npm - @cupel-sh/cli - Versions diffs - 0.1.0 → 0.2.0 - Mend

@cupel-sh/cli 0.1.0 → 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/bundle/cli.js +26 -26
package/package.json +1 -1

package/bundle/cli.js CHANGED Viewed

@@ -1,42 +1,42 @@
 #!/usr/bin/env node
-import{randomBytes as io}from"node:crypto";import{readFileSync as Oc,renameSync as $c,writeFileSync as ro}from"node:fs";import Lc from"node:path";import{fileURLToPath as Pc}from"node:url";var oo=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function yn(e){if(!oo.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function Ln(e,n){let t=e.split(".").map(Number),r=n.split(".").map(Number);for(let i=0;i<3;i+=1){let s=t[i]??0,l=r[i]??0;if(s!==l)return s<l?-1:1}return 0}var yt=["dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function en(e,n){let t=yn(e);return!(n.introduced!=="0"&&Ln(t,yn(n.introduced))<0||n.fixed!==void 0&&Ln(t,yn(n.fixed))>=0||n.lastAffected!==void 0&&Ln(t,yn(n.lastAffected))>0)}function Pn(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),i=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),l=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let o=s.get(a.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let m=n.get(f.moduleId);m!==void 0&&m.packageName!==u.packageName&&l.push({packageName:m.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:a.resolution})}return l}function ao(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,r)=>t.analyzedVersion<r.analyzedVersion?1:t.analyzedVersion>r.analyzedVersion?-1:0)}function lo(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function vi(e,n,t,r,i,s){if(s<=0)return null;let l=null,a=o=>{(l===null||o.hops<l.hops)&&(l=o)};for(let o of ao(e,n))for(let c of o.edges){if(c.entryExport!==t||c.entryContainer!==r)continue;if(lo(c,i,o.packageName)){a({viaPackages:[],hops:c.hops,provenance:{tool:o.tool,toolVersion:o.toolVersion,analyzedVersion:o.analyzedVersion}});continue}if(c.target.kind!=="dep")continue;let u=vi(e,c.target.calleePackage,c.target.calleeExport,null,i,s-1);u!==null&&a({viaPackages:[c.target.calleePackage,...u.viaPackages],hops:c.hops+u.hops,provenance:u.provenance})}return l}function xt(e,n,t,r,i,s){let l=null;for(let a of Pn(e,n,t)){let o=vi(i,a.packageName,a.exportName,a.container,r,s);o!==null&&(l===null||o.hops<l.totalHops)&&(l={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:o.viaPackages,totalHops:o.hops,provenance:o.provenance})}return l}function xn(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Rn(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function _i(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(i.moduleId)??[];s.push(r.resolvedModuleId),n.set(i.moduleId,s)}return n}function co(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(r.resolvedModuleId)??[];s.push(i.moduleId),n.set(r.resolvedModuleId,s)}return n}function nn(e){let n=_i(e),t=new Set,r=e.modules.filter(i=>i.isEntrypoint).map(i=>i.id);for(;r.length>0;){let i=r.pop();if(!(i===void 0||t.has(i))){t.add(i);for(let s of n.get(i)??[])t.has(s)||r.push(s)}}return t}function uo(e,n){let t=co(e),r=new Set,i=[n];for(;i.length>0;){let s=i.pop();if(!(s===void 0||r.has(s))){r.add(s);for(let l of t.get(s)??[])r.has(l)||i.push(l)}}return r}function fo(e,n,t){let r=_i(e),i=Rn(e),s=new Set,l=[n];for(;l.length>0;){let a=l.pop();if(a===void 0||s.has(a))continue;s.add(a);let o=i.get(a);if(o===void 0||o.externalSurface===!0||t.has(a))return!0;for(let c of r.get(a)??[])s.has(c)||l.push(c)}return!1}function po(e){let n=new Set(e.modules.filter(l=>l.isEntrypoint).map(l=>l.id)),t=new Map(e.functions.map(l=>[l.id,l])),r=Rn(e),i=new Map;for(let l of e.functions)n.has(l.moduleId)&&(l.publicSurfaceReachable||l.name==="<toplevel>")&&i.set(l.id,l);let s=new Map(e.exports.map(l=>[l.id,l]));for(let l of e.exportBindings){if(l.target.kind!=="function")continue;let a=s.get(l.exportId);if(a===void 0||!n.has(a.moduleId))continue;let o=t.get(l.target.functionId);o===void 0||r.get(o.moduleId)?.externalSurface===!0||i.set(o.id,o)}return[...i.values()]}function Ai(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let i=e.slice(t+n.length).split("/"),s=i[0]?.startsWith("@")===!0?2:1;return i.slice(s).join("/")}function mo(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let r=t.symbolKind==="method"||t.symbolKind==="ctor",i=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let l=n.get(s.moduleId);if(l===void 0||l.packageName!==t.packageName)return!1;if(r){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||i.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return l.externalSurface===!0?!0:Ai(l.path)===t.sourcePath})}function Ii(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Ai(t.path)===n.sourcePath)}function ho(e,n,t,r){let i=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(l=>{let a=i.get(l);if(a?.name!==r.exportName)return!1;let o=n.get(a.moduleId);return o?.externalSurface===!0&&o.packageName===r.packageName&&t.has(a.moduleId)}))}function go(e,n,t){return t.container===null?!0:e.classes.some(r=>{if(r.name!==t.container)return!1;let i=n.get(r.moduleId);return i!==void 0&&i.packageName===t.packageName&&i.externalSurface!==!0})}function yo(e,n,t){let r=new Map(e.callSites.map(o=>[o.id,o.enclosingFunctionId])),i=new Map;for(let o of e.callEdges){let c=r.get(o.callSiteId);if(c===void 0)continue;let u=i.get(c)??[];u.push({to:o.calleeFunctionId,res:o.resolution}),i.set(c,u)}let s=o=>{let c=new Set,u=n.map(f=>({id:f.id,prev:null}));for(let f of u)c.add(f.id);for(;u.length>0;){let f=u.shift();if(f===void 0)break;if(f.id===t){let m=[];for(let h=f;h!==null;h=h.prev)m.unshift(h.id);return m}for(let m of i.get(f.id)??[])m.res!=="unresolved"&&(m.res==="field-based"&&!o||c.has(m.to)||(c.add(m.to),u.push({id:m.to,prev:f})))}return null},l=s(!1);if(l!==null)return{path:l,usedFieldBased:!1};let a=s(!0);return a!==null?{path:a,usedFieldBased:!0}:null}function xo(e,n,t,r){let i=[],s=[],l=new Map(e.functions.map(o=>[o.id,o.moduleId])),a=o=>o!==void 0&&t.has(o)&&r.has(n.get(o)?.packageName??"");for(let o of e.callSites)o.resolution==="unresolved"&&a(l.get(o.enclosingFunctionId))&&i.push(o.range);for(let o of e.imports)!o.specifierIsLiteral&&t.has(o.moduleId)&&s.push({path:n.get(o.moduleId)?.path??"",start:0,end:0});return{dispatch:i,load:s}}function So(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function bo(e,n){let t=new Map(e.functions.map(i=>[i.id,i])),r=Rn(e);return n.map(i=>{let s=t.get(i),l=s!==void 0?r.get(s.moduleId):void 0;return{functionId:i,functionName:s?.name,modulePath:l?.path??""}})}function St(e){let{graph:n,installed:t,range:r,symbol:i,coverage:s}=e,l=[],a=So(n),o=new Set;for(let _ of e.incompleteness)_.reach.kind==="unbounded"&&o.add(_.source);let c=new Map,u=_=>{let $=c.get(_);return $===void 0&&($=fo(n,_,o),c.set(_,$)),$},f=_=>_.reach.kind==="class-scope"&&i!==null&&i.packageName===_.reach.packageName&&i.container===_.reach.container,m=_=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let $ of yt)for(let R of e.incompleteness)if(R.cause===$&&_(R))return{cause:R.cause,source:R.source};return null},h=_=>{let $;return m(R=>R.reach.kind==="unbounded"?!0:R.reach.kind==="class-scope"?f(R):_===void 0||u(R.reach.anchor)?!0:($??=uo(n,_),$.has(R.reach.anchor)))},k=()=>m(_=>_.reach.kind==="unbounded"?!0:_.reach.kind==="class-scope"?f(_):u(_.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${r.packageName} is not installed`,unknownKind:void 0,attribution:void 0,path:void 0,unresolvedSites:l};let x;try{x=en(t.version,r)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,path:void 0,unresolvedSites:l}}if(!x)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${r.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,path:void 0,unresolvedSites:l};let y=Rn(n),I=nn(n),v=_=>{if(_.cause!=="dynamic-load"||_.source===null)return l;let $=y.get(_.source);return $===void 0?l:[{path:$.path,start:0,end:0}]},{dispatch:C,load:M}=xo(n,y,I,a),E=[...C,...M],p=_=>{for(let $ of I)if(y.get($)?.packageName===_)return!0;return!1},S=_=>({tier:"unknown",decidedAtStage:_,reason:`${i?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,path:void 0,unresolvedSites:l});if(i===null||!i.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:i===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:i===null?"db-gap":"unverified-symbol",attribution:void 0,path:void 0,unresolvedSites:E};if(s!==null&&!s.comparedPaths.has(i.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${i.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,path:void 0,unresolvedSites:E};if(i.symbolKind==="accessor"||i.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a ${i.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,path:void 0,unresolvedSites:E};let A=mo(n,y,i);if(A===void 0||!I.has(A.moduleId)){if(A===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&ho(n,y,I,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,path:void 0,unresolvedSites:E};if(A===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&!go(n,y,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a method of the dependency class ${i.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,path:void 0,unresolvedSites:E};if(!p(r.packageName)){if(M.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,path:void 0,unresolvedSites:M};let R=k();return R!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:R.cause,attribution:void 0,path:void 0,unresolvedSites:v(R)}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,path:void 0,unresolvedSites:l}}if(E.length>0){let R=A!==void 0?y.get(A.moduleId):Ii(n,i),j=A===void 0&&R!==void 0&&R.externalSurface!==!0&&I.has(R.id)&&!a.has(R.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:M.length>0?"dynamic-load":j?"dep-opaque":"dispatch",attribution:void 0,path:void 0,unresolvedSites:E}}let _=A!==void 0?y.get(A.moduleId):Ii(n,i);if(A===void 0&&_!==void 0&&_.externalSurface!==!0&&I.has(_.id)&&!a.has(_.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,path:void 0,unresolvedSites:l};let $=_!==void 0?h(_.id):k();return $!==null?{tier:"unknown",decidedAtStage:A===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:$.cause,attribution:void 0,path:void 0,unresolvedSites:v($)}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:A===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,path:void 0,unresolvedSites:l}:S(A===void 0?"symbol-reachable":"module-reachable")}let N=yo(n,po(n),A.id);if(N!==null)return{tier:xn(N.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Tn(i),path:bo(n,N.path),unresolvedSites:l};if(E.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but unresolved edges exist`,unknownKind:M.length>0?"dynamic-load":"dispatch",attribution:void 0,path:void 0,unresolvedSites:E};let O=h(A.moduleId);return O!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:O.cause,attribution:void 0,path:void 0,unresolvedSites:v(O)}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,path:void 0,unresolvedSites:l}:S("call-path-confirmed")}function ko(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Eo(e,n,t){let r=new Map(e.classes.map(i=>[i.id,i.name]));for(let i of e.functions){if(i.name!==t.exportName)continue;let s=n.get(i.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(i.enclosingClassId!==void 0?r.get(i.enclosingClassId)??null:null)!==t.container))return i.id}return null}function wo(e,n,t){if(n===t)return[];let r=new Map(e.functions.map(o=>[o.id,o])),i=new Map(e.callSites.map(o=>[o.id,o])),s=new Map;for(let o of e.callEdges){if(o.resolution!=="resolved"&&o.resolution!=="field-based")continue;let c=i.get(o.callSiteId);if(c===void 0)continue;let u=c.enclosingFunctionId;if(!r.has(u)||!r.has(o.calleeFunctionId))continue;let f=s.get(u),m={to:o.calleeFunctionId,label:o.resolution};f===void 0?s.set(u,[m]):f.push(m)}let l=new Set([n]),a=[{at:n,labels:[]}];for(let o=0;o<a.length;o++){let c=a[o];for(let u of s.get(c.at)??[]){if(l.has(u.to))continue;let f=[...c.labels,u.label];if(u.to===t)return f;l.add(u.to),a.push({at:u.to,labels:f})}}return null}function Sn(e,n,t,r,i){if(i.length===0)return null;let s=Pn(e,n,t);if(s.length===0)return null;let l=Eo(e,n,r);for(let a of i){let o=s.filter(u=>u.packageName===a.anchor.packageName&&u.exportName===a.anchor.exportName&&u.container===a.anchor.container),c=o.find(u=>u.resolution==="resolved")??o[0];if(c!==void 0){if(ko(a.callee,r))return{tier:xn("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[c.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&l!==null){let u=wo(e,a.callee.realFunctionId,l);if(u!==null)return{tier:xn("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[c.resolution,"modeled",...u]}}}}return null}var Ni=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Ci=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function Tn(e){return e.verified?"gated":"candidate"}var bt=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],kt=["cupel","project"],Ie={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Mi(e){return Ie[e]}import{randomBytes as Ss}from"node:crypto";import{mkdirSync as bs,realpathSync as wd,renameSync as ks,writeFileSync as Es}from"node:fs";import ws from"node:path";import{createRequire as vo}from"node:module";var Io=vo(import.meta.url);function _o(){try{return Io("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function Ao(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Dn={open(e,n){let{DatabaseSync:t}=_o(),r=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?r.exec("PRAGMA query_only = ON;"):r.exec("PRAGMA journal_mode = DELETE;"),{exec:i=>r.exec(i),prepare:i=>Ao(r.prepare(i)),close:()=>r.close()}}};function me(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function fe(e){return typeof e=="string"?e:null}function Te(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Oi=`
+import{randomBytes as _o}from"node:crypto";import{readFileSync as hu,renameSync as gu,writeFileSync as Ao}from"node:fs";import yu from"node:path";import{fileURLToPath as xu}from"node:url";var Co=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function wn(e){if(!Co.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function zn(e,n){let t=e.split(".").map(Number),r=n.split(".").map(Number);for(let i=0;i<3;i+=1){let s=t[i]??0,l=r[i]??0;if(s!==l)return s<l?-1:1}return 0}var Nt=["dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function on(e,n){let t=wn(e);return!(n.introduced!=="0"&&zn(t,wn(n.introduced))<0||n.fixed!==void 0&&zn(t,wn(n.fixed))>=0||n.lastAffected!==void 0&&zn(t,wn(n.lastAffected))>0)}function Un(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),i=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),l=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let o=s.get(a.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let m=n.get(f.moduleId);m!==void 0&&m.packageName!==u.packageName&&l.push({packageName:m.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:a.resolution})}return l}function Oo(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,r)=>t.analyzedVersion<r.analyzedVersion?1:t.analyzedVersion>r.analyzedVersion?-1:0)}function Ro(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function ji(e,n,t,r,i,s){if(s<=0)return null;let l=null,a=o=>{(l===null||o.hops<l.hops)&&(l=o)};for(let o of Oo(e,n))for(let c of o.edges){if(c.entryExport!==t||c.entryContainer!==r)continue;if(Ro(c,i,o.packageName)){a({viaPackages:[],hops:c.hops,provenance:{tool:o.tool,toolVersion:o.toolVersion,analyzedVersion:o.analyzedVersion}});continue}if(c.target.kind!=="dep")continue;let u=ji(e,c.target.calleePackage,c.target.calleeExport,null,i,s-1);u!==null&&a({viaPackages:[c.target.calleePackage,...u.viaPackages],hops:c.hops+u.hops,provenance:u.provenance})}return l}function Ct(e,n,t,r,i,s){let l=null;for(let a of Un(e,n,t)){let o=ji(i,a.packageName,a.exportName,a.container,r,s);o!==null&&(l===null||o.hops<l.totalHops)&&(l={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:o.viaPackages,totalHops:o.hops,provenance:o.provenance})}return l}function vn(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function qn(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function zi(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(i.moduleId)??[];s.push(r.resolvedModuleId),n.set(i.moduleId,s)}return n}function Mo(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(r.resolvedModuleId)??[];s.push(i.moduleId),n.set(r.resolvedModuleId,s)}return n}function an(e){let n=zi(e),t=new Set,r=e.modules.filter(i=>i.isEntrypoint).map(i=>i.id);for(;r.length>0;){let i=r.pop();if(!(i===void 0||t.has(i))){t.add(i);for(let s of n.get(i)??[])t.has(s)||r.push(s)}}return t}function Lo(e,n){let t=Mo(e),r=new Set,i=[n];for(;i.length>0;){let s=i.pop();if(!(s===void 0||r.has(s))){r.add(s);for(let l of t.get(s)??[])r.has(l)||i.push(l)}}return r}function $o(e,n,t){let r=zi(e),i=qn(e),s=new Set,l=[n];for(;l.length>0;){let a=l.pop();if(a===void 0||s.has(a))continue;s.add(a);let o=i.get(a);if(o===void 0||o.externalSurface===!0||t.has(a))return!0;for(let c of r.get(a)??[])s.has(c)||l.push(c)}return!1}function Po(e){let n=new Set(e.modules.filter(l=>l.isEntrypoint).map(l=>l.id)),t=new Map(e.functions.map(l=>[l.id,l])),r=qn(e),i=new Map;for(let l of e.functions)n.has(l.moduleId)&&(l.publicSurfaceReachable||l.name==="<toplevel>")&&i.set(l.id,l);let s=new Map(e.exports.map(l=>[l.id,l]));for(let l of e.exportBindings){if(l.target.kind!=="function")continue;let a=s.get(l.exportId);if(a===void 0||!n.has(a.moduleId))continue;let o=t.get(l.target.functionId);o===void 0||r.get(o.moduleId)?.externalSurface===!0||i.set(o.id,o)}return[...i.values()]}function Ui(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let i=e.slice(t+n.length).split("/"),s=i[0]?.startsWith("@")===!0?2:1;return i.slice(s).join("/")}function To(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let r=t.symbolKind==="method"||t.symbolKind==="ctor",i=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let l=n.get(s.moduleId);if(l===void 0||l.packageName!==t.packageName)return!1;if(r){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||i.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return l.externalSurface===!0?!0:Ui(l.path)===t.sourcePath})}function Bi(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Ui(t.path)===n.sourcePath)}function Do(e,n,t,r){let i=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(l=>{let a=i.get(l);if(a?.name!==r.exportName)return!1;let o=n.get(a.moduleId);return o?.externalSurface===!0&&o.packageName===r.packageName&&t.has(a.moduleId)}))}function Fo(e,n,t){return t.container===null?!0:e.classes.some(r=>{if(r.name!==t.container)return!1;let i=n.get(r.moduleId);return i!==void 0&&i.packageName===t.packageName&&i.externalSurface!==!0})}function Ko(e,n,t){let r=new Map(e.callSites.map(o=>[o.id,o.enclosingFunctionId])),i=new Map;for(let o of e.callEdges){let c=r.get(o.callSiteId);if(c===void 0)continue;let u=i.get(c)??[];u.push({to:o.calleeFunctionId,res:o.resolution}),i.set(c,u)}let s=o=>{let c=new Set,u=n.map(f=>({id:f.id,prev:null}));for(let f of u)c.add(f.id);for(;u.length>0;){let f=u.shift();if(f===void 0)break;if(f.id===t){let m=[];for(let h=f;h!==null;h=h.prev)m.unshift(h.id);return m}for(let m of i.get(f.id)??[])m.res!=="unresolved"&&(m.res==="field-based"&&!o||c.has(m.to)||(c.add(m.to),u.push({id:m.to,prev:f})))}return null},l=s(!1);if(l!==null)return{path:l,usedFieldBased:!1};let a=s(!0);return a!==null?{path:a,usedFieldBased:!0}:null}function jo(e,n,t,r){let i=[],s=[],l=new Map(e.functions.map(o=>[o.id,o.moduleId])),a=o=>o!==void 0&&t.has(o)&&r.has(n.get(o)?.packageName??"");for(let o of e.callSites)o.resolution==="unresolved"&&a(l.get(o.enclosingFunctionId))&&i.push(o.range);for(let o of e.imports)!o.specifierIsLiteral&&t.has(o.moduleId)&&s.push({path:n.get(o.moduleId)?.path??"",start:0,end:0});return{dispatch:i,load:s}}function Bo(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function zo(e,n){let t=new Map(e.functions.map(i=>[i.id,i])),r=qn(e);return n.map(i=>{let s=t.get(i),l=s!==void 0?r.get(s.moduleId):void 0;return{functionId:i,functionName:s?.name,modulePath:l?.path??""}})}function Ot(e){let{graph:n,installed:t,range:r,symbol:i,coverage:s}=e,l=e.guardLift===!0,a=[],o=Bo(n),c=new Set;for(let O of e.incompleteness)O.reach.kind==="unbounded"&&c.add(O.source);let u=e.incompleteness.some(O=>O.reach.kind==="assumed-bounded")?"loader-assumption":"complete",f=O=>O==="not-reachable"?u:void 0,m=new Map,h=O=>{let K=m.get(O);return K===void 0&&(K=$o(n,O,c),m.set(O,K)),K},k=O=>O.reach.kind==="class-scope"&&i!==null&&i.packageName===O.reach.packageName&&i.container===O.reach.container,E=O=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let K of Nt)for(let W of e.incompleteness)if(W.cause===K&&O(W))return{cause:W.cause,source:W.source};return null},S=O=>{let K;return E(W=>W.reach.kind==="unbounded"?!0:W.reach.kind==="class-scope"?k(W):O===void 0||h(W.reach.anchor)?!0:(K??=Lo(n,O),K.has(W.reach.anchor)))},w=()=>E(O=>O.reach.kind==="unbounded"?!0:O.reach.kind==="class-scope"?k(O):h(O.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${r.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,unresolvedSites:a};let A;try{A=on(t.version,r)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:a}}if(!A)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${r.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,unresolvedSites:a};let R=qn(n),v=an(n),y=O=>{if(O.cause!=="dynamic-load"||O.source===null)return a;let K=R.get(O.source);return K===void 0?a:[{path:K.path,start:0,end:0}]},{dispatch:p,load:x}=jo(n,R,v,o),N=[...p,...x],D=O=>{for(let K of v)if(R.get(K)?.packageName===O)return!0;return!1},B=O=>({tier:"unknown",decidedAtStage:O,reason:`${i?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:a}),F=()=>{if(!D(r.packageName)){if(x.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:x};let O=w();return O!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:O.cause,attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:y(O)}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${r.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${r.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,unresolvedSites:a}}return null};if(l){let O=F();if(O!==null)return O}if(i===null||!i.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:i===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:i===null?"db-gap":"unverified-symbol",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:N};if(s!==null&&!s.comparedPaths.has(i.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${i.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:N};if(i.symbolKind==="accessor"||i.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a ${i.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:N};let _=To(n,R,i);if(_===void 0||!v.has(_.moduleId)){if(_===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&Do(n,R,v,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:N};if(_===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&!Fo(n,R,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a method of the dependency class ${i.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:N};if(!l){let W=F();if(W!==null)return W}if(N.length>0){let W=_!==void 0?R.get(_.moduleId):Bi(n,i),J=_===void 0&&W!==void 0&&W.externalSurface!==!0&&v.has(W.id)&&!o.has(W.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:x.length>0?"dynamic-load":J?"dep-opaque":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:N}}let O=_!==void 0?R.get(_.moduleId):Bi(n,i);if(_===void 0&&O!==void 0&&O.externalSurface!==!0&&v.has(O.id)&&!o.has(O.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:a};let K=O!==void 0?S(O.id):w();return K!==null?{tier:"unknown",decidedAtStage:_===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:K.cause,attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:y(K)}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:_===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,unresolvedSites:a}:B(_===void 0?"symbol-reachable":"module-reachable")}let M=Ko(n,Po(n),_.id);if(M!==null)return{tier:vn(M.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Vn(i),basis:f("reachable-high"),path:zo(n,M.path),unresolvedSites:a};if(N.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but unresolved edges exist`,unknownKind:x.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:N};let T=S(_.moduleId);return T!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:T.cause,attribution:void 0,basis:f("unknown"),path:void 0,unresolvedSites:y(T)}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,unresolvedSites:a}:B("call-path-confirmed")}function Uo(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function qo(e,n,t){let r=new Map(e.classes.map(i=>[i.id,i.name]));for(let i of e.functions){if(i.name!==t.exportName)continue;let s=n.get(i.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(i.enclosingClassId!==void 0?r.get(i.enclosingClassId)??null:null)!==t.container))return i.id}return null}function Vo(e,n,t){if(n===t)return[];let r=new Map(e.functions.map(o=>[o.id,o])),i=new Map(e.callSites.map(o=>[o.id,o])),s=new Map;for(let o of e.callEdges){if(o.resolution!=="resolved"&&o.resolution!=="field-based")continue;let c=i.get(o.callSiteId);if(c===void 0)continue;let u=c.enclosingFunctionId;if(!r.has(u)||!r.has(o.calleeFunctionId))continue;let f=s.get(u),m={to:o.calleeFunctionId,label:o.resolution};f===void 0?s.set(u,[m]):f.push(m)}let l=new Set([n]),a=[{at:n,labels:[]}];for(let o=0;o<a.length;o++){let c=a[o];for(let u of s.get(c.at)??[]){if(l.has(u.to))continue;let f=[...c.labels,u.label];if(u.to===t)return f;l.add(u.to),a.push({at:u.to,labels:f})}}return null}function In(e,n,t,r,i){if(i.length===0)return null;let s=Un(e,n,t);if(s.length===0)return null;let l=qo(e,n,r);for(let a of i){let o=s.filter(u=>u.packageName===a.anchor.packageName&&u.exportName===a.anchor.exportName&&u.container===a.anchor.container),c=o.find(u=>u.resolution==="resolved")??o[0];if(c!==void 0){if(Uo(a.callee,r))return{tier:vn("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[c.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&l!==null){let u=Vo(e,a.callee.realFunctionId,l);if(u!==null)return{tier:vn("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[c.resolution,"modeled",...u]}}}}return null}var qi=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Vi=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function Vn(e){return e.verified?"gated":"candidate"}var Rt=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],Mt=["cupel","project"],Me={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Hi(e){return Me[e]}import{randomBytes as Ds}from"node:crypto";import{mkdirSync as Fs,realpathSync as Wd,renameSync as Ks,writeFileSync as js}from"node:fs";import Bs from"node:path";import{createRequire as Ho}from"node:module";var Wo=Ho(import.meta.url);function Xo(){try{return Wo("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function Go(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Hn={open(e,n){let{DatabaseSync:t}=Xo(),r=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?r.exec("PRAGMA query_only = ON;"):r.exec("PRAGMA journal_mode = DELETE;"),{exec:i=>r.exec(i),prepare:i=>Go(r.prepare(i)),close:()=>r.close()}}};function fe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function de(e){return typeof e=="string"?e:null}function qe(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Wi=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,No=`${Oi}, ap.surface_complete
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Jo=`${Wi}, ap.surface_complete
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Co=`${Oi},
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Yo=`${Wi},
          EXISTS (SELECT 1 FROM vulnerable_symbol vs
                  WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Mo=5,Oo="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",$o="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Lo="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function Et(e,n=Dn){let t=n.open(e,"readonly"),r=t.prepare(Lo).get(),i=r!==void 0?me(r.value):"",s=/^\d+$/u.test(i)&&Number(i)>=Mo,l=t.prepare(s?No:Co),a=t.prepare(Oo),o=t.prepare($o);return{schemaVersion:i,advisoriesForPackage(c,u){return l.all({eco:c,name:u}).map(f=>({affected:{id:Te(f.ap_id)??0,advisoryId:me(f.advisory_id),ecosystem:me(f.ecosystem),packageName:me(f.package_name),introduced:fe(f.introduced),fixed:fe(f.fixed),lastAffected:fe(f.last_affected),fixCommit:fe(f.fix_commit),repoUrl:fe(f.repo_url),surfaceComplete:Te(f.surface_complete)===1?1:0},advisory:{id:me(f.a_id),osvId:fe(f.osv_id),cveId:fe(f.cve_id),summary:fe(f.summary),severity:fe(f.severity),published:fe(f.published),source:me(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(c){return a.all({id:c}).map(u=>({id:Te(u.id)??0,affectedPackageId:Te(u.affected_package_id)??0,exportName:fe(u.export_name),symbolKind:me(u.symbol_kind),matchPattern:fe(u.match_pattern),matchGlobs:fe(u.match_globs),container:fe(u.container),sourcePath:fe(u.source_path),declStart:Te(u.decl_start),declEnd:Te(u.decl_end),astHashBefore:fe(u.ast_hash_before),astHashAfter:fe(u.ast_hash_after),derivation:me(u.derivation),confidence:me(u.confidence),verified:Te(u.verified)===1?1:0}))},aliasesForSymbol(c){return o.all({id:c}).map(u=>({id:Te(u.id)??0,vulnerableSymbolId:Te(u.vulnerable_symbol_id)??0,aliasPath:me(u.alias_path),aliasName:me(u.alias_name)}))},allModels(){let c;try{c=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Qo=5,Zo="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",ea="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",na="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function Lt(e,n=Hn){let t=n.open(e,"readonly"),r=t.prepare(na).get(),i=r!==void 0?fe(r.value):"",s=/^\d+$/u.test(i)&&Number(i)>=Qo,l=t.prepare(s?Jo:Yo),a=t.prepare(Zo),o=t.prepare(ea);return{schemaVersion:i,advisoriesForPackage(c,u){return l.all({eco:c,name:u}).map(f=>({affected:{id:qe(f.ap_id)??0,advisoryId:fe(f.advisory_id),ecosystem:fe(f.ecosystem),packageName:fe(f.package_name),introduced:de(f.introduced),fixed:de(f.fixed),lastAffected:de(f.last_affected),fixCommit:de(f.fix_commit),repoUrl:de(f.repo_url),surfaceComplete:qe(f.surface_complete)===1?1:0},advisory:{id:fe(f.a_id),osvId:de(f.osv_id),cveId:de(f.cve_id),summary:de(f.summary),severity:de(f.severity),published:de(f.published),source:fe(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(c){return a.all({id:c}).map(u=>({id:qe(u.id)??0,affectedPackageId:qe(u.affected_package_id)??0,exportName:de(u.export_name),symbolKind:fe(u.symbol_kind),matchPattern:de(u.match_pattern),matchGlobs:de(u.match_globs),container:de(u.container),sourcePath:de(u.source_path),declStart:qe(u.decl_start),declEnd:qe(u.decl_end),astHashBefore:de(u.ast_hash_before),astHashAfter:de(u.ast_hash_after),derivation:fe(u.derivation),confidence:fe(u.confidence),verified:qe(u.verified)===1?1:0}))},aliasesForSymbol(c){return o.all({id:c}).map(u=>({id:qe(u.id)??0,vulnerableSymbolId:qe(u.vulnerable_symbol_id)??0,aliasPath:fe(u.alias_path),aliasName:fe(u.alias_name)}))},allModels(){let c;try{c=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
                FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let u=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return c.map(f=>{let m=Te(f.id)??0;return{packageName:me(f.package_name),modelId:me(f.evidence_ref),introduced:me(f.introduced),fixedBefore:fe(f.fixed_before),evidenceRef:me(f.evidence_ref),edges:u.all({id:m}).map(h=>({kind:me(h.kind),anchorExport:me(h.anchor_export),anchorContainer:fe(h.anchor_container),calleePackage:me(h.callee_package),calleeContainer:fe(h.callee_container),calleeExport:me(h.callee_export)}))}})},close(){t.close()}}}var tn="5";import{realpathSync as _n}from"node:fs";import Ge from"node:path";import{realpathSync as on}from"node:fs";import{isBuiltin as ga}from"node:module";import Se from"node:path";import g from"typescript";function wt(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function he(e){let n=wt(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function qe(e){let n=wt(e);if(n.startsWith("@")){let r=n.indexOf("/");if(r===-1)return n;let i=n.indexOf("/",r+1);return i===-1?n:n.slice(0,i)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function $i(e){let n=wt(e),t=qe(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as Fo,statSync as vt}from"node:fs";var Je=16*1024*1024;function un(e,n){try{let t=vt(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:Fo(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function De(e){let n=un(e,Je);return n.kind==="ok"?n.text:null}function Fe(e){try{return vt(e).isFile()}catch{return!1}}function Li(e){try{let n=vt(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Ko,realpathSync as Nt}from"node:fs";import ge from"node:path";import It from"typescript";var Ki=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Ke(e){return Ki.some(([n])=>e.endsWith(n))}function jo(e){for(let[n,t]of Ki)if(e.endsWith(n)){let r=e.slice(0,-n.length);return t.map(i=>r+i)}return[]}var Bo=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function zo(e){if(Ke(e))return e;for(let[n,t]of Bo)if(e.endsWith(n)){let r=e.slice(0,-n.length);for(let i of t){let s=r+i;if(Fe(s))return s}return e}return e}var Uo=[It.ModuleKind.CommonJS,It.ModuleKind.ESNext],Vo=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function ji(e,n,t,r,i,s){let l=It.resolveModuleName(e,n,t,r,void 0,void 0,i).resolvedModule;if(l===void 0)return null;let a=l.resolvedFileName;if(s){for(let o of jo(a))if(Fe(o))return o}return a}var Bi=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],qo=[".js",".json",".node"],Ho=["index.js","index.json","index.node"];function Fn(e){return!Ke(e)&&Bi.some(n=>e.endsWith(n))}function zi(e){if(Fe(e))return e;for(let n of qo)if(Fe(e+n))return e+n;return null}function Pi(e){for(let n of Ho){let t=ge.join(e,n);if(Fe(t))return t}return null}var Ui=[".ts",".tsx",".cts",".mts",".jsx"];function Wo(e){for(let n of Ui)if(Fe(e+n))return e+n;return null}function Xo(e){for(let n of Ui){let t=ge.join(e,"index"+n);if(Fe(t))return t}return null}function Go(e){let n=De(ge.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let r=ge.join(e,t),i=zi(r)??Pi(r);if(i!==null)return i}}catch{}return Pi(e)}function Vi(e){return zi(e)??Go(e)??Wo(e)??Xo(e)}function qi(e){return Vi(e)!==null}function Jo(e,n){let t=e.split(ge.sep),r=n.split("/"),i=null;for(let l=t.length-r.length-1;l>=0;l-=1)if(t[l]==="node_modules"&&r.every((a,o)=>t[l+1+o]===a)){i=t.slice(0,l+1+r.length).join(ge.sep);break}if(i===null||i==="")return null;let s=De(ge.join(i,"package.json"));if(s===null)return null;try{let l=JSON.parse(s),a=l.exports,o=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(l.name!==n||o)return null}catch{return null}try{return Nt(i)}catch{return null}}function Yo(e,n){let t=Vi(ge.join(e,n));if(t===null)return null;let r;try{r=Nt(t)}catch{return null}let i=e.endsWith(ge.sep)?e:e+ge.sep;return r!==e&&!r.startsWith(i)||Ke(r)||!Bi.some(s=>r.endsWith(s))?null:r}function Qo(e,n){let t=$i(e);return t===""||t.includes("\0")||t.split("/").some(r=>r===""||r==="."||r===".."||r==="node_modules")?null:Yo(n,t)}var rn={kind:"nothing-loads"},_t=8192;function At(e,n){let t=n.get(e);if(t!==void 0)return t;let r,i=null;try{i=Ko(e);let s=new Set,l=!1;for(;;){let a=i.readSync();if(a===null)break;if(s.size>=_t){l=!0;break}s.add(a.name)}r={names:s,truncated:l}}catch{r=null}finally{try{i?.closeSync()}catch{}}return n.set(e,r),r}var Zo=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function Hi(e){return Zo.some(n=>e.length>n.length&&e.endsWith(n))}function Ct(e,n){let t=e.endsWith(ge.sep)?e:e+ge.sep;return n===e||n.startsWith(t)}function Ri(e,n){let t;try{t=Nt(n)}catch{return{kind:"missing"}}return Ct(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Ti(e,n){let t=(n+".").toLowerCase(),r=[];for(let i of e){let s=i.toLowerCase();s.length>t.length&&s.startsWith(t)&&r.push(i)}return r}function ea(e,n,t){let r=ge.dirname(n);if(!Ct(e,r))return null;let i=At(r,t);if(i===null)return null;let s=ge.basename(n);return i.names.has(s)?s:null}function Di(e,n){let t=e.filter(i=>!Hi(i));if(t.length===0)return rn;let r=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${r}") the analyzer cannot parse`}}function Wi(e,n,t,r){let i=e,s=i.indexOf("?");s!==-1&&(i=i.slice(0,s));let l=i.indexOf("#");if(l!==-1&&(i=i.slice(0,l)),i===""||i.includes("\0"))return rn;let a=ge.resolve(ge.dirname(n),i);if(!Ct(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed"};let o=Ri(t,a);if(o.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed"};if(o.kind==="ok"){let h=Li(o.real);if(h==="file"){let y=ea(t,o.real,r);return y!==null&&Hi(y)?rn:{kind:"unanalyzable",reason:y===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${y}") the analyzer cannot parse`}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file"};let k=At(o.real,r);if(k===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let x=Di(Ti(k.names,"index"),"a directory index");return x.kind==="unanalyzable"?x:k.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve"}:k.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(_t)} entries and was not fully probed`}:rn}let c=ge.basename(a);if(c===""||c==="."||c==="..")return rn;let u=Ri(t,ge.dirname(a));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed"};if(u.kind==="missing")return rn;let f=At(u.real,r);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let m=Di(Ti(f.names,c),"a sibling file exists");return m.kind==="unanalyzable"?m:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(_t)} entries and was not fully probed`}:rn}function Fi(e,n,t,r,i){let s;for(let l of Uo)for(let a of Vo){let o={...t,noDtsResolution:!0,customConditions:[...a]},c=ji(e,n,o,r,l,i);if(s===void 0)s=c;else if(s!==c)return null}return s??null}function je(e,n,t,r){let i=he(e);if(i==="relative")return ji(e,n,t,r,void 0,!0);if(i==="package-root")return Fi(e,n,t,r,!0);let s=Fi(e,n,t,r,!1);if(s===null)return null;let l=Jo(s,qe(e));return l!==null?Qo(e,l):Ke(s)?s:zo(s)}import{readdirSync as na,realpathSync as ta}from"node:fs";import He from"node:path";import D from"typescript";function bn(e,n){if(D.isIdentifier(e))n.add(e.text);else for(let t of e.elements)D.isBindingElement(t)&&bn(t.name,n)}function fn(e){let n=new Map,t=new Set,r=o=>{n.set(o,(n.get(o)??0)+1)},i=o=>{let c=we(o);if(D.isIdentifier(c))t.add(c.text);else if(D.isArrayLiteralExpression(c))for(let u of c.elements)i(u);else if(D.isObjectLiteralExpression(c))for(let u of c.properties)D.isShorthandPropertyAssignment(u)?t.add(u.name.text):D.isPropertyAssignment(u)?i(u.initializer):D.isSpreadAssignment(u)&&i(u.expression);else D.isSpreadElement(c)?i(c.expression):D.isBinaryExpression(c)&&c.operatorToken.kind===D.SyntaxKind.EqualsToken&&i(c.left)},s=o=>{let c=new Set;bn(o,c);for(let u of c)r(u)},l=o=>{D.isVariableDeclaration(o)?s(o.name):D.isFunctionDeclaration(o)&&o.name!==void 0||D.isClassDeclaration(o)&&o.name!==void 0?r(o.name.text):D.isParameter(o)?s(o.name):((D.isFunctionExpression(o)||D.isClassExpression(o))&&o.name!==void 0&&D.isIdentifier(o.name)&&!(o.parent!==void 0&&D.isVariableDeclaration(o.parent)&&o.parent.initializer===o&&D.isIdentifier(o.parent.name)&&o.parent.name.text===o.name.text)||D.isImportClause(o)&&o.name!==void 0||D.isNamespaceImport(o)||D.isImportSpecifier(o)||D.isImportEqualsDeclaration(o))&&r(o.name.text),D.isBinaryExpression(o)&&o.operatorToken.kind>=D.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=D.SyntaxKind.LastAssignment?i(o.left):(D.isPrefixUnaryExpression(o)||D.isPostfixUnaryExpression(o))&&(o.operator===D.SyntaxKind.PlusPlusToken||o.operator===D.SyntaxKind.MinusMinusToken)?i(o.operand):(D.isForOfStatement(o)||D.isForInStatement(o))&&!D.isVariableDeclarationList(o.initializer)&&i(o.initializer),D.forEachChild(o,l)};l(e);let a=new Set(t);for(let[o,c]of n)c>1&&a.add(o);return a}function sn(e,n,t){let r=fn(e),i=new Map,s=l=>{D.isVariableDeclaration(l)&&D.isIdentifier(l.name)&&l.initializer!==void 0&&!r.has(l.name.text)&&!i.has(l.name.text)&&i.set(l.name.text,l.initializer),D.forEachChild(l,s)};return s(e),{containingFile:n,taintedNames:r,constBindings:i,resolveParamDirs:t}}var ia=1024,ra=32,sa=new Set(["filter","sort","slice","reverse"]),oa=new Set(["forEach","map","filter","flatMap","find","some","every"]);function we(e){let n=e;for(;D.isParenthesizedExpression(n);)n=n.expression;return n}function Xi(e,n){return D.isPropertyAccessExpression(e)&&D.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function Ye(e,n,t,r){if(t>ra)return null;let i=we(e);if(D.isStringLiteralLike(i))return i.text;if(D.isTemplateExpression(i)){let s=i.head.text;for(let l of i.templateSpans){let a=Ye(l.expression,n,t+1,r);if(a===null)return null;s+=a+l.literal.text}return s}if(D.isBinaryExpression(i)&&i.operatorToken.kind===D.SyntaxKind.PlusToken){let s=Ye(i.left,n,t+1,r);if(s===null)return null;let l=Ye(i.right,n,t+1,r);return l===null?null:s+l}if(D.isIdentifier(i)){if(i.text==="__dirname")return He.dirname(n.containingFile);if(i.text==="__filename")return n.containingFile;if(n.taintedNames.has(i.text)||r.has(i.text))return null;let s=n.constBindings.get(i.text);if(s===void 0)return null;r.add(i.text);let l=Ye(s,n,t+1,r);return r.delete(i.text),l}if(D.isCallExpression(i)){let s=Xi(i.expression,"join"),l=Xi(i.expression,"resolve");if(!s&&!l)return null;let a=[];for(let c of i.arguments){let u=Ye(c,n,t+1,r);if(u===null)return null;a.push(u)}let o=a[0];return o===void 0||l&&!He.isAbsolute(o)?null:l?He.resolve(...a):He.join(...a)}return null}function Kn(e){let n=we(e);if(D.isBinaryExpression(n)&&n.operatorToken.kind===D.SyntaxKind.PlusToken)return[...Kn(n.left),...Kn(n.right)];if(D.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let r of n.templateSpans)t.push({expr:r.expression}),r.literal.text.length>0&&t.push({lit:r.literal.text});return t}return D.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Yi(e){let n=e,t=0;for(;t++<4096;){let r=n.parent;if(r===void 0)return null;if(D.isForOfStatement(r)&&r.statement===n){let i=r.initializer;if(D.isVariableDeclarationList(i)&&i.declarations.length===1&&i.declarations[0]!==void 0&&D.isIdentifier(i.declarations[0].name)&&i.declarations[0].name.text===e.text){let s=Gi(r.expression);if(s!==null)return s}}if((D.isArrowFunction(n)||D.isFunctionExpression(n))&&D.isCallExpression(r)&&r.arguments.length>0&&r.arguments[0]===n&&D.isPropertyAccessExpression(r.expression)&&oa.has(r.expression.name.text)){let i=n.parameters[0];if(i!==void 0&&D.isIdentifier(i.name)&&i.name.text===e.text){let s=Gi(r.expression.expression);if(s!==null)return s}}n=r}return null}function Gi(e){let n=we(e),t=0;for(;D.isCallExpression(n)&&t++<16;){let r=n.expression;if(D.isPropertyAccessExpression(r)){let i=r.name.text;if(i==="readdirSync")return n.arguments[0]??null;if(sa.has(i)){n=we(r.expression);continue}return null}return D.isIdentifier(r)&&r.text==="readdirSync"?n.arguments[0]??null:null}return null}function aa(e,n){let t=Kn(e);if(t.length<2)return null;let r=t[t.length-1];if(r===void 0||!("expr"in r)||!D.isIdentifier(r.expr))return null;let i=r.expr;if(n.taintedNames.has(i.text))return null;let s="";for(let c=0;c<t.length-1;c+=1){let u=t[c];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let f=Ye(u.expr,n,0,new Set);if(f===null)return null;s+=f}}let l=Yi(i),a=l===null?null:Ye(l,n,0,new Set);if(a===null)return null;let o=He.resolve(s);return o!==He.resolve(a)?null:o}function la(e){if((D.isFunctionDeclaration(e)||D.isFunctionExpression(e))&&e.name!==void 0&&D.isIdentifier(e.name)||D.isMethodDeclaration(e)&&D.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&D.isVariableDeclaration(n)&&D.isIdentifier(n.name)?n.name.text:null}function da(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!D.isFunctionLike(t))continue;let r=-1;for(let s=0;s<t.parameters.length;s+=1){let l=t.parameters[s];if(l!==void 0&&D.isIdentifier(l.name)&&l.name.text===n){r=s;break}}if(r<0)continue;let i=la(t);return i===null?null:{fnName:i,paramIndex:r}}return null}function kn(e,n){let t=Kn(e);if(t.length!==2)return null;let[r,i]=t;if(r===void 0||!("expr"in r)||!D.isIdentifier(r.expr)||i===void 0||!("expr"in i)||!D.isIdentifier(i.expr))return null;let s=r.expr,l=i.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(l.text))return null;let a=Yi(l);return a===null||!D.isIdentifier(a)||a.text!==s.text?null:da(s,s.text)}function ca(e,n){if(n.resolveParamDirs===void 0)return null;let t=kn(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function jn(e){for(let n=e.parent;n!==void 0;n=n.parent){if(D.isSourceFile(n))return!0;if(!D.isArrowFunction(n)&&D.isFunctionLike(n))return!1}return!0}function Mt(e,n){let t=Ye(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let r=aa(e,n);if(r!==null)return{kind:"dir",dir:r};let i=ca(e,n);return i!==null&&i.length>0?{kind:"dirs",dirs:[...i]}:{kind:"opaque"}}function Qi(e,n){let t;try{t=ta(e)}catch{return null}let r=n.endsWith(He.sep)?n:n+He.sep;return t===n||t.startsWith(r)?t:null}function Zi(e,n,t,r,i){let s=je(e,n,r,i);return s===null||Ke(s)||!Fn(s)?null:Qi(s,t)}function Ji(e,n,t,r,i){let s=Qi(e,t);if(s===null)return[];let l;try{l=na(s)}catch{return[]}if(l.length===0||l.length>ia)return[];l.sort();let a=new Set,o=[];for(let c of l){let u=Zi(He.join(s,c),n,t,r,i);u!==null&&!a.has(u)&&(a.add(u),o.push(u))}return o}function Bn(e,n,t,r,i){let s=Mt(e,n);if(s.kind==="const"){if(he(s.value)==="package-root")return[];let l=Zi(s.value,n.containingFile,t,r,i);return l===null?[]:[l]}if(s.kind==="dir")return Ji(s.dir,n.containingFile,t,r,i);if(s.kind==="dirs"){let l=new Set,a=[];for(let o of s.dirs)for(let c of Ji(o,n.containingFile,t,r,i))l.has(c)||(l.add(c),a.push(c));return a}return[]}import ua from"node:path";import Z from"typescript";var fa=32,zn="\0",er=(e,n)=>`${e}${zn}${n}`,nr=(e,n,t)=>`${e}${zn}${n}${zn}${String(t)}`;function pa(e){let n=new Map,t=new Set,r=(i,s)=>{if(t.has(i)){n.delete(i);return}t.add(i),n.set(i,s)};for(let i of e.statements)if(Z.isImportDeclaration(i)&&Z.isStringLiteralLike(i.moduleSpecifier)){let s=i.moduleSpecifier.text,l=i.importClause;if(l===void 0)continue;l.name!==void 0&&r(l.name.text,{kind:"module",specifier:s});let a=l.namedBindings;if(a!==void 0&&Z.isNamespaceImport(a))r(a.name.text,{kind:"module",specifier:s});else if(a!==void 0&&Z.isNamedImports(a))for(let o of a.elements)r(o.name.text,{kind:"named",specifier:s,imported:(o.propertyName??o.name).text})}else if(Z.isImportEqualsDeclaration(i)&&Z.isExternalModuleReference(i.moduleReference)&&Z.isStringLiteralLike(i.moduleReference.expression))r(i.name.text,{kind:"module",specifier:i.moduleReference.expression.text});else if(Z.isFunctionDeclaration(i)&&i.name!==void 0)r(i.name.text,{kind:"local"});else if(Z.isVariableStatement(i))for(let s of i.declarationList.declarations){if(s.initializer===void 0)continue;let l=s.initializer;if(Z.isIdentifier(s.name))Z.isArrowFunction(l)||Z.isFunctionExpression(l)?r(s.name.text,{kind:"local"}):tr(l)&&r(s.name.text,{kind:"module",specifier:ir(l)});else if(Z.isObjectBindingPattern(s.name)&&tr(l)){let a=ir(l);for(let o of s.name.elements){if(o.dotDotDotToken!==void 0||!Z.isIdentifier(o.name))continue;let c=o.propertyName??o.name;!Z.isIdentifier(c)&&!Z.isStringLiteralLike(c)||r(o.name.text,{kind:"named",specifier:a,imported:c.text})}}}return n}function tr(e){return Z.isCallExpression(e)&&Z.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&Z.isStringLiteralLike(e.arguments[0])}function ir(e){let n=e.arguments[0];return n!==void 0&&Z.isStringLiteralLike(n)?n.text:"\0"}function ma(e){let n=e.expression;if(Z.isPropertyAccessExpression(n))return n.name.text;if(Z.isIdentifier(n))return n.text}function ha(e,n,t,r,i,s){let l=e.expression,a=o=>{let c=`${o}${zn}${n}`,u=s.get(c);if(u!==void 0||s.has(c))return u??null;let f=je(o,n,r,i),m=f===null?null:ua.resolve(f);return s.set(c,m),m};if(Z.isPropertyAccessExpression(l)&&Z.isIdentifier(l.expression)){let o=t.get(l.expression.text);if(o?.kind==="module"){let c=a(o.specifier);return c===null?null:{moduleReal:c,fnName:l.name.text}}return null}if(Z.isIdentifier(l)){let o=t.get(l.text);if(o?.kind==="named"){let c=a(o.specifier);return c===null?null:{moduleReal:c,fnName:o.imported}}return o?.kind==="local"?{moduleReal:n,fnName:l.text}:null}return null}function rr(e,n,t,r,i=new Map){if(n.length===0)return()=>null;let s=new Map,l=new Set;for(let o of n){let c=er(o.definingModuleReal,o.fnName),u=s.get(c);u===void 0&&(u=new Set,s.set(c,u)),u.add(o.paramIndex),l.add(o.fnName)}let a=new Map;for(let o of e){let c=sn(o.sf,o.real),u=pa(o.sf),f=m=>{if(Z.isCallExpression(m)){let h=ma(m);if(h!==void 0&&l.has(h)&&jn(m)){let k=ha(m,o.real,u,t,r,i);if(k!==null){let x=s.get(er(k.moduleReal,k.fnName));if(x!==void 0)for(let y of x){let I=m.arguments[y];if(I===void 0)continue;let v=Mt(I,c);if(v.kind==="const"){let C=nr(k.moduleReal,k.fnName,y),M=a.get(C);M===void 0&&(M=new Set,a.set(C,M)),M.add(v.value)}}}}}Z.forEachChild(m,f)};f(o.sf)}return(o,c,u)=>{let f=a.get(nr(o,c,u));return f===void 0||f.size===0||f.size>fa?null:[...f].sort()}}var We={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:g.ScriptTarget.ES2020,module:g.ModuleKind.CommonJS,moduleResolution:g.ModuleResolutionKind.Node10,types:[]},Un=5e3;function Be(e,n){let t;try{t=on(n)}catch{t=Se.resolve(n)}let r=e.endsWith(Se.sep)?e:e+Se.sep;return t!==e&&!t.startsWith(r)?null:t===e?"":t.slice(r.length).split(Se.sep).join("/")}function pe(e){let n=e;for(;;)if(g.isParenthesizedExpression(n))n=n.expression;else if(g.isBinaryExpression(n)&&n.operatorToken.kind===g.SyntaxKind.CommaToken)n=n.right;else return n}function Xe(e){return g.isPropertyAccessExpression(e)?{receiver:pe(e.expression),name:e.name.text}:g.isElementAccessExpression(e)&&g.isStringLiteralLike(e.argumentExpression)?{receiver:pe(e.expression),name:e.argumentExpression.text}:null}function vn(e){let n=pe(e.expression);if(g.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===g.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=Xe(n);if(t!==null){if(t.name==="require"&&g.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(g.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let r=e.arguments[1];return{specifierArg:r!==void 0&&g.isArrayLiteralExpression(r)?r.elements[0]:void 0}}}}return null}function sr(e){let n=[],t=r=>{if(g.isImportDeclaration(r)&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.importClause?.isTypeOnly!==!0});else if(g.isImportEqualsDeclaration(r)&&g.isExternalModuleReference(r.moduleReference)&&g.isStringLiteralLike(r.moduleReference.expression))n.push({text:r.moduleReference.expression.text,runtime:!0});else if(g.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.isTypeOnly!==!0});else if(g.isCallExpression(r)){let i=vn(r),s=i?.specifierArg;i!==null&&s!==void 0&&g.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}g.forEachChild(r,t)};return t(e),n}function ya(e,n){let t=n===g.ScriptKind.TSX?"__scriptkind_probe.tsx":n===g.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",r=g.createSourceFile(t,e,g.ScriptTarget.ES2020,!0,n),i={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:l=>l===t?r:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:l=>l,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:l=>l===t,readFile:l=>l===t?e:void 0};return g.createProgram({rootNames:[t],options:i,host:s}).getSyntacticDiagnostics(r).length}function Rt(e){return e.endsWith(".js")||e.endsWith(".jsx")}function or(e){let n=0,t=r=>{(g.isCallExpression(r)||g.isNewExpression(r)||g.isTaggedTemplateExpression(r))&&(n+=1),g.forEachChild(r,t)};return t(e),n}function dr(e,n){let t=sr(g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0));if(!Rt(e)||!n.includes("<")||!n.includes("require"))return t;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX),i=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of sr(r)){let l=`${s.runtime?"R":"T"}:${s.text}`;i.has(l)||(i.add(l),t.push(s))}return t}function ar(e,n,t,r,i){if(!n.includes("require")&&!n.includes("import("))return[];let s=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0),l=sn(s,e,i),a=[],o=new Set;return cr(s,c=>{for(let u of Bn(c,l,t,We,r))o.has(u)||(o.add(u),a.push(u))}),a}function cr(e,n){let t=r=>{if(g.isCallExpression(r)){let i=vn(r),s=i?.specifierArg;i!==null&&s!==void 0&&!g.isStringLiteralLike(s)&&n(s)}g.forEachChild(r,t)};t(e)}function xa(e){let n=[];for(let t of e){let r=sn(t.sf,t.real);cr(t.sf,i=>{let s=kn(i,r);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var Sa=4,Ot=Un,$t=new Set(["eval","Function","createRequire"]),ba=new Set(["require","eval","Function","createRequire"]),Hn=new Set(["module","Module","require","process","global","globalThis"]),Wn=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function ka(e){return e===g.SyntaxKind.LessThanToken||e===g.SyntaxKind.GreaterThanToken||e===g.SyntaxKind.LessThanEqualsToken||e===g.SyntaxKind.GreaterThanEqualsToken||e===g.SyntaxKind.EqualsEqualsToken||e===g.SyntaxKind.EqualsEqualsEqualsToken||e===g.SyntaxKind.ExclamationEqualsToken||e===g.SyntaxKind.ExclamationEqualsEqualsToken||e===g.SyntaxKind.InstanceOfKeyword||e===g.SyntaxKind.InKeyword}function Ea(e){let n=e.parent;return(g.isParameter(n)||g.isVariableDeclaration(n)||g.isBindingElement(n)||g.isFunctionDeclaration(n)||g.isFunctionExpression(n)||g.isClassDeclaration(n)||g.isClassExpression(n)||g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isMethodDeclaration(n))&&n.name===e?!0:g.isPropertyAccessExpression(n)&&n.name===e}function wa(e,n){return g.isCallExpression(n)&&n.expression===e||(g.isPropertyAccessExpression(n)||g.isElementAccessExpression(n))&&n.expression===e||g.isTypeOfExpression(n)||g.isVoidExpression(n)||g.isDeleteExpression(n)||g.isPrefixUnaryExpression(n)||g.isPostfixUnaryExpression(n)?!0:g.isBinaryExpression(n)&&ka(n.operatorToken.kind)}function ur(e){let n=e,t=e.parent;for(;;)if(g.isParenthesizedExpression(t))n=t,t=t.parent;else if(g.isBinaryExpression(t)&&t.operatorToken.kind===g.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!wa(n,t)}function va(e){return Ea(e)?!1:ur(e)}function fr(e){let n=Xe(e);if(n!==null&&Wn.has(n.name))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=pe(e.expression);if(g.isIdentifier(t)&&Hn.has(t.text))return!0}return!1}function En(e){let n=Xe(e);if(n===null||n.name!=="constructor")return!1;let t=Xe(n.receiver);return t!==null&&t.name==="constructor"}function pr(e){if(!g.isCallExpression(e))return!1;let n=pe(e.expression);if(!g.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&g.isStringLiteralLike(t)&&t.text==="module"}var Ia={roots:new Map,nodes:new Set,saturated:!1};function mr(e){return g.isSourceFile(e)||g.isFunctionDeclaration(e)||g.isFunctionExpression(e)||g.isArrowFunction(e)||g.isMethodDeclaration(e)||g.isConstructorDeclaration(e)||g.isGetAccessorDeclaration(e)||g.isSetAccessorDeclaration(e)||g.isClassStaticBlockDeclaration(e)||g.isModuleDeclaration(e)}function hr(e,n){let t=e.parent;for(;t!==void 0;){if(mr(t))return t;t=t.parent}return n}function _a(e){let n=new Set;if(g.isFunctionLike(e))for(let r of e.parameters)for(let i of wn(r.name))n.add(i);let t=[e];for(;t.length>0;){let r=t.pop();if(r===void 0)break;if(!(r!==e&&mr(r))){if(g.isVariableDeclaration(r)&&g.isVariableDeclarationList(r.parent)&&!((r.parent.flags&g.NodeFlags.BlockScoped)!==0))for(let s of wn(r.name))n.add(s);g.forEachChild(r,i=>{t.push(i)})}}return n}function Aa(e,n,t){let r=hr(e,n);if(g.isSourceFile(r))return n;let i=t.get(r);return i===void 0&&(i=_a(r),t.set(r,i)),i.has(e.text)?r:n}function Vn(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let r=n;for(;;){if(t.has(r))return!0;let i=r.parent;if(i===void 0)return!g.isSourceFile(r);r=i}}var Na=12,Ca=8;function qn(e,n){let t=pe(e);for(;;){if(n.nodes.has(t))return!0;if(g.isIdentifier(t))return Hn.has(t.text)||Vn(n,t);if(g.isCallExpression(t))return pr(t);let r=Xe(t);if(r!==null){if(r.name==="constructor")return!0;t=r.receiver;continue}if(g.isElementAccessExpression(t)){t=pe(t.expression);continue}return!1}}function gr(e){let n=Xe(pe(e.expression));if(n===null||n.name!=="get"||!g.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function Ma(e,n){let t=gr(e);if(t===null||!qn(t.target,n))return!1;let r=t.key;return r===void 0||!g.isStringLiteralLike(r)?!0:Wn.has(r.text)}function Lt(e){if(!g.isFunctionExpression(e)&&!g.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,r=i=>{if(!(t||g.isFunctionExpression(i)||g.isFunctionDeclaration(i)||g.isClassLike(i))){if(g.isReturnStatement(i)&&i.expression!==void 0&&pe(i.expression).kind===g.SyntaxKind.ThisKeyword){t=!0;return}g.forEachChild(i,r)}};return r(n),t}function wn(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isOmittedExpression(t)||n.push(...wn(t.name));return n}function yr(e){return e.parameters.map(n=>wn(n.name))}function Oa(e){let n=new Map,t=new Set,r=(s,l)=>{let a={fn:l,slots:yr(l)},o=n.get(s);o===void 0?n.set(s,[a]):o.push(a),Lt(l)&&t.add(s)},i=s=>{if(g.isFunctionDeclaration(s)&&s.name!==void 0)r(s.name.text,s);else if(g.isVariableDeclaration(s)&&g.isIdentifier(s.name)&&s.initializer!==void 0){let l=pe(s.initializer);(g.isFunctionExpression(l)||g.isArrowFunction(l))&&r(s.name.text,l)}g.forEachChild(s,i)};return i(e),{params:n,thisReturning:t}}function $a(e){let n=new Map,t=new Set,r={roots:n,nodes:t},i=Oa(e),s=new Map,l=new Set(i.thisReturning),a=!0;for(let o=0;a;o+=1){if(o>=Na)return{roots:n,nodes:t,saturated:!0};a=!1;let c=(x,y)=>{y!==""&&!x.has(y)&&(x.add(y),a=!0)},u=(x,y)=>{if(x==="")return;let I=n.get(x);I===void 0&&(I=new Set,n.set(x,I)),I.has(y)||(I.add(y),a=!0)},f=x=>{t.has(x)||(t.add(x),a=!0)},m=(x,y)=>{let I=pe(x.expression);if(g.isIdentifier(I)&&$t.has(I.text)||En(I)||g.isCallExpression(x)&&pr(x)||Lt(I))return!0;let v=Xe(I);if(v!==null&&(v.name==="call"||v.name==="apply"||v.name==="bind")){let C=v.receiver;if(Lt(C)||t.has(C)||g.isIdentifier(C)&&(Vn(r,C)||l.has(C.text)))return!0}if(t.has(I)||(g.isCallExpression(I)||g.isNewExpression(I))&&m(I,y+1)||g.isIdentifier(I)&&(Vn(r,I)||l.has(I.text)))return!0;if(g.isCallExpression(x)){let C=gr(x);if(C!==null&&qn(C.target,r))return!0}return!1},h=(x,y)=>{if(y>=Ca)return!0;let I=pe(x);if(t.has(I))return!0;if(g.isIdentifier(I))return Hn.has(I.text)||Vn(r,I);if(g.isBinaryExpression(I)){let v=I.operatorToken.kind;return v===g.SyntaxKind.BarBarToken||v===g.SyntaxKind.AmpersandAmpersandToken||v===g.SyntaxKind.QuestionQuestionToken?h(I.left,y+1)||h(I.right,y+1):!1}return g.isConditionalExpression(I)?h(I.whenTrue,y+1)||h(I.whenFalse,y+1):g.isPropertyAccessExpression(I)||g.isElementAccessExpression(I)?qn(I,r):g.isCallExpression(I)||g.isNewExpression(I)?m(I,y+1):!1},k=(x,y)=>{if((g.isVariableDeclaration(x)||g.isParameter(x)||g.isBindingElement(x))&&x.initializer!==void 0){if(h(x.initializer,0)){let v=hr(x,e);for(let C of wn(x.name))u(C,v)}}else if(g.isBinaryExpression(x)&&x.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(x.left)&&h(x.right,0))u(x.left.text,Aa(x.left,e,s));else if(g.isReturnStatement(x)&&x.expression!==void 0&&y!==void 0&&h(x.expression,0))c(l,y);else if(g.isCallExpression(x)||g.isNewExpression(x)){m(x,0)&&f(x);let v=pe(x.expression),C=Xe(v),M=C!==null&&C.name==="call",E=C!==null&&C.name==="apply",p=M||E?C.receiver:v,S=M?1:0,A=[];g.isFunctionExpression(p)||g.isArrowFunction(p)?A.push({fn:p,slots:yr(p)}):g.isIdentifier(p)&&A.push(...i.params.get(p.text)??[]);let N=x.arguments??[];if(E){let O=N[1]===void 0?void 0:pe(N[1]);for(let{fn:_,slots:$}of A)if(O!==void 0&&g.isArrayLiteralExpression(O))for(let R=0;R<O.elements.length;R+=1){let j=O.elements[R],V=$[R];if(!(j===void 0||V===void 0)&&h(j,0))for(let te of V)u(te,_)}else if(O!==void 0)for(let R of $)for(let j of R)u(j,_)}else for(let{fn:O,slots:_}of A)for(let $=S;$<N.length;$+=1){let R=N[$],j=_[$-S];if(!(R===void 0||j===void 0)&&h(R,0))for(let V of j)u(V,O)}}let I=y;if(g.isFunctionDeclaration(x))I=x.name?.text;else if(g.isFunctionExpression(x)||g.isArrowFunction(x)){let v=x.parent;I=g.isVariableDeclaration(v)&&g.isIdentifier(v.name)?v.name.text:void 0}g.forEachChild(x,v=>k(v,I))};k(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function La(e){if(g.isIdentifier(e)&&$t.has(e.text)||En(e))return!0;let n=Xe(e);if(n!==null&&(Wn.has(n.name)||(n.name==="call"||n.name==="apply")&&(g.isIdentifier(n.receiver)&&$t.has(n.receiver.text)||En(n.receiver)||(g.isPropertyAccessExpression(n.receiver)||g.isElementAccessExpression(n.receiver))&&fr(n.receiver))))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=pe(e.expression);if(g.isIdentifier(t)&&Hn.has(t.text))return!0}return!1}var Pa=4;function lr(e,n){for(let t of e){if(!g.isStringLiteralLike(t)||n>=Pa)return!0;let r=g.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return c.map(f=>{let m=qe(f.id)??0;return{packageName:fe(f.package_name),modelId:fe(f.evidence_ref),introduced:fe(f.introduced),fixedBefore:de(f.fixed_before),evidenceRef:fe(f.evidence_ref),edges:u.all({id:m}).map(h=>({kind:fe(h.kind),anchorExport:fe(h.anchor_export),anchorContainer:de(h.anchor_container),calleePackage:fe(h.callee_package),calleeContainer:de(h.callee_container),calleeExport:fe(h.callee_export)}))}})},close(){t.close()}}}var ln="5";import{realpathSync as Mn}from"node:fs";import en from"node:path";import{realpathSync as un}from"node:fs";import{isBuiltin as Fa}from"node:module";import Se from"node:path";import g from"typescript";function $t(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function pe(e){let n=$t(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Ye(e){let n=$t(e);if(n.startsWith("@")){let r=n.indexOf("/");if(r===-1)return n;let i=n.indexOf("/",r+1);return i===-1?n:n.slice(0,i)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Xi(e){let n=$t(e),t=Ye(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as oa,statSync as Pt}from"node:fs";var nn=16*1024*1024;function yn(e,n){try{let t=Pt(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:oa(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function De(e){let n=yn(e,nn);return n.kind==="ok"?n.text:null}function Ve(e){try{return Pt(e).isFile()}catch{return!1}}function Gi(e){try{let n=Pt(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as aa,realpathSync as Ft}from"node:fs";import te from"node:path";import Wn from"typescript";var nr=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function He(e){return nr.some(([n])=>e.endsWith(n))}function la(e){for(let[n,t]of nr)if(e.endsWith(n)){let r=e.slice(0,-n.length);return t.map(i=>r+i)}return[]}var da=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function ca(e){if(He(e))return e;for(let[n,t]of da)if(e.endsWith(n)){let r=e.slice(0,-n.length);for(let i of t){let s=r+i;if(Ve(s))return s}return e}return e}var ua=[Wn.ModuleKind.CommonJS,Wn.ModuleKind.ESNext],fa=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function tr(e,n,t,r,i,s){let l=Wn.resolveModuleName(e,n,t,r,void 0,void 0,i).resolvedModule;if(l===void 0)return null;let a=l.resolvedFileName;if(s){for(let o of la(a))if(Ve(o))return o}return a}var ir=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],pa=[".js",".json",".node"],ma=["index.js","index.json","index.node"];function Xn(e){return!He(e)&&ir.some(n=>e.endsWith(n))}function rr(e){if(Ve(e))return e;for(let n of pa)if(Ve(e+n))return e+n;return null}function Ji(e){for(let n of ma){let t=te.join(e,n);if(Ve(t))return t}return null}var sr=[".ts",".tsx",".cts",".mts",".jsx"];function ha(e){for(let n of sr)if(Ve(e+n))return e+n;return null}function ga(e){for(let n of sr){let t=te.join(e,"index"+n);if(Ve(t))return t}return null}function ya(e){let n=De(te.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let r=te.join(e,t),i=rr(r)??Ji(r);if(i!==null)return i}}catch{}return Ji(e)}function or(e){return rr(e)??ya(e)??ha(e)??ga(e)}function ar(e){return or(e)!==null}function xa(e,n){let t=e.split(te.sep),r=n.split("/"),i=null;for(let l=t.length-r.length-1;l>=0;l-=1)if(t[l]==="node_modules"&&r.every((a,o)=>t[l+1+o]===a)){i=t.slice(0,l+1+r.length).join(te.sep);break}if(i===null||i==="")return null;let s=De(te.join(i,"package.json"));if(s===null)return null;try{let l=JSON.parse(s),a=l.exports,o=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(l.name!==n||o)return null}catch{return null}try{return Ft(i)}catch{return null}}function Sa(e,n){let t=or(te.join(e,n));if(t===null)return null;let r;try{r=Ft(t)}catch{return null}let i=e.endsWith(te.sep)?e:e+te.sep;return r!==e&&!r.startsWith(i)||He(r)||!ir.some(s=>r.endsWith(s))?null:r}function ba(e,n){let t=Xi(e);return t===""||t.includes("\0")||t.split("/").some(r=>r===""||r==="."||r===".."||r==="node_modules")?null:Sa(n,t)}var dn={kind:"nothing-loads"},Tt=8192;function Dt(e,n){let t=n.get(e);if(t!==void 0)return t;let r,i=null;try{i=aa(e);let s=new Set,l=!1;for(;;){let a=i.readSync();if(a===null)break;if(s.size>=Tt){l=!0;break}s.add(a.name)}r={names:s,truncated:l}}catch{r=null}finally{try{i?.closeSync()}catch{}}return n.set(e,r),r}var ka=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function lr(e){return ka.some(n=>e.length>n.length&&e.endsWith(n))}function Gn(e,n){let t=e.endsWith(te.sep)?e:e+te.sep;return n===e||n.startsWith(t)}function Yi(e,n){let t;try{t=Ft(n)}catch{return{kind:"missing"}}return Gn(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Qi(e,n){let t=(n+".").toLowerCase(),r=[];for(let i of e){let s=i.toLowerCase();s.length>t.length&&s.startsWith(t)&&r.push(i)}return r}function Ea(e,n,t){let r=te.dirname(n);if(!Gn(e,r))return null;let i=Dt(r,t);if(i===null)return null;let s=te.basename(n);return i.names.has(s)?s:null}function Zi(e,n){let t=e.filter(i=>!lr(i));if(t.length===0)return dn;let r=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${r}") the analyzer cannot parse`}}function dr(e,n,t,r){let i=e,s=i.indexOf("?");s!==-1&&(i=i.slice(0,s));let l=i.indexOf("#");if(l!==-1&&(i=i.slice(0,l)),i===""||i.includes("\0"))return dn;let a=te.resolve(te.dirname(n),i);if(!Gn(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed"};let o=Yi(t,a);if(o.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed"};if(o.kind==="ok"){let h=Gi(o.real);if(h==="file"){let S=Ea(t,o.real,r);return S!==null&&lr(S)?dn:{kind:"unanalyzable",reason:S===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${S}") the analyzer cannot parse`}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file"};let k=Dt(o.real,r);if(k===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let E=Zi(Qi(k.names,"index"),"a directory index");return E.kind==="unanalyzable"?E:k.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve"}:k.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Tt)} entries and was not fully probed`}:dn}let c=te.basename(a);if(c===""||c==="."||c==="..")return dn;let u=Yi(t,te.dirname(a));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed"};if(u.kind==="missing")return dn;let f=Dt(u.real,r);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let m=Zi(Qi(f.names,c),"a sibling file exists");return m.kind==="unanalyzable"?m:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Tt)} entries and was not fully probed`}:dn}function er(e,n,t,r,i){let s;for(let l of ua)for(let a of fa){let o={...t,noDtsResolution:!0,customConditions:[...a]},c=tr(e,n,o,r,l,i);if(s===void 0)s=c;else if(s!==c)return null}return s??null}function Fe(e,n,t,r){let i=pe(e);if(i==="relative")return tr(e,n,t,r,void 0,!0);if(i==="package-root")return er(e,n,t,r,!0);let s=er(e,n,t,r,!1);if(s===null)return null;let l=xa(s,Ye(e));return l!==null?ba(e,l):He(s)?s:ca(s)}function cr(e,n,t){let r=De(te.join(e,"tsconfig.json"));if(r===null)return()=>null;let i=Wn.parseConfigFileTextToJson(te.join(e,"tsconfig.json"),r);if(i.error!==void 0)return()=>null;let s=i.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let l=s.paths;if(typeof l!="object"||l===null)return()=>null;let a=s.baseUrl,o=typeof a=="string"?te.resolve(e,a):e,c=new Map,u=[];for(let[m,h]of Object.entries(l)){if(!Array.isArray(h))continue;let k=h.filter(S=>typeof S=="string");if(k.length===0)continue;let E=m.indexOf("*");E===-1?c.set(m,k):m.indexOf("*",E+1)===-1&&u.push({prefix:m.slice(0,E),suffix:m.slice(E+1),targets:k})}if(u.sort((m,h)=>h.prefix.length-m.prefix.length),c.size===0&&u.length===0)return()=>null;let f=m=>{let h=c.get(m);if(h!==void 0)return h;for(let k of u){if(m.length<k.prefix.length+k.suffix.length||!m.startsWith(k.prefix)||!m.endsWith(k.suffix))continue;let E=m.slice(k.prefix.length,m.length-k.suffix.length);return k.targets.map(S=>{let w=S.indexOf("*");return w===-1?S:S.slice(0,w)+E+S.slice(w+1)})}return[]};return(m,h)=>{let k=f(m);if(k.length===0||Fe(m,h,n,t)!==null)return null;for(let E of k){let S=te.resolve(o,E),w=te.relative(te.dirname(h),S).split(te.sep).join("/");if(w==="")continue;w.startsWith(".")||(w=`./${w}`);let A=Fe(w,h,n,t);if(A!==null&&Gn(e,A))return A}return null}}import{readdirSync as wa,realpathSync as va}from"node:fs";import Qe from"node:path";import $ from"typescript";function _n(e,n){if($.isIdentifier(e))n.add(e.text);else for(let t of e.elements)$.isBindingElement(t)&&_n(t.name,n)}function xn(e){let n=new Map,t=new Set,r=o=>{n.set(o,(n.get(o)??0)+1)},i=o=>{let c=Ne(o);if($.isIdentifier(c))t.add(c.text);else if($.isArrayLiteralExpression(c))for(let u of c.elements)i(u);else if($.isObjectLiteralExpression(c))for(let u of c.properties)$.isShorthandPropertyAssignment(u)?t.add(u.name.text):$.isPropertyAssignment(u)?i(u.initializer):$.isSpreadAssignment(u)&&i(u.expression);else $.isSpreadElement(c)?i(c.expression):$.isBinaryExpression(c)&&c.operatorToken.kind===$.SyntaxKind.EqualsToken&&i(c.left)},s=o=>{let c=new Set;_n(o,c);for(let u of c)r(u)},l=o=>{$.isVariableDeclaration(o)?s(o.name):$.isFunctionDeclaration(o)&&o.name!==void 0||$.isClassDeclaration(o)&&o.name!==void 0?r(o.name.text):$.isParameter(o)?s(o.name):(($.isFunctionExpression(o)||$.isClassExpression(o))&&o.name!==void 0&&$.isIdentifier(o.name)&&!(o.parent!==void 0&&$.isVariableDeclaration(o.parent)&&o.parent.initializer===o&&$.isIdentifier(o.parent.name)&&o.parent.name.text===o.name.text)||$.isImportClause(o)&&o.name!==void 0||$.isNamespaceImport(o)||$.isImportSpecifier(o)||$.isImportEqualsDeclaration(o))&&r(o.name.text),$.isBinaryExpression(o)&&o.operatorToken.kind>=$.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=$.SyntaxKind.LastAssignment?i(o.left):($.isPrefixUnaryExpression(o)||$.isPostfixUnaryExpression(o))&&(o.operator===$.SyntaxKind.PlusPlusToken||o.operator===$.SyntaxKind.MinusMinusToken)?i(o.operand):($.isForOfStatement(o)||$.isForInStatement(o))&&!$.isVariableDeclarationList(o.initializer)&&i(o.initializer),$.forEachChild(o,l)};l(e);let a=new Set(t);for(let[o,c]of n)c>1&&a.add(o);return a}function cn(e,n,t){let r=xn(e),i=new Map,s=l=>{$.isVariableDeclaration(l)&&$.isIdentifier(l.name)&&l.initializer!==void 0&&!r.has(l.name.text)&&!i.has(l.name.text)&&i.set(l.name.text,l.initializer),$.forEachChild(l,s)};return s(e),{containingFile:n,taintedNames:r,constBindings:i,resolveParamDirs:t}}var Ia=1024,_a=32,Aa=new Set(["filter","sort","slice","reverse"]),Na=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ne(e){let n=e;for(;$.isParenthesizedExpression(n);)n=n.expression;return n}function ur(e,n){return $.isPropertyAccessExpression(e)&&$.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function tn(e,n,t,r){if(t>_a)return null;let i=Ne(e);if($.isStringLiteralLike(i))return i.text;if($.isTemplateExpression(i)){let s=i.head.text;for(let l of i.templateSpans){let a=tn(l.expression,n,t+1,r);if(a===null)return null;s+=a+l.literal.text}return s}if($.isBinaryExpression(i)&&i.operatorToken.kind===$.SyntaxKind.PlusToken){let s=tn(i.left,n,t+1,r);if(s===null)return null;let l=tn(i.right,n,t+1,r);return l===null?null:s+l}if($.isIdentifier(i)){if(i.text==="__dirname")return Qe.dirname(n.containingFile);if(i.text==="__filename")return n.containingFile;if(n.taintedNames.has(i.text)||r.has(i.text))return null;let s=n.constBindings.get(i.text);if(s===void 0)return null;r.add(i.text);let l=tn(s,n,t+1,r);return r.delete(i.text),l}if($.isCallExpression(i)){let s=ur(i.expression,"join"),l=ur(i.expression,"resolve");if(!s&&!l)return null;let a=[];for(let c of i.arguments){let u=tn(c,n,t+1,r);if(u===null)return null;a.push(u)}let o=a[0];return o===void 0||l&&!Qe.isAbsolute(o)?null:l?Qe.resolve(...a):Qe.join(...a)}return null}function Jn(e){let n=Ne(e);if($.isBinaryExpression(n)&&n.operatorToken.kind===$.SyntaxKind.PlusToken)return[...Jn(n.left),...Jn(n.right)];if($.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let r of n.templateSpans)t.push({expr:r.expression}),r.literal.text.length>0&&t.push({lit:r.literal.text});return t}return $.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function mr(e){let n=e,t=0;for(;t++<4096;){let r=n.parent;if(r===void 0)return null;if($.isForOfStatement(r)&&r.statement===n){let i=r.initializer;if($.isVariableDeclarationList(i)&&i.declarations.length===1&&i.declarations[0]!==void 0&&$.isIdentifier(i.declarations[0].name)&&i.declarations[0].name.text===e.text){let s=fr(r.expression);if(s!==null)return s}}if(($.isArrowFunction(n)||$.isFunctionExpression(n))&&$.isCallExpression(r)&&r.arguments.length>0&&r.arguments[0]===n&&$.isPropertyAccessExpression(r.expression)&&Na.has(r.expression.name.text)){let i=n.parameters[0];if(i!==void 0&&$.isIdentifier(i.name)&&i.name.text===e.text){let s=fr(r.expression.expression);if(s!==null)return s}}n=r}return null}function fr(e){let n=Ne(e),t=0;for(;$.isCallExpression(n)&&t++<16;){let r=n.expression;if($.isPropertyAccessExpression(r)){let i=r.name.text;if(i==="readdirSync")return n.arguments[0]??null;if(Aa.has(i)){n=Ne(r.expression);continue}return null}return $.isIdentifier(r)&&r.text==="readdirSync"?n.arguments[0]??null:null}return null}function Ca(e,n){let t=Jn(e);if(t.length<2)return null;let r=t[t.length-1];if(r===void 0||!("expr"in r)||!$.isIdentifier(r.expr))return null;let i=r.expr;if(n.taintedNames.has(i.text))return null;let s="";for(let c=0;c<t.length-1;c+=1){let u=t[c];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let f=tn(u.expr,n,0,new Set);if(f===null)return null;s+=f}}let l=mr(i),a=l===null?null:tn(l,n,0,new Set);if(a===null)return null;let o=Qe.resolve(s);return o!==Qe.resolve(a)?null:o}function Oa(e){if(($.isFunctionDeclaration(e)||$.isFunctionExpression(e))&&e.name!==void 0&&$.isIdentifier(e.name)||$.isMethodDeclaration(e)&&$.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&$.isVariableDeclaration(n)&&$.isIdentifier(n.name)?n.name.text:null}function Ra(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!$.isFunctionLike(t))continue;let r=-1;for(let s=0;s<t.parameters.length;s+=1){let l=t.parameters[s];if(l!==void 0&&$.isIdentifier(l.name)&&l.name.text===n){r=s;break}}if(r<0)continue;let i=Oa(t);return i===null?null:{fnName:i,paramIndex:r}}return null}function An(e,n){let t=Jn(e);if(t.length!==2)return null;let[r,i]=t;if(r===void 0||!("expr"in r)||!$.isIdentifier(r.expr)||i===void 0||!("expr"in i)||!$.isIdentifier(i.expr))return null;let s=r.expr,l=i.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(l.text))return null;let a=mr(l);return a===null||!$.isIdentifier(a)||a.text!==s.text?null:Ra(s,s.text)}function Ma(e,n){if(n.resolveParamDirs===void 0)return null;let t=An(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function Yn(e){for(let n=e.parent;n!==void 0;n=n.parent){if($.isSourceFile(n))return!0;if(!$.isArrowFunction(n)&&$.isFunctionLike(n))return!1}return!0}function Kt(e,n){let t=tn(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let r=Ca(e,n);if(r!==null)return{kind:"dir",dir:r};let i=Ma(e,n);return i!==null&&i.length>0?{kind:"dirs",dirs:[...i]}:{kind:"opaque"}}function hr(e,n){let t;try{t=va(e)}catch{return null}let r=n.endsWith(Qe.sep)?n:n+Qe.sep;return t===n||t.startsWith(r)?t:null}function gr(e,n,t,r,i){let s=Fe(e,n,r,i);return s===null||He(s)||!Xn(s)?null:hr(s,t)}function pr(e,n,t,r,i){let s=hr(e,t);if(s===null)return[];let l;try{l=wa(s)}catch{return[]}if(l.length===0||l.length>Ia)return[];l.sort();let a=new Set,o=[];for(let c of l){let u=gr(Qe.join(s,c),n,t,r,i);u!==null&&!a.has(u)&&(a.add(u),o.push(u))}return o}function Qn(e,n,t,r,i){let s=Kt(e,n);if(s.kind==="const"){if(pe(s.value)==="package-root")return[];let l=gr(s.value,n.containingFile,t,r,i);return l===null?[]:[l]}if(s.kind==="dir")return pr(s.dir,n.containingFile,t,r,i);if(s.kind==="dirs"){let l=new Set,a=[];for(let o of s.dirs)for(let c of pr(o,n.containingFile,t,r,i))l.has(c)||(l.add(c),a.push(c));return a}return[]}import La from"node:path";import ee from"typescript";var $a=32,Zn="\0",yr=(e,n)=>`${e}${Zn}${n}`,xr=(e,n,t)=>`${e}${Zn}${n}${Zn}${String(t)}`;function Pa(e){let n=new Map,t=new Set,r=(i,s)=>{if(t.has(i)){n.delete(i);return}t.add(i),n.set(i,s)};for(let i of e.statements)if(ee.isImportDeclaration(i)&&ee.isStringLiteralLike(i.moduleSpecifier)){let s=i.moduleSpecifier.text,l=i.importClause;if(l===void 0)continue;l.name!==void 0&&r(l.name.text,{kind:"module",specifier:s});let a=l.namedBindings;if(a!==void 0&&ee.isNamespaceImport(a))r(a.name.text,{kind:"module",specifier:s});else if(a!==void 0&&ee.isNamedImports(a))for(let o of a.elements)r(o.name.text,{kind:"named",specifier:s,imported:(o.propertyName??o.name).text})}else if(ee.isImportEqualsDeclaration(i)&&ee.isExternalModuleReference(i.moduleReference)&&ee.isStringLiteralLike(i.moduleReference.expression))r(i.name.text,{kind:"module",specifier:i.moduleReference.expression.text});else if(ee.isFunctionDeclaration(i)&&i.name!==void 0)r(i.name.text,{kind:"local"});else if(ee.isVariableStatement(i))for(let s of i.declarationList.declarations){if(s.initializer===void 0)continue;let l=s.initializer;if(ee.isIdentifier(s.name))ee.isArrowFunction(l)||ee.isFunctionExpression(l)?r(s.name.text,{kind:"local"}):Sr(l)&&r(s.name.text,{kind:"module",specifier:br(l)});else if(ee.isObjectBindingPattern(s.name)&&Sr(l)){let a=br(l);for(let o of s.name.elements){if(o.dotDotDotToken!==void 0||!ee.isIdentifier(o.name))continue;let c=o.propertyName??o.name;!ee.isIdentifier(c)&&!ee.isStringLiteralLike(c)||r(o.name.text,{kind:"named",specifier:a,imported:c.text})}}}return n}function Sr(e){return ee.isCallExpression(e)&&ee.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&ee.isStringLiteralLike(e.arguments[0])}function br(e){let n=e.arguments[0];return n!==void 0&&ee.isStringLiteralLike(n)?n.text:"\0"}function Ta(e){let n=e.expression;if(ee.isPropertyAccessExpression(n))return n.name.text;if(ee.isIdentifier(n))return n.text}function Da(e,n,t,r,i,s){let l=e.expression,a=o=>{let c=`${o}${Zn}${n}`,u=s.get(c);if(u!==void 0||s.has(c))return u??null;let f=Fe(o,n,r,i),m=f===null?null:La.resolve(f);return s.set(c,m),m};if(ee.isPropertyAccessExpression(l)&&ee.isIdentifier(l.expression)){let o=t.get(l.expression.text);if(o?.kind==="module"){let c=a(o.specifier);return c===null?null:{moduleReal:c,fnName:l.name.text}}return null}if(ee.isIdentifier(l)){let o=t.get(l.text);if(o?.kind==="named"){let c=a(o.specifier);return c===null?null:{moduleReal:c,fnName:o.imported}}return o?.kind==="local"?{moduleReal:n,fnName:l.text}:null}return null}function kr(e,n,t,r,i=new Map){if(n.length===0)return()=>null;let s=new Map,l=new Set;for(let o of n){let c=yr(o.definingModuleReal,o.fnName),u=s.get(c);u===void 0&&(u=new Set,s.set(c,u)),u.add(o.paramIndex),l.add(o.fnName)}let a=new Map;for(let o of e){let c=cn(o.sf,o.real),u=Pa(o.sf),f=m=>{if(ee.isCallExpression(m)){let h=Ta(m);if(h!==void 0&&l.has(h)&&Yn(m)){let k=Da(m,o.real,u,t,r,i);if(k!==null){let E=s.get(yr(k.moduleReal,k.fnName));if(E!==void 0)for(let S of E){let w=m.arguments[S];if(w===void 0)continue;let A=Kt(w,c);if(A.kind==="const"){let R=xr(k.moduleReal,k.fnName,S),v=a.get(R);v===void 0&&(v=new Set,a.set(R,v)),v.add(A.value)}}}}}ee.forEachChild(m,f)};f(o.sf)}return(o,c,u)=>{let f=a.get(xr(o,c,u));return f===void 0||f.size===0||f.size>$a?null:[...f].sort()}}var We={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:g.ScriptTarget.ES2020,module:g.ModuleKind.CommonJS,moduleResolution:g.ModuleResolutionKind.Node10,types:[]},et=5e3;function Xe(e,n){let t;try{t=un(n)}catch{t=Se.resolve(n)}let r=e.endsWith(Se.sep)?e:e+Se.sep;return t!==e&&!t.startsWith(r)?null:t===e?"":t.slice(r.length).split(Se.sep).join("/")}function ce(e){let n=e;for(;;)if(g.isParenthesizedExpression(n))n=n.expression;else if(g.isBinaryExpression(n)&&n.operatorToken.kind===g.SyntaxKind.CommaToken)n=n.right;else return n}function Ze(e){return g.isPropertyAccessExpression(e)?{receiver:ce(e.expression),name:e.name.text}:g.isElementAccessExpression(e)&&g.isStringLiteralLike(e.argumentExpression)?{receiver:ce(e.expression),name:e.argumentExpression.text}:null}function On(e){let n=ce(e.expression);if(g.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===g.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=Ze(n);if(t!==null){if(t.name==="require"&&g.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(g.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let r=e.arguments[1];return{specifierArg:r!==void 0&&g.isArrayLiteralExpression(r)?r.elements[0]:void 0}}}}return null}function Er(e){let n=[],t=r=>{if(g.isImportDeclaration(r)&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.importClause?.isTypeOnly!==!0});else if(g.isImportEqualsDeclaration(r)&&g.isExternalModuleReference(r.moduleReference)&&g.isStringLiteralLike(r.moduleReference.expression))n.push({text:r.moduleReference.expression.text,runtime:!0});else if(g.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.isTypeOnly!==!0});else if(g.isCallExpression(r)){let i=On(r),s=i?.specifierArg;i!==null&&s!==void 0&&g.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}g.forEachChild(r,t)};return t(e),n}function Ka(e,n){let t=n===g.ScriptKind.TSX?"__scriptkind_probe.tsx":n===g.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",r=g.createSourceFile(t,e,g.ScriptTarget.ES2020,!0,n),i={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:l=>l===t?r:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:l=>l,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:l=>l===t,readFile:l=>l===t?e:void 0};return g.createProgram({rootNames:[t],options:i,host:s}).getSyntacticDiagnostics(r).length}function qt(e){return e.endsWith(".js")||e.endsWith(".jsx")}function wr(e){let n=0,t=r=>{(g.isCallExpression(r)||g.isNewExpression(r)||g.isTaggedTemplateExpression(r))&&(n+=1),g.forEachChild(r,t)};return t(e),n}function _r(e,n){let t=Er(g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0));if(!qt(e)||!n.includes("<")||!n.includes("require"))return t;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX),i=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Er(r)){let l=`${s.runtime?"R":"T"}:${s.text}`;i.has(l)||(i.add(l),t.push(s))}return t}function vr(e,n,t,r,i){if(!n.includes("require")&&!n.includes("import("))return[];let s=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0),l=cn(s,e,i),a=[],o=new Set;return Ar(s,c=>{for(let u of Qn(c,l,t,We,r))o.has(u)||(o.add(u),a.push(u))}),a}function Ar(e,n){let t=r=>{if(g.isCallExpression(r)){let i=On(r),s=i?.specifierArg;i!==null&&s!==void 0&&!g.isStringLiteralLike(s)&&n(s)}g.forEachChild(r,t)};t(e)}function ja(e){let n=[];for(let t of e){let r=cn(t.sf,t.real);Ar(t.sf,i=>{let s=An(i,r);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var Ba=4,jt=et,Bt=new Set(["eval","Function","createRequire"]),za=new Set(["require","eval","Function","createRequire"]),it=new Set(["module","Module","require","process","global","globalThis"]),rt=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function Ua(e){return e===g.SyntaxKind.LessThanToken||e===g.SyntaxKind.GreaterThanToken||e===g.SyntaxKind.LessThanEqualsToken||e===g.SyntaxKind.GreaterThanEqualsToken||e===g.SyntaxKind.EqualsEqualsToken||e===g.SyntaxKind.EqualsEqualsEqualsToken||e===g.SyntaxKind.ExclamationEqualsToken||e===g.SyntaxKind.ExclamationEqualsEqualsToken||e===g.SyntaxKind.InstanceOfKeyword||e===g.SyntaxKind.InKeyword}function qa(e){let n=e.parent;return(g.isParameter(n)||g.isVariableDeclaration(n)||g.isBindingElement(n)||g.isFunctionDeclaration(n)||g.isFunctionExpression(n)||g.isClassDeclaration(n)||g.isClassExpression(n)||g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isMethodDeclaration(n))&&n.name===e?!0:g.isPropertyAccessExpression(n)&&n.name===e}function Va(e,n){return g.isCallExpression(n)&&n.expression===e||(g.isPropertyAccessExpression(n)||g.isElementAccessExpression(n))&&n.expression===e||g.isTypeOfExpression(n)||g.isVoidExpression(n)||g.isDeleteExpression(n)||g.isPrefixUnaryExpression(n)||g.isPostfixUnaryExpression(n)?!0:g.isBinaryExpression(n)&&Ua(n.operatorToken.kind)}function Nr(e){let n=e,t=e.parent;for(;;)if(g.isParenthesizedExpression(t))n=t,t=t.parent;else if(g.isBinaryExpression(t)&&t.operatorToken.kind===g.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Va(n,t)}function Ha(e){return qa(e)?!1:Nr(e)}function Cr(e){let n=Ze(e);if(n!==null&&rt.has(n.name))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=ce(e.expression);if(g.isIdentifier(t)&&it.has(t.text))return!0}return!1}function Nn(e){let n=Ze(e);if(n===null||n.name!=="constructor")return!1;let t=Ze(n.receiver);return t!==null&&t.name==="constructor"}function Or(e){if(!g.isCallExpression(e))return!1;let n=ce(e.expression);if(!g.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&g.isStringLiteralLike(t)&&t.text==="module"}var Wa={roots:new Map,nodes:new Set,saturated:!1};function Rr(e){return g.isSourceFile(e)||g.isFunctionDeclaration(e)||g.isFunctionExpression(e)||g.isArrowFunction(e)||g.isMethodDeclaration(e)||g.isConstructorDeclaration(e)||g.isGetAccessorDeclaration(e)||g.isSetAccessorDeclaration(e)||g.isClassStaticBlockDeclaration(e)||g.isModuleDeclaration(e)}function Mr(e,n){let t=e.parent;for(;t!==void 0;){if(Rr(t))return t;t=t.parent}return n}function Xa(e){let n=new Set;if(g.isFunctionLike(e))for(let r of e.parameters)for(let i of Cn(r.name))n.add(i);let t=[e];for(;t.length>0;){let r=t.pop();if(r===void 0)break;if(!(r!==e&&Rr(r))){if(g.isVariableDeclaration(r)&&g.isVariableDeclarationList(r.parent)&&!((r.parent.flags&g.NodeFlags.BlockScoped)!==0))for(let s of Cn(r.name))n.add(s);g.forEachChild(r,i=>{t.push(i)})}}return n}function Ga(e,n,t){let r=Mr(e,n);if(g.isSourceFile(r))return n;let i=t.get(r);return i===void 0&&(i=Xa(r),t.set(r,i)),i.has(e.text)?r:n}function nt(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let r=n;for(;;){if(t.has(r))return!0;let i=r.parent;if(i===void 0)return!g.isSourceFile(r);r=i}}var Ja=12,Ya=8;function tt(e,n){let t=ce(e);for(;;){if(n.nodes.has(t))return!0;if(g.isIdentifier(t))return it.has(t.text)||nt(n,t);if(g.isCallExpression(t))return Or(t);let r=Ze(t);if(r!==null){if(r.name==="constructor")return!0;t=r.receiver;continue}if(g.isElementAccessExpression(t)){t=ce(t.expression);continue}return!1}}function Lr(e){let n=Ze(ce(e.expression));if(n===null||n.name!=="get"||!g.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function Qa(e,n){let t=Lr(e);if(t===null||!tt(t.target,n))return!1;let r=t.key;return r===void 0||!g.isStringLiteralLike(r)?!0:rt.has(r.text)}function zt(e){if(!g.isFunctionExpression(e)&&!g.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,r=i=>{if(!(t||g.isFunctionExpression(i)||g.isFunctionDeclaration(i)||g.isClassLike(i))){if(g.isReturnStatement(i)&&i.expression!==void 0&&ce(i.expression).kind===g.SyntaxKind.ThisKeyword){t=!0;return}g.forEachChild(i,r)}};return r(n),t}function Cn(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isOmittedExpression(t)||n.push(...Cn(t.name));return n}function $r(e){return e.parameters.map(n=>Cn(n.name))}function Za(e){let n=new Map,t=new Set,r=(s,l)=>{let a={fn:l,slots:$r(l)},o=n.get(s);o===void 0?n.set(s,[a]):o.push(a),zt(l)&&t.add(s)},i=s=>{if(g.isFunctionDeclaration(s)&&s.name!==void 0)r(s.name.text,s);else if(g.isVariableDeclaration(s)&&g.isIdentifier(s.name)&&s.initializer!==void 0){let l=ce(s.initializer);(g.isFunctionExpression(l)||g.isArrowFunction(l))&&r(s.name.text,l)}g.forEachChild(s,i)};return i(e),{params:n,thisReturning:t}}function el(e){let n=new Map,t=new Set,r={roots:n,nodes:t},i=Za(e),s=new Map,l=new Set(i.thisReturning),a=!0;for(let o=0;a;o+=1){if(o>=Ja)return{roots:n,nodes:t,saturated:!0};a=!1;let c=(E,S)=>{S!==""&&!E.has(S)&&(E.add(S),a=!0)},u=(E,S)=>{if(E==="")return;let w=n.get(E);w===void 0&&(w=new Set,n.set(E,w)),w.has(S)||(w.add(S),a=!0)},f=E=>{t.has(E)||(t.add(E),a=!0)},m=(E,S)=>{let w=ce(E.expression);if(g.isIdentifier(w)&&Bt.has(w.text)||Nn(w)||g.isCallExpression(E)&&Or(E)||zt(w))return!0;let A=Ze(w);if(A!==null&&(A.name==="call"||A.name==="apply"||A.name==="bind")){let R=A.receiver;if(zt(R)||t.has(R)||g.isIdentifier(R)&&(nt(r,R)||l.has(R.text)))return!0}if(t.has(w)||(g.isCallExpression(w)||g.isNewExpression(w))&&m(w,S+1)||g.isIdentifier(w)&&(nt(r,w)||l.has(w.text)))return!0;if(g.isCallExpression(E)){let R=Lr(E);if(R!==null&&tt(R.target,r))return!0}return!1},h=(E,S)=>{if(S>=Ya)return!0;let w=ce(E);if(t.has(w))return!0;if(g.isIdentifier(w))return it.has(w.text)||nt(r,w);if(g.isBinaryExpression(w)){let A=w.operatorToken.kind;return A===g.SyntaxKind.BarBarToken||A===g.SyntaxKind.AmpersandAmpersandToken||A===g.SyntaxKind.QuestionQuestionToken?h(w.left,S+1)||h(w.right,S+1):!1}return g.isConditionalExpression(w)?h(w.whenTrue,S+1)||h(w.whenFalse,S+1):g.isPropertyAccessExpression(w)||g.isElementAccessExpression(w)?tt(w,r):g.isCallExpression(w)||g.isNewExpression(w)?m(w,S+1):!1},k=(E,S)=>{if((g.isVariableDeclaration(E)||g.isParameter(E)||g.isBindingElement(E))&&E.initializer!==void 0){if(h(E.initializer,0)){let A=Mr(E,e);for(let R of Cn(E.name))u(R,A)}}else if(g.isBinaryExpression(E)&&E.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(E.left)&&h(E.right,0))u(E.left.text,Ga(E.left,e,s));else if(g.isReturnStatement(E)&&E.expression!==void 0&&S!==void 0&&h(E.expression,0))c(l,S);else if(g.isCallExpression(E)||g.isNewExpression(E)){m(E,0)&&f(E);let A=ce(E.expression),R=Ze(A),v=R!==null&&R.name==="call",y=R!==null&&R.name==="apply",p=v||y?R.receiver:A,x=v?1:0,N=[];g.isFunctionExpression(p)||g.isArrowFunction(p)?N.push({fn:p,slots:$r(p)}):g.isIdentifier(p)&&N.push(...i.params.get(p.text)??[]);let D=E.arguments??[];if(y){let B=D[1]===void 0?void 0:ce(D[1]);for(let{fn:F,slots:_}of N)if(B!==void 0&&g.isArrayLiteralExpression(B))for(let M=0;M<B.elements.length;M+=1){let T=B.elements[M],O=_[M];if(!(T===void 0||O===void 0)&&h(T,0))for(let K of O)u(K,F)}else if(B!==void 0)for(let M of _)for(let T of M)u(T,F)}else for(let{fn:B,slots:F}of N)for(let _=x;_<D.length;_+=1){let M=D[_],T=F[_-x];if(!(M===void 0||T===void 0)&&h(M,0))for(let O of T)u(O,B)}}let w=S;if(g.isFunctionDeclaration(E))w=E.name?.text;else if(g.isFunctionExpression(E)||g.isArrowFunction(E)){let A=E.parent;w=g.isVariableDeclaration(A)&&g.isIdentifier(A.name)?A.name.text:void 0}g.forEachChild(E,A=>k(A,w))};k(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function nl(e){if(g.isIdentifier(e)&&Bt.has(e.text)||Nn(e))return!0;let n=Ze(e);if(n!==null&&(rt.has(n.name)||(n.name==="call"||n.name==="apply")&&(g.isIdentifier(n.receiver)&&Bt.has(n.receiver.text)||Nn(n.receiver)||(g.isPropertyAccessExpression(n.receiver)||g.isElementAccessExpression(n.receiver))&&Cr(n.receiver))))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=ce(e.expression);if(g.isIdentifier(t)&&it.has(t.text))return!0}return!1}var tl=4;function Ir(e,n){for(let t of e){if(!g.isStringLiteralLike(t)||n>=tl)return!0;let r=g.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,g.ScriptTarget.Latest,!0),i=r.parseDiagnostics;if(i!==void 0&&i.length>0||Pt(r,n+1,!0))return!0}return!1}function Pt(e,n=0,t=!1){let r=!1,i=t?Ia:$a(e);if(i.saturated)return!0;let s=a=>g.isElementAccessExpression(a)&&!g.isStringLiteralLike(a.argumentExpression)&&qn(pe(a.expression),i),l=a=>{if(!r){if(t&&(g.isCallExpression(a)||g.isNewExpression(a)||g.isTaggedTemplateExpression(a))){r=!0;return}if(g.isCallExpression(a)){let o=vn(a);if(o!==null){let c=o.specifierArg;if(c===void 0||!g.isStringLiteralLike(c)||t){r=!0;return}}else{let c=pe(a.expression);if(g.isIdentifier(c)&&(c.text==="eval"||c.text==="Function")){if(lr(a.arguments,n)){r=!0;return}}else if(La(c)){r=!0;return}else if(s(c)){r=!0;return}else if(Ma(a,i)){r=!0;return}}}else if(g.isNewExpression(a)){let o=pe(a.expression);if(g.isIdentifier(o)&&o.text==="Function"){if(lr(a.arguments??[],n)){r=!0;return}}else if(En(o)){r=!0;return}}else if(g.isIdentifier(a)&&ba.has(a.text)&&va(a)){r=!0;return}else if((g.isPropertyAccessExpression(a)||g.isElementAccessExpression(a))&&(fr(a)||En(a)||s(a))&&ur(a)){r=!0;return}else if(g.isBindingElement(a)){let o=a.propertyName??a.name,c=g.isIdentifier(o)||g.isStringLiteralLike(o)?o.text:g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?o.expression.text:void 0;if(c!==void 0&&Wn.has(c)){r=!0;return}}g.forEachChild(a,l)}};return l(e),r}function xr(e,n,t){if(Pt(t))return!0;if(!Rt(e)||!n.includes("<")||!n.includes("require"))return!1;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);return Pt(r)}function Ra(e,n,t){if(ga(e))return!0;let r=t.endsWith(Se.sep)?t:t+Se.sep,i=e.split("/"),s=n;for(;;){let l=Se.join(s,"node_modules",...i),a;try{a=on(Se.join(l,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(r))return!1;let c=De(a);if(c===null)return!1;let u;try{u=JSON.parse(c).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(qi(l))return!1;if(s===t)break;let o=Se.dirname(s);if(o===s||o!==t&&!o.startsWith(r))break;s=o}return!0}function Ta(e,n){let t=n.endsWith(Se.sep)?n:n+Se.sep,r=Se.dirname(e);for(;;){let i=Se.join(r,"package.json"),s;try{s=on(i)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let a=De(s);if(a!==null)try{let o=JSON.parse(a).name;if(typeof o=="string"&&o.length>0)return o}catch{return null}}if(r===n)break;let l=Se.dirname(r);if(l===r||l!==n&&!l.startsWith(t))break;r=l}return null}function Da(e,n,t,r,i){let s=[],l=[],a=new Set,o={},c=new Set,u=new Set,f=[],m=!1,h=(x,y)=>{let I;try{I=on(y)}catch{return!1}let v=Be(e,I);if(v===null)return i.push({code:"out-of-root",path:I,detail:"dependency module resolved outside the app root; not followed"}),!1;let C=!t.has(I)&&!u.has(I);return C&&u.size>=Ot?(m=!0,!1):(l.push({from:x,to:{module:v}}),C?(u.add(I),s.push(v),!0):!1)},k=(x,y)=>{if(a.add(y),c.has(y))return;c.add(y);let I=je(y,x,We,n);if(I!==null&&!Ke(I)){if(h({surface:y},I)){f.push(I);try{let v=Be(e,on(I)),C=Ta(I,e);v!==null&&C!==null&&(o[v]=C)}catch{}}return}Ra(y,Se.dirname(x),e)||i.push({code:"unresolved-specifier",path:y,detail:`dependency "${y}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let x of r)k(x.containingFile,x.packageName);for(;f.length>0&&u.size<Ot;){let x=f.pop();if(x===void 0)break;let y=Be(e,x);if(y===null)continue;let I=un(x,Je);if(I.kind==="too-large"){i.push({code:"limit-exceeded",path:y,detail:`dependency module over the ${String(Je/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(I.kind==="not-regular"){i.push({code:"parse-error",path:y,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let v=g.createSourceFile(x,I.text,g.ScriptTarget.ES2020,!0),C=v.parseDiagnostics;if(C!==void 0&&C.length>0){i.push({code:"dependency-body",path:y,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}if(xr(x,I.text,v)){i.push({code:"dependency-body",path:y,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)"});continue}i.push({code:"dependency-body",path:y,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:y});for(let M of dr(x,I.text))if(M.runtime)if(he(M.text)==="package-root"){let E=qe(M.text);l.push({from:{module:y},to:{surface:E}}),k(x,E)}else{let E=je(M.text,x,We,n);if(E===null){he(M.text)==="package-subpath"&&i.push({code:"unresolved-specifier",path:y,detail:`runtime package-subpath import "${M.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`});continue}if(Ke(E)){let p=Be(e,E);i.push({code:p===null?"out-of-root":"declaration-shadow",path:y,detail:p===null?`runtime import "${M.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${M.text}" resolved to the declaration file "${p}" with no co-located runtime module; its code was not analyzed`});continue}h({module:y},E)&&f.push(E)}}return(m||f.length>0)&&i.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(Ot)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:l,surfacePackages:[...a],entryRealNames:o}}function Sr(e,n){let t=on(e),r=[],i=g.createCompilerHost(We,!0),s=new Set,l=new Set,a=n.map(N=>Se.join(t,N)),o=[],c=new Map,u=new Map,f=new Map,m=new Map,h=new Set,k=(N,O)=>{let _=`${String(N.length)}:${N}${O}`;h.has(_)||(h.add(_),r.push({code:"unresolved-specifier",path:N,detail:O}))},x=()=>null,y=0,I=(N,O)=>{let _=u.get(N);return _===void 0&&(_=g.createSourceFile(N,O,g.ScriptTarget.ES2020,!0),u.set(N,_)),{real:N,sf:_}};for(;l.size<Un;){let N=a.pop();if(N===void 0){if(y>=Sa)break;y+=1;let R=[];for(let[se,X]of c)X.includes("readdir")&&(X.includes("require")||X.includes("import("))&&R.push(I(se,X));let j=xa(R);if(j.length===0)break;let V=[];for(let[se,X]of c)V.push(I(se,X));x=rr(V,j,We,i,f);let te=!1;for(let se of R){let X=c.get(se.real);if(X!==void 0)for(let Y of ar(se.real,X,t,i,x))l.has(Y)||(a.push(Y),te=!0)}if(!te)break;continue}let O;try{O=on(N)}catch{continue}if(l.has(O))continue;if(l.add(O),Be(t,O)===null){r.push({code:"out-of-root",path:N,detail:"resolved outside app root"});continue}let _=un(O,Je);if(_.kind==="too-large"){r.push({code:"limit-exceeded",path:O,detail:`file is ${String(Math.round(_.bytes/1048576))}MiB, over the ${String(Je/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(_.kind==="not-regular"){r.push({code:"parse-error",path:O,detail:"unreadable or not a regular file"});continue}let $=_.text;s.add(O),c.set(O,$);for(let R of dr(O,$)){if(he(R.text)==="package-root"){R.runtime&&o.push({containingFile:O,packageName:qe(R.text)});continue}let j=je(R.text,O,We,i);if(j===null){if(R.runtime){let V=he(R.text);if(V==="package-subpath")k(O,`runtime package-subpath import "${R.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`);else if(V==="relative"){let te=Wi(R.text,O,t,m);te.kind==="unanalyzable"&&k(O,`runtime relative import "${R.text}" did not resolve and its absence could not be proven \u2014 ${te.reason}; a bundler/loader may load a module the analyzer never saw`)}}continue}if(Be(t,j)===null){r.push({code:"out-of-root",path:j,detail:`specifier "${R.text}" resolved outside app root`});continue}if(R.runtime&&Ke(j)){r.push({code:"declaration-shadow",path:j,detail:`runtime import "${R.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(R.runtime&&!Fn(j)){r.push({code:"unanalyzable-module",path:j,detail:`runtime import "${R.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}a.push(j)}for(let R of ar(O,$,t,i,x))l.has(R)||a.push(R)}l.size>=Un&&a.length>0&&r.push({code:"limit-exceeded",path:t,detail:`reachable file set exceeds ${String(Un)}; analysis truncated (${String(a.length)}+ files not analyzed)`});let v=Da(t,i,s,o,r),C=g.createProgram({rootNames:[...s],options:We,host:i}),M=new Set,E=new Map;for(let N of C.getSourceFiles()){if(N.isDeclarationFile||C.isSourceFileDefaultLibrary(N)||Be(t,N.fileName)===null||!Rt(N.fileName))continue;let O=C.getSyntacticDiagnostics(N).length>0;if(!O&&!N.text.includes("<")||ya(N.text,g.ScriptKind.TSX)!==0)continue;let _=g.createSourceFile(N.fileName,N.text,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);(O||or(_)>or(N))&&(M.add(N.fileName),E.set(N.fileName,N.text))}let p=C;if(M.size>0){let N=i.getSourceFile.bind(i);i.getSourceFile=(O,_,$,R)=>{let j=E.get(O);return j!==void 0?g.createSourceFile(O,j,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX):N(O,_,$,R)},p=g.createProgram({rootNames:[...s],options:We,host:i,oldProgram:C})}let S=p.getTypeChecker(),A=[];for(let N of p.getSourceFiles()){if(N.isDeclarationFile||p.isSourceFileDefaultLibrary(N)||Be(t,N.fileName)===null)continue;A.push(N);let O=p.getSyntacticDiagnostics(N);if(O.length>0){let $=O[0],R=$!==void 0?g.flattenDiagnosticMessageText($.messageText," "):"syntax error";r.push({code:"parse-error",path:N.fileName,detail:`${String(O.length)} syntax error(s): ${R}`})}let _=Be(t,N.fileName);_!==null&&xr(N.fileName,N.text,N)&&r.push({code:"loader-escape",path:_,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)"})}return{program:p,checker:S,host:i,options:We,appRoot:t,sourceFiles:A,diagnostics:r,depReach:v,resolveParamDirs:x,toRel:N=>Be(t,N)}}function Me(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let r of n){let i=r.codePointAt(0)??0;t+=i<32||i>=127&&i<=159?`\\x${i.toString(16).padStart(2,"0")}`:r}return t}function Fa(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function Ka(e){let n=[],t="";for(let r of e){if(r===" "||r==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=r}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var ja=/^[A-Za-z_][A-Za-z0-9_]*=/u;function Ba(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var za=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),Ua=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),Va=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function br(e){return e.includes("require")||e.includes("import")||e.includes("loader")}var qa=[".js",".cjs",".mjs",".ts",".mts",".cts"];function Ha(e){return qa.some(n=>e.endsWith(n))}var Wa=new Set(["npm","yarn","pnpm"]);function Xa(e){let n=e[0];return n===void 0||!Wa.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Tt(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(Fa(n))return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let t=Ka(n);if(t===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let r=0;for(t[r]==="env"&&(r+=1);r<t.length;r+=1){let l=t[r];if(l===void 0||!ja.test(l))break;if(br(l))return{kind:"unparsed",reason:`environment \`${Me(l)}\` preloads another module; the launch surface is more than one file`}}let i=t[r];if(i===void 0)return{kind:"unparsed",reason:"no program in the command"};if(Xa(t.slice(r)))return{kind:"delegates",target:"scripts.start"};if(!Ba(i))return{kind:"unparsed",reason:`runs \`${Me(i)}\`, not node directly \u2014 the entry file cannot be identified`};for(r+=1;r<t.length;r+=1){let l=t[r];if(l===void 0||!l.startsWith("-"))break;if(br(l))return{kind:"unparsed",reason:`node flag \`${Me(l)}\` preloads another module; the launch surface is more than one file`};let a=l.indexOf("="),o=a===-1?l:l.slice(0,a);if(Va.has(o))return{kind:"unparsed",reason:`node flag \`${Me(o)}\` runs code that is not the script token (or can inject a preload); the entry file cannot be identified`};if(!za.has(o)&&!(a!==-1&&Ua.has(o)))return{kind:"unparsed",reason:`node flag \`${Me(o)}\` is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty`}}let s=t[r];return s===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:Ha(s)?{kind:"file",specifier:s}:{kind:"unparsed",reason:`\`${Me(s)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Ga(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Ja=64;function Dt(e){let n=e.split(`
-`),t=n.length>64,r=[],i=0;for(let s of n.slice(0,64)){let l=s.trim();if(l.length===0||l.startsWith("#"))continue;let a=l.indexOf(":");if(a<=0)continue;let o=l.slice(a+1).trim();if(o.length===0)continue;let c=l.slice(0,a);if(c.length>Ja||!Ga(c)){i+=1;continue}r.push({name:c,command:o})}return r.sort((s,l)=>s.name===l.name?0:s.name==="web"?-1:l.name==="web"?1:0),{entries:r,truncated:t,unnamedLines:i}}import{realpathSync as kr}from"node:fs";import _e from"node:path";import d from"typescript";var Er=3;function ee(e,n,t){if(e===void 0)return;let r=e[n]??={fired:0,refused:{}};t===null?r.fired+=1:r.refused[t]=(r.refused[t]??0)+1}function Qe(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var Gn=16,jt=256,Ft=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.fns.has(r)||(this.moduleFor(n),this.fns.set(r,{id:i,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),i}classFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.classNodes.has(r)||(this.moduleFor(n),this.classNodes.set(r,{id:i,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(r,[])),i}methodFor(n,t,r,i){let s=`${n}#${t}.${r}`,l=`pkg:${n}#${t}.${r}`;if(!this.fns.has(s)){let a=this.classFor(n,t);this.fns.set(s,{id:l,moduleId:`pkg:${n}`,name:r,kind:i,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(l)}return l}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function Or(e,n){let t="node_modules/",r=e.lastIndexOf(t);if(r===-1)return n;let s=e.slice(r+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function wr(e,n,t){let r=_e.dirname(e),i=_e.dirname(n),s=[];for(;;){let a=t.get(r);if(a!==void 0){for(let c of s)t.set(c,a);return a}s.push(r);let o=De(_e.join(r,"package.json"));if(o!==null)try{let c=JSON.parse(o),u={name:c.name??"app",version:c.version??"0.0.0",dir:r};for(let f of s)t.set(f,u);return u}catch{}if(r===i||r===_e.dirname(r))break;r=_e.dirname(r)}let l={name:"app",version:"0.0.0",dir:null};for(let a of s)t.set(a,l);return l}function Ya(e){let n=[],t=r=>{if(d.isImportDeclaration(r)&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isImportEqualsDeclaration(r)&&d.isExternalModuleReference(r.moduleReference)&&d.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isCallExpression(r)){let i=vn(r);if(i!==null){let s=i.specifierArg,l=s!==void 0&&d.isStringLiteralLike(s);n.push({specifier:l?s.text:void 0,specifierIsLiteral:l,dynamic:!0,...s!==void 0&&!l?{computedArg:s,loadPos:r.getStart(e)}:{}})}}d.forEachChild(r,t)};return t(e),n}function Qa(e,n,t){let r=new Map,i=wr(_e.join(e.appRoot,"package.json"),e.appRoot,r),s=[],l=[],a=[],o=new Map,c=new Set,u=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&u.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let h=wr(f.fileName,e.appRoot,r),k=Or(m,i.name),x=m.includes("node_modules/");s.push({id:m,packageName:x&&h.name!==i.name?h.name:k,versionRange:h.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),h.dir===i.dir&&c.add(m);let y=0,I=null;for(let v of Ya(f)){let C=`${m}#import${String(y)}`;y+=1;let M=null;if(v.specifier!==void 0)if(he(v.specifier)==="package-root")M=t.moduleFor(qe(v.specifier));else{let E=je(v.specifier,f.fileName,e.options,e.host),p=E!==null?e.toRel(E):null;p!==null&&(M=p)}if(l.push({id:C,moduleId:m,specifier:v.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:v.dynamic,specifierIsLiteral:v.specifierIsLiteral,...M!==null?{resolvedModuleId:M}:{}}),M!==null&&a.push({importId:C,resolvedModuleId:M}),v.computedArg!==void 0&&v.loadPos!==void 0){I??=sn(f,f.fileName,e.resolveParamDirs);let E=[];for(let p of Bn(v.computedArg,I,e.appRoot,e.options,e.host)){let S=e.toRel(p);if(S===null||!u.has(S))continue;let A=S,N=`${m}#import${String(y)}`;y+=1,l.push({id:N,moduleId:m,specifier:S,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:A}),a.push({importId:N,resolvedModuleId:A}),E.push(S)}if(E.length>0){let p=kn(v.computedArg,I)!==null||jn(v.computedArg),S=o.get(m)??[];S.push({pos:v.loadPos,candidateRels:E,seedable:p}),o.set(m,S)}}}}return{modules:s,imports:l,importEdges:a,computedLoads:o,appOwnedPaths:c}}function Za(e,n,t){for(let c of e.surfacePackages)n.moduleFor(c);let r=c=>"surface"in c?n.moduleFor(c.surface):c.module,i=[],s=new Set;for(let c of e.modules)t.has(c)||s.has(c)||(s.add(c),i.push({id:c,packageName:e.entryRealNames[c]??Or(c,"app"),versionRange:"",path:c,moduleSystem:"cjs",isEntrypoint:!1}));let l=[],a=[],o=0;for(let c of e.edges){let u=r(c.from),f=r(c.to),m=`${String(u)}#depreach${String(o)}`;o+=1,l.push({id:m,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),a.push({importId:m,resolvedModuleId:f})}return{modules:i,imports:l,importEdges:a}}function vr(e,n,t){let r=e.expression;if(d.isIdentifier(r)&&!t.has(r.text)){let i=n.get(r.text);if(i?.kind==="package-export")return{kind:"package-instance",packageName:i.packageName,className:i.exportName};if(i?.kind==="app-class")return{kind:"app-instance",cls:i.cls}}else if(d.isPropertyAccessExpression(r)&&d.isIdentifier(r.expression)&&!t.has(r.expression.text)){let i=n.get(r.expression.text);if(i?.kind==="package-surface")return{kind:"package-instance",packageName:i.packageName,className:r.name.text}}return null}function an(e){return d.canHaveModifiers(e)&&(d.getModifiers(e)?.some(n=>n.kind===d.SyntaxKind.ExportKeyword)??!1)}function el(e){let n=new Set,t;for(let r of e.statements){if(d.isExpressionStatement(r)&&d.isBinaryExpression(r.expression)){let i=r.expression;if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(i.left)&&d.isIdentifier(i.left.expression)&&i.left.expression.text==="module"&&i.left.name.text==="exports"){if(d.isIdentifier(i.right))n.add(i.right.text),t=i.right.text;else if(d.isObjectLiteralExpression(i.right))for(let s of i.right.properties)d.isShorthandPropertyAssignment(s)?n.add(s.name.text):d.isPropertyAssignment(s)&&d.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(d.isFunctionDeclaration(r)&&r.name!==void 0&&an(r))n.add(r.name.text);else if(d.isVariableStatement(r)&&an(r))for(let i of r.declarationList.declarations)d.isIdentifier(i.name)&&n.add(i.name.text);else if(d.isExportDeclaration(r)&&r.exportClause&&d.isNamedExports(r.exportClause))for(let i of r.exportClause.elements)n.add((i.propertyName??i.name).text);else d.isExportAssignment(r)&&d.isIdentifier(r.expression)&&(n.add(r.expression.text),t=r.expression.text)}return{reachableLocals:n,defaultTarget:t}}function nl(e){for(let n of e.statements){if(d.isFunctionDeclaration(n)&&n.name!==void 0&&an(n)&&d.getModifiers(n)?.some(t=>t.kind===d.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(d.isExportAssignment(n)&&!n.isExportEquals&&d.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===d.SyntaxKind.EqualsToken&&ke(t.left)&&d.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function ze(e){if(d.isCallExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&d.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function ke(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Oe(e){if(ke(e))return!0;if(!d.isPropertyAccessExpression(e)&&!d.isElementAccessExpression(e))return!1;let n=e.expression;return d.isIdentifier(n)&&n.text==="exports"?!0:ke(n)}function mn(e){return d.isPropertyAccessExpression(e.expression)&&d.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function $r(e){let n=!1,t=r=>{if(!n){if(d.isCallExpression(r)){let i=ze(r);if(i!==void 0&&he(i)!=="package-root"){n=!0;return}}d.forEachChild(r,t)}};return t(e),n}function Lr(e){let n=new Set,t=i=>i!==void 0&&$r(i),r=i=>{d.isVariableDeclaration(i)&&t(i.initializer)&&bn(i.name,n),d.isBinaryExpression(i)&&i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(i.left)&&t(i.right)&&n.add(i.left.text),d.forEachChild(i,r)};return r(e),n}function Pr(e,n){for(let t of e.properties)d.isShorthandPropertyAssignment(t)?n.add(t.name.text):d.isPropertyAssignment(t)&&d.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function tl(e){let n=new Set;for(let a of e.statements)if(d.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(d.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(d.isVariableStatement(a))for(let o of a.declarationList.declarations)d.isIdentifier(o.name)&&o.initializer!==void 0&&(d.isFunctionExpression(o.initializer)||d.isArrowFunction(o.initializer)||d.isObjectLiteralExpression(o.initializer))&&n.add(o.name.text);let t=a=>d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isObjectLiteralExpression(a)||d.isIdentifier(a)&&n.has(a.text),r=new Set,i=a=>{d.isIdentifier(a)?r.add(a.text):d.isObjectLiteralExpression(a)&&Pr(a,r)},s=!1,l=a=>{if(!s){if(d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken)if(ke(a.left)){i(a.right);let o=a.right;(d.isObjectLiteralExpression(o)?o.properties.every(u=>d.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||d.isPropertyAssignment(u)&&t(u.initializer)):t(o))||(s=!0)}else Oe(a.left)&&(t(a.right)||(s=!0));else(d.isCallExpression(a)&&mn(a)&&a.arguments[0]!==void 0&&ln(a.arguments[0])||d.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(s=!0);s||d.forEachChild(a,l)}};if(l(e),!s&&r.size>0){for(let a of Fr(e))if(r.has(a)){s=!0;break}}return s}function ln(e){return Oe(e)||d.isIdentifier(e)&&e.text==="exports"}function Rr(e){if(!d.isPropertyAccessExpression(e.expression)||!d.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Bt(e){return Rr(e)&&e.arguments[0]!==void 0&&ln(e.arguments[0])}function il(e){return Rr(e)&&e.arguments[0]!==void 0&&d.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function rl(e){for(let n of e.declarations??[])if(d.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(d.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function sl(e,n,t,r,i){let s=(e.declarations??[]).filter(a=>!d.isSourceFile(a)&&!d.isModuleDeclaration(a));for(let a of s){let o=a.getSourceFile(),c=n.toRel(o.fileName);if(c===null||i.has(c))continue;let u=t.get(`${c}::${String(a.getStart(o,!1))}`);if(u!==void 0)return u}let l=e.getName();for(let a of s){let o=n.toRel(a.getSourceFile().fileName);if(o===null||i.has(o))continue;let c=r.get(`${o}::${l}`);if(c!==void 0)return c}}function Jn(e){return d.isPropertyAccessExpression(e)?e.name.text:d.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var zt=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Ut(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?Jn(e):void 0;return n!==void 0&&n!=="__proto__"&&zt.test(n)?n:void 0}function ol(e){return e!=="__proto__"&&zt.test(e)}function Ir(e){let n=pe(e);return d.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||ke(n)}function al(e){if(!d.isArrayLiteralExpression(e)&&!d.isObjectLiteralExpression(e))return!1;let n=!1,t=r=>{n||(Oe(r)?n=!0:d.forEachChild(r,t))};return t(e),n}function Vt(e){let n=!1,t=new Map,r=i=>{if(!n){if(d.isBinaryExpression(i)&&i.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(ke(i.left)||d.isIdentifier(i.left)&&i.left.text==="exports")n=!0;else if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ir(i.right))n=!0;else if(al(i.left))n=!0;else if(Oe(i.left)){let s=Ut(i.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(d.isCallExpression(i)&&mn(i)&&i.arguments[0]!==void 0&&ln(i.arguments[0])||d.isCallExpression(i)&&Bt(i)||d.isCallExpression(i)&&il(i)||d.isVariableDeclaration(i)&&i.initializer!==void 0&&Ir(i.initializer))&&(n=!0);n||d.forEachChild(i,r)}};return r(e),{surfaceEscapes:n,assignCount:t}}function qt(e){let n=[];for(let t of e.statements){if(!d.isExpressionStatement(t)||!d.isBinaryExpression(t.expression))continue;let r=t.expression;r.operatorToken.kind===d.SyntaxKind.EqualsToken&&(!Oe(r.left)||ke(r.left)||n.push({bin:r,name:Ut(r.left)}))}return n}function ll(e){let{surfaceEscapes:n,assignCount:t}=Vt(e);if(n)return[];let r=[];for(let{bin:i,name:s}of qt(e))s===void 0||(t.get(s)??0)!==1||(d.isFunctionExpression(i.right)||d.isArrowFunction(i.right))&&r.push({name:s,value:i.right});return r}function dl(e,n){let{surfaceEscapes:t,assignCount:r}=Vt(e);if(t)return[];let i=[];for(let{bin:s,name:l}of qt(e))l===void 0||(r.get(l)??0)!==1||d.isIdentifier(s.right)&&!n.has(s.right.text)&&i.push(s.right.text);return i}function cl(e,n){let{surfaceEscapes:t,assignCount:r}=Vt(e);for(let{bin:i,name:s}of qt(e)){let l=i.right;if(!(d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isIdentifier(l)))continue;let o=d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isIdentifier(l)&&!n.has(l.text);if(!(!t&&s!==void 0&&(r.get(s)??0)===1&&o))return!0}return!1}function ul(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&d.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function _r(e){let n=e.parent;return n===void 0?!1:d.isPropertyAccessExpression(n)?n.name===e:d.isQualifiedName(n)?n.right===e:d.isBindingElement(n)||d.isImportSpecifier(n)?n.propertyName===e:d.isExportSpecifier(n)?!0:d.isPropertyAssignment(n)||d.isPropertyDeclaration(n)||d.isPropertySignature(n)||d.isMethodDeclaration(n)||d.isMethodSignature(n)||d.isGetAccessorDeclaration(n)||d.isSetAccessorDeclaration(n)||d.isEnumMember(n)?n.name===e:!1}function Ar(e){for(let n=e.parent;n!==void 0;n=n.parent){if(d.isSourceFile(n))return!0;if(!d.isArrowFunction(n)&&(d.isFunctionLike(n)||d.isClassLike(n)))return!1}return!0}function fl(e,n){let t=r=>{d.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&n.add(r),d.forEachChild(r,t)};t(e)}function pl(e){let n=[],t=new Set;for(let s of e.statements){if(d.isExportDeclaration(s)||d.isExportAssignment(s)||d.isImportDeclaration(s)||d.isImportEqualsDeclaration(s)||an(s))return null;if(!d.isExpressionStatement(s)||!d.isBinaryExpression(s.expression))continue;let l=s.expression;if(l.operatorToken.kind===d.SyntaxKind.EqualsToken){if(ke(l.left))n.push({kind:"whole",value:l.right});else if(Oe(l.left)){let a=Ut(l.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:l.right,root:ul(l.left)})}else continue;fl(l.left,t)}}let r=!1,i=s=>{if(!r){if(d.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!_r(s)){r=!0;return}if(s.kind===d.SyntaxKind.ThisKeyword&&Ar(s)){r=!0;return}if(d.isIdentifier(s)&&s.text==="arguments"&&!_r(s)&&Ar(s)){r=!0;return}d.forEachChild(s,i)}};return i(e),r?null:n}function Kt(e){return d.isIdentifier(e)||d.isStringLiteralLike(e)?e.text:void 0}function Nr(e,n,t){return d.isIdentifier(e)?n(e.text):t?.(e)}function ml(e,n,t,r){let i=new Map,s=pl(e);if(s===null||s.filter(h=>h.kind==="whole").length>1)return i;let l=s.findIndex(h=>h.kind==="whole"),a=(h,k)=>l>=0&&k>l&&h.kind==="member"&&h.root==="exports",o=s.some(a);if(o){let h=s[l];if(h===void 0||h.kind!=="whole"||!d.isObjectLiteralExpression(h.value))return i}let c=o?s.filter((h,k)=>!a(h,k)):s,u=new Map;for(let h of c)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let f=h=>n.has(h)?void 0:t(h),m=(h,k)=>{k===void 0?i.delete(h):i.set(h,k)};for(let h of c){if(h.kind==="member"){m(h.name,(u.get(h.name)??0)>1?void 0:Nr(h.value,f,r));continue}i.clear();let k=h.value;if(d.isObjectLiteralExpression(k))for(let x of k.properties){if(d.isSpreadAssignment(x))return new Map;if(d.isShorthandPropertyAssignment(x)){m(x.name.text,f(x.name.text));continue}let y=Kt(x.name);if(y===void 0)return new Map;m(y,d.isPropertyAssignment(x)?Nr(x.initializer,f,r):void 0)}}return i}function Tr(e,n,t,r){let i=new Map,s=a=>a!==void 0&&he(a)==="relative"?t.get(`${n}::${a}`):void 0,l=a=>{if(d.isVariableDeclaration(a)&&a.initializer!==void 0){let o=a.initializer;if(d.isIdentifier(a.name)&&!r.has(a.name.text)){let c=s(ze(o));if(c!==void 0)i.set(a.name.text,{kind:"whole",target:c});else if((d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o))&&d.isCallExpression(o.expression)){let u=s(ze(o.expression)),f=Jn(o);u!==void 0&&f!==void 0&&i.set(a.name.text,{kind:"member",target:u,member:f})}}else if(d.isObjectBindingPattern(a.name)){let c=s(ze(o));if(c!==void 0){for(let u of a.name.elements)if(d.isIdentifier(u.name)&&!r.has(u.name.text)){let f=u.propertyName!==void 0&&d.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;i.set(u.name.text,{kind:"member",target:c,member:f})}}}}d.forEachChild(a,l)};return l(e),i}function hl(e,n,t,r){let i=l=>l!==void 0&&he(l)==="relative"?t.get(`${n}::${l}`):void 0,s=i(ze(e));if(s!==void 0)return{kind:"whole",target:s};if(d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)){let l=Jn(e);if(l===void 0)return;let a=i(ze(e.expression));if(a!==void 0)return{kind:"member",target:a,member:l};if(d.isIdentifier(e.expression)){let o=r.get(e.expression.text);if(o?.kind==="whole")return{kind:"member",target:o.target,member:l}}return}if(d.isIdentifier(e))return r.get(e.text)}function Dr(e,n,t,r,i){let s=[],l=!1,a=f=>{if($r(f))return!0;let m=!1,h=k=>{m||(d.isIdentifier(k)&&i.has(k.text)?m=!0:d.forEachChild(k,h))};return h(f),m},o=(f,m)=>{let h=hl(f,n,t,r);h!==void 0?s.push({source:h,exportedName:m}):a(f)&&(l=!0)},c=f=>{if(d.isObjectLiteralExpression(f)){for(let m of f.properties)if(d.isSpreadAssignment(m))o(m.expression,"default");else if(d.isPropertyAssignment(m)){let h=d.isIdentifier(m.name)||d.isStringLiteralLike(m.name)?m.name.text:"default";o(m.initializer,h)}else if(d.isShorthandPropertyAssignment(m)){let h=r.get(m.name.text);h!==void 0&&s.push({source:h,exportedName:m.name.text})}return}o(f,"default")},u=f=>{if(d.isBinaryExpression(f)&&f.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(ke(f.left)){c(f.right);return}if(Oe(f.left)){let m=d.isPropertyAccessExpression(f.left)?f.left.name.text:d.isElementAccessExpression(f.left)&&d.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";o(f.right,m);return}}else if(d.isExportAssignment(f)&&f.isExportEquals){o(f.expression,"default");return}else if(d.isCallExpression(f)&&mn(f)&&f.arguments[0]!==void 0&&ln(f.arguments[0])){for(let m of f.arguments.slice(1))c(m);return}d.forEachChild(f,u)};return u(e),{sources:s,residual:l}}function Fr(e){let n=new Set,t=i=>{let s=i;for(;d.isPropertyAccessExpression(s)||d.isElementAccessExpression(s);)s=s.expression;return d.isIdentifier(s)?s.text:void 0},r=i=>{let s=Kr(i);if(s!==void 0){let l=t(s);l!==void 0&&n.add(l)}d.forEachChild(i,r)};return r(e),n}function Kr(e){return d.isBinaryExpression(e)&&e.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=d.SyntaxKind.LastAssignment&&(d.isPropertyAccessExpression(e.left)||d.isElementAccessExpression(e.left))?e.left:void 0}function Xn(e){if(d.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)d.isBindingElement(t)&&n.push(...Xn(t.name));return n}function be(e){if(d.isIdentifier(e))return[e.text];if(d.isParenthesizedExpression(e)||d.isAsExpression(e)||d.isNonNullExpression(e)||d.isSatisfiesExpression(e)||d.isTypeAssertionExpression(e)||d.isAwaitExpression(e))return be(e.expression);if(d.isYieldExpression(e))return e.expression!==void 0?be(e.expression):[];if(d.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===d.SyntaxKind.BarBarToken||n===d.SyntaxKind.AmpersandAmpersandToken||n===d.SyntaxKind.QuestionQuestionToken?[...be(e.left),...be(e.right)]:n===d.SyntaxKind.CommaToken?be(e.right):[]}return d.isConditionalExpression(e)?[...be(e.whenTrue),...be(e.whenFalse)]:d.isArrayLiteralExpression(e)?e.elements.flatMap(n=>d.isSpreadElement(n)?be(n.expression):d.isOmittedExpression(n)?[]:be(n)):d.isObjectLiteralExpression(e)?e.properties.flatMap(n=>d.isShorthandPropertyAssignment(n)?[n.name.text]:d.isPropertyAssignment(n)?be(n.initializer):d.isSpreadAssignment(n)?be(n.expression):[]):[]}function jr(e,n){let t=[],r=(a,o)=>{for(let c of a)for(let u of o)c!==u&&t.push({a:c,b:u})},i=a=>d.isIdentifier(a)?[a.text]:d.isArrayLiteralExpression(a)?a.elements.flatMap(i):d.isObjectLiteralExpression(a)?a.properties.flatMap(o=>d.isShorthandPropertyAssignment(o)?[o.name.text]:d.isPropertyAssignment(o)?i(o.initializer):[]):[],s=a=>{d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken?r(i(a.left),be(a.right)):d.isVariableDeclaration(a)&&a.initializer!==void 0?r(Xn(a.name),be(a.initializer)):(d.isForOfStatement(a)||d.isForInStatement(a))&&d.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&r(Xn(a.initializer.declarations[0].name),be(a.expression)),d.forEachChild(a,s)};s(e);let l=new Set(n);for(let a=!0;a;){a=!1;for(let{a:o,b:c}of t)l.has(o)&&!l.has(c)&&(l.add(c),a=!0),l.has(c)&&!l.has(o)&&(l.add(o),a=!0)}return l}function Br(e,n){let t=a=>{if(!d.isPropertyAccessExpression(a)&&!d.isElementAccessExpression(a))return;let o=a;for(;d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o);)o=o.expression;return d.isIdentifier(o)?o.text:void 0},r=[],i=(a,o)=>{for(let u of be(o))r.push({name:a,root:u});let c=t(o);c!==void 0&&r.push({name:a,root:c})},s=a=>{d.isVariableDeclaration(a)&&d.isIdentifier(a.name)&&a.initializer!==void 0?i(a.name.text,a.initializer):d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(a.left)&&i(a.left.text,a.right),d.forEachChild(a,s)};s(e);let l=new Map(n);for(let a=!0;a;){a=!1;for(let{name:o,root:c}of r){let u=l.get(c);u!==void 0&&!l.has(o)&&(l.set(o,u),a=!0)}}return l}function zr(e){return jr(e,Fr(e))}function gl(e,n){let t=o=>o>=d.SyntaxKind.FirstAssignment&&o<=d.SyntaxKind.LastAssignment,r=o=>{let c=o.parent;if(c===void 0||!d.isObjectLiteralExpression(c))return!1;let u=c.parent;return u!==void 0&&d.isBinaryExpression(u)&&u.operatorToken.kind===d.SyntaxKind.EqualsToken&&u.right===c&&Oe(u.left)?!0:u!==void 0&&d.isCallExpression(u)&&mn(u)&&u.arguments[0]!==void 0&&ln(u.arguments[0])&&u.arguments.indexOf(c)>0},i=(o,c)=>{if((d.isFunctionDeclaration(c)||d.isFunctionExpression(c))&&c.name===o||d.isVariableDeclaration(c)&&c.name===o||d.isParameter(c)&&c.name===o||d.isBindingElement(c)&&c.name===o||(d.isCallExpression(c)||d.isNewExpression(c))&&c.expression===o)return!0;if((d.isPropertyAccessExpression(c)||d.isElementAccessExpression(c))&&c.expression===o){let u=c;for(;u.parent!==void 0&&(d.isPropertyAccessExpression(u.parent)||d.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let f=u.parent;return!(f!==void 0&&d.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===u)}return d.isBinaryExpression(c)&&c.operatorToken.kind===d.SyntaxKind.EqualsToken&&c.right===o&&Oe(c.left)?!0:d.isShorthandPropertyAssignment(c)&&c.name===o||d.isPropertyAssignment(c)&&c.initializer===o?r(c):!!(d.isExportAssignment(c)&&c.expression===o||d.isExportSpecifier(c))},s=(o,c)=>d.isPropertyAccessExpression(c)&&c.name===o||d.isPropertyAssignment(c)&&c.name===o||(d.isMethodDeclaration(c)||d.isGetAccessorDeclaration(c)||d.isSetAccessorDeclaration(c))&&c.name===o,l=!1,a=(o,c)=>{if(!l){if(d.isIdentifier(o)&&c!==void 0&&n.has(o.text)&&!s(o,c)&&!i(o,c)){l=!0;return}d.forEachChild(o,u=>a(u,o))}};return a(e,void 0),l}function yl(e){let n=new Set;for(let o of e.statements)if(d.isFunctionDeclaration(o)&&o.name!==void 0)n.add(o.name.text);else if(d.isVariableStatement(o))for(let c of o.declarationList.declarations)d.isIdentifier(c.name)&&c.initializer!==void 0&&(d.isFunctionExpression(c.initializer)||d.isArrowFunction(c.initializer))&&n.add(c.name.text);let t=new Set,r=o=>{d.isBinaryExpression(o)&&o.operatorToken.kind===d.SyntaxKind.EqualsToken?(ke(o.left)&&(d.isIdentifier(o.right)?t.add(o.right.text):d.isObjectLiteralExpression(o.right)&&Pr(o.right,t)),ke(o.right)&&d.isIdentifier(o.left)&&t.add(o.left.text)):d.isVariableDeclaration(o)&&d.isIdentifier(o.name)&&o.initializer!==void 0&&ke(o.initializer)&&t.add(o.name.text),d.forEachChild(o,r)};if(r(e),t.size>0){if(gl(e,t))return!0;let o=Br(e,new Map([...t].map(u=>[u,u]))),c=zr(e);for(let u of o.keys())if(c.has(u))return!0}let i=o=>d.isIdentifier(o)&&n.has(o.text),s=o=>o.properties.every(c=>d.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||d.isPropertyAssignment(c)&&i(c.initializer)),l=!1,a=o=>{if(!l){if(d.isBinaryExpression(o)){let c=o.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=d.SyntaxKind.LastAssignment;c&&ke(o.left)?o.operatorToken.kind===d.SyntaxKind.EqualsToken&&(i(o.right)||d.isObjectLiteralExpression(o.right)&&s(o.right))||(l=!0):c&&Oe(o.left)&&(l=!0)}else d.isCallExpression(o)?(mn(o)&&o.arguments[0]!==void 0&&ln(o.arguments[0])||Bt(o))&&(l=!0):(d.isExportAssignment(o)&&o.isExportEquals&&!d.isIdentifier(o.expression)||d.isExportDeclaration(o)&&o.moduleSpecifier!==void 0)&&(l=!0);l||d.forEachChild(o,a)}};return a(e),l}var xl=8;function Cr(e,n,t){let r=new Set,i=Tr(e,n,t,fn(e)),s=Dr(e,n,t,i,Lr(e));for(let{source:l}of s.sources)r.add(l.target);for(let l of e.statements)if(d.isExportDeclaration(l)&&l.moduleSpecifier!==void 0&&d.isStringLiteralLike(l.moduleSpecifier)&&he(l.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${l.moduleSpecifier.text}`);a!==void 0&&r.add(a)}return r}function Sl(e,n,t,r=new Map){let i=new Set(n.modules.filter(E=>E.isEntrypoint).map(E=>String(E.id)));if(i.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(E=>E.externalSurface===!0).map(E=>String(E.id))),l=new Map,a=new Map,o=new Map,c=new Map;for(let E of t){if(E.name==="<toplevel>"){c.set(String(E.moduleId),E);continue}if(l.set(`${String(E.moduleId)}::${String(E.declRange.start)}`,E),E.name!==void 0&&a.set(`${String(E.moduleId)}::${E.name}`,E),E.isExported&&E.name!==void 0){let p=o.get(String(E.moduleId))??[];p.push(E),o.set(String(E.moduleId),p)}}if(r.size>0){let E=new Map(t.map(p=>[String(p.id),p]));for(let[p,S]of r){let A=E.get(String(S));A!==void 0&&!l.has(p)&&l.set(p,A)}}let u=new Map;for(let E of n.imports)E.resolvedModuleId!==void 0&&u.set(`${E.moduleId}::${E.specifier}`,String(E.resolvedModuleId));let f=new Map;for(let E of e.sourceFiles){let p=e.toRel(E.fileName);p!==null&&f.set(p,E)}let m=new Map,h=E=>{let p=m.get(E);if(p!==void 0)return p;let S=f.get(E),A=S===void 0?!0:yl(S);return m.set(E,A),A},k=new Set,x=(E,p)=>p!==void 0&&he(p)==="relative"?u.get(`${E}::${p}`):void 0,y=E=>{if(d.isIdentifier(E))return E.text;if(d.isPropertyAccessExpression(E)){let p=y(E.expression);return p===void 0?void 0:`${p}.${E.name.text}`}if(d.isElementAccessExpression(E)&&d.isStringLiteralLike(E.argumentExpression)){let p=y(E.expression);return p===void 0?void 0:`${p}.${E.argumentExpression.text}`}},I=E=>{let p=E;for(;d.isPropertyAccessExpression(p)||d.isElementAccessExpression(p);)p=p.expression;return ze(p)};for(let E of e.sourceFiles){let p=e.toRel(E.fileName);if(p===null)continue;let S=new Map,A=new Map,N=($,R)=>{let j=x(p,ze(R));if(j!==void 0){if(d.isIdentifier($))A.set($.text,j),S.set($.text,j);else if(d.isObjectBindingPattern($)||d.isArrayBindingPattern($))for(let V of Xn($))A.set(V,j);else if(d.isPropertyAccessExpression($)||d.isElementAccessExpression($)){let V=y($);V!==void 0&&S.set(V,j)}}},O=$=>{d.isVariableDeclaration($)&&$.initializer!==void 0?N($.name,$.initializer):d.isBinaryExpression($)&&$.operatorToken.kind===d.SyntaxKind.EqualsToken&&N($.left,$.right),d.forEachChild($,O)};O(E);let _=$=>{let R=Kr($);if(R!==void 0){let j=R.expression,V=x(p,I(j));V!==void 0&&k.add(V);let te=y(j),se=te!==void 0?S.get(te):void 0;se!==void 0&&k.add(se)}d.forEachChild($,_)};if(_(E),A.size>0){let $=Br(E,A),R=zr(E);for(let[j,V]of $)R.has(j)&&k.add(V)}}let v=[],C=[],M=[];for(let E of e.sourceFiles){let p=e.toRel(E.fileName);if(p===null||!i.has(p))continue;let S=e.checker.getSymbolAtLocation(E),A=new Set,N=new Set,O=0,_=(z,P)=>{if(s.has(String(z.moduleId))||A.has(String(z.id)))return;A.add(String(z.id));let q=`${p}#reexport:${String(O)}:${P}`;O+=1,v.push({id:q,moduleId:p,exportedName:P,kind:"value",reexportOf:{moduleId:String(z.moduleId),name:z.name??P}}),C.push({exportId:q,target:{kind:"function",functionId:z.id}})},$=z=>{if(rl(z))return;let P=z;if((z.flags&d.SymbolFlags.Alias)!==0)try{P=e.checker.getAliasedSymbol(z)}catch{return}let q=sl(P,e,l,a,s);if(q!==void 0){_(q,z.getName());return}if((P.flags&d.SymbolFlags.Module)!==0&&!N.has(P)){N.add(P);try{for(let oe of e.checker.getExportsOfModule(P))$(oe)}catch{}}};if(S!==void 0)for(let z of e.checker.getExportsOfModule(S))$(z);let R=Tr(E,p,u,fn(E)),j=Dr(E,p,u,R,Lr(E)),V=new Set,te=j.residual,se=z=>{let P=f.get(z);z.includes("node_modules/")||P===void 0||tl(P)?te=!0:V.add(z)};for(let{source:z,exportedName:P}of j.sources){let q=o.get(z.target)??[],oe=k.has(z.target);if(z.kind==="whole"){for(let G of q)_(G,G.name??P);oe?te=!0:(q.length===0||h(z.target))&&se(z.target)}else{let G=q.filter(ae=>ae.name===z.member);for(let ae of G)_(ae,P);oe?te=!0:(G.length===0||h(z.target))&&se(z.target)}}let X=new Set,Y=[];for(let z of Cr(E,p,u))Y.push({target:z,depth:1});for(;Y.length>0;){let z=Y.shift();if(z===void 0)break;let{target:P,depth:q}=z;if(X.has(P)||q>xl||(X.add(P),P.split("/").includes("node_modules")))continue;let oe=f.get(P);if(oe===void 0)continue;let G=c.get(P);G!==void 0&&!h(P)&&_(G,"<load>");for(let ae of Cr(oe,P,u))X.has(ae)||Y.push({target:ae,depth:q+1})}cl(E,fn(E))&&(te=!0);for(let z of V)M.push({code:"unresolved-reexport",path:p,detail:`entrypoint whole/member re-exports app-owned relative module ${z} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:z});te&&M.push({code:"unresolved-reexport",path:p,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:v,exportBindings:C,diagnostics:M}}var pn=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),bl=new Set(["defineProperty","defineProperties","create"]);function kl(e){let n=!0,t=i=>d.isIdentifier(i)||d.isStringLiteral(i)||d.isNumericLiteral(i)?pn.has(i.text):d.isComputedPropertyName(i)&&d.isStringLiteralLike(i.expression)?pn.has(i.expression.text):!1,r=i=>{if(n){if(d.isNewExpression(i)||d.isForOfStatement(i)||d.isSpreadElement(i)||d.isSpreadAssignment(i)||d.isArrayBindingPattern(i)||d.isGetAccessorDeclaration(i)||d.isSetAccessorDeclaration(i)||d.isYieldExpression(i)&&i.asteriskToken!==void 0||d.canHaveDecorators(i)&&(d.getDecorators(i)?.length??0)>0){n=!1;return}if((d.isPropertyAccessExpression(i)||d.isMethodDeclaration(i)||d.isPropertyAssignment(i))&&t(i.name)||d.isPropertyDeclaration(i)&&t(i.name)||d.isShorthandPropertyAssignment(i)&&t(i.name)||d.isBindingElement(i)&&t(i.propertyName??i.name)||d.isElementAccessExpression(i)&&d.isStringLiteralLike(i.argumentExpression)&&pn.has(i.argumentExpression.text)){n=!1;return}if(d.isCallExpression(i)&&d.isPropertyAccessExpression(i.expression)&&d.isIdentifier(i.expression.expression)&&i.expression.expression.text==="Object"&&bl.has(i.expression.name.text)){n=!1;return}d.forEachChild(i,r)}};return r(e),n}function Yn(e){if(d.isIdentifier(e)||d.isStringLiteral(e)||d.isNumericLiteral(e))return e.text}function Ur(e){let n=t=>d.canHaveDecorators(t)&&(d.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function El(e){let n=!1,t=new Set,r=[],i=new Map,s=(m,h)=>{let k=i.get(m);k===void 0?i.set(m,[h]):k.push(h)},l=m=>{d.isIdentifier(m)?t.add(m.text):r.push(m)},a=m=>{for(let h of m.properties)d.isShorthandPropertyAssignment(h)?t.add(h.name.text):d.isPropertyAssignment(h)?r.push(h.initializer):n=!0},o=m=>{if(d.isBinaryExpression(m)&&m.operatorToken.kind===d.SyntaxKind.EqualsToken){let h=m.left,k=m.right;ke(h)?d.isObjectLiteralExpression(k)?a(k):d.isIdentifier(k)||d.isFunctionExpression(k)||d.isArrowFunction(k)||d.isClassExpression(k)?l(k):n=!0:Oe(h)?(d.isElementAccessExpression(h)&&!d.isStringLiteralLike(h.argumentExpression)&&(n=!0),l(k)):d.isIdentifier(h)?s(h.text,k):(d.isPropertyAccessExpression(h)||d.isElementAccessExpression(h))&&d.isIdentifier(h.expression)&&s(h.expression.text,k)}else if(d.isCallExpression(m))(mn(m)&&m.arguments[0]!==void 0&&ln(m.arguments[0])||Bt(m))&&(n=!0);else if(d.isVariableDeclaration(m)&&d.isIdentifier(m.name)&&m.initializer!==void 0)s(m.name.text,m.initializer);else if((d.isFunctionDeclaration(m)||d.isClassDeclaration(m))&&m.name!==void 0)s(m.name.text,m),an(m)&&t.add(m.name.text);else if(d.isExportDeclaration(m)){if(m.exportClause===void 0)n=!0;else if(m.moduleSpecifier===void 0&&d.isNamedExports(m.exportClause))for(let h of m.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(d.isExportAssignment(m))m.isExportEquals&&!d.isIdentifier(m.expression)?n=!0:l(m.expression);else if(d.isVariableStatement(m)&&an(m))for(let h of m.declarationList.declarations)d.isIdentifier(h.name)&&t.add(h.name.text);d.forEachChild(m,o)};o(e);let c=new Set,u=[...t],f=m=>{let h=k=>{d.isIdentifier(k)&&u.push(k.text),d.forEachChild(k,h)};h(m)};for(let m of r)f(m);for(;u.length>0;){let m=u.pop();if(!(m===void 0||c.has(m))){c.add(m);for(let h of i.get(m)??[])f(h)}}return{names:c,opaque:n}}var wl=512,vl=new Set(["get","post","put","patch","delete","options","head"]);function Il(e){for(let n of e.statements){if(d.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(n.expression.left)&&d.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,r=n.expression.left.name.text;if(t==="module"&&r==="exports"||t==="exports"&&r==="default")return n.expression.right}}return null}function _l(e){let n=new Map,t=Il(e);if(t===null)return n;let r=s=>{for(let l of s.properties)if(d.isPropertyAssignment(l)&&d.isObjectLiteralExpression(l.initializer)){let a=Yn(l.name);a!==void 0&&n.set(a,l.initializer)}};if(d.isObjectLiteralExpression(t))return r(t),n;if(!d.isIdentifier(t))return n;let i=t.text;for(let s of e.statements)if(d.isVariableStatement(s))for(let l of s.declarationList.declarations)d.isIdentifier(l.name)&&l.name.text===i&&l.initializer!==void 0&&d.isObjectLiteralExpression(l.initializer)&&r(l.initializer);else if(d.isExpressionStatement(s)&&d.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(s.expression.left)&&d.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===i&&d.isObjectLiteralExpression(s.expression.right)){let l=s.expression.left.name.text;n.set(l,s.expression.right)}return n}function Al(e){for(let n of e.properties){if(d.isMethodDeclaration(n)&&d.isIdentifier(n.name)&&n.name.text==="handler")return n;if(d.isPropertyAssignment(n)&&d.isIdentifier(n.name)&&n.name.text==="handler"&&(d.isArrowFunction(n.initializer)||d.isFunctionExpression(n.initializer)))return n.initializer}return null}function Nl(e,n){for(let r of e.properties){let i;if(d.isPropertyAssignment(r)||d.isMethodDeclaration(r)?i=Yn(r.name):d.isShorthandPropertyAssignment(r)&&(i=r.name.text),i==="method"||i==="url"||i==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Cl(e,n){let t=[],r=new Set,i=(a,o,c)=>{if(t.length>=wl||a==="__proto__"||!zt.test(a))return;let u=`${e}#handler:${a}`;r.has(u)||(r.add(u),t.push({id:u,node:o,memberPath:a,idiom:c}))};for(let[a,o]of _l(n)){let c=Al(o);c!==null&&Nl(o,c)&&i(a,c,"descriptor-object")}let s=0,l=a=>{if(d.isCallExpression(a)&&d.isPropertyAccessExpression(a.expression)&&d.isIdentifier(a.expression.expression)&&vl.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&d.isStringLiteralLike(a.arguments[0])){let o=a.expression.name.text;for(let c=1;c<a.arguments.length;c+=1){let u=a.arguments[c];u!==void 0&&(d.isArrowFunction(u)||d.isFunctionExpression(u))&&i(`${o}_${String(s)}_${String(c)}`,u,"router-verb")}s+=1}d.forEachChild(a,l)};return l(n),t}function Ml(e,n,t,r,i,s){let l=`${e}#class:${t}`,a=[],o=new Set;for(let c of r.members){let u,f,m;if(d.isConstructorDeclaration(c))u="constructor",f="ctor",m=!1;else if(d.isMethodDeclaration(c))u=Yn(c.name),f="method",m=u!==void 0&&!pn.has(u);else continue;if(u===void 0||o.has(u))continue;o.add(u);let h=`${e}#${t}.${u}`;i.push({id:h,moduleId:e,name:u,kind:f,enclosingClassId:l,declRange:Qe(e,c,n),isExported:!1,publicSurfaceReachable:!1}),a.push(h),m&&s.push({start:c.getStart(n,!1),end:c.getEnd(),id:h})}return{id:l,moduleId:e,name:t,implementsRefs:[],members:a}}function Ol(e,n,t=[],r=!1,i){let s=[],l=new Map,a=[],{reachableLocals:o,defaultTarget:c}=el(n),u=fn(n),f=`${e}#<toplevel>`;s.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let m=(p,S)=>{let A=`${e}#${p}`;return s.push({id:A,moduleId:e,name:p,kind:"function",declRange:Qe(e,S,n),isExported:o.has(p),publicSurfaceReachable:o.has(p)}),l.set(p,{kind:"function",functionId:A}),a.push({start:S.getStart(n,!1),end:S.getEnd(),id:A}),A},h=[],k=!e.split("/").includes("node_modules");if(k)for(let p of dl(n,u))o.add(p);let x=k?El(n):void 0,y=(p,S,A)=>{x===void 0||x.opaque||x.names.has(p)||an(A)||Ur(S)||h.push(Ml(e,n,p,S,s,a))};for(let p of n.statements)if(d.isFunctionDeclaration(p)&&p.name!==void 0)m(p.name.text,p);else if(d.isClassDeclaration(p)&&p.name!==void 0)y(p.name.text,p,p);else if(d.isVariableStatement(p))for(let S of p.declarationList.declarations){if(d.isObjectBindingPattern(S.name)&&S.initializer!==void 0&&d.isCallExpression(S.initializer)&&d.isIdentifier(S.initializer.expression)&&S.initializer.expression.text==="require"&&S.initializer.arguments.length===1&&S.initializer.arguments[0]!==void 0&&d.isStringLiteralLike(S.initializer.arguments[0])){let N=S.initializer.arguments[0].text;for(let O of S.name.elements){if(O.dotDotDotToken!==void 0||O.initializer!==void 0||!d.isIdentifier(O.name))continue;let _=O.propertyName??O.name;!d.isIdentifier(_)&&!d.isStringLiteralLike(_)||l.set(O.name.text,{kind:"import",specifier:N,form:{named:_.text}})}continue}if(!d.isIdentifier(S.name)||S.initializer===void 0)continue;let A=S.initializer;if(d.isFunctionExpression(A)||d.isArrowFunction(A))m(S.name.text,S);else if(d.isClassExpression(A))y(S.name.text,A,p);else if(d.isCallExpression(A)&&d.isIdentifier(A.expression)&&A.expression.text==="require"&&A.arguments.length===1&&A.arguments[0]!==void 0&&d.isStringLiteralLike(A.arguments[0]))l.set(S.name.text,{kind:"import",specifier:A.arguments[0].text,form:"whole"});else if((d.isPropertyAccessExpression(A)||d.isElementAccessExpression(A))&&Jn(A)==="default"&&d.isCallExpression(A.expression)){let N=ze(A.expression);N!==void 0&&l.set(S.name.text,{kind:"import",specifier:N,form:"require-default"})}}else if(d.isImportDeclaration(p)&&d.isStringLiteralLike(p.moduleSpecifier)){let S=p.moduleSpecifier.text,A=p.importClause;if(A!==void 0){A.name!==void 0&&l.set(A.name.text,{kind:"import",specifier:S,form:"default"});let N=A.namedBindings;if(N!==void 0&&d.isNamespaceImport(N))l.set(N.name.text,{kind:"import",specifier:S,form:"namespace"});else if(N!==void 0&&d.isNamedImports(N))for(let O of N.elements){let _=(O.propertyName??O.name).text;l.set(O.name.text,{kind:"import",specifier:S,form:{named:_}})}}}else d.isImportEqualsDeclaration(p)&&d.isExternalModuleReference(p.moduleReference)&&d.isStringLiteralLike(p.moduleReference.expression)&&l.set(p.name.text,{kind:"import",specifier:p.moduleReference.expression.text,form:"whole"});let I=new Map,v,C=new Map,M=new Map;if(k)for(let{name:p,value:S}of ll(n)){let A=`${e}#member-export:${p}`;s.push({id:A,moduleId:e,name:p,kind:d.isArrowFunction(S)?"arrow":"function",declRange:Qe(e,S,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:S.getStart(n,!1),end:S.getEnd(),id:A}),I.set(S.getStart(n,!1),A)}if(r&&k){let p=_=>{let $=we(_);return d.isFunctionExpression($)||d.isArrowFunction($)?$:void 0},S=(_,$)=>{let R=_;return s.push({id:R,moduleId:e,kind:d.isArrowFunction($)?"arrow":"function",declRange:Qe(e,$,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:$.getStart(n,!1),end:$.getEnd(),id:R}),I.set($.getStart(n,!1),R),R},A=[],N=[],O=[];for(let _ of n.statements)d.isExportAssignment(_)&&!_.isExportEquals?A.push(_):d.isFunctionDeclaration(_)&&d.getModifiers(_)?.some($=>$.kind===d.SyntaxKind.DefaultKeyword)===!0?N.push(_):d.isExpressionStatement(_)&&d.isBinaryExpression(_.expression)&&_.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&ke(_.expression.left)&&O.push(_.expression);if(A.length+N.length+O.length===1){let _=A[0],$=N[0],R=O[0];if(_!==void 0){let j=p(_.expression);if(j!==void 0){let V=S(`${e}#<default>`,j);v={id:V,esm:!0},M.set(_.getStart(n,!1),V),ee(i,"2a-default",null)}}else if($!==void 0&&$.name===void 0&&$.body!==void 0){let j=S(`${e}#<default>`,$);v={id:j,esm:!0},M.set($.getStart(n,!1),j),ee(i,"2a-default",null)}else if(R!==void 0){let j=p(R.right);if(j!==void 0){let V=S(`${e}#<default>`,j);v={id:V,esm:!1},M.set(R.getStart(n,!1),V),ee(i,"2a-default",null)}else if(d.isObjectLiteralExpression(R.right)){let V=R.right,te=[],se=!0;for(let X of V.properties){if(d.isSpreadAssignment(X)){se=!1;break}let Y=X.name,z=Y===void 0?void 0:Kt(Y);if(z===void 0){se=!1;break}te.push(z)}if(se){let X=new Map;for(let Y of te)X.set(Y,(X.get(Y)??0)+1);for(let Y of V.properties){if(!d.isPropertyAssignment(Y))continue;let z=Kt(Y.name),P=p(Y.initializer);if(z!==void 0){if(!ol(z)){P!==void 0&&ee(i,"2a-member","charset-refused");continue}if((X.get(z)??0)!==1){P!==void 0&&ee(i,"2a-member","duplicate-key");continue}if(P!==void 0){let q=S(`${e}#<cjs>.${z}`,P);C.set(z,q),M.set(Y.getStart(n,!1),q),ee(i,"2a-member",null)}}}}else for(let X of V.properties)d.isPropertyAssignment(X)&&p(X.initializer)!==void 0&&ee(i,"2a-member","spread-or-computed-literal")}}}else{for(let _ of A)p(_.expression)!==void 0&&ee(i,"2a-default","duplicate-default-sources");for(let _ of N)_.name===void 0&&ee(i,"2a-default","duplicate-default-sources");for(let _ of O)if(p(_.right)!==void 0)ee(i,"2a-default","duplicate-default-sources");else if(d.isObjectLiteralExpression(_.right))for(let $ of _.right.properties)d.isPropertyAssignment($)&&p($.initializer)!==void 0&&ee(i,"2a-member","duplicate-default-sources")}}for(let p of t)s.push({id:p.id,moduleId:e,name:`handler:${p.memberPath}`,kind:d.isArrowFunction(p.node)?"arrow":"function",declRange:Qe(e,p.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:p.node.getStart(n,!1),end:p.node.getEnd(),id:p.id});a.sort((p,S)=>p.end-p.start-(S.end-S.start));let E=c!==void 0?`${e}#${c}`:void 0;return{rel:e,sf:n,functions:s,bindings:l,exportedFunctionId:E,exportedNames:o,tainted:u,fnRanges:a,toplevelId:f,classes:h,mintedByPos:I,mintedDefault:v,mintedMembers:C,mintSeedAliases:M}}function $l(e){return d.isIdentifier(e)?"identifier":d.isPropertyAccessExpression(e)?"member":d.isElementAccessExpression(e)?"computed-member":e.kind===d.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function Mr(e,n){let t=r=>{if(d.isBinaryExpression(r)&&r.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=d.SyntaxKind.LastAssignment){let i=r.left;d.isPropertyAccessExpression(i)&&d.isIdentifier(i.expression)?n(i.expression.text,i.name.text):d.isElementAccessExpression(i)&&d.isIdentifier(i.expression)&&n(i.expression.text,d.isStringLiteralLike(i.argumentExpression)?i.argumentExpression.text:null)}else if(d.isCallExpression(r)&&d.isPropertyAccessExpression(r.expression)){let i=r.expression,s=r.arguments[0];d.isIdentifier(i.expression)&&s!==void 0&&d.isIdentifier(s)&&(i.expression.text==="Object"&&(i.name.text==="assign"||i.name.text==="defineProperty"||i.name.text==="defineProperties")||i.expression.text==="Reflect"&&i.name.text==="defineProperty")&&n(s.text,null)}d.forEachChild(r,t)};t(e)}function Ll(e){let n=!1,t=r=>{if(!n){if(d.isVariableDeclaration(r)||d.isParameter(r)){let i=new Set;if(bn(r.name,i),i.has("require")){n=!0;return}}else if((d.isFunctionDeclaration(r)||d.isClassDeclaration(r))&&r.name!==void 0&&r.name.text==="require"){n=!0;return}d.forEachChild(r,t)}};return t(e),n}function Pl(e,n,t,r=new Map,i={}){let s=i.additiveForms===!0,l=i.namelessExports===!0,a=s||l?{}:void 0,o=new Map,c=new Map;for(let p of n.imports)p.resolvedModuleId!==void 0&&c.set(`${p.moduleId}::${p.specifier}`,p.resolvedModuleId);for(let p of e.sourceFiles){let S=e.toRel(p.fileName);S!==null&&o.set(S,Ol(S,p,r.get(S)??[],l,a))}let u=new Map;if(s)for(let p of o.values()){let S=new Map;for(let[A,N]of p.bindings)if(N.kind==="import"&&N.form==="whole"&&he(N.specifier)!=="package-root"){let O=c.get(`${p.rel}::${N.specifier}`);O!==void 0&&S.set(A,String(O))}S.size!==0&&Mr(p.sf,(A,N)=>{let O=S.get(A);if(O===void 0)return;let _=u.get(O);if(_!=="*"){if(N===null){u.set(O,"*");return}_===void 0?u.set(O,new Set([N])):_.add(N)}})}let f=new Map;for(let p of o.values())p.exportedFunctionId!==void 0&&f.set(p.rel,p.exportedFunctionId);let m=new Map;for(let p of o.values()){if(p.rel.split("/").includes("node_modules"))continue;let S=nl(p.sf);if(S===void 0){l&&p.mintedDefault!==void 0&&m.set(p.rel,p.mintedDefault);continue}let A=p.bindings.get(S.name);A?.kind==="function"&&m.set(p.rel,{id:A.functionId,esm:S.esm})}let h=new Map;for(let p of o.values()){let S;for(let A of p.exportedNames){let N=p.bindings.get(A);N?.kind==="function"&&(S??=new Map,S.set(A,N.functionId))}S!==void 0&&h.set(p.rel,S)}let k=new Map;for(let p of o.values()){if(p.rel.split("/").includes("node_modules"))continue;let S=ml(p.sf,p.tainted,A=>{let N=p.bindings.get(A);return N?.kind==="function"?N.functionId:void 0},l?A=>{let N=we(A);return d.isFunctionExpression(N)||d.isArrowFunction(N)?p.mintedByPos.get(N.getStart(p.sf,!1)):void 0}:void 0);S.size>0&&k.set(p.rel,S)}let x=[],y=[],I=[],v=[],C=[],M=[];for(let p of o.values()){x.push(...p.functions),M.push(...p.classes);for(let b of p.exportedNames){let w=p.bindings.get(b);if(w?.kind==="function"){let L=`${p.rel}#export:${b}`;v.push({id:L,moduleId:p.rel,exportedName:b,kind:"value"}),C.push({exportId:L,target:{kind:"function",functionId:w.functionId}})}}if(l){if(p.mintedDefault!==void 0){let b=`${p.rel}#export:<default>`;v.push({id:b,moduleId:p.rel,exportedName:"default",kind:"value"}),C.push({exportId:b,target:{kind:"function",functionId:p.mintedDefault.id}})}for(let[b,w]of p.mintedMembers){let L=`${p.rel}#export:<cjs>.${b}`;v.push({id:L,moduleId:p.rel,exportedName:b,kind:"value"}),C.push({exportId:L,target:{kind:"function",functionId:w}})}}let S=new Map;for(let[b,w]of p.bindings){if(w.kind==="function"){S.set(b,w);continue}if(he(w.specifier)==="package-root"){let F=qe(w.specifier);typeof w.form=="object"?S.set(b,{kind:"package-export",packageName:F,exportName:w.form.named}):w.form==="require-default"?S.set(b,{kind:"package-default",packageName:F}):S.set(b,{kind:"package-surface",packageName:F})}else{let F=c.get(`${p.rel}::${w.specifier}`);if(F!==void 0&&typeof w.form=="object"){let H=h.get(String(F))?.get(w.form.named);H!==void 0&&S.set(b,{kind:"app-named-fn",functionId:H})}else if(F!==void 0&&w.form==="require-default"){let H=m.get(String(F));H!==void 0&&H.esm&&S.set(b,{kind:"app-default-fn",functionId:H.id})}else F!==void 0&&typeof w.form!="object"&&w.form!=="require-default"&&S.set(b,{kind:"module",resolvedModuleId:F})}}let A=new Map;for(let b of p.functions){if(b.enclosingClassId===void 0||b.name===void 0)continue;let w=A.get(b.enclosingClassId);w===void 0&&(w=new Map,A.set(b.enclosingClassId,w)),w.set(b.name,b.id)}for(let b of p.classes)b.name===void 0||p.tainted.has(b.name)||S.has(b.name)||S.set(b.name,{kind:"app-class",cls:{classId:b.id,className:b.name,memberIds:A.get(b.id)??new Map}});let N=b=>{if(d.isVariableDeclaration(b)&&d.isIdentifier(b.name)&&b.initializer!==void 0&&d.isNewExpression(b.initializer)&&!p.tainted.has(b.name.text)&&!S.has(b.name.text)){let w=vr(b.initializer,S,p.tainted);w!==null&&S.set(b.name.text,w)}d.forEachChild(b,N)};N(p.sf);let O=b=>{for(let w of p.fnRanges)if(b>=w.start&&b<w.end)return w.id;return p.toplevelId},_=new Map,$=new Map,R=new Map,j=(b,w,L)=>{if(L===null){b.set(w,"*");return}let F=b.get(w);F!=="*"&&(F===void 0?b.set(w,new Set([L])):F.add(L))},V=(b,w)=>{j(_,b,w);let L=S.get(b);L?.kind==="package-surface"?j($,L.packageName,w):L?.kind==="module"&&j(R,String(L.resolvedModuleId),w)};Mr(p.sf,V);let te=new Map,se=256,X=b=>{let w=te.get(b);return w===void 0&&(w=te.size>=se?new Set([b]):jr(p.sf,new Set([b])),te.set(b,w)),w},Y=(b,w)=>b==="*"||b!==void 0&&b.has(w),z=(b,w)=>{let L=S.get(b);if(L?.kind==="package-surface"&&Y($.get(L.packageName),w)||L?.kind==="module"&&Y(R.get(String(L.resolvedModuleId)),w))return!0;for(let F of X(b))if(Y(_.get(F),w))return!0;return!1},P=b=>{if(d.isIdentifier(b)){let w=p.tainted.has(b.text)?void 0:S.get(b.text);return w?.kind==="function"?w.functionId:w?.kind==="module"?f.get(String(w.resolvedModuleId))??null:w?.kind==="package-export"?t.exportFor(w.packageName,w.exportName):null}if(d.isPropertyAccessExpression(b)&&d.isIdentifier(b.expression)){let w=b.expression.text;if(z(w,b.name.text))return null;let L=p.tainted.has(w)?void 0:S.get(w);return L?.kind==="package-surface"?t.exportFor(L.packageName,b.name.text):L?.kind==="package-export"?t.methodFor(L.packageName,L.exportName,b.name.text,"method"):L?.kind==="package-instance"?t.methodFor(L.packageName,L.className,b.name.text,"method"):null}return null},q=b=>{for(let w=b.parent;w!==void 0;w=w.parent)if(!d.isArrowFunction(w)){if(d.isFunctionExpression(w)||d.isFunctionDeclaration(w))return null;if(d.isMethodDeclaration(w)||d.isConstructorDeclaration(w)||d.isGetAccessorDeclaration(w)||d.isSetAccessorDeclaration(w)){let L=w.parent;if(!d.isClassLike(L)||L.name===void 0)return null;let F=p.tainted.has(L.name.text)?void 0:S.get(L.name.text);return F?.kind==="app-class"?F.cls:null}}return null},oe=s&&!p.tainted.has("require")&&!Ll(p.sf),G=b=>{if(d.isIdentifier(b)){let F=p.tainted.has(b.text)?void 0:S.get(b.text);return F?.kind==="package-surface"||F?.kind==="package-default"?t.exportFor(F.packageName,"default"):F?.kind==="app-named-fn"||F?.kind==="app-default-fn"?F.functionId:F?.kind==="module"?m.get(String(F.resolvedModuleId))?.id??null:F?.kind==="member-value"?F.functionId:null}if(!d.isPropertyAccessExpression(b))return null;let w=b.expression;if(s&&d.isCallExpression(we(w))){let F=ze(we(w));if(F!==void 0)if(!oe)ee(a,"2b","require-shadow");else if(he(F)==="package-root")ee(a,"2b","package-root");else{let H=c.get(`${p.rel}::${F}`);if(H===void 0)ee(a,"2b","unresolved-module");else{let le=b.name.text,B=u.get(String(H));if(B==="*"||B!==void 0&&B.has(le))ee(a,"2b","module-mutation-gate");else{let T=k.get(String(H))?.get(le);if(T!==void 0)return ee(a,"2b",null),T;if(le==="default"){let U=m.get(String(H));if(U!==void 0&&U.esm)return ee(a,"2b",null),U.id;ee(a,"2b","non-esm-default")}else ee(a,"2b","unknown-member")}}}return null}let L;if(d.isIdentifier(w)){let F=p.tainted.has(w.text)?void 0:S.get(w.text);if(F?.kind==="app-class"||F?.kind==="app-instance")L=F.cls.memberIds;else if(F?.kind==="object-literal")L=F.obj.members;else if(F?.kind==="module"){let H=k.get(String(F.resolvedModuleId));H?.has(b.name.text)===!0&&!z(w.text,b.name.text)&&(L=H)}}else if(d.isNewExpression(w)){let F=vr(w,S,p.tainted);F?.kind==="app-instance"&&(L=F.cls.memberIds)}else w.kind===d.SyntaxKind.ThisKeyword&&(L=q(b)?.memberIds);return L?.get(b.name.text)??null},ae=new Map,J=b=>{if(d.isVariableDeclaration(b)&&d.isIdentifier(b.name)&&b.initializer!==void 0&&d.isObjectLiteralExpression(b.initializer)&&!p.tainted.has(b.name.text)&&!S.has(b.name.text)&&!ae.has(b.name.text)){let w=new Map;for(let L of b.initializer.properties)if(d.isPropertyAssignment(L)&&d.isIdentifier(L.name)){let F=P(L.initializer);F!==null&&w.set(L.name.text,F)}ae.set(b.name.text,w)}d.forEachChild(b,J)};J(p.sf);let Ne=b=>{if(d.isBinaryExpression(b)&&b.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(b.left)&&d.isIdentifier(b.left.expression)&&!p.tainted.has(b.left.expression.text)){let w=ae.get(b.left.expression.text);if(w!==void 0){let L=P(b.right);L!==null&&w.set(b.left.name.text,L)}}d.forEachChild(b,Ne)};Ne(p.sf);for(let[b,w]of ae)S.set(b,{kind:"object-literal",obj:{members:w}});let Ee=(b,w=0)=>{if(w>Er)return null;let L=we(b);if(d.isCallExpression(L)&&d.isPropertyAccessExpression(L.expression)&&L.expression.name.text==="bind")return Ee(L.expression.expression,w+1);if(d.isIdentifier(L)){let F=P(L);if(F!==null)return F;let H=p.tainted.has(L.text)?void 0:S.get(L.text);return H?.kind==="member-value"?H.functionId:null}return d.isPropertyAccessExpression(L)?P(L)??G(L):null},Q=(b,w=0)=>{if(w>Er)return"depth-cap";let L=we(b);if(d.isCallExpression(L)&&d.isPropertyAccessExpression(L.expression)&&L.expression.name.text==="bind")return Q(L.expression.expression,w+1);if(d.isIdentifier(L))return p.tainted.has(L.text)?"tainted-receiver":"unresolved-receiver";if(d.isPropertyAccessExpression(L)&&d.isIdentifier(L.expression)){if(p.tainted.has(L.expression.text))return"tainted-receiver";if(z(L.expression.text,L.name.text))return"mutated-member"}return"unresolved-receiver"},Ce=b=>{if(d.isVariableDeclaration(b)&&d.isIdentifier(b.name)&&b.initializer!==void 0){let w=we(b.initializer),L=d.isPropertyAccessExpression(w),F=d.isCallExpression(w)&&d.isPropertyAccessExpression(w.expression)&&w.expression.name.text==="bind";if(L||F){let H=L?"D1":"A2";if(p.tainted.has(b.name.text))ee(a,H,"tainted-alias");else if(S.has(b.name.text))ee(a,H,"already-bound");else{let le=Ee(w);le!==null?(S.set(b.name.text,{kind:"member-value",functionId:le}),ee(a,H,null)):ee(a,H,Q(w))}}}d.forEachChild(b,Ce)};s&&Ce(p.sf);let ye=0,ve=b=>{let w,L;if(d.isCallExpression(b)){let F=b.expression,H=d.isIdentifier(F)&&F.text==="require",le=F.kind===d.SyntaxKind.ImportKeyword;!H&&!le&&(w=F,L=b.arguments)}else d.isTaggedTemplateExpression(b)&&(w=b.tag);if(w!==void 0){let F=$l(w),H=b.getStart(p.sf,!1),le=`${p.rel}#call${String(ye)}`;ye+=1;let B="unresolved",T=[],U=P(w);U!==null&&(B="resolved",T.push(U)),y.push({id:le,enclosingFunctionId:O(H),calleeExprShape:F,resolvedTargetIds:T,resolution:B,range:Qe(p.rel,b,p.sf)});for(let re of T)I.push({callSiteId:le,calleeFunctionId:re,resolution:B});if(U===null){let re=G(w);if(re!==null)I.push({callSiteId:le,calleeFunctionId:re,resolution:"field-based"});else if(s&&d.isPropertyAccessExpression(w)&&(w.name.text==="call"||w.name.text==="apply")){let ie=Ee(w.expression);ie!==null?(I.push({callSiteId:le,calleeFunctionId:ie,resolution:"field-based"}),ee(a,"A3",null)):ee(a,"A3",Q(w.expression))}}for(let re of L??[]){let ie=P(re);if(ie!==null)I.push({callSiteId:le,calleeFunctionId:ie,resolution:"field-based"});else{let W=G(re);if(W!==null)I.push({callSiteId:le,calleeFunctionId:W,resolution:"field-based"});else if(s){let xe=Ee(re),ue=we(re),Ve=ue!==re||d.isCallExpression(ue)&&d.isPropertyAccessExpression(ue.expression)&&ue.expression.name.text==="bind";xe!==null?(I.push({callSiteId:le,calleeFunctionId:xe,resolution:"field-based"}),Ve&&ee(a,"A2p",null)):Ve&&ee(a,"A2p",Q(re))}}}}d.forEachChild(b,ve)};ve(p.sf);for(let b of n.computedLoads.get(p.rel)??[]){let w=b.candidateRels.filter(F=>o.has(F)).map(F=>`${F}#<toplevel>`);if(w.length===0)continue;let L=`${p.rel}#dirload${String(ye)}`;ye+=1,y.push({id:L,enclosingFunctionId:O(b.pos),calleeExprShape:"require",resolvedTargetIds:w,resolution:"field-based",range:{path:p.rel,start:b.pos,end:b.pos}});for(let F of w)I.push({callSiteId:L,calleeFunctionId:F,resolution:"field-based"})}let Re=0;for(let b of r.get(p.rel)??[]){let w=`${p.rel}#handlerseed${String(Re)}`;Re+=1;let L=b.node.getStart(p.sf,!1);y.push({id:w,enclosingFunctionId:p.toplevelId,calleeExprShape:"member",resolvedTargetIds:[b.id],resolution:"field-based",range:{path:p.rel,start:L,end:L}}),I.push({callSiteId:w,calleeFunctionId:b.id,resolution:"field-based"})}}let E=new Map;if(l)for(let p of o.values())for(let[S,A]of p.mintSeedAliases)E.set(`${p.rel}::${String(S)}`,A);return{functions:x,callSites:y,callEdges:I,exports:v,exportBindings:C,classes:M,mintSeedAliases:E,bindingApplicability:a}}function Rl(e,n,t){let r=o=>o.length===0||_e.isAbsolute(o)||o.includes("\\")||/^[a-zA-Z]:/u.test(o)||o.split("/").some(c=>c===".."||c==="");if(r(n)||r(t))return null;let i=e.endsWith(_e.sep)?e:e+_e.sep,s;try{s=kr(_e.resolve(e,n))}catch{return null}if(!s.startsWith(i))return null;let l=s.endsWith(_e.sep)?s:s+_e.sep,a;try{a=kr(_e.resolve(s,t))}catch{return null}return a.startsWith(l)?a:null}function Vr(e,n,t){let r=`${e}#class:${t}`,i=[],s=[],l=[],a=new Set;return{pushMember(o,c,u,f){if(o==="__proto__"||a.has(o))return;a.add(o);let m=`${e}#${t}.${o}`;i.push({id:m,moduleId:e,name:o,kind:u,enclosingClassId:r,declRange:Qe(e,c,n),isExported:!1,publicSurfaceReachable:!1}),l.push(m),s.push({name:o,id:m,kind:u,body:f})},finish(){return s.length===0?null:{functions:i,classNode:{id:r,moduleId:e,name:t,implementsRefs:[],members:l},members:s}}}}function Tl(e,n,t,r){if(Ur(r)||r.members.length>jt)return null;let i=Vr(e,n,t);for(let s of r.members){let l,a,o;if(d.isConstructorDeclaration(s))l="constructor",a="ctor",o=void 0;else if(d.isMethodDeclaration(s))l=Yn(s.name),a="method",o=l!==void 0&&!pn.has(l)?s.body??void 0:void 0;else continue;l!==void 0&&i.pushMember(l,s,a,o)}return i.finish()}function Dl(e,n,t){let r;for(let l of n.statements)if(d.isFunctionDeclaration(l)&&l.name?.text===t){r=l;break}if(r===void 0)return null;let i=[];for(let l of n.statements){if(!d.isExpressionStatement(l))continue;let a=l.expression;if(!d.isBinaryExpression(a)||a.operatorToken.kind!==d.SyntaxKind.EqualsToken)continue;let o=a.left;if(d.isPropertyAccessExpression(o)&&d.isPropertyAccessExpression(o.expression)&&d.isIdentifier(o.expression.expression)&&o.expression.expression.text===t&&o.expression.name.text==="prototype"){let c=o.name.text;d.isFunctionExpression(a.right)?i.push({name:c,fn:a.right,walk:!0}):d.isArrowFunction(a.right)&&i.push({name:c,fn:a.right,walk:!1})}}if(i.length===0||i.length+1>jt)return null;let s=Vr(e,n,t);s.pushMember("constructor",r,"ctor",void 0);for(let l of i){let a=l.walk&&!pn.has(l.name)&&d.isFunctionExpression(l.fn)?l.fn.body:void 0;s.pushMember(l.name,l.fn,"method",a)}return s.finish()}function Fl(e,n,t){for(let r of n.statements)if(d.isClassDeclaration(r)&&r.name?.text===t)return Tl(e,n,t,r);return Dl(e,n,t)}function Kl(e,n,t,r,i){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let l=new Set(t.map(f=>f.packageName)),a=new Set(t.map(f=>f.path)),o=new Set,c=new Set,u=0;for(let f of n){if(!l.has(f.packageName))continue;let m=Rl(e.appRoot,f.packageRootRel,f.sourcePath);if(m===null)continue;let h=e.toRel(m);if(h===null)continue;let k=`${h}#${f.container}`;if(c.has(k)||!o.has(h)&&o.size>=Gn)continue;let x=De(m);if(x===null)continue;let y;try{y=d.createSourceFile(h,x,d.ScriptTarget.Latest,!0,d.ScriptKind.JS)}catch{continue}let I=Fl(h,y,f.container);if(I===null)continue;o.add(h),c.add(k);let v=new Map,C=new Map;for(let E of I.members){let p=i.methodFor(f.packageName,f.container,E.name,E.kind);v.set(E.name,p),C.set(p,E.id)}let M=0;for(let E of I.members){if(E.body===void 0)continue;let p=(S,A)=>{if(A&&d.isCallExpression(S)&&d.isPropertyAccessExpression(S.expression)&&S.expression.expression.kind===d.SyntaxKind.ThisKeyword){let _=v.get(S.expression.name.text);if(_!==void 0){let $=`${h}#depclass:${f.container}.${E.name}#c${String(M)}`;M+=1,s.callSites.push({id:$,enclosingFunctionId:E.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:Qe(h,S,y)}),s.callEdges.push({callSiteId:$,calleeFunctionId:_,resolution:"field-based"})}}let N=d.isFunctionExpression(S)||d.isFunctionDeclaration(S)||d.isMethodDeclaration(S)||d.isConstructorDeclaration(S)||d.isGetAccessorDeclaration(S)||d.isSetAccessorDeclaration(S)||d.isClassLike(S),O=d.isArrowFunction(S)?A:N?!1:A;d.forEachChild(S,_=>{p(_,O)})};p(E.body,!0)}for(let E of r){let p=C.get(E.calleeFunctionId);p!==void 0&&s.callEdges.push({callSiteId:E.callSiteId,calleeFunctionId:p,resolution:"field-based"})}if(s.functions.push(...I.functions),s.classes.push(I.classNode),!a.has(h)){a.add(h),s.modules.push({id:h,packageName:f.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let E=i.moduleFor(f.packageName),p=`${String(E)}#depclass${String(u)}`;u+=1,s.imports.push({id:p,moduleId:E,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),s.importEdges.push({importId:p,resolvedModuleId:h})}s.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(I.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return s}function jl(e,n,t,r){let i=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.packageName)),s=new Map(e.functions.map(o=>[o.id,o.moduleId])),l=new Map;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let c=s.get(o.enclosingFunctionId);c!==void 0&&l.set(c,(l.get(c)??0)+1)}let a=[];for(let o of e.modules){if(o.externalSurface===!0)continue;let c=n.get(o.path);if(c===void 0||t.has(o.path)||i.has(o.packageName)&&r.has(o.path)&&!o.path.split("/").includes("node_modules"))continue;let u=l.get(o.id)??0;if(u===0&&kl(c))continue;let f=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:o.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:o.id})}return a}function qr(e,n,t=[],r={}){let i=new Ft,s=Qa(e,n,i),l=new Set;for(let v of s.computedLoads.values())for(let C of v)if(C.seedable)for(let M of C.candidateRels)l.add(M);let a=new Map;for(let v of e.sourceFiles){let C=e.toRel(v.fileName);if(C===null||!l.has(C)||C.split("/").includes("node_modules"))continue;let M=Cl(C,v);M.length>0&&a.set(C,M)}let o=a.size===0?s.modules:s.modules.map(v=>a.has(v.path)&&!v.isEntrypoint?{...v,isEntrypoint:!0}:v),c={...s,modules:o},u=Pl(e,c,i,a,r),f=Sl(e,s,u.functions,u.mintSeedAliases),m=new Set(s.modules.map(v=>v.path)),h=Za(e.depReach,i,m),k=[...c.modules,...h.modules,...i.modules()],x=Kl(e,t,k,u.callEdges,i),y={modules:[...c.modules,...h.modules,...x.modules,...i.modules()],exports:[...u.exports,...f.exports],imports:[...s.imports,...h.imports,...x.imports],functions:[...u.functions,...i.functions(),...x.functions],callSites:[...u.callSites,...x.callSites],classes:[...u.classes,...i.classes(),...x.classes],callEdges:[...u.callEdges,...x.callEdges],importEdges:[...s.importEdges,...h.importEdges,...x.importEdges],exportBindings:[...u.exportBindings,...f.exportBindings],inheritEdges:[]},I=new Map;for(let v of e.sourceFiles){let C=e.toRel(v.fileName);C!==null&&I.set(C,v)}return{graph:y,diagnostics:[...f.diagnostics,...x.diagnostics,...jl(y,I,new Set(e.diagnostics.filter(v=>v.code==="dependency-body").map(v=>v.path)),s.appOwnedPaths)],...u.bindingApplicability!==void 0?{bindingApplicability:u.bindingApplicability}:{}}}var Bl=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,Qn=/^[A-Za-z0-9_$.-]{1,128}$/u;function zl(e){return Bl.test(e.calleePackage)?Qn.test(e.anchorExport)?Qn.test(e.calleeExport)?e.anchorContainer!==null&&!Qn.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!Qn.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function In(e,n){let t=[],r=[],i=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.classes.map(c=>[c.id,c.name])),l=(c,u,f)=>e.functions.some(m=>{if(m.name!==u)return!1;let h=i.get(m.moduleId);return h===void 0||h.packageName!==c?!1:(m.enclosingClassId!==void 0?s.get(m.enclosingClassId)??null:null)===f}),a=(c,u,f)=>{for(let m of e.functions){if(m.name!==u)continue;let h=i.get(m.moduleId);if(!(h===void 0||h.packageName!==c||(m.enclosingClassId!==void 0?s.get(m.enclosingClassId)??null:null)!==f))return m.id}return null},o=[...n].sort((c,u)=>c.modelId<u.modelId?-1:c.modelId>u.modelId?1:0);for(let c of o){if(c.edges.length>64){t.push(`model ${c.modelId}: ${String(c.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=c.edges.map(zl).find(h=>h!==null);if(u!==void 0){t.push(`model ${c.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let f=0,m=0;for(let h of c.edges){if(!l(c.packageName,h.anchorExport,h.anchorContainer)){m+=1;continue}r.push({modelId:c.modelId,kind:h.kind,anchor:{packageName:c.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:a(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${c.modelId}: ${String(f)} edge(s) lowered, ${String(m)} reference-gated`):t.push(`model ${c.modelId}: refused \u2014 no anchor surface in the graph (${String(m)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:r,notes:t}}}var Ul={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Wt(e){try{let n=Sr(e.appRoot,e.entrypoints),t=new Set(e.entrypoints.map(l=>l.split(Ge.sep).join("/"))),{graph:r,diagnostics:i,bindingApplicability:s}=qr(n,t,e.depClassAnchors??[],e.bindingForms??{});return{graph:r,diagnostics:[...n.diagnostics,...i],...s!==void 0?{bindingApplicability:s}:{}}}catch(n){return{graph:Ul,diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Hr(e,n){let t=512,r=(i,s)=>{if(!(t<=0||s>12)){if(t-=1,typeof i=="string"){n(i);return}if(Array.isArray(i)){for(let l of i)r(l,s+1);return}if(i!==null&&typeof i=="object")for(let[l,a]of Object.entries(i))l==="types"||l==="typings"||r(a,s+1)}};r(e,0)}function Jr(e,n,t,r=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let i;try{i=_n(Ge.resolve(e,t))}catch{return null}return i!==e&&!i.startsWith(n)||r&&!Fe(i)?null:i===e?"":i.slice(n.length).split(Ge.sep).join("/")}function Yr(e){let n=_n(e),t=n.endsWith(Ge.sep)?n:n+Ge.sep,r=new Set,i=[],s=[],l=[],a=(M,E,p=!1)=>{let S=Jr(n,t,M);return S===null||S.length===0?"unresolved":r.has(S)?"duplicate":(r.add(S),i.push(S),s.push({source:E,specifier:Me(typeof M=="string"?M:""),entrypoint:S,launch:p}),"added")},o=[],c=(M,E)=>{l.push({source:M,file:M,detail:E.detail}),o.push({code:E.code,path:M,detail:`${M} ${E.detail}`})},u,f,m,h=Wr(n,t,"package.json",Je);h.kind==="refused"&&c("package.json",h);try{let M=h.kind==="ok"?JSON.parse(h.text):{};if(a(M.main,"main"),typeof M.bin=="string")a(M.bin,"bin");else if(M.bin!==null&&typeof M.bin=="object")for(let p of Object.values(M.bin))a(p,"bin");Hr(M.exports,p=>{a(p,"exports")}),Hr(M.browser,p=>{a(p,"browser")});let E=M.scripts;if(E!==null&&typeof E=="object"){let p=E;u=p.start,f=p.prestart,m=p.poststart}}catch{}if(i.length===0)try{_n(Ge.join(n,"index.js")),a("index.js","index.js fallback")}catch{}let k=(M,E)=>typeof M=="string"&&M.trim().length>0?Xr(M,E,"package.json",a,l,!1)==="used"?"resolved":"gapped":M===void 0||typeof M=="string"?"absent":(l.push({source:E,file:"package.json",detail:`${E} is not a string; no entry file could be read from it`}),"gapped"),x=k(u,"scripts.start"),y=k(f,"scripts.prestart"),I=k(m,"scripts.poststart"),v=x==="resolved"&&y!=="gapped"&&I!=="gapped",C=Wr(n,t,"Procfile",65536);if(C.kind==="refused")c("Procfile",C);else if(C.kind==="ok"){let{entries:M,truncated:E,unnamedLines:p}=Dt(C.text);E&&l.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),p>0&&l.push({source:"Procfile",file:"Procfile",detail:`${String(p)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let S of M)Xr(S.command,`Procfile:${S.name}`,"Procfile",a,l,v)}return{entrypoints:i,sources:s,gaps:l,diagnostics:o}}function Wr(e,n,t,r){let i;try{i=_n(Ge.join(e,t))}catch{return{kind:"absent"}}if(!i.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=un(i,r);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(r)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Xr(e,n,t,r,i,s){let l=Tt(e);return l.kind==="delegates"?s?"used":(i.push({source:n,file:t,detail:`\`${Me(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped"):l.kind==="unparsed"?(i.push({source:n,file:t,detail:`\`${Me(e)}\`: ${l.reason}`}),"gapped"):r(l.specifier,n,!0)==="unresolved"?(i.push({source:n,file:t,detail:`\`${Me(l.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function Xt(e,n){if(n.length===0||!e.some(r=>r.launch))return[];let t=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${t}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Qr(e,n){let t=_n(e),r=t.endsWith(Ge.sep)?t:t+Ge.sep,i=new Set,s=[],l=[];for(let a of n){let o=Jr(t,r,a,!0);if(o===null||o.length===0){l.push(a);continue}i.has(o)||(i.add(o),s.push(o))}return{entrypoints:s,rejected:l}}import{readdirSync as ls,readFileSync as Zt,realpathSync as ei,statSync as Mn}from"node:fs";import Le from"node:path";function Vl(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let r=t+2;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;let i=e.charCodeAt(r);return i===38||i===42}function An(e,n,t){let r=n.maxLines??2e6,i=n.maxLineBytes??16384,s=!1,l=!1,a=0,o=0,c=e.charCodeAt(0)===65279?1:0;for(;c<=e.length;){let u=e.indexOf(`
-`,c),f=u===-1;f&&(u=e.length);let m=u>c&&e.charCodeAt(u-1)===13?u-1:u;if(o+=1,o>r){s=!0;break}if(m-c>i)a+=1;else{let h=c;for(;h<m&&e.charCodeAt(h)===32;)h+=1;let k=h-c,x=m;for(;x>h&&(e.charCodeAt(x-1)===32||e.charCodeAt(x-1)===9);)x-=1;if(h<x&&e.charCodeAt(h)!==35){let y=e.slice(h,x);if(Vl(y)){l=!0;break}t(k,y)}}if(f)break;c=u+1}return{truncated:s||a>0,refusedAnchors:l,oversizeLines:a}}function Zn(e){let n=e.charCodeAt(0);if(n===34||n===39){let r=e.indexOf(String.fromCharCode(n),1);if(r===-1)return null;let i=r+1;for(;i<e.length&&e.charCodeAt(i)===32;)i+=1;return e.charCodeAt(i)===58?e.slice(0,r+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function hn(e){return e.endsWith(":")}function $e(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function et(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,r=t.indexOf("/");if(n){if(r<=0||t.indexOf("/",r+1)!==-1)return!1}else if(r!==-1)return!1;let i=n?[t.slice(0,r),t.slice(r+1)]:[t];for(let s of i){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let l=0;l<s.length;l+=1){let a=s.charCodeAt(l);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function Nn(e){return et(e)?`node_modules/${e}`:""}function Cn(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Zr=2e5,es=64,ql=1024,Hl=5,Wl=[1,2,3];function Xl(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let r=e.slice(t+n.length);if(r==="")return null;let i=r.split("/");return i[0]?.startsWith("@")?i.length>=2?`${i[0]}/${i[1]}`:null:i[0]??null}function ns(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let r=t.indexOf("@",1);if(r>0){let i=t.slice(0,r),s=t.slice(r+1);if(i.length>0&&s.length>0)return[{name:i,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function gn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function ts(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function is(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function rs(e,n,t,r,i=!1){let s=JSON.stringify([n,t,r]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:r,dev:i})}}function Gl(e,n){for(let[t,r]of Object.entries(e)){if(t==="")continue;if(!is(n))return;let i=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=gn(r);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let l=s.name,a=typeof l=="string"&&l!==""?l:Xl(t),o=s.version;if(a===null||typeof o!="string"){i&&(n.unread+=1);continue}let c=s.dev===!0||s.devOptional===!0;for(let u of ns(a,o))rs(n,u.name,u.version,t,c)}}function ss(e,n,t){let r=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],i=!1;for(let s=0;s<r.length;s+=1){let l=r[s];if(l===void 0)break;for(let[a,o]of Object.entries(l.deps)){if(!is(n))return{depthCapped:i};if(a===""){n.unread+=1;continue}let c=gn(o);if(c===null){n.unread+=1;continue}let u=l.pathSafe&&et(a),f=u?`${l.prefix}node_modules/${a}`:"",m=u&&f.length<=ql,h=m?f:"",k=c.version,x=c.dev===!0||l.dev;if(c.link!==!0&&typeof k=="string"&&k!=="")for(let I of ns(a,k))rs(n,I.name,I.version,h,x);else n.unread+=1;let y=gn(c.dependencies);if(y!==null){if(l.depth+1>t){i=!0;continue}r.push({deps:y,prefix:m?`${h}/`:l.prefix,depth:l.depth+1,pathSafe:m,dev:x})}}}return{depthCapped:i}}function Jl(e,n,t){let r=ts(n.maxEntries),{depthCapped:i}=ss(e,r,t),s=[],l=new Set(n.deps.map(c=>JSON.stringify([c.name,c.version]))),a=new Set,o=[];for(let c of r.deps){if(c.version.includes(":"))continue;let u=JSON.stringify([c.name,c.version]);l.has(u)||a.has(u)||(a.add(u),o.length<Hl&&o.push(Cn(c.name,c.version)))}if(a.size>0){let c=a.size-o.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${o.join(", ")}${c>0?`, and ${String(c)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(r.capped||i)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function nt(e,n={}){let t=[],r;try{r=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let i=gn(r);if(i===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=i.lockfileVersion,l=typeof s=="number"&&Number.isInteger(s)?s:null,a=typeof s=="number"?String(s):"?",o=gn(i.packages),c=gn(i.dependencies);if(o===null&&c===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(l===null||!Wl.includes(l))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??es,f=ts(n.maxEntries??Zr),m=!1;return o!==null?(Gl(o,f),c!==null&&t.push(...Jl(c,f,u))):c!==null&&(m=ss(c,f,u).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),m&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||m}}var Yl=["workspace:","link:","portal:","file:","exec:"];function Ql(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Zl(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let r=n.slice(0,t),i=n.slice(t+1);if(r.length===0)return[];for(let a of Yl)if(i.startsWith(a))return[];if(!i.startsWith("npm:"))return[r];let s=i.slice(4),l=s.indexOf("@",1);if(l>0){let a=s.slice(0,l);return a.length>0?[a]:[r]}return s.length===0||Ql(s)?[r]:[r,s]}function ed(e){if(hn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let r=e.charCodeAt(t);if(r===34||r===39){n===0?n=r:n===r&&(n=0);continue}if(n===0&&r===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function nd(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let r of n.split(",")){let i=r.trim();i.length>0&&t.push(i)}return t}function td(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let r=t.length;for(;r<n.length&&r<t.length+3;){let s=n.charCodeAt(r);if(s<48||s>57)break;r+=1}let i=n.slice(t.length,r);return i.length>0?i:null}function os(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=$e(e.slice(8).trim());return t.length>0?t:null}function Gt(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,l=!1,a=null,o=!1,c=[],u=!1,f=-1,m=!1,h=0,k=()=>{c.length>0&&!u&&(h+=1)},x=An(e,n,(C,M)=>{if(C===0){k(),c=[],u=!1,f=-1,o=!1;let p=ed(M);if(p===null)return;let S=$e(p.trim());if(S==="__metadata"){l=!0,o=hn(M);return}for(let A of nd(S))c.push(...Zl(A));return}if(o){if(C===2&&a===null){let p=os(M);p!==null&&(a=p)}return}if(c.length===0||(f===-1&&(f=C),C!==f||u))return;let E=os(M);if(E!==null){u=!0;for(let p of c){let S=JSON.stringify([p,E]);if(!i.has(S)){if(r.length>=s){m=!0;return}i.add(S),r.push({name:p,version:E,lockKey:Nn(p),dev:!1})}}}});k();let y=l?"yarn.lock (Berry)":"yarn.lock (v1)";if(x.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};x.oversizeLines>0&&t.push(`${y} has ${String(x.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),m&&t.push(`${y} exceeds ${String(s)} entries; truncated`);let I=a??td(e),v=I===null?null:Number(I.split(".")[0]);return I!==null&&(v===null||!Number.isInteger(v)||v<1||v>8)&&t.push(`${y} declares unsupported lockfileVersion ${I} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${y} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:r,diagnostics:t,truncated:x.truncated||m}}function Jt(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.indexOf("_");return r!==-1&&(n=n.slice(0,r)),n.trim()}function Yt(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function as(e){let n=$e(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.charCodeAt(0)===47;if(r&&(n=n.slice(1)),n.length===0)return null;if(!r&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),f=n.indexOf("@",1);u>0&&(f===-1||u<f)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let i=n.charCodeAt(0)===64,s=i?n.indexOf("/"):-1;if(i&&s<=0)return null;let l=i?s+1:0,a=-1;for(let u=l;u<n.length;u+=1){let f=n.charCodeAt(u);if(f===47||f===64){a=u;break}}if(a<=l)return null;let o=n.slice(0,a),c=Jt(n.slice(a+1));return Yt(c)?{name:o,version:c}:null}var id=new Set(["packages","snapshots","importers"]),rd=new Set([5,6,7,8,9]);function sd(e){let n=$e(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function it(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:$e(e.slice(0,n).trim()),value:$e(t)}}function Qt(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,l="",a=null,o=!1,c=0,u=[],f=(h,k)=>{let x=JSON.stringify([h,k]);if(!i.has(x)){if(r.length>=s){o=!0;return}i.add(x),r.push({name:h,version:k,lockKey:Nn(h),dev:!1})}},m=An(e,n,(h,k)=>{if(h===0){let x=Zn(k);if(l=x===null?"":$e(x.trim()),a=null,l==="lockfileVersion"){let y=it(k),I=y===null?null:sd(y.value);y!==null&&(I===null||!rd.has(I))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),l="";return}if(id.has(l)&&!hn(k)){let y=it(k)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(c+=1),l=""}return}if(l==="packages"||l==="snapshots"){if(h!==2)return;let x=Zn(k),y=x===null?null:as(x);if(y===null){c+=1;return}f(y.name,y.version);return}if(l==="importers"){if(h===6){let x=it(k);if(x===null){a=k.endsWith(":")?$e(k.slice(0,-1).trim()):null;return}a=null;let y=Jt(x.value);Yt(y)&&f(x.key,y);return}if(h===8&&a!==null){let x=it(k);if(x===null||x.key!=="version")return;let y=Jt(x.value);Yt(y)&&f(a,y)}}});return m.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),m.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(m.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),o&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),c>0&&t.push(`pnpm-lock.yaml has ${String(c)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:r,diagnostics:t,truncated:m.truncated||o})}var od=128*1024*1024,ad=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>nt(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>nt(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Gt(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Qt(e,n===void 0?{}:{maxEntries:n})}],ld=[".pnp.cjs",".pnp.data.json",".pnp.js"];function ni(e,n){let t;try{t=ei(Le.join(e,n))}catch{return null}let r=e.endsWith(Le.sep)?e:e+Le.sep;return t.startsWith(r)?t:null}function ds(e,n){let t=Le.join(e,"package.json"),r;try{r=ei(t)}catch{return null}if(!r.startsWith(n+Le.sep))return null;try{if(!Mn(r).isFile())return null;let i=JSON.parse(Zt(r,"utf8"));return typeof i.name!="string"||typeof i.version!="string"?null:{name:i.name,version:i.version}}catch{return null}}function cs(e,n){try{return Mn(Le.join(e,n)),!0}catch{return!1}}function dd(e,n){if(cs(e,"pnpm-workspace.yaml"))return!0;let t=ni(e,"package.json");if(t===null)return cs(e,"package.json");let r;try{let l=Mn(t);if(!l.isFile()||l.size>n)return!0;r=Zt(t,"utf8")}catch{return!0}let i;try{i=JSON.parse(r)}catch{return!0}for(let l of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=i[l];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let s=i.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function us(e,n){let t=Le.join(e,"node_modules"),r=[],i;try{i=ls(t,{withFileTypes:!0})}catch{return r}for(let s of i){let l=s.name;if(l.startsWith("."))continue;if(l.startsWith("@")){let o;try{o=ls(Le.join(t,l),{withFileTypes:!0})}catch{continue}for(let c of o){let u=ds(Le.join(t,l,c.name),n);u!==null&&r.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${l}/${c.name}`,linked:c.isSymbolicLink()||s.isSymbolicLink()})}continue}let a=ds(Le.join(t,l),n);a!==null&&r.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${l}`,linked:s.isSymbolicLink()})}return r}var cd=5;function ud(e,n,t){let r=ni(e,n);if(r===null){try{Mn(Le.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let i;try{i=Mn(r)}catch{return null}if(!i.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(i.size>t)return{gap:`${n} is ${String(i.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:Zt(r,"utf8")}}catch{return{gap:`${n} could not be read`}}}function fs(e,n){let t=ei(e),r=[],i=[],s=n?.maxLockfileBytes??od,l=[],a=new Set,o=[],c=dd(t,s),u=null,f=!1,m=(k,x,y)=>{i.push({kind:k,detail:x,blindsAnalysis:y}),r.push(x)};for(let k of ad){let x=ud(t,k.file,s);if(x===null)continue;if("gap"in x){m("lockfile-unreadable",x.gap,!1);continue}let y=k.parse(x.text,n?.maxLockfileEntries);if(y.truncated&&(f=!0),y.deps.length===0){if(y.diagnostics.length>0||c){let I=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";m("lockfile-unparsed",`${k.file} yielded NO dependencies (${I}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&m("lockfile-partial",`${k.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),u===null&&(u=k.file),o.includes(k.source)||o.push(k.source);for(let I of y.deps){let v=JSON.stringify([I.name,I.version,I.lockKey]);a.has(v)||(a.add(v),l.push(I))}}for(let k of ld)if(ni(t,k)!==null){m("yarn-pnp",`${k} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(l.length>0){let k=o.length===1?o[0]??"none":"multi-lockfile";o.length>1&&r.push(`multiple lockfiles present (${o.join(", ")}); enumerated the UNION of all of them`);let x=new Set(l.map(v=>JSON.stringify([v.name,v.version]))),y=new Set,I=[];for(let v of us(t,t)){let C=JSON.stringify([v.name,v.version,v.lockKey]);a.has(C)||(a.add(C),l.push({name:v.name,version:v.version,lockKey:v.lockKey,dev:v.dev}));let M=JSON.stringify([v.name,v.version]);v.linked||x.has(M)||y.has(M)||(y.add(M),I.length<cd&&I.push(Cn(v.name,v.version)))}if(y.size>0){let v=y.size-I.length;m("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${I.join(", ")}${v>0?`, and ${String(v)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:l,source:k,lockfilePath:u,diagnostics:r,truncated:f,gaps:i}}let h=us(t,t);return h.length>0?(m("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(k=>({name:k.name,version:k.version,lockKey:k.lockKey,dev:!1})),source:"node-modules",lockfilePath:null,diagnostics:r,truncated:f,gaps:i}):(c&&m("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:r,truncated:f,gaps:i})}import{readdirSync as fd,readFileSync as pd}from"node:fs";import md from"node:path";var hd=new Set(["summarized","crashed","over-cap"]),gd=new Set(["function","method","ctor"]);function de(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function ti(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function yd(e,n){ti(e)||de(n,"edge is not an object");let{entryPath:t,entryExport:r,entryContainer:i,hops:s}=e;(typeof t!="string"||typeof r!="string")&&de(n,"edge entry fields must be strings"),i!==null&&typeof i!="string"&&de(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&de(n,"hops must be a non-negative integer");let l=e.target;if(ti(l)||de(n,"edge target missing"),l.kind==="symbol"){let{exportName:a,container:o,symbolKind:c}=l;return typeof a!="string"&&de(n,"symbol target exportName"),o!==null&&typeof o!="string"&&de(n,"symbol target container"),(typeof c!="string"||!gd.has(c))&&de(n,`symbol target kind ${JSON.stringify(c)}`),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"symbol",exportName:a,container:o,symbolKind:c},hops:s}}if(l.kind==="dep"){let{calleePackage:a,calleeSubpath:o,calleeExport:c}=l;return(typeof a!="string"||a.length===0)&&de(n,"dep target calleePackage"),o!==null&&typeof o!="string"&&de(n,"dep target calleeSubpath"),(typeof c!="string"||c.length===0)&&de(n,"dep target calleeExport"),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"dep",calleePackage:a,calleeSubpath:o,calleeExport:c},hops:s}}de(n,`unknown target kind ${JSON.stringify(l.kind)}`)}function xd(e,n){ti(e)||de(n,"root is not an object");let{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:l,status:a}=e;(typeof t!="string"||t.length===0)&&de(n,"packageName"),typeof r!="string"&&de(n,"analyzedVersion"),i!=="jelly"&&de(n,`tool ${JSON.stringify(i)} (only 'jelly' exists)`),typeof s!="string"&&de(n,"toolVersion"),typeof l!="number"&&de(n,"maxIndirections"),(typeof a!="string"||!hd.has(a))&&de(n,`status ${JSON.stringify(a)} not in the enum`);let o=e.edges;return Array.isArray(o)||de(n,"edges is not an array"),a!=="summarized"&&o.length>0&&de(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:l,status:a,edges:o.map(c=>yd(c,n))}}function ps(e){let n=new Map,t=fd(e).filter(r=>r.endsWith(".summary.json"));for(let r of t){let i=md.join(e,r),s;try{s=JSON.parse(pd(i,"utf8"))}catch(o){de(r,`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}let l=xd(s,r),a=n.get(l.packageName);a===void 0?n.set(l.packageName,[l]):a.push(l)}return n}import{readFileSync as Sd,statSync as bd}from"node:fs";var ri=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,rt=/^[A-Za-z0-9_$.-]{1,128}$/u,ms=64,hs=1024*1024,gs=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,ys=/^[A-Za-z0-9@_.-]{1,128}$/u;function ce(e){throw new Error(`model claims rejected: ${e}`)}function ii(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function kd(e,n){ii(e)||ce(`${n}: edge is not an object`);let{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:l,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&ce(`${n}: edge kind`),(typeof r!="string"||!rt.test(r))&&ce(`${n}: anchorExport ${JSON.stringify(r)}`),i!==null&&(typeof i!="string"||!rt.test(i))&&ce(`${n}: anchorContainer`),(typeof s!="string"||!ri.test(s))&&ce(`${n}: calleePackage ${JSON.stringify(s)}`),l!==null&&(typeof l!="string"||!rt.test(l))&&ce(`${n}: calleeContainer`),(typeof a!="string"||!rt.test(a))&&ce(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:l,calleeExport:a}}function xs(e){let n=bd(e).size;n>hs&&ce(`file is ${String(n)} bytes, over the ${String(hs)} cap`);let t;try{t=JSON.parse(Sd(e,"utf8"))}catch(i){ce(`unparseable JSON: ${i instanceof Error?i.message:String(i)}`)}Array.isArray(t)||ce("root is not an array"),t.length>ms&&ce(`${String(t.length)} claims over cap ${String(ms)}`);let r=[];for(let i of t){ii(i)||ce("claim is not an object");let{packageName:s,modelId:l,range:a,edges:o}=i;(typeof s!="string"||!ri.test(s))&&ce("packageName"),(typeof l!="string"||!ys.test(l))&&ce("modelId (identifier charset, 1-128 chars)"),r.some(u=>u.model.modelId===l)&&ce(`duplicate modelId ${l} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!ii(a)||typeof a.introduced!="string")&&ce(`${l}: range`),gs.test(a.introduced)||ce(`${l}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let c=a.fixedBefore;c!==null&&typeof c!="string"&&ce(`${l}: fixedBefore`),typeof c=="string"&&!gs.test(c)&&ce(`${l}: range.fixedBefore ${JSON.stringify(c)} is not an exact x.y.z triple`),Array.isArray(o)||ce(`${l}: edges`),o.length>64&&ce(`${l}: ${String(o.length)} edges over cap ${String(64)}`),r.push({model:{packageName:s,modelId:l,edges:o.map(u=>kd(u,l))},introduced:a.introduced,fixedBefore:c})}return r}var Ed=["in-app-purchase@1-v1"];function si(e,n,t){let r=[],i=[],s=[],l=(a,o,c,u)=>{i.push(c),s.push({modelId:u??a.model.modelId,status:o,reason:c,edgeCount:a.model.edges.length})};for(let a of e){if(!ri.test(a.model.packageName)||!ys.test(a.model.modelId)){l(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Ed.includes(a.model.modelId)){l(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){l(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let o=n(a.model.packageName);if(o===void 0){l(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let c;try{c=en(o,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{l(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${o} not an exact triple \u2014 inert (never guessed)`);continue}if(!c){l(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${o} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}r.push(a.model),s.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:r,notes:i,dispositions:s}}var vd=4,Id={additiveForms:!0,namelessExports:!0},_d=new Set(["dep-opaque","dynamic-load","dispatch"]),Ad={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function li(e,n,t){return e.tier==="unknown"&&Ad[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&_d.has(e.unknownKind)&&n!==null&&n.verified}var Nd=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),Pe=class extends Error{},di="cupel/coverage-gap",Cd={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function st(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function vs(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Is(e,n,t){let r=new Map(e.modules.map(l=>[l.path,l.id])),i=e.modules[0]?.id;if(i===void 0)return[];let s=n.map(l=>({source:r.get(l.path)??i,cause:Cd[l.code],reach:l.classScope!==void 0?{kind:"class-scope",packageName:l.classScope.packageName,container:l.classScope.container}:l.anchor!==void 0?{kind:"via-module",anchor:l.anchor}:{kind:"unbounded"}}));return t&&s.push({source:i,reach:{kind:"unbounded"},cause:"resolution-divergence"}),s}function oi(e,n,t,r,i){let s=t.filter(l=>l.exportName!==null&&(r===1||i||l.verified!==1));return s.length>0?s.map(l=>({advisoryId:e,packageName:n,exportName:l.exportName??"",container:l.container,symbolKind:l.symbolKind,sourcePath:l.sourcePath??"",derivation:l.derivation,confidence:l.confidence,verified:l.verified===1})):t.length===0||t.every(l=>l.exportName!==null&&l.verified===1)?[null]:[]}function ai(e,n,t,r,i,s,l){let a=St({graph:e,installed:t,range:r,symbol:i,coverage:null,incompleteness:s,analysisAborted:l});if(n!==null&&i!==null&&li(a,i,"base")){let o=Sn(e,n.modulesById,n.reachMods,i,n.records);if(o!==null)return{finding:a,hit:o}}return{finding:a,hit:null}}function Md(e,n){let t=new Set,r=[];for(let i of e.packages)for(let{advisory:s,affected:l}of n.advisoriesForPackage("npm",i.name)){let a=st(s.id,i.name,l),o;try{o=en(i.version,a)}catch{continue}if(o)for(let c of n.symbolsForAffected(l.id)){if(c.verified!==1||c.symbolKind!=="method"&&c.symbolKind!=="ctor"||c.container===null||c.sourcePath===null)continue;let u=`${i.lockKey}\0${c.container}\0${c.sourcePath}`;t.has(u)||(t.add(u),r.push({packageName:i.name,packageRootRel:i.lockKey,container:c.container,sourcePath:c.sourcePath}))}}return r.sort((i,s)=>`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),r.slice(0,Gn)}function Od(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),i=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),l=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let o=s.get(a.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let m=n.get(f.moduleId);m!==void 0&&m.packageName!==u.packageName&&l.push({packageName:m.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:c.id})}return l}function $d(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),r=new Map(e.functions.map(u=>[u.id,u])),i=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&i.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let f=s.get(u.exportId);if(f===void 0||!n.has(f.moduleId))continue;let m=r.get(u.target.functionId);m===void 0||t.get(m.moduleId)?.externalSurface===!0||i.add(m.id)}let l=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),a=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let f=l.get(u.callSiteId);if(f===void 0)continue;let m=a.get(f);m===void 0?a.set(f,[u.calleeFunctionId]):m.push(u.calleeFunctionId)}let o=new Set(i),c=[...i];for(;c.length>0;){let u=c.pop();if(u!==void 0)for(let f of a.get(u)??[])o.has(f)||(o.add(f),c.push(f))}return o}function Ld(e,n,t,r){for(let i of n){if(i.modelId!==e.modelId||i.anchor.packageName!==e.anchorPackage||i.anchor.exportName!==e.entryExport)continue;let s=t.filter(a=>a.packageName===i.anchor.packageName&&a.exportName===i.anchor.exportName&&a.container===i.anchor.container),l=s.find(a=>a.resolution==="resolved")??s[0];if(l!==void 0)return r.has(l.callerFunctionId)}return null}function Pd(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let r=new Set(t),i=s=>r.has(s)||r.has(Ie[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&i(s.unknownKind)||s.modelPromotedFromKind!==void 0&&i(s.modelPromotedFromKind))}function ci(e){let n=wd(e.dir),t=e.reader??Et(e.shardPath),r=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(tn))throw new Pe(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${tn})`);let i=null;if(e.summaryShadow!==void 0)try{i=ps(e.summaryShadow)}catch(P){throw new Pe(`--summary-shadow facts dir rejected: ${P instanceof Error?P.message:String(P)}`)}let s=null;if(e.modelShadow!==void 0)try{s=xs(e.modelShadow.claimsPath)}catch(P){throw new Pe(`--model-shadow claims rejected: ${P instanceof Error?P.message:String(P)}`)}let l=fs(n);if(l.truncated)throw new Pe(`the dependency enumeration hit a hard cap and is incomplete (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`);let a=e.entry??[],o=a.length>0?Qr(n,a):{entrypoints:[],rejected:[]},c=o.rejected,u=Yr(n),f=[...new Set([...u.entrypoints,...o.entrypoints])],m=[...u.sources];for(let P of o.entrypoints)u.entrypoints.includes(P)||m.push({source:"--entry",specifier:P,entrypoint:P,launch:!1});let h=Md(l,t),k=e.bindingForms??Id,x=Wt({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:k}),y=x.graph,I=[...u.diagnostics,...Xt(u.sources,u.gaps),...x.diagnostics],v=vs(f.length,y),C=l.gaps.some(P=>P.blindsAnalysis),M=Is(y,I,C),E=t.allModels?.()??[],p=si(E.map(P=>({model:{packageName:P.packageName,modelId:P.modelId,edges:P.edges},introduced:P.introduced,fixedBefore:P.fixedBefore})),P=>l.packages.find(q=>q.name===P)?.version),S=p.models.length>0?In(y,p.models).delta:null,A=S!==null?{records:S.records,reachMods:nn(y),modulesById:new Map(y.modules.map(P=>[P.id,P]))}:null,N=[],O=Nd(),_=[],$=[];for(let P of l.packages)for(let{advisory:q,affected:oe}of t.advisoriesForPackage("npm",P.name)){let G=st(q.id,P.name,oe),ae=q.cveId??q.id,J=t.symbolsForAffected(oe.id),Ne=J.filter(Q=>Q.exportName===null),Ee=oi(q.id,P.name,J,oe.surfaceComplete,r);for(let Q of Ee){let{finding:Ce,hit:ye}=ai(y,A,{name:P.name,version:P.version},G,Q,M,v),ve=Ce,Re,b;ye!==null&&Q!==null&&(Re=ye.modelId,b=Ce.unknownKind,ve={tier:ye.tier,decidedAtStage:Ce.decidedAtStage,reason:`boundary model ${ye.modelId}: ${ye.anchorPackage}.${ye.entryExport} reaches ${Q.exportName} [${ye.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Tn(Q),path:void 0,unresolvedSites:Ce.unresolvedSites}),O[ve.tier]+=1;let w={...ve,modelId:Re,modelPromotedFromKind:b,surfaceComplete:G.surfaceComplete,advisoryId:q.id,displayId:ae,packageName:P.name,version:P.version,symbolName:Q?.exportName??null,symbolPath:Q?.sourcePath||null,severity:q.severity,packageLocation:l.lockfilePath};N.push(w);let L=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&w.tier==="unknown"&&w.decidedAtStage==="symbol-reachable"&&w.unknownKind!==void 0&&L.has(w.unknownKind)&&Q!==null&&_.push({finding:w,symbol:Q}),s!==null&&w.tier==="unknown"&&Q!==null&&$.push({finding:w,symbol:Q})}for(let Q of Ne)O.unknown+=1,N.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:G.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${ae} carries a ${Q.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,path:void 0,unresolvedSites:[],advisoryId:q.id,displayId:ae,packageName:P.name,version:P.version,symbolName:null,symbolPath:null,severity:q.severity,packageLocation:l.lockfilePath})}for(let P of l.gaps)O.unknown+=1,N.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:P.detail,attribution:void 0,path:void 0,unresolvedSites:[],advisoryId:di,displayId:di,packageName:P.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:l.lockfilePath});let R=O["reachable-high"]+O["reachable-medium"],j=e.failOnReachable===!0&&R>0,V=Pd(N,O.unknown,e.failOnUnknown),te=j||V?2:0,se;if(i!==null){let P=nn(y),q=new Map(y.modules.map(G=>[G.id,G])),oe=[];for(let{finding:G,symbol:ae}of _){let J=xt(y,q,P,ae,i,vd);oe.push({advisoryId:G.advisoryId,packageName:G.packageName,symbolName:G.symbolName,unknownKind:G.unknownKind??null,wouldPromote:J!==null,...J!==null?{anchorPackage:J.anchorPackage,entryExport:J.entryExport,viaPackages:J.viaPackages,totalHops:J.totalHops}:{}})}se={records:oe}}let X;if(s!==null&&e.modelShadow!==void 0){let P=e.modelShadow.widened===!0?"widened":"base",q=new Map(l.packages.map(T=>[T.name,T.version])),{models:oe,notes:G,dispositions:ae}=si(s,T=>q.get(T),{shadowConsultDenylisted:!0}),{delta:J}=In(y,oe),Ne=nn(y),Ee=new Map(y.modules.map(T=>[T.id,T])),Q=Od(y,Ee,Ne),Ce=$d(y),ye=J.records.some(T=>Q.some(U=>U.packageName===T.anchor.packageName&&U.exportName===T.anchor.exportName&&U.container===T.anchor.container)),ve=[],Re=Date.now();for(let{finding:T,symbol:U}of $){let re=J.records,ie=li(T,U,P),W=ie?Sn(y,Ee,Ne,U,re):null,xe=J.records.filter(ue=>ue.callee.packageName===U.packageName&&ue.callee.exportName===U.exportName&&ue.callee.container===U.container||ue.callee.packageName===U.packageName&&ue.callee.realFunctionId!==null);ve.push({advisoryId:T.advisoryId,packageName:T.packageName,symbolName:T.symbolName,unknownKind:T.unknownKind??null,decidedAtStage:T.decidedAtStage,consultSurface:P,noHitReason:W!==null?null:ie?ye?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:W!==null?Ld(W,re,Q,Ce):null,verdictBefore:T.tier,verdictAfter:W!==null?"reachable-low":T.tier,wouldPromote:W!==null,...W!==null?{modelId:W.modelId,anchorPackage:W.anchorPackage,entryExport:W.entryExport,pathLabels:W.pathLabels,calleeBinding:xe.find(ue=>ue.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:ie?xe.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${xe[0]?.anchor.packageName??"?"}#${xe[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let b=Date.now()-Re,w=ae.map(T=>{if(T.status!=="active")return{modelId:T.modelId,state:T.status,reason:T.reason,edgesLowered:0,edgesReferenceGated:0};let U=J.records.filter(ie=>ie.modelId===T.modelId).length;if(U>0)return{modelId:T.modelId,state:"lowered",reason:null,edgesLowered:U,edgesReferenceGated:T.edgeCount-U};let re=J.notes.find(ie=>ie.startsWith(`model ${T.modelId}:`)||ie.startsWith(`model-edge ${T.modelId}:`));return{modelId:T.modelId,state:"refused",reason:re??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:T.edgeCount}}),L=ve.filter(T=>T.wouldPromote).length,F=O.unknown-L,H=O["reachable-high"]+O["reachable-medium"],le=T=>({none:0,"fail-on-reachable":H>0?2:0,"fail-on-unknown":T>0?2:0,both:H>0||T>0?2:0});X={records:ve,notes:[...G,...J.notes],laneStates:w,exitCodes:{baseline:le(O.unknown),withModels:le(F)},overlayWallMs:b},bs(ws.dirname(e.modelShadow.outPath),{recursive:!0});let B=`${e.modelShadow.outPath}.tmp-${Ss(8).toString("hex")}`;Es(B,`${JSON.stringify(X,null,2)}
-`,{encoding:"utf8",flag:"wx"}),ks(B,e.modelShadow.outPath)}let Y;if(e.bindingShadow!==void 0){let P=Date.now(),q=B=>p.models.length>0?{records:In(B,p.models).delta.records,reachMods:nn(B),modulesById:new Map(B.modules.map(T=>[T.id,T]))}:null,oe=(B,T,U,re)=>{let ie=[];for(let W of l.packages)for(let{advisory:xe,affected:ue}of t.advisoriesForPackage("npm",W.name)){let Ve=st(xe.id,W.name,ue),so=oi(xe.id,W.name,t.symbolsForAffected(ue.id),ue.surfaceComplete,r);for(let Ei of so){let{finding:wi,hit:gt}=ai(B,re,{name:W.name,version:W.version},Ve,Ei,T,U);ie.push({advisoryId:xe.id,packageName:W.name,symbolName:Ei?.exportName??null,tier:gt!==null?gt.tier:wi.tier,unknownKind:gt!==null?null:wi.unknownKind??null})}}return ie},G=B=>{let T=Wt({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:B}),U=[...u.diagnostics,...Xt(u.sources,u.gaps),...T.diagnostics];return{graph:T.graph,inc:Is(T.graph,U,C),aborted:vs(f.length,T.graph),live:q(T.graph),applicability:T.bindingApplicability}},ae=B=>{let T=G(B);return oe(T.graph,T.inc,T.aborted,T.live)},J=G({}),Ne=oe(J.graph,J.inc,J.aborted,J.live),Ee=oe(y,M,v,A);if(Ee.length!==Ne.length)throw new Pe("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let Q=(B,T)=>T.tier!==B.tier||T.unknownKind!==B.unknownKind,Ce=Ne.some((B,T)=>{let U=Ee[T];return U!==void 0&&Q(B,U)}),ye=Ce?ae({additiveForms:!0}):null,ve=Ce?ae({namelessExports:!0}):null,Re=0,b=Ne.map((B,T)=>{let U=Ee[T];if(U===void 0||U.advisoryId!==B.advisoryId||U.packageName!==B.packageName||U.symbolName!==B.symbolName)throw new Pe("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let re={advisoryId:B.advisoryId,packageName:B.packageName,symbolName:B.symbolName,unknownKind:B.unknownKind,verdictBefore:B.tier,verdictAfter:U.tier,wouldPromote:U.tier!==B.tier&&(U.tier==="reachable-high"||U.tier==="reachable-medium"||U.tier==="reachable-low")};if(!Q(B,U)||ye===null||ve===null)return re;Re+=1;let ie=ye[T],W=ve[T],xe=ie!==void 0&&Q(B,ie),ue=W!==void 0&&Q(B,W);return{...re,attributedArm:xe&&!ue?"additiveForms":ue&&!xe?"namelessExports":"both",...ie!==void 0?{verdictArmA:ie.tier}:{},...W!==void 0?{verdictArmB:W.tier}:{}}}),w={...O};Ne.forEach((B,T)=>{let U=Ee[T];U!==void 0&&U.tier!==B.tier&&(w[U.tier]-=1,w[B.tier]+=1)});let L=(B,T)=>({none:0,"fail-on-reachable":B>0?2:0,"fail-on-unknown":T>0?2:0,both:B>0||T>0?2:0}),F;if(p.models.length>0&&A!==null){F=[];for(let B of l.packages)for(let{advisory:T,affected:U}of t.advisoriesForPackage("npm",B.name)){let re=st(T.id,B.name,U),ie=oi(T.id,B.name,t.symbolsForAffected(U.id),U.surfaceComplete,r);for(let W of ie){if(W===null||!W.verified)continue;let xe=ai(J.graph,J.live,{name:B.name,version:B.version},re,W,J.inc,J.aborted);if(!(xe.hit===null&&li(xe.finding,W,"base")))continue;let Ve=Sn(y,A.modulesById,A.reachMods,W,A.records);F.push({advisoryId:T.id,packageName:B.name,symbolName:W.exportName,modelWouldPromote:Ve!==null,...Ve!==null?{modelId:Ve.modelId}:{},anchorCleared:Ve!==null})}}}let H=N.some(B=>B.modelId!==void 0);Y={records:b,deltas:Re,exitCodes:{baseline:L(w["reachable-high"]+w["reachable-medium"],w.unknown+(H?1:0)),withBindingForms:L(O["reachable-high"]+O["reachable-medium"],O.unknown+(H?1:0))},dualRunWallMs:Date.now()-P,...x.bindingApplicability!==void 0?{applicability:x.bindingApplicability}:{},...F!==void 0?{modelProbe:F}:{}},bs(ws.dirname(e.bindingShadow.outPath),{recursive:!0});let le=`${e.bindingShadow.outPath}.tmp-${Ss(8).toString("hex")}`;Es(le,`${JSON.stringify(Y,null,2)}
-`,{encoding:"utf8",flag:"wx"}),ks(le,e.bindingShadow.outPath)}let z=E.length>0||p.notes.length>0?{active:p.models.length,stored:E.length,promoted:N.filter(P=>P.modelId!==void 0).length,notes:[...p.notes,...S!==null?S.notes:[]]}:void 0;return{...se!==void 0?{summaryShadow:se}:{},...X!==void 0?{modelShadow:X}:{},...Y!==void 0?{bindingShadow:Y}:{},...z!==void 0?{modelLane:z}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:N,counts:O,analyzerDiagnostics:I,analysisAborted:v,rejectedEntries:c,entrypointSources:m,entrypointGaps:u.gaps,exitCode:te}}finally{e.reader===void 0&&t.close()}}var Rd="cupel",Td="reachability-first SCA \u2014 verdict + call path + confidence";function ui(e){return[`${Rd} v${e} \u2014 ${Td}`,`cascade: ${Ni.join(" \u2192 ")}`,`verdicts: ${Ci.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)"].join(`
-`)}var Dd=new Set([...bt,...kt]);function dn(e,n,t){let r=e[n+1];if(r===void 0||r.startsWith("--"))throw new Error(`${t} requires a value`);return r}function Fd(e){let n=e.split(",").map(i=>i.trim()),t=[...bt,...kt].join(", ");if(n.length===0||n.some(i=>i===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let r=[];for(let i of n){if(!Dd.has(i))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(i)}; valid: ${t}`);r.push(i)}return r}function _s(e){let n=".",t,r,i=!1,s=!1,l=!1,a=!1,o,c,u,f=!1,m=!1,h,k=!1,x=!1,y,I=[];for(let v=0;v<e.length;v+=1){let C=e[v];if(C==="--fail-on-reachable")i=!0;else if(C==="--fail-on-unknown")s="all";else if(C!==void 0&&C.startsWith("--fail-on-unknown="))s=Fd(C.slice(18));else if(C==="--offline")l=!0;else if(C==="--sarif")t=dn(e,v,"--sarif"),v+=1;else if(C==="--shard")r=dn(e,v,"--shard"),v+=1;else if(C==="--entry")I.push(dn(e,v,"--entry")),v+=1;else if(C==="--summary-shadow")o=dn(e,v,"--summary-shadow"),v+=1;else if(C==="--model-shadow")c=dn(e,v,"--model-shadow"),v+=1;else if(C==="--model-shadow-out")u=dn(e,v,"--model-shadow-out"),v+=1;else if(C==="--model-shadow-widened")f=!0;else if(C==="--binding-shadow")m=!0;else if(C==="--binding-shadow-out")h=dn(e,v,"--binding-shadow-out");else if(C==="--x-partial-rows")k=!0,v+=1;else if(C==="--push")x=!0;else if(C!==void 0&&C.startsWith("--auth=")){let M=C.slice(7);if(M!=="oidc"&&M!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(M)}`);y=M}else{if(C!==void 0&&C.startsWith("--"))throw new Error(`unknown flag ${C}`);C!==void 0&&!a&&(n=C,a=!0)}}if(c===void 0!=(u===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(f&&c===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(m!==(h!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(y!==void 0&&!x)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:r,failOnReachable:i,failOnUnknown:s,offline:l,entry:I,summaryShadow:o,modelShadow:c,modelShadowOut:u,modelShadowWidened:f,push:x,auth:y,bindingShadow:m,bindingShadowOut:h,partialRows:k}}import{randomBytes as Kd,createHash as jd}from"node:crypto";import{mkdirSync as Bd,readFileSync as zd,renameSync as Ud,writeFileSync as Vd}from"node:fs";import{homedir as qd}from"node:os";import cn from"node:path";var ot="latest.json",at="latest.json.sig";function lt(e){return jd("sha256").update(e).digest("hex")}function As(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=qd();if(process.platform==="darwin")return cn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let i=process.env.LOCALAPPDATA,s=i!==void 0&&i!==""?i:cn.join(n,"AppData","Local");return cn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,r=t!==void 0&&t!==""?t:cn.join(n,".cache");return cn.join(r,"cupel","shards")}function fi(e,n,t){return cn.join(e,`${n}-${t}.sqlite`)}function dt(e,n){Bd(cn.dirname(e),{recursive:!0});let t=`${e}.tmp-${Kd(8).toString("hex")}`;Vd(t,n,{flag:"wx"}),Ud(t,e)}function On(e){try{return zd(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function Ns(e,n,t,r){let i=fi(e,n,t),s=On(i);if(s===void 0)return;let l=lt(s);if(l!==t)throw r(`cached shard ${i} failed sha256 re-verify (expected ${t}, got ${l})`);return{path:i,bytes:s}}var Cs="delivery-not-activated.invalid",ct=new Set(["delivery-not-activated.invalid"]),Ms=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import mt from"node:path";function Ue(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function ut(e,n={}){let t=n.maxBytes??1073741824,r=n.timeoutMs??3e4,{get:i}=await import("node:https");return await new Promise((s,l)=>{let a=i(e,n.headers!==void 0?{headers:n.headers}:{},o=>{let c=o.statusCode??0;if(c<200||c>=300){o.resume(),l(new Error(`GET ${e} \u2192 HTTP ${String(c)}`));return}let u=[],f=0;o.on("data",m=>{if(f+=m.length,f>t){o.destroy(),l(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(m)}),o.on("end",()=>{s(Buffer.concat(u))}),o.on("error",l)});a.on("error",l),a.setTimeout(r,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(r)}ms`))})})}import{createPublicKey as Hd,verify as Wd}from"node:crypto";var ne=class extends Error{constructor(n){super(n),this.name="DistError"}},Xd=Buffer.from("302a300506032b6570032100","hex"),Gd=32;function Ps(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Gd)try{return Hd({key:Buffer.concat([Xd,n]),format:"der",type:"spki"})}catch{return}}function pi(e,n,t){for(let r of t){let i=Ps(r);if(i!==void 0)try{if(Wd(null,e,i,n))return!0}catch{}}return!1}function Rs(e){return e.some(n=>Ps(n)!==void 0)}var Jd=/^[0-9a-f]{64}$/u,Yd=/^[a-z0-9-]+$/u;function Os(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new ne(`${n} must be an object`);return e}function $s(e,n){if(!Array.isArray(e))throw new ne(`${n} must be an array`);return e}function ft(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new ne(`${n} must be an integer`);return e}function pt(e,n){if(typeof e!="string")throw new ne(`${n} must be a string`);return e}function Ls(e,n){let t=pt(e,n);if(Number.isNaN(Date.parse(t)))throw new ne(`${n} is not a valid timestamp: ${t}`);return t}function mi(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new ne("distribution index is not valid JSON")}let r=Os(t,"index"),i=ft(r.schema_version,"schema_version");if(i!==n.supportedIndexSchemaVersion)throw new ne(`index schema_version ${String(i)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=ft(r.sequence,"sequence");if(s<0)throw new ne("sequence must be non-negative");let l=Ls(r.generated,"generated"),a=$s(r.shards,"shards"),o;for(let k of a){let x=Os(k,"shard entry"),y=pt(x.ecosystem,"ecosystem");if(!Yd.test(y))throw new ne(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){o=x;break}}if(o===void 0)throw new ne(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);Ls(o.built,"built");let c=ft(o.db_schema_version,"db_schema_version");if(c<1)throw new ne("db_schema_version must be >= 1");if(c>n.supportedDbSchemaVersion)throw new ne(`this shard needs a newer cupel (db_schema_version ${String(c)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=pt(o.sha256,"sha256");if(!Jd.test(u))throw new ne(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let f=ft(o.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new ne(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let m=$s(o.urls,"urls");if(m.length===0)throw new ne("urls must be a non-empty array");let h=[];for(let k of m){let x=pt(k,"url");try{h.push(Ue(x,n.shardHosts))}catch(y){throw new ne(`refusing shard url ${JSON.stringify(x)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:f,dbSchemaVersion:c,urls:h,sequence:s,generated:l}}var Qd=1,Zd=1024*1024*1024,ec=1024*1024,nc=4096;function tc(e=ct){return{async fetchIndex(n){let t=new Set([n]),r=Ue(`https://${n}/${ot}`,t).href,i=Ue(`https://${n}/${at}`,t).href,s=await ut(r,{maxBytes:ec,timeoutMs:3e4}),l=await ut(i,{maxBytes:nc,timeoutMs:3e4});return{index:s,sig:l}},async fetchShard(n,t){return Ue(n.href,e),await ut(n.href,{maxBytes:t,timeoutMs:3e4})}}}function yi(e){return e instanceof Error?e.message:String(e)}function Ts(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Qd,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:Zd}}function ic(e){let n=On(mt.join(e.cacheDir,ot)),t=On(mt.join(e.cacheDir,at));if(!(n===void 0||t===void 0)&&pi(n,t,e.pubkeys))try{return mi(n,Ts(e))}catch{return}}function Ds(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let r=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(r)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function gi(e,n,t){let r=Ns(n.cacheDir,e.ecosystem,e.sha256,i=>new ne(i));if(r===void 0)throw new ne(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:r.path,fromCache:!0,warnings:[...t,...Ds(e,n)],sequence:e.sequence}}async function rc(e,n,t){let r=fi(n.cacheDir,e.ecosystem,e.sha256),i=On(r);if(i!==void 0&&lt(i)===e.sha256)return{path:r,downloaded:!1};let s="no shard urls";for(let l of e.urls){let a;try{a=await t.fetchShard(l,e.sizeBytes)}catch(c){s=yi(c);continue}let o=lt(a);if(o!==e.sha256){s=`sha256 mismatch from ${l.href} (expected ${e.sha256}, got ${o})`;continue}return dt(r,a),{path:r,downloaded:!0}}throw new ne(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${s}`)}async function Fs(e,n){if(!e.activated)throw new ne("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??tc(e.shardHosts);if(!Rs(e.pubkeys))throw new ne("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let r=ic(e);if(e.offline){if(r===void 0)throw new ne(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return gi(r,e,[])}let i,s;try{let o=await t.fetchIndex(e.indexHost);i=o.index,s=o.sig}catch(o){if(r===void 0)throw new ne(`no cached ${e.ecosystem} shard and the shard index is unreachable (${yi(o)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return gi(r,e,[`could not refresh the shard index (${yi(o)}); using the cached shard`])}if(!pi(i,s,e.pubkeys))throw new ne("shard index signature did not verify against any pinned key");let l=mi(i,Ts(e));if(r!==void 0&&l.sequence<r.sequence)return gi(r,e,[`refusing a rolled-back shard index (served sequence ${String(l.sequence)} < cached ${String(r.sequence)}); keeping the newer cached shard`]);let a=await rc(l,e,t);return dt(mt.join(e.cacheDir,ot),i),dt(mt.join(e.cacheDir,at),s),{path:a.path,fromCache:!a.downloaded,warnings:Ds(l,e),sequence:l.sequence}}var oc=720*60*60*1e3,ac=Number(tn);function Ks(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Pe("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function js(e){let n=await Fs({ecosystem:"npm",activated:!1,pubkeys:Ms,indexHost:Cs,shardHosts:ct,cacheDir:As(),offline:e.offline,now:Date.now(),maxAgeMs:oc,supportedDbSchemaVersion:ac});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
-`);return{path:n.path,sequence:n.sequence}}var lc=4,$n=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function dc(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new $n(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,r=e.modelPromotedFromKind??null;if(t===null!=(r===null))throw new $n(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new $n(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:Mi(n),path:e.path===void 0?null:e.path.map(i=>({functionName:i.functionName??null,modulePath:i.modulePath})),unresolvedSites:e.unresolvedSites.map(i=>({path:i.path,start:i.start,end:i.end})),modelId:t,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null}}function Bs(e,n){return{version:lc,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:e.findings.map(dc)}}var cc="https://api.cupel.sh",zs=".actions.githubusercontent.com",uc=8192,Ae=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function fc(e){let n;try{n=new URL(e).hostname}catch{throw new Ae("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=zs.slice(1);if(n!==t&&!n.endsWith(zs))throw new Ae(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Ue(e,new Set([n]))}catch{throw new Ae(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Us(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,r=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Ae("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(r===void 0||r==="")throw new Ae("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let i=fc(t);i.searchParams.set("audience",cc);let s;try{s=await n(i.href,{authorization:`Bearer ${r}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Ae("the ID-token request failed")}if(s.length>uc)throw new Ae("the ID-token response was larger than a token can be");let l;try{l=JSON.parse(s)}catch{throw new Ae("the ID-token response was not JSON")}let a=typeof l=="object"&&l!==null?l.value:void 0;if(typeof a!="string"||a.length===0)throw new Ae("the ID-token response carried no token");return a}async function Vs(e,n,t={}){let r=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",i=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!r)throw new Ae("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Us(e,n)};if(r)return i&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(i)return{kind:"oidc",value:await Us(e,n)};throw new Ae("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var xi="api.cupel.sh",pc=`https://${xi}/v1/findings`,mc=64*1024,ht=8*1024*1024,hc=3e4,Ze=class extends Error{constructor(n){super(n),this.name="PushError"}};async function qs(e,n,t,r={}){if(e.length>ht)throw new Ze(`findings payload is ${String(e.length)} bytes, over the ${String(ht)}-byte limit`);let i=Ue(pc,new Set([xi])),s;try{s=await t(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,r.timeoutMs??hc)}catch{throw new Ze(`the findings push to ${xi} failed`)}if(s.body.length>mc)throw new Ze("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new Ze("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new Ze("the control plane rejected the findings payload as malformed"):new Ze(`the findings push was refused with status ${String(s.status)}`)}var gc=64*1024,yc=64*1024;async function Hs(e,n,t,r,i,s){let{request:l}=await import("node:https"),a=new URL(n).hostname;return await new Promise((o,c)=>{let u=l(n,{method:e,headers:t},f=>{let m=[],h=0;f.on("data",k=>{if(h+=k.length,h>s){f.destroy(),c(new Error(`${e} to ${a} returned more than ${String(s)} bytes`));return}m.push(k)}),f.on("end",()=>{o({status:f.statusCode??0,body:Buffer.concat(m).toString("utf8")})}),f.on("error",()=>{c(new Error(`${e} to ${a} failed`))})});u.on("error",()=>{c(new Error(`${e} to ${a} failed`))}),u.setTimeout(i,()=>{u.destroy(new Error(`${e} to ${a} timed out after ${String(i)}ms`))}),r!==void 0&&u.write(r),u.end()})}var Ws=async(e,n,t,r)=>{if(Buffer.byteLength(t,"utf8")>ht)throw new Error("findings payload is over the size limit");return await Hs("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,r,yc)};async function Xs(e,n){let t=await Hs("GET",e,n,void 0,15e3,gc);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}function K(e){let n="";for(let t of e){let r=t.charCodeAt(0),i=r<32||r>=127&&r<=159;n+=i?"\\x"+r.toString(16).padStart(2,"0"):t}return n}var xc={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Gs=4,Si=3,bi=10,Js={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},Sc="(symbol set known incomplete)";function bc(e){let n=(e.path??[]).map(t=>K(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Ys(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function kc(e){let n=e.findings.filter(c=>c.tier==="unknown"&&c.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let c of n){let u=t.get(c.unknownKind)??[];u.push(c),t.set(c.unknownKind,u)}let r={cupel:0,project:0};for(let[c,u]of t)r[Ie[c]]+=u.length;let i=[];i.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(c,u)=>{if(r[c]===0)return;i.push(""),i.push(`   ${u} (${String(r[c])}):`);let f=[...t.entries()].filter(([h])=>Ie[h]===c).sort((h,k)=>k[1].length-h[1].length||h[0].localeCompare(k[0])),m=f.slice(0,Gs);for(let[h,k]of m){let x=c==="project"?[...new Set(k.flatMap(Ys))]:[],y=x.slice(0,Si).map(K).join(", "),I=x.length>Si?` (+${String(x.length-Si)} more files)`:"";i.push(`     ${h.padEnd(21)} ${String(k.length).padStart(4)}  ${Js[h]}`+(y!==""?`
-       ${y}${I}`:""))}for(let[h,k]of f.slice(Gs))i.push(`     ${h.padEnd(21)} ${String(k.length).padStart(4)}  ${Js[h]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let l=new Map;for(let c of n)if(Ie[c.unknownKind]==="project")for(let u of Ys(c))l.set(u,(l.get(u)??0)+1);let a=[...l.entries()].sort((c,u)=>u[1]-c[1]||c[0].localeCompare(u[0]))[0];a!==void 0&&r.project>0&&(i.push(""),i.push(`   \u279C Start here: ${K(a[0])} appears in ${String(a[1])} of your ${String(r.project)} finding(s), across ${String(l.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let o=n.filter(c=>Ie[c.unknownKind]==="project");if(o.length>0){i.push("");for(let c of o.slice(0,bi))i.push(`     ${K(c.displayId)}  ${K(c.packageName)}@${K(c.version)}  [${c.unknownKind}] ${K(c.reason)}`);o.length>bi&&i.push(`     \u2026 and ${String(o.length-bi)} more`)}return i.push(""),i}function Qs(e){let n=[],t=e.counts,r=e.findings.filter(a=>a.tier==="reachable-high"||a.tier==="reachable-medium"||a.tier==="reachable-low");if(n.push(`cupel scan: ${K(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let a=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+a.map(o=>`${K(o.entrypoint)} [${K(o.source)}]`).join(", ")+(e.entrypointSources.length>a.length?`, \u2026 and ${String(e.entrypointSources.length-a.length)} more`:"")),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let a of e.entrypointGaps.slice(0,5))n.push(`  - ${K(a.source)} (${K(a.file)}): ${K(a.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(K).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.'),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let i=e.installed.gaps;if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let a of i.slice(0,10))n.push(`  - [${K(a.kind)}] ${K(a.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let s=new Set(i.map(a=>a.detail)),l=[...e.analyzerDiagnostics.map(a=>`${K(a.code)}: ${K(a.detail)}`),...e.installed.diagnostics.filter(a=>!s.has(a)).map(K)];if(l.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(l.length)}) \u2014 verdicts are conservative:`);for(let a of l.slice(0,10))n.push(`  - ${a}`);l.length>10&&n.push(`  \u2026 and ${String(l.length-10)} more`),n.push("")}if(r.length>0){n.push(`\u{1F3AF} Reachable (${String(r.length)}) \u2014 fix these:`);for(let a of r)n.push(`  ${xc[a.tier]} ${K(a.displayId)}  ${K(a.packageName)}@${K(a.version)}  ${K(a.symbolName??"")}`+(a.surfaceComplete===!1?`  ${Sc}`:"")),n.push(`        path: ${bc(a)}`);n.push("")}return n.push(...kc(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable (ignorable), ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as Ec}from"node:crypto";var wc="https://json.schemastore.org/sarif-2.1.0.json",Zs="cupel-reachability",ki=new Set(["dispatch","dynamic-load","coverage-gap"]);function vc(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var Ic=500,_c=10;function Ac(e,n){return`${e}::${n}`}function Nc(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Cc(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Ec("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Mc(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:ki.has(e.unknownKind)}var eo={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function no(e){let n=[],t=new Map,r=[];for(let o of e.findings){if(!Mc(o))continue;let c=Ac(o.displayId,o.packageName);if(!t.has(c)){t.set(c,n.length);let y=Nc(o.severity);n.push({id:K(c),properties:{tags:o.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${K(o.packageName)}`]:["security","reachability",`package/${K(o.packageName)}`],...y!==void 0?{"security-severity":y}:{}}})}let u=o.tier==="reachable-high"||o.tier==="reachable-medium"||o.tier==="reachable-low",f=o.path??[],m=f.find(y=>y.modulePath!==""),h=[...new Set(o.unresolvedSites.map(y=>y.path).filter(y=>y!==""))],k=u?m!==void 0?{physicalLocation:{artifactLocation:{uri:K(m.modulePath)}},message:{text:`calls ${K(o.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:K(o.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:K(h[0])}},message:{text:`unresolved ${K(o.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:K(o.packageLocation??(o.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},x=u?f.map(y=>({physicalLocation:{artifactLocation:{uri:K(y.modulePath||"package-lock.json")}},message:{text:K(y.functionName??"<step>")}})):h.slice(1,_c+1).map(y=>({physicalLocation:{artifactLocation:{uri:K(y)}},message:{text:"also blocked here"}}));r.push({ruleId:K(c),ruleIndex:t.get(c),level:u?"error":"warning",message:{text:K(`[${o.tier}] ${o.displayId} in ${o.packageName}@${o.version}`+(o.symbolName!==null?` \u2014 reaches ${o.symbolName}`:"")+(o.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${o.reason}`)},locations:[k],...x.length>0?{relatedLocations:x}:{},partialFingerprints:{"cupelReachability/v1":Cc(o)},properties:{tier:o.tier,advisoryId:K(o.advisoryId),...o.surfaceComplete===!1?{surfaceComplete:!1}:{},...o.modelId!==void 0?{modelId:K(o.modelId),modelPromotedFromKind:o.modelPromotedFromKind}:{},...o.unknownKind!==void 0?{unknownKind:o.unknownKind,unknownOwner:Ie[o.unknownKind],unresolvedSiteCount:o.unresolvedSites.length}:{}}})}let i=new Map,s=new Map;for(let o of e.findings){if(o.tier!=="unknown"||o.unknownKind===void 0||(i.set(o.unknownKind,(i.get(o.unknownKind)??0)+1),ki.has(o.unknownKind)))continue;let c=s.get(o.unknownKind)??[];c.length<Ic&&c.push({advisory:K(o.displayId),package:K(o.packageName),version:K(o.version)}),s.set(o.unknownKind,c)}let l={cupel:0,project:0};for(let[o,c]of i)l[Ie[o]]+=c;let a={};for(let[o,c]of s){let u=i.get(o)??c.length;a[o]={count:u,owner:Ie[o],note:eo[o],truncated:u>c.length,advisories:c}}return{$schema:wc,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Zs},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:K(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(o=>`${o.entrypoint} (${o.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...i.keys()].filter(o=>!ki.has(o)&&!vc(o,e.analysisAborted)).sort().map(o=>({descriptor:{id:`unknown-${o}`},level:"warning",message:{text:`${String(i.get(o)??0)} finding(s) are unknown because ${eo[o]} (owner: ${Ie[o]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${o}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(o=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:K(`${o.source} (${o.file}): ${o.detail}`)}})),...e.rejectedEntries.map(o=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:K(`--entry did not resolve to a file inside the app root: ${o}`)}})),...e.analyzerDiagnostics.map(o=>({descriptor:{id:o.code},level:"warning",message:{text:K(`${o.detail} (${o.path})`)}})),...e.installed.diagnostics.map(o=>({descriptor:{id:"resolve"},level:"warning",message:{text:K(o)}}))]}],results:r,properties:{category:Zs,summary:e.counts,unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...i].sort((o,c)=>c[1]-o[1])),byOwner:l,grouped:a},dbCoverageGaps:e.findings.filter(o=>o.tier==="unknown"&&o.unknownKind==="db-gap").map(o=>({advisory:K(o.displayId),package:K(o.packageName),version:K(o.version)}))}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function to(){try{let e=Oc(Pc(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Rc(e,n){let t=`${JSON.stringify(n,null,2)}
-`,r=`${e}.tmp-${io(8).toString("hex")}`;ro(r,t,{encoding:"utf8",flag:"wx"}),$c(r,e)}async function Tc(e){let n=_s(e),r=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:Ks(n.shard),sequence:null}:await js({offline:n.offline}),i=r.path,s=ci({dir:n.dir,shardPath:i,failOnReachable:n.failOnReachable,failOnUnknown:n.failOnUnknown,entry:n.entry,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{}});if(process.stdout.write(`${Qs(s)}
-`),s.modelLane!==void 0){let l=s.modelLane.notes.length>0?` (${s.modelLane.notes.map(a=>K(a)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(s.modelLane.active)}/${String(s.modelLane.stored)} active, ${String(s.modelLane.promoted)} promoted to reachable-low${l}
-`)}if(n.summaryShadow!==void 0&&s.summaryShadow!==void 0){let l=Lc.join(n.summaryShadow,"shadow-report.json");ro(l,`${JSON.stringify(s.summaryShadow,null,2)}
+}`,g.ScriptTarget.Latest,!0),i=r.parseDiagnostics;if(i!==void 0&&i.length>0||Ut(r,n+1,!0))return!0}return!1}function Ut(e,n=0,t=!1){let r=!1,i=t?Wa:el(e);if(i.saturated)return!0;let s=a=>g.isElementAccessExpression(a)&&!g.isStringLiteralLike(a.argumentExpression)&&tt(ce(a.expression),i),l=a=>{if(!r){if(t&&(g.isCallExpression(a)||g.isNewExpression(a)||g.isTaggedTemplateExpression(a))){r=!0;return}if(g.isCallExpression(a)){let o=On(a);if(o!==null){let c=o.specifierArg;if(c===void 0||!g.isStringLiteralLike(c)||t){r=!0;return}}else{let c=ce(a.expression);if(g.isIdentifier(c)&&(c.text==="eval"||c.text==="Function")){if(Ir(a.arguments,n)){r=!0;return}}else if(nl(c)){r=!0;return}else if(s(c)){r=!0;return}else if(Qa(a,i)){r=!0;return}}}else if(g.isNewExpression(a)){let o=ce(a.expression);if(g.isIdentifier(o)&&o.text==="Function"){if(Ir(a.arguments??[],n)){r=!0;return}}else if(Nn(o)){r=!0;return}}else if(g.isIdentifier(a)&&za.has(a.text)&&Ha(a)){r=!0;return}else if((g.isPropertyAccessExpression(a)||g.isElementAccessExpression(a))&&(Cr(a)||Nn(a)||s(a))&&Nr(a)){r=!0;return}else if(g.isBindingElement(a)){let o=a.propertyName??a.name,c=g.isIdentifier(o)||g.isStringLiteralLike(o)?o.text:g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?o.expression.text:void 0;if(c!==void 0&&rt.has(c)){r=!0;return}}g.forEachChild(a,l)}};return l(e),r}function Pr(e,n,t){if(Ut(t))return!0;if(!qt(e)||!n.includes("<")||!n.includes("require"))return!1;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);return Ut(r)}function il(e,n,t){if(Fa(e))return!0;let r=t.endsWith(Se.sep)?t:t+Se.sep,i=e.split("/"),s=n;for(;;){let l=Se.join(s,"node_modules",...i),a;try{a=un(Se.join(l,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(r))return!1;let c=De(a);if(c===null)return!1;let u;try{u=JSON.parse(c).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(ar(l))return!1;if(s===t)break;let o=Se.dirname(s);if(o===s||o!==t&&!o.startsWith(r))break;s=o}return!0}function rl(e,n){let t=n.endsWith(Se.sep)?n:n+Se.sep,r=Se.dirname(e);for(;;){let i=Se.join(r,"package.json"),s;try{s=un(i)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let a=De(s);if(a!==null)try{let o=JSON.parse(a).name;if(typeof o=="string"&&o.length>0)return o}catch{return null}}if(r===n)break;let l=Se.dirname(r);if(l===r||l!==n&&!l.startsWith(t))break;r=l}return null}function sl(e,n,t,r,i,s){let l=[],a=[],o=new Set,c={},u=new Set,f=new Set,m=[],h=!1,k=(S,w)=>{let A;try{A=un(w)}catch{return!1}let R=Xe(e,A);if(R===null)return i.push({code:"out-of-root",path:A,detail:"dependency module resolved outside the app root; not followed"}),!1;let v=!t.has(A)&&!f.has(A);return v&&f.size>=jt?(h=!0,!1):(a.push({from:S,to:{module:R}}),v?(f.add(A),l.push(R),!0):!1)},E=(S,w)=>{if(o.add(w),u.has(w))return;u.add(w);let A=Fe(w,S,We,n);if(A!==null&&!He(A)){if(k({surface:w},A)){m.push(A);try{let R=Xe(e,un(A)),v=rl(A,e);R!==null&&v!==null&&(c[R]=v)}catch{}}return}il(w,Se.dirname(S),e)||i.push({code:"unresolved-specifier",path:w,detail:`dependency "${w}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let S of r)E(S.containingFile,S.packageName);for(;m.length>0&&f.size<jt;){let S=m.pop();if(S===void 0)break;let w=Xe(e,S);if(w===null)continue;let A=yn(S,nn);if(A.kind==="too-large"){i.push({code:"limit-exceeded",path:w,detail:`dependency module over the ${String(nn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(A.kind==="not-regular"){i.push({code:"parse-error",path:w,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let R=g.createSourceFile(S,A.text,g.ScriptTarget.ES2020,!0),v=R.parseDiagnostics;if(v!==void 0&&v.length>0){i.push({code:"dependency-body",path:w,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}if(Pr(S,A.text,R)){if(!s){i.push({code:"dependency-body",path:w,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)"});continue}i.push({code:"dependency-loader-assumed",path:w,detail:"dependency module contains a loader escape; its LITERAL imports were followed and bound its module reach, and its dynamic reach rests on the stated assumption \u2014 no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime (ADR-089 D2)",anchor:w})}else i.push({code:"dependency-body",path:w,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:w});for(let y of _r(S,A.text))if(y.runtime)if(pe(y.text)==="package-root"){let p=Ye(y.text);a.push({from:{module:w},to:{surface:p}}),E(S,p)}else{let p=Fe(y.text,S,We,n);if(p===null){pe(y.text)==="package-subpath"&&i.push({code:"unresolved-specifier",path:w,detail:`runtime package-subpath import "${y.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`});continue}if(He(p)){let x=Xe(e,p);i.push({code:x===null?"out-of-root":"declaration-shadow",path:w,detail:x===null?`runtime import "${y.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${y.text}" resolved to the declaration file "${x}" with no co-located runtime module; its code was not analyzed`});continue}k({module:w},p)&&m.push(p)}}return(h||m.length>0)&&i.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(jt)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:l,edges:a,surfacePackages:[...o],entryRealNames:c}}function Tr(e,n,t=!1,r=!1){let i=un(e),s=[],l=g.createCompilerHost(We,!0),a=t?cr(i,We,l):()=>null,o=new Set,c=new Set,u=n.map(_=>Se.join(i,_)),f=[],m=new Map,h=new Map,k=new Map,E=new Map,S=new Set,w=(_,M)=>{let T=`${String(_.length)}:${_}${M}`;S.has(T)||(S.add(T),s.push({code:"unresolved-specifier",path:_,detail:M}))},A=()=>null,R=0,v=(_,M)=>{let T=h.get(_);return T===void 0&&(T=g.createSourceFile(_,M,g.ScriptTarget.ES2020,!0),h.set(_,T)),{real:_,sf:T}};for(;c.size<et;){let _=u.pop();if(_===void 0){if(R>=Ba)break;R+=1;let K=[];for(let[j,V]of m)V.includes("readdir")&&(V.includes("require")||V.includes("import("))&&K.push(v(j,V));let W=ja(K);if(W.length===0)break;let J=[];for(let[j,V]of m)J.push(v(j,V));A=kr(J,W,We,l,k);let Z=!1;for(let j of K){let V=m.get(j.real);if(V!==void 0)for(let ie of vr(j.real,V,i,l,A))c.has(ie)||(u.push(ie),Z=!0)}if(!Z)break;continue}let M;try{M=un(_)}catch{continue}if(c.has(M))continue;if(c.add(M),Xe(i,M)===null){s.push({code:"out-of-root",path:_,detail:"resolved outside app root"});continue}let T=yn(M,nn);if(T.kind==="too-large"){s.push({code:"limit-exceeded",path:M,detail:`file is ${String(Math.round(T.bytes/1048576))}MiB, over the ${String(nn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(T.kind==="not-regular"){s.push({code:"parse-error",path:M,detail:"unreadable or not a regular file"});continue}let O=T.text;o.add(M),m.set(M,O);for(let K of _r(M,O)){let W=K.runtime?a(K.text,M):null;if(W===null&&pe(K.text)==="package-root"){K.runtime&&f.push({containingFile:M,packageName:Ye(K.text)});continue}let J=W??Fe(K.text,M,We,l);if(J===null){if(K.runtime){let Z=pe(K.text);if(Z==="package-subpath")w(M,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`);else if(Z==="relative"){let j=dr(K.text,M,i,E);j.kind==="unanalyzable"&&w(M,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${j.reason}; a bundler/loader may load a module the analyzer never saw`)}}continue}if(Xe(i,J)===null){s.push({code:"out-of-root",path:J,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&He(J)){s.push({code:"declaration-shadow",path:J,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!Xn(J)){s.push({code:"unanalyzable-module",path:J,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}u.push(J)}for(let K of vr(M,O,i,l,A))c.has(K)||u.push(K)}c.size>=et&&u.length>0&&s.push({code:"limit-exceeded",path:i,detail:`reachable file set exceeds ${String(et)}; analysis truncated (${String(u.length)}+ files not analyzed)`});let y=sl(i,l,o,f,s,r),p=g.createProgram({rootNames:[...o],options:We,host:l}),x=new Set,N=new Map;for(let _ of p.getSourceFiles()){if(_.isDeclarationFile||p.isSourceFileDefaultLibrary(_)||Xe(i,_.fileName)===null||!qt(_.fileName))continue;let M=p.getSyntacticDiagnostics(_).length>0;if(!M&&!_.text.includes("<")||Ka(_.text,g.ScriptKind.TSX)!==0)continue;let T=g.createSourceFile(_.fileName,_.text,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);(M||wr(T)>wr(_))&&(x.add(_.fileName),N.set(_.fileName,_.text))}let D=p;if(x.size>0){let _=l.getSourceFile.bind(l);l.getSourceFile=(M,T,O,K)=>{let W=N.get(M);return W!==void 0?g.createSourceFile(M,W,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX):_(M,T,O,K)},D=g.createProgram({rootNames:[...o],options:We,host:l,oldProgram:p})}let B=D.getTypeChecker(),F=[];for(let _ of D.getSourceFiles()){if(_.isDeclarationFile||D.isSourceFileDefaultLibrary(_)||Xe(i,_.fileName)===null)continue;F.push(_);let M=D.getSyntacticDiagnostics(_);if(M.length>0){let O=M[0],K=O!==void 0?g.flattenDiagnosticMessageText(O.messageText," "):"syntax error";s.push({code:"parse-error",path:_.fileName,detail:`${String(M.length)} syntax error(s): ${K}`})}let T=Xe(i,_.fileName);T!==null&&Pr(_.fileName,_.text,_)&&s.push({code:"loader-escape",path:T,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)"})}return{program:D,checker:B,host:l,options:We,appRoot:i,sourceFiles:F,diagnostics:s,depReach:y,resolveParamDirs:A,toRel:_=>Xe(i,_)}}function Ge(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let r of n){let i=r.codePointAt(0)??0;t+=i<32||i>=127&&i<=159?`\\x${i.toString(16).padStart(2,"0")}`:r}return t}function ol(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function al(e){let n=[],t="";for(let r of e){if(r===" "||r==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=r}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var ll=/^[A-Za-z_][A-Za-z0-9_]*=/u;function dl(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var cl=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),ul=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),fl=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function Fr(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Dr(e){if(Fr(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return fl.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:cl.has(t)||n!==-1&&ul.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var pl=[".js",".cjs",".mjs",".ts",".mts",".cts"];function ml(e){return pl.some(n=>e.endsWith(n))}var hl=new Set(["npm","yarn","pnpm"]);function gl(e){let n=e[0];return n===void 0||!hl.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Vt(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(ol(n))return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let t=al(n);if(t===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let r=0;for(t[r]==="env"&&(r+=1);r<t.length;r+=1){let l=t[r];if(l===void 0||!ll.test(l))break;if(Fr(l))return{kind:"unparsed",reason:`environment \`${Ge(l)}\` preloads another module; the launch surface is more than one file`};let a=l.indexOf("=");if(l.slice(0,a)==="NODE_OPTIONS")for(let o of l.slice(a+1).split(/\s+/u)){if(o===""||!o.startsWith("-"))continue;let c=Dr(o);if(c!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Ge(c.token)}\` ${c.why}`}}}let i=t[r];if(i===void 0)return{kind:"unparsed",reason:"no program in the command"};if(gl(t.slice(r)))return{kind:"delegates",target:"scripts.start"};if(!dl(i))return{kind:"unparsed",reason:`runs \`${Ge(i)}\`, not node directly \u2014 the entry file cannot be identified`};for(r+=1;r<t.length;r+=1){let l=t[r];if(l===void 0||!l.startsWith("-"))break;let a=Dr(l);if(a!==null)return{kind:"unparsed",reason:`node flag \`${Ge(a.token)}\` ${a.why}`}}let s=t[r];return s===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:ml(s)?{kind:"file",specifier:s}:{kind:"unparsed",reason:`\`${Ge(s)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function yl(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var xl=64;function Ht(e){let n=e.split(`
+`),t=n.length>64,r=[],i=0;for(let s of n.slice(0,64)){let l=s.trim();if(l.length===0||l.startsWith("#"))continue;let a=l.indexOf(":");if(a<=0)continue;let o=l.slice(a+1).trim();if(o.length===0)continue;let c=l.slice(0,a);if(c.length>xl||!yl(c)){i+=1;continue}r.push({name:c,command:o})}return r.sort((s,l)=>s.name===l.name?0:s.name==="web"?-1:l.name==="web"?1:0),{entries:r,truncated:t,unnamedLines:i}}import{realpathSync as Kr}from"node:fs";import Ce from"node:path";import d from"typescript";var jr=3;function ne(e,n,t){if(e===void 0)return;let r=e[n]??={fired:0,refused:{}};t===null?r.fired+=1:r.refused[t]=(r.refused[t]??0)+1}function rn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var ot=16,Gt=256,Wt=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.fns.has(r)||(this.moduleFor(n),this.fns.set(r,{id:i,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),i}classFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.classNodes.has(r)||(this.moduleFor(n),this.classNodes.set(r,{id:i,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(r,[])),i}methodFor(n,t,r,i){let s=`${n}#${t}.${r}`,l=`pkg:${n}#${t}.${r}`;if(!this.fns.has(s)){let a=this.classFor(n,t);this.fns.set(s,{id:l,moduleId:`pkg:${n}`,name:r,kind:i,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(l)}return l}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function Gr(e,n){let t="node_modules/",r=e.lastIndexOf(t);if(r===-1)return n;let s=e.slice(r+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function Br(e,n,t){let r=Ce.dirname(e),i=Ce.dirname(n),s=[];for(;;){let a=t.get(r);if(a!==void 0){for(let c of s)t.set(c,a);return a}s.push(r);let o=De(Ce.join(r,"package.json"));if(o!==null)try{let c=JSON.parse(o),u={name:c.name??"app",version:c.version??"0.0.0",dir:r};for(let f of s)t.set(f,u);return u}catch{}if(r===i||r===Ce.dirname(r))break;r=Ce.dirname(r)}let l={name:"app",version:"0.0.0",dir:null};for(let a of s)t.set(a,l);return l}function Sl(e){let n=[],t=r=>{if(d.isImportDeclaration(r)&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isImportEqualsDeclaration(r)&&d.isExternalModuleReference(r.moduleReference)&&d.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isCallExpression(r)){let i=On(r);if(i!==null){let s=i.specifierArg,l=s!==void 0&&d.isStringLiteralLike(s);n.push({specifier:l?s.text:void 0,specifierIsLiteral:l,dynamic:!0,...s!==void 0&&!l?{computedArg:s,loadPos:r.getStart(e)}:{}})}}d.forEachChild(r,t)};return t(e),n}function bl(e,n,t){let r=new Map,i=Br(Ce.join(e.appRoot,"package.json"),e.appRoot,r),s=[],l=[],a=[],o=new Map,c=new Set,u=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&u.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let h=Br(f.fileName,e.appRoot,r),k=Gr(m,i.name),E=m.includes("node_modules/");s.push({id:m,packageName:E&&h.name!==i.name?h.name:k,versionRange:h.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),h.dir===i.dir&&c.add(m);let S=0,w=null;for(let A of Sl(f)){let R=`${m}#import${String(S)}`;S+=1;let v=null;if(A.specifier!==void 0)if(pe(A.specifier)==="package-root")v=t.moduleFor(Ye(A.specifier));else{let y=Fe(A.specifier,f.fileName,e.options,e.host),p=y!==null?e.toRel(y):null;p!==null&&(v=p)}if(l.push({id:R,moduleId:m,specifier:A.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:A.dynamic,specifierIsLiteral:A.specifierIsLiteral,...v!==null?{resolvedModuleId:v}:{}}),v!==null&&a.push({importId:R,resolvedModuleId:v}),A.computedArg!==void 0&&A.loadPos!==void 0){w??=cn(f,f.fileName,e.resolveParamDirs);let y=[];for(let p of Qn(A.computedArg,w,e.appRoot,e.options,e.host)){let x=e.toRel(p);if(x===null||!u.has(x))continue;let N=x,D=`${m}#import${String(S)}`;S+=1,l.push({id:D,moduleId:m,specifier:x,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:N}),a.push({importId:D,resolvedModuleId:N}),y.push(x)}if(y.length>0){let p=An(A.computedArg,w)!==null||Yn(A.computedArg),x=o.get(m)??[];x.push({pos:A.loadPos,candidateRels:y,seedable:p}),o.set(m,x)}}}}return{modules:s,imports:l,importEdges:a,computedLoads:o,appOwnedPaths:c}}function kl(e){let n=De(e);if(n===null)return null;let t=d.createSourceFile(e,n,d.ScriptTarget.Latest,!0),r=i=>t.statements.some(s=>d.isFunctionDeclaration(s)?s.name?.text===i:d.isVariableStatement(s)?s.declarationList.declarations.some(l=>d.isIdentifier(l.name)&&l.name.text===i&&l.initializer!==void 0&&(d.isFunctionExpression(l.initializer)||d.isArrowFunction(l.initializer))):!1);for(let i of t.statements){if(d.isFunctionDeclaration(i)&&i.name!==void 0&&i.modifiers?.some(l=>l.kind===d.SyntaxKind.DefaultKeyword)===!0)return i.name.text;if(!d.isExpressionStatement(i)||!d.isBinaryExpression(i.expression))continue;let s=i.expression;if(s.operatorToken.kind===d.SyntaxKind.EqualsToken&&El(s.left)){if(d.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(d.isIdentifier(s.right)&&r(s.right.text))return s.right.text}}return null}function El(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function wl(e,n,t){for(let c of e.surfacePackages)n.moduleFor(c);let r=c=>"surface"in c?n.moduleFor(c.surface):c.module,i=[],s=new Set;for(let c of e.modules)t.has(c)||s.has(c)||(s.add(c),i.push({id:c,packageName:e.entryRealNames[c]??Gr(c,"app"),versionRange:"",path:c,moduleSystem:"cjs",isEntrypoint:!1}));let l=[],a=[],o=0;for(let c of e.edges){let u=r(c.from),f=r(c.to),m=`${String(u)}#depreach${String(o)}`;o+=1,l.push({id:m,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),a.push({importId:m,resolvedModuleId:f})}return{modules:i,imports:l,importEdges:a}}function zr(e,n,t){let r=e.expression;if(d.isIdentifier(r)&&!t.has(r.text)){let i=n.get(r.text);if(i?.kind==="package-export")return{kind:"package-instance",packageName:i.packageName,className:i.exportName};if(i?.kind==="app-class")return{kind:"app-instance",cls:i.cls}}else if(d.isPropertyAccessExpression(r)&&d.isIdentifier(r.expression)&&!t.has(r.expression.text)){let i=n.get(r.expression.text);if(i?.kind==="package-surface")return{kind:"package-instance",packageName:i.packageName,className:r.name.text}}return null}function fn(e){return d.canHaveModifiers(e)&&(d.getModifiers(e)?.some(n=>n.kind===d.SyntaxKind.ExportKeyword)??!1)}function vl(e){let n=new Set,t;for(let r of e.statements){if(d.isExpressionStatement(r)&&d.isBinaryExpression(r.expression)){let i=r.expression;if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(i.left)&&d.isIdentifier(i.left.expression)&&i.left.expression.text==="module"&&i.left.name.text==="exports"){if(d.isIdentifier(i.right))n.add(i.right.text),t=i.right.text;else if(d.isObjectLiteralExpression(i.right))for(let s of i.right.properties)d.isShorthandPropertyAssignment(s)?n.add(s.name.text):d.isPropertyAssignment(s)&&d.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(d.isFunctionDeclaration(r)&&r.name!==void 0&&fn(r))n.add(r.name.text);else if(d.isVariableStatement(r)&&fn(r))for(let i of r.declarationList.declarations)d.isIdentifier(i.name)&&n.add(i.name.text);else if(d.isExportDeclaration(r)&&r.exportClause&&d.isNamedExports(r.exportClause))for(let i of r.exportClause.elements)n.add((i.propertyName??i.name).text);else d.isExportAssignment(r)&&d.isIdentifier(r.expression)&&(n.add(r.expression.text),t=r.expression.text)}return{reachableLocals:n,defaultTarget:t}}function Il(e){for(let n of e.statements){if(d.isFunctionDeclaration(n)&&n.name!==void 0&&fn(n)&&d.getModifiers(n)?.some(t=>t.kind===d.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(d.isExportAssignment(n)&&!n.isExportEquals&&d.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ee(t.left)&&d.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function Je(e){if(d.isCallExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&d.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function Ee(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function je(e){if(Ee(e))return!0;if(!d.isPropertyAccessExpression(e)&&!d.isElementAccessExpression(e))return!1;let n=e.expression;return d.isIdentifier(n)&&n.text==="exports"?!0:Ee(n)}function bn(e){return d.isPropertyAccessExpression(e.expression)&&d.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function Jr(e){let n=!1,t=r=>{if(!n){if(d.isCallExpression(r)){let i=Je(r);if(i!==void 0&&pe(i)!=="package-root"){n=!0;return}}d.forEachChild(r,t)}};return t(e),n}function Yr(e){let n=new Set,t=i=>i!==void 0&&Jr(i),r=i=>{d.isVariableDeclaration(i)&&t(i.initializer)&&_n(i.name,n),d.isBinaryExpression(i)&&i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(i.left)&&t(i.right)&&n.add(i.left.text),d.forEachChild(i,r)};return r(e),n}function Qr(e,n){for(let t of e.properties)d.isShorthandPropertyAssignment(t)?n.add(t.name.text):d.isPropertyAssignment(t)&&d.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function _l(e){let n=new Set;for(let a of e.statements)if(d.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(d.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(d.isVariableStatement(a))for(let o of a.declarationList.declarations)d.isIdentifier(o.name)&&o.initializer!==void 0&&(d.isFunctionExpression(o.initializer)||d.isArrowFunction(o.initializer)||d.isObjectLiteralExpression(o.initializer))&&n.add(o.name.text);let t=a=>d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isObjectLiteralExpression(a)||d.isIdentifier(a)&&n.has(a.text),r=new Set,i=a=>{d.isIdentifier(a)?r.add(a.text):d.isObjectLiteralExpression(a)&&Qr(a,r)},s=!1,l=a=>{if(!s){if(d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken)if(Ee(a.left)){i(a.right);let o=a.right;(d.isObjectLiteralExpression(o)?o.properties.every(u=>d.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||d.isPropertyAssignment(u)&&t(u.initializer)):t(o))||(s=!0)}else je(a.left)&&(t(a.right)||(s=!0));else(d.isCallExpression(a)&&bn(a)&&a.arguments[0]!==void 0&&pn(a.arguments[0])||d.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(s=!0);s||d.forEachChild(a,l)}};if(l(e),!s&&r.size>0){for(let a of ts(e))if(r.has(a)){s=!0;break}}return s}function pn(e){return je(e)||d.isIdentifier(e)&&e.text==="exports"}function Zr(e){if(!d.isPropertyAccessExpression(e.expression)||!d.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Jt(e){return Zr(e)&&e.arguments[0]!==void 0&&pn(e.arguments[0])}function Al(e){return Zr(e)&&e.arguments[0]!==void 0&&d.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Nl(e){for(let n of e.declarations??[])if(d.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(d.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Cl(e,n,t,r,i){let s=(e.declarations??[]).filter(a=>!d.isSourceFile(a)&&!d.isModuleDeclaration(a));for(let a of s){let o=a.getSourceFile(),c=n.toRel(o.fileName);if(c===null||i.has(c))continue;let u=t.get(`${c}::${String(a.getStart(o,!1))}`);if(u!==void 0)return u}let l=e.getName();for(let a of s){let o=n.toRel(a.getSourceFile().fileName);if(o===null||i.has(o))continue;let c=r.get(`${o}::${l}`);if(c!==void 0)return c}}function at(e){return d.isPropertyAccessExpression(e)?e.name.text:d.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Yt=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Qt(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?at(e):void 0;return n!==void 0&&n!=="__proto__"&&Yt.test(n)?n:void 0}function Ol(e){return e!=="__proto__"&&Yt.test(e)}function Ur(e){let n=ce(e);return d.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||Ee(n)}function Rl(e){if(!d.isArrayLiteralExpression(e)&&!d.isObjectLiteralExpression(e))return!1;let n=!1,t=r=>{n||(je(r)?n=!0:d.forEachChild(r,t))};return t(e),n}function Zt(e){let n=!1,t=new Map,r=i=>{if(!n){if(d.isBinaryExpression(i)&&i.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(Ee(i.left)||d.isIdentifier(i.left)&&i.left.text==="exports")n=!0;else if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ur(i.right))n=!0;else if(Rl(i.left))n=!0;else if(je(i.left)){let s=Qt(i.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(d.isCallExpression(i)&&bn(i)&&i.arguments[0]!==void 0&&pn(i.arguments[0])||d.isCallExpression(i)&&Jt(i)||d.isCallExpression(i)&&Al(i)||d.isVariableDeclaration(i)&&i.initializer!==void 0&&Ur(i.initializer))&&(n=!0);n||d.forEachChild(i,r)}};return r(e),{surfaceEscapes:n,assignCount:t}}function ei(e){let n=[];for(let t of e.statements){if(!d.isExpressionStatement(t)||!d.isBinaryExpression(t.expression))continue;let r=t.expression;r.operatorToken.kind===d.SyntaxKind.EqualsToken&&(!je(r.left)||Ee(r.left)||n.push({bin:r,name:Qt(r.left)}))}return n}function Ml(e){let{surfaceEscapes:n,assignCount:t}=Zt(e);if(n)return[];let r=[];for(let{bin:i,name:s}of ei(e))s===void 0||(t.get(s)??0)!==1||(d.isFunctionExpression(i.right)||d.isArrowFunction(i.right))&&r.push({name:s,value:i.right});return r}function Ll(e,n){let{surfaceEscapes:t,assignCount:r}=Zt(e);if(t)return[];let i=[];for(let{bin:s,name:l}of ei(e))l===void 0||(r.get(l)??0)!==1||d.isIdentifier(s.right)&&!n.has(s.right.text)&&i.push(s.right.text);return i}function $l(e,n){let{surfaceEscapes:t,assignCount:r}=Zt(e);for(let{bin:i,name:s}of ei(e)){let l=i.right;if(!(d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isIdentifier(l)))continue;let o=d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isIdentifier(l)&&!n.has(l.text);if(!(!t&&s!==void 0&&(r.get(s)??0)===1&&o))return!0}return!1}function Pl(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&d.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function qr(e){let n=e.parent;return n===void 0?!1:d.isPropertyAccessExpression(n)?n.name===e:d.isQualifiedName(n)?n.right===e:d.isBindingElement(n)||d.isImportSpecifier(n)?n.propertyName===e:d.isExportSpecifier(n)?!0:d.isPropertyAssignment(n)||d.isPropertyDeclaration(n)||d.isPropertySignature(n)||d.isMethodDeclaration(n)||d.isMethodSignature(n)||d.isGetAccessorDeclaration(n)||d.isSetAccessorDeclaration(n)||d.isEnumMember(n)?n.name===e:!1}function Vr(e){for(let n=e.parent;n!==void 0;n=n.parent){if(d.isSourceFile(n))return!0;if(!d.isArrowFunction(n)&&(d.isFunctionLike(n)||d.isClassLike(n)))return!1}return!0}function Tl(e,n){let t=r=>{d.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&n.add(r),d.forEachChild(r,t)};t(e)}function Dl(e){let n=[],t=new Set;for(let s of e.statements){if(d.isExportDeclaration(s)||d.isExportAssignment(s)||d.isImportDeclaration(s)||d.isImportEqualsDeclaration(s)||fn(s))return null;if(!d.isExpressionStatement(s)||!d.isBinaryExpression(s.expression))continue;let l=s.expression;if(l.operatorToken.kind===d.SyntaxKind.EqualsToken){if(Ee(l.left))n.push({kind:"whole",value:l.right});else if(je(l.left)){let a=Qt(l.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:l.right,root:Pl(l.left)})}else continue;Tl(l.left,t)}}let r=!1,i=s=>{if(!r){if(d.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!qr(s)){r=!0;return}if(s.kind===d.SyntaxKind.ThisKeyword&&Vr(s)){r=!0;return}if(d.isIdentifier(s)&&s.text==="arguments"&&!qr(s)&&Vr(s)){r=!0;return}d.forEachChild(s,i)}};return i(e),r?null:n}function Xt(e){return d.isIdentifier(e)||d.isStringLiteralLike(e)?e.text:void 0}function Hr(e,n,t){return d.isIdentifier(e)?n(e.text):t?.(e)}function Fl(e,n,t,r){let i=new Map,s=Dl(e);if(s===null||s.filter(h=>h.kind==="whole").length>1)return i;let l=s.findIndex(h=>h.kind==="whole"),a=(h,k)=>l>=0&&k>l&&h.kind==="member"&&h.root==="exports",o=s.some(a);if(o){let h=s[l];if(h===void 0||h.kind!=="whole"||!d.isObjectLiteralExpression(h.value))return i}let c=o?s.filter((h,k)=>!a(h,k)):s,u=new Map;for(let h of c)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let f=h=>n.has(h)?void 0:t(h),m=(h,k)=>{k===void 0?i.delete(h):i.set(h,k)};for(let h of c){if(h.kind==="member"){m(h.name,(u.get(h.name)??0)>1?void 0:Hr(h.value,f,r));continue}i.clear();let k=h.value;if(d.isObjectLiteralExpression(k))for(let E of k.properties){if(d.isSpreadAssignment(E))return new Map;if(d.isShorthandPropertyAssignment(E)){m(E.name.text,f(E.name.text));continue}let S=Xt(E.name);if(S===void 0)return new Map;m(S,d.isPropertyAssignment(E)?Hr(E.initializer,f,r):void 0)}}return i}function es(e,n,t,r){let i=new Map,s=a=>a!==void 0&&pe(a)==="relative"?t.get(`${n}::${a}`):void 0,l=a=>{if(d.isVariableDeclaration(a)&&a.initializer!==void 0){let o=a.initializer;if(d.isIdentifier(a.name)&&!r.has(a.name.text)){let c=s(Je(o));if(c!==void 0)i.set(a.name.text,{kind:"whole",target:c});else if((d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o))&&d.isCallExpression(o.expression)){let u=s(Je(o.expression)),f=at(o);u!==void 0&&f!==void 0&&i.set(a.name.text,{kind:"member",target:u,member:f})}}else if(d.isObjectBindingPattern(a.name)){let c=s(Je(o));if(c!==void 0){for(let u of a.name.elements)if(d.isIdentifier(u.name)&&!r.has(u.name.text)){let f=u.propertyName!==void 0&&d.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;i.set(u.name.text,{kind:"member",target:c,member:f})}}}}d.forEachChild(a,l)};return l(e),i}function Kl(e,n,t,r){let i=l=>l!==void 0&&pe(l)==="relative"?t.get(`${n}::${l}`):void 0,s=i(Je(e));if(s!==void 0)return{kind:"whole",target:s};if(d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)){let l=at(e);if(l===void 0)return;let a=i(Je(e.expression));if(a!==void 0)return{kind:"member",target:a,member:l};if(d.isIdentifier(e.expression)){let o=r.get(e.expression.text);if(o?.kind==="whole")return{kind:"member",target:o.target,member:l}}return}if(d.isIdentifier(e))return r.get(e.text)}function ns(e,n,t,r,i){let s=[],l=!1,a=f=>{if(Jr(f))return!0;let m=!1,h=k=>{m||(d.isIdentifier(k)&&i.has(k.text)?m=!0:d.forEachChild(k,h))};return h(f),m},o=(f,m)=>{let h=Kl(f,n,t,r);h!==void 0?s.push({source:h,exportedName:m}):a(f)&&(l=!0)},c=f=>{if(d.isObjectLiteralExpression(f)){for(let m of f.properties)if(d.isSpreadAssignment(m))o(m.expression,"default");else if(d.isPropertyAssignment(m)){let h=d.isIdentifier(m.name)||d.isStringLiteralLike(m.name)?m.name.text:"default";o(m.initializer,h)}else if(d.isShorthandPropertyAssignment(m)){let h=r.get(m.name.text);h!==void 0&&s.push({source:h,exportedName:m.name.text})}return}o(f,"default")},u=f=>{if(d.isBinaryExpression(f)&&f.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(Ee(f.left)){c(f.right);return}if(je(f.left)){let m=d.isPropertyAccessExpression(f.left)?f.left.name.text:d.isElementAccessExpression(f.left)&&d.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";o(f.right,m);return}}else if(d.isExportAssignment(f)&&f.isExportEquals){o(f.expression,"default");return}else if(d.isCallExpression(f)&&bn(f)&&f.arguments[0]!==void 0&&pn(f.arguments[0])){for(let m of f.arguments.slice(1))c(m);return}d.forEachChild(f,u)};return u(e),{sources:s,residual:l}}function ts(e){let n=new Set,t=i=>{let s=i;for(;d.isPropertyAccessExpression(s)||d.isElementAccessExpression(s);)s=s.expression;return d.isIdentifier(s)?s.text:void 0},r=i=>{let s=is(i);if(s!==void 0){let l=t(s);l!==void 0&&n.add(l)}d.forEachChild(i,r)};return r(e),n}function is(e){return d.isBinaryExpression(e)&&e.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=d.SyntaxKind.LastAssignment&&(d.isPropertyAccessExpression(e.left)||d.isElementAccessExpression(e.left))?e.left:void 0}function st(e){if(d.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)d.isBindingElement(t)&&n.push(...st(t.name));return n}function ke(e){if(d.isIdentifier(e))return[e.text];if(d.isParenthesizedExpression(e)||d.isAsExpression(e)||d.isNonNullExpression(e)||d.isSatisfiesExpression(e)||d.isTypeAssertionExpression(e)||d.isAwaitExpression(e))return ke(e.expression);if(d.isYieldExpression(e))return e.expression!==void 0?ke(e.expression):[];if(d.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===d.SyntaxKind.BarBarToken||n===d.SyntaxKind.AmpersandAmpersandToken||n===d.SyntaxKind.QuestionQuestionToken?[...ke(e.left),...ke(e.right)]:n===d.SyntaxKind.CommaToken?ke(e.right):[]}return d.isConditionalExpression(e)?[...ke(e.whenTrue),...ke(e.whenFalse)]:d.isArrayLiteralExpression(e)?e.elements.flatMap(n=>d.isSpreadElement(n)?ke(n.expression):d.isOmittedExpression(n)?[]:ke(n)):d.isObjectLiteralExpression(e)?e.properties.flatMap(n=>d.isShorthandPropertyAssignment(n)?[n.name.text]:d.isPropertyAssignment(n)?ke(n.initializer):d.isSpreadAssignment(n)?ke(n.expression):[]):[]}function rs(e,n){let t=[],r=(a,o)=>{for(let c of a)for(let u of o)c!==u&&t.push({a:c,b:u})},i=a=>d.isIdentifier(a)?[a.text]:d.isArrayLiteralExpression(a)?a.elements.flatMap(i):d.isObjectLiteralExpression(a)?a.properties.flatMap(o=>d.isShorthandPropertyAssignment(o)?[o.name.text]:d.isPropertyAssignment(o)?i(o.initializer):[]):[],s=a=>{d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken?r(i(a.left),ke(a.right)):d.isVariableDeclaration(a)&&a.initializer!==void 0?r(st(a.name),ke(a.initializer)):(d.isForOfStatement(a)||d.isForInStatement(a))&&d.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&r(st(a.initializer.declarations[0].name),ke(a.expression)),d.forEachChild(a,s)};s(e);let l=new Set(n);for(let a=!0;a;){a=!1;for(let{a:o,b:c}of t)l.has(o)&&!l.has(c)&&(l.add(c),a=!0),l.has(c)&&!l.has(o)&&(l.add(o),a=!0)}return l}function ss(e,n){let t=a=>{if(!d.isPropertyAccessExpression(a)&&!d.isElementAccessExpression(a))return;let o=a;for(;d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o);)o=o.expression;return d.isIdentifier(o)?o.text:void 0},r=[],i=(a,o)=>{for(let u of ke(o))r.push({name:a,root:u});let c=t(o);c!==void 0&&r.push({name:a,root:c})},s=a=>{d.isVariableDeclaration(a)&&d.isIdentifier(a.name)&&a.initializer!==void 0?i(a.name.text,a.initializer):d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(a.left)&&i(a.left.text,a.right),d.forEachChild(a,s)};s(e);let l=new Map(n);for(let a=!0;a;){a=!1;for(let{name:o,root:c}of r){let u=l.get(c);u!==void 0&&!l.has(o)&&(l.set(o,u),a=!0)}}return l}function os(e){return rs(e,ts(e))}function jl(e,n){let t=o=>o>=d.SyntaxKind.FirstAssignment&&o<=d.SyntaxKind.LastAssignment,r=o=>{let c=o.parent;if(c===void 0||!d.isObjectLiteralExpression(c))return!1;let u=c.parent;return u!==void 0&&d.isBinaryExpression(u)&&u.operatorToken.kind===d.SyntaxKind.EqualsToken&&u.right===c&&je(u.left)?!0:u!==void 0&&d.isCallExpression(u)&&bn(u)&&u.arguments[0]!==void 0&&pn(u.arguments[0])&&u.arguments.indexOf(c)>0},i=(o,c)=>{if((d.isFunctionDeclaration(c)||d.isFunctionExpression(c))&&c.name===o||d.isVariableDeclaration(c)&&c.name===o||d.isParameter(c)&&c.name===o||d.isBindingElement(c)&&c.name===o||(d.isCallExpression(c)||d.isNewExpression(c))&&c.expression===o)return!0;if((d.isPropertyAccessExpression(c)||d.isElementAccessExpression(c))&&c.expression===o){let u=c;for(;u.parent!==void 0&&(d.isPropertyAccessExpression(u.parent)||d.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let f=u.parent;return!(f!==void 0&&d.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===u)}return d.isBinaryExpression(c)&&c.operatorToken.kind===d.SyntaxKind.EqualsToken&&c.right===o&&je(c.left)?!0:d.isShorthandPropertyAssignment(c)&&c.name===o||d.isPropertyAssignment(c)&&c.initializer===o?r(c):!!(d.isExportAssignment(c)&&c.expression===o||d.isExportSpecifier(c))},s=(o,c)=>d.isPropertyAccessExpression(c)&&c.name===o||d.isPropertyAssignment(c)&&c.name===o||(d.isMethodDeclaration(c)||d.isGetAccessorDeclaration(c)||d.isSetAccessorDeclaration(c))&&c.name===o,l=!1,a=(o,c)=>{if(!l){if(d.isIdentifier(o)&&c!==void 0&&n.has(o.text)&&!s(o,c)&&!i(o,c)){l=!0;return}d.forEachChild(o,u=>a(u,o))}};return a(e,void 0),l}function Bl(e){let n=new Set;for(let o of e.statements)if(d.isFunctionDeclaration(o)&&o.name!==void 0)n.add(o.name.text);else if(d.isVariableStatement(o))for(let c of o.declarationList.declarations)d.isIdentifier(c.name)&&c.initializer!==void 0&&(d.isFunctionExpression(c.initializer)||d.isArrowFunction(c.initializer))&&n.add(c.name.text);let t=new Set,r=o=>{d.isBinaryExpression(o)&&o.operatorToken.kind===d.SyntaxKind.EqualsToken?(Ee(o.left)&&(d.isIdentifier(o.right)?t.add(o.right.text):d.isObjectLiteralExpression(o.right)&&Qr(o.right,t)),Ee(o.right)&&d.isIdentifier(o.left)&&t.add(o.left.text)):d.isVariableDeclaration(o)&&d.isIdentifier(o.name)&&o.initializer!==void 0&&Ee(o.initializer)&&t.add(o.name.text),d.forEachChild(o,r)};if(r(e),t.size>0){if(jl(e,t))return!0;let o=ss(e,new Map([...t].map(u=>[u,u]))),c=os(e);for(let u of o.keys())if(c.has(u))return!0}let i=o=>d.isIdentifier(o)&&n.has(o.text),s=o=>o.properties.every(c=>d.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||d.isPropertyAssignment(c)&&i(c.initializer)),l=!1,a=o=>{if(!l){if(d.isBinaryExpression(o)){let c=o.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=d.SyntaxKind.LastAssignment;c&&Ee(o.left)?o.operatorToken.kind===d.SyntaxKind.EqualsToken&&(i(o.right)||d.isObjectLiteralExpression(o.right)&&s(o.right))||(l=!0):c&&je(o.left)&&(l=!0)}else d.isCallExpression(o)?(bn(o)&&o.arguments[0]!==void 0&&pn(o.arguments[0])||Jt(o))&&(l=!0):(d.isExportAssignment(o)&&o.isExportEquals&&!d.isIdentifier(o.expression)||d.isExportDeclaration(o)&&o.moduleSpecifier!==void 0)&&(l=!0);l||d.forEachChild(o,a)}};return a(e),l}var zl=8;function Wr(e,n,t){let r=new Set,i=es(e,n,t,xn(e)),s=ns(e,n,t,i,Yr(e));for(let{source:l}of s.sources)r.add(l.target);for(let l of e.statements)if(d.isExportDeclaration(l)&&l.moduleSpecifier!==void 0&&d.isStringLiteralLike(l.moduleSpecifier)&&pe(l.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${l.moduleSpecifier.text}`);a!==void 0&&r.add(a)}return r}function Ul(e,n,t,r=new Map){let i=new Set(n.modules.filter(y=>y.isEntrypoint).map(y=>String(y.id)));if(i.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(y=>y.externalSurface===!0).map(y=>String(y.id))),l=new Map,a=new Map,o=new Map,c=new Map;for(let y of t){if(y.name==="<toplevel>"){c.set(String(y.moduleId),y);continue}if(l.set(`${String(y.moduleId)}::${String(y.declRange.start)}`,y),y.name!==void 0&&a.set(`${String(y.moduleId)}::${y.name}`,y),y.isExported&&y.name!==void 0){let p=o.get(String(y.moduleId))??[];p.push(y),o.set(String(y.moduleId),p)}}if(r.size>0){let y=new Map(t.map(p=>[String(p.id),p]));for(let[p,x]of r){let N=y.get(String(x));N!==void 0&&!l.has(p)&&l.set(p,N)}}let u=new Map;for(let y of n.imports)y.resolvedModuleId!==void 0&&u.set(`${y.moduleId}::${y.specifier}`,String(y.resolvedModuleId));let f=new Map;for(let y of e.sourceFiles){let p=e.toRel(y.fileName);p!==null&&f.set(p,y)}let m=new Map,h=y=>{let p=m.get(y);if(p!==void 0)return p;let x=f.get(y),N=x===void 0?!0:Bl(x);return m.set(y,N),N},k=new Set,E=(y,p)=>p!==void 0&&pe(p)==="relative"?u.get(`${y}::${p}`):void 0,S=y=>{if(d.isIdentifier(y))return y.text;if(d.isPropertyAccessExpression(y)){let p=S(y.expression);return p===void 0?void 0:`${p}.${y.name.text}`}if(d.isElementAccessExpression(y)&&d.isStringLiteralLike(y.argumentExpression)){let p=S(y.expression);return p===void 0?void 0:`${p}.${y.argumentExpression.text}`}},w=y=>{let p=y;for(;d.isPropertyAccessExpression(p)||d.isElementAccessExpression(p);)p=p.expression;return Je(p)};for(let y of e.sourceFiles){let p=e.toRel(y.fileName);if(p===null)continue;let x=new Map,N=new Map,D=(_,M)=>{let T=E(p,Je(M));if(T!==void 0){if(d.isIdentifier(_))N.set(_.text,T),x.set(_.text,T);else if(d.isObjectBindingPattern(_)||d.isArrayBindingPattern(_))for(let O of st(_))N.set(O,T);else if(d.isPropertyAccessExpression(_)||d.isElementAccessExpression(_)){let O=S(_);O!==void 0&&x.set(O,T)}}},B=_=>{d.isVariableDeclaration(_)&&_.initializer!==void 0?D(_.name,_.initializer):d.isBinaryExpression(_)&&_.operatorToken.kind===d.SyntaxKind.EqualsToken&&D(_.left,_.right),d.forEachChild(_,B)};B(y);let F=_=>{let M=is(_);if(M!==void 0){let T=M.expression,O=E(p,w(T));O!==void 0&&k.add(O);let K=S(T),W=K!==void 0?x.get(K):void 0;W!==void 0&&k.add(W)}d.forEachChild(_,F)};if(F(y),N.size>0){let _=ss(y,N),M=os(y);for(let[T,O]of _)M.has(T)&&k.add(O)}}let A=[],R=[],v=[];for(let y of e.sourceFiles){let p=e.toRel(y.fileName);if(p===null||!i.has(p))continue;let x=e.checker.getSymbolAtLocation(y),N=new Set,D=new Set,B=0,F=(j,V)=>{if(s.has(String(j.moduleId))||N.has(String(j.id)))return;N.add(String(j.id));let ie=`${p}#reexport:${String(B)}:${V}`;B+=1,A.push({id:ie,moduleId:p,exportedName:V,kind:"value",reexportOf:{moduleId:String(j.moduleId),name:j.name??V}}),R.push({exportId:ie,target:{kind:"function",functionId:j.id}})},_=j=>{if(Nl(j))return;let V=j;if((j.flags&d.SymbolFlags.Alias)!==0)try{V=e.checker.getAliasedSymbol(j)}catch{return}let ie=Cl(V,e,l,a,s);if(ie!==void 0){F(ie,j.getName());return}if((V.flags&d.SymbolFlags.Module)!==0&&!D.has(V)){D.add(V);try{for(let we of e.checker.getExportsOfModule(V))_(we)}catch{}}};if(x!==void 0)for(let j of e.checker.getExportsOfModule(x))_(j);let M=es(y,p,u,xn(y)),T=ns(y,p,u,M,Yr(y)),O=new Set,K=T.residual,W=j=>{let V=f.get(j);j.includes("node_modules/")||V===void 0||_l(V)?K=!0:O.add(j)};for(let{source:j,exportedName:V}of T.sources){let ie=o.get(j.target)??[],we=k.has(j.target);if(j.kind==="whole"){for(let ge of ie)F(ge,ge.name??V);we?K=!0:(ie.length===0||h(j.target))&&W(j.target)}else{let ge=ie.filter(ve=>ve.name===j.member);for(let ve of ge)F(ve,V);we?K=!0:(ge.length===0||h(j.target))&&W(j.target)}}let J=new Set,Z=[];for(let j of Wr(y,p,u))Z.push({target:j,depth:1});for(;Z.length>0;){let j=Z.shift();if(j===void 0)break;let{target:V,depth:ie}=j;if(J.has(V)||ie>zl||(J.add(V),V.split("/").includes("node_modules")))continue;let we=f.get(V);if(we===void 0)continue;let ge=c.get(V);ge!==void 0&&!h(V)&&F(ge,"<load>");for(let ve of Wr(we,V,u))J.has(ve)||Z.push({target:ve,depth:ie+1})}$l(y,xn(y))&&(K=!0);for(let j of O)v.push({code:"unresolved-reexport",path:p,detail:`entrypoint whole/member re-exports app-owned relative module ${j} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:j});K&&v.push({code:"unresolved-reexport",path:p,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:A,exportBindings:R,diagnostics:v}}var Sn=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),ql=new Set(["defineProperty","defineProperties","create"]);function Vl(e){let n=!0,t=i=>d.isIdentifier(i)||d.isStringLiteral(i)||d.isNumericLiteral(i)?Sn.has(i.text):d.isComputedPropertyName(i)&&d.isStringLiteralLike(i.expression)?Sn.has(i.expression.text):!1,r=i=>{if(n){if(d.isNewExpression(i)||d.isForOfStatement(i)||d.isSpreadElement(i)||d.isSpreadAssignment(i)||d.isArrayBindingPattern(i)||d.isGetAccessorDeclaration(i)||d.isSetAccessorDeclaration(i)||d.isYieldExpression(i)&&i.asteriskToken!==void 0||d.canHaveDecorators(i)&&(d.getDecorators(i)?.length??0)>0){n=!1;return}if((d.isPropertyAccessExpression(i)||d.isMethodDeclaration(i)||d.isPropertyAssignment(i))&&t(i.name)||d.isPropertyDeclaration(i)&&t(i.name)||d.isShorthandPropertyAssignment(i)&&t(i.name)||d.isBindingElement(i)&&t(i.propertyName??i.name)||d.isElementAccessExpression(i)&&d.isStringLiteralLike(i.argumentExpression)&&Sn.has(i.argumentExpression.text)){n=!1;return}if(d.isCallExpression(i)&&d.isPropertyAccessExpression(i.expression)&&d.isIdentifier(i.expression.expression)&&i.expression.expression.text==="Object"&&ql.has(i.expression.name.text)){n=!1;return}d.forEachChild(i,r)}};return r(e),n}function lt(e){if(d.isIdentifier(e)||d.isStringLiteral(e)||d.isNumericLiteral(e))return e.text}function as(e){let n=t=>d.canHaveDecorators(t)&&(d.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Hl(e){let n=!1,t=new Set,r=[],i=new Map,s=(m,h)=>{let k=i.get(m);k===void 0?i.set(m,[h]):k.push(h)},l=m=>{d.isIdentifier(m)?t.add(m.text):r.push(m)},a=m=>{for(let h of m.properties)d.isShorthandPropertyAssignment(h)?t.add(h.name.text):d.isPropertyAssignment(h)?r.push(h.initializer):n=!0},o=m=>{if(d.isBinaryExpression(m)&&m.operatorToken.kind===d.SyntaxKind.EqualsToken){let h=m.left,k=m.right;Ee(h)?d.isObjectLiteralExpression(k)?a(k):d.isIdentifier(k)||d.isFunctionExpression(k)||d.isArrowFunction(k)||d.isClassExpression(k)?l(k):n=!0:je(h)?(d.isElementAccessExpression(h)&&!d.isStringLiteralLike(h.argumentExpression)&&(n=!0),l(k)):d.isIdentifier(h)?s(h.text,k):(d.isPropertyAccessExpression(h)||d.isElementAccessExpression(h))&&d.isIdentifier(h.expression)&&s(h.expression.text,k)}else if(d.isCallExpression(m))(bn(m)&&m.arguments[0]!==void 0&&pn(m.arguments[0])||Jt(m))&&(n=!0);else if(d.isVariableDeclaration(m)&&d.isIdentifier(m.name)&&m.initializer!==void 0)s(m.name.text,m.initializer);else if((d.isFunctionDeclaration(m)||d.isClassDeclaration(m))&&m.name!==void 0)s(m.name.text,m),fn(m)&&t.add(m.name.text);else if(d.isExportDeclaration(m)){if(m.exportClause===void 0)n=!0;else if(m.moduleSpecifier===void 0&&d.isNamedExports(m.exportClause))for(let h of m.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(d.isExportAssignment(m))m.isExportEquals&&!d.isIdentifier(m.expression)?n=!0:l(m.expression);else if(d.isVariableStatement(m)&&fn(m))for(let h of m.declarationList.declarations)d.isIdentifier(h.name)&&t.add(h.name.text);d.forEachChild(m,o)};o(e);let c=new Set,u=[...t],f=m=>{let h=k=>{d.isIdentifier(k)&&u.push(k.text),d.forEachChild(k,h)};h(m)};for(let m of r)f(m);for(;u.length>0;){let m=u.pop();if(!(m===void 0||c.has(m))){c.add(m);for(let h of i.get(m)??[])f(h)}}return{names:c,opaque:n}}var Wl=512,Xl=new Set(["get","post","put","patch","delete","options","head"]);function Gl(e){for(let n of e.statements){if(d.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(n.expression.left)&&d.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,r=n.expression.left.name.text;if(t==="module"&&r==="exports"||t==="exports"&&r==="default")return n.expression.right}}return null}function Jl(e){let n=new Map,t=Gl(e);if(t===null)return n;let r=s=>{for(let l of s.properties)if(d.isPropertyAssignment(l)&&d.isObjectLiteralExpression(l.initializer)){let a=lt(l.name);a!==void 0&&n.set(a,l.initializer)}};if(d.isObjectLiteralExpression(t))return r(t),n;if(!d.isIdentifier(t))return n;let i=t.text;for(let s of e.statements)if(d.isVariableStatement(s))for(let l of s.declarationList.declarations)d.isIdentifier(l.name)&&l.name.text===i&&l.initializer!==void 0&&d.isObjectLiteralExpression(l.initializer)&&r(l.initializer);else if(d.isExpressionStatement(s)&&d.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(s.expression.left)&&d.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===i&&d.isObjectLiteralExpression(s.expression.right)){let l=s.expression.left.name.text;n.set(l,s.expression.right)}return n}function Yl(e){for(let n of e.properties){if(d.isMethodDeclaration(n)&&d.isIdentifier(n.name)&&n.name.text==="handler")return n;if(d.isPropertyAssignment(n)&&d.isIdentifier(n.name)&&n.name.text==="handler"&&(d.isArrowFunction(n.initializer)||d.isFunctionExpression(n.initializer)))return n.initializer}return null}function Ql(e,n){for(let r of e.properties){let i;if(d.isPropertyAssignment(r)||d.isMethodDeclaration(r)?i=lt(r.name):d.isShorthandPropertyAssignment(r)&&(i=r.name.text),i==="method"||i==="url"||i==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Zl(e,n){let t=[],r=new Set,i=(a,o,c)=>{if(t.length>=Wl||a==="__proto__"||!Yt.test(a))return;let u=`${e}#handler:${a}`;r.has(u)||(r.add(u),t.push({id:u,node:o,memberPath:a,idiom:c}))};for(let[a,o]of Jl(n)){let c=Yl(o);c!==null&&Ql(o,c)&&i(a,c,"descriptor-object")}let s=0,l=a=>{if(d.isCallExpression(a)&&d.isPropertyAccessExpression(a.expression)&&d.isIdentifier(a.expression.expression)&&Xl.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&d.isStringLiteralLike(a.arguments[0])){let o=a.expression.name.text;for(let c=1;c<a.arguments.length;c+=1){let u=a.arguments[c];u!==void 0&&(d.isArrowFunction(u)||d.isFunctionExpression(u))&&i(`${o}_${String(s)}_${String(c)}`,u,"router-verb")}s+=1}d.forEachChild(a,l)};return l(n),t}function ed(e,n,t,r,i,s){let l=`${e}#class:${t}`,a=[],o=new Set;for(let c of r.members){let u,f,m;if(d.isConstructorDeclaration(c))u="constructor",f="ctor",m=!1;else if(d.isMethodDeclaration(c))u=lt(c.name),f="method",m=u!==void 0&&!Sn.has(u);else continue;if(u===void 0||o.has(u))continue;o.add(u);let h=`${e}#${t}.${u}`;i.push({id:h,moduleId:e,name:u,kind:f,enclosingClassId:l,declRange:rn(e,c,n),isExported:!1,publicSurfaceReachable:!1}),a.push(h),m&&s.push({start:c.getStart(n,!1),end:c.getEnd(),id:h})}return{id:l,moduleId:e,name:t,implementsRefs:[],members:a}}function nd(e,n,t=[],r=!1,i){let s=[],l=new Map,a=[],{reachableLocals:o,defaultTarget:c}=vl(n),u=xn(n),f=`${e}#<toplevel>`;s.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let m=(p,x)=>{let N=`${e}#${p}`;return s.push({id:N,moduleId:e,name:p,kind:"function",declRange:rn(e,x,n),isExported:o.has(p),publicSurfaceReachable:o.has(p)}),l.set(p,{kind:"function",functionId:N}),a.push({start:x.getStart(n,!1),end:x.getEnd(),id:N}),N},h=[],k=!e.split("/").includes("node_modules");if(k)for(let p of Ll(n,u))o.add(p);let E=k?Hl(n):void 0,S=(p,x,N)=>{E===void 0||E.opaque||E.names.has(p)||fn(N)||as(x)||h.push(ed(e,n,p,x,s,a))};for(let p of n.statements)if(d.isFunctionDeclaration(p)&&p.name!==void 0)m(p.name.text,p);else if(d.isClassDeclaration(p)&&p.name!==void 0)S(p.name.text,p,p);else if(d.isVariableStatement(p))for(let x of p.declarationList.declarations){if(d.isObjectBindingPattern(x.name)&&x.initializer!==void 0&&d.isCallExpression(x.initializer)&&d.isIdentifier(x.initializer.expression)&&x.initializer.expression.text==="require"&&x.initializer.arguments.length===1&&x.initializer.arguments[0]!==void 0&&d.isStringLiteralLike(x.initializer.arguments[0])){let D=x.initializer.arguments[0].text;for(let B of x.name.elements){if(B.dotDotDotToken!==void 0||B.initializer!==void 0||!d.isIdentifier(B.name))continue;let F=B.propertyName??B.name;!d.isIdentifier(F)&&!d.isStringLiteralLike(F)||l.set(B.name.text,{kind:"import",specifier:D,form:{named:F.text}})}continue}if(!d.isIdentifier(x.name)||x.initializer===void 0)continue;let N=x.initializer;if(d.isFunctionExpression(N)||d.isArrowFunction(N))m(x.name.text,x);else if(d.isClassExpression(N))S(x.name.text,N,p);else if(d.isCallExpression(N)&&d.isIdentifier(N.expression)&&N.expression.text==="require"&&N.arguments.length===1&&N.arguments[0]!==void 0&&d.isStringLiteralLike(N.arguments[0]))l.set(x.name.text,{kind:"import",specifier:N.arguments[0].text,form:"whole"});else if((d.isPropertyAccessExpression(N)||d.isElementAccessExpression(N))&&at(N)==="default"&&d.isCallExpression(N.expression)){let D=Je(N.expression);D!==void 0&&l.set(x.name.text,{kind:"import",specifier:D,form:"require-default"})}}else if(d.isImportDeclaration(p)&&d.isStringLiteralLike(p.moduleSpecifier)){let x=p.moduleSpecifier.text,N=p.importClause;if(N!==void 0){N.name!==void 0&&l.set(N.name.text,{kind:"import",specifier:x,form:"default"});let D=N.namedBindings;if(D!==void 0&&d.isNamespaceImport(D))l.set(D.name.text,{kind:"import",specifier:x,form:"namespace"});else if(D!==void 0&&d.isNamedImports(D))for(let B of D.elements){let F=(B.propertyName??B.name).text;l.set(B.name.text,{kind:"import",specifier:x,form:{named:F}})}}}else d.isImportEqualsDeclaration(p)&&d.isExternalModuleReference(p.moduleReference)&&d.isStringLiteralLike(p.moduleReference.expression)&&l.set(p.name.text,{kind:"import",specifier:p.moduleReference.expression.text,form:"whole"});let w=new Map,A,R=new Map,v=new Map;if(k)for(let{name:p,value:x}of Ml(n)){let N=`${e}#member-export:${p}`;s.push({id:N,moduleId:e,name:p,kind:d.isArrowFunction(x)?"arrow":"function",declRange:rn(e,x,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:x.getStart(n,!1),end:x.getEnd(),id:N}),w.set(x.getStart(n,!1),N)}if(r&&k){let p=F=>{let _=Ne(F);return d.isFunctionExpression(_)||d.isArrowFunction(_)?_:void 0},x=(F,_)=>{let M=F;return s.push({id:M,moduleId:e,kind:d.isArrowFunction(_)?"arrow":"function",declRange:rn(e,_,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:_.getStart(n,!1),end:_.getEnd(),id:M}),w.set(_.getStart(n,!1),M),M},N=[],D=[],B=[];for(let F of n.statements)d.isExportAssignment(F)&&!F.isExportEquals?N.push(F):d.isFunctionDeclaration(F)&&d.getModifiers(F)?.some(_=>_.kind===d.SyntaxKind.DefaultKeyword)===!0?D.push(F):d.isExpressionStatement(F)&&d.isBinaryExpression(F.expression)&&F.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ee(F.expression.left)&&B.push(F.expression);if(N.length+D.length+B.length===1){let F=N[0],_=D[0],M=B[0];if(F!==void 0){let T=p(F.expression);if(T!==void 0){let O=x(`${e}#<default>`,T);A={id:O,esm:!0},v.set(F.getStart(n,!1),O),ne(i,"2a-default",null)}}else if(_!==void 0&&_.name===void 0&&_.body!==void 0){let T=x(`${e}#<default>`,_);A={id:T,esm:!0},v.set(_.getStart(n,!1),T),ne(i,"2a-default",null)}else if(M!==void 0){let T=p(M.right);if(T!==void 0){let O=x(`${e}#<default>`,T);A={id:O,esm:!1},v.set(M.getStart(n,!1),O),ne(i,"2a-default",null)}else if(d.isObjectLiteralExpression(M.right)){let O=M.right,K=[],W=!0;for(let J of O.properties){if(d.isSpreadAssignment(J)){W=!1;break}let Z=J.name,j=Z===void 0?void 0:Xt(Z);if(j===void 0){W=!1;break}K.push(j)}if(W){let J=new Map;for(let Z of K)J.set(Z,(J.get(Z)??0)+1);for(let Z of O.properties){if(!d.isPropertyAssignment(Z))continue;let j=Xt(Z.name),V=p(Z.initializer);if(j!==void 0){if(!Ol(j)){V!==void 0&&ne(i,"2a-member","charset-refused");continue}if((J.get(j)??0)!==1){V!==void 0&&ne(i,"2a-member","duplicate-key");continue}if(V!==void 0){let ie=x(`${e}#<cjs>.${j}`,V);R.set(j,ie),v.set(Z.getStart(n,!1),ie),ne(i,"2a-member",null)}}}}else for(let J of O.properties)d.isPropertyAssignment(J)&&p(J.initializer)!==void 0&&ne(i,"2a-member","spread-or-computed-literal")}}}else{for(let F of N)p(F.expression)!==void 0&&ne(i,"2a-default","duplicate-default-sources");for(let F of D)F.name===void 0&&ne(i,"2a-default","duplicate-default-sources");for(let F of B)if(p(F.right)!==void 0)ne(i,"2a-default","duplicate-default-sources");else if(d.isObjectLiteralExpression(F.right))for(let _ of F.right.properties)d.isPropertyAssignment(_)&&p(_.initializer)!==void 0&&ne(i,"2a-member","duplicate-default-sources")}}for(let p of t)s.push({id:p.id,moduleId:e,name:`handler:${p.memberPath}`,kind:d.isArrowFunction(p.node)?"arrow":"function",declRange:rn(e,p.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:p.node.getStart(n,!1),end:p.node.getEnd(),id:p.id});a.sort((p,x)=>p.end-p.start-(x.end-x.start));let y=c!==void 0?`${e}#${c}`:void 0;return{rel:e,sf:n,functions:s,bindings:l,exportedFunctionId:y,exportedNames:o,tainted:u,fnRanges:a,toplevelId:f,classes:h,mintedByPos:w,mintedDefault:A,mintedMembers:R,mintSeedAliases:v}}function td(e){return d.isIdentifier(e)?"identifier":d.isPropertyAccessExpression(e)?"member":d.isElementAccessExpression(e)?"computed-member":e.kind===d.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function Xr(e,n){let t=r=>{if(d.isBinaryExpression(r)&&r.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=d.SyntaxKind.LastAssignment){let i=r.left;d.isPropertyAccessExpression(i)&&d.isIdentifier(i.expression)?n(i.expression.text,i.name.text):d.isElementAccessExpression(i)&&d.isIdentifier(i.expression)&&n(i.expression.text,d.isStringLiteralLike(i.argumentExpression)?i.argumentExpression.text:null)}else if(d.isCallExpression(r)&&d.isPropertyAccessExpression(r.expression)){let i=r.expression,s=r.arguments[0];d.isIdentifier(i.expression)&&s!==void 0&&d.isIdentifier(s)&&(i.expression.text==="Object"&&(i.name.text==="assign"||i.name.text==="defineProperty"||i.name.text==="defineProperties")||i.expression.text==="Reflect"&&i.name.text==="defineProperty")&&n(s.text,null)}d.forEachChild(r,t)};t(e)}function id(e){let n=!1,t=r=>{if(!n){if(d.isVariableDeclaration(r)||d.isParameter(r)){let i=new Set;if(_n(r.name,i),i.has("require")){n=!0;return}}else if((d.isFunctionDeclaration(r)||d.isClassDeclaration(r))&&r.name!==void 0&&r.name.text==="require"){n=!0;return}d.forEachChild(r,t)}};return t(e),n}function rd(e,n,t,r=new Map,i={}){let s=i.additiveForms===!0,l=i.namelessExports===!0,a=s||l?{}:void 0,o=new Map,c=new Map;for(let p of n.imports)p.resolvedModuleId!==void 0&&c.set(`${p.moduleId}::${p.specifier}`,p.resolvedModuleId);for(let p of e.sourceFiles){let x=e.toRel(p.fileName);x!==null&&o.set(x,nd(x,p,r.get(x)??[],l,a))}let u=new Map;if(s)for(let p of o.values()){let x=new Map;for(let[N,D]of p.bindings)if(D.kind==="import"&&D.form==="whole"&&pe(D.specifier)!=="package-root"){let B=c.get(`${p.rel}::${D.specifier}`);B!==void 0&&x.set(N,String(B))}x.size!==0&&Xr(p.sf,(N,D)=>{let B=x.get(N);if(B===void 0)return;let F=u.get(B);if(F!=="*"){if(D===null){u.set(B,"*");return}F===void 0?u.set(B,new Set([D])):F.add(D)}})}let f=new Map;for(let p of o.values())p.exportedFunctionId!==void 0&&f.set(p.rel,p.exportedFunctionId);let m=new Map;for(let p of o.values()){if(p.rel.split("/").includes("node_modules"))continue;let x=Il(p.sf);if(x===void 0){l&&p.mintedDefault!==void 0&&m.set(p.rel,p.mintedDefault);continue}let N=p.bindings.get(x.name);N?.kind==="function"&&m.set(p.rel,{id:N.functionId,esm:x.esm})}let h=new Map;for(let p of o.values()){let x;for(let N of p.exportedNames){let D=p.bindings.get(N);D?.kind==="function"&&(x??=new Map,x.set(N,D.functionId))}x!==void 0&&h.set(p.rel,x)}let k=new Map;for(let p of o.values()){if(p.rel.split("/").includes("node_modules"))continue;let x=Fl(p.sf,p.tainted,N=>{let D=p.bindings.get(N);return D?.kind==="function"?D.functionId:void 0},l?N=>{let D=Ne(N);return d.isFunctionExpression(D)||d.isArrowFunction(D)?p.mintedByPos.get(D.getStart(p.sf,!1)):void 0}:void 0);x.size>0&&k.set(p.rel,x)}let E=[],S=[],w=[],A=[],R=[],v=[];for(let p of o.values()){E.push(...p.functions),v.push(...p.classes);for(let b of p.exportedNames){let I=p.bindings.get(b);if(I?.kind==="function"){let C=`${p.rel}#export:${b}`;A.push({id:C,moduleId:p.rel,exportedName:b,kind:"value"}),R.push({exportId:C,target:{kind:"function",functionId:I.functionId}})}}if(l){if(p.mintedDefault!==void 0){let b=`${p.rel}#export:<default>`;A.push({id:b,moduleId:p.rel,exportedName:"default",kind:"value"}),R.push({exportId:b,target:{kind:"function",functionId:p.mintedDefault.id}})}for(let[b,I]of p.mintedMembers){let C=`${p.rel}#export:<cjs>.${b}`;A.push({id:C,moduleId:p.rel,exportedName:b,kind:"value"}),R.push({exportId:C,target:{kind:"function",functionId:I}})}}let x=new Map;for(let[b,I]of p.bindings){if(I.kind==="function"){x.set(b,I);continue}if(pe(I.specifier)==="package-root"){let L=Ye(I.specifier);typeof I.form=="object"?x.set(b,{kind:"package-export",packageName:L,exportName:I.form.named}):I.form==="require-default"?x.set(b,{kind:"package-default",packageName:L}):x.set(b,{kind:"package-surface",packageName:L})}else{let L=c.get(`${p.rel}::${I.specifier}`);if(L!==void 0&&typeof I.form=="object"){let G=h.get(String(L))?.get(I.form.named);G!==void 0&&x.set(b,{kind:"app-named-fn",functionId:G})}else if(L!==void 0&&I.form==="require-default"){let G=m.get(String(L));G!==void 0&&G.esm&&x.set(b,{kind:"app-default-fn",functionId:G.id})}else L!==void 0&&typeof I.form!="object"&&I.form!=="require-default"&&x.set(b,{kind:"module",resolvedModuleId:L})}}let N=new Map;for(let b of p.functions){if(b.enclosingClassId===void 0||b.name===void 0)continue;let I=N.get(b.enclosingClassId);I===void 0&&(I=new Map,N.set(b.enclosingClassId,I)),I.set(b.name,b.id)}for(let b of p.classes)b.name===void 0||p.tainted.has(b.name)||x.has(b.name)||x.set(b.name,{kind:"app-class",cls:{classId:b.id,className:b.name,memberIds:N.get(b.id)??new Map}});let D=b=>{if(d.isVariableDeclaration(b)&&d.isIdentifier(b.name)&&b.initializer!==void 0&&d.isNewExpression(b.initializer)&&!p.tainted.has(b.name.text)&&!x.has(b.name.text)){let I=zr(b.initializer,x,p.tainted);I!==null&&x.set(b.name.text,I)}d.forEachChild(b,D)};D(p.sf);let B=b=>{for(let I of p.fnRanges)if(b>=I.start&&b<I.end)return I.id;return p.toplevelId},F=new Map,_=new Map,M=new Map,T=(b,I,C)=>{if(C===null){b.set(I,"*");return}let L=b.get(I);L!=="*"&&(L===void 0?b.set(I,new Set([C])):L.add(C))},O=(b,I)=>{T(F,b,I);let C=x.get(b);C?.kind==="package-surface"?T(_,C.packageName,I):C?.kind==="module"&&T(M,String(C.resolvedModuleId),I)};Xr(p.sf,O);let K=new Map,W=256,J=b=>{let I=K.get(b);return I===void 0&&(I=K.size>=W?new Set([b]):rs(p.sf,new Set([b])),K.set(b,I)),I},Z=(b,I)=>b==="*"||b!==void 0&&b.has(I),j=(b,I)=>{let C=x.get(b);if(C?.kind==="package-surface"&&Z(_.get(C.packageName),I)||C?.kind==="module"&&Z(M.get(String(C.resolvedModuleId)),I))return!0;for(let L of J(b))if(Z(F.get(L),I))return!0;return!1},V=b=>{if(d.isIdentifier(b)){let I=p.tainted.has(b.text)?void 0:x.get(b.text);return I?.kind==="function"?I.functionId:I?.kind==="module"?f.get(String(I.resolvedModuleId))??null:I?.kind==="package-export"?t.exportFor(I.packageName,I.exportName):null}if(d.isPropertyAccessExpression(b)&&d.isIdentifier(b.expression)){let I=b.expression.text;if(j(I,b.name.text))return null;let C=p.tainted.has(I)?void 0:x.get(I);return C?.kind==="package-surface"?t.exportFor(C.packageName,b.name.text):C?.kind==="package-export"?t.methodFor(C.packageName,C.exportName,b.name.text,"method"):C?.kind==="package-instance"?t.methodFor(C.packageName,C.className,b.name.text,"method"):null}return null},ie=b=>{for(let I=b.parent;I!==void 0;I=I.parent)if(!d.isArrowFunction(I)){if(d.isFunctionExpression(I)||d.isFunctionDeclaration(I))return null;if(d.isMethodDeclaration(I)||d.isConstructorDeclaration(I)||d.isGetAccessorDeclaration(I)||d.isSetAccessorDeclaration(I)){let C=I.parent;if(!d.isClassLike(C)||C.name===void 0)return null;let L=p.tainted.has(C.name.text)?void 0:x.get(C.name.text);return L?.kind==="app-class"?L.cls:null}}return null},we=s&&!p.tainted.has("require")&&!id(p.sf),ge=b=>{if(d.isIdentifier(b)){let L=p.tainted.has(b.text)?void 0:x.get(b.text);return L?.kind==="package-surface"||L?.kind==="package-default"?t.exportFor(L.packageName,"default"):L?.kind==="app-named-fn"||L?.kind==="app-default-fn"?L.functionId:L?.kind==="module"?m.get(String(L.resolvedModuleId))?.id??null:L?.kind==="member-value"?L.functionId:null}if(!d.isPropertyAccessExpression(b))return null;let I=b.expression;if(s&&d.isCallExpression(Ne(I))){let L=Je(Ne(I));if(L!==void 0)if(!we)ne(a,"2b","require-shadow");else if(pe(L)==="package-root")ne(a,"2b","package-root");else{let G=c.get(`${p.rel}::${L}`);if(G===void 0)ne(a,"2b","unresolved-module");else{let se=b.name.text,re=u.get(String(G));if(re==="*"||re!==void 0&&re.has(se))ne(a,"2b","module-mutation-gate");else{let Re=k.get(String(G))?.get(se);if(Re!==void 0)return ne(a,"2b",null),Re;if(se==="default"){let Ie=m.get(String(G));if(Ie!==void 0&&Ie.esm)return ne(a,"2b",null),Ie.id;ne(a,"2b","non-esm-default")}else ne(a,"2b","unknown-member")}}}return null}let C;if(d.isIdentifier(I)){let L=p.tainted.has(I.text)?void 0:x.get(I.text);if(L?.kind==="app-class"||L?.kind==="app-instance")C=L.cls.memberIds;else if(L?.kind==="object-literal")C=L.obj.members;else if(L?.kind==="module"){let G=k.get(String(L.resolvedModuleId));G?.has(b.name.text)===!0&&!j(I.text,b.name.text)&&(C=G)}}else if(d.isNewExpression(I)){let L=zr(I,x,p.tainted);L?.kind==="app-instance"&&(C=L.cls.memberIds)}else I.kind===d.SyntaxKind.ThisKeyword&&(C=ie(b)?.memberIds);return C?.get(b.name.text)??null},ve=new Map,U=b=>{if(d.isVariableDeclaration(b)&&d.isIdentifier(b.name)&&b.initializer!==void 0&&d.isObjectLiteralExpression(b.initializer)&&!p.tainted.has(b.name.text)&&!x.has(b.name.text)&&!ve.has(b.name.text)){let I=new Map;for(let C of b.initializer.properties)if(d.isPropertyAssignment(C)&&d.isIdentifier(C.name)){let L=V(C.initializer);L!==null&&I.set(C.name.text,L)}ve.set(b.name.text,I)}d.forEachChild(b,U)};U(p.sf);let ue=b=>{if(d.isBinaryExpression(b)&&b.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(b.left)&&d.isIdentifier(b.left.expression)&&!p.tainted.has(b.left.expression.text)){let I=ve.get(b.left.expression.text);if(I!==void 0){let C=V(b.right);C!==null&&I.set(b.left.name.text,C)}}d.forEachChild(b,ue)};ue(p.sf);for(let[b,I]of ve)x.set(b,{kind:"object-literal",obj:{members:I}});let ye=(b,I=0)=>{if(I>jr)return null;let C=Ne(b);if(d.isCallExpression(C)&&d.isPropertyAccessExpression(C.expression)&&C.expression.name.text==="bind")return ye(C.expression.expression,I+1);if(d.isIdentifier(C)){let L=V(C);if(L!==null)return L;let G=p.tainted.has(C.text)?void 0:x.get(C.text);return G?.kind==="member-value"?G.functionId:null}return d.isPropertyAccessExpression(C)?V(C)??ge(C):null},ae=(b,I=0)=>{if(I>jr)return"depth-cap";let C=Ne(b);if(d.isCallExpression(C)&&d.isPropertyAccessExpression(C.expression)&&C.expression.name.text==="bind")return ae(C.expression.expression,I+1);if(d.isIdentifier(C))return p.tainted.has(C.text)?"tainted-receiver":"unresolved-receiver";if(d.isPropertyAccessExpression(C)&&d.isIdentifier(C.expression)){if(p.tainted.has(C.expression.text))return"tainted-receiver";if(j(C.expression.text,C.name.text))return"mutated-member"}return"unresolved-receiver"},Oe=b=>{if(d.isVariableDeclaration(b)&&d.isIdentifier(b.name)&&b.initializer!==void 0){let I=Ne(b.initializer),C=d.isPropertyAccessExpression(I),L=d.isCallExpression(I)&&d.isPropertyAccessExpression(I.expression)&&I.expression.name.text==="bind";if(C||L){let G=C?"D1":"A2";if(p.tainted.has(b.name.text))ne(a,G,"tainted-alias");else if(x.has(b.name.text))ne(a,G,"already-bound");else{let se=ye(I);se!==null?(x.set(b.name.text,{kind:"member-value",functionId:se}),ne(a,G,null)):ne(a,G,ae(I))}}}d.forEachChild(b,Oe)};s&&Oe(p.sf);let Y=0,Pe=b=>{let I,C;if(d.isCallExpression(b)){let L=b.expression,G=d.isIdentifier(L)&&L.text==="require",se=L.kind===d.SyntaxKind.ImportKeyword;!G&&!se&&(I=L,C=b.arguments)}else d.isTaggedTemplateExpression(b)&&(I=b.tag);if(I!==void 0){let L=td(I),G=b.getStart(p.sf,!1),se=`${p.rel}#call${String(Y)}`;Y+=1;let re="unresolved",Re=[],Ie=V(I);Ie!==null&&(re="resolved",Re.push(Ie)),S.push({id:se,enclosingFunctionId:B(G),calleeExprShape:L,resolvedTargetIds:Re,resolution:re,range:rn(p.rel,b,p.sf)});for(let xe of Re)w.push({callSiteId:se,calleeFunctionId:xe,resolution:re});if(Ie===null){let xe=ge(I);if(xe!==null)w.push({callSiteId:se,calleeFunctionId:xe,resolution:"field-based"});else if(s&&d.isPropertyAccessExpression(I)&&(I.name.text==="call"||I.name.text==="apply")){let Ke=ye(I.expression);Ke!==null?(w.push({callSiteId:se,calleeFunctionId:Ke,resolution:"field-based"}),ne(a,"A3",null)):ne(a,"A3",ae(I.expression))}}for(let xe of C??[]){let Ke=V(xe);if(Ke!==null)w.push({callSiteId:se,calleeFunctionId:Ke,resolution:"field-based"});else{let q=ge(xe);if(q!==null)w.push({callSiteId:se,calleeFunctionId:q,resolution:"field-based"});else if(s){let P=ye(xe),H=Ne(xe),_e=H!==xe||d.isCallExpression(H)&&d.isPropertyAccessExpression(H.expression)&&H.expression.name.text==="bind";P!==null?(w.push({callSiteId:se,calleeFunctionId:P,resolution:"field-based"}),_e&&ne(a,"A2p",null)):_e&&ne(a,"A2p",ae(xe))}}}}d.forEachChild(b,Pe)};Pe(p.sf);for(let b of n.computedLoads.get(p.rel)??[]){let I=b.candidateRels.filter(L=>o.has(L)).map(L=>`${L}#<toplevel>`);if(I.length===0)continue;let C=`${p.rel}#dirload${String(Y)}`;Y+=1,S.push({id:C,enclosingFunctionId:B(b.pos),calleeExprShape:"require",resolvedTargetIds:I,resolution:"field-based",range:{path:p.rel,start:b.pos,end:b.pos}});for(let L of I)w.push({callSiteId:C,calleeFunctionId:L,resolution:"field-based"})}let Te=0;for(let b of r.get(p.rel)??[]){let I=`${p.rel}#handlerseed${String(Te)}`;Te+=1;let C=b.node.getStart(p.sf,!1);S.push({id:I,enclosingFunctionId:p.toplevelId,calleeExprShape:"member",resolvedTargetIds:[b.id],resolution:"field-based",range:{path:p.rel,start:C,end:C}}),w.push({callSiteId:I,calleeFunctionId:b.id,resolution:"field-based"})}}let y=new Map;if(l)for(let p of o.values())for(let[x,N]of p.mintSeedAliases)y.set(`${p.rel}::${String(x)}`,N);return{functions:E,callSites:S,callEdges:w,exports:A,exportBindings:R,classes:v,mintSeedAliases:y,bindingApplicability:a}}function sd(e,n,t){let r=o=>o.length===0||Ce.isAbsolute(o)||o.includes("\\")||/^[a-zA-Z]:/u.test(o)||o.split("/").some(c=>c===".."||c==="");if(r(n)||r(t))return null;let i=e.endsWith(Ce.sep)?e:e+Ce.sep,s;try{s=Kr(Ce.resolve(e,n))}catch{return null}if(!s.startsWith(i))return null;let l=s.endsWith(Ce.sep)?s:s+Ce.sep,a;try{a=Kr(Ce.resolve(s,t))}catch{return null}return a.startsWith(l)?a:null}function ls(e,n,t){let r=`${e}#class:${t}`,i=[],s=[],l=[],a=new Set;return{pushMember(o,c,u,f){if(o==="__proto__"||a.has(o))return;a.add(o);let m=`${e}#${t}.${o}`;i.push({id:m,moduleId:e,name:o,kind:u,enclosingClassId:r,declRange:rn(e,c,n),isExported:!1,publicSurfaceReachable:!1}),l.push(m),s.push({name:o,id:m,kind:u,body:f})},finish(){return s.length===0?null:{functions:i,classNode:{id:r,moduleId:e,name:t,implementsRefs:[],members:l},members:s}}}}function od(e,n,t,r){if(as(r)||r.members.length>Gt)return null;let i=ls(e,n,t);for(let s of r.members){let l,a,o;if(d.isConstructorDeclaration(s))l="constructor",a="ctor",o=void 0;else if(d.isMethodDeclaration(s))l=lt(s.name),a="method",o=l!==void 0&&!Sn.has(l)?s.body??void 0:void 0;else continue;l!==void 0&&i.pushMember(l,s,a,o)}return i.finish()}function ad(e,n,t){let r;for(let l of n.statements)if(d.isFunctionDeclaration(l)&&l.name?.text===t){r=l;break}if(r===void 0)return null;let i=[];for(let l of n.statements){if(!d.isExpressionStatement(l))continue;let a=l.expression;if(!d.isBinaryExpression(a)||a.operatorToken.kind!==d.SyntaxKind.EqualsToken)continue;let o=a.left;if(d.isPropertyAccessExpression(o)&&d.isPropertyAccessExpression(o.expression)&&d.isIdentifier(o.expression.expression)&&o.expression.expression.text===t&&o.expression.name.text==="prototype"){let c=o.name.text;d.isFunctionExpression(a.right)?i.push({name:c,fn:a.right,walk:!0}):d.isArrowFunction(a.right)&&i.push({name:c,fn:a.right,walk:!1})}}if(i.length===0||i.length+1>Gt)return null;let s=ls(e,n,t);s.pushMember("constructor",r,"ctor",void 0);for(let l of i){let a=l.walk&&!Sn.has(l.name)&&d.isFunctionExpression(l.fn)?l.fn.body:void 0;s.pushMember(l.name,l.fn,"method",a)}return s.finish()}function ld(e,n,t){for(let r of n.statements)if(d.isClassDeclaration(r)&&r.name?.text===t)return od(e,n,t,r);return ad(e,n,t)}function dd(e,n,t,r,i){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let l=new Set(t.map(f=>f.packageName)),a=new Set(t.map(f=>f.path)),o=new Set,c=new Set,u=0;for(let f of n){if(!l.has(f.packageName))continue;let m=sd(e.appRoot,f.packageRootRel,f.sourcePath);if(m===null)continue;let h=e.toRel(m);if(h===null)continue;let k=`${h}#${f.container}`;if(c.has(k)||!o.has(h)&&o.size>=ot)continue;let E=De(m);if(E===null)continue;let S;try{S=d.createSourceFile(h,E,d.ScriptTarget.Latest,!0,d.ScriptKind.JS)}catch{continue}let w=ld(h,S,f.container);if(w===null)continue;o.add(h),c.add(k);let A=new Map,R=new Map;for(let y of w.members){let p=i.methodFor(f.packageName,f.container,y.name,y.kind);A.set(y.name,p),R.set(p,y.id)}let v=0;for(let y of w.members){if(y.body===void 0)continue;let p=(x,N)=>{if(N&&d.isCallExpression(x)&&d.isPropertyAccessExpression(x.expression)&&x.expression.expression.kind===d.SyntaxKind.ThisKeyword){let F=A.get(x.expression.name.text);if(F!==void 0){let _=`${h}#depclass:${f.container}.${y.name}#c${String(v)}`;v+=1,s.callSites.push({id:_,enclosingFunctionId:y.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:rn(h,x,S)}),s.callEdges.push({callSiteId:_,calleeFunctionId:F,resolution:"field-based"})}}let D=d.isFunctionExpression(x)||d.isFunctionDeclaration(x)||d.isMethodDeclaration(x)||d.isConstructorDeclaration(x)||d.isGetAccessorDeclaration(x)||d.isSetAccessorDeclaration(x)||d.isClassLike(x),B=d.isArrowFunction(x)?N:D?!1:N;d.forEachChild(x,F=>{p(F,B)})};p(y.body,!0)}for(let y of r){let p=R.get(y.calleeFunctionId);p!==void 0&&s.callEdges.push({callSiteId:y.callSiteId,calleeFunctionId:p,resolution:"field-based"})}if(s.functions.push(...w.functions),s.classes.push(w.classNode),!a.has(h)){a.add(h),s.modules.push({id:h,packageName:f.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let y=i.moduleFor(f.packageName),p=`${String(y)}#depclass${String(u)}`;u+=1,s.imports.push({id:p,moduleId:y,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),s.importEdges.push({importId:p,resolvedModuleId:h})}s.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(w.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return s}function cd(e,n,t,r){let i=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.packageName)),s=new Map(e.functions.map(o=>[o.id,o.moduleId])),l=new Map;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let c=s.get(o.enclosingFunctionId);c!==void 0&&l.set(c,(l.get(c)??0)+1)}let a=[];for(let o of e.modules){if(o.externalSurface===!0)continue;let c=n.get(o.path);if(c===void 0||t.has(o.path)||i.has(o.packageName)&&r.has(o.path)&&!o.path.split("/").includes("node_modules"))continue;let u=l.get(o.id)??0;if(u===0&&Vl(c))continue;let f=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:o.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:o.id})}return a}function ds(e,n,t=[],r={},i=!1){let s=new Wt,l=bl(e,n,s),a=new Set;for(let v of l.computedLoads.values())for(let y of v)if(y.seedable)for(let p of y.candidateRels)a.add(p);let o=new Map;for(let v of e.sourceFiles){let y=e.toRel(v.fileName);if(y===null||!a.has(y)||y.split("/").includes("node_modules"))continue;let p=Zl(y,v);p.length>0&&o.set(y,p)}let c=o.size===0?l.modules:l.modules.map(v=>o.has(v.path)&&!v.isEntrypoint?{...v,isEntrypoint:!0}:v),u={...l,modules:c},f=rd(e,u,s,o,r),m=Ul(e,l,f.functions,f.mintSeedAliases),h=new Set(l.modules.map(v=>v.path)),k=wl(e.depReach,s,h),E=[...u.modules,...k.modules,...s.modules()],S=dd(e,t,E,f.callEdges,s),w=[];if(i){let v="#default",y=new Set;for(let x of f.callEdges){let N=String(x.calleeFunctionId);!N.startsWith("pkg:")||!N.endsWith(v)||y.add(N.slice(4,N.length-v.length))}let p=new Map;for(let x of e.depReach.edges){if(!("surface"in x.from)||"surface"in x.to)continue;let N=x.from.surface;p.set(N,p.has(N)?null:x.to.module)}for(let x of y){let N=p.get(x);if(N==null)continue;let D=kl(Ce.join(e.appRoot,N));if(D===null||D==="default")continue;let B=s.exportFor(x,D),F=`pkg:${x}${v}`;for(let _ of f.callEdges)String(_.calleeFunctionId)===F&&w.push({callSiteId:_.callSiteId,calleeFunctionId:B,resolution:"field-based"})}}let A={modules:[...u.modules,...k.modules,...S.modules,...s.modules()],exports:[...f.exports,...m.exports],imports:[...l.imports,...k.imports,...S.imports],functions:[...f.functions,...s.functions(),...S.functions],callSites:[...f.callSites,...S.callSites],classes:[...f.classes,...s.classes(),...S.classes],callEdges:[...f.callEdges,...S.callEdges,...w],importEdges:[...l.importEdges,...k.importEdges,...S.importEdges],exportBindings:[...f.exportBindings,...m.exportBindings],inheritEdges:[]},R=new Map;for(let v of e.sourceFiles){let y=e.toRel(v.fileName);y!==null&&R.set(y,v)}return{graph:A,diagnostics:[...m.diagnostics,...S.diagnostics,...cd(A,R,new Set(e.diagnostics.filter(v=>v.code==="dependency-body").map(v=>v.path)),l.appOwnedPaths)],...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var ud=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,dt=/^[A-Za-z0-9_$.-]{1,128}$/u;function fd(e){return ud.test(e.calleePackage)?dt.test(e.anchorExport)?dt.test(e.calleeExport)?e.anchorContainer!==null&&!dt.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!dt.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Rn(e,n){let t=[],r=[],i=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.classes.map(c=>[c.id,c.name])),l=(c,u,f)=>e.functions.some(m=>{if(m.name!==u)return!1;let h=i.get(m.moduleId);return h===void 0||h.packageName!==c?!1:(m.enclosingClassId!==void 0?s.get(m.enclosingClassId)??null:null)===f}),a=(c,u,f)=>{for(let m of e.functions){if(m.name!==u)continue;let h=i.get(m.moduleId);if(!(h===void 0||h.packageName!==c||(m.enclosingClassId!==void 0?s.get(m.enclosingClassId)??null:null)!==f))return m.id}return null},o=[...n].sort((c,u)=>c.modelId<u.modelId?-1:c.modelId>u.modelId?1:0);for(let c of o){if(c.edges.length>64){t.push(`model ${c.modelId}: ${String(c.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=c.edges.map(fd).find(h=>h!==null);if(u!==void 0){t.push(`model ${c.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let f=0,m=0;for(let h of c.edges){if(!l(c.packageName,h.anchorExport,h.anchorContainer)){m+=1;continue}r.push({modelId:c.modelId,kind:h.kind,anchor:{packageName:c.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:a(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${c.modelId}: ${String(f)} edge(s) lowered, ${String(m)} reference-gated`):t.push(`model ${c.modelId}: refused \u2014 no anchor surface in the graph (${String(m)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:r,notes:t}}}var pd={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function ti(e){try{let n=Tr(e.appRoot,e.entrypoints,e.tsconfigPaths===!0,e.assumedBounded===!0),t=new Set(e.entrypoints.map(l=>l.split(en.sep).join("/"))),{graph:r,diagnostics:i,bindingApplicability:s}=ds(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:r,diagnostics:[...n.diagnostics,...i],...s!==void 0?{bindingApplicability:s}:{}}}catch(n){return{graph:pd,diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function cs(e,n){let t=512,r=(i,s)=>{if(!(t<=0||s>12)){if(t-=1,typeof i=="string"){n(i);return}if(Array.isArray(i)){for(let l of i)r(l,s+1);return}if(i!==null&&typeof i=="object")for(let[l,a]of Object.entries(i))l==="types"||l==="typings"||r(a,s+1)}};r(e,0)}function ms(e,n,t,r=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let i;try{i=Mn(en.resolve(e,t))}catch{return null}return i!==e&&!i.startsWith(n)||r&&!Ve(i)?null:i===e?"":i.slice(n.length).split(en.sep).join("/")}function hs(e){let n=Mn(e),t=n.endsWith(en.sep)?n:n+en.sep,r=new Set,i=[],s=[],l=[],a=(v,y,p=!1)=>{let x=ms(n,t,v);return x===null||x.length===0?"unresolved":r.has(x)?"duplicate":(r.add(x),i.push(x),s.push({source:y,specifier:Ge(typeof v=="string"?v:""),entrypoint:x,launch:p}),"added")},o=[],c=(v,y)=>{l.push({source:v,file:v,detail:y.detail}),o.push({code:y.code,path:v,detail:`${v} ${y.detail}`})},u,f,m,h=us(n,t,"package.json",nn);h.kind==="refused"&&c("package.json",h);try{let v=h.kind==="ok"?JSON.parse(h.text):{};if(a(v.main,"main"),typeof v.bin=="string")a(v.bin,"bin");else if(v.bin!==null&&typeof v.bin=="object")for(let p of Object.values(v.bin))a(p,"bin");cs(v.exports,p=>{a(p,"exports")}),cs(v.browser,p=>{a(p,"browser")});let y=v.scripts;if(y!==null&&typeof y=="object"){let p=y;u=p.start,f=p.prestart,m=p.poststart}}catch{}if(i.length===0)try{Mn(en.join(n,"index.js")),a("index.js","index.js fallback")}catch{}let k=(v,y)=>typeof v=="string"&&v.trim().length>0?fs(v,y,"package.json",a,l,!1)==="used"?"resolved":"gapped":v===void 0||typeof v=="string"?"absent":(l.push({source:y,file:"package.json",detail:`${y} is not a string; no entry file could be read from it`}),"gapped"),E=k(u,"scripts.start"),S=k(f,"scripts.prestart"),w=k(m,"scripts.poststart"),A=E==="resolved"&&S!=="gapped"&&w!=="gapped",R=us(n,t,"Procfile",65536);if(R.kind==="refused")c("Procfile",R);else if(R.kind==="ok"){let{entries:v,truncated:y,unnamedLines:p}=Ht(R.text);y&&l.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),p>0&&l.push({source:"Procfile",file:"Procfile",detail:`${String(p)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let x of v)fs(x.command,`Procfile:${x.name}`,"Procfile",a,l,A)}return{entrypoints:i,sources:s,gaps:l,diagnostics:o}}function us(e,n,t,r){let i;try{i=Mn(en.join(e,t))}catch{return{kind:"absent"}}if(!i.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=yn(i,r);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(r)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function fs(e,n,t,r,i,s){let l=Vt(e);return l.kind==="delegates"?s?"used":(i.push({source:n,file:t,detail:`\`${Ge(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped"):l.kind==="unparsed"?(i.push({source:n,file:t,detail:`\`${Ge(e)}\`: ${l.reason}`}),"gapped"):r(l.specifier,n,!0)==="unresolved"?(i.push({source:n,file:t,detail:`\`${Ge(l.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function ii(e,n){if(n.length===0||!e.some(r=>r.launch))return[];let t=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${t}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function gs(e,n){let t=Mn(e),r=t.endsWith(en.sep)?t:t+en.sep,i=new Set,s=[],l=[];for(let a of n){let o=ms(t,r,a,!0);if(o===null||o.length===0){l.push(a);continue}i.has(o)||(i.add(o),s.push(o))}return{entrypoints:s,rejected:l}}import{readdirSync as _s,readFileSync as li,realpathSync as di,statSync as Tn}from"node:fs";import ze from"node:path";function md(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let r=t+2;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;let i=e.charCodeAt(r);return i===38||i===42}function Ln(e,n,t){let r=n.maxLines??2e6,i=n.maxLineBytes??16384,s=!1,l=!1,a=0,o=0,c=e.charCodeAt(0)===65279?1:0;for(;c<=e.length;){let u=e.indexOf(`
+`,c),f=u===-1;f&&(u=e.length);let m=u>c&&e.charCodeAt(u-1)===13?u-1:u;if(o+=1,o>r){s=!0;break}if(m-c>i)a+=1;else{let h=c;for(;h<m&&e.charCodeAt(h)===32;)h+=1;let k=h-c,E=m;for(;E>h&&(e.charCodeAt(E-1)===32||e.charCodeAt(E-1)===9);)E-=1;if(h<E&&e.charCodeAt(h)!==35){let S=e.slice(h,E);if(md(S)){l=!0;break}t(k,S)}}if(f)break;c=u+1}return{truncated:s||a>0,refusedAnchors:l,oversizeLines:a}}function ct(e){let n=e.charCodeAt(0);if(n===34||n===39){let r=e.indexOf(String.fromCharCode(n),1);if(r===-1)return null;let i=r+1;for(;i<e.length&&e.charCodeAt(i)===32;)i+=1;return e.charCodeAt(i)===58?e.slice(0,r+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function kn(e){return e.endsWith(":")}function Be(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function ut(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,r=t.indexOf("/");if(n){if(r<=0||t.indexOf("/",r+1)!==-1)return!1}else if(r!==-1)return!1;let i=n?[t.slice(0,r),t.slice(r+1)]:[t];for(let s of i){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let l=0;l<s.length;l+=1){let a=s.charCodeAt(l);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function $n(e){return ut(e)?`node_modules/${e}`:""}function Pn(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var ys=2e5,xs=64,hd=1024,gd=5,yd=[1,2,3];function xd(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let r=e.slice(t+n.length);if(r==="")return null;let i=r.split("/");return i[0]?.startsWith("@")?i.length>=2?`${i[0]}/${i[1]}`:null:i[0]??null}function Ss(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let r=t.indexOf("@",1);if(r>0){let i=t.slice(0,r),s=t.slice(r+1);if(i.length>0&&s.length>0)return[{name:i,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function En(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function bs(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function ks(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Es(e,n,t,r,i=!1){let s=JSON.stringify([n,t,r]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:r,dev:i})}}function Sd(e,n){for(let[t,r]of Object.entries(e)){if(t==="")continue;if(!ks(n))return;let i=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=En(r);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let l=s.name,a=typeof l=="string"&&l!==""?l:xd(t),o=s.version;if(a===null||typeof o!="string"){i&&(n.unread+=1);continue}let c=s.dev===!0||s.devOptional===!0;for(let u of Ss(a,o))Es(n,u.name,u.version,t,c)}}function ws(e,n,t){let r=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],i=!1;for(let s=0;s<r.length;s+=1){let l=r[s];if(l===void 0)break;for(let[a,o]of Object.entries(l.deps)){if(!ks(n))return{depthCapped:i};if(a===""){n.unread+=1;continue}let c=En(o);if(c===null){n.unread+=1;continue}let u=l.pathSafe&&ut(a),f=u?`${l.prefix}node_modules/${a}`:"",m=u&&f.length<=hd,h=m?f:"",k=c.version,E=c.dev===!0||l.dev;if(c.link!==!0&&typeof k=="string"&&k!=="")for(let w of Ss(a,k))Es(n,w.name,w.version,h,E);else n.unread+=1;let S=En(c.dependencies);if(S!==null){if(l.depth+1>t){i=!0;continue}r.push({deps:S,prefix:m?`${h}/`:l.prefix,depth:l.depth+1,pathSafe:m,dev:E})}}}return{depthCapped:i}}function bd(e,n,t){let r=bs(n.maxEntries),{depthCapped:i}=ws(e,r,t),s=[],l=new Set(n.deps.map(c=>JSON.stringify([c.name,c.version]))),a=new Set,o=[];for(let c of r.deps){if(c.version.includes(":"))continue;let u=JSON.stringify([c.name,c.version]);l.has(u)||a.has(u)||(a.add(u),o.length<gd&&o.push(Pn(c.name,c.version)))}if(a.size>0){let c=a.size-o.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${o.join(", ")}${c>0?`, and ${String(c)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(r.capped||i)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function ft(e,n={}){let t=[],r;try{r=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let i=En(r);if(i===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=i.lockfileVersion,l=typeof s=="number"&&Number.isInteger(s)?s:null,a=typeof s=="number"?String(s):"?",o=En(i.packages),c=En(i.dependencies);if(o===null&&c===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(l===null||!yd.includes(l))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??xs,f=bs(n.maxEntries??ys),m=!1;return o!==null?(Sd(o,f),c!==null&&t.push(...bd(c,f,u))):c!==null&&(m=ws(c,f,u).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),m&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||m}}var kd=["workspace:","link:","portal:","file:","exec:"];function Ed(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function wd(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let r=n.slice(0,t),i=n.slice(t+1);if(r.length===0)return[];for(let a of kd)if(i.startsWith(a))return[];if(!i.startsWith("npm:"))return[r];let s=i.slice(4),l=s.indexOf("@",1);if(l>0){let a=s.slice(0,l);return a.length>0?[a]:[r]}return s.length===0||Ed(s)?[r]:[r,s]}function vd(e){if(kn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let r=e.charCodeAt(t);if(r===34||r===39){n===0?n=r:n===r&&(n=0);continue}if(n===0&&r===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Id(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let r of n.split(",")){let i=r.trim();i.length>0&&t.push(i)}return t}function _d(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let r=t.length;for(;r<n.length&&r<t.length+3;){let s=n.charCodeAt(r);if(s<48||s>57)break;r+=1}let i=n.slice(t.length,r);return i.length>0?i:null}function vs(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Be(e.slice(8).trim());return t.length>0?t:null}function ri(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,l=!1,a=null,o=!1,c=[],u=!1,f=-1,m=!1,h=0,k=()=>{c.length>0&&!u&&(h+=1)},E=Ln(e,n,(R,v)=>{if(R===0){k(),c=[],u=!1,f=-1,o=!1;let p=vd(v);if(p===null)return;let x=Be(p.trim());if(x==="__metadata"){l=!0,o=kn(v);return}for(let N of Id(x))c.push(...wd(N));return}if(o){if(R===2&&a===null){let p=vs(v);p!==null&&(a=p)}return}if(c.length===0||(f===-1&&(f=R),R!==f||u))return;let y=vs(v);if(y!==null){u=!0;for(let p of c){let x=JSON.stringify([p,y]);if(!i.has(x)){if(r.length>=s){m=!0;return}i.add(x),r.push({name:p,version:y,lockKey:$n(p),dev:!1})}}}});k();let S=l?"yarn.lock (Berry)":"yarn.lock (v1)";if(E.refusedAnchors)return{deps:[],diagnostics:[`${S} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};E.oversizeLines>0&&t.push(`${S} has ${String(E.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),m&&t.push(`${S} exceeds ${String(s)} entries; truncated`);let w=a??_d(e),A=w===null?null:Number(w.split(".")[0]);return w!==null&&(A===null||!Number.isInteger(A)||A<1||A>8)&&t.push(`${S} declares unsupported lockfileVersion ${w} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${S} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:r,diagnostics:t,truncated:E.truncated||m}}function si(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.indexOf("_");return r!==-1&&(n=n.slice(0,r)),n.trim()}function oi(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Is(e){let n=Be(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.charCodeAt(0)===47;if(r&&(n=n.slice(1)),n.length===0)return null;if(!r&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),f=n.indexOf("@",1);u>0&&(f===-1||u<f)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let i=n.charCodeAt(0)===64,s=i?n.indexOf("/"):-1;if(i&&s<=0)return null;let l=i?s+1:0,a=-1;for(let u=l;u<n.length;u+=1){let f=n.charCodeAt(u);if(f===47||f===64){a=u;break}}if(a<=l)return null;let o=n.slice(0,a),c=si(n.slice(a+1));return oi(c)?{name:o,version:c}:null}var Ad=new Set(["packages","snapshots","importers"]),Nd=new Set([5,6,7,8,9]);function Cd(e){let n=Be(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function mt(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Be(e.slice(0,n).trim()),value:Be(t)}}function ai(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,l="",a=null,o=!1,c=0,u=[],f=(h,k)=>{let E=JSON.stringify([h,k]);if(!i.has(E)){if(r.length>=s){o=!0;return}i.add(E),r.push({name:h,version:k,lockKey:$n(h),dev:!1})}},m=Ln(e,n,(h,k)=>{if(h===0){let E=ct(k);if(l=E===null?"":Be(E.trim()),a=null,l==="lockfileVersion"){let S=mt(k),w=S===null?null:Cd(S.value);S!==null&&(w===null||!Nd.has(w))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${S.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),l="";return}if(Ad.has(l)&&!kn(k)){let S=mt(k)?.value.trim()??"";S!=="{}"&&S!=="[]"&&(c+=1),l=""}return}if(l==="packages"||l==="snapshots"){if(h!==2)return;let E=ct(k),S=E===null?null:Is(E);if(S===null){c+=1;return}f(S.name,S.version);return}if(l==="importers"){if(h===6){let E=mt(k);if(E===null){a=k.endsWith(":")?Be(k.slice(0,-1).trim()):null;return}a=null;let S=si(E.value);oi(S)&&f(E.key,S);return}if(h===8&&a!==null){let E=mt(k);if(E===null||E.key!=="version")return;let S=si(E.value);oi(S)&&f(a,S)}}});return m.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),m.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(m.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),o&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),c>0&&t.push(`pnpm-lock.yaml has ${String(c)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:r,diagnostics:t,truncated:m.truncated||o})}var Od=128*1024*1024,Rd=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>ft(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>ft(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>ri(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>ai(e,n===void 0?{}:{maxEntries:n})}],Md=[".pnp.cjs",".pnp.data.json",".pnp.js"];function ci(e,n){let t;try{t=di(ze.join(e,n))}catch{return null}let r=e.endsWith(ze.sep)?e:e+ze.sep;return t.startsWith(r)?t:null}function As(e,n){let t=ze.join(e,"package.json"),r;try{r=di(t)}catch{return null}if(!r.startsWith(n+ze.sep))return null;try{if(!Tn(r).isFile())return null;let i=JSON.parse(li(r,"utf8"));return typeof i.name!="string"||typeof i.version!="string"?null:{name:i.name,version:i.version}}catch{return null}}function Ns(e,n){try{return Tn(ze.join(e,n)),!0}catch{return!1}}function Ld(e,n){if(Ns(e,"pnpm-workspace.yaml"))return!0;let t=ci(e,"package.json");if(t===null)return Ns(e,"package.json");let r;try{let l=Tn(t);if(!l.isFile()||l.size>n)return!0;r=li(t,"utf8")}catch{return!0}let i;try{i=JSON.parse(r)}catch{return!0}for(let l of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=i[l];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let s=i.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function Cs(e,n){let t=ze.join(e,"node_modules"),r=[],i;try{i=_s(t,{withFileTypes:!0})}catch{return r}for(let s of i){let l=s.name;if(l.startsWith("."))continue;if(l.startsWith("@")){let o;try{o=_s(ze.join(t,l),{withFileTypes:!0})}catch{continue}for(let c of o){let u=As(ze.join(t,l,c.name),n);u!==null&&r.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${l}/${c.name}`,linked:c.isSymbolicLink()||s.isSymbolicLink()})}continue}let a=As(ze.join(t,l),n);a!==null&&r.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${l}`,linked:s.isSymbolicLink()})}return r}var $d=5;function Pd(e,n,t){let r=ci(e,n);if(r===null){try{Tn(ze.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let i;try{i=Tn(r)}catch{return null}if(!i.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(i.size>t)return{gap:`${n} is ${String(i.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:li(r,"utf8")}}catch{return{gap:`${n} could not be read`}}}function Os(e,n){let t=di(e),r=[],i=[],s=n?.maxLockfileBytes??Od,l=[],a=new Set,o=[],c=Ld(t,s),u=null,f=!1,m=(k,E,S)=>{i.push({kind:k,detail:E,blindsAnalysis:S}),r.push(E)};for(let k of Rd){let E=Pd(t,k.file,s);if(E===null)continue;if("gap"in E){m("lockfile-unreadable",E.gap,!1);continue}let S=k.parse(E.text,n?.maxLockfileEntries);if(S.truncated&&(f=!0),S.deps.length===0){if(S.diagnostics.length>0||c){let w=S.diagnostics.length>0?S.diagnostics.join("; "):"no entries found";m("lockfile-unparsed",`${k.file} yielded NO dependencies (${w}); its transitive dependency set was not enumerated`,!1)}continue}S.diagnostics.length>0&&m("lockfile-partial",`${k.file} was only partly enumerated (${S.diagnostics.join("; ")})`,!1),u===null&&(u=k.file),o.includes(k.source)||o.push(k.source);for(let w of S.deps){let A=JSON.stringify([w.name,w.version,w.lockKey]);a.has(A)||(a.add(A),l.push(w))}}for(let k of Md)if(ci(t,k)!==null){m("yarn-pnp",`${k} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(l.length>0){let k=o.length===1?o[0]??"none":"multi-lockfile";o.length>1&&r.push(`multiple lockfiles present (${o.join(", ")}); enumerated the UNION of all of them`);let E=new Set(l.map(A=>JSON.stringify([A.name,A.version]))),S=new Set,w=[];for(let A of Cs(t,t)){let R=JSON.stringify([A.name,A.version,A.lockKey]);a.has(R)||(a.add(R),l.push({name:A.name,version:A.version,lockKey:A.lockKey,dev:A.dev}));let v=JSON.stringify([A.name,A.version]);A.linked||E.has(v)||S.has(v)||(S.add(v),w.length<$d&&w.push(Pn(A.name,A.version)))}if(S.size>0){let A=S.size-w.length;m("lockfile-skew",`node_modules holds ${String(S.size)} package(s) at a (name, version) no lockfile lists (${w.join(", ")}${A>0?`, and ${String(A)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:l,source:k,lockfilePath:u,diagnostics:r,truncated:f,gaps:i}}let h=Cs(t,t);return h.length>0?(m("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(k=>({name:k.name,version:k.version,lockKey:k.lockKey,dev:!1})),source:"node-modules",lockfilePath:null,diagnostics:r,truncated:f,gaps:i}):(c&&m("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:r,truncated:f,gaps:i})}import{readdirSync as Td,readFileSync as Dd}from"node:fs";import Fd from"node:path";var Kd=new Set(["summarized","crashed","over-cap"]),jd=new Set(["function","method","ctor"]);function oe(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function ui(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Bd(e,n){ui(e)||oe(n,"edge is not an object");let{entryPath:t,entryExport:r,entryContainer:i,hops:s}=e;(typeof t!="string"||typeof r!="string")&&oe(n,"edge entry fields must be strings"),i!==null&&typeof i!="string"&&oe(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&oe(n,"hops must be a non-negative integer");let l=e.target;if(ui(l)||oe(n,"edge target missing"),l.kind==="symbol"){let{exportName:a,container:o,symbolKind:c}=l;return typeof a!="string"&&oe(n,"symbol target exportName"),o!==null&&typeof o!="string"&&oe(n,"symbol target container"),(typeof c!="string"||!jd.has(c))&&oe(n,`symbol target kind ${JSON.stringify(c)}`),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"symbol",exportName:a,container:o,symbolKind:c},hops:s}}if(l.kind==="dep"){let{calleePackage:a,calleeSubpath:o,calleeExport:c}=l;return(typeof a!="string"||a.length===0)&&oe(n,"dep target calleePackage"),o!==null&&typeof o!="string"&&oe(n,"dep target calleeSubpath"),(typeof c!="string"||c.length===0)&&oe(n,"dep target calleeExport"),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"dep",calleePackage:a,calleeSubpath:o,calleeExport:c},hops:s}}oe(n,`unknown target kind ${JSON.stringify(l.kind)}`)}function zd(e,n){ui(e)||oe(n,"root is not an object");let{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:l,status:a}=e;(typeof t!="string"||t.length===0)&&oe(n,"packageName"),typeof r!="string"&&oe(n,"analyzedVersion"),i!=="jelly"&&oe(n,`tool ${JSON.stringify(i)} (only 'jelly' exists)`),typeof s!="string"&&oe(n,"toolVersion"),typeof l!="number"&&oe(n,"maxIndirections"),(typeof a!="string"||!Kd.has(a))&&oe(n,`status ${JSON.stringify(a)} not in the enum`);let o=e.edges;return Array.isArray(o)||oe(n,"edges is not an array"),a!=="summarized"&&o.length>0&&oe(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:l,status:a,edges:o.map(c=>Bd(c,n))}}function Rs(e){let n=new Map,t=Td(e).filter(r=>r.endsWith(".summary.json"));for(let r of t){let i=Fd.join(e,r),s;try{s=JSON.parse(Dd(i,"utf8"))}catch(o){oe(r,`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}let l=zd(s,r),a=n.get(l.packageName);a===void 0?n.set(l.packageName,[l]):a.push(l)}return n}import{readFileSync as Ud,statSync as qd}from"node:fs";var pi=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,ht=/^[A-Za-z0-9_$.-]{1,128}$/u,Ms=64,Ls=1024*1024,$s=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Ps=/^[A-Za-z0-9@_.-]{1,128}$/u;function le(e){throw new Error(`model claims rejected: ${e}`)}function fi(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Vd(e,n){fi(e)||le(`${n}: edge is not an object`);let{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:l,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&le(`${n}: edge kind`),(typeof r!="string"||!ht.test(r))&&le(`${n}: anchorExport ${JSON.stringify(r)}`),i!==null&&(typeof i!="string"||!ht.test(i))&&le(`${n}: anchorContainer`),(typeof s!="string"||!pi.test(s))&&le(`${n}: calleePackage ${JSON.stringify(s)}`),l!==null&&(typeof l!="string"||!ht.test(l))&&le(`${n}: calleeContainer`),(typeof a!="string"||!ht.test(a))&&le(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:l,calleeExport:a}}function Ts(e){let n=qd(e).size;n>Ls&&le(`file is ${String(n)} bytes, over the ${String(Ls)} cap`);let t;try{t=JSON.parse(Ud(e,"utf8"))}catch(i){le(`unparseable JSON: ${i instanceof Error?i.message:String(i)}`)}Array.isArray(t)||le("root is not an array"),t.length>Ms&&le(`${String(t.length)} claims over cap ${String(Ms)}`);let r=[];for(let i of t){fi(i)||le("claim is not an object");let{packageName:s,modelId:l,range:a,edges:o}=i;(typeof s!="string"||!pi.test(s))&&le("packageName"),(typeof l!="string"||!Ps.test(l))&&le("modelId (identifier charset, 1-128 chars)"),r.some(u=>u.model.modelId===l)&&le(`duplicate modelId ${l} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!fi(a)||typeof a.introduced!="string")&&le(`${l}: range`),$s.test(a.introduced)||le(`${l}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let c=a.fixedBefore;c!==null&&typeof c!="string"&&le(`${l}: fixedBefore`),typeof c=="string"&&!$s.test(c)&&le(`${l}: range.fixedBefore ${JSON.stringify(c)} is not an exact x.y.z triple`),Array.isArray(o)||le(`${l}: edges`),o.length>64&&le(`${l}: ${String(o.length)} edges over cap ${String(64)}`),r.push({model:{packageName:s,modelId:l,edges:o.map(u=>Vd(u,l))},introduced:a.introduced,fixedBefore:c})}return r}var Hd=["in-app-purchase@1-v1"];function mi(e,n,t){let r=[],i=[],s=[],l=(a,o,c,u)=>{i.push(c),s.push({modelId:u??a.model.modelId,status:o,reason:c,edgeCount:a.model.edges.length})};for(let a of e){if(!pi.test(a.model.packageName)||!Ps.test(a.model.modelId)){l(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Hd.includes(a.model.modelId)){l(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){l(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let o=n(a.model.packageName);if(o===void 0){l(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let c;try{c=on(o,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{l(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${o} not an exact triple \u2014 inert (never guessed)`);continue}if(!c){l(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${o} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}r.push(a.model),s.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:r,notes:i,dispositions:s}}var Xd=4,Gd={additiveForms:!0,namelessExports:!0},Jd=new Set(["dep-opaque","dynamic-load","dispatch"]),Yd={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function yi(e,n,t){return e.tier==="unknown"&&Yd[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&Jd.has(e.unknownKind)&&n!==null&&n.verified}var Qd=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),Ue=class extends Error{},xi="cupel/coverage-gap",Zd={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","dependency-body":"dep-opaque","dependency-loader-assumed":"dep-opaque","dep-class-corridor":"dep-opaque"};function gt(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function zs(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Us(e,n,t){let r=new Map(e.modules.map(l=>[l.path,l.id])),i=e.modules[0]?.id;if(i===void 0)return[];let s=n.map(l=>({source:r.get(l.path)??i,cause:Zd[l.code],reach:l.classScope!==void 0?{kind:"class-scope",packageName:l.classScope.packageName,container:l.classScope.container}:l.anchor!==void 0?{kind:l.code==="dependency-loader-assumed"?"assumed-bounded":"via-module",anchor:l.anchor}:{kind:"unbounded"}}));return t&&s.push({source:i,reach:{kind:"unbounded"},cause:"resolution-divergence"}),s}function hi(e,n,t,r,i){let s=t.filter(l=>l.exportName!==null&&(r===1||i||l.verified!==1));return s.length>0?s.map(l=>({advisoryId:e,packageName:n,exportName:l.exportName??"",container:l.container,symbolKind:l.symbolKind,sourcePath:l.sourcePath??"",derivation:l.derivation,confidence:l.confidence,verified:l.verified===1})):t.length===0||t.every(l=>l.exportName!==null&&l.verified===1)?[null]:[]}function gi(e,n,t,r,i,s,l,a){let o=Ot({graph:e,installed:t,range:r,symbol:i,coverage:null,incompleteness:s,analysisAborted:l,guardLift:a});if(n!==null&&i!==null&&yi(o,i,"base")){let c=In(e,n.modulesById,n.reachMods,i,n.records);if(c!==null)return{finding:o,hit:c}}return{finding:o,hit:null}}function ec(e,n){let t=new Set,r=[];for(let i of e.packages)for(let{advisory:s,affected:l}of n.advisoriesForPackage("npm",i.name)){let a=gt(s.id,i.name,l),o;try{o=on(i.version,a)}catch{continue}if(o)for(let c of n.symbolsForAffected(l.id)){if(c.verified!==1||c.symbolKind!=="method"&&c.symbolKind!=="ctor"||c.container===null||c.sourcePath===null)continue;let u=`${i.lockKey}\0${c.container}\0${c.sourcePath}`;t.has(u)||(t.add(u),r.push({packageName:i.name,packageRootRel:i.lockKey,container:c.container,sourcePath:c.sourcePath}))}}return r.sort((i,s)=>`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),r.slice(0,ot)}function nc(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),i=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),l=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let o=s.get(a.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let m=n.get(f.moduleId);m!==void 0&&m.packageName!==u.packageName&&l.push({packageName:m.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:c.id})}return l}function tc(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),r=new Map(e.functions.map(u=>[u.id,u])),i=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&i.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let f=s.get(u.exportId);if(f===void 0||!n.has(f.moduleId))continue;let m=r.get(u.target.functionId);m===void 0||t.get(m.moduleId)?.externalSurface===!0||i.add(m.id)}let l=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),a=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let f=l.get(u.callSiteId);if(f===void 0)continue;let m=a.get(f);m===void 0?a.set(f,[u.calleeFunctionId]):m.push(u.calleeFunctionId)}let o=new Set(i),c=[...i];for(;c.length>0;){let u=c.pop();if(u!==void 0)for(let f of a.get(u)??[])o.has(f)||(o.add(f),c.push(f))}return o}function ic(e,n,t,r){for(let i of n){if(i.modelId!==e.modelId||i.anchor.packageName!==e.anchorPackage||i.anchor.exportName!==e.entryExport)continue;let s=t.filter(a=>a.packageName===i.anchor.packageName&&a.exportName===i.anchor.exportName&&a.container===i.anchor.container),l=s.find(a=>a.resolution==="resolved")??s[0];if(l!==void 0)return r.has(l.callerFunctionId)}return null}function rc(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let r=new Set(t),i=s=>r.has(s)||r.has(Me[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&i(s.unknownKind)||s.modelPromotedFromKind!==void 0&&i(s.modelPromotedFromKind))}function Si(e){let n=Wd(e.dir),t=e.reader??Lt(e.shardPath),r=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(ln))throw new Ue(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${ln})`);let i=null;if(e.summaryShadow!==void 0)try{i=Rs(e.summaryShadow)}catch(U){throw new Ue(`--summary-shadow facts dir rejected: ${U instanceof Error?U.message:String(U)}`)}let s=null;if(e.modelShadow!==void 0)try{s=Ts(e.modelShadow.claimsPath)}catch(U){throw new Ue(`--model-shadow claims rejected: ${U instanceof Error?U.message:String(U)}`)}let l=Os(n);if(l.truncated)throw new Ue(`the dependency enumeration hit a hard cap and is incomplete (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`);let a=e.entry??[],o=a.length>0?gs(n,a):{entrypoints:[],rejected:[]},c=o.rejected,u=hs(n),f=[...new Set([...u.entrypoints,...o.entrypoints])],m=[...u.sources];for(let U of o.entrypoints)u.entrypoints.includes(U)||m.push({source:"--entry",specifier:U,entrypoint:U,launch:!1});let h=ec(l,t),k=e.bindingForms??Gd,E=e.callablePackageResolver===!0,S=e.tsconfigPaths===!0,w=e.assumedBounded===!0,A=e.guardLift===!0,R=ti({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:k,callablePackageResolver:E,tsconfigPaths:S,assumedBounded:w}),v=R.graph,y=[...u.diagnostics,...ii(u.sources,u.gaps),...R.diagnostics],p=zs(f.length,v),x=l.gaps.some(U=>U.blindsAnalysis),N=Us(v,y,x),D=t.allModels?.()??[],B=mi(D.map(U=>({model:{packageName:U.packageName,modelId:U.modelId,edges:U.edges},introduced:U.introduced,fixedBefore:U.fixedBefore})),U=>l.packages.find(ue=>ue.name===U)?.version),F=B.models.length>0?Rn(v,B.models).delta:null,_=F!==null?{records:F.records,reachMods:an(v),modulesById:new Map(v.modules.map(U=>[U.id,U]))}:null,M=[],T=Qd(),O=[],K=[];for(let U of l.packages)for(let{advisory:ue,affected:ye}of t.advisoriesForPackage("npm",U.name)){let ae=gt(ue.id,U.name,ye),Oe=ue.cveId??ue.id,Y=t.symbolsForAffected(ye.id),Pe=Y.filter(b=>b.exportName===null),Te=hi(ue.id,U.name,Y,ye.surfaceComplete,r);for(let b of Te){let{finding:I,hit:C}=gi(v,_,{name:U.name,version:U.version,devOnly:U.dev},ae,b,N,p,A),L=I,G,se;C!==null&&b!==null&&(G=C.modelId,se=I.unknownKind,L={basis:void 0,tier:C.tier,decidedAtStage:I.decidedAtStage,reason:`boundary model ${C.modelId}: ${C.anchorPackage}.${C.entryExport} reaches ${b.exportName} [${C.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Vn(b),path:void 0,unresolvedSites:I.unresolvedSites}),T[L.tier]+=1;let re={...L,modelId:G,modelPromotedFromKind:se,surfaceComplete:ae.surfaceComplete,advisoryId:ue.id,displayId:Oe,packageName:U.name,version:U.version,symbolName:b?.exportName??null,symbolPath:b?.sourcePath||null,severity:ue.severity,packageLocation:l.lockfilePath};M.push(re);let Re=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&re.tier==="unknown"&&re.decidedAtStage==="symbol-reachable"&&re.unknownKind!==void 0&&Re.has(re.unknownKind)&&b!==null&&O.push({finding:re,symbol:b}),s!==null&&re.tier==="unknown"&&b!==null&&K.push({finding:re,symbol:b})}for(let b of Pe)T.unknown+=1,M.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:ae.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${Oe} carries a ${b.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],advisoryId:ue.id,displayId:Oe,packageName:U.name,version:U.version,symbolName:null,symbolPath:null,severity:ue.severity,packageLocation:l.lockfilePath})}for(let U of l.gaps)T.unknown+=1,M.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:U.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],advisoryId:xi,displayId:xi,packageName:U.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:l.lockfilePath});let W=T["reachable-high"]+T["reachable-medium"],J=e.failOnReachable===!0&&W>0,Z=rc(M,T.unknown,e.failOnUnknown),j=e.requireCompleteDenial===!0&&M.some(U=>U.tier==="not-reachable"&&U.basis==="loader-assumption"),V=J||Z||j?2:0,ie;if(i!==null){let U=an(v),ue=new Map(v.modules.map(ae=>[ae.id,ae])),ye=[];for(let{finding:ae,symbol:Oe}of O){let Y=Ct(v,ue,U,Oe,i,Xd);ye.push({advisoryId:ae.advisoryId,packageName:ae.packageName,symbolName:ae.symbolName,unknownKind:ae.unknownKind??null,wouldPromote:Y!==null,...Y!==null?{anchorPackage:Y.anchorPackage,entryExport:Y.entryExport,viaPackages:Y.viaPackages,totalHops:Y.totalHops}:{}})}ie={records:ye}}let we;if(s!==null&&e.modelShadow!==void 0){let U=e.modelShadow.widened===!0?"widened":"base",ue=new Map(l.packages.map(P=>[P.name,P.version])),{models:ye,notes:ae,dispositions:Oe}=mi(s,P=>ue.get(P),{shadowConsultDenylisted:!0}),{delta:Y}=Rn(v,ye),Pe=an(v),Te=new Map(v.modules.map(P=>[P.id,P])),b=nc(v,Te,Pe),I=tc(v),C=Y.records.some(P=>b.some(H=>H.packageName===P.anchor.packageName&&H.exportName===P.anchor.exportName&&H.container===P.anchor.container)),L=[],G=Date.now();for(let{finding:P,symbol:H}of K){let _e=Y.records,me=yi(P,H,U),Q=me?In(v,Te,Pe,H,_e):null,Ae=Y.records.filter(be=>be.callee.packageName===H.packageName&&be.callee.exportName===H.exportName&&be.callee.container===H.container||be.callee.packageName===H.packageName&&be.callee.realFunctionId!==null);L.push({advisoryId:P.advisoryId,packageName:P.packageName,symbolName:P.symbolName,unknownKind:P.unknownKind??null,decidedAtStage:P.decidedAtStage,consultSurface:U,noHitReason:Q!==null?null:me?C?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Q!==null?ic(Q,_e,b,I):null,verdictBefore:P.tier,verdictAfter:Q!==null?"reachable-low":P.tier,wouldPromote:Q!==null,...Q!==null?{modelId:Q.modelId,anchorPackage:Q.anchorPackage,entryExport:Q.entryExport,pathLabels:Q.pathLabels,calleeBinding:Ae.find(be=>be.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:me?Ae.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Ae[0]?.anchor.packageName??"?"}#${Ae[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let se=Date.now()-G,re=Oe.map(P=>{if(P.status!=="active")return{modelId:P.modelId,state:P.status,reason:P.reason,edgesLowered:0,edgesReferenceGated:0};let H=Y.records.filter(me=>me.modelId===P.modelId).length;if(H>0)return{modelId:P.modelId,state:"lowered",reason:null,edgesLowered:H,edgesReferenceGated:P.edgeCount-H};let _e=Y.notes.find(me=>me.startsWith(`model ${P.modelId}:`)||me.startsWith(`model-edge ${P.modelId}:`));return{modelId:P.modelId,state:"refused",reason:_e??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:P.edgeCount}}),Re=L.filter(P=>P.wouldPromote).length,Ie=T.unknown-Re,xe=T["reachable-high"]+T["reachable-medium"],Ke=P=>({none:0,"fail-on-reachable":xe>0?2:0,"fail-on-unknown":P>0?2:0,both:xe>0||P>0?2:0});we={records:L,notes:[...ae,...Y.notes],laneStates:re,exitCodes:{baseline:Ke(T.unknown),withModels:Ke(Ie)},overlayWallMs:se},Fs(Bs.dirname(e.modelShadow.outPath),{recursive:!0});let q=`${e.modelShadow.outPath}.tmp-${Ds(8).toString("hex")}`;js(q,`${JSON.stringify(we,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Ks(q,e.modelShadow.outPath)}let ge;if(e.bindingShadow!==void 0){let U=Date.now(),ue=q=>B.models.length>0?{records:Rn(q,B.models).delta.records,reachMods:an(q),modulesById:new Map(q.modules.map(P=>[P.id,P]))}:null,ye=(q,P,H,_e)=>{let me=[];for(let Q of l.packages)for(let{advisory:Ae,affected:be}of t.advisoriesForPackage("npm",Q.name)){let gn=gt(Ae.id,Q.name,be),No=hi(Ae.id,Q.name,t.symbolsForAffected(be.id),be.surfaceComplete,r);for(let Fi of No){let{finding:Ki,hit:At}=gi(q,_e,{name:Q.name,version:Q.version,devOnly:Q.dev},gn,Fi,P,H,A);me.push({advisoryId:Ae.id,packageName:Q.name,symbolName:Fi?.exportName??null,tier:At!==null?At.tier:Ki.tier,unknownKind:At!==null?null:Ki.unknownKind??null})}}return me},ae=q=>{let P=ti({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:q,callablePackageResolver:E,tsconfigPaths:S,assumedBounded:w}),H=[...u.diagnostics,...ii(u.sources,u.gaps),...P.diagnostics];return{graph:P.graph,inc:Us(P.graph,H,x),aborted:zs(f.length,P.graph),live:ue(P.graph),applicability:P.bindingApplicability}},Oe=q=>{let P=ae(q);return ye(P.graph,P.inc,P.aborted,P.live)},Y=ae({}),Pe=ye(Y.graph,Y.inc,Y.aborted,Y.live),Te=ye(v,N,p,_);if(Te.length!==Pe.length)throw new Ue("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let b=(q,P)=>P.tier!==q.tier||P.unknownKind!==q.unknownKind,I=Pe.some((q,P)=>{let H=Te[P];return H!==void 0&&b(q,H)}),C=I?Oe({additiveForms:!0}):null,L=I?Oe({namelessExports:!0}):null,G=0,se=Pe.map((q,P)=>{let H=Te[P];if(H===void 0||H.advisoryId!==q.advisoryId||H.packageName!==q.packageName||H.symbolName!==q.symbolName)throw new Ue("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let _e={advisoryId:q.advisoryId,packageName:q.packageName,symbolName:q.symbolName,unknownKind:q.unknownKind,verdictBefore:q.tier,verdictAfter:H.tier,wouldPromote:H.tier!==q.tier&&(H.tier==="reachable-high"||H.tier==="reachable-medium"||H.tier==="reachable-low")};if(!b(q,H)||C===null||L===null)return _e;G+=1;let me=C[P],Q=L[P],Ae=me!==void 0&&b(q,me),be=Q!==void 0&&b(q,Q);return{..._e,attributedArm:Ae&&!be?"additiveForms":be&&!Ae?"namelessExports":"both",...me!==void 0?{verdictArmA:me.tier}:{},...Q!==void 0?{verdictArmB:Q.tier}:{}}}),re={...T};Pe.forEach((q,P)=>{let H=Te[P];H!==void 0&&H.tier!==q.tier&&(re[H.tier]-=1,re[q.tier]+=1)});let Re=(q,P)=>({none:0,"fail-on-reachable":q>0?2:0,"fail-on-unknown":P>0?2:0,both:q>0||P>0?2:0}),Ie;if(B.models.length>0&&_!==null){Ie=[];for(let q of l.packages)for(let{advisory:P,affected:H}of t.advisoriesForPackage("npm",q.name)){let _e=gt(P.id,q.name,H),me=hi(P.id,q.name,t.symbolsForAffected(H.id),H.surfaceComplete,r);for(let Q of me){if(Q===null||!Q.verified)continue;let Ae=gi(Y.graph,Y.live,{name:q.name,version:q.version,devOnly:q.dev},_e,Q,Y.inc,Y.aborted,A);if(!(Ae.hit===null&&yi(Ae.finding,Q,"base")))continue;let gn=In(v,_.modulesById,_.reachMods,Q,_.records);Ie.push({advisoryId:P.id,packageName:q.name,symbolName:Q.exportName,modelWouldPromote:gn!==null,...gn!==null?{modelId:gn.modelId}:{},anchorCleared:gn!==null})}}}let xe=M.some(q=>q.modelId!==void 0);ge={records:se,deltas:G,exitCodes:{baseline:Re(re["reachable-high"]+re["reachable-medium"],re.unknown+(xe?1:0)),withBindingForms:Re(T["reachable-high"]+T["reachable-medium"],T.unknown+(xe?1:0))},dualRunWallMs:Date.now()-U,...R.bindingApplicability!==void 0?{applicability:R.bindingApplicability}:{},...Ie!==void 0?{modelProbe:Ie}:{}},Fs(Bs.dirname(e.bindingShadow.outPath),{recursive:!0});let Ke=`${e.bindingShadow.outPath}.tmp-${Ds(8).toString("hex")}`;js(Ke,`${JSON.stringify(ge,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Ks(Ke,e.bindingShadow.outPath)}let ve=D.length>0||B.notes.length>0?{active:B.models.length,stored:D.length,promoted:M.filter(U=>U.modelId!==void 0).length,notes:[...B.notes,...F!==null?F.notes:[]]}:void 0;return{...ie!==void 0?{summaryShadow:ie}:{},...we!==void 0?{modelShadow:we}:{},...ge!==void 0?{bindingShadow:ge}:{},...ve!==void 0?{modelLane:ve}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:M,counts:T,analyzerDiagnostics:y,analysisAborted:p,rejectedEntries:c,entrypointSources:m,entrypointGaps:u.gaps,exitCode:V}}finally{e.reader===void 0&&t.close()}}var sc="cupel",oc="reachability-first SCA \u2014 verdict + call path + confidence";function bi(e){return[`${sc} v${e} \u2014 ${oc}`,`cascade: ${qi.join(" \u2192 ")}`,`verdicts: ${Vi.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)"].join(`
+`)}var ac=new Set([...Rt,...Mt]);function mn(e,n,t){let r=e[n+1];if(r===void 0||r.startsWith("--"))throw new Error(`${t} requires a value`);return r}function lc(e){let n=e.split(",").map(i=>i.trim()),t=[...Rt,...Mt].join(", ");if(n.length===0||n.some(i=>i===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let r=[];for(let i of n){if(!ac.has(i))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(i)}; valid: ${t}`);r.push(i)}return r}function qs(e){let n=".",t,r,i=!1,s=!1,l=!1,a=!1,o=!1,c=!1,u,f,m,h=!1,k=!1,E,S=!1,w=!1,A,R=[];for(let v=0;v<e.length;v+=1){let y=e[v];if(y==="--x-guard-lift"){l=!0;continue}if(y==="--require-complete-denial"){s=!0;continue}if(y==="--fail-on-reachable")i=!0;else if(y==="--fail-on-unknown")a="all";else if(y!==void 0&&y.startsWith("--fail-on-unknown="))a=lc(y.slice(18));else if(y==="--offline")o=!0;else if(y==="--sarif")t=mn(e,v,"--sarif"),v+=1;else if(y==="--shard")r=mn(e,v,"--shard"),v+=1;else if(y==="--entry")R.push(mn(e,v,"--entry")),v+=1;else if(y==="--summary-shadow")u=mn(e,v,"--summary-shadow"),v+=1;else if(y==="--model-shadow")f=mn(e,v,"--model-shadow"),v+=1;else if(y==="--model-shadow-out")m=mn(e,v,"--model-shadow-out"),v+=1;else if(y==="--model-shadow-widened")h=!0;else if(y==="--binding-shadow")k=!0;else if(y==="--binding-shadow-out")E=mn(e,v,"--binding-shadow-out"),v+=1;else if(y==="--x-partial-rows")S=!0;else if(y==="--push")w=!0;else if(y!==void 0&&y.startsWith("--auth=")){let p=y.slice(7);if(p!=="oidc"&&p!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(p)}`);A=p}else{if(y!==void 0&&y.startsWith("--"))throw new Error(`unknown flag ${y}`);y!==void 0&&!c&&(n=y,c=!0)}}if(f===void 0!=(m===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(h&&f===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(k!==(E!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(A!==void 0&&!w)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:r,failOnReachable:i,requireCompleteDenial:s,guardLift:l,failOnUnknown:a,offline:o,entry:R,summaryShadow:u,modelShadow:f,modelShadowOut:m,modelShadowWidened:h,push:w,auth:A,bindingShadow:k,bindingShadowOut:E,partialRows:S}}import{randomBytes as dc,createHash as cc}from"node:crypto";import{mkdirSync as uc,readFileSync as fc,renameSync as pc,writeFileSync as mc}from"node:fs";import{homedir as hc}from"node:os";import hn from"node:path";var ki="latest.json",Ei="latest.json.sig";function yt(e){return cc("sha256").update(e).digest("hex")}function Vs(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=hc();if(process.platform==="darwin")return hn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let i=process.env.LOCALAPPDATA,s=i!==void 0&&i!==""?i:hn.join(n,"AppData","Local");return hn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,r=t!==void 0&&t!==""?t:hn.join(n,".cache");return hn.join(r,"cupel","shards")}function wi(e,n,t){return hn.join(e,`${n}-${t}.sqlite`)}function xt(e,n){uc(hn.dirname(e),{recursive:!0});let t=`${e}.tmp-${dc(8).toString("hex")}`;mc(t,n,{flag:"wx"}),pc(t,e)}function Dn(e){try{return fc(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function Hs(e,n,t,r){let i=wi(e,n,t),s=Dn(i);if(s===void 0)return;let l=yt(s);if(l!==t)throw r(`cached shard ${i} failed sha256 re-verify (expected ${t}, got ${l})`);return{path:i,bytes:s}}var Ws="api.cupel.sh",St=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Xs=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Et from"node:path";function Le(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function Gs(e,n={}){let t=n.maxBytes??1073741824,r=n.timeoutMs??3e4,{get:i}=await import("node:https");return await new Promise((s,l)=>{let a=i(e,n.headers!==void 0?{headers:n.headers}:{},o=>{let c=o.statusCode??0;if(c<200||c>=300){o.resume(),l(new Error(`GET ${e} \u2192 HTTP ${String(c)}`));return}let u=[],f=0;o.on("data",m=>{if(f+=m.length,f>t){o.destroy(),l(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(m)}),o.on("end",()=>{s(Buffer.concat(u))}),o.on("error",l)});a.on("error",l),a.setTimeout(r,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(r)}ms`))})})}async function Fn(e,n,t,r,i,s=3e4){let{request:l}=await import("node:https"),a=new URL(n).hostname;return await new Promise((o,c)=>{let u=l(n,{method:e,headers:t},f=>{let m=[],h=0;f.on("data",k=>{if(h+=k.length,h>i){f.destroy(),c(new Error(`${e} to ${a} returned more than ${String(i)} bytes`));return}m.push(k)}),f.on("end",()=>{o({status:f.statusCode??0,body:Buffer.concat(m).toString("utf8")})}),f.on("error",()=>{c(new Error(`${e} to ${a} failed`))})});u.on("error",()=>{c(new Error(`${e} to ${a} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${a} timed out after ${String(s)}ms`))}),r!==void 0&&u.write(r),u.end()})}import{createPublicKey as gc,verify as yc}from"node:crypto";var X=class extends Error{constructor(n){super(n),this.name="DistError"}},xc=Buffer.from("302a300506032b6570032100","hex"),Sc=32;function Zs(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Sc)try{return gc({key:Buffer.concat([xc,n]),format:"der",type:"spki"})}catch{return}}function vi(e,n,t){for(let r of t){let i=Zs(r);if(i!==void 0)try{if(yc(null,e,i,n))return!0}catch{}}return!1}function eo(e){return e.some(n=>Zs(n)!==void 0)}var bc=/^[0-9a-f]{64}$/u,kc=/^[a-z0-9-]+$/u;function Js(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new X(`${n} must be an object`);return e}function Ys(e,n){if(!Array.isArray(e))throw new X(`${n} must be an array`);return e}function bt(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new X(`${n} must be an integer`);return e}function kt(e,n){if(typeof e!="string")throw new X(`${n} must be a string`);return e}function Qs(e,n){let t=kt(e,n);if(Number.isNaN(Date.parse(t)))throw new X(`${n} is not a valid timestamp: ${t}`);return t}function Ii(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new X("distribution index is not valid JSON")}let r=Js(t,"index"),i=bt(r.schema_version,"schema_version");if(i!==n.supportedIndexSchemaVersion)throw new X(`index schema_version ${String(i)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=bt(r.sequence,"sequence");if(s<0)throw new X("sequence must be non-negative");let l=Qs(r.generated,"generated"),a=Ys(r.shards,"shards"),o;for(let k of a){let E=Js(k,"shard entry"),S=kt(E.ecosystem,"ecosystem");if(!kc.test(S))throw new X(`ecosystem ${JSON.stringify(S)} is malformed`);if(S===n.ecosystem){o=E;break}}if(o===void 0)throw new X(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);Qs(o.built,"built");let c=bt(o.db_schema_version,"db_schema_version");if(c<1)throw new X("db_schema_version must be >= 1");if(c>n.supportedDbSchemaVersion)throw new X(`this shard needs a newer cupel (db_schema_version ${String(c)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=kt(o.sha256,"sha256");if(!bc.test(u))throw new X(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let f=bt(o.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new X(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let m=Ys(o.urls,"urls");if(m.length===0)throw new X("urls must be a non-empty array");let h=[];for(let k of m){let E=kt(k,"url");try{h.push(Le(E,n.shardHosts))}catch(S){throw new X(`refusing shard url ${JSON.stringify(E)}: ${S.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:f,dbSchemaVersion:c,urls:h,sequence:s,generated:l}}var Ni="CUPEL_DELIVERY_TOKEN",_i=class extends X{constructor(n){super(n),this.name="NoDeliveryTokenError"}},Ai=class extends X{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Ec(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function no(e,n){let t=Ec(e);return t!==void 0?()=>Promise.resolve(t):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function to(e){if(e===void 0)throw new _i(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow, elsewhere set ${Ni} to a token from app.cupel.sh, or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new Ai(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var wc="/v1/resolve",Ci=1024*1024,Oi=4096,io=Ci+Oi+64*1024,vc=8,Ic=2048,_c=/^[A-Za-z0-9+/]+={0,2}$/u,Ac=3e4,he=class extends X{constructor(n){super(n),this.name="DeliveryRefusedError"}},Kn=class extends X{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},jn=class extends X{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function Nc(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Cc(e){if(typeof e!="string"||e.length===0)throw new he("the delivery response carried no index signature");if(e.length>Oi||!_c.test(e))throw new he("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new he("the delivery response's index signature is not canonical base64");return n}function Oc(e){if(typeof e!="string"||e.length===0)throw new he("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Ci)throw new he("the delivery response's index is larger than one can be");return n}function Rc(e){if(!Array.isArray(e)||e.length===0)throw new he("the delivery response named no shard urls");if(e.length>vc)throw new he("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>Ic)throw new he("the delivery response carried a malformed shard url");n.push(t)}return n}function Mc(e,n){throw e===401||e===403?new he(`${n} rejected the delivery credential \u2014 check ${Ni}, or that the token has not been revoked in the dashboard`):e===404?new he(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new jn(`${n} holds nothing newer than the shard index already cached`):e===429?new Kn(`${n} rate-limited the delivery request`):e>=500?new Kn(`${n} answered ${String(e)}`):new he(`${n} refused the delivery request with status ${String(e)}`)}async function ro(e,n,t,r,i=Ac){let s=Le(`https://${e}${wc}`,new Set([e])),l=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await r(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},l,i)}catch{throw new Kn(`${e} could not be reached`)}if(a.status!==200&&Mc(a.status,e),Buffer.byteLength(a.body,"utf8")>io)throw new he(`${e} returned a delivery response larger than one can be`);let o;try{o=JSON.parse(a.body)}catch{throw new he(`${e} returned a delivery response that is not JSON`)}if(!Nc(o))throw new he(`${e} returned a delivery response that is not an object`);return{index:Oc(o.index),sig:Cc(o.signature),shardUrls:Rc(o.shardUrls)}}var so=async(e,n,t,r)=>await Fn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,io,r);var Lc=8,Mi=class extends X{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Ri(e){return`${e.origin}${e.pathname}`}function oo(e,n,t){let r=new Map;for(let l of n)r.set(Ri(l),l);let i=[],s=[];for(let l of e.slice(0,Lc)){let a;try{a=Le(l,t)}catch(u){s.push(u.message);continue}if(a.hash!==""){s.push("a candidate carried a fragment");continue}let o=r.get(Ri(a));if(o===void 0){s.push("a candidate named an object the signed index does not list");continue}let c=new URL(`${Ri(o)}${a.search}`);i.push(Le(c.href,t))}if(i.length===0)throw new Mi(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return i}var Pc=1,Tc=1024*1024*1024;function Dc(e=St){return{async resolve(n){return await ro(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},so)},async fetchShard(n,t){return Le(n.href,e),await Gs(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Li(e){return e instanceof Error?e.message:String(e)}function ao(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Pc,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:Tc}}function Fc(e){let n=Dn(Et.join(e.cacheDir,ki)),t=Dn(Et.join(e.cacheDir,Ei));if(!(n===void 0||t===void 0)&&vi(n,t,e.pubkeys))try{return Ii(n,ao(e))}catch{return}}function lo(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let r=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(r)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function wt(e,n,t){let r=Hs(n.cacheDir,e.ecosystem,e.sha256,i=>new X(i));if(r===void 0)throw new X(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:r.path,fromCache:!0,warnings:[...t,...lo(e,n)],sequence:e.sequence}}async function Kc(e,n,t,r){let i=wi(t.cacheDir,e.ecosystem,e.sha256),s=Dn(i);if(s!==void 0&&yt(s)===e.sha256)return{path:i,downloaded:!1};let l="no shard urls";for(let a of n){let o;try{o=await r.fetchShard(a,e.sizeBytes)}catch(u){l=Li(u);continue}let c=yt(o);if(c!==e.sha256){l=`sha256 mismatch (expected ${e.sha256}, got ${c})`;continue}return xt(i,o),{path:i,downloaded:!0}}throw new X(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${l}`)}function jc(e,n,t){if(e instanceof he)throw e;if(e instanceof jn){if(n===void 0)throw new X(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return wt(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new X(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Li(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return wt(n,t,[`could not refresh the shard index (${Li(e)}); using the cached shard`])}async function co(e,n){if(!e.activated)throw new X("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??Dc(e.shardHosts);if(!eo(e.pubkeys))throw new X("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let r=Fc(e);if(e.offline){if(r===void 0)throw new X(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return wt(r,e,[])}let i=await to(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:i,ecosystem:e.ecosystem,sequenceFloor:r?.sequence??0})}catch(c){return jc(c,r,e)}if(!vi(s.index,s.sig,e.pubkeys))throw new X("shard index signature did not verify against any pinned key");let l=Ii(s.index,ao(e));if(r!==void 0&&l.sequence<r.sequence)return wt(r,e,[`refusing a rolled-back shard index (served sequence ${String(l.sequence)} < cached ${String(r.sequence)}); keeping the newer cached shard`]);let a=oo(s.shardUrls,l.urls,e.shardHosts),o=await Kc(l,a,e,t);return xt(Et.join(e.cacheDir,ki),s.index),xt(Et.join(e.cacheDir,Ei),s.sig),{path:o.path,fromCache:!o.downloaded,warnings:lo(l,e),sequence:l.sequence}}var Bc="https://api.cupel.sh",uo=".actions.githubusercontent.com",zc=8192,$e=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function Uc(e){let n;try{n=new URL(e).hostname}catch{throw new $e("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=uo.slice(1);if(n!==t&&!n.endsWith(uo))throw new $e(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Le(e,new Set([n]))}catch{throw new $e(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function vt(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,r=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new $e("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(r===void 0||r==="")throw new $e("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let i=Uc(t);i.searchParams.set("audience",Bc);let s;try{s=await n(i.href,{authorization:`Bearer ${r}`,accept:"application/json","user-agent":"cupel"})}catch{throw new $e("the ID-token request failed")}if(s.length>zc)throw new $e("the ID-token response was larger than a token can be");let l;try{l=JSON.parse(s)}catch{throw new $e("the ID-token response was not JSON")}let a=typeof l=="object"&&l!==null?l.value:void 0;if(typeof a!="string"||a.length===0)throw new $e("the ID-token response carried no token");return a}async function fo(e,n,t={}){let r=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",i=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!r)throw new $e("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await vt(e,n)};if(r)return i&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(i)return{kind:"oidc",value:await vt(e,n)};throw new $e("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var $i="api.cupel.sh",qc=`https://${$i}/v1/findings`,Vc=64*1024,It=8*1024*1024,Hc=3e4,sn=class extends Error{constructor(n){super(n),this.name="PushError"}};async function po(e,n,t,r={}){if(e.length>It)throw new sn(`findings payload is ${String(e.length)} bytes, over the ${String(It)}-byte limit`);let i=Le(qc,new Set([$i])),s;try{s=await t(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,r.timeoutMs??Hc)}catch{throw new sn(`the findings push to ${$i} failed`)}if(s.body.length>Vc)throw new sn("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new sn("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new sn("the control plane rejected the findings payload as malformed"):new sn(`the findings push was refused with status ${String(s.status)}`)}var Wc=64*1024,Xc=64*1024,mo=async(e,n,t,r)=>{if(Buffer.byteLength(t,"utf8")>It)throw new Error("findings payload is over the size limit");return await Fn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Xc,r)};async function _t(e,n){let t=await Fn("GET",e,n,void 0,Wc,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var Jc=720*60*60*1e3,Yc=Number(ln);function ho(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Ue("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function go(e){let n=await co({ecosystem:"npm",activated:!0,pubkeys:Xs,indexHost:Ws,shardHosts:St,credential:no(process.env,()=>vt(process.env,_t)),cacheDir:Vs(),offline:e.offline,now:Date.now(),maxAgeMs:Jc,supportedDbSchemaVersion:Yc});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
+`);return{path:n.path,sequence:n.sequence}}var Qc=5,Bn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Zc(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new Bn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,r=e.modelPromotedFromKind??null;if(t===null!=(r===null))throw new Bn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new Bn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:Hi(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(i=>({functionName:i.functionName??null,modulePath:i.modulePath})),unresolvedSites:e.unresolvedSites.map(i=>({path:i.path,start:i.start,end:i.end})),modelId:t,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null}}function yo(e,n){return{version:Qc,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:e.findings.map(Zc)}}function z(e){let n="";for(let t of e){let r=t.charCodeAt(0),i=r<32||r>=127&&r<=159;n+=i?"\\x"+r.toString(16).padStart(2,"0"):t}return n}function eu(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var nu={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},xo=4,Pi=3,Ti=10,So={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},tu="(symbol set known incomplete)";function iu(e){let n=(e.path??[]).map(t=>z(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function bo(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function ru(e){let n=e.findings.filter(c=>c.tier==="unknown"&&c.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let c of n){let u=t.get(c.unknownKind)??[];u.push(c),t.set(c.unknownKind,u)}let r={cupel:0,project:0};for(let[c,u]of t)r[Me[c]]+=u.length;let i=[];i.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(c,u)=>{if(r[c]===0)return;i.push(""),i.push(`   ${u} (${String(r[c])}):`);let f=[...t.entries()].filter(([h])=>Me[h]===c).sort((h,k)=>k[1].length-h[1].length||h[0].localeCompare(k[0])),m=f.slice(0,xo);for(let[h,k]of m){let E=c==="project"?[...new Set(k.flatMap(bo))]:[],S=E.slice(0,Pi).map(z).join(", "),w=E.length>Pi?` (+${String(E.length-Pi)} more files)`:"";i.push(`     ${h.padEnd(21)} ${String(k.length).padStart(4)}  ${So[h]}`+(S!==""?`
+       ${S}${w}`:""))}for(let[h,k]of f.slice(xo))i.push(`     ${h.padEnd(21)} ${String(k.length).padStart(4)}  ${So[h]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let l=new Map;for(let c of n)if(Me[c.unknownKind]==="project")for(let u of bo(c))l.set(u,(l.get(u)??0)+1);let a=[...l.entries()].sort((c,u)=>u[1]-c[1]||c[0].localeCompare(u[0]))[0];a!==void 0&&r.project>0&&(i.push(""),i.push(`   \u279C Start here: ${z(a[0])} appears in ${String(a[1])} of your ${String(r.project)} finding(s), across ${String(l.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let o=n.filter(c=>Me[c.unknownKind]==="project");if(o.length>0){i.push("");for(let c of o.slice(0,Ti))i.push(`     ${z(c.displayId)}  ${z(c.packageName)}@${z(c.version)}  [${c.unknownKind}] ${z(c.reason)}`);o.length>Ti&&i.push(`     \u2026 and ${String(o.length-Ti)} more`)}return i.push(""),i}function ko(e){let n=[],t=e.counts,r=e.findings.filter(a=>a.tier==="reachable-high"||a.tier==="reachable-medium"||a.tier==="reachable-low");if(n.push(`cupel scan: ${z(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let a=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+a.map(o=>`${z(o.entrypoint)} [${z(o.source)}]`).join(", ")+(e.entrypointSources.length>a.length?`, \u2026 and ${String(e.entrypointSources.length-a.length)} more`:"")),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let a of e.entrypointGaps.slice(0,5))n.push(`  - ${z(a.source)} (${z(a.file)}): ${z(a.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(z).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.'),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let i=e.installed.gaps;if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let a of i.slice(0,10))n.push(`  - [${z(a.kind)}] ${z(a.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let s=new Set(i.map(a=>a.detail)),l=[...e.analyzerDiagnostics.map(a=>`${z(a.code)}: ${z(a.detail)}`),...e.installed.diagnostics.filter(a=>!s.has(a)).map(z)];if(l.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(l.length)}) \u2014 verdicts are conservative:`);for(let a of l.slice(0,10))n.push(`  - ${a}`);l.length>10&&n.push(`  \u2026 and ${String(l.length-10)} more`),n.push("")}if(r.length>0){n.push(`\u{1F3AF} Reachable (${String(r.length)}) \u2014 fix these:`);for(let a of r)n.push(`  ${nu[a.tier]} ${z(a.displayId)}  ${z(a.packageName)}@${z(a.version)}  ${z(a.symbolName??"")}`+(a.surfaceComplete===!1?`  ${tu}`:"")),n.push(`        path: ${iu(a)}`);n.push("")}return n.push(...ru(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${eu(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as su}from"node:crypto";var ou="https://json.schemastore.org/sarif-2.1.0.json",Eo="cupel-reachability",Di=new Set(["dispatch","dynamic-load","coverage-gap"]);function au(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var lu=500,du=10;function cu(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function uu(e,n){return`${e}::${n}`}function fu(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function pu(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return su("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function mu(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Di.has(e.unknownKind)}var wo={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function vo(e){let n=[],t=new Map,r=[];for(let o of e.findings){if(!mu(o))continue;let c=uu(o.displayId,o.packageName);if(!t.has(c)){t.set(c,n.length);let S=fu(o.severity);n.push({id:z(c),properties:{tags:o.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${z(o.packageName)}`]:["security","reachability",`package/${z(o.packageName)}`],...S!==void 0?{"security-severity":S}:{}}})}let u=o.tier==="reachable-high"||o.tier==="reachable-medium"||o.tier==="reachable-low",f=o.path??[],m=f.find(S=>S.modulePath!==""),h=[...new Set(o.unresolvedSites.map(S=>S.path).filter(S=>S!==""))],k=u?m!==void 0?{physicalLocation:{artifactLocation:{uri:z(m.modulePath)}},message:{text:`calls ${z(o.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:z(o.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:z(h[0])}},message:{text:`unresolved ${z(o.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:z(o.packageLocation??(o.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},E=u?f.map(S=>({physicalLocation:{artifactLocation:{uri:z(S.modulePath||"package-lock.json")}},message:{text:z(S.functionName??"<step>")}})):h.slice(1,du+1).map(S=>({physicalLocation:{artifactLocation:{uri:z(S)}},message:{text:"also blocked here"}}));r.push({ruleId:z(c),ruleIndex:t.get(c),level:u?"error":"warning",message:{text:z(`[${o.tier}] ${o.displayId} in ${o.packageName}@${o.version}`+(o.symbolName!==null?` \u2014 reaches ${o.symbolName}`:"")+(o.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${o.reason}`)},locations:[k],...E.length>0?{relatedLocations:E}:{},partialFingerprints:{"cupelReachability/v1":pu(o)},properties:{tier:o.tier,advisoryId:z(o.advisoryId),...o.surfaceComplete===!1?{surfaceComplete:!1}:{},...o.modelId!==void 0?{modelId:z(o.modelId),modelPromotedFromKind:o.modelPromotedFromKind}:{},...o.unknownKind!==void 0?{unknownKind:o.unknownKind,unknownOwner:Me[o.unknownKind],unresolvedSiteCount:o.unresolvedSites.length}:{}}})}let i=new Map,s=new Map;for(let o of e.findings){if(o.tier!=="unknown"||o.unknownKind===void 0||(i.set(o.unknownKind,(i.get(o.unknownKind)??0)+1),Di.has(o.unknownKind)))continue;let c=s.get(o.unknownKind)??[];c.length<lu&&c.push({advisory:z(o.displayId),package:z(o.packageName),version:z(o.version)}),s.set(o.unknownKind,c)}let l={cupel:0,project:0};for(let[o,c]of i)l[Me[o]]+=c;let a={};for(let[o,c]of s){let u=i.get(o)??c.length;a[o]={count:u,owner:Me[o],note:wo[o],truncated:u>c.length,advisories:c}}return{$schema:ou,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Eo},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:z(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(o=>`${o.entrypoint} (${o.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...i.keys()].filter(o=>!Di.has(o)&&!au(o,e.analysisAborted)).sort().map(o=>({descriptor:{id:`unknown-${o}`},level:"warning",message:{text:`${String(i.get(o)??0)} finding(s) are unknown because ${wo[o]} (owner: ${Me[o]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${o}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(o=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:z(`${o.source} (${o.file}): ${o.detail}`)}})),...e.rejectedEntries.map(o=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:z(`--entry did not resolve to a file inside the app root: ${o}`)}})),...e.analyzerDiagnostics.map(o=>({descriptor:{id:o.code},level:"warning",message:{text:z(`${o.detail} (${o.path})`)}})),...e.installed.diagnostics.map(o=>({descriptor:{id:"resolve"},level:"warning",message:{text:z(o)}}))]}],results:r,properties:{category:Eo,summary:e.counts,...cu(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...i].sort((o,c)=>c[1]-o[1])),byOwner:l,grouped:a},dbCoverageGaps:e.findings.filter(o=>o.tier==="unknown"&&o.unknownKind==="db-gap").map(o=>({advisory:z(o.displayId),package:z(o.packageName),version:z(o.version)}))}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function Io(){try{let e=hu(xu(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Su(e,n){let t=`${JSON.stringify(n,null,2)}
+`,r=`${e}.tmp-${_o(8).toString("hex")}`;Ao(r,t,{encoding:"utf8",flag:"wx"}),gu(r,e)}async function bu(e){let n=qs(e),r=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:ho(n.shard),sequence:null}:await go({offline:n.offline}),i=r.path,s=Si({dir:n.dir,shardPath:i,failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,guardLift:n.guardLift,failOnUnknown:n.failOnUnknown,entry:n.entry,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{}});if(process.stdout.write(`${ko(s)}
+`),s.modelLane!==void 0){let l=s.modelLane.notes.length>0?` (${s.modelLane.notes.map(a=>z(a)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(s.modelLane.active)}/${String(s.modelLane.stored)} active, ${String(s.modelLane.promoted)} promoted to reachable-low${l}
+`)}if(n.summaryShadow!==void 0&&s.summaryShadow!==void 0){let l=yu.join(n.summaryShadow,"shadow-report.json");Ao(l,`${JSON.stringify(s.summaryShadow,null,2)}
 `),process.stdout.write(`summary-shadow: ${String(s.summaryShadow.records.length)} counterfactual record(s) -> ${l}
 `)}if(s.modelShadow!==void 0&&n.modelShadowOut!==void 0){let l=s.modelShadow.records.filter(a=>a.wouldPromote).length;process.stdout.write(`model-shadow: ${String(l)}/${String(s.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
 `)}if(s.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(s.bindingShadow.deltas)}/${String(s.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),n.sarif!==void 0&&Rc(n.sarif,no(s)),n.push){let l=Bs(s,{scanId:io(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:r.sequence}),a=await Vs(process.env,Xs,{...n.auth!==void 0?{auth:n.auth}:{},warn:c=>process.stderr.write(`cupel: ${c}
-`)});try{await qs(JSON.stringify(l),a.value,Ws)}catch(c){let u=c instanceof Error?c.message:String(c);return process.stderr.write(`cupel: ${u}
+`),n.sarif!==void 0&&Su(n.sarif,vo(s)),n.push){let l=yo(s,{scanId:_o(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:r.sequence}),a=await fo(process.env,_t,{...n.auth!==void 0?{auth:n.auth}:{},warn:c=>process.stderr.write(`cupel: ${c}
+`)});try{await po(JSON.stringify(l),a.value,mo)}catch(c){let u=c instanceof Error?c.message:String(c);return process.stderr.write(`cupel: ${u}
 `),s.exitCode===0?1:s.exitCode}let o=r.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(l.findings.length)} finding(s) to api.cupel.sh (${a.kind})${o}
-`)}return s.exitCode}async function Dc(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Tc(e.slice(1))}catch(t){let r=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${r}
-`),1}let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${ui(to())}
-`),0):(process.stderr.write(`cupel: unknown command '${K(n)}'
-`),process.stderr.write(`${ui(to())}
-`),1)}Dc().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`)}return s.exitCode}async function ku(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await bu(e.slice(1))}catch(t){let r=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${r}
+`),1}let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${bi(Io())}
+`),0):(process.stderr.write(`cupel: unknown command '${z(n)}'
+`),process.stderr.write(`${bi(Io())}
+`),1)}ku().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});