})(?:\s+with\s+(${THREAT_REF}))?(?:\s+${DESC})?$`),
+    exposes: new RegExp(String.raw `^@exposes\s+(${ASSET_REF})\s+to\s+(${THREAT_REF})(?:\s+${SEVERITY})?${EXT_REFS_OPT}(?:\s+${DESC})?$`),
+    accepts: new RegExp(String.raw `^@accepts\s+(${THREAT_REF})\s+on\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    accepts_v1: new RegExp(String.raw `^@accepts\s+(${THREAT_REF})\s+to\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    transfers: new RegExp(String.raw `^@transfers\s+(${THREAT_REF})\s+from\s+(${ASSET_REF})\s+to\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    flows: new RegExp(String.raw `^@flows\s+(${ASSET_REF})\s+->\s+(${ASSET_REF})(?:\s+via\s+(.+?))?(?:\s+${DESC})?$`),
+    boundary: new RegExp(String.raw `^@boundary\s+(?:between\s+)?(${ASSET_REF})\s+and\s+(${ASSET_REF})(?:\s+${ID_DEF})?(?:\s+${DESC})?$`),
+    boundary_pipe: new RegExp(String.raw `^@boundary\s+(${ASSET_REF})\s*\|\s*(${ASSET_REF})(?:\s+${ID_DEF})?(?:\s+${DESC})?$`),
+    connects_v1: new RegExp(String.raw `^@connects\s+(${ASSET_REF})\s+to\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    // Lifecycle — asset positions accept #id OR Dotted.Path
+    validates: new RegExp(String.raw `^@validates\s+(${THREAT_REF})\s+for\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    audit: new RegExp(String.raw `^@audit\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    review_v1: new RegExp(String.raw `^@review\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    owns: new RegExp(String.raw `^@owns\s+([a-zA-Z0-9_-]+)\s+for\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    handles: new RegExp(String.raw `^@handles\s+(pii|phi|financial|secrets|internal|public)\s+on\s+(${ASSET_REF})(?:\s+${DESC})?$`, 'i'),
+    assumes: new RegExp(String.raw `^@assumes\s+(${ASSET_REF})(?:\s+${DESC})?$`),
+    // Comment — developer note, description only
+    comment: new RegExp(String.raw `^@comment(?:\s+${DESC})?$`),
+    // Special
+    shield: new RegExp(String.raw `^@shield(?:\s+${DESC})?$`),
+    shield_begin: new RegExp(String.raw `^@shield:begin(?:\s+${DESC})?$`),
+    shield_end: /^@shield:end$/,
+};
+// ─── External ref extractor ──────────────────────────────────────────
+function extractExternalRefs(raw) {
+    if (!raw || !raw.trim())
+        return [];
+    return raw.trim().split(/\s+/).filter(r => /^[a-zA-Z]+:[A-Za-z0-9_:.\-]+$/.test(r));
+}
+// ─── Ref resolver: #id or Name → string ──────────────────────────────
+function resolveRef(ref) {
+    return ref.startsWith('#') ? ref : ref;
+}
+/**
+ * Parse a single annotation line (after comment prefix has been stripped).
+ * Returns the typed annotation, a diagnostic if parsing failed, or null if
+ * the line is not an annotation.
+ */
+export function parseLine(text, location) {
+    const trimmed = text.trim();
+    // Not an annotation
+    if (!trimmed.startsWith('@')) {
+        // Check for continuation line (-- "...")
+        const contMatch = trimmed.match(new RegExp(String.raw `^${DESC}$`));
+        if (contMatch) {
+            return { annotation: null, diagnostic: null, isContinuation: true };
+        }
+        return { annotation: null, diagnostic: null, isContinuation: false };
+    }
+    const base = { location, raw: trimmed };
+    let m;
+    // ── @asset ──
+    if ((m = trimmed.match(PATTERNS.asset))) {
+        return ok({ ...base, verb: 'asset', path: m[1], id: m[2], description: desc(m[3]) });
+    }
+    // ── @threat ──
+    if ((m = trimmed.match(PATTERNS.threat))) {
+        const name = m[1];
+        return ok({
+            ...base, verb: 'threat', name, canonical_name: normalizeName(name),
+            id: m[2], severity: m[3] ? resolveSeverity(m[3]) : undefined,
+            external_refs: extractExternalRefs(m[4]), description: desc(m[5]),
+        });
+    }
+    // ── @control ──
+    if ((m = trimmed.match(PATTERNS.control))) {
+        const name = m[1];
+        return ok({
+            ...base, verb: 'control', name, canonical_name: normalizeName(name),
+            id: m[2], description: desc(m[3]),
+        });
+    }
+    // ── @mitigates ──
+    if ((m = trimmed.match(PATTERNS.mitigates)) || (m = trimmed.match(PATTERNS.mitigates_v1))) {
+        return ok({
+            ...base, verb: 'mitigates', asset: m[1],
+            threat: resolveRef(m[2]), control: m[3] ? resolveRef(m[3]) : undefined,
+            description: desc(m[4]),
+        });
+    }
+    // ── @exposes ──
+    if ((m = trimmed.match(PATTERNS.exposes))) {
+        return ok({
+            ...base, verb: 'exposes', asset: m[1], threat: resolveRef(m[2]),
+            severity: m[3] ? resolveSeverity(m[3]) : undefined,
+            external_refs: extractExternalRefs(m[4]), description: desc(m[5]),
+        });
+    }
+    // ── @accepts ──
+    if ((m = trimmed.match(PATTERNS.accepts)) || (m = trimmed.match(PATTERNS.accepts_v1))) {
+        return ok({ ...base, verb: 'accepts', threat: resolveRef(m[1]), asset: m[2], description: desc(m[3]) });
+    }
+    // ── @transfers ──
+    if ((m = trimmed.match(PATTERNS.transfers))) {
+        return ok({
+            ...base, verb: 'transfers', threat: resolveRef(m[1]),
+            source: m[2], target: m[3], description: desc(m[4]),
+        });
+    }
+    // ── @flows ──
+    if ((m = trimmed.match(PATTERNS.flows))) {
+        return ok({
+            ...base, verb: 'flows', source: m[1], target: m[2],
+            mechanism: m[3]?.trim(), description: desc(m[4]),
+        });
+    }
+    // ── @boundary ──
+    if ((m = trimmed.match(PATTERNS.boundary))) {
+        return ok({
+            ...base, verb: 'boundary', asset_a: m[1], asset_b: m[2],
+            id: m[3], description: desc(m[4]),
+        });
+    }
+    // ── @boundary pipe shorthand: @boundary A | B ──
+    if ((m = trimmed.match(PATTERNS.boundary_pipe))) {
+        return ok({
+            ...base, verb: 'boundary', asset_a: m[1], asset_b: m[2],
+            id: m[3], description: desc(m[4]),
+        });
+    }
+    // ── @connects (v1 → flows) ──
+    if ((m = trimmed.match(PATTERNS.connects_v1))) {
+        return ok({
+            ...base, verb: 'flows', source: m[1], target: m[2], description: desc(m[3]),
+        });
+    }
+    // ── @validates ──
+    if ((m = trimmed.match(PATTERNS.validates))) {
+        return ok({ ...base, verb: 'validates', control: resolveRef(m[1]), asset: m[2], description: desc(m[3]) });
+    }
+    // ── @audit / @review (v1) ──
+    if ((m = trimmed.match(PATTERNS.audit)) || (m = trimmed.match(PATTERNS.review_v1))) {
+        return ok({ ...base, verb: 'audit', asset: m[1], description: desc(m[2]) });
+    }
+    // ── @owns ──
+    if ((m = trimmed.match(PATTERNS.owns))) {
+        return ok({ ...base, verb: 'owns', owner: m[1], asset: m[2], description: desc(m[3]) });
+    }
+    // ── @handles ──
+    if ((m = trimmed.match(PATTERNS.handles))) {
+        return ok({
+            ...base, verb: 'handles',
+            classification: m[1].toLowerCase(),
+            asset: m[2], description: desc(m[3]),
+        });
+    }
+    // ── @assumes ──
+    if ((m = trimmed.match(PATTERNS.assumes))) {
+        return ok({ ...base, verb: 'assumes', asset: m[1], description: desc(m[2]) });
+    }
+    // ── @comment ──
+    if ((m = trimmed.match(PATTERNS.comment))) {
+        return ok({ ...base, verb: 'comment', description: desc(m[1]) });
+    }
+    // ── @shield ──
+    if ((m = trimmed.match(PATTERNS.shield_begin))) {
+        return ok({ ...base, verb: 'shield:begin', description: desc(m[1]) });
+    }
+    if (trimmed.match(PATTERNS.shield_end)) {
+        return ok({ ...base, verb: 'shield:end' });
+    }
+    if ((m = trimmed.match(PATTERNS.shield))) {
+        return ok({ ...base, verb: 'shield', description: desc(m[1]) });
+    }
+    // Starts with @ but didn't match — likely a malformed annotation
+    const verbMatch = trimmed.match(/^@(\S+)/);
+    if (verbMatch) {
+        const knownVerbs = new Set([
+            'asset', 'threat', 'control', 'mitigates', 'exposes', 'accepts',
+            'transfers', 'flows', 'boundary', 'validates', 'audit', 'owns',
+            'handles', 'assumes', 'comment', 'shield', 'shield:begin', 'shield:end',
+            // v1 compat
+            'review', 'connects',
+        ]);
+        if (knownVerbs.has(verbMatch[1])) {
+            return {
+                annotation: null,
+                diagnostic: {
+                    level: 'error',
+                    message: `Malformed @${verbMatch[1]} annotation: could not parse arguments`,
+                    file: location.file,
+                    line: location.line,
+                    raw: trimmed,
+                },
+                isContinuation: false,
+            };
+        }
+    }
+    // Not a GuardLink annotation (could be @param, @returns, etc.)
+    return { annotation: null, diagnostic: null, isContinuation: false };
+}
+// ─── Helpers ─────────────────────────────────────────────────────────
+function ok(annotation) {
+    return { annotation, diagnostic: null, isContinuation: false };
+}
+function desc(raw) {
+    if (!raw)
+        return undefined;
+    return unescapeDescription(raw);
+}
+//# sourceMappingURL=parse-line.js.map

package/dist/parser/parse-line.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-line.js","sourceRoot":"","sources":["../../src/parser/parse-line.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErF,wEAAwE;AAExE,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAA,iCAAiC,CAAC;AAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAA,qDAAqD,CAAC,CAAE,qBAAqB;AACzG,MAAM,IAAI,GAAQ,MAAM,CAAC,GAAG,CAAA,mCAAmC,CAAC;AAChE,MAAM,MAAM,GAAM,MAAM,CAAC,GAAG,CAAA,uBAAuB,CAAC;AACpD,MAAM,MAAM,GAAM,MAAM,CAAC,GAAG,CAAA,mBAAmB,CAAC;AAChD,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAA,uDAAuD,CAAC;AACrF,MAAM,QAAQ,GAAI,MAAM,CAAC,GAAG,CAAA,uCAAuC,CAAC;AACpE,MAAM,OAAO,GAAK,MAAM,CAAC,GAAG,CAAA,+BAA+B,CAAC;AAC5D,MAAM,IAAI,GAAQ,MAAM,CAAC,GAAG,CAAA,0BAA0B,CAAC;AAEvD,qDAAqD;AACrD,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAA,uCAAuC,CAAC;AAEvE,wEAAwE;AAExE,MAAM,QAAQ,GAA2B;IACvC,mDAAmD;IACnD,KAAK,EAAI,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,cAAc,SAAS,UAAU,MAAM,WAAW,IAAI,KAAK,CAAC;IAC1F,MAAM,EAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,eAAe,IAAI,UAAU,MAAM,WAAW,QAAQ,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC;IACxH,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gBAAgB,IAAI,UAAU,MAAM,WAAW,IAAI,KAAK,CAAC;IAEvF,yEAAyE;IACzE,SAAS,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,kBAAkB,SAAS,kBAAkB,UAAU,mBAAmB,UAAU,YAAY,IAAI,KAAK,CAAC;IAC1I,YAAY,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,kBAAkB,SAAS,kBAAkB,UAAU,kBAAkB,UAAU,YAAY,IAAI,KAAK,CAAC;IAC5I,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gBAAgB,SAAS,aAAa,UAAU,UAAU,QAAQ,KAAK,YAAY,SAAS,IAAI,KAAK,CAAC;IACpI,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gBAAgB,UAAU,aAAa,SAAS,UAAU,IAAI,KAAK,CAAC;IAClG,UAAU,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gBAAgB,UAAU,aAAa,SAAS,UAAU,IAAI,KAAK,CAAC;IACrG,SAAS,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,kBAAkB,UAAU,eAAe,SAAS,aAAa,SAAS,UAAU,IAAI,KAAK,CAAC;IAC9H,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,cAAc,SAAS,aAAa,SAAS,6BAA6B,IAAI,KAAK,CAAC;IAChH,QAAQ,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gCAAgC,SAAS,cAAc,SAAS,UAAU,MAAM,WAAW,IAAI,KAAK,CAAC;IACpI,aAAa,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iBAAiB,SAAS,aAAa,SAAS,UAAU,MAAM,WAAW,IAAI,KAAK,CAAC;IACzH,WAAW,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iBAAiB,SAAS,aAAa,SAAS,UAAU,IAAI,KAAK,CAAC;IAEtG,wDAAwD;IACxD,SAAS,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,kBAAkB,UAAU,cAAc,SAAS,UAAU,IAAI,KAAK,CAAC;IACvG,KAAK,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,cAAc,SAAS,UAAU,IAAI,KAAK,CAAC;IACvE,SAAS,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,eAAe,SAAS,UAAU,IAAI,KAAK,CAAC;IAC5E,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,sCAAsC,SAAS,UAAU,IAAI,KAAK,CAAC;IAC9F,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mEAAmE,SAAS,UAAU,IAAI,KAAK,EAAE,GAAG,CAAC;IACnI,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,gBAAgB,SAAS,UAAU,IAAI,KAAK,CAAC;IAE3E,6CAA6C;IAC7C,OAAO,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,kBAAkB,IAAI,KAAK,CAAC;IAE1D,UAAU;IACV,MAAM,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iBAAiB,IAAI,KAAK,CAAC;IACxD,YAAY,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,uBAAuB,IAAI,KAAK,CAAC;IACpE,UAAU,EAAE,eAAe;CAC5B,CAAC;AAEF,wEAAwE;AAExE,SAAS,mBAAmB,CAAC,GAAuB;IAClD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IACnC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,wEAAwE;AAExE,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACzC,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,QAAwB;IAExB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAE5B,oBAAoB;IACpB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,yCAAyC;QACzC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;QACnE,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IACxC,IAAI,CAA0B,CAAC;IAE/B,eAAe;IACf,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC;YAClE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5D,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,aAAa,CAAC,IAAI,CAAC;YACnE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YACtE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxB,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YAClD,aAAa,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1G,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpD,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,CAAC,CAAC;IACL,CAAC;IAED,eAAe;IACf,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;YAClD,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,kBAAkB;IAClB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvD,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC5E,CAAC,CAAC;IACL,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,8BAA8B;IAC9B,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,cAAc;IACd,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;YACR,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS;YACxB,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAwB;YACxD,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACrC,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,iBAAiB;IACjB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,iEAAiE;IACjE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,UAAU,GAAgB,IAAI,GAAG,CAAC;YACtC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS;YAC/D,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM;YAC9D,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY;YACvE,YAAY;YACZ,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;QACH,IAAI,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE;oBACV,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,cAAc,SAAS,CAAC,CAAC,CAAC,wCAAwC;oBAC3E,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,GAAG,EAAE,OAAO;iBACb;gBACD,cAAc,EAAE,KAAK;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,wEAAwE;AAExE,SAAS,EAAE,CAAC,UAAsB;IAChC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,IAAI,CAAC,GAAuB;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC"}

package/dist/parser/parse-project.d.ts

@@ -0,0 +1,31 @@
+/**
+ * GuardLink — Project-level parser.
+ * Walks a directory, parses all source files, and assembles a ThreatModel.
+ *
+ * @exposes #parser to #path-traversal [high] cwe:CWE-22 -- "Accepts user-provided root directory for file scanning"
+ * @exposes #parser to #dos [medium] cwe:CWE-400 -- "Iterates all files in directory tree, may exhaust memory on large repos"
+ * @mitigates #parser against #path-traversal using #glob-filtering -- "fast-glob with explicit exclude patterns prevents access outside project"
+ * @mitigates #parser against #dos using #glob-filtering -- "Default excludes (node_modules, dist, .git) limit scope"
+ * @flows #cli -> #parser via parseProject -- "CLI passes user-specified root directory to parser"
+ * @flows #mcp -> #parser via parseProject -- "MCP server passes root param from AI agents"
+ * @handles internal on #parser -- "Processes source files to extract security annotation metadata"
+ */
+import type { ThreatModel, ParseDiagnostic } from '../types/index.js';
+export interface ParseProjectOptions {
+    /** Root directory to scan */
+    root: string;
+    /** Glob patterns to include (default: common source files) */
+    include?: string[];
+    /** Glob patterns to exclude (default: node_modules, dist, .git) */
+    exclude?: string[];
+    /** Project name for the ThreatModel */
+    project?: string;
+}
+/**
+ * Parse an entire project directory and return a ThreatModel.
+ */
+export declare function parseProject(options: ParseProjectOptions): Promise<{
+    model: ThreatModel;
+    diagnostics: ParseDiagnostic[];
+}>;
+//# sourceMappingURL=parse-project.d.ts.map

package/dist/parser/parse-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-project.d.ts","sourceRoot":"","sources":["../../src/parser/parse-project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,KAAK,EACE,WAAW,EAAe,eAAe,EAQtD,MAAM,mBAAmB,CAAC;AAG3B,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAuBD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC;IACxE,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,eAAe,EAAE,CAAC;CAChC,CAAC,CAwDD"}

package/dist/parser/parse-project.js

@@ -0,0 +1,281 @@
+/**
+ * GuardLink — Project-level parser.
+ * Walks a directory, parses all source files, and assembles a ThreatModel.
+ *
+ * @exposes #parser to #path-traversal [high] cwe:CWE-22 -- "Accepts user-provided root directory for file scanning"
+ * @exposes #parser to #dos [medium] cwe:CWE-400 -- "Iterates all files in directory tree, may exhaust memory on large repos"
+ * @mitigates #parser against #path-traversal using #glob-filtering -- "fast-glob with explicit exclude patterns prevents access outside project"
+ * @mitigates #parser against #dos using #glob-filtering -- "Default excludes (node_modules, dist, .git) limit scope"
+ * @flows #cli -> #parser via parseProject -- "CLI passes user-specified root directory to parser"
+ * @flows #mcp -> #parser via parseProject -- "MCP server passes root param from AI agents"
+ * @handles internal on #parser -- "Processes source files to extract security annotation metadata"
+ */
+import fg from 'fast-glob';
+import { relative } from 'node:path';
+import { parseFile } from './parse-file.js';
+const DEFAULT_INCLUDE = [
+    '**/*.ts', '**/*.tsx', '**/*.js', '**/*.jsx',
+    '**/*.py', '**/*.rb', '**/*.go', '**/*.rs',
+    '**/*.java', '**/*.kt', '**/*.scala',
+    '**/*.c', '**/*.cpp', '**/*.cc', '**/*.h', '**/*.hpp',
+    '**/*.cs', '**/*.swift', '**/*.dart',
+    '**/*.sql', '**/*.lua', '**/*.hs',
+    '**/*.tf', '**/*.hcl',
+    '**/*.yaml', '**/*.yml',
+    '**/*.sh', '**/*.bash',
+    '**/*.html', '**/*.xml', '**/*.svg',
+    '**/*.css',
+    '**/*.ex', '**/*.exs',
+];
+const DEFAULT_EXCLUDE = [
+    '**/node_modules/**', '**/dist/**', '**/build/**', '**/.git/**',
+    '**/__pycache__/**', '**/target/**', '**/vendor/**', '**/.next/**',
+    '**/tests/**', '**/test/**', '**/__tests__/**',
+];
+/**
+ * Parse an entire project directory and return a ThreatModel.
+ */
+export async function parseProject(options) {
+    const { root, include = DEFAULT_INCLUDE, exclude = DEFAULT_EXCLUDE, project = 'unknown', } = options;
+    // Discover files (dot: true to include .guardlink/ definitions)
+    const files = await fg(include, {
+        cwd: root,
+        ignore: exclude,
+        absolute: true,
+        dot: true,
+    });
+    // Parse all files
+    const allAnnotations = [];
+    const allDiagnostics = [];
+    for (const file of files) {
+        const result = await parseFile(file);
+        // Normalize file paths to relative
+        for (const ann of result.annotations) {
+            ann.location.file = relative(root, ann.location.file);
+        }
+        for (const diag of result.diagnostics) {
+            diag.file = relative(root, diag.file);
+        }
+        allAnnotations.push(...result.annotations);
+        allDiagnostics.push(...result.diagnostics);
+    }
+    // Check for duplicate identifiers
+    const idMap = new Map();
+    for (const ann of allAnnotations) {
+        const id = getAnnotationId(ann);
+        if (id) {
+            if (idMap.has(id)) {
+                const prev = idMap.get(id);
+                allDiagnostics.push({
+                    level: 'error',
+                    message: `Duplicate identifier #${id} (first defined at ${prev.location.file}:${prev.location.line})`,
+                    file: ann.location.file,
+                    line: ann.location.line,
+                });
+            }
+            else {
+                idMap.set(id, ann);
+            }
+        }
+    }
+    // Assemble ThreatModel
+    const model = assembleModel(allAnnotations, files.length, project);
+    return { model, diagnostics: allDiagnostics };
+}
+function getAnnotationId(ann) {
+    if ('id' in ann)
+        return ann.id;
+    return undefined;
+}
+function assembleModel(annotations, fileCount, project) {
+    const model = {
+        version: '1.0.0',
+        project,
+        generated_at: new Date().toISOString(),
+        source_files: fileCount,
+        annotations_parsed: annotations.length,
+        assets: [],
+        threats: [],
+        controls: [],
+        mitigations: [],
+        exposures: [],
+        acceptances: [],
+        transfers: [],
+        flows: [],
+        boundaries: [],
+        validations: [],
+        audits: [],
+        ownership: [],
+        data_handling: [],
+        assumptions: [],
+        shields: [],
+        comments: [],
+        coverage: {
+            total_symbols: 0,
+            annotated_symbols: annotations.length,
+            coverage_percent: 0,
+            unannotated_critical: [],
+        },
+    };
+    for (const ann of annotations) {
+        switch (ann.verb) {
+            case 'asset': {
+                const a = ann;
+                model.assets.push({
+                    path: a.path.split('.'),
+                    id: a.id,
+                    description: a.description,
+                    location: a.location,
+                });
+                break;
+            }
+            case 'threat': {
+                const t = ann;
+                model.threats.push({
+                    name: t.name,
+                    canonical_name: t.canonical_name,
+                    id: t.id,
+                    severity: t.severity,
+                    external_refs: t.external_refs,
+                    description: t.description,
+                    location: t.location,
+                });
+                break;
+            }
+            case 'control': {
+                const c = ann;
+                model.controls.push({
+                    name: c.name,
+                    canonical_name: c.canonical_name,
+                    id: c.id,
+                    description: c.description,
+                    location: c.location,
+                });
+                break;
+            }
+            case 'mitigates': {
+                const m = ann;
+                model.mitigations.push({
+                    asset: m.asset, threat: m.threat, control: m.control,
+                    description: m.description, location: m.location,
+                });
+                break;
+            }
+            case 'exposes': {
+                const e = ann;
+                model.exposures.push({
+                    asset: e.asset, threat: e.threat, severity: e.severity,
+                    external_refs: e.external_refs,
+                    description: e.description, location: e.location,
+                });
+                break;
+            }
+            case 'accepts': {
+                const a = ann;
+                model.acceptances.push({
+                    threat: a.threat, asset: a.asset,
+                    description: a.description, location: a.location,
+                });
+                break;
+            }
+            case 'transfers': {
+                const t = ann;
+                model.transfers.push({
+                    threat: t.threat, source: t.source, target: t.target,
+                    description: t.description, location: t.location,
+                });
+                break;
+            }
+            case 'flows': {
+                const f = ann;
+                model.flows.push({
+                    source: f.source, target: f.target, mechanism: f.mechanism,
+                    description: f.description, location: f.location,
+                });
+                break;
+            }
+            case 'boundary': {
+                const b = ann;
+                model.boundaries.push({
+                    asset_a: b.asset_a, asset_b: b.asset_b, id: b.id,
+                    description: b.description, location: b.location,
+                });
+                break;
+            }
+            case 'validates': {
+                const v = ann;
+                model.validations.push({
+                    control: v.control, asset: v.asset,
+                    description: v.description, location: v.location,
+                });
+                break;
+            }
+            case 'audit': {
+                const a = ann;
+                model.audits.push({
+                    asset: a.asset,
+                    description: a.description, location: a.location,
+                });
+                break;
+            }
+            case 'owns': {
+                const o = ann;
+                model.ownership.push({
+                    owner: o.owner, asset: o.asset,
+                    description: o.description, location: o.location,
+                });
+                break;
+            }
+            case 'handles': {
+                const h = ann;
+                model.data_handling.push({
+                    classification: h.classification,
+                    asset: h.asset,
+                    description: h.description, location: h.location,
+                });
+                break;
+            }
+            case 'assumes': {
+                const a = ann;
+                model.assumptions.push({
+                    asset: a.asset,
+                    description: a.description, location: a.location,
+                });
+                break;
+            }
+            case 'comment': {
+                const c = ann;
+                model.comments.push({
+                    description: c.description, location: c.location,
+                });
+                break;
+            }
+            case 'shield':
+            case 'shield:begin':
+            case 'shield:end': {
+                const s = ann;
+                model.shields.push({
+                    reason: s.description,
+                    location: s.location,
+                });
+                break;
+            }
+        }
+    }
+    // Second pass: resolve exposure severity from threat definitions
+    // when the @exposes annotation has no inline severity
+    const threatSeverityMap = new Map();
+    for (const t of model.threats) {
+        if (t.id && t.severity)
+            threatSeverityMap.set(`#${t.id}`, t.severity);
+        if (t.id && t.severity)
+            threatSeverityMap.set(t.id, t.severity);
+    }
+    for (const e of model.exposures) {
+        if (!e.severity) {
+            e.severity = threatSeverityMap.get(e.threat);
+        }
+    }
+    return model;
+}
+//# sourceMappingURL=parse-project.js.map

package/dist/parser/parse-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse-project.js","sourceRoot":"","sources":["../../src/parser/parse-project.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3B,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAWrC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAa5C,MAAM,eAAe,GAAG;IACtB,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU;IAC5C,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;IAC1C,WAAW,EAAE,SAAS,EAAE,YAAY;IACpC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU;IACrD,SAAS,EAAE,YAAY,EAAE,WAAW;IACpC,UAAU,EAAE,UAAU,EAAE,SAAS;IACjC,SAAS,EAAE,UAAU;IACrB,WAAW,EAAE,UAAU;IACvB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,UAAU,EAAE,UAAU;IACnC,UAAU;IACV,SAAS,EAAE,UAAU;CACtB,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,oBAAoB,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY;IAC/D,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa;IAClE,aAAa,EAAE,YAAY,EAAE,iBAAiB;CAC/C,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAI7D,MAAM,EACJ,IAAI,EACJ,OAAO,GAAG,eAAe,EACzB,OAAO,GAAG,eAAe,EACzB,OAAO,GAAG,SAAS,GACpB,GAAG,OAAO,CAAC;IAEZ,gEAAgE;IAChE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,EAAE;QAC9B,GAAG,EAAE,IAAI;QACT,MAAM,EAAE,OAAO;QACf,QAAQ,EAAE,IAAI;QACd,GAAG,EAAE,IAAI;KACV,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,cAAc,GAAiB,EAAE,CAAC;IACxC,MAAM,cAAc,GAAsB,EAAE,CAAC;IAE7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,mCAAmC;QACnC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;QAC3C,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7C,CAAC;IAED,kCAAkC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC;gBAC5B,cAAc,CAAC,IAAI,CAAC;oBAClB,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG;oBACrG,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;oBACvB,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;iBACxB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,MAAM,KAAK,GAAG,aAAa,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEnE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,GAAe;IACtC,IAAI,IAAI,IAAI,GAAG;QAAE,OAAQ,GAAW,CAAC,EAAE,CAAC;IACxC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,WAAyB,EAAE,SAAiB,EAAE,OAAe;IAClF,MAAM,KAAK,GAAgB;QACzB,OAAO,EAAE,OAAO;QAChB,OAAO;QACP,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtC,YAAY,EAAE,SAAS;QACvB,kBAAkB,EAAE,WAAW,CAAC,MAAM;QACtC,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,EAAE;QACZ,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,EAAE;QACb,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,EAAE;QACb,KAAK,EAAE,EAAE;QACT,UAAU,EAAE,EAAE;QACd,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,EAAE;QACV,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,EAAE;QACjB,WAAW,EAAE,EAAE;QACf,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE;YACR,aAAa,EAAE,CAAC;YAChB,iBAAiB,EAAE,WAAW,CAAC,MAAM;YACrC,gBAAgB,EAAE,CAAC;YACnB,oBAAoB,EAAE,EAAE;SACzB;KACF,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,GAAG,GAAsB,CAAC;gBACjC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;oBACvB,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACrB,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,CAAC,GAAG,GAAuB,CAAC;gBAClC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,cAAc,EAAE,CAAC,CAAC,cAAc;oBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACrB,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,GAAwB,CAAC;gBACnC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAClB,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,cAAc,EAAE,CAAC,CAAC,cAAc;oBAChC,EAAE,EAAE,CAAC,CAAC,EAAE;oBACR,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACrB,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,GAA0B,CAAC;gBACrC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;oBACpD,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,GAAwB,CAAC;gBACnC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACtD,aAAa,EAAE,CAAC,CAAC,aAAa;oBAC9B,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,GAAwB,CAAC;gBACnC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;oBACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;oBAChC,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,GAA0B,CAAC;gBACrC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;oBACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM;oBACpD,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,GAAG,GAAsB,CAAC;gBACjC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;oBACf,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;oBAC1D,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,CAAC,GAAG,GAAyB,CAAC;gBACpC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;oBACpB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE;oBAChD,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,GAA0B,CAAC;gBACrC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;oBACrB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;oBAClC,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,GAAG,GAAsB,CAAC;gBACjC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,MAAM,CAAC,CAAC,CAAC;gBACZ,MAAM,CAAC,GAAG,GAAqB,CAAC;gBAChC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK;oBAC9B,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,GAAwB,CAAC;gBACnC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC;oBACvB,cAAc,EAAE,CAAC,CAAC,cAAoC;oBACtD,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,GAAwB,CAAC;gBACnC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;oBACrB,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,GAAwB,CAAC;gBACnC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAClB,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACjD,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC;YACd,KAAK,cAAc,CAAC;YACpB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,CAAC,GAAG,GAAuB,CAAC;gBAClC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;oBACjB,MAAM,EAAE,CAAC,CAAC,WAAW;oBACrB,QAAQ,EAAE,CAAC,CAAC,QAAQ;iBACrB,CAAC,CAAC;gBACH,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ;YAAE,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ;YAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YAChB,CAAC,CAAC,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAQ,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/report/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * GuardLink Report — exports.
+ */
+export { generateMermaid } from './mermaid.js';
+export { generateReport } from './report.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/report/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/report/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/report/index.js

@@ -0,0 +1,6 @@
+/**
+ * GuardLink Report — exports.
+ */
+export { generateMermaid } from './mermaid.js';
+export { generateReport } from './report.js';
+//# sourceMappingURL=index.js.map

package/dist/report/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/report/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC"}

package/dist/report/mermaid.d.ts

@@ -0,0 +1,15 @@
+/**
+ * GuardLink Report — Mermaid diagram generator.
+ *
+ * Design principles:
+ * 1. DFD-style: Show data flows between assets, trust boundaries, and threats
+ * 2. Only connected nodes: Assets with no flows/exposures are omitted
+ * 3. Controls stay in tables: Don't add control nodes — they clutter the graph
+ * 4. Threat markers on edges: Show exposures as red dotted edges, not separate nodes
+ * 5. Distinct shapes: Actors (()), Processes [], Data stores [()]
+ * 6. Deduplicate: One node per asset, one label per data classification
+ * 7. Top-down layout: External → boundary → internal → data
+ */
+import type { ThreatModel } from '../types/index.js';
+export declare function generateMermaid(model: ThreatModel): string;
+//# sourceMappingURL=mermaid.d.ts.map

package/dist/report/mermaid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mermaid.d.ts","sourceRoot":"","sources":["../../src/report/mermaid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAuBrD,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAiM1D"}