@coana-tech/cli 14.12.114 → 14.12.116

package/repos/coana-tech/jelly-private/dist/bundle/jelly.js

@@ -9,11 +9,11 @@ import {
   require_hints,
   require_parser,
   require_patching
-} from "./chunk-PAV2YSLW.js";
+} from "./chunk-RUAUP2X2.js";
 import {
   require_moduleresolver,
   require_typescript
-} from "./chunk-AO2BBATE.js";
+} from "./chunk-XXE5Z2AZ.js";
 import {
   __commonJS,
   __name,
@@ -37,7 +37,7 @@ import {
   require_tokens,
   require_transform,
   require_util
-} from "./chunk-VDHMBLB5.js";
+} from "./chunk-US4VPHJ4.js";
 
 // lib/misc/timer.js
 var require_timer = __commonJS({
@@ -255,7 +255,7 @@ var require_globalstate = __commonJS({
         this.functionInfos.set(fun, f);
         const parent = (0, asthelpers_1.getEnclosingFunction)(path)?.node;
         (parent ? this.functionInfos.get(parent).functions : m.functions).add(f);
-        this.vulnerabilities?.reachedFunction(path, f);
+        this.vulnerabilities?.reachedFunction(f);
       }
       reachedFile(tofile, entry, from, local) {
         let moduleInfo;
@@ -269,8 +269,8 @@ var require_globalstate = __commonJS({
             packageInfo = from.packageInfo;
             rel = (0, path_1.relative)(packageInfo.dir, tofile);
             if (rel.startsWith("../")) {
-              packageInfo = void 0;
               logger_1.default.warn(`Relative module reference from ${from.getPath()} to ${rel} outside current package ${packageInfo}`);
+              packageInfo = void 0;
             }
           }
           if (!packageInfo) {
@@ -354,20 +354,17 @@ var require_constraintvarproducer = __commonJS({
     exports.ConstraintVarProducer = void 0;
     var types_1 = __require("@babel/types");
     var constraintvars_1 = require_constraintvars();
-    var tokens_1 = require_tokens();
     var ecmascript_1 = require_ecmascript();
-    var options_1 = require_options();
+    var asthelpers_1 = require_asthelpers();
     var ConstraintVarProducer = class {
       static {
         __name(this, "ConstraintVarProducer");
       }
       s;
-      f;
       a;
-      constructor(s, f) {
+      constructor(s, a) {
         this.s = s;
-        this.f = f;
-        this.a = f.a;
+        this.a = a;
       }
       expVar(exp, path) {
         return this.expVar2(exp, path).v;
@@ -392,15 +389,12 @@ var require_constraintvarproducer = __commonJS({
         const binding = path.scope.getBinding(id.name);
         if (binding)
           return { v: this.nodeVar(binding.identifier) };
-        else if (id.name === "arguments") {
-          const fun = this.f.registerArguments(path);
-          return { v: this.argumentsVar(fun ?? path.findParent((p) => p.isProgram()).node) };
-        } else
+        else if (id.name === "arguments")
+          return { v: this.argumentsVar((0, asthelpers_1.getEnclosingNonArrowFunction)(path) ?? path.findParent((p) => p.isProgram()).node) };
+        else
           return { v: this.objPropVar(this.a.globalSpecialNatives["globalThis"], id.name), unbound: true };
       }
       objPropVar(obj, prop, accessor = "normal") {
-        if (options_1.options.widening && obj instanceof tokens_1.ObjectToken && this.f.widened.has(obj))
-          return this.packagePropVar(obj.getPackageInfo(), prop, accessor);
         return this.a.canonicalizeVar(constraintvars_1.ObjectPropertyVar.make(this.s, obj, prop, accessor));
       }
       arrayUnknownVar(arr) {
@@ -409,9 +403,6 @@ var require_constraintvarproducer = __commonJS({
       arrayAllVar(arr) {
         return this.objPropVar(arr, ecmascript_1.ARRAY_ALL);
       }
-      packagePropVar(pck, prop, accessor = "normal") {
-        return this.objPropVar(this.a.canonicalizeToken(new tokens_1.PackageObjectToken(pck)), prop, accessor);
-      }
       returnVar(fun) {
         return this.a.canonicalizeVar(new constraintvars_1.FunctionReturnVar(fun));
       }
@@ -428,13 +419,9 @@ var require_constraintvarproducer = __commonJS({
         return n !== void 0 ? this.a.canonicalizeVar(new constraintvars_1.NodeVar(n)) : void 0;
       }
       ancestorsVar(t) {
-        if (options_1.options.widening && t instanceof tokens_1.ObjectToken && this.f.widened.has(t))
-          t = this.a.canonicalizeToken(new tokens_1.PackageObjectToken(t.getPackageInfo()));
         return this.a.canonicalizeVar(new constraintvars_1.AncestorsVar(t));
       }
       readResultVar(t, prop) {
-        if (options_1.options.widening && t instanceof tokens_1.ObjectToken && this.f.widened.has(t))
-          t = this.a.canonicalizeToken(new tokens_1.PackageObjectToken(t.getPackageInfo()));
         return this.a.canonicalizeVar(new constraintvars_1.ReadResultVar(t, prop));
       }
     };
@@ -454,6 +441,7 @@ var require_fragmentstate = __commonJS({
     var constraintvars_1 = require_constraintvars();
     var tokens_1 = require_tokens();
     var infos_1 = require_infos();
+    var types_1 = __require("@babel/types");
     var assert_1 = __importDefault(__require("assert"));
     var util_1 = require_util();
     var options_1 = require_options();
@@ -480,10 +468,8 @@ var require_fragmentstate = __commonJS({
       tokenListeners2 = /* @__PURE__ */ new Map();
       listenersProcessed = /* @__PURE__ */ new Map();
       externalCallbacksProcessed = /* @__PURE__ */ new Set();
-      packageNeighborListeners = /* @__PURE__ */ new Map();
       arrayEntriesListeners = /* @__PURE__ */ new Map();
       objectPropertiesListeners = /* @__PURE__ */ new Map();
-      packageNeighbors = /* @__PURE__ */ new Map();
       postponedListenerCalls = [];
       postponedListenerCalls2 = [];
       nodesWithNewEdges = /* @__PURE__ */ new Set();
@@ -507,7 +493,6 @@ var require_fragmentstate = __commonJS({
       functionParameters = /* @__PURE__ */ new Map();
       invokedExpressions = /* @__PURE__ */ new Set();
       maybeEscaping = /* @__PURE__ */ new Set();
-      widened = /* @__PURE__ */ new Set();
       maybeEscapingToExternal = /* @__PURE__ */ new Map();
       unhandledDynamicPropertyWrites = /* @__PURE__ */ new Map();
       unhandledDynamicPropertyReads = /* @__PURE__ */ new Set();
@@ -527,7 +512,7 @@ var require_fragmentstate = __commonJS({
       functionTokens = /* @__PURE__ */ new Set();
       constructor(s) {
         this.a = s.globalState;
-        this.varProducer = new constraintvarproducer_1.ConstraintVarProducer(s, this);
+        this.varProducer = new constraintvarproducer_1.ConstraintVarProducer(s, s.globalState);
       }
       registerCallEdge(call, from, to, { native, accessor, external } = {}) {
         if ((!accessor || options_1.options.callgraphImplicit) && (!native || options_1.options.callgraphNative) && (!external || options_1.options.callgraphExternal)) {
@@ -734,18 +719,6 @@ var require_fragmentstate = __commonJS({
       isEmpty(v) {
         return !this.tokens.has(v);
       }
-      static emptyHas = /* @__PURE__ */ __name((_t) => false, "emptyHas");
-      getHas(v) {
-        if (v) {
-          const ts = this.tokens.get(v);
-          if (ts) {
-            if (ts instanceof tokens_1.Token)
-              return (t) => ts === t;
-            return (t) => ts.has(t);
-          }
-        }
-        return _FragmentState.emptyHas;
-      }
       getNumberOfVarsWithTokens() {
         return this.tokens.size;
       }
@@ -768,10 +741,6 @@ var require_fragmentstate = __commonJS({
       deleteVar(v) {
         this.tokens.delete(v);
       }
-      replaceTokens(v, ts, old) {
-        this.tokens.set(v, ts.size === 1 ? ts.values().next().value : ts);
-        this.numberOfTokens += ts.size - old;
-      }
       hasToken(v, t) {
         const ts = this.tokens.get(v);
         if (!ts)
@@ -824,18 +793,29 @@ var require_fragmentstate = __commonJS({
         this.numberOfTokens += added.length;
         return added;
       }
-      maybeWidened(t) {
-        if (options_1.options.widening && t instanceof tokens_1.ObjectToken && this.widened.has(t))
-          return this.a.canonicalizeToken(new tokens_1.PackageObjectToken(t.getPackageInfo(), t.kind));
-        else
-          return t;
-      }
-      requireModule(str, path, moduleInfo) {
+      loadModule(mode, str, path, moduleInfo) {
         let m;
-        const filepath = (0, files_1.requireResolve2)(str, path, moduleInfo.getPath(), this);
+        let filepath;
+        try {
+          filepath = (0, files_1.resolveModule)(mode, str, moduleInfo.getPath(), this.a);
+          if (filepath !== void 0 && !filepath.startsWith(options_1.options.basedir) && !filepath.startsWith(options_1.options.basedir)) {
+            this.warn(`Skipping module '${str}' at ${filepath} outside basedir`, path.node);
+            filepath = void 0;
+          }
+        } catch (e) {
+          if (options_1.options.ignoreUnresolved || options_1.options.ignoreDependencies || (0, files_1.isAbsoluteModuleName)(str) && (options_1.options.includePackages && !options_1.options.includePackages.includes(str) || options_1.options.excludePackages?.includes(str))) {
+            if (logger_1.default.isVerboseEnabled())
+              logger_1.default.verbose(`Ignoring unresolved module '${str}' at ${(0, util_1.locationToStringWithFile)(path.node.loc)}`);
+          } else if ((0, asthelpers_1.isInTryBlockOrBranch)(path))
+            this.warn(`Unable to resolve conditionally loaded module '${str}' (${e.message})`, path.node);
+          else if (path.isCallExpression() && !((0, types_1.isIdentifier)(path.node.callee) && path.node.callee.name === "require"))
+            this.warn(`Unable to resolve module '${str}' at indirect require call (${e.message})`, path.node);
+          else
+            this.error(`Unable to resolve module '${str}' (${e.message})`, path.node);
+        }
         if (filepath)
           m = this.a.reachedFile(filepath, false, moduleInfo, (0, files_1.isLocalRequire)(str));
-        else if (!"./#".includes(str[0]))
+        else if ((0, files_1.isAbsoluteModuleName)(str))
           m = (0, util_1.getOrSet)(this.a.dummyModuleInfos, str, () => new infos_1.DummyModuleInfo(str));
         return m;
       }
@@ -1040,7 +1020,6 @@ var require_diagnostics = __commonJS({
       lastPrintDiagnosticsTime = 0;
       tokenListenerNotifications = 0;
       tokenListener2Notifications = 0;
-      packageNeighborListenerNotifications = 0;
       arrayEntriesListenerNotifications = 0;
       objectPropertiesListenerNotifications = 0;
       waveLimitReached = 0;
@@ -1049,8 +1028,6 @@ var require_diagnostics = __commonJS({
       totalCycleEliminationRuns = 0;
       totalPropagationTime = 0n;
       totalListenerCallTime = 0n;
-      totalWideningTime = 0n;
-      totalFragmentMergeTime = 0n;
       totalEscapePatchingTime = 0n;
       totalApproxPatchingTime = 0n;
       totalOtherPatchingTime = 0n;
@@ -1147,7 +1124,6 @@ var require_solver = __commonJS({
         return this.fragmentState.varProducer;
       }
       unprocessedTokens = /* @__PURE__ */ new Map();
-      restored = /* @__PURE__ */ new Set();
       listeners = /* @__PURE__ */ new Map();
       diagnostics = new diagnostics_1.default();
       abort;
@@ -1167,7 +1143,6 @@ var require_solver = __commonJS({
         d.listeners = [
           f.tokenListeners,
           f.tokenListeners2,
-          f.packageNeighborListeners,
           f.arrayEntriesListeners,
           f.objectPropertiesListeners
         ].reduce((acc, l) => acc + (0, util_1.mapMapSize)(l), 0);
@@ -1214,26 +1189,6 @@ var require_solver = __commonJS({
             ws = this.tokenAdded(toRep, t, ws);
         }
       }
-      replaceTokens(m) {
-        const f = this.fragmentState;
-        for (const [v, ts, size] of f.getAllVarsAndTokens()) {
-          const r = /* @__PURE__ */ new Set();
-          let any = false;
-          let ws = void 0;
-          for (const t of ts) {
-            const q = t instanceof tokens_1.ObjectToken && m.get(t);
-            if (q) {
-              if (!(Array.isArray(ts) ? ts.includes(q) : ts.has(q)) && !r.has(q))
-                ws = this.tokenAdded(v, q, ws);
-              r.add(q);
-              any = true;
-            } else
-              r.add(t);
-          }
-          if (any)
-            f.replaceTokens(v, r, size);
-        }
-      }
       tokenAdded(toRep, t, ws) {
         if (logger_1.default.isDebugEnabled())
           logger_1.default.debug(`Added token ${t} to ${toRep}`);
@@ -1275,12 +1230,12 @@ var require_solver = __commonJS({
         }
       }
       printDiagnostics() {
-        if (options_1.options.printProgress && options_1.options.tty && logger_1.isTTY && !options_1.options.logfile && logger_1.default.level === "info" && this.phase !== "init") {
+        if (options_1.options.printProgress && options_1.options.tty && logger_1.isTTY && !options_1.options.logfile && logger_1.default.level === "info") {
           const d = Number(this.timer.elapsed() / 1000000n);
           if (d > this.diagnostics.lastPrintDiagnosticsTime + 100) {
             this.diagnostics.lastPrintDiagnosticsTime = d;
             const f = this.fragmentState;
-            (0, logger_1.writeStdOut)(`Phase: ${this.phase}, total time: ${d}ms, call edges: ${f.numberOfCallToFunctionEdges}` + (options_1.options.diagnostics ? `, vars: ${f.getNumberOfVarsWithTokens()}, tokens: ${f.numberOfTokens}, subsets: ${f.numberOfSubsetEdges}, ` + (options_1.options.maxIndirections !== void 0 ? `round: ${this.diagnostics.round}, ` : "") + `wave: ${this.diagnostics.wave}, propagations: ${this.diagnostics.propagations}, worklist: ${this.diagnostics.unprocessedTokensSize + f.postponedListenerCalls.length + f.postponedListenerCalls2.length - this.postponedListenersProcessed}` : ""));
+            (0, logger_1.writeStdOut)(`${this.phase}... (total time: ${d}ms, call edges: ${f.numberOfCallToFunctionEdges}` + (options_1.options.diagnostics ? `, vars: ${f.getNumberOfVarsWithTokens()}, tokens: ${f.numberOfTokens}, subsets: ${f.numberOfSubsetEdges}, ` + (options_1.options.maxIndirections !== void 0 ? `round: ${this.diagnostics.round}, ` : "") + `wave: ${this.diagnostics.wave}, propagations: ${this.diagnostics.propagations}, worklist: ${this.diagnostics.unprocessedTokensSize + f.postponedListenerCalls.length + f.postponedListenerCalls2.length - this.postponedListenersProcessed}` : "") + ")");
             f.a.timeoutTimer.checkTimeout();
           }
         }
@@ -1403,8 +1358,6 @@ var require_solver = __commonJS({
         }
       }
       callTokenListener2(id, listener, t) {
-        if (this.phase === "module" || this.phase === "init")
-          return;
         const s = (0, util_1.mapGetSet)(this.fragmentState.listenersProcessed, id);
         if (!s.has(t)) {
           s.add(t);
@@ -1412,48 +1365,6 @@ var require_solver = __commonJS({
           this.diagnostics.tokenListener2Notifications++;
         }
       }
-      addForAllPackageNeighborsConstraint(k, opts, listener) {
-        if (logger_1.default.isDebugEnabled())
-          logger_1.default.debug(`Adding package neighbor constraint to ${k}`);
-        const id = this.getListenerID({ l: listeners_1.TokenListener.PACKAGE_NEIGHBORS, ...opts });
-        const m = this.runPackageNeighborsListener(k, id, listener);
-        if (m) {
-          m.set(id, listener);
-        }
-      }
-      runPackageNeighborsListener(k, id, listener) {
-        const f = this.fragmentState;
-        const m = (0, util_1.mapGetMap)(f.packageNeighborListeners, k);
-        if (!m.has(id)) {
-          const qs = f.packageNeighbors.get(k);
-          if (qs)
-            for (const q of qs) {
-              this.enqueueListenerCall([listener, q]);
-              this.diagnostics.packageNeighborListenerNotifications++;
-            }
-          return m;
-        } else
-          return false;
-      }
-      addPackageNeighbor(k1, k2) {
-        if (options_1.options.readNeighbors) {
-          this.addPackageNeighborPrivate(k1, k2);
-          this.addPackageNeighborPrivate(k2, k1);
-        }
-      }
-      addPackageNeighborPrivate(k, neighbor) {
-        const f = this.fragmentState;
-        const s = (0, util_1.mapGetSet)(f.packageNeighbors, k);
-        if (!s.has(neighbor)) {
-          s.add(neighbor);
-          const ts = f.packageNeighborListeners.get(k);
-          if (ts)
-            for (const listener of ts.values()) {
-              this.enqueueListenerCall([listener, neighbor]);
-              this.diagnostics.packageNeighborListenerNotifications++;
-            }
-        }
-      }
       addForAllAncestorsConstraint(t, key, opts, listener) {
         if (logger_1.default.isDebugEnabled())
           logger_1.default.debug(`Adding ancestors constraint to ${t} ${opts.n ? `at ${(0, util_1.nodeToString)(opts.n)}` : `${listeners_1.TokenListener[key]} ${opts.s}`}`);
@@ -1468,7 +1379,7 @@ var require_solver = __commonJS({
             else if (t instanceof tokens_1.ArrayToken) {
               this.callTokenListener(id, listener, g[ecmascript_1.ARRAY_PROTOTYPE]);
               this.callTokenListener(id, listener, g[ecmascript_1.OBJECT_PROTOTYPE]);
-            } else if (t instanceof tokens_1.FunctionToken || t instanceof tokens_1.ClassToken) {
+            } else if (t instanceof tokens_1.FunctionToken) {
               this.callTokenListener(id, listener, g[ecmascript_1.FUNCTION_PROTOTYPE]);
               this.callTokenListener(id, listener, g[ecmascript_1.OBJECT_PROTOTYPE]);
             } else if (t instanceof tokens_1.AllocationSiteToken) {
@@ -1532,7 +1443,7 @@ var require_solver = __commonJS({
         } else
           return false;
       }
-      addArrayEntry(a, prop, merging = false) {
+      addArrayEntry(a, prop) {
         if (!(0, util_1.isArrayIndex)(prop))
           return;
         const f = this.fragmentState;
@@ -1547,9 +1458,7 @@ var require_solver = __commonJS({
               this.enqueueListenerCall([listener, prop]);
               this.diagnostics.arrayEntriesListenerNotifications++;
             }
-          if (!merging) {
-            this.addSubsetEdge(f.getRepresentative(f.varProducer.objPropVar(a, prop)), f.getRepresentative(f.varProducer.arrayAllVar(a)));
-          }
+          this.addSubsetEdge(f.getRepresentative(f.varProducer.objPropVar(a, prop)), f.getRepresentative(f.varProducer.arrayAllVar(a)));
         }
       }
       addForAllObjectPropertiesConstraint(t, key, n, listener) {
@@ -1577,7 +1486,7 @@ var require_solver = __commonJS({
         } else
           return false;
       }
-      addObjectProperty(a, prop, merging = false) {
+      addObjectProperty(a, prop) {
         const f = this.fragmentState;
         const ps = (0, util_1.mapGetSet)(f.objectProperties, a);
         if (!ps.has(prop)) {
@@ -1592,17 +1501,15 @@ var require_solver = __commonJS({
                 this.diagnostics.objectPropertiesListenerNotifications++;
               }
           }
-          if (!merging) {
-            if (a instanceof tokens_1.ArrayToken && prop === ecmascript_1.ARRAY_UNKNOWN)
-              this.addSubsetEdge(f.getRepresentative(f.varProducer.arrayUnknownVar(a)), f.getRepresentative(f.varProducer.arrayAllVar(a)));
-            if (prop === (0, ecmascript_1.INTERNAL_PROTOTYPE)()) {
-              this.addForAllTokensConstraint(f.varProducer.objPropVar(a, prop), listeners_1.TokenListener.ANCESTORS, { t: a }, (b) => {
-                const aVar = this.varProducer.ancestorsVar(a);
-                this.addTokenConstraint(b, aVar);
-                if ((0, constraintvars_1.isObjectPropertyVarObj)(b))
-                  this.addSubsetConstraint(this.varProducer.ancestorsVar(b), aVar);
-              });
-            }
+          if (a instanceof tokens_1.ArrayToken && prop === ecmascript_1.ARRAY_UNKNOWN)
+            this.addSubsetEdge(f.getRepresentative(f.varProducer.arrayUnknownVar(a)), f.getRepresentative(f.varProducer.arrayAllVar(a)));
+          if (prop === (0, ecmascript_1.INTERNAL_PROTOTYPE)()) {
+            this.addForAllTokensConstraint(f.varProducer.objPropVar(a, prop), listeners_1.TokenListener.ANCESTORS, { t: a }, (b) => {
+              const aVar = this.varProducer.ancestorsVar(a);
+              this.addTokenConstraint(b, aVar);
+              if ((0, constraintvars_1.isObjectPropertyVarObj)(b))
+                this.addSubsetConstraint(this.varProducer.ancestorsVar(b), aVar);
+            });
           }
         }
       }
@@ -1744,9 +1651,9 @@ var require_solver = __commonJS({
         f.a.timeoutTimer.checkTimeout();
         await this.checkAbort();
         if (logger_1.default.isVerboseEnabled())
-          logger_1.default.verbose(`Propagating (tokens: ${this.unprocessedTokens.size}, restored: ${this.restored.size}, non-bounded: ${f.postponedListenerCalls.length}, bounded: ${f.postponedListenerCalls2.length})`);
+          logger_1.default.verbose(`Propagating (tokens: ${this.unprocessedTokens.size}, non-bounded: ${f.postponedListenerCalls.length}, bounded: ${f.postponedListenerCalls2.length})`);
         let wave = 1, round = 1;
-        while (this.unprocessedTokens.size > 0 || this.restored.size > 0 || f.postponedListenerCalls.length > 0 || f.postponedListenerCalls2.length > 0) {
+        while (this.unprocessedTokens.size > 0 || f.postponedListenerCalls.length > 0 || f.postponedListenerCalls2.length > 0) {
           this.diagnostics.wave = wave;
           this.diagnostics.round = round;
           if (logger_1.default.isVerboseEnabled())
@@ -1757,17 +1664,14 @@ var require_solver = __commonJS({
             this.diagnostics.unprocessedTokensSize = 0;
             this.unprocessedTokens.clear();
             f.nodesWithNewEdges.clear();
-            this.restored.clear();
             f.postponedListenerCalls.length = 0;
             break;
           }
-          if (this.unprocessedTokens.size > 0 || this.restored.size > 0) {
+          if (this.unprocessedTokens.size > 0) {
             if (options_1.options.cycleElimination && f.numberOfSubsetEdges >= CYCLE_ELIMINATION_MINIMUM && f.numberOfSubsetEdges >= f.prevNumEdges * CYCLE_ELIMINATION_FACTOR) {
               const nodes = /* @__PURE__ */ new Set();
               for (const v of f.nodesWithNewEdges)
                 nodes.add(f.getRepresentative(v));
-              for (const v of this.restored)
-                nodes.add(f.getRepresentative(v));
               if (nodes.size > 0) {
                 const edgesBefore = f.numberOfSubsetEdges;
                 const timer1 = new timer_1.default();
@@ -1791,7 +1695,6 @@ var require_solver = __commonJS({
                 }
                 this.diagnostics.totalPropagationTime += timer2.elapsed();
                 f.nodesWithNewEdges.clear();
-                this.restored.clear();
               }
               const timer3 = new timer_1.default();
               for (const v of this.unprocessedTokens.keys())
@@ -1801,7 +1704,6 @@ var require_solver = __commonJS({
               if (logger_1.default.isVerboseEnabled())
                 logger_1.default.verbose(`Processing ${this.diagnostics.unprocessedTokensSize} new token${this.diagnostics.unprocessedTokensSize !== 1 ? "s" : ""}`);
               const timer = new timer_1.default();
-              this.restored.clear();
               for (const v of this.unprocessedTokens.keys()) {
                 this.processTokens(v);
                 await this.checkAbort(true);
@@ -1809,8 +1711,8 @@ var require_solver = __commonJS({
               this.diagnostics.totalPropagationTime += timer.elapsed();
             }
           }
-          if (this.unprocessedTokens.size !== 0 || this.diagnostics.unprocessedTokensSize !== this.unprocessedTokens.size || this.restored.size !== 0)
-            assert_1.default.fail(`worklist non-empty: unprocessedTokens.size: ${this.unprocessedTokens.size}, unprocessedTokensSize: ${this.diagnostics.unprocessedTokensSize}, restored.size: ${this.restored.size}`);
+          if (this.unprocessedTokens.size !== 0 || this.diagnostics.unprocessedTokensSize !== this.unprocessedTokens.size)
+            assert_1.default.fail(`worklist non-empty: unprocessedTokens.size: ${this.unprocessedTokens.size}, unprocessedTokensSize: ${this.diagnostics.unprocessedTokensSize}`);
           if (f.postponedListenerCalls.length > 0) {
             if (logger_1.default.isVerboseEnabled())
               logger_1.default.verbose(`Processing non-bounded listener calls: ${f.postponedListenerCalls.length}`);
@@ -1831,7 +1733,6 @@ var require_solver = __commonJS({
               this.diagnostics.unprocessedTokensSize = 0;
               this.unprocessedTokens.clear();
               f.nodesWithNewEdges.clear();
-              this.restored.clear();
               f.postponedListenerCalls.length = 0;
               f.postponedListenerCalls2.length = 0;
             } else {
@@ -1877,347 +1778,11 @@ var require_solver = __commonJS({
           }
         }
       }
-      prepare() {
-        this.fragmentState = new fragmentstate_1.FragmentState(this);
-        this.phase = "init";
-      }
-      merge(_s) {
-        this.phase = "merging";
-        const timer = new timer_1.default();
-        const s = _s;
-        const f = this.fragmentState;
-        (0, util_1.mapSetAddAll)(s.listenersProcessed, f.listenersProcessed);
-        (0, util_1.addAll)(s.externalCallbacksProcessed, f.externalCallbacksProcessed);
-        for (const [v, rep] of s.redirections) {
-          const fRep = f.getRepresentative(v);
-          const repRep = f.getRepresentative(rep);
-          this.addSubsetEdge(fRep, repRep);
-          this.redirect(fRep, repRep);
-        }
-        for (const [t, m] of s.arrayEntriesListeners)
-          for (const [id, listener] of m)
-            this.runArrayEntriesListener(t, id, listener);
-        for (const [t, m] of s.objectPropertiesListeners)
-          for (const [id, listener] of m)
-            this.runObjectPropertiesListener(t, id, listener);
-        for (const [k, m] of s.packageNeighborListeners)
-          for (const [n, listener] of m)
-            this.runPackageNeighborsListener(k, n, listener);
-        for (const v of s.vars) {
-          const vRep = f.getRepresentative(v);
-          f.vars.add(vRep);
-          const ntr = s.tokenListeners.get(v);
-          const ntr2 = s.tokenListeners2.get(v);
-          const svs = s.subsetEdges.get(v);
-          if (ntr) {
-            const vHas = s.getHas(v);
-            for (const t of f.getTokens(vRep))
-              if (!vHas(t))
-                for (const [id, listener] of ntr)
-                  this.callTokenListener(id, listener, t);
-          }
-          if (ntr2) {
-            const vHas = s.getHas(v);
-            for (const t of f.getTokens(vRep))
-              if (!vHas(t))
-                for (const [id, listener] of ntr2)
-                  this.callTokenListener2(id, listener, t);
-          }
-          if (svs)
-            for (const v2 of svs)
-              this.addTokens(f.getTokens(vRep), f.getRepresentative(v2));
-          this.addTokens(s.getTokens(v), vRep);
-          if (ntr)
-            for (const [id, listener] of ntr)
-              (0, util_1.mapGetMap)(f.tokenListeners, vRep).set(id, listener);
-          if (ntr2)
-            for (const [id, listener] of ntr2)
-              (0, util_1.mapGetMap)(f.tokenListeners2, vRep).set(id, listener);
-          if (svs) {
-            const fvs = (0, util_1.mapGetSet)(f.subsetEdges, vRep);
-            for (const v2 of svs) {
-              const v2Rep = f.getRepresentative(v2);
-              if (!fvs.has(v2Rep) && vRep !== v2Rep) {
-                fvs.add(v2Rep);
-                f.numberOfSubsetEdges++;
-                (0, util_1.mapGetSet)(f.reverseSubsetEdges, v2Rep).add(vRep);
-                this.restored.add(v2Rep);
-              }
-            }
-          }
-        }
-        for (const [t, props] of s.objectProperties)
-          for (const prop of props)
-            this.addObjectProperty(t, prop, true);
-        for (const [t, entries] of s.arrayEntries)
-          for (const entry of entries)
-            this.addArrayEntry(t, entry, true);
-        (0, util_1.mapMapSetAll)(s.arrayEntriesListeners, f.arrayEntriesListeners);
-        (0, util_1.mapMapSetAll)(s.objectPropertiesListeners, f.objectPropertiesListeners);
-        for (const [k, ns] of s.packageNeighbors)
-          for (const n of ns)
-            this.addPackageNeighbor(k, n);
-        (0, util_1.mapMapSetAll)(s.packageNeighborListeners, f.packageNeighborListeners);
-        (0, util_1.mapSetAddAll)(s.requireGraph, f.requireGraph);
-        (0, util_1.mapSetAddAll)(s.functionToFunction, f.functionToFunction);
-        (0, util_1.mapSetAddAll)(s.callToFunction, f.callToFunction);
-        (0, util_1.mapSetAddAll)(s.callToFunctionOrModule, f.callToFunctionOrModule);
-        (0, util_1.setAll)(s.callToContainingFunction, f.callToContainingFunction);
-        (0, util_1.mapSetAddAll)(s.callToCalleeVars, f.callToCalleeVars);
-        (0, util_1.mapSetAddAll)(s.callToModule, f.callToModule);
-        f.numberOfFunctionToFunctionEdges += s.numberOfFunctionToFunctionEdges;
-        f.numberOfCallToFunctionEdges += s.numberOfCallToFunctionEdges;
-        (0, util_1.addAll)(s.functionsWithArguments, f.functionsWithArguments);
-        (0, util_1.pushAll)(s.artificialFunctions, f.artificialFunctions);
-        (0, util_1.addAll)(s.callLocations, f.callLocations);
-        (0, util_1.setAll)(s.maybeEmptyMethodCalls, f.maybeEmptyMethodCalls);
-        (0, util_1.addAll)(s.nativeCallLocations, f.nativeCallLocations);
-        (0, util_1.addAll)(s.externalCallLocations, f.externalCallLocations);
-        (0, util_1.addAll)(s.callsWithUnusedResult, f.callsWithUnusedResult);
-        (0, util_1.addAll)(s.callsWithResultMaybeUsedAsPromise, f.callsWithResultMaybeUsedAsPromise);
-        (0, util_1.mapSetAddAll)(s.functionParameters, f.functionParameters);
-        (0, util_1.addAll)(s.invokedExpressions, f.invokedExpressions);
-        (0, util_1.addAll)(s.maybeEscaping, f.maybeEscaping);
-        (0, util_1.addAll)(s.widened, f.widened);
-        (0, util_1.mapMapSetAll)(s.maybeEscapingToExternal, f.maybeEscapingToExternal);
-        (0, util_1.setAll)(s.unhandledDynamicPropertyWrites, f.unhandledDynamicPropertyWrites);
-        (0, util_1.addAll)(s.unhandledDynamicPropertyReads, f.unhandledDynamicPropertyReads);
-        (0, util_1.addAllMapHybridSet)(s.errors, f.errors);
-        (0, util_1.addAllMapHybridSet)(s.warnings, f.warnings);
-        (0, util_1.addAllMapHybridSet)(s.warningsUnsupported, f.warningsUnsupported);
-        (0, util_1.mapMapSetAll)(s.moduleAccessPaths, f.moduleAccessPaths);
-        (0, util_1.mapMapMapSetAll)(s.propertyReadAccessPaths, f.propertyReadAccessPaths);
-        (0, util_1.mapMapMapSetAll)(s.propertyWriteAccessPaths, f.propertyWriteAccessPaths);
-        (0, util_1.mapMapSetAll)(s.callResultAccessPaths, f.callResultAccessPaths);
-        (0, util_1.mapMapSetAll)(s.componentAccessPaths, f.componentAccessPaths);
-        (0, util_1.mapArrayPushAll)(s.importDeclRefs, f.importDeclRefs);
-        (0, util_1.pushAll)(s.propertyReads, f.propertyReads);
-        (0, util_1.pushAll)(s.maybeEmptyPropertyReads, f.maybeEmptyPropertyReads);
-        (0, util_1.addAll)(s.dynamicPropertyWrites, f.dynamicPropertyWrites);
-        (0, util_1.addAll)(s.functionTokens, f.functionTokens);
-        this.printDiagnostics();
-        this.diagnostics.totalFragmentMergeTime += timer.elapsed();
-      }
     };
     exports.default = Solver;
   }
 });
 
-// lib/analysis/widening.js
-var require_widening = __commonJS({
-  "lib/analysis/widening.js"(exports) {
-    "use strict";
-    var __createBinding = exports && exports.__createBinding || (Object.create ? (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      var desc = Object.getOwnPropertyDescriptor(m, k);
-      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-        desc = { enumerable: true, get: /* @__PURE__ */ __name(function() {
-          return m[k];
-        }, "get") };
-      }
-      Object.defineProperty(o, k2, desc);
-    }) : (function(o, m, k, k2) {
-      if (k2 === void 0) k2 = k;
-      o[k2] = m[k];
-    }));
-    var __setModuleDefault = exports && exports.__setModuleDefault || (Object.create ? (function(o, v) {
-      Object.defineProperty(o, "default", { enumerable: true, value: v });
-    }) : function(o, v) {
-      o["default"] = v;
-    });
-    var __importStar = exports && exports.__importStar || /* @__PURE__ */ (function() {
-      var ownKeys = /* @__PURE__ */ __name(function(o) {
-        ownKeys = Object.getOwnPropertyNames || function(o2) {
-          var ar = [];
-          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
-          return ar;
-        };
-        return ownKeys(o);
-      }, "ownKeys");
-      return function(mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) {
-          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        }
-        __setModuleDefault(result, mod);
-        return result;
-      };
-    })();
-    var __importDefault = exports && exports.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.widenObjects = widenObjects;
-    var tokens_1 = require_tokens();
-    var logger_1 = __importDefault(require_logger());
-    var constraintvars_1 = require_constraintvars();
-    var util_1 = require_util();
-    var timer_1 = __importStar(require_timer());
-    var accesspaths_1 = require_accesspaths();
-    function widenObjects(widened, solver) {
-      const a = solver.globalState;
-      const f = solver.fragmentState;
-      if (logger_1.default.isVerboseEnabled())
-        logger_1.default.verbose(`Widening (constraint vars: ${f.getNumberOfVarsWithTokens()}, widened tokens: ${widened.size})`);
-      if (logger_1.default.isDebugEnabled())
-        for (const t of widened)
-          logger_1.default.debug(`Widening ${t}`);
-      if (widened.size === 0)
-        return;
-      (0, util_1.addAll)(widened, f.widened);
-      const timer = new timer_1.default();
-      const tokenMap = /* @__PURE__ */ new Map();
-      for (const t of widened)
-        tokenMap.set(t, a.canonicalizeToken(new tokens_1.PackageObjectToken(t.getPackageInfo())));
-      function widenToken(t) {
-        return t instanceof tokens_1.ObjectToken && tokenMap.get(t) || t;
-      }
-      __name(widenToken, "widenToken");
-      function widenTokenSet(ts) {
-        const res = /* @__PURE__ */ new Set();
-        for (const t of ts)
-          res.add(widenToken(t));
-        return res;
-      }
-      __name(widenTokenSet, "widenTokenSet");
-      function widenTokenMapArrayValues(m) {
-        const res = /* @__PURE__ */ new Map();
-        let size = 0;
-        for (const [v, ts] of m) {
-          if (ts instanceof tokens_1.Token) {
-            const s = widenToken(ts);
-            res.set(v, s);
-            size += 1;
-          } else {
-            const s = widenTokenSet(ts);
-            res.set(v, Array.from(s));
-            size += s.size;
-          }
-        }
-        return [res, size];
-      }
-      __name(widenTokenMapArrayValues, "widenTokenMapArrayValues");
-      function widenTokenMapMapKeys(m) {
-        const res = /* @__PURE__ */ new Map();
-        for (const [t, m2] of m) {
-          const rm = (0, util_1.mapGetMap)(res, widenToken(t));
-          for (const [k, v] of m2)
-            rm.set(k, v);
-        }
-        return res;
-      }
-      __name(widenTokenMapMapKeys, "widenTokenMapMapKeys");
-      const varMap = /* @__PURE__ */ new Map();
-      function widenVar(v) {
-        if (v instanceof constraintvars_1.ObjectPropertyVar && v.obj instanceof tokens_1.ObjectToken && widened.has(v.obj)) {
-          const vobj = v.obj;
-          return (0, util_1.getOrSet)(varMap, v, () => f.varProducer.packagePropVar(vobj.getPackageInfo(), v.prop, v.accessor));
-        } else if (v instanceof constraintvars_1.AncestorsVar && v.t instanceof tokens_1.ObjectToken && widened.has(v.t))
-          return (0, util_1.getOrSet)(varMap, v, () => f.varProducer.ancestorsVar(v.t));
-        else if (v instanceof constraintvars_1.ReadResultVar && v.t instanceof tokens_1.ObjectToken && widened.has(v.t))
-          return (0, util_1.getOrSet)(varMap, v, () => f.varProducer.readResultVar(v.t, v.prop));
-        else
-          return v;
-      }
-      __name(widenVar, "widenVar");
-      function widenVarSet(s) {
-        const res = /* @__PURE__ */ new Set();
-        for (const v of s)
-          res.add(widenVar(v));
-        return res;
-      }
-      __name(widenVarSet, "widenVarSet");
-      function widenPropertyAccessPath(ap) {
-        const w = widenVar(ap.base);
-        if (w === ap.base)
-          return ap;
-        return a.canonicalizeAccessPath(new accesspaths_1.PropertyAccessPath(w, ap.prop));
-      }
-      __name(widenPropertyAccessPath, "widenPropertyAccessPath");
-      function widenCallResultAccessPath(ap) {
-        const w = widenVar(ap.caller);
-        if (w === ap.caller)
-          return ap;
-        return a.canonicalizeAccessPath(new accesspaths_1.CallResultAccessPath(w));
-      }
-      __name(widenCallResultAccessPath, "widenCallResultAccessPath");
-      function widenComponentAccessPath(ap) {
-        const w = widenVar(ap.component);
-        if (w === ap.component)
-          return ap;
-        return a.canonicalizeAccessPath(new accesspaths_1.ComponentAccessPath(w));
-      }
-      __name(widenComponentAccessPath, "widenComponentAccessPath");
-      [solver.unprocessedTokens, solver.diagnostics.unprocessedTokensSize] = widenTokenMapArrayValues(solver.unprocessedTokens);
-      solver.replaceTokens(tokenMap);
-      for (const [_, ls] of f.tokenListeners)
-        for (const [id, _2] of ls) {
-          const { t } = solver.listeners.get(id);
-          if (t instanceof tokens_1.ObjectToken && widened.has(t)) {
-            ls.delete(id);
-          }
-        }
-      f.objectPropertiesListeners = widenTokenMapMapKeys(f.objectPropertiesListeners);
-      for (const [t, pt] of tokenMap) {
-        const props = f.objectProperties.get(t);
-        if (props !== void 0) {
-          f.objectProperties.delete(t);
-          for (const prop of props)
-            solver.addObjectProperty(pt, prop);
-        }
-      }
-      for (const v of [...f.vars, ...f.redirections.keys()]) {
-        const vRep = f.getRepresentative(v);
-        const wRep = f.getRepresentative(widenVar(v));
-        solver.addSubsetEdge(vRep, wRep);
-        solver.redirect(vRep, wRep);
-      }
-      f.dynamicPropertyWrites = widenVarSet(f.dynamicPropertyWrites);
-      for (const e of f.propertyReads)
-        e.base = widenVar(e.base);
-      for (const e of f.maybeEmptyPropertyReads) {
-        if ("result" in e)
-          e.result = widenVar(e.result);
-        e.base = widenVar(e.base);
-      }
-      for (const e of f.maybeEmptyMethodCalls.values()) {
-        e.baseVar = widenVar(e.baseVar);
-        e.calleeVar = widenVar(e.calleeVar);
-        for (let i = 0; i < e.argVars.length; i++) {
-          const a2 = e.argVars[i];
-          if (a2)
-            e.argVars[i] = widenVar(a2);
-        }
-      }
-      for (const e of f.unhandledDynamicPropertyWrites.values())
-        e.src = widenVar(e.src);
-      for (const m of [f.propertyReadAccessPaths, f.propertyWriteAccessPaths])
-        for (const m1 of m.values())
-          for (const m2 of m1.values())
-            for (const e of m2.values()) {
-              e.sub = widenVar(e.sub);
-              e.bp = widenPropertyAccessPath(e.bp);
-            }
-      for (const m of f.callResultAccessPaths.values())
-        for (const e of m.values()) {
-          e.sub = widenVar(e.sub);
-          e.bp = widenCallResultAccessPath(e.bp);
-        }
-      for (const m of f.componentAccessPaths.values())
-        for (const e of m.values()) {
-          e.sub = widenVar(e.sub);
-          e.bp = widenComponentAccessPath(e.bp);
-        }
-      const ms = timer.elapsed();
-      solver.diagnostics.totalWideningTime += ms;
-      if (logger_1.default.isVerboseEnabled())
-        logger_1.default.verbose(`Widening completed in ${(0, timer_1.nanoToMs)(ms)}`);
-    }
-    __name(widenObjects, "widenObjects");
-  }
-});
-
 // lib/analysis/modulefinder.js
 var require_modulefinder = __commonJS({
   "lib/analysis/modulefinder.js"(exports) {
@@ -2231,30 +1796,31 @@ var require_modulefinder = __commonJS({
     var traverse_1 = __importDefault(__require("@babel/traverse"));
     var module_1 = __importDefault(__require("module"));
     function findModules(ast, f, moduleInfo) {
-      function requireModule(str, path) {
+      function loadModule(mode, str, path) {
         if (!module_1.default.isBuiltin(str))
-          f.requireModule(str, path, moduleInfo);
+          f.loadModule(mode, str, path, moduleInfo);
       }
-      __name(requireModule, "requireModule");
+      __name(loadModule, "loadModule");
       (0, traverse_1.default)(ast, {
         CallExpression(path) {
-          if (((0, types_1.isIdentifier)(path.node.callee) && path.node.callee.name === "require" && !path.scope.getBinding(path.node.callee.name) || (0, types_1.isImport)(path.node.callee)) && path.node.arguments.length >= 1) {
+          const imp = (0, types_1.isImport)(path.node.callee);
+          if ((imp || (0, types_1.isIdentifier)(path.node.callee) && path.node.callee.name === "require" && !path.scope.getBinding(path.node.callee.name)) && path.node.arguments.length >= 1) {
             const arg = path.node.arguments[0];
             if ((0, types_1.isStringLiteral)(arg))
-              requireModule(arg.value, path);
+              loadModule(imp ? "module" : "commonjs", arg.value, path);
             else
               f.warnUnsupported(path.node, "Unhandled 'require'");
           }
         },
         ImportDeclaration(path) {
-          requireModule(path.node.source.value, path);
+          loadModule("module", path.node.source.value, path);
         },
         ExportAllDeclaration(path) {
-          requireModule(path.node.source.value, path);
+          loadModule("module", path.node.source.value, path);
         },
         ExportNamedDeclaration(path) {
           if (path.node.source)
-            requireModule(path.node.source.value, path);
+            loadModule("module", path.node.source.value, path);
         }
       });
     }
@@ -2361,29 +1927,29 @@ var require_nativebuilder = __commonJS({
       return mod && mod.__esModule ? mod : { "default": mod };
     };
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.buildNatives = buildNatives;
+    exports.buildGlobalNatives = buildGlobalNatives;
+    exports.buildModuleNatives = buildModuleNatives;
     var tokens_1 = require_tokens();
     var ecmascript_1 = require_ecmascript();
     var nodejs_1 = require_nodejs();
     var options_1 = require_options();
     var logger_1 = __importDefault(require_logger());
-    function buildNatives(solver, moduleInfo, moduleParams) {
-      const moduleSpecialNatives = {};
+    function buildGlobalNatives(solver) {
       const globalSpecialNatives = {};
       const f = solver.fragmentState;
       const a = solver.globalState;
-      solver.phase = "init";
+      solver.phase = "Initializing";
       const models = [ecmascript_1.ecmascriptModels, nodejs_1.nodejsModels];
       for (const m of models) {
-        let defineGlobal = function(name, moduleSpecific = false, invoke, constr = false, hidden = false, init) {
+        let defineGlobal = function(name, invoke, constr = false, hidden = false, init) {
           if (options_1.options.natives || m.name === "ecmascript" || m.name === "nodejs" && ["exports", "module"].includes(name)) {
-            const t = init ? init({ solver, moduleInfo, moduleSpecialNatives, globalSpecialNatives }) : a.canonicalizeToken(new tokens_1.NativeObjectToken(name, moduleSpecific ? moduleInfo : void 0, invoke, constr));
-            (moduleSpecific ? moduleSpecialNatives : globalSpecialNatives)[name] = t;
+            const t = init ? init({ solver, globalSpecialNatives }) : a.canonicalizeToken(new tokens_1.NativeObjectToken(name, void 0, invoke, constr));
+            globalSpecialNatives[name] = t;
             if (!hidden)
-              solver.addTokenConstraint(t, moduleSpecific ? f.varProducer.nodeVar(moduleParams.get(name)) : f.varProducer.objPropVar(globalSpecialNatives["globalThis"], name));
+              solver.addTokenConstraint(t, f.varProducer.objPropVar(globalSpecialNatives["globalThis"], name));
           }
         }, defineGlobalFunction = function(name, invoke, constr = false, hidden = false) {
-          defineGlobal(name, void 0, invoke, constr, hidden);
+          defineGlobal(name, invoke, constr, hidden);
         }, definePrototypeObject = function(name) {
           const t = a.canonicalizeToken(new tokens_1.NativeObjectToken(`${name}.prototype`));
           if (m.name === "ecmascript")
@@ -2415,12 +1981,9 @@ var require_nativebuilder = __commonJS({
         __name(defineMethod, "defineMethod");
         if (logger_1.default.isVerboseEnabled())
           logger_1.default.verbose(`Adding ${m.name}`);
-        if (m.params)
-          for (const v of m.params)
-            defineGlobal(v.name, true, void 0, void 0, void 0, v.init);
         if (m.variables)
           for (const v of m.variables)
-            defineGlobal(v.name, void 0, void 0, void 0, void 0, v.init);
+            defineGlobal(v.name, void 0, void 0, void 0, v.init);
         for (const f2 of m.functions)
           defineGlobalFunction(f2.name, f2.invoke);
         for (const x of m.classes) {
@@ -2437,17 +2000,37 @@ var require_nativebuilder = __commonJS({
               defineMethod(x, f2, pro);
         }
       }
+      return globalSpecialNatives;
+    }
+    __name(buildGlobalNatives, "buildGlobalNatives");
+    function buildModuleNatives(solver, moduleInfo, moduleParams) {
+      const moduleSpecialNatives = {};
+      const f = solver.fragmentState;
+      const a = solver.globalState;
+      const globalSpecialNatives = a.globalSpecialNatives;
+      const models = [ecmascript_1.ecmascriptModels, nodejs_1.nodejsModels];
+      for (const m of models) {
+        let defineGlobal = function(name, init) {
+          if (options_1.options.natives || m.name === "ecmascript" || m.name === "nodejs" && ["exports", "module"].includes(name)) {
+            const t = init ? init({ solver, globalSpecialNatives }) : a.canonicalizeToken(new tokens_1.NativeObjectToken(name, moduleInfo));
+            moduleSpecialNatives[name] = t;
+            solver.addTokenConstraint(t, f.varProducer.nodeVar(moduleParams.get(name)));
+          }
+        };
+        __name(defineGlobal, "defineGlobal");
+        if (m.params)
+          for (const v of m.params)
+            defineGlobal(v.name, v.init);
+      }
       for (const m of models)
         if (m.init) {
           if (logger_1.default.isVerboseEnabled())
             logger_1.default.verbose(`Running initialization for ${m.name}`);
           m.init({ solver, moduleInfo, moduleSpecialNatives, globalSpecialNatives });
         }
-      if (logger_1.default.isVerboseEnabled())
-        logger_1.default.verbose("Adding natives completed");
-      return { moduleSpecialNatives, globalSpecialNatives };
+      return moduleSpecialNatives;
     }
-    __name(buildNatives, "buildNatives");
+    __name(buildModuleNatives, "buildModuleNatives");
   }
 });
 
@@ -3052,6 +2635,7 @@ var require_operations = __commonJS({
     };
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.Operations = void 0;
+    exports.isGlobalNative = isGlobalNative;
     var types_1 = __require("@babel/types");
     var asthelpers_1 = require_asthelpers();
     var tokens_1 = require_tokens();
@@ -3118,6 +2702,7 @@ var require_operations = __commonJS({
         const f = this.solver.fragmentState;
         const vp = this.solver.varProducer;
         const caller = this.a.getEnclosingFunctionOrModule(path);
+        const args = path.node.arguments;
         let p = path.get("callee");
         while (p.isParenthesizedExpression())
           p = p.get("expression");
@@ -3129,8 +2714,31 @@ var require_operations = __commonJS({
         if ((0, asthelpers_1.isMaybeUsedAsPromise)(path))
           f.registerCallWithResultMaybeUsedAsPromise(path.node);
         f.registerInvokedExpression(path.node.callee);
+        let strs;
+        const strings = /* @__PURE__ */ __name(() => strs ??= args.length >= 1 && (0, types_1.isStringLiteral)(args[0]) ? [args[0].value] : this.getRequireHints(pars) ?? [], "strings");
+        if ((0, types_1.isImport)(p.node)) {
+          f.registerCall(pars.node, caller, void 0, { native: true });
+          const v = this.a.canonicalizeVar(new constraintvars_1.IntermediateVar(path.node, "import"));
+          const ss = strings();
+          if (ss.length === 0)
+            f.warnUnsupported(path.node, `Unhandled 'import'${this.a.patching ? " (no hints found)" : ""}`);
+          for (const str of ss)
+            this.loadModule("module", str, v, path);
+          const promise = this.newPromiseToken(path.node);
+          this.solver.addTokenConstraint(promise, this.expVar(path.node, path));
+          this.solver.addSubsetConstraint(v, this.solver.varProducer.objPropVar(promise, ecmascript_1.PROMISE_FULFILLED_VALUES));
+          return;
+        }
         const resultVar = vp.nodeVar(path.node);
-        const args = path.node.arguments;
+        if ((0, types_1.isIdentifier)(p.node) && p.node.name === "require" && path.scope.getBinding(p.node.name)?.identifier.loc?.native === "%nodejs") {
+          f.registerCall(pars.node, caller, void 0, { native: true });
+          const ss = strings();
+          if (ss.length === 0)
+            f.warnUnsupported(path.node, `Unhandled 'require'${this.a.patching ? " (no hints found)" : ""}`);
+          for (const str of ss)
+            this.loadModule("commonjs", str, resultVar, path);
+          return;
+        }
         const argVars = args.map((arg) => {
           if ((0, types_1.isExpression)(arg))
             return this.expVar(arg, path);
@@ -3178,18 +2786,6 @@ var require_operations = __commonJS({
             }
           });
         }
-        const strings = args.length >= 1 && (0, types_1.isStringLiteral)(args[0]) ? [args[0].value] : [];
-        if (path.get("callee").isImport() && args.length >= 1) {
-          const v = this.a.canonicalizeVar(new constraintvars_1.IntermediateVar(path.node, "import"));
-          const ss = strings.length > 0 ? strings : this.getRequireHints(p) ?? [];
-          if (ss.length === 0)
-            f.warnUnsupported(path.node, `Unhandled 'import'${this.a.patching ? " (no hints found)" : ""}`);
-          for (const str of ss)
-            this.requireModule(str, v, path);
-          const promise = this.newPromiseToken(path.node);
-          this.solver.addTokenConstraint(promise, this.expVar(path.node, path));
-          this.solver.addSubsetConstraint(v, this.solver.varProducer.objPropVar(promise, ecmascript_1.PROMISE_FULFILLED_VALUES));
-        }
       }
       callFunctionBound(base, t, calleeVar, argVars, resultVar, strings, path) {
         const f = this.solver.fragmentState;
@@ -3197,8 +2793,6 @@ var require_operations = __commonJS({
         const pars = (0, asthelpers_1.getAdjustedCallNodePath)(path);
         const args = path.node.arguments;
         const isNew = path.isNewExpression();
-        if (base)
-          base = f.maybeWidened(base);
         if (t instanceof tokens_1.FunctionToken)
           this.callFunctionTokenBound(t, base, caller, argVars, resultVar, isNew, path);
         else if (t instanceof tokens_1.NativeObjectToken) {
@@ -3216,11 +2810,11 @@ var require_operations = __commonJS({
               globalSpecialNatives: this.globalSpecialNatives
             });
           if (t.name === "require") {
-            const ss = strings.length > 0 ? strings : this.getRequireHints(pars) ?? [];
+            const ss = strings();
             if (ss.length === 0)
               f.warnUnsupported(path.node, `Unhandled 'require'${this.a.patching ? " (no hints found)" : ""}`);
             for (const str of ss)
-              this.requireModule(str, resultVar, path);
+              this.loadModule("commonjs", str, resultVar, path);
           }
         } else if (t instanceof tokens_1.AllocationSiteToken && (t.kind === "PromiseResolve" || t.kind === "PromiseReject") && !isNew) {
           (0, nativehelpers_1.callPromiseResolve)(t, path.node.arguments, path, this);
@@ -3240,17 +2834,11 @@ var require_operations = __commonJS({
               f.warnUnsupported(args[i], "SpreadElement in arguments to external function");
           }
         }
-        if (!options_1.options.oldobj) {
-          if (isNew && t instanceof tokens_1.FunctionToken) {
-            const q = this.newObjectToken(t.fun);
-            this.solver.addTokenConstraint(q, resultVar);
-            this.solver.addTokenConstraint(q, this.solver.varProducer.thisVar(t.fun));
-            this.solver.addInherits(q, this.solver.varProducer.objPropVar(t, "prototype"));
-          }
-        } else {
-          if (isNew && (t instanceof tokens_1.FunctionToken || t instanceof tokens_1.ClassToken)) {
-            this.solver.addTokenConstraint(this.packageObjectToken, resultVar);
-          }
+        if (isNew && t instanceof tokens_1.FunctionToken) {
+          const q = this.newObjectToken(t.fun);
+          this.solver.addTokenConstraint(q, resultVar);
+          this.solver.addTokenConstraint(q, this.solver.varProducer.thisVar(t.fun));
+          this.solver.addInherits(q, this.solver.varProducer.objPropVar(t, "prototype"));
         }
       }
       callFunctionTokenBound(t, base, caller, args, resultVar, isNew, path, kind = {}) {
@@ -3320,12 +2908,6 @@ var require_operations = __commonJS({
           this.solver.addForAllTokensConstraint(base, listeners_1.TokenListener.READ_BASE, lopts, (t) => {
             if ((0, constraintvars_1.isObjectPropertyVarObj)(t)) {
               this.solver.addSubsetConstraint(this.readPropertyFromChain(t, prop), dst);
-              if (options_1.options.oldobj) {
-                if ((t instanceof tokens_1.FunctionToken || t instanceof tokens_1.ClassToken) && prop === "prototype") {
-                  if (dst)
-                    this.solver.addTokenConstraint(this.packageObjectToken, dst);
-                }
-              }
             } else if (t instanceof tokens_1.AccessPathToken) {
               this.solver.addAccessPath(new accesspaths_1.PropertyAccessPath(base, prop), this.solver.varProducer.nodeVar(node), node, enclosing, t.ap);
             }
@@ -3348,12 +2930,12 @@ var require_operations = __commonJS({
         if (base instanceof tokens_1.ArrayToken && prop === "length")
           return void 0;
         const dst = this.solver.varProducer.readResultVar(base, prop);
-        if (base instanceof tokens_1.FunctionToken && prop === "prototype")
+        if (prop === "prototype" && (0, ecmascript_1.getNativeType)(base) === "Function")
           this.readPropertyBound(base, prop, dst, { t: base, s: prop }, base);
         else if (options_1.options.proto && prop === (0, ecmascript_1.INTERNAL_PROTOTYPE)())
           this.readProto(base, dst);
         else {
-          const nativeProperty = (0, ecmascript_1.isNativeProperty)(base, prop, true);
+          const nativeProperty = (0, ecmascript_1.isNativeMethod)(base, prop, true);
           const objProto = this.globalSpecialNatives?.[ecmascript_1.OBJECT_PROTOTYPE];
           this.solver.addForAllAncestorsConstraint(base, listeners_1.TokenListener.READ_ANCESTORS, { s: prop }, (t2) => {
             if (nativeProperty && t2 !== base && t2 === objProto)
@@ -3370,7 +2952,7 @@ var require_operations = __commonJS({
           this.solver.addTokenConstraint(this.globalSpecialNatives[ecmascript_1.OBJECT_PROTOTYPE], dst);
         else if (t instanceof tokens_1.ArrayToken)
           this.solver.addTokenConstraint(this.globalSpecialNatives[ecmascript_1.ARRAY_PROTOTYPE], dst);
-        else if (t instanceof tokens_1.FunctionToken || t instanceof tokens_1.PrototypeToken || t instanceof tokens_1.ClassToken)
+        else if (t instanceof tokens_1.FunctionToken || t instanceof tokens_1.PrototypeToken)
           this.solver.addTokenConstraint(this.globalSpecialNatives[ecmascript_1.FUNCTION_PROTOTYPE], dst);
         else if (t instanceof tokens_1.AllocationSiteToken) {
           if (t.kind === "Promise")
@@ -3404,27 +2986,15 @@ var require_operations = __commonJS({
         }, "readFromGetter");
         const bindGetterThis = /* @__PURE__ */ __name((baset, t2) => {
           if (t2 instanceof tokens_1.FunctionToken && t2.fun.params.length === 0)
-            this.solver.addTokenConstraint(this.solver.fragmentState.maybeWidened(baset), this.solver.varProducer.thisVar(t2.fun));
+            this.solver.addTokenConstraint(baset, this.solver.varProducer.thisVar(t2.fun));
         }, "bindGetterThis");
         this.solver.addSubsetConstraint(this.solver.varProducer.objPropVar(t, prop), dst);
-        if (!(t instanceof tokens_1.NativeObjectToken && !t.moduleInfo) && prop !== (0, ecmascript_1.INTERNAL_PROTOTYPE)() && prop !== "prototype" && prop !== "toString" && !(0, util_1.isArrayIndex)(prop)) {
+        if (!isGlobalNative(t) && !isUnlikelyGetterSetter(prop)) {
           const getter = this.solver.varProducer.objPropVar(t, prop, "get");
           this.solver.addForAllTokensConstraint(getter, listeners_1.TokenListener.READ_GETTER, dstkey, (t3) => readFromGetter(t3));
           this.solver.addForAllTokensConstraint(getter, listeners_1.TokenListener.READ_GETTER_THIS, { t: thist }, (t3) => bindGetterThis(thist, t3));
         }
-        if (t instanceof tokens_1.PackageObjectToken && t.kind === "Object") {
-          if (options_1.options.readNeighbors)
-            this.solver.addForAllPackageNeighborsConstraint(t.packageInfo, { t, s: prop }, (neighbor) => {
-              if (dst)
-                this.solver.addSubsetConstraint(this.solver.varProducer.packagePropVar(neighbor, prop), dst);
-              if (prop !== "prototype") {
-                const nt = this.a.canonicalizeToken(new tokens_1.PackageObjectToken(neighbor));
-                const getter = this.solver.varProducer.packagePropVar(neighbor, prop, "get");
-                this.solver.addForAllTokensConstraint(getter, listeners_1.TokenListener.READ_GETTER2, dstkey, (t3) => readFromGetter(t3));
-                this.solver.addForAllTokensConstraint(getter, listeners_1.TokenListener.READ_GETTER_THIS2, { t: nt }, (t3) => bindGetterThis(nt, t3));
-              }
-            });
-        } else if (t instanceof tokens_1.ArrayToken) {
+        if (t instanceof tokens_1.ArrayToken) {
           if ((0, util_1.isArrayIndex)(prop)) {
             this.solver.addSubsetConstraint(this.solver.varProducer.arrayUnknownVar(t), dst);
           }
@@ -3440,17 +3010,17 @@ var require_operations = __commonJS({
         }, "writeToSetter");
         const bindSetterThis = /* @__PURE__ */ __name((t) => {
           if (t instanceof tokens_1.FunctionToken && t.fun.params.length === 1)
-            this.solver.addTokenConstraint(this.solver.fragmentState.maybeWidened(base), this.solver.varProducer.thisVar(t.fun));
+            this.solver.addTokenConstraint(base, this.solver.varProducer.thisVar(t.fun));
         }, "bindSetterThis");
         if ((0, constraintvars_1.isObjectPropertyVarObj)(base)) {
-          if (!options_1.options.nativeOverwrites && prop !== "toString" && (0, ecmascript_1.isNativeProperty)(base, prop)) {
+          if (!options_1.options.nativeOverwrites && prop !== "toString" && (0, ecmascript_1.isNativeMethod)(base, prop)) {
             this.solver.fragmentState.warnUnsupported(node, `Ignoring write to native property ${base}.${prop}`);
             return;
           }
           if (src)
             this.solver.addSubsetConstraint(src, this.solver.varProducer.objPropVar(base, prop, ac));
           if (invokeSetters) {
-            if (!(base instanceof tokens_1.NativeObjectToken && !base.moduleInfo) && prop !== (0, ecmascript_1.INTERNAL_PROTOTYPE)() && prop !== "prototype" && prop !== "toString" && !(0, util_1.isArrayIndex)(prop))
+            if (!isGlobalNative(base) && !isUnlikelyGetterSetter(prop))
               this.solver.addForAllAncestorsConstraint(base, listeners_1.TokenListener.WRITE_ANCESTORS, { n: node, s: prop }, (anc) => {
                 if ((0, constraintvars_1.isObjectPropertyVarObj)(anc)) {
                   const setter = this.solver.varProducer.objPropVar(anc, prop, "set");
@@ -3468,7 +3038,7 @@ var require_operations = __commonJS({
           this.solver.fragmentState.registerEscapingToExternal(src, escapeNode, enclosing);
         }
       }
-      requireModule(str, resultVar, path) {
+      loadModule(mode, str, resultVar, path) {
         const f = this.solver.fragmentState;
         const reexport = (0, types_1.isExportDeclaration)(path.node);
         let m;
@@ -3478,12 +3048,12 @@ var require_operations = __commonJS({
           } else
             f.warnUnsupported(path.node, `Ignoring re-export from built-in module '${str}'`);
         } else {
-          m = f.requireModule(str, path, this.moduleInfo);
+          m = f.loadModule(mode, str, path, this.moduleInfo);
           if (m instanceof infos_1.ModuleInfo && m.isIncluded) {
             const fp = (0, asthelpers_1.getEnclosingFunction)(path)?.node;
             const from = fp ? this.a.functionInfos.get(fp) : this.moduleInfo;
             f.registerRequireEdge(from, m);
-            if (m instanceof infos_1.ModuleInfo && !reexport)
+            if (!reexport)
               this.solver.addSubsetConstraint(this.solver.varProducer.objPropVar(this.a.canonicalizeToken(new tokens_1.NativeObjectToken("module", m)), "exports"), resultVar);
           }
           if (m) {
@@ -3617,6 +3187,14 @@ var require_operations = __commonJS({
                 this.solver.addSubsetConstraint(vp.objPropVar(t, ecmascript_1.MAP_VALUES), vp.objPropVar(pair, "1"));
                 break;
               case "Iterator":
+              case "ArrayKeys":
+              case "ArrayValues":
+              case "ArrayEntries":
+              case "SetValues":
+              case "SetEntries":
+              case "MapKeys":
+              case "MapValues":
+              case "MapEntries":
               case "Generator":
                 this.solver.addSubsetConstraint(vp.objPropVar(t, "value"), dst);
                 break;
@@ -3624,14 +3202,9 @@ var require_operations = __commonJS({
         });
       }
       newObjectToken(n) {
-        if (options_1.options.alloc) {
-          const t = this.a.canonicalizeToken(new tokens_1.ObjectToken(n));
-          if (!options_1.options.widening || !this.solver.fragmentState.widened.has(t)) {
-            this.a.patching?.registerAllocationSite(t);
-            return t;
-          }
-        }
-        return this.packageObjectToken;
+        const t = this.a.canonicalizeToken(new tokens_1.ObjectToken(n));
+        this.a.patching?.registerAllocationSite(t);
+        return t;
       }
       newPrototypeToken(fun) {
         const t = this.a.canonicalizeToken(new tokens_1.PrototypeToken(fun));
@@ -3643,9 +3216,6 @@ var require_operations = __commonJS({
         this.a.patching?.registerAllocationSite(t);
         return t;
       }
-      newClassToken(n) {
-        return this.a.canonicalizeToken(new tokens_1.ClassToken(n));
-      }
       newFunctionToken(fun) {
         const t = this.a.canonicalizeToken(new tokens_1.FunctionToken(fun));
         this.a.patching?.registerAllocationSite(t);
@@ -3669,6 +3239,14 @@ var require_operations = __commonJS({
       }
     };
     exports.Operations = Operations;
+    function isUnlikelyGetterSetter(prop) {
+      return prop === (0, ecmascript_1.INTERNAL_PROTOTYPE)() || prop === "prototype" || prop === "toString" || (0, util_1.isArrayIndex)(prop);
+    }
+    __name(isUnlikelyGetterSetter, "isUnlikelyGetterSetter");
+    function isGlobalNative(t) {
+      return t instanceof tokens_1.NativeObjectToken && t.moduleInfo === void 0 && t.name !== "globalThis";
+    }
+    __name(isGlobalNative, "isGlobalNative");
   }
 });
 
@@ -4014,7 +3592,10 @@ var require_processmanager = __commonJS({
       numForcedExceptions = 0;
       numModuleExceptions = 0;
       numStaticFunctions = 0;
-      staticRequires = /* @__PURE__ */ new Map();
+      staticModuleLoads = {
+        "commonjs": /* @__PURE__ */ new Map(),
+        "module": /* @__PURE__ */ new Map()
+      };
       approxTime = 0n;
       totalCodeSize = 0;
       resultPromiseResolve;
@@ -4037,7 +3618,8 @@ ${JSON.stringify(msg, void 0, 2)}`);
           this.numForcedExceptions += msg.numForcedExceptions;
           this.numModuleExceptions += msg.moduleException ? 1 : 0;
           this.numStaticFunctions += msg.numStaticFunctions;
-          (0, util_1.addPairArrayToMapSet)(msg.staticRequires, this.staticRequires);
+          for (const mode of ["commonjs", "module"])
+            (0, util_1.addPairArrayToMapSet)(msg.staticModuleLoads[mode], this.staticModuleLoads[mode]);
           this.totalCodeSize = msg.totalCodeSize;
           this.resultPromiseResolve();
           this.resultPromiseResolve = void 0;
@@ -4060,16 +3642,22 @@ ${JSON.stringify(msg, void 0, 2)}`);
               logger_1.default.info(`Analyzing ${m}`);
             await this.execute(file);
           }
-          const rs = this.staticRequires.get(file);
-          if (rs)
-            for (const r of rs)
-              try {
-                const filepath = (0, files_1.requireResolve)(r, file, this.a);
-                if (filepath)
-                  this.a.reachedFile(filepath, false, m, (0, files_1.isLocalRequire)(r));
-              } catch {
-                logger_1.default.warn(`Unable to resolve module '${r}' from ${file}`);
-              }
+          for (const mode of ["commonjs", "module"]) {
+            const rs = this.staticModuleLoads[mode].get(file);
+            if (rs)
+              for (const r of rs)
+                try {
+                  const filepath = (0, files_1.resolveModule)(mode, r, file, this.a);
+                  if (filepath) {
+                    if (!filepath.startsWith(options_1.options.basedir) && !filepath.startsWith(options_1.options.basedir))
+                      logger_1.default.warning(`Warning: Skipping module '${r}' at ${filepath} outside basedir`);
+                    else
+                      this.a.reachedFile(filepath, false, m, (0, files_1.isLocalRequire)(r));
+                  }
+                } catch (e) {
+                  logger_1.default.warn(`Unable to resolve module '${r}' from ${file}: ${e}`);
+                }
+          }
         }
       }
       stop() {
@@ -4286,7 +3874,6 @@ var require_analyzer = __commonJS({
     var astvisitor_1 = require_astvisitor();
     var infos_1 = require_infos();
     var options_1 = require_options();
-    var widening_1 = require_widening();
     var modulefinder_1 = require_modulefinder();
     var parser_1 = require_parser();
     var escaping_1 = require_escaping();
@@ -4305,26 +3892,17 @@ var require_analyzer = __commonJS({
       const a = solver.globalState;
       const d = solver.diagnostics;
       const timer = new timer_1.default();
-      const fragmentStates = /* @__PURE__ */ new Map();
+      (0, options_1.resolveBaseDir)();
       if (options_1.options.approx || options_1.options.approxLoad) {
         a.approx = new processmanager_1.ProcessManager(a);
         a.patching = new patching_1.Patching(a.approx.hints);
         d.patching = new diagnostics_1.PatchingDiagnostics();
       }
-      function merge(mp) {
-        const f = fragmentStates.get(mp);
-        if (f) {
-          if (logger_1.default.isDebugEnabled())
-            logger_1.default.debug(`Merging state for ${mp}`);
-          solver.merge(f);
-        } else if (logger_1.default.isVerboseEnabled())
-          logger_1.default.verbose(`No state found for ${mp}`);
-      }
-      __name(merge, "merge");
       try {
         if (files.length === 0)
           logger_1.default.info("Error: No files to analyze");
         else {
+          a.globalSpecialNatives = (0, nativebuilder_1.buildGlobalNatives)(solver);
           for (const file of files)
             a.entryFiles.add((0, path_1.resolve)(options_1.options.basedir, file));
           for (const file of a.entryFiles)
@@ -4334,106 +3912,79 @@ var require_analyzer = __commonJS({
               logger_1.default.info(`Loading ${options_1.options.approxLoad}`);
             a.approx.add(JSON.parse((0, fs_1.readFileSync)(options_1.options.approxLoad, "utf-8")));
           }
-          for (const file of a.pendingFiles) {
-            const moduleInfo = a.getModuleInfo(file);
-            solver.prepare();
-            d.modules++;
-            if (!options_1.options.modulesOnly && options_1.options.printProgress)
-              logger_1.default.info(`Analyzing module ${moduleInfo} (${d.modules})`);
-            const str = fs_1.default.readFileSync(file, "utf8");
-            (0, logger_1.writeStdOutIfActive)(`Parsing ${file} (${Math.ceil(str.length / 1024)}KB)...`);
-            const ast = (0, parser_1.parseAndDesugar)(str, file, solver.fragmentState);
-            if (!ast) {
-              a.filesWithParseErrors.push(file);
-              continue;
-            }
-            moduleInfo.loc = ast.program.loc;
-            a.modules.set(moduleInfo, ast.program);
-            a.filesAnalyzed.push(file);
-            const fileSize = (0, fs_1.statSync)(file).size;
-            d.codeSize += fileSize;
-            if (moduleInfo.packageInfo.isEntry)
-              d.codeSizeMain += fileSize;
-            else
-              d.codeSizeDependencies += fileSize;
-            if (options_1.options.approx) {
-              if (a.approx.hints.moduleIndex.has(moduleInfo.toString())) {
-                if (logger_1.default.isVerboseEnabled())
-                  logger_1.default.verbose(`Skipping approximate interpretation of module ${file}, already visited`);
-              } else {
-                (0, logger_1.writeStdOutIfActive)(`Approximate interpretation...`);
-                await a.approx.execute(file);
-              }
-            }
-            if (options_1.options.modulesOnly) {
-              (0, modulefinder_1.findModules)(ast, solver.fragmentState, moduleInfo);
-              if (d.modules % 16 === 0)
-                a.timeoutTimer.checkTimeout();
-            } else {
-              const moduleParams = (0, extras_1.preprocessAst)(ast, moduleInfo);
-              (0, logger_1.writeStdOutIfActive)("Initializing...");
-              const { moduleSpecialNatives, globalSpecialNatives } = (0, nativebuilder_1.buildNatives)(solver, moduleInfo, moduleParams);
-              a.globalSpecialNatives = globalSpecialNatives;
-              (0, logger_1.writeStdOutIfActive)("Traversing AST...");
-              solver.fragmentState.maybeEscaping.clear();
-              (0, astvisitor_1.visit)(ast, new operations_1.Operations(moduleInfo, solver, moduleSpecialNatives));
-              await solver.propagate("module");
-              if (options_1.options.alloc && options_1.options.widening) {
-                const escaping = (0, escaping_1.findEscapingObjects)(moduleInfo, solver);
-                (0, widening_1.widenObjects)(escaping, solver);
-                await solver.propagate("widening");
+          while (a.pendingFiles.isNonEmpty()) {
+            while (a.pendingFiles.isNonEmpty()) {
+              for (const file of a.pendingFiles) {
+                const moduleInfo = a.getModuleInfo(file);
+                d.modules++;
+                d.packages = a.packageInfos.size;
+                if (!options_1.options.modulesOnly && options_1.options.printProgress)
+                  logger_1.default.info(`Analyzing module ${moduleInfo} (${d.modules})`);
+                const str = fs_1.default.readFileSync(file, "utf8");
+                (0, logger_1.writeStdOutIfActive)(`Parsing ${file} (${Math.ceil(str.length / 1024)}KB)...`);
+                const ast = (0, parser_1.parseAndDesugar)(str, file, solver.fragmentState);
+                if (!ast) {
+                  a.filesWithParseErrors.push(file);
+                  continue;
+                }
+                moduleInfo.loc = ast.program.loc;
+                a.modules.set(moduleInfo, ast.program);
+                a.filesAnalyzed.push(file);
+                const fileSize = (0, fs_1.statSync)(file).size;
+                d.codeSize += fileSize;
+                if (moduleInfo.packageInfo.isEntry)
+                  d.codeSizeMain += fileSize;
+                else
+                  d.codeSizeDependencies += fileSize;
+                if (options_1.options.approx) {
+                  if (a.approx.hints.moduleIndex.has(moduleInfo.toString())) {
+                    if (logger_1.default.isVerboseEnabled())
+                      logger_1.default.verbose(`Skipping approximate interpretation of module ${file}, already visited`);
+                  } else {
+                    (0, logger_1.writeStdOutIfActive)(`Approximate interpretation...`);
+                    await a.approx.execute(file);
+                  }
+                }
+                if (options_1.options.modulesOnly) {
+                  (0, modulefinder_1.findModules)(ast, solver.fragmentState, moduleInfo);
+                  if (d.modules % 16 === 0)
+                    a.timeoutTimer.checkTimeout();
+                } else {
+                  const moduleParams = (0, extras_1.preprocessAst)(ast, moduleInfo);
+                  (0, logger_1.writeStdOutIfActive)("Traversing AST...");
+                  (0, astvisitor_1.visit)(ast, new operations_1.Operations(moduleInfo, solver, (0, nativebuilder_1.buildModuleNatives)(solver, moduleInfo, moduleParams)));
+                }
+                ast.tokens = void 0;
               }
-              if (logger_1.default.isDebugEnabled())
-                logger_1.default.debug(`Shelving state for ${moduleInfo}`);
-              fragmentStates.set(moduleInfo, solver.fragmentState);
+              await solver.propagate("Analyzing");
               solver.updateDiagnostics();
             }
-            ast.tokens = void 0;
-          }
-          if (!options_1.options.modulesOnly) {
-            if (options_1.options.printProgress)
-              logger_1.default.info("Analyzing combined modules");
-            solver.prepare();
-            const allModules = [];
-            for (const p of a.packageInfos.values()) {
-              await solver.checkAbort();
-              if (!p.modules.values().some((m) => fragmentStates.has(m)))
-                continue;
-              d.packages++;
-              for (const m of p.modules.values()) {
-                merge(m);
-                allModules.push(m);
+            if (!options_1.options.modulesOnly) {
+              if (options_1.options.patchEscaping) {
+                const t = new timer_1.default();
+                (0, escaping_1.findEscapingObjects)(Array.from(a.moduleInfos.values()), solver);
+                await solver.propagate("Escape patching");
+                d.totalEscapePatchingTime += t.elapsed();
               }
-              for (const d2 of p.directDependencies)
-                solver.addPackageNeighbor(p, d2);
-            }
-            await solver.propagate("main");
-            if (options_1.options.patchEscaping) {
-              const t = new timer_1.default();
-              (0, escaping_1.findEscapingObjects)(allModules, solver);
-              await solver.propagate("escape patching");
-              d.totalEscapePatchingTime += t.elapsed();
-            }
-            if (options_1.options.approx || options_1.options.approxLoad) {
-              const t = new timer_1.default();
-              a.patching.patch(solver);
-              await solver.propagate("approximate patching");
-              d.totalApproxPatchingTime += t.elapsed();
-            }
-            if (options_1.options.patchDynamics || options_1.options.patchMethodCalls || options_1.options.patchThis) {
-              const t = new timer_1.default();
-              if (options_1.options.patchDynamics)
-                (0, patchdynamics_1.patchDynamics)(solver);
-              if (options_1.options.patchMethodCalls)
-                (0, patchmethodcalls_1.patchMethodCalls)(solver);
-              if (options_1.options.patchThis)
-                (0, patchthis_1.patchThis)(solver);
-              await solver.propagate("extra patching");
-              d.totalOtherPatchingTime += t.elapsed();
+              if (options_1.options.approx || options_1.options.approxLoad) {
+                const t = new timer_1.default();
+                a.patching.patch(solver);
+                await solver.propagate("Approximate patching");
+                d.totalApproxPatchingTime += t.elapsed();
+              }
+              if (options_1.options.patchDynamics || options_1.options.patchMethodCalls || options_1.options.patchThis) {
+                const t = new timer_1.default();
+                if (options_1.options.patchDynamics)
+                  (0, patchdynamics_1.patchDynamics)(solver);
+                if (options_1.options.patchMethodCalls)
+                  (0, patchmethodcalls_1.patchMethodCalls)(solver);
+                if (options_1.options.patchThis)
+                  (0, patchthis_1.patchThis)(solver);
+                await solver.propagate("Extra patching");
+                d.totalOtherPatchingTime += t.elapsed();
+              }
+              solver.updateDiagnostics();
             }
-            if (a.pendingFiles.isNonEmpty())
-              solver.fragmentState.warn("Unexpected module");
-            solver.updateDiagnostics();
           }
         }
         const f = solver.fragmentState;
@@ -4492,9 +4043,9 @@ var require_analyzer = __commonJS({
             if (options_1.options.maxWaves !== void 0)
               logger_1.default.info(`Fixpoint wave limit reached: ${d.waveLimitReached} time${d.waveLimitReached !== 1 ? "s" : ""}`);
             logger_1.default.info(`Constraint vars: ${f.getNumberOfVarsWithTokens()} (${f.vars.size}), tokens: ${d.tokens}, subset edges: ${d.subsetEdges}, max tokens: ${f.getLargestTokenSetSize()}, max subset out: ${f.getLargestSubsetEdgeOutDegree()}, redirections: ${f.redirections.size}`);
-            logger_1.default.info(`Listeners (notifications) token: ${(0, util_1.mapMapSize)(f.tokenListeners)} (${d.tokenListenerNotifications}), bounded: ${(0, util_1.mapMapSize)(f.tokenListeners2)} (${d.tokenListener2Notifications}), ` + (options_1.options.readNeighbors ? `neighbor: ${(0, util_1.mapMapSize)(f.packageNeighborListeners)} (${d.packageNeighborListenerNotifications}), ` : "") + `array: ${(0, util_1.mapMapSize)(f.arrayEntriesListeners)} (${d.arrayEntriesListenerNotifications}), obj: ${(0, util_1.mapMapSize)(f.objectPropertiesListeners)} (${d.objectPropertiesListenerNotifications})`);
+            logger_1.default.info(`Listeners (notifications) token: ${(0, util_1.mapMapSize)(f.tokenListeners)} (${d.tokenListenerNotifications}), bounded: ${(0, util_1.mapMapSize)(f.tokenListeners2)} (${d.tokenListener2Notifications}), array: ${(0, util_1.mapMapSize)(f.arrayEntriesListeners)} (${d.arrayEntriesListenerNotifications}), obj: ${(0, util_1.mapMapSize)(f.objectPropertiesListeners)} (${d.objectPropertiesListenerNotifications})`);
             logger_1.default.info(`Canonicalize vars: ${a.canonicalConstraintVars.size} (${a.numberOfCanonicalizeVarCalls}), tokens: ${a.canonicalTokens.size} (${a.numberOfCanonicalizeTokenCalls}), access paths: ${a.canonicalAccessPaths.size} (${a.numberOfCanonicalizeAccessPathCalls})`);
-            logger_1.default.info(`Propagation: ${(0, timer_1.nanoToMs)(d.totalPropagationTime)}, listeners: ${(0, timer_1.nanoToMs)(d.totalListenerCallTime)}, fragment merging: ${(0, timer_1.nanoToMs)(d.totalFragmentMergeTime)}` + (options_1.options.alloc && options_1.options.widening ? `, widening: ${(0, timer_1.nanoToMs)(d.totalWideningTime)}` : "") + `, finalization: ${(0, timer_1.nanoToMs)(d.finalizationTime)}`);
+            logger_1.default.info(`Propagation: ${(0, timer_1.nanoToMs)(d.totalPropagationTime)}, listeners: ${(0, timer_1.nanoToMs)(d.totalListenerCallTime)}, finalization: ${(0, timer_1.nanoToMs)(d.finalizationTime)}`);
             logger_1.default.info(`Patching time escape: ${(0, timer_1.nanoToMs)(d.totalEscapePatchingTime)}, approx: ${(0, timer_1.nanoToMs)(d.totalApproxPatchingTime)}, other: ${(0, timer_1.nanoToMs)(d.totalOtherPatchingTime)}`);
             if (options_1.options.cycleElimination)
               logger_1.default.info(`Cycle elimination: ${(0, timer_1.nanoToMs)(d.totalCycleEliminationTime)}, runs: ${d.totalCycleEliminationRuns}, nodes removed: ${f.redirections.size}`);
@@ -9873,7 +9424,7 @@ var require_vulnerabilities = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.getVulnerabilityId = getVulnerabilityId;
     function getVulnerabilityId(v) {
-      return "id" in v.osv ? v.osv.id : v.osv.url;
+      return "osv" in v ? v.osv.id : v.npm.url;
     }
     __name(getVulnerabilityId, "getVulnerabilityId");
   }
@@ -10493,6 +10044,9 @@ var require_identifiers = __commonJS({
     "use strict";
     var numeric = /^[0-9]+$/;
     var compareIdentifiers = /* @__PURE__ */ __name((a, b) => {
+      if (typeof a === "number" && typeof b === "number") {
+        return a === b ? 0 : a < b ? -1 : 1;
+      }
       const anum = numeric.test(a);
       const bnum = numeric.test(b);
       if (anum && bnum) {
@@ -10602,7 +10156,25 @@ var require_semver = __commonJS({
         if (!(other instanceof _SemVer)) {
           other = new _SemVer(other, this.options);
         }
-        return compareIdentifiers(this.major, other.major) || compareIdentifiers(this.minor, other.minor) || compareIdentifiers(this.patch, other.patch);
+        if (this.major < other.major) {
+          return -1;
+        }
+        if (this.major > other.major) {
+          return 1;
+        }
+        if (this.minor < other.minor) {
+          return -1;
+        }
+        if (this.minor > other.minor) {
+          return 1;
+        }
+        if (this.patch < other.patch) {
+          return -1;
+        }
+        if (this.patch > other.patch) {
+          return 1;
+        }
+        return 0;
       }
       comparePre(other) {
         if (!(other instanceof _SemVer)) {
@@ -11369,6 +10941,7 @@ var require_range = __commonJS({
       return result;
     }, "isSatisfiable");
     var parseComparator = /* @__PURE__ */ __name((comp, options) => {
+      comp = comp.replace(re[t.BUILD], "");
       debug("comp", comp, options);
       comp = replaceCarets(comp, options);
       debug("caret", comp);
@@ -12595,13 +12168,15 @@ var require_vulnerabilitydetector = __commonJS({
       constructor(vs) {
         const c = new patternparser_1.AccessPathPatternCanonicalizer();
         for (const v of vs) {
-          if ("affected" in v.osv && v.osv.affected) {
-            for (const affected of v.osv.affected)
-              if (affected.package && affected.package.ecosystem === "npm")
-                (0, util_1.mapGetArray)(this.vulnerabilities, affected.package.name).push(v);
-          } else if ("dependency" in v.osv)
-            (0, util_1.mapGetArray)(this.vulnerabilities, v.osv.dependency).push(v);
-          if (v.patterns)
+          if ("osv" in v) {
+            if (v.osv.affected) {
+              for (const affected of v.osv.affected)
+                if (affected.package)
+                  (0, util_1.mapGetArray)(this.vulnerabilities, affected.package.name).push(v);
+            }
+          } else if ("npm" in v)
+            (0, util_1.mapGetArray)(this.vulnerabilities, v.npm.name).push(v);
+          if ("patterns" in v)
             for (const p of v.patterns) {
               try {
                 (0, util_1.mapGetArray)(this.patterns, v).push((0, patternparser_1.parseDetectionPattern)(p, c));
@@ -12624,7 +12199,7 @@ ${p} (${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
         const vs = this.vulnerabilities.get(packageInfo.name);
         if (vs) {
           for (const v of vs)
-            if (this.checkPackageMatchesOpenSourceVulnerability(packageInfo, v.osv)) {
+            if (this.checkPackageMatchesVulnerability(packageInfo, v)) {
               (0, util_1.mapGetSet)(this.vulnerabilityPackageMatches, packageInfo).add(v);
               logger_1.default.info(`Detected vulnerable package ${packageInfo} (vulnerability: ${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
             }
@@ -12634,21 +12209,21 @@ ${p} (${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
         const vs = this.vulnerabilityPackageMatches.get(moduleInfo.packageInfo);
         if (vs) {
           for (const v of vs)
-            if (this.checkModuleContainsVulnerabilityLocation(moduleInfo, v.location)) {
+            if (!("loc" in v) || v.loc.filename === moduleInfo.relativePath) {
               (0, util_1.mapGetSet)(this.vulnerabilityModuleMatches, moduleInfo).add(v);
               logger_1.default.info(`Detected vulnerable module ${moduleInfo} (vulnerability: ${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
-              if (v.location && !v.location.line && !v.location.code)
+              if ("loc" in v && !("start" in v.loc))
                 (0, util_1.mapGetSet)(this.vulnerabilityFunctionMatches, moduleInfo).add(v);
             }
         }
       }
-      reachedFunction(fun, functionInfo) {
-        const vs = this.vulnerabilityModuleMatches.get(functionInfo.moduleInfo);
+      reachedFunction(fun) {
+        const vs = this.vulnerabilityModuleMatches.get(fun.moduleInfo);
         if (vs) {
           for (const v of vs)
-            if (this.checkFunctionContainsVulnerabilityLocation(fun, v.location)) {
-              (0, util_1.mapGetSet)(this.vulnerabilityFunctionMatches, functionInfo).add(v);
-              logger_1.default.info(`Detected vulnerable function ${functionInfo} (vulnerability: ${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
+            if ("loc" in v && "start" in v.loc && v.loc.start.line == fun.loc.start.line && v.loc.start.column == fun.loc.start.column && v.loc.end.line == fun.loc.end.line && v.loc.end.column == fun.loc.end.column) {
+              (0, util_1.mapGetSet)(this.vulnerabilityFunctionMatches, fun).add(v);
+              logger_1.default.info(`Detected vulnerable function ${fun} (vulnerability: ${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
             }
         }
       }
@@ -12735,30 +12310,44 @@ ${p} (${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
         return res;
       }
       reportResults(f, vulnerabilities) {
+        let cp = 0, cm = 0, cf = 0, cc = 0;
         if (vulnerabilities.package) {
           for (const [src, vs] of vulnerabilities.package)
             if (src.isEntry)
-              for (const v of vs)
+              for (const v of vs) {
                 logger_1.default.info(`Vulnerability warning: Entry package ${src} depends on package with vulnerability ${(0, vulnerabilities_1.getVulnerabilityId)(v)}`);
+                cp++;
+              }
         }
         if (vulnerabilities.module) {
           for (const [src, vs] of vulnerabilities.module)
             if (src.packageInfo.isEntry)
-              for (const v of vs)
+              for (const v of vs) {
                 logger_1.default.info(`Vulnerability warning: Entry package module ${src} depends on module with vulnerability ${(0, vulnerabilities_1.getVulnerabilityId)(v)}`);
+                cm++;
+              }
         }
         if (vulnerabilities.function) {
           for (const [src, vs] of vulnerabilities.function)
             if (src.packageInfo.isEntry)
-              for (const v of vs)
+              for (const v of vs) {
                 logger_1.default.info(`Vulnerability warning: Entry package function ${src} may reach function with vulnerability ${(0, vulnerabilities_1.getVulnerabilityId)(v)}`);
+                cf++;
+              }
         }
         if (vulnerabilities.call) {
           for (const [src, vs] of vulnerabilities.call)
             if (src.loc?.module?.packageInfo.isEntry)
-              for (const v of vs)
+              for (const v of vs) {
                 logger_1.default.info(`Vulnerability warning: Entry package function call site ${(0, util_1.locationToStringWithFile)(src.loc)} may reach function with vulnerability ${(0, vulnerabilities_1.getVulnerabilityId)(v)}`);
+                cc++;
+              }
         }
+        logger_1.default.info(`Vulnerability summary:
+  Entry packages that depend on package with vulnerability: ${cp}
+  Entry package that depend on module with vulnerability: ${cm}
+  Entry package functions that may reach function with vulnerability: ${cf}
+  Entry package function call site that may reach function vulnerability: ${cc}`);
         if (logger_1.default.isDebugEnabled()) {
           if (vulnerabilities.package) {
             for (const [src, vs] of vulnerabilities.package)
@@ -12796,69 +12385,55 @@ ${p} (${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
             }
           }
       }
-      checkPackageMatchesOpenSourceVulnerability(p, osv) {
-        if ("affected" in osv && osv.affected) {
-          for (const affected of osv.affected)
-            if (affected.package && affected.package.ecosystem === "npm" && affected.package.name === p.name) {
-              if (p.version === void 0)
-                return true;
-              if (affected.versions) {
-                for (const version of affected.versions)
-                  if (version === p.version)
-                    return true;
-              }
-              if (affected.ranges) {
-                for (const range of affected.ranges) {
-                  let beforeLimits = false;
-                  if (!range.events.some((event) => "limit" in event))
-                    beforeLimits = true;
-                  else
-                    for (const event of range.events)
-                      if (event.limit && (event.limit === "*" || (0, semver_1.lt)(p.version, event.limit))) {
-                        beforeLimits = true;
-                        break;
+      checkPackageMatchesVulnerability(p, v) {
+        if ("osv" in v) {
+          if (v.osv.affected) {
+            for (const affected of v.osv.affected)
+              if (affected.package && affected.package.name === p.name) {
+                if (p.version === void 0)
+                  return true;
+                if (affected.versions) {
+                  for (const version of affected.versions)
+                    if (version === p.version)
+                      return true;
+                }
+                if (affected.ranges) {
+                  for (const range of affected.ranges) {
+                    let beforeLimits = false;
+                    if (!range.events.some((event) => "limit" in event))
+                      beforeLimits = true;
+                    else
+                      for (const event of range.events)
+                        if (event.limit && (event.limit === "*" || (0, semver_1.lt)(p.version, event.limit))) {
+                          beforeLimits = true;
+                          break;
+                        }
+                    if (beforeLimits) {
+                      let match = false;
+                      for (const event of range.events) {
+                        if (event.introduced && (event.introduced === "0" || (0, semver_1.gte)(p.version, event.introduced)))
+                          match = true;
+                        else if (event.fixed && (0, semver_1.gte)(p.version, event.fixed))
+                          match = false;
+                        else if (event.last_affected && (0, semver_1.gt)(p.version, event.last_affected))
+                          match = false;
                       }
-                  if (beforeLimits) {
-                    let match = false;
-                    for (const event of range.events) {
-                      if (event.introduced && (event.introduced === "0" || (0, semver_1.gte)(p.version, event.introduced)))
-                        match = true;
-                      else if (event.fixed && (0, semver_1.gte)(p.version, event.fixed))
-                        match = false;
-                      else if (event.last_affected && (0, semver_1.gt)(p.version, event.last_affected))
-                        match = false;
+                      if (match)
+                        return true;
                     }
-                    if (match)
-                      return true;
                   }
                 }
               }
-            }
-        }
-        if ("url" in osv) {
-          if (osv.dependency === p.name) {
+          }
+        } else if ("npm" in v) {
+          if (v.npm.name === p.name) {
             if (p.version === void 0)
               return true;
-            return (0, semver_1.satisfies)(p.version, osv.range);
+            return (0, semver_1.satisfies)(p.version, v.npm.range);
           }
         }
         return false;
       }
-      checkModuleContainsVulnerabilityLocation(moduleInfo, loc) {
-        return Boolean(loc && loc.file === moduleInfo.relativePath);
-      }
-      checkFunctionContainsVulnerabilityLocation(fun, loc) {
-        if (!(loc && loc.file && loc.line && loc.code))
-          return false;
-        const source = fun.getSource();
-        const firstMatch = source.indexOf(loc.code);
-        if (firstMatch === -1)
-          return false;
-        const multipleMatches = source.indexOf(loc.code, firstMatch + 1) !== -1;
-        if (!multipleMatches)
-          return true;
-        return Boolean(fun.node.loc?.start.line && fun.node.loc?.end.line && fun.node.loc?.start.line <= loc.line + 1 && loc.line <= fun.node.loc?.end.line + 1);
-      }
       patternMatch(fragmentState, typer, diagnostics) {
         const res = /* @__PURE__ */ new Map();
         (0, logger_1.writeStdOutIfActive)("Pattern matching...");
@@ -12866,7 +12441,7 @@ ${p} (${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
           const matcher = new patternmatcher_1.PatternMatcher(fragmentState, typer);
           for (const [v, ps] of this.patterns)
             for (const p of ps) {
-              const moduleFilter = /* @__PURE__ */ __name((m) => m instanceof infos_1.DummyModuleInfo || this.checkPackageMatchesOpenSourceVulnerability(m.packageInfo, v.osv), "moduleFilter");
+              const moduleFilter = /* @__PURE__ */ __name((m) => m instanceof infos_1.DummyModuleInfo || this.checkPackageMatchesVulnerability(m.packageInfo, v), "moduleFilter");
               for (const m of matcher.findDetectionPatternMatches(p, diagnostics, moduleFilter)) {
                 logger_1.default.info(`Vulnerability pattern match: ${p} at ${(0, util_1.locationToStringWithFileAndEnd)(m.exp.loc)} (vulnerability: ${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
                 (0, util_1.mapGetSetPair)(res, m.exp, m.encl).add(v);
@@ -12907,7 +12482,7 @@ ${p} (${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
         }
         const d = this.diagnostics;
         d.vulnerabilityCollectionTime = t.elapsed();
-        d.distinctVulnerabilities = this.vulnerabilityPackageMatches.values().reduce((p, c) => ((0, util_1.addAll)(c, p), p), /* @__PURE__ */ new Set()).size;
+        d.distinctVulnerabilities = pcks.values().reduce((p, c) => ((0, util_1.addAll)(c, p), p), /* @__PURE__ */ new Set()).size;
         d.packagesWithVulnerabilityLocationMatches = this.vulnerabilityPackageMatches.size;
         d.modulesWithVulnerabilityLocationMatches = this.vulnerabilityModuleMatches.size;
         d.functionsWithVulnerabilityLocationMatches = this.vulnerabilityFunctionMatches.size;
@@ -13405,7 +12980,7 @@ var require_main = __commonJS({
     var processmanager_1 = require_processmanager();
     var semver_1 = __importDefault(require_semver2());
     var ENGINES_NODE = require_package()?.engines?.node;
-    commander_1.program.name("jelly").version(options_1.VERSION).addHelpText("before", options_1.COPYRIGHT).option("-b, --basedir <directory>", "base directory for files to analyze (default: auto-detect)").option("-f, --logfile <file>", "log to file (default: log to stdout)").option("-l, --loglevel <level>", "log level (debug/verbose/info/warn/error)", "info").option("-i, --timeout <seconds>", "limit analysis time").option("-a, --dataflow-html <file>", "save data-flow graph as HTML file").option("-m, --callgraph-html <file>", "save call graph as HTML file").option("-j, --callgraph-json <file>", "save call graph as JSON file").option("-s, --soundness <file>", "compare with dynamic call graph").option("-n, --graal-home <directory>", "home of graal-nodejs (default: $GRAAL_HOME)").option("-d, --dynamic <file>", "generate call graph dynamically, no static analysis").option("--approx", "enable approximate interpretation").option("--approx-only <file>", "perform approximate interpretation, no static analysis").option("--approx-load <file>", "use pre-computed approximate interpretation results").option("-p, --patterns <file...>", "files containing API usage patterns to detect").option("-v, --vulnerabilities <file>", "report vulnerability matches").option("--vulnerabilities-json <json>", "report vulnerability matches (patterns given as JSON string)").option("--include-packages <package...>", "include only dependencies in this list").option("--exclude-packages <package...>", "exclude dependencies in this list").option("--ignore-dependencies", "don't include dependencies in analysis").option("--ignore-unresolved", "don't report errors about unresolved modules").option("--npm-test <dir>", "run 'npm test' instead of 'node' (use with -d)").option("--callgraph", "report call graph").option("--tokens-json <file>", "save tokens for constraint variables as JSON file").option("--tokens", "report tokens for constraint variables").option("--largest", "report largest token sets and subset relations").option("--no-cycle-elimination", "disable cycle elimination").option("--no-natives", "disable nonessential models of native libraries").option("--test-graal", "test graal-nodejs (use with -d)").option("--no-print-progress", "don't print analysis progress information").option("--no-tty", "don't print solver progress for TTY").option("--warnings-unsupported", "print warnings about unsupported features").option("--gc", "enable garbage collection for more accurate memory usage reporting").option("--typescript", "enable TypeScript type inference (use with -p)").option("--api-usage", "report API usage of external packages (implies --ignore-dependencies)").option("--api-exported", "report API of modules").option("--find-access-paths <location>", "find access paths for source location (file:line)").option("--higher-order-functions", "report higher-order functions").option("--zeros", "report calls with zero callees and functions with zero callers").option("--exclude-entries <glob...>", "files to exclude when specifying entry directories").option("--tracked-modules <glob...>", "modules to track usage of (default: auto-detect)").option("--external-matches", "enable pattern matches from external code").option("--no-callgraph-implicit", "omit implicit calls in call graph").option("--no-callgraph-native", "omit native calls in call graph").option("--no-callgraph-require", "omit module loading in call graph").option("--no-callgraph-external", "omit heuristic external callbacks in call graph").option("--diagnostics", "report internal analysis diagnostics").option("--diagnostics-json <file>", "save analysis diagnostics in JSON file").option("--variable-kinds", "report constraint variable kinds").option("--max-waves <number>", "limit number of fixpoint waves").option("--max-indirections <number>", "limit number of function call and property write indirections").option("--full-indirection-bounding", "enable indirection bounding for method calls and property reads (use with --max-indirections)").option("--typescript-library-usage <file>", "save TypeScript library usage in JSON file, no analysis").option("--modules-only", "report reachable packages and modules only, no analysis").option("--compare-callgraphs", "compare two call graphs given as JSON files, no analysis").option("--reachability", "compare call graph reachability (use with -s or --compare-callgraphs)").option("--library", "assume program is a library (default: true if in node_modules)").option("--skip-tests", "skip files that look like tests").option("--no-alloc", "disable allocation site abstraction").option("--oldobj", "old object abstraction").option("--widening", "enable object widening").option("--no-patch-escaping", "disable patching using escape analysis").option("--patch-dynamics", "enable dynamic property access patching heuristic").option("--patch-method-calls", "enable method call patching heuristic").option("--no-patch-this", "disable 'this' patching heuristic").option("--read-neighbors", "enable package neighbor heuristic").option("--proto", "enable model of assignments to the __proto__ property").option("--obj-spread", "enable model of spread syntax for object literals ({...obj})").option("--native-overwrites", "allow overwriting of native object properties").option("--ignore-imprecise-native-calls", "ignore imprecise native calls").option("--matches-json <file>", "save vulnerability pattern matches in JSON file").option("--reachable-json <file>", "save reachable packages and modules in JSON file").option("--callstacks-json <file>", "save vulnerability call stacks in JSON file").option("--vulnerabilities-full", "full report of vulnerabilities").option("--modules-json <file>", "save modules dependencies in JSON file").usage("[options] [files]").addHelpText("after", `
+    commander_1.program.name("jelly").version(options_1.VERSION).addHelpText("before", options_1.COPYRIGHT).option("-b, --basedir <directory>", "base directory for files to analyze (default: auto-detect)").option("-f, --logfile <file>", "log to file (default: log to stdout)").option("-l, --loglevel <level>", "log level (debug/verbose/info/warn/error)", "info").option("-i, --timeout <seconds>", "limit analysis time").option("-a, --dataflow-html <file>", "save data-flow graph as HTML file").option("-m, --callgraph-html <file>", "save call graph as HTML file").option("-j, --callgraph-json <file>", "save call graph as JSON file").option("-s, --soundness <file>", "compare with dynamic call graph").option("-n, --graal-home <directory>", "home of graal-nodejs (default: $GRAAL_HOME)").option("-d, --dynamic <file>", "generate call graph dynamically, no static analysis").option("--approx", "enable approximate interpretation").option("--approx-only <file>", "perform approximate interpretation, no static analysis").option("--approx-load <file>", "use pre-computed approximate interpretation results").option("-p, --patterns <file...>", "files containing API usage patterns to detect").option("-v, --vulnerabilities <file>", "report vulnerability matches").option("--vulnerabilities-json <json>", "report vulnerability matches (patterns given as JSON string)").option("--include-packages <package...>", "include only dependencies in this list").option("--exclude-packages <package...>", "exclude dependencies in this list").option("--ignore-dependencies", "don't include dependencies in analysis").option("--ignore-unresolved", "don't report errors about unresolved modules").option("--npm-test <dir>", "run 'npm test' instead of 'node' (use with -d)").option("--callgraph", "report call graph").option("--tokens-json <file>", "save tokens for constraint variables as JSON file").option("--tokens", "report tokens for constraint variables").option("--largest", "report largest token sets and subset relations").option("--no-cycle-elimination", "disable cycle elimination").option("--no-natives", "disable nonessential models of native libraries").option("--test-graal", "test graal-nodejs (use with -d)").option("--no-print-progress", "don't print analysis progress information").option("--no-tty", "don't print solver progress for TTY").option("--warnings-unsupported", "print warnings about unsupported features").option("--gc", "enable garbage collection for more accurate memory usage reporting").option("--typescript", "enable TypeScript type inference (use with -p)").option("--api-usage", "report API usage of external packages (implies --ignore-dependencies)").option("--api-exported", "report API of modules").option("--find-access-paths <location>", "find access paths for source location (file:line)").option("--higher-order-functions", "report higher-order functions").option("--zeros", "report calls with zero callees and functions with zero callers").option("--exclude-entries <glob...>", "files to exclude when specifying entry directories").option("--tracked-modules <glob...>", "modules to track usage of (default: auto-detect)").option("--external-matches", "enable pattern matches from external code").option("--no-callgraph-implicit", "omit implicit calls in call graph").option("--no-callgraph-native", "omit native calls in call graph").option("--no-callgraph-require", "omit module loading in call graph").option("--no-callgraph-external", "omit heuristic external callbacks in call graph").option("--diagnostics", "report internal analysis diagnostics").option("--diagnostics-json <file>", "save analysis diagnostics in JSON file").option("--variable-kinds", "report constraint variable kinds").option("--max-waves <number>", "limit number of fixpoint waves").option("--max-indirections <number>", "limit number of function call and property write indirections").option("--full-indirection-bounding", "enable indirection bounding for method calls and property reads (use with --max-indirections)").option("--typescript-library-usage <file>", "save TypeScript library usage in JSON file, no analysis").option("--modules-only", "report reachable packages and modules only, no analysis").option("--compare-callgraphs", "compare two call graphs given as JSON files, no analysis").option("--reachability", "compare call graph reachability (use with -s or --compare-callgraphs)").option("--library", "assume program is a library (default: true if in node_modules)").option("--skip-tests", "skip files that look like tests").option("--no-patch-escaping", "disable patching using escape analysis").option("--patch-dynamics", "enable dynamic property access patching heuristic").option("--patch-method-calls", "enable method call patching heuristic").option("--no-patch-this", "disable 'this' patching heuristic").option("--read-neighbors", "enable package neighbor heuristic").option("--proto", "enable model of assignments to the __proto__ property").option("--obj-spread", "enable model of spread syntax for object literals ({...obj})").option("--native-overwrites", "allow overwriting of native object properties").option("--ignore-imprecise-native-calls", "ignore imprecise native calls").option("--matches-json <file>", "save vulnerability pattern matches in JSON file").option("--reachable-json <file>", "save reachable packages and modules in JSON file").option("--callstacks-json <file>", "save vulnerability call stacks in JSON file").option("--vulnerabilities-full", "full report of vulnerabilities").option("--modules-json <file>", "save modules dependencies in JSON file").usage("[options] [files]").addHelpText("after", `
 All modules reachable by require/import from the given files are included in the analysis
 (except when using --ignore-dependencies, --include-packages or --exclude-packages).
 If specifying directories instead of files, the files in the directories and their