@coana-tech/cli 14.12.123 → 14.12.125

package/repos/coana-tech/jelly-private/dist/bundle/jelly.js

@@ -9,11 +9,11 @@ import {
   require_hints,
   require_parser,
   require_patching
-} from "./chunk-RUAUP2X2.js";
+} from "./chunk-D4F3MOY5.js";
 import {
   require_moduleresolver,
   require_typescript
-} from "./chunk-XXE5Z2AZ.js";
+} from "./chunk-L7Z5ACXW.js";
 import {
   __commonJS,
   __name,
@@ -37,7 +37,7 @@ import {
   require_tokens,
   require_transform,
   require_util
-} from "./chunk-US4VPHJ4.js";
+} from "./chunk-NNOCQRBG.js";
 
 // lib/misc/timer.js
 var require_timer = __commonJS({
@@ -177,6 +177,8 @@ var require_globalstate = __commonJS({
       entryFiles = /* @__PURE__ */ new Set();
       reachedFiles = /* @__PURE__ */ new Set();
       pendingFiles = new worklist_1.Worklist();
+      reachedModulesFull = /* @__PURE__ */ new Set();
+      pendingModulesFull = new worklist_1.Worklist();
       filesWithParseErrors = [];
       filesAnalyzed = [];
       timeoutTimer = new timer_1.default();
@@ -257,6 +259,18 @@ var require_globalstate = __commonJS({
         (parent ? this.functionInfos.get(parent).functions : m.functions).add(f);
         this.vulnerabilities?.reachedFunction(f);
       }
+      reachedModuleFull(m) {
+        if (!m.isIncluded)
+          assert_1.default.fail(`Module ${m} is not included in the analysis!`);
+        if (options_1.options.modulesOnly)
+          assert_1.default.fail("reachedModuleFull called in modulesOnly mode!");
+        if (!this.reachedModulesFull.has(m)) {
+          if (options_1.options.lazy && logger_1.default.isVerboseEnabled())
+            logger_1.default.verbose(`Lazy: Module ${m} added for full analysis`);
+          this.reachedModulesFull.add(m);
+          this.pendingModulesFull.enqueue(m);
+        }
+      }
       reachedFile(tofile, entry, from, local) {
         let moduleInfo;
         if (this.reachedFiles.has(tofile))
@@ -484,6 +498,7 @@ var require_fragmentstate = __commonJS({
       numberOfFunctionToFunctionEdges = 0;
       numberOfCallToFunctionEdges = 0;
       functionsWithArguments = /* @__PURE__ */ new Set();
+      functionsWithThis = /* @__PURE__ */ new Set();
       artificialFunctions = [];
       callLocations = /* @__PURE__ */ new Set();
       nativeCallLocations = /* @__PURE__ */ new Set();
@@ -510,6 +525,7 @@ var require_fragmentstate = __commonJS({
       dynamicPropertyWrites = /* @__PURE__ */ new Set();
       maybeEmptyMethodCalls = /* @__PURE__ */ new Map();
       functionTokens = /* @__PURE__ */ new Set();
+      lazyEscaping = /* @__PURE__ */ new Map();
       constructor(s) {
         this.a = s.globalState;
         this.varProducer = new constraintvarproducer_1.ConstraintVarProducer(s, s.globalState);
@@ -654,6 +670,11 @@ var require_fragmentstate = __commonJS({
         }
         return f;
       }
+      registerThis(f) {
+        this.functionsWithThis.add(f);
+        if (logger_1.default.isDebugEnabled())
+          logger_1.default.debug(`Function uses 'this': ${(0, util_1.locationToStringWithFile)(f.loc)}`);
+      }
       getRepresentative(v) {
         let w = v;
         const ws = [];
@@ -661,7 +682,7 @@ var require_fragmentstate = __commonJS({
           const w2 = this.redirections.get(w);
           if (!w2)
             break;
-          (0, assert_1.default)(ws.length < 100);
+          (0, assert_1.default)(ws.length < 1e3);
           ws.push(w);
           w = w2;
         }
@@ -986,6 +1007,7 @@ var require_diagnostics = __commonJS({
       }
       packages = 0;
       modules = 0;
+      modulesFull = 0;
       functions = 0;
       vars = 0;
       listeners = 0;
@@ -1016,6 +1038,7 @@ var require_diagnostics = __commonJS({
       unprocessedTokensSize = 0;
       wave = 0;
       round = 0;
+      analyzerRounds = 0;
       listenerNotificationRounds = 0;
       lastPrintDiagnosticsTime = 0;
       tokenListenerNotifications = 0;
@@ -1043,6 +1066,323 @@ var require_diagnostics = __commonJS({
   }
 });
 
+// lib/misc/bitset.js
+var require_bitset = __commonJS({
+  "lib/misc/bitset.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.BitSet = void 0;
+    var node_assert_1 = __importDefault(__require("node:assert"));
+    var BitSet = class {
+      static {
+        __name(this, "BitSet");
+      }
+      static make(size) {
+        if (size <= 32)
+          return new SmallBitSet();
+        return new LargeBitSet(size);
+      }
+    };
+    exports.BitSet = BitSet;
+    var SmallBitSet = class _SmallBitSet extends BitSet {
+      static {
+        __name(this, "SmallBitSet");
+      }
+      v = 0;
+      get value() {
+        return this.v;
+      }
+      isEmpty() {
+        return !this.v;
+      }
+      set(index) {
+        if (index < 0 || index >= 32)
+          throw new RangeError(`Index out of bounds: ${index}`);
+        this.v |= 1 << index;
+      }
+      unionUpdate(other) {
+        (0, node_assert_1.default)(other instanceof _SmallBitSet, "Expected other to be SmallBitSet");
+        this.v |= other.v;
+      }
+      *[Symbol.iterator]() {
+        let { v } = this;
+        for (let i = 0; v; i++, v >>>= 1)
+          if (v & 1)
+            yield i;
+      }
+    };
+    var LargeBitSet = class _LargeBitSet extends BitSet {
+      static {
+        __name(this, "LargeBitSet");
+      }
+      size;
+      words;
+      empty = true;
+      constructor(size) {
+        super();
+        this.size = size;
+        this.words = new Int32Array(size + 31 >>> 5);
+      }
+      isEmpty() {
+        return this.empty;
+      }
+      set(index) {
+        if (index < 0 || index >= this.size)
+          throw new RangeError(`Index out of bounds: ${index}`);
+        this.words[index >>> 5] |= 1 << (index & 31);
+        this.empty = false;
+      }
+      unionUpdate(other) {
+        if (other instanceof SmallBitSet) {
+          this.words[0] |= other.value;
+          this.empty &&= other.isEmpty();
+        } else {
+          (0, node_assert_1.default)(other instanceof _LargeBitSet, "Expected other to be LargeBitSet");
+          node_assert_1.default.strictEqual(this.size, other.size, "BitSets must have same size");
+          for (const [i, w] of other.words.entries())
+            this.words[i] |= w;
+          this.empty &&= other.empty;
+        }
+      }
+      *[Symbol.iterator]() {
+        for (let [wi, w] of this.words.entries()) {
+          if (!w)
+            continue;
+          const baseIndex = wi << 5;
+          for (let i = 0; w; i++, w >>>= 1) {
+            if (w & 1)
+              yield baseIndex + i;
+          }
+        }
+      }
+    };
+  }
+});
+
+// lib/analysis/escaping.js
+var require_escaping = __commonJS({
+  "lib/analysis/escaping.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.findEscapingObjects = findEscapingObjects;
+    exports.findExportedTokens = findExportedTokens;
+    var tokens_1 = require_tokens();
+    var constraintvars_1 = require_constraintvars();
+    var logger_1 = __importDefault(require_logger());
+    var types_1 = __require("@babel/types");
+    var accesspaths_1 = require_accesspaths();
+    var ecmascript_1 = require_ecmascript();
+    var options_1 = require_options();
+    var packagejson_1 = require_packagejson();
+    function findEscapingObjects(ms, solver) {
+      const a = solver.globalState;
+      const f = solver.fragmentState;
+      const worklist = [];
+      const visited = /* @__PURE__ */ new Set();
+      const escaping = /* @__PURE__ */ new Set();
+      const theUnknownAccessPathToken = a.canonicalizeToken(new tokens_1.AccessPathToken(accesspaths_1.UnknownAccessPath.instance));
+      function addToWorklist(v) {
+        for (const t of v instanceof tokens_1.Token ? [v] : f.getTokens(f.getRepresentative(v)))
+          if ((t instanceof tokens_1.AllocationSiteToken || t instanceof tokens_1.FunctionToken || t instanceof tokens_1.NativeObjectToken && t.name === "exports") && !visited.has(t)) {
+            worklist.push(t);
+            visited.add(t);
+          }
+      }
+      __name(addToWorklist, "addToWorklist");
+      for (const m of Array.isArray(ms) ? ms : [ms])
+        if (1) {
+          const pi = a.packageJsonInfos.get(m.packageInfo.dir);
+          if (!pi?.exports || (0, packagejson_1.isInExports)(`./${m.relativePath}`, pi.exports))
+            addToWorklist(f.varProducer.objPropVar(a.canonicalizeToken(new tokens_1.NativeObjectToken("module", m)), "exports"));
+        }
+      const w2 = [];
+      while (worklist.length !== 0) {
+        const t = worklist.pop();
+        if (t instanceof tokens_1.FunctionToken)
+          w2.push(t);
+        else if (t instanceof tokens_1.ObjectToken || t instanceof tokens_1.NativeObjectToken && t.name === "exports") {
+          for (const p of f.objectProperties.get(t) ?? [])
+            if (!(0, ecmascript_1.isInternalProperty)(p))
+              addToWorklist(f.varProducer.objPropVar(t, p));
+        }
+      }
+      visited.clear();
+      for (const t of w2) {
+        visited.add(t);
+        worklist.push(t);
+      }
+      for (const v of f.maybeEscaping)
+        addToWorklist(v);
+      f.maybeEscaping.clear();
+      while (worklist.length !== 0) {
+        const t = worklist.pop();
+        if (t instanceof tokens_1.ObjectToken) {
+          if (logger_1.default.isDebugEnabled())
+            logger_1.default.debug(`Escaping object: ${t}`);
+          escaping.add(t);
+        }
+        if (t instanceof tokens_1.FunctionToken) {
+          addToWorklist(f.varProducer.returnVar(t.fun));
+          const tv = f.getRepresentative(f.varProducer.thisVar(t.fun));
+          if (Array.from(f.getTokens(tv)).every((y) => !(0, constraintvars_1.isObjectPropertyVarObj)(y)) && ((0, types_1.isClassMethod)(t.fun) ? t.fun.kind === "constructor" : f.functionsWithThis.has(t.fun))) {
+            const q = a.canonicalizeToken(new tokens_1.ObjectToken(t.fun));
+            solver.addToken(q, tv);
+            solver.addInherits(q, solver.varProducer.objPropVar(t, "prototype"));
+          }
+          for (const param of t.fun.params)
+            if ((0, types_1.isIdentifier)(param))
+              solver.addToken(theUnknownAccessPathToken, f.getRepresentative(f.varProducer.nodeVar(param)));
+          solver.addToken(theUnknownAccessPathToken, f.getRepresentative(f.varProducer.thisVar(t.fun)));
+        }
+        for (const p of f.objectProperties.get(t) ?? [])
+          if (!(0, ecmascript_1.isInternalProperty)(p)) {
+            const w = f.varProducer.objPropVar(t, p);
+            addToWorklist(w);
+            solver.addToken(theUnknownAccessPathToken, f.getRepresentative(w));
+          }
+      }
+      if (logger_1.default.isVerboseEnabled()) {
+        const objecttokens = /* @__PURE__ */ new Set();
+        for (const [, ts] of f.getAllVarsAndTokens())
+          for (const t of ts)
+            if (t instanceof tokens_1.ObjectToken)
+              objecttokens.add(t);
+        logger_1.default.verbose(`Escaping objects: ${escaping.size}/${objecttokens.size}`);
+      }
+      return escaping;
+    }
+    __name(findEscapingObjects, "findEscapingObjects");
+    function findExportedTokens(m, solver) {
+      const a = solver.globalState;
+      const f = solver.fragmentState;
+      const vp = f.varProducer;
+      return f.getTokens(f.getRepresentative(vp.objPropVar(a.canonicalizeToken(new tokens_1.NativeObjectToken("module", m)), "exports")));
+    }
+    __name(findExportedTokens, "findExportedTokens");
+  }
+});
+
+// lib/analysis/lazy.js
+var require_lazy = __commonJS({
+  "lib/analysis/lazy.js"(exports) {
+    "use strict";
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.constructTokenReachabilityGraph = constructTokenReachabilityGraph;
+    exports.isLazyAPActive = isLazyAPActive;
+    exports.assertLazyAPActive = assertLazyAPActive;
+    exports.getExportedFunctionsByModule = getExportedFunctionsByModule;
+    var node_assert_1 = __importDefault(__require("node:assert"));
+    var bitset_1 = require_bitset();
+    var scc_1 = require_scc();
+    var util_1 = require_util();
+    var ecmascript_1 = require_ecmascript();
+    var constraintvars_1 = require_constraintvars();
+    var escaping_1 = require_escaping();
+    var tokens_1 = require_tokens();
+    var logger_1 = __importDefault(require_logger());
+    function constructTokenReachabilityGraph(ts, solver) {
+      const f = solver.fragmentState;
+      const vp = f.varProducer;
+      const worklist = [...ts];
+      const graph = new Map(worklist.map((t) => [t, void 0]));
+      const add = /* @__PURE__ */ __name((edges, v) => {
+        for (const t of f.getTokens(f.getRepresentative(v))) {
+          edges.add(t);
+          if (!graph.has(t)) {
+            graph.set(t, void 0);
+            worklist.push(t);
+          }
+        }
+      }, "add");
+      let anyFunction = false;
+      while (worklist.length !== 0) {
+        const t = worklist.pop();
+        if ((0, constraintvars_1.isObjectPropertyVarObj)(t)) {
+          const edges = /* @__PURE__ */ new Set();
+          graph.set(t, edges);
+          for (const p of f.objectProperties.get(t) ?? [])
+            if (p !== ecmascript_1.ARRAY_ALL)
+              for (const ac of ["normal", "get", "set"])
+                add(edges, vp.objPropVar(t, p, ac));
+          if (t instanceof tokens_1.FunctionToken) {
+            anyFunction = true;
+            add(edges, vp.returnVar(t.fun));
+          }
+        }
+      }
+      return [graph, anyFunction];
+    }
+    __name(constructTokenReachabilityGraph, "constructTokenReachabilityGraph");
+    function isLazyAPActive(ap, a) {
+      if (ap.dependents) {
+        return ap.moduleInfo.directDependents.values().some((m) => !a.reachedModulesFull.has(m));
+      } else
+        return !a.reachedModulesFull.has(ap.moduleInfo);
+    }
+    __name(isLazyAPActive, "isLazyAPActive");
+    function assertLazyAPActive(ap, a) {
+      if (ap.dependents) {
+        if (ap.moduleInfo.directDependents.values().every((m) => a.reachedModulesFull.has(m)))
+          node_assert_1.default.fail(`Lazy access path ${ap} is irrelevant, all dependents are already reached`);
+      } else if (a.reachedModulesFull.has(ap.moduleInfo))
+        node_assert_1.default.fail(`Lazy access path ${ap} is irrelevant, module ${ap.moduleInfo} is already reached`);
+    }
+    __name(assertLazyAPActive, "assertLazyAPActive");
+    function getExportedFunctionsByModule(ms, solver) {
+      const roots = /* @__PURE__ */ new Set();
+      for (const m of ms)
+        (0, util_1.addAll)((0, escaping_1.findExportedTokens)(m, solver), roots);
+      const [graph, anyFunction] = constructTokenReachabilityGraph(roots, solver);
+      if (logger_1.default.isVerboseEnabled())
+        logger_1.default.verbose(`Lazy: Exported tokens: ${graph.size}`);
+      if (ms.size === 0 || !anyFunction)
+        return /* @__PURE__ */ new Map();
+      else if (ms.size === 1)
+        return /* @__PURE__ */ new Map([[
+          ms.values().next().value,
+          graph.keys().filter((t) => t instanceof tokens_1.FunctionToken).toArray()
+        ]]);
+      const [sccs, reps] = (0, scc_1.nuutila)(graph.keys(), (t) => graph.get(t));
+      const sets = /* @__PURE__ */ new Map();
+      for (const [t, rep] of reps.entries())
+        (0, util_1.mapArrayAdd)(rep, t, sets);
+      const modules = [...ms];
+      const bitsets = new Map(sccs.map((t) => [t, bitset_1.BitSet.make(ms.size)]));
+      for (const [i, m] of modules.entries())
+        for (const t of (0, escaping_1.findExportedTokens)(m, solver))
+          bitsets.get(reps.get(t)).set(i);
+      const exportedFunctionsByModule = /* @__PURE__ */ new Map();
+      for (const rep of sccs.reverse()) {
+        const bs = bitsets.get(rep);
+        (0, node_assert_1.default)(!bs.isEmpty());
+        for (const t of sets.get(rep)) {
+          const es = graph.get(t);
+          if (es?.size)
+            for (const t2 of es) {
+              const rep2 = reps.get(t2);
+              if (rep !== rep2)
+                bitsets.get(rep2).unionUpdate(bs);
+            }
+          if (t instanceof tokens_1.FunctionToken)
+            for (const i of bs)
+              (0, util_1.mapArrayAdd)(modules[i], t, exportedFunctionsByModule);
+        }
+      }
+      return exportedFunctionsByModule;
+    }
+    __name(getExportedFunctionsByModule, "getExportedFunctionsByModule");
+  }
+});
+
 // lib/analysis/solver.js
 var require_solver = __commonJS({
   "lib/analysis/solver.js"(exports) {
@@ -1106,6 +1446,7 @@ var require_solver = __commonJS({
     var memory_1 = require_memory();
     var diagnostics_1 = __importDefault(require_diagnostics());
     var ecmascript_1 = require_ecmascript();
+    var lazy_1 = require_lazy();
     var CYCLE_ELIMINATION_MINIMUM = 100;
     var CYCLE_ELIMINATION_FACTOR = 1.2;
     var AbortedException = class extends Error {
@@ -1131,6 +1472,7 @@ var require_solver = __commonJS({
       postponedListenersProcessed = 0;
       phase;
       timer = new timer_1.default();
+      lazyRoundsHook;
       constructor(abort) {
         this.abort = abort;
       }
@@ -1190,6 +1532,8 @@ var require_solver = __commonJS({
         }
       }
       tokenAdded(toRep, t, ws) {
+        if (options_1.options.lazyCleanup && t instanceof tokens_1.AccessPathToken && t.ap instanceof accesspaths_1.LazyAccessPath && !(0, lazy_1.isLazyAPActive)(t.ap, this.globalState))
+          return ws;
         if (logger_1.default.isDebugEnabled())
           logger_1.default.debug(`Added token ${t} to ${toRep}`);
         if (logger_1.default.isVerboseEnabled()) {
@@ -1208,14 +1552,14 @@ var require_solver = __commonJS({
         if (!to)
           return;
         const abstractProp = ap instanceof accesspaths_1.PropertyAccessPath && !(subap instanceof accesspaths_1.ModuleAccessPath && ap.prop === "default") && options_1.patternProperties && !options_1.patternProperties.has(ap.prop);
-        const ap2 = this.globalState.canonicalizeAccessPath(subap instanceof accesspaths_1.IgnoredAccessPath || subap instanceof accesspaths_1.UnknownAccessPath && (ap instanceof accesspaths_1.CallResultAccessPath || ap instanceof accesspaths_1.ComponentAccessPath || abstractProp) ? subap : abstractProp ? new accesspaths_1.PropertyAccessPath(ap.base, "?") : ap);
+        const ap2 = this.globalState.canonicalizeAccessPath(subap instanceof accesspaths_1.IgnoredAccessPath || subap instanceof accesspaths_1.LazyAccessPath || subap instanceof accesspaths_1.UnknownAccessPath && (ap instanceof accesspaths_1.CallResultAccessPath || ap instanceof accesspaths_1.ComponentAccessPath || abstractProp) ? subap : abstractProp ? new accesspaths_1.PropertyAccessPath(ap.base, "?") : ap);
         if (logger_1.default.isDebugEnabled())
           logger_1.default.debug(`Adding access path ${ap2}${ap2 !== ap ? ` (${ap})` : ""} at ${to}${subap ? ` (sub-expression access path: ${subap})` : ""}`);
         const f = this.fragmentState;
         const asn = to instanceof constraintvars_1.NodeVar && (0, types_1.isAssignmentExpression)(to.node);
         if (!asn)
           this.addToken(f.a.canonicalizeToken(new tokens_1.AccessPathToken(ap2)), f.getRepresentative(to));
-        if (!(ap2 instanceof accesspaths_1.UnknownAccessPath || ap2 instanceof accesspaths_1.IgnoredAccessPath) && (to instanceof constraintvars_1.NodeVar || to instanceof constraintvars_1.IntermediateVar && to.label === "import")) {
+        if (!(ap2 instanceof accesspaths_1.UnknownAccessPath || ap2 instanceof accesspaths_1.IgnoredAccessPath || ap2 instanceof accesspaths_1.LazyAccessPath) && (to instanceof constraintvars_1.NodeVar || to instanceof constraintvars_1.IntermediateVar && to.label === "import")) {
           (0, assert_1.default)(node !== void 0 && encl !== void 0);
           if (ap2 instanceof accesspaths_1.ModuleAccessPath)
             (0, util_1.mapGetMap)(f.moduleAccessPaths, ap2).set(node, encl);
@@ -1793,18 +2137,46 @@ var require_modulefinder = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.findModules = findModules;
     var types_1 = __require("@babel/types");
+    var util_1 = require_util();
     var traverse_1 = __importDefault(__require("@babel/traverse"));
     var module_1 = __importDefault(__require("module"));
+    var infos_1 = require_infos();
+    var micromatch_1 = __importDefault(require_micromatch());
+    var options_1 = require_options();
+    var logger_1 = __importDefault(require_logger());
+    var asthelpers_1 = require_asthelpers();
     function findModules(ast, f, moduleInfo) {
       function loadModule(mode, str, path) {
-        if (!module_1.default.isBuiltin(str))
-          f.loadModule(mode, str, path, moduleInfo);
+        if (!module_1.default.isBuiltin(str)) {
+          const m = f.loadModule(mode, str, path, moduleInfo);
+          if (m && options_1.options.lazy) {
+            const s = (0, infos_1.normalizeModuleName)(str);
+            const tracked = options_1.options.trackedModules?.some((e) => micromatch_1.default.isMatch(m.getOfficialName(), e) || micromatch_1.default.isMatch(s, e));
+            if (tracked) {
+              if (logger_1.default.isVerboseEnabled())
+                logger_1.default.verbose(`Lazy: Module ${moduleInfo} imports tracked module ${m}`);
+              f.a.reachedModuleFull(moduleInfo);
+            }
+          }
+        }
       }
       __name(loadModule, "loadModule");
+      function isRequire(path) {
+        if (!path.isExpression() || path.scope.getBinding("require"))
+          return false;
+        const aux = /* @__PURE__ */ __name((path2) => {
+          path2 = (0, asthelpers_1.skipParenthesizedChildren)(path2);
+          if (path2.isIdentifier({ name: "require" }))
+            return true;
+          return path2.isConditionalExpression() && (aux(path2.get("consequent")) || aux(path2.get("alternate")));
+        }, "aux");
+        return aux(path);
+      }
+      __name(isRequire, "isRequire");
       (0, traverse_1.default)(ast, {
         CallExpression(path) {
           const imp = (0, types_1.isImport)(path.node.callee);
-          if ((imp || (0, types_1.isIdentifier)(path.node.callee) && path.node.callee.name === "require" && !path.scope.getBinding(path.node.callee.name)) && path.node.arguments.length >= 1) {
+          if ((imp || isRequire(path.get("callee"))) && path.node.arguments.length >= 1) {
             const arg = path.node.arguments[0];
             if ((0, types_1.isStringLiteral)(arg))
               loadModule(imp ? "module" : "commonjs", arg.value, path);
@@ -1821,104 +2193,35 @@ var require_modulefinder = __commonJS({
         ExportNamedDeclaration(path) {
           if (path.node.source)
             loadModule("module", path.node.source.value, path);
-        }
+        },
+        ...options_1.options.lazy ? {
+          Identifier(path) {
+            const { node, parent } = path;
+            if (!isRequire(path) || (0, types_1.isCallExpression)(parent, { callee: node }) || ((0, types_1.isMemberExpression)(parent, { object: node }) || (0, types_1.isOptionalMemberExpression)(parent, { object: node })) && ["main", "cache", "resolve", "extensions"].includes((0, asthelpers_1.getProperty)(parent)) || (0, types_1.isUnaryExpression)(parent, { argument: node }))
+              return;
+            let p = path;
+            while (true) {
+              const pp = p.parentPath;
+              if (!pp)
+                return;
+              if (pp.isParenthesizedExpression() || pp.isConditionalExpression({ consequent: p.node }) || pp.isConditionalExpression({ alternate: p.node }))
+                p = pp;
+              else if (pp.isCallExpression({ callee: p.node }) && pp.node.arguments.length >= 1)
+                return;
+              else
+                break;
+            }
+            if (logger_1.default.isVerboseEnabled())
+              logger_1.default.verbose(`Lazy: Aliasing 'require' at ${(0, util_1.locationToStringWithFileAndEnd)(path.node.loc)} in ${moduleInfo}`);
+            f.a.reachedModuleFull(moduleInfo);
+          }
+        } : {}
       });
     }
     __name(findModules, "findModules");
   }
 });
 
-// lib/analysis/escaping.js
-var require_escaping = __commonJS({
-  "lib/analysis/escaping.js"(exports) {
-    "use strict";
-    var __importDefault = exports && exports.__importDefault || function(mod) {
-      return mod && mod.__esModule ? mod : { "default": mod };
-    };
-    Object.defineProperty(exports, "__esModule", { value: true });
-    exports.findEscapingObjects = findEscapingObjects;
-    var tokens_1 = require_tokens();
-    var logger_1 = __importDefault(require_logger());
-    var types_1 = __require("@babel/types");
-    var accesspaths_1 = require_accesspaths();
-    var ecmascript_1 = require_ecmascript();
-    var options_1 = require_options();
-    var packagejson_1 = require_packagejson();
-    function findEscapingObjects(ms, solver) {
-      const a = solver.globalState;
-      const f = solver.fragmentState;
-      const worklist = [];
-      const visited = /* @__PURE__ */ new Set();
-      const escaping = /* @__PURE__ */ new Set();
-      const theUnknownAccessPathToken = a.canonicalizeToken(new tokens_1.AccessPathToken(accesspaths_1.UnknownAccessPath.instance));
-      function addToWorklist(v) {
-        for (const t of v instanceof tokens_1.Token ? [v] : f.getTokens(f.getRepresentative(v)))
-          if ((t instanceof tokens_1.AllocationSiteToken || t instanceof tokens_1.FunctionToken || t instanceof tokens_1.NativeObjectToken && t.name === "exports") && !visited.has(t)) {
-            worklist.push(t);
-            visited.add(t);
-          }
-      }
-      __name(addToWorklist, "addToWorklist");
-      for (const m of Array.isArray(ms) ? ms : [ms])
-        if (m.packageInfo.isEntry && (m.getPath().includes("node_modules") || options_1.options.library)) {
-          const pi = a.packageJsonInfos.get(m.packageInfo.dir);
-          if (!pi?.exports || (0, packagejson_1.isInExports)(`./${m.relativePath}`, pi.exports))
-            addToWorklist(f.varProducer.objPropVar(a.canonicalizeToken(new tokens_1.NativeObjectToken("module", m)), "exports"));
-        }
-      const w2 = [];
-      while (worklist.length !== 0) {
-        const t = worklist.pop();
-        if (t instanceof tokens_1.FunctionToken)
-          w2.push(t);
-        else if (t instanceof tokens_1.ObjectToken || t instanceof tokens_1.NativeObjectToken && t.name === "exports") {
-          for (const p of f.objectProperties.get(t) ?? [])
-            if (!(0, ecmascript_1.isInternalProperty)(p))
-              addToWorklist(f.varProducer.objPropVar(t, p));
-        }
-      }
-      visited.clear();
-      for (const t of w2) {
-        visited.add(t);
-        worklist.push(t);
-      }
-      for (const v of f.maybeEscaping)
-        addToWorklist(v);
-      f.maybeEscaping.clear();
-      while (worklist.length !== 0) {
-        const t = worklist.pop();
-        if (t instanceof tokens_1.ObjectToken) {
-          if (logger_1.default.isDebugEnabled())
-            logger_1.default.debug(`Escaping object: ${t}`);
-          escaping.add(t);
-        }
-        if (t instanceof tokens_1.FunctionToken) {
-          addToWorklist(f.varProducer.returnVar(t.fun));
-          for (const param of t.fun.params)
-            if ((0, types_1.isIdentifier)(param))
-              solver.addToken(theUnknownAccessPathToken, f.getRepresentative(f.varProducer.nodeVar(param)));
-          solver.addToken(theUnknownAccessPathToken, f.getRepresentative(f.varProducer.thisVar(t.fun)));
-        }
-        for (const p of f.objectProperties.get(t) ?? [])
-          if (!(0, ecmascript_1.isInternalProperty)(p)) {
-            const w = f.varProducer.objPropVar(t, p);
-            addToWorklist(w);
-            solver.addToken(theUnknownAccessPathToken, f.getRepresentative(w));
-          }
-      }
-      if (logger_1.default.isVerboseEnabled()) {
-        const objecttokens = /* @__PURE__ */ new Set();
-        for (const [, ts] of f.getAllVarsAndTokens())
-          for (const t of ts)
-            if (t instanceof tokens_1.ObjectToken)
-              objecttokens.add(t);
-        logger_1.default.verbose(`Escaping objects: ${escaping.size}/${objecttokens.size}`);
-      }
-      return escaping;
-    }
-    __name(findEscapingObjects, "findEscapingObjects");
-  }
-});
-
 // lib/natives/nativebuilder.js
 var require_nativebuilder = __commonJS({
   "lib/natives/nativebuilder.js"(exports) {
@@ -2833,6 +3136,14 @@ var require_operations = __commonJS({
             } else if ((0, types_1.isSpreadElement)(args[i]))
               f.warnUnsupported(args[i], "SpreadElement in arguments to external function");
           }
+          if (t.ap instanceof accesspaths_1.LazyAccessPath) {
+            const s = (0, util_1.mapGetSet)(this.solver.fragmentState.lazyEscaping, t.ap);
+            for (let i = 0; i < argVars.length; i++) {
+              const argVar = argVars[i];
+              if (argVar)
+                s.add(argVar);
+            }
+          }
         }
         if (isNew && t instanceof tokens_1.FunctionToken) {
           const q = this.newObjectToken(t.fun);
@@ -3036,6 +3347,8 @@ var require_operations = __commonJS({
         } else if (lVar && base instanceof tokens_1.AccessPathToken) {
           this.solver.addAccessPath(new accesspaths_1.PropertyAccessPath(lVar, prop), this.solver.varProducer.nodeVar(escapeNode), escapeNode, enclosing, base.ap);
           this.solver.fragmentState.registerEscapingToExternal(src, escapeNode, enclosing);
+          if (src && base.ap instanceof accesspaths_1.LazyAccessPath)
+            (0, util_1.mapGetSet)(this.solver.fragmentState.lazyEscaping, base.ap).add(src);
         }
       }
       loadModule(mode, str, resultVar, path) {
@@ -3049,18 +3362,24 @@ var require_operations = __commonJS({
             f.warnUnsupported(path.node, `Ignoring re-export from built-in module '${str}'`);
         } else {
           m = f.loadModule(mode, str, path, this.moduleInfo);
-          if (m instanceof infos_1.ModuleInfo && m.isIncluded) {
-            const fp = (0, asthelpers_1.getEnclosingFunction)(path)?.node;
-            const from = fp ? this.a.functionInfos.get(fp) : this.moduleInfo;
-            f.registerRequireEdge(from, m);
-            if (!reexport)
-              this.solver.addSubsetConstraint(this.solver.varProducer.objPropVar(this.a.canonicalizeToken(new tokens_1.NativeObjectToken("module", m)), "exports"), resultVar);
-          }
           if (m) {
+            if (m instanceof infos_1.ModuleInfo && m.isIncluded) {
+              const fp = (0, asthelpers_1.getEnclosingFunction)(path)?.node;
+              const from = fp ? this.a.functionInfos.get(fp) : this.moduleInfo;
+              f.registerRequireEdge(from, m);
+              if (!reexport)
+                this.solver.addSubsetConstraint(this.solver.varProducer.objPropVar(this.a.canonicalizeToken(new tokens_1.NativeObjectToken("module", m)), "exports"), resultVar);
+              if (options_1.options.lazy && !this.a.reachedModulesFull.has(m) && resultVar) {
+                const ap = new accesspaths_1.LazyAccessPath(m, false);
+                if (logger_1.default.isVerboseEnabled())
+                  logger_1.default.verbose(`Lazy: Injecting ${ap} at ${resultVar}`);
+                this.solver.addAccessPath(ap, resultVar);
+              }
+            }
             const analyzed = m instanceof infos_1.ModuleInfo && m.isIncluded;
             if (!analyzed || options_1.options.vulnerabilities || options_1.options.vulnerabilitiesJson) {
               const s = (0, infos_1.normalizeModuleName)(str);
-              const tracked = options_1.options.trackedModules && options_1.options.trackedModules.find((e) => micromatch_1.default.isMatch(m.getOfficialName(), e) || micromatch_1.default.isMatch(s, e));
+              const tracked = options_1.options.trackedModules && options_1.options.trackedModules.some((e) => micromatch_1.default.isMatch(m.getOfficialName(), e) || micromatch_1.default.isMatch(s, e));
               const ap = tracked ? new accesspaths_1.ModuleAccessPath(m, s) : accesspaths_1.IgnoredAccessPath.instance;
               this.solver.addAccessPath(ap, resultVar, path.node, this.a.getEnclosingFunctionOrModule(path));
               if ((0, types_1.isExportAllDeclaration)(path.node))
@@ -3517,7 +3836,7 @@ var require_finalization = __commonJS({
               }
             }
         }
-      solver.diagnostics.finalizationTime = finalTimer.elapsed();
+      solver.diagnostics.finalizationTime += finalTimer.elapsed();
     }
     __name(finalizeCallEdges, "finalizeCallEdges");
   }
@@ -3863,6 +4182,9 @@ var require_analyzer = __commonJS({
         return result;
       };
     })();
+    var __importDefault = exports && exports.__importDefault || function(mod) {
+      return mod && mod.__esModule ? mod : { "default": mod };
+    };
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.analyzeFiles = analyzeFiles;
     var fs_1 = __importStar(__require("fs"));
@@ -3877,6 +4199,7 @@ var require_analyzer = __commonJS({
     var modulefinder_1 = require_modulefinder();
     var parser_1 = require_parser();
     var escaping_1 = require_escaping();
+    var lazy_1 = require_lazy();
     var nativebuilder_1 = require_nativebuilder();
     var analysisstatereporter_1 = require_analysisstatereporter();
     var operations_1 = require_operations();
@@ -3888,6 +4211,10 @@ var require_analyzer = __commonJS({
     var patching_1 = require_patching();
     var diagnostics_1 = require_diagnostics2();
     var patchthis_1 = require_patchthis();
+    var assert_1 = __importDefault(__require("assert"));
+    var accesspaths_1 = require_accesspaths();
+    var tokens_1 = require_tokens();
+    var types_1 = __require("@babel/types");
     async function analyzeFiles(files, solver) {
       const a = solver.globalState;
       const d = solver.diagnostics;
@@ -3912,49 +4239,63 @@ var require_analyzer = __commonJS({
               logger_1.default.info(`Loading ${options_1.options.approxLoad}`);
             a.approx.add(JSON.parse((0, fs_1.readFileSync)(options_1.options.approxLoad, "utf-8")));
           }
-          while (a.pendingFiles.isNonEmpty()) {
-            while (a.pendingFiles.isNonEmpty()) {
-              for (const file of a.pendingFiles) {
-                const moduleInfo = a.getModuleInfo(file);
-                d.modules++;
-                d.packages = a.packageInfos.size;
-                if (!options_1.options.modulesOnly && options_1.options.printProgress)
-                  logger_1.default.info(`Analyzing module ${moduleInfo} (${d.modules})`);
-                const str = fs_1.default.readFileSync(file, "utf8");
-                (0, logger_1.writeStdOutIfActive)(`Parsing ${file} (${Math.ceil(str.length / 1024)}KB)...`);
-                const ast = (0, parser_1.parseAndDesugar)(str, file, solver.fragmentState);
-                if (!ast) {
-                  a.filesWithParseErrors.push(file);
-                  continue;
-                }
-                moduleInfo.loc = ast.program.loc;
-                a.modules.set(moduleInfo, ast.program);
-                a.filesAnalyzed.push(file);
-                const fileSize = (0, fs_1.statSync)(file).size;
-                d.codeSize += fileSize;
-                if (moduleInfo.packageInfo.isEntry)
-                  d.codeSizeMain += fileSize;
-                else
-                  d.codeSizeDependencies += fileSize;
-                if (options_1.options.approx) {
-                  if (a.approx.hints.moduleIndex.has(moduleInfo.toString())) {
-                    if (logger_1.default.isVerboseEnabled())
-                      logger_1.default.verbose(`Skipping approximate interpretation of module ${file}, already visited`);
+          while (a.pendingFiles.isNonEmpty() || a.pendingModulesFull.isNonEmpty()) {
+            d.analyzerRounds++;
+            const prevModulesFull = d.modulesFull;
+            while (a.pendingFiles.isNonEmpty() || a.pendingModulesFull.isNonEmpty()) {
+              while (a.pendingFiles.isNonEmpty() || a.pendingModulesFull.isNonEmpty()) {
+                for (const file of a.pendingFiles) {
+                  const moduleInfo = a.getModuleInfo(file);
+                  d.packages = a.packageInfos.size;
+                  if (!options_1.options.modulesOnly && options_1.options.printProgress)
+                    logger_1.default.info(`Loading ${moduleInfo} (${d.modules})`);
+                  const str = fs_1.default.readFileSync(file, "utf8");
+                  (0, logger_1.writeStdOutIfActive)(`Parsing ${file} (${Math.ceil(str.length / 1024)}KB)...`);
+                  const ast = (0, parser_1.parseAndDesugar)(str, file, solver.fragmentState);
+                  if (!ast) {
+                    a.filesWithParseErrors.push(file);
+                    continue;
+                  }
+                  moduleInfo.loc = ast.program.loc;
+                  moduleInfo.ast = ast;
+                  a.modules.set(moduleInfo, ast.program);
+                  a.filesAnalyzed.push(file);
+                  const fileSize = (0, fs_1.statSync)(file).size;
+                  d.modules++;
+                  d.codeSize += fileSize;
+                  if (moduleInfo.packageInfo.isEntry)
+                    d.codeSizeMain += fileSize;
+                  else
+                    d.codeSizeDependencies += fileSize;
+                  if (options_1.options.approx) {
+                    if (a.approx.hints.moduleIndex.has(moduleInfo.toString())) {
+                      if (logger_1.default.isVerboseEnabled())
+                        logger_1.default.verbose(`Skipping approximate interpretation of module ${file}, already visited`);
+                    } else {
+                      (0, logger_1.writeStdOutIfActive)(`Approximate interpretation...`);
+                      await a.approx.execute(file);
+                    }
+                  }
+                  if (options_1.options.modulesOnly || options_1.options.lazy) {
+                    (0, modulefinder_1.findModules)(ast, solver.fragmentState, moduleInfo);
                   } else {
-                    (0, logger_1.writeStdOutIfActive)(`Approximate interpretation...`);
-                    await a.approx.execute(file);
+                    a.reachedModuleFull(moduleInfo);
                   }
-                }
-                if (options_1.options.modulesOnly) {
-                  (0, modulefinder_1.findModules)(ast, solver.fragmentState, moduleInfo);
                   if (d.modules % 16 === 0)
                     a.timeoutTimer.checkTimeout();
-                } else {
+                }
+                for (const moduleInfo of a.pendingModulesFull) {
+                  const ast = moduleInfo.ast;
+                  (0, assert_1.default)(ast);
+                  d.modulesFull++;
+                  if (!options_1.options.modulesOnly && options_1.options.printProgress)
+                    logger_1.default.info(`Analyzing ${moduleInfo}`);
                   const moduleParams = (0, extras_1.preprocessAst)(ast, moduleInfo);
                   (0, logger_1.writeStdOutIfActive)("Traversing AST...");
                   (0, astvisitor_1.visit)(ast, new operations_1.Operations(moduleInfo, solver, (0, nativebuilder_1.buildModuleNatives)(solver, moduleInfo, moduleParams)));
+                  ast.tokens = void 0;
+                  moduleInfo.ast = void 0;
                 }
-                ast.tokens = void 0;
               }
               await solver.propagate("Analyzing");
               solver.updateDiagnostics();
@@ -3985,6 +4326,107 @@ var require_analyzer = __commonJS({
               }
               solver.updateDiagnostics();
             }
+            if (options_1.options.lazy && d.modulesFull > prevModulesFull) {
+              const f2 = solver.fragmentState;
+              (0, logger_1.writeStdOutIfActive)("Lazy module analysis...");
+              solver.lazyRoundsHook?.();
+              const funs = /* @__PURE__ */ new Map();
+              for (const [vs, fun] of a.vulnerabilities.patternMatch(solver.fragmentState, void 0, solver.diagnostics).values())
+                (0, util_1.addAll)(vs, (0, util_1.mapGetSet)(funs, fun));
+              const reachingFunctions = /* @__PURE__ */ new Set();
+              if (funs.size) {
+                (0, finalization_1.finalizeCallEdges)(solver);
+                (0, util_1.addAll)(a.vulnerabilities.findFunctionsThatMayReachVulnerableFunctions(funs, f2).keys(), reachingFunctions);
+              }
+              if (logger_1.default.isVerboseEnabled())
+                logger_1.default.verbose(`Lazy: Functions that may reach vulnerable functions: ${reachingFunctions.size}`);
+              const isCandidate = /* @__PURE__ */ __name((m) => m.directDependents.values().some((d2) => !a.reachedModulesFull.has(d2)), "isCandidate");
+              const candidateModules = new Set(a.reachedModulesFull.values().filter(isCandidate));
+              if (logger_1.default.isVerboseEnabled())
+                logger_1.default.verbose(`Lazy: Candidate modules: ${candidateModules.size}`);
+              let reevaluateCandidates = false;
+              for (const r of reachingFunctions)
+                if (r instanceof infos_1.ModuleInfo && candidateModules.has(r)) {
+                  logger_1.default.verbose(`Lazy: top-level function ${r} may reach vulnerable function`);
+                  for (const d2 of r.directDependents)
+                    a.reachedModuleFull(d2);
+                  candidateModules.delete(r);
+                  reevaluateCandidates = true;
+                }
+              if (reevaluateCandidates) {
+                for (const m of candidateModules)
+                  if (!isCandidate(m)) {
+                    logger_1.default.verbose(`Lazy: Candidate module ${m}'s non-analyzed dependents were all reached`);
+                    candidateModules.delete(m);
+                  }
+              }
+              for (const [m, ts] of (0, lazy_1.getExportedFunctionsByModule)(candidateModules, solver)) {
+                const ap = new accesspaths_1.LazyAccessPath(m, true);
+                for (const t of ts) {
+                  for (const param of t.fun.params)
+                    if ((0, types_1.isIdentifier)(param))
+                      solver.addAccessPath(ap, f2.varProducer.nodeVar(param));
+                  if (f2.functionsWithThis.has(t.fun))
+                    solver.addAccessPath(ap, f2.varProducer.thisVar(t.fun));
+                  if (f2.functionsWithArguments.has(t.fun))
+                    solver.addAccessPath(ap, f2.varProducer.argumentsVar(t.fun));
+                }
+              }
+              await solver.propagate("Lazy loading");
+              for (const m of candidateModules) {
+                const ap = a.canonicalizeAccessPath(new accesspaths_1.LazyAccessPath(m, true));
+                (0, lazy_1.assertLazyAPActive)(ap, a);
+                const v = f2.varProducer.objPropVar(a.canonicalizeToken(new tokens_1.NativeObjectToken("module", m)), "exports");
+                (0, util_1.mapGetSet)(f2.lazyEscaping, ap).add(v);
+              }
+              const roots = /* @__PURE__ */ new Set();
+              const lazyEscapingTokens = /* @__PURE__ */ new Map();
+              for (const [ap, vs] of f2.lazyEscaping) {
+                if (!(0, lazy_1.isLazyAPActive)(ap, a)) {
+                  f2.lazyEscaping.delete(ap);
+                  continue;
+                }
+                const ts = /* @__PURE__ */ new Set();
+                for (const v of vs)
+                  (0, util_1.addAll)(f2.getTokens(f2.getRepresentative(v)), ts);
+                (0, util_1.addAll)(ts, roots);
+                lazyEscapingTokens.set(ap, ts);
+              }
+              const [graph] = (0, lazy_1.constructTokenReachabilityGraph)(roots, solver);
+              const vulnTokens = graph.keys().filter((t) => t instanceof tokens_1.AccessPathToken && !(t.ap instanceof accesspaths_1.UnknownAccessPath || t.ap instanceof accesspaths_1.IgnoredAccessPath || t.ap instanceof accesspaths_1.LazyAccessPath) || t instanceof tokens_1.FunctionToken && reachingFunctions.has(a.functionInfos.get(t.fun))).toArray();
+              if (vulnTokens.length) {
+                const rGraph = (0, util_1.getReverseGraph)(graph);
+                const worklist = vulnTokens;
+                const visited = new Set(worklist);
+                while (worklist.length) {
+                  const t = worklist.pop();
+                  const es = rGraph.get(t);
+                  if (es) {
+                    for (const t2 of es)
+                      if (!visited.has(t2)) {
+                        visited.add(t2);
+                        worklist.push(t2);
+                      }
+                  }
+                }
+                for (const [ap, ts] of lazyEscapingTokens)
+                  for (const t of ts)
+                    if (visited.has(t)) {
+                      if (ap.dependents) {
+                        if (logger_1.default.isVerboseEnabled())
+                          logger_1.default.verbose(`Lazy: Including ${ap.moduleInfo.directDependents.size} dependents of ${ap.moduleInfo}`);
+                        for (const d2 of ap.moduleInfo.directDependents)
+                          a.reachedModuleFull(d2);
+                      } else {
+                        if (logger_1.default.isVerboseEnabled())
+                          logger_1.default.verbose(`Lazy: Including ${ap.moduleInfo}`);
+                        a.reachedModuleFull(ap.moduleInfo);
+                      }
+                      break;
+                    }
+              }
+              solver.updateDiagnostics();
+            }
           }
         }
         const f = solver.fragmentState;
@@ -4030,7 +4472,7 @@ var require_analyzer = __commonJS({
         d.functionsWithZeroCallers = r.getZeroCallerFunctions().size;
         d.reachableFunctions = Array.from(r.getReachableModulesAndFunctions(r.getEntryModules())).filter((r2) => r2 instanceof infos_1.FunctionInfo).length;
         if (logger_1.default.isInfoEnabled()) {
-          logger_1.default.info(`Analyzed packages: ${d.packages}, modules: ${d.modules}, functions: ${a.functionInfos.size}, code size main: ${Math.ceil(d.codeSizeMain / 1024)}KB, dependencies: ${Math.ceil(d.codeSizeDependencies / 1024)}KB`);
+          logger_1.default.info(`Analyzed packages: ${d.packages}, modules: ${d.modules} (full: ${d.modulesFull}), functions: ${a.functionInfos.size}, code size main: ${Math.ceil(d.codeSizeMain / 1024)}KB, dependencies: ${Math.ceil(d.codeSizeDependencies / 1024)}KB`);
           logger_1.default.info(`Call edges function->function: ${d.functionToFunctionEdges}, call->function: ${d.callToFunctionEdges}`);
           const total = d.totalCallSites, zeroOne = d.callsWithNoCallee + d.callsWithUniqueCallee, nativeExternal = d.nativeOnlyCalls + d.externalOnlyCalls + d.nativeOrExternalCalls;
           if (total > 0)
@@ -8148,7 +8590,7 @@ var require_patternmatcher = __commonJS({
         const f = this.fragmentState;
         for (const [v, m] of f.maybeEscapingToExternal)
           for (const t of f.getTokens(f.getRepresentative(v)))
-            if (t instanceof tokens_1.AccessPathToken)
+            if (t instanceof tokens_1.AccessPathToken && !(t.ap instanceof accesspaths_1.LazyAccessPath))
               for (const [n, encl] of m)
                 (0, util_1.mapGetMap)(this.escapingToExternal, t.ap).set(n, encl);
       }
@@ -11982,7 +12424,7 @@ var require_paths = __commonJS({
     }
     __name(isPathExistInArray, "isPathExistInArray");
     function removeBestCandidate(candidates) {
-      return candidates.sort((a, b) => b.totalCost - a.totalCost).pop();
+      return candidates.sort((a, b) => a.totalCost - b.totalCost).shift();
     }
     __name(removeBestCandidate, "removeBestCandidate");
     function dijkstra(g, source, removed) {
@@ -12572,8 +13014,9 @@ ${p} (${(0, vulnerabilities_1.getVulnerabilityId)(v)})`);
             target.edges.push({ to, weight: 1 });
           g.nodes.push(to);
           g.targets = [to];
+          const orderedSources = g.sources.toSorted((a, b) => (0, util_1.locationToStringWithFileAndEnd)(a.node?.loc, true).localeCompare((0, util_1.locationToStringWithFileAndEnd)(b.node?.loc, true)));
           let i = 0;
-          for (const source of g.sources) {
+          for (const source of orderedSources) {
             if (maxSources !== void 0 && i++ > maxSources)
               break;
             const t = logger_1.default.isVerboseEnabled() && new timer_1.default();
@@ -12732,17 +13175,9 @@ var require_apiexported = __commonJS({
       return void 0;
     }
     __name(findFunctionAtLocation, "findFunctionAtLocation");
-    function getReverseGraph(g) {
-      const r = /* @__PURE__ */ new Map();
-      for (const [from, tos] of g)
-        for (const to of tos)
-          (0, util_1.mapGetSet)(r, to).add(from);
-      return r;
-    }
-    __name(getReverseGraph, "getReverseGraph");
     function findReachingFunctions(f, fun) {
-      const callers = getReverseGraph(f.functionToFunction);
-      const requires = getReverseGraph(f.requireGraph);
+      const callers = (0, util_1.getReverseGraph)(f.functionToFunction);
+      const requires = (0, util_1.getReverseGraph)(f.requireGraph);
       const r = /* @__PURE__ */ new Map();
       const w = /* @__PURE__ */ new Set();
       r.set(fun, /* @__PURE__ */ new Set());
@@ -12978,9 +13413,10 @@ var require_main = __commonJS({
     var apiexported_1 = require_apiexported();
     var merge_1 = require_merge();
     var processmanager_1 = require_processmanager();
+    var assert_1 = __importDefault(__require("assert"));
     var semver_1 = __importDefault(require_semver2());
     var ENGINES_NODE = require_package()?.engines?.node;
-    commander_1.program.name("jelly").version(options_1.VERSION).addHelpText("before", options_1.COPYRIGHT).option("-b, --basedir <directory>", "base directory for files to analyze (default: auto-detect)").option("-f, --logfile <file>", "log to file (default: log to stdout)").option("-l, --loglevel <level>", "log level (debug/verbose/info/warn/error)", "info").option("-i, --timeout <seconds>", "limit analysis time").option("-a, --dataflow-html <file>", "save data-flow graph as HTML file").option("-m, --callgraph-html <file>", "save call graph as HTML file").option("-j, --callgraph-json <file>", "save call graph as JSON file").option("-s, --soundness <file>", "compare with dynamic call graph").option("-n, --graal-home <directory>", "home of graal-nodejs (default: $GRAAL_HOME)").option("-d, --dynamic <file>", "generate call graph dynamically, no static analysis").option("--approx", "enable approximate interpretation").option("--approx-only <file>", "perform approximate interpretation, no static analysis").option("--approx-load <file>", "use pre-computed approximate interpretation results").option("-p, --patterns <file...>", "files containing API usage patterns to detect").option("-v, --vulnerabilities <file>", "report vulnerability matches").option("--vulnerabilities-json <json>", "report vulnerability matches (patterns given as JSON string)").option("--include-packages <package...>", "include only dependencies in this list").option("--exclude-packages <package...>", "exclude dependencies in this list").option("--ignore-dependencies", "don't include dependencies in analysis").option("--ignore-unresolved", "don't report errors about unresolved modules").option("--npm-test <dir>", "run 'npm test' instead of 'node' (use with -d)").option("--callgraph", "report call graph").option("--tokens-json <file>", "save tokens for constraint variables as JSON file").option("--tokens", "report tokens for constraint variables").option("--largest", "report largest token sets and subset relations").option("--no-cycle-elimination", "disable cycle elimination").option("--no-natives", "disable nonessential models of native libraries").option("--test-graal", "test graal-nodejs (use with -d)").option("--no-print-progress", "don't print analysis progress information").option("--no-tty", "don't print solver progress for TTY").option("--warnings-unsupported", "print warnings about unsupported features").option("--gc", "enable garbage collection for more accurate memory usage reporting").option("--typescript", "enable TypeScript type inference (use with -p)").option("--api-usage", "report API usage of external packages (implies --ignore-dependencies)").option("--api-exported", "report API of modules").option("--find-access-paths <location>", "find access paths for source location (file:line)").option("--higher-order-functions", "report higher-order functions").option("--zeros", "report calls with zero callees and functions with zero callers").option("--exclude-entries <glob...>", "files to exclude when specifying entry directories").option("--tracked-modules <glob...>", "modules to track usage of (default: auto-detect)").option("--external-matches", "enable pattern matches from external code").option("--no-callgraph-implicit", "omit implicit calls in call graph").option("--no-callgraph-native", "omit native calls in call graph").option("--no-callgraph-require", "omit module loading in call graph").option("--no-callgraph-external", "omit heuristic external callbacks in call graph").option("--diagnostics", "report internal analysis diagnostics").option("--diagnostics-json <file>", "save analysis diagnostics in JSON file").option("--variable-kinds", "report constraint variable kinds").option("--max-waves <number>", "limit number of fixpoint waves").option("--max-indirections <number>", "limit number of function call and property write indirections").option("--full-indirection-bounding", "enable indirection bounding for method calls and property reads (use with --max-indirections)").option("--typescript-library-usage <file>", "save TypeScript library usage in JSON file, no analysis").option("--modules-only", "report reachable packages and modules only, no analysis").option("--compare-callgraphs", "compare two call graphs given as JSON files, no analysis").option("--reachability", "compare call graph reachability (use with -s or --compare-callgraphs)").option("--library", "assume program is a library (default: true if in node_modules)").option("--skip-tests", "skip files that look like tests").option("--no-patch-escaping", "disable patching using escape analysis").option("--patch-dynamics", "enable dynamic property access patching heuristic").option("--patch-method-calls", "enable method call patching heuristic").option("--no-patch-this", "disable 'this' patching heuristic").option("--read-neighbors", "enable package neighbor heuristic").option("--proto", "enable model of assignments to the __proto__ property").option("--obj-spread", "enable model of spread syntax for object literals ({...obj})").option("--native-overwrites", "allow overwriting of native object properties").option("--ignore-imprecise-native-calls", "ignore imprecise native calls").option("--matches-json <file>", "save vulnerability pattern matches in JSON file").option("--reachable-json <file>", "save reachable packages and modules in JSON file").option("--callstacks-json <file>", "save vulnerability call stacks in JSON file").option("--vulnerabilities-full", "full report of vulnerabilities").option("--modules-json <file>", "save modules dependencies in JSON file").usage("[options] [files]").addHelpText("after", `
+    commander_1.program.name("jelly").version(options_1.VERSION).addHelpText("before", options_1.COPYRIGHT).option("-b, --basedir <directory>", "base directory for files to analyze (default: auto-detect)").option("-f, --logfile <file>", "log to file (default: log to stdout)").option("-l, --loglevel <level>", "log level (debug/verbose/info/warn/error)", "info").option("-i, --timeout <seconds>", "limit analysis time").option("-a, --dataflow-html <file>", "save data-flow graph as HTML file").option("-m, --callgraph-html <file>", "save call graph as HTML file").option("-j, --callgraph-json <file>", "save call graph as JSON file").option("-s, --soundness <file>", "compare with dynamic call graph").option("-n, --graal-home <directory>", "home of graal-nodejs (default: $GRAAL_HOME)").option("-d, --dynamic <file>", "generate call graph dynamically, no static analysis").option("--approx", "enable approximate interpretation").option("--approx-only <file>", "perform approximate interpretation, no static analysis").option("--approx-load <file>", "use pre-computed approximate interpretation results").option("-p, --patterns <file...>", "files containing API usage patterns to detect").option("-v, --vulnerabilities <file>", "report vulnerability matches").option("--vulnerabilities-json <json>", "report vulnerability matches (patterns given as JSON string)").option("--include-packages <package...>", "include only dependencies in this list").option("--exclude-packages <package...>", "exclude dependencies in this list").option("--ignore-dependencies", "don't include dependencies in analysis").option("--ignore-unresolved", "don't report errors about unresolved modules").option("--npm-test <dir>", "run 'npm test' instead of 'node' (use with -d)").option("--callgraph", "report call graph").option("--tokens-json <file>", "save tokens for constraint variables as JSON file").option("--tokens", "report tokens for constraint variables").option("--largest", "report largest token sets and subset relations").option("--no-cycle-elimination", "disable cycle elimination").option("--no-natives", "disable nonessential models of native libraries").option("--test-graal", "test graal-nodejs (use with -d)").option("--no-print-progress", "don't print analysis progress information").option("--no-tty", "don't print solver progress for TTY").option("--warnings-unsupported", "print warnings about unsupported features").option("--gc", "enable garbage collection for more accurate memory usage reporting").option("--typescript", "enable TypeScript type inference (use with -p)").option("--api-usage", "report API usage of external packages (implies --ignore-dependencies)").option("--api-exported", "report API of modules").option("--find-access-paths <location>", "find access paths for source location (file:line)").option("--higher-order-functions", "report higher-order functions").option("--zeros", "report calls with zero callees and functions with zero callers").option("--exclude-entries <glob...>", "files to exclude when specifying entry directories").option("--tracked-modules <glob...>", "modules to track usage of (default: auto-detect)").option("--external-matches", "enable pattern matches from external code").option("--no-callgraph-implicit", "omit implicit calls in call graph").option("--no-callgraph-native", "omit native calls in call graph").option("--no-callgraph-require", "omit module loading in call graph").option("--no-callgraph-external", "omit heuristic external callbacks in call graph").option("--diagnostics", "report internal analysis diagnostics").option("--diagnostics-json <file>", "save analysis diagnostics in JSON file").option("--variable-kinds", "report constraint variable kinds").option("--max-waves <number>", "limit number of fixpoint waves").option("--max-indirections <number>", "limit number of function call and property write indirections").option("--full-indirection-bounding", "enable indirection bounding for method calls and property reads (use with --max-indirections)").option("--typescript-library-usage <file>", "save TypeScript library usage in JSON file, no analysis").option("--modules-only", "report reachable packages and modules only, no analysis").option("--compare-callgraphs", "compare two call graphs given as JSON files, no analysis").option("--reachability", "compare call graph reachability (use with -s or --compare-callgraphs)").option("--library", "assume program is a library (default: true if in node_modules)").option("--skip-tests", "skip files that look like tests").option("--no-patch-escaping", "disable patching using escape analysis").option("--patch-dynamics", "enable dynamic property access patching heuristic").option("--patch-method-calls", "enable method call patching heuristic").option("--no-patch-this", "disable 'this' patching heuristic").option("--proto", "enable model of assignments to the __proto__ property").option("--obj-spread", "enable model of spread syntax for object literals ({...obj})").option("--native-overwrites", "allow overwriting of native object properties").option("--ignore-imprecise-native-calls", "ignore imprecise native calls").option("--matches-json <file>", "save vulnerability pattern matches in JSON file").option("--reachable-json <file>", "save reachable packages and modules in JSON file").option("--callstacks-json <file>", "save vulnerability call stacks in JSON file").option("--vulnerabilities-full", "full report of vulnerabilities").option("--modules-json <file>", "save modules dependencies in JSON file").option("--lazy", "lazy analysis of modules").option("--lazy-cleanup", "lazily clean up redundant tokens for lazy module analysis").usage("[options] [files]").addHelpText("after", `
 All modules reachable by require/import from the given files are included in the analysis
 (except when using --ignore-dependencies, --include-packages or --exclude-packages).
 If specifying directories instead of files, the files in the directories and their
@@ -13170,7 +13606,7 @@ Memory limit is ${(0, memory_1.getMemoryLimit)()}MB.${options_1.PKG ? "" : " Cha
           }
           if (options_1.options.vulnerabilities || options_1.options.vulnerabilitiesJson) {
             if (options_1.options.vulnerabilities)
-              logger_1.default.info(`Loading vulnerability patterns from ${options_1.options.vulnerabilities}`);
+              logger_1.default.info(`Loading vulnerability descriptors from ${options_1.options.vulnerabilities}`);
             vulnerabilityDetector = new vulnerabilitydetector_1.VulnerabilityDetector(JSON.parse(options_1.options.vulnerabilities ? (0, fs_1.readFileSync)(options_1.options.vulnerabilities, "utf8") : options_1.options.vulnerabilitiesJson));
             const ps = vulnerabilityDetector.getPatterns();
             (0, util_1.addAll)((0, patternloader_1.getGlobs)(ps), globs = globs ?? /* @__PURE__ */ new Set());
@@ -13178,6 +13614,12 @@ Memory limit is ${(0, memory_1.getMemoryLimit)()}MB.${options_1.PKG ? "" : " Cha
           }
           (0, options_1.setDefaultTrackedModules)(globs);
           (0, options_1.setPatternProperties)(options_1.options.apiUsage ? void 0 : props ?? /* @__PURE__ */ new Set());
+          if (options_1.options.lazy && !options_1.options.vulnerabilities && !options_1.options.vulnerabilitiesJson) {
+            logger_1.default.error("Error: --lazy enabled but no vulnerabilities (use --vulnerabilities or --vulnerabilities-JSON)");
+            process.exitCode = -1;
+            return;
+          }
+          (0, assert_1.default)(!options_1.options.lazy || options_1.options.trackedModules);
           const solver = new solver_1.default();
           const a = solver.globalState;
           a.vulnerabilities = vulnerabilityDetector;