@coana-tech/cli 14.12.134 → 14.12.136

package/repos/coana-tech/jelly-private/dist/bundle/approx.js

@@ -7,11 +7,11 @@ import "./iterator-helpers-polyfill.js";
 import {
   require_hints,
   require_parser
-} from "./chunk-QPIPGSUC.js";
+} from "./chunk-4VFJ6VRH.js";
 import {
   require_proxy,
   require_sandbox
-} from "./chunk-MZDUAIIH.js";
+} from "./chunk-IK6PDI7V.js";
 import {
   __commonJS,
   __name,
@@ -21,7 +21,7 @@ import {
   require_options,
   require_transform,
   require_util
-} from "./chunk-K5LIJ7OH.js";
+} from "./chunk-BDEOKPLQ.js";
 
 // lib/approx/approx.js
 var require_approx = __commonJS({

package/repos/coana-tech/jelly-private/dist/bundle/{chunk-QPIPGSUC.js → chunk-4VFJ6VRH.js}

@@ -14,7 +14,7 @@ import {
   require_options,
   require_tokens,
   require_util
-} from "./chunk-K5LIJ7OH.js";
+} from "./chunk-BDEOKPLQ.js";
 
 // lib/parsing/parser.js
 var require_parser = __commonJS({
@@ -516,4 +516,4 @@ export {
   require_patching,
   require_hints
 };
-//# sourceMappingURL=chunk-QPIPGSUC.js.map
+//# sourceMappingURL=chunk-4VFJ6VRH.js.map

package/repos/coana-tech/jelly-private/dist/bundle/{chunk-K5LIJ7OH.js → chunk-BDEOKPLQ.js}

@@ -10874,6 +10874,7 @@ var require_options = __commonJS({
       modulesJson: void 0,
       lazy: false,
       lazyCleanup: false,
+      lazySoftAssert: false,
       reparse: false,
       memory: void 0
     };
@@ -19871,4 +19872,4 @@ fill-range/index.js:
    * Licensed under the MIT License.
    *)
 */
-//# sourceMappingURL=chunk-K5LIJ7OH.js.map
+//# sourceMappingURL=chunk-BDEOKPLQ.js.map

package/repos/coana-tech/jelly-private/dist/bundle/{chunk-PYSMGG45.js → chunk-IEQ4BC6O.js}

@@ -8,7 +8,7 @@ import {
   __commonJS,
   __name,
   __require
-} from "./chunk-K5LIJ7OH.js";
+} from "./chunk-BDEOKPLQ.js";
 
 // node_modules/source-map/lib/base64.js
 var require_base64 = __commonJS({
@@ -224380,4 +224380,4 @@ typescript/lib/typescript.js:
   and limitations under the License.
   ***************************************************************************** *)
 */
-//# sourceMappingURL=chunk-PYSMGG45.js.map
+//# sourceMappingURL=chunk-IEQ4BC6O.js.map

package/repos/coana-tech/jelly-private/dist/bundle/{chunk-MZDUAIIH.js → chunk-IK6PDI7V.js}

@@ -9,7 +9,7 @@ import {
   __name,
   __require,
   require_transform
-} from "./chunk-K5LIJ7OH.js";
+} from "./chunk-BDEOKPLQ.js";
 
 // lib/approx/proxy.js
 var require_proxy = __commonJS({
@@ -268,4 +268,4 @@ export {
   require_proxy,
   require_sandbox
 };
-//# sourceMappingURL=chunk-MZDUAIIH.js.map
+//# sourceMappingURL=chunk-IK6PDI7V.js.map

package/repos/coana-tech/jelly-private/dist/bundle/hooks.js

@@ -6,10 +6,10 @@ import "./iterator-helpers-polyfill.js";
 
 import {
   require_moduleresolver
-} from "./chunk-PYSMGG45.js";
+} from "./chunk-IEQ4BC6O.js";
 import {
   require_sandbox
-} from "./chunk-MZDUAIIH.js";
+} from "./chunk-IK6PDI7V.js";
 import {
   __commonJS,
   __name,
@@ -17,7 +17,7 @@ import {
   require_files,
   require_options,
   require_transform
-} from "./chunk-K5LIJ7OH.js";
+} from "./chunk-BDEOKPLQ.js";
 
 // lib/approx/hooks.js
 var require_hooks = __commonJS({

package/repos/coana-tech/jelly-private/dist/bundle/jelly.js

@@ -9,11 +9,11 @@ import {
   require_hints,
   require_parser,
   require_patching
-} from "./chunk-QPIPGSUC.js";
+} from "./chunk-4VFJ6VRH.js";
 import {
   require_moduleresolver,
   require_typescript
-} from "./chunk-PYSMGG45.js";
+} from "./chunk-IEQ4BC6O.js";
 import {
   __commonJS,
   __name,
@@ -37,7 +37,7 @@ import {
   require_tokens,
   require_transform,
   require_util
-} from "./chunk-K5LIJ7OH.js";
+} from "./chunk-BDEOKPLQ.js";
 
 // lib/misc/timer.js
 var require_timer = __commonJS({
@@ -1075,6 +1075,8 @@ var require_diagnostics = __commonJS({
       totalOtherPatchingTime = 0n;
       finalizationTime = 0n;
       patternMatchingTime = 0n;
+      lazyTime = 0n;
+      lazyErrors;
       unhandledDynamicPropertyWrites = 0;
       unhandledDynamicPropertyReads = 0;
       vulnerabilities;
@@ -1299,7 +1301,6 @@ var require_lazy = __commonJS({
     exports.isLazyAPActive = isLazyAPActive;
     exports.assertLazyAPActive = assertLazyAPActive;
     exports.getExportedFunctionsByModule = getExportedFunctionsByModule;
-    var node_assert_1 = __importDefault(__require("node:assert"));
     var bitset_1 = require_bitset();
     var scc_1 = require_scc();
     var util_1 = require_util();
@@ -1348,12 +1349,13 @@ var require_lazy = __commonJS({
         return !a.reachedModulesFull.has(ap.moduleInfo);
     }
     __name(isLazyAPActive, "isLazyAPActive");
-    function assertLazyAPActive(ap, a) {
+    function assertLazyAPActive(ap, s) {
+      const { globalState: a } = s;
       if (ap.dependents) {
         if (ap.moduleInfo.directDependents.values().every((m) => a.reachedModulesFull.has(m)))
-          node_assert_1.default.fail(`Lazy access path ${ap} is irrelevant, all dependents are already reached`);
+          s.assertLazy`Lazy access path ${ap} is irrelevant, all dependents are already reached`;
       } else if (a.reachedModulesFull.has(ap.moduleInfo))
-        node_assert_1.default.fail(`Lazy access path ${ap} is irrelevant, module ${ap.moduleInfo} is already reached`);
+        s.assertLazy`Lazy access path ${ap} is irrelevant, module ${ap.moduleInfo} is already reached`;
     }
     __name(assertLazyAPActive, "assertLazyAPActive");
     function getExportedFunctionsByModule(ms, solver) {
@@ -1382,7 +1384,10 @@ var require_lazy = __commonJS({
       const exportedFunctionsByModule = /* @__PURE__ */ new Map();
       for (const rep of sccs.reverse()) {
         const bs = bitsets.get(rep);
-        (0, node_assert_1.default)(!bs.isEmpty());
+        if (bs.isEmpty()) {
+          solver.assertLazy`Unexpected empty bitset for representative ${rep}`;
+          continue;
+        }
         for (const t of sets.get(rep)) {
           const es = graph.get(t);
           if (es?.size)
@@ -1448,12 +1453,13 @@ var require_solver = __commonJS({
     };
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.AbortedException = void 0;
+    var assert_1 = __importDefault(__require("assert"));
+    var util_1 = __require("util");
     var constraintvars_1 = require_constraintvars();
     var logger_1 = __importStar(require_logger());
     var tokens_1 = require_tokens();
     var globalstate_1 = require_globalstate();
-    var util_1 = require_util();
-    var assert_1 = __importDefault(__require("assert"));
+    var util_2 = require_util();
     var accesspaths_1 = require_accesspaths();
     var types_1 = __require("@babel/types");
     var fragmentstate_1 = require_fragmentstate();
@@ -1506,7 +1512,7 @@ var require_solver = __commonJS({
           f.tokenListeners2,
           f.arrayEntriesListeners,
           f.objectPropertiesListeners
-        ].reduce((acc, l) => acc + (0, util_1.mapMapSize)(l), 0);
+        ].reduce((acc, l) => acc + (0, util_2.mapMapSize)(l), 0);
         d.tokens = f.numberOfTokens;
         d.subsetEdges = f.numberOfSubsetEdges;
         d.functionToFunctionEdges = f.numberOfFunctionToFunctionEdges;
@@ -1561,7 +1567,7 @@ var require_solver = __commonJS({
         }
         if (!ws)
           ws = this.unprocessedTokens.get(toRep);
-        ws = (0, util_1.pushArraySingle)(this.unprocessedTokens, toRep, t, ws);
+        ws = (0, util_2.pushArraySingle)(this.unprocessedTokens, toRep, t, ws);
         this.diagnostics.unprocessedTokensSize++;
         if (this.diagnostics.unprocessedTokensSize % 100 === 0)
           this.printDiagnostics();
@@ -1581,13 +1587,13 @@ var require_solver = __commonJS({
         if (!(ap2 instanceof accesspaths_1.UnknownAccessPath || ap2 instanceof accesspaths_1.IgnoredAccessPath || ap2 instanceof accesspaths_1.LazyAccessPath) && (to instanceof constraintvars_1.NodeVar || to instanceof constraintvars_1.IntermediateVar && to.label === "import")) {
           (0, assert_1.default)(node !== void 0 && encl !== void 0);
           if (ap2 instanceof accesspaths_1.ModuleAccessPath)
-            (0, util_1.mapGetMap)(f.moduleAccessPaths, ap2).set(node, encl);
+            (0, util_2.mapGetMap)(f.moduleAccessPaths, ap2).set(node, encl);
           else if (ap2 instanceof accesspaths_1.PropertyAccessPath)
-            (0, util_1.mapGetMap)((0, util_1.mapGetMap)(asn ? f.propertyWriteAccessPaths : f.propertyReadAccessPaths, subap), ap2.prop).set(node, { bp: ap2, sub: ap2.base, encl });
+            (0, util_2.mapGetMap)((0, util_2.mapGetMap)(asn ? f.propertyWriteAccessPaths : f.propertyReadAccessPaths, subap), ap2.prop).set(node, { bp: ap2, sub: ap2.base, encl });
           else if (ap2 instanceof accesspaths_1.CallResultAccessPath)
-            (0, util_1.mapGetMap)(f.callResultAccessPaths, subap).set(node, { bp: ap2, sub: ap2.caller, encl });
+            (0, util_2.mapGetMap)(f.callResultAccessPaths, subap).set(node, { bp: ap2, sub: ap2.caller, encl });
           else if (ap2 instanceof accesspaths_1.ComponentAccessPath)
-            (0, util_1.mapGetMap)(f.componentAccessPaths, subap).set(node, { bp: ap2, sub: ap2.component, encl });
+            (0, util_2.mapGetMap)(f.componentAccessPaths, subap).set(node, { bp: ap2, sub: ap2.component, encl });
           else
             assert_1.default.fail("Unexpected AccessPath");
         }
@@ -1617,11 +1623,11 @@ var require_solver = __commonJS({
       addSubsetEdge(fromRep, toRep) {
         if (fromRep !== toRep) {
           const f = this.fragmentState;
-          const s = (0, util_1.mapGetSet)(f.subsetEdges, fromRep);
+          const s = (0, util_2.mapGetSet)(f.subsetEdges, fromRep);
           if (!s.has(toRep)) {
             s.add(toRep);
             f.numberOfSubsetEdges++;
-            (0, util_1.mapGetSet)(f.reverseSubsetEdges, toRep).add(fromRep);
+            (0, util_2.mapGetSet)(f.reverseSubsetEdges, toRep).add(fromRep);
             if (logger_1.default.isVerboseEnabled())
               (0, assert_1.default)(!f.redirections.has(fromRep) && !f.redirections.has(toRep));
             f.vars.add(fromRep);
@@ -1642,7 +1648,7 @@ var require_solver = __commonJS({
         const x = this.listeners.get(id);
         if (x) {
           if (x.l !== key.l || x.n !== key.n || x.t !== key.t || x.s !== key.s) {
-            const format = /* @__PURE__ */ __name((x2) => `(${listeners_1.TokenListener[x2.l] ?? ""}${x2.t ?? ""},${x2.s ?? ""},${x2.n ? (0, util_1.nodeToString)(x2.n) : ""},${x2.n ? ` at ${(0, util_1.locationToStringWithFileAndEnd)(x2.n.loc)}` : ""}`, "format");
+            const format = /* @__PURE__ */ __name((x2) => `(${listeners_1.TokenListener[x2.l] ?? ""}${x2.t ?? ""},${x2.s ?? ""},${x2.n ? (0, util_2.nodeToString)(x2.n) : ""},${x2.n ? ` at ${(0, util_2.locationToStringWithFileAndEnd)(x2.n.loc)}` : ""}`, "format");
             logger_1.default.error(`Error: Hash collision in getListenerID ${id}: ${format(x)} != ${format(key)}`);
           }
         } else
@@ -1655,9 +1661,9 @@ var require_solver = __commonJS({
           id += BigInt(key.t.hash);
         }
         if (key.n)
-          id += (0, util_1.getNodeHash)(key.n);
+          id += (0, util_2.getNodeHash)(key.n);
         if (key.s)
-          id ^= BigInt((0, util_1.strHash)(key.s));
+          id ^= BigInt((0, util_2.strHash)(key.s));
         id = id << 16n | BigInt(key.l);
         this.checkListenerIDCollision(id, key);
         return id;
@@ -1669,7 +1675,7 @@ var require_solver = __commonJS({
         const vRep = f.getRepresentative(v);
         const lkey = { l: key, ...(0, types_1.isNode)(opts) ? { n: opts } : opts };
         if (logger_1.default.isDebugEnabled())
-          logger_1.default.debug(`Adding universally quantified constraint #${listeners_1.TokenListener[key]} to ${vRep} at ${lkey.n ? (0, util_1.locationToStringWithFileAndEnd)(lkey.n.loc) : lkey.t}`);
+          logger_1.default.debug(`Adding universally quantified constraint #${listeners_1.TokenListener[key]} to ${vRep} at ${lkey.n ? (0, util_2.locationToStringWithFileAndEnd)(lkey.n.loc) : lkey.t}`);
         this.addForAllTokensConstraintPrivate(vRep, this.getListenerID(lkey), key, listener);
       }
       addForAllTokensConstraintPrivate(vRep, id, key, listener) {
@@ -1695,7 +1701,7 @@ var require_solver = __commonJS({
                 }
               break;
           }
-        const m = (0, util_1.mapGetMap)(bound ? f.tokenListeners2 : f.tokenListeners, vRep);
+        const m = (0, util_2.mapGetMap)(bound ? f.tokenListeners2 : f.tokenListeners, vRep);
         if (!m.has(id)) {
           if (bound)
             for (const t of f.getTokens(vRep))
@@ -1710,7 +1716,7 @@ var require_solver = __commonJS({
         return false;
       }
       callTokenListener(id, listener, t, now) {
-        const s = (0, util_1.mapGetSet)(this.fragmentState.listenersProcessed, id);
+        const s = (0, util_2.mapGetSet)(this.fragmentState.listenersProcessed, id);
         if (!s.has(t)) {
           s.add(t);
           if (now)
@@ -1722,7 +1728,7 @@ var require_solver = __commonJS({
         }
       }
       callTokenListener2(id, listener, t) {
-        const s = (0, util_1.mapGetSet)(this.fragmentState.listenersProcessed, id);
+        const s = (0, util_2.mapGetSet)(this.fragmentState.listenersProcessed, id);
         if (!s.has(t)) {
           s.add(t);
           this.enqueueListenerCall2([listener, t]);
@@ -1731,7 +1737,7 @@ var require_solver = __commonJS({
       }
       addForAllAncestorsConstraint(t, key, opts, listener) {
         if (logger_1.default.isDebugEnabled())
-          logger_1.default.debug(`Adding ancestors constraint to ${t} ${opts.n ? `at ${(0, util_1.nodeToString)(opts.n)}` : `${listeners_1.TokenListener[key]} ${opts.s}`}`);
+          logger_1.default.debug(`Adding ancestors constraint to ${t} ${opts.n ? `at ${(0, util_2.nodeToString)(opts.n)}` : `${listeners_1.TokenListener[key]} ${opts.s}`}`);
         const id = this.getListenerID({ ...opts, l: key, t });
         const anc = this.fragmentState.getRepresentative(this.varProducer.ancestorsVar(t));
         if (this.addForAllTokensConstraintPrivate(anc, id, key, listener)) {
@@ -1795,7 +1801,7 @@ var require_solver = __commonJS({
       }
       runArrayEntriesListener(t, id, listener) {
         const f = this.fragmentState;
-        const m = (0, util_1.mapGetMap)(f.arrayEntriesListeners, t);
+        const m = (0, util_2.mapGetMap)(f.arrayEntriesListeners, t);
         if (!m.has(id)) {
           const ps = f.arrayEntries.get(t);
           if (ps)
@@ -1808,10 +1814,10 @@ var require_solver = __commonJS({
           return false;
       }
       addArrayEntry(a, prop) {
-        if (!(0, util_1.isArrayIndex)(prop))
+        if (!(0, util_2.isArrayIndex)(prop))
           return;
         const f = this.fragmentState;
-        const ps = (0, util_1.mapGetSet)(f.arrayEntries, a);
+        const ps = (0, util_2.mapGetSet)(f.arrayEntries, a);
         if (!ps.has(prop)) {
           if (logger_1.default.isDebugEnabled())
             logger_1.default.debug(`Adding array entry ${a}[${prop}]`);
@@ -1836,7 +1842,7 @@ var require_solver = __commonJS({
       }
       runObjectPropertiesListener(t, id, listener) {
         const f = this.fragmentState;
-        const m = (0, util_1.mapGetMap)(f.objectPropertiesListeners, t);
+        const m = (0, util_2.mapGetMap)(f.objectPropertiesListeners, t);
         if (!m.has(id)) {
           const ps = f.objectProperties.get(t);
           if (ps) {
@@ -1852,7 +1858,7 @@ var require_solver = __commonJS({
       }
       addObjectProperty(a, prop) {
         const f = this.fragmentState;
-        const ps = (0, util_1.mapGetSet)(f.objectProperties, a);
+        const ps = (0, util_2.mapGetSet)(f.objectProperties, a);
         if (!ps.has(prop)) {
           if (logger_1.default.isDebugEnabled())
             logger_1.default.debug(`Adding object property ${a}.${prop}`);
@@ -1894,8 +1900,8 @@ var require_solver = __commonJS({
         for (const t of f.getTokens(rep))
           if (!has(t))
             rts.add(t);
-        const repOut = (0, util_1.mapGetSet)(f.subsetEdges, rep);
-        const repIn = (0, util_1.mapGetSet)(f.reverseSubsetEdges, rep);
+        const repOut = (0, util_2.mapGetSet)(f.subsetEdges, rep);
+        const repIn = (0, util_2.mapGetSet)(f.reverseSubsetEdges, rep);
         const vOut = f.subsetEdges.get(v);
         if (vOut) {
           for (const w of vOut) {
@@ -1938,7 +1944,7 @@ var require_solver = __commonJS({
           f.reverseSubsetEdges.delete(rep);
         const tr = f.tokenListeners.get(v);
         if (tr) {
-          const qr = (0, util_1.mapGetMap)(f.tokenListeners, rep);
+          const qr = (0, util_2.mapGetMap)(f.tokenListeners, rep);
           for (const [k, listener] of tr)
             if (!qr.has(k)) {
               qr.set(k, listener);
@@ -1949,7 +1955,7 @@ var require_solver = __commonJS({
         }
         const tr2 = f.tokenListeners2.get(v);
         if (tr2) {
-          const qr = (0, util_1.mapGetMap)(f.tokenListeners2, rep);
+          const qr = (0, util_2.mapGetMap)(f.tokenListeners2, rep);
           for (const [k, listener] of tr2)
             if (!qr.has(k)) {
               qr.set(k, listener);
@@ -2146,6 +2152,15 @@ var require_solver = __commonJS({
           }
         }
       }
+      assertLazy(strings, ...values) {
+        const template = strings.join("%s");
+        if (options_1.options.lazySoftAssert) {
+          const errs = (this.diagnostics.lazyErrors ??= {})[template] ??= { messages: [], count: 0 };
+          if (++errs.count <= 5)
+            errs.messages.push((0, util_1.format)(template, ...values));
+        } else
+          assert_1.default.fail((0, util_1.format)(template, ...values));
+      }
     };
     exports.default = Solver;
   }
@@ -4364,11 +4379,14 @@ var require_analyzer = __commonJS({
               const funs = /* @__PURE__ */ new Map();
               for (const [vs, fun] of a.vulnerabilities.patternMatch(solver.fragmentState, void 0, solver.diagnostics).values())
                 (0, util_1.addAll)(vs, (0, util_1.mapGetSet)(funs, fun));
+              let t;
               const reachingFunctions = /* @__PURE__ */ new Set();
               if (funs.size) {
                 (0, finalization_1.finalizeCallEdges)(solver);
+                t = new timer_1.default();
                 (0, util_1.addAll)(a.vulnerabilities.findFunctionsThatMayReachVulnerableFunctions(funs, f2).keys(), reachingFunctions);
-              }
+              } else
+                t = new timer_1.default();
               if (logger_1.default.isVerboseEnabled())
                 logger_1.default.verbose(`Lazy: Functions that may reach vulnerable functions: ${reachingFunctions.size}`);
               const isCandidate = /* @__PURE__ */ __name((m) => m.directDependents.values().some((d2) => !a.reachedModulesFull.has(d2)), "isCandidate");
@@ -4393,20 +4411,24 @@ var require_analyzer = __commonJS({
               }
               for (const [m, ts] of (0, lazy_1.getExportedFunctionsByModule)(candidateModules, solver)) {
                 const ap = new accesspaths_1.LazyAccessPath(m, true);
-                for (const t of ts) {
-                  for (const param of t.fun.params)
+                for (const t2 of ts) {
+                  for (const param of t2.fun.params)
                     if ((0, types_1.isIdentifier)(param))
                       solver.addAccessPath(ap, f2.varProducer.nodeVar(param));
-                  if (f2.functionsWithThis.has(t.fun))
-                    solver.addAccessPath(ap, f2.varProducer.thisVar(t.fun));
-                  if (f2.functionsWithArguments.has(t.fun))
-                    solver.addAccessPath(ap, f2.varProducer.argumentsVar(t.fun));
+                  if (f2.functionsWithThis.has(t2.fun))
+                    solver.addAccessPath(ap, f2.varProducer.thisVar(t2.fun));
+                  if (f2.functionsWithArguments.has(t2.fun))
+                    solver.addAccessPath(ap, f2.varProducer.argumentsVar(t2.fun));
                 }
               }
-              await solver.propagate("Lazy loading");
+              {
+                const t2 = new timer_1.default();
+                await solver.propagate("Lazy loading");
+                d.lazyTime -= t2.elapsed();
+              }
               for (const m of candidateModules) {
                 const ap = a.canonicalizeAccessPath(new accesspaths_1.LazyAccessPath(m, true));
-                (0, lazy_1.assertLazyAPActive)(ap, a);
+                (0, lazy_1.assertLazyAPActive)(ap, solver);
                 const v = f2.varProducer.objPropVar(a.canonicalizeToken(new tokens_1.NativeObjectToken("module", m)), "exports");
                 (0, util_1.mapGetSet)(f2.lazyEscaping, ap).add(v);
               }
@@ -4424,25 +4446,25 @@ var require_analyzer = __commonJS({
                 lazyEscapingTokens.set(ap, ts);
               }
               const [graph] = (0, lazy_1.constructTokenReachabilityGraph)(roots, solver);
-              const vulnTokens = graph.keys().filter((t) => t instanceof tokens_1.AccessPathToken && !(t.ap instanceof accesspaths_1.UnknownAccessPath || t.ap instanceof accesspaths_1.IgnoredAccessPath || t.ap instanceof accesspaths_1.LazyAccessPath) || t instanceof tokens_1.FunctionToken && reachingFunctions.has(a.functionInfos.get(t.fun))).toArray();
+              const vulnTokens = graph.keys().filter((t2) => t2 instanceof tokens_1.AccessPathToken && !(t2.ap instanceof accesspaths_1.UnknownAccessPath || t2.ap instanceof accesspaths_1.IgnoredAccessPath || t2.ap instanceof accesspaths_1.LazyAccessPath) || t2 instanceof tokens_1.FunctionToken && reachingFunctions.has(a.functionInfos.get(t2.fun))).toArray();
               if (vulnTokens.length) {
                 const rGraph = (0, util_1.getReverseGraph)(graph);
                 const worklist = vulnTokens;
                 const visited = new Set(worklist);
                 while (worklist.length) {
-                  const t = worklist.pop();
-                  const es = rGraph.get(t);
+                  const t2 = worklist.pop();
+                  const es = rGraph.get(t2);
                   if (es) {
-                    for (const t2 of es)
-                      if (!visited.has(t2)) {
-                        visited.add(t2);
-                        worklist.push(t2);
+                    for (const t22 of es)
+                      if (!visited.has(t22)) {
+                        visited.add(t22);
+                        worklist.push(t22);
                       }
                   }
                 }
                 for (const [ap, ts] of lazyEscapingTokens)
-                  for (const t of ts)
-                    if (visited.has(t)) {
+                  for (const t2 of ts)
+                    if (visited.has(t2)) {
                       if (ap.dependents) {
                         if (logger_1.default.isVerboseEnabled())
                           logger_1.default.verbose(`Lazy: Including ${ap.moduleInfo.directDependents.size} dependents of ${ap.moduleInfo}`);
@@ -4456,6 +4478,7 @@ var require_analyzer = __commonJS({
                       break;
                     }
               }
+              d.lazyTime += t.elapsed();
               solver.updateDiagnostics();
             }
           }
@@ -13461,7 +13484,7 @@ var require_main = __commonJS({
     var assert_1 = __importDefault(__require("assert"));
     var semver_1 = __importDefault(require_semver2());
     var ENGINES_NODE = require_package()?.engines?.node;
-    commander_1.program.name("jelly").version(options_1.VERSION).addHelpText("before", options_1.COPYRIGHT).option("-b, --basedir <directory>", "base directory for files to analyze (default: auto-detect)").option("-f, --logfile <file>", "log to file (default: log to stdout)").option("-l, --loglevel <level>", "log level (debug/verbose/info/warn/error)", "info").option("-i, --timeout <seconds>", "limit analysis time").option("-a, --dataflow-html <file>", "save data-flow graph as HTML file").option("-m, --callgraph-html <file>", "save call graph as HTML file").option("-j, --callgraph-json <file>", "save call graph as JSON file").option("-s, --soundness <file>", "compare with dynamic call graph").option("-n, --graal-home <directory>", "home of graal-nodejs (default: $GRAAL_HOME)").option("-d, --dynamic <file>", "generate call graph dynamically, no static analysis").option("--approx", "enable approximate interpretation").option("--approx-only <file>", "perform approximate interpretation, no static analysis").option("--approx-load <file>", "use pre-computed approximate interpretation results").option("-p, --patterns <file...>", "files containing API usage patterns to detect").option("-v, --vulnerabilities <file>", "report vulnerability matches").option("--vulnerabilities-json <json>", "report vulnerability matches (patterns given as JSON string)").option("--include-packages <package...>", "include only dependencies in this list").option("--exclude-packages <package...>", "exclude dependencies in this list").option("--ignore-dependencies", "don't include dependencies in analysis").option("--ignore-unresolved", "don't report errors about unresolved modules").option("--npm-test <dir>", "run 'npm test' instead of 'node' (use with -d)").option("--callgraph", "report call graph").option("--tokens-json <file>", "save tokens for constraint variables as JSON file").option("--tokens", "report tokens for constraint variables").option("--largest", "report largest token sets and subset relations").option("--no-cycle-elimination", "disable cycle elimination").option("--no-natives", "disable nonessential models of native libraries").option("--test-graal", "test graal-nodejs (use with -d)").option("--no-print-progress", "don't print analysis progress information").option("--no-tty", "don't print solver progress for TTY").option("--warnings-unsupported", "print warnings about unsupported features").option("--gc", "enable garbage collection for more accurate memory usage reporting").option("--typescript", "enable TypeScript type inference (use with -p)").option("--api-usage", "report API usage of external packages (implies --ignore-dependencies)").option("--api-exported", "report API of modules").option("--find-access-paths <location>", "find access paths for source location (file:line)").option("--higher-order-functions", "report higher-order functions").option("--zeros", "report calls with zero callees and functions with zero callers").option("--exclude-entries <glob...>", "files to exclude when specifying entry directories").option("--tracked-modules <glob...>", "modules to track usage of (default: auto-detect)").option("--external-matches", "enable pattern matches from external code").option("--no-callgraph-implicit", "omit implicit calls in call graph").option("--no-callgraph-native", "omit native calls in call graph").option("--no-callgraph-require", "omit module loading in call graph").option("--no-callgraph-external", "omit heuristic external callbacks in call graph").option("--diagnostics", "report internal analysis diagnostics").option("--diagnostics-json <file>", "save analysis diagnostics in JSON file").option("--variable-kinds", "report constraint variable kinds").option("--max-waves <number>", "limit number of fixpoint waves").option("--max-indirections <number>", "limit number of function call and property write indirections").option("--full-indirection-bounding", "enable indirection bounding for method calls and property reads (use with --max-indirections)").option("--typescript-library-usage <file>", "save TypeScript library usage in JSON file, no analysis").option("--modules-only", "report reachable packages and modules only, no analysis").option("--compare-callgraphs", "compare two call graphs given as JSON files, no analysis").option("--reachability", "compare call graph reachability (use with -s or --compare-callgraphs)").option("--library", "assume program is a library (default: true if in node_modules)").option("--skip-tests", "skip files that look like tests").option("--no-patch-escaping", "disable patching using escape analysis").option("--patch-dynamics", "enable dynamic property access patching heuristic").option("--patch-method-calls", "enable method call patching heuristic").option("--no-patch-this", "disable 'this' patching heuristic").option("--proto", "enable model of assignments to the __proto__ property").option("--obj-spread", "enable model of spread syntax for object literals ({...obj})").option("--native-overwrites", "allow overwriting of native object properties").option("--ignore-imprecise-native-calls", "ignore imprecise native calls").option("--matches-json <file>", "save vulnerability pattern matches in JSON file").option("--reachable-json <file>", "save reachable packages and modules in JSON file").option("--callstacks-json <file>", "save vulnerability call stacks in JSON file").option("--vulnerabilities-full", "full report of vulnerabilities").option("--modules-json <file>", "save modules dependencies in JSON file").option("--lazy", "lazy analysis of modules").option("--lazy-cleanup", "lazily clean up redundant tokens for lazy module analysis").option("--reparse", "reparse by need (use with --lazy)").option("--memory <limit>", "abort if reaching selected fraction of memory limit").usage("[options] [files]").addHelpText("after", `
+    commander_1.program.name("jelly").version(options_1.VERSION).addHelpText("before", options_1.COPYRIGHT).option("-b, --basedir <directory>", "base directory for files to analyze (default: auto-detect)").option("-f, --logfile <file>", "log to file (default: log to stdout)").option("-l, --loglevel <level>", "log level (debug/verbose/info/warn/error)", "info").option("-i, --timeout <seconds>", "limit analysis time").option("-a, --dataflow-html <file>", "save data-flow graph as HTML file").option("-m, --callgraph-html <file>", "save call graph as HTML file").option("-j, --callgraph-json <file>", "save call graph as JSON file").option("-s, --soundness <file>", "compare with dynamic call graph").option("-n, --graal-home <directory>", "home of graal-nodejs (default: $GRAAL_HOME)").option("-d, --dynamic <file>", "generate call graph dynamically, no static analysis").option("--approx", "enable approximate interpretation").option("--approx-only <file>", "perform approximate interpretation, no static analysis").option("--approx-load <file>", "use pre-computed approximate interpretation results").option("-p, --patterns <file...>", "files containing API usage patterns to detect").option("-v, --vulnerabilities <file>", "report vulnerability matches").option("--vulnerabilities-json <json>", "report vulnerability matches (patterns given as JSON string)").option("--include-packages <package...>", "include only dependencies in this list").option("--exclude-packages <package...>", "exclude dependencies in this list").option("--ignore-dependencies", "don't include dependencies in analysis").option("--ignore-unresolved", "don't report errors about unresolved modules").option("--npm-test <dir>", "run 'npm test' instead of 'node' (use with -d)").option("--callgraph", "report call graph").option("--tokens-json <file>", "save tokens for constraint variables as JSON file").option("--tokens", "report tokens for constraint variables").option("--largest", "report largest token sets and subset relations").option("--no-cycle-elimination", "disable cycle elimination").option("--no-natives", "disable nonessential models of native libraries").option("--test-graal", "test graal-nodejs (use with -d)").option("--no-print-progress", "don't print analysis progress information").option("--no-tty", "don't print solver progress for TTY").option("--warnings-unsupported", "print warnings about unsupported features").option("--gc", "enable garbage collection for more accurate memory usage reporting").option("--typescript", "enable TypeScript type inference (use with -p)").option("--api-usage", "report API usage of external packages (implies --ignore-dependencies)").option("--api-exported", "report API of modules").option("--find-access-paths <location>", "find access paths for source location (file:line)").option("--higher-order-functions", "report higher-order functions").option("--zeros", "report calls with zero callees and functions with zero callers").option("--exclude-entries <glob...>", "files to exclude when specifying entry directories").option("--tracked-modules <glob...>", "modules to track usage of (default: auto-detect)").option("--external-matches", "enable pattern matches from external code").option("--no-callgraph-implicit", "omit implicit calls in call graph").option("--no-callgraph-native", "omit native calls in call graph").option("--no-callgraph-require", "omit module loading in call graph").option("--no-callgraph-external", "omit heuristic external callbacks in call graph").option("--diagnostics", "report internal analysis diagnostics").option("--diagnostics-json <file>", "save analysis diagnostics in JSON file").option("--variable-kinds", "report constraint variable kinds").option("--max-waves <number>", "limit number of fixpoint waves").option("--max-indirections <number>", "limit number of function call and property write indirections").option("--full-indirection-bounding", "enable indirection bounding for method calls and property reads (use with --max-indirections)").option("--typescript-library-usage <file>", "save TypeScript library usage in JSON file, no analysis").option("--modules-only", "report reachable packages and modules only, no analysis").option("--compare-callgraphs", "compare two call graphs given as JSON files, no analysis").option("--reachability", "compare call graph reachability (use with -s or --compare-callgraphs)").option("--library", "assume program is a library (default: true if in node_modules)").option("--skip-tests", "skip files that look like tests").option("--no-patch-escaping", "disable patching using escape analysis").option("--patch-dynamics", "enable dynamic property access patching heuristic").option("--patch-method-calls", "enable method call patching heuristic").option("--no-patch-this", "disable 'this' patching heuristic").option("--proto", "enable model of assignments to the __proto__ property").option("--obj-spread", "enable model of spread syntax for object literals ({...obj})").option("--native-overwrites", "allow overwriting of native object properties").option("--ignore-imprecise-native-calls", "ignore imprecise native calls").option("--matches-json <file>", "save vulnerability pattern matches in JSON file").option("--reachable-json <file>", "save reachable packages and modules in JSON file").option("--callstacks-json <file>", "save vulnerability call stacks in JSON file").option("--vulnerabilities-full", "full report of vulnerabilities").option("--modules-json <file>", "save modules dependencies in JSON file").option("--lazy", "lazy analysis of modules").option("--lazy-cleanup", "lazily clean up redundant tokens for lazy module analysis").option("--lazy-soft-assert", "assertions for --lazy mode are non-fatal (see diagnostics)").option("--reparse", "reparse by need (use with --lazy)").option("--memory <limit>", "abort if reaching selected fraction of memory limit").usage("[options] [files]").addHelpText("after", `
 All modules reachable by require/import from the given files are included in the analysis
 (except when using --ignore-dependencies, --include-packages or --exclude-packages).
 If specifying directories instead of files, the files in the directories and their