sdlc-agent-4-enterprise-server 1.0.0

package/dist/engine/analyzers/graph-analysis/utils/TestFileDetector.d.ts

@@ -0,0 +1,11 @@
+/**
+ * KSA-163: Test file detection heuristics.
+ */
+export declare class TestFileDetector {
+    private testPatterns;
+    private testDirs;
+    /** Check if a file path is a test file. */
+    isTestFile(filePath: string): boolean;
+    /** Check if a symbol name looks like a test function. */
+    isTestFunction(symbolName: string): boolean;
+}

package/dist/engine/analyzers/graph-analysis/utils/TestFileDetector.js

@@ -0,0 +1,29 @@
+/**
+ * KSA-163: Test file detection heuristics.
+ */
+export class TestFileDetector {
+    testPatterns = [
+        /\.test\.[jt]sx?$/,
+        /\.spec\.[jt]sx?$/,
+        /_test\.(py|go|rs)$/,
+        /test_.*\.py$/,
+        /Test\.java$/,
+        /Test\.kt$/,
+    ];
+    testDirs = ['__tests__', 'tests', 'test', 'spec'];
+    /** Check if a file path is a test file. */
+    isTestFile(filePath) {
+        const normalized = filePath.replace(/\\/g, '/');
+        return (this.testPatterns.some(p => p.test(normalized)) ||
+            this.testDirs.some(d => normalized.includes(`/${d}/`)));
+    }
+    /** Check if a symbol name looks like a test function. */
+    isTestFunction(symbolName) {
+        return (symbolName.startsWith('test_') ||
+            symbolName.startsWith('Test') ||
+            symbolName.startsWith('it_') ||
+            symbolName.startsWith('should_') ||
+            /^(describe|it|test)\b/.test(symbolName));
+    }
+}
+//# sourceMappingURL=TestFileDetector.js.map

package/dist/engine/analyzers/graph-analysis/utils/TestFileDetector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TestFileDetector.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/graph-analysis/utils/TestFileDetector.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,OAAO,gBAAgB;IACnB,YAAY,GAAG;QACrB,kBAAkB;QAClB,kBAAkB;QAClB,oBAAoB;QACpB,cAAc;QACd,aAAa;QACb,WAAW;KACZ,CAAC;IACM,QAAQ,GAAG,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1D,2CAA2C;IAC3C,UAAU,CAAC,QAAgB;QACzB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChD,OAAO,CACL,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,cAAc,CAAC,UAAkB;QAC/B,OAAO,CACL,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;YAC9B,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC;YAC7B,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC5B,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAChC,uBAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CACzC,CAAC;IACJ,CAAC;CACF"}

package/dist/engine/analyzers/security/cfg/BasicBlock.d.ts

@@ -0,0 +1,19 @@
+/**
+ * KSA-164: Basic Block — Fundamental unit of a control flow graph.
+ */
+import type { SyntaxNode } from '../../../parsers/types.js';
+import type { BlockType, Statement, VariableDef, VariableUse } from '../types.js';
+export declare class BasicBlock {
+    readonly id: number;
+    readonly type: BlockType;
+    readonly statements: Statement[];
+    startLine: number;
+    endLine: number;
+    constructor(id: number, type: BlockType);
+    addStatement(node: SyntaxNode): void;
+    /** Extract variable definitions from this block's statements. */
+    getDefinitions(): VariableDef[];
+    /** Extract variable uses from this block's statements. */
+    getUses(): VariableUse[];
+    get isEmpty(): boolean;
+}

package/dist/engine/analyzers/security/cfg/BasicBlock.js

@@ -0,0 +1,115 @@
+/**
+ * KSA-164: Basic Block — Fundamental unit of a control flow graph.
+ */
+export class BasicBlock {
+    id;
+    type;
+    statements = [];
+    startLine = 0;
+    endLine = 0;
+    constructor(id, type) {
+        this.id = id;
+        this.type = type;
+    }
+    addStatement(node) {
+        const stmt = {
+            node,
+            line: node.startPosition.row + 1,
+            type: node.type,
+            text: node.text.slice(0, 120),
+        };
+        this.statements.push(stmt);
+        if (this.statements.length === 1)
+            this.startLine = stmt.line;
+        this.endLine = stmt.line;
+    }
+    /** Extract variable definitions from this block's statements. */
+    getDefinitions() {
+        const defs = [];
+        for (const stmt of this.statements) {
+            const extracted = extractDefinitions(stmt.node, this.id);
+            defs.push(...extracted);
+        }
+        return defs;
+    }
+    /** Extract variable uses from this block's statements. */
+    getUses() {
+        const uses = [];
+        for (const stmt of this.statements) {
+            const extracted = extractUses(stmt.node, this.id);
+            uses.push(...extracted);
+        }
+        return uses;
+    }
+    get isEmpty() {
+        return this.statements.length === 0;
+    }
+}
+/** Extract variable definitions from an AST node. */
+function extractDefinitions(node, blockId) {
+    const defs = [];
+    const type = node.type;
+    // Variable declarations: let x = ..., const y = ..., var z = ...
+    if (type === 'lexical_declaration' || type === 'variable_declaration') {
+        for (let i = 0; i < node.namedChildCount; i++) {
+            const declarator = node.namedChild(i);
+            if (declarator && declarator.type === 'variable_declarator') {
+                const nameNode = declarator.childForFieldName('name');
+                if (nameNode) {
+                    defs.push({ name: nameNode.text, line: nameNode.startPosition.row + 1, blockId, node: nameNode });
+                }
+            }
+        }
+    }
+    // Assignment expressions: x = ...
+    if (type === 'assignment_expression' || type === 'augmented_assignment_expression') {
+        const left = node.childForFieldName('left');
+        if (left && left.type === 'identifier') {
+            defs.push({ name: left.text, line: left.startPosition.row + 1, blockId, node: left });
+        }
+    }
+    // Expression statement wrapping assignment
+    if (type === 'expression_statement') {
+        const expr = node.namedChild(0);
+        if (expr) {
+            defs.push(...extractDefinitions(expr, blockId));
+        }
+    }
+    // Python: assignment
+    if (type === 'assignment') {
+        const left = node.childForFieldName('left');
+        if (left && left.type === 'identifier') {
+            defs.push({ name: left.text, line: left.startPosition.row + 1, blockId, node: left });
+        }
+    }
+    // For loop variable
+    if (type === 'for_statement' || type === 'for_in_statement') {
+        const init = node.childForFieldName('initializer') ?? node.childForFieldName('left');
+        if (init && init.type === 'identifier') {
+            defs.push({ name: init.text, line: init.startPosition.row + 1, blockId, node: init });
+        }
+    }
+    return defs;
+}
+/** Extract variable uses from an AST node (identifiers in read position). */
+function extractUses(node, blockId) {
+    const uses = [];
+    collectIdentifiers(node, uses, blockId, new Set());
+    return uses;
+}
+function collectIdentifiers(node, uses, blockId, seen) {
+    if (node.type === 'identifier') {
+        const key = `${node.text}:${node.startPosition.row}`;
+        if (!seen.has(key)) {
+            seen.add(key);
+            uses.push({ name: node.text, line: node.startPosition.row + 1, blockId, node });
+        }
+        return;
+    }
+    for (let i = 0; i < node.childCount; i++) {
+        const child = node.child(i);
+        if (child)
+            collectIdentifiers(child, uses, blockId, seen);
+    }
+}
+//# sourceMappingURL=BasicBlock.js.map

package/dist/engine/analyzers/security/cfg/BasicBlock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BasicBlock.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/cfg/BasicBlock.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,OAAO,UAAU;IACZ,EAAE,CAAS;IACX,IAAI,CAAY;IAChB,UAAU,GAAgB,EAAE,CAAC;IACtC,SAAS,GAAW,CAAC,CAAC;IACtB,OAAO,GAAW,CAAC,CAAC;IAEpB,YAAY,EAAU,EAAE,IAAe;QACrC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,YAAY,CAAC,IAAgB;QAC3B,MAAM,IAAI,GAAc;YACtB,IAAI;YACJ,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAC9B,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,iEAAiE;IACjE,cAAc;QACZ,MAAM,IAAI,GAAkB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,OAAO;QACL,MAAM,IAAI,GAAkB,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC;IACtC,CAAC;CACF;AAED,qDAAqD;AACrD,SAAS,kBAAkB,CAAC,IAAgB,EAAE,OAAe;IAC3D,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAEvB,iEAAiE;IACjE,IAAI,IAAI,KAAK,qBAAqB,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACtE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;gBAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpG,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,IAAI,IAAI,KAAK,uBAAuB,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QACrF,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,IAAgB,EAAE,OAAe;IACpD,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAgB,EAAE,IAAmB,EAAE,OAAe,EAAE,IAAiB;IACnG,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO;IACT,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,KAAK;YAAE,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC"}

package/dist/engine/analyzers/security/cfg/CFGBuilder.d.ts

@@ -0,0 +1,22 @@
+/**
+ * KSA-164: CFG Builder — Constructs control flow graphs from AST function nodes.
+ * Handles if/else, loops, try/catch, switch, and early returns.
+ */
+import type { SyntaxNode } from '../../../parsers/types.js';
+import { ControlFlowGraph } from './ControlFlowGraph.js';
+export declare class CFGBuilder {
+    private blockCounter;
+    private cfg;
+    /** Build CFG from a function AST node. */
+    build(functionNode: SyntaxNode, language: string): ControlFlowGraph;
+    private getFunctionBody;
+    private processStatements;
+    private processStatement;
+    private handleIf;
+    private handleWhile;
+    private handleFor;
+    private handleTryCatch;
+    private handleSwitch;
+    private processBlockOrStatement;
+    private newBlock;
+}

package/dist/engine/analyzers/security/cfg/CFGBuilder.js

@@ -0,0 +1,244 @@
+/**
+ * KSA-164: CFG Builder — Constructs control flow graphs from AST function nodes.
+ * Handles if/else, loops, try/catch, switch, and early returns.
+ */
+import { BasicBlock } from './BasicBlock.js';
+import { ControlFlowGraph } from './ControlFlowGraph.js';
+export class CFGBuilder {
+    blockCounter = 0;
+    cfg;
+    /** Build CFG from a function AST node. */
+    build(functionNode, language) {
+        this.blockCounter = 0;
+        const entry = this.newBlock('entry');
+        this.cfg = new ControlFlowGraph(entry);
+        const exit = this.newBlock('exit');
+        this.cfg.addBlock(exit);
+        const body = this.getFunctionBody(functionNode, language);
+        if (!body) {
+            this.cfg.addEdge(entry, exit, 'sequential');
+            return this.cfg;
+        }
+        const lastBlock = this.processStatements(body, entry, exit);
+        if (lastBlock && lastBlock !== exit) {
+            this.cfg.addEdge(lastBlock, exit, 'sequential');
+        }
+        return this.cfg;
+    }
+    getFunctionBody(node, language) {
+        const body = node.childForFieldName('body');
+        if (body)
+            return body;
+        for (let i = 0; i < node.namedChildCount; i++) {
+            const child = node.namedChild(i);
+            if (child && (child.type === 'statement_block' || child.type === 'block')) {
+                return child;
+            }
+        }
+        return null;
+    }
+    processStatements(blockNode, currentBlock, exitBlock) {
+        let active = currentBlock;
+        for (let i = 0; i < blockNode.namedChildCount; i++) {
+            const stmt = blockNode.namedChild(i);
+            if (!stmt || !active)
+                break;
+            active = this.processStatement(stmt, active, exitBlock);
+        }
+        return active;
+    }
+    processStatement(stmt, currentBlock, exitBlock) {
+        switch (stmt.type) {
+            case 'if_statement':
+                return this.handleIf(stmt, currentBlock, exitBlock);
+            case 'while_statement':
+            case 'do_statement':
+                return this.handleWhile(stmt, currentBlock, exitBlock);
+            case 'for_statement':
+            case 'for_in_statement':
+                return this.handleFor(stmt, currentBlock, exitBlock);
+            case 'try_statement':
+                return this.handleTryCatch(stmt, currentBlock, exitBlock);
+            case 'switch_statement':
+                return this.handleSwitch(stmt, currentBlock, exitBlock);
+            case 'return_statement':
+                currentBlock.addStatement(stmt);
+                this.cfg.addEdge(currentBlock, exitBlock, 'return');
+                return null;
+            case 'throw_statement':
+                currentBlock.addStatement(stmt);
+                this.cfg.addEdge(currentBlock, exitBlock, 'exception');
+                return null;
+            case 'break_statement':
+            case 'continue_statement':
+                currentBlock.addStatement(stmt);
+                return null;
+            default:
+                currentBlock.addStatement(stmt);
+                return currentBlock;
+        }
+    }
+    handleIf(node, currentBlock, exitBlock) {
+        const condNode = node.childForFieldName('condition');
+        if (condNode)
+            currentBlock.addStatement(condNode);
+        const mergeBlock = this.newBlock('normal');
+        this.cfg.addBlock(mergeBlock);
+        const consequence = node.childForFieldName('consequence');
+        const thenBlock = this.newBlock('normal');
+        this.cfg.addBlock(thenBlock);
+        this.cfg.addEdge(currentBlock, thenBlock, 'branch-true');
+        let thenEnd = thenBlock;
+        if (consequence) {
+            thenEnd = this.processBlockOrStatement(consequence, thenBlock, exitBlock);
+        }
+        if (thenEnd)
+            this.cfg.addEdge(thenEnd, mergeBlock, 'sequential');
+        const alternative = node.childForFieldName('alternative');
+        if (alternative) {
+            const elseBlock = this.newBlock('normal');
+            this.cfg.addBlock(elseBlock);
+            this.cfg.addEdge(currentBlock, elseBlock, 'branch-false');
+            const elseBody = alternative.type === 'else_clause' ? alternative.namedChild(0) : alternative;
+            let elseEnd = elseBlock;
+            if (elseBody) {
+                if (elseBody.type === 'if_statement') {
+                    elseEnd = this.handleIf(elseBody, elseBlock, exitBlock);
+                }
+                else {
+                    elseEnd = this.processBlockOrStatement(elseBody, elseBlock, exitBlock);
+                }
+            }
+            if (elseEnd)
+                this.cfg.addEdge(elseEnd, mergeBlock, 'sequential');
+        }
+        else {
+            this.cfg.addEdge(currentBlock, mergeBlock, 'branch-false');
+        }
+        return mergeBlock;
+    }
+    handleWhile(node, currentBlock, exitBlock) {
+        const headerBlock = this.newBlock('loop-header');
+        this.cfg.addBlock(headerBlock);
+        this.cfg.addEdge(currentBlock, headerBlock, 'sequential');
+        const condNode = node.childForFieldName('condition');
+        if (condNode)
+            headerBlock.addStatement(condNode);
+        const postLoop = this.newBlock('normal');
+        this.cfg.addBlock(postLoop);
+        const body = node.childForFieldName('body');
+        const bodyBlock = this.newBlock('normal');
+        this.cfg.addBlock(bodyBlock);
+        this.cfg.addEdge(headerBlock, bodyBlock, 'branch-true');
+        this.cfg.addEdge(headerBlock, postLoop, 'loop-exit');
+        let bodyEnd = bodyBlock;
+        if (body)
+            bodyEnd = this.processBlockOrStatement(body, bodyBlock, exitBlock);
+        if (bodyEnd)
+            this.cfg.addEdge(bodyEnd, headerBlock, 'loop-back');
+        return postLoop;
+    }
+    handleFor(node, currentBlock, exitBlock) {
+        const init = node.childForFieldName('initializer');
+        if (init)
+            currentBlock.addStatement(init);
+        const headerBlock = this.newBlock('loop-header');
+        this.cfg.addBlock(headerBlock);
+        this.cfg.addEdge(currentBlock, headerBlock, 'sequential');
+        const condNode = node.childForFieldName('condition');
+        if (condNode)
+            headerBlock.addStatement(condNode);
+        const postLoop = this.newBlock('normal');
+        this.cfg.addBlock(postLoop);
+        const body = node.childForFieldName('body');
+        const bodyBlock = this.newBlock('normal');
+        this.cfg.addBlock(bodyBlock);
+        this.cfg.addEdge(headerBlock, bodyBlock, 'branch-true');
+        this.cfg.addEdge(headerBlock, postLoop, 'loop-exit');
+        let bodyEnd = bodyBlock;
+        if (body)
+            bodyEnd = this.processBlockOrStatement(body, bodyBlock, exitBlock);
+        const increment = node.childForFieldName('increment');
+        if (increment && bodyEnd)
+            bodyEnd.addStatement(increment);
+        if (bodyEnd)
+            this.cfg.addEdge(bodyEnd, headerBlock, 'loop-back');
+        return postLoop;
+    }
+    handleTryCatch(node, currentBlock, exitBlock) {
+        const mergeBlock = this.newBlock('normal');
+        this.cfg.addBlock(mergeBlock);
+        const tryBody = node.childForFieldName('body');
+        const tryBlock = this.newBlock('normal');
+        this.cfg.addBlock(tryBlock);
+        this.cfg.addEdge(currentBlock, tryBlock, 'sequential');
+        let tryEnd = tryBlock;
+        if (tryBody)
+            tryEnd = this.processBlockOrStatement(tryBody, tryBlock, exitBlock);
+        if (tryEnd)
+            this.cfg.addEdge(tryEnd, mergeBlock, 'sequential');
+        const handler = node.childForFieldName('handler');
+        if (handler) {
+            const catchBlock = this.newBlock('catch');
+            this.cfg.addBlock(catchBlock);
+            this.cfg.addEdge(tryBlock, catchBlock, 'exception');
+            const catchBody = handler.childForFieldName('body');
+            let catchEnd = catchBlock;
+            if (catchBody)
+                catchEnd = this.processBlockOrStatement(catchBody, catchBlock, exitBlock);
+            if (catchEnd)
+                this.cfg.addEdge(catchEnd, mergeBlock, 'sequential');
+        }
+        const finalizer = node.childForFieldName('finalizer');
+        if (finalizer) {
+            const finallyBlock = this.newBlock('normal');
+            this.cfg.addBlock(finallyBlock);
+            this.cfg.addEdge(mergeBlock, finallyBlock, 'sequential');
+            const finallyBody = finalizer.namedChild(0);
+            if (finallyBody)
+                this.processBlockOrStatement(finallyBody, finallyBlock, exitBlock);
+            return finallyBlock;
+        }
+        return mergeBlock;
+    }
+    handleSwitch(node, currentBlock, exitBlock) {
+        const value = node.childForFieldName('value');
+        if (value)
+            currentBlock.addStatement(value);
+        const mergeBlock = this.newBlock('normal');
+        this.cfg.addBlock(mergeBlock);
+        const body = node.childForFieldName('body');
+        if (!body)
+            return mergeBlock;
+        for (let i = 0; i < body.namedChildCount; i++) {
+            const caseNode = body.namedChild(i);
+            if (!caseNode)
+                continue;
+            const caseBlock = this.newBlock('normal');
+            this.cfg.addBlock(caseBlock);
+            this.cfg.addEdge(currentBlock, caseBlock, 'branch-true');
+            let caseEnd = caseBlock;
+            for (let j = 0; j < caseNode.namedChildCount; j++) {
+                const stmt = caseNode.namedChild(j);
+                if (!stmt || !caseEnd)
+                    break;
+                if (stmt.type === 'switch_case' || stmt.type === 'switch_default')
+                    continue;
+                caseEnd = this.processStatement(stmt, caseEnd, exitBlock);
+            }
+            if (caseEnd)
+                this.cfg.addEdge(caseEnd, mergeBlock, 'sequential');
+        }
+        return mergeBlock;
+    }
+    processBlockOrStatement(node, currentBlock, exitBlock) {
+        if (node.type === 'statement_block' || node.type === 'block') {
+            return this.processStatements(node, currentBlock, exitBlock);
+        }
+        return this.processStatement(node, currentBlock, exitBlock);
+    }
+    newBlock(type) {
+        return new BasicBlock(this.blockCounter++, type);
+    }
+}
+//# sourceMappingURL=CFGBuilder.js.map

package/dist/engine/analyzers/security/cfg/CFGBuilder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CFGBuilder.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/cfg/CFGBuilder.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,OAAO,UAAU;IACb,YAAY,GAAG,CAAC,CAAC;IACjB,GAAG,CAAoB;IAE/B,0CAA0C;IAC1C,KAAK,CAAC,YAAwB,EAAE,QAAgB;QAC9C,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QAEtB,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAExB,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAEO,eAAe,CAAC,IAAgB,EAAE,QAAgB;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,CAAC;gBAC1E,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,iBAAiB,CAAC,SAAqB,EAAE,YAAwB,EAAE,SAAqB;QAC9F,IAAI,MAAM,GAAsB,YAAY,CAAC;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YACnD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM;YAC5B,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,gBAAgB,CAAC,IAAgB,EAAE,YAAwB,EAAE,SAAqB;QACxF,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACtD,KAAK,iBAAiB,CAAC;YACvB,KAAK,cAAc;gBACjB,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACzD,KAAK,eAAe,CAAC;YACrB,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACvD,KAAK,eAAe;gBAClB,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC5D,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YAC1D,KAAK,kBAAkB;gBACrB,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;gBACpD,OAAO,IAAI,CAAC;YACd,KAAK,iBAAiB;gBACpB,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;gBACvD,OAAO,IAAI,CAAC;YACd,KAAK,iBAAiB,CAAC;YACvB,KAAK,oBAAoB;gBACvB,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd;gBACE,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAChC,OAAO,YAAY,CAAC;QACxB,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,IAAgB,EAAE,YAAwB,EAAE,SAAqB;QAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE9B,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAEzD,IAAI,OAAO,GAAsB,SAAS,CAAC;QAC3C,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAEjE,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QAC1D,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAE1D,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;YAC9F,IAAI,OAAO,GAAsB,SAAS,CAAC;YAC3C,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,QAAQ,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;oBACrC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC1D,CAAC;qBAAM,CAAC;oBACN,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YACD,IAAI,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,WAAW,CAAC,IAAgB,EAAE,YAAwB,EAAE,SAAqB;QACnF,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QAE1D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAErD,IAAI,OAAO,GAAsB,SAAS,CAAC;QAC3C,IAAI,IAAI;YAAE,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7E,IAAI,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAEjE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,SAAS,CAAC,IAAgB,EAAE,YAAwB,EAAE,SAAqB;QACjF,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACnD,IAAI,IAAI;YAAE,YAAY,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QAE1D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAEjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAErD,IAAI,OAAO,GAAsB,SAAS,CAAC;QAC3C,IAAI,IAAI;YAAE,OAAO,GAAG,IAAI,CAAC,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QAE7E,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,SAAS,IAAI,OAAO;YAAE,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,OAAO;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAEjE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,cAAc,CAAC,IAAgB,EAAE,YAAwB,EAAE,SAAqB;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAEvD,IAAI,MAAM,GAAsB,QAAQ,CAAC;QACzC,IAAI,OAAO;YAAE,MAAM,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjF,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YAEpD,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YACpD,IAAI,QAAQ,GAAsB,UAAU,CAAC;YAC7C,IAAI,SAAS;gBAAE,QAAQ,GAAG,IAAI,CAAC,uBAAuB,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;YACzF,IAAI,QAAQ;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,WAAW,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,WAAW;gBAAE,IAAI,CAAC,uBAAuB,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;YACpF,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,YAAY,CAAC,IAAgB,EAAE,YAAwB,EAAE,SAAqB;QACpF,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAE5C,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAE9B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI;YAAE,OAAO,UAAU,CAAC;QAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAExB,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YAEzD,IAAI,OAAO,GAAsB,SAAS,CAAC;YAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC;gBAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACpC,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;oBAAE,MAAM;gBAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;oBAAE,SAAS;gBAC5E,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,OAAO;gBAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,uBAAuB,CAAC,IAAgB,EAAE,YAAwB,EAAE,SAAqB;QAC/F,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7D,OAAO,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC9D,CAAC;IAEO,QAAQ,CAAC,IAAwB;QACvC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,IAAI,CAAC,CAAC;IACnD,CAAC;CACF"}

package/dist/engine/analyzers/security/cfg/CFGEdge.d.ts

@@ -0,0 +1,13 @@
+/**
+ * KSA-164: CFG Edge — Represents control flow between basic blocks.
+ */
+import type { EdgeType } from '../types.js';
+import type { BasicBlock } from './BasicBlock.js';
+export declare class CFGEdge {
+    readonly from: BasicBlock;
+    readonly to: BasicBlock;
+    readonly type: EdgeType;
+    readonly label?: string;
+    constructor(from: BasicBlock, to: BasicBlock, type: EdgeType, label?: string);
+    toString(): string;
+}

package/dist/engine/analyzers/security/cfg/CFGEdge.js

@@ -0,0 +1,19 @@
+/**
+ * KSA-164: CFG Edge — Represents control flow between basic blocks.
+ */
+export class CFGEdge {
+    from;
+    to;
+    type;
+    label;
+    constructor(from, to, type, label) {
+        this.from = from;
+        this.to = to;
+        this.type = type;
+        this.label = label;
+    }
+    toString() {
+        return `B${this.from.id} -[${this.type}]-> B${this.to.id}`;
+    }
+}
+//# sourceMappingURL=CFGEdge.js.map

package/dist/engine/analyzers/security/cfg/CFGEdge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CFGEdge.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/cfg/CFGEdge.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,OAAO,OAAO;IACT,IAAI,CAAa;IACjB,EAAE,CAAa;IACf,IAAI,CAAW;IACf,KAAK,CAAU;IAExB,YAAY,IAAgB,EAAE,EAAc,EAAE,IAAc,EAAE,KAAc;QAC1E,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,IAAI,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IAC7D,CAAC;CACF"}

package/dist/engine/analyzers/security/cfg/ControlFlowGraph.d.ts

@@ -0,0 +1,29 @@
+/**
+ * KSA-164: Control Flow Graph — Container for basic blocks and edges.
+ */
+import { BasicBlock } from './BasicBlock.js';
+import { CFGEdge } from './CFGEdge.js';
+import type { EdgeType } from '../types.js';
+export declare class ControlFlowGraph {
+    readonly entry: BasicBlock;
+    readonly exits: BasicBlock[];
+    readonly blocks: BasicBlock[];
+    readonly edges: CFGEdge[];
+    private adjacency;
+    private reverseAdj;
+    constructor(entry: BasicBlock);
+    addBlock(block: BasicBlock): void;
+    addEdge(from: BasicBlock, to: BasicBlock, type: EdgeType, label?: string): CFGEdge;
+    getSuccessors(block: BasicBlock): BasicBlock[];
+    getPredecessors(block: BasicBlock): BasicBlock[];
+    getOutEdges(block: BasicBlock): CFGEdge[];
+    getInEdges(block: BasicBlock): CFGEdge[];
+    /** Topological sort using DFS (for acyclic portions). */
+    topologicalOrder(): BasicBlock[];
+    /** Reverse post-order traversal (optimal for dataflow iteration). */
+    reversePostOrder(): BasicBlock[];
+    /** Get block by ID. */
+    getBlock(id: number): BasicBlock | undefined;
+    /** Summary for debugging. */
+    toString(): string;
+}

package/dist/engine/analyzers/security/cfg/ControlFlowGraph.js

@@ -0,0 +1,87 @@
+/**
+ * KSA-164: Control Flow Graph — Container for basic blocks and edges.
+ */
+import { CFGEdge } from './CFGEdge.js';
+export class ControlFlowGraph {
+    entry;
+    exits = [];
+    blocks = [];
+    edges = [];
+    adjacency = new Map();
+    reverseAdj = new Map();
+    constructor(entry) {
+        this.entry = entry;
+        this.addBlock(entry);
+    }
+    addBlock(block) {
+        this.blocks.push(block);
+        this.adjacency.set(block.id, []);
+        this.reverseAdj.set(block.id, []);
+        if (block.type === 'exit')
+            this.exits.push(block);
+    }
+    addEdge(from, to, type, label) {
+        const edge = new CFGEdge(from, to, type, label);
+        this.edges.push(edge);
+        this.adjacency.get(from.id).push(edge);
+        this.reverseAdj.get(to.id).push(edge);
+        return edge;
+    }
+    getSuccessors(block) {
+        return (this.adjacency.get(block.id) ?? []).map(e => e.to);
+    }
+    getPredecessors(block) {
+        return (this.reverseAdj.get(block.id) ?? []).map(e => e.from);
+    }
+    getOutEdges(block) {
+        return this.adjacency.get(block.id) ?? [];
+    }
+    getInEdges(block) {
+        return this.reverseAdj.get(block.id) ?? [];
+    }
+    /** Topological sort using DFS (for acyclic portions). */
+    topologicalOrder() {
+        const visited = new Set();
+        const result = [];
+        const dfs = (block) => {
+            if (visited.has(block.id))
+                return;
+            visited.add(block.id);
+            for (const succ of this.getSuccessors(block)) {
+                dfs(succ);
+            }
+            result.unshift(block);
+        };
+        dfs(this.entry);
+        return result;
+    }
+    /** Reverse post-order traversal (optimal for dataflow iteration). */
+    reversePostOrder() {
+        const visited = new Set();
+        const postOrder = [];
+        const dfs = (block) => {
+            if (visited.has(block.id))
+                return;
+            visited.add(block.id);
+            for (const succ of this.getSuccessors(block)) {
+                dfs(succ);
+            }
+            postOrder.push(block);
+        };
+        dfs(this.entry);
+        return postOrder.reverse();
+    }
+    /** Get block by ID. */
+    getBlock(id) {
+        return this.blocks.find(b => b.id === id);
+    }
+    /** Summary for debugging. */
+    toString() {
+        const lines = [`CFG: ${this.blocks.length} blocks, ${this.edges.length} edges`];
+        for (const edge of this.edges) {
+            lines.push(`  ${edge.toString()}`);
+        }
+        return lines.join('\n');
+    }
+}
+//# sourceMappingURL=ControlFlowGraph.js.map

package/dist/engine/analyzers/security/cfg/ControlFlowGraph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ControlFlowGraph.js","sourceRoot":"","sources":["../../../../../src/engine/analyzers/security/cfg/ControlFlowGraph.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,MAAM,OAAO,gBAAgB;IAClB,KAAK,CAAa;IAClB,KAAK,GAAiB,EAAE,CAAC;IACzB,MAAM,GAAiB,EAAE,CAAC;IAC1B,KAAK,GAAc,EAAE,CAAC;IACvB,SAAS,GAA2B,IAAI,GAAG,EAAE,CAAC;IAC9C,UAAU,GAA2B,IAAI,GAAG,EAAE,CAAC;IAEvD,YAAY,KAAiB;QAC3B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,KAAiB;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,CAAC,IAAgB,EAAE,EAAc,EAAE,IAAc,EAAE,KAAc;QACtE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,KAAiB;QAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,eAAe,CAAC,KAAiB;QAC/B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,WAAW,CAAC,KAAiB;QAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAC5C,CAAC;IAED,UAAU,CAAC,KAAiB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,yDAAyD;IACzD,gBAAgB;QACd,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,MAAM,GAAiB,EAAE,CAAC;QAEhC,MAAM,GAAG,GAAG,CAAC,KAAiB,EAAE,EAAE;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,OAAO;YAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,qEAAqE;IACrE,gBAAgB;QACd,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,MAAM,SAAS,GAAiB,EAAE,CAAC;QAEnC,MAAM,GAAG,GAAG,CAAC,KAAiB,EAAE,EAAE;YAChC,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAAE,OAAO;YAClC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,IAAI,CAAC,CAAC;YACZ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC;QAEF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChB,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,uBAAuB;IACvB,QAAQ,CAAC,EAAU;QACjB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,6BAA6B;IAC7B,QAAQ;QACN,MAAM,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,MAAM,YAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC;QAChF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;CACF"}

package/dist/engine/analyzers/security/dataflow/DataFlowAnalyzer.d.ts

@@ -0,0 +1,14 @@
+/**
+ * KSA-164: Data Flow Analyzer — Computes def-use chains from CFG + reaching definitions.
+ */
+import { ControlFlowGraph } from '../cfg/ControlFlowGraph.js';
+import type { DataFlowResult } from '../types.js';
+export declare class DataFlowAnalyzer {
+    private reachingDefs;
+    /** Analyze data flow for a control flow graph. */
+    analyze(cfg: ControlFlowGraph): DataFlowResult;
+    /** Collect all definitions across all blocks. */
+    private collectAllDefinitions;
+    /** Build def-use chains: for each definition, find all uses that it reaches. */
+    private buildDefUseChains;
+}