@cupel-sh/cli 0.10.0 → 0.11.0

package/bundle/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-var ee={"extract.py":`None
+var oe={"extract.py":`None
 
 import ast
 import builtins
@@ -116,6 +116,7 @@ REFLECTIVE_ATTRS = frozenset(
 )
 
 NAMESPACE_WRITERS = frozenset({"update", "setdefault", "__setitem__", "__delitem__", "pop"})
+NAMESPACE_READERS = frozenset({"get", "items", "keys", "values", "copy", "__contains__", "__getitem__", "__iter__", "__len__"})
 
 _HINTS = {"proxies": frozenset(), "calls": frozenset(), "roots": frozenset()}
 MAX_HINTS = 256
@@ -220,6 +221,8 @@ class Scopes(ast.NodeVisitor):
         self.class_binds = {}
         self._vars_of_other = set()
         self.dynamic = False
+        self.rebinds = False
+        self._namespace_reads = set()
         self.star = False
         self._counts = {}
         self._last_star = 0
@@ -300,12 +303,14 @@ class Scopes(ast.NodeVisitor):
         self.class_binds[id(node)] = others if len(others) <= MAX_PER_KIND else None
 
     def _comprehension(self, node, results):
+        self._read(node.generators[0].iter)
         self.visit(node.generators[0].iter)
         own = self._open("comprehension")
         prev, self._cur = self._cur, own
         for i, g in enumerate(node.generators):
             self.visit(g.target)
             if i > 0:
+                self._read(g.iter)
                 self.visit(g.iter)
             for c in g.ifs:
                 self.visit(c)
@@ -350,6 +355,8 @@ class Scopes(ast.NodeVisitor):
             and id(node) not in self._vars_of_other
         ):
             self.dynamic = True
+            if id(node) not in self._namespace_reads:
+                self.rebinds = True
 
     def visit_Global(self, node):
         self._cur.globals.update(node.names)
@@ -407,12 +414,44 @@ class Scopes(ast.NodeVisitor):
             and not isinstance(node.args[0], ast.Starred)
         )
 
+
+    def _own_namespace(self, node):
+        None
+        return (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Name)
+            and not node.args
+            and not node.keywords
+            and (node.func.id == "globals" or (node.func.id in ("locals", "vars") and self._cur.kind in ("module", "class")))
+        )
+
+    def _read(self, node):
+        None
+        if self._own_namespace(node):
+            self._namespace_reads.add(id(node.func))
+
+    def visit_Compare(self, node):
+        for op, right in zip(node.ops, node.comparators):
+            if isinstance(op, (ast.In, ast.NotIn)):
+                self._read(right)
+        self.generic_visit(node)
+
+    def visit_For(self, node):
+        self._read(node.iter)
+        self.generic_visit(node)
+
+    visit_AsyncFor = visit_For
+
     def visit_Attribute(self, node):
         if isinstance(node.ctx, (ast.Store, ast.Del)):
             self.attr_writes.add(node.attr)
+        elif node.attr in NAMESPACE_READERS:
+            self._read(node.value)
         self.generic_visit(node)
 
     def visit_Subscript(self, node):
+        if isinstance(node.ctx, ast.Load):
+            self._read(node.value)
         if isinstance(node.ctx, (ast.Store, ast.Del)) and self._namespace(node.value):
             key = node.slice
             if type(key).__name__ == "Index":
@@ -562,8 +601,15 @@ class Scopes(ast.NodeVisitor):
 
     def module_bindings(self):
         None
+        return None if self.dynamic else self._bindings_table()
+
+    def static_bindings(self):
+        None
+        return self._bindings_table() if self.dynamic and not self.rebinds else None
+
+    def _bindings_table(self):
         found = self._counts.get(id(self.module), {})
-        if self.dynamic or len(found) > MAX_PER_KIND:
+        if len(found) > MAX_PER_KIND:
             return None
         kind = lambda entry: "other" if entry[2] == "except" else entry[2]
         return {n: (kind(entry) if self.times(self.module, n) == 1 else "multi") for n, entry in sorted(found.items())}
@@ -669,6 +715,23 @@ class Scopes(ast.NodeVisitor):
             return None, None
         return dict(sorted(origins.items())), dict(sorted(aliases.items()))
 
+    def module_calls(self):
+        None
+        if self.dynamic:
+            return None
+        out = {}
+        for (sid, name), info in self.info.items():
+            if sid != id(self.module) or info[0] != "value" or self.times(self.module, name) != 1:
+                continue
+            if not isinstance(info[1], ast.Call):
+                continue
+            where = span(info[1])
+            if where is not None:
+                out[name] = [where[0], where[1]]
+        if len(out) > MAX_PER_KIND:
+            return None
+        return dict(sorted(out.items()))
+
 
 class Extract(ast.NodeVisitor):
     None
@@ -1351,6 +1414,12 @@ class _Refuse(Exception):
         self.reason = reason
 
 
+def _kwarg_name(H):
+    None
+    kw = H.node.args.kwarg
+    return None if kw is None else _mangle(H.private, kw.arg)
+
+
 def _params_in_order(args):
     None
     return [a for a in (*getattr(args, "posonlyargs", ()), *args.args, args.vararg, *args.kwonlyargs, args.kwarg) if a is not None]
@@ -2157,6 +2226,9 @@ class _FlowEmit:
         if H.kind != "class" and name not in params and self.stable(H):
             keys = self.fs.bound_by.get(key, ())
             got = _one_type({self.fs.literal.get(k) for k in keys})
+        elif H.kind == "def" and self.stable(H) and _kwarg_name(H) == name:
+            keys = self.fs.bound_by.get(key, ())
+            got = _one_type({"dict", *(self.fs.literal.get(k) for k in keys)})
         self._types[key] = got
         return got
 
@@ -2846,12 +2918,14 @@ def extract(path, max_bytes, max_nodes):
         "allComputed": ex.all_computed,
         "truncated": ex.truncated,
         "moduleBindings": scopes.module_bindings(),
+        "staticBindings": scopes.static_bindings(),
         "attrWrites": scopes.attribute_writes(),
         "starImport": scopes.star,
         "toplevelFlows": toplevel_flows,
         "flowsRefused": flows_refused,
         "moduleOrigins": module_origins,
         "annotatedAliases": annotated_aliases,
+        "moduleCalls": scopes.module_calls(),
         **refs,
     }
 
@@ -3018,64 +3092,76 @@ def main(argv):
 
 if __name__ == "__main__":
     sys.exit(main(sys.argv))
-`};import{randomBytes as bm}from"node:crypto";import{readFileSync as Vv,renameSync as Xv,writeFileSync as Sm}from"node:fs";import Yv from"node:path";import{fileURLToPath as Jv}from"node:url";var vm=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Em(e){let n=vm.exec(e);return n===null?null:{kind:"npm",release:[Number(n[1]),Number(n[2]),Number(n[3])]}}function Nm(e,n){for(let t=0;t<3;t+=1){let s=e.release[t]??0,r=n.release[t]??0;if(s!==r)return s<r?-1:1}return 0}var Am=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,Im={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function ds(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function Rm(e){let n=Am.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,s=(t.release??"").split(".");if(s.length===0||s.length>32)return null;let r=[];for(let c of s){let p=ds(c);if(p===null)return null;r.push(p)}let i=0;if(t.epoch!==void 0){let c=ds(t.epoch);if(c===null)return null;i=c}let o=null;if(t.preL!==void 0){let c=t.preN===void 0?0:ds(t.preN);if(c===null)return null;o=[Im[t.preL]??t.preL,c]}let a=null;if(t.postImplicit!==void 0){let c=ds(t.postImplicit);if(c===null)return null;a=c}else if(t.postL!==void 0){let c=t.postN===void 0?0:ds(t.postN);if(c===null)return null;a=c}let d=null;if(t.devL!==void 0){let c=t.devN===void 0?0:ds(t.devN);if(c===null)return null;d=c}let l=t.local===void 0?null:t.local.split(/[-_.]/u).map(c=>/^[0-9]+$/u.test(c)?Number(c):c);return{kind:"PyPI",epoch:i,release:r,pre:o,post:a,dev:d,local:l}}function cs(e,n){return e===n?0:e<n?-1:1}function jl(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function Om(e,n){let t=jl(e),s=jl(n),r=Math.max(t.length,s.length);for(let i=0;i<r;i+=1){let o=cs(t[i]??0,s[i]??0);if(o!==0)return o}return 0}function Bl(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function Pm(e,n){let t=Bl(e),s=Bl(n);return t!==s?t<s?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:cs(e.pre[1],n.pre[1])}function Cm(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:cs(e,n)}function Mm(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:cs(e,n)}function Tm(e,n){let t=typeof e=="number",s=typeof n=="number";return t&&s?cs(e,n):!t&&!s?e===n?0:e<n?-1:1:t?1:-1}function $m(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let s=0;s<t;s+=1){let r=e[s],i=n[s];if(r===void 0)return-1;if(i===void 0)return 1;let o=Tm(r,i);if(o!==0)return o}return 0}function Lm(e,n){let t=cs(e.epoch,n.epoch);if(t!==0)return t;let s=Om(e.release,n.release);if(s!==0)return s;let r=Pm(e,n);if(r!==0)return r;let i=Cm(e.post,n.post);if(i!==0)return i;let o=Mm(e.dev,n.dev);return o!==0?o:$m(e.local,n.local)}function Dm(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=e==="npm"?Em(n):Rm(n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function Ls(e,n){let t=Dm(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function Pr(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return Nm(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return Lm(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function Kl(e,n,t){let s=Ls(e,n);return!(t.introduced!=="0"&&Pr(s,Ls(e,t.introduced))<0||t.fixed!==void 0&&Pr(s,Ls(e,t.fixed))>=0||t.lastAffected!==void 0&&Pr(s,Ls(e,t.lastAffected))>0)}var Go=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function zt(e,n){return Kl(n.ecosystem??"npm",e,n)}function Cr(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),r=new Map(e.classes.map(a=>[a.id,a.name])),i=new Map(e.callSites.map(a=>[a.id,a])),o=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let d=i.get(a.callSiteId);if(d===void 0)continue;let l=s.get(d.enclosingFunctionId);if(l===void 0||!t.has(l.moduleId))continue;let c=n.get(l.moduleId);if(c===void 0)continue;let p=s.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&o.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:a.resolution})}return o}function Fm(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,s)=>t.analyzedVersion<s.analyzedVersion?1:t.analyzedVersion>s.analyzedVersion?-1:0)}function jm(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function zl(e,n,t,s,r,i){if(i<=0)return null;let o=null,a=d=>{(o===null||d.hops<o.hops)&&(o=d)};for(let d of Fm(e,n))for(let l of d.edges){if(l.entryExport!==t||l.entryContainer!==s)continue;if(jm(l,r,d.packageName)){a({viaPackages:[],hops:l.hops,provenance:{tool:d.tool,toolVersion:d.toolVersion,analyzedVersion:d.analyzedVersion}});continue}if(l.target.kind!=="dep")continue;let c=zl(e,l.target.calleePackage,l.target.calleeExport,null,r,i-1);c!==null&&a({viaPackages:[l.target.calleePackage,...c.viaPackages],hops:l.hops+c.hops,provenance:c.provenance})}return o}function Vo(e,n,t,s,r,i){let o=null;for(let a of Cr(e,n,t)){let d=zl(r,a.packageName,a.exportName,a.container,s,i);d!==null&&(o===null||d.hops<o.totalHops)&&(o={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:d.viaPackages,totalHops:d.hops,provenance:d.provenance})}return o}function Mr(e,n){let{args:t,convention:s}=e,r=n.params;if(t===void 0||s===void 0||r===void 0)return{known:!1,reason:"not-emitted"};if(s==="unknown")return{known:!1,reason:"convention"};if(n.reflectiveArguments===!0)return{known:!1,reason:"reflective-arguments"};if(s==="shifted"&&t[0]?.spread!==void 0&&t[0].spread!==!1)return{known:!1,reason:"convention"};let i=s==="shifted"?t.slice(1):t,o=[...r].sort((b,x)=>b.index-x.index),a=o.filter(b=>b.kind==="positional"),d=o.find(b=>b.kind==="rest"),l=o.find(b=>b.kind==="keyword-rest"),c=new Map,p=(b,x)=>{let k=c.get(b);k!=="unknown"&&c.set(b,[...k??[],x])},u=b=>{b!==void 0&&c.set(b,"unknown")},f=[],h=0,g=!1,y=!1;for(let b of i){if(b.spread==="positional"){g=!0;for(let k of a.slice(h))u(k);u(d);continue}if(b.spread==="keyword"){y=!0;for(let k of o)(k.kind==="positional"||k.kind==="keyword-only")&&!c.has(k)&&u(k);u(l);continue}if(b.keyword!==void 0){let k=o.find(w=>w.name===b.keyword&&(w.kind==="positional"||w.kind==="keyword-only"));k!==void 0?c.has(k)?u(k):p(k,b.index):l!==void 0?p(l,b.index):f.push(b.index);continue}if(g){for(let k of a.slice(h))u(k);u(d);continue}let x=a[h];x!==void 0?p(x,b.index):d!==void 0?p(d,b.index):f.push(b.index),h+=1}return{known:!0,params:o.map(b=>{let x=c.get(b);return x==="unknown"?{kind:"unknown"}:x!==void 0?{kind:"args",argIndexes:x}:y&&(b.kind==="positional"||b.kind==="keyword-only")?{kind:"unknown"}:b.kind==="rest"||b.kind==="keyword-rest"?{kind:"args",argIndexes:[]}:{kind:"absent"}}),receiver:Bm(e,n),unbound:f}}function Bm(e,n){if(n.receiver===void 0)return"unknown";if(n.receiver!=="call")return"none";switch(e.convention){case"construct":return"fresh";case"shifted":return(e.args?.length??0)>0?"first-argument":"none";case"direct":return e.receiverRange!==void 0?"receiver-expression":"none";default:return"unknown"}}var Xo=["builtin-call","host-lib-call","primitive-mutation","dependency-boundary","app-unresolved","untyped-call","dependency-callee","app-callee","module-binding","global","free-name","construct","opaque","unregistered-entry","binding","not-emitted","analysis-cap"],Ul=2e4,Km=4,Un=(e,n)=>`${String(e)}-${String(n)}`,Tr=e=>{switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${Un(e.at,e.end)}`;case"argument":return`a${Un(e.at,e.end)}:${String(e.index)}`;case"call-receiver":return`r${Un(e.at,e.end)}`;case"mutated-by-call":return`m${Un(e.at,e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"shared":return`h${String(e.id)}`;default:return e.kind}};function zm(e){if(e.kind==="entry-parameter")return"unregistered-entry";if(e.kind==="unknown")switch(e.reason){case"binding":return"binding";case"not-emitted":return"not-emitted";case"analysis-cap":return"analysis-cap";case"opaque":return e.detail==="construct"?"construct":"opaque";default:return}}function us(e){let n=new Map(e.functions.map(c=>[c.id,c])),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map;for(let c of e.functions){if(c.valueFlows===void 0)continue;let p=new Map;for(let u of c.valueFlows){let f=Tr(u.to),h=p.get(f);h===void 0?p.set(f,[u]):h.push(u)}s.set(c.id,p)}let r=new Map,i=new Map,o=0;for(let c of e.callSites){let p=`${c.range.path}\0${Un(c.range.start,c.range.end)}`;r.has(p)&&(o+=1),r.set(p,c),i.set(c.id,c)}let a=new Map,d=new Map,l=(c,p,u)=>{let f=c.get(p)??[];f.includes(u)||f.push(u),c.set(p,f)};for(let c of e.callEdges){let p=i.get(c.callSiteId);if(p===void 0)continue;let u=c.invocation==="direct";u&&l(a,p.id,c.calleeFunctionId);let f=d.get(c.calleeFunctionId)??[],h=f.find(g=>g.site===p);h===void 0?f.push({site:p,direct:u}):u&&(h.direct=!0),d.set(c.calleeFunctionId,f)}return{functions:n,modules:t,into:s,siteAt:r,identityCollisions:o,callees:a,callers:d}}function Um(e,n){let{args:t,convention:s}=e;if(t===void 0||s===void 0||s!=="direct"&&s!=="construct")return"unknown";for(let r=0;r<=n&&r<t.length;r+=1){let i=t[r];if(i===void 0||i.spread!==!1||i.keyword!==void 0)return"unknown"}return n<t.length?n:"absent"}var ql=e=>[...e.params??[]].sort((n,t)=>n.index-t.index);function qm(e,n,t){if(n===-1)return e.receiver==="receiver-expression"?{kind:"receiver"}:e.receiver==="unknown"?"unknown":null;if(e.receiver==="first-argument"&&n===0)return{kind:"receiver"};let s=e.params.findIndex(r=>r.kind==="args"&&r.argIndexes.includes(n));if(s>=0){let r=ql(t)[s];return r!==void 0?{kind:"param",index:r.index}:"unknown"}return e.unbound.includes(n)?null:"unknown"}function Ds(e,n){let t=new Map,s=v=>{let C=v.class??zm(v),R=v.site===void 0?"":`${v.site.path}:${String(v.site.start)}-${String(v.site.end)}`;t.set(`${v.kind}|${v.functionId}|${v.reason??""}|${v.detail??""}|${R}|${v.via??""}`,C===void 0?v:{...v,class:C})},r=new Map,i=v=>{r.set(`${v.site.path}:${String(v.site.start)}-${String(v.site.end)}|${v.reason}`,v)},o=(v,C)=>{if(C.kind==="receiver")return v.receiverPrimitive===!0;let R=v.args??[];return C.kind==="arg"?R[C.index]?.primitive===!0:R.slice(C.index).every(F=>F.primitive===!0)},a=(v,C,R,F)=>{let P=C.range.start,U=C.range.end,E=Un(P,U),T=C.args,K=T!==void 0&&T.every(V=>V.spread===!1&&V.keyword===void 0),J=T!==void 0&&!K&&T.every(V=>V.spread===!1)&&T.some(V=>V.keyword!==void 0),W=J?T.findIndex(V=>V.keyword!==void 0):Number.POSITIVE_INFINITY,se=(V,fe)=>fe===-1?V.kind==="receiver":fe<W?V.kind==="arg"&&V.index===fe||V.kind==="args-from"&&fe>=V.index:V.kind==="args-from"||V.kind==="arg"&&V.index>=W,Y=F.kind==="call-result"?R.result:R.mutates.filter(V=>se(V.into,F.index)).flatMap(V=>V.from);for(let V of Y){if(V.kind==="receiver"){C.receiverRange!==void 0&&y({fn:v.fn,ref:{kind:"call-receiver",at:P,end:U},stack:v.stack,tracing:E});continue}if(T===void 0||!K&&!J){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:"summary input",site:C.range});continue}let[fe,S]=V.kind==="arg"&&V.index<W?[V.index,Math.min(V.index+1,T.length)]:[Math.min(V.index,W),T.length];for(let A=fe;A<S;A+=1)y({fn:v.fn,ref:{kind:"argument",at:P,end:U,index:A},stack:v.stack,tracing:E})}R.reviewed!==!0&&i({site:C.range,id:R.id,reason:"unreviewed-summary"}),(R.callsProgram??[]).some(V=>!o(C,V))&&i({site:C.range,id:R.id,reason:"calls-program"})},d=(v,C,R,F)=>{if(C.kind==="mutated-by-call"&&C.index>=0&&v.args?.[C.index]?.primitive===!0)return"primitive-mutation";if(R!==null){let P=e.modules.get(R.moduleId),U=e.modules.get(F.moduleId);return P===void 0?"not-emitted":P.externalSurface===!0||P.packageName!==U?.packageName?"dependency-callee":"app-callee"}switch(v.calleeDecl){case"ecmascript":case"runtime":return"builtin-call";case"host-lib":return"host-lib-call";case"dependency":return"dependency-boundary";case"app":return"app-unresolved";default:return"untyped-call"}},l=new Set,c=[],p=new Map,u=null,f,h=v=>`${v.fn}\0${Tr(v.ref)}\0${v.stack.map(C=>C.id).join(",")}\0${String(v.tracing??"")}`,g=v=>{if(f!==void 0)return;let C=[{functionId:v.fn,ref:v.ref}];for(let R=u;R!==null;){let F=p.get(R);if(F===void 0)break;C.push({functionId:F.state.fn,ref:F.state.ref}),R=F.key}f=C},y=v=>{let C=h(v);l.has(C)||(l.add(C),p.set(C,{key:u,state:v}),c.push(v))},_=n.site.enclosingFunctionId,b=n.site.range.start,x=n.site.range.end;if(n.port.kind==="receiver")y({fn:_,ref:{kind:"call-receiver",at:b,end:x},stack:[],tracing:Un(b,x)});else{let v=Um(n.site,n.port.index);v==="unknown"?s({kind:"unknown",functionId:_,reason:"binding"}):v==="absent"?s({kind:"constant",functionId:_,detail:"no argument"}):y({fn:_,ref:{kind:"argument",at:b,end:x,index:v},stack:[],tracing:Un(b,x)})}let k=0;for(;c.length>0;){if(k+=1,k>Ul){s({kind:"unknown",functionId:_,reason:"analysis-cap"});break}let v=c.pop();u=h(v);let C=e.into.get(v.fn),R=e.functions.get(v.fn);if(C===void 0||R===void 0){s({kind:"unknown",functionId:v.fn,reason:"not-emitted"});continue}let F=C.get(Tr(v.ref));if(F!==void 0&&F.length>0){for(let U of F)v.tracing!==void 0&&U.from.kind==="mutated-by-call"&&Un(U.from.at,U.from.end)===v.tracing&&e.siteAt.get(`${R.declRange.path}\0${v.tracing}`)?.repeats===!1||y({...v,ref:U.from});if(v.ref.kind!=="param"&&v.ref.kind!=="receiver"&&v.ref.kind!=="call-result"&&v.ref.kind!=="mutated-by-call"&&v.ref.kind!=="free")continue}let P=v.ref;switch(P.kind){case"constant":s({kind:"constant",functionId:v.fn});break;case"opaque":s({kind:"unknown",functionId:v.fn,reason:"opaque",detail:P.reason});break;case"source":s({kind:"source",functionId:v.fn,sourceClass:P.sourceClass,model:P.model}),g(v);break;case"free":s({kind:"unknown",functionId:v.fn,reason:"free",detail:P.name,class:P.binding==="module"?"module-binding":P.binding==="global"?"global":"free-name"});break;case"local":case"return":(F===void 0||F.length===0)&&s({kind:"constant",functionId:v.fn,detail:"undefined"});break;case"param":case"receiver":{let U=P.kind==="param"?R.sourceParams?.find(W=>W.index===P.index):void 0;U!==void 0&&(s({kind:"source",functionId:v.fn,sourceClass:U.sourceClass,model:U.model}),g(v));let E=v.stack[v.stack.length-1],T=E!==void 0?[{site:E,direct:!0}]:e.callers.get(v.fn)??[],K=U!==void 0?T.filter(W=>W.direct&&W.site.args!==void 0):T;if(U!==void 0&&K.length===0)break;let J=E!==void 0?v.stack.slice(0,-1):[];if(K.length===0){s({kind:"entry-parameter",functionId:v.fn,detail:P.kind==="param"?`param ${String(P.index)}`:"receiver"});break}for(let{site:W,direct:se}of K){if(!se){s({kind:"unknown",functionId:W.enclosingFunctionId,reason:"binding",detail:"callback"});continue}let Y=Mr(W,R);if(!Y.known){s({kind:"unknown",functionId:W.enclosingFunctionId,reason:"binding",detail:Y.reason});continue}let V=W.range.start,fe=W.range.end,S=Un(V,fe),A=W.enclosingFunctionId;if(P.kind==="receiver"){Y.receiver==="receiver-expression"?y({fn:A,ref:{kind:"call-receiver",at:V,end:fe},stack:J,tracing:S}):Y.receiver==="first-argument"?y({fn:A,ref:{kind:"argument",at:V,end:fe,index:0},stack:J,tracing:S}):Y.receiver==="none"?s({kind:"constant",functionId:A,detail:"no receiver"}):s({kind:"unknown",functionId:A,reason:"binding",detail:`receiver ${Y.receiver}`});continue}let j=ql(R).findIndex(X=>X.index===P.index),ne=Y.params[j];if(ne===void 0||ne.kind==="unknown")s({kind:"unknown",functionId:A,reason:"binding"});else if(ne.kind==="absent")(F===void 0||F.length===0)&&s({kind:"constant",functionId:v.fn,detail:"no argument"});else for(let X of ne.argIndexes)y({fn:A,ref:{kind:"argument",at:V,end:fe,index:X},stack:J,tracing:S})}break}case"call-result":case"mutated-by-call":{let U=e.siteAt.get(`${R.declRange.path}\0${Un(P.at,P.end)}`);if(U===void 0){s({kind:"unknown",functionId:v.fn,reason:"unresolved-call",detail:"no call site at offset",class:"not-emitted"});break}let E=e.callees.get(U.id)??[];if(E.length===0&&U.summary!==void 0){a(v,U,U.summary,P);break}if(E.length===0){s({kind:"unknown",functionId:v.fn,reason:"unresolved-call",...U.runtimeId!==void 0?{detail:U.runtimeId}:{},site:U.range,via:P.kind==="call-result"?"result":"mutation",class:d(U,P,null,R)});break}let T=v.stack.length>=Km?[]:[...v.stack,U];for(let K of E){let J=e.functions.get(K);if(J===void 0||!e.into.has(K)){s({kind:"unknown",functionId:v.fn,reason:"opaque-callee",detail:K,site:U.range,via:P.kind==="call-result"?"result":"mutation",class:J===void 0?"not-emitted":d(U,P,J,R)});continue}if(P.kind==="call-result"){y({fn:K,ref:{kind:"return"},stack:T});continue}let W=Mr(U,J);if(!W.known){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:W.reason});continue}let se=qm(W,P.index,J);if(se==="unknown"){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:"mutation target",site:U.range});continue}if(se===null)continue;let Y=(e.into.get(K)?.get(Tr(se))??[]).filter(V=>V.kind==="field"||V.kind==="mutation");for(let V of Y)y({fn:K,ref:V.from,stack:T})}break}case"argument":case"call-receiver":(F===void 0||F.length===0)&&s({kind:"unknown",functionId:v.fn,reason:"not-emitted",detail:"no flow into the argument"});break}}let w=[...t.values()],I=[...r.values()];return{outcome:w.some(v=>v.kind==="source")?"influenced":w.some(v=>v.kind==="unknown")||I.length>0?"unknown":w.some(v=>v.kind==="entry-parameter")?"reaches-entry-parameter":"no-source-reached",leaves:w,caveats:I,visited:l.size,...f!==void 0?{witness:f}:{}}}var Fs={"no-contract":"cupel","no-source-model":"cupel","control-influence-unsupported":"cupel","analysis-cap":"cupel"};function Yo(e){if(Hl.includes(e))return{value:"unknown",kind:"no-contract"}}function js(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function fs(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function $r(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let r=t.get(s.importId);if(r===void 0)continue;let i=n.get(r.moduleId)??[];i.push(s.resolvedModuleId),n.set(r.moduleId,i)}return n}function Hm(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let r=t.get(s.importId);if(r===void 0)continue;let i=n.get(s.resolvedModuleId)??[];i.push(r.moduleId),n.set(s.resolvedModuleId,i)}return n}function qn(e){let n=$r(e),t=new Set,s=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;s.length>0;){let r=s.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let i of n.get(r)??[])t.has(i)||s.push(i)}}return t}function Wm(e,n){let t=Hm(e),s=new Set,r=[n];for(;r.length>0;){let i=r.pop();if(!(i===void 0||s.has(i))){s.add(i);for(let o of t.get(i)??[])s.has(o)||r.push(o)}}return s}function Gm(e,n,t){let s=$r(e),r=fs(e),i=new Set,o=[n];for(;o.length>0;){let a=o.pop();if(a===void 0||i.has(a))continue;i.add(a);let d=r.get(a);if(d===void 0||d.externalSurface===!0||t.has(a))return!0;for(let l of s.get(a)??[])i.has(l)||o.push(l)}return!1}function Bs(e,n,t,s=new Set){let r=$r(e),i=fs(e),o=new Set,a=[],d=[n];for(;d.length>0;){let l=d.pop();if(l===void 0||o.has(l))continue;o.add(l);let c=i.get(l);if(c===void 0){a.push({module:l,kind:"absent"});continue}if(t.has(l)){a.push({module:l,kind:"unbounded"});continue}if(c.externalSurface===!0&&!s.has(l)){a.push({module:l,kind:"surface"});continue}for(let p of r.get(l)??[])o.has(p)||d.push(p)}return a}function Xl(e){let n=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.id)),t=new Map(e.functions.map(o=>[o.id,o])),s=fs(e),r=new Map;for(let o of e.functions)n.has(o.moduleId)&&(o.publicSurfaceReachable||o.name==="<toplevel>")&&r.set(o.id,o);let i=new Map(e.exports.map(o=>[o.id,o]));for(let o of e.exportBindings){if(o.target.kind!=="function")continue;let a=i.get(o.exportId);if(a===void 0||!n.has(a.moduleId))continue;let d=t.get(o.target.functionId);d===void 0||s.get(d.moduleId)?.externalSurface===!0||r.set(d.id,d)}return[...r.values()]}function Yl(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),i=r[0]?.startsWith("@")===!0?2:1;return r.slice(i).join("/")}function Vm(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let s=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(i=>[i.id,i]));return e.functions.find(i=>{if(i.name!==t.exportName)return!1;let o=n.get(i.moduleId);if(o===void 0||o.packageName!==t.packageName)return!1;if(s){if(i.kind!==t.symbolKind||i.enclosingClassId===void 0||r.get(i.enclosingClassId)?.name!==t.container)return!1}else if(i.kind!=="function")return!1;return o.externalSurface===!0?!0:Yl(o.path)===t.sourcePath})}function Wl(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Yl(t.path)===n.sourcePath)}function Xm(e,n,t,s){let r=new Map(e.functions.map(i=>[i.id,i]));return e.callSites.some(i=>i.calleeExprShape!=="member"||i.resolution!=="resolved"?!1:i.resolvedTargetIds.some(o=>{let a=r.get(o);if(a?.name!==s.exportName)return!1;let d=n.get(a.moduleId);return d?.externalSurface===!0&&d.packageName===s.packageName&&t.has(a.moduleId)}))}function Ym(e,n,t){return t.container===null?!0:e.classes.some(s=>{if(s.name!==t.container)return!1;let r=n.get(s.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function Jm(e,n,t){let s=new Map(e.callSites.map(d=>[d.id,d.enclosingFunctionId])),r=new Map;for(let d of e.callEdges){let l=s.get(d.callSiteId);if(l===void 0)continue;let c=r.get(l)??[];c.push({to:d.calleeFunctionId,res:d.resolution,site:d.callSiteId}),r.set(l,c)}let i=d=>{let l=new Set,c=n.map(p=>({id:p.id,prev:null,via:null}));for(let p of c)l.add(p.id);for(;c.length>0;){let p=c.shift();if(p===void 0)break;if(p.id===t){let u=[],f=[];for(let h=p;h!==null;h=h.prev)u.unshift(h.id),f.unshift(h.via);return{path:u,via:f}}for(let u of r.get(p.id)??[])u.res!=="unresolved"&&(u.res==="field-based"&&!d||l.has(u.to)||(l.add(u.to),c.push({id:u.to,prev:p,via:u.site})))}return null},o=i(!1);if(o!==null)return{...o,usedFieldBased:!1};let a=i(!0);return a!==null?{...a,usedFieldBased:!0}:null}function Jo(e,n,t){let s=new Map(e.callSites.map(y=>[y.id,y.enclosingFunctionId])),r=new Map,i=new Map,o=[],a=(y,_,b)=>{let x=y.get(_);x===void 0?y.set(_,[b]):x.push(b)};for(let y of e.callEdges){if(y.resolution==="unresolved"||y.resolution==="field-based"&&!t)continue;let _=s.get(y.callSiteId);if(_===void 0)continue;let b=y.calleeFunctionId;a(r,_,b),a(i,b,_),o.push({from:_,to:b,site:y.callSiteId})}let d=new Set,l=Xl(e).map(y=>y.id);for(let y of l)d.add(y);for(let y=0;y<l.length;y+=1)for(let _ of r.get(l[y])??[])d.has(_)||(d.add(_),l.push(_));if(!d.has(n))return null;let c=new Map([[n,0]]),p=[n];for(let y=0;y<p.length;y+=1){let _=p[y],b=(c.get(_)??0)+1;for(let x of i.get(_)??[])c.has(x)||!d.has(x)||(c.set(x,b),p.push(x))}let u=(y,_)=>y<_?-1:y>_?1:0,f=[...c].map(([y,_])=>({functionId:y,distance:_})).sort((y,_)=>y.distance-_.distance||u(y.functionId,_.functionId)),h=new Set,g=o.filter(y=>c.has(y.from)&&c.has(y.to)).filter(y=>{let _=JSON.stringify([y.from,y.to,y.site]);return h.has(_)?!1:(h.add(_),!0)}).sort((y,_)=>u(y.from,_.from)||u(y.to,_.to)||u(y.site,_.site));return{functions:f,edges:g}}function Gl(e,n){let t=new Set,s=[...e];for(let r=s.pop();r!==void 0;r=s.pop())if(!t.has(r)){t.add(r);for(let i of n(r)??[])t.has(i)||s.push(i)}return t}var Vl=new WeakMap;function Zm(e,n){let t=Vl.get(n);if(t!==void 0&&t.graph===e)return t.reach;let s=qn(e),r=n.filter(o=>o.reach.kind==="dependency-dispatch"&&s.has(o.source)).map(o=>o.source),i=new Set;if(r.length>0){let o=$r(e),a=Gl(r,p=>o.get(p)),d=e.functions.filter(p=>s.has(p.moduleId)&&(a.has(p.moduleId)||p.addressTaken!==!1)).map(p=>p.id),l=new Map(e.callSites.map(p=>[p.id,p.enclosingFunctionId])),c=new Map;for(let p of e.callEdges){if(p.resolution==="unresolved")continue;let u=l.get(p.callSiteId);if(u===void 0)continue;let f=c.get(u);f===void 0?c.set(u,[p.calleeFunctionId]):f.push(p.calleeFunctionId)}i=Gl(d,p=>c.get(p))}return Vl.set(n,{graph:e,reach:i}),i}function Zo(e){return Jl(e,fs(e),qn(e),Zl(e))}function Jl(e,n,t,s){let r=[],i=[],o=new Map(e.functions.map(d=>[d.id,d.moduleId])),a=d=>d!==void 0&&t.has(d)&&s.has(n.get(d)?.packageName??"");for(let d of e.callSites)d.resolution==="unresolved"&&a(o.get(d.enclosingFunctionId))&&r.push(d.range);for(let d of e.imports)!d.specifierIsLiteral&&t.has(d.moduleId)&&i.push({path:n.get(d.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:i}}function Zl(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function Qm(e,n,t){let s=new Map(e.functions.map(o=>[o.id,o])),r=fs(e),i=new Map(e.callSites.map(o=>[o.id,o]));return n.map((o,a)=>{let d=s.get(o),l=d!==void 0?r.get(d.moduleId):void 0,c=t[a];return{functionId:o,functionName:d?.name,modulePath:l?.path??"",calledAt:c==null?null:i.get(c)?.range??null}})}function Qo(e){let{graph:n,installed:t,range:s,symbol:r,coverage:i}=e,o=[],a={unresolvedSites:o,unresolvedEvidence:{own:o,sets:[]}},d=W=>({unresolvedSites:W,unresolvedEvidence:{own:W,sets:[]}}),l=Zl(n),c=new Set;for(let W of e.incompleteness)W.reach.kind==="unbounded"&&c.add(W.source);let p=e.incompleteness.some(W=>W.reach.kind==="assumed-bounded")?"loader-assumption":"complete",u=W=>W==="not-reachable"?p:void 0,f=new Map,h=W=>{let se=f.get(W);return se===void 0&&(se=Gm(n,W,c),f.set(W,se)),se},g=W=>W.reach.kind==="class-scope"&&r!==null&&r.packageName===W.reach.packageName&&r.container===W.reach.container,y=W=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let se of Go)for(let Y of e.incompleteness)if(Y.cause===se&&W(Y))return{cause:Y.cause,source:Y.source};return null},_=(W,se)=>{let Y;return y(V=>V.reach.kind==="unbounded"?!0:V.reach.kind==="class-scope"?g(V):V.reach.kind==="dependency-dispatch"?se===void 0||Zm(n,e.incompleteness).has(se):V.reach.kind==="loaded-package"?(s.ecosystem??"npm")===V.reach.ecosystem:W===void 0||h(V.reach.anchor)?!0:(Y??=Wm(n,W),Y.has(V.reach.anchor)))},b=()=>y(W=>W.reach.kind==="unbounded"?!0:W.reach.kind==="class-scope"?g(W):W.reach.kind==="dependency-dispatch"?!1:W.reach.kind==="loaded-package"?(s.ecosystem??"npm")===W.reach.ecosystem&&(W.reach.alsoLoaded?.includes(s.packageName)??!1):h(W.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${s.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let x;try{if((t.ecosystem??"npm")!==(s.ecosystem??"npm"))throw new Error("ecosystem mismatch");x=zt(t.version,s)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:u("unknown"),path:void 0,...a}}if(!x)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${s.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let k=fs(n),w=qn(n),I=W=>{if(W.cause!=="dynamic-load"||W.source===null)return o;let se=k.get(W.source);return se===void 0?o:[{path:se.path,start:0,end:0}]},{dispatch:N,load:v}=Jl(n,k,w,l),C=[...N,...v],R={unresolvedSites:v,unresolvedEvidence:{own:o,sets:["load"]}},F={unresolvedSites:C,unresolvedEvidence:{own:o,sets:["dispatch","load"]}},P=W=>{for(let se of w)if(k.get(se)?.packageName===W)return!0;return!1},U=W=>({tier:"unknown",decidedAtStage:W,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:u("unknown"),path:void 0,...a}),E=()=>{if(!P(s.packageName)){if(v.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:u("unknown"),path:void 0,...R};let W=b();return W!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:W.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(I(W))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${s.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:u("unknown"),path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${s.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${s.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}}return null};if(r===null||!r.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,basis:u("unknown"),path:void 0,...F};if(i!==null&&!i.comparedPaths.has(r.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:u("unknown"),path:void 0,...F};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:u("unknown"),path:void 0,...F};let T=Vm(n,k,r);if(T===void 0||!w.has(T.moduleId)){if(T===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&Xm(n,k,w,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...F};if(T===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!Ym(n,k,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...F};let W=E();if(W!==null)return W;if(C.length>0){let V=T!==void 0?k.get(T.moduleId):Wl(n,r),fe=T===void 0&&V!==void 0&&V.externalSurface!==!0&&w.has(V.id)&&!l.has(V.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:v.length>0?"dynamic-load":fe?"dep-opaque":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,...F}}let se=T!==void 0?k.get(T.moduleId):Wl(n,r);if(T===void 0&&se!==void 0&&se.externalSurface!==!0&&w.has(se.id)&&!l.has(se.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...a};let Y=se!==void 0?_(se.id,T?.id):b();return Y!==null?{tier:"unknown",decidedAtStage:T===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:Y.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(I(Y))}:s.surfaceComplete?{tier:"not-reachable",decidedAtStage:T===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:U(T===void 0?"symbol-reachable":"module-reachable")}let K=Jm(n,Xl(n),T.id);if(K!==null)return{tier:js(K.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Lr(r),basis:u("reachable-high"),path:Qm(n,K.path,K.via),...a};if(C.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but unresolved edges exist`,unknownKind:v.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,...F};let J=_(T.moduleId,T.id);return J!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:J.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(I(J))}:s.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:U("call-path-confirmed")}function eh(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function nh(e,n,t){let s=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let i=n.get(r.moduleId);if(!(i===void 0||i.packageName!==t.packageName||(r.enclosingClassId!==void 0?s.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function th(e,n,t){if(n===t)return[];let s=new Map(e.functions.map(d=>[d.id,d])),r=new Map(e.callSites.map(d=>[d.id,d])),i=new Map;for(let d of e.callEdges){if(d.resolution!=="resolved"&&d.resolution!=="field-based")continue;let l=r.get(d.callSiteId);if(l===void 0)continue;let c=l.enclosingFunctionId;if(!s.has(c)||!s.has(d.calleeFunctionId))continue;let p=i.get(c),u={to:d.calleeFunctionId,label:d.resolution};p===void 0?i.set(c,[u]):p.push(u)}let o=new Set([n]),a=[{at:n,labels:[]}];for(let d=0;d<a.length;d++){let l=a[d];for(let c of i.get(l.at)??[]){if(o.has(c.to))continue;let p=[...l.labels,c.label];if(c.to===t)return p;o.add(c.to),a.push({at:c.to,labels:p})}}return null}function Ks(e,n,t,s,r){if(r.length===0)return null;let i=Cr(e,n,t);if(i.length===0)return null;let o=nh(e,n,s);for(let a of r){let d=i.filter(c=>c.packageName===a.anchor.packageName&&c.exportName===a.anchor.exportName&&c.container===a.anchor.container),l=d.find(c=>c.resolution==="resolved")??d[0];if(l!==void 0){if(eh(a.callee,s))return{tier:js("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[l.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&o!==null){let c=th(e,a.callee.realFunctionId,o);if(c!==null)return{tier:js("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[l.resolution,"modeled",...c]}}}}return null}var Ql=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],ed=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"],Hl=["reachable-high","reachable-medium","reachable-low"];function Lr(e){return e.verified?"gated":"candidate"}var ei=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],ni=["cupel","project"],Rn={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function nd(e){return Rn[e]}import{randomBytes as ol}from"node:crypto";import{performance as Cs}from"node:perf_hooks";import xd from"node:path";import{closeSync as sh,constants as td,fstatSync as rh,openSync as oh,readSync as ih,realpathSync as sd}from"node:fs";import ti from"node:path";var ah=8*1024*1024;function zs(e){return e==="PyPI"?"utf8-bytes":"utf16-units"}var Nt=class{#e;#t;#n=new Map;constructor(n,t=ah){this.#t=t;let s;try{s=sd(n)}catch{s=null}this.#e=s}read(n){let t=this.#n.get(n);if(t!==void 0)return t;let s=this.#s(n);return this.#n.set(n,s),s}#s(n){let t=this.#e;if(t===null||n===""||ti.isAbsolute(n))return null;let s;try{s=sd(ti.join(t,n))}catch{return null}if(s!==t&&!s.startsWith(`${t}${ti.sep}`))return null;let r;try{r=oh(s,td.O_RDONLY|td.O_NONBLOCK)}catch{return null}try{let i=rh(r);if(!i.isFile()||i.size>this.#t)return null;let o=Buffer.alloc(i.size),a=0;for(;a<i.size;){let d=ih(r,o,a,i.size-a,a);if(d===0)break;a+=d}return a===i.size?o:null}catch{return null}finally{sh(r)}}};function rd(e,n,t){if(!Number.isInteger(n)||n<0)return null;if(t==="utf8-bytes"){if(n>e.length)return null;let o=e.subarray(0,n),a=1;for(let l of o)l===10&&(a+=1);let d=o.lastIndexOf(10)+1;return[a,e.subarray(d,n).toString("utf8").length+1]}let s=e.toString("utf8");if(n>s.length)return null;let r=s.slice(0,n),i=1;for(let o=0;o<r.length;o+=1)r.charCodeAt(o)===10&&(i+=1);return[i,n-(r.lastIndexOf(`
-`)+1)+1]}function At(e,n,t){if(n.end<n.start)return null;let s=e.read(n.path);if(s===null)return null;let r=rd(s,n.start,t),i=rd(s,n.end,t);return r===null||i===null?null:{startLine:r[0],startColumn:r[1],endLine:i[0],endColumn:i[1]}}var lh="cupel/influence-shadow/2",od=64,id=16,dh=e=>e.startsWith("reachable-");function Dr(e){let n=new Map(e.functions.map(t=>[t.id,t.moduleId]));return{...e,functions:e.functions.map(t=>({...t,declRange:{...t.declRange,path:t.moduleId}})),callSites:e.callSites.map(t=>{let s=n.get(t.enclosingFunctionId);return s===void 0?t:{...t,range:{...t.range,path:s}}})}}function ad(e,n,t,s=()=>null,r=null){let i=t(),o={graph:e,lineOf:s},a={npm:o,PyPI:r},d=new Map,l=b=>{let x=d.get(b);return x===void 0&&(x=us(b.graph),d.set(b,x)),x};l(o);let c=Object.fromEntries(Xo.map(b=>[b,0])),p=0,u=0,f=b=>x=>{let{site:k,...w}=x;return k===void 0?w:{...w,site:{...k,line:b.lineOf?.(k)??null}}},h={influenced:0,"no-source-reached":0,"reaches-entry-parameter":0,unknown:0},g={},y=0,_=[];for(let b of n){if(!dh(b.tier))continue;let x={advisoryId:b.advisoryId,packageName:b.packageName,version:b.version,ecosystem:b.ecosystem,symbol:b.symbolName,tier:b.tier},k=b.ecosystem==="npm"||b.ecosystem==="PyPI"?a[b.ecosystem]:null;if(k===null){_.push({...x,skipped:b.ecosystem==="PyPI"?"this scan holds no Python graph to ask":`no front-end emits value flows for ${b.ecosystem}`,sites:[],truncatedSites:!1});continue}let w=l(k),I=f(k),N=b.path?.[b.path.length-1]?.functionId,v=N!==void 0?(w.callers.get(N)??[]).filter(R=>R.direct).map(R=>R.site):[],C=[];for(let R of v.slice(0,od)){let F=[],P=R.args?.length??1,U=(E,T)=>{let K=Ds(w,{site:R,port:T});y+=1,h[K.outcome]+=1,K.caveats.length>0&&(u+=1);for(let J of K.leaves)J.kind==="unknown"&&J.reason!==void 0&&(g[J.reason]=(g[J.reason]??0)+1),(J.kind==="unknown"||J.kind==="entry-parameter")&&(J.class===void 0?p+=1:c[J.class]+=1);F.push({port:E,outcome:K.outcome,leaves:K.leaves.map(I),caveats:K.caveats,visited:K.visited,...K.witness!==void 0?{witness:K.witness}:{}})};for(let E=0;E<Math.min(P,id);E+=1)U(`arg[${String(E)}]`,{kind:"arg",index:E});R.receiverRange!==void 0&&U("receiver",{kind:"receiver"}),C.push({path:R.range.path,start:R.range.start,enclosing:R.enclosingFunctionId,ports:F,truncatedArgs:P>id})}_.push({...x,sites:C,truncatedSites:v.length>od})}return{format:lh,findings:_,totals:{findings:_.length,ports:y,byOutcome:h,unknownReasons:g,identityCollisions:[...d.values()].reduce((b,x)=>b+x.identityCollisions,0),byClass:c,unclassified:p,portsWithCaveats:u},wallMs:Math.round((t()-i)*10)/10}}function Ve(e){return Buffer.byteLength(JSON.stringify(e),"utf8")}function Fr(e,n){return 2+e+Math.max(n-1,0)}function ld(e){return String(e).length}var It=class{#e;constructor(n,t){let s=new Float64Array(n+2);for(let[r,i]of t)s[r+1]=(s[r+1]??0)+i;for(let r=1;r<s.length;r+=1)s[r]=(s[r]??0)+(s[r-1]??0);this.#e=s}below(n){return this.#e[n]??0}},ri=class{index;finding;key;size;kept;#e;#t;#n;#s;#o;#i;#a;#r;#l;#d;#c;#u;#f;constructor(n,t,s,r){this.index=n,this.finding=t,this.key=r,this.size=s.nodes.length,this.kept=s.nodes.length,this.#e=s,this.#t=t.influence?.overlay??null;let i=this.size,o=new Map;s.nodes.forEach((f,h)=>{o.has(f.id)||o.set(f.id,h)}),this.#n=o;let a=f=>o.get(f)??i,d=f=>Math.max(a(f.from),a(f.to));this.#s=new It(i,s.nodes.map((f,h)=>[h,Ve(f)])),this.#o=new It(i,s.edges.map(f=>[d(f),Ve(f)])),this.#i=new It(i,s.edges.map(f=>[d(f),1])),this.#c=Ve({...s,nodes:[],edges:[],truncated:0})-5;let l=this.#t,c=l?.inputs??[];this.#a=new It(i,c.map(f=>[a(f.node),Ve(f)])),this.#r=new It(i,c.map(f=>[a(f.node),1]));let p=0,u=[];for(let f of l?.blockers??[]){let h=Ve(f.node===null?f:{...f,node:null});p+=h,f.node!==null&&u.push([a(f.node),Ve(f)-h])}this.#l=new It(i,u),this.#d=p,this.#u=l===null?0:Ve({...l,inputs:[],blockers:[],truncated:0})-5,this.#f=Ve(s)+(l===null?0:Ve(l))}bytesAt(n){if(n===this.size)return this.#f;let t=this.#c+Fr(this.#s.below(n),n)+Fr(this.#o.below(n),this.#i.below(n))+ld(this.#e.truncated+(this.size-n)),s=this.#t;if(s===null)return t;let r=this.#r.below(n);return t+this.#u+Fr(this.#a.below(n),r)+Fr(this.#d+this.#l.below(n),s.blockers.length)+ld(s.truncated+(s.inputs.length-r))}cut(){let n=this.kept,t=u=>(this.#n.get(u)??this.size)<n,s=this.#e,r=s.edges.filter(u=>t(u.from)&&t(u.to)),i={...s,nodes:s.nodes.slice(0,n),edges:r,truncated:s.truncated+(this.size-n)},o=this.#t,a=this.finding;if(o===null||a.influence===null)return{finding:{...a,reach:i},calls:s.edges.length-r.length,inputs:0,offGraph:0};let d=o.inputs.filter(u=>t(u.node)),l=0,c=o.blockers.map(u=>u.node===null||t(u.node)?u:(l+=1,{...u,node:null})),p={...o,inputs:d,blockers:c,truncated:o.truncated+(o.inputs.length-d.length)};return{finding:{...a,reach:i,influence:{...a.influence,overlay:p}},calls:s.edges.length-r.length,inputs:o.inputs.length-d.length,offGraph:l}}};function si(e,n){return e<n?-1:e>n?1:0}function ch(e,n){return si(e.finding.advisoryId,n.finding.advisoryId)||si(e.finding.packageName,n.finding.packageName)||si(e.key,n.key)}function dd(e,n,t){let s=Ve(e);if(s<=n)return{payload:e,bytes:s,cut:null};let r=e.findings.flatMap((g,y)=>g.reach!==null&&g.reach.nodes.length>1?[new ri(y,g,g.reach,t(g))]:[]);if(r.length===0)return{payload:e,bytes:s,cut:null};r.sort(ch);let i=r.reduce((g,y)=>Math.max(g,y.size),0),o=s;for(let g=i;g>1&&o>n;g-=1)for(let y of r){if(o<=n)break;y.size<g||(o+=y.bytesAt(y.kept-1)-y.bytesAt(y.kept),y.kept-=1)}let a=new Map(r.filter(g=>g.kept<g.size).map(g=>[g.index,g]));if(a.size===0)return{payload:e,bytes:s,cut:null};let d=0,l=0,c=0,p=0,u=e.findings.map((g,y)=>{let _=a.get(y);if(_===void 0)return g;let b=_.cut();return d+=_.size-_.kept,l+=b.calls,c+=b.inputs,p+=b.offGraph,b.finding}),f={...e,findings:u},h=Ve(f);return{payload:f,bytes:h,cut:{budget:n,bytesBefore:s,bytesAfter:h,graphsCut:a.size,functionsCut:d,callsCut:l,inputsCut:c,blockersOffGraph:p,exhausted:h>n}}}function cd(e){let n=0,t=0,s=0,r=0;for(let d of e.findings){d.reach!==null&&(n+=Ve(d.reach));let l=d.influence?.overlay??null;l!==null&&(t+=Ve(l)),d.path!==null&&(s+=Ve(d.path)),r+=Ve(d.unresolvedSites)}let i=0;for(let d of e.advisories)d.details!==null&&(i+=Ve(d.details));let o=Ve(e.findings),a=Ve(e.advisories);return[{name:"the reach graphs",bytes:n},{name:"the influence overlays",bytes:t},{name:"the call paths",bytes:s},{name:"the findings' own unresolved sites",bytes:r},{name:"the rest of the findings",bytes:o-n-t-s-r},{name:"the app-global unresolved sets",bytes:Ve(e.unresolved)},{name:"the advisory descriptions",bytes:i},{name:"the rest of the advisory records",bytes:a-i},{name:"the package graphs",bytes:Ve(e.packageGraphs)}].sort((d,l)=>l.bytes-d.bytes)}function ud(e){let n=e.exhausted?`; every graph is down to its vulnerable function and the payload is still ${String(e.bytesAfter)} bytes`:"";return`the findings payload was ${String(e.bytesBefore)} bytes, over its ${String(e.budget)}-byte budget, so ${String(e.graphsCut)} reach graph(s) were cut nearest the vulnerable function first (ADR-120): ${String(e.functionsCut)} function(s) dropped and counted in each graph's \`truncated\`, with the ${String(e.callsCut)} call(s) that touched them and the ${String(e.inputsCut)} overlay input(s) on them${n}`}function On(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function fd(e,n={}){let t=n.maxBytes??1073741824,s=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((i,o)=>{let a=r(e,n.headers!==void 0?{headers:n.headers}:{},d=>{let l=d.statusCode??0;if(l<200||l>=300){d.resume(),o(new Error(`GET ${e} \u2192 HTTP ${String(l)}`));return}let c=[],p=0;d.on("data",u=>{if(p+=u.length,p>t){d.destroy(),o(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}c.push(u)}),d.on("end",()=>{i(Buffer.concat(c))}),d.on("error",o)});a.on("error",o),a.setTimeout(s,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(s)}ms`))})})}async function Us(e,n,t,s,r,i=3e4){let{request:o}=await import("node:https"),a=new URL(n).hostname;return await new Promise((d,l)=>{let c=o(n,{method:e,headers:t},p=>{let u=[],f=0;p.on("data",h=>{if(f+=h.length,f>r){p.destroy(),l(new Error(`${e} to ${a} returned more than ${String(r)} bytes`));return}u.push(h)}),p.on("end",()=>{d({status:p.statusCode??0,body:Buffer.concat(u).toString("utf8")})}),p.on("error",()=>{l(new Error(`${e} to ${a} failed`))})});c.on("error",()=>{l(new Error(`${e} to ${a} failed`))}),c.setTimeout(i,()=>{c.destroy(new Error(`${e} to ${a} timed out after ${String(i)}ms`))}),s!==void 0&&c.write(s),c.end()})}var qs="api.cupel.sh",uh=`https://${qs}/v1/findings`,fh=64*1024,Ut=8*1024*1024,ph=3e4,Rt=class extends Error{constructor(n){super(n),this.name="PushError"}};async function pd(e,n,t,s={}){if(e.length>Ut)throw new Rt(`findings payload is ${String(e.length)} bytes, over the ${String(Ut)}-byte limit`);let r=On(uh,new Set([qs])),i;try{i=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,s.timeoutMs??ph)}catch{throw new Rt(`the findings push to ${qs} failed`)}if(i.body.length>fh)throw new Rt("the control plane returned a response larger than it should");if(!(i.status===202||i.status===200))throw i.status===401||i.status===403?new Rt("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):i.status===400?new Rt("the control plane rejected the findings payload as malformed"):new Rt(`the findings push was refused with status ${String(i.status)}`)}var mh=13,Ot={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:1024,maxAdvisoryDetails:8e3,maxReachNodes:512,maxReachEdges:2048,maxPackageGraphNodes:256,maxPackageGraphEdges:1024,maxPackageGraphs:2e4,maxSourcePosition:1e7},hh=7.5*1024*1024,tt=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function ii(e){return{path:e.path,start:e.start,end:e.end}}function gh(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new tt(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,s=e.modelPromotedFromKind??null;if(t===null!=(s===null))throw new tt(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new tt(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,symbolContainer:e.symbolContainer,symbolPath:e.symbolPath,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:nd(n),basis:e.basis??null,path:yh(e),unresolvedSites:e.unresolvedEvidence.own.map(ii),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:s,surfaceComplete:e.surfaceComplete??null,reach:_h(e),introducedBy:e.introducedBy??null,influence:e.influence===void 0?null:{value:e.influence.value,kind:e.influence.kind,owner:Fs[e.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null,overlay:e.influenceOverlay??null}}}function md(e){return e===null?null:{line:e.line,column:e.column}}function yh(e){if(e.path===void 0)return null;let n=e.located?.path??null;return n!==null&&n.length===e.path.length?n.map((t,s)=>({functionName:e.path?.[s]?.functionName??null,modulePath:t.modulePath,line:t.line,column:t.column,callSite:md(t.callSite)})):e.path.map(t=>({functionName:t.functionName??null,modulePath:t.modulePath,line:null,column:null,callSite:null}))}function _h(e){let n=e.located?.reach??null;return n===null?null:{nodes:n.nodes.map(t=>({id:t.id,functionName:t.functionName,modulePath:t.modulePath,line:t.line,column:t.column})),edges:n.edges.map(t=>({from:t.from,to:t.to,callSite:md(t.callSite)})),truncated:n.truncated}}var oi="";function hd(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];if(e.ecosystem==="npm")return n.join(oi);let{symbolContainer:t,symbolPath:s}=e;return t===null&&s===null?[...n,e.ecosystem].join(oi):[...n,e.ecosystem,t??"",s??""].join(oi)}function xh(e){let n=new Map;for(let t of e){let s=hd(t),r=n.get(s);if(r===void 0){n.set(s,t);continue}if(r.tier!==t.tier||r.unknownKind!==t.unknownKind)throw new tt(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function bh(e){let n=Ot,t=(s,r,i)=>{throw new tt(`${s} has ${String(r)} entries, over the ${String(i)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let s of["dispatch","load"]){let r=e.unresolved[s].length;r>n.maxUnresolvedSites&&t(`the app-global ${s} set`,r,n.maxUnresolvedSites)}for(let s of e.findings)s.path!==null&&s.path.length>n.maxPathSteps&&t(`the call path of finding ${s.advisoryId}`,s.path.length,n.maxPathSteps),s.reach!==null&&s.reach.nodes.length>n.maxReachNodes&&t(`the reach graph of finding ${s.advisoryId}`,s.reach.nodes.length,n.maxReachNodes),s.reach!==null&&s.reach.edges.length>n.maxReachEdges&&t(`the reach graph's calls of finding ${s.advisoryId}`,s.reach.edges.length,n.maxReachEdges),s.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${s.advisoryId}`,s.unresolvedSites.length,n.maxUnresolvedSites);e.packageGraphs.length>n.maxPackageGraphs&&t("the package graphs list",e.packageGraphs.length,n.maxPackageGraphs);for(let s of e.packageGraphs)s.nodes.length>n.maxPackageGraphNodes&&t(`package graph ${s.id}`,s.nodes.length,n.maxPackageGraphNodes),s.edges.length>n.maxPackageGraphEdges&&t(`the links of package graph ${s.id}`,s.edges.length,n.maxPackageGraphEdges);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let s of e.advisories){if(s.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${s.id}`,s.ranges.length,n.maxAdvisoryRanges),s.summary!==null&&s.summary.length>n.maxStringLength)throw new tt(`the summary of advisory ${s.id} is ${String(s.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(s.details!==null&&s.details.length>n.maxAdvisoryDetails)throw new tt(`the description of advisory ${s.id} is ${String(s.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function Sh(e,n){let t=new Set(n.map(s=>s.advisoryId));return e.advisories.filter(s=>t.has(s.advisory.id)).map(s=>({id:s.advisory.id,cveId:s.advisory.cveId,osvId:s.advisory.osvId,summary:s.advisory.summary,details:s.advisory.details??null,severity:s.advisory.severity,published:s.advisory.published,source:s.advisory.source,ranges:s.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function kh(e,n){let t=new Set(n.flatMap(s=>s.introducedBy===null?[]:[s.introducedBy]));return(e.packageGraphs??[]).filter(s=>t.has(s.id)).map(s=>({id:s.id,nodes:s.nodes.map(r=>({id:r.id,name:r.name,version:r.version,direct:r.direct,declaredIn:r.declaredIn===null?null:{path:r.declaredIn.path,line:r.declaredIn.line}})),edges:s.edges.map(r=>({from:r.from,to:r.to})),truncated:s.truncated}))}function wh(e){if(e.bytes<=Ut)return;let n=o=>`${o.name} (${String(o.bytes)} bytes, ${String(Math.round(100*o.bytes/e.bytes))}%)`,[t,s]=cd(e.payload),r=e.payload.findings.flatMap(o=>o.reach===null?[]:[o.reach]),i=r.length===0?"with no reach graph to cut":r.every(o=>o.nodes.length<=1)?"with every reach graph cut to its vulnerable function":"with its reach graphs as built";throw new tt(`the findings payload is ${String(e.bytes)} bytes, over the ${String(Ut)}-byte limit, ${i} (ADR-120); its largest part is ${t===void 0?"unknown":n(t)}${s===void 0?"":`, then ${n(s)}`}`)}function gd(e,n,t={}){let s=xh(e.findings.map(gh)),r={version:mh,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:s,unresolved:{dispatch:e.unresolved.dispatch.map(ii),load:e.unresolved.load.map(ii)},advisories:Sh(e,s),packageGraphs:kh(e,s)};bh(r);let i=dd(r,t.byteBudget??hh,hd);return i.cut!==null&&t.onCut?.(i.cut),wh(i),i.payload}function yd(e){let n=new Set(e.installed.packages.map(s=>s.ecosystem??"npm")),t=["npm","PyPI"].filter(s=>n.has(s));return t.length===0?"npm":t.join("+")}var di="site-packages:",li=class{#e;#t;#n=new Map;constructor(n,t){this.#e=n,this.#t=t}point(n,t){if(!Number.isInteger(t)||t<0)return null;let s=this.#s(n);if(s===null)return null;let r=(typeof s.text=="string",s.text.length);if(t>r)return null;let i=0,o=s.starts.length-1;for(;i<o;){let p=i+o+1>>1;(s.starts[p]??0)<=t?i=p:o=p-1}let a=s.starts[i]??0,d=typeof s.text=="string"?t-a+1:s.text.subarray(a,t).toString("utf8").length+1,l=i+1,c=Ot.maxSourcePosition;return l>c||d>c?null:{line:l,column:d}}#s(n){let t=this.#n.get(n);if(t!==void 0)return t;let s=this.#e.read(n),r=null;if(s!==null){let i=[0];if(this.#t==="utf8-bytes"){for(let o=0;o<s.length;o+=1)s[o]===10&&i.push(o+1);r={text:s,starts:i}}else{let o=s.toString("utf8");for(let a=0;a<o.length;a+=1)o.charCodeAt(a)===10&&i.push(a+1);r={text:o,starts:i}}}return this.#n.set(n,r),r}},Hs=class{#e;#t;#n;#s;#o;#i;constructor(n,t,s,r){this.#e=n,this.#t=new li(t,s),this.#n=r,this.#s=new Map(n.functions.map(i=>[i.id,i])),this.#o=new Map(n.modules.map(i=>[i.id,i])),this.#i=new Map(n.callSites.map(i=>[i.id,i]))}locate(n){let t=n.path;if(t===void 0||t.length===0)return{path:null,reach:null};let s=t.map((d,l)=>{let c=this.#s.get(d.functionId),p=c===void 0?"":this.#n(c.moduleId),u=c===void 0?null:this.#r(p,c.declRange),f=t[l+1]?.calledAt??null;return{modulePath:ai(p,d.modulePath),line:u?.line??null,column:u?.column??null,callSite:f===null?null:this.#r(p,f)}}),r=t[t.length-1]?.functionId,i=r===void 0?null:Jo(this.#e,r,n.tier==="reachable-medium");if(i===null)return{path:s,reach:null};let o=_d(i),a=new Map(i.functions.slice(0,o).map((d,l)=>[d.functionId,`n${String(l)}`]));return{path:s,reach:this.#a(i),nodeOf:a}}modulePathOf(n){let t=this.#o.get(n);return t===void 0?null:ai(this.#n(n),t.path)}#a(n){let t=_d(n),s=new Map(n.functions.slice(0,t).map((o,a)=>[o.functionId,a])),r=n.functions.slice(0,t).map((o,a)=>{let d=this.#s.get(o.functionId),l=d===void 0?"":this.#n(d.moduleId),c=d===void 0?null:this.#r(l,d.declRange);return{id:`n${String(a)}`,functionName:d?.name??null,modulePath:(d===void 0?null:this.modulePathOf(d.moduleId))??"",line:c?.line??null,column:c?.column??null}}),i=n.edges.flatMap(o=>{let a=s.get(o.from),d=s.get(o.to);if(a===void 0||d===void 0)return[];let l=this.#i.get(o.site),c=this.#s.get(o.from),p=c===void 0?"":this.#n(c.moduleId);return[{from:`n${String(a)}`,to:`n${String(d)}`,callSite:l===void 0?null:this.#r(p,l.range)}]});return{nodes:r,edges:i,truncated:n.functions.length-t}}#r(n,t){return t.path===""||t.path.startsWith(di)?null:this.#t.point(ai(n,t.path),t.start)}};function _d(e){let n=Ot,t=new Map(e.functions.map((o,a)=>[o.functionId,a])),s=new Array(e.functions.length).fill(0);for(let o of e.edges){let a=Math.max(t.get(o.from)??0,t.get(o.to)??0);s[a]=(s[a]??0)+1}let r=0,i=0;for(;i<e.functions.length&&i<n.maxReachNodes;){let o=s[i]??0;if(r+o>n.maxReachEdges)break;r+=o,i+=1}return i}function ai(e,n){return e===""||n===""?n:`${e}/${n}`}function ci(e){let n=e.filter(t=>t!=="").sort((t,s)=>s.length-t.length);return t=>n.find(s=>t.startsWith(`${s}::`))??""}var vh=512,Eh=2048,Nh=64*1024,Ah=255,Ih=1024,Rh=64,Oh=16,Ph=/^(?:pkg:[^\s\p{Cc}]{1,200}|ecmascript:[A-Za-z0-9_.$]{1,200})$/u;function ui(e){return e.length>0&&e.length<=Ih&&!new RegExp("\\p{Cc}","u").test(e)&&!xd.posix.isAbsolute(e)&&!xd.win32.isAbsolute(e)}function bd(e,n){return{index:us(e),lineOf:t=>At(n,t,"utf16-units")?.startLine??null,pathOf:t=>t.path}}function Sd(e,n,t){let s=new Map(e.modules.map(a=>[a.id,a])),r=(a,d)=>{let l=d.registeredAt;if(l===void 0)return d;let c=a.declRange.path,p=c!==""&&a.moduleId.endsWith(c)?a.moduleId.slice(0,a.moduleId.length-c.length):null,u=p===null?null:`${p}${l.path}`;return u!==null&&s.has(u)?{...d,registeredAt:{...l,path:u}}:{index:d.index,sourceClass:d.sourceClass,model:d.model}},i={...e,functions:e.functions.map(a=>a.sourceParams===void 0?a:{...a,sourceParams:a.sourceParams.map(d=>r(a,d))})},o=a=>a.packageName===""&&!a.id.includes(di);return{index:us(Dr(i)),lineOf:a=>{let d=s.get(a.path);if(d===void 0||!o(d))return null;let l=n.modulePathOf(d.id);return l===null?null:At(t,{...a,path:l},"utf8-bytes")?.startLine??null},pathOf:a=>s.has(a.path)?n.modulePathOf(a.path):null}}function kd(e,n,t,s,r=i=>i.path){let i=0,o=64,a=u=>{let f=Buffer.byteLength(JSON.stringify(u),"utf8")+1;return o+f>Nh?!1:(o+=f,!0)},d=[];for(let[u,f]of t)for(let h of e.functions.get(u)?.sourceParams??[]){if(d.length>=vh||h.index<0||h.index>Ah){i+=1;continue}let g=h.registeredAt,y=g===void 0?null:r(g),_=g===void 0||y===null||!ui(y)?null:s(g),b={node:f,param:h.index,sourceClass:h.sourceClass,model:h.model,registeredAt:y!==null&&_!==null?{path:y,line:_}:null};if(!a(b)){i+=1;continue}d.push(b)}let l=[],c=new Set,p=(e.callers.get(n)??[]).filter(u=>u.direct).map(u=>u.site);for(let u of p.slice(0,Rh)){let f=[],h=Math.min(u.args?.length??1,Oh);for(let g=0;g<h;g+=1)f.push({label:`arg[${String(g)}]`,port:{kind:"arg",index:g}});u.receiverRange!==void 0&&f.push({label:"receiver",port:{kind:"receiver"}});for(let{label:g,port:y}of f)for(let _ of Ds(e,{site:u,port:y}).leaves){if(_.kind!=="unknown"&&_.kind!=="entry-parameter"||_.class===void 0)continue;let b=_.site??e.functions.get(_.functionId)?.declRange;if(b===void 0||b.path==="")continue;let x=r(b);if(x===null)continue;let k={port:g,node:t.get(_.functionId)??null,path:x,line:ui(x)?s(b):null,class:_.class,owner:"cupel",callee:(_.reason==="opaque-callee"||_.reason==="unresolved-call")&&_.detail!==void 0&&Ph.test(_.detail)?_.detail:null},w=JSON.stringify(k);if(!c.has(w)){if(c.add(w),!ui(x)||l.length>=Eh||!a(k)){i+=1;continue}l.push(k)}}}return{inputs:d,blockers:l,truncated:i}}import{mkdirSync as il,readdirSync as Pp,readFileSync as ew,realpathSync as wr,renameSync as al,statSync as ul,writeFileSync as ll}from"node:fs";import nt from"node:path";import{createRequire as Ch}from"node:module";var Mh=Ch(import.meta.url);function Th(){try{return Mh("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function $h(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var jr={open(e,n){let{DatabaseSync:t}=Th(),s=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?s.exec("PRAGMA query_only = ON;"):s.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>s.exec(r),prepare:r=>$h(s.prepare(r)),close:()=>s.close()}}};var Nd=["data","control","state","call-only","config-only"],Ad=["patch-derived","pov-derived","drafted","reviewed"],Id=["remote-unauthenticated","remote-authenticated","rpc","message","upload","stored","upstream-response","cli","env","file"];var wd="[A-Za-z_$][A-Za-z0-9_$]{0,127}",Lh=new RegExp(`^(?:(?:arg\\[(?:0|[1-9][0-9]{0,2})\\]|receiver)(?:\\.${wd}){0,${String(4)}}|kwarg\\[${wd}\\])$`,"u");function Rd(e){return Lh.test(e)}var fi=(e,n)=>typeof e=="string"&&n.includes(e)?e:null,vd=e=>{if(e==null)return null;if(typeof e!="string"||e.length>4096)return!1;try{return JSON.parse(e),e}catch{return!1}},Ed=e=>e==null?null:typeof e=="string"&&e.length<=4096?e:!1,Br=e=>typeof e=="number"&&Number.isSafeInteger(e)?e:typeof e=="bigint"?Number(e):null;function pi(e){let n=Br(e.id),t=Br(e.vulnerable_symbol_id),s=fi(e.mode,Nd),r=fi(e.provenance,Ad);if(n===null||t===null||s===null||r===null)return null;let i=s==="call-only"||s==="config-only",o=e.port;if(i?o!==null:typeof o!="string"||!Rd(o))return null;let a=e.at_path,d=e.at_start===null?null:Br(e.at_start),l=e.at_end===null?null:Br(e.at_end),c=null;if(a!==null||e.at_start!==null||e.at_end!==null){if(typeof a!="string"||a===""||a.length>4096||d===null||l===null||d<0||l<d)return null;c={path:a,start:d,end:l}}let p;try{p=typeof e.accepted_sources=="string"&&e.accepted_sources.length<=4096?JSON.parse(e.accepted_sources):void 0}catch{return null}if(!Array.isArray(p))return null;let u=[];for(let _ of p){let b=fi(_,Id);if(b===null||u.includes(b))return null;u.push(b)}let f=vd(e.barriers),h=vd(e.trigger_predicate),g=Ed(e.evidence_ref),y=Ed(e.reviewer);return f===!1||h===!1||g===!1||y===!1||r==="reviewed"&&y===null?null:{id:n,vulnerableSymbolId:t,mode:s,port:i?null:o,at:c,acceptedSources:u,barriers:f,triggerPredicate:h,provenance:r,evidenceRef:g,reviewer:y}}function qe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function He(e){return typeof e=="string"?e:null}function st(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Dh=`
+`};import{randomBytes as Zh}from"node:crypto";import{readFileSync as $A,renameSync as LA,writeFileSync as Qh}from"node:fs";import DA from"node:path";import{fileURLToPath as FA}from"node:url";var tg=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Ni(e){let n=0;for(;n<e.length-1&&e.charCodeAt(n)===48;)n+=1;return e.slice(n)}function sg(e){let n=Mi(e,!1);if(n!==null)return{kind:"npm",...n};let t=tg.exec(e);return t===null?null:{kind:"npm",major:Ni(t[1]??""),minor:Ni(t[2]??""),patch:Ni(t[3]??""),prerelease:"",build:""}}var og=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,rg={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function Rs(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function ig(e){let n=og.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,s=(t.release??"").split(".");if(s.length===0||s.length>32)return null;let o=[];for(let c of s){let p=Rs(c);if(p===null)return null;o.push(p)}let r=0;if(t.epoch!==void 0){let c=Rs(t.epoch);if(c===null)return null;r=c}let i=null;if(t.preL!==void 0){let c=t.preN===void 0?0:Rs(t.preN);if(c===null)return null;i=[rg[t.preL]??t.preL,c]}let a=null;if(t.postImplicit!==void 0){let c=Rs(t.postImplicit);if(c===null)return null;a=c}else if(t.postL!==void 0){let c=t.postN===void 0?0:Rs(t.postN);if(c===null)return null;a=c}let l=null;if(t.devL!==void 0){let c=t.devN===void 0?0:Rs(t.devN);if(c===null)return null;l=c}let d=t.local===void 0?null:t.local.split(/[-_.]/u).map(c=>/^[0-9]+$/u.test(c)?Number(c):c);return{kind:"PyPI",epoch:r,release:o,pre:i,post:a,dev:l,local:d}}function Os(e,n){return e===n?0:e<n?-1:1}function Md(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function ag(e,n){let t=Md(e),s=Md(n),o=Math.max(t.length,s.length);for(let r=0;r<o;r+=1){let i=Os(t[r]??0,s[r]??0);if(i!==0)return i}return 0}function Td(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function lg(e,n){let t=Td(e),s=Td(n);return t!==s?t<s?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:Os(e.pre[1],n.pre[1])}function dg(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:Os(e,n)}function cg(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:Os(e,n)}function ug(e,n){let t=typeof e=="number",s=typeof n=="number";return t&&s?Os(e,n):!t&&!s?e===n?0:e<n?-1:1:t?1:-1}function fg(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let s=0;s<t;s+=1){let o=e[s],r=n[s];if(o===void 0)return-1;if(r===void 0)return 1;let i=ug(o,r);if(i!==0)return i}return 0}function pg(e,n){let t=Os(e.epoch,n.epoch);if(t!==0)return t;let s=ag(e.release,n.release);if(s!==0)return s;let o=lg(e,n);if(o!==0)return o;let r=dg(e.post,n.post);if(r!==0)return r;let i=cg(e.dev,n.dev);return i!==0?i:fg(e.local,n.local)}var lr=46;function Pi(e,n){let t=e.charCodeAt(n);return t>=48&&t<=57}function Dd(e,n){let t=e.charCodeAt(n);return t>=48&&t<=57||t>=65&&t<=90||t>=97&&t<=122||t===45}function Ci(e){for(let n=0;n<e.length;n+=1)if(!Pi(e,n))return!1;return!0}function $d(e){return e.length>1&&e.startsWith("0")&&Ci(e)}function Ii(e){if(e.length===0||!Pi(e,0))return null;let n=1;for(;n<e.length&&Pi(e,n);)n+=1;return e.startsWith("0")&&n!==1?null:[e.slice(0,n),e.slice(n)]}function mg(e){if(!e.startsWith("-"))return null;let n=1,t=1;for(;n<e.length&&e[n]!=="+";){if(!Dd(e,n)&&e.charCodeAt(n)!==lr)return null;if(e.charCodeAt(n)===lr){if(t===n||$d(e.slice(t,n)))return null;t=n+1}n+=1}return t===n||$d(e.slice(t,n))?null:[e.slice(0,n),e.slice(n)]}function hg(e){if(!e.startsWith("+"))return null;let n=1,t=1;for(;n<e.length;){if(!Dd(e,n)&&e.charCodeAt(n)!==lr)return null;if(e.charCodeAt(n)===lr){if(t===n)return null;t=n+1}n+=1}return t===n?null:[e.slice(0,n),e.slice(n)]}function Mi(e,n){let t=Ii(e);if(t===null)return null;let[s,o]=t;if(o==="")return n?{major:s,minor:"0",patch:"0",prerelease:"",build:""}:null;if(!o.startsWith("."))return null;let r=Ii(o.slice(1));if(r===null)return null;let[i,a]=r;if(a==="")return n?{major:s,minor:i,patch:"0",prerelease:"",build:""}:null;if(!a.startsWith("."))return null;let l=Ii(a.slice(1));if(l===null)return null;let[d,c]=l,p=c,u="",f="";if(p.startsWith("-")){let m=mg(p);if(m===null)return null;[u,p]=m}if(p.startsWith("+")){let m=hg(p);if(m===null)return null;[f,p]=m}return p!==""?null:{major:s,minor:i,patch:d,prerelease:u,build:f}}function gg(e){let n=Mi(e.startsWith("v")?e.slice(1):e,!0);return n===null?null:{kind:"Go",...n}}function yg(e){let n=Mi(e,!1);return n===null?null:{kind:"crates.io",...n}}function Ri(e,n){return e===n?0:e.length!==n.length?e.length<n.length?-1:1:e<n?-1:1}function Ld(e){let n=e.indexOf(".");return n<0?[e,""]:[e.slice(0,n),e.slice(n)]}function _g(e,n){if(e===n)return 0;if(e==="")return 1;if(n==="")return-1;let t=e,s=n;for(;t!==""&&s!=="";){let[o,r]=Ld(t.slice(1)),[i,a]=Ld(s.slice(1));if(t=r,s=a,o!==i){let l=Ci(o),d=Ci(i);return l!==d?l?-1:1:l&&o.length!==i.length?o.length<i.length?-1:1:o<i?-1:1}}return t===""?-1:1}function Oi(e,n){return Ri(e.major,n.major)||Ri(e.minor,n.minor)||Ri(e.patch,n.patch)||_g(e.prerelease,n.prerelease)}function bg(e,n){return e==="npm"?sg(n):e==="PyPI"?ig(n):e==="crates.io"?yg(n):gg(n)}function Sg(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=bg(e,n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function ao(e,n){let t=Sg(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function ar(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return Oi(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return pg(e.parsed,n.parsed);if(e.parsed.kind==="Go"&&n.parsed.kind==="Go"||e.parsed.kind==="crates.io"&&n.parsed.kind==="crates.io")return Oi(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function Fd(e,n,t){let s=ao(e,n);return!(t.introduced!=="0"&&ar(s,ao(e,t.introduced))<0||t.fixed!==void 0&&ar(s,ao(e,t.fixed))>=0||t.lastAffected!==void 0&&ar(s,ao(e,t.lastAffected))>0)}var Ti=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Rt(e,n){return Fd(n.ecosystem??"npm",e,n)}function dr(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),o=new Map(e.classes.map(a=>[a.id,a.name])),r=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let l=r.get(a.callSiteId);if(l===void 0)continue;let d=s.get(l.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let c=n.get(d.moduleId);if(c===void 0)continue;let p=s.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&i.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:a.resolution})}return i}function xg(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,s)=>t.analyzedVersion<s.analyzedVersion?1:t.analyzedVersion>s.analyzedVersion?-1:0)}function kg(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function jd(e,n,t,s,o,r){if(r<=0)return null;let i=null,a=l=>{(i===null||l.hops<i.hops)&&(i=l)};for(let l of xg(e,n))for(let d of l.edges){if(d.entryExport!==t||d.entryContainer!==s)continue;if(kg(d,o,l.packageName)){a({viaPackages:[],hops:d.hops,provenance:{tool:l.tool,toolVersion:l.toolVersion,analyzedVersion:l.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let c=jd(e,d.target.calleePackage,d.target.calleeExport,null,o,r-1);c!==null&&a({viaPackages:[d.target.calleePackage,...c.viaPackages],hops:d.hops+c.hops,provenance:c.provenance})}return i}function $i(e,n,t,s,o,r){let i=null;for(let a of dr(e,n,t)){let l=jd(o,a.packageName,a.exportName,a.container,s,r);l!==null&&(i===null||l.hops<i.totalHops)&&(i={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:l.viaPackages,totalHops:l.hops,provenance:l.provenance})}return i}function cr(e,n){let{args:t,convention:s}=e,o=n.params;if(t===void 0||s===void 0||o===void 0)return{known:!1,reason:"not-emitted"};if(s==="unknown")return{known:!1,reason:"convention"};if(n.reflectiveArguments===!0)return{known:!1,reason:"reflective-arguments"};if(s==="shifted"&&t[0]?.spread!==void 0&&t[0].spread!==!1)return{known:!1,reason:"convention"};let r=s==="shifted"?t.slice(1):t,i=[...o].sort((S,b)=>S.index-b.index),a=i.filter(S=>S.kind==="positional"),l=i.find(S=>S.kind==="rest"),d=i.find(S=>S.kind==="keyword-rest"),c=new Map,p=(S,b)=>{let k=c.get(S);k!=="unknown"&&c.set(S,[...k??[],b])},u=S=>{S!==void 0&&c.set(S,"unknown")},f=[],m=0,h=!1,y=!1;for(let S of r){if(S.spread==="positional"){h=!0;for(let k of a.slice(m))u(k);u(l);continue}if(S.spread==="keyword"){y=!0;for(let k of i)(k.kind==="positional"||k.kind==="keyword-only")&&!c.has(k)&&u(k);u(d);continue}if(S.keyword!==void 0){let k=i.find(w=>w.name===S.keyword&&(w.kind==="positional"||w.kind==="keyword-only"));k!==void 0?c.has(k)?u(k):p(k,S.index):d!==void 0?p(d,S.index):f.push(S.index);continue}if(h){for(let k of a.slice(m))u(k);u(l);continue}let b=a[m];b!==void 0?p(b,S.index):l!==void 0?p(l,S.index):f.push(S.index),m+=1}return{known:!0,params:i.map(S=>{let b=c.get(S);return b==="unknown"?{kind:"unknown"}:b!==void 0?{kind:"args",argIndexes:b}:y&&(S.kind==="positional"||S.kind==="keyword-only")?{kind:"unknown"}:S.kind==="rest"||S.kind==="keyword-rest"?{kind:"args",argIndexes:[]}:{kind:"absent"}}),receiver:wg(e,n),unbound:f}}function wg(e,n){if(n.receiver===void 0)return"unknown";if(n.receiver!=="call")return"none";switch(e.convention){case"construct":return"fresh";case"shifted":return(e.args?.length??0)>0?"first-argument":"none";case"direct":return e.receiverRange!==void 0?"receiver-expression":"none";default:return"unknown"}}var Li=["builtin-call","host-lib-call","primitive-mutation","dependency-boundary","app-unresolved","untyped-call","dependency-callee","app-callee","module-binding","global","free-name","construct","opaque","unregistered-entry","binding","not-emitted","analysis-cap"],Bd=2e4,vg=4,Jn=(e,n)=>`${String(e)}-${String(n)}`,ur=e=>{switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${Jn(e.at,e.end)}`;case"argument":return`a${Jn(e.at,e.end)}:${String(e.index)}`;case"call-receiver":return`r${Jn(e.at,e.end)}`;case"mutated-by-call":return`m${Jn(e.at,e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"shared":return`h${String(e.id)}`;default:return e.kind}};function Eg(e){if(e.kind==="entry-parameter")return"unregistered-entry";if(e.kind==="unknown")switch(e.reason){case"binding":return"binding";case"not-emitted":return"not-emitted";case"analysis-cap":return"analysis-cap";case"opaque":return e.detail==="construct"?"construct":"opaque";default:return}}function Ps(e){let n=new Map(e.functions.map(c=>[c.id,c])),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map;for(let c of e.functions){if(c.valueFlows===void 0)continue;let p=new Map;for(let u of c.valueFlows){let f=ur(u.to),m=p.get(f);m===void 0?p.set(f,[u]):m.push(u)}s.set(c.id,p)}let o=new Map,r=new Map,i=0;for(let c of e.callSites){let p=`${c.range.path}\0${Jn(c.range.start,c.range.end)}`;o.has(p)&&(i+=1),o.set(p,c),r.set(c.id,c)}let a=new Map,l=new Map,d=(c,p,u)=>{let f=c.get(p)??[];f.includes(u)||f.push(u),c.set(p,f)};for(let c of e.callEdges){let p=r.get(c.callSiteId);if(p===void 0)continue;let u=c.invocation==="direct";u&&d(a,p.id,c.calleeFunctionId);let f=l.get(c.calleeFunctionId)??[],m=f.find(h=>h.site===p);m===void 0?f.push({site:p,direct:u}):u&&(m.direct=!0),l.set(c.calleeFunctionId,f)}return{functions:n,modules:t,into:s,siteAt:o,identityCollisions:i,callees:a,callers:l}}function Ag(e,n){let{args:t,convention:s}=e;if(t===void 0||s===void 0||s!=="direct"&&s!=="construct")return"unknown";for(let o=0;o<=n&&o<t.length;o+=1){let r=t[o];if(r===void 0||r.spread!==!1||r.keyword!==void 0)return"unknown"}return n<t.length?n:"absent"}var Gd=e=>[...e.params??[]].sort((n,t)=>n.index-t.index);function Ng(e,n,t){if(n===-1)return e.receiver==="receiver-expression"?{kind:"receiver"}:e.receiver==="unknown"?"unknown":null;if(e.receiver==="first-argument"&&n===0)return{kind:"receiver"};let s=e.params.findIndex(o=>o.kind==="args"&&o.argIndexes.includes(n));if(s>=0){let o=Gd(t)[s];return o!==void 0?{kind:"param",index:o.index}:"unknown"}return e.unbound.includes(n)?null:"unknown"}function lo(e,n){let t=new Map,s=v=>{let I=v.class??Eg(v),A=v.site===void 0?"":`${v.site.path}:${String(v.site.start)}-${String(v.site.end)}`;t.set(`${v.kind}|${v.functionId}|${v.reason??""}|${v.detail??""}|${A}|${v.via??""}`,I===void 0?v:{...v,class:I})},o=new Map,r=v=>{o.set(`${v.site.path}:${String(v.site.start)}-${String(v.site.end)}|${v.reason}`,v)},i=(v,I)=>{if(I.kind==="receiver")return v.receiverPrimitive===!0;let A=v.args??[];return I.kind==="arg"?A[I.index]?.primitive===!0:A.slice(I.index).every(B=>B.primitive===!0)},a=(v,I,A,B)=>{let O=I.range.start,V=I.range.end,E=Jn(O,V),D=I.args,L=D!==void 0&&D.every(Z=>Z.spread===!1&&Z.keyword===void 0),K=D!==void 0&&!L&&D.every(Z=>Z.spread===!1)&&D.some(Z=>Z.keyword!==void 0),Y=K?D.findIndex(Z=>Z.keyword!==void 0):Number.POSITIVE_INFINITY,le=(Z,de)=>de===-1?Z.kind==="receiver":de<Y?Z.kind==="arg"&&Z.index===de||Z.kind==="args-from"&&de>=Z.index:Z.kind==="args-from"||Z.kind==="arg"&&Z.index>=Y,z=B.kind==="call-result"?A.result:A.mutates.filter(Z=>le(Z.into,B.index)).flatMap(Z=>Z.from);for(let Z of z){if(Z.kind==="receiver"){I.receiverRange!==void 0&&y({fn:v.fn,ref:{kind:"call-receiver",at:O,end:V},stack:v.stack,tracing:E});continue}if(D===void 0||!L&&!K){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:"summary input",site:I.range});continue}let[de,x]=Z.kind==="arg"&&Z.index<Y?[Z.index,Math.min(Z.index+1,D.length)]:[Math.min(Z.index,Y),D.length];for(let M=de;M<x;M+=1)y({fn:v.fn,ref:{kind:"argument",at:O,end:V,index:M},stack:v.stack,tracing:E})}A.reviewed!==!0&&r({site:I.range,id:A.id,reason:"unreviewed-summary"}),(A.callsProgram??[]).some(Z=>!i(I,Z))&&r({site:I.range,id:A.id,reason:"calls-program"})},l=(v,I,A,B)=>{if(I.kind==="mutated-by-call"&&I.index>=0&&v.args?.[I.index]?.primitive===!0)return"primitive-mutation";if(A!==null){let O=e.modules.get(A.moduleId),V=e.modules.get(B.moduleId);return O===void 0?"not-emitted":O.externalSurface===!0||O.packageName!==V?.packageName?"dependency-callee":"app-callee"}switch(v.calleeDecl){case"ecmascript":case"runtime":return"builtin-call";case"host-lib":return"host-lib-call";case"dependency":return"dependency-boundary";case"app":return"app-unresolved";default:return"untyped-call"}},d=new Set,c=[],p=new Map,u=null,f,m=v=>`${v.fn}\0${ur(v.ref)}\0${v.stack.map(I=>I.id).join(",")}\0${String(v.tracing??"")}`,h=v=>{if(f!==void 0)return;let I=[{functionId:v.fn,ref:v.ref}];for(let A=u;A!==null;){let B=p.get(A);if(B===void 0)break;I.push({functionId:B.state.fn,ref:B.state.ref}),A=B.key}f=I},y=v=>{let I=m(v);d.has(I)||(d.add(I),p.set(I,{key:u,state:v}),c.push(v))},_=n.site.enclosingFunctionId,S=n.site.range.start,b=n.site.range.end;if(n.port.kind==="receiver")y({fn:_,ref:{kind:"call-receiver",at:S,end:b},stack:[],tracing:Jn(S,b)});else{let v=Ag(n.site,n.port.index);v==="unknown"?s({kind:"unknown",functionId:_,reason:"binding"}):v==="absent"?s({kind:"constant",functionId:_,detail:"no argument"}):y({fn:_,ref:{kind:"argument",at:S,end:b,index:v},stack:[],tracing:Jn(S,b)})}let k=0;for(;c.length>0;){if(k+=1,k>Bd){s({kind:"unknown",functionId:_,reason:"analysis-cap"});break}let v=c.pop();u=m(v);let I=e.into.get(v.fn),A=e.functions.get(v.fn);if(I===void 0||A===void 0){s({kind:"unknown",functionId:v.fn,reason:"not-emitted"});continue}let B=I.get(ur(v.ref));if(B!==void 0&&B.length>0){for(let V of B)v.tracing!==void 0&&V.from.kind==="mutated-by-call"&&Jn(V.from.at,V.from.end)===v.tracing&&e.siteAt.get(`${A.declRange.path}\0${v.tracing}`)?.repeats===!1||y({...v,ref:V.from});if(v.ref.kind!=="param"&&v.ref.kind!=="receiver"&&v.ref.kind!=="call-result"&&v.ref.kind!=="mutated-by-call"&&v.ref.kind!=="free")continue}let O=v.ref;switch(O.kind){case"constant":s({kind:"constant",functionId:v.fn});break;case"opaque":s({kind:"unknown",functionId:v.fn,reason:"opaque",detail:O.reason});break;case"source":s({kind:"source",functionId:v.fn,sourceClass:O.sourceClass,model:O.model}),h(v);break;case"free":s({kind:"unknown",functionId:v.fn,reason:"free",detail:O.name,class:O.binding==="module"?"module-binding":O.binding==="global"?"global":"free-name"});break;case"local":case"return":(B===void 0||B.length===0)&&s({kind:"constant",functionId:v.fn,detail:"undefined"});break;case"param":case"receiver":{let V=O.kind==="param"?A.sourceParams?.find(Y=>Y.index===O.index):void 0;V!==void 0&&(s({kind:"source",functionId:v.fn,sourceClass:V.sourceClass,model:V.model}),h(v));let E=v.stack[v.stack.length-1],D=E!==void 0?[{site:E,direct:!0}]:e.callers.get(v.fn)??[],L=V!==void 0?D.filter(Y=>Y.direct&&Y.site.args!==void 0):D;if(V!==void 0&&L.length===0)break;let K=E!==void 0?v.stack.slice(0,-1):[];if(L.length===0){s({kind:"entry-parameter",functionId:v.fn,detail:O.kind==="param"?`param ${String(O.index)}`:"receiver"});break}for(let{site:Y,direct:le}of L){if(!le){s({kind:"unknown",functionId:Y.enclosingFunctionId,reason:"binding",detail:"callback"});continue}let z=cr(Y,A);if(!z.known){s({kind:"unknown",functionId:Y.enclosingFunctionId,reason:"binding",detail:z.reason});continue}let Z=Y.range.start,de=Y.range.end,x=Jn(Z,de),M=Y.enclosingFunctionId;if(O.kind==="receiver"){z.receiver==="receiver-expression"?y({fn:M,ref:{kind:"call-receiver",at:Z,end:de},stack:K,tracing:x}):z.receiver==="first-argument"?y({fn:M,ref:{kind:"argument",at:Z,end:de,index:0},stack:K,tracing:x}):z.receiver==="none"?s({kind:"constant",functionId:M,detail:"no receiver"}):s({kind:"unknown",functionId:M,reason:"binding",detail:`receiver ${z.receiver}`});continue}let X=Gd(A).findIndex(q=>q.index===O.index),W=z.params[X];if(W===void 0||W.kind==="unknown")s({kind:"unknown",functionId:M,reason:"binding"});else if(W.kind==="absent")(B===void 0||B.length===0)&&s({kind:"constant",functionId:v.fn,detail:"no argument"});else for(let q of W.argIndexes)y({fn:M,ref:{kind:"argument",at:Z,end:de,index:q},stack:K,tracing:x})}break}case"call-result":case"mutated-by-call":{let V=e.siteAt.get(`${A.declRange.path}\0${Jn(O.at,O.end)}`);if(V===void 0){s({kind:"unknown",functionId:v.fn,reason:"unresolved-call",detail:"no call site at offset",class:"not-emitted"});break}let E=e.callees.get(V.id)??[];if(E.length===0&&V.summary!==void 0){a(v,V,V.summary,O);break}if(E.length===0){s({kind:"unknown",functionId:v.fn,reason:"unresolved-call",...V.runtimeId!==void 0?{detail:V.runtimeId}:{},site:V.range,via:O.kind==="call-result"?"result":"mutation",class:l(V,O,null,A)});break}let D=v.stack.length>=vg?[]:[...v.stack,V];for(let L of E){let K=e.functions.get(L);if(K===void 0||!e.into.has(L)){s({kind:"unknown",functionId:v.fn,reason:"opaque-callee",detail:L,site:V.range,via:O.kind==="call-result"?"result":"mutation",class:K===void 0?"not-emitted":l(V,O,K,A)});continue}if(O.kind==="call-result"){y({fn:L,ref:{kind:"return"},stack:D});continue}let Y=cr(V,K);if(!Y.known){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:Y.reason});continue}let le=Ng(Y,O.index,K);if(le==="unknown"){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:"mutation target",site:V.range});continue}if(le===null)continue;let z=(e.into.get(L)?.get(ur(le))??[]).filter(Z=>Z.kind==="field"||Z.kind==="mutation");for(let Z of z)y({fn:L,ref:Z.from,stack:D})}break}case"argument":case"call-receiver":(B===void 0||B.length===0)&&s({kind:"unknown",functionId:v.fn,reason:"not-emitted",detail:"no flow into the argument"});break}}let w=[...t.values()],N=[...o.values()];return{outcome:w.some(v=>v.kind==="source")?"influenced":w.some(v=>v.kind==="unknown")||N.length>0?"unknown":w.some(v=>v.kind==="entry-parameter")?"reaches-entry-parameter":"no-source-reached",leaves:w,caveats:N,visited:d.size,...f!==void 0?{witness:f}:{}}}var co={"no-contract":"cupel","no-source-model":"cupel","control-influence-unsupported":"cupel","analysis-cap":"cupel"};function Di(e){if(Fi.includes(e))return{value:"unknown",kind:"no-contract"}}function uo(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Cs(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function fr(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let o=t.get(s.importId);if(o===void 0)continue;let r=n.get(o.moduleId)??[];r.push(s.resolvedModuleId),n.set(o.moduleId,r)}return n}function Ig(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let o=t.get(s.importId);if(o===void 0)continue;let r=n.get(s.resolvedModuleId)??[];r.push(o.moduleId),n.set(s.resolvedModuleId,r)}return n}function Zn(e){let n=fr(e),t=new Set,s=e.modules.filter(o=>o.isEntrypoint).map(o=>o.id);for(;s.length>0;){let o=s.pop();if(!(o===void 0||t.has(o))){t.add(o);for(let r of n.get(o)??[])t.has(r)||s.push(r)}}return t}function Rg(e,n){let t=Ig(e),s=new Set,o=[n];for(;o.length>0;){let r=o.pop();if(!(r===void 0||s.has(r))){s.add(r);for(let i of t.get(r)??[])s.has(i)||o.push(i)}}return s}function Og(e,n,t){let s=fr(e),o=Cs(e),r=new Set,i=[n];for(;i.length>0;){let a=i.pop();if(a===void 0||r.has(a))continue;r.add(a);let l=o.get(a);if(l===void 0||l.externalSurface===!0||t.has(a))return!0;for(let d of s.get(a)??[])r.has(d)||i.push(d)}return!1}function fo(e,n,t,s=new Set){let o=fr(e),r=Cs(e),i=new Set,a=[],l=[n];for(;l.length>0;){let d=l.pop();if(d===void 0||i.has(d))continue;i.add(d);let c=r.get(d);if(c===void 0){a.push({module:d,kind:"absent"});continue}if(t.has(d)){a.push({module:d,kind:"unbounded"});continue}if(c.externalSurface===!0&&!s.has(d)){a.push({module:d,kind:"surface"});continue}for(let p of o.get(d)??[])i.has(p)||l.push(p)}return a}function Wd(e){let n=new Set(e.modules.filter(i=>i.isEntrypoint).map(i=>i.id)),t=new Map(e.functions.map(i=>[i.id,i])),s=Cs(e),o=new Map;for(let i of e.functions)n.has(i.moduleId)&&(i.publicSurfaceReachable||i.name==="<toplevel>")&&o.set(i.id,i);let r=new Map(e.exports.map(i=>[i.id,i]));for(let i of e.exportBindings){if(i.target.kind!=="function")continue;let a=r.get(i.exportId);if(a===void 0||!n.has(a.moduleId))continue;let l=t.get(i.target.functionId);l===void 0||s.get(l.moduleId)?.externalSurface===!0||o.set(l.id,l)}return[...o.values()]}function ji(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let o=e.slice(t+n.length).split("/"),r=o[0]?.startsWith("@")===!0?2:1;return o.slice(r).join("/")}function Pg(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let s=t.symbolKind==="method"||t.symbolKind==="ctor",o=new Map(e.classes.map(r=>[r.id,r]));return e.functions.find(r=>{if(r.name!==t.exportName)return!1;let i=n.get(r.moduleId);if(i===void 0||i.packageName!==t.packageName)return!1;if(s){if(r.kind!==t.symbolKind||r.enclosingClassId===void 0||o.get(r.enclosingClassId)?.name!==t.container)return!1}else if(r.kind!=="function"&&r.kind!=="class")return!1;return i.externalSurface===!0?!0:ji(i.path)===t.sourcePath})}function Kd(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&ji(t.path)===n.sourcePath)}function Cg(e,n,t){if(!(t.symbolKind!=="function"||t.container!==null))for(let s of e.classes){if(s.name!==t.exportName)continue;let o=n.get(s.moduleId);if(o!==void 0&&o.externalSurface!==!0&&o.packageName===t.packageName&&ji(o.path)===t.sourcePath)return o}}function Mg(e,n,t,s){let o=new Map(e.functions.map(r=>[r.id,r]));return e.callSites.some(r=>r.calleeExprShape!=="member"||r.resolution!=="resolved"?!1:r.resolvedTargetIds.some(i=>{let a=o.get(i);if(a?.name!==s.exportName)return!1;let l=n.get(a.moduleId);return l?.externalSurface===!0&&l.packageName===s.packageName&&t.has(a.moduleId)}))}function Tg(e,n,t){return t.container===null?!0:e.classes.some(s=>{if(s.name!==t.container)return!1;let o=n.get(s.moduleId);return o!==void 0&&o.packageName===t.packageName&&o.externalSurface!==!0})}function $g(e,n,t){let s=new Map(e.callSites.map(l=>[l.id,l.enclosingFunctionId])),o=new Map;for(let l of e.callEdges){let d=s.get(l.callSiteId);if(d===void 0)continue;let c=o.get(d)??[];c.push({to:l.calleeFunctionId,res:l.resolution,site:l.callSiteId}),o.set(d,c)}let r=l=>{let d=new Set,c=n.map(p=>({id:p.id,prev:null,via:null}));for(let p of c)d.add(p.id);for(;c.length>0;){let p=c.shift();if(p===void 0)break;if(p.id===t){let u=[],f=[];for(let m=p;m!==null;m=m.prev)u.unshift(m.id),f.unshift(m.via);return{path:u,via:f}}for(let u of o.get(p.id)??[])u.res!=="unresolved"&&(u.res==="field-based"&&!l||d.has(u.to)||(d.add(u.to),c.push({id:u.to,prev:p,via:u.site})))}return null},i=r(!1);if(i!==null)return{...i,usedFieldBased:!1};let a=r(!0);return a!==null?{...a,usedFieldBased:!0}:null}function Bi(e,n,t){let s=new Map(e.callSites.map(y=>[y.id,y.enclosingFunctionId])),o=new Map,r=new Map,i=[],a=(y,_,S)=>{let b=y.get(_);b===void 0?y.set(_,[S]):b.push(S)};for(let y of e.callEdges){if(y.resolution==="unresolved"||y.resolution==="field-based"&&!t)continue;let _=s.get(y.callSiteId);if(_===void 0)continue;let S=y.calleeFunctionId;a(o,_,S),a(r,S,_),i.push({from:_,to:S,site:y.callSiteId})}let l=new Set,d=Wd(e).map(y=>y.id);for(let y of d)l.add(y);for(let y=0;y<d.length;y+=1)for(let _ of o.get(d[y])??[])l.has(_)||(l.add(_),d.push(_));if(!l.has(n))return null;let c=new Map([[n,0]]),p=[n];for(let y=0;y<p.length;y+=1){let _=p[y],S=(c.get(_)??0)+1;for(let b of r.get(_)??[])c.has(b)||!l.has(b)||(c.set(b,S),p.push(b))}let u=(y,_)=>y<_?-1:y>_?1:0,f=[...c].map(([y,_])=>({functionId:y,distance:_})).sort((y,_)=>y.distance-_.distance||u(y.functionId,_.functionId)),m=new Set,h=i.filter(y=>c.has(y.from)&&c.has(y.to)).filter(y=>{let _=JSON.stringify([y.from,y.to,y.site]);return m.has(_)?!1:(m.add(_),!0)}).sort((y,_)=>u(y.from,_.from)||u(y.to,_.to)||u(y.site,_.site));return{functions:f,edges:h}}function zd(e,n){let t=new Set,s=[...e];for(let o=s.pop();o!==void 0;o=s.pop())if(!t.has(o)){t.add(o);for(let r of n(o)??[])t.has(r)||s.push(r)}return t}var Ud=new WeakMap;function Lg(e,n){let t=Ud.get(n);if(t!==void 0&&t.graph===e)return t.reach;let s=Zn(e),o=n.filter(i=>i.reach.kind==="dependency-dispatch"&&s.has(i.source)).map(i=>i.source),r=new Set;if(o.length>0){let i=fr(e),a=zd(o,p=>i.get(p)),l=e.functions.filter(p=>s.has(p.moduleId)&&(a.has(p.moduleId)||p.addressTaken!==!1)).map(p=>p.id),d=new Map(e.callSites.map(p=>[p.id,p.enclosingFunctionId])),c=new Map;for(let p of e.callEdges){if(p.resolution==="unresolved")continue;let u=d.get(p.callSiteId);if(u===void 0)continue;let f=c.get(u);f===void 0?c.set(u,[p.calleeFunctionId]):f.push(p.calleeFunctionId)}r=zd(l,p=>c.get(p))}return Ud.set(n,{graph:e,reach:r}),r}function Gi(e){return Hd(e,Cs(e),Zn(e),qd(e))}function Hd(e,n,t,s){let o=[],r=[],i=new Map(e.functions.map(l=>[l.id,l.moduleId])),a=l=>l!==void 0&&t.has(l)&&s.has(n.get(l)?.packageName??"");for(let l of e.callSites)l.resolution==="unresolved"&&a(i.get(l.enclosingFunctionId))&&o.push(l.range);for(let l of e.imports)!l.specifierIsLiteral&&t.has(l.moduleId)&&r.push({path:n.get(l.moduleId)?.path??"",start:0,end:0});return{dispatch:o,load:r}}function qd(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function Dg(e,n,t){let s=new Map(e.functions.map(i=>[i.id,i])),o=Cs(e),r=new Map(e.callSites.map(i=>[i.id,i]));return n.map((i,a)=>{let l=s.get(i),d=l!==void 0?o.get(l.moduleId):void 0,c=t[a];return{functionId:i,functionName:l?.name,modulePath:d?.path??"",calledAt:c==null?null:r.get(c)?.range??null}})}function Ki(e){return Fg(jg(e))}function Fg(e){if(He(e.tier)!==(e.reasonKind!==void 0))throw new Error(`engine invariant: tier ${e.tier} with reasonKind ${String(e.reasonKind)} (a reason kind is set iff the tier is Potentially reachable)`);if(e.reasonKind!==void 0&&mt[e.reasonKind]!==e.tier)throw new Error(`engine invariant: reasonKind ${e.reasonKind} belongs in ${mt[e.reasonKind]}, not ${e.tier}`);return e}function jg(e){let{graph:n,installed:t,range:s,symbol:o,coverage:r}=e,i=[],a={unresolvedSites:i,unresolvedEvidence:{own:i,sets:[]}},l=z=>({unresolvedSites:z,unresolvedEvidence:{own:z,sets:[]}}),d=qd(n),c=new Set;for(let z of e.incompleteness)z.reach.kind==="unbounded"&&c.add(z.source);let p=e.incompleteness.some(z=>z.reach.kind==="assumed-bounded")?"loader-assumption":"complete",u=z=>z==="not-reachable"?p:void 0,f=void 0,m=new Map,h=z=>{let Z=m.get(z);return Z===void 0&&(Z=Og(n,z,c),m.set(z,Z)),Z},y=z=>z.reach.kind==="class-scope"&&o!==null&&o.packageName===z.reach.packageName&&o.container===z.reach.container,_=z=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let Z of Ti)for(let de of e.incompleteness)if(de.cause===Z&&z(de))return{cause:de.cause,source:de.source};return null},S=(z,Z)=>{let de;return _(x=>x.reach.kind==="unbounded"?!0:x.reach.kind==="class-scope"?y(x):x.reach.kind==="dependency-dispatch"?Z===void 0||Lg(n,e.incompleteness).has(Z):x.reach.kind==="loaded-package"?(s.ecosystem??"npm")===x.reach.ecosystem:z===void 0||h(x.reach.anchor)?!0:(de??=Rg(n,z),de.has(x.reach.anchor)))},b=()=>_(z=>z.reach.kind==="unbounded"?!0:z.reach.kind==="class-scope"?y(z):z.reach.kind==="dependency-dispatch"?!1:z.reach.kind==="loaded-package"?(s.ecosystem??"npm")===z.reach.ecosystem&&(z.reach.alsoLoaded?.includes(s.packageName)??!1):h(z.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${s.packageName} is not installed`,reasonKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let k;try{if((t.ecosystem??"npm")!==(s.ecosystem??"npm"))throw new Error("ecosystem mismatch");k=Rt(t.version,s)}catch{return{tier:Te("version-undecidable"),decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,reasonKind:"version-undecidable",attribution:void 0,basis:f,path:void 0,...a}}if(!k)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${s.packageName}@${t.version} is outside the affected range`,reasonKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let w=Cs(n),N=Zn(n),R=z=>{if(z.cause!=="dynamic-load"||z.source===null)return i;let Z=w.get(z.source);return Z===void 0?i:[{path:Z.path,start:0,end:0}]},{dispatch:v,load:I}=Hd(n,w,N,d),A=[...v,...I],B={unresolvedSites:I,unresolvedEvidence:{own:i,sets:["load"]}},O={unresolvedSites:A,unresolvedEvidence:{own:i,sets:["dispatch","load"]}},V=z=>{for(let Z of N)if(w.get(Z)?.packageName===z)return!0;return!1},E=z=>({tier:Te("incomplete-surface"),decidedAtStage:z,reason:`${o?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,reasonKind:"incomplete-surface",attribution:void 0,basis:f,path:void 0,...a}),D=()=>{if(!V(s.packageName)){if(I.length>0)return{tier:Te("dynamic-load"),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,reasonKind:"dynamic-load",attribution:void 0,basis:f,path:void 0,...B};let z=b();return z!==null?{tier:Te(z.cause),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,reasonKind:z.cause,attribution:void 0,basis:f,path:void 0,...l(R(z))}:t!==null&&t.outOfGraphExecution.length>0?{tier:Te("analysis-cap"),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,reasonKind:"analysis-cap",attribution:void 0,basis:f,path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${s.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${s.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,reasonKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}}return null};if(o===null||!o.verified)return{tier:Te(o===null?"db-gap":"unverified-symbol"),decidedAtStage:"symbol-reachable",reason:o===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",reasonKind:o===null?"db-gap":"unverified-symbol",attribution:void 0,basis:f,path:void 0,...O};if(r!==null&&!r.comparedPaths.has(o.sourcePath))return{tier:Te("db-gap"),decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${o.sourcePath}; symbol reachability undetermined`,reasonKind:"db-gap",attribution:void 0,basis:f,path:void 0,...O};if(o.symbolKind==="accessor"||o.symbolKind==="pattern")return{tier:Te("symbol-unsupported"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a ${o.symbolKind} symbol; call-graph reachability is not evaluated`,reasonKind:"symbol-unsupported",attribution:void 0,basis:f,path:void 0,...O};let L=Pg(n,w,o);if(L===void 0||!N.has(L.moduleId)){if(L===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&Mg(n,w,N,o))return{tier:Te("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} may be a static method reached via an ambiguous package-surface member call`,reasonKind:"dep-opaque",attribution:void 0,basis:f,path:void 0,...O};if(L===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&!Tg(n,w,o))return{tier:Te("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a method of the dependency class ${o.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,reasonKind:"dep-opaque",attribution:void 0,basis:f,path:void 0,...O};if(L===void 0){let x=Cg(n,w,o);if(x!==void 0&&N.has(x.id))return{tier:Te(I.length>0?"dynamic-load":"dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a class a loaded module declares, and the graph holds no node for constructing it \u2014 a class cannot be shown unused without one`,reasonKind:I.length>0?"dynamic-load":"dep-opaque",attribution:void 0,basis:f,path:void 0,...O}}let z=D();if(z!==null)return z;if(A.length>0){let x=L!==void 0?w.get(L.moduleId):Kd(n,o),M=L===void 0&&x!==void 0&&x.externalSurface!==!0&&N.has(x.id)&&!d.has(x.packageName);return{tier:Te(I.length>0?"dynamic-load":M?"dep-opaque":"dispatch"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} not statically reached, but unresolved dynamic access exists`,reasonKind:I.length>0?"dynamic-load":M?"dep-opaque":"dispatch",attribution:void 0,basis:f,path:void 0,...O}}let Z=L!==void 0?w.get(L.moduleId):Kd(n,o);if(L===void 0&&Z!==void 0&&Z.externalSurface!==!0&&N.has(Z.id)&&!d.has(Z.packageName))return{tier:Te("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,reasonKind:"dep-opaque",attribution:void 0,basis:f,path:void 0,...a};let de=Z!==void 0?S(Z.id,L?.id):b();return de!==null?{tier:Te(de.cause),decidedAtStage:L===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,reasonKind:de.cause,attribution:void 0,basis:f,path:void 0,...l(R(de))}:s.surfaceComplete?{tier:"not-reachable",decidedAtStage:L===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} is never reached from the application's entrypoints`,reasonKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:E(L===void 0?"symbol-reachable":"module-reachable")}let K=L.kind==="class",Y=$g(n,Wd(n),L.id);if(Y!==null)return{tier:uo(Y.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:K?`${o.exportName} is a class, and a path from an application entrypoint constructs it or a class below it`:`${o.exportName} is called from an application entrypoint`,reasonKind:void 0,attribution:pr(o),basis:u("reachable-high"),path:Dg(n,Y.path,Y.via),...a};if(A.length>0)return{tier:Te(I.length>0?"dynamic-load":K?"dep-opaque":"dispatch"),decidedAtStage:"call-path-confirmed",reason:K?`no path constructs the class ${o.exportName}, but unresolved edges exist \u2014 and a class is used by more than its construction`:`no resolved call path to ${o.exportName}, but unresolved edges exist`,reasonKind:I.length>0?"dynamic-load":K?"dep-opaque":"dispatch",attribution:void 0,basis:f,path:void 0,...O};let le=S(L.moduleId,L.id);return le!==null?{tier:Te(le.cause),decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${o.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,reasonKind:le.cause,attribution:void 0,basis:f,path:void 0,...l(R(le))}:s.surfaceComplete?K?{tier:Te("dep-opaque"),decidedAtStage:"call-path-confirmed",reason:`no path constructs the class ${o.exportName}, but a class is also used through subclasses, class attributes and class methods, which the call graph does not enumerate \u2014 cannot confirm it is unused`,reasonKind:"dep-opaque",attribution:void 0,basis:f,path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${o.exportName} is imported but never called from an entrypoint`,reasonKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:E("call-path-confirmed")}function Bg(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Gg(e,n,t){let s=new Map(e.classes.map(o=>[o.id,o.name]));for(let o of e.functions){if(o.name!==t.exportName)continue;let r=n.get(o.moduleId);if(!(r===void 0||r.packageName!==t.packageName||(o.enclosingClassId!==void 0?s.get(o.enclosingClassId)??null:null)!==t.container))return o.id}return null}function Kg(e,n,t){if(n===t)return[];let s=new Map(e.functions.map(l=>[l.id,l])),o=new Map(e.callSites.map(l=>[l.id,l])),r=new Map;for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let d=o.get(l.callSiteId);if(d===void 0)continue;let c=d.enclosingFunctionId;if(!s.has(c)||!s.has(l.calleeFunctionId))continue;let p=r.get(c),u={to:l.calleeFunctionId,label:l.resolution};p===void 0?r.set(c,[u]):p.push(u)}let i=new Set([n]),a=[{at:n,labels:[]}];for(let l=0;l<a.length;l++){let d=a[l];for(let c of r.get(d.at)??[]){if(i.has(c.to))continue;let p=[...d.labels,c.label];if(c.to===t)return p;i.add(c.to),a.push({at:c.to,labels:p})}}return null}function po(e,n,t,s,o){if(o.length===0)return null;let r=dr(e,n,t);if(r.length===0)return null;let i=Gg(e,n,s);for(let a of o){let l=r.filter(c=>c.packageName===a.anchor.packageName&&c.exportName===a.anchor.exportName&&c.container===a.anchor.container),d=l.find(c=>c.resolution==="resolved")??l[0];if(d!==void 0){if(Bg(a.callee,s))return{tier:uo("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&i!==null){let c=Kg(e,a.callee.realFunctionId,i);if(c!==null)return{tier:uo("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[d.resolution,"modeled",...c]}}}}return null}var Vd=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Xd=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","potentially-reachable-not-ruled-out","potentially-reachable-not-analysed"],Fi=["reachable-high","reachable-medium","reachable-low"],Yd=new Set(Fi),cs=["potentially-reachable-not-ruled-out","potentially-reachable-not-analysed"],zg=new Set(cs);function He(e){return zg.has(e)}function zt(e){return cs.reduce((n,t)=>n+e[t],0)}function pr(e){return e.verified?"gated":"candidate"}var mo=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],zi=["cupel","project"],$n={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Jd(e){return $n[e]}var mt={dispatch:"potentially-reachable-not-ruled-out","dynamic-load":"potentially-reachable-not-ruled-out","dep-opaque":"potentially-reachable-not-ruled-out","no-entrypoint":"potentially-reachable-not-analysed","analyzer-crash":"potentially-reachable-not-analysed","version-undecidable":"potentially-reachable-not-analysed","db-gap":"potentially-reachable-not-analysed","unverified-symbol":"potentially-reachable-not-analysed","symbol-unsupported":"potentially-reachable-not-analysed","resolution-divergence":"potentially-reachable-not-analysed","analysis-cap":"potentially-reachable-not-analysed","coverage-gap":"potentially-reachable-not-analysed","incomplete-surface":"potentially-reachable-not-analysed"};function Te(e){return mt[e]}import{randomBytes as Zl}from"node:crypto";import{performance as oo}from"node:perf_hooks";import hc from"node:path";import{closeSync as Ug,constants as Zd,fstatSync as Wg,openSync as Hg,readSync as qg,realpathSync as Qd}from"node:fs";import Ui from"node:path";var Vg=8*1024*1024;function Ms(e){return e==="PyPI"?"utf8-bytes":"utf16-units"}var Ut=class{#e;#t;#n=new Map;constructor(n,t=Vg){this.#t=t;let s;try{s=Qd(n)}catch{s=null}this.#e=s}read(n){let t=this.#n.get(n);if(t!==void 0)return t;let s=this.#s(n);return this.#n.set(n,s),s}#s(n){let t=this.#e;if(t===null||n===""||Ui.isAbsolute(n))return null;let s;try{s=Qd(Ui.join(t,n))}catch{return null}if(s!==t&&!s.startsWith(`${t}${Ui.sep}`))return null;let o;try{o=Hg(s,Zd.O_RDONLY|Zd.O_NONBLOCK)}catch{return null}try{let r=Wg(o);if(!r.isFile()||r.size>this.#t)return null;let i=Buffer.alloc(r.size),a=0;for(;a<r.size;){let l=qg(o,i,a,r.size-a,a);if(l===0)break;a+=l}return a===r.size?i:null}catch{return null}finally{Ug(o)}}};function ec(e,n,t){if(!Number.isInteger(n)||n<0)return null;if(t==="utf8-bytes"){if(n>e.length)return null;let i=e.subarray(0,n),a=1;for(let d of i)d===10&&(a+=1);let l=i.lastIndexOf(10)+1;return[a,e.subarray(l,n).toString("utf8").length+1]}let s=e.toString("utf8");if(n>s.length)return null;let o=s.slice(0,n),r=1;for(let i=0;i<o.length;i+=1)o.charCodeAt(i)===10&&(r+=1);return[r,n-(o.lastIndexOf(`
+`)+1)+1]}function Wt(e,n,t){if(n.end<n.start)return null;let s=e.read(n.path);if(s===null)return null;let o=ec(s,n.start,t),r=ec(s,n.end,t);return o===null||r===null?null:{startLine:o[0],startColumn:o[1],endLine:r[0],endColumn:r[1]}}var Xg="cupel/influence-shadow/2",nc=64,tc=16,Yg=e=>Yd.has(e);function mr(e){let n=new Map(e.functions.map(t=>[t.id,t.moduleId]));return{...e,functions:e.functions.map(t=>({...t,declRange:{...t.declRange,path:t.moduleId}})),callSites:e.callSites.map(t=>{let s=n.get(t.enclosingFunctionId);return s===void 0?t:{...t,range:{...t.range,path:s}}})}}function sc(e,n,t,s=()=>null,o=null){let r=t(),i={graph:e,lineOf:s},a={npm:i,PyPI:o},l=new Map,d=S=>{let b=l.get(S);return b===void 0&&(b=Ps(S.graph),l.set(S,b)),b};d(i);let c=Object.fromEntries(Li.map(S=>[S,0])),p=0,u=0,f=S=>b=>{let{site:k,...w}=b;return k===void 0?w:{...w,site:{...k,line:S.lineOf?.(k)??null}}},m={influenced:0,"no-source-reached":0,"reaches-entry-parameter":0,unknown:0},h={},y=0,_=[];for(let S of n){if(!Yg(S.tier))continue;let b={advisoryId:S.advisoryId,packageName:S.packageName,version:S.version,ecosystem:S.ecosystem,symbol:S.symbolName,tier:S.tier},k=S.ecosystem==="npm"||S.ecosystem==="PyPI"?a[S.ecosystem]:null;if(k===null){_.push({...b,skipped:S.ecosystem==="PyPI"?"this scan holds no Python graph to ask":`no front-end emits value flows for ${S.ecosystem}`,sites:[],truncatedSites:!1});continue}let w=d(k),N=f(k),R=S.path?.[S.path.length-1]?.functionId,v=R!==void 0?(w.callers.get(R)??[]).filter(A=>A.direct).map(A=>A.site):[],I=[];for(let A of v.slice(0,nc)){let B=[],O=A.args?.length??1,V=(E,D)=>{let L=lo(w,{site:A,port:D});y+=1,m[L.outcome]+=1,L.caveats.length>0&&(u+=1);for(let K of L.leaves)K.kind==="unknown"&&K.reason!==void 0&&(h[K.reason]=(h[K.reason]??0)+1),(K.kind==="unknown"||K.kind==="entry-parameter")&&(K.class===void 0?p+=1:c[K.class]+=1);B.push({port:E,outcome:L.outcome,leaves:L.leaves.map(N),caveats:L.caveats,visited:L.visited,...L.witness!==void 0?{witness:L.witness}:{}})};for(let E=0;E<Math.min(O,tc);E+=1)V(`arg[${String(E)}]`,{kind:"arg",index:E});A.receiverRange!==void 0&&V("receiver",{kind:"receiver"}),I.push({path:A.range.path,start:A.range.start,enclosing:A.enclosingFunctionId,ports:B,truncatedArgs:O>tc})}_.push({...b,sites:I,truncatedSites:v.length>nc})}return{format:Xg,findings:_,totals:{findings:_.length,ports:y,byOutcome:m,unknownReasons:h,identityCollisions:[...l.values()].reduce((S,b)=>S+b.identityCollisions,0),byClass:c,unclassified:p,portsWithCaveats:u},wallMs:Math.round((t()-r)*10)/10}}function tn(e){return Buffer.byteLength(JSON.stringify(e),"utf8")}function hr(e,n){return 2+e+Math.max(n-1,0)}function oc(e){return String(e).length}var Ht=class{#e;constructor(n,t){let s=new Float64Array(n+2);for(let[o,r]of t)s[o+1]=(s[o+1]??0)+r;for(let o=1;o<s.length;o+=1)s[o]=(s[o]??0)+(s[o-1]??0);this.#e=s}below(n){return this.#e[n]??0}},Hi=class{index;finding;key;size;kept;#e;#t;#n;#s;#r;#i;#a;#o;#l;#d;#c;#u;#f;constructor(n,t,s,o){this.index=n,this.finding=t,this.key=o,this.size=s.nodes.length,this.kept=s.nodes.length,this.#e=s,this.#t=t.influence?.overlay??null;let r=this.size,i=new Map;s.nodes.forEach((f,m)=>{i.has(f.id)||i.set(f.id,m)}),this.#n=i;let a=f=>i.get(f)??r,l=f=>Math.max(a(f.from),a(f.to));this.#s=new Ht(r,s.nodes.map((f,m)=>[m,tn(f)])),this.#r=new Ht(r,s.edges.map(f=>[l(f),tn(f)])),this.#i=new Ht(r,s.edges.map(f=>[l(f),1])),this.#c=tn({...s,nodes:[],edges:[],truncated:0})-5;let d=this.#t,c=d?.inputs??[];this.#a=new Ht(r,c.map(f=>[a(f.node),tn(f)])),this.#o=new Ht(r,c.map(f=>[a(f.node),1]));let p=0,u=[];for(let f of d?.blockers??[]){let m=tn(f.node===null?f:{...f,node:null});p+=m,f.node!==null&&u.push([a(f.node),tn(f)-m])}this.#l=new Ht(r,u),this.#d=p,this.#u=d===null?0:tn({...d,inputs:[],blockers:[],truncated:0})-5,this.#f=tn(s)+(d===null?0:tn(d))}bytesAt(n){if(n===this.size)return this.#f;let t=this.#c+hr(this.#s.below(n),n)+hr(this.#r.below(n),this.#i.below(n))+oc(this.#e.truncated+(this.size-n)),s=this.#t;if(s===null)return t;let o=this.#o.below(n);return t+this.#u+hr(this.#a.below(n),o)+hr(this.#d+this.#l.below(n),s.blockers.length)+oc(s.truncated+(s.inputs.length-o))}cut(){let n=this.kept,t=u=>(this.#n.get(u)??this.size)<n,s=this.#e,o=s.edges.filter(u=>t(u.from)&&t(u.to)),r={...s,nodes:s.nodes.slice(0,n),edges:o,truncated:s.truncated+(this.size-n)},i=this.#t,a=this.finding;if(i===null||a.influence===null)return{finding:{...a,reach:r},calls:s.edges.length-o.length,inputs:0,offGraph:0};let l=i.inputs.filter(u=>t(u.node)),d=0,c=i.blockers.map(u=>u.node===null||t(u.node)?u:(d+=1,{...u,node:null})),p={...i,inputs:l,blockers:c,truncated:i.truncated+(i.inputs.length-l.length)};return{finding:{...a,reach:r,influence:{...a.influence,overlay:p}},calls:s.edges.length-o.length,inputs:i.inputs.length-l.length,offGraph:d}}};function Wi(e,n){return e<n?-1:e>n?1:0}function Jg(e,n){return Wi(e.finding.advisoryId,n.finding.advisoryId)||Wi(e.finding.packageName,n.finding.packageName)||Wi(e.key,n.key)}function rc(e,n,t){let s=tn(e);if(s<=n)return{payload:e,bytes:s,cut:null};let o=e.findings.flatMap((h,y)=>h.reach!==null&&h.reach.nodes.length>1?[new Hi(y,h,h.reach,t(h))]:[]);if(o.length===0)return{payload:e,bytes:s,cut:null};o.sort(Jg);let r=o.reduce((h,y)=>Math.max(h,y.size),0),i=s;for(let h=r;h>1&&i>n;h-=1)for(let y of o){if(i<=n)break;y.size<h||(i+=y.bytesAt(y.kept-1)-y.bytesAt(y.kept),y.kept-=1)}let a=new Map(o.filter(h=>h.kept<h.size).map(h=>[h.index,h]));if(a.size===0)return{payload:e,bytes:s,cut:null};let l=0,d=0,c=0,p=0,u=e.findings.map((h,y)=>{let _=a.get(y);if(_===void 0)return h;let S=_.cut();return l+=_.size-_.kept,d+=S.calls,c+=S.inputs,p+=S.offGraph,S.finding}),f={...e,findings:u},m=tn(f);return{payload:f,bytes:m,cut:{budget:n,bytesBefore:s,bytesAfter:m,graphsCut:a.size,functionsCut:l,callsCut:d,inputsCut:c,blockersOffGraph:p,exhausted:m>n}}}function ic(e){let n=0,t=0,s=0,o=0;for(let l of e.findings){l.reach!==null&&(n+=tn(l.reach));let d=l.influence?.overlay??null;d!==null&&(t+=tn(d)),l.path!==null&&(s+=tn(l.path)),o+=tn(l.unresolvedSites)}let r=0;for(let l of e.advisories)l.details!==null&&(r+=tn(l.details));let i=tn(e.findings),a=tn(e.advisories);return[{name:"the reach graphs",bytes:n},{name:"the influence overlays",bytes:t},{name:"the call paths",bytes:s},{name:"the findings' own unresolved sites",bytes:o},{name:"the rest of the findings",bytes:i-n-t-s-o},{name:"the app-global unresolved sets",bytes:tn(e.unresolved)},{name:"the advisory descriptions",bytes:r},{name:"the rest of the advisory records",bytes:a-r},{name:"the package graphs",bytes:tn(e.packageGraphs)}].sort((l,d)=>d.bytes-l.bytes)}function ac(e){let n=e.exhausted?`; every graph is down to its vulnerable function and the payload is still ${String(e.bytesAfter)} bytes`:"";return`the findings payload was ${String(e.bytesBefore)} bytes, over its ${String(e.budget)}-byte budget, so ${String(e.graphsCut)} reach graph(s) were cut nearest the vulnerable function first (ADR-120): ${String(e.functionsCut)} function(s) dropped and counted in each graph's \`truncated\`, with the ${String(e.callsCut)} call(s) that touched them and the ${String(e.inputsCut)} overlay input(s) on them${n}`}function Ln(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function lc(e,n={}){let t=n.maxBytes??1073741824,s=n.timeoutMs??3e4,{get:o}=await import("node:https");return await new Promise((r,i)=>{let a=o(e,n.headers!==void 0?{headers:n.headers}:{},l=>{let d=l.statusCode??0;if(d<200||d>=300){l.resume(),i(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let c=[],p=0;l.on("data",u=>{if(p+=u.length,p>t){l.destroy(),i(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}c.push(u)}),l.on("end",()=>{r(Buffer.concat(c))}),l.on("error",i)});a.on("error",i),a.setTimeout(s,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(s)}ms`))})})}async function ho(e,n,t,s,o,r=3e4){let{request:i}=await import("node:https"),a=new URL(n).hostname;return await new Promise((l,d)=>{let c=i(n,{method:e,headers:t},p=>{let u=[],f=0;p.on("data",m=>{if(f+=m.length,f>o){p.destroy(),d(new Error(`${e} to ${a} returned more than ${String(o)} bytes`));return}u.push(m)}),p.on("end",()=>{l({status:p.statusCode??0,body:Buffer.concat(u).toString("utf8")})}),p.on("error",()=>{d(new Error(`${e} to ${a} failed`))})});c.on("error",()=>{d(new Error(`${e} to ${a} failed`))}),c.setTimeout(r,()=>{c.destroy(new Error(`${e} to ${a} timed out after ${String(r)}ms`))}),s!==void 0&&c.write(s),c.end()})}var go="api.cupel.sh",Zg=`https://${go}/v1/findings`,Qg=64*1024,us=8*1024*1024,ey=3e4,qt=class extends Error{constructor(n){super(n),this.name="PushError"}};async function dc(e,n,t,s={}){if(e.length>us)throw new qt(`findings payload is ${String(e.length)} bytes, over the ${String(us)}-byte limit`);let o=Ln(Zg,new Set([go])),r;try{r=await t(o.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,s.timeoutMs??ey)}catch{throw new qt(`the findings push to ${go} failed`)}if(r.body.length>Qg)throw new qt("the control plane returned a response larger than it should");if(!(r.status===202||r.status===200))throw r.status===401||r.status===403?new qt("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):r.status===400?new qt("the control plane rejected the findings payload as malformed"):new qt(`the findings push was refused with status ${String(r.status)}`)}var ny=14,Vt={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:1024,maxAdvisoryDetails:8e3,maxReachNodes:512,maxReachEdges:2048,maxPackageGraphNodes:256,maxPackageGraphEdges:1024,maxPackageGraphs:2e4,maxSourcePosition:1e7},ty=7.5*1024*1024,Hn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Vi(e){return{path:e.path,start:e.start,end:e.end}}function sy(e){let n=He(e.tier);if(n&&e.reasonKind===void 0)throw new Hn(`finding ${e.advisoryId} is ${e.tier} with no reason kind \u2014 a Potentially reachable finding without its kind is a hedge`);if(!n&&e.reasonKind!==void 0)throw new Hn(`finding ${e.advisoryId} is ${e.tier} but carries reason kind ${e.reasonKind} \u2014 only a Potentially reachable finding has one`);if(e.reasonKind!==void 0&&Te(e.reasonKind)!==e.tier)throw new Hn(`finding ${e.advisoryId} is ${e.tier} but its reason kind ${e.reasonKind} puts it in ${Te(e.reasonKind)}`);let t=n?e.reasonKind:null,s=e.modelId??null,o=e.modelPromotedFromKind??null;if(s===null!=(o===null))throw new Hn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(s!==null&&e.tier!=="reachable-low")throw new Hn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,symbolContainer:e.symbolContainer,symbolPath:e.symbolPath,severity:e.severity,tier:e.tier,reason:e.reason,reasonKind:t,reasonOwner:t===null?null:Jd(t),basis:e.basis??null,path:oy(e),unresolvedSites:e.unresolvedEvidence.own.map(Vi),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:s,modelPromotedFromKind:o,surfaceComplete:e.surfaceComplete??null,reach:ry(e),introducedBy:e.introducedBy??null,influence:e.influence===void 0?null:{value:e.influence.value,kind:e.influence.kind,owner:co[e.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null,overlay:e.influenceOverlay??null}}}function cc(e){return e===null?null:{line:e.line,column:e.column}}function oy(e){if(e.path===void 0)return null;let n=e.located?.path??null;return n!==null&&n.length===e.path.length?n.map((t,s)=>({functionName:e.path?.[s]?.functionName??null,modulePath:t.modulePath,line:t.line,column:t.column,callSite:cc(t.callSite)})):e.path.map(t=>({functionName:t.functionName??null,modulePath:t.modulePath,line:null,column:null,callSite:null}))}function ry(e){let n=e.located?.reach??null;return n===null?null:{nodes:n.nodes.map(t=>({id:t.id,functionName:t.functionName,modulePath:t.modulePath,line:t.line,column:t.column})),edges:n.edges.map(t=>({from:t.from,to:t.to,callSite:cc(t.callSite)})),truncated:n.truncated}}var qi="";function uc(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];if(e.ecosystem==="npm")return n.join(qi);let{symbolContainer:t,symbolPath:s}=e;return t===null&&s===null?[...n,e.ecosystem].join(qi):[...n,e.ecosystem,t??"",s??""].join(qi)}function iy(e){let n=new Map;for(let t of e){let s=uc(t),o=n.get(s);if(o===void 0){n.set(s,t);continue}if(o.tier!==t.tier||o.reasonKind!==t.reasonKind)throw new Hn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${o.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function ay(e){let n=Vt,t=(s,o,r)=>{throw new Hn(`${s} has ${String(o)} entries, over the ${String(r)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let s of["dispatch","load"]){let o=e.unresolved[s].length;o>n.maxUnresolvedSites&&t(`the app-global ${s} set`,o,n.maxUnresolvedSites)}for(let s of e.findings)s.path!==null&&s.path.length>n.maxPathSteps&&t(`the call path of finding ${s.advisoryId}`,s.path.length,n.maxPathSteps),s.reach!==null&&s.reach.nodes.length>n.maxReachNodes&&t(`the reach graph of finding ${s.advisoryId}`,s.reach.nodes.length,n.maxReachNodes),s.reach!==null&&s.reach.edges.length>n.maxReachEdges&&t(`the reach graph's calls of finding ${s.advisoryId}`,s.reach.edges.length,n.maxReachEdges),s.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${s.advisoryId}`,s.unresolvedSites.length,n.maxUnresolvedSites);e.packageGraphs.length>n.maxPackageGraphs&&t("the package graphs list",e.packageGraphs.length,n.maxPackageGraphs);for(let s of e.packageGraphs)s.nodes.length>n.maxPackageGraphNodes&&t(`package graph ${s.id}`,s.nodes.length,n.maxPackageGraphNodes),s.edges.length>n.maxPackageGraphEdges&&t(`the links of package graph ${s.id}`,s.edges.length,n.maxPackageGraphEdges);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let s of e.advisories){if(s.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${s.id}`,s.ranges.length,n.maxAdvisoryRanges),s.summary!==null&&s.summary.length>n.maxStringLength)throw new Hn(`the summary of advisory ${s.id} is ${String(s.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(s.details!==null&&s.details.length>n.maxAdvisoryDetails)throw new Hn(`the description of advisory ${s.id} is ${String(s.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function ly(e,n){let t=new Set(n.map(s=>s.advisoryId));return e.advisories.filter(s=>t.has(s.advisory.id)).map(s=>({id:s.advisory.id,cveId:s.advisory.cveId,osvId:s.advisory.osvId,summary:s.advisory.summary,details:s.advisory.details??null,severity:s.advisory.severity,published:s.advisory.published,source:s.advisory.source,ranges:s.ranges.map(o=>({packageName:o.packageName,introduced:o.introduced,fixed:o.fixed,lastAffected:o.lastAffected}))}))}function dy(e,n){let t=new Set(n.flatMap(s=>s.introducedBy===null?[]:[s.introducedBy]));return(e.packageGraphs??[]).filter(s=>t.has(s.id)).map(s=>({id:s.id,nodes:s.nodes.map(o=>({id:o.id,name:o.name,version:o.version,direct:o.direct,declaredIn:o.declaredIn===null?null:{path:o.declaredIn.path,line:o.declaredIn.line}})),edges:s.edges.map(o=>({from:o.from,to:o.to})),truncated:s.truncated}))}function cy(e){if(e.bytes<=us)return;let n=i=>`${i.name} (${String(i.bytes)} bytes, ${String(Math.round(100*i.bytes/e.bytes))}%)`,[t,s]=ic(e.payload),o=e.payload.findings.flatMap(i=>i.reach===null?[]:[i.reach]),r=o.length===0?"with no reach graph to cut":o.every(i=>i.nodes.length<=1)?"with every reach graph cut to its vulnerable function":"with its reach graphs as built";throw new Hn(`the findings payload is ${String(e.bytes)} bytes, over the ${String(us)}-byte limit, ${r} (ADR-120); its largest part is ${t===void 0?"unknown":n(t)}${s===void 0?"":`, then ${n(s)}`}`)}function fc(e,n,t={}){let s=iy(e.findings.map(sy)),o={version:ny,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:s,unresolved:{dispatch:e.unresolved.dispatch.map(Vi),load:e.unresolved.load.map(Vi)},advisories:ly(e,s),packageGraphs:dy(e,s)};ay(o);let r=rc(o,t.byteBudget??ty,uc);return r.cut!==null&&t.onCut?.(r.cut),cy(r),r.payload}function pc(e){let n=new Set(e.installed.packages.map(s=>s.ecosystem??"npm")),t=["npm","PyPI","Go"].filter(s=>n.has(s));return t.length===0?"npm":t.join("+")}var Ji="site-packages:",Yi=class{#e;#t;#n=new Map;constructor(n,t){this.#e=n,this.#t=t}point(n,t){if(!Number.isInteger(t)||t<0)return null;let s=this.#s(n);if(s===null)return null;let o=(typeof s.text=="string",s.text.length);if(t>o)return null;let r=0,i=s.starts.length-1;for(;r<i;){let p=r+i+1>>1;(s.starts[p]??0)<=t?r=p:i=p-1}let a=s.starts[r]??0,l=typeof s.text=="string"?t-a+1:s.text.subarray(a,t).toString("utf8").length+1,d=r+1,c=Vt.maxSourcePosition;return d>c||l>c?null:{line:d,column:l}}#s(n){let t=this.#n.get(n);if(t!==void 0)return t;let s=this.#e.read(n),o=null;if(s!==null){let r=[0];if(this.#t==="utf8-bytes"){for(let i=0;i<s.length;i+=1)s[i]===10&&r.push(i+1);o={text:s,starts:r}}else{let i=s.toString("utf8");for(let a=0;a<i.length;a+=1)i.charCodeAt(a)===10&&r.push(a+1);o={text:i,starts:r}}}return this.#n.set(n,o),o}},Ts=class{#e;#t;#n;#s;#r;#i;constructor(n,t,s,o){this.#e=n,this.#t=new Yi(t,s),this.#n=o,this.#s=new Map(n.functions.map(r=>[r.id,r])),this.#r=new Map(n.modules.map(r=>[r.id,r])),this.#i=new Map(n.callSites.map(r=>[r.id,r]))}locate(n){let t=n.path;if(t===void 0||t.length===0)return{path:null,reach:null};let s=t.map((l,d)=>{let c=this.#s.get(l.functionId),p=c===void 0?"":this.#n(c.moduleId),u=c===void 0?null:this.#o(p,c.declRange),f=t[d+1]?.calledAt??null;return{modulePath:Xi(p,l.modulePath),line:u?.line??null,column:u?.column??null,callSite:f===null?null:this.#o(p,f)}}),o=t[t.length-1]?.functionId,r=o===void 0?null:Bi(this.#e,o,n.tier==="reachable-medium");if(r===null)return{path:s,reach:null};let i=mc(r),a=new Map(r.functions.slice(0,i).map((l,d)=>[l.functionId,`n${String(d)}`]));return{path:s,reach:this.#a(r),nodeOf:a}}modulePathOf(n){let t=this.#r.get(n);return t===void 0?null:Xi(this.#n(n),t.path)}#a(n){let t=mc(n),s=new Map(n.functions.slice(0,t).map((i,a)=>[i.functionId,a])),o=n.functions.slice(0,t).map((i,a)=>{let l=this.#s.get(i.functionId),d=l===void 0?"":this.#n(l.moduleId),c=l===void 0?null:this.#o(d,l.declRange);return{id:`n${String(a)}`,functionName:l?.name??null,modulePath:(l===void 0?null:this.modulePathOf(l.moduleId))??"",line:c?.line??null,column:c?.column??null}}),r=n.edges.flatMap(i=>{let a=s.get(i.from),l=s.get(i.to);if(a===void 0||l===void 0)return[];let d=this.#i.get(i.site),c=this.#s.get(i.from),p=c===void 0?"":this.#n(c.moduleId);return[{from:`n${String(a)}`,to:`n${String(l)}`,callSite:d===void 0?null:this.#o(p,d.range)}]});return{nodes:o,edges:r,truncated:n.functions.length-t}}#o(n,t){return t.path===""||t.path.startsWith(Ji)?null:this.#t.point(Xi(n,t.path),t.start)}};function mc(e){let n=Vt,t=new Map(e.functions.map((i,a)=>[i.functionId,a])),s=new Array(e.functions.length).fill(0);for(let i of e.edges){let a=Math.max(t.get(i.from)??0,t.get(i.to)??0);s[a]=(s[a]??0)+1}let o=0,r=0;for(;r<e.functions.length&&r<n.maxReachNodes;){let i=s[r]??0;if(o+i>n.maxReachEdges)break;o+=i,r+=1}return r}function Xi(e,n){return e===""||n===""?n:`${e}/${n}`}function Zi(e){let n=e.filter(t=>t!=="").sort((t,s)=>s.length-t.length);return t=>n.find(s=>t.startsWith(`${s}::`))??""}var uy=512,fy=2048,py=64*1024,my=255,hy=1024,gy=64,yy=16,_y=/^(?:pkg:[^\s\p{Cc}]{1,200}|ecmascript:[A-Za-z0-9_.$]{1,200})$/u;function Qi(e){return e.length>0&&e.length<=hy&&!new RegExp("\\p{Cc}","u").test(e)&&!hc.posix.isAbsolute(e)&&!hc.win32.isAbsolute(e)}function gc(e,n){return{index:Ps(e),lineOf:t=>Wt(n,t,"utf16-units")?.startLine??null,pathOf:t=>t.path}}function yc(e,n,t){let s=new Map(e.modules.map(a=>[a.id,a])),o=(a,l)=>{let d=l.registeredAt;if(d===void 0)return l;let c=a.declRange.path,p=c!==""&&a.moduleId.endsWith(c)?a.moduleId.slice(0,a.moduleId.length-c.length):null,u=p===null?null:`${p}${d.path}`;return u!==null&&s.has(u)?{...l,registeredAt:{...d,path:u}}:{index:l.index,sourceClass:l.sourceClass,model:l.model}},r={...e,functions:e.functions.map(a=>a.sourceParams===void 0?a:{...a,sourceParams:a.sourceParams.map(l=>o(a,l))})},i=a=>a.packageName===""&&!a.id.includes(Ji);return{index:Ps(mr(r)),lineOf:a=>{let l=s.get(a.path);if(l===void 0||!i(l))return null;let d=n.modulePathOf(l.id);return d===null?null:Wt(t,{...a,path:d},"utf8-bytes")?.startLine??null},pathOf:a=>s.has(a.path)?n.modulePathOf(a.path):null}}function _c(e,n,t,s,o=r=>r.path){let r=0,i=64,a=u=>{let f=Buffer.byteLength(JSON.stringify(u),"utf8")+1;return i+f>py?!1:(i+=f,!0)},l=[];for(let[u,f]of t)for(let m of e.functions.get(u)?.sourceParams??[]){if(l.length>=uy||m.index<0||m.index>my){r+=1;continue}let h=m.registeredAt,y=h===void 0?null:o(h),_=h===void 0||y===null||!Qi(y)?null:s(h),S={node:f,param:m.index,sourceClass:m.sourceClass,model:m.model,registeredAt:y!==null&&_!==null?{path:y,line:_}:null};if(!a(S)){r+=1;continue}l.push(S)}let d=[],c=new Set,p=(e.callers.get(n)??[]).filter(u=>u.direct).map(u=>u.site);for(let u of p.slice(0,gy)){let f=[],m=Math.min(u.args?.length??1,yy);for(let h=0;h<m;h+=1)f.push({label:`arg[${String(h)}]`,port:{kind:"arg",index:h}});u.receiverRange!==void 0&&f.push({label:"receiver",port:{kind:"receiver"}});for(let{label:h,port:y}of f)for(let _ of lo(e,{site:u,port:y}).leaves){if(_.kind!=="unknown"&&_.kind!=="entry-parameter"||_.class===void 0)continue;let S=_.site??e.functions.get(_.functionId)?.declRange;if(S===void 0||S.path==="")continue;let b=o(S);if(b===null)continue;let k={port:h,node:t.get(_.functionId)??null,path:b,line:Qi(b)?s(S):null,class:_.class,owner:"cupel",callee:(_.reason==="opaque-callee"||_.reason==="unresolved-call")&&_.detail!==void 0&&_y.test(_.detail)?_.detail:null},w=JSON.stringify(k);if(!c.has(w)){if(c.add(w),!Qi(b)||d.length>=fy||!a(k)){r+=1;continue}d.push(k)}}}return{inputs:l,blockers:d,truncated:r}}import{mkdirSync as Ql,readdirSync as nh,readFileSync as RE,realpathSync as er,renameSync as ed,statSync as od,writeFileSync as nd}from"node:fs";import ct from"node:path";import{createRequire as by}from"node:module";var Sy=by(import.meta.url);function xy(){try{return Sy("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function ky(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var gr={open(e,n){let{DatabaseSync:t}=xy(),s=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?s.exec("PRAGMA query_only = ON;"):s.exec("PRAGMA journal_mode = DELETE;"),{exec:o=>s.exec(o),prepare:o=>ky(s.prepare(o)),close:()=>s.close()}}};var kc=["data","control","state","call-only","config-only"],wc=["patch-derived","pov-derived","drafted","reviewed"],vc=["remote-unauthenticated","remote-authenticated","rpc","message","upload","stored","upstream-response","cli","env","file"];var bc="[A-Za-z_$][A-Za-z0-9_$]{0,127}",wy=new RegExp(`^(?:(?:arg\\[(?:0|[1-9][0-9]{0,2})\\]|receiver)(?:\\.${bc}){0,${String(4)}}|kwarg\\[${bc}\\])$`,"u");function Ec(e){return wy.test(e)}var ea=(e,n)=>typeof e=="string"&&n.includes(e)?e:null,Sc=e=>{if(e==null)return null;if(typeof e!="string"||e.length>4096)return!1;try{return JSON.parse(e),e}catch{return!1}},xc=e=>e==null?null:typeof e=="string"&&e.length<=4096?e:!1,yr=e=>typeof e=="number"&&Number.isSafeInteger(e)?e:typeof e=="bigint"?Number(e):null;function na(e){let n=yr(e.id),t=yr(e.vulnerable_symbol_id),s=ea(e.mode,kc),o=ea(e.provenance,wc);if(n===null||t===null||s===null||o===null)return null;let r=s==="call-only"||s==="config-only",i=e.port;if(r?i!==null:typeof i!="string"||!Ec(i))return null;let a=e.at_path,l=e.at_start===null?null:yr(e.at_start),d=e.at_end===null?null:yr(e.at_end),c=null;if(a!==null||e.at_start!==null||e.at_end!==null){if(typeof a!="string"||a===""||a.length>4096||l===null||d===null||l<0||d<l)return null;c={path:a,start:l,end:d}}let p;try{p=typeof e.accepted_sources=="string"&&e.accepted_sources.length<=4096?JSON.parse(e.accepted_sources):void 0}catch{return null}if(!Array.isArray(p))return null;let u=[];for(let _ of p){let S=ea(_,vc);if(S===null||u.includes(S))return null;u.push(S)}let f=Sc(e.barriers),m=Sc(e.trigger_predicate),h=xc(e.evidence_ref),y=xc(e.reviewer);return f===!1||m===!1||h===!1||y===!1||o==="reviewed"&&y===null?null:{id:n,vulnerableSymbolId:t,mode:s,port:r?null:i,at:c,acceptedSources:u,barriers:f,triggerPredicate:m,provenance:o,evidenceRef:h,reviewer:y}}var yo="8",_r=new Set(["vulndb-listed","vulndb-derived"]),ht="8";function _o(e,n){return/^\d+$/u.test(e)&&Number(e)>=Number(n)}function qe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function Je(e){return typeof e=="string"?e:null}function gt(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var vy=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Fh=`
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Ey=`
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,jh=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
-                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Bh=5,Kh=6;function zh(e){let n=e>=Kh?"a.details":"NULL AS details",t=e>=Bh?"ap.surface_complete":jh;return`${Dh}, ${n}, ${t}${Fh}`}var Uh="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",qh="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Hh="SELECT value FROM ingest_meta WHERE key = 'schema_version'",Wh=7,Gh="SELECT * FROM vulnerability_contract WHERE vulnerable_symbol_id = :id ORDER BY id",Vh="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem",Xh="SELECT value FROM ingest_meta WHERE key = 'population_mode'";function Ws(e,n=jr){let t=n.open(e,"readonly"),s=t.prepare(Hh).get(),r=s!==void 0?qe(s.value):"",i=/^\d+$/u.test(r)?Number(r):0,o=t.prepare(zh(i)),a=t.prepare(Uh),d=t.prepare(qh),l=t.prepare(Vh),c=t.prepare(Xh),p=i>=Wh?t.prepare(Gh):null;return{schemaVersion:r,ecosystems(){return l.all({}).map(u=>qe(u.ecosystem))},populationMode(){let u=c.get();return u===void 0?null:qe(u.value)},advisoriesForPackage(u,f){return o.all({eco:u,name:f}).map(h=>({affected:{id:st(h.ap_id)??0,advisoryId:qe(h.advisory_id),ecosystem:qe(h.ecosystem),packageName:qe(h.package_name),introduced:He(h.introduced),fixed:He(h.fixed),lastAffected:He(h.last_affected),fixCommit:He(h.fix_commit),repoUrl:He(h.repo_url),surfaceComplete:st(h.surface_complete)===1?1:0},advisory:{id:qe(h.a_id),osvId:He(h.osv_id),cveId:He(h.cve_id),summary:He(h.summary),details:He(h.details),severity:He(h.severity),published:He(h.published),source:qe(h.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(u){return a.all({id:u}).map(f=>({id:st(f.id)??0,affectedPackageId:st(f.affected_package_id)??0,exportName:He(f.export_name),symbolKind:qe(f.symbol_kind),matchPattern:He(f.match_pattern),matchGlobs:He(f.match_globs),container:He(f.container),sourcePath:He(f.source_path),declStart:st(f.decl_start),declEnd:st(f.decl_end),astHashBefore:He(f.ast_hash_before),astHashAfter:He(f.ast_hash_after),derivation:qe(f.derivation),confidence:qe(f.confidence),verified:st(f.verified)===1?1:0}))},contractsForSymbol(u){if(p===null)return[];let f=[];for(let h of p.all({id:u})){let g=pi(h);if(g===null||g.vulnerableSymbolId!==u)return"unreadable";f.push(g)}return f},aliasesForSymbol(u){return d.all({id:u}).map(f=>({id:st(f.id)??0,vulnerableSymbolId:st(f.vulnerable_symbol_id)??0,aliasPath:qe(f.alias_path),aliasName:qe(f.alias_name)}))},allModels(){let u;try{u=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
-               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let f=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return u.map(h=>{let g=st(h.id)??0;return{packageName:qe(h.package_name),modelId:qe(h.evidence_ref),introduced:qe(h.introduced),fixedBefore:He(h.fixed_before),evidenceRef:qe(h.evidence_ref),edges:f.all({id:g}).map(y=>({kind:qe(y.kind),anchorExport:qe(y.anchor_export),anchorContainer:He(y.anchor_container),calleePackage:qe(y.callee_package),calleeContainer:He(y.callee_container),calleeExport:qe(y.callee_export)}))}})},close(){t.close()}}}function mi(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let f of e)if(f.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${f.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,s=new Map,r=new Map,i=new Map,o=1,a=(f,h,g,y)=>{let _=`${String(g)}:${String(y)}`,b=f.get(_);if(b!==void 0)return b;let x=o;o+=1,f.set(_,x);let k=e[g];if(k===void 0)throw new Error("unreachable: reader index out of range");return h.set(x,{reader:k,id:y}),x},d=e.map(f=>new Set(f.ecosystems?.()??[])),l=f=>{let h=e.map((g,y)=>y).filter(g=>d[g]?.has(f)===!0);return h.length>0?h:e.map((g,y)=>y).filter(g=>e[g]?.ecosystems===void 0)},c=(f,h)=>({...h,id:a(r,i,f,h.id),affectedPackageId:a(t,s,f,h.affectedPackageId)}),p=e.map((f,h)=>h),u=f=>{let h;for(let g of f){let y=e[g];if(y?.populationMode===void 0)continue;let _=y.populationMode();if(_!=="census")return _;h=_}return h};return{schemaVersion:n.schemaVersion,ecosystems(){let f=new Set;for(let h of d)for(let g of h)f.add(g);return[...f].sort()},populationMode(){return u(p)??null},populationModeFor(f){let h=l(f);return u(h.length>0?h:p)},advisoriesForPackage(f,h){let g=[];for(let y of l(f)){let _=e[y];if(_!==void 0)for(let b of _.advisoriesForPackage(f,h))g.push({...b,affected:{...b.affected,id:a(t,s,y,b.affected.id)}})}return g},symbolsForAffected(f){let h=s.get(f);if(h===void 0)return[];let g=e.indexOf(h.reader);return h.reader.symbolsForAffected(h.id).map(y=>c(g,y))},aliasesForSymbol(f){let h=i.get(f);if(h===void 0)return[];let g=e.indexOf(h.reader);return h.reader.aliasesForSymbol(h.id).map(y=>({...y,vulnerableSymbolId:a(r,i,g,y.vulnerableSymbolId)}))},contractsForSymbol(f){let h=i.get(f);if(h===void 0)return[];let g=h.reader.contractsForSymbol?.(h.id)??[];return g==="unreadable"?g:g.map(y=>({...y,vulnerableSymbolId:f}))},allModels(){return e.flatMap(f=>f.allModels?.()??[])},close(){for(let f of e)f.close()}}}var ps="7";import{realpathSync as bt}from"node:fs";import Tn from"node:path";import{realpathSync as Wt}from"node:fs";import{isBuiltin as Ri}from"node:module";import ln from"node:path";import M from"typescript";function hi(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function We(e){let n=hi(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Pn(e){let n=hi(e);if(n.startsWith("@")){let s=n.indexOf("/");if(s===-1)return n;let r=n.indexOf("/",s+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Od(e){let n=hi(e),t=Pn(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as ng,statSync as gi}from"node:fs";var Pt=16*1024*1024;function ms(e,n){try{let t=gi(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:ng(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function on(e){let n=ms(e,Pt);return n.kind==="ok"?n.text:null}function rt(e){try{return gi(e).isFile()}catch{return!1}}function Pd(e){try{let n=gi(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as tg,realpathSync as xi}from"node:fs";import ve from"node:path";import Kr from"typescript";var Dd=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Sn(e){return Dd.some(([n])=>e.endsWith(n))}function sg(e){for(let[n,t]of Dd)if(e.endsWith(n)){let s=e.slice(0,-n.length);return t.map(r=>s+r)}return[]}var rg=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function Fd(e){if(Sn(e))return e;for(let[n,t]of rg)if(e.endsWith(n)){let s=e.slice(0,-n.length);for(let r of t){let i=s+r;if(rt(i))return i}return e}return e}var bi=[Kr.ModuleKind.CommonJS,Kr.ModuleKind.ESNext],Si=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function Gs(e,n,t,s,r,i){let o=Kr.resolveModuleName(e,n,t,s,void 0,void 0,r).resolvedModule;if(o===void 0)return null;let a=o.resolvedFileName;if(i){for(let d of sg(a))if(rt(d))return d}return a}var jd=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],og=[".js",".json",".node"],ig=["index.js","index.json","index.node"];function zr(e){return!Sn(e)&&jd.some(n=>e.endsWith(n))}function Bd(e){if(rt(e))return e;for(let n of og)if(rt(e+n))return e+n;return null}function Cd(e){for(let n of ig){let t=ve.join(e,n);if(rt(t))return t}return null}var Kd=[".ts",".tsx",".cts",".mts",".jsx"];function ag(e){for(let n of Kd)if(rt(e+n))return e+n;return null}function lg(e){for(let n of Kd){let t=ve.join(e,"index"+n);if(rt(t))return t}return null}function ki(e){let n=on(ve.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let s=ve.join(e,t),r=Bd(s)??Cd(s);if(r!==null)return r}}catch{}return Cd(e)}function zd(e){return Bd(e)??ki(e)??ag(e)??lg(e)}function Ud(e){return zd(e)!==null}function dg(e,n){let t=e.split(ve.sep),s=n.split("/"),r=null;for(let o=t.length-s.length-1;o>=0;o-=1)if(t[o]==="node_modules"&&s.every((a,d)=>t[o+1+d]===a)){r=t.slice(0,o+1+s.length).join(ve.sep);break}if(r===null||r==="")return null;let i=on(ve.join(r,"package.json"));if(i===null)return null;try{let o=JSON.parse(i),a=o.exports,d=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(o.name!==n||d)return null}catch{return null}try{return xi(r)}catch{return null}}function cg(e,n){let t=zd(ve.join(e,n));if(t===null)return null;let s;try{s=xi(t)}catch{return null}let r=e.endsWith(ve.sep)?e:e+ve.sep;return s!==e&&!s.startsWith(r)||Sn(s)||!jd.some(i=>s.endsWith(i))?null:s}function ug(e,n){let t=Od(e);return t===""||t.includes("\0")||t.split("/").some(s=>s===""||s==="."||s===".."||s==="node_modules")?null:cg(n,t)}var qt={kind:"nothing-loads"},yi=8192;function _i(e,n){let t=n.get(e);if(t!==void 0)return t;let s,r=null;try{r=tg(e);let i=new Set,o=!1;for(;;){let a=r.readSync();if(a===null)break;if(i.size>=yi){o=!0;break}i.add(a.name)}s={names:i,truncated:o}}catch{s=null}finally{try{r?.closeSync()}catch{}}return n.set(e,s),s}var fg=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function qd(e){return fg.some(n=>e.length>n.length&&e.endsWith(n))}function Ct(e,n){let t=e.endsWith(ve.sep)?e:e+ve.sep;return n===e||n.startsWith(t)}function Md(e,n){let t;try{t=xi(n)}catch{return{kind:"missing"}}return Ct(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Td(e,n){let t=(n+".").toLowerCase(),s=[];for(let r of e){let i=r.toLowerCase();i.length>t.length&&i.startsWith(t)&&s.push(r)}return s}function pg(e,n,t){let s=ve.dirname(n);if(!Ct(e,s))return null;let r=_i(s,t);if(r===null)return null;let i=ve.basename(n);return r.names.has(i)?i:null}function $d(e,n){let t=e.filter(r=>!qd(r));if(t.length===0)return qt;let s=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${s}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Hd(e,n,t,s){let r=e,i=r.indexOf("?");i!==-1&&(r=r.slice(0,i));let o=r.indexOf("#");if(o!==-1&&(r=r.slice(0,o)),r===""||r.includes("\0"))return qt;let a=ve.resolve(ve.dirname(n),r);if(!Ct(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let d=Md(t,a);if(d.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(d.kind==="ok"){let f=Pd(d.real);if(f==="file"){let y=pg(t,d.real,s);return y!==null&&qd(y)?qt:{kind:"unanalyzable",reason:y===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${y}") the analyzer cannot parse`,why:y===null?"probe-refused":"sibling-unparsable"}}if(f!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let h=_i(d.real,s);if(h===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let g=$d(Td(h.names,"index"),"a directory index");return g.kind==="unanalyzable"?g:h.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:h.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(yi)} entries and was not fully probed`,why:"probe-refused"}:qt}let l=ve.basename(a);if(l===""||l==="."||l==="..")return qt;let c=Md(t,ve.dirname(a));if(c.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(c.kind==="missing")return qt;let p=_i(c.real,s);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let u=$d(Td(p.names,l),"a sibling file exists");return u.kind==="unanalyzable"?u:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(yi)} entries and was not fully probed`,why:"probe-refused"}:qt}function wi(e,n){let t=Pn(e),s=ve.dirname(n);for(let r=0;r<64;r+=1){let i=ve.join(s,"node_modules",...t.split("/"));if(on(ve.join(i,"package.json"))!==null)return i;let o=ve.dirname(s);if(o===s)return null;s=o}return null}function Ld(e,n,t,s,r){let i;for(let o of bi)for(let a of Si){let d={...t,noDtsResolution:!0,customConditions:[...a]},l=Gs(e,n,d,s,o,r);if(i===void 0)i=l;else if(i!==l)return null}return i??null}function Cn(e,n,t,s){let r=We(e);if(r==="relative")return Gs(e,n,t,s,void 0,!0);if(r==="package-root"){let a=Ld(e,n,t,s,!0);if(a!==null)return a;let d=wi(e,n);if(d===null||on(ve.join(d,"package.json"))?.includes('"exports"')===!0)return null;let l=ki(d);return l===null||Sn(l)?null:Ct(d,l)?l:null}let i=Ld(e,n,t,s,!1);if(i===null)return null;let o=dg(i,Pn(e));return o!==null?ug(e,o):Sn(i)?i:Fd(i)}function Wd(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function Vs(e,n,t,s){let r=We(e);if(r==="relative")return"no-candidate";if(Wd(e))return"alias-unmapped";let i=new Set;for(let h of bi)for(let g of Si){let y={...t,noDtsResolution:!0,customConditions:[...g]};i.add(Gs(e,n,y,s,h,r==="package-root"))}if(i.size>1)return"divergent-exports";let o=wi(e,n);if(o===null)return"not-installed";let a=on(ve.join(o,"package.json"));if(a===null)return"unreadable-manifest";let d;try{d=JSON.parse(a)}catch{return"unreadable-manifest"}if(typeof d!="object"||d===null)return"unreadable-manifest";let l=d,c=l.exports!==void 0&&l.exports!==null,p=typeof l.typesVersions=="object"&&l.typesVersions!==null,[u]=i;if(u!=null)return Ct(o,u)?!c&&p?"types-versions-remap":Sn(u)?"declaration-only":"no-candidate":"out-of-root";let f=Gs(e,n,t,s,void 0,!1);if(f!==null&&Sn(f))return!c&&p?"types-versions-remap":"declaration-only";if(r==="package-root"&&!c){let h=ki(o);if(h!==null&&!Ct(o,h))return"out-of-root"}return"no-candidate"}function hs(e,n,t,s){let r=Cn(e,n,t,s);if(r!==null)return[r];let i=We(e);if(i==="relative")return[];let o=new Set;for(let l of bi)for(let c of Si){let p={...t,noDtsResolution:!0,customConditions:[...c]};o.add(Gs(e,n,p,s,l,i==="package-root"))}if(o.size<2||o.has(null))return[];let a=wi(e,n);if(a===null)return[];let d=[];for(let l of o){if(l===null)return[];let c=Fd(l);if(Sn(c)||!Ct(a,c))return[];d.push(c)}return[...new Set(d)].sort()}function Gd(e,n){let t=ve.dirname(e);for(let s=0;s<64;s+=1){let r=on(ve.join(t,"package.json"));if(r!==null){try{let o=JSON.parse(r);if(typeof o!="object"||o===null)return!1;let a=o.optionalDependencies;if(typeof a=="object"&&a!==null&&n in a)return!0;let d=o.peerDependenciesMeta;if(typeof d=="object"&&d!==null){let l=d[n];if(typeof l=="object"&&l!==null)return l.optional===!0}}catch{return!1}return!1}let i=ve.dirname(t);if(i===t)return!1;t=i}return!1}function Vd(e,n,t){let s=on(ve.join(e,"tsconfig.json"));if(s===null)return()=>null;let r=Kr.parseConfigFileTextToJson(ve.join(e,"tsconfig.json"),s);if(r.error!==void 0)return()=>null;let i=r.config?.compilerOptions;if(typeof i!="object"||i===null)return()=>null;let o=i.paths;if(typeof o!="object"||o===null)return()=>null;let a=i.baseUrl,d=typeof a=="string"?ve.resolve(e,a):e,l=new Map,c=[];for(let[u,f]of Object.entries(o)){if(!Array.isArray(f))continue;let h=f.filter(y=>typeof y=="string");if(h.length===0)continue;let g=u.indexOf("*");g===-1?l.set(u,h):u.indexOf("*",g+1)===-1&&c.push({prefix:u.slice(0,g),suffix:u.slice(g+1),targets:h})}if(c.sort((u,f)=>f.prefix.length-u.prefix.length),l.size===0&&c.length===0)return()=>null;let p=u=>{let f=l.get(u);if(f!==void 0)return f;for(let h of c){if(u.length<h.prefix.length+h.suffix.length||!u.startsWith(h.prefix)||!u.endsWith(h.suffix))continue;let g=u.slice(h.prefix.length,u.length-h.suffix.length);return h.targets.map(y=>{let _=y.indexOf("*");return _===-1?y:y.slice(0,_)+g+y.slice(_+1)})}return[]};return(u,f)=>{let h=p(u);if(h.length===0||Cn(u,f,n,t)!==null)return null;for(let g of h){let y=ve.resolve(d,g),_=ve.relative(ve.dirname(f),y).split(ve.sep).join("/");if(_==="")continue;_.startsWith(".")||(_=`./${_}`);let b=Cn(_,f,n,t);if(b!==null&&Ct(e,b))return b}return null}}import{readdirSync as mg,realpathSync as hg}from"node:fs";import gt from"node:path";import le from"typescript";function Xs(e,n){if(le.isIdentifier(e))n.add(e.text);else for(let t of e.elements)le.isBindingElement(t)&&Xs(t.name,n)}function gs(e){let n=new Map,t=new Set,s=d=>{n.set(d,(n.get(d)??0)+1)},r=d=>{let l=Ze(d);if(le.isIdentifier(l))t.add(l.text);else if(le.isArrayLiteralExpression(l))for(let c of l.elements)r(c);else if(le.isObjectLiteralExpression(l))for(let c of l.properties)le.isShorthandPropertyAssignment(c)?t.add(c.name.text):le.isPropertyAssignment(c)?r(c.initializer):le.isSpreadAssignment(c)&&r(c.expression);else le.isSpreadElement(l)?r(l.expression):le.isBinaryExpression(l)&&l.operatorToken.kind===le.SyntaxKind.EqualsToken&&r(l.left)},i=d=>{let l=new Set;Xs(d,l);for(let c of l)s(c)},o=d=>{le.isVariableDeclaration(d)?i(d.name):le.isFunctionDeclaration(d)&&d.name!==void 0||le.isClassDeclaration(d)&&d.name!==void 0?s(d.name.text):le.isParameter(d)?i(d.name):((le.isFunctionExpression(d)||le.isClassExpression(d))&&d.name!==void 0&&le.isIdentifier(d.name)&&!(d.parent!==void 0&&le.isVariableDeclaration(d.parent)&&d.parent.initializer===d&&le.isIdentifier(d.parent.name)&&d.parent.name.text===d.name.text)||le.isImportClause(d)&&d.name!==void 0||le.isNamespaceImport(d)||le.isImportSpecifier(d)||le.isImportEqualsDeclaration(d))&&s(d.name.text),le.isBinaryExpression(d)&&d.operatorToken.kind>=le.SyntaxKind.FirstAssignment&&d.operatorToken.kind<=le.SyntaxKind.LastAssignment?r(d.left):(le.isPrefixUnaryExpression(d)||le.isPostfixUnaryExpression(d))&&(d.operator===le.SyntaxKind.PlusPlusToken||d.operator===le.SyntaxKind.MinusMinusToken)?r(d.operand):(le.isForOfStatement(d)||le.isForInStatement(d))&&!le.isVariableDeclarationList(d.initializer)&&r(d.initializer),le.forEachChild(d,o)};o(e);let a=new Set(t);for(let[d,l]of n)l>1&&a.add(d);return a}function Ht(e,n,t){let s=gs(e),r=new Map,i=o=>{le.isVariableDeclaration(o)&&le.isIdentifier(o.name)&&o.initializer!==void 0&&!s.has(o.name.text)&&!r.has(o.name.text)&&r.set(o.name.text,o.initializer),le.forEachChild(o,i)};return i(e),{containingFile:n,taintedNames:s,constBindings:r,resolveParamDirs:t}}var gg=1024,yg=32,_g=new Set(["filter","sort","slice","reverse"]),xg=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ze(e){let n=e;for(;le.isParenthesizedExpression(n);)n=n.expression;return n}function Xd(e,n){return le.isPropertyAccessExpression(e)&&le.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function Mt(e,n,t,s){if(t>yg)return null;let r=Ze(e);if(le.isStringLiteralLike(r))return r.text;if(le.isTemplateExpression(r)){let i=r.head.text;for(let o of r.templateSpans){let a=Mt(o.expression,n,t+1,s);if(a===null)return null;i+=a+o.literal.text}return i}if(le.isBinaryExpression(r)&&r.operatorToken.kind===le.SyntaxKind.PlusToken){let i=Mt(r.left,n,t+1,s);if(i===null)return null;let o=Mt(r.right,n,t+1,s);return o===null?null:i+o}if(le.isIdentifier(r)){if(r.text==="__dirname")return gt.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||s.has(r.text))return null;let i=n.constBindings.get(r.text);if(i===void 0)return null;s.add(r.text);let o=Mt(i,n,t+1,s);return s.delete(r.text),o}if(le.isCallExpression(r)){let i=Xd(r.expression,"join"),o=Xd(r.expression,"resolve");if(!i&&!o)return null;let a=[];for(let l of r.arguments){let c=Mt(l,n,t+1,s);if(c===null)return null;a.push(c)}let d=a[0];return d===void 0||o&&!gt.isAbsolute(d)?null:o?gt.resolve(...a):gt.join(...a)}return null}function Ur(e){let n=Ze(e);if(le.isBinaryExpression(n)&&n.operatorToken.kind===le.SyntaxKind.PlusToken)return[...Ur(n.left),...Ur(n.right)];if(le.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let s of n.templateSpans)t.push({expr:s.expression}),s.literal.text.length>0&&t.push({lit:s.literal.text});return t}return le.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Zd(e){let n=e,t=0;for(;t++<4096;){let s=n.parent;if(s===void 0)return null;if(le.isForOfStatement(s)&&s.statement===n){let r=s.initializer;if(le.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&le.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let i=Yd(s.expression);if(i!==null)return i}}if((le.isArrowFunction(n)||le.isFunctionExpression(n))&&le.isCallExpression(s)&&s.arguments.length>0&&s.arguments[0]===n&&le.isPropertyAccessExpression(s.expression)&&xg.has(s.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&le.isIdentifier(r.name)&&r.name.text===e.text){let i=Yd(s.expression.expression);if(i!==null)return i}}n=s}return null}function Yd(e){let n=Ze(e),t=0;for(;le.isCallExpression(n)&&t++<16;){let s=n.expression;if(le.isPropertyAccessExpression(s)){let r=s.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(_g.has(r)){n=Ze(s.expression);continue}return null}return le.isIdentifier(s)&&s.text==="readdirSync"?n.arguments[0]??null:null}return null}function bg(e,n){let t=Ur(e);if(t.length<2)return null;let s=t[t.length-1];if(s===void 0||!("expr"in s)||!le.isIdentifier(s.expr))return null;let r=s.expr;if(n.taintedNames.has(r.text))return null;let i="";for(let l=0;l<t.length-1;l+=1){let c=t[l];if(c===void 0)return null;if("lit"in c)i+=c.lit;else{let p=Mt(c.expr,n,0,new Set);if(p===null)return null;i+=p}}let o=Zd(r),a=o===null?null:Mt(o,n,0,new Set);if(a===null)return null;let d=gt.resolve(i);return d!==gt.resolve(a)?null:d}function Sg(e){if((le.isFunctionDeclaration(e)||le.isFunctionExpression(e))&&e.name!==void 0&&le.isIdentifier(e.name)||le.isMethodDeclaration(e)&&le.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&le.isVariableDeclaration(n)&&le.isIdentifier(n.name)?n.name.text:null}function kg(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!le.isFunctionLike(t))continue;let s=-1;for(let i=0;i<t.parameters.length;i+=1){let o=t.parameters[i];if(o!==void 0&&le.isIdentifier(o.name)&&o.name.text===n){s=i;break}}if(s<0)continue;let r=Sg(t);return r===null?null:{fnName:r,paramIndex:s}}return null}function Ys(e,n){let t=Ur(e);if(t.length!==2)return null;let[s,r]=t;if(s===void 0||!("expr"in s)||!le.isIdentifier(s.expr)||r===void 0||!("expr"in r)||!le.isIdentifier(r.expr))return null;let i=s.expr,o=r.expr;if(n.taintedNames.has(i.text)||n.taintedNames.has(o.text))return null;let a=Zd(o);return a===null||!le.isIdentifier(a)||a.text!==i.text?null:kg(i,i.text)}function wg(e,n){if(n.resolveParamDirs===void 0)return null;let t=Ys(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function qr(e){for(let n=e.parent;n!==void 0;n=n.parent){if(le.isSourceFile(n))return!0;if(!le.isArrowFunction(n)&&le.isFunctionLike(n))return!1}return!0}function vi(e,n){let t=Mt(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let s=bg(e,n);if(s!==null)return{kind:"dir",dir:s};let r=wg(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function Qd(e,n){let t;try{t=hg(e)}catch{return null}let s=n.endsWith(gt.sep)?n:n+gt.sep;return t===n||t.startsWith(s)?t:null}function ec(e,n,t,s,r){let i=Cn(e,n,s,r);return i===null||Sn(i)||!zr(i)?null:Qd(i,t)}function Jd(e,n,t,s,r){let i=Qd(e,t);if(i===null)return[];let o;try{o=mg(i)}catch{return[]}if(o.length===0||o.length>gg)return[];o.sort();let a=new Set,d=[];for(let l of o){let c=ec(gt.join(i,l),n,t,s,r);c!==null&&!a.has(c)&&(a.add(c),d.push(c))}return d}function Hr(e,n,t,s,r){let i=vi(e,n);if(i.kind==="const"){if(We(i.value)==="package-root")return[];let o=ec(i.value,n.containingFile,t,s,r);return o===null?[]:[o]}if(i.kind==="dir")return Jd(i.dir,n.containingFile,t,s,r);if(i.kind==="dirs"){let o=new Set,a=[];for(let d of i.dirs)for(let l of Jd(d,n.containingFile,t,s,r))o.has(l)||(o.add(l),a.push(l));return a}return[]}import vg from"node:path";import Te from"typescript";var Eg=32,Wr="\0",nc=(e,n)=>`${e}${Wr}${n}`,tc=(e,n,t)=>`${e}${Wr}${n}${Wr}${String(t)}`;function Ng(e){let n=new Map,t=new Set,s=(r,i)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,i)};for(let r of e.statements)if(Te.isImportDeclaration(r)&&Te.isStringLiteralLike(r.moduleSpecifier)){let i=r.moduleSpecifier.text,o=r.importClause;if(o===void 0)continue;o.name!==void 0&&s(o.name.text,{kind:"module",specifier:i});let a=o.namedBindings;if(a!==void 0&&Te.isNamespaceImport(a))s(a.name.text,{kind:"module",specifier:i});else if(a!==void 0&&Te.isNamedImports(a))for(let d of a.elements)s(d.name.text,{kind:"named",specifier:i,imported:(d.propertyName??d.name).text})}else if(Te.isImportEqualsDeclaration(r)&&Te.isExternalModuleReference(r.moduleReference)&&Te.isStringLiteralLike(r.moduleReference.expression))s(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(Te.isFunctionDeclaration(r)&&r.name!==void 0)s(r.name.text,{kind:"local"});else if(Te.isVariableStatement(r))for(let i of r.declarationList.declarations){if(i.initializer===void 0)continue;let o=i.initializer;if(Te.isIdentifier(i.name))Te.isArrowFunction(o)||Te.isFunctionExpression(o)?s(i.name.text,{kind:"local"}):sc(o)&&s(i.name.text,{kind:"module",specifier:rc(o)});else if(Te.isObjectBindingPattern(i.name)&&sc(o)){let a=rc(o);for(let d of i.name.elements){if(d.dotDotDotToken!==void 0||!Te.isIdentifier(d.name))continue;let l=d.propertyName??d.name;!Te.isIdentifier(l)&&!Te.isStringLiteralLike(l)||s(d.name.text,{kind:"named",specifier:a,imported:l.text})}}}return n}function sc(e){return Te.isCallExpression(e)&&Te.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&Te.isStringLiteralLike(e.arguments[0])}function rc(e){let n=e.arguments[0];return n!==void 0&&Te.isStringLiteralLike(n)?n.text:"\0"}function Ag(e){let n=e.expression;if(Te.isPropertyAccessExpression(n))return n.name.text;if(Te.isIdentifier(n))return n.text}function Ig(e,n,t,s,r,i){let o=e.expression,a=d=>{let l=`${d}${Wr}${n}`,c=i.get(l);if(c!==void 0||i.has(l))return c??null;let p=Cn(d,n,s,r),u=p===null?null:vg.resolve(p);return i.set(l,u),u};if(Te.isPropertyAccessExpression(o)&&Te.isIdentifier(o.expression)){let d=t.get(o.expression.text);if(d?.kind==="module"){let l=a(d.specifier);return l===null?null:{moduleReal:l,fnName:o.name.text}}return null}if(Te.isIdentifier(o)){let d=t.get(o.text);if(d?.kind==="named"){let l=a(d.specifier);return l===null?null:{moduleReal:l,fnName:d.imported}}return d?.kind==="local"?{moduleReal:n,fnName:o.text}:null}return null}function oc(e,n,t,s,r=new Map){if(n.length===0)return()=>null;let i=new Map,o=new Set;for(let d of n){let l=nc(d.definingModuleReal,d.fnName),c=i.get(l);c===void 0&&(c=new Set,i.set(l,c)),c.add(d.paramIndex),o.add(d.fnName)}let a=new Map;for(let d of e){let l=Ht(d.sf,d.real),c=Ng(d.sf),p=u=>{if(Te.isCallExpression(u)){let f=Ag(u);if(f!==void 0&&o.has(f)&&qr(u)){let h=Ig(u,d.real,c,t,s,r);if(h!==null){let g=i.get(nc(h.moduleReal,h.fnName));if(g!==void 0)for(let y of g){let _=u.arguments[y];if(_===void 0)continue;let b=vi(_,l);if(b.kind==="const"){let x=tc(h.moduleReal,h.fnName,y),k=a.get(x);k===void 0&&(k=new Set,a.set(x,k)),k.add(b.value)}}}}}Te.forEachChild(u,p)};p(d.sf)}return(d,l,c)=>{let p=a.get(tc(d,l,c));return p===void 0||p.size===0||p.size>Eg?null:[...p].sort()}}var an={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:M.ScriptTarget.ES2020,module:M.ModuleKind.CommonJS,moduleResolution:M.ModuleResolutionKind.Node10,types:[]},Gr=5e3;function mn(e,n){let t;try{t=Wt(n)}catch{t=ln.resolve(n)}let s=e.endsWith(ln.sep)?e:e+ln.sep;return t!==e&&!t.startsWith(s)?null:t===e?"":t.slice(s.length).split(ln.sep).join("/")}function Xe(e){let n=e;for(;;)if(M.isParenthesizedExpression(n))n=n.expression;else if(M.isBinaryExpression(n)&&n.operatorToken.kind===M.SyntaxKind.CommaToken)n=n.right;else return n}function yt(e){return M.isPropertyAccessExpression(e)?{receiver:Xe(e.expression),name:e.name.text}:M.isElementAccessExpression(e)&&M.isStringLiteralLike(e.argumentExpression)?{receiver:Xe(e.expression),name:e.argumentExpression.text}:null}function Qs(e){let n=Xe(e.expression);if(M.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===M.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=yt(n);if(t!==null){if(t.name==="require"&&M.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(M.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let s=e.arguments[1];return{specifierArg:s!==void 0&&M.isArrayLiteralExpression(s)?s.elements[0]:void 0}}}}return null}function ic(e){let n=[],t=s=>{if(M.isImportDeclaration(s)&&M.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.importClause?.isTypeOnly!==!0});else if(M.isImportEqualsDeclaration(s)&&M.isExternalModuleReference(s.moduleReference)&&M.isStringLiteralLike(s.moduleReference.expression))n.push({text:s.moduleReference.expression.text,runtime:!0});else if(M.isExportDeclaration(s)&&s.moduleSpecifier!==void 0&&M.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.isTypeOnly!==!0});else if(M.isCallExpression(s)){let r=Qs(s),i=r?.specifierArg;r!==null&&i!==void 0&&M.isStringLiteralLike(i)&&n.push({text:i.text,runtime:!0})}M.forEachChild(s,t)};return t(e),n}function Rg(e,n){let t=n===M.ScriptKind.TSX?"__scriptkind_probe.tsx":n===M.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",s=M.createSourceFile(t,e,M.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},i={getSourceFile:o=>o===t?s:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:o=>o,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:o=>o===t,readFile:o=>o===t?e:void 0};return M.createProgram({rootNames:[t],options:r,host:i}).getSyntacticDiagnostics(s).length}function Oi(e){return e.endsWith(".js")||e.endsWith(".jsx")}function ac(e){let n=0,t=s=>{(M.isCallExpression(s)||M.isNewExpression(s)||M.isTaggedTemplateExpression(s))&&(n+=1),M.forEachChild(s,t)};return t(e),n}function cc(e,n){let t=ic(M.createSourceFile(e,n,M.ScriptTarget.ES2020,!0));if(!Oi(e)||!n.includes("<")||!n.includes("require"))return t;let s=M.createSourceFile(e,n,M.ScriptTarget.ES2020,!0,M.ScriptKind.TSX),r=new Set(t.map(i=>`${i.runtime?"R":"T"}:${i.text}`));for(let i of ic(s)){let o=`${i.runtime?"R":"T"}:${i.text}`;r.has(o)||(r.add(o),t.push(i))}return t}function lc(e,n,t,s,r){if(!n.includes("require")&&!n.includes("import("))return[];let i=M.createSourceFile(e,n,M.ScriptTarget.ES2020,!0),o=Ht(i,e,r),a=[],d=new Set;return uc(i,l=>{for(let c of Hr(l,o,t,an,s))d.has(c)||(d.add(c),a.push(c))}),a}function uc(e,n){let t=s=>{if(M.isCallExpression(s)){let r=Qs(s),i=r?.specifierArg;r!==null&&i!==void 0&&!M.isStringLiteralLike(i)&&n(i)}M.forEachChild(s,t)};t(e)}function Og(e){let n=[];for(let t of e){let s=Ht(t.sf,t.real);uc(t.sf,r=>{let i=Ys(r,s);i!==null&&n.push({definingModuleReal:t.real,fnName:i.fnName,paramIndex:i.paramIndex})})}return n}var Pg=4,Ei=Gr,Ni=new Set(["eval","Function","createRequire"]),Cg=new Set(["require","eval","Function","createRequire"]),Yr=new Set(["module","Module","require","process","global","globalThis"]),Jr=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function Mg(e){return e===M.SyntaxKind.LessThanToken||e===M.SyntaxKind.GreaterThanToken||e===M.SyntaxKind.LessThanEqualsToken||e===M.SyntaxKind.GreaterThanEqualsToken||e===M.SyntaxKind.EqualsEqualsToken||e===M.SyntaxKind.EqualsEqualsEqualsToken||e===M.SyntaxKind.ExclamationEqualsToken||e===M.SyntaxKind.ExclamationEqualsEqualsToken||e===M.SyntaxKind.InstanceOfKeyword||e===M.SyntaxKind.InKeyword}function Tg(e){let n=e.parent;return(M.isParameter(n)||M.isVariableDeclaration(n)||M.isBindingElement(n)||M.isFunctionDeclaration(n)||M.isFunctionExpression(n)||M.isClassDeclaration(n)||M.isClassExpression(n)||M.isPropertyAssignment(n)||M.isPropertyDeclaration(n)||M.isMethodDeclaration(n))&&n.name===e?!0:M.isPropertyAccessExpression(n)&&n.name===e}function $g(e,n){return M.isCallExpression(n)&&n.expression===e||(M.isPropertyAccessExpression(n)||M.isElementAccessExpression(n))&&n.expression===e||M.isTypeOfExpression(n)||M.isVoidExpression(n)||M.isDeleteExpression(n)||M.isPrefixUnaryExpression(n)||M.isPostfixUnaryExpression(n)?!0:M.isBinaryExpression(n)&&Mg(n.operatorToken.kind)}function fc(e){let n=e,t=e.parent;for(;;)if(M.isParenthesizedExpression(t))n=t,t=t.parent;else if(M.isBinaryExpression(t)&&t.operatorToken.kind===M.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!$g(n,t)}function Lg(e){return Tg(e)?!1:fc(e)}function pc(e){let n=yt(e);if(n!==null&&Jr.has(n.name))return!0;if(M.isElementAccessExpression(e)&&!M.isStringLiteralLike(e.argumentExpression)){let t=Xe(e.expression);if(M.isIdentifier(t)&&Yr.has(t.text))return!0}return!1}function Js(e){let n=yt(e);if(n===null||n.name!=="constructor")return!1;let t=yt(n.receiver);return t!==null&&t.name==="constructor"}function mc(e){if(!M.isCallExpression(e))return!1;let n=Xe(e.expression);if(!M.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&M.isStringLiteralLike(t)&&t.text==="module"}var Dg={roots:new Map,nodes:new Set,saturated:!1};function hc(e){return M.isSourceFile(e)||M.isFunctionDeclaration(e)||M.isFunctionExpression(e)||M.isArrowFunction(e)||M.isMethodDeclaration(e)||M.isConstructorDeclaration(e)||M.isGetAccessorDeclaration(e)||M.isSetAccessorDeclaration(e)||M.isClassStaticBlockDeclaration(e)||M.isModuleDeclaration(e)}function gc(e,n){let t=e.parent;for(;t!==void 0;){if(hc(t))return t;t=t.parent}return n}function Fg(e){let n=new Set;if(M.isFunctionLike(e))for(let s of e.parameters)for(let r of Zs(s.name))n.add(r);let t=[e];for(;t.length>0;){let s=t.pop();if(s===void 0)break;if(!(s!==e&&hc(s))){if(M.isVariableDeclaration(s)&&M.isVariableDeclarationList(s.parent)&&!((s.parent.flags&M.NodeFlags.BlockScoped)!==0))for(let i of Zs(s.name))n.add(i);M.forEachChild(s,r=>{t.push(r)})}}return n}function jg(e,n,t){let s=gc(e,n);if(M.isSourceFile(s))return n;let r=t.get(s);return r===void 0&&(r=Fg(s),t.set(s,r)),r.has(e.text)?s:n}function Vr(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let s=n;for(;;){if(t.has(s))return!0;let r=s.parent;if(r===void 0)return!M.isSourceFile(s);s=r}}var Bg=12,Kg=8;function Xr(e,n){let t=Xe(e);for(;;){if(n.nodes.has(t))return!0;if(M.isIdentifier(t))return Yr.has(t.text)||Vr(n,t);if(M.isCallExpression(t))return mc(t);let s=yt(t);if(s!==null){if(s.name==="constructor")return!0;t=s.receiver;continue}if(M.isElementAccessExpression(t)){t=Xe(t.expression);continue}return!1}}function yc(e){let n=yt(Xe(e.expression));if(n===null||n.name!=="get"||!M.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function zg(e,n){let t=yc(e);if(t===null||!Xr(t.target,n))return!1;let s=t.key;return s===void 0||!M.isStringLiteralLike(s)?!0:Jr.has(s.text)}function Ai(e){if(!M.isFunctionExpression(e)&&!M.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,s=r=>{if(!(t||M.isFunctionExpression(r)||M.isFunctionDeclaration(r)||M.isClassLike(r))){if(M.isReturnStatement(r)&&r.expression!==void 0&&Xe(r.expression).kind===M.SyntaxKind.ThisKeyword){t=!0;return}M.forEachChild(r,s)}};return s(n),t}function Zs(e){if(M.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)M.isOmittedExpression(t)||n.push(...Zs(t.name));return n}function _c(e){return e.parameters.map(n=>Zs(n.name))}function Ug(e){let n=new Map,t=new Set,s=(i,o)=>{let a={fn:o,slots:_c(o)},d=n.get(i);d===void 0?n.set(i,[a]):d.push(a),Ai(o)&&t.add(i)},r=i=>{if(M.isFunctionDeclaration(i)&&i.name!==void 0)s(i.name.text,i);else if(M.isVariableDeclaration(i)&&M.isIdentifier(i.name)&&i.initializer!==void 0){let o=Xe(i.initializer);(M.isFunctionExpression(o)||M.isArrowFunction(o))&&s(i.name.text,o)}M.forEachChild(i,r)};return r(e),{params:n,thisReturning:t}}function qg(e){let n=new Map,t=new Set,s={roots:n,nodes:t},r=Ug(e),i=new Map,o=new Set(r.thisReturning),a=!0;for(let d=0;a;d+=1){if(d>=Bg)return{roots:n,nodes:t,saturated:!0};a=!1;let l=(g,y)=>{y!==""&&!g.has(y)&&(g.add(y),a=!0)},c=(g,y)=>{if(g==="")return;let _=n.get(g);_===void 0&&(_=new Set,n.set(g,_)),_.has(y)||(_.add(y),a=!0)},p=g=>{t.has(g)||(t.add(g),a=!0)},u=(g,y)=>{let _=Xe(g.expression);if(M.isIdentifier(_)&&Ni.has(_.text)||Js(_)||M.isCallExpression(g)&&mc(g)||Ai(_))return!0;let b=yt(_);if(b!==null&&(b.name==="call"||b.name==="apply"||b.name==="bind")){let x=b.receiver;if(Ai(x)||t.has(x)||M.isIdentifier(x)&&(Vr(s,x)||o.has(x.text)))return!0}if(t.has(_)||(M.isCallExpression(_)||M.isNewExpression(_))&&u(_,y+1)||M.isIdentifier(_)&&(Vr(s,_)||o.has(_.text)))return!0;if(M.isCallExpression(g)){let x=yc(g);if(x!==null&&Xr(x.target,s))return!0}return!1},f=(g,y)=>{if(y>=Kg)return!0;let _=Xe(g);if(t.has(_))return!0;if(M.isIdentifier(_))return Yr.has(_.text)||Vr(s,_);if(M.isBinaryExpression(_)){let b=_.operatorToken.kind;return b===M.SyntaxKind.BarBarToken||b===M.SyntaxKind.AmpersandAmpersandToken||b===M.SyntaxKind.QuestionQuestionToken?f(_.left,y+1)||f(_.right,y+1):!1}return M.isConditionalExpression(_)?f(_.whenTrue,y+1)||f(_.whenFalse,y+1):M.isPropertyAccessExpression(_)||M.isElementAccessExpression(_)?Xr(_,s):M.isCallExpression(_)||M.isNewExpression(_)?u(_,y+1):!1},h=(g,y)=>{if((M.isVariableDeclaration(g)||M.isParameter(g)||M.isBindingElement(g))&&g.initializer!==void 0){if(f(g.initializer,0)){let b=gc(g,e);for(let x of Zs(g.name))c(x,b)}}else if(M.isBinaryExpression(g)&&g.operatorToken.kind===M.SyntaxKind.EqualsToken&&M.isIdentifier(g.left)&&f(g.right,0))c(g.left.text,jg(g.left,e,i));else if(M.isReturnStatement(g)&&g.expression!==void 0&&y!==void 0&&f(g.expression,0))l(o,y);else if(M.isCallExpression(g)||M.isNewExpression(g)){u(g,0)&&p(g);let b=Xe(g.expression),x=yt(b),k=x!==null&&x.name==="call",w=x!==null&&x.name==="apply",I=k||w?x.receiver:b,N=k?1:0,v=[];M.isFunctionExpression(I)||M.isArrowFunction(I)?v.push({fn:I,slots:_c(I)}):M.isIdentifier(I)&&v.push(...r.params.get(I.text)??[]);let C=g.arguments??[];if(w){let R=C[1]===void 0?void 0:Xe(C[1]);for(let{fn:F,slots:P}of v)if(R!==void 0&&M.isArrayLiteralExpression(R))for(let U=0;U<R.elements.length;U+=1){let E=R.elements[U],T=P[U];if(!(E===void 0||T===void 0)&&f(E,0))for(let K of T)c(K,F)}else if(R!==void 0)for(let U of P)for(let E of U)c(E,F)}else for(let{fn:R,slots:F}of v)for(let P=N;P<C.length;P+=1){let U=C[P],E=F[P-N];if(!(U===void 0||E===void 0)&&f(U,0))for(let T of E)c(T,R)}}let _=y;if(M.isFunctionDeclaration(g))_=g.name?.text;else if(M.isFunctionExpression(g)||M.isArrowFunction(g)){let b=g.parent;_=M.isVariableDeclaration(b)&&M.isIdentifier(b.name)?b.name.text:void 0}M.forEachChild(g,b=>h(b,_))};h(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Hg(e){if(M.isIdentifier(e)&&Ni.has(e.text)||Js(e))return!0;let n=yt(e);if(n!==null&&(Jr.has(n.name)||(n.name==="call"||n.name==="apply")&&(M.isIdentifier(n.receiver)&&Ni.has(n.receiver.text)||Js(n.receiver)||(M.isPropertyAccessExpression(n.receiver)||M.isElementAccessExpression(n.receiver))&&pc(n.receiver))))return!0;if(M.isElementAccessExpression(e)&&!M.isStringLiteralLike(e.argumentExpression)){let t=Xe(e.expression);if(M.isIdentifier(t)&&Yr.has(t.text))return!0}return!1}var Wg=4;function dc(e,n){for(let t of e){if(!M.isStringLiteralLike(t)||n>=Wg)return!0;let s=M.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Ay=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
+                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Ny=5,Iy=6;function Ry(e){let n=e>=Iy?"a.details":"NULL AS details",t=e>=Ny?"ap.surface_complete":Ay;return`${vy}, ${n}, ${t}${Ey}`}var Oy="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",Py="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Cy="SELECT value FROM ingest_meta WHERE key = 'schema_version'",My=7,Ty="SELECT * FROM vulnerability_contract WHERE vulnerable_symbol_id = :id ORDER BY id",$y="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem",Ly=`SELECT DISTINCT package_name FROM affected_package
+  WHERE ecosystem = :eco AND package_name >= :lo AND package_name < :hi ORDER BY package_name`,Dy="SELECT value FROM ingest_meta WHERE key = 'population_mode'";function Xt(e,n=gr){let t=n.open(e,"readonly"),s=t.prepare(Cy).get(),o=s!==void 0?qe(s.value):"";if(_o(o,String(Number(ht)+1)))throw t.close(),new Error(`shard schema ${JSON.stringify(o)} is newer than this cupel understands (v${ht})`);let r=_o(o,yo),i=/^\d+$/u.test(o)?Number(o):0,a=t.prepare(Ry(i)),l=t.prepare(Oy),d=t.prepare(Py),c=t.prepare($y),p=t.prepare(Ly),u=t.prepare(Dy),f=i>=My?t.prepare(Ty):null;return{schemaVersion:o,ecosystems(){return c.all({}).map(m=>qe(m.ecosystem))},populationMode(){let m=u.get();return m===void 0?null:qe(m.value)},packageNamesUnder(m,h){if(h.length===0)return[];for(let S=0;S<h.length;S+=1){let b=h.charCodeAt(S);if(b<33||b>126)return[]}let y=h,_=h.slice(0,-1)+String.fromCharCode(h.charCodeAt(h.length-1)+1);return p.all({eco:m,lo:y,hi:_}).map(S=>qe(S.package_name))},advisoriesForPackage(m,h){return a.all({eco:m,name:h}).map(y=>({affected:{id:gt(y.ap_id)??0,advisoryId:qe(y.advisory_id),ecosystem:qe(y.ecosystem),packageName:qe(y.package_name),introduced:Je(y.introduced),fixed:Je(y.fixed),lastAffected:Je(y.last_affected),fixCommit:Je(y.fix_commit),repoUrl:Je(y.repo_url),surfaceComplete:gt(y.surface_complete)===1?1:0},advisory:{id:qe(y.a_id),osvId:Je(y.osv_id),cveId:Je(y.cve_id),summary:Je(y.summary),details:Je(y.details),severity:Je(y.severity),published:Je(y.published),source:qe(y.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(m){return l.all({id:m}).map(h=>{let y=qe(h.derivation);if(!r&&_r.has(y))throw new Error(`shard stamped schema ${o===""?"(none)":o} carries a ${y} row, which only a v${yo} shard may: its stamp is not the truth \u2014 refusing (ADR-108 D2)`);return{id:gt(h.id)??0,affectedPackageId:gt(h.affected_package_id)??0,exportName:Je(h.export_name),symbolKind:qe(h.symbol_kind),matchPattern:Je(h.match_pattern),matchGlobs:Je(h.match_globs),container:Je(h.container),sourcePath:Je(h.source_path),declStart:gt(h.decl_start),declEnd:gt(h.decl_end),astHashBefore:Je(h.ast_hash_before),astHashAfter:Je(h.ast_hash_after),derivation:y,confidence:qe(h.confidence),verified:gt(h.verified)===1?1:0}})},contractsForSymbol(m){if(f===null)return[];let h=[];for(let y of f.all({id:m})){let _=na(y);if(_===null||_.vulnerableSymbolId!==m)return"unreadable";h.push(_)}return h},aliasesForSymbol(m){return d.all({id:m}).map(h=>({id:gt(h.id)??0,vulnerableSymbolId:gt(h.vulnerable_symbol_id)??0,aliasPath:qe(h.alias_path),aliasName:qe(h.alias_name)}))},allModels(){let m;try{m=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let h=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return m.map(y=>{let _=gt(y.id)??0;return{packageName:qe(y.package_name),modelId:qe(y.evidence_ref),introduced:qe(y.introduced),fixedBefore:Je(y.fixed_before),evidenceRef:qe(y.evidence_ref),edges:h.all({id:_}).map(S=>({kind:qe(S.kind),anchorExport:qe(S.anchor_export),anchorContainer:Je(S.anchor_container),calleePackage:qe(S.callee_package),calleeContainer:Je(S.callee_container),calleeExport:qe(S.callee_export)}))}})},close(){t.close()}}}function br(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let f of e)if(f.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${f.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,s=new Map,o=new Map,r=new Map,i=1,a=(f,m,h,y)=>{let _=`${String(h)}:${String(y)}`,S=f.get(_);if(S!==void 0)return S;let b=i;i+=1,f.set(_,b);let k=e[h];if(k===void 0)throw new Error("unreachable: reader index out of range");return m.set(b,{reader:k,id:y}),b},l=e.map(f=>new Set(f.ecosystems?.()??[])),d=f=>{let m=e.map((h,y)=>y).filter(h=>l[h]?.has(f)===!0);return m.length>0?m:e.map((h,y)=>y).filter(h=>e[h]?.ecosystems===void 0)},c=(f,m)=>({...m,id:a(o,r,f,m.id),affectedPackageId:a(t,s,f,m.affectedPackageId)}),p=e.map((f,m)=>m),u=f=>{let m;for(let h of f){let y=e[h];if(y?.populationMode===void 0)continue;let _=y.populationMode();if(_!=="census")return _;m=_}return m};return{schemaVersion:n.schemaVersion,ecosystems(){let f=new Set;for(let m of l)for(let h of m)f.add(h);return[...f].sort()},populationMode(){return u(p)??null},populationModeFor(f){let m=d(f);return u(m.length>0?m:p)},packageNamesUnder(f,m){let h=new Set;for(let y of d(f))for(let _ of e[y]?.packageNamesUnder?.(f,m)??[])h.add(_);return[...h].sort()},advisoriesForPackage(f,m){let h=[];for(let y of d(f)){let _=e[y];if(_!==void 0)for(let S of _.advisoriesForPackage(f,m))h.push({...S,affected:{...S.affected,id:a(t,s,y,S.affected.id)}})}return h},symbolsForAffected(f){let m=s.get(f);if(m===void 0)return[];let h=e.indexOf(m.reader);return m.reader.symbolsForAffected(m.id).map(y=>c(h,y))},aliasesForSymbol(f){let m=r.get(f);if(m===void 0)return[];let h=e.indexOf(m.reader);return m.reader.aliasesForSymbol(m.id).map(y=>({...y,vulnerableSymbolId:a(o,r,h,y.vulnerableSymbolId)}))},contractsForSymbol(f){let m=r.get(f);if(m===void 0)return[];let h=m.reader.contractsForSymbol?.(m.id)??[];return h==="unreadable"?h:h.map(y=>({...y,vulnerableSymbolId:f}))},allModels(){return e.flatMap(f=>f.allModels?.()??[])},close(){for(let f of e)f.close()}}}import{realpathSync as Tt}from"node:fs";import Pn from"node:path";import{realpathSync as Qt}from"node:fs";import{isBuiltin as ya}from"node:module";import ln from"node:path";import C from"typescript";function ta(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function Ze(e){let n=ta(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Dn(e){let n=ta(e);if(n.startsWith("@")){let s=n.indexOf("/");if(s===-1)return n;let o=n.indexOf("/",s+1);return o===-1?n:n.slice(0,o)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Ac(e){let n=ta(e),t=Dn(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as zy,statSync as sa}from"node:fs";var Yt=16*1024*1024;function $s(e,n){try{let t=sa(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:zy(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function gn(e){let n=$s(e,Yt);return n.kind==="ok"?n.text:null}function yt(e){try{return sa(e).isFile()}catch{return!1}}function Nc(e){try{let n=sa(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Uy,realpathSync as ia}from"node:fs";import Ne from"node:path";import Sr from"typescript";var Tc=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Rn(e){return Tc.some(([n])=>e.endsWith(n))}function Wy(e){for(let[n,t]of Tc)if(e.endsWith(n)){let s=e.slice(0,-n.length);return t.map(o=>s+o)}return[]}var Hy=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function $c(e){if(Rn(e))return e;for(let[n,t]of Hy)if(e.endsWith(n)){let s=e.slice(0,-n.length);for(let o of t){let r=s+o;if(yt(r))return r}return e}return e}var aa=[Sr.ModuleKind.CommonJS,Sr.ModuleKind.ESNext],la=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function bo(e,n,t,s,o,r){let i=Sr.resolveModuleName(e,n,t,s,void 0,void 0,o).resolvedModule;if(i===void 0)return null;let a=i.resolvedFileName;if(r){for(let l of Wy(a))if(yt(l))return l}return a}var Lc=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],qy=[".js",".json",".node"],Vy=["index.js","index.json","index.node"];function xr(e){return!Rn(e)&&Lc.some(n=>e.endsWith(n))}function Dc(e){if(yt(e))return e;for(let n of qy)if(yt(e+n))return e+n;return null}function Ic(e){for(let n of Vy){let t=Ne.join(e,n);if(yt(t))return t}return null}var Fc=[".ts",".tsx",".cts",".mts",".jsx"];function Xy(e){for(let n of Fc)if(yt(e+n))return e+n;return null}function Yy(e){for(let n of Fc){let t=Ne.join(e,"index"+n);if(yt(t))return t}return null}function da(e){let n=gn(Ne.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let s=Ne.join(e,t),o=Dc(s)??Ic(s);if(o!==null)return o}}catch{}return Ic(e)}function jc(e){return Dc(e)??da(e)??Xy(e)??Yy(e)}function Bc(e){return jc(e)!==null}function Jy(e,n){let t=e.split(Ne.sep),s=n.split("/"),o=null;for(let i=t.length-s.length-1;i>=0;i-=1)if(t[i]==="node_modules"&&s.every((a,l)=>t[i+1+l]===a)){o=t.slice(0,i+1+s.length).join(Ne.sep);break}if(o===null||o==="")return null;let r=gn(Ne.join(o,"package.json"));if(r===null)return null;try{let i=JSON.parse(r),a=i.exports,l=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(i.name!==n||l)return null}catch{return null}try{return ia(o)}catch{return null}}function Zy(e,n){let t=jc(Ne.join(e,n));if(t===null)return null;let s;try{s=ia(t)}catch{return null}let o=e.endsWith(Ne.sep)?e:e+Ne.sep;return s!==e&&!s.startsWith(o)||Rn(s)||!Lc.some(r=>s.endsWith(r))?null:s}function Qy(e,n){let t=Ac(e);return t===""||t.includes("\0")||t.split("/").some(s=>s===""||s==="."||s===".."||s==="node_modules")?null:Zy(n,t)}var fs={kind:"nothing-loads"},Gc={kind:"absent"},oa=8192;function ra(e,n){let t=n.get(e);if(t!==void 0)return t;let s,o=null;try{o=Uy(e);let r=new Set,i=!1;for(;;){let a=o.readSync();if(a===null)break;if(r.size>=oa){i=!0;break}r.add(a.name)}s={names:r,truncated:i}}catch{s=null}finally{try{o?.closeSync()}catch{}}return n.set(e,s),s}var e_=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function ca(e){return e_.some(n=>e.length>n.length&&e.endsWith(n))}function Jt(e,n){let t=e.endsWith(Ne.sep)?e:e+Ne.sep;return n===e||n.startsWith(t)}function Rc(e,n){let t;try{t=ia(n)}catch{return{kind:"missing"}}return Jt(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Oc(e,n){let t=(n+".").toLowerCase(),s=[];for(let o of e){let r=o.toLowerCase();r.length>t.length&&r.startsWith(t)&&s.push(o)}return s}function n_(e,n,t){let s=Ne.dirname(n);if(!Jt(e,s))return null;let o=ra(s,t);if(o===null)return null;let r=Ne.basename(n);return o.names.has(r)?r:null}function Pc(e){return ca(e.split("/").pop()??"")?fs:Gc}function Cc(e,n){let t=e.filter(o=>!ca(o));if(t.length===0)return fs;let s=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${s}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Kc(e,n,t,s){let o=e,r=o.indexOf("?");r!==-1&&(o=o.slice(0,r));let i=o.indexOf("#");if(i!==-1&&(o=o.slice(0,i)),o===""||o.includes("\0"))return fs;let a=Ne.resolve(Ne.dirname(n),o);if(!Jt(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let l=Rc(t,a);if(l.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(l.kind==="ok"){let m=Nc(l.real);if(m==="file"){let S=n_(t,l.real,s);return S!==null&&ca(S)?fs:{kind:"unanalyzable",reason:S===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${S}") the analyzer cannot parse`,why:S===null?"probe-refused":"sibling-unparsable"}}if(m!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let h=ra(l.real,s);if(h===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let y=Oc(h.names,"index"),_=Cc(y,"a directory index");return _.kind==="unanalyzable"?_:h.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:h.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(oa)} entries and was not fully probed`,why:"probe-refused"}:y.length===0?Gc:fs}let d=Ne.basename(a);if(d===""||d==="."||d==="..")return fs;let c=Rc(t,Ne.dirname(a));if(c.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(c.kind==="missing")return Pc(o);let p=ra(c.real,s);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let u=Oc(p.names,d),f=Cc(u,"a sibling file exists");return f.kind==="unanalyzable"?f:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(oa)} entries and was not fully probed`,why:"probe-refused"}:u.length===0?Pc(o):fs}function ua(e,n){let t=Dn(e),s=Ne.dirname(n);for(let o=0;o<64;o+=1){let r=Ne.join(s,"node_modules",...t.split("/"));if(gn(Ne.join(r,"package.json"))!==null)return r;let i=Ne.dirname(s);if(i===s)return null;s=i}return null}function Mc(e,n,t,s,o){let r;for(let i of aa)for(let a of la){let l={...t,noDtsResolution:!0,customConditions:[...a]},d=bo(e,n,l,s,i,o);if(r===void 0)r=d;else if(r!==d)return null}return r??null}function Fn(e,n,t,s){let o=Ze(e);if(o==="relative")return bo(e,n,t,s,void 0,!0);if(o==="package-root"){let a=Mc(e,n,t,s,!0);if(a!==null)return a;let l=ua(e,n);if(l===null||gn(Ne.join(l,"package.json"))?.includes('"exports"')===!0)return null;let d=da(l);return d===null||Rn(d)?null:Jt(l,d)?d:null}let r=Mc(e,n,t,s,!1);if(r===null)return null;let i=Jy(r,Dn(e));return i!==null?Qy(e,i):Rn(r)?r:$c(r)}function zc(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function So(e,n,t,s){let o=Ze(e);if(o==="relative")return"no-candidate";if(zc(e))return"alias-unmapped";let r=new Set;for(let m of aa)for(let h of la){let y={...t,noDtsResolution:!0,customConditions:[...h]};r.add(bo(e,n,y,s,m,o==="package-root"))}if(r.size>1)return"divergent-exports";let i=ua(e,n);if(i===null)return"not-installed";let a=gn(Ne.join(i,"package.json"));if(a===null)return"unreadable-manifest";let l;try{l=JSON.parse(a)}catch{return"unreadable-manifest"}if(typeof l!="object"||l===null)return"unreadable-manifest";let d=l,c=d.exports!==void 0&&d.exports!==null,p=typeof d.typesVersions=="object"&&d.typesVersions!==null,[u]=r;if(u!=null)return Jt(i,u)?!c&&p?"types-versions-remap":Rn(u)?"declaration-only":"no-candidate":"out-of-root";let f=bo(e,n,t,s,void 0,!1);if(f!==null&&Rn(f))return!c&&p?"types-versions-remap":"declaration-only";if(o==="package-root"&&!c){let m=da(i);if(m!==null&&!Jt(i,m))return"out-of-root"}return"no-candidate"}function Ls(e,n,t,s){let o=Fn(e,n,t,s);if(o!==null)return[o];let r=Ze(e);if(r==="relative")return[];let i=new Set;for(let d of aa)for(let c of la){let p={...t,noDtsResolution:!0,customConditions:[...c]};i.add(bo(e,n,p,s,d,r==="package-root"))}if(i.size<2||i.has(null))return[];let a=ua(e,n);if(a===null)return[];let l=[];for(let d of i){if(d===null)return[];let c=$c(d);if(Rn(c)||!Jt(a,c))return[];l.push(c)}return[...new Set(l)].sort()}function Uc(e,n){let t=Ne.dirname(e);for(let s=0;s<64;s+=1){let o=gn(Ne.join(t,"package.json"));if(o!==null){try{let i=JSON.parse(o);if(typeof i!="object"||i===null)return!1;let a=i.optionalDependencies;if(typeof a=="object"&&a!==null&&n in a)return!0;let l=i.peerDependenciesMeta;if(typeof l=="object"&&l!==null){let d=l[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let r=Ne.dirname(t);if(r===t)return!1;t=r}return!1}function Wc(e,n,t){let s=gn(Ne.join(e,"tsconfig.json"));if(s===null)return()=>null;let o=Sr.parseConfigFileTextToJson(Ne.join(e,"tsconfig.json"),s);if(o.error!==void 0)return()=>null;let r=o.config?.compilerOptions;if(typeof r!="object"||r===null)return()=>null;let i=r.paths;if(typeof i!="object"||i===null)return()=>null;let a=r.baseUrl,l=typeof a=="string"?Ne.resolve(e,a):e,d=new Map,c=[];for(let[u,f]of Object.entries(i)){if(!Array.isArray(f))continue;let m=f.filter(y=>typeof y=="string");if(m.length===0)continue;let h=u.indexOf("*");h===-1?d.set(u,m):u.indexOf("*",h+1)===-1&&c.push({prefix:u.slice(0,h),suffix:u.slice(h+1),targets:m})}if(c.sort((u,f)=>f.prefix.length-u.prefix.length),d.size===0&&c.length===0)return()=>null;let p=u=>{let f=d.get(u);if(f!==void 0)return f;for(let m of c){if(u.length<m.prefix.length+m.suffix.length||!u.startsWith(m.prefix)||!u.endsWith(m.suffix))continue;let h=u.slice(m.prefix.length,u.length-m.suffix.length);return m.targets.map(y=>{let _=y.indexOf("*");return _===-1?y:y.slice(0,_)+h+y.slice(_+1)})}return[]};return(u,f)=>{let m=p(u);if(m.length===0||Fn(u,f,n,t)!==null)return null;for(let h of m){let y=Ne.resolve(l,h),_=Ne.relative(Ne.dirname(f),y).split(Ne.sep).join("/");if(_==="")continue;_.startsWith(".")||(_=`./${_}`);let S=Fn(_,f,n,t);if(S!==null&&Jt(e,S))return S}return null}}import{readdirSync as t_,realpathSync as s_}from"node:fs";import Ot from"node:path";import ce from"typescript";function xo(e,n){if(ce.isIdentifier(e))n.add(e.text);else for(let t of e.elements)ce.isBindingElement(t)&&xo(t.name,n)}function Ds(e){let n=new Map,t=new Set,s=l=>{n.set(l,(n.get(l)??0)+1)},o=l=>{let d=rn(l);if(ce.isIdentifier(d))t.add(d.text);else if(ce.isArrayLiteralExpression(d))for(let c of d.elements)o(c);else if(ce.isObjectLiteralExpression(d))for(let c of d.properties)ce.isShorthandPropertyAssignment(c)?t.add(c.name.text):ce.isPropertyAssignment(c)?o(c.initializer):ce.isSpreadAssignment(c)&&o(c.expression);else ce.isSpreadElement(d)?o(d.expression):ce.isBinaryExpression(d)&&d.operatorToken.kind===ce.SyntaxKind.EqualsToken&&o(d.left)},r=l=>{let d=new Set;xo(l,d);for(let c of d)s(c)},i=l=>{ce.isVariableDeclaration(l)?r(l.name):ce.isFunctionDeclaration(l)&&l.name!==void 0||ce.isClassDeclaration(l)&&l.name!==void 0?s(l.name.text):ce.isParameter(l)?r(l.name):((ce.isFunctionExpression(l)||ce.isClassExpression(l))&&l.name!==void 0&&ce.isIdentifier(l.name)&&!(l.parent!==void 0&&ce.isVariableDeclaration(l.parent)&&l.parent.initializer===l&&ce.isIdentifier(l.parent.name)&&l.parent.name.text===l.name.text)||ce.isImportClause(l)&&l.name!==void 0||ce.isNamespaceImport(l)||ce.isImportSpecifier(l)||ce.isImportEqualsDeclaration(l))&&s(l.name.text),ce.isBinaryExpression(l)&&l.operatorToken.kind>=ce.SyntaxKind.FirstAssignment&&l.operatorToken.kind<=ce.SyntaxKind.LastAssignment?o(l.left):(ce.isPrefixUnaryExpression(l)||ce.isPostfixUnaryExpression(l))&&(l.operator===ce.SyntaxKind.PlusPlusToken||l.operator===ce.SyntaxKind.MinusMinusToken)?o(l.operand):(ce.isForOfStatement(l)||ce.isForInStatement(l))&&!ce.isVariableDeclarationList(l.initializer)&&o(l.initializer),ce.forEachChild(l,i)};i(e);let a=new Set(t);for(let[l,d]of n)d>1&&a.add(l);return a}function ps(e,n,t){let s=Ds(e),o=new Map,r=i=>{ce.isVariableDeclaration(i)&&ce.isIdentifier(i.name)&&i.initializer!==void 0&&!s.has(i.name.text)&&!o.has(i.name.text)&&o.set(i.name.text,i.initializer),ce.forEachChild(i,r)};return r(e),{containingFile:n,taintedNames:s,constBindings:o,resolveParamDirs:t}}var o_=1024,r_=32,i_=new Set(["filter","sort","slice","reverse"]),a_=new Set(["forEach","map","filter","flatMap","find","some","every"]);function rn(e){let n=e;for(;ce.isParenthesizedExpression(n);)n=n.expression;return n}function Hc(e,n){return ce.isPropertyAccessExpression(e)&&ce.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function Zt(e,n,t,s){if(t>r_)return null;let o=rn(e);if(ce.isStringLiteralLike(o))return o.text;if(ce.isTemplateExpression(o)){let r=o.head.text;for(let i of o.templateSpans){let a=Zt(i.expression,n,t+1,s);if(a===null)return null;r+=a+i.literal.text}return r}if(ce.isBinaryExpression(o)&&o.operatorToken.kind===ce.SyntaxKind.PlusToken){let r=Zt(o.left,n,t+1,s);if(r===null)return null;let i=Zt(o.right,n,t+1,s);return i===null?null:r+i}if(ce.isIdentifier(o)){if(o.text==="__dirname")return Ot.dirname(n.containingFile);if(o.text==="__filename")return n.containingFile;if(n.taintedNames.has(o.text)||s.has(o.text))return null;let r=n.constBindings.get(o.text);if(r===void 0)return null;s.add(o.text);let i=Zt(r,n,t+1,s);return s.delete(o.text),i}if(ce.isCallExpression(o)){let r=Hc(o.expression,"join"),i=Hc(o.expression,"resolve");if(!r&&!i)return null;let a=[];for(let d of o.arguments){let c=Zt(d,n,t+1,s);if(c===null)return null;a.push(c)}let l=a[0];return l===void 0||i&&!Ot.isAbsolute(l)?null:i?Ot.resolve(...a):Ot.join(...a)}return null}function kr(e){let n=rn(e);if(ce.isBinaryExpression(n)&&n.operatorToken.kind===ce.SyntaxKind.PlusToken)return[...kr(n.left),...kr(n.right)];if(ce.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let s of n.templateSpans)t.push({expr:s.expression}),s.literal.text.length>0&&t.push({lit:s.literal.text});return t}return ce.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Xc(e){let n=e,t=0;for(;t++<4096;){let s=n.parent;if(s===void 0)return null;if(ce.isForOfStatement(s)&&s.statement===n){let o=s.initializer;if(ce.isVariableDeclarationList(o)&&o.declarations.length===1&&o.declarations[0]!==void 0&&ce.isIdentifier(o.declarations[0].name)&&o.declarations[0].name.text===e.text){let r=qc(s.expression);if(r!==null)return r}}if((ce.isArrowFunction(n)||ce.isFunctionExpression(n))&&ce.isCallExpression(s)&&s.arguments.length>0&&s.arguments[0]===n&&ce.isPropertyAccessExpression(s.expression)&&a_.has(s.expression.name.text)){let o=n.parameters[0];if(o!==void 0&&ce.isIdentifier(o.name)&&o.name.text===e.text){let r=qc(s.expression.expression);if(r!==null)return r}}n=s}return null}function qc(e){let n=rn(e),t=0;for(;ce.isCallExpression(n)&&t++<16;){let s=n.expression;if(ce.isPropertyAccessExpression(s)){let o=s.name.text;if(o==="readdirSync")return n.arguments[0]??null;if(i_.has(o)){n=rn(s.expression);continue}return null}return ce.isIdentifier(s)&&s.text==="readdirSync"?n.arguments[0]??null:null}return null}function l_(e,n){let t=kr(e);if(t.length<2)return null;let s=t[t.length-1];if(s===void 0||!("expr"in s)||!ce.isIdentifier(s.expr))return null;let o=s.expr;if(n.taintedNames.has(o.text))return null;let r="";for(let d=0;d<t.length-1;d+=1){let c=t[d];if(c===void 0)return null;if("lit"in c)r+=c.lit;else{let p=Zt(c.expr,n,0,new Set);if(p===null)return null;r+=p}}let i=Xc(o),a=i===null?null:Zt(i,n,0,new Set);if(a===null)return null;let l=Ot.resolve(r);return l!==Ot.resolve(a)?null:l}function d_(e){if((ce.isFunctionDeclaration(e)||ce.isFunctionExpression(e))&&e.name!==void 0&&ce.isIdentifier(e.name)||ce.isMethodDeclaration(e)&&ce.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&ce.isVariableDeclaration(n)&&ce.isIdentifier(n.name)?n.name.text:null}function c_(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!ce.isFunctionLike(t))continue;let s=-1;for(let r=0;r<t.parameters.length;r+=1){let i=t.parameters[r];if(i!==void 0&&ce.isIdentifier(i.name)&&i.name.text===n){s=r;break}}if(s<0)continue;let o=d_(t);return o===null?null:{fnName:o,paramIndex:s}}return null}function ko(e,n){let t=kr(e);if(t.length!==2)return null;let[s,o]=t;if(s===void 0||!("expr"in s)||!ce.isIdentifier(s.expr)||o===void 0||!("expr"in o)||!ce.isIdentifier(o.expr))return null;let r=s.expr,i=o.expr;if(n.taintedNames.has(r.text)||n.taintedNames.has(i.text))return null;let a=Xc(i);return a===null||!ce.isIdentifier(a)||a.text!==r.text?null:c_(r,r.text)}function u_(e,n){if(n.resolveParamDirs===void 0)return null;let t=ko(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function wr(e){for(let n=e.parent;n!==void 0;n=n.parent){if(ce.isSourceFile(n))return!0;if(!ce.isArrowFunction(n)&&ce.isFunctionLike(n))return!1}return!0}function fa(e,n){let t=Zt(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let s=l_(e,n);if(s!==null)return{kind:"dir",dir:s};let o=u_(e,n);return o!==null&&o.length>0?{kind:"dirs",dirs:[...o]}:{kind:"opaque"}}function Yc(e,n){let t;try{t=s_(e)}catch{return null}let s=n.endsWith(Ot.sep)?n:n+Ot.sep;return t===n||t.startsWith(s)?t:null}function Jc(e,n,t,s,o){let r=Fn(e,n,s,o);return r===null||Rn(r)||!xr(r)?null:Yc(r,t)}function Vc(e,n,t,s,o){let r=Yc(e,t);if(r===null)return[];let i;try{i=t_(r)}catch{return[]}if(i.length===0||i.length>o_)return[];i.sort();let a=new Set,l=[];for(let d of i){let c=Jc(Ot.join(r,d),n,t,s,o);c!==null&&!a.has(c)&&(a.add(c),l.push(c))}return l}function vr(e,n,t,s,o){let r=fa(e,n);if(r.kind==="const"){if(Ze(r.value)==="package-root")return[];let i=Jc(r.value,n.containingFile,t,s,o);return i===null?[]:[i]}if(r.kind==="dir")return Vc(r.dir,n.containingFile,t,s,o);if(r.kind==="dirs"){let i=new Set,a=[];for(let l of r.dirs)for(let d of Vc(l,n.containingFile,t,s,o))i.has(d)||(i.add(d),a.push(d));return a}return[]}import f_ from"node:path";import De from"typescript";var p_=32,Er="\0",Zc=(e,n)=>`${e}${Er}${n}`,Qc=(e,n,t)=>`${e}${Er}${n}${Er}${String(t)}`;function m_(e){let n=new Map,t=new Set,s=(o,r)=>{if(t.has(o)){n.delete(o);return}t.add(o),n.set(o,r)};for(let o of e.statements)if(De.isImportDeclaration(o)&&De.isStringLiteralLike(o.moduleSpecifier)){let r=o.moduleSpecifier.text,i=o.importClause;if(i===void 0)continue;i.name!==void 0&&s(i.name.text,{kind:"module",specifier:r});let a=i.namedBindings;if(a!==void 0&&De.isNamespaceImport(a))s(a.name.text,{kind:"module",specifier:r});else if(a!==void 0&&De.isNamedImports(a))for(let l of a.elements)s(l.name.text,{kind:"named",specifier:r,imported:(l.propertyName??l.name).text})}else if(De.isImportEqualsDeclaration(o)&&De.isExternalModuleReference(o.moduleReference)&&De.isStringLiteralLike(o.moduleReference.expression))s(o.name.text,{kind:"module",specifier:o.moduleReference.expression.text});else if(De.isFunctionDeclaration(o)&&o.name!==void 0)s(o.name.text,{kind:"local"});else if(De.isVariableStatement(o))for(let r of o.declarationList.declarations){if(r.initializer===void 0)continue;let i=r.initializer;if(De.isIdentifier(r.name))De.isArrowFunction(i)||De.isFunctionExpression(i)?s(r.name.text,{kind:"local"}):eu(i)&&s(r.name.text,{kind:"module",specifier:nu(i)});else if(De.isObjectBindingPattern(r.name)&&eu(i)){let a=nu(i);for(let l of r.name.elements){if(l.dotDotDotToken!==void 0||!De.isIdentifier(l.name))continue;let d=l.propertyName??l.name;!De.isIdentifier(d)&&!De.isStringLiteralLike(d)||s(l.name.text,{kind:"named",specifier:a,imported:d.text})}}}return n}function eu(e){return De.isCallExpression(e)&&De.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&De.isStringLiteralLike(e.arguments[0])}function nu(e){let n=e.arguments[0];return n!==void 0&&De.isStringLiteralLike(n)?n.text:"\0"}function h_(e){let n=e.expression;if(De.isPropertyAccessExpression(n))return n.name.text;if(De.isIdentifier(n))return n.text}function g_(e,n,t,s,o,r){let i=e.expression,a=l=>{let d=`${l}${Er}${n}`,c=r.get(d);if(c!==void 0||r.has(d))return c??null;let p=Fn(l,n,s,o),u=p===null?null:f_.resolve(p);return r.set(d,u),u};if(De.isPropertyAccessExpression(i)&&De.isIdentifier(i.expression)){let l=t.get(i.expression.text);if(l?.kind==="module"){let d=a(l.specifier);return d===null?null:{moduleReal:d,fnName:i.name.text}}return null}if(De.isIdentifier(i)){let l=t.get(i.text);if(l?.kind==="named"){let d=a(l.specifier);return d===null?null:{moduleReal:d,fnName:l.imported}}return l?.kind==="local"?{moduleReal:n,fnName:i.text}:null}return null}function tu(e,n,t,s,o=new Map){if(n.length===0)return()=>null;let r=new Map,i=new Set;for(let l of n){let d=Zc(l.definingModuleReal,l.fnName),c=r.get(d);c===void 0&&(c=new Set,r.set(d,c)),c.add(l.paramIndex),i.add(l.fnName)}let a=new Map;for(let l of e){let d=ps(l.sf,l.real),c=m_(l.sf),p=u=>{if(De.isCallExpression(u)){let f=h_(u);if(f!==void 0&&i.has(f)&&wr(u)){let m=g_(u,l.real,c,t,s,o);if(m!==null){let h=r.get(Zc(m.moduleReal,m.fnName));if(h!==void 0)for(let y of h){let _=u.arguments[y];if(_===void 0)continue;let S=fa(_,d);if(S.kind==="const"){let b=Qc(m.moduleReal,m.fnName,y),k=a.get(b);k===void 0&&(k=new Set,a.set(b,k)),k.add(S.value)}}}}}De.forEachChild(u,p)};p(l.sf)}return(l,d,c)=>{let p=a.get(Qc(l,d,c));return p===void 0||p.size===0||p.size>p_?null:[...p].sort()}}var un={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:C.ScriptTarget.ES2020,module:C.ModuleKind.CommonJS,moduleResolution:C.ModuleResolutionKind.Node10,types:[]},Ar=5e3;function fn(e,n){let t;try{t=Qt(n)}catch{t=ln.resolve(n)}let s=e.endsWith(ln.sep)?e:e+ln.sep;return t!==e&&!t.startsWith(s)?null:t===e?"":t.slice(s.length).split(ln.sep).join("/")}function y_(e,n){let t=fn(e,n);return t!==null&&!t.split("/").includes("node_modules")}function __(e,n){if(C.isFunctionLike(e))return n!==e.name&&!C.isDecorator(n)&&!b_(e);if(C.isPropertyDeclaration(e))return n===e.initializer&&(C.getCombinedModifierFlags(e)&C.ModifierFlags.Static)===0;if(C.isTryStatement(e))return n===e.catchClause||n===e.tryBlock&&e.catchClause!==void 0;if(C.isIfStatement(e))return n!==e.expression;if(C.isConditionalExpression(e))return n!==e.condition;if(C.isCaseClause(e))return n!==e.expression;if(C.isDefaultClause(e))return!0;if(C.isBinaryExpression(e)){let t=e.operatorToken.kind;return n===e.right&&(t===C.SyntaxKind.AmpersandAmpersandToken||t===C.SyntaxKind.BarBarToken||t===C.SyntaxKind.QuestionQuestionToken||t===C.SyntaxKind.AmpersandAmpersandEqualsToken||t===C.SyntaxKind.BarBarEqualsToken||t===C.SyntaxKind.QuestionQuestionEqualsToken)}return C.isForStatement(e)?n===e.statement||n===e.incrementor:C.isForInStatement(e)||C.isForOfStatement(e)||C.isWhileStatement(e)?n===e.statement:C.isBindingElement(e)?n===e.initializer:C.isShorthandPropertyAssignment(e)?n===e.objectAssignmentInitializer:C.isCallExpression(e)&&C.isOptionalChain(e)?e.arguments.some(t=>t===n):C.isElementAccessExpression(e)&&C.isOptionalChain(e)?n===e.argumentExpression:!1}function b_(e){if(!C.isFunctionExpression(e)&&!C.isArrowFunction(e)||C.isFunctionExpression(e)&&e.asteriskToken!==void 0)return!1;let n=e;for(;C.isParenthesizedExpression(n.parent);)n=n.parent;let t=n.parent;return(C.isCallExpression(t)||C.isNewExpression(t))&&t.expression===n?!0:C.isPropertyAccessExpression(t)&&t.expression===n&&(t.name.text==="call"||t.name.text==="apply")&&C.isCallExpression(t.parent)&&t.parent.expression===t}function Ve(e){let n=e;for(;;)if(C.isParenthesizedExpression(n))n=n.expression;else if(C.isBinaryExpression(n)&&n.operatorToken.kind===C.SyntaxKind.CommaToken)n=n.right;else return n}function Pt(e){return C.isPropertyAccessExpression(e)?{receiver:Ve(e.expression),name:e.name.text}:C.isElementAccessExpression(e)&&C.isStringLiteralLike(e.argumentExpression)?{receiver:Ve(e.expression),name:e.argumentExpression.text}:null}function Eo(e){let n=Ve(e.expression);if(C.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===C.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=Pt(n);if(t!==null){if(t.name==="require"&&C.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(C.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let s=e.arguments[1];return{specifierArg:s!==void 0&&C.isArrayLiteralExpression(s)?s.elements[0]:void 0}}}}return null}function su(e){let n=[],t=(s,o)=>{if(C.isImportDeclaration(s)&&C.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.importClause?.isTypeOnly!==!0,unguarded:!o&&C.isSourceFile(s.parent)});else if(C.isImportEqualsDeclaration(s)&&C.isExternalModuleReference(s.moduleReference)&&C.isStringLiteralLike(s.moduleReference.expression))n.push({text:s.moduleReference.expression.text,runtime:!0,unguarded:!o&&C.isSourceFile(s.parent)});else if(C.isExportDeclaration(s)&&s.moduleSpecifier!==void 0&&C.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.isTypeOnly!==!0,unguarded:!o&&C.isSourceFile(s.parent)});else if(C.isCallExpression(s)){let r=Eo(s),i=r?.specifierArg;if(r!==null&&i!==void 0&&C.isStringLiteralLike(i)){let a=Ve(s.expression).kind===C.SyntaxKind.ImportKeyword;n.push({text:i.text,runtime:!0,unguarded:!o&&(!a||S_(s))})}}C.forEachChild(s,r=>{t(r,o||__(s,r))})};return t(e,!1),n}function S_(e){let n=e;for(;C.isParenthesizedExpression(n.parent);)n=n.parent;return C.isAwaitExpression(n.parent)}function x_(e,n){let t=n===C.ScriptKind.TSX?"__scriptkind_probe.tsx":n===C.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",s=C.createSourceFile(t,e,C.ScriptTarget.ES2020,!0,n),o={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},r={getSourceFile:i=>i===t?s:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:i=>i,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:i=>i===t,readFile:i=>i===t?e:void 0};return C.createProgram({rootNames:[t],options:o,host:r}).getSyntacticDiagnostics(s).length}function _a(e){return e.endsWith(".js")||e.endsWith(".jsx")}function k_(e){return ln.extname(e)===""}function w_(e){if(!e.startsWith("#!"))return"none";let n=e.indexOf(`
+`),t=(n===-1?e:e.slice(0,n)).slice(0,512);return/(?:^|[\s/])node(?:\s|$)/u.test(t)?"node":"other"}function ou(e){let n=0,t=s=>{(C.isCallExpression(s)||C.isNewExpression(s)||C.isTaggedTemplateExpression(s))&&(n+=1),C.forEachChild(s,t)};return t(e),n}function au(e,n){let t=su(C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0));if(!_a(e)||!n.includes("<")||!n.includes("require"))return t;let s=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX),o=i=>`${i.runtime?"R":"T"}${i.unguarded?"U":"G"}:${i.text}`,r=new Set(t.map(o));for(let i of su(s)){let a=o(i);r.has(a)||(r.add(a),t.push(i))}return t}function ru(e,n,t,s,o){if(!n.includes("require")&&!n.includes("import("))return[];let r=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0),i=ps(r,e,o),a=[],l=new Set;return lu(r,d=>{for(let c of vr(d,i,t,un,s))l.has(c)||(l.add(c),a.push(c))}),a}function lu(e,n){let t=s=>{if(C.isCallExpression(s)){let o=Eo(s),r=o?.specifierArg;o!==null&&r!==void 0&&!C.isStringLiteralLike(r)&&n(r)}C.forEachChild(s,t)};t(e)}function v_(e){let n=[];for(let t of e){let s=ps(t.sf,t.real);lu(t.sf,o=>{let r=ko(o,s);r!==null&&n.push({definingModuleReal:t.real,fnName:r.fnName,paramIndex:r.paramIndex})})}return n}var E_=4,pa=Ar,ma=new Set(["eval","Function","createRequire"]),A_=new Set(["require","eval","Function","createRequire"]),Rr=new Set(["module","Module","require","process","global","globalThis"]),Or=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function N_(e){return e===C.SyntaxKind.LessThanToken||e===C.SyntaxKind.GreaterThanToken||e===C.SyntaxKind.LessThanEqualsToken||e===C.SyntaxKind.GreaterThanEqualsToken||e===C.SyntaxKind.EqualsEqualsToken||e===C.SyntaxKind.EqualsEqualsEqualsToken||e===C.SyntaxKind.ExclamationEqualsToken||e===C.SyntaxKind.ExclamationEqualsEqualsToken||e===C.SyntaxKind.InstanceOfKeyword||e===C.SyntaxKind.InKeyword}function I_(e){let n=e.parent;return(C.isParameter(n)||C.isVariableDeclaration(n)||C.isBindingElement(n)||C.isFunctionDeclaration(n)||C.isFunctionExpression(n)||C.isClassDeclaration(n)||C.isClassExpression(n)||C.isPropertyAssignment(n)||C.isPropertyDeclaration(n)||C.isMethodDeclaration(n))&&n.name===e?!0:C.isPropertyAccessExpression(n)&&n.name===e}function R_(e,n){return C.isCallExpression(n)&&n.expression===e||(C.isPropertyAccessExpression(n)||C.isElementAccessExpression(n))&&n.expression===e||C.isTypeOfExpression(n)||C.isVoidExpression(n)||C.isDeleteExpression(n)||C.isPrefixUnaryExpression(n)||C.isPostfixUnaryExpression(n)?!0:C.isBinaryExpression(n)&&N_(n.operatorToken.kind)}function du(e){let n=e,t=e.parent;for(;;)if(C.isParenthesizedExpression(t))n=t,t=t.parent;else if(C.isBinaryExpression(t)&&t.operatorToken.kind===C.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!R_(n,t)}function O_(e){return I_(e)?!1:du(e)}function cu(e){let n=Pt(e);if(n!==null&&Or.has(n.name))return!0;if(C.isElementAccessExpression(e)&&!C.isStringLiteralLike(e.argumentExpression)){let t=Ve(e.expression);if(C.isIdentifier(t)&&Rr.has(t.text))return!0}return!1}function wo(e){let n=Pt(e);if(n===null||n.name!=="constructor")return!1;let t=Pt(n.receiver);return t!==null&&t.name==="constructor"}function uu(e){if(!C.isCallExpression(e))return!1;let n=Ve(e.expression);if(!C.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&C.isStringLiteralLike(t)&&t.text==="module"}var P_={roots:new Map,nodes:new Set,saturated:!1};function fu(e){return C.isSourceFile(e)||C.isFunctionDeclaration(e)||C.isFunctionExpression(e)||C.isArrowFunction(e)||C.isMethodDeclaration(e)||C.isConstructorDeclaration(e)||C.isGetAccessorDeclaration(e)||C.isSetAccessorDeclaration(e)||C.isClassStaticBlockDeclaration(e)||C.isModuleDeclaration(e)}function pu(e,n){let t=e.parent;for(;t!==void 0;){if(fu(t))return t;t=t.parent}return n}function C_(e){let n=new Set;if(C.isFunctionLike(e))for(let s of e.parameters)for(let o of vo(s.name))n.add(o);let t=[e];for(;t.length>0;){let s=t.pop();if(s===void 0)break;if(!(s!==e&&fu(s))){if(C.isVariableDeclaration(s)&&C.isVariableDeclarationList(s.parent)&&!((s.parent.flags&C.NodeFlags.BlockScoped)!==0))for(let r of vo(s.name))n.add(r);C.forEachChild(s,o=>{t.push(o)})}}return n}function M_(e,n,t){let s=pu(e,n);if(C.isSourceFile(s))return n;let o=t.get(s);return o===void 0&&(o=C_(s),t.set(s,o)),o.has(e.text)?s:n}function Nr(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let s=n;for(;;){if(t.has(s))return!0;let o=s.parent;if(o===void 0)return!C.isSourceFile(s);s=o}}var T_=12,$_=8;function Ir(e,n){let t=Ve(e);for(;;){if(n.nodes.has(t))return!0;if(C.isIdentifier(t))return Rr.has(t.text)||Nr(n,t);if(C.isCallExpression(t))return uu(t);let s=Pt(t);if(s!==null){if(s.name==="constructor")return!0;t=s.receiver;continue}if(C.isElementAccessExpression(t)){t=Ve(t.expression);continue}return!1}}function mu(e){let n=Pt(Ve(e.expression));if(n===null||n.name!=="get"||!C.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function L_(e,n){let t=mu(e);if(t===null||!Ir(t.target,n))return!1;let s=t.key;return s===void 0||!C.isStringLiteralLike(s)?!0:Or.has(s.text)}function ha(e){if(!C.isFunctionExpression(e)&&!C.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,s=o=>{if(!(t||C.isFunctionExpression(o)||C.isFunctionDeclaration(o)||C.isClassLike(o))){if(C.isReturnStatement(o)&&o.expression!==void 0&&Ve(o.expression).kind===C.SyntaxKind.ThisKeyword){t=!0;return}C.forEachChild(o,s)}};return s(n),t}function vo(e){if(C.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)C.isOmittedExpression(t)||n.push(...vo(t.name));return n}function hu(e){return e.parameters.map(n=>vo(n.name))}function D_(e){let n=new Map,t=new Set,s=(r,i)=>{let a={fn:i,slots:hu(i)},l=n.get(r);l===void 0?n.set(r,[a]):l.push(a),ha(i)&&t.add(r)},o=r=>{if(C.isFunctionDeclaration(r)&&r.name!==void 0)s(r.name.text,r);else if(C.isVariableDeclaration(r)&&C.isIdentifier(r.name)&&r.initializer!==void 0){let i=Ve(r.initializer);(C.isFunctionExpression(i)||C.isArrowFunction(i))&&s(r.name.text,i)}C.forEachChild(r,o)};return o(e),{params:n,thisReturning:t}}function F_(e){let n=new Map,t=new Set,s={roots:n,nodes:t},o=D_(e),r=new Map,i=new Set(o.thisReturning),a=!0;for(let l=0;a;l+=1){if(l>=T_)return{roots:n,nodes:t,saturated:!0};a=!1;let d=(h,y)=>{y!==""&&!h.has(y)&&(h.add(y),a=!0)},c=(h,y)=>{if(h==="")return;let _=n.get(h);_===void 0&&(_=new Set,n.set(h,_)),_.has(y)||(_.add(y),a=!0)},p=h=>{t.has(h)||(t.add(h),a=!0)},u=(h,y)=>{let _=Ve(h.expression);if(C.isIdentifier(_)&&ma.has(_.text)||wo(_)||C.isCallExpression(h)&&uu(h)||ha(_))return!0;let S=Pt(_);if(S!==null&&(S.name==="call"||S.name==="apply"||S.name==="bind")){let b=S.receiver;if(ha(b)||t.has(b)||C.isIdentifier(b)&&(Nr(s,b)||i.has(b.text)))return!0}if(t.has(_)||(C.isCallExpression(_)||C.isNewExpression(_))&&u(_,y+1)||C.isIdentifier(_)&&(Nr(s,_)||i.has(_.text)))return!0;if(C.isCallExpression(h)){let b=mu(h);if(b!==null&&Ir(b.target,s))return!0}return!1},f=(h,y)=>{if(y>=$_)return!0;let _=Ve(h);if(t.has(_))return!0;if(C.isIdentifier(_))return Rr.has(_.text)||Nr(s,_);if(C.isBinaryExpression(_)){let S=_.operatorToken.kind;return S===C.SyntaxKind.BarBarToken||S===C.SyntaxKind.AmpersandAmpersandToken||S===C.SyntaxKind.QuestionQuestionToken?f(_.left,y+1)||f(_.right,y+1):!1}return C.isConditionalExpression(_)?f(_.whenTrue,y+1)||f(_.whenFalse,y+1):C.isPropertyAccessExpression(_)||C.isElementAccessExpression(_)?Ir(_,s):C.isCallExpression(_)||C.isNewExpression(_)?u(_,y+1):!1},m=(h,y)=>{if((C.isVariableDeclaration(h)||C.isParameter(h)||C.isBindingElement(h))&&h.initializer!==void 0){if(f(h.initializer,0)){let S=pu(h,e);for(let b of vo(h.name))c(b,S)}}else if(C.isBinaryExpression(h)&&h.operatorToken.kind===C.SyntaxKind.EqualsToken&&C.isIdentifier(h.left)&&f(h.right,0))c(h.left.text,M_(h.left,e,r));else if(C.isReturnStatement(h)&&h.expression!==void 0&&y!==void 0&&f(h.expression,0))d(i,y);else if(C.isCallExpression(h)||C.isNewExpression(h)){u(h,0)&&p(h);let S=Ve(h.expression),b=Pt(S),k=b!==null&&b.name==="call",w=b!==null&&b.name==="apply",N=k||w?b.receiver:S,R=k?1:0,v=[];C.isFunctionExpression(N)||C.isArrowFunction(N)?v.push({fn:N,slots:hu(N)}):C.isIdentifier(N)&&v.push(...o.params.get(N.text)??[]);let I=h.arguments??[];if(w){let A=I[1]===void 0?void 0:Ve(I[1]);for(let{fn:B,slots:O}of v)if(A!==void 0&&C.isArrayLiteralExpression(A))for(let V=0;V<A.elements.length;V+=1){let E=A.elements[V],D=O[V];if(!(E===void 0||D===void 0)&&f(E,0))for(let L of D)c(L,B)}else if(A!==void 0)for(let V of O)for(let E of V)c(E,B)}else for(let{fn:A,slots:B}of v)for(let O=R;O<I.length;O+=1){let V=I[O],E=B[O-R];if(!(V===void 0||E===void 0)&&f(V,0))for(let D of E)c(D,A)}}let _=y;if(C.isFunctionDeclaration(h))_=h.name?.text;else if(C.isFunctionExpression(h)||C.isArrowFunction(h)){let S=h.parent;_=C.isVariableDeclaration(S)&&C.isIdentifier(S.name)?S.name.text:void 0}C.forEachChild(h,S=>m(S,_))};m(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function j_(e){if(C.isIdentifier(e)&&ma.has(e.text)||wo(e))return!0;let n=Pt(e);if(n!==null&&(Or.has(n.name)||(n.name==="call"||n.name==="apply")&&(C.isIdentifier(n.receiver)&&ma.has(n.receiver.text)||wo(n.receiver)||(C.isPropertyAccessExpression(n.receiver)||C.isElementAccessExpression(n.receiver))&&cu(n.receiver))))return!0;if(C.isElementAccessExpression(e)&&!C.isStringLiteralLike(e.argumentExpression)){let t=Ve(e.expression);if(C.isIdentifier(t)&&Rr.has(t.text))return!0}return!1}var B_=4;function iu(e,n){for(let t of e){if(!C.isStringLiteralLike(t)||n>=B_)return!0;let s=C.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,M.ScriptTarget.Latest,!0),r=s.parseDiagnostics;if(r!==void 0&&r.length>0||Gg(s,n+1,!0))return!0}return!1}function Gg(e,n=0,t=!1){return Ii(e,n,t).size>0}function Ii(e,n=0,t=!1){let s=new Set,r=t?Dg:qg(e);if(r.saturated)return s.add("saturated"),s;let i=a=>M.isElementAccessExpression(a)&&!M.isStringLiteralLike(a.argumentExpression)&&Xr(Xe(a.expression),r),o=a=>{if(t&&(M.isCallExpression(a)||M.isNewExpression(a)||M.isTaggedTemplateExpression(a))){s.add("eval-invocation");return}if(M.isCallExpression(a)){let d=Qs(a);if(d!==null){let l=d.specifierArg;if(l===void 0||!M.isStringLiteralLike(l)||t){s.add("non-literal-load");return}}else{let l=Xe(a.expression);if(M.isIdentifier(l)&&(l.text==="eval"||l.text==="Function")){if(dc(a.arguments,n)){s.add("eval-code");return}}else if(Hg(l)){s.add("loader-callee");return}else if(i(l)){s.add("computed-loader");return}else if(zg(a,r)){s.add("reflect-get");return}}}else if(M.isNewExpression(a)){let d=Xe(a.expression);if(M.isIdentifier(d)&&d.text==="Function"){if(dc(a.arguments??[],n)){s.add("function-ctor");return}}else if(Js(d)){s.add("ctor-chain");return}}else if(M.isIdentifier(a)&&Cg.has(a.text)&&Lg(a)){s.add("captured-loader");return}else if((M.isPropertyAccessExpression(a)||M.isElementAccessExpression(a))&&(pc(a)||Js(a)||i(a))&&fc(a)){s.add("captured-member");return}else if(M.isBindingElement(a)){let d=a.propertyName??a.name,l=M.isIdentifier(d)||M.isStringLiteralLike(d)?d.text:M.isComputedPropertyName(d)&&M.isStringLiteralLike(d.expression)?d.expression.text:void 0;if(l!==void 0&&Jr.has(l)){s.add("destructured-member");return}}M.forEachChild(a,o)};return o(e),s}function xc(e,n,t){let s=new Set(Ii(t));if(Oi(e)&&n.includes("<")&&n.includes("require")){let r=M.createSourceFile(e,n,M.ScriptTarget.ES2020,!0,M.ScriptKind.TSX);for(let i of Ii(r))s.add(i)}return s}function Vg(e,n,t){if(Ri(e))return!0;let s=t.endsWith(ln.sep)?t:t+ln.sep,r=e.split("/"),i=n;for(;;){let o=ln.join(i,"node_modules",...r),a;try{a=Wt(ln.join(o,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(s))return!1;let l=on(a);if(l===null)return!1;let c;try{c=JSON.parse(l).exports}catch{return!1}if(typeof c=="string"||Array.isArray(c)||typeof c=="object"&&c!==null)return!1}if(Ud(o))return!1;if(i===t)break;let d=ln.dirname(i);if(d===i||d!==t&&!d.startsWith(s))break;i=d}return!0}function Xg(e,n){let t=n.endsWith(ln.sep)?n:n+ln.sep,s=ln.dirname(e);for(;;){let r=ln.join(s,"package.json"),i;try{i=Wt(r)}catch{i=null}if(i!==null&&(i===n||i.startsWith(t))){let a=on(i);if(a!==null)try{let d=JSON.parse(a).name;if(typeof d=="string"&&d.length>0)return d}catch{return null}}if(s===n)break;let o=ln.dirname(s);if(o===s||o!==n&&!o.startsWith(t))break;s=o}return null}function Yg(e,n,t,s,r){let i=[],o=[],a=new Set,d={},l=[],c=[],p=new Set,u=new Set,f=[],h=!1,g=(_,b)=>{let x;try{x=Wt(b)}catch{return!1}let k=mn(e,x);if(k===null)return r.push({code:"out-of-root",path:x,detail:"dependency module resolved outside the app root; not followed"}),!1;let w=!t.has(x)&&!u.has(x);return w&&u.size>=Ei?(h=!0,!1):(o.push({from:_,to:{module:k}}),w?(u.add(x),i.push(k),!0):!1)},y=(_,b)=>{if(a.add(b),p.has(b))return;p.add(b);let x=Cn(b,_,an,n),k=x!==null?[x]:hs(b,_,an,n);k.length>=2&&l.push({path:mn(e,_)??_,specifier:b,candidates:k.map(I=>mn(e,I)??I)});let w=!1;for(let I of k)if(!Sn(I)&&(w=!0,g({surface:b},I))){f.push(I);try{let N=mn(e,Wt(I)),v=Xg(I,e);N!==null&&v!==null&&(d[N]=v)}catch{}}w||Vg(b,ln.dirname(_),e)||r.push({code:"unresolved-specifier",path:b,reason:Vs(b,_,an,n),detail:`dependency "${b}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let _ of s)y(_.containingFile,_.packageName);for(;f.length>0&&u.size<Ei;){let _=f.pop();if(_===void 0)break;let b=mn(e,_);if(b===null)continue;let x=ms(_,Pt);if(x.kind==="too-large"){r.push({code:"limit-exceeded",path:b,detail:`dependency module over the ${String(Pt/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(x.kind==="not-regular"){r.push({code:"parse-error",path:b,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let k=M.createSourceFile(_,x.text,M.ScriptTarget.ES2020,!0),w=k.parseDiagnostics;if(w!==void 0&&w.length>0){r.push({code:"dependency-body",path:b,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let I=xc(_,x.text,k);if(I.size>0){r.push({code:"dependency-body",path:b,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...I].sort()});continue}r.push({code:"dependency-body",path:b,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:b});for(let N of cc(_,x.text))if(N.runtime)if(We(N.text)==="package-root"){let v=Pn(N.text);o.push({from:{module:b},to:{surface:v}}),y(_,v)}else{if(Ri(Pn(N.text)))continue;let v=Cn(N.text,_,an,n),C=v!==null?[v]:hs(N.text,_,an,n);if(C.length===0){if(We(N.text)==="package-subpath"){let R=Vs(N.text,_,an,n);if(R==="no-candidate"||R==="not-installed"&&Gd(_,Pn(N.text))){c.push({path:b,specifier:N.text,why:R});continue}r.push({code:"unresolved-specifier",path:b,reason:R,detail:`runtime package-subpath import "${N.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}C.length>=2&&l.push({path:b,specifier:N.text,candidates:C.map(R=>mn(e,R)??R)});for(let R of C){if(Sn(R)){let F=mn(e,R);r.push({code:F===null?"out-of-root":"declaration-shadow",path:b,detail:F===null?`runtime import "${N.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${N.text}" resolved to the declaration file "${F}" with no co-located runtime module; its code was not analyzed`});continue}g({module:b},R)&&f.push(R)}}}return(h||f.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(Ei)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:i,edges:o,surfacePackages:[...a],entryRealNames:d,conditionUnions:l,provenAbsent:c}}function bc(e,n,t=!1){let s=Wt(e),r=[],i=[],o=M.createCompilerHost(an,!0),a=t?Vd(s,an,o):()=>null,d=new Set,l=new Set,c=n.map(P=>ln.join(s,P)),p=[],u=new Map,f=new Map,h=new Map,g=new Map,y=new Set,_=(P,U,E)=>{let T=`${String(P.length)}:${P}${U}`;y.has(T)||(y.add(T),r.push({code:"unresolved-specifier",path:P,detail:U,reason:E}))},b=()=>null,x=0,k=(P,U)=>{let E=f.get(P);return E===void 0&&(E=M.createSourceFile(P,U,M.ScriptTarget.ES2020,!0),f.set(P,E)),{real:P,sf:E}};for(;l.size<Gr;){let P=c.pop();if(P===void 0){if(x>=Pg)break;x+=1;let K=[];for(let[Y,V]of u)V.includes("readdir")&&(V.includes("require")||V.includes("import("))&&K.push(k(Y,V));let J=Og(K);if(J.length===0)break;let W=[];for(let[Y,V]of u)W.push(k(Y,V));b=oc(W,J,an,o,h);let se=!1;for(let Y of K){let V=u.get(Y.real);if(V!==void 0)for(let fe of lc(Y.real,V,s,o,b))l.has(fe)||(c.push(fe),se=!0)}if(!se)break;continue}let U;try{U=Wt(P)}catch{continue}if(l.has(U))continue;if(l.add(U),mn(s,U)===null){r.push({code:"out-of-root",path:P,detail:"resolved outside app root"});continue}let E=ms(U,Pt);if(E.kind==="too-large"){r.push({code:"limit-exceeded",path:U,detail:`file is ${String(Math.round(E.bytes/1048576))}MiB, over the ${String(Pt/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(E.kind==="not-regular"){r.push({code:"parse-error",path:U,detail:"unreadable or not a regular file"});continue}let T=E.text;d.add(U),u.set(U,T);for(let K of cc(U,T)){let J=K.runtime?a(K.text,U):null;if(J===null&&We(K.text)==="package-root"){K.runtime&&p.push({containingFile:U,packageName:Pn(K.text)});continue}let W=J??Cn(K.text,U,an,o),se=W!==null?[W]:K.runtime&&J===null?hs(K.text,U,an,o):[];if(se.length===0){if(K.runtime){let Y=We(K.text);if(!(Y==="package-subpath"&&Ri(Pn(K.text)))){if(Y==="package-subpath")_(U,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,Vs(K.text,U,an,o));else if(Y==="relative"){let V=Hd(K.text,U,s,g);V.kind==="unanalyzable"&&_(U,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${V.reason}; a bundler/loader may load a module the analyzer never saw`,V.why)}}}continue}se.length>=2&&i.push({path:mn(s,U)??U,specifier:K.text,candidates:se.map(Y=>mn(s,Y)??Y)});for(let Y of se){if(mn(s,Y)===null){r.push({code:"out-of-root",path:Y,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&Sn(Y)){r.push({code:"declaration-shadow",path:Y,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!zr(Y)){r.push({code:"unanalyzable-module",path:Y,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(Y)}}for(let K of lc(U,T,s,o,b))l.has(K)||c.push(K)}l.size>=Gr&&c.length>0&&r.push({code:"limit-exceeded",path:s,detail:`reachable file set exceeds ${String(Gr)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let w=Yg(s,o,d,p,r),I=M.createProgram({rootNames:[...d],options:an,host:o}),N=new Set,v=new Map;for(let P of I.getSourceFiles()){if(P.isDeclarationFile||I.isSourceFileDefaultLibrary(P)||mn(s,P.fileName)===null||!Oi(P.fileName))continue;let U=I.getSyntacticDiagnostics(P).length>0;if(!U&&!P.text.includes("<")||Rg(P.text,M.ScriptKind.TSX)!==0)continue;let E=M.createSourceFile(P.fileName,P.text,M.ScriptTarget.ES2020,!0,M.ScriptKind.TSX);(U||ac(E)>ac(P))&&(N.add(P.fileName),v.set(P.fileName,P.text))}let C=I;if(N.size>0){let P=o.getSourceFile.bind(o);o.getSourceFile=(U,E,T,K)=>{let J=v.get(U);return J!==void 0?M.createSourceFile(U,J,M.ScriptTarget.ES2020,!0,M.ScriptKind.TSX):P(U,E,T,K)},C=M.createProgram({rootNames:[...d],options:an,host:o,oldProgram:I})}let R=C.getTypeChecker(),F=[];for(let P of C.getSourceFiles()){if(P.isDeclarationFile||C.isSourceFileDefaultLibrary(P)||mn(s,P.fileName)===null)continue;F.push(P);let U=C.getSyntacticDiagnostics(P);if(U.length>0){let K=U[0],J=K!==void 0?M.flattenDiagnosticMessageText(K.messageText," "):"syntax error";r.push({code:"parse-error",path:P.fileName,detail:`${String(U.length)} syntax error(s): ${J}`})}let E=mn(s,P.fileName),T=E===null?null:xc(P.fileName,P.text,P);E!==null&&T!==null&&T.size>0&&r.push({code:"loader-escape",path:E,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...T].sort()})}return{program:C,checker:R,host:o,options:an,appRoot:s,sourceFiles:F,diagnostics:r,depReach:w,conditionUnions:[...i,...w.conditionUnions],provenAbsent:w.provenAbsent,resolveParamDirs:b,toRel:P=>mn(s,P)}}import{opendirSync as Jg,statSync as Zg}from"node:fs";import Pi from"node:path";var Qg=8192,ey=2e4,ny=new Set(["node_modules"]),Sc=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),ty=16;function Zr(e,n,t,s,r={}){let i=r.maxEntries??ey,o=r.prune,a=[],d=!1,l=0,c=[{dir:Pi.join(e,n),rel:n,depth:0}];for(;c.length>0;){let p=c.pop();if(p===void 0)break;if(p.depth>ty){d=!0;continue}let u;try{u=Jg(p.dir)}catch{d=!0;continue}try{let f=0;for(;;){let h=u.readSync();if(h===null)break;if(f+=1,l+=1,f>Qg||l>i){d=!0;break}let g=p.rel+h.name;if(h.isSymbolicLink()){let y;try{y=Zg(Pi.join(p.dir,h.name)).isDirectory()}catch{d=!0;continue}if(y){d=!0;continue}}else if(h.isDirectory()){if(ny.has(h.name)||h.name.startsWith(".")||o?.has(h.name)===!0){d=!0;continue}c.push({dir:Pi.join(p.dir,h.name),rel:`${g}/`,depth:p.depth+1});continue}else if(!h.isFile())continue;if(t(g)){if(a.length>=s){d=!0;break}a.push(g)}}}finally{try{u.closeSync()}catch{}}}return{matches:a,truncated:d}}var sy=64;function kc(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let s=n.slice(0,t),r=n.slice(t+1);if(s.startsWith("./")&&(s=s.slice(2)),s.startsWith("/")||r.includes("/")||s.split("/").includes("..")||s.includes("\\")||n.includes("\0"))return null;let i=s.slice(0,s.lastIndexOf("/")+1);return Zr(e,i,o=>o.length>=s.length+r.length&&o.startsWith(s)&&o.endsWith(r),sy)}import{existsSync as ry}from"node:fs";import oy from"node:path";var iy=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],ay=["dependencies","devDependencies"];function ly(e,n){for(let t of ay){let s=e[t];if(!(typeof s!="object"||s===null||Array.isArray(s))&&Object.hasOwn(s,n))return!0}return!1}function Ci(e,n){if(n===null)return null;for(let t of iy)if(ly(n,t.dependency)){for(let s of t.configFiles)if(ry(oy.join(e,s)))return{name:t.name,configFile:s,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function Mi(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var dy=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],cy=256,uy=12e4;function Ti(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let s=Zr(e,"",r=>{let i=r.split("/");for(let o=0;o<i.length-1;o+=1){let a=i[o];if(a!==void 0&&t.has(a))return dy.some(d=>r.endsWith(d))}return!1},cy,{maxEntries:uy,prune:Sc});return{roots:s.matches,truncated:s.truncated}}function Mn(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let s of n){let r=s.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:s}return t}function fy(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function py(e){let n=!1;for(let t=0;t<e.length;t+=1){let s=e.charAt(t),r=s.codePointAt(0)??0;if(r<32||r===127||r>=128&&r<=159)return null;if(s==="\\"){n=!0;let i=e.charAt(t+1);if(!(i>="a"&&i<="z"||i>="A"&&i<="Z"||i>="0"&&i<="9"||i==="."||i==="_"||i==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(s))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function my(e){let n=[],t="";for(let s of e){if(s===" "||s==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=s}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var hy=/^[A-Za-z_][A-Za-z0-9_]*=/u;function gy(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var wc=new Set(["flask","granian","gunicorn","hypercorn","php","php-fpm","puma","python","python2","python3","rails","ruby","streamlit","unicorn","uvicorn","uwsgi","waitress-serve"]);function yy(e){let n=e.slice(e.lastIndexOf("/")+1);return wc.has(n)||wc.has(n.replace(/[0-9.]+$/u,""))}var _y=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),xy=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),by=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function Ec(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function vc(e){if(Ec(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return by.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:_y.has(t)||n!==-1&&xy.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var Sy=[".js",".cjs",".mjs",".ts",".mts",".cts"];function ky(e){return Sy.some(n=>e.endsWith(n))}var wy=new Set(["npm","yarn","pnpm"]);function vy(e){let n=e[0];return n===void 0||!wy.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Li(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!fy(n))return $i(n);let t=py(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let s=$i(t.windows),r=$i(t.posixShell);if(s.kind==="file"){let i=r.kind==="file"?r.specifier:void 0;return i===void 0||i===s.specifier?{kind:"file",specifier:s.specifier}:{kind:"file",specifier:s.specifier,alt:i}}return r.kind==="file"?{kind:"file",specifier:r.specifier}:s}function $i(e){let n=my(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let i=n[t];if(i===void 0||!hy.test(i))break;if(Ec(i))return{kind:"unparsed",reason:`environment \`${Mn(i)}\` preloads another module; the launch surface is more than one file`};let o=i.indexOf("=");if(i.slice(0,o)==="NODE_OPTIONS")for(let a of i.slice(o+1).split(/\s+/u)){if(a===""||!a.startsWith("-"))continue;let d=vc(a);if(d!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Mn(d.token)}\` ${d.why}`}}}let s=n[t];if(s===void 0)return{kind:"unparsed",reason:"no program in the command"};if(vy(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!gy(s))return yy(s)?{kind:"foreign",binary:s}:{kind:"unparsed",reason:`runs \`${Mn(s)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let i=n[t];if(i===void 0||!i.startsWith("-"))break;let o=vc(i);if(o!==null)return{kind:"unparsed",reason:`node flag \`${Mn(o.token)}\` ${o.why}`}}let r=n[t];return r===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:ky(r)?{kind:"file",specifier:r}:{kind:"unparsed",reason:`\`${Mn(r)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Ey(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Ny=64,Di=64*1024,Ay=64;function Fi(e){let n=[],t=!1;for(let s of e.split(/\r?\n/u)){if(n.length>=Ay){t=!0;break}let r=/^\s*(CMD|ENTRYPOINT)\s+(.*\S)\s*$/iu.exec(s),i=/^\s*(command|entrypoint):\s*(.*\S)\s*$/u.exec(s),o=r??i;if(o?.[1]===void 0||o[2]===void 0)continue;let a=Iy(o[2]);a!==null&&n.push({label:o[1].toUpperCase(),command:a})}return{commands:n,truncated:t}}function Iy(e){let n=e.trim();if(!n.startsWith("["))return n===""?null:n;let t;try{t=JSON.parse(n)}catch{return null}if(!Array.isArray(t))return null;let s=t.filter(r=>typeof r=="string");return s.length===0||s.length!==t.length?null:s.join(" ")}function ji(e){let n=e.split(`
-`),t=n.length>64,s=[],r=0;for(let i of n.slice(0,64)){let o=i.trim();if(o.length===0||o.startsWith("#"))continue;let a=o.indexOf(":");if(a<=0)continue;let d=o.slice(a+1).trim();if(d.length===0)continue;let l=o.slice(0,a);if(l.length>Ny||!Ey(l)){r+=1;continue}s.push({name:l,command:d})}return s.sort((i,o)=>i.name===o.name?0:i.name==="web"?-1:o.name==="web"?1:0),{entries:s,truncated:t,unnamedLines:r}}import{realpathSync as Wc}from"node:fs";import kn from"node:path";import m from"typescript";import O from"typescript";import Nc from"node:path";import de from"typescript";var Ry=/^lib\.(?:es5|es20\d\d(?:\.[a-z0-9]+)*|esnext(?:\.[a-z0-9]+)*|decorators(?:\.legacy)?)\.d\.ts$/u,Oy=/^lib\.(?:dom|webworker|scripthost)(?:\.[a-z0-9]+)*\.d\.ts$/u;function Py(e,n){if(e.isSourceFileDefaultLibrary(n)){let t=Nc.basename(n.fileName);return Ry.test(t)?"ecmascript":Oy.test(t)?"host-lib":"unknown"}return n.fileName.split(Nc.sep).join("/").includes("/node_modules/")?"dependency":"app"}function Cy(e,n,t){if(t===void 0)return"unknown";let s=t;if(s.flags&de.SymbolFlags.Alias)try{s=n.getAliasedSymbol(s)}catch{return"unknown"}let r=s.declarations??[];if(r.length===0)return"unknown";let i=new Set(r.map(o=>Py(e,o.getSourceFile())));return i.size===1?[...i][0]:"unknown"}function Bi(e,n,t){let s=t;for(;de.isParenthesizedExpression(s);)s=s.expression;let r;if(de.isIdentifier(s)?r=s:de.isPropertyAccessExpression(s)?r=s.name:de.isElementAccessExpression(s)&&de.isStringLiteralLike(s.argumentExpression)&&(r=s.argumentExpression),r===void 0)return"unknown";let i;try{i=n.getSymbolAtLocation(r)}catch{return"unknown"}return Cy(e,n,i)}function My(e){if(de.isVariableDeclaration(e)){let n=e.parent;return de.isVariableDeclarationList(n)&&de.isVariableStatement(n.parent)&&de.isSourceFile(n.parent.parent)}return de.isFunctionDeclaration(e)||de.isClassDeclaration(e)?de.isSourceFile(e.parent):de.isImportClause(e)||de.isImportSpecifier(e)||de.isNamespaceImport(e)}function Ac(e,n,t){let s;try{s=n.getSymbolAtLocation(t)}catch{return"unknown"}let r=s?.declarations??[];if(r.length===0)return"unknown";let i=t.getSourceFile();return r.every(o=>o.getSourceFile()===i&&My(o))?"module":r.every(o=>e.isSourceFileDefaultLibrary(o.getSourceFile()))?"global":"unknown"}var Ty=de.TypeFlags.StringLike|de.TypeFlags.NumberLike|de.TypeFlags.BooleanLike|de.TypeFlags.BigIntLike|de.TypeFlags.ESSymbolLike|de.TypeFlags.Null|de.TypeFlags.Undefined|de.TypeFlags.Void;function Ic(e){return e.flags&(de.TypeFlags.Any|de.TypeFlags.Unknown|de.TypeFlags.Never)?!1:e.isUnion()?e.types.every(Ic):(e.flags&Ty)!==0&&(e.flags&de.TypeFlags.Object)===0}var $y=new Set([de.SyntaxKind.EqualsEqualsToken,de.SyntaxKind.EqualsEqualsEqualsToken,de.SyntaxKind.ExclamationEqualsToken,de.SyntaxKind.ExclamationEqualsEqualsToken,de.SyntaxKind.LessThanToken,de.SyntaxKind.LessThanEqualsToken,de.SyntaxKind.GreaterThanToken,de.SyntaxKind.GreaterThanEqualsToken,de.SyntaxKind.InstanceOfKeyword,de.SyntaxKind.InKeyword,de.SyntaxKind.PlusToken,de.SyntaxKind.MinusToken,de.SyntaxKind.AsteriskToken,de.SyntaxKind.AsteriskAsteriskToken,de.SyntaxKind.SlashToken,de.SyntaxKind.PercentToken,de.SyntaxKind.AmpersandToken,de.SyntaxKind.BarToken,de.SyntaxKind.CaretToken,de.SyntaxKind.LessThanLessThanToken,de.SyntaxKind.GreaterThanGreaterThanToken,de.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]),Ly=new Set([de.SyntaxKind.AmpersandAmpersandToken,de.SyntaxKind.BarBarToken,de.SyntaxKind.QuestionQuestionToken]);function er(e,n,t,s=0){if(s>8)return!1;let r=t;for(;de.isParenthesizedExpression(r);)r=r.expression;let i=o=>er(e,n,o,s+1);if(de.isStringLiteral(r)||de.isNoSubstitutionTemplateLiteral(r)||de.isTemplateExpression(r)||de.isNumericLiteral(r)||de.isBigIntLiteral(r)||r.kind===de.SyntaxKind.TrueKeyword||r.kind===de.SyntaxKind.FalseKeyword||r.kind===de.SyntaxKind.NullKeyword||de.isTypeOfExpression(r)||de.isVoidExpression(r)||de.isPrefixUnaryExpression(r)||de.isPostfixUnaryExpression(r)||de.isIdentifier(r)&&r.text==="undefined")return!0;if(de.isBinaryExpression(r)){let o=r.operatorToken.kind;return $y.has(o)?!0:Ly.has(o)?i(r.left)&&i(r.right):o===de.SyntaxKind.CommaToken?i(r.right):!1}if(de.isConditionalExpression(r))return i(r.whenTrue)&&i(r.whenFalse);if(de.isCallExpression(r)){if(Bi(e,n,r.expression)!=="ecmascript")return!1;try{let o=n.getResolvedSignature(r);return o!==void 0&&Ic(n.getReturnTypeOfSignature(o))}catch{return!1}}if(de.isIdentifier(r)){let o;try{o=n.getSymbolAtLocation(r)}catch{return!1}let a=o?.declarations??[],d=a.length===1?a[0]:void 0;return d===void 0||!de.isVariableDeclaration(d)||d.initializer===void 0||!de.isIdentifier(d.name)||!de.isVariableDeclarationList(d.parent)||(d.parent.flags&de.NodeFlags.Const)===0?!1:i(d.initializer)}return!1}import Fn from"typescript";var cn={kind:"receiver"},dn=e=>({kind:"arg",index:e}),Ki=e=>({kind:"args-from",index:e}),Ye=Ki(0),_t=(e=[Ye])=>({result:[Ye],mutates:[],callsProgram:e}),Wn=(e=[cn,Ye])=>({result:[cn,Ye],mutates:[],callsProgram:e}),Hn=(e=[])=>({result:[cn],mutates:[],callsProgram:e}),Dy={result:[],mutates:[]},zi=new Map,ge=(e,n)=>{for(let t of e)zi.set(t,n)};ge(["String","Number","BigInt"],{result:[dn(0)],mutates:[],callsProgram:[dn(0)]});ge(["Boolean"],{result:[dn(0)],mutates:[]});ge(["parseInt","parseFloat","isNaN","isFinite","encodeURIComponent","encodeURI","decodeURIComponent","decodeURI","escape","unescape"],_t());ge(["Array","Object"],{result:[Ye],mutates:[]});ge(["String.fromCharCode","String.fromCodePoint","String.raw"],_t());ge(["at","charAt","charCodeAt","codePointAt","concat","endsWith","includes","indexOf","isWellFormed","lastIndexOf","localeCompare","match","matchAll","normalize","padEnd","padStart","repeat","replace","replaceAll","search","slice","split","startsWith","substr","substring","toLocaleLowerCase","toLocaleUpperCase","toLowerCase","toString","toUpperCase","toWellFormed","trim","trimEnd","trimLeft","trimRight","trimStart","valueOf"].map(e=>`String.prototype.${e}`),Wn());ge(["Object.keys","Object.values","Object.entries","Object.getOwnPropertyNames","Object.getOwnPropertySymbols","Object.getPrototypeOf","Object.fromEntries","Object.freeze","Object.seal","Object.preventExtensions","Object.isFrozen","Object.isSealed","Object.isExtensible"],{result:[dn(0)],mutates:[],callsProgram:[dn(0)]});ge(["Object.is","Object.hasOwn","Object.create"],_t());ge(["Object.assign"],{result:[Ye],mutates:[{into:dn(0),from:[Ki(1)]}],callsProgram:[Ye]});ge(["Object.defineProperty"],{result:[dn(0)],mutates:[{into:dn(0),from:[dn(2)]}],callsProgram:[Ye]});ge(["Object.prototype.hasOwnProperty","Object.prototype.isPrototypeOf","Object.prototype.propertyIsEnumerable","Object.prototype.toString","Object.prototype.toLocaleString","Object.prototype.valueOf"],Wn());ge(["Array.isArray"],{result:[dn(0)],mutates:[]});ge(["Array.of"],{result:[Ye],mutates:[]});ge(["Array.from"],_t());var Fy=["at","concat","entries","flat","includes","indexOf","join","keys","lastIndexOf","slice","toLocaleString","toReversed","toSpliced","toString","values","with"];ge(Fy.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),Wn([cn,Ye]));var jy=["every","filter","find","findIndex","findLast","findLastIndex","flatMap","forEach","map","reduce","reduceRight","some","toSorted"];ge(jy.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),Wn([cn,Ye]));ge(["Array.prototype.push","Array.prototype.unshift"],{result:[cn,Ye],mutates:[{into:cn,from:[Ye]}]});ge(["Array.prototype.splice"],{result:[cn],mutates:[{into:cn,from:[Ki(2)]}],callsProgram:[Ye]});ge(["Array.prototype.fill"],{result:[cn,dn(0)],mutates:[{into:cn,from:[dn(0)]}],callsProgram:[Ye]});ge(["Array.prototype.pop","Array.prototype.shift"],Hn());ge(["Array.prototype.reverse","Array.prototype.copyWithin"],Hn([Ye]));ge(["Array.prototype.sort"],Hn([cn,Ye]));for(let e of["Map","WeakMap","ReadonlyMap"])ge([`${e}.prototype.get`],Hn()),ge([`${e}.prototype.has`],Wn([])),ge([`${e}.prototype.delete`],Wn([])),ge([`${e}.prototype.set`],{result:[cn],mutates:[{into:cn,from:[dn(0),dn(1)]}]}),ge([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],Hn()),ge([`${e}.prototype.forEach`],Hn([Ye]));for(let e of["Set","WeakSet","ReadonlySet"])ge([`${e}.prototype.has`],Wn([])),ge([`${e}.prototype.delete`],Wn([])),ge([`${e}.prototype.add`],{result:[cn],mutates:[{into:cn,from:[dn(0)]}]}),ge([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],Hn()),ge([`${e}.prototype.forEach`],Hn([Ye]));ge(["Map.prototype.clear","Set.prototype.clear"],Hn());ge(["JSON.parse","JSON.stringify"],_t());ge(["Number.isInteger","Number.isFinite","Number.isNaN","Number.isSafeInteger"],{result:[dn(0)],mutates:[]});ge(["Number.parseInt","Number.parseFloat"],_t());ge(["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"].map(e=>`Number.prototype.${e}`),Wn([Ye]));ge(["abs","acos","acosh","asin","asinh","atan","atan2","atanh","cbrt","ceil","clz32","cos","cosh","exp","expm1","floor","fround","hypot","imul","log","log10","log1p","log2","max","min","pow","round","sign","sin","sinh","sqrt","tan","tanh","trunc"].map(e=>`Math.${e}`),_t());ge(["Math.random","Date.now"],Dy);ge(["RegExp.prototype.test","RegExp.prototype.exec"],Wn());ge(["RegExp.prototype.toString"],Hn());ge(["Date.parse","Date.UTC"],_t());ge(["getDate","getDay","getFullYear","getHours","getMilliseconds","getMinutes","getMonth","getSeconds","getTime","getTimezoneOffset","toDateString","toISOString","toJSON","toLocaleDateString","toLocaleString","toLocaleTimeString","toString","toTimeString","toUTCString","valueOf"].map(e=>`Date.prototype.${e}`),Hn());ge(["Promise.resolve","Promise.all","Promise.allSettled","Promise.any","Promise.race"],_t());ge(["Promise.prototype.then","Promise.prototype.catch","Promise.prototype.finally"],Wn());var By=new Set(["JSON","Math","Reflect","Atomics"]);function Rc(e,n){let t=n;for(;Fn.isParenthesizedExpression(t);)t=t.expression;let s=Fn.isIdentifier(t)?t:Fn.isPropertyAccessExpression(t)?t.name:void 0;if(s===void 0)return null;let r;try{r=e.getSymbolAtLocation(s),r!==void 0&&r.flags&Fn.SymbolFlags.Alias&&(r=e.getAliasedSymbol(r))}catch{return null}let i=r?.valueDeclaration??r?.declarations?.[0];if(i===void 0)return null;if(Fn.isIdentifier(t))return(Fn.isVariableDeclaration(i)||Fn.isFunctionDeclaration(i))&&i.name!==void 0&&Fn.isIdentifier(i.name)?i.name.text:null;let o=i.parent;if(Fn.isModuleBlock(o)&&Fn.isModuleDeclaration(o.parent)&&Fn.isIdentifier(o.parent.name))return`${o.parent.name.text}.${s.text}`;if(!Fn.isInterfaceDeclaration(o))return null;let a=o.name.text,d=s.text;return By.has(a)?`${a}.${d}`:a.endsWith("Constructor")?`${a.slice(0,-11)}.${d}`:`${a}.prototype.${d}`}function Oc(e){let n=zi.get(e);return n===void 0?void 0:{id:`ecmascript:${e}`,...n}}var _0=zi.size;import Gt from"typescript";var Ui=["get","post","put","patch","delete","options","head","all"],Ky=[{id:"express@4-source-v1",packages:["express"],members:new Set([...Ui,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://expressjs.com/en/4x/api.html#app.METHOD \u2014 callbacks receive (req, res, next); error-handling middleware receives (err, req, res, next)"},{id:"koa@2-source-v1",packages:["koa","@koa/router","koa-router"],members:new Set([...Ui,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://koajs.com/#context \u2014 middleware receives (ctx, next); ctx.request carries the request"},{id:"fastify@4-source-v1",packages:["fastify"],members:new Set(Ui),sourceClass:"remote-unauthenticated",evidence:"https://fastify.dev/docs/latest/Reference/Routes/ \u2014 handler receives (request, reply)"}];function Pc(e){let n=new Set(e.map(t=>t.startsWith("@")?t.split("/").slice(0,2).join("/"):t.split("/")[0]));return Ky.filter(t=>t.packages.some(s=>n.has(s)))}function Qr(e,n){if(n.length===0)return null;let t=e.expression;for(;Gt.isParenthesizedExpression(t);)t=t.expression;if(!Gt.isPropertyAccessExpression(t))return null;let s=t.name.text,r=n.find(a=>a.members.has(s));if(r===void 0)return null;let i=e.arguments.filter(a=>Gt.isArrowFunction(a)||Gt.isFunctionExpression(a)||Gt.isIdentifier(a)||Gt.isPropertyAccessExpression(a)),o=e.arguments.filter(Gt.isCallExpression);return i.length>0||o.length>0?{model:r,handlers:i,forwarded:o}:null}function nr(e,n){return e.id.startsWith("express@")&&n===4?1:0}function Vt(e){return O.isFunctionDeclaration(e)||O.isFunctionExpression(e)||O.isArrowFunction(e)||O.isMethodDeclaration(e)||O.isConstructorDeclaration(e)||O.isGetAccessorDeclaration(e)||O.isSetAccessorDeclaration(e)}var eo=(e,n,t)=>({path:e,start:n.getStart(t,!1),end:n.getEnd()});function zy(e,n,t){let s=[];for(let r of e.parameters){if(O.isIdentifier(r.name)&&r.name.text==="this")continue;let i=O.isIdentifier(r.name)?r.name.text:void 0;s.push({index:s.length,kind:r.dotDotDotToken!==void 0?"rest":"positional",...i!==void 0?{name:i}:{},destructured:i===void 0,hasDefault:r.initializer!==void 0,range:eo(n,r,t)})}return s}function Uy(e){return O.isArrowFunction(e)?"lexical":"call"}function qy(e){let n=!1,t=s=>{if(!n&&!(s!==e&&Vt(s)&&!O.isArrowFunction(s))){if(O.isIdentifier(s)&&s.text==="arguments"){let r=s.parent;O.isPropertyAccessExpression(r)&&r.name===s||O.isPropertyAssignment(r)&&r.name===s||(n=!0)}O.isCallExpression(s)&&O.isIdentifier(s.expression)&&s.expression.text==="eval"&&(n=!0),O.forEachChild(s,t)}};e.body!==void 0&&O.forEachChild(e.body,t);for(let s of e.parameters)s.initializer!==void 0&&t(s.initializer);return n}function Hi(e,n,t,s=[],r,i=new Map){let o=new Map;if(s.length>0){let u=f=>{if(O.isCallExpression(f)){let h=Qr(f,s);for(let g of h?.handlers??[])h!==null&&(O.isArrowFunction(g)||O.isFunctionExpression(g))&&o.set(g,{model:h.model,index:nr(h.model,g.parameters.length),registeredAt:eo(t,f,n)})}O.forEachChild(f,u)};u(n)}for(let[u,f]of i)o.has(u)||o.set(u,f);let a=[],d=u=>{Vt(u)&&a.push({start:u.getStart(n,!1),end:u.getEnd(),node:u}),O.forEachChild(u,d)};d(n),a.sort((u,f)=>u.start-f.start||f.end-u.end);let l=u=>{let f=0,h=a.length;for(;f<h;){let g=f+h>>>1;(a[g]?.start??1/0)<u?f=g+1:h=g}return f},c=e.map(u=>{if(u.declRange.path!==t||u.name==="<toplevel>")return;let{start:f,end:h}=u.declRange,g=l(f);for(;g<a.length&&(a[g]?.start??1/0)<h&&(a[g]?.end??0)>h;)g+=1;let y=a[g];if(y===void 0||y.start>=h||y.end>h)return;let _=a[l(y.end)];if(!(_!==void 0&&_.start<h&&_.end<=h))return y.node}),p=new Set(c.filter(u=>u!==void 0));return e.map((u,f)=>{if(u.name==="<toplevel>"&&u.declRange.path===t){let _=Mc(n,p,n,o,r);return _!==void 0?{...u,valueFlows:_}:u}let h=c[f];if(h===void 0)return u;let g=Mc(h,p,n,o,r),y=o.get(h);return{...u,...y!==void 0?{sourceParams:[{index:y.index,sourceClass:y.model.sourceClass,model:y.model.id,registeredAt:y.registeredAt}]}:{},params:zy(h,t,n),receiver:Uy(h),reflectiveArguments:qy(h),...g!==void 0?{valueFlows:g}:{}}})}var Hy=new Set(["call","apply","bind"]),Cc=new WeakMap;function Lc(e,n){let t=Cc.get(n.checker);t===void 0&&(t=new WeakMap,Cc.set(n.checker,t));let s=t.get(e);if(s!==void 0)return s;let r=Bi(n.program,n.checker,e),i=r==="ecmascript"?Rc(n.checker,e):null,o=i!==null?Oc(i):void 0,a={calleeDecl:r,identity:i,...o!==void 0?{summary:o}:{}};return t.set(e,a),a}function Wi(e,n,t,s,r){let i=n;for(;O.isParenthesizedExpression(i);)i=i.expression;let o=O.isPropertyAccessExpression(i)||O.isElementAccessExpression(i)?i.expression:void 0,a=o!==void 0?{receiverRange:eo(t,o,s)}:{},d={repeats:Wy(e)},l=r!==void 0?Lc(n,r):void 0,c=l?.calleeDecl,p=l?.identity??null,u=l?.summary,f={...c!==void 0?{calleeDecl:c}:{},...u!==void 0?{summary:u}:{},...p!==null?{runtimeId:`ecmascript:${p}`}:{},...r!==void 0&&o!==void 0&&er(r.program,r.checker,o)?{receiverPrimitive:!0}:{}};if(O.isTaggedTemplateExpression(e))return{convention:"unknown",...a,...d,...f};let h=O.isPropertyAccessExpression(i)&&Hy.has(i.name.text);return{args:e.arguments.map((y,_)=>({index:_,spread:O.isSpreadElement(y)?"positional":!1,range:eo(t,y,s),...r!==void 0&&!O.isSpreadElement(y)&&er(r.program,r.checker,y)?{primitive:!0}:{}})),convention:h?"unknown":"direct",...a,...d,...f}}function Wy(e){for(let n=e.parent;n!==void 0;n=n.parent){if(O.isForStatement(n)||O.isForInStatement(n)||O.isForOfStatement(n)||O.isWhileStatement(n)||O.isDoStatement(n))return!0;if(O.isFunctionDeclaration(n)||O.isMethodDeclaration(n)||O.isConstructorDeclaration(n)||O.isGetAccessorDeclaration(n)||O.isSetAccessorDeclaration(n))return!1;if(O.isFunctionExpression(n)||O.isArrowFunction(n))return!(O.isVariableDeclaration(n.parent)&&n.parent.initializer===n)}return!0}var Dc=2e4,ys={kind:"constant"},rn=e=>({kind:"opaque",reason:e}),no=class extends Error{},Gy=new Set([O.SyntaxKind.BarBarToken,O.SyntaxKind.AmpersandAmpersandToken,O.SyntaxKind.QuestionQuestionToken,O.SyntaxKind.BarBarEqualsToken,O.SyntaxKind.AmpersandAmpersandEqualsToken,O.SyntaxKind.QuestionQuestionEqualsToken]),Vy=new Set([O.SyntaxKind.EqualsToken,O.SyntaxKind.BarBarEqualsToken,O.SyntaxKind.AmpersandAmpersandEqualsToken,O.SyntaxKind.QuestionQuestionEqualsToken]);function xt(e){switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${String(e.at)}-${String(e.end)}`;case"argument":return`a${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"call-receiver":return`r${String(e.at)}-${String(e.end)}`;case"mutated-by-call":return`m${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"source":return`s${e.model}`;case"shared":return`h${String(e.id)}`;default:return e.kind}}var tr=e=>e.kind==="local"||e.kind==="param"||e.kind==="receiver"||e.kind==="free";function qi(e){if(O.isIdentifier(e))return[];let n=[];for(let t of e.elements)O.isOmittedExpression(t)||(t.initializer!==void 0&&n.push(t),n.push(...qi(t.name)));return n}function Xy(e){return O.isWithStatement(e)||O.isCallExpression(e)&&O.isIdentifier(e.expression)&&e.expression.text==="eval"}function Mc(e,n,t,s,r){let i=[],o=(S,A,j)=>{for(let ne of S)for(let X of A)if(i.push({from:ne,to:X,kind:j}),i.length>Dc)throw new no},a=S=>S.getStart(t,!1),d=S=>({at:S.getStart(t,!1),end:S.getEnd()}),l=S=>r!==void 0&&er(r.program,r.checker,S),c=new Map,p=new Map,u=(S,A)=>{p.set(S,A);let j=c.get(S.text);j===void 0?c.set(S.text,[A]):j.push(A)},f=S=>{if(O.isIdentifier(S))return[S];let A=[];for(let j of S.elements)O.isOmittedExpression(j)||A.push(...f(j.name));return A},h=S=>({kind:"local",name:S.text,declStart:a(S)}),g=O.isSourceFile(e)?[]:e.parameters.filter(S=>!(O.isIdentifier(S.name)&&S.name.text==="this"));g.forEach((S,A)=>{if(O.isIdentifier(S.name))u(S.name,{kind:"param",index:A});else for(let j of f(S.name))u(j,h(j))});let y=S=>{for(let A=S.parent;A!==void 0&&A!==e;A=A.parent)if(Vt(A)&&!O.isArrowFunction(A))return!0;return!1},_=S=>{if(S!==e&&Vt(S)){if(n.has(S))return;for(let A of S.parameters)for(let j of f(A.name))u(j,h(j))}else if(O.isVariableDeclaration(S))for(let A of f(S.name))u(A,h(A));else if((O.isFunctionDeclaration(S)||O.isClassDeclaration(S))&&S.name!==void 0&&S!==e)u(S.name,h(S.name));else if(O.isCatchClause(S)&&S.variableDeclaration!==void 0)for(let A of f(S.variableDeclaration.name))u(A,h(A));O.forEachChild(S,_)},b=[];O.isSourceFile(e)?b.push(e):e.body!==void 0&&b.push(e.body);for(let S of g){S.initializer!==void 0&&b.push(S.initializer);for(let A of qi(S.name))A.initializer!==void 0&&b.push(A.initializer)}for(let S of b)_(S);let x=S=>r===void 0?{kind:"free",name:S.text}:{kind:"free",name:S.text,binding:Ac(r.program,r.checker,S)},k=S=>{if(r===void 0)return;let A;try{let D=S.parent;A=D!==void 0&&O.isShorthandPropertyAssignment(D)&&D.name===S?r.checker.getShorthandAssignmentValueSymbol(D):r.checker.getSymbolAtLocation(S)}catch{return}let j=A?.declarations??[];if(j.length===0)return;let ne=[],X=!1;for(let D of j){let $=O.getNameOfDeclaration(D),L=$===void 0?void 0:p.get($);L===void 0?X=!0:ne.push(L)}return X&&ne.push(x(S)),ne},w=S=>{if(S.text==="undefined")return[ys];if(S.text==="arguments")return[rn("reflective")];let A=k(S);return A!==void 0?A:c.get(S.text)??[x(S)]},I=S=>{if(n.has(S))return[];if(O.isArrowFunction(S)&&!O.isBlock(S.body))return[S.body];let A=[],j=ne=>{Vt(ne)||((O.isReturnStatement(ne)||O.isYieldExpression(ne))&&ne.expression!==void 0&&A.push(ne.expression),O.forEachChild(ne,j))};return S.body!==void 0&&O.forEachChild(S.body,j),A},N=S=>{if(O.isStringLiteral(S)||O.isNumericLiteral(S)||O.isBigIntLiteral(S)||O.isNoSubstitutionTemplateLiteral(S)||O.isRegularExpressionLiteral(S)||S.kind===O.SyntaxKind.TrueKeyword||S.kind===O.SyntaxKind.FalseKeyword||S.kind===O.SyntaxKind.NullKeyword||O.isVoidExpression(S)||O.isDeleteExpression(S))return[ys];if(O.isFunctionExpression(S)||O.isArrowFunction(S)||O.isClassExpression(S))return[rn("unmodeled")];if(O.isIdentifier(S))return w(S);if(S.kind===O.SyntaxKind.ThisKeyword)return y(S)||O.isSourceFile(e)?[rn("unmodeled")]:[{kind:"receiver"}];if(O.isParenthesizedExpression(S)||O.isAsExpression(S)||O.isNonNullExpression(S)||O.isTypeAssertionExpression(S)||O.isSatisfiesExpression(S)||O.isSpreadElement(S)||O.isTypeOfExpression(S)||O.isAwaitExpression(S))return N(S.expression);if(O.isYieldExpression(S))return[rn("unmodeled")];if(O.isPropertyAccessExpression(S)||O.isElementAccessExpression(S))return N(S.expression);if(O.isCallExpression(S)){if(O.isIdentifier(S.expression)&&S.expression.text==="require"){let A=S.arguments[0];return A!==void 0&&O.isStringLiteralLike(A)?[ys]:[rn("unmodeled")]}return S.expression.kind===O.SyntaxKind.ImportKeyword?[rn("unmodeled")]:[{kind:"call-result",...d(S)}]}if(O.isTaggedTemplateExpression(S))return[{kind:"call-result",...d(S)}];if(O.isNewExpression(S))return[rn("construct")];if(O.isConditionalExpression(S))return[...N(S.whenTrue),...N(S.whenFalse)];if(O.isBinaryExpression(S)){let A=S.operatorToken.kind;return A===O.SyntaxKind.CommaToken||A===O.SyntaxKind.EqualsToken?N(S.right):[...N(S.left),...N(S.right)]}return O.isPrefixUnaryExpression(S)||O.isPostfixUnaryExpression(S)?N(S.operand):O.isTemplateExpression(S)?S.templateSpans.flatMap(A=>N(A.expression)):O.isArrayLiteralExpression(S)?S.elements.length===0?[ys]:S.elements.flatMap(A=>N(A)):O.isObjectLiteralExpression(S)?S.properties.length===0?[ys]:S.properties.flatMap(A=>O.isPropertyAssignment(A)?N(A.initializer):O.isShorthandPropertyAssignment(A)?w(A.name):O.isSpreadAssignment(A)?N(A.expression):O.isSetAccessorDeclaration(A)?[ys]:[rn("unmodeled")]):[rn("unmodeled")]},v=S=>{if(O.isIdentifier(S))return w(S).filter(tr);if(S.kind===O.SyntaxKind.ThisKeyword)return N(S).filter(tr);if(O.isParenthesizedExpression(S)||O.isAsExpression(S)||O.isNonNullExpression(S)||O.isTypeAssertionExpression(S)||O.isSatisfiesExpression(S)||O.isSpreadElement(S)||O.isAwaitExpression(S)||O.isPropertyAccessExpression(S)||O.isElementAccessExpression(S))return v(S.expression);if(O.isConditionalExpression(S))return[...v(S.whenTrue),...v(S.whenFalse)];if(O.isBinaryExpression(S)){let A=S.operatorToken.kind;return A===O.SyntaxKind.CommaToken||A===O.SyntaxKind.EqualsToken?v(S.right):Gy.has(A)?[...v(S.left),...v(S.right)]:[]}if(O.isArrayLiteralExpression(S))return S.elements.flatMap(A=>v(A));if(O.isObjectLiteralExpression(S))return S.properties.flatMap(A=>O.isPropertyAssignment(A)?v(A.initializer):O.isShorthandPropertyAssignment(A)?w(A.name).filter(tr):O.isSpreadAssignment(A)?v(A.expression):O.isMethodDeclaration(A)||O.isGetAccessorDeclaration(A)?I(A).flatMap(j=>v(j)):[]);if(O.isCallExpression(S)||O.isNewExpression(S)||O.isTaggedTemplateExpression(S)){if(O.isCallExpression(S)&&Tc(S))return[];if(l(S))return[];let A=O.isTaggedTemplateExpression(S)?O.isTemplateExpression(S.template)?S.template.templateSpans.map(X=>X.expression):[]:[...S.arguments??[]],j=O.isTaggedTemplateExpression(S)?S.tag:S.expression;for(;O.isParenthesizedExpression(j);)j=j.expression;let ne=O.isPropertyAccessExpression(j)||O.isElementAccessExpression(j)?v(j.expression):v(j).filter(X=>X.kind!=="free");return[...A.flatMap(X=>l(X)?[]:v(X)),...ne]}return O.isFunctionExpression(S)||O.isArrowFunction(S)?I(S).flatMap(A=>v(A)):[]},C=S=>O.isIdentifier(S)?w(S):O.isParenthesizedExpression(S)||O.isNonNullExpression(S)||O.isAsExpression(S)||O.isSatisfiesExpression(S)||O.isTypeAssertionExpression(S)?C(S.expression):O.isPropertyAccessExpression(S)||O.isElementAccessExpression(S)?v(S.expression):O.isArrayLiteralExpression(S)?S.elements.flatMap(A=>C(A)):O.isObjectLiteralExpression(S)?S.properties.flatMap(A=>O.isShorthandPropertyAssignment(A)?w(A.name):O.isPropertyAssignment(A)?C(A.initializer):O.isSpreadAssignment(A)?C(A.expression):[]):O.isSpreadElement(S)?C(S.expression):O.isBinaryExpression(S)&&S.operatorToken.kind===O.SyntaxKind.EqualsToken?C(S.left):[],R=S=>O.isParenthesizedExpression(S)||O.isNonNullExpression(S)||O.isAsExpression(S)||O.isSatisfiesExpression(S)||O.isTypeAssertionExpression(S)||O.isSpreadElement(S)?R(S.expression):O.isPropertyAccessExpression(S)||O.isElementAccessExpression(S)?v(S.expression):O.isArrayLiteralExpression(S)?S.elements.flatMap(A=>R(A)):O.isObjectLiteralExpression(S)?S.properties.flatMap(A=>O.isPropertyAssignment(A)?R(A.initializer):O.isSpreadAssignment(A)?R(A.expression):[]):O.isBinaryExpression(S)&&S.operatorToken.kind===O.SyntaxKind.EqualsToken?R(S.left):[],F=S=>v(S).filter(A=>A.kind==="local"||A.kind==="param"||A.kind==="receiver"),P=new Map,U=new Map,E=S=>{let A=S;for(let j=P.get(A);j!==void 0&&j!==A;j=P.get(A))A=j;for(let j=S;j!==A;){let ne=P.get(j)??A;P.set(j,A),j=ne}return A},T=(S,A)=>{let j=xt(S),ne=xt(A);U.has(j)||(U.set(j,S),P.set(j,j)),U.has(ne)||(U.set(ne,A),P.set(ne,ne));let X=E(j),D=E(ne);X!==D&&P.set(X,D)},K=(S,A)=>{let j=S.filter(tr);if(j.length===0)return;let ne=v(A),X=ne[0];if(X!==void 0){for(let D of ne)T(X,D);for(let D of j)T(X,D)}},J=new Map,W=(S,A)=>{for(let j of S){if(!tr(j))continue;let ne=xt(j),X=J.get(ne);X===void 0&&(X=new Map,J.set(ne,X));for(let D of A)X.set(xt(D),D)}};g.forEach((S,A)=>{let j={kind:"param",index:A};if(S.initializer!==void 0&&(o(N(S.initializer),[j],"copy"),K([j],S.initializer)),!O.isIdentifier(S.name)){let ne=f(S.name).map(h);o([j],ne,"field");for(let X of ne)T(j,X);for(let X of qi(S.name)){if(X.initializer===void 0)continue;let D=f(X.name).map(h);o(N(X.initializer),D,"copy"),K(D,X.initializer)}}});let se=S=>{if(S!==e&&Vt(S)){if(n.has(S))return;let A=s.get(S);S.parameters.forEach((j,ne)=>{let X=A!==void 0&&ne===A.index?{kind:"source",sourceClass:A.model.sourceClass,model:A.model.id}:rn("inner-function-param");o([X],f(j.name).map(h),"copy")})}else if(O.isVariableDeclaration(S)&&S.initializer!==void 0){let A=f(S.name).map(h);o(N(S.initializer),A,O.isIdentifier(S.name)?"copy":"field"),K(A,S.initializer)}else if(O.isBindingElement(S)&&S.initializer!==void 0){let A=f(S.name).map(h);o(N(S.initializer),A,"copy"),K(A,S.initializer)}else if(O.isCatchClause(S)&&S.variableDeclaration!==void 0)o([rn("caught")],f(S.variableDeclaration.name).map(h),"copy");else if(O.isTryStatement(S)&&S.catchClause?.variableDeclaration!==void 0){let A=f(S.catchClause.variableDeclaration.name).map(h),j=[],ne=X=>{if(!n.has(X)){if(O.isThrowStatement(X))j.push(X.expression);else if(O.isCallExpression(X)||O.isNewExpression(X)){j.push(...X.arguments??[]);let D=X.expression;for(;O.isParenthesizedExpression(D);)D=D.expression;(O.isPropertyAccessExpression(D)||O.isElementAccessExpression(D))&&j.push(D.expression)}O.forEachChild(X,ne)}};ne(S.tryBlock);for(let X of j)l(X)||K(A,X)}else if((O.isFunctionDeclaration(S)||O.isClassDeclaration(S))&&S.name!==void 0&&S!==e)o([rn("unmodeled")],[h(S.name)],"copy");else if(O.isForOfStatement(S)||O.isForInStatement(S)){let A=S.initializer,j=O.isVariableDeclarationList(A)?A.declarations.flatMap(X=>f(X.name).map(h)):C(A),ne=N(S.expression);o(ne,j,"derive"),O.isVariableDeclarationList(A)||W(R(A),ne),O.isForOfStatement(S)&&K(j,S.expression)}else if(O.isBinaryExpression(S)&&Yy(S.operatorToken.kind)){let A=S.operatorToken.kind===O.SyntaxKind.EqualsToken?N(S.right):[...N(S.left),...N(S.right)],j=C(S.left);o(A,j,O.isIdentifier(S.left)?"copy":"field"),W(R(S.left),A),Vy.has(S.operatorToken.kind)&&K(j,S.right)}else if(O.isShorthandPropertyAssignment(S)&&S.objectAssignmentInitializer!==void 0){let A=w(S.name);o(N(S.objectAssignmentInitializer),A,"copy"),K(A,S.objectAssignmentInitializer)}else if(O.isReturnStatement(S)&&S.expression!==void 0&&$c(S)===e)o(N(S.expression),[{kind:"return"}],"return");else if(O.isYieldExpression(S)&&S.expression!==void 0&&$c(S)===e)o(N(S.expression),[{kind:"return"}],"return");else if(O.isCallExpression(S)&&!Tc(S)){let A=d(S);S.arguments.forEach(($,L)=>{if(o(N($),[{kind:"argument",...A,index:L}],"argument"),!l($)){let H={kind:"mutated-by-call",...A,index:L},z=F($);o([H],z,"mutation"),W(z,[H])}});let j=S.expression;for(;O.isParenthesizedExpression(j);)j=j.expression;let ne=O.isPropertyAccessExpression(j)||O.isElementAccessExpression(j)?j.expression:void 0,X=$=>$.kind==="receiver"?ne!==void 0?[ne]:[]:$.kind==="arg"?S.arguments.slice($.index,$.index+1):S.arguments.slice($.index),D=r!==void 0?Lc(S.expression,r):void 0;for(let $ of D?.summary?.mutates??[]){let L=[...X($.into),...$.from.flatMap(X)].filter(z=>!l(z)).flatMap(z=>v(z)),H=L[0];if(H!==void 0)for(let z of L)T(H,z)}if((O.isPropertyAccessExpression(j)||O.isElementAccessExpression(j))&&(o(N(j.expression),[{kind:"call-receiver",...A}],"argument"),!l(j.expression))){let $={kind:"mutated-by-call",...A,index:-1},L=F(j.expression);o([$],L,"mutation"),W(L,[$])}}else if(O.isNewExpression(S))for(let A of S.arguments??[]){if(l(A))continue;let j=F(A);o([rn("construct")],j,"mutation"),W(j,[rn("construct")])}O.forEachChild(S,se)},Y=()=>{let S=new Map,A=X=>{for(let D of X)D.kind==="local"&&S.set(xt(D),D)},j=X=>{let D=X.parent;D!==void 0&&D.name===X&&!O.isShorthandPropertyAssignment(D)||D!==void 0&&(O.isCallExpression(D)||O.isNewExpression(D)||O.isTaggedTemplateExpression(D))&&(O.isTaggedTemplateExpression(D)?D.tag:D.expression)===X||l(X)||A(k(X)??c.get(X.text)??[])},ne=(X,D)=>{let $=D||n.has(X);$&&O.isIdentifier(X)&&j(X),O.forEachChild(X,L=>{ne(L,$)})};ne(t,!1);for(let X of t.statements){let D=O.canHaveModifiers(X)&&(O.getModifiers(X)??[]).some($=>$.kind===O.SyntaxKind.ExportKeyword);if(D&&O.isVariableStatement(X))for(let $ of X.declarationList.declarations)A(f($.name).map(h));else if(D&&(O.isFunctionDeclaration(X)||O.isClassDeclaration(X))&&X.name!==void 0)A([h(X.name)]);else if(O.isExportDeclaration(X)&&X.moduleSpecifier===void 0&&X.exportClause!==void 0&&O.isNamedExports(X.exportClause))for(let $ of X.exportClause.elements)A(c.get(($.propertyName??$.name).text)??[]);else O.isExportAssignment(X)&&A(v(X.expression))}return[...S.values()]},V=()=>{let S=!1,A=j=>{if(!S&&!(j!==e&&n.has(j)&&!O.isSourceFile(e))){if(Xy(j)){S=!0;return}O.forEachChild(j,A)}};for(let j of b)A(j);return S},fe=()=>{let S=new Map;for(let[j,ne]of U){let X=E(j),D=S.get(X);D===void 0?S.set(X,[ne]):D.push(ne)}let A=0;for(let j of S.values()){if(j.length<2)continue;let ne=new Map;for(let D of j)for(let[$,L]of J.get(xt(D))??[])ne.set($,L);for(let D of j)D.kind==="free"&&ne.set(xt(D),D);if(ne.size>0){let D={kind:"shared",id:A};A+=1,o([...ne.values()],[D],"mutation"),o([D],j.filter($=>$.kind!=="free"),"mutation")}let X=j.filter(D=>D.kind==="param"||D.kind==="receiver");if(X.length>=2)for(let D of X)o(X.filter($=>xt($)!==xt(D)),[D],"mutation")}};try{for(let S of b)se(S);if(!O.isSourceFile(e)&&O.isArrowFunction(e)&&!O.isBlock(e.body)&&o(N(e.body),[{kind:"return"}],"return"),O.isSourceFile(e)){let S=Y();o([rn("unmodeled")],S,"mutation"),W(S,[rn("unmodeled")])}if(V()){let S=[...c.values()].flat(),A=g.map((ne,X)=>({kind:"param",index:X})),j=O.isSourceFile(e)?[]:[{kind:"receiver"}];o([rn("reflective")],[...S,...A,...j],"mutation")}fe()}catch(S){if(S instanceof no)return;throw S}return i}function Yy(e){return e>=O.SyntaxKind.FirstAssignment&&e<=O.SyntaxKind.LastAssignment}function Tc(e){return O.isIdentifier(e.expression)&&e.expression.text==="require"||e.expression.kind===O.SyntaxKind.ImportKeyword}function $c(e){for(let n=e.parent;n!==void 0;n=n.parent)if(Vt(n))return n}import ce from"typescript";var Bc=4,Jy=[{id:"express-async-handler@1-forwarder-v1",package:"express-async-handler",versions:"0.0.1 - 1.2.0: all 13 published versions, read 2026-09-24",shape:{param:0,arity:[3,0],passes:3},evidence:"index.js, 1.1.4 and 1.2.0 (npm dist.shasum 225a84908df63b35ae9df94b6f0f1af061266426, ffc9896061d90f8d2e71a2d2b8668db5b0934391): `const asyncUtil = fn => function asyncUtilWrap(...args) { const fnReturn = fn(...args) ...`, `module.exports = asyncUtil`. 0.0.1-1.0.2: `(req, res, next) => ... fn(req, res, next)`; 1.0.3-1.1.3: `(req, res, next, ...args)` calling `fn(req, res, next, ...args)` (1.1.0 on both branches of `fn instanceof Promise`). https://github.com/Abazhenov/express-async-handler"}];function Kc(e){return Jy.find(n=>n.package===e)}var Zy=8;function zc(e){if(!(ce.isFunctionDeclaration(e)||ce.isFunctionExpression(e)||ce.isArrowFunction(e)||ce.isMethodDeclaration(e))||e.body===void 0||Qy(e)||!ce.isArrowFunction(e)&&e.asteriskToken!==void 0||ce.canHaveDecorators(e)&&(ce.getDecorators(e)??[]).length>0||n_(e))return null;let n=t_(e);if(n===null||ce.isFunctionExpression(n)&&n.asteriskToken!==void 0)return null;let t=e_(n);if(t===null||t.length===0)return null;let s=t.map(f=>f.text),r=new Set(s),i=new Map,o=Uc(e);for(let f=0;f<o.length;f+=1){let h=o[f];if(h===void 0)continue;let g=h.name;if(ce.isIdentifier(g)){if(i.has(g.text))return null;h.dotDotDotToken!==void 0||h.initializer!==void 0||r.has(g.text)||i.set(g.text,{index:f,decl:g})}}let a=[...s_(n,i,s)],d=a[0];if(a.length!==1||d===void 0||d[1].length>Zy)return null;let[l,c]=d,p=i.get(l);if(p===void 0)return null;let u=0;for(let f of c)r_(f,n)&&(u=Math.max(u,f.arguments.length));return u===0||!jc(e,new Map([[l,p.decl]]))||!jc(n,new Map(t.slice(0,u).map(f=>[f.text,f])))?null:{param:p.index,arity:[t.length],passes:u}}function Uc(e){return e.parameters.filter(n=>!(ce.isIdentifier(n.name)&&n.name.text==="this"))}function Qy(e){return ce.canHaveModifiers(e)&&(ce.getModifiers(e)??[]).some(n=>n.kind===ce.SyntaxKind.AsyncKeyword)}function e_(e){let n=[],t=new Set;for(let s of Uc(e)){let r=s.name;if(!ce.isIdentifier(r)||s.dotDotDotToken!==void 0||s.initializer!==void 0||t.has(r.text))return null;t.add(r.text),n.push(r)}return n}function n_(e){let n=!1,t=s=>{n||((ce.isWithStatement(s)||ce.isIdentifier(s)&&(s.text==="arguments"||s.text==="eval")&&!qc(s))&&(n=!0),ce.forEachChild(s,t))};return ce.forEachChild(e,t),n}function t_(e){let n=e.body;if(n===void 0)return null;let t=o=>{if(o===void 0)return null;let a=Ze(o);return ce.isArrowFunction(a)||ce.isFunctionExpression(a)?a:null};if(!ce.isBlock(n))return t(n);let s=[],r=o=>{ce.isFunctionLike(o)||ce.isClassLike(o)||(ce.isReturnStatement(o)&&s.push(o),ce.forEachChild(o,r))};ce.forEachChild(n,r);let i=s[0];return s.length!==1||i===void 0||i.parent!==n?null:t(i.expression)}function s_(e,n,t){let s=new Map,r=o=>{if(ce.isCallExpression(o)&&ce.isIdentifier(o.expression)&&n.has(o.expression.text)&&o.questionDotToken===void 0&&o.arguments.length>0&&o.arguments.length<=t.length&&o.arguments.every((a,d)=>ce.isIdentifier(a)&&a.text===t[d])){let a=s.get(o.expression.text);a===void 0?s.set(o.expression.text,[o]):a.push(o)}ce.forEachChild(o,r)},i=e.body;return ce.isBlock(i)?ce.forEachChild(i,r):r(i),s}function r_(e,n){let t=e;for(;;){let s=t.parent;if(s===n)return ce.isArrowFunction(n)&&n.body===t;if(ce.isParenthesizedExpression(s)||ce.isAwaitExpression(s)||ce.isAsExpression(s)||ce.isNonNullExpression(s)||ce.isSatisfiesExpression(s)||ce.isTypeAssertionExpression(s)){t=s;continue}if((ce.isPropertyAccessExpression(s)||ce.isElementAccessExpression(s))&&s.expression===t){t=s;continue}if(ce.isCallExpression(s)){if(s.expression===t){t=s;continue}if(!ce.isOptionalChain(s)&&s.arguments.some(r=>r===t)){t=s;continue}return!1}if(ce.isVariableDeclaration(s)&&s.initializer===t){let i=s.parent.parent;return ce.isVariableStatement(i)&&Fc(i,n)}return(ce.isExpressionStatement(s)||ce.isReturnStatement(s))&&s.expression===t?Fc(s,n):!1}}function Fc(e,n){let t=e;for(;;){let s=t.parent;if(!ce.isBlock(s))return!1;for(let i of s.statements){if(i===t)break;if(!(ce.isExpressionStatement(i)||ce.isVariableStatement(i)||ce.isEmptyStatement(i)))return!1}if(s===n.body)return!0;let r=s.parent;if(!ce.isTryStatement(r)||r.tryBlock!==s)return!1;t=r}}function jc(e,n){let t=!0,s=r=>{if(t){if(ce.isIdentifier(r)){let i=n.get(r.text);i!==void 0&&r!==i&&!qc(r)&&!o_(r)&&(t=!1)}ce.forEachChild(r,s)}};return ce.forEachChild(e,s),t}function o_(e){let n=e.parent;return ce.isCallExpression(n)&&(n.expression===e||n.arguments.some(t=>t===e))||ce.isNewExpression(n)&&(n.arguments??[]).some(t=>t===e)||ce.isTypeOfExpression(n)||(ce.isPropertyAccessExpression(n)||ce.isElementAccessExpression(n))&&n.expression===e}function qc(e){let n=e.parent;return(ce.isPropertyAccessExpression(n)||ce.isPropertyAssignment(n)||ce.isMethodDeclaration(n)||ce.isPropertyDeclaration(n)||ce.isGetAccessorDeclaration(n)||ce.isSetAccessorDeclaration(n))&&n.name===e||ce.isBindingElement(n)&&n.propertyName===e}function Hc(e,n,t){let s=null,r=i=>{if(s!==null)return;let o=i.getStart(e,!1),a=i.getEnd();if(o===n&&a===t){if(ce.isVariableDeclaration(i)&&i.initializer!==void 0){let d=Ze(i.initializer);s=ce.isArrowFunction(d)||ce.isFunctionExpression(d)?d:null}else(ce.isFunctionDeclaration(i)||ce.isFunctionExpression(i)||ce.isArrowFunction(i)||ce.isMethodDeclaration(i))&&(s=i);if(s!==null)return}i.pos<=n&&a>=t&&ce.forEachChild(i,r)};return r(e),s}var Gc=3;function $e(e,n,t){if(e===void 0)return;let s=e[n]??={fired:0,refused:{}};t===null?s.fired+=1:s.refused[t]=(s.refused[t]??0)+1}function ot(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var so=16,Yi=256,Gi=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let s=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(s)||(this.moduleFor(n),this.fns.set(s,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let s=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(s)||(this.moduleFor(n),this.classNodes.set(s,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(s,[])),r}methodFor(n,t,s,r){let i=`${n}#${t}.${s}`,o=`pkg:${n}#${t}.${s}`;if(!this.fns.has(i)){let a=this.classFor(n,t);this.fns.set(i,{id:o,moduleId:`pkg:${n}`,name:s,kind:r,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(o)}return o}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function tu(e,n){let t="node_modules/",s=e.lastIndexOf(t);if(s===-1)return n;let i=e.slice(s+t.length).split("/");return i[0]?.startsWith("@")&&i.length>=2?`${i[0]}/${i[1]}`:i[0]??n}function Vc(e,n,t){let s=kn.dirname(e),r=kn.dirname(n),i=[];for(;;){let a=t.get(s);if(a!==void 0){for(let l of i)t.set(l,a);return a}i.push(s);let d=on(kn.join(s,"package.json"));if(d!==null)try{let l=JSON.parse(d),c={name:l.name??"app",version:l.version??"0.0.0",dir:s};for(let p of i)t.set(p,c);return c}catch{}if(s===r||s===kn.dirname(s))break;s=kn.dirname(s)}let o={name:"app",version:"0.0.0",dir:null};for(let a of i)t.set(a,o);return o}function Vi(e){return m.isParenthesizedExpression(e)?Vi(e.expression):m.isStringLiteralLike(e)?e.text:m.isTemplateExpression(e)?e.head.text:m.isBinaryExpression(e)&&e.operatorToken.kind===m.SyntaxKind.PlusToken?Vi(e.left):null}function i_(e){if(!m.isCallExpression(e))return!1;let n=e.expression,t=m.isPropertyAccessExpression(n)?n.name.text:m.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let s=e.arguments[0];return s!==void 0&&m.isIdentifier(s)&&(s.text==="__dirname"||s.text==="__filename")}function su(e){let n=Vi(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":i_(e)?"relative-bounded":"unknown"}function a_(e){let n=[],t=s=>{if(m.isImportDeclaration(s)&&m.isStringLiteralLike(s.moduleSpecifier))n.push({specifier:s.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(m.isImportEqualsDeclaration(s)&&m.isExternalModuleReference(s.moduleReference)&&m.isStringLiteralLike(s.moduleReference.expression))n.push({specifier:s.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(m.isExportDeclaration(s)&&s.moduleSpecifier!==void 0&&m.isStringLiteralLike(s.moduleSpecifier))n.push({specifier:s.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(m.isCallExpression(s)){let r=Qs(s);if(r!==null){let i=r.specifierArg,o=i!==void 0&&m.isStringLiteralLike(i);n.push({specifier:o?i.text:void 0,specifierIsLiteral:o,dynamic:!0,...i!==void 0&&!o?{computedArg:i,loadPos:s.getStart(e)}:{}})}}m.forEachChild(s,t)};return t(e),n}function l_(e,n,t){let s=new Map,r=Vc(kn.join(e.appRoot,"package.json"),e.appRoot,s),i=[],o=[],a=[],d=new Map,l=new Set,c=[],p=new Set;for(let u of e.sourceFiles){let f=e.toRel(u.fileName);f!==null&&p.add(f)}for(let u of e.sourceFiles){let f=e.toRel(u.fileName);if(f===null)continue;let h=Vc(u.fileName,e.appRoot,s),g=tu(f,r.name),y=f.includes("node_modules/");i.push({id:f,packageName:y&&h.name!==r.name?h.name:g,versionRange:h.version,path:f,moduleSystem:"cjs",isEntrypoint:n.has(f)}),h.dir===r.dir&&l.add(f);let _=0,b=null;for(let x of a_(u)){let k=`${f}#import${String(_)}`;_+=1;let w=null,I=[];if(x.specifier!==void 0)if(We(x.specifier)==="package-root")w=t.moduleFor(Pn(x.specifier));else{let N=Cn(x.specifier,u.fileName,e.options,e.host),v=N!==null?e.toRel(N):null;if(v!==null)w=v;else if(x.specifier!==void 0){let[C,...R]=hs(x.specifier,u.fileName,e.options,e.host).map(F=>e.toRel(F)).filter(F=>F!==null&&p.has(F));C!==void 0&&R.length>=1&&(w=C,I=R.map(F=>F))}}o.push({id:k,moduleId:f,specifier:x.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:x.dynamic,specifierIsLiteral:x.specifierIsLiteral,...w!==null?{resolvedModuleId:w}:{}}),w!==null&&a.push({importId:k,resolvedModuleId:w});for(let N of I)a.push({importId:k,resolvedModuleId:N});if(x.computedArg!==void 0&&x.loadPos!==void 0&&c.push({importId:String(k),path:f,pos:x.loadPos,shape:su(x.computedArg),text:x.computedArg.getText(u).slice(0,160)}),x.computedArg!==void 0&&x.loadPos!==void 0){b??=Ht(u,u.fileName,e.resolveParamDirs);let N=[];for(let v of Hr(x.computedArg,b,e.appRoot,e.options,e.host)){let C=e.toRel(v);if(C===null||!p.has(C))continue;let R=C,F=`${f}#import${String(_)}`;_+=1,o.push({id:F,moduleId:f,specifier:C,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:R}),a.push({importId:F,resolvedModuleId:R}),N.push(C)}if(N.length>0){let v=Ys(x.computedArg,b)!==null||qr(x.computedArg),C=d.get(f)??[];C.push({pos:x.loadPos,candidateRels:N,seedable:v}),d.set(f,C)}}}}return{modules:i,imports:o,importEdges:a,computedLoads:d,appOwnedPaths:l,loadSites:c}}function d_(e){let n=on(e);if(n===null)return null;let t=m.createSourceFile(e,n,m.ScriptTarget.Latest,!0),s=r=>t.statements.some(i=>m.isFunctionDeclaration(i)?i.name?.text===r:m.isVariableStatement(i)?i.declarationList.declarations.some(o=>m.isIdentifier(o.name)&&o.name.text===r&&o.initializer!==void 0&&(m.isFunctionExpression(o.initializer)||m.isArrowFunction(o.initializer))):!1);for(let r of t.statements){if(m.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(o=>o.kind===m.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!m.isExpressionStatement(r)||!m.isBinaryExpression(r.expression))continue;let i=r.expression;if(i.operatorToken.kind===m.SyntaxKind.EqualsToken&&c_(i.left)){if(m.isFunctionExpression(i.right)&&i.right.name!==void 0)return i.right.name.text;if(m.isIdentifier(i.right)&&s(i.right.text))return i.right.text}}return null}function c_(e){return m.isPropertyAccessExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:m.isElementAccessExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="module"&&m.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function u_(e,n,t){for(let l of e.surfacePackages)n.moduleFor(l);let s=l=>"surface"in l?n.moduleFor(l.surface):l.module,r=[],i=new Set;for(let l of e.modules)t.has(l)||i.has(l)||(i.add(l),r.push({id:l,packageName:e.entryRealNames[l]??tu(l,"app"),versionRange:"",path:l,moduleSystem:"cjs",isEntrypoint:!1}));let o=[],a=[],d=0;for(let l of e.edges){let c=s(l.from),p=s(l.to),u=`${String(c)}#depreach${String(d)}`;d+=1,o.push({id:u,moduleId:c,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),a.push({importId:u,resolvedModuleId:p})}return{modules:r,imports:o,importEdges:a}}function Xc(e,n,t){let s=e.expression;if(m.isIdentifier(s)&&!t.has(s.text)){let r=n.get(s.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(m.isPropertyAccessExpression(s)&&m.isIdentifier(s.expression)&&!t.has(s.expression.text)){let r=n.get(s.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:s.name.text}}return null}function Xt(e){return m.canHaveModifiers(e)&&(m.getModifiers(e)?.some(n=>n.kind===m.SyntaxKind.ExportKeyword)??!1)}function f_(e){let n=new Set,t;for(let s of e.statements){if(m.isExpressionStatement(s)&&m.isBinaryExpression(s.expression)){let r=s.expression;if(r.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isPropertyAccessExpression(r.left)&&m.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(m.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(m.isObjectLiteralExpression(r.right))for(let i of r.right.properties)m.isShorthandPropertyAssignment(i)?n.add(i.name.text):m.isPropertyAssignment(i)&&m.isIdentifier(i.initializer)&&n.add(i.initializer.text)}continue}if(m.isFunctionDeclaration(s)&&s.name!==void 0&&Xt(s))n.add(s.name.text);else if(m.isVariableStatement(s)&&Xt(s))for(let r of s.declarationList.declarations)m.isIdentifier(r.name)&&n.add(r.name.text);else if(m.isExportDeclaration(s)&&s.exportClause&&m.isNamedExports(s.exportClause))for(let r of s.exportClause.elements)n.add((r.propertyName??r.name).text);else m.isExportAssignment(s)&&m.isIdentifier(s.expression)&&(n.add(s.expression.text),t=s.expression.text)}return{reachableLocals:n,defaultTarget:t}}function p_(e){for(let n of e.statements){if(m.isFunctionDeclaration(n)&&n.name!==void 0&&Xt(n)&&m.getModifiers(n)?.some(t=>t.kind===m.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(m.isExportAssignment(n)&&!n.isExportEquals&&m.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(m.isExpressionStatement(n)&&m.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===m.SyntaxKind.EqualsToken&&gn(t.left)&&m.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function it(e){if(m.isCallExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&m.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function gn(e){return m.isPropertyAccessExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:m.isElementAccessExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="module"&&m.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Gn(e){if(gn(e))return!0;if(!m.isPropertyAccessExpression(e)&&!m.isElementAccessExpression(e))return!1;let n=e.expression;return m.isIdentifier(n)&&n.text==="exports"?!0:gn(n)}function xs(e){return m.isPropertyAccessExpression(e.expression)&&m.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ru(e){let n=!1,t=s=>{if(!n){if(m.isCallExpression(s)){let r=it(s);if(r!==void 0&&We(r)!=="package-root"){n=!0;return}}m.forEachChild(s,t)}};return t(e),n}function ou(e){let n=new Set,t=r=>r!==void 0&&ru(r),s=r=>{m.isVariableDeclaration(r)&&t(r.initializer)&&Xs(r.name,n),m.isBinaryExpression(r)&&r.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),m.forEachChild(r,s)};return s(e),n}function iu(e,n){for(let t of e.properties)m.isShorthandPropertyAssignment(t)?n.add(t.name.text):m.isPropertyAssignment(t)&&m.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function m_(e){let n=new Set;for(let a of e.statements)if(m.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(m.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(m.isVariableStatement(a))for(let d of a.declarationList.declarations)m.isIdentifier(d.name)&&d.initializer!==void 0&&(m.isFunctionExpression(d.initializer)||m.isArrowFunction(d.initializer)||m.isObjectLiteralExpression(d.initializer))&&n.add(d.name.text);let t=a=>m.isFunctionExpression(a)||m.isArrowFunction(a)||m.isObjectLiteralExpression(a)||m.isIdentifier(a)&&n.has(a.text),s=new Set,r=a=>{m.isIdentifier(a)?s.add(a.text):m.isObjectLiteralExpression(a)&&iu(a,s)},i=!1,o=a=>{if(!i){if(m.isBinaryExpression(a)&&a.operatorToken.kind===m.SyntaxKind.EqualsToken)if(gn(a.left)){r(a.right);let d=a.right;(m.isObjectLiteralExpression(d)?d.properties.every(c=>m.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||m.isPropertyAssignment(c)&&t(c.initializer)):t(d))||(i=!0)}else Gn(a.left)&&(t(a.right)||(i=!0));else(m.isCallExpression(a)&&xs(a)&&a.arguments[0]!==void 0&&Yt(a.arguments[0])||m.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(i=!0);i||m.forEachChild(a,o)}};if(o(e),!i&&s.size>0){for(let a of cu(e))if(s.has(a)){i=!0;break}}return i}function Yt(e){return Gn(e)||m.isIdentifier(e)&&e.text==="exports"}function au(e){if(!m.isPropertyAccessExpression(e.expression)||!m.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Ji(e){return au(e)&&e.arguments[0]!==void 0&&Yt(e.arguments[0])}function h_(e){return au(e)&&e.arguments[0]!==void 0&&m.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function g_(e){for(let n of e.declarations??[])if(m.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(m.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(m.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(m.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function y_(e,n,t,s,r){let i=(e.declarations??[]).filter(a=>!m.isSourceFile(a)&&!m.isModuleDeclaration(a));for(let a of i){let d=a.getSourceFile(),l=n.toRel(d.fileName);if(l===null||r.has(l))continue;let c=t.get(`${l}::${String(a.getStart(d,!1))}`);if(c!==void 0)return c}let o=e.getName();for(let a of i){let d=n.toRel(a.getSourceFile().fileName);if(d===null||r.has(d))continue;let l=s.get(`${d}::${o}`);if(l!==void 0)return l}}function ro(e){return m.isPropertyAccessExpression(e)?e.name.text:m.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Zi=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Qi(e){let n=m.isPropertyAccessExpression(e)||m.isElementAccessExpression(e)?ro(e):void 0;return n!==void 0&&n!=="__proto__"&&Zi.test(n)?n:void 0}function __(e){return e!=="__proto__"&&Zi.test(e)}function Yc(e){let n=Xe(e);return m.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||gn(n)}function x_(e){if(!m.isArrayLiteralExpression(e)&&!m.isObjectLiteralExpression(e))return!1;let n=!1,t=s=>{n||(Gn(s)?n=!0:m.forEachChild(s,t))};return t(e),n}function ea(e){let n=!1,t=new Map,s=r=>{if(!n){if(m.isBinaryExpression(r)&&r.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=m.SyntaxKind.LastAssignment){if(gn(r.left)||m.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===m.SyntaxKind.EqualsToken&&Yc(r.right))n=!0;else if(x_(r.left))n=!0;else if(Gn(r.left)){let i=Qi(r.left);i===void 0?n=!0:t.set(i,(t.get(i)??0)+1)}}else(m.isCallExpression(r)&&xs(r)&&r.arguments[0]!==void 0&&Yt(r.arguments[0])||m.isCallExpression(r)&&Ji(r)||m.isCallExpression(r)&&h_(r)||m.isVariableDeclaration(r)&&r.initializer!==void 0&&Yc(r.initializer))&&(n=!0);n||m.forEachChild(r,s)}};return s(e),{surfaceEscapes:n,assignCount:t}}function na(e){let n=[];for(let t of e.statements){if(!m.isExpressionStatement(t)||!m.isBinaryExpression(t.expression))continue;let s=t.expression;s.operatorToken.kind===m.SyntaxKind.EqualsToken&&(!Gn(s.left)||gn(s.left)||n.push({bin:s,name:Qi(s.left)}))}return n}function b_(e){let{surfaceEscapes:n,assignCount:t}=ea(e);if(n)return[];let s=[];for(let{bin:r,name:i}of na(e))i===void 0||(t.get(i)??0)!==1||(m.isFunctionExpression(r.right)||m.isArrowFunction(r.right))&&s.push({name:i,value:r.right});return s}function S_(e,n){let{surfaceEscapes:t,assignCount:s}=ea(e);if(t)return[];let r=[];for(let{bin:i,name:o}of na(e))o===void 0||(s.get(o)??0)!==1||m.isIdentifier(i.right)&&!n.has(i.right.text)&&r.push(i.right.text);return r}function k_(e,n){let{surfaceEscapes:t,assignCount:s}=ea(e);for(let{bin:r,name:i}of na(e)){let o=r.right;if(!(m.isFunctionExpression(o)||m.isArrowFunction(o)||m.isIdentifier(o)))continue;let d=m.isFunctionExpression(o)||m.isArrowFunction(o)||m.isIdentifier(o)&&!n.has(o.text);if(!(!t&&i!==void 0&&(s.get(i)??0)===1&&d))return!0}return!1}function w_(e){let n=m.isPropertyAccessExpression(e)||m.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&m.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Jc(e){let n=e.parent;return n===void 0?!1:m.isPropertyAccessExpression(n)?n.name===e:m.isQualifiedName(n)?n.right===e:m.isBindingElement(n)||m.isImportSpecifier(n)?n.propertyName===e:m.isExportSpecifier(n)?!0:m.isPropertyAssignment(n)||m.isPropertyDeclaration(n)||m.isPropertySignature(n)||m.isMethodDeclaration(n)||m.isMethodSignature(n)||m.isGetAccessorDeclaration(n)||m.isSetAccessorDeclaration(n)||m.isEnumMember(n)?n.name===e:!1}function Zc(e){for(let n=e.parent;n!==void 0;n=n.parent){if(m.isSourceFile(n))return!0;if(!m.isArrowFunction(n)&&(m.isFunctionLike(n)||m.isClassLike(n)))return!1}return!0}function v_(e,n){let t=s=>{m.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&n.add(s),m.forEachChild(s,t)};t(e)}function E_(e){let n=[],t=new Set;for(let i of e.statements){if(m.isExportDeclaration(i)||m.isExportAssignment(i)||m.isImportDeclaration(i)||m.isImportEqualsDeclaration(i)||Xt(i))return null;if(!m.isExpressionStatement(i)||!m.isBinaryExpression(i.expression))continue;let o=i.expression;if(o.operatorToken.kind===m.SyntaxKind.EqualsToken){if(gn(o.left))n.push({kind:"whole",value:o.right});else if(Gn(o.left)){let a=Qi(o.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:o.right,root:w_(o.left)})}else continue;v_(o.left,t)}}let s=!1,r=i=>{if(!s){if(m.isIdentifier(i)&&(i.text==="exports"||i.text==="module")&&!t.has(i)&&!Jc(i)){s=!0;return}if(i.kind===m.SyntaxKind.ThisKeyword&&Zc(i)){s=!0;return}if(m.isIdentifier(i)&&i.text==="arguments"&&!Jc(i)&&Zc(i)){s=!0;return}m.forEachChild(i,r)}};return r(e),s?null:n}function Xi(e){return m.isIdentifier(e)||m.isStringLiteralLike(e)?e.text:void 0}function Qc(e,n,t){return m.isIdentifier(e)?n(e.text):t?.(e)}function N_(e,n,t,s){let r=new Map,i=E_(e);if(i===null||i.filter(f=>f.kind==="whole").length>1)return r;let o=i.findIndex(f=>f.kind==="whole"),a=(f,h)=>o>=0&&h>o&&f.kind==="member"&&f.root==="exports",d=i.some(a);if(d){let f=i[o];if(f===void 0||f.kind!=="whole"||!m.isObjectLiteralExpression(f.value))return r}let l=d?i.filter((f,h)=>!a(f,h)):i,c=new Map;for(let f of l)f.kind==="member"&&c.set(f.name,(c.get(f.name)??0)+1);let p=f=>n.has(f)?void 0:t(f),u=(f,h)=>{h===void 0?r.delete(f):r.set(f,h)};for(let f of l){if(f.kind==="member"){u(f.name,(c.get(f.name)??0)>1?void 0:Qc(f.value,p,s));continue}r.clear();let h=f.value;if(m.isObjectLiteralExpression(h))for(let g of h.properties){if(m.isSpreadAssignment(g))return new Map;if(m.isShorthandPropertyAssignment(g)){u(g.name.text,p(g.name.text));continue}let y=Xi(g.name);if(y===void 0)return new Map;u(y,m.isPropertyAssignment(g)?Qc(g.initializer,p,s):void 0)}}return r}function lu(e,n,t,s){let r=new Map,i=a=>a!==void 0&&We(a)==="relative"?t.get(`${n}::${a}`):void 0,o=a=>{if(m.isVariableDeclaration(a)&&a.initializer!==void 0){let d=a.initializer;if(m.isIdentifier(a.name)&&!s.has(a.name.text)){let l=i(it(d));if(l!==void 0)r.set(a.name.text,{kind:"whole",target:l});else if((m.isPropertyAccessExpression(d)||m.isElementAccessExpression(d))&&m.isCallExpression(d.expression)){let c=i(it(d.expression)),p=ro(d);c!==void 0&&p!==void 0&&r.set(a.name.text,{kind:"member",target:c,member:p})}}else if(m.isObjectBindingPattern(a.name)){let l=i(it(d));if(l!==void 0){for(let c of a.name.elements)if(m.isIdentifier(c.name)&&!s.has(c.name.text)){let p=c.propertyName!==void 0&&m.isIdentifier(c.propertyName)?c.propertyName.text:c.name.text;r.set(c.name.text,{kind:"member",target:l,member:p})}}}}m.forEachChild(a,o)};return o(e),r}function A_(e,n,t,s){let r=o=>o!==void 0&&We(o)==="relative"?t.get(`${n}::${o}`):void 0,i=r(it(e));if(i!==void 0)return{kind:"whole",target:i};if(m.isPropertyAccessExpression(e)||m.isElementAccessExpression(e)){let o=ro(e);if(o===void 0)return;let a=r(it(e.expression));if(a!==void 0)return{kind:"member",target:a,member:o};if(m.isIdentifier(e.expression)){let d=s.get(e.expression.text);if(d?.kind==="whole")return{kind:"member",target:d.target,member:o}}return}if(m.isIdentifier(e))return s.get(e.text)}function du(e,n,t,s,r){let i=[],o=!1,a=p=>{if(ru(p))return!0;let u=!1,f=h=>{u||(m.isIdentifier(h)&&r.has(h.text)?u=!0:m.forEachChild(h,f))};return f(p),u},d=(p,u)=>{let f=A_(p,n,t,s);f!==void 0?i.push({source:f,exportedName:u}):a(p)&&(o=!0)},l=p=>{if(m.isObjectLiteralExpression(p)){for(let u of p.properties)if(m.isSpreadAssignment(u))d(u.expression,"default");else if(m.isPropertyAssignment(u)){let f=m.isIdentifier(u.name)||m.isStringLiteralLike(u.name)?u.name.text:"default";d(u.initializer,f)}else if(m.isShorthandPropertyAssignment(u)){let f=s.get(u.name.text);f!==void 0&&i.push({source:f,exportedName:u.name.text})}return}d(p,"default")},c=p=>{if(m.isBinaryExpression(p)&&p.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=m.SyntaxKind.LastAssignment){if(gn(p.left)){l(p.right);return}if(Gn(p.left)){let u=m.isPropertyAccessExpression(p.left)?p.left.name.text:m.isElementAccessExpression(p.left)&&m.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";d(p.right,u);return}}else if(m.isExportAssignment(p)&&p.isExportEquals){d(p.expression,"default");return}else if(m.isCallExpression(p)&&xs(p)&&p.arguments[0]!==void 0&&Yt(p.arguments[0])){for(let u of p.arguments.slice(1))l(u);return}m.forEachChild(p,c)};return c(e),{sources:i,residual:o}}function cu(e){let n=new Set,t=r=>{let i=r;for(;m.isPropertyAccessExpression(i)||m.isElementAccessExpression(i);)i=i.expression;return m.isIdentifier(i)?i.text:void 0},s=r=>{let i=uu(r);if(i!==void 0){let o=t(i);o!==void 0&&n.add(o)}m.forEachChild(r,s)};return s(e),n}function uu(e){return m.isBinaryExpression(e)&&e.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=m.SyntaxKind.LastAssignment&&(m.isPropertyAccessExpression(e.left)||m.isElementAccessExpression(e.left))?e.left:void 0}function to(e){if(m.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)m.isBindingElement(t)&&n.push(...to(t.name));return n}function hn(e){if(m.isIdentifier(e))return[e.text];if(m.isParenthesizedExpression(e)||m.isAsExpression(e)||m.isNonNullExpression(e)||m.isSatisfiesExpression(e)||m.isTypeAssertionExpression(e)||m.isAwaitExpression(e))return hn(e.expression);if(m.isYieldExpression(e))return e.expression!==void 0?hn(e.expression):[];if(m.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===m.SyntaxKind.BarBarToken||n===m.SyntaxKind.AmpersandAmpersandToken||n===m.SyntaxKind.QuestionQuestionToken?[...hn(e.left),...hn(e.right)]:n===m.SyntaxKind.CommaToken?hn(e.right):[]}return m.isConditionalExpression(e)?[...hn(e.whenTrue),...hn(e.whenFalse)]:m.isArrayLiteralExpression(e)?e.elements.flatMap(n=>m.isSpreadElement(n)?hn(n.expression):m.isOmittedExpression(n)?[]:hn(n)):m.isObjectLiteralExpression(e)?e.properties.flatMap(n=>m.isShorthandPropertyAssignment(n)?[n.name.text]:m.isPropertyAssignment(n)?hn(n.initializer):m.isSpreadAssignment(n)?hn(n.expression):[]):[]}function fu(e,n){let t=[],s=(a,d)=>{for(let l of a)for(let c of d)l!==c&&t.push({a:l,b:c})},r=a=>m.isIdentifier(a)?[a.text]:m.isArrayLiteralExpression(a)?a.elements.flatMap(r):m.isObjectLiteralExpression(a)?a.properties.flatMap(d=>m.isShorthandPropertyAssignment(d)?[d.name.text]:m.isPropertyAssignment(d)?r(d.initializer):[]):[],i=a=>{m.isBinaryExpression(a)&&a.operatorToken.kind===m.SyntaxKind.EqualsToken?s(r(a.left),hn(a.right)):m.isVariableDeclaration(a)&&a.initializer!==void 0?s(to(a.name),hn(a.initializer)):(m.isForOfStatement(a)||m.isForInStatement(a))&&m.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&s(to(a.initializer.declarations[0].name),hn(a.expression)),m.forEachChild(a,i)};i(e);let o=new Set(n);for(let a=!0;a;){a=!1;for(let{a:d,b:l}of t)o.has(d)&&!o.has(l)&&(o.add(l),a=!0),o.has(l)&&!o.has(d)&&(o.add(d),a=!0)}return o}function pu(e,n){let t=a=>{if(!m.isPropertyAccessExpression(a)&&!m.isElementAccessExpression(a))return;let d=a;for(;m.isPropertyAccessExpression(d)||m.isElementAccessExpression(d);)d=d.expression;return m.isIdentifier(d)?d.text:void 0},s=[],r=(a,d)=>{for(let c of hn(d))s.push({name:a,root:c});let l=t(d);l!==void 0&&s.push({name:a,root:l})},i=a=>{m.isVariableDeclaration(a)&&m.isIdentifier(a.name)&&a.initializer!==void 0?r(a.name.text,a.initializer):m.isBinaryExpression(a)&&a.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isIdentifier(a.left)&&r(a.left.text,a.right),m.forEachChild(a,i)};i(e);let o=new Map(n);for(let a=!0;a;){a=!1;for(let{name:d,root:l}of s){let c=o.get(l);c!==void 0&&!o.has(d)&&(o.set(d,c),a=!0)}}return o}function mu(e){return fu(e,cu(e))}function I_(e,n){let t=d=>d>=m.SyntaxKind.FirstAssignment&&d<=m.SyntaxKind.LastAssignment,s=d=>{let l=d.parent;if(l===void 0||!m.isObjectLiteralExpression(l))return!1;let c=l.parent;return c!==void 0&&m.isBinaryExpression(c)&&c.operatorToken.kind===m.SyntaxKind.EqualsToken&&c.right===l&&Gn(c.left)?!0:c!==void 0&&m.isCallExpression(c)&&xs(c)&&c.arguments[0]!==void 0&&Yt(c.arguments[0])&&c.arguments.indexOf(l)>0},r=(d,l)=>{if((m.isFunctionDeclaration(l)||m.isFunctionExpression(l))&&l.name===d||m.isVariableDeclaration(l)&&l.name===d||m.isParameter(l)&&l.name===d||m.isBindingElement(l)&&l.name===d||(m.isCallExpression(l)||m.isNewExpression(l))&&l.expression===d)return!0;if((m.isPropertyAccessExpression(l)||m.isElementAccessExpression(l))&&l.expression===d){let c=l;for(;c.parent!==void 0&&(m.isPropertyAccessExpression(c.parent)||m.isElementAccessExpression(c.parent))&&c.parent.expression===c;)c=c.parent;let p=c.parent;return!(p!==void 0&&m.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===c)}return m.isBinaryExpression(l)&&l.operatorToken.kind===m.SyntaxKind.EqualsToken&&l.right===d&&Gn(l.left)?!0:m.isShorthandPropertyAssignment(l)&&l.name===d||m.isPropertyAssignment(l)&&l.initializer===d?s(l):!!(m.isExportAssignment(l)&&l.expression===d||m.isExportSpecifier(l))},i=(d,l)=>m.isPropertyAccessExpression(l)&&l.name===d||m.isPropertyAssignment(l)&&l.name===d||(m.isMethodDeclaration(l)||m.isGetAccessorDeclaration(l)||m.isSetAccessorDeclaration(l))&&l.name===d,o=!1,a=(d,l)=>{if(!o){if(m.isIdentifier(d)&&l!==void 0&&n.has(d.text)&&!i(d,l)&&!r(d,l)){o=!0;return}m.forEachChild(d,c=>a(c,d))}};return a(e,void 0),o}function R_(e){let n=new Set;for(let d of e.statements)if(m.isFunctionDeclaration(d)&&d.name!==void 0)n.add(d.name.text);else if(m.isVariableStatement(d))for(let l of d.declarationList.declarations)m.isIdentifier(l.name)&&l.initializer!==void 0&&(m.isFunctionExpression(l.initializer)||m.isArrowFunction(l.initializer))&&n.add(l.name.text);let t=new Set,s=d=>{m.isBinaryExpression(d)&&d.operatorToken.kind===m.SyntaxKind.EqualsToken?(gn(d.left)&&(m.isIdentifier(d.right)?t.add(d.right.text):m.isObjectLiteralExpression(d.right)&&iu(d.right,t)),gn(d.right)&&m.isIdentifier(d.left)&&t.add(d.left.text)):m.isVariableDeclaration(d)&&m.isIdentifier(d.name)&&d.initializer!==void 0&&gn(d.initializer)&&t.add(d.name.text),m.forEachChild(d,s)};if(s(e),t.size>0){if(I_(e,t))return!0;let d=pu(e,new Map([...t].map(c=>[c,c]))),l=mu(e);for(let c of d.keys())if(l.has(c))return!0}let r=d=>m.isIdentifier(d)&&n.has(d.text),i=d=>d.properties.every(l=>m.isShorthandPropertyAssignment(l)&&n.has(l.name.text)||m.isPropertyAssignment(l)&&r(l.initializer)),o=!1,a=d=>{if(!o){if(m.isBinaryExpression(d)){let l=d.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&d.operatorToken.kind<=m.SyntaxKind.LastAssignment;l&&gn(d.left)?d.operatorToken.kind===m.SyntaxKind.EqualsToken&&(r(d.right)||m.isObjectLiteralExpression(d.right)&&i(d.right))||(o=!0):l&&Gn(d.left)&&(o=!0)}else m.isCallExpression(d)?(xs(d)&&d.arguments[0]!==void 0&&Yt(d.arguments[0])||Ji(d))&&(o=!0):(m.isExportAssignment(d)&&d.isExportEquals&&!m.isIdentifier(d.expression)||m.isExportDeclaration(d)&&d.moduleSpecifier!==void 0)&&(o=!0);o||m.forEachChild(d,a)}};return a(e),o}var O_=8;function eu(e,n,t){let s=new Set,r=lu(e,n,t,gs(e)),i=du(e,n,t,r,ou(e));for(let{source:o}of i.sources)s.add(o.target);for(let o of e.statements)if(m.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&m.isStringLiteralLike(o.moduleSpecifier)&&We(o.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${o.moduleSpecifier.text}`);a!==void 0&&s.add(a)}return s}function P_(e,n,t,s=new Map){let r=new Set(n.modules.filter(w=>w.isEntrypoint).map(w=>String(w.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let i=new Set(n.modules.filter(w=>w.externalSurface===!0).map(w=>String(w.id))),o=new Map,a=new Map,d=new Map,l=new Map;for(let w of t){if(w.name==="<toplevel>"){l.set(String(w.moduleId),w);continue}if(o.set(`${String(w.moduleId)}::${String(w.declRange.start)}`,w),w.name!==void 0&&a.set(`${String(w.moduleId)}::${w.name}`,w),w.isExported&&w.name!==void 0){let I=d.get(String(w.moduleId))??[];I.push(w),d.set(String(w.moduleId),I)}}if(s.size>0){let w=new Map(t.map(I=>[String(I.id),I]));for(let[I,N]of s){let v=w.get(String(N));v!==void 0&&!o.has(I)&&o.set(I,v)}}let c=new Map;for(let w of n.imports)w.resolvedModuleId!==void 0&&c.set(`${w.moduleId}::${w.specifier}`,String(w.resolvedModuleId));let p=new Map;for(let w of e.sourceFiles){let I=e.toRel(w.fileName);I!==null&&p.set(I,w)}let u=new Map,f=w=>{let I=u.get(w);if(I!==void 0)return I;let N=p.get(w),v=N===void 0?!0:R_(N);return u.set(w,v),v},h=new Set,g=(w,I)=>I!==void 0&&We(I)==="relative"?c.get(`${w}::${I}`):void 0,y=w=>{if(m.isIdentifier(w))return w.text;if(m.isPropertyAccessExpression(w)){let I=y(w.expression);return I===void 0?void 0:`${I}.${w.name.text}`}if(m.isElementAccessExpression(w)&&m.isStringLiteralLike(w.argumentExpression)){let I=y(w.expression);return I===void 0?void 0:`${I}.${w.argumentExpression.text}`}},_=w=>{let I=w;for(;m.isPropertyAccessExpression(I)||m.isElementAccessExpression(I);)I=I.expression;return it(I)};for(let w of e.sourceFiles){let I=e.toRel(w.fileName);if(I===null)continue;let N=new Map,v=new Map,C=(P,U)=>{let E=g(I,it(U));if(E!==void 0){if(m.isIdentifier(P))v.set(P.text,E),N.set(P.text,E);else if(m.isObjectBindingPattern(P)||m.isArrayBindingPattern(P))for(let T of to(P))v.set(T,E);else if(m.isPropertyAccessExpression(P)||m.isElementAccessExpression(P)){let T=y(P);T!==void 0&&N.set(T,E)}}},R=P=>{m.isVariableDeclaration(P)&&P.initializer!==void 0?C(P.name,P.initializer):m.isBinaryExpression(P)&&P.operatorToken.kind===m.SyntaxKind.EqualsToken&&C(P.left,P.right),m.forEachChild(P,R)};R(w);let F=P=>{let U=uu(P);if(U!==void 0){let E=U.expression,T=g(I,_(E));T!==void 0&&h.add(T);let K=y(E),J=K!==void 0?N.get(K):void 0;J!==void 0&&h.add(J)}m.forEachChild(P,F)};if(F(w),v.size>0){let P=pu(w,v),U=mu(w);for(let[E,T]of P)U.has(E)&&h.add(T)}}let b=[],x=[],k=[];for(let w of e.sourceFiles){let I=e.toRel(w.fileName);if(I===null||!r.has(I))continue;let N=e.checker.getSymbolAtLocation(w),v=new Set,C=new Set,R=0,F=(Y,V)=>{if(i.has(String(Y.moduleId))||v.has(String(Y.id)))return;v.add(String(Y.id));let fe=`${I}#reexport:${String(R)}:${V}`;R+=1,b.push({id:fe,moduleId:I,exportedName:V,kind:"value",reexportOf:{moduleId:String(Y.moduleId),name:Y.name??V}}),x.push({exportId:fe,target:{kind:"function",functionId:Y.id}})},P=Y=>{if(g_(Y))return;let V=Y;if((Y.flags&m.SymbolFlags.Alias)!==0)try{V=e.checker.getAliasedSymbol(Y)}catch{return}let fe=y_(V,e,o,a,i);if(fe!==void 0){F(fe,Y.getName());return}if((V.flags&m.SymbolFlags.Module)!==0&&!C.has(V)){C.add(V);try{for(let S of e.checker.getExportsOfModule(V))P(S)}catch{}}};if(N!==void 0)for(let Y of e.checker.getExportsOfModule(N))P(Y);let U=lu(w,I,c,gs(w)),E=du(w,I,c,U,ou(w)),T=new Set,K=E.residual,J=Y=>{let V=p.get(Y);Y.includes("node_modules/")||V===void 0||m_(V)?K=!0:T.add(Y)};for(let{source:Y,exportedName:V}of E.sources){let fe=d.get(Y.target)??[],S=h.has(Y.target);if(Y.kind==="whole"){for(let A of fe)F(A,A.name??V);S?K=!0:(fe.length===0||f(Y.target))&&J(Y.target)}else{let A=fe.filter(j=>j.name===Y.member);for(let j of A)F(j,V);S?K=!0:(A.length===0||f(Y.target))&&J(Y.target)}}let W=new Set,se=[];for(let Y of eu(w,I,c))se.push({target:Y,depth:1});for(;se.length>0;){let Y=se.shift();if(Y===void 0)break;let{target:V,depth:fe}=Y;if(W.has(V)||fe>O_||(W.add(V),V.split("/").includes("node_modules")))continue;let S=p.get(V);if(S===void 0)continue;let A=l.get(V);A!==void 0&&!f(V)&&F(A,"<load>");for(let j of eu(S,V,c))W.has(j)||se.push({target:j,depth:fe+1})}k_(w,gs(w))&&(K=!0);for(let Y of T)k.push({code:"unresolved-reexport",path:I,detail:`entrypoint whole/member re-exports app-owned relative module ${Y} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:Y});K&&k.push({code:"unresolved-reexport",path:I,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:b,exportBindings:x,diagnostics:k}}var _s=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),C_=new Set(["defineProperty","defineProperties","create"]);function M_(e){let n=!0,t=r=>m.isIdentifier(r)||m.isStringLiteral(r)||m.isNumericLiteral(r)?_s.has(r.text):m.isComputedPropertyName(r)&&m.isStringLiteralLike(r.expression)?_s.has(r.expression.text):!1,s=r=>{if(n){if(m.isNewExpression(r)||m.isForOfStatement(r)||m.isSpreadElement(r)||m.isSpreadAssignment(r)||m.isArrayBindingPattern(r)||m.isGetAccessorDeclaration(r)||m.isSetAccessorDeclaration(r)||m.isYieldExpression(r)&&r.asteriskToken!==void 0||m.canHaveDecorators(r)&&(m.getDecorators(r)?.length??0)>0){n=!1;return}if((m.isPropertyAccessExpression(r)||m.isMethodDeclaration(r)||m.isPropertyAssignment(r))&&t(r.name)||m.isPropertyDeclaration(r)&&t(r.name)||m.isShorthandPropertyAssignment(r)&&t(r.name)||m.isBindingElement(r)&&t(r.propertyName??r.name)||m.isElementAccessExpression(r)&&m.isStringLiteralLike(r.argumentExpression)&&_s.has(r.argumentExpression.text)){n=!1;return}if(m.isCallExpression(r)&&m.isPropertyAccessExpression(r.expression)&&m.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&C_.has(r.expression.name.text)){n=!1;return}m.forEachChild(r,s)}};return s(e),n}function oo(e){if(m.isIdentifier(e)||m.isStringLiteral(e)||m.isNumericLiteral(e))return e.text}function hu(e){let n=t=>m.canHaveDecorators(t)&&(m.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function T_(e){let n=!1,t=new Set,s=[],r=new Map,i=(u,f)=>{let h=r.get(u);h===void 0?r.set(u,[f]):h.push(f)},o=u=>{m.isIdentifier(u)?t.add(u.text):s.push(u)},a=u=>{for(let f of u.properties)m.isShorthandPropertyAssignment(f)?t.add(f.name.text):m.isPropertyAssignment(f)?s.push(f.initializer):n=!0},d=u=>{if(m.isBinaryExpression(u)&&u.operatorToken.kind===m.SyntaxKind.EqualsToken){let f=u.left,h=u.right;gn(f)?m.isObjectLiteralExpression(h)?a(h):m.isIdentifier(h)||m.isFunctionExpression(h)||m.isArrowFunction(h)||m.isClassExpression(h)?o(h):n=!0:Gn(f)?(m.isElementAccessExpression(f)&&!m.isStringLiteralLike(f.argumentExpression)&&(n=!0),o(h)):m.isIdentifier(f)?i(f.text,h):(m.isPropertyAccessExpression(f)||m.isElementAccessExpression(f))&&m.isIdentifier(f.expression)&&i(f.expression.text,h)}else if(m.isCallExpression(u))(xs(u)&&u.arguments[0]!==void 0&&Yt(u.arguments[0])||Ji(u))&&(n=!0);else if(m.isVariableDeclaration(u)&&m.isIdentifier(u.name)&&u.initializer!==void 0)i(u.name.text,u.initializer);else if((m.isFunctionDeclaration(u)||m.isClassDeclaration(u))&&u.name!==void 0)i(u.name.text,u),Xt(u)&&t.add(u.name.text);else if(m.isExportDeclaration(u)){if(u.exportClause===void 0)n=!0;else if(u.moduleSpecifier===void 0&&m.isNamedExports(u.exportClause))for(let f of u.exportClause.elements)t.add((f.propertyName??f.name).text)}else if(m.isExportAssignment(u))u.isExportEquals&&!m.isIdentifier(u.expression)?n=!0:o(u.expression);else if(m.isVariableStatement(u)&&Xt(u))for(let f of u.declarationList.declarations)m.isIdentifier(f.name)&&t.add(f.name.text);m.forEachChild(u,d)};d(e);let l=new Set,c=[...t],p=u=>{let f=h=>{m.isIdentifier(h)&&c.push(h.text),m.forEachChild(h,f)};f(u)};for(let u of s)p(u);for(;c.length>0;){let u=c.pop();if(!(u===void 0||l.has(u))){l.add(u);for(let f of r.get(u)??[])p(f)}}return{names:l,opaque:n}}var $_=512,L_=new Set(["get","post","put","patch","delete","options","head"]);function D_(e){for(let n of e.statements){if(m.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(m.isExpressionStatement(n)&&m.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isPropertyAccessExpression(n.expression.left)&&m.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,s=n.expression.left.name.text;if(t==="module"&&s==="exports"||t==="exports"&&s==="default")return n.expression.right}}return null}function F_(e){let n=new Map,t=D_(e);if(t===null)return n;let s=i=>{for(let o of i.properties)if(m.isPropertyAssignment(o)&&m.isObjectLiteralExpression(o.initializer)){let a=oo(o.name);a!==void 0&&n.set(a,o.initializer)}};if(m.isObjectLiteralExpression(t))return s(t),n;if(!m.isIdentifier(t))return n;let r=t.text;for(let i of e.statements)if(m.isVariableStatement(i))for(let o of i.declarationList.declarations)m.isIdentifier(o.name)&&o.name.text===r&&o.initializer!==void 0&&m.isObjectLiteralExpression(o.initializer)&&s(o.initializer);else if(m.isExpressionStatement(i)&&m.isBinaryExpression(i.expression)&&i.expression.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isPropertyAccessExpression(i.expression.left)&&m.isIdentifier(i.expression.left.expression)&&i.expression.left.expression.text===r&&m.isObjectLiteralExpression(i.expression.right)){let o=i.expression.left.name.text;n.set(o,i.expression.right)}return n}function j_(e){for(let n of e.properties){if(m.isMethodDeclaration(n)&&m.isIdentifier(n.name)&&n.name.text==="handler")return n;if(m.isPropertyAssignment(n)&&m.isIdentifier(n.name)&&n.name.text==="handler"&&(m.isArrowFunction(n.initializer)||m.isFunctionExpression(n.initializer)))return n.initializer}return null}function B_(e,n){for(let s of e.properties){let r;if(m.isPropertyAssignment(s)||m.isMethodDeclaration(s)?r=oo(s.name):m.isShorthandPropertyAssignment(s)&&(r=s.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function K_(e,n){let t=[],s=new Set,r=(a,d,l)=>{if(t.length>=$_||a==="__proto__"||!Zi.test(a))return;let c=`${e}#handler:${a}`;s.has(c)||(s.add(c),t.push({id:c,node:d,memberPath:a,idiom:l}))};for(let[a,d]of F_(n)){let l=j_(d);l!==null&&B_(d,l)&&r(a,l,"descriptor-object")}let i=0,o=a=>{if(m.isCallExpression(a)&&m.isPropertyAccessExpression(a.expression)&&m.isIdentifier(a.expression.expression)&&L_.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&m.isStringLiteralLike(a.arguments[0])){let d=a.expression.name.text;for(let l=1;l<a.arguments.length;l+=1){let c=a.arguments[l];c!==void 0&&(m.isArrowFunction(c)||m.isFunctionExpression(c))&&r(`${d}_${String(i)}_${String(l)}`,c,"router-verb")}i+=1}m.forEachChild(a,o)};return o(n),t}function z_(e,n,t,s,r,i){let o=`${e}#class:${t}`,a=[],d=new Set;for(let l of s.members){let c,p,u;if(m.isConstructorDeclaration(l))c="constructor",p="ctor",u=!1;else if(m.isMethodDeclaration(l))c=oo(l.name),p="method",u=c!==void 0&&!_s.has(c);else continue;if(c===void 0||d.has(c))continue;d.add(c);let f=`${e}#${t}.${c}`;r.push({id:f,moduleId:e,name:c,kind:p,enclosingClassId:o,declRange:ot(e,l,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),u&&i.push({start:l.getStart(n,!1),end:l.getEnd(),id:f})}return{id:o,moduleId:e,name:t,implementsRefs:[],members:a}}function U_(e,n,t=[],s=!1,r){let i=[],o=new Map,a=[],{reachableLocals:d,defaultTarget:l}=f_(n),c=gs(n),p=`${e}#<toplevel>`;i.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let u=(I,N)=>{let v=`${e}#${I}`;return i.push({id:v,moduleId:e,name:I,kind:"function",declRange:ot(e,N,n),isExported:d.has(I),publicSurfaceReachable:d.has(I)}),o.set(I,{kind:"function",functionId:v}),a.push({start:N.getStart(n,!1),end:N.getEnd(),id:v}),v},f=[],h=!e.split("/").includes("node_modules");if(h)for(let I of S_(n,c))d.add(I);let g=h?T_(n):void 0,y=(I,N,v)=>{g===void 0||g.opaque||g.names.has(I)||Xt(v)||hu(N)||f.push(z_(e,n,I,N,i,a))};for(let I of n.statements)if(m.isFunctionDeclaration(I)&&I.name!==void 0)u(I.name.text,I);else if(m.isClassDeclaration(I)&&I.name!==void 0)y(I.name.text,I,I);else if(m.isVariableStatement(I))for(let N of I.declarationList.declarations){if(m.isObjectBindingPattern(N.name)&&N.initializer!==void 0&&m.isCallExpression(N.initializer)&&m.isIdentifier(N.initializer.expression)&&N.initializer.expression.text==="require"&&N.initializer.arguments.length===1&&N.initializer.arguments[0]!==void 0&&m.isStringLiteralLike(N.initializer.arguments[0])){let C=N.initializer.arguments[0].text;for(let R of N.name.elements){if(R.dotDotDotToken!==void 0||R.initializer!==void 0||!m.isIdentifier(R.name))continue;let F=R.propertyName??R.name;!m.isIdentifier(F)&&!m.isStringLiteralLike(F)||o.set(R.name.text,{kind:"import",specifier:C,form:{named:F.text}})}continue}if(!m.isIdentifier(N.name)||N.initializer===void 0)continue;let v=N.initializer;if(m.isFunctionExpression(v)||m.isArrowFunction(v))u(N.name.text,N);else if(m.isClassExpression(v))y(N.name.text,v,I);else if(m.isCallExpression(v)&&m.isIdentifier(v.expression)&&v.expression.text==="require"&&v.arguments.length===1&&v.arguments[0]!==void 0&&m.isStringLiteralLike(v.arguments[0]))o.set(N.name.text,{kind:"import",specifier:v.arguments[0].text,form:"whole"});else if((m.isPropertyAccessExpression(v)||m.isElementAccessExpression(v))&&ro(v)==="default"&&m.isCallExpression(v.expression)){let C=it(v.expression);C!==void 0&&o.set(N.name.text,{kind:"import",specifier:C,form:"require-default"})}}else if(m.isImportDeclaration(I)&&m.isStringLiteralLike(I.moduleSpecifier)){let N=I.moduleSpecifier.text,v=I.importClause;if(v!==void 0){v.name!==void 0&&o.set(v.name.text,{kind:"import",specifier:N,form:"default"});let C=v.namedBindings;if(C!==void 0&&m.isNamespaceImport(C))o.set(C.name.text,{kind:"import",specifier:N,form:"namespace"});else if(C!==void 0&&m.isNamedImports(C))for(let R of C.elements){let F=(R.propertyName??R.name).text;o.set(R.name.text,{kind:"import",specifier:N,form:{named:F}})}}}else m.isImportEqualsDeclaration(I)&&m.isExternalModuleReference(I.moduleReference)&&m.isStringLiteralLike(I.moduleReference.expression)&&o.set(I.name.text,{kind:"import",specifier:I.moduleReference.expression.text,form:"whole"});let _=new Map,b,x=new Map,k=new Map;if(h)for(let{name:I,value:N}of b_(n)){let v=`${e}#member-export:${I}`;i.push({id:v,moduleId:e,name:I,kind:m.isArrowFunction(N)?"arrow":"function",declRange:ot(e,N,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:N.getStart(n,!1),end:N.getEnd(),id:v}),_.set(N.getStart(n,!1),v)}if(s&&h){let I=F=>{let P=Ze(F);return m.isFunctionExpression(P)||m.isArrowFunction(P)?P:void 0},N=(F,P)=>{let U=F;return i.push({id:U,moduleId:e,kind:m.isArrowFunction(P)?"arrow":"function",declRange:ot(e,P,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:P.getStart(n,!1),end:P.getEnd(),id:U}),_.set(P.getStart(n,!1),U),U},v=[],C=[],R=[];for(let F of n.statements)m.isExportAssignment(F)&&!F.isExportEquals?v.push(F):m.isFunctionDeclaration(F)&&m.getModifiers(F)?.some(P=>P.kind===m.SyntaxKind.DefaultKeyword)===!0?C.push(F):m.isExpressionStatement(F)&&m.isBinaryExpression(F.expression)&&F.expression.operatorToken.kind===m.SyntaxKind.EqualsToken&&gn(F.expression.left)&&R.push(F.expression);if(v.length+C.length+R.length===1){let F=v[0],P=C[0],U=R[0];if(F!==void 0){let E=I(F.expression);if(E!==void 0){let T=N(`${e}#<default>`,E);b={id:T,esm:!0},k.set(F.getStart(n,!1),T),$e(r,"2a-default",null)}}else if(P!==void 0&&P.name===void 0&&P.body!==void 0){let E=N(`${e}#<default>`,P);b={id:E,esm:!0},k.set(P.getStart(n,!1),E),$e(r,"2a-default",null)}else if(U!==void 0){let E=I(U.right);if(E!==void 0){let T=N(`${e}#<default>`,E);b={id:T,esm:!1},k.set(U.getStart(n,!1),T),$e(r,"2a-default",null)}else if(m.isObjectLiteralExpression(U.right)){let T=U.right,K=[],J=!0;for(let W of T.properties){if(m.isSpreadAssignment(W)){J=!1;break}let se=W.name,Y=se===void 0?void 0:Xi(se);if(Y===void 0){J=!1;break}K.push(Y)}if(J){let W=new Map;for(let se of K)W.set(se,(W.get(se)??0)+1);for(let se of T.properties){if(!m.isPropertyAssignment(se))continue;let Y=Xi(se.name),V=I(se.initializer);if(Y!==void 0){if(!__(Y)){V!==void 0&&$e(r,"2a-member","charset-refused");continue}if((W.get(Y)??0)!==1){V!==void 0&&$e(r,"2a-member","duplicate-key");continue}if(V!==void 0){let fe=N(`${e}#<cjs>.${Y}`,V);x.set(Y,fe),k.set(se.getStart(n,!1),fe),$e(r,"2a-member",null)}}}}else for(let W of T.properties)m.isPropertyAssignment(W)&&I(W.initializer)!==void 0&&$e(r,"2a-member","spread-or-computed-literal")}}}else{for(let F of v)I(F.expression)!==void 0&&$e(r,"2a-default","duplicate-default-sources");for(let F of C)F.name===void 0&&$e(r,"2a-default","duplicate-default-sources");for(let F of R)if(I(F.right)!==void 0)$e(r,"2a-default","duplicate-default-sources");else if(m.isObjectLiteralExpression(F.right))for(let P of F.right.properties)m.isPropertyAssignment(P)&&I(P.initializer)!==void 0&&$e(r,"2a-member","duplicate-default-sources")}}for(let I of t)i.push({id:I.id,moduleId:e,name:`handler:${I.memberPath}`,kind:m.isArrowFunction(I.node)?"arrow":"function",declRange:ot(e,I.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:I.node.getStart(n,!1),end:I.node.getEnd(),id:I.id});a.sort((I,N)=>I.end-I.start-(N.end-N.start));let w=l!==void 0?`${e}#${l}`:void 0;return{rel:e,sf:n,functions:i,bindings:o,exportedFunctionId:w,exportedNames:d,tainted:c,fnRanges:a,toplevelId:p,classes:f,mintedByPos:_,mintedDefault:b,mintedMembers:x,mintSeedAliases:k}}function q_(e){return m.isIdentifier(e)?"identifier":m.isPropertyAccessExpression(e)?"member":m.isElementAccessExpression(e)?"computed-member":e.kind===m.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function nu(e,n){let t=s=>{if(m.isBinaryExpression(s)&&s.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=m.SyntaxKind.LastAssignment){let r=s.left;m.isPropertyAccessExpression(r)&&m.isIdentifier(r.expression)?n(r.expression.text,r.name.text):m.isElementAccessExpression(r)&&m.isIdentifier(r.expression)&&n(r.expression.text,m.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(m.isCallExpression(s)&&m.isPropertyAccessExpression(s.expression)){let r=s.expression,i=s.arguments[0];m.isIdentifier(r.expression)&&i!==void 0&&m.isIdentifier(i)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(i.text,null)}m.forEachChild(s,t)};t(e)}function H_(e){let n=!1,t=s=>{if(!n){if(m.isVariableDeclaration(s)||m.isParameter(s)){let r=new Set;if(Xs(s.name,r),r.has("require")){n=!0;return}}else if((m.isFunctionDeclaration(s)||m.isClassDeclaration(s))&&s.name!==void 0&&s.name.text==="require"){n=!0;return}m.forEachChild(s,t)}};return t(e),n}function W_(e,n,t,s=new Map,r={}){let i=r.additiveForms===!0,o=r.namelessExports===!0,a=i||o?{}:void 0,d=new Map,l=new Map;for(let E of n.imports)E.resolvedModuleId!==void 0&&l.set(`${E.moduleId}::${E.specifier}`,E.resolvedModuleId);for(let E of e.sourceFiles){let T=e.toRel(E.fileName);T!==null&&d.set(T,U_(T,E,s.get(T)??[],o,a))}let c=new Map;if(i)for(let E of d.values()){let T=new Map;for(let[K,J]of E.bindings)if(J.kind==="import"&&J.form==="whole"&&We(J.specifier)!=="package-root"){let W=l.get(`${E.rel}::${J.specifier}`);W!==void 0&&T.set(K,String(W))}T.size!==0&&nu(E.sf,(K,J)=>{let W=T.get(K);if(W===void 0)return;let se=c.get(W);if(se!=="*"){if(J===null){c.set(W,"*");return}se===void 0?c.set(W,new Set([J])):se.add(J)}})}let p=new Map;for(let E of d.values())E.exportedFunctionId!==void 0&&p.set(E.rel,E.exportedFunctionId);let u=new Map;for(let E of d.values()){if(E.rel.split("/").includes("node_modules"))continue;let T=p_(E.sf);if(T===void 0){o&&E.mintedDefault!==void 0&&u.set(E.rel,E.mintedDefault);continue}let K=E.bindings.get(T.name);K?.kind==="function"&&u.set(E.rel,{id:K.functionId,esm:T.esm})}let f=new Map;for(let E of d.values()){let T;for(let K of E.exportedNames){let J=E.bindings.get(K);J?.kind==="function"&&(T??=new Map,T.set(K,J.functionId))}T!==void 0&&f.set(E.rel,T)}let h=new Map;for(let E of d.values()){if(E.rel.split("/").includes("node_modules"))continue;let T=N_(E.sf,E.tainted,K=>{let J=E.bindings.get(K);return J?.kind==="function"?J.functionId:void 0},o?K=>{let J=Ze(K);return m.isFunctionExpression(J)||m.isArrowFunction(J)?E.mintedByPos.get(J.getStart(E.sf,!1)):void 0}:void 0);T.size>0&&h.set(E.rel,T)}let g=[],y=[],_=[],b=[],x=[],k=[],w=new Map;for(let E of n.imports){let T=w.get(E.moduleId)??[];T.push(E.specifier),w.set(E.moduleId,T)}let I=E=>Pc(w.get(E)??[]),N=new Map,v=new Map,C=new Map,R=new Map;for(let E of d.values())if(!E.rel.split("/").includes("node_modules"))for(let T of E.functions)T.id!==E.toplevelId&&R.set(T.id,{fn:T,sf:E.sf});let F=new Map,P=E=>{let T=F.get(E);if(T===void 0){let K=R.get(E),J=K===void 0?null:Hc(K.sf,K.fn.declRange.start,K.fn.declRange.end);T=J===null?null:zc(J),F.set(E,T)}return T};for(let E of d.values()){k.push(...E.classes);for(let B of E.exportedNames){let q=E.bindings.get(B);if(q?.kind==="function"){let Q=`${E.rel}#export:${B}`;b.push({id:Q,moduleId:E.rel,exportedName:B,kind:"value"}),x.push({exportId:Q,target:{kind:"function",functionId:q.functionId}})}}if(o){if(E.mintedDefault!==void 0){let B=`${E.rel}#export:<default>`;b.push({id:B,moduleId:E.rel,exportedName:"default",kind:"value"}),x.push({exportId:B,target:{kind:"function",functionId:E.mintedDefault.id}})}for(let[B,q]of E.mintedMembers){let Q=`${E.rel}#export:<cjs>.${B}`;b.push({id:Q,moduleId:E.rel,exportedName:B,kind:"value"}),x.push({exportId:Q,target:{kind:"function",functionId:q}})}}let T=new Map;for(let[B,q]of E.bindings){if(q.kind==="function"){T.set(B,q);continue}if(We(q.specifier)==="package-root"){let oe=Pn(q.specifier);typeof q.form=="object"?T.set(B,{kind:"package-export",packageName:oe,exportName:q.form.named}):q.form==="require-default"?T.set(B,{kind:"package-default",packageName:oe}):T.set(B,{kind:"package-surface",packageName:oe})}else{let oe=l.get(`${E.rel}::${q.specifier}`);if(oe!==void 0&&typeof q.form=="object"){let ke=f.get(String(oe))?.get(q.form.named);ke!==void 0&&T.set(B,{kind:"app-named-fn",functionId:ke})}else if(oe!==void 0&&q.form==="require-default"){let ke=u.get(String(oe));ke!==void 0&&ke.esm&&T.set(B,{kind:"app-default-fn",functionId:ke.id})}else oe!==void 0&&typeof q.form!="object"&&q.form!=="require-default"&&T.set(B,{kind:"module",resolvedModuleId:oe})}}let K=new Map;for(let B of E.functions){if(B.enclosingClassId===void 0||B.name===void 0)continue;let q=K.get(B.enclosingClassId);q===void 0&&(q=new Map,K.set(B.enclosingClassId,q)),q.set(B.name,B.id)}for(let B of E.classes)B.name===void 0||E.tainted.has(B.name)||T.has(B.name)||T.set(B.name,{kind:"app-class",cls:{classId:B.id,className:B.name,memberIds:K.get(B.id)??new Map}});let J=B=>{if(m.isVariableDeclaration(B)&&m.isIdentifier(B.name)&&B.initializer!==void 0&&m.isNewExpression(B.initializer)&&!E.tainted.has(B.name.text)&&!T.has(B.name.text)){let q=Xc(B.initializer,T,E.tainted);q!==null&&T.set(B.name.text,q)}m.forEachChild(B,J)};J(E.sf);let W=B=>{for(let q of E.fnRanges)if(B>=q.start&&B<q.end)return q.id;return E.toplevelId},se=new Map,Y=new Map,V=new Map,fe=(B,q,Q)=>{if(Q===null){B.set(q,"*");return}let oe=B.get(q);oe!=="*"&&(oe===void 0?B.set(q,new Set([Q])):oe.add(Q))},S=(B,q)=>{fe(se,B,q);let Q=T.get(B);Q?.kind==="package-surface"?fe(Y,Q.packageName,q):Q?.kind==="module"&&fe(V,String(Q.resolvedModuleId),q)};nu(E.sf,S);let A=new Map,j=256,ne=B=>{let q=A.get(B);return q===void 0&&(q=A.size>=j?new Set([B]):fu(E.sf,new Set([B])),A.set(B,q)),q},X=(B,q)=>B==="*"||B!==void 0&&B.has(q),D=(B,q)=>{let Q=T.get(B);if(Q?.kind==="package-surface"&&X(Y.get(Q.packageName),q)||Q?.kind==="module"&&X(V.get(String(Q.resolvedModuleId)),q))return!0;for(let oe of ne(B))if(X(se.get(oe),q))return!0;return!1},$=B=>{if(m.isIdentifier(B)){let q=E.tainted.has(B.text)?void 0:T.get(B.text);return q?.kind==="function"?q.functionId:q?.kind==="module"?p.get(String(q.resolvedModuleId))??null:q?.kind==="package-export"?t.exportFor(q.packageName,q.exportName):null}if(m.isPropertyAccessExpression(B)&&m.isIdentifier(B.expression)){let q=B.expression.text;if(D(q,B.name.text))return null;let Q=E.tainted.has(q)?void 0:T.get(q);return Q?.kind==="package-surface"?t.exportFor(Q.packageName,B.name.text):Q?.kind==="package-export"?t.methodFor(Q.packageName,Q.exportName,B.name.text,"method"):Q?.kind==="package-instance"?t.methodFor(Q.packageName,Q.className,B.name.text,"method"):null}return null},L=B=>{for(let q=B.parent;q!==void 0;q=q.parent)if(!m.isArrowFunction(q)){if(m.isFunctionExpression(q)||m.isFunctionDeclaration(q))return null;if(m.isMethodDeclaration(q)||m.isConstructorDeclaration(q)||m.isGetAccessorDeclaration(q)||m.isSetAccessorDeclaration(q)){let Q=q.parent;if(!m.isClassLike(Q)||Q.name===void 0)return null;let oe=E.tainted.has(Q.name.text)?void 0:T.get(Q.name.text);return oe?.kind==="app-class"?oe.cls:null}}return null},H=i&&!E.tainted.has("require")&&!H_(E.sf),z=B=>{if(m.isIdentifier(B)){let oe=E.tainted.has(B.text)?void 0:T.get(B.text);return oe?.kind==="package-surface"||oe?.kind==="package-default"?t.exportFor(oe.packageName,"default"):oe?.kind==="app-named-fn"||oe?.kind==="app-default-fn"?oe.functionId:oe?.kind==="module"?u.get(String(oe.resolvedModuleId))?.id??null:oe?.kind==="member-value"?oe.functionId:null}if(!m.isPropertyAccessExpression(B))return null;let q=B.expression;if(i&&m.isCallExpression(Ze(q))){let oe=it(Ze(q));if(oe!==void 0)if(!H)$e(a,"2b","require-shadow");else if(We(oe)==="package-root")$e(a,"2b","package-root");else{let ke=l.get(`${E.rel}::${oe}`);if(ke===void 0)$e(a,"2b","unresolved-module");else{let Re=B.name.text,En=c.get(String(ke));if(En==="*"||En!==void 0&&En.has(Re))$e(a,"2b","module-mutation-gate");else{let Nn=h.get(String(ke))?.get(Re);if(Nn!==void 0)return $e(a,"2b",null),Nn;if(Re==="default"){let An=u.get(String(ke));if(An!==void 0&&An.esm)return $e(a,"2b",null),An.id;$e(a,"2b","non-esm-default")}else $e(a,"2b","unknown-member")}}}return null}let Q;if(m.isIdentifier(q)){let oe=E.tainted.has(q.text)?void 0:T.get(q.text);if(oe?.kind==="app-class"||oe?.kind==="app-instance")Q=oe.cls.memberIds;else if(oe?.kind==="object-literal")Q=oe.obj.members;else if(oe?.kind==="module"){let ke=h.get(String(oe.resolvedModuleId));ke?.has(B.name.text)===!0&&!D(q.text,B.name.text)&&(Q=ke)}}else if(m.isNewExpression(q)){let oe=Xc(q,T,E.tainted);oe?.kind==="app-instance"&&(Q=oe.cls.memberIds)}else q.kind===m.SyntaxKind.ThisKeyword&&(Q=L(B)?.memberIds);return Q?.get(B.name.text)??null},Z=new Map,ie=B=>{if(m.isVariableDeclaration(B)&&m.isIdentifier(B.name)&&B.initializer!==void 0&&m.isObjectLiteralExpression(B.initializer)&&!E.tainted.has(B.name.text)&&!T.has(B.name.text)&&!Z.has(B.name.text)){let q=new Map;for(let Q of B.initializer.properties)if(m.isPropertyAssignment(Q)&&m.isIdentifier(Q.name)){let oe=$(Q.initializer);oe!==null&&q.set(Q.name.text,oe)}Z.set(B.name.text,q)}m.forEachChild(B,ie)};ie(E.sf);let ae=B=>{if(m.isBinaryExpression(B)&&B.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isPropertyAccessExpression(B.left)&&m.isIdentifier(B.left.expression)&&!E.tainted.has(B.left.expression.text)){let q=Z.get(B.left.expression.text);if(q!==void 0){let Q=$(B.right);Q!==null&&q.set(B.left.name.text,Q)}}m.forEachChild(B,ae)};ae(E.sf);for(let[B,q]of Z)T.set(B,{kind:"object-literal",obj:{members:q}});let pe=(B,q=0)=>{if(q>Gc)return null;let Q=Ze(B);if(m.isCallExpression(Q)&&m.isPropertyAccessExpression(Q.expression)&&Q.expression.name.text==="bind")return pe(Q.expression.expression,q+1);if(m.isIdentifier(Q)){let oe=$(Q);if(oe!==null)return oe;let ke=E.tainted.has(Q.text)?void 0:T.get(Q.text);return ke?.kind==="member-value"?ke.functionId:null}return m.isPropertyAccessExpression(Q)?$(Q)??z(Q):null},he=(B,q=0)=>{if(q>Gc)return"depth-cap";let Q=Ze(B);if(m.isCallExpression(Q)&&m.isPropertyAccessExpression(Q.expression)&&Q.expression.name.text==="bind")return he(Q.expression.expression,q+1);if(m.isIdentifier(Q))return E.tainted.has(Q.text)?"tainted-receiver":"unresolved-receiver";if(m.isPropertyAccessExpression(Q)&&m.isIdentifier(Q.expression)){if(E.tainted.has(Q.expression.text))return"tainted-receiver";if(D(Q.expression.text,Q.name.text))return"mutated-member"}return"unresolved-receiver"},we=B=>{if(m.isVariableDeclaration(B)&&m.isIdentifier(B.name)&&B.initializer!==void 0){let q=Ze(B.initializer),Q=m.isPropertyAccessExpression(q),oe=m.isCallExpression(q)&&m.isPropertyAccessExpression(q.expression)&&q.expression.name.text==="bind";if(Q||oe){let ke=Q?"D1":"A2";if(E.tainted.has(B.name.text))$e(a,ke,"tainted-alias");else if(T.has(B.name.text))$e(a,ke,"already-bound");else{let Re=pe(q);Re!==null?(T.set(B.name.text,{kind:"member-value",functionId:Re}),$e(a,ke,null)):$e(a,ke,he(q))}}}m.forEachChild(B,we)};i&&we(E.sf);let Ne=I(E.rel),Ie=new Map,Fe=new Map,Le=B=>{let q=Ze(B);if(!m.isIdentifier(q))return null;let Q=E.tainted.has(q.text)?void 0:T.get(q.text),oe=Q?.kind==="package-surface"||Q?.kind==="package-export"&&Q.exportName==="default"?Q.packageName:null;return oe===null?null:Kc(oe)?.shape??null},Je=(B,q)=>{let Q=new Set((q.arity??[]).map(Re=>nr(q.model,Re))),[oe]=[...Q];if(Q.size!==1||oe===void 0||oe>=q.passes)return;let ke={model:q.model,index:oe,registeredAt:q.registeredAt};if(m.isArrowFunction(B)||m.isFunctionExpression(B))Fe.has(B)||Fe.set(B,ke);else if(m.isIdentifier(B)||m.isPropertyAccessExpression(B)){let Re=$(B)??z(B);Re!==null&&!N.has(Re)&&(N.set(Re,q.model),v.set(Re,q.registeredAt),C.set(Re,oe))}},Ae=(B,q,Q)=>{let oe=Ie.get(B);if(oe===void 0)return;let ke=Le(q)??(Q===null?null:P(Q));if(ke===null||B.questionDotToken!==void 0||B.arguments.some(m.isSpreadElement))return;let Re=B.arguments[ke.param];if(Re===void 0)return;let En={...oe,depth:oe.depth+1,arity:oe.arity??ke.arity,passes:Math.min(oe.passes,ke.passes)},Nn=Ze(Re);m.isCallExpression(Nn)?En.depth<Bc&&Ie.set(Nn,En):Je(Nn,En)},tn=0,Ms=B=>{let q,Q;if(m.isCallExpression(B)){let oe=B.expression,ke=m.isIdentifier(oe)&&oe.text==="require",Re=oe.kind===m.SyntaxKind.ImportKeyword;!ke&&!Re&&(q=oe,Q=B.arguments)}else m.isTaggedTemplateExpression(B)&&(q=B.tag);if(q!==void 0){let oe=q_(q),ke=B.getStart(E.sf,!1),Re=`${E.rel}#call${String(tn)}`;tn+=1;let En="unresolved",Nn=[],An=$(q);if(An!==null&&(En="resolved",Nn.push(An)),y.push({id:Re,enclosingFunctionId:W(ke),calleeExprShape:oe,resolvedTargetIds:Nn,resolution:En,range:ot(E.rel,B,E.sf),...Wi(B,q,E.rel,E.sf,{program:e.program,checker:e.checker})}),m.isCallExpression(B)){let ue=Qr(B,Ne);for(let ye of ue?.handlers??[]){if(ue===null||!(m.isIdentifier(ye)||m.isPropertyAccessExpression(ye)))continue;let be=$(ye)??z(ye);be!==null&&!N.has(be)&&(N.set(be,ue.model),v.set(be,ot(E.rel,B,E.sf)))}for(let ye of ue?.forwarded??[])ue!==null&&Ie.set(ye,{model:ue.model,registeredAt:ot(E.rel,B,E.sf),depth:0,arity:null,passes:Number.POSITIVE_INFINITY})}for(let ue of Nn)_.push({callSiteId:Re,calleeFunctionId:ue,resolution:En,invocation:"direct"});let G=An===null?z(q):null;if(An===null){if(G!==null)_.push({callSiteId:Re,calleeFunctionId:G,resolution:"field-based",invocation:"direct"});else if(i&&m.isPropertyAccessExpression(q)&&(q.name.text==="call"||q.name.text==="apply")){let ue=pe(q.expression);ue!==null?(_.push({callSiteId:Re,calleeFunctionId:ue,resolution:"field-based"}),$e(a,"A3",null)):$e(a,"A3",he(q.expression))}}m.isCallExpression(B)&&Ae(B,q,An??G);for(let ue of Q??[]){let ye=$(ue);if(ye!==null)_.push({callSiteId:Re,calleeFunctionId:ye,resolution:"field-based",invocation:"callback"});else{let be=z(ue);if(be!==null)_.push({callSiteId:Re,calleeFunctionId:be,resolution:"field-based",invocation:"callback"});else if(i){let Ke=pe(ue),Pe=Ze(ue),Dn=Pe!==ue||m.isCallExpression(Pe)&&m.isPropertyAccessExpression(Pe.expression)&&Pe.expression.name.text==="bind";Ke!==null?(_.push({callSiteId:Re,calleeFunctionId:Ke,resolution:"field-based"}),Dn&&$e(a,"A2p",null)):Dn&&$e(a,"A2p",he(ue))}}}}m.forEachChild(B,Ms)};Ms(E.sf),g.push(...Hi(E.functions,E.sf,E.rel,Ne,{program:e.program,checker:e.checker},Fe));for(let B of n.computedLoads.get(E.rel)??[]){let q=B.candidateRels.filter(oe=>d.has(oe)).map(oe=>`${oe}#<toplevel>`);if(q.length===0)continue;let Q=`${E.rel}#dirload${String(tn)}`;tn+=1,y.push({id:Q,enclosingFunctionId:W(B.pos),calleeExprShape:"require",resolvedTargetIds:q,resolution:"field-based",range:{path:E.rel,start:B.pos,end:B.pos}});for(let oe of q)_.push({callSiteId:Q,calleeFunctionId:oe,resolution:"field-based"})}let Ts=0;for(let B of s.get(E.rel)??[]){let q=`${E.rel}#handlerseed${String(Ts)}`;Ts+=1;let Q=B.node.getStart(E.sf,!1);y.push({id:q,enclosingFunctionId:E.toplevelId,calleeExprShape:"member",resolvedTargetIds:[B.id],resolution:"field-based",range:{path:E.rel,start:Q,end:Q}}),_.push({callSiteId:q,calleeFunctionId:B.id,resolution:"field-based"})}}let U=new Map;if(o)for(let E of d.values())for(let[T,K]of E.mintSeedAliases)U.set(`${E.rel}::${String(T)}`,K);return{functions:g.map(E=>{let T=N.get(E.id);if(T===void 0||E.sourceParams!==void 0)return E;let K=v.get(E.id);return{...E,sourceParams:[{index:C.get(E.id)??nr(T,E.params?.length??0),sourceClass:T.sourceClass,model:T.id,...K!==void 0?{registeredAt:K}:{}}]}}),callSites:y,callEdges:_,exports:b,exportBindings:x,classes:k,mintSeedAliases:U,bindingApplicability:a}}function G_(e,n,t){let s=d=>d.length===0||kn.isAbsolute(d)||d.includes("\\")||/^[a-zA-Z]:/u.test(d)||d.split("/").some(l=>l===".."||l==="");if(s(n)||s(t))return null;let r=e.endsWith(kn.sep)?e:e+kn.sep,i;try{i=Wc(kn.resolve(e,n))}catch{return null}if(!i.startsWith(r))return null;let o=i.endsWith(kn.sep)?i:i+kn.sep,a;try{a=Wc(kn.resolve(i,t))}catch{return null}return a.startsWith(o)?a:null}function gu(e,n,t){let s=`${e}#class:${t}`,r=[],i=[],o=[],a=new Set;return{pushMember(d,l,c,p){if(d==="__proto__"||a.has(d))return;a.add(d);let u=`${e}#${t}.${d}`;r.push({id:u,moduleId:e,name:d,kind:c,enclosingClassId:s,declRange:ot(e,l,n),isExported:!1,publicSurfaceReachable:!1}),o.push(u),i.push({name:d,id:u,kind:c,body:p})},finish(){return i.length===0?null:{functions:r,classNode:{id:s,moduleId:e,name:t,implementsRefs:[],members:o},members:i}}}}function V_(e,n,t,s){if(hu(s)||s.members.length>Yi)return null;let r=gu(e,n,t);for(let i of s.members){let o,a,d;if(m.isConstructorDeclaration(i))o="constructor",a="ctor",d=void 0;else if(m.isMethodDeclaration(i))o=oo(i.name),a="method",d=o!==void 0&&!_s.has(o)?i.body??void 0:void 0;else continue;o!==void 0&&r.pushMember(o,i,a,d)}return r.finish()}function X_(e,n,t){let s;for(let o of n.statements)if(m.isFunctionDeclaration(o)&&o.name?.text===t){s=o;break}if(s===void 0)return null;let r=[];for(let o of n.statements){if(!m.isExpressionStatement(o))continue;let a=o.expression;if(!m.isBinaryExpression(a)||a.operatorToken.kind!==m.SyntaxKind.EqualsToken)continue;let d=a.left;if(m.isPropertyAccessExpression(d)&&m.isPropertyAccessExpression(d.expression)&&m.isIdentifier(d.expression.expression)&&d.expression.expression.text===t&&d.expression.name.text==="prototype"){let l=d.name.text;m.isFunctionExpression(a.right)?r.push({name:l,fn:a.right,walk:!0}):m.isArrowFunction(a.right)&&r.push({name:l,fn:a.right,walk:!1})}}if(r.length===0||r.length+1>Yi)return null;let i=gu(e,n,t);i.pushMember("constructor",s,"ctor",void 0);for(let o of r){let a=o.walk&&!_s.has(o.name)&&m.isFunctionExpression(o.fn)?o.fn.body:void 0;i.pushMember(o.name,o.fn,"method",a)}return i.finish()}function Y_(e,n,t){for(let s of n.statements)if(m.isClassDeclaration(s)&&s.name?.text===t)return V_(e,n,t,s);return X_(e,n,t)}function J_(e,n,t,s,r){let i={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return i;let o=new Set(t.map(p=>p.packageName)),a=new Set(t.map(p=>p.path)),d=new Set,l=new Set,c=0;for(let p of n){if(!o.has(p.packageName))continue;let u=G_(e.appRoot,p.packageRootRel,p.sourcePath);if(u===null)continue;let f=e.toRel(u);if(f===null)continue;let h=`${f}#${p.container}`;if(l.has(h)||!d.has(f)&&d.size>=so)continue;let g=on(u);if(g===null)continue;let y;try{y=m.createSourceFile(f,g,m.ScriptTarget.Latest,!0,m.ScriptKind.JS)}catch{continue}let _=Y_(f,y,p.container);if(_===null)continue;d.add(f),l.add(h);let b=new Map,x=new Map;for(let w of _.members){let I=r.methodFor(p.packageName,p.container,w.name,w.kind);b.set(w.name,I),x.set(I,w.id)}let k=0;for(let w of _.members){if(w.body===void 0)continue;let I=(N,v)=>{if(v&&m.isCallExpression(N)&&m.isPropertyAccessExpression(N.expression)&&N.expression.expression.kind===m.SyntaxKind.ThisKeyword){let F=b.get(N.expression.name.text);if(F!==void 0){let P=`${f}#depclass:${p.container}.${w.name}#c${String(k)}`;k+=1,i.callSites.push({id:P,enclosingFunctionId:w.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:ot(f,N,y)}),i.callEdges.push({callSiteId:P,calleeFunctionId:F,resolution:"field-based"})}}let C=m.isFunctionExpression(N)||m.isFunctionDeclaration(N)||m.isMethodDeclaration(N)||m.isConstructorDeclaration(N)||m.isGetAccessorDeclaration(N)||m.isSetAccessorDeclaration(N)||m.isClassLike(N),R=m.isArrowFunction(N)?v:C?!1:v;m.forEachChild(N,F=>{I(F,R)})};I(w.body,!0)}for(let w of s){let I=x.get(w.calleeFunctionId);I!==void 0&&i.callEdges.push({callSiteId:w.callSiteId,calleeFunctionId:I,resolution:"field-based"})}if(i.functions.push(..._.functions),i.classes.push(_.classNode),!a.has(f)){a.add(f),i.modules.push({id:f,packageName:p.packageName,versionRange:"",path:f,moduleSystem:"cjs",isEntrypoint:!1});let w=r.moduleFor(p.packageName),I=`${String(w)}#depclass${String(c)}`;c+=1,i.imports.push({id:I,moduleId:w,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),i.importEdges.push({importId:I,resolvedModuleId:f})}i.diagnostics.push({code:"dep-class-corridor",path:f,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(_.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return i}function Z_(e,n,t,s){let r=new Set(e.modules.filter(d=>d.isEntrypoint).map(d=>d.packageName)),i=new Map(e.functions.map(d=>[d.id,d.moduleId])),o=new Map;for(let d of e.callSites){if(d.resolution!=="unresolved")continue;let l=i.get(d.enclosingFunctionId);l!==void 0&&o.set(l,(o.get(l)??0)+1)}let a=[];for(let d of e.modules){if(d.externalSurface===!0)continue;let l=n.get(d.path);if(l===void 0||t.has(d.path)||r.has(d.packageName)&&s.has(d.path)&&!d.path.split("/").includes("node_modules"))continue;let c=o.get(d.id)??0;if(c===0&&M_(l))continue;let p=c>0?`${String(c)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:d.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:d.id})}return a}function yu(e,n,t=[],s={},r=!1){let i=new Gi,o=l_(e,n,i),a=new Set;for(let k of o.computedLoads.values())for(let w of k)if(w.seedable)for(let I of w.candidateRels)a.add(I);let d=new Map;for(let k of e.sourceFiles){let w=e.toRel(k.fileName);if(w===null||!a.has(w)||w.split("/").includes("node_modules"))continue;let I=K_(w,k);I.length>0&&d.set(w,I)}let l=d.size===0?o.modules:o.modules.map(k=>d.has(k.path)&&!k.isEntrypoint?{...k,isEntrypoint:!0}:k),c={...o,modules:l},p=W_(e,c,i,d,s),u=P_(e,o,p.functions,p.mintSeedAliases),f=new Set(o.modules.map(k=>k.path)),h=u_(e.depReach,i,f),g=[...c.modules,...h.modules,...i.modules()],y=J_(e,t,g,p.callEdges,i),_=[];if(r){let k="#default",w=new Set;for(let N of p.callEdges){let v=String(N.calleeFunctionId);!v.startsWith("pkg:")||!v.endsWith(k)||w.add(v.slice(4,v.length-k.length))}let I=new Map;for(let N of e.depReach.edges){if(!("surface"in N.from)||"surface"in N.to)continue;let v=N.from.surface;I.set(v,I.has(v)?null:N.to.module)}for(let N of w){let v=I.get(N);if(v==null)continue;let C=d_(kn.join(e.appRoot,v));if(C===null||C==="default")continue;let R=i.exportFor(N,C),F=`pkg:${N}${k}`;for(let P of p.callEdges)String(P.calleeFunctionId)===F&&_.push({callSiteId:P.callSiteId,calleeFunctionId:R,resolution:"field-based"})}}let b={modules:[...c.modules,...h.modules,...y.modules,...i.modules()],exports:[...p.exports,...u.exports],imports:[...o.imports,...h.imports,...y.imports],functions:[...p.functions,...i.functions(),...y.functions],callSites:[...p.callSites,...y.callSites],classes:[...p.classes,...i.classes(),...y.classes],callEdges:[...p.callEdges,...y.callEdges,..._],importEdges:[...o.importEdges,...h.importEdges,...y.importEdges],exportBindings:[...p.exportBindings,...u.exportBindings],inheritEdges:[]},x=new Map;for(let k of e.sourceFiles){let w=e.toRel(k.fileName);w!==null&&x.set(w,k)}return{graph:b,diagnostics:[...u.diagnostics,...y.diagnostics,...Z_(b,x,new Set(e.diagnostics.filter(k=>k.code==="dependency-body").map(k=>k.path)),o.appOwnedPaths)],loadSites:o.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var Q_=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,io=/^[A-Za-z0-9_$.-]{1,128}$/u;function ex(e){return Q_.test(e.calleePackage)?io.test(e.anchorExport)?io.test(e.calleeExport)?e.anchorContainer!==null&&!io.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!io.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function sr(e,n){let t=[],s=[],r=new Map(e.modules.map(l=>[l.id,l])),i=new Map(e.classes.map(l=>[l.id,l.name])),o=(l,c,p)=>e.functions.some(u=>{if(u.name!==c)return!1;let f=r.get(u.moduleId);return f===void 0||f.packageName!==l?!1:(u.enclosingClassId!==void 0?i.get(u.enclosingClassId)??null:null)===p}),a=(l,c,p)=>{for(let u of e.functions){if(u.name!==c)continue;let f=r.get(u.moduleId);if(!(f===void 0||f.packageName!==l||(u.enclosingClassId!==void 0?i.get(u.enclosingClassId)??null:null)!==p))return u.id}return null},d=[...n].sort((l,c)=>l.modelId<c.modelId?-1:l.modelId>c.modelId?1:0);for(let l of d){if(l.edges.length>64){t.push(`model ${l.modelId}: ${String(l.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let c=l.edges.map(ex).find(f=>f!==null);if(c!==void 0){t.push(`model ${l.modelId}: hostile/invalid edge field ${c} \u2014 model refused WHOLE`);continue}let p=0,u=0;for(let f of l.edges){if(!o(l.packageName,f.anchorExport,f.anchorContainer)){u+=1;continue}s.push({modelId:l.modelId,kind:f.kind,anchor:{packageName:l.packageName,exportName:f.anchorExport,container:f.anchorContainer},callee:{packageName:f.calleePackage,exportName:f.calleeExport,container:f.calleeContainer,realFunctionId:a(f.calleePackage,f.calleeExport,f.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${l.modelId}: ${String(p)} edge(s) lowered, ${String(u)} reference-gated`):t.push(`model ${l.modelId}: refused \u2014 no anchor surface in the graph (${String(u)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:s,notes:t}}}var nx={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function ra(e){try{let n=bc(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(a=>a.split(Tn.sep).join("/"))),{graph:s,diagnostics:r,loadSites:i,bindingApplicability:o}=yu(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:s,diagnostics:[...n.diagnostics,...r],loadSites:i,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...o!==void 0?{bindingApplicability:o}:{}}}catch(n){return{graph:nx,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function _u(e,n){let t=512,s=(r,i,o)=>{if(!(t<=0||i>12)){if(t-=1,typeof r=="string"){n(r,o);return}if(Array.isArray(r)){for(let a of r)s(a,i+1,o);return}if(r!==null&&typeof r=="object")for(let[a,d]of Object.entries(r))a==="types"||a==="typings"||s(d,i+1,o||a.includes("*"))}};s(e,0,!1)}function Su(e,n,t,s=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=bt(Tn.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||s&&!rt(r)?null:r===e?"":r.slice(n.length).split(Tn.sep).join("/")}var tx=1024*1024,sx=4096;function xu(e,n){let t=e.toLowerCase(),s=0;for(;;){let r=t.indexOf(n,s);if(r===-1)return null;let i=r===0?" ":t[r-1],o=r+n.length;for(;o<e.length&&(e[o]===" "||e[o]==="	"||e[o]===`
-`||e[o]==="\r");)o+=1;if(/[a-z0-9_:-]/i.test(i??" ")||e[o]!=="="){s=r+n.length;continue}for(o+=1;o<e.length&&(e[o]===" "||e[o]==="	"||e[o]===`
-`||e[o]==="\r");)o+=1;let a=e[o];if(a==='"'||a==="'"){let l=e.indexOf(a,o+1);return l===-1?null:e.slice(o+1,l)}let d=o;for(;d<e.length&&!/[\s>]/.test(e[d]??"");)d+=1;return e.slice(o,d)}}function rx(e){let n=[],t=e.toLowerCase(),s=0;for(;;){let r=t.indexOf("<script",s);if(r===-1)break;let i=t[r+7];if(i!==void 0&&/[a-z0-9-]/.test(i)){s=r+7;continue}let o=e.indexOf(">",r);if(o===-1)break;s=o+1;let a=e.slice(r+7,o);if(a.length>sx)continue;let d=xu(a,"type");n.push({module:(d??"").trim().toLowerCase()==="module",src:xu(a,"src")})}return n}function ox(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function ix(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function ax(e){let n=bt(e),t=n.endsWith(Tn.sep)?n:n+Tn.sep,s=new Set,r=[],i=[],o=[],a=[],d=[],l=!1,c=(E,T,K=!1,J)=>{let W=Su(n,t,E);return W===null||W.length===0?"unresolved":s.has(W)?"duplicate":(s.add(W),r.push(W),i.push({source:T,specifier:Mn(J??(typeof E=="string"?E:"")),entrypoint:W,launch:K}),"added")},p=new Set,u=(E,T,K=!1)=>{let J=c(E,T),W=typeof E=="string"&&E.includes("\\")?c(E.split("\\").join("/"),T,!1,E):"unresolved";if(J!=="unresolved"||W!=="unresolved"||typeof E!="string"||E.trim().length===0||E.endsWith(".d.ts")||E.endsWith(".d.mts")||E.endsWith(".d.cts"))return;if(K&&E.includes("*")){let Y=kc(n,E),V=!1;if(Y!==null){for(let fe of Y.matches)c(fe,T,!1,E)!=="unresolved"&&(V=!0);if(!Y.truncated&&V)return}a.push({source:T,file:"package.json",detail:`\`${Mn(E)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let se=`${T}\0${E}`;p.has(se)||(p.add(se),a.push({source:T,file:"package.json",detail:`\`${Mn(E)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},f=[],h=(E,T)=>{o.push({source:E,file:E,detail:T.detail}),f.push({code:T.code,path:E,detail:`${E} ${T.detail}`})},g,y,_,b=null,x=ao(n,t,"package.json",Pt);x.kind==="refused"&&h("package.json",x);try{let E=x.kind==="ok"?JSON.parse(x.text):{};if(b=x.kind==="ok"?E:null,u(E.main,"main"),typeof E.bin=="string")u(E.bin,"bin");else if(E.bin!==null&&typeof E.bin=="object")for(let K of Object.values(E.bin))u(K,"bin");_u(E.exports,(K,J)=>{u(K,"exports",J)}),typeof E.browser=="string"?u(E.browser,"browser"):_u(E.browser,K=>{c(K,"browser")});let T=E.scripts;if(T!==null&&typeof T=="object"){let K=T;g=K.start,y=K.prestart,_=K.poststart}}catch{}if(r.length===0)try{bt(Tn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let k=(E,T)=>{if(typeof E=="string"&&E.trim().length>0){let K=ta(E,T,"package.json",c,o,!1)==="used";return K&&(l=!0),K?"resolved":"gapped"}return E===void 0||typeof E=="string"?"absent":(o.push({source:T,file:"package.json",detail:`${T} is not a string; no entry file could be read from it`}),"gapped")},w=k(g,"scripts.start"),I=k(y,"scripts.prestart"),N=k(_,"scripts.poststart"),v=w==="resolved"&&I!=="gapped"&&N!=="gapped",C=ao(n,t,"Procfile",65536);if(C.kind==="refused")h("Procfile",C);else if(C.kind==="ok"){let{entries:E,truncated:T,unnamedLines:K}=ji(C.text);T&&o.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),K>0&&o.push({source:"Procfile",file:"Procfile",detail:`${String(K)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let J of E)ta(J.command,`Procfile:${J.name}`,"Procfile",c,o,v)==="used"&&(l=!0)}for(let E of["Dockerfile","docker-compose.yml","docker-compose.yaml","compose.yml"]){let T=ao(n,t,E,Di);if(T.kind==="refused"){h(E,T);continue}if(T.kind!=="ok")continue;let{commands:K,truncated:J}=Fi(T.text);J&&o.push({source:E,file:E,detail:`${E} declares more launch commands than cupel parses; the remainder was not read`});for(let W of K)ta(W.command,`${E}:${W.label}`,E,c,o,v)==="used"&&(l=!0)}let R=r.length===0,F=ao(n,t,"index.html",tx);if(F.kind==="ok")for(let E of rx(F.text)){if(E.src===null)continue;let T=Mn(E.src);if(!E.module){d.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${T}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(ox(E.src)){d.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${T}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}c(ix(E.src),"index.html",!1,E.src)==="unresolved"&&o.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${T}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else F.kind==="refused"&&d.push({kind:F.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${F.detail}`,root:""});let P=R?Ci(n,b):null;if(P!==null){let E=0;for(let T of Ti(n,P).roots)c(T,`framework:${P.name}`)==="added"&&(E+=1);E>0&&f.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${P.name}'s directory conventions (recognised via ${P.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let U=E=>E.map(T=>({...T,root:""}));return{entrypoints:r,sources:U(i),gaps:U(o),surfaceGaps:U(a),launchResolved:l,diagnostics:f,framework:P,observations:d}}function ao(e,n,t,s){let r;try{r=bt(Tn.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let i=ms(r,s);return i.kind==="ok"?i:i.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(i.bytes)} bytes, over the ${String(s)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function ta(e,n,t,s,r,i){let o=Li(e);if(o.kind==="delegates")return i?"used":(r.push({source:n,file:t,detail:`\`${Mn(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(o.kind==="foreign")return"foreign";if(o.kind==="unparsed")return r.push({source:n,file:t,detail:`\`${Mn(e)}\`: ${o.reason}`}),"gapped";let a=s(o.specifier,n,!0),d=o.alt===void 0?"unresolved":s(o.alt,n,!0);return a==="unresolved"&&d==="unresolved"?(r.push({source:n,file:t,detail:`\`${Mn(o.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function bs(e,n){return e===""?n:`${e}/${n}`}function ku(e,n){let t=bt(e),s=t.endsWith(Tn.sep)?t:t+Tn.sep,r=new Set,i=[],o=[],a=[],d=[],l=[],c=[],p=!1,u=null,f=[...n].sort((h,g)=>h.rel===""?-1:g.rel===""?1:h.rel<g.rel?-1:h.rel>g.rel?1:0);for(let h of f){let g=bs(h.rel,"package.json"),y=h.rel===""?".":h.rel,_;try{_=bt(h.abs)}catch{a.push({source:"root",file:g,detail:`root \`${y}\` could not be resolved; not seeded`,root:h.rel});continue}if(_!==t&&!_.startsWith(s)){a.push({source:"root",file:g,detail:`root \`${y}\` resolves outside the scan root; refused, not seeded`,root:h.rel});continue}let b;try{b=ax(_)}catch{a.push({source:"root",file:g,detail:`root \`${y}\` could not be read; not seeded`,root:h.rel});continue}for(let x of b.sources){let k=bs(h.rel,x.entrypoint),w,I;try{w=bt(Tn.resolve(t,k)),I=bt(Tn.resolve(_,x.entrypoint))}catch{a.push({source:x.source,file:g,detail:`\`${x.specifier}\` re-based to \`${k}\` did not resolve; not seeded`,root:h.rel});continue}if(!w.startsWith(s)||w!==I){a.push({source:x.source,file:g,detail:`\`${x.specifier}\` re-based to \`${k}\` escapes the scan root or names another file; refused, not seeded`,root:h.rel});continue}r.has(k)||(r.add(k),i.push(k),o.push({...x,entrypoint:k,root:h.rel}))}b.launchResolved&&(p=!0);for(let x of b.gaps)a.push({...x,file:bs(h.rel,x.file),root:h.rel});for(let x of b.surfaceGaps)d.push({...x,file:bs(h.rel,x.file),root:h.rel});for(let x of b.diagnostics)l.push({...x,path:bs(h.rel,x.path)});for(let x of b.observations)c.push({...x,file:bs(h.rel,x.file),root:h.rel});h.rel===""&&(u=b.framework)}return{entrypoints:i,sources:o,gaps:a,surfaceGaps:d,launchResolved:p,diagnostics:l,framework:u,observations:c}}function oa(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let s=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${s}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function ia(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let s=[...new Set(t.slice(0,3).map(r=>r.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${s}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function wu(e,n){let t=bt(e),s=t.endsWith(Tn.sep)?t:t+Tn.sep,r=new Set,i=[],o=[];for(let a of n){let d=Su(t,s,a,!0);if(d===null||d.length===0){o.push(a);continue}r.has(d)||(r.add(d),i.push(d))}return{entrypoints:i,rejected:o}}import{readdirSync as af,readFileSync as Na,realpathSync as Aa,statSync as pr}from"node:fs";import Jn from"node:path";function lx(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let s=t+2;for(;s<e.length&&e.charCodeAt(s)===32;)s+=1;let r=e.charCodeAt(s);return r===38||r===42}function Vn(e,n,t){let s=n.maxLines??2e6,r=n.maxLineBytes??16384,i=!1,o=!1,a=0,d=0,l=e.charCodeAt(0)===65279?1:0;for(;l<=e.length;){let c=e.indexOf(`
-`,l),p=c===-1;p&&(c=e.length);let u=c>l&&e.charCodeAt(c-1)===13?c-1:c;if(d+=1,d>s){i=!0;break}if(u-l>r)a+=1;else{let f=l;for(;f<u&&e.charCodeAt(f)===32;)f+=1;let h=f-l,g=u;for(;g>f&&(e.charCodeAt(g-1)===32||e.charCodeAt(g-1)===9);)g-=1;if(f<g&&e.charCodeAt(f)!==35){let y=e.slice(f,g);if(lx(y)){o=!0;break}t(h,y)}}if(p)break;l=c+1}return{truncated:i||a>0,refusedAnchors:o,oversizeLines:a}}function at(e){let n=e.charCodeAt(0);if(n===34||n===39){let s=e.indexOf(String.fromCharCode(n),1);if(s===-1)return null;let r=s+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,s+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function jn(e){return e.endsWith(":")}function Me(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function lo(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,s=t.indexOf("/");if(n){if(s<=0||t.indexOf("/",s+1)!==-1)return!1}else if(s!==-1)return!1;let r=n?[t.slice(0,s),t.slice(s+1)]:[t];for(let i of r){if(i.length===0||i.charCodeAt(0)===46||i.charCodeAt(0)===95)return!1;for(let o=0;o<i.length;o+=1){let a=i.charCodeAt(o);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function rr(e){return lo(e)?`node_modules/${e}`:""}function or(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var co=2e5,vu=64,uo=1024,dx=5,cx=[1,2,3];function ux(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let s=e.slice(t+n.length);if(s==="")return null;let r=s.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function Eu(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let s=t.indexOf("@",1);if(s>0){let r=t.slice(0,s),i=t.slice(s+1);if(r.length>0&&i.length>0)return[{name:r,version:i}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function Xn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Nu(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Au(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Iu(e,n,t,s,r=!1){let i=JSON.stringify([n,t,s]);if(!e.seen.has(i)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(i),e.deps.push({name:n,version:t,lockKey:s,dev:r})}}function fx(e,n){for(let[t,s]of Object.entries(e)){if(t==="")continue;if(!Au(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),i=Xn(s);if(i===null){n.unread+=1;continue}if(i.link===!0)continue;let o=i.name,a=typeof o=="string"&&o!==""?o:ux(t),d=i.version;if(a===null||typeof d!="string"){r&&(n.unread+=1);continue}let l=i.dev===!0||i.devOptional===!0;for(let c of Eu(a,d))Iu(n,c.name,c.version,t,l)}}function Ru(e,n,t){let s=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let i=0;i<s.length;i+=1){let o=s[i];if(o===void 0)break;for(let[a,d]of Object.entries(o.deps)){if(!Au(n))return{depthCapped:r};if(a===""){n.unread+=1;continue}let l=Xn(d);if(l===null){n.unread+=1;continue}let c=o.pathSafe&&lo(a),p=c?`${o.prefix}node_modules/${a}`:"",u=c&&p.length<=uo,f=u?p:"",h=l.version,g=l.dev===!0||o.dev;if(l.link!==!0&&typeof h=="string"&&h!=="")for(let _ of Eu(a,h))Iu(n,_.name,_.version,f,g);else n.unread+=1;let y=Xn(l.dependencies);if(y!==null){if(o.depth+1>t){r=!0;continue}s.push({deps:y,prefix:u?`${f}/`:o.prefix,depth:o.depth+1,pathSafe:u,dev:g})}}}return{depthCapped:r}}function px(e,n,t){let s=Nu(n.maxEntries),{depthCapped:r}=Ru(e,s,t),i=[],o=new Set(n.deps.map(l=>JSON.stringify([l.name,l.version]))),a=new Set,d=[];for(let l of s.deps){if(l.version.includes(":"))continue;let c=JSON.stringify([l.name,l.version]);o.has(c)||a.has(c)||(a.add(c),d.length<dx&&d.push(or(l.name,l.version)))}if(a.size>0){let l=a.size-d.length;i.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${d.join(", ")}${l>0?`, and ${String(l)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(s.capped||r)&&i.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),i}function fo(e,n={}){let t=[],s;try{s=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=Xn(s);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let i=r.lockfileVersion,o=typeof i=="number"&&Number.isInteger(i)?i:null,a=typeof i=="number"?String(i):"?",d=Xn(r.packages),l=Xn(r.dependencies);if(d===null&&l===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(o===null||!cx.includes(o))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let c=n.maxDepth??vu,p=Nu(n.maxEntries??co),u=!1;return d!==null?(fx(d,p),l!==null&&t.push(...px(l,p,c))):l!==null&&(u=Ru(l,p,c).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),u&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(c)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||u}}var mx=["workspace:","link:","portal:","file:","exec:"];function hx(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function aa(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let s=n.slice(0,t),r=n.slice(t+1);if(s.length===0)return[];for(let a of mx)if(r.startsWith(a))return[];if(!r.startsWith("npm:"))return[s];let i=r.slice(4),o=i.indexOf("@",1);if(o>0){let a=i.slice(0,o);return a.length>0?[a]:[s]}return i.length===0||hx(i)?[s]:[s,i]}function gx(e){if(jn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let s=e.charCodeAt(t);if(s===34||s===39){n===0?n=s:n===s&&(n=0);continue}if(n===0&&s===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function yx(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let s of n.split(",")){let r=s.trim();r.length>0&&t.push(r)}return t}function _x(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let s=t.length;for(;s<n.length&&s<t.length+3;){let i=n.charCodeAt(s);if(i<48||i>57)break;s+=1}let r=n.slice(t.length,s);return r.length>0?r:null}function Ou(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Me(e.slice(8).trim());return t.length>0?t:null}function la(e,n={}){let t=[],s=[],r=new Set,i=n.maxEntries??2e5,o=!1,a=null,d=!1,l=[],c=!1,p=-1,u=!1,f=0,h=()=>{l.length>0&&!c&&(f+=1)},g=Vn(e,n,(x,k)=>{if(x===0){h(),l=[],c=!1,p=-1,d=!1;let I=gx(k);if(I===null)return;let N=Me(I.trim());if(N==="__metadata"){o=!0,d=jn(k);return}for(let v of yx(N))l.push(...aa(v));return}if(d){if(x===2&&a===null){let I=Ou(k);I!==null&&(a=I)}return}if(l.length===0||(p===-1&&(p=x),x!==p||c))return;let w=Ou(k);if(w!==null){c=!0;for(let I of l){let N=JSON.stringify([I,w]);if(!r.has(N)){if(s.length>=i){u=!0;return}r.add(N),s.push({name:I,version:w,lockKey:rr(I),dev:!1})}}}});h();let y=o?"yarn.lock (Berry)":"yarn.lock (v1)";if(g.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};g.oversizeLines>0&&t.push(`${y} has ${String(g.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),u&&t.push(`${y} exceeds ${String(i)} entries; truncated`);let _=a??_x(e),b=_===null?null:Number(_.split(".")[0]);return _!==null&&(b===null||!Number.isInteger(b)||b<1||b>8)&&t.push(`${y} declares unsupported lockfileVersion ${_} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),f>0&&t.push(`${y} has ${String(f)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:s,diagnostics:t,truncated:g.truncated||u}}function da(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.indexOf("_");return s!==-1&&(n=n.slice(0,s)),n.trim()}function ca(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function mo(e){let n=Me(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.charCodeAt(0)===47;if(s&&(n=n.slice(1)),n.length===0)return null;if(!s&&n.charCodeAt(0)!==64){let c=n.indexOf("/"),p=n.indexOf("@",1);c>0&&(p===-1||c<p)&&n.slice(0,c).includes(".")&&n.indexOf("/",c+1)!==-1&&(n=n.slice(c+1))}let r=n.charCodeAt(0)===64,i=r?n.indexOf("/"):-1;if(r&&i<=0)return null;let o=r?i+1:0,a=-1;for(let c=o;c<n.length;c+=1){let p=n.charCodeAt(c);if(p===47||p===64){a=c;break}}if(a<=o)return null;let d=n.slice(0,a),l=da(n.slice(a+1));return ca(l)?{name:d,version:l}:null}var xx=new Set(["packages","snapshots","importers"]),bx=new Set([5,6,7,8,9]);function Sx(e){let n=Me(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function po(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Me(e.slice(0,n).trim()),value:Me(t)}}function ua(e,n={}){let t=[],s=[],r=new Set,i=n.maxEntries??2e5,o="",a=null,d=!1,l=0,c=[],p=(f,h)=>{let g=JSON.stringify([f,h]);if(!r.has(g)){if(s.length>=i){d=!0;return}r.add(g),s.push({name:f,version:h,lockKey:rr(f),dev:!1})}},u=Vn(e,n,(f,h)=>{if(f===0){let g=at(h);if(o=g===null?"":Me(g.trim()),a=null,o==="lockfileVersion"){let y=po(h),_=y===null?null:Sx(y.value);y!==null&&(_===null||!bx.has(_))&&c.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),o="";return}if(xx.has(o)&&!jn(h)){let y=po(h)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(l+=1),o=""}return}if(o==="packages"||o==="snapshots"){if(f!==2)return;let g=at(h),y=g===null?null:mo(g);if(y===null){l+=1;return}p(y.name,y.version);return}if(o==="importers"){if(f===6){let g=po(h);if(g===null){a=h.endsWith(":")?Me(h.slice(0,-1).trim()):null;return}a=null;let y=da(g.value);ca(y)&&p(g.key,y);return}if(f===8&&a!==null){let g=po(h);if(g===null||g.key!=="version")return;let y=da(g.value);ca(y)&&p(a,y)}}});return u.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...c),u.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(u.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),d&&t.push(`pnpm-lock.yaml exceeds ${String(i)} entries; truncated`),l>0&&t.push(`pnpm-lock.yaml has ${String(l)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:s,diagnostics:t,truncated:u.truncated||d})}function lt(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var Mu=1e6,Pu=2e5,kx=4096,wx=65536,vx=262144,ir=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Tu(e){let n=[];for(let t of e.split(/\r?\n/u)){if(t==="")break;let s=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(t);s!==null&&n.push([(s[1]??"").toLowerCase(),s[2]??""])}return n}function $u(e){if(e.length>Mu)return null;let n,t;for(let[s,r]of Tu(e))s==="name"&&n===void 0?n=r.trim():s==="version"&&t===void 0&&(t=r.trim());return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}var Ex=/^([A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)/u;function Lu(e){if(e.length>Mu)return[];let n=new Set;for(let[t,s]of Tu(e)){if(t!=="requires-dist")continue;let r=Ex.exec(s.trim())?.[1];r!==void 0&&n.add(lt(r))}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function Du(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&ir.test(n))}function Fu(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let s=e[t];if(s==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=s}return n}function ju(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Bu(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function Ku(e){let n=e.split(/\r?\n/u);return n.length>Pu?n.slice(0,Pu):n}function zu(e){let n=new Set;for(let t of Ku(e)){if(t==="")continue;let s=Fu(t).split("/"),r=s[0]??"";if(ju(r))continue;if(s.length>1){ir.test(r)&&n.add(r);continue}let i=Bu(r);i!==null&&ir.test(i)&&n.add(i)}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function Nx(e){let n=e.split("/"),t=n[0]??"";if(ju(t))return null;let s=n[n.length-1]??"",r=Bu(s);if(r===null)return null;let i=n.slice(0,-1);if(i.some(a=>!ir.test(a)||a==="__pycache__"))return null;let o=r==="__init__"?i:[...i,r];return o.length===0||!ir.test(r==="__init__"?i[i.length-1]??"":r)?null:o}function Uu(e,n=kx){let t=new Set,s=0,r=0,i=!1;for(let o of Ku(e)){if(o==="")continue;let a=Fu(o),d=Nx(a);if(d!==null){s+=1,(a.endsWith(".so")||a.endsWith(".pyd"))&&(r+=1);for(let l=1;l<=Math.min(2,d.length);l+=1){let c=d.slice(0,l).join(".");if(!t.has(c)){if(t.size>=n){i=!0;break}t.add(c)}}}}return{prefixes:[...t].sort((o,a)=>o<a?-1:o>a?1:0),moduleFiles:s,extensionModules:r,capped:i}}function Ax(e){if(e.length>vx)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let s=t.trim();if(!(s===""||s.startsWith("#")||s.startsWith(";"))){if(s.startsWith("[")){let r=s.slice(1,s.endsWith("]")?-1:void 0).trim();n=r==="console_scripts"||r==="gui_scripts";continue}if(n&&s.includes("="))return!0}}return!1}function qu(e){if(e.length>wx)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,s=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:s?.editable===!0}}function ar(e,n){let t=$u(e);if(t===null)return null;let s=n.topLevelText!==void 0?Du(n.topLevelText):[],r=s.length>0?s:n.recordText!==void 0?zu(n.recordText):[],i=n.recordText!==void 0?Uu(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},o=n.entryPointsText!==void 0?Ax(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",a=n.directUrlText!==void 0?qu(n.directUrlText)?.editable??!1:!1;return{name:lt(t.name),version:t.version,importNames:r,modulePrefixes:i.prefixes,moduleFiles:i.moduleFiles,editable:a,consoleScripts:o,extensionModules:i.extensionModules,recordKnown:n.recordText!==void 0,requiresDist:Lu(e)}}function Cu(e,n,t){let s=e.get(n);s===void 0?e.set(n,[t]):s.includes(t)||s.push(t)}function ho(e){let n=new Map,t=new Map,s=[];for(let r of e){if(r.importNames.length===0){s.push(r);continue}for(let i of r.importNames)Cu(n,i,r);for(let i of r.modulePrefixes)Cu(t,i,r)}return{byImportName:n,byModulePrefix:t,unmapped:s}}function lr(e,n){let t=n.split(".").filter(r=>r.length>0),s=t[0];if(s===void 0)return[];for(let r=Math.min(2,t.length);r>=1;r-=1){let i=e.byModulePrefix.get(t.slice(0,r).join("."));if(i!==void 0&&i.length>0)return i}return e.byImportName.get(s)??[]}var dr=class{nodes=new Map;children=new Map;importers=new Map;over=!1;node(n,t,s){if(!this.nodes.has(n)){if(this.nodes.size>=2e5){this.over=!0;return}this.nodes.set(n,{name:t,version:s})}}edge(n,t){let s=this.children.get(n);s===void 0?this.children.set(n,[t]):s.includes(t)||s.push(t)}done(){return this.over||this.importers.size===0?null:{nodes:this.nodes,children:this.children,importers:this.importers}}},Tt="importer:",Jt="node_modules/";function pa(e){let n;try{n=JSON.parse(e)}catch{return null}let t=Xn(Xn(n)?.packages);if(t===null)return null;let s=new dr,r=new Map;for(let[l,c]of Object.entries(t)){let p=Xn(c);p!==null&&r.set(l,p)}let i=l=>l.startsWith(Jt)||l.includes(`/${Jt}`),o=l=>{let c=l;for(let p=0;p<8;p+=1){let u=r.get(c);if(u===void 0)return null;if(u.link!==!0)return c;let f=u.resolved;if(typeof f!="string")return null;c=f}return null},a=l=>i(l)?l:`${Tt}${l}`,d=(l,c)=>{let p=l;for(;;){let u=p===""?`${Jt}${c}`:`${p}/${Jt}${c}`;if(r.has(u))return o(u);if(p==="")return null;let f=p.lastIndexOf(`/${Jt}`);p=f===-1?"":p.slice(0,f)}};for(let[l,c]of r){if(c.link===!0)continue;let p=i(l);if(p){let f=typeof c.name=="string"&&c.name!==""?c.name:l.slice(l.lastIndexOf(Jt)+Jt.length),h=c.version;if(typeof h!="string")continue;s.node(l,f,h)}else s.importers.set(`${Tt}${l}`,l===""?"package.json":`${l}/package.json`);let u=p?["dependencies","optionalDependencies","peerDependencies"]:["dependencies","devDependencies","optionalDependencies","peerDependencies"];for(let f of u){let h=Xn(c[f]);if(h!==null)for(let g of Object.keys(h)){let y=d(l,g);y!==null&&y!==l&&s.edge(a(l),a(y))}}}return s.done()}function go(e){let n=at(e);if(n===null)return null;let t=e.slice(n.length+1).trim();return t.length===0?null:{key:Me(n.trim()),value:Me(t)}}var fa=new Set(["dependencies","optionalDependencies","devDependencies"]);function ma(e,n={}){let t=new dr,s=[],r="",i=!1,o=null,a="",d=null,l=u=>u==="."||u===""?"package.json":`${u}/package.json`,c=(u,f,h,g)=>{if(h===f){let y=go(g);d=y===null&&jn(g)?Me(g.slice(0,-1).trim()):null,y!==null&&s.push({from:u,name:y.key,token:y.value});return}if(h===f+2&&d!==null){let y=go(g);y?.key==="version"&&s.push({from:u,name:d,token:y.value})}},p=Vn(e,n,(u,f)=>{if(u===0){let h=at(f);r=h===null?"":Me(h.trim()),r==="lockfileVersion"&&(i=(go(f)?.value??"").startsWith("5")),o=null,fa.has(r)&&jn(f)&&(o=`${Tt}.`,t.importers.set(o,"package.json"),a=r,d=null);return}if(fa.has(r)){o!==null&&c(o,2,u,f);return}if(r==="importers"){if(u===2){let h=at(f),g=h===null?".":Me(h.trim());o=`${Tt}${g}`,t.importers.set(o,l(g)),a="";return}if(o===null)return;if(u===4){a=jn(f)?Me(f.slice(0,-1).trim()):"",d=null;return}fa.has(a)&&c(o,6,u,f);return}if(!(r!=="packages"&&r!=="snapshots")){if(u===2){let h=at(f);if(h===null){o=null;return}let g=Me(h.trim()),y=g.startsWith("/")?g.slice(1):g,_=mo(g);o=_===null?null:y,_!==null&&t.node(y,_.name,_.version),a="";return}if(o!==null){if(u===4){a=jn(f)?Me(f.slice(0,-1).trim()):"";return}if(u===6&&(a==="dependencies"||a==="optionalDependencies")){let h=go(f);h!==null&&s.push({from:o,name:h.key,token:h.value})}}}});if(p.refusedAnchors||p.truncated)return null;for(let u of s){if(u.token.startsWith("link:"))continue;let h=(u.token.startsWith("/")?u.token.slice(1):null)??(i?`${u.name}/${u.token}`:`${u.name}@${u.token}`);t.nodes.has(h)&&t.edge(u.from,h)}return t.done()}function Ix(e,n){let t=e.indexOf("@npm:",1);return t<=0?null:e.slice(t+5)===n?e.slice(0,t):null}function ha(e,n,t={}){let s=new dr,r=new Map,i=[],o=null,a=-1,d=!1,l=-1,c=[],p=null,u=null,f=0,h=Vn(e,t,(g,y)=>{if(g===0){d=!1,a=-1,p=null,u=null;let k=jn(y)?y.slice(0,-1):null;if(o=null,c=[],k===null)return;let w=Me(k.trim());if(w==="__metadata"||(c=w.split(",").map(N=>Me(N.trim())).filter(N=>N.length>0),c.length===0))return;f+=1,o=`y${String(f)}`;for(let N of c)r.set(N,o);let I=c.find(N=>N.includes("@workspace:"));if(I!==void 0){let N=I.slice(I.indexOf("@workspace:")+11),v=`${Tt}${N}`;s.importers.set(v,N==="."||N===""?"package.json":`${N}/package.json`),o=v;for(let C of c)r.set(C,v)}return}if(o===null)return;if(a===-1&&(a=g),g===a){if(d=!1,y==="dependencies:"||y==="optionalDependencies:"){d=!0,l=-1;return}if(y.startsWith("version ")||y.startsWith("version:"))p=Me(y.slice(8).trim());else if(y.startsWith("resolution:"))u=Me(y.slice(11).trim());else return;let k=c[0];if(p!==null&&k!==void 0&&!o.startsWith(Tt)){let w=aa(k);if(w.length===1&&w[0]!==void 0)s.node(o,w[0],p);else if(u!==null){let I=Ix(u,p);I!==null&&s.node(o,I,p)}}return}if(!d||g<=a||(l===-1&&(l=g),g!==l))return;let _=at(y),b,x;if(_!==null&&y.charCodeAt(_.length)===58)b=Me(_.trim()),x=Me(y.slice(_.length+1).trim());else{let k=y.indexOf(" ");if(k<=0)return;b=Me(y.slice(0,k)),x=Me(y.slice(k+1).trim())}b.length>0&&x.length>0&&i.push({from:o,descriptor:`${b}@${x}`})});if(h.refusedAnchors||h.truncated)return null;if(s.importers.size===0){s.importers.set(`${Tt}.`,"package.json");for(let[g,y]of n)i.push({from:`${Tt}.`,descriptor:`${g}@${y}`})}for(let g of i){let y=g.descriptor.indexOf("@",1),_=g.descriptor.slice(y+1),b=_.includes(":")?g.descriptor:`${g.descriptor.slice(0,y)}@npm:${_}`,x=r.get(g.descriptor)??r.get(b);x!==void 0&&x!==g.from&&s.edge(g.from,x)}return s.done()}function ga(e,n,t,s){let r=new Map;for(let[k,w]of e.children)for(let I of w){let N=r.get(I);N===void 0?r.set(I,[k]):N.push(k)}let i=new Set,o=[...e.importers.keys()];for(let k=0;k<o.length;k+=1)for(let w of e.children.get(o[k])??[])i.has(w)||e.importers.has(w)||(i.add(w),o.push(w));let a=[...e.nodes].filter(([k,w])=>w.name===n&&w.version===t&&i.has(k)).map(([k])=>k).sort();if(a.length===0)return null;let d=new Map(a.map(k=>[k,0])),l=[...a];for(let k=0;k<l.length;k+=1){let w=l[k];for(let I of r.get(w)??[])d.has(I)||!i.has(I)||(d.set(I,(d.get(w)??0)+1),l.push(I))}let c=[...d.keys()].sort((k,w)=>(d.get(k)??0)-(d.get(w)??0)||(k<w?-1:k>w?1:0)),p=c.filter(k=>e.nodes.has(k)),u=c.length-p.length,f=new Map(p.map((k,w)=>[k,w])),h=[];for(let k of p)for(let w of e.children.get(k)??[])f.has(w)&&h.push([k,w]);let g=new Array(p.length).fill(0);for(let[k,w]of h){let I=Math.max(f.get(k)??0,f.get(w)??0);g[I]=(g[I]??0)+1}let y=0,_=0;for(;y<p.length&&y<s.maxNodes;){let k=g[y]??0;if(_+k>s.maxEdges)break;_+=k,y+=1}let b=new Map(p.slice(0,y).map((k,w)=>[k,`p${String(w)}`])),x=k=>{let I=(r.get(k)??[]).filter(N=>e.importers.has(N)).sort()[0];return I===void 0?null:e.importers.get(I)??null};return{nodes:p.slice(0,y).map(k=>{let w=e.nodes.get(k);return{id:b.get(k),name:w.name,version:w.version,directFrom:x(k)}}),edges:h.flatMap(([k,w])=>{let I=b.get(k),N=b.get(w);return I===void 0||N===void 0?[]:[{from:I,to:N}]}),truncated:p.length-y+u}}function ya(e){let n=new Map,t=new Set(["dependencies","devDependencies","optionalDependencies","peerDependencies"]),s=[],r=1,i=!1,o=e.charCodeAt(0)===65279?1:0;for(;o<e.length;){let a=e.charCodeAt(o);if(a===10)r+=1;else if(a===123||a===91){if(s.length>=64)return null;s.push({kind:a===123?"{":"[",key:null}),i=a===123}else if(a===125||a===93)s.pop(),i=!1;else if(a===44)i=s.at(-1)?.kind==="{";else if(a===58)i=!1;else if(a===34){let d=r,l=o+1;for(;l<e.length&&e.charCodeAt(l)!==34;){if(e.charCodeAt(l)===92)l+=1;else if(e.charCodeAt(l)===10)return null;l+=1}if(l>=e.length)return null;let c=s.at(-1);if(i&&c?.kind==="{"){let p;try{p=JSON.parse(e.slice(o,l+1))}catch{return null}c.key=p;let u=s.length===2?s[0]?.key:null;u!=null&&t.has(u)&&!n.has(p)&&n.set(p,d)}i=!1,o=l}o+=1}return s.length===0?n:null}var _a="importer:";function yo(e){let n=e.indexOf(" = ");if(n<=0)return null;let t=e.slice(n+3).trim();if(t.length<2||!t.startsWith('"')||!t.endsWith('"'))return null;let s=t.slice(1,-1);return s.includes('"')?null:{key:e.slice(0,n).trim(),value:s}}function Rx(e){let n=[],t=0;for(;;){let s=e.indexOf('"',t);if(s===-1)return n;let r=e.indexOf('"',s+1);if(r===-1)return n;n.push(e.slice(s+1,r)),t=r+1}}function Ox(e){let n=[],t=0;for(;;){let s=e.indexOf("{",t);if(s===-1)return n;let r=e.indexOf("}",s);if(r===-1)return n;let i=e.slice(s+1,r),o=[],a=i.indexOf("extra = [");if(a!==-1){let c=i.indexOf("]",a);c!==-1&&(o=Rx(i.slice(a,c)),i=i.slice(0,a)+i.slice(c+1))}let d=null,l=null;for(let c of i.split(",")){let p=yo(c.trim());p?.key==="name"?d=p.value:p?.key==="version"&&(l=p.value)}d!==null&&n.push({name:d,version:l,extras:o}),t=r+1}}function Hu(e,n,t,s,r=new Map){if(s||n.size===0)return null;let i=new Map;for(let[l,c]of e){let p=i.get(c.name);p===void 0?i.set(c.name,[l]):p.push(l)}let o=new Map,a=[...t],d=new Set;for(let l=0;l<a.length;l+=1){let c=a[l],p=lt(c.name),u=i.get(p)??[],f=c.version!==null?`${p}@${c.version}`:u.length===1?u[0]??null:null;if(f===null||!e.has(f)||f===c.from)continue;let h=o.get(c.from);h===void 0?o.set(c.from,[f]):h.includes(f)||h.push(f);for(let g of c.extras){let y=JSON.stringify([f,g]);if(!d.has(y)){d.add(y);for(let _ of r.get(f)?.get(g)??[])a.push({from:f,..._})}}}return{nodes:e,children:o,importers:n}}function ba(e,n={}){let t=new Map,s=new Map,r=[],i=!1,o=null,a=null,d=null,l=[],c=new Map,p=new Map,u="",f=!1,h="",g=null,y=x=>{let k=Ox(x);g===null?l.push(...k):c.set(g,[...c.get(g)??[],...k])},_=()=>{if(o===null)return;let x=lt(o),k=null;if(d!==null?(k=`${_a}${d}`,s.set(k,d==="."?"pyproject.toml":`${d}/pyproject.toml`)):a!==null&&(k=`${x}@${a}`,t.size>=2e5?i=!0:t.set(k,{name:x,version:a})),k!==null){for(let w of l)r.push({from:k,...w});c.size>0&&p.set(k,c)}o=null,a=null,d=null,l=[],c=new Map},b=Vn(e,n,(x,k)=>{if(f){h+=k,k.startsWith("]")&&(y(h),f=!1);return}if(k==="[[package]]"){_(),u="package";return}if(k.startsWith("[")){u=k==="[package.dev-dependencies]"?"dev":k==="[package.optional-dependencies]"?"optional":"other";return}if(u==="other")return;let w=k.indexOf(" = ");if(w<=0)return;let I=k.slice(0,w).trim(),N=k.slice(w+3).trim();if((u==="optional"||(u==="dev"?d!==null:I==="dependencies"))&&N.startsWith("[")){g=u==="optional"?I.replaceAll('"',""):null,N.endsWith("]")?y(N):(f=!0,h=N);return}if(u!=="package")return;if(I==="source"){let R=N.startsWith("{")&&N.endsWith("}")?N.slice(1,-1):"";for(let F of R.split(",")){let P=yo(F.trim());(P?.key==="editable"||P?.key==="virtual")&&(d=P.value)}return}let C=yo(k);C?.key==="name"?o=C.value:C?.key==="version"&&(a=C.value)});return _(),b.refusedAnchors||b.truncated?null:Hu(t,s,r,i,p)}function Sa(e,n,t={}){let s=new Map,r=new Map([[`${_a}.`,"pyproject.toml"]]),i=n.map(f=>({from:`${_a}.`,name:f,version:null,extras:[]})),o=!1,a=null,d=null,l=[],c="",p=()=>{if(a!==null&&d!==null){let f=lt(a),h=`${f}@${d}`;s.size>=2e5?o=!0:s.set(h,{name:f,version:d});for(let g of l)i.push({from:h,name:g,version:null,extras:[]})}a=null,d=null,l=[]},u=Vn(e,t,(f,h)=>{if(h==="[[package]]"){p(),c="package";return}if(h.startsWith("[")){c=h==="[package.dependencies]"?"deps":"other";return}if(c==="package"){let _=yo(h);_?.key==="name"?a=_.value:_?.key==="version"&&(d=_.value);return}if(c!=="deps")return;let g=h.indexOf(" = ");g<=0||h.slice(g+3).includes("optional = true")||l.push(h.slice(0,g).trim().replaceAll('"',""))});return p(),u.refusedAnchors||u.truncated?null:Hu(s,r,i,o)}function xa(e){let n=0;for(;n<e.length;){let t=e.charCodeAt(n);if(!(t>=97&&t<=122||t>=65&&t<=90||t>=48&&t<=57||t===45||t===46||t===95))break;n+=1}return n===0?null:lt(e.slice(0,n))}function Px(e){return e==="tool.poetry.dependencies"||e==="tool.poetry.dev-dependencies"||e.startsWith("tool.poetry.group.")&&e.endsWith(".dependencies")}function _o(e){let n=new Map,t="",s=!1,r=0,i=l=>{l!==null&&l!=="python"&&!n.has(l)&&n.set(l,r)},o=l=>{let c=0;for(;;){let p=l.indexOf('"',c);if(p===-1)return;let u=l.indexOf('"',p+1);if(u===-1)return;i(xa(l.slice(p+1,u))),c=u+1}},a=(l,c)=>l==="project"&&c==="dependencies"||l==="project.optional-dependencies"||l==="dependency-groups"||l==="tool.uv"&&c==="dev-dependencies",d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length&&r<2e5;){let l=e.indexOf(`
-`,d);l===-1&&(l=e.length),r+=1;let c=e.slice(d,l);d=l+1;let p=c.indexOf("#"),u=(p===-1?c:c.slice(0,p)).trim();if(u.length>4096)continue;if(s){o(u),u.includes("]")&&(s=!1);continue}if(u.startsWith("[")&&!u.startsWith("[[")){t=u.slice(1,u.indexOf("]")===-1?u.length:u.indexOf("]")).trim();continue}let f=u.indexOf("=");if(f<=0)continue;let h=u.slice(0,f).trim().replaceAll('"',""),g=u.slice(f+1).trim();if(Px(t)){i(xa(h));continue}if(a(t,h)&&g.startsWith("[")&&(o(g),s=!g.includes("]")),l===e.length)break}return n}function ka(e){let n=new Map,t=0,s=0;for(;s<=e.length&&t<2e5;){let r=e.indexOf(`
-`,s);r===-1&&(r=e.length),t+=1;let i=e.slice(s,r);s=r+1;let o=i.trim();if(o.length>0&&o.length<=4096&&!o.startsWith("#")&&!o.startsWith("-")){let a=xa(o);a!==null&&!n.has(a)&&n.set(a,t)}if(r===e.length)break}return n}import{statSync as Zx}from"node:fs";import Qx from"node:path";import{lstatSync as Cx,readFileSync as Mx,readdirSync as Tx,realpathSync as wa,statSync as cr}from"node:fs";import ze from"node:path";function ur(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}var Xu=2e4,Yu=32,Ju=256,$x=2*1024*1024,Lx=256*1024,Zu=256,Dx=16,Fx=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],jx=["pyproject.toml","setup.py","setup.cfg"],Bx=["requirements.txt","Pipfile"],Kx=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],Qu={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function Wu(e,n){try{let t=cr(e);return!t.isFile()||t.size>n?null:Mx(e,"utf8")}catch{return null}}function $t(e){let n;try{n=cr(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function zx(e){try{return cr(e).isDirectory()}catch{return!1}}function Ux(e,n){let t=0,s=0,r=-1,i=0;for(;s<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(s)))t+=1,s+=1;else if(t<e.length&&e.charAt(t)==="*")r=t,i=s,t+=1;else if(r>=0)t=r+1,i+=1,s=i;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function qx(e,n){let t=(s,r)=>{if(s===e.length)return r===n.length;let i=e[s]??"";if(i==="**"){for(let a=r;a<=n.length;a+=1)if(t(s+1,a))return!0;return!1}if(r>=n.length)return!1;let o=n[r]??"";return(i.includes("*")||i.includes("?")?Ux(i,o):i===o)?t(s+1,r+1):!1};return t(0,0)}function Hx(e){let n=[],t=Wu(ze.join(e,"package.json"),$x);if(t!==null)try{let o=JSON.parse(t)?.workspaces;if(Array.isArray(o))for(let a of o)typeof a=="string"&&n.push(a);else if(typeof o=="object"&&o!==null){let a=o.packages;if(Array.isArray(a))for(let d of a)typeof d=="string"&&n.push(d)}}catch{}let s=Wu(ze.join(e,"pnpm-workspace.yaml"),Lx);s!==null&&n.push(...Wx(s));let r=[];for(let i of n){if(r.length>=Zu)break;let o=i.trim();if(o.length===0)continue;for(;o.startsWith("./");)o=o.slice(2);if(o.startsWith("/")||ze.isAbsolute(o))continue;let a=o.split("/").filter(d=>d.length>0);a.length===0||a.length>Dx||a.includes("..")||r.push(a.join("/"))}return r}function Wx(e){let n=[],t=!1;for(let s of e.split(`
-`)){if(n.length>=Zu)break;if(/^packages:\s*(#.*)?$/.test(s)){t=!0;continue}if(!t)continue;let r=/^\s+-\s*(.*?)\s*$/.exec(s);if(r===null){s.trim().length>0&&(t=!1);continue}let i=(r[1]??"").trim(),o=i.indexOf(" #");o>=0&&(i=i.slice(0,o).trim()),(i.startsWith('"')&&i.endsWith('"')&&i.length>=2||i.startsWith("'")&&i.endsWith("'")&&i.length>=2)&&(i=i.slice(1,-1)),i.length>0&&n.push(i)}return n}function Gu(e,n){let t=ze.relative(n,e);return t.length===0?!1:t.split(ze.sep).includes("node_modules")}function Vu(e,n){return ze.relative(e,n).split(ze.sep).join("/")}function va(e,n){let t=n?.maxDirs??Xu,s=n?.maxDepth??Yu,r=n?.maxRoots??Ju,i=n?.discoverPythonRoots??!0,o;try{o=wa(e)}catch{return{...Qu,observations:[{kind:"refused-unreadable",rel:""}]}}let a=[],d=[],l=new Set([o]),c=0,p=0,u=0,f="complete",h=Hx(o).map(x=>x.split("/")),g=x=>{let k="absent";for(let I of jx){let N=$t(ze.join(x,I));if(N==="regular"){k="declared";break}N==="refused"&&(k="refused")}if(k==="absent"&&Bx.some(I=>$t(ze.join(x,I))==="regular")&&(k="listed"),k==="absent")return{candidate:k,witnesses:[]};let w=[];return Kx.some(I=>$t(ze.join(x,I))==="regular")&&w.push("own-lockfile"),zx(ze.join(x,".venv"))&&w.push("installed-env"),{candidate:k,witnesses:w}},y=(x,k)=>{let w=g(x);return w.candidate==="absent"?"not-root":(w.candidate!=="listed"&&(p+=1),w.witnesses.length===0&&w.candidate!=="refused"?(w.candidate==="declared"&&d.push({kind:"undeclared-manifest",rel:k}),"not-root"):a.length>=r?"exhausted":(a.push({rel:k,abs:x,witnesses:w.witnesses,manifestRefused:w.candidate==="refused",ecosystem:"PyPI"}),"root"))},_=(x,k)=>{if(k.length===0){let C=$t(ze.join(x,"package.json"))!=="absent",R=i?g(x):{candidate:"absent",witnesses:[]};return!C&&R.candidate!=="absent"?(a.push({rel:"",abs:x,witnesses:["scan-root",...R.witnesses],manifestRefused:!1,ecosystem:"PyPI"}),"root"):(a.push({rel:"",abs:x,witnesses:["scan-root",...R.witnesses],manifestRefused:!1,...R.witnesses.length>0?{alsoPython:!0}:{}}),"root")}let w=$t(ze.join(x,"package.json"));if(w==="absent")return i?y(x,k):"not-root";p+=1;let I=[],N=k.split("/");h.some(C=>qx(C,N))&&I.push("workspace-declared"),Fx.some(C=>$t(ze.join(x,C))==="regular")&&I.push("own-lockfile");let v=i?g(x):{candidate:"absent",witnesses:[]};for(let C of v.witnesses)I.includes(C)||I.push(C);return I.length===0&&w!=="refused"?(d.push({kind:"undeclared-manifest",rel:k}),"not-root"):a.length>=r?"exhausted":(a.push({rel:k,abs:x,witnesses:I,manifestRefused:w==="refused",...v.witnesses.length>0?{alsoPython:!0}:{}}),"root")},b=[{abs:o,rel:"",depth:0}];for(;b.length>0;){let x=b.pop();if(x===void 0)break;if(c>=t){f="dirs-exhausted";break}c+=1;let k=_(x.abs,x.rel);if(k==="exhausted"){f="roots-exhausted";break}let w=k==="root";if(x.depth>=s){f=f==="complete"?"depth-clamped":f;continue}let I;try{I=Tx(x.abs)}catch{d.push({kind:"refused-unreadable",rel:x.rel});continue}I.sort().reverse();for(let N of I){let v=ze.join(x.abs,N),C=x.rel.length===0?N:`${x.rel}/${N}`,R;try{let U=Cx(v);R=U.isDirectory()||U.isSymbolicLink()&&cr(v).isDirectory()}catch{continue}if(!R)continue;if(N==="node_modules"){w||d.push({kind:"unenumerated-install",rel:C});continue}if(N.startsWith(".")){u+=1,d.push({kind:"skipped-dot-directory",rel:C}),$t(ze.join(v,"package.json"))!=="absent"&&d.push({kind:"undeclared-manifest",rel:C});continue}let F;try{F=wa(v)}catch{d.push({kind:"refused-unreadable",rel:C});continue}let P=o.endsWith(ze.sep)?o:o+ze.sep;if(F!==o&&!F.startsWith(P)){d.push({kind:"refused-out-of-root",rel:C});continue}Gu(F,o)||l.has(F)||(l.add(F),b.push({abs:F,rel:Vu(o,F),depth:x.depth+1}))}}for(let x of n?.operatorRoots??[]){let k=typeof x=="string"?x.slice(0,512):"",w=()=>{d.push({kind:"refused-operator-root",rel:k})};if(k.length===0||k.includes("\0")){w();continue}let I;try{I=wa(ze.resolve(o,k))}catch{w();continue}let N=o.endsWith(ze.sep)?o:o+ze.sep;if(I!==o&&(!I.startsWith(N)||Gu(I,o))){w();continue}let v;try{v=cr(I).isDirectory()}catch{v=!1}if(!v||$t(ze.join(I,"package.json"))!=="regular"){w();continue}let C=a.findIndex(P=>P.abs===I);if(C>=0){let P=a[C];P!==void 0&&!P.witnesses.includes("operator")&&(a[C]={...P,witnesses:[...P.witnesses,"operator"]});continue}let R=Vu(o,I);a.push({rel:R,abs:I,witnesses:["operator"],manifestRefused:!1});let F=d.findIndex(P=>P.kind==="undeclared-manifest"&&P.rel===R);F>=0&&d.splice(F,1)}return a.sort((x,k)=>x.rel<k.rel?-1:x.rel>k.rel?1:0),d.sort((x,k)=>x.kind!==k.kind?x.kind<k.kind?-1:1:x.rel<k.rel?-1:x.rel>k.rel?1:0),{roots:a,observations:d,budget:f,counts:{dirsWalked:c,manifestsSeen:p,rootsAdmitted:a.length,dotDirectoriesSkipped:u}}}import{lstatSync as ef,readdirSync as Gx,readFileSync as Vx,realpathSync as sf,statSync as rf}from"node:fs";import wn from"node:path";var Yn={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},Xx=/^python\d+\.\d+$/u;function Lt(e,n){let t;try{t=rf(e)}catch(s){return{why:s?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:Vx(e,"utf8")}}catch{return{why:"unreadable"}}}function Ea(e,n){let t;try{if(t=sf(n),!rf(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+wn.sep)?t:null}function nf(e,n){return wn.relative(e,n).split(wn.sep).join("/")}function tf(e){try{return Gx(e).sort()}catch{return null}}function Yx(e){let n=[],t=[],s=0;for(let r of e.split(/\r?\n/u)){let i=r.trim();if(!(i===""||i.startsWith("#"))){if(/^import[ \t]/u.test(i)){s+=1;let o=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(i);o?.[1]!==void 0&&t.length<Yn.maxPthPaths&&t.push(o[1]);continue}n.length<Yn.maxPthPaths&&n.push(i)}}return{paths:n,importLines:s,importModules:t}}function Jx(e){let n=null;for(let t of e.split(/\r?\n/u)){let s=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(s!==null){if(s[1]==="version_info")return s[2]??null;n??=s[2]??null}}return n}function fr(e,n){let t=n?.envDir??Yn.envDir,s=n?.maxDistributions??Yn.maxDistributions,r=n?.maxMetadataBytes??Yn.maxMetadataBytes,i=n?.maxRecordBytes??Yn.maxRecordBytes,o=n?.maxTopLevelBytes??Yn.maxTopLevelBytes,a=n?.maxDirectUrlBytes??Yn.maxDirectUrlBytes,d=Yn.maxEntryPointsBytes,l=t,c=[],p=(C,R,F=null)=>({envRel:l,refused:C,sitePackages:[],interpreter:F,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...c,R],truncated:!1}),u;try{u=sf(e)}catch{return p("absent","the root itself could not be resolved")}let f=wn.join(u,t),h;try{h=ef(f)}catch(C){return C?.code==="ENOENT"?p("absent",`${l}: absent`):p("not-a-directory",`${l}: could not be inspected`)}if(!h.isDirectory()&&!h.isSymbolicLink())return p("not-a-directory",`${l}: not a directory`);let g=Ea(u,f);if(g===null)return p("escapes-root",`${l}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let y=Lt(wn.join(g,"pyvenv.cfg"),Yn.maxPyvenvCfgBytes),_="text"in y?Jx(y.text):null;"text"in y||c.push(`${l}/pyvenv.cfg: ${y.why} \u2014 interpreter version unknown`);let b=[];for(let C of["lib","lib64"]){let R=tf(wn.join(g,C));if(R!==null)for(let F of R)Xx.test(F)&&b.push(wn.join(g,C,F,"site-packages"))}b.push(wn.join(g,"Lib","site-packages"));let x=[],k=new Set;for(let C of b){let R=Ea(g,C);R===null||k.has(R)||(k.add(R),x.push(R))}if(x.length===0)return p("no-site-packages",`${l}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,_);x.length>1&&c.push(`${l}: ${String(x.length)} site-packages directories; all enumerated`);let w=[],I=[],N=0,v=!1;e:for(let C of x){let R=nf(u,C),F=tf(C);if(F===null){c.push(`${R}: unreadable; nothing enumerated there`);continue}for(let P of F){let U=wn.join(C,P),E=P.endsWith(".dist-info"),T=P.endsWith(".egg-info");if(P.endsWith(".pth")){let A=Lt(U,Yn.maxPthBytes);if(!("text"in A)){c.push(`${R}/${P}: ${A.why}; the paths it adds were NOT enumerated`);continue}I.push({name:P,sitePackages:R,...Yx(A.text)});continue}if(!E&&!T)continue;if(w.length>=s){v=!0,c.push(`${R}: the distribution cap (${String(s)}) was hit at ${P}; the enumeration is INCOMPLETE`);break e}let K;try{K=ef(U)}catch{N+=1,c.push(`${R}/${P}: could not be inspected; not enumerated`);continue}let J=E?"dist-info":"egg-info";if(K.isFile()&&T){let A=Lt(U,r);"text"in A?w.push({dir:P,kind:J,metadata:A.text,entryPointsUnknown:!0}):(N+=1,c.push(`${R}/${P}: ${A.why}; not enumerated`));continue}let W=Ea(g,U);if(W===null){N+=1,c.push(`${R}/${P}: not a directory inside the environment; not enumerated`);continue}let se=E?"METADATA":"PKG-INFO",Y=Lt(wn.join(W,se),r);if(!("text"in Y)){N+=1,c.push(`${R}/${P}: ${se} ${Y.why}; not enumerated`);continue}let V={dir:P,kind:J,metadata:Y.text},fe=Lt(wn.join(W,"entry_points.txt"),d);"text"in fe?V.entryPoints=fe.text:fe.why!=="absent"&&(V.entryPointsUnknown=!0,c.push(`${R}/${P}/entry_points.txt: ${fe.why}; the commands it declares are UNKNOWN`));let S=Lt(wn.join(W,"top_level.txt"),o);if("text"in S?V.topLevel=S.text:S.why!=="absent"&&c.push(`${R}/${P}/top_level.txt: ${S.why}; ignored`),E){let A=Lt(wn.join(W,"RECORD"),i);"text"in A?V.record=A.text:c.push(`${R}/${P}/RECORD: ${A.why}; import names from top_level.txt only`);let j=Lt(wn.join(W,"direct_url.json"),a);"text"in j&&(V.directUrl=j.text)}w.push(V)}}return{envRel:l,refused:null,sitePackages:x.map(C=>nf(u,C)),interpreter:_,distInfos:w,pthFiles:I,unreadable:N,diagnostics:c,truncated:v}}var eb=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function nb(e,n){for(let t of n)try{if(Zx(Qx.join(e,t)).isFile())return t}catch{}return null}function of(e){let n=[],t=[],s=(p,u)=>{t.push({kind:p,detail:u,blindsAnalysis:!1,rootRel:""}),n.push(u)},r=nb(e,eb),i=fr(e);if(i.refused!==null){let p=i.refused==="absent"?`no \`${i.envRel}\` is installed`:`\`${i.envRel}\` could not be read (${i.refused})`;return s("no-installed-env",`${r??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:r,diagnostics:[...n,...i.diagnostics],truncated:!1,gaps:t}}let o=[],a=new Set,d=[],l=0;for(let p of i.distInfos){let u=ar(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(u===null){l+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let f=JSON.stringify([u.name,u.version]);a.has(f)||(a.add(f),u.importNames.length===0&&d.push(u.name),o.push({name:u.name,version:u.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...i.diagnostics);let c=i.unreadable+l;return c>0&&s("installed-env-partial",`${String(c)} entr${c===1?"y":"ies"} under ${i.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(o.length)} enumerated were assessed normally.`),i.truncated&&s("installed-env-partial",`the environment walk under ${i.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),d.length>0&&n.push(`${String(d.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${d.slice(0,5).join(", ")}${d.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:o,source:o.length>0?"installed-env":"none",lockfilePath:r,diagnostics:n,truncated:i.truncated,gaps:t}}var Ia=128*1024*1024,tb=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>fo(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>fo(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>la(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>ua(e,n===void 0?{}:{maxEntries:n})}],sb=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Ra(e,n){let t;try{t=Aa(Jn.join(e,n))}catch{return null}let s=e.endsWith(Jn.sep)?e:e+Jn.sep;return t.startsWith(s)?t:null}function lf(e,n){let t=Jn.join(e,"package.json"),s;try{s=Aa(t)}catch{return null}if(!s.startsWith(n+Jn.sep))return null;try{if(!pr(s).isFile())return null;let r=JSON.parse(Na(s,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function df(e,n){try{return pr(Jn.join(e,n)),!0}catch{return!1}}function rb(e,n){if(df(e,"pnpm-workspace.yaml"))return!0;let t=Ra(e,"package.json");if(t===null)return df(e,"package.json");let s;try{let o=pr(t);if(!o.isFile()||o.size>n)return!0;s=Na(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(s)}catch{return!0}for(let o of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=r[o];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let i=r.workspaces;return Array.isArray(i)?i.length>0:typeof i=="object"&&i!==null}function cf(e,n){let t=Jn.join(e,"node_modules"),s=[],r;try{r=af(t,{withFileTypes:!0})}catch{return s}for(let i of r){let o=i.name;if(o.startsWith("."))continue;if(o.startsWith("@")){let d;try{d=af(Jn.join(t,o),{withFileTypes:!0})}catch{continue}for(let l of d){let c=lf(Jn.join(t,o,l.name),n);c!==null&&s.push({dev:!1,name:c.name,version:c.version,lockKey:`node_modules/${o}/${l.name}`,linked:l.isSymbolicLink()||i.isSymbolicLink()})}continue}let a=lf(Jn.join(t,o),n);a!==null&&s.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${o}`,linked:i.isSymbolicLink()})}return s}var ob=5;function ib(e,n,t){let s=Ra(e,n);if(s===null){try{pr(Jn.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=pr(s)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:Na(s,"utf8")}}catch{return{gap:`${n} could not be read`}}}function ab(e,n){let t=Aa(e),s=[],r=[],i=n?.maxLockfileBytes??Ia,o=[],a=new Set,d=[],l=rb(t,i),c=null,p=!1,u=(h,g,y)=>{r.push({kind:h,detail:g,blindsAnalysis:y,rootRel:""}),s.push(g)};for(let h of tb){let g=ib(t,h.file,i);if(g===null)continue;if("gap"in g){u("lockfile-unreadable",g.gap,!1);continue}let y=h.parse(g.text,n?.maxLockfileEntries);if(y.truncated&&(p=!0),y.deps.length===0){if(y.diagnostics.length>0||l){let _=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";u("lockfile-unparsed",`${h.file} yielded NO dependencies (${_}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&u("lockfile-partial",`${h.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),c===null&&(c=h.file),d.includes(h.source)||d.push(h.source);for(let _ of y.deps){let b=JSON.stringify([_.name,_.version,_.lockKey]);a.has(b)||(a.add(b),o.push({..._,declaredIn:h.file}))}}for(let h of sb)if(Ra(t,h)!==null){u("yarn-pnp",`${h} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(o.length>0){let h=d.length===1?d[0]??"none":"multi-lockfile";d.length>1&&s.push(`multiple lockfiles present (${d.join(", ")}); enumerated the UNION of all of them`);let g=new Set(o.map(b=>JSON.stringify([b.name,b.version]))),y=new Set,_=[];for(let b of cf(t,t)){let x=JSON.stringify([b.name,b.version,b.lockKey]);a.has(x)||(a.add(x),o.push({name:b.name,version:b.version,lockKey:b.lockKey,dev:b.dev,declaredIn:""}));let k=JSON.stringify([b.name,b.version]);b.linked||g.has(k)||y.has(k)||(y.add(k),_.length<ob&&_.push(or(b.name,b.version)))}if(y.size>0){let b=y.size-_.length;u("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${_.join(", ")}${b>0?`, and ${String(b)} more`:""}): ${c??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:o,source:h,lockfilePath:c,diagnostics:s,truncated:p,gaps:r}}let f=cf(t,t);return f.length>0?(u("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(f.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:f.map(h=>({name:h.name,version:h.version,lockKey:h.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:s,truncated:p,gaps:r}):(l&&u("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:s,truncated:p,gaps:r})}function lb(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function db(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function ff(e){return e===""||e.split("/").every(db)}function cb(e,n){if(e===""||n==="")return n;if(!ff(e))return"";let t=`${e}/${n}`;return t.length<=uo?t:""}function uf(e,n){return e===""?n:`${e}: ${n}`}function ub(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function pf(e,n,t){let s=t?.maxUnionEntries??co,r=n.roots.filter(lb),i=r.some(h=>h.rel==="")?r:[ub(e),...r],o=[],a=[],d=new Set,l=[],c=[],p=!1,u=!1;for(let h of i){let g=h.rel===""?e:h.abs,y=ab(g,t),_=ur(h)?of(g):null,b=_===null?y:mb(y,_),x=b.diagnostics.map(w=>uf(h.rel,w));!ff(h.rel)&&b.packages.length>0&&x.push(`${h.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(b.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let k={...b,rootRel:h.rel,...h.ecosystem!==void 0?{ecosystem:h.ecosystem}:{},..._!==null?{pythonLockfilePath:_.lockfilePath===null||h.rel===""?_.lockfilePath:`${h.rel}/${_.lockfilePath}`}:{},packages:b.packages.map(w=>({...w,lockKey:cb(h.rel,w.lockKey),declaredIn:w.declaredIn===""||h.rel===""?w.declaredIn:`${h.rel}/${w.declaredIn}`})),lockfilePath:b.lockfilePath===null||h.rel===""?b.lockfilePath:`${h.rel}/${b.lockfilePath}`,gaps:b.gaps.map(w=>({...w,rootRel:h.rel,detail:uf(h.rel,w.detail)})),diagnostics:x};o.push(k),b.truncated&&(p=!0);for(let w of k.packages){let I=JSON.stringify([w.name,w.version,w.lockKey]);if(!d.has(I)){if(a.length>=s){u=!0;break}d.add(I),a.push(w)}}l.push(...k.gaps),c.push(...k.diagnostics)}u&&(p=!0,c.push(`the union of installed sets across ${String(i.length)} roots exceeds its ceiling of ${String(s)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let f=o[0];if(f===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:a,source:f.source,lockfilePath:f.lockfilePath,diagnostics:c,truncated:p,gaps:l,perRoot:o}}function fb(e,n){let t;for(let s of e.perRoot){if(s.rootRel===""){t??=s;continue}n.startsWith(`${s.rootRel}/`)&&(t===void 0||s.rootRel.length>t.rootRel.length)&&(t=s)}return t}function xo(e,n){return n.declaredIn!==""?n.declaredIn:fb(e,n.lockKey)?.lockfilePath??null}function mf(e,n){let t=e.perRoot.find(s=>s.rootRel===n.rootRel);return pb.has(n.kind)?t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`:t?.lockfilePath!==void 0&&t.lockfilePath!==null?t.lockfilePath:n.rootRel===""?null:`${n.rootRel}/${t?.ecosystem==="PyPI"?"pyproject.toml":"package.json"}`}var pb=new Set(["no-installed-env","installed-env-partial"]);function mb(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function hf(e){let n=new Map;for(let t of e){let s=n.get(t.name)??new Set;s.add(t.version),n.set(t.name,s)}return t=>{let s=n.get(t);if(s===void 0)return;let r=[...s].sort();return r.length===1?r[0]:r}}function mr(e){return new Set(e.map(n=>n.root))}function Ss(e,n){let t=mr(n);return e.roots.filter(s=>!t.has(s.rel)&&(s.rel===""||s.ecosystem!=="PyPI"))}function Oa(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function Pa(e,n){return Ss(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function gf(e){let n=[],t=e.observations.filter(s=>s.kind==="unenumerated-install").map(s=>s.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${Oa(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let s=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(s.dirsWalked)} dirs walked, ${String(s.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function yf(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as Sk}from"node:fs";import rs from"node:path";import{spawnSync as jS}from"node:child_process";function hr(e){{let n=ee[e];if(n===void 0)throw new Error(`the bundle does not embed ${e}; this is a cupel build defect`);return["-c",n]}}var _f=["get","post","put","patch","delete","options","head","trace"],vn=(e,n)=>e.map(t=>`${t}.${n}()`),un=(e,...n)=>e.flatMap(t=>n.map(s=>`${t}.${s}`)),$n={id:"fastapi@0-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://fastapi.tiangolo.com/reference/apirouter/ \u2014 APIRouter.api_route's decorator calls add_api_route(path, func) and returns func (fastapi/routing.py, 0.141.1); FastAPI.get/\u2026 delegate to self.router","https://fastapi.tiangolo.com/tutorial/dependencies/ \u2014 a Depends parameter receives the dependency's return","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/dependencies/utils.py \u2014 add_non_field_param_to_dependency: Request, WebSocket, HTTPConnection, Response, BackgroundTasks, SecurityScopes are injected","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/security/http.py \u2014 HTTPBearer.__call__ returns HTTPAuthorizationCredentials read from the request's Authorization header"],apps:[...vn(["fastapi","fastapi.applications"],"FastAPI"),...vn(["fastapi","fastapi.routing"],"APIRouter")],decorators:[..._f,"api_route"],addRoute:"add_api_route",depends:un(["fastapi","fastapi.params","fastapi.param_functions"],"Depends","Security"),injected:[...un(["fastapi","fastapi.responses","starlette.responses"],"Response","JSONResponse","HTMLResponse","PlainTextResponse","RedirectResponse","StreamingResponse","FileResponse","ORJSONResponse","UJSONResponse","EventSourceResponse"),...un(["fastapi","fastapi.background","starlette.background"],"BackgroundTasks"),...un(["fastapi.security","fastapi.security.oauth2"],"SecurityScopes")],schemes:[...vn(["fastapi.security","fastapi.security.http"],"HTTPBearer"),...vn(["fastapi.security","fastapi.security.http"],"HTTPBasic"),...vn(["fastapi.security","fastapi.security.http"],"HTTPDigest"),...vn(["fastapi.security","fastapi.security.oauth2"],"OAuth2"),...vn(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordBearer"),...vn(["fastapi.security","fastapi.security.oauth2"],"OAuth2AuthorizationCodeBearer"),...vn(["fastapi.security","fastapi.security.open_id_connect_url"],"OpenIdConnect"),...vn(["fastapi.security","fastapi.security.api_key"],"APIKeyHeader"),...vn(["fastapi.security","fastapi.security.api_key"],"APIKeyQuery"),...vn(["fastapi.security","fastapi.security.api_key"],"APIKeyCookie")],forms:un(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordRequestForm","OAuth2PasswordRequestFormStrict")},Bn={id:"flask@3-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://flask.palletsprojects.com/en/stable/api/#flask.Flask.route \u2014 Scaffold.route's decorator calls add_url_rule(rule, endpoint, f) and returns f (flask/sansio/scaffold.py, 3.1.3); get/post/put/delete/patch are route(methods=[\u2026])","https://flask.palletsprojects.com/en/stable/quickstart/#variable-rules \u2014 <converter:variable> sections are passed to the view as keyword arguments (werkzeug/routing/rules.py _part_re)","https://flask.palletsprojects.com/en/stable/api/#flask.request \u2014 the request object for the active context (flask/globals.py: a LocalProxy)"],apps:[...vn(["flask","flask.app"],"Flask"),...vn(["flask","flask.blueprints"],"Blueprint")],decorators:["route","get","post","put","delete","patch"],addRule:"add_url_rule",proxies:["flask.request","flask.globals.request"]},yn={id:"django@6-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://docs.djangoproject.com/en/6.1/topics/http/urls/#how-django-processes-a-request \u2014 the view is called with the HttpRequest, then the captured values (django/urls/resolvers.py, 6.1.1)","https://docs.djangoproject.com/en/6.1/ref/class-based-views/base/#django.views.generic.base.View.dispatch \u2014 as_view()'s view calls dispatch(request, *args, **kwargs), which calls the method named for the verb","https://docs.djangoproject.com/en/3.2/ref/urls/#url \u2014 url() (removed in 4.0) is re_path()","https://www.django-rest-framework.org/api-guide/views/#api_view \u2014 the decorated function is called by a generated APIView's handler with (request, *args, **kwargs) (rest_framework/decorators.py, 3.18.1)","https://docs.djangoproject.com/en/6.1/topics/http/decorators/ \u2014 Django's view decorators; each wrapper calls the view with (request, *args, **kwargs) (django/views/decorators/*.py, django/contrib/auth/decorators.py user_passes_test, django/utils/decorators.py make_middleware_decorator, 6.1.1)"],paths:["django.urls.path","django.urls.conf.path"],regexes:["django.urls.re_path","django.urls.conf.re_path","django.conf.urls.url"],methods:_f,passThrough:[...un(["django.contrib.auth.decorators"],"login_required","login_required()","login_not_required","permission_required()","user_passes_test()"),...un(["django.contrib.admin.views.decorators"],"staff_member_required","staff_member_required()"),...un(["django.views.decorators.http"],"require_http_methods()","require_GET","require_POST","require_safe","condition()","etag()","last_modified()","conditional_page"),...un(["django.views.decorators.csrf"],"csrf_exempt","csrf_protect","requires_csrf_token","ensure_csrf_cookie"),...un(["django.views.decorators.cache"],"cache_page()","cache_control()","never_cache"),...un(["django.views.decorators.vary"],"vary_on_headers()","vary_on_cookie"),...un(["django.views.decorators.clickjacking"],"xframe_options_deny","xframe_options_sameorigin","xframe_options_exempt"),...un(["django.views.decorators.gzip"],"gzip_page"),...un(["django.views.decorators.debug"],"sensitive_post_parameters()","sensitive_variables()"),...un(["django.views.decorators.common"],"no_append_slash")],apiView:"rest_framework.decorators.api_view()",apiViewSetters:un(["rest_framework.decorators"],"renderer_classes()","parser_classes()","authentication_classes()","throttle_classes()","permission_classes()","schema()")};function xf(e){return Bn.proxies.includes(e)?{kind:"source",sourceClass:Bn.sourceClass,model:Bn.id}:null}var hb=[$n.addRoute,Bn.addRule,...new Set([...yn.paths,...yn.regexes].map(e=>e.slice(e.lastIndexOf(".")+1)))],gb=[...new Set([...yn.passThrough,yn.apiView,...yn.apiViewSetters].map(e=>e.split(".")[0]??e))];function bf(e){return{proxies:Bn.proxies.filter(n=>!e(n.split(".")[0]??n)),calls:hb,roots:gb.filter(n=>!e(n))}}import{readdirSync as wf,realpathSync as Sf,statSync as vf}from"node:fs";import kt from"node:path";var Ef=32,yb=512,_b=/^[A-Za-z_][A-Za-z0-9_]*$/u,xb=[".so",".pyd",".dylib"],bo=e=>({resolved:e,failure:null}),ks=e=>({resolved:null,failure:e});function bb(e){if(e.length===0||e.length>yb)return null;let n=e.split(".");return n.length>Ef?null:n.every(t=>_b.test(t))?n:null}function Ca(e){try{return vf(e).isDirectory()}catch{return!1}}function vs(e){try{return vf(e).isFile()}catch{return!1}}var kf=new WeakMap;function ws(e,n,t){let s=kf.get(e);s===void 0&&(s=new Map,kf.set(e,s));let r=s.get(n);if(r===void 0){try{r=new Set(wf(n))}catch{r=null}s.set(n,r)}return r?.has(t)===!0}function gr(e,n){let t,s;try{t=Sf(n),s=Sf(e)}catch{return null}return t===s||t.startsWith(s+kt.sep)?t:null}function Sb(e,n){let t;try{t=wf(e)}catch{return null}for(let s of t)if(s.startsWith(`${n}.`)&&xb.some(r=>s.endsWith(r))&&vs(kt.join(e,s)))return kt.join(e,s);return null}function wt(e,n){let t=bb(n);if(t===null)return ks("refused");let s=null,r=!1;for(let[i,o]of e.roots.entries()){let a=o,d=!1;for(let g of t.slice(0,-1)){let y=kt.join(a,g);if(ws(e,a,g)&&(vs(kt.join(y,"__init__.py"))||Ca(y))){if(!Ca(y)){d=!0;break}a=y;continue}d=!0,ws(e,a,`${g}.py`)&&vs(`${y}.py`)&&(r=!0);break}if(d)continue;let l=t[t.length-1];if(l===void 0)return ks("refused");let c=kt.join(a,l,"__init__.py");if(ws(e,a,l)&&vs(c)){let g=gr(o,c);return g===null?ks("escapes-root"):bo({module:n,kind:"package",path:g,rootIndex:i})}let p=kt.join(a,`${l}.py`);if(ws(e,a,`${l}.py`)&&vs(p)){let g=gr(o,p);return g===null?ks("escapes-root"):bo({module:n,kind:"module",path:g,rootIndex:i})}let u=Sb(a,l);if(u!==null){let g=gr(o,u);return g===null?ks("escapes-root"):bo({module:n,kind:"extension",path:g,rootIndex:i})}let f=kt.join(a,l);if(s===null&&ws(e,a,l)&&Ca(f)){let g=gr(o,f);g!==null&&(s={module:n,kind:"namespace",path:g,rootIndex:i});continue}let h=kt.join(a,`${l}.pyi`);if(s===null&&ws(e,a,`${l}.pyi`)&&vs(h)){let g=gr(o,h);g!==null&&(s={module:n,kind:"stub-only",path:g,rootIndex:i})}}return s!==null?bo(s):ks(r?"not-a-package":"not-found")}function So(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function Es(e,n,t,s){if(t<1||t>Ef)return{failure:"refused"};let r=So(e,n),i=r===""?[]:r.split("."),o=t-1;if(o>i.length)return{failure:"beyond-top-level"};let a=i.slice(0,i.length-o),d=s===null||s===""?[]:s.split("."),l=[...a,...d].join(".");return l===""?{failure:"beyond-top-level"}:{dotted:l}}function yr(e,n,t){if(e===null)return null;let s=i=>i.kind!=="declared-param"?i:i.index>=t?null:n==="none"?{kind:"param",index:i.index}:i.index===0?{kind:"receiver"}:{kind:"param",index:i.index-1},r=[];for(let i of e){let o=s(i.from),a=s(i.to);if(o===null||a===null)return null;r.push({from:o,to:a,kind:i.kind})}return r}var Ta="https://docs.python.org/3.13/",kb=`${Ta}builtins/functions.html#`,Zt=`${Ta}builtins/stdtypes.html#`,dt=e=>`${Ta}library/${e}.html#`;function ko(e){return e===""?[]:e.split(",").map(n=>{if(n==="r")return{kind:"receiver"};let t=n.endsWith("+"),s=Number(t?n.slice(0,-1):n);if(!Number.isSafeInteger(s)||s<0)throw new Error(`runtime table: input ${n}`);return t?{kind:"args-from",index:s}:{kind:"arg",index:s}})}var Af=new Map;function _e(e,n,t){let s=(t.mutates??"").split(";").filter(o=>o!=="").map(o=>{let[a,d]=o.split("<"),l=ko(a??"");if(l.length!==1||l[0]===void 0||d===void 0)throw new Error(`runtime table: mutation ${o}`);return{into:l[0],from:ko(d)}}),r=ko(t.program??""),i=t.returns;Af.set(e,{summary:{id:`python:${e}`,result:ko(t.result),mutates:s,...r.length>0?{callsProgram:r}:{}},...i!==void 0?{returns:i.endsWith("?")?{type:i.slice(0,-1),exact:"inputs"}:{type:i,exact:"always"}}:{},doc:n})}function $a(e,n,t){for(let s of e)_e(s,n(s),t)}var wb=(e,n=e)=>`${kb}${n}`,De=(e,n,t=e)=>_e(`builtins.${e}`,wb(e,t),n);De("len",{result:"0",program:"0",returns:"int"});De("isinstance",{result:"0+",program:"0+",returns:"bool"});De("issubclass",{result:"0+",program:"0+",returns:"bool"});De("callable",{result:"0",returns:"bool"});De("str",{result:"0+",program:"0+",returns:"str?"},"func-str");De("repr",{result:"0",program:"0",returns:"str?"});De("ascii",{result:"0",program:"0",returns:"str?"});De("format",{result:"0+",program:"0+",returns:"str?"});De("bytes",{result:"0+",program:"0+",returns:"bytes?"},"func-bytes");De("int",{result:"0+",program:"0+",returns:"int"});De("float",{result:"0",program:"0",returns:"float"});De("bool",{result:"0",program:"0",returns:"bool"});De("ord",{result:"0",returns:"int"});De("chr",{result:"0",program:"0",returns:"str"});for(let e of["hex","oct","bin"])De(e,{result:"0",program:"0",returns:"str"});De("hash",{result:"0",program:"0",returns:"int"});for(let e of["any","all"])De(e,{result:"0",program:"0",returns:"bool"});for(let e of["abs","reversed","frozenset"])De(e,{result:"0",program:"0"},e==="frozenset"?"func-frozenset":e);for(let e of["round","min","max","sum","enumerate","zip","map","iter","next"])De(e,{result:"0+",program:"0+"});De("range",{result:"0+",program:"0+"},"func-range");De("filter",{result:"1",program:"0+"});De("sorted",{result:"0",program:"0+",returns:"list"});De("list",{result:"0",program:"0",returns:"list"},"func-list");De("tuple",{result:"0",program:"0",returns:"tuple"},"func-tuple");De("dict",{result:"0+",program:"0+",returns:"dict"},"func-dict");De("set",{result:"0",program:"0",returns:"set"},"func-set");var vt=e=>n=>`${e}.${n}`,Ns=e=>n=>`${Zt}${e}.${n}`,vb=["capitalize","center","expandtabs","join","ljust","lower","lstrip","removeprefix","removesuffix","replace","rjust","rstrip","strip","swapcase","title","translate","upper","zfill"],Eb=["endswith","isalnum","isalpha","isascii","isdigit","islower","isspace","istitle","isupper","startswith"],Nb=["count","find","index","rfind","rindex"];for(let e of["str","bytes"]){let n=(t,s)=>{for(let r of t)_e(vt(e)(r),Ns(e)(r),s)};n(vb,{result:"r,0+",program:"0+",returns:e}),n(Eb,{result:"r,0+",program:"0+",returns:"bool"}),n(Nb,{result:"r,0+",program:"0+",returns:"int"}),n(["split","rsplit","splitlines"],{result:"r,0+",program:"0+",returns:"list"}),n(["partition","rpartition"],{result:"r,0+",program:"0+",returns:"tuple"})}$a(["casefold","format","format_map"].map(vt("str")),e=>`${Zt}${e}`,{result:"r,0+",program:"0+",returns:"str"});$a(["isdecimal","isidentifier","isnumeric","isprintable"].map(vt("str")),e=>`${Zt}${e}`,{result:"r",returns:"bool"});_e("str.encode",`${Zt}str.encode`,{result:"r,0+",program:"0+",returns:"bytes?"});_e("bytes.decode",`${Zt}bytes.decode`,{result:"r,0+",program:"0+",returns:"str?"});_e("bytes.hex",`${Zt}bytes.hex`,{result:"r,0+",program:"0+",returns:"str"});var As=Ns("dict");_e("dict.get",As("get"),{result:"r,1",program:"r,0"});_e("dict.pop",As("pop"),{result:"r,1",program:"r,0"});_e("dict.setdefault",As("setdefault"),{result:"r,1",mutates:"r<0,1",program:"r,0"});_e("dict.update",As("update"),{result:"",mutates:"r<0+",program:"r,0+"});$a(["keys","values","items","popitem"].map(vt("dict")),e=>`${Zt}${e}`,{result:"r"});_e("dict.copy",As("copy"),{result:"r",returns:"dict"});_e("dict.clear",As("clear"),{result:""});var Et=Ns("list");_e("list.append",Et("append"),{result:"",mutates:"r<0"});_e("list.extend",Et("extend"),{result:"",mutates:"r<0",program:"0"});_e("list.insert",Et("insert"),{result:"",mutates:"r<1",program:"0"});_e("list.pop",Et("pop"),{result:"r",program:"0"});_e("list.remove",Et("remove"),{result:"",program:"r,0"});_e("list.sort",Et("sort"),{result:"",program:"r,0+"});_e("list.reverse",Et("reverse"),{result:""});_e("list.clear",Et("clear"),{result:""});_e("list.copy",Et("copy"),{result:"r",returns:"list"});for(let e of["list","tuple"])for(let n of["index","count"])_e(vt(e)(n),Ns(e)(n),{result:"r,0+",program:"r,0+",returns:"int"});var Is=Ns("set"),La=Ns("frozenset");_e("set.add",Is("add"),{result:"",mutates:"r<0",program:"0"});_e("set.update",Is("update"),{result:"",mutates:"r<0+",program:"0+"});for(let e of["intersection_update","difference_update","symmetric_difference_update"])_e(vt("set")(e),Is(e),{result:"",mutates:"r<0+",program:"r,0+"});for(let e of["discard","remove"])_e(vt("set")(e),Is(e),{result:"",program:"r,0"});_e("set.pop",Is("pop"),{result:"r"});_e("set.clear",Is("clear"),{result:""});_e("set.copy",La("copy"),{result:"r",returns:"set"});for(let e of["union","intersection","difference","symmetric_difference"])_e(vt("set")(e),La(e),{result:"r,0+",program:"r,0+",returns:"set"});for(let e of["issubset","issuperset","isdisjoint"])_e(vt("set")(e),La(e),{result:"r,0+",program:"r,0+",returns:"bool"});_e("json.loads",`${dt("json")}json.loads`,{result:"0+",program:"0+"});_e("json.dumps",`${dt("json")}json.dumps`,{result:"0+",program:"0+"});_e("copy.copy",`${dt("copy")}copy.copy`,{result:"0",program:"0"});_e("copy.deepcopy",`${dt("copy")}copy.deepcopy`,{result:"0+",mutates:"1<0",program:"0+"});for(let e of["b64encode","b64decode","standard_b64encode","standard_b64decode","urlsafe_b64encode","urlsafe_b64decode"])_e(`base64.${e}`,`${dt("base64")}base64.${e}`,{result:"0+",program:"0+",returns:"bytes"});_e("unicodedata.normalize",`${dt("unicodedata")}unicodedata.normalize`,{result:"0+",returns:"str?"});for(let e of["category","bidirectional"])_e(`unicodedata.${e}`,`${dt("unicodedata")}unicodedata.${e}`,{result:"0",returns:"str"});for(let e of["bisect_left","bisect_right","bisect"])_e(`bisect.${e}`,`${dt("bisect")}bisect.${e}`,{result:"0+",program:"0+",returns:"int"});for(let e of["insort_left","insort_right","insort"])_e(`bisect.${e}`,`${dt("bisect")}bisect.${e}`,{result:"",mutates:"0<1",program:"0+"});for(let e of["join","basename","dirname","normpath","splitext","split"])_e(`os.path.${e}`,`${dt("os.path")}os.path.${e}`,{result:"0+",program:"0+"});var Nf=new Set(["str","bytes","int","float","complex","bool","none","scalar"]),Ab=new Set(["str","bytes","int","float","complex","bool","tuple","list","dict","set"]),Zn={decl:"unknown"},Ib=8;function If(e,n){let t=new Map,s=c=>c==null||c.unlessWritten!==void 0&&n.written(c.unlessWritten)?null:{type:c.type,exact:!0},r=(c,p)=>c.get(Ma(p))?.value??null,i=(c,p,u)=>{if(u>Ib)return Zn;let f=n.decls.get(c),h=f?.moduleBindings?.get(p),g=e.packageOf(c);if(h==="def"||h==="class")return g===void 0?Zn:{decl:g===""?"app":"dependency"};if(h!=="import"||f?.aliases.get(p)?.rows!==1)return Zn;let y=n.envs.get(c),_=y?.names.get(p);if(_!==void 0)return i(_.moduleId,_.name,u+1);let b=y?.externalOrigins?.get(p);return b!==void 0?o(b,u+1):Zn},o=(c,p)=>{let u=c.split(".");for(let h=u.length;h>=1;h-=1){let g=e.placed(u.slice(0,h).join("."));if(g===null)continue;if(g.kind==="surface")return{decl:"dependency"};let y=u.slice(h);return y.length===1&&y[0]!==void 0?i(g.id,y[0],p):Zn}let f=u[0];return f!==void 0&&e.stdlib.has(f)?{decl:"runtime",identity:c}:Zn},a=(c,p)=>{if(p.startsWith("~")){let y=e.packageOf(c);return y===void 0?Zn:{decl:y===""?"app":"dependency"}}let u=p,f=/^\.+/u.exec(p)?.[0].length??0;if(f>0){let y=e.dottedOf(c);if(y===void 0)return Zn;let _=p.slice(f),b=Es(y.dotted,y.isPackage,f,_===""?null:_);if("failure"in b)return Zn;u=b.dotted}let[h,g]=u.split(".");return h==="builtins"?g!==void 0&&e.builtins.has(g)?{decl:"runtime",identity:u}:Zn:o(u,0)},d=(c,p,u)=>{let g=(p.args??[]).map((N,v)=>{let C=p.argProofs?.[v],R=C?.unlessWritten===void 0?s(C):null;return R!==null||N.kind!=="positional"?R:r(u,N)}).map(N=>N!==null&&N.exact&&Nf.has(N.type)),y=p.attr===null||p.receiverRange===null?null:s(p.receiverProof)??r(u,p.receiverRange),_=y!==null&&y.exact&&Nf.has(y.type),b=Zn;y!==null&&p.attr!==null?Ab.has(y.type)&&e.typeAttrs.get(y.type)?.has(p.attr)===!0&&(b={decl:"runtime",identity:`${y.type}.${p.attr}`,method:!0}):p.calleeOrigin!==null&&(b=a(c,p.calleeOrigin));let x=b.identity===void 0?void 0:Af.get(b.identity),k=x?.summary;k!==void 0&&b.method===!0&&y?.exact!==!0&&(k={...k,callsProgram:[{kind:"receiver"},...k.callsProgram??[]]});let w=x?.returns,I=w===void 0?void 0:{type:w.type,exact:w.exact==="always"||g.every(Boolean)&&(b.method!==!0||_)};return{calleeDecl:b.decl,...b.identity!==void 0?{runtimeId:`python:${b.identity}`}:{},...k!==void 0?{summary:k}:{},..._?{receiverPrimitive:!0}:{},argPrimitive:g,...I!==void 0?{value:I}:{}}},l=c=>{let p=t.get(c);if(p!==void 0)return p;let u=new Map,f=g=>g.range.end-g.range.start,h=[...n.calls.get(c)??[]].sort((g,y)=>f(g)-f(y)||g.range.start-y.range.start);for(let g of h)f(g)>0&&u.set(Ma(g.range),d(c,g,u));return t.set(c,u),u};return(c,p)=>{let u=l(c),f=u.get(Ma(p.range))??d(c,p,u),{value:h,...g}=f;return g}}function Ma(e){return`${String(e.start)}-${String(e.end)}`}var Ba="<toplevel>",Tf=64,Rb=new Set(["self","cls"]),Ao=8,Ob=new Set(["__new__","__init_subclass__","__class_getitem__"]),Io=new Set(["__del__","__repr__","__str__","__bytes__","__format__","__lt__","__le__","__eq__","__ne__","__gt__","__ge__","__hash__","__bool__","__getattr__","__getattribute__","__setattr__","__delattr__","__dir__","__get__","__set__","__delete__","__init_subclass__","__set_name__","__mro_entries__","__prepare__","__instancecheck__","__subclasscheck__","__class_getitem__","__call__","__len__","__length_hint__","__getitem__","__setitem__","__delitem__","__missing__","__iter__","__reversed__","__contains__","__add__","__sub__","__mul__","__matmul__","__truediv__","__floordiv__","__mod__","__divmod__","__pow__","__lshift__","__rshift__","__and__","__xor__","__or__","__radd__","__rsub__","__rmul__","__rmatmul__","__rtruediv__","__rfloordiv__","__rmod__","__rdivmod__","__rpow__","__rlshift__","__rrshift__","__rand__","__rxor__","__ror__","__iadd__","__isub__","__imul__","__imatmul__","__itruediv__","__ifloordiv__","__imod__","__ipow__","__ilshift__","__irshift__","__iand__","__ixor__","__ior__","__neg__","__pos__","__abs__","__invert__","__complex__","__int__","__float__","__index__","__round__","__trunc__","__floor__","__ceil__","__enter__","__exit__","__buffer__","__release_buffer__","__await__","__aiter__","__anext__","__aenter__","__aexit__","__next__","__fspath__","__post_init__","__copy__","__deepcopy__","__reduce__","__reduce_ex__","__getstate__","__setstate__","__getnewargs__","__getnewargs_ex__","__subclasshook__","__sizeof__","_missing_","_generate_next_value_"]),$f=new Set(["__getattr__","__dir__"]),Pb=new Set(["property","cached_property","abstractproperty","getter","setter","deleter"]),Cb=e=>e.some(n=>n!==null&&Pb.has(n.split(".").pop()??n)),Rf=["__new__","__init__"],Lf=new Set(["object","BaseException","Exception","ArithmeticError","AssertionError","AttributeError","BufferError","EOFError","FloatingPointError","ImportError","IndexError","KeyError","LookupError","MemoryError","ModuleNotFoundError","NameError","NotImplementedError","OSError","OverflowError","RecursionError","ReferenceError","RuntimeError","StopAsyncIteration","StopIteration","SystemError","TimeoutError","TypeError","UnboundLocalError","UnicodeError","ValueError","ZeroDivisionError","Warning","UserWarning","DeprecationWarning","RuntimeWarning"]),Eo=new Set([...Lf,"type","dict","list","set","frozenset","tuple","str","bytes","bytearray","int","float","complex"]),Mb=new Map([["keys","any"],["get","mapping"],["close","iterator"]]),Df=new Set(["excepthook","unraisablehook","displayhook","breakpointhook","__import__"]),Tb=new Map([["dataclass",{module:"dataclasses",name:"dataclass"}],["dataclasses.dataclass",{module:"dataclasses",name:null}],["total_ordering",{module:"functools",name:"total_ordering"}],["functools.total_ordering",{module:"functools",name:null}],["unique",{module:"enum",name:"unique"}],["enum.unique",{module:"enum",name:null}],["final",{module:"typing",name:"final"}],["typing.final",{module:"typing",name:null}]]),Of=new Map([["ABCMeta",{module:"abc",name:"ABCMeta"}],["abc.ABCMeta",{module:"abc",name:null}],["type",null]]);function _r(e,n){return{path:e,start:n.start,end:n.end}}function Pf(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function za(e,n,t,s){let r=[],i=[],o=[],a=[],d=new Map,l=new Map,c=new Map,p=new Map,u=new Map,f=new Map,h=new Map,g=new Map,y=new Map,_=new Map,b=new Set,x=new Set,k=new Set,w=new Map,I=new Set,N=new Map,v=A=>{let j=new Map;for(let ne of A)j.set(ne,(j.get(ne)??0)+1);return j},C=v(e.functions.map(A=>A.qualname)),R=v(e.classes.map(A=>A.qualname)),F=new Map(e.classes.map(A=>[A.qualname,A])),P=jb(e),U=(A,j)=>j!==void 0&&Fb(A,j,e.moduleBindings,P),E=A=>!A.rebound&&A.decorators.every(j=>j!==null&&U(j,Tb.get(j)))&&(A.metaclass===null||U(A.metaclass,Of.get(A.metaclass))),T=`${n}#${Ba}`,K=yr(e.toplevelFlows,"none",0);r.push({id:T,moduleId:n,name:Ba,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1,...K!==null?{valueFlows:K}:{}});let J=new Set,W=new Set,se=new Set,Y=new Map,V=new Map,fe=new Map;for(let A of e.classes){let j=`${n}#class:${A.qualname}`;A.decorators.length>0&&se.add(j),fe.has(j)||fe.set(j,A.range.start),c.set(A.qualname,j),_.set(j,A.qualname),A.bases.length>1&&b.add(j),A.interceptsLookup&&x.add(j),w.set(j,A.nonDefBinds),N.set(j,A.valueBases),(!E(A)||R.get(A.qualname)!==1)&&I.add(j),A.metaclass!==null&&!U(A.metaclass,Of.get(A.metaclass))&&k.add(j);let ne=u.get(j),X=A.valueBases??A.bases;u.set(j,ne===void 0?[...X]:[...ne,...X]);let D=A.qualname.includes(".")?A.qualname:A.name;i.push({id:j,moduleId:n,name:D,implementsRefs:[],members:[]})}for(let A of e.functions){let j=`${n}#${A.qualname}`;d.set(A.qualname,j),g.set(A.qualname,A.params===null?null:new Set(A.params.map(ae=>ae.name)));let ne=A.enclosingClass,X=ne!==null&&A.qualname===`${ne}.${A.name}`,D=X?c.get(ne):void 0,$=ne===null&&A.enclosingFunction===null,L=!$&&!X&&A.qualname===`${A.enclosingFunction??""}.${A.name}`?A.enclosingFunction:null,H=$?Pf(A.name,e.all):X&&!ne.includes(".")?Pf(ne,e.all):!1,z=X?F.get(ne):void 0,Z=C.get(A.qualname)===1&&(z===void 0||R.get(z.qualname)===1)?Db(A,z===void 0?void 0:E(z),t):null;if(Z!==null&&y.set(j,Z.kind),Y.set(j,A.name),A.decorators.length>0&&W.add(j),V.get(j)!=="other"&&V.set(j,A.decorated),(X?Io.has(A.name)||Cb(A.decorators):$&&$f.has(A.name))&&J.add(j),r.push({id:j,moduleId:n,name:$||X?A.name:A.qualname,kind:D!==void 0?A.name==="__init__"?"ctor":"method":"function",...D!==void 0?{enclosingClassId:D}:{},declRange:_r(t,A.range),isExported:H,publicSurfaceReachable:H,...Z!==null?Z.fields:{}}),$&&(l.set(A.name,j),H)){let ae=s();o.push({id:ae,moduleId:n,exportedName:A.name,kind:"value"}),a.push({exportId:ae,target:{kind:"function",functionId:j}})}if(X){let ae=p.get(ne)??new Map;ae.set(A.name,j),p.set(ne,ae)}if(L!==null){let ae=f.get(L)??new Map;ae.set(A.name,j),f.set(L,ae)}!$&&!X&&h.set(A.name,[...h.get(A.name)??[],j])}let S=i.map(A=>{let j=[...c.entries()].find(([,X])=>X===A.id)?.[0],ne=j===void 0?void 0:p.get(j);return ne===void 0?A:{...A,members:[...ne.values()]}});return{moduleId:n,functions:r,classes:S,exports:o,exportBindings:a,byQualname:d,topLevel:l,classByName:c,methods:p,baseSlots:u,nested:f,closures:h,paramNames:g,all:e.all,allComputed:e.allComputed,toplevelId:T,callable:y,moduleBindings:e.moduleBindings,aliases:P,classQualname:_,multiBase:b,intercepts:x,customMeta:k,nonDefBinds:w,rewrites:I,valueBases:N,starImport:e.starImport,attrWrites:e.attrWrites,implicitRoots:J,decoratedDefs:W,decoration:V,classStarts:fe,decoratedClasses:se,defNames:Y,valueNames:e.valueNames,valueAttrs:e.valueAttrs,computedAccess:e.computedAccess,classBinds:e.classBinds,moduleBinds:e.moduleBinds,dunderWrites:e.dunderWrites,importRenames:e.imports.flatMap(A=>A.form==="from"?A.names.flatMap(j=>j.asname!==null?[[j.asname,j.name]]:[]):[])}}function $b(e,n){let t=new Set,s=!1;for(let o of e.values())if(o.attrWrites===null)s=!0;else for(let a of o.attrWrites)t.add(a);let r=t.has("__class__")||t.has("__getattribute__"),i=new Map;for(let[o,a]of e){let d=new Map;for(let c of a.functions){let p=a.callable.get(c.id);if(p===void 0||s||c.name!==void 0&&t.has(c.name))continue;let u=p!=="function";u&&r||u&&c.enclosingClassId!==void 0&&n.has(c.enclosingClassId)||d.set(c.id,p)}if(d.size===a.callable.size){i.set(o,a);continue}let l=a.functions.map(c=>{if(!a.callable.has(c.id)||d.has(c.id))return c;let{params:p,receiver:u,reflectiveArguments:f,valueFlows:h,...g}=c;return g});i.set(o,{...a,functions:l,callable:d})}return i}var _n={kind:"unknown"},No={kind:"external"};function Ka(e,n,t,s,r=0,i=new Set){let[o,...a]=e;if(o===void 0||r>Ao)return _n;let d=`${n}${e.join(".")}`;if(i.has(d))return _n;i.add(d);let l=t.get(n),c=l?.moduleBindings;if(l===void 0||c===void 0||c===null)return _n;let p=c.get(o);if(p===void 0)return r===0&&!l.starImport?No:_n;if(p==="class"){let y=a.length===0?l.classByName.get(o):void 0;return y===void 0?_n:{kind:"class",id:y}}let u=l.aliases.get(o);if(p!=="import"||u?.rows!==1)return _n;let f=s.get(n),h=f?.names.get(o);if(h!==void 0)return Ka([h.name,...a],h.moduleId,t,s,r+1,i);let g=f?.modules.get(o);return g!==void 0?u.exactModule&&a.length>0?Ka(a,g,t,s,r+1,i):_n:f?.external?.has(o)===!0?No:_n}function Lb(e,n){let t=new Map,s=new Map,r=[],i=(o,a,d)=>{let l=o.get(a);l===void 0?o.set(a,[d]):l.push(d)};for(let[o,a]of e)for(let[d,l]of a.classByName){let c=a.valueBases.get(l);if(c==null){r.push(l);continue}if(d.includes(".")){c.length>0&&r.push(l);continue}let p=!0;for(let u of c){let f=u===null?_n:Ka(u.split("."),o,e,n);f.kind==="unknown"&&(p=!1),f.kind==="class"&&(i(t,f.id,l),i(s,l,f.id))}p||r.push(l)}return{sub:t,sup:s,unknown:es(r,t)}}function es(e,n){let t=new Set,s=[...e];for(let r=s.pop();r!==void 0;r=s.pop())if(!t.has(r)){t.add(r);for(let i of n.get(r)??[])s.push(i)}return t}function Db(e,n,t){if(e.params===null||e.rebound)return null;let s;if(e.method){if(n!==!0)return null;if(e.decorated==="staticmethod")s="static-method";else if(e.decorated==="classmethod")s="class-method";else if(e.decorated==="none"&&!Ob.has(e.name))s="instance-method";else return null}else{if(e.decorated!=="none")return null;s="function"}let r=e.params;if(s==="instance-method"||s==="class-method"){let o=r[0];if(o===void 0||o.kind!=="positional"&&o.kind!=="positional-only")return null;r=r.slice(1)}let i=yr(e.valueFlows,r.length<e.params.length?"first":"none",e.params.length);return{kind:s,fields:{params:r.map((o,a)=>({index:a,kind:o.kind==="positional-only"?"positional":o.kind,...o.kind==="positional-only"?{}:{name:o.name},destructured:!1,hasDefault:o.hasDefault,range:{path:t,start:o.start,end:o.end}})),receiver:s==="instance-method"||s==="class-method"?"call":"none",reflectiveArguments:e.reflective,...i!==null?{valueFlows:i}:{}}}}function Fb(e,n,t,s){if(t===null)return!1;if(n===null)return!t.has(e);let r=e.split(".")[0]??e,i=s.get(r)?.source;return t.get(r)!=="import"||i===void 0||i.level!==0?!1:n.name===null?i.form==="import"&&i.name===n.module&&r===n.module:i.form==="from"&&i.module===n.module&&i.name===n.name&&r===n.name}function jb(e){let n=new Map,t=(s,r,i)=>{let o=n.get(s);n.set(s,o===void 0?{rows:1,exactModule:r,...i!==void 0?{source:i}:{}}:{rows:o.rows+1,exactModule:!1})};for(let s of e.imports)for(let r of s.names){let i={form:s.form,module:s.module,level:s.level,name:r.name};s.form==="import"?t(r.asname??r.name.split(".")[0]??r.name,r.asname!==null||!r.name.includes("."),r.asname===null?i:void 0):t(r.asname??r.name,!0,r.asname===null?i:void 0)}return n}function Ua(e){let{envs:n}=e,t=e.children??new Map,s=Bb(e.decls,{decls:e.decls,envs:n,children:t}),{inheritEdges:r}=s,i=Lb(e.decls,n),o=[];for(let $ of e.decls.values())o.push(...$.customMeta);let a=es(o,i.sub),d=new Set(a);if(o.length>0)for(let $ of i.unknown)d.add($);let l=$b(e.decls,d),c=new Map,p=($,L)=>{let H=c.get($)??[];H.includes(L)||H.push(L),c.set($,H)};for(let $ of l.values()){for(let L of $.methods.values())for(let[H,z]of L)p(H,z);for(let[L,H]of $.closures)for(let z of H)p(L,z)}for(let $ of e.rebinds??[]){let L=l.get($.moduleId)?.topLevel.get($.target);L!==void 0&&p($.attr,L)}let u=new Map;for(let $ of l.values())for(let L of $.classByName.values())u.set(L,$);let f=new Map,h=new Set,g=new Set,y=new Set(a),_=new Map;for(let $ of l.values()){for(let[L,H]of $.callable)f.set(L,H);for(let L of $.multiBase)h.add(L);for(let L of $.intercepts)g.add(L);for(let L of $.rewrites)y.add(L);for(let[L,H]of $.nonDefBinds)_.set(L,H)}let b=$=>{let L=_.get($),H=u.get($),z=H?.classQualname.get($);return L==null||H===void 0||z===void 0?null:new Set([...L,...H.methods.get(z)?.keys()??[]])},x=[],k=new Map;for(let $ of i.unknown){let L=new Set,H=!1;for(let z of es([$],i.sup)){let Z=b(z);if(Z===null||y.has(z)||g.has(z)){H=!0;break}for(let ie of Z)L.add(ie)}if(H){x.push($);continue}for(let z of L){let Z=k.get(z);Z===void 0?k.set(z,[$]):Z.push($)}}let w=$=>{let L=new Map;return H=>{let z=L.get(H);return z===void 0&&(z=es([H],$),L.set(H,z)),z}},I={decls:l,envs:n,kindOf:f,classOwner:u,multiBase:h,intercepts:g,rewrites:y,nonDefBinds:_,below:w(i.sub),above:w(i.sup),unplaced:i.unknown,unplacedAnyName:x,unplacedByName:k},N=[],v=[],C=0,R=0,F=new Set,P=!1,U=new Map;for(let $ of l.values()){if($.attrWrites===null)P=!0;else for(let L of $.attrWrites)F.add(L);for(let[L,H]of $.closures)U.set(L,[...U.get(L)??[],...H])}let E=new Set;for(let $ of l.values())for(let L of $.decoratedClasses)E.add(L);let T=new Map;for(let $ of l.values())for(let[L,H]of $.decoration)T.set(L,H);let K={hier:s,rewrites:y,decorated:E},J={byMethodName:c,children:t,selfTargets:Kb(s,c,{installable:$=>P||F.has($),closures:U,intercepts:g}),construct:Wb(K,$=>P||F.has($)),written:$=>P||F.has($),decoration:$=>T.get($)??"other"},W=new Map;for(let{moduleId:$,call:L}of e.pending){let H=W.get($);H===void 0?W.set($,[L]):H.push(L)}let se=e.runtime===void 0?void 0:If(e.runtime,{decls:l,envs:n,written:J.written,calls:W}),Y=new Set,V=new Map,fe=[];for(let $ of e.pending){let{moduleId:L,path:H,call:z}=$,Z=l.get(L);if(Z===void 0)continue;if(z.raisedCall!==null){fe.push($);continue}let ie=z.enclosingFunction===null?Z.toplevelId:Z.byQualname.get(z.enclosingFunction)??Z.toplevelId,ae=Qb(z,L,Z,n.get(L),l,n,J),pe=nS(z,L,Z,ae,I);ae.how==="name-match"&&ae.resolution!=="unresolved"&&pe.direct.size===0&&(ae=Qt(ae)),V.set(`${L}${String(z.range.start)}${String(z.range.end)}`,ae);let he=`py-call:${L}:${String(C)}`;C+=1;let we=ae.resolution==="unresolved";we&&(R+=1,z.attr!==null&&Y.add(z.attr),pe=fn);let Ne=se?.(L,z);N.push({id:he,enclosingFunctionId:ie,calleeExprShape:z.receiver===null?"identifier":"member",resolvedTargetIds:we?[]:ae.ids,resolution:ae.resolution,range:_r(H,z.range),...sS(H,z,pe.convention,Ne?.argPrimitive),...oS(Ne)});for(let Ie of ae.ids)v.push({callSiteId:he,calleeFunctionId:Ie,resolution:we?"field-based":ae.resolution,...pe.direct.has(Ie)?{invocation:"direct"}:{}})}for(let{moduleId:$,path:L,call:H}of fe){let z=l.get($),Z=H.raisedCall;if(z===void 0||Z===null)continue;let ie=V.get(`${$}${String(Z.start)}${String(Z.end)}`);if(ie===void 0||ie.how==="construct"||ie.ids.length===0)continue;let ae=`py-raise:${$}:${String(C)}`;C+=1,R+=1,N.push({id:ae,enclosingFunctionId:H.enclosingFunction===null?z.toplevelId:z.byQualname.get(H.enclosingFunction)??z.toplevelId,calleeExprShape:"unknown",resolvedTargetIds:[],resolution:"unresolved",range:_r(L,H.range)})}let S=new Map;for(let $ of e.loads??[]){let L=[$.moduleId,$.enclosingFunction??"",String($.at),$.shape].join(""),H=S.get(L);if(H===void 0)S.set(L,{load:$,targets:new Set($.targets)});else for(let z of $.targets)H.targets.add(z)}let A=0;for(let{load:$,targets:L}of S.values()){let H=l.get($.moduleId);if(H===void 0)continue;let z=new Set;for(let ie of L){let ae=l.get(ie)?.toplevelId;ae!==void 0&&z.add(ae)}if(z.size===0)continue;let Z=`py-load:${$.moduleId}:${String(A)}`;A+=1,N.push({id:Z,enclosingFunctionId:$.enclosingFunction===null?H.toplevelId:H.byQualname.get($.enclosingFunction)??H.toplevelId,calleeExprShape:$.shape,resolvedTargetIds:[...z],resolution:"resolved",range:{path:$.path,start:$.at,end:$.at}});for(let ie of z)v.push({callSiteId:Z,calleeFunctionId:ie,resolution:"resolved"})}let j=[...l.values()].flatMap($=>$.functions),ne=new Map(j.map($=>[$.id,$.declRange])),X=new Set;for(let $ of N)for(let L of $.resolvedTargetIds)X.add(`${$.enclosingFunctionId}${L}`);for(let[$,L]of l)for(let[H,z]of L.nested){let Z=L.byQualname.get(H);if(Z!==void 0)for(let ie of z.values()){let ae=ne.get(ie);if(ae===void 0||X.has(`${Z}${ie}`))continue;let pe=`py-closure:${$}:${String(C)}`;C+=1,N.push({id:pe,enclosingFunctionId:Z,calleeExprShape:"identifier",resolvedTargetIds:[ie],resolution:"field-based",range:{path:ae.path,start:ae.start,end:ae.start}}),v.push({callSiteId:pe,calleeFunctionId:ie,resolution:"field-based"})}}let D=($,L,H,z,Z=$.toplevelId)=>{let ie=[...new Set(H)];if(ie.length===0&&!z)return;let ae=`py-implicit:${$.moduleId}:${String(C)}`;C+=1,z&&(R+=1),N.push({id:ae,enclosingFunctionId:Z,calleeExprShape:"unknown",resolvedTargetIds:z?[]:ie,resolution:z?"unresolved":"field-based",range:{path:L.path,start:L.start,end:L.start}});for(let pe of ie)v.push({callSiteId:ae,calleeFunctionId:pe,resolution:"field-based"})};for(let $ of l.values()){for(let z of $.implicitRoots){let Z=ne.get(z);Z!==void 0&&D($,Z,[z],!1)}let L=ne.get($.toplevelId)?.path??String($.moduleId),H=(z,Z)=>{let ie=n.get($.moduleId),ae=Xb(z,{d:$,env:ie,classQual:Z,decls:l,envs:n,facts:K});ae!==null&&D($,{path:L,start:z.at},ae.ids,ae.unnamed)};for(let[z,Z]of $.classBinds??[])for(let ie of Z)H(ie,z);for(let z of $.moduleBinds??[])$f.has(z.name)&&H(z,null);for(let z of $.dunderWrites??[])(Io.has(z.name)||Df.has(z.name))&&H(z,null);for(let[z,Z]of $.classByName){let ie=$.methods.get(z);for(let[ae,pe]of Mb){let he=ie?.get(ae),we=he===void 0?void 0:ne.get(he);if(he===void 0||we===void 0)continue;(pe==="any"||pe==="mapping"&&Da(s,Z,zb).leaves||pe==="iterator"&&Da(s,Z,Eo,"__next__").reaches)&&D($,we,[he],!1)}if(Da(s,Z,Eo).leaves){let ae=$.classStarts.get(Z);ae!==void 0&&D($,{path:L,start:ae},[],!0,Ub($,z))}}}return{functions:Yb(l,Y),callSites:N,callEdges:v,inheritEdges:r,unresolved:R}}function Ff(e,n){return e===void 0?!1:e.allComputed?!0:e.all!==null?e.all.includes(n):!n.startsWith("_")}function vo(e,n,t,s=0,r=new Set){let[i,...o]=e;if(i===void 0||s>Ao)return _n;let a=`${n}${e.join(".")}`;if(r.has(a))return _n;r.add(a);let d=t.decls.get(n);if(d===void 0)return _n;let l=d.classByName.get(e.join("."));if(l!==void 0)return{kind:"class",id:l};let c=t.envs.get(n),p=c?.names.get(i);if(p!==void 0){let u=vo([p.name,...o],p.moduleId,t,s+1,r);if(u.kind!=="unknown")return u}if(o.length>0){let u=c?.modules.get(i)??t.children.get(n)?.get(i);if(u!==void 0){let f=vo(o,u,t,s+1,r);if(f.kind!=="unknown")return f}}if(c?.external?.has(i)===!0)return No;for(let u of c?.stars??[]){if(!Ff(t.decls.get(u),i))continue;let f=vo(e,u,t,s+1,r);if(f.kind!=="unknown")return f}return s===0&&d.moduleBindings!==null&&!d.moduleBindings.has(i)&&!d.starImport?No:_n}var jf=256;function Bb(e,n){let t=[],s=new Map,r=new Map,i=new Map,o=new Map,a=[],d=(h,g,y)=>{let _=h.get(g);_===void 0?h.set(g,[y]):_.push(y)};for(let[h,g]of e)for(let[y,_]of g.classByName){o.set(_,g);let b=g.baseSlots.get(_)??[],x=b.map(w=>w===null?_n:vo(w.split("."),h,n));y.includes(".")&&b.length>0&&x.push(_n),s.set(_,x),x.some(w=>w.kind==="unknown")&&a.push(_);let k=new Set;for(let w of x)w.kind==="class"&&k.add(w.id);for(let w of k)t.push({subclassId:_,superclassId:w,relation:"extends"}),d(r,w,_),d(i,_,w)}let l=es(a,r),c=new Map;for(let h of es(l,i)){let g=o.get(h),y=g?.classQualname.get(h),_=y===void 0?void 0:g?.methods.get(y);for(let[b,x]of _??[]){let k=c.get(b);k===void 0?c.set(b,[x]):k.push(x)}}let p=new Map,u=(h,g)=>{let y=p.get(h);if(y!==void 0)return y;if(g>jf)return 2;p.set(h,0);let _=0;for(let x of s.get(h)??[])if(_+=x.kind==="unknown"?1:x.kind==="class"?u(x.id,g+1):0,_>=2)break;let b=Math.min(_,2);return p.set(h,b),b},f=!1;for(let h of l)if(u(h,0)>=2){f=!0;break}return{inheritEdges:t,basesOf:s,subclassesOf:r,classOwner:o,unplacedDefs:c,unplacedMixin:f}}function qa(e,n,t){let s=e.classOwner.get(n),r=s?.classQualname.get(n);return r===void 0?void 0:s?.methods.get(r)?.get(t)}function Ha(e,n,t){let s=new Set,r=!1,i=!1,o=!1,a=new Set,d=[...n];for(let l=d.pop();l!==void 0;l=d.pop()){if(a.has(l))continue;a.add(l);let c=qa(e,l,t);c!==void 0&&s.add(c);let p=e.classOwner.get(l),u=p?.nonDefBinds.get(l);if(u===null||u?.has(t)===!0)i=!0;else if(c===void 0){let f=p?.baseSlots.get(l)??[];for(let[h,g]of(e.basesOf.get(l)??[]).entries())g.kind==="class"?d.push(g.id):g.kind==="unknown"?r=!0:(p===void 0||!Wa(Lf,f[h],p))&&(o=!0)}}return{ids:s,open:r,alias:i,outside:o}}function Kb(e,n,t){let s=new Map,r=new Map;return(i,o)=>{let a=`${i}${o}`,d=r.get(a);if(d!==void 0)return d;let l=s.get(i);l===void 0&&(l=es([i],e.subclassesOf),s.set(i,l));let{ids:c,open:p,alias:u,outside:f}=Ha(e,l,o),h=u,g=k=>{c.has(k)||(c.add(k),h=!0)};for(let k of e.unplacedDefs.get(o)??[])g(k);let y=t.installable(o)?t.closures.get(o)??[]:[];for(let k of y)g(k);let _="self",b;if(p||e.unplacedMixin){let k=new Set([...c,...n.get(o)??[]]);if(k.size<=Tf){if(k.size>c.size||p){for(let w of k)c.add(w);h=!0,_="name-match"}}else p&&(y.length>0||[...l].some(I=>qa(e,I,o)!==void 0)||(b=ns),h=!0)}let x=!h&&!p&&!f&&!e.unplacedMixin&&!qb(e,l,t.intercepts);return b??=c.size===0?ns:{ids:[...c],resolution:x?c.size===1?"resolved":"field-based":"unresolved",how:_},r.set(a,b),b}}var zb=new Set([...Eo].filter(e=>e!=="dict"));function Da(e,n,t,s){let r=!1,i=!1,o=new Set,a=[n];for(let d=a.pop();d!==void 0;d=a.pop()){if(o.has(d))continue;o.add(d);let l=e.classOwner.get(d);if(s!==void 0){let p=l?.nonDefBinds.get(d);(qa(e,d,s)!==void 0||p===null||p?.has(s)===!0)&&(i=!0)}let c=l?.baseSlots.get(d)??[];for(let[p,u]of(e.basesOf.get(d)??[]).entries())u.kind==="class"?a.push(u.id):(u.kind==="unknown"||l===void 0||!Wa(t,c[p],l))&&(r=!0)}return{leaves:r,reaches:r||i}}function Ub(e,n){for(let t=n;t.includes(".");){t=t.slice(0,t.lastIndexOf("."));let s=e.byQualname.get(t);if(s!==void 0)return s}return e.toplevelId}function qb(e,n,t){if(t.size===0)return!1;let s=new Set,r=[...n];for(let i=r.pop();i!==void 0;i=r.pop())if(!s.has(i)){if(s.add(i),t.has(i))return!0;for(let o of e.basesOf.get(i)??[])o.kind==="class"&&r.push(o.id)}return!1}var Wa=(e,n,t)=>typeof n=="string"&&e.has(n)&&t.moduleBindings!==null&&!t.moduleBindings.has(n)&&!t.starImport,Hb=(e,n)=>Wa(Eo,e,n);function Bf(e,n){let t=new Set,s=[e];for(let r=s.pop();r!==void 0;r=s.pop()){if(t.has(r))continue;if(t.add(r),t.size>jf||n.rewrites.has(r)||n.decorated.has(r))return!1;let i=n.hier.classOwner.get(r);if(i===void 0)return!1;let o=i.baseSlots.get(r)??[];for(let[a,d]of(n.hier.basesOf.get(r)??[]).entries())if(d.kind==="class")s.push(d.id);else if(d.kind==="unknown"||!Hb(o[a],i))return!1}return!0}function Wb(e,n){let t=new Map;return s=>{let r=t.get(s);if(r!==void 0)return r;let i=e.hier.classOwner.get(s)?.classQualname.get(s)??"",o=Rf.map(l=>Ha(e.hier,[s],l)),a=i!==""&&!Rf.some(n)&&!n(i.split(".").pop()??i)&&o.every(l=>!l.open&&!l.alias)&&Bf(s,e),d={ids:o.flatMap(l=>[...l.ids]),resolution:a?o.every(l=>l.ids.size<=1)?"resolved":"field-based":"unresolved",how:"construct"};return t.set(s,d),d}}function xr(e,n,t,s,r=0,i=new Set){if(r>Ao||i.has(`${e}${n}`))return;i.add(`${e}${n}`);let o=t.get(e),a=o?.moduleBindings?.get(n);if(a==="class")return o?.classByName.get(n);if(a!=="import"||o?.aliases.get(n)?.rows!==1)return;let d=s.get(e)?.names.get(n);return d===void 0?void 0:xr(d.moduleId,d.name,t,s,r+1,i)}function Kf(e,n,t){let s=n.aliases.get(e);return!e.includes(".")&&n.moduleBindings?.get(e)==="import"&&s?.rows===1&&s.exactModule?t?.modules.get(e):void 0}function Gb(e,n){let t=e.split(".");for(let s=t.length-1;s>0;s-=1)if(n.byQualname.has(t.slice(0,s).join(".")))return!0;return!1}function Fa(e,n,t){let[s,...r]=n;if(s===void 0||r.length>0||!Bf(e,t))return null;let i=Ha(t.hier,[e],s);return i.open||i.alias?null:[...i.ids]}function Vb(e,n){let[t,...s]=e.split("."),{d:r,env:i,classQual:o}=n;if(t===void 0||t==="")return null;if(o!==null){if(Gb(o,r))return null;let h=r.classByName.get(o),g=h===void 0?null:r.nonDefBinds.get(h)??null;if(g===null||g.has(t))return null;let y=r.methods.get(o)?.get(t);if(y!==void 0)return s.length===0?[y]:null}let a=r.moduleBindings?.get(t);if(r.moduleBindings===null)return null;if(a===void 0)return r.starImport||r.topLevel.has("__getattr__")?null:[];if(a==="def"){let h=r.topLevel.get(t);return h!==void 0&&s.length===0?[h]:null}if(a==="class"){let h=r.classByName.get(t);return h===void 0?null:Fa(h,s,n.facts)}if(a!=="import"||r.aliases.get(t)?.rows!==1)return null;let d=i?.names.get(t);if(d!==void 0){let h=s.length===0?Qn(d.moduleId,d.name,n.decls,n.envs,!0):void 0;if(h!==void 0)return[h];let g=xr(d.moduleId,d.name,n.decls,n.envs);return g===void 0?null:Fa(g,s,n.facts)}let l=Kf(t,r,i),[c,...p]=s;if(l===void 0||c===void 0)return null;let u=p.length===0?Qn(l,c,n.decls,n.envs,!0):void 0;if(u!==void 0)return[u];let f=xr(l,c,n.decls,n.envs);return f===void 0?null:Fa(f,p,n.facts)}function Xb(e,n){let t=e.value;if(t.kind==="const"||t.kind==="lambda"||t.kind!=="property"&&!Io.has(e.name)&&!Df.has(e.name))return null;if(t.kind==="other")return{ids:[],unnamed:!0};let s=t.kind==="name"?[t.dotted]:t.accessors.flatMap(o=>o.kind==="name"?[o.dotted]:o.kind==="other"?[null]:[]),r=[],i=!1;for(let o of s){let a=o===null?null:Vb(o,n);a===null?i=!0:r.push(...a)}return{ids:r,unnamed:i}}function Yb(e,n){let t=!1,s=new Set(n),r=new Map;for(let o of e.values()){(o.computedAccess||o.valueNames===null||o.valueAttrs===null)&&(t=!0);for(let a of o.valueNames??[])s.add(a);for(let a of o.valueAttrs??[])s.add(a);for(let[a,d]of o.importRenames){let l=r.get(a);l===void 0?r.set(a,[d]):l.push(d)}}let i=[...s];for(let o=i.pop();o!==void 0;o=i.pop())for(let a of r.get(o)??[])s.has(a)||(s.add(a),i.push(a));return[...e.values()].flatMap(o=>o.functions.map(a=>{let d=o.defNames.get(a.id)??"",l=a.id!==o.toplevelId&&(t||a.enclosingClassId!==void 0||s.has(d)||o.decoratedDefs.has(a.id));return{...a,addressTaken:l}}))}function Qn(e,n,t,s,r=!1,i=new Set,o=0){if(o>Ao)return;let a=`${e}${n}`;if(i.has(a))return;i.add(a);let d=t.get(e),l=d?.moduleBindings?.get(n),c=d?.topLevel.get(n);if(c!==void 0)return!r||l==="def"?c:void 0;let p=s.get(e),u=p?.names.get(n);if(u!==void 0)return r&&(l!=="import"||d?.aliases.get(n)?.rows!==1)?void 0:Qn(u.moduleId,u.name,t,s,r,i,o+1);if(!r)for(let f of p?.stars??[]){if(!Ff(t.get(f),n))continue;let h=Qn(f,n,t,s,!1,i,o+1);if(h!==void 0)return h}}var ns={ids:[],resolution:"unresolved",how:"none"};function ja(e,n){let t=n.byMethodName.get(e)??[];return t.length===0||t.length>Tf?ns:{ids:t,resolution:"field-based",how:"name-match"}}function Jb(e,n,t){for(let s=n;s!==null&&s!=="";){if(t.byQualname.has(s)){let i=t.nested.get(s)?.get(e);if(i!==void 0)return{kind:"def",id:i};if(t.paramNames.get(s)?.has(e)===!0)return{kind:"param"}}let r=s.lastIndexOf(".");s=r<0?null:s.slice(0,r)}return{kind:"none"}}function Zb(e,n,t,s){let[r,...i]=e.split(".");if(r===void 0||r==="")return;let o=n?.modules.get(r);for(let a of i){if(o===void 0)return;o=t.get(o)?.modules.get(a)??s.get(o)?.get(a)}return o}function Qb(e,n,t,s,r,i,o){let a=e.attr,d=e.nameScope;if(a===null){if(e.callee===null||e.receiver!==null)return ns;let p=e.callee,u=Jb(p,e.enclosingFunction,t);if(d==="local-def"&&u.kind==="def")return wo({ids:[u.id],resolution:"resolved",how:"local"},o,null);let f=eS(p,u,n,t,s,r,i);if(d!=="module")return Qt(f);let h=Qn(n,p,r,i,!0);if(h!==void 0&&f.ids[0]===h)return wo({ids:[h],resolution:"resolved",how:"bare"},o,p);if(f.ids.length>0)return Qt(f);let g=xr(n,p,r,i);return g===void 0?ns:o.construct(g)}if(e.receiver===null)return ja(a,o);let l=e.receiver;if(Rb.has(l)&&e.enclosingFunction!==null){let p=e.enclosingFunction.split(".").slice(0,-1).join("."),u=t.classByName.get(p);if(u!==void 0){let f=o.selfTargets(u,a),h=t.byQualname.get(e.enclosingFunction),g=h===void 0?"other":o.decoration(h),y=e.root==="param0"&&(g==="none"||g==="classmethod");return f.resolution==="unresolved"||!y?Qt(f):wo(f,o,a)}}let c=Zb(l,s,i,o.children);if(c!==void 0){let p=l.split("."),u=p[0]??l,f=d==="module"&&t.moduleBindings?.get(u)==="import"&&t.aliases.get(u)?.rows===1&&p.slice(1).every(b=>!o.written(b)),h=Qn(c,a,r,i);if(h!==void 0){let b={ids:[h],resolution:"resolved",how:"module"};return f&&Qn(c,a,r,i,!0)===h?wo(b,o,a):Qt(b)}let g=ja(a,o),y=f&&Kf(l,t,s)===c?xr(c,a,r,i):void 0;if(y===void 0)return Qt(g);let _=o.construct(y);return g.ids.length===0?_:{ids:[...new Set([..._.ids,...g.ids])],resolution:_.resolution==="unresolved"?"unresolved":"field-based",how:"construct"}}return ja(a,o)}function eS(e,n,t,s,r,i,o){if(n.kind==="def")return{ids:[n.id],resolution:"resolved",how:"local"};let a=s.topLevel.get(e);if(a!==void 0)return{ids:[a],resolution:"resolved",how:"bare"};let d=r?.names.get(e),l=d!==void 0?Qn(d.moduleId,d.name,i,o):Qn(t,e,i,o);return l!==void 0?{ids:[l],resolution:"resolved",how:"bare"}:ns}function Qt(e){return e.ids.length===0?ns:{...e,resolution:"unresolved"}}function wo(e,n,t){return e.ids.some(r=>{let i=n.decoration(r);return i!=="none"&&i!=="staticmethod"&&i!=="classmethod"})||t!==null&&n.written(t)?Qt(e):e}var fn={direct:new Set,convention:"unknown"};function Cf(e,n,t){return e!==void 0&&n.ids.length===1&&n.ids[0]===e&&t.get(e)==="function"?{direct:new Set([e]),convention:"direct"}:fn}function Mf(e){return e.length>0&&e.every(n=>n==="instance-method")?"shifted":e.length>0&&e.every(n=>n==="class-method"||n==="static-method")?"direct":"unknown"}function nS(e,n,t,s,r){if(e.root!==(s.how==="self"?"param0":"global"))return fn;let i=r.envs.get(n);switch(s.how){case"bare":return e.callee===null?fn:Cf(Qn(n,e.callee,r.decls,r.envs,!0),s,r.kindOf);case"module":{let o=e.receiver===null?void 0:t.aliases.get(e.receiver),a=e.receiver===null?void 0:i?.modules.get(e.receiver);return e.receiver===null||e.attr===null||a===void 0||t.moduleBindings?.get(e.receiver)!=="import"||o?.rows!==1||!o.exactModule?fn:Cf(Qn(a,e.attr,r.decls,r.envs,!0),s,r.kindOf)}case"self":{let o=e.attr,a=e.enclosingFunction===null?void 0:t.byQualname.get(e.enclosingFunction),d=a===void 0?void 0:r.kindOf.get(a);if(o===null||d!=="instance-method"&&d!=="class-method")return fn;let l=(e.enclosingFunction??"").split(".").slice(0,-1).join("."),c=t.classByName.get(l),p=t.methods.get(l)?.get(o);if(c===void 0||p===void 0||!s.ids.includes(p))return fn;let u=[];for(let y of s.ids){let _=r.kindOf.get(y);if(_===void 0||_==="function")return fn;u.push(_)}let f=r.below(c),h=r.above(c);for(let y of f){if(y===c)continue;let _=r.nonDefBinds.get(y);if(r.multiBase.has(y)||r.rewrites.has(y)||r.intercepts.has(y)||_===void 0||_===null||_.has(o))return fn;let b=r.classOwner.get(y),x=b?.classQualname.get(y),k=x===void 0?void 0:b?.methods.get(x)?.get(o);if(k!==void 0&&!s.ids.includes(k))return fn}for(let y of h)if(r.intercepts.has(y))return fn;if(r.unplaced.has(c)&&r.intercepts.size>0)return fn;let g=y=>f.has(y)||h.has(y);return r.unplacedAnyName.some(y=>!g(y))||(r.unplacedByName.get(o)??[]).some(y=>!g(y))?fn:{direct:new Set(s.ids),convention:d==="instance-method"?"direct":Mf(u)}}case"name-match":{let o=e.receiver===null||e.receiver.includes(".")?void 0:tS(e.receiver,t,i,r.decls),a=o===void 0?void 0:r.classOwner.get(o),d=o===void 0?void 0:a?.classQualname.get(o),l=d===void 0||e.attr===null?void 0:a?.methods.get(d)?.get(e.attr),c=l===void 0?void 0:r.kindOf.get(l);return l===void 0||c===void 0||c==="function"||!s.ids.includes(l)?fn:{direct:new Set([l]),convention:Mf([c])}}default:return fn}}function tS(e,n,t,s){let r=n.moduleBindings?.get(e);if(r==="class")return n.classByName.get(e);let i=t?.names.get(e);if(r!=="import"||i===void 0||n.aliases.get(e)?.rows!==1)return;let o=s.get(i.moduleId);return o?.moduleBindings?.get(i.name)==="class"?o.classByName.get(i.name):void 0}function sS(e,n,t,s=[]){let r=n.args,i=t==="shifted"&&r?.[0]?.kind!=="positional"?"unknown":t;return{...r!==null?{args:r.map((o,a)=>rS(e,o,a,s[a]===!0)),convention:i}:{},...n.receiverRange!==null?{receiverRange:_r(e,n.receiverRange)}:{},repeats:n.repeats}}function rS(e,n,t,s){return{index:t,...n.kind==="keyword"&&n.keyword!==void 0?{keyword:n.keyword}:{},spread:n.kind==="star"?"positional":n.kind==="double-star"?"keyword":!1,range:_r(e,n),...s?{primitive:!0}:{}}}function oS(e){return e===void 0?{}:{calleeDecl:e.calleeDecl,...e.runtimeId!==void 0?{runtimeId:e.runtimeId}:{},...e.summary!==void 0?{summary:e.summary}:{},...e.receiverPrimitive===!0?{receiverPrimitive:!0}:{}}}var iS=8,aS=new Set(["__new__","__init_subclass__","__class_getitem__"]),Ro=e=>e.map(n=>n.name+"()".repeat(n.calls)).join(".");function lS(e){let n=/^(~|\.*)(.*)$/u.exec(e);if(n===null)return null;let t=[];for(let s of(n[2]??"").split(".")){let r=s.replace(/(?:\(\))+$/u,"");if(r==="")return null;t.push({name:r,calls:(s.length-r.length)/2})}return{lead:n[1]??"",segs:t}}function dS(e){let n=new Map,t=e.moduleBindings;if(t===null)return n;for(let s of e.imports)if(!(s.enclosingFunction!==null||s.guards.includes("type-checking")))for(let r of s.names){let i=r.name.split(".")[0]??r.name,o=r.asname??(s.form==="import"?i:r.name);if(t.get(o)!=="import")continue;let a=s.form==="import"?r.asname!==null?r.name:i:`${".".repeat(s.level)}${s.module!==null&&s.module!==""?`${s.module}.`:""}${r.name}`;n.set(o,a)}return n}function Hf(e,n){let t=new Map;for(let[p,u]of n.modules){let f=new Map;for(let g of u.file.functions)f.set(g.qualname,(f.get(g.qualname)??0)+1);let h=new Map(u.file.functions.filter(g=>f.get(g.qualname)===1).map(g=>[g.qualname,g]));t.set(p,{...u,id:p,imports:dS(u.file),rows:h})}let s=(p,u,f=0)=>{if(f>iS)return null;let h=lS(p);if(h===null)return null;if(h.lead==="~"){let[y,..._]=h.segs;return y===void 0?null:r(u,y,_,f)}let g=h.segs;if(h.lead.length>0){let y=So(u.dotted,u.isPackage),_=y===""?[]:y.split("."),b=h.lead.length-1;if(b>=_.length)return null;g=[..._.slice(0,_.length-b).map(x=>({name:x,calls:0})),...g]}for(let y=g.length;y>=1;y-=1){if(g.slice(0,y).some(k=>k.calls>0))continue;let _=n.byDotted.get(Ro(g.slice(0,y)));if(_===void 0)continue;let b=t.get(_);if(b===void 0||!b.app)return{kind:"name",text:Ro(g)};let x=g[y];return x===void 0?null:r(b,x,g.slice(y+1),f)}return{kind:"name",text:Ro(g)}},r=(p,u,f,h)=>{let g="()".repeat(u.calls)+f.map(k=>`.${Ro([k])}`).join(""),y=p.file.moduleOrigins?.get(u.name);if(y!==void 0)return s(y+g,p,h+1);let _=p.imports.get(u.name);if(_!==void 0)return s(_+g,p,h+1);let b=p.file.moduleBindings?.get(u.name);if(b==="def"&&u.calls===0){let k=p.decls.topLevel.get(u.name),w=p.rows.get(u.name);return k===void 0||w===void 0?null:{kind:"function",module:p,id:k,row:w,rest:f}}if(b==="class"&&p.decls.classByName.has(u.name))return{kind:"class",module:p,qualname:u.name,calls:u.calls,rest:f};let x=p.file.annotatedAliases?.get(u.name);return x!==void 0&&u.calls===0&&f.length===0?{kind:"annotated",module:p,value:x}:null},i=(p,u)=>{if(p===null)return null;let f=s(p,u);return f?.kind==="name"?f.text:null},o=(p,u)=>p!==null&&u.includes(p),a=(p,u,f)=>p!==null&&u.some(h=>f.some(g=>p===`${h}.${g}()`)),d=new Map,l=new Set,c=(p,u,f)=>{let h=d.get(p);h===void 0?d.set(p,{row:u,regs:[f]}):h.regs.push(f)};for(let p of t.values()){for(let u of p.file.functions){let f=u.decoratorFacts;if(f===null||f.length===0||u.method||u.params===null)continue;let h=p.decls.byQualname.get(u.qualname);if(h===void 0||p.rows.get(u.qualname)!==u)continue;let g=f.map(_=>i(_.origin,p)),y=_=>{let b=g[_]??null;return a(b,$n.apps,$n.decorators)?$n:a(b,Bn.apps,Bn.decorators)?Bn:null};f.forEach((_,b)=>{let x=y(b);if(x===null)return;l.add(h);for(let I=b+1;I<f.length;I+=1)if(y(I)===null)return;let k={path:p.path,start:_.start,end:_.end},w=x===$n?zf(u,p,s):Uf(u,_.rule);c(h,u,{model:x,at:k,params:w})})}for(let u of p.file.calls){let f=u.registration;if(f===null||u.args===null||u.args.length!==f.args.length)continue;let h=i(f.callee,p);if(h===null)continue;let g={path:p.path,start:u.range.start,end:u.range.end},y=(b,x)=>cS(u,b,x),_=b=>{let x=b===null?null:f.args[b]?.origin??null,k=x===null?null:s(x,p);return k?.kind!=="function"||k.rest.length!==0?null:(k.row.decoratorFacts??[null]).length===0?{id:k.id,row:k.row,ctx:k.module}:null};if($n.apps.some(b=>h===`${b}.${$n.addRoute}`)){let b=_(y("endpoint",1));b!==null&&c(b.id,b.row,{model:$n,at:g,params:zf(b.row,b.ctx,s)})}else if(Bn.apps.some(b=>h===`${b}.${Bn.addRule}`)){let b=_(y("view_func",2)),x=y("rule",0);b!==null&&c(b.id,b.row,{model:Bn,at:g,params:Uf(b.row,x===null?null:f.args[x]?.literal??null)})}else if(o(h,yn.paths)||o(h,yn.regexes)){let b=o(h,yn.regexes),x=y("route",0),k=x===null?null:f.args[x]?.literal??null,w=y("view",1),I=w===null?null:f.args[w]?.origin??null,N=I===null?null:s(I,p);if(N?.kind==="function"&&N.rest.length===0&&gS(N.row,N.module,i))c(N.id,N.row,{model:yn,at:g,params:qf(N.row,0,k,b)});else if(N?.kind==="class"&&N.calls===0&&N.rest.length===1&&N.rest[0]?.name==="as_view"&&N.rest[0].calls===1){let v=N.module.decls.methods.get(N.qualname);for(let C of yn.methods){let R=v?.get(C),F=N.module.rows.get(`${N.qualname}.${C}`);R===void 0||F===void 0||F.decorated!=="none"||c(R,F,{model:yn,at:g,params:qf(F,1,k,b)})}}}}}return e.map(p=>{let u=d.get(p.id),f=u?.row??uS(p,t),h=p;if(u!==void 0){let g=pS(u.row,u.regs);g.length>0&&(h={...h,sourceParams:g})}if(h.valueFlows===void 0&&f!==void 0&&f.valueFlows!==null){let y=u!==void 0||l.has(p.id)||f.valueFlows.some(_=>_.from.kind==="source")?fS(f):null;y!==null&&(h={...h,valueFlows:y})}return h})}function cS(e,n,t){let s=e.args??[],r=s.findIndex(o=>o.kind==="keyword"&&o.keyword===n);if(r>=0)return r;let i=0;for(let o=0;o<s.length;o+=1){let a=s[o];if(a===void 0)break;if(a.kind==="star"||a.kind==="double-star")return null;if(a.kind==="positional"){if(i===t)return o;i+=1}}return null}function uS(e,n){let t=n.get(e.moduleId);if(t===void 0)return;let s=e.id.slice(`${e.moduleId}#`.length);return t.decls.byQualname.get(s)===e.id?t.rows.get(s):void 0}function fS(e){if(e.params===null)return null;let n;if(!e.method)n="none";else if(e.decorated==="staticmethod")n="none";else if(e.decorated==="none"&&!aS.has(e.name)||e.decorated==="classmethod")n="first";else return null;if(n==="first"){let t=e.params[0];if(t===void 0||t.kind!=="positional"&&t.kind!=="positional-only")return null}return yr(e.valueFlows,n,e.params.length)}function pS(e,n){let t=e.method&&e.decorated!=="staticmethod"?1:0,s=new Map,r=[...n].sort((i,o)=>i.at.path.localeCompare(o.at.path)||i.at.start-o.at.start);for(let i of r)for(let o of[...i.params].sort((a,d)=>a-d)){let a=o-t;a<0||s.has(a)||s.set(a,{index:a,sourceClass:i.model.sourceClass,model:i.model.id,registeredAt:i.at})}return[...s.values()].sort((i,o)=>i.index-o.index)}function zf(e,n,t){let s=new Set,r=(a,d)=>{if(a===null)return null;let l=t(a,d);return l?.kind==="name"?l.text:null},i=(a,d)=>a!==null&&$n.depends.includes(r(a.callee,d)??""),o=(a,d)=>$n.schemes.includes(r(a.arg0,d)??"");return(e.params??[]).forEach((a,d)=>{let l=e.paramFacts?.[d]??null;if(l===null){s.add(d);return}let c=l.annotated!==null?{value:l.annotated,from:n}:null;if(c===null&&l.annotation!==null){let f=t(l.annotation,n);f?.kind==="annotated"&&(c={value:f.value,from:f.module})}let p=c!==null?r(c.value.type,c.from):r(l.annotation,n),u=[];i(l.default,n)&&l.default!==null&&u.push({call:l.default,from:n});for(let f of c?.value.meta??[])f!==null&&c!==null&&i(f,c.from)&&u.push({call:f,from:c.from});if(u.length>0){u.some(h=>o(h.call,h.from)||h.call.arg0===null&&$n.forms.includes(p??""))&&s.add(d);return}$n.injected.includes(p??"")||s.add(d)}),s}var mS=/<(?:[a-zA-Z_][a-zA-Z0-9_]*(?:\([^)]*\))?:)?([a-zA-Z_][a-zA-Z0-9_]*)>/gu;function Uf(e,n){let t=n===null?null:new Set([...n.matchAll(mS)].map(s=>s[1]));return Wf(e,0,t)}function qf(e,n,t,s){let r=e.params??[],i=r[n];if(i===void 0||i.kind!=="positional"&&i.kind!=="positional-only")return new Set;let o=new Set([n]);if(t===null)return r.forEach((c,p)=>{p>n&&o.add(p)}),o;let a=s?[...t.matchAll(/\(\?P<([^>]+)>/gu)].map(c=>c[1]):[...t.matchAll(/<(?:[^>:]+:)?([^>]+)>/gu)].map(c=>c[1]);if(a.length>0){for(let c of Wf(e,n+1,new Set(a)))o.add(c);return o}let d=s?[...t.matchAll(/(?<!\\)\((?!\?)/gu)].length:0,l=0;return r.forEach((c,p)=>{p<=n||l>=d||(c.kind==="positional"||c.kind==="positional-only"?(o.add(p),l+=1):c.kind==="rest"&&(o.add(p),l=d))}),o}function Wf(e,n,t){let s=new Set,r=t===null||t.size>0;return(e.params??[]).forEach((i,o)=>{o<n||(i.kind==="keyword-rest"?r&&s.add(o):(i.kind==="positional"||i.kind==="keyword-only")&&(t===null||t.has(i.name))&&s.add(o))}),s}var hS=new Set([...yn.passThrough,yn.apiView,...yn.apiViewSetters]);function gS(e,n,t){let s=e.decoratorFacts;return s===null?!1:s.every(r=>hS.has(t(r.origin,n)??""))}var yS=5e3,Gf=200,Vf=100,_S=new Set(["args","params","flows"]),Xf={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Yf(e){return`pkg:${e}`}function ct(e){return e.split(/[\\/]+/u).join("/")}function Ga(e,n){let t=e.endsWith("/")?e:`${e}/`,s=ct(n),r=ct(t);return s.startsWith(r)?s.slice(r.length):null}function Jf(e){let n=ct(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let s=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),s].filter(r=>r!=="").join("."),isPackage:!1}}function Va(e){return e.split(".")[0]??e}var xS="site-packages:";function Xa(e){let n=e.extract??Oo,t=e.maxModules??yS,s=(e.externalRoots??[]).map(L=>ct(L).endsWith("/")?ct(L):`${ct(L)}/`),r=L=>{let H=ct(L);return s.find(z=>H.startsWith(z))??null},i=L=>r(L)!==null,o=[],a=new Map,d=[],l=[],c=new Set,p=new Set,u=new Map,f=new Map,h=[],g=[],y=new Map,_=new Set,b=new Set,x=[],k=0,w=()=>{let L=`py-export:${String(k)}`;return k+=1,L},I=null,N=!1,v=new Set,C=new Set,R=new Map,F=new Map,P=bf(L=>{let H=wt(e.paths,L).resolved;return H!==null&&Ga(e.projectRoot,H.path)!==null&&!i(H.path)}),U=new Map,E=[];for(let L of e.entryFiles){let H=Ga(e.projectRoot,L);if(H===null){o.push({code:"unresolved-import",where:ct(L),detail:"entrypoint lies outside the project root; not analyzed"});continue}c.has(L)||(c.add(L),E.push({file:L,rel:H,isEntry:!0,packageName:"",modulePath:H}))}let T=L=>{let H=Yf(L);return a.has(H)||(p.add(L),a.set(H,{id:H,packageName:L,versionRange:"",path:L,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),H},K=0,J=(L,H,z,Z)=>{let ie=`py-import:${String(K)}`;K+=1,d.push({id:ie,moduleId:L,specifier:H,...z!==null?{resolvedModuleId:z}:{},isNamespace:!1,isDefault:!1,dynamic:Z,specifierIsLiteral:!0}),z!==null&&l.push({importId:ie,resolvedModuleId:z})};for(let L=0;L<Vf&&E.length>0;L+=1){let H=E.slice(0,Gf);E=E.slice(Gf);let z=n(H.map(ie=>ie.file),e.python!==void 0?{python:e.python,hints:P}:{hints:P});if(I??=z.interpreter,v.size===0&&z.stdlib.length>0&&(v=new Set(z.stdlib)),C.size===0&&z.builtins.length>0&&(C=new Set(z.builtins)),R.size===0&&z.typeAttrs.size>0&&(R=z.typeAttrs),z.refused!==null)return o.push({code:"extract-refused",where:"",detail:`${z.refused}: ${z.diagnostics.join("; ")}`}),{graph:Xf,diagnostics:o,interpreter:z.interpreter,counts:{modules:0,surfaces:0},opaqueCode:[]};let Z=new Map(z.files.map(ie=>[ie.path,ie]));for(let ie of H){let ae=Z.get(ie.file),pe=ie.rel,he=Jf(ie.modulePath);if(F.set(pe,he),a.set(pe,{id:pe,packageName:ie.packageName,versionRange:"",path:ie.modulePath,moduleSystem:"dual",isEntrypoint:ie.isEntry}),ae===void 0||ae.refused!==null){o.push({code:"file-refused",where:ie.rel,detail:ae?.refused??"no row was returned for this file"});continue}W(ae,pe,he),S(ae,ie.rel);let we=ae.truncated.filter(Ne=>!_S.has(Ne));we.length>0&&o.push({code:"extract-truncated",where:ie.rel,detail:`the extract stopped at its per-file bound for ${we.join(", ")}; what lies past it is not in this graph`}),u.set(pe,za(ae,pe,ie.rel,w)),f.set(pe,fe(ae,pe,he)),U.set(pe,{file:ae,decls:u.get(pe),dotted:he.dotted,isPackage:he.isPackage,app:ie.packageName==="",path:ie.rel});for(let Ne of ae.calls)h.push({moduleId:pe,path:ie.rel,call:Ne});for(let Ne of ae.escapes){if(Ne.kind!=="attr-rebind")continue;let Ie=Ne.attr??null;Ie===null||Ne.target===null||x.push({moduleId:pe,attr:Ie,target:Ne.target})}}}function W(L,H,z){for(let Z of L.imports){if(Z.guards.includes("type-checking"))continue;let ie=[];if(Z.level>0){let he=Es(z.dotted,z.isPackage,Z.level,Z.module);if("failure"in he){o.push({code:"unresolved-import",where:L.path,detail:`relative import (level ${String(Z.level)}) ${he.failure}`});continue}ie.push(he.dotted);for(let we of Z.names)ie.push(`${he.dotted}.${we.name}`)}else if(Z.module!==null){ie.push(Z.module);for(let he of Z.names)ie.push(`${Z.module}.${he.name}`)}else continue;let ae=!1,pe=new Set;for(let he of ie)se(he,H,Z.deferred,pe)&&(ae=!0);if(pe.size>0&&g.push({moduleId:H,path:H,enclosingFunction:Z.enclosingFunction,at:Z.range.start,shape:"require",targets:[...pe]}),!ae){let he=ie[0]??"";J(H,he,null,Z.deferred);let we=Va(he);if(v.has(we)||Z.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf(we)===null)continue;o.push({code:"unresolved-import",where:L.path,detail:`\`${he}\` did not resolve on the search path`})}}}function se(L,H,z,Z){let ie=L.split("."),ae=!1;for(let pe=1;pe<=ie.length;pe+=1){let he=ie.slice(0,pe).join("."),we=wt(e.paths,he);if(we.resolved===null)continue;let Ne=V(we.resolved,H,he,z);Ne!==null&&Z.add(Ne),pe===ie.length&&(ae=!0)}return ae}function Y(L){return c.has(L.file)||a.has(L.rel)?!0:c.size>=t?(N||(N=!0,o.push({code:"module-cap",where:L.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(c.add(L.file),E.push(L),!0)}function V(L,H,z,Z){if(L.kind==="stub-only")return null;let ie=L.kind==="module"||L.kind==="package",ae=Ga(e.projectRoot,L.path);if(ae!==null&&!i(L.path)&&ie){let Ne=ae;return J(H,z,Ne,Z),y.set(z,Ne),Y({file:L.path,rel:ae,isEntry:!1,packageName:"",modulePath:ae}),Ne}let pe=e.distributionOf(Va(z));if(pe===null)return J(H,z,null,Z),o.push({code:"unresolved-import",where:z,detail:`resolved to ${L.kind} outside the project, but no installed distribution provides \`${Va(z)}\``}),null;let he=r(L.path);if(!ie||he===null)return J(H,z,T(pe),Z),_.add(z),(L.kind==="extension"||ie&&he===null)&&b.add(z),null;let we=`${xS}${ct(L.path).slice(he.length)}`;return J(H,z,we,Z),y.set(z,we),Y({file:L.path,rel:we,isEntry:!1,packageName:pe,modulePath:ct(L.path).slice(he.length)}),we}function fe(L,H,z){let Z=new Map,ie=new Map,ae=new Set,pe=new Map,he=(Ie,Fe)=>{ae.add(Ie),pe.set(Ie,Fe)},we=[],Ne=Ie=>v.has(Ie.split(".")[0]??Ie)||_.has(Ie);for(let Ie of L.imports){if(Ie.guards.includes("type-checking"))continue;let Fe=Ie.module;if(Ie.level>0){let Le=Es(z.dotted,z.isPackage,Ie.level,Ie.module);if("failure"in Le)continue;Fe=Le.dotted}if(Fe!==null){if(Ie.star){let Le=y.get(Fe);Le!==void 0&&!we.includes(Le)&&we.push(Le)}if(Ie.form==="import"){let Le=Ie.names[0]?.asname??null;if(Le!==null){let tn=y.get(Fe);tn!==void 0?Z.set(Le,tn):Ne(Fe)&&he(Le,Fe);continue}let Je=Fe.split(".")[0]??Fe,Ae=y.get(Je)??y.get(Fe);Ae!==void 0?Z.set(Je,Ae):Ne(Je)&&he(Je,Je);continue}for(let Le of Ie.names){let Je=Le.asname??Le.name,Ae=y.get(`${Fe}.${Le.name}`);if(Ae!==void 0){Z.set(Je,Ae);continue}let tn=y.get(Fe);tn!==void 0?ie.set(Je,{moduleId:tn,name:Le.name}):(Ne(Fe)||Ne(`${Fe}.${Le.name}`))&&he(Je,`${Fe}.${Le.name}`)}}}return Z.set("",H),{modules:Z,names:ie,external:ae,externalOrigins:pe,stars:we}}function S(L,H){for(let z of L.escapes)switch(z.kind){case"loader-escape":o.push({code:"loader-escape",where:H,detail:`${z.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":o.push({code:"dynamic-load-set",where:H,detail:`${z.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":o.push({code:"module-registry-write",where:H,detail:`${z.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let Z=z.target;if(Z===null)break;let ie=new Set;se(Z,H,!0,ie),ie.size>0&&g.push({moduleId:H,path:H,enclosingFunction:z.enclosingFunction,at:z.range.start,shape:"dynamic-import",targets:[...ie]});break}case"dispatch-escape":break}}E.length>0&&o.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(Vf)} waves; the graph is INCOMPLETE`});let A=new Map;for(let[L,H]of y){let z=L.lastIndexOf(".");if(z<0)continue;let Z=y.get(L.slice(0,z));if(Z===void 0||Z===H)continue;let ie=A.get(Z)??new Map;ie.set(L.slice(z+1),H),A.set(Z,ie)}let j=Ua({decls:u,envs:f,pending:h,rebinds:x,loads:g,children:A,runtime:{builtins:C,typeAttrs:R,stdlib:v,placed:L=>{let H=y.get(L);return H!==void 0?{kind:"module",id:H}:_.has(L)?{kind:"surface"}:null},packageOf:L=>a.get(L)?.packageName,dottedOf:L=>F.get(L)}}),ne=Hf(j.functions,{modules:U,byDotted:y}),X=[...u.values()].flatMap(L=>L.classes),D=[...u.values()].flatMap(L=>L.exports),$=[...u.values()].flatMap(L=>L.exportBindings);return{graph:{...Xf,modules:[...a.values()],imports:d,importEdges:l,functions:ne,classes:X,exports:D,exportBindings:$,callSites:j.callSites,callEdges:j.callEdges,inheritEdges:j.inheritEdges},diagnostics:o,interpreter:I,counts:{modules:a.size-p.size,surfaces:p.size},opaqueCode:[...b].sort()}}import{readdirSync as bS,readFileSync as Qf,statSync as Po}from"node:fs";import xn from"node:path";import{spawnSync as SS}from"node:child_process";var kS="python3",wS=256*1024,vS=8*1024*1024,ep=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,ES=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function Dt(e){try{return Po(e).isFile()}catch{return!1}}function Zf(e){try{return Po(e).isDirectory()}catch{return!1}}function NS(e,n){return xn.relative(e,n).split(xn.sep).join("/")}function AS(e){let n=e.python??process.env.CUPEL_PYTHON??kS,t=SS(n,["-I","-S",...hr("metadata.py"),e.projectRoot],{encoding:"utf8",maxBuffer:vS,timeout:6e4}),s=d=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:d}]});if(t.error!==void 0||t.status!==0)return s("the declared entry surface could not be read; it is unknown, not empty");let r;try{r=JSON.parse(t.stdout)}catch{return s("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof r!="object"||r===null)return{entries:[],projectName:null,gaps:[]};let i=r,o=(Array.isArray(i.entryPoints)?i.entryPoints:[]).filter(d=>typeof d=="object"&&d!==null&&typeof d.name=="string"&&typeof d.target=="string"&&typeof d.kind=="string"),a=(Array.isArray(i.gaps)?i.gaps:[]).flatMap(d=>{if(typeof d!="object"||d===null)return[];let l=d,c=typeof l.file=="string"?l.file:"",p=typeof l.why=="string"?l.why:"";return[{source:"metadata",declaration:c,detail:p==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":p}]});return{entries:o,gaps:a,projectName:typeof i.projectName=="string"?i.projectName:null}}function Ya(e,n){let t=ep.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let s=t[1]??"",r=wt(e.paths,s);if(r.resolved===null)return{detail:`\`${s}\` ${r.failure??"did not resolve"}`};if(r.resolved.kind==="namespace"||r.resolved.kind==="stub-only")return{detail:`\`${s}\` resolved to a ${r.resolved.kind}, which runs no code`};let i=NS(e.projectRoot,r.resolved.path);return i.startsWith("..")?{detail:`\`${s}\` resolves outside the project root; not seeded`}:{file:i}}function IS(e){let n=[];Dt(xn.join(e,"__main__.py"))&&n.push("__main__.py");let t=(s,r)=>{let i;try{i=bS(s).sort()}catch{return}for(let o of i){if(o.startsWith("."))continue;let a=xn.join(s,o);Zf(a)&&Dt(xn.join(a,"__init__.py"))&&Dt(xn.join(a,"__main__.py"))&&n.push(`${r}${o}/__main__.py`)}};return t(e,""),Zf(xn.join(e,"src"))&&t(xn.join(e,"src"),"src/"),n}function RS(e,n){let t=xn.join(e,"Procfile");if(!Dt(t))return[];let s;try{if(Po(t).size>n)return[];s=Qf(t,"utf8")}catch{return[]}let r=[];for(let i of s.split(/\r?\n/u)){let o=ES.exec(i);o?.[1]!==void 0&&r.push(o[1])}return r}var OS=256*1024,PS=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,CS=/^\s*WORKDIR\s+(\S+)\s*$/imu,MS=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,TS=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,$S=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function LS(e){let n=CS.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let s=MS.exec(t),r=s?.[1],i=s?.[2]?.replace(/\/+$/u,"");if(r===void 0||i===void 0||i!==n)continue;let o=r.replace(/\/+$/u,"");return o==="."?null:o}return null}function DS(e,n){let t=[],s=i=>{let o=xn.join(e,i);if(!Dt(o))return null;try{return Po(o).size>n?null:Qf(o,"utf8")}catch{return null}},r=s("Dockerfile");if(r!==null){let i=LS(r);for(let o of r.split(/\r?\n/u)){let a=PS.exec(o);a?.[1]!==void 0&&t.push({command:a[1],from:"Dockerfile",srcRoot:i})}}for(let i of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let o=s(i);if(o!==null)for(let a of o.split(/\r?\n/u)){let d=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(a);d?.[1]!==void 0&&t.push({command:d[1],from:i,srcRoot:null})}}return t}function FS(e,n,t){let s=e.projectRoot,r=$S.exec(n)?.[1];if(r!==void 0){for(let a of t===null?[r]:[xn.join(t,r),r])if(Dt(xn.join(s,a)))return{file:a}}let i=TS.exec(n)?.[1];if(i===void 0)return r===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${r}\` is not a file in this repository`};let o=ep.exec(i)?.[1]??"";for(let a of t===null?[""]:[t,""])for(let d of[`${o.replace(/\./gu,"/")}.py`,`${o.replace(/\./gu,"/")}/__init__.py`]){let l=a===""?d:xn.join(a,d);if(Dt(xn.join(s,l)))return{file:l}}return Ya(e,i)}function Ja(e){let n=[],t=[],s=new Set,r=(a,d,l)=>{let c=`${a} ${d}`;s.has(c)||(s.add(c),n.push({file:a,source:d,declaration:l}))},i=AS(e);t.push(...i.gaps);for(let a of i.entries){let d=a.kind==="entry-point-group"?"entry-point-group":"console-script",l=Ya(e,a.target);"file"in l?r(l.file,d,`${a.name} = ${a.target}`):t.push({source:d,declaration:`${a.name} = ${a.target}`,detail:l.detail})}for(let a of IS(e.projectRoot))r(a,"dunder-main",a);Dt(xn.join(e.projectRoot,"manage.py"))&&r("manage.py","manage-py","manage.py");let o=e.maxProcfileBytes??wS;for(let a of RS(e.projectRoot,o)){let d=Ya(e,a);"file"in d?r(d.file,"launch-declaration",a):t.push({source:"launch-declaration",declaration:a,detail:d.detail})}for(let a of DS(e.projectRoot,OS)){let d=FS(e,a.command,a.srcRoot),l=`${a.from}: ${a.command.trim()}`;"file"in d?r(d.file,"launch-declaration",l):t.push({source:"launch-declaration",declaration:l,detail:d.detail})}return{entrypoints:n,gaps:t,projectName:i.projectName}}var aO=256*1024*1024;var np="CUPEL_PYTHON",BS=["-I","-S"],KS="python3",zS=256*1024*1024,US=12e4,qS=512,tp=2e4,ip=new Set(["str","bytes","int","float","complex","bool","none","scalar","tuple","list","dict","set"]),HS=new Set(["module","local-def","local","class"]);function xe(e,n=qS){return typeof e=="string"&&e.length<=n?e:null}function ts(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function br(e){let n=bn(e)?e:{};return{line:ts(n.line),endLine:ts(n.endLine),col:ts(n.col),start:ts(n.start),end:ts(n.end)}}function bn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ft(e){return Array.isArray(e)?e:[]}function Rs(e){return Ft(e).map(n=>xe(n))}function ss(e,n){return Number.isSafeInteger(e)&&Number.isSafeInteger(n)&&e>=0&&n>=e?{start:e,end:n}:null}var WS={o:"positional-only",p:"positional",r:"rest",k:"keyword-only",K:"keyword-rest"},GS={p:"positional",s:"star",k:"keyword",d:"double-star"};function Os(e,n){if(!Array.isArray(e))return null;let t=[];for(let s of e){let r=Array.isArray(s)?n(s):null;if(r===null)return null;t.push(r)}return t}function VS(e){return Os(e,([n,t,s,r,i])=>{let o=typeof n=="string"?WS[n]:void 0,a=xe(t),d=ss(r,i);return o===void 0||a===null||a===""||typeof s!="boolean"||d===null?null:{kind:o,name:a,hasDefault:s,...d}})}function XS(e){return Os(e,([n,t,s,r])=>{let i=typeof n=="string"?GS[n]:void 0,o=ss(t,s);if(i===void 0||o===null)return null;if(i!=="keyword")return r===void 0?{kind:i,...o}:null;let a=xe(r);return a!==null&&a!==""?{kind:i,keyword:a,...o}:null})}var YS=new Set(["def","class","import","other","multi"]);function JS(e){if(!bn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e))xe(t)!==null&&typeof s=="string"&&YS.has(s)&&n.set(t,s);return n}var ZS=new Map([["c","copy"],["d","derive"],["f","field"],["w","await"],["r","return"],["a","argument"],["m","mutation"]]),QS=new Map([["m","module"],["g","global"],["u","unknown"]]),ek=new Set(["unmodeled","reflective","inner-function-param","caught","construct"]),nk=256;function sp(e,n){return Number.isSafeInteger(e)&&e>=n&&e<nk?e:null}function tk(e,n){let[t,s,r,i]=e;switch(t){case"p":{let o=e.length===2&&n?sp(s,0):null;return o===null?null:{kind:"declared-param",index:o}}case"l":{let o=xe(s);return e.length===3&&o!==null&&o!==""&&Number.isSafeInteger(r)&&r>=0?{kind:"local",name:o,declStart:r}:null}case"f":{let o=xe(s),a=QS.get(r);return e.length===3&&o!==null&&o!==""&&a!==void 0?{kind:"free",name:o,binding:a}:null}case"c":case"r":{let o=e.length===3?ss(s,r):null;return o===null?null:{kind:t==="c"?"call-result":"call-receiver",at:o.start,end:o.end}}case"a":case"m":{let o=e.length===4?ss(s,r):null,a=sp(i,t==="m"?-1:0);return o===null||a===null?null:{kind:t==="a"?"argument":"mutated-by-call",at:o.start,end:o.end,index:a}}case"R":return e.length===1?{kind:"return"}:null;case"k":return e.length===1?{kind:"constant"}:null;case"s":{let o=e.length===2?xe(s):null;return o===null?null:xf(o)}case"o":return e.length===2&&ek.has(s)?{kind:"opaque",reason:s}:null;default:return null}}function rp(e,n){if(!bn(e))return null;let t=e.refs,s=e.edges;if(!Array.isArray(t)||!Array.isArray(s)||s.length>tp||t.length>2*tp)return null;let r=Os(t,i=>tk(i,n));return r===null?null:Os(s,([i,o,a])=>{let d=Number.isSafeInteger(i)?r[i]:void 0,l=Number.isSafeInteger(o)?r[o]:void 0,c=ZS.get(a);return d===void 0||l===void 0||c===void 0?null:{from:d,to:l,kind:c}})}var sk=/^(?:~|\.*)[^\s.()~]+(?:\(\))*(?:\.[^\s.()~]+(?:\(\))*)*$/u,rk=2048;function jt(e){let n=xe(e);return n!==null&&sk.test(n)?n:null}function ap(e){return xe(e,rk)}function lp(e){return Array.isArray(e)&&e.length===2?{callee:jt(e[0]),arg0:jt(e[1])}:null}function dp(e){return!bn(e)||!Array.isArray(e.m)?null:{type:jt(e.t),meta:e.m.map(lp)}}function ok(e){return Os(e,([n,t,s,r])=>{let i=ss(t,s);return i===null?null:{origin:jt(n),rule:ap(r),...i}})}function ik(e){return Array.isArray(e)?e.map(n=>{if(!Array.isArray(n)||n.length!==2)return null;let t=n[1];return{default:lp(n[0]),annotated:dp(t),annotation:bn(t)?jt(t.o):null}}):null}function ak(e){if(!Array.isArray(e)||e.length!==2||!Array.isArray(e[1]))return null;let n=e[1].map(t=>Array.isArray(t)?{origin:jt(t[0]),literal:ap(t[1])}:{origin:null,literal:null});return{callee:jt(e[0]),args:n}}function op(e,n){if(!bn(e))return null;let t=new Map;for(let[s,r]of Object.entries(e)){let i=n(r);xe(s)!==null&&i!==null&&t.set(s,i)}return t}var lk=/^(?:~|\.*)[^\s.()~]+(?:\.[^\s.()~]+)*$/u;function dk(e){let n=xe(e);return n!==null&&lk.test(n)?n:null}function cp(e){if(!Array.isArray(e)||e.length<1||e.length>2||!ip.has(e[0]))return null;let n=e[0];if(e.length===1)return{type:n};let t=xe(e[1]);return t!==null&&t!==""?{type:n,unlessWritten:t}:null}function ck(e,n){return!Array.isArray(e)||n===null||e.length!==n.length?null:e.map(t=>t===null?null:cp(t))}var uk=new Set(["none","staticmethod","classmethod","other"]);function Co(e){if(!Array.isArray(e))return null;let n=new Set;for(let t of e){let s=xe(t);if(s===null)return null;n.add(s)}return n}function fk(e){if(e===!0)return{kind:"lambda"};if(e===!1)return{kind:"const"};if(e===null)return{kind:"other"};let n=xe(e);return n!==null&&n!==""?{kind:"name",dotted:n}:null}function pk(e){if(!Array.isArray(e))return null;let n=e,[t,s]=n;if(t==="k"&&n.length===1)return{kind:"const"};if(t==="l"&&n.length===1)return{kind:"lambda"};if(t==="o"&&n.length===1)return{kind:"other"};if(t==="n"&&n.length===2){let r=xe(s);return r!==null&&r!==""?{kind:"name",dotted:r}:null}if(t==="p"&&n.length===2&&Array.isArray(s)){let r=[];for(let i of s){let o=fk(i);if(o===null)return null;r.push(o)}return{kind:"property",accessors:r}}return null}function Za(e){return Os(e,([n,t,s])=>{let r=xe(n),i=pk(t);return r===null||r===""||i===null||!Number.isSafeInteger(s)||s<0?null:{name:r,value:i,at:s}})}function mk(e){if(!bn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e)){let r=xe(t)===null?null:Za(s);if(r===null)return null;n.set(t,r)}return n}var hk=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),gk=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function yk(e,n){if(n!==null)return[];let t=e.truncated;return Array.isArray(t)?t.map(s=>xe(s,64)??"unreadable"):["unreported"]}function _k(e){let n=XS(e.args);return{args:n,calleeOrigin:dk(e.calleeOrigin),receiverProof:cp(e.receiverProof),argProofs:ck(e.argProofs,n)}}function xk(e){let n=xe(e.path,4096);if(n===null)return null;let t=e.refused,s=typeof t=="string"&&gk.has(t)?t:null,r=xe(e.detail,200),i=Ft(e.imports).filter(bn).map(x=>({form:x.form==="import"?"import":"from",module:xe(x.module),level:ts(x.level),names:Ft(x.names).filter(bn).map(k=>({name:xe(k.name)??"",asname:xe(k.asname)})).filter(k=>k.name!==""),star:x.star===!0,deferred:x.deferred===!0,enclosingFunction:xe(x.enclosingFunction),guards:Rs(x.guards).filter(k=>k!==null),range:br(x.range)})),o=Ft(e.functions).filter(bn).flatMap(x=>{let k=xe(x.name),w=xe(x.qualname);return k===null||w===null?[]:[{name:k,qualname:w,kind:x.kind==="async-function"?"async-function":"function",enclosingClass:xe(x.enclosingClass),enclosingFunction:xe(x.enclosingFunction),decorators:Rs(x.decorators),range:br(x.range),params:VS(x.params),method:x.method===!0,decorated:typeof x.decorated=="string"&&uk.has(x.decorated)?x.decorated:"other",rebound:x.rebound!==!1,reflective:x.reflective!==!1,valueFlows:rp(x.flows,!0),decoratorFacts:ok(x.decoratorFacts),paramFacts:ik(x.paramFacts)}]}),a=Ft(e.classes).filter(bn).flatMap(x=>{let k=xe(x.name),w=xe(x.qualname);return k===null||w===null?[]:[{name:k,qualname:w,bases:Rs(x.bases),decorators:Rs(x.decorators),range:br(x.range),metaclass:x.metaclass===null?null:xe(x.metaclass)??"?",rebound:x.rebound!==!1,interceptsLookup:x.interceptsLookup!==!1,nonDefBinds:Co(x.nonDefBinds),valueBases:Array.isArray(x.valueBases)?Rs(x.valueBases):null}]}),d=Ft(e.calls).filter(bn).map(x=>({..._k(x),callee:xe(x.callee),attr:xe(x.attr),receiver:xe(x.receiver),enclosingFunction:xe(x.enclosingFunction),argCount:ts(x.argCount),range:br(x.range),receiverRange:Array.isArray(x.receiverRange)?ss(x.receiverRange[0],x.receiverRange[1]):null,root:x.root===null?null:x.root==="param0"||x.root==="global"?x.root:"other",nameScope:x.nameScope===null&&x.callee===null?null:HS.has(x.nameScope)?x.nameScope:"local",raisedCall:Array.isArray(x.raisedCall)?ss(x.raisedCall[0],x.raisedCall[1]):null,repeats:x.repeats!==!1,registration:ak(x.registration)})),l=Ft(e.escapes).filter(bn).flatMap(x=>{let k=x.kind,w=xe(x.callee);return typeof k!="string"||!hk.has(k)||w===null?[]:[{kind:k,callee:w,target:xe(x.target),attr:xe(x.attr),enclosingFunction:xe(x.enclosingFunction),range:br(x.range)}]}),c=e.all,p=Array.isArray(c)?Rs(c).filter(x=>x!==null):null,u=Co(e.attrWrites),f=mk(e.classBinds),h=Za(e.moduleBinds),g=Za(e.dunderWrites),y=JS(e.moduleBindings),_=yk(e,s),b=f===null&&a.length>0||h===null&&(y===null||y.has("__getattr__")||y.has("__dir__"))||g===null&&(u===null||[...u].some(x=>/^__.+__$/u.test(x))||d.length>0||o.length>0);return s===null&&b&&!_.includes("bindings")&&_.push("bindings"),{path:n,refused:s,...r!==null?{detail:r}:{},imports:i,functions:o,classes:a,calls:d,toplevelFlows:rp(e.toplevelFlows,!1),flowsRefused:e.flowsRefused===null?null:xe(e.flowsRefused,64)??"unreadable",escapes:l,all:p,allComputed:e.allComputed===!0,truncated:_,moduleBindings:y,attrWrites:u,starImport:e.starImport!==!1,moduleOrigins:op(e.moduleOrigins,jt),annotatedAliases:op(e.annotatedAliases,dp),valueNames:Co(e.valueNames),valueAttrs:Co(e.valueAttrs),computedAccess:e.computedAccess!==!1,classBinds:f,moduleBinds:h,dunderWrites:g}}function Oo(e,n={}){let t=n.env??process.env,s=n.python??t[np]??KS,r=[],i=e.filter(g=>!g.includes(`
-`));i.length!==e.length&&r.push(`${String(e.length-i.length)} path(s) carried a newline and were not extracted`);let o=[...BS,...hr("extract.py")];n.maxBytesPerFile!==void 0&&o.push("--max-bytes",String(n.maxBytesPerFile)),n.hints!==void 0&&o.push("--hints",JSON.stringify(n.hints));let a=jS(s,o,{input:i.length>0?`${i.join(`
+}`,C.ScriptTarget.Latest,!0),o=s.parseDiagnostics;if(o!==void 0&&o.length>0||G_(s,n+1,!0))return!0}return!1}function G_(e,n=0,t=!1){return ga(e,n,t).size>0}function ga(e,n=0,t=!1){let s=new Set,o=t?P_:F_(e);if(o.saturated)return s.add("saturated"),s;let r=a=>C.isElementAccessExpression(a)&&!C.isStringLiteralLike(a.argumentExpression)&&Ir(Ve(a.expression),o),i=a=>{if(t&&(C.isCallExpression(a)||C.isNewExpression(a)||C.isTaggedTemplateExpression(a))){s.add("eval-invocation");return}if(C.isCallExpression(a)){let l=Eo(a);if(l!==null){let d=l.specifierArg;if(d===void 0||!C.isStringLiteralLike(d)||t){s.add("non-literal-load");return}}else{let d=Ve(a.expression);if(C.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if(iu(a.arguments,n)){s.add("eval-code");return}}else if(j_(d)){s.add("loader-callee");return}else if(r(d)){s.add("computed-loader");return}else if(L_(a,o)){s.add("reflect-get");return}}}else if(C.isNewExpression(a)){let l=Ve(a.expression);if(C.isIdentifier(l)&&l.text==="Function"){if(iu(a.arguments??[],n)){s.add("function-ctor");return}}else if(wo(l)){s.add("ctor-chain");return}}else if(C.isIdentifier(a)&&A_.has(a.text)&&O_(a)){s.add("captured-loader");return}else if((C.isPropertyAccessExpression(a)||C.isElementAccessExpression(a))&&(cu(a)||wo(a)||r(a))&&du(a)){s.add("captured-member");return}else if(C.isBindingElement(a)){let l=a.propertyName??a.name,d=C.isIdentifier(l)||C.isStringLiteralLike(l)?l.text:C.isComputedPropertyName(l)&&C.isStringLiteralLike(l.expression)?l.expression.text:void 0;if(d!==void 0&&Or.has(d)){s.add("destructured-member");return}}C.forEachChild(a,i)};return i(e),s}function gu(e,n,t){let s=new Set(ga(t));if(_a(e)&&n.includes("<")&&n.includes("require")){let o=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);for(let r of ga(o))s.add(r)}return s}function K_(e,n,t){if(ya(e))return!0;let s=t.endsWith(ln.sep)?t:t+ln.sep,o=e.split("/"),r=n;for(;;){let i=ln.join(r,"node_modules",...o),a;try{a=Qt(ln.join(i,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(s))return!1;let d=gn(a);if(d===null)return!1;let c;try{c=JSON.parse(d).exports}catch{return!1}if(typeof c=="string"||Array.isArray(c)||typeof c=="object"&&c!==null)return!1}if(Bc(i))return!1;if(r===t)break;let l=ln.dirname(r);if(l===r||l!==t&&!l.startsWith(s))break;r=l}return!0}function z_(e,n){let t=n.endsWith(ln.sep)?n:n+ln.sep,s=ln.dirname(e);for(;;){let o=ln.join(s,"package.json"),r;try{r=Qt(o)}catch{r=null}if(r!==null&&(r===n||r.startsWith(t))){let a=gn(r);if(a!==null)try{let l=JSON.parse(a).name;if(typeof l=="string"&&l.length>0)return l}catch{return null}}if(s===n)break;let i=ln.dirname(s);if(i===s||i!==n&&!i.startsWith(t))break;s=i}return null}function U_(e,n,t,s,o){let r=[],i=[],a=new Set,l={},d=[],c=[],p=new Set,u=new Set,f=[],m=!1,h=(_,S)=>{let b;try{b=Qt(S)}catch{return!1}let k=fn(e,b);if(k===null)return o.push({code:"out-of-root",path:b,detail:"dependency module resolved outside the app root; not followed"}),!1;let w=!t.has(b)&&!u.has(b);return w&&u.size>=pa?(m=!0,!1):(i.push({from:_,to:{module:k}}),w?(u.add(b),r.push(k),!0):!1)},y=(_,S)=>{if(a.add(S),p.has(S))return;p.add(S);let b=Fn(S,_,un,n),k=b!==null?[b]:Ls(S,_,un,n);k.length>=2&&d.push({path:fn(e,_)??_,specifier:S,candidates:k.map(N=>fn(e,N)??N)});let w=!1;for(let N of k)if(!Rn(N)&&(w=!0,h({surface:S},N))){f.push(N);try{let R=fn(e,Qt(N)),v=z_(N,e);R!==null&&v!==null&&(l[R]=v)}catch{}}w||K_(S,ln.dirname(_),e)||o.push({code:"unresolved-specifier",path:S,reason:So(S,_,un,n),detail:`dependency "${S}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let _ of s)y(_.containingFile,_.packageName);for(;f.length>0&&u.size<pa;){let _=f.pop();if(_===void 0)break;let S=fn(e,_);if(S===null)continue;let b=$s(_,Yt);if(b.kind==="too-large"){o.push({code:"limit-exceeded",path:S,detail:`dependency module over the ${String(Yt/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(b.kind==="not-regular"){o.push({code:"parse-error",path:S,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let k=C.createSourceFile(_,b.text,C.ScriptTarget.ES2020,!0),w=k.parseDiagnostics;if(w!==void 0&&w.length>0){o.push({code:"dependency-body",path:S,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let N=gu(_,b.text,k);if(N.size>0){o.push({code:"dependency-body",path:S,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...N].sort()});continue}o.push({code:"dependency-body",path:S,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:S});for(let R of au(_,b.text))if(R.runtime)if(Ze(R.text)==="package-root"){let v=Dn(R.text);i.push({from:{module:S},to:{surface:v}}),y(_,v)}else{if(ya(Dn(R.text)))continue;let v=Fn(R.text,_,un,n),I=v!==null?[v]:Ls(R.text,_,un,n);if(I.length===0){if(Ze(R.text)==="package-subpath"){let A=So(R.text,_,un,n);if(A==="no-candidate"||A==="not-installed"&&Uc(_,Dn(R.text))){c.push({path:S,specifier:R.text,why:A});continue}o.push({code:"unresolved-specifier",path:S,reason:A,detail:`runtime package-subpath import "${R.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}I.length>=2&&d.push({path:S,specifier:R.text,candidates:I.map(A=>fn(e,A)??A)});for(let A of I){if(Rn(A)){let B=fn(e,A);o.push({code:B===null?"out-of-root":"declaration-shadow",path:S,detail:B===null?`runtime import "${R.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${R.text}" resolved to the declaration file "${B}" with no co-located runtime module; its code was not analyzed`});continue}h({module:S},A)&&f.push(A)}}}return(m||f.length>0)&&o.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(pa)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:r,edges:i,surfacePackages:[...a],entryRealNames:l,conditionUnions:d,provenAbsent:c}}function yu(e,n,t=!1,s=new Set){let o=Qt(e),r=[],i=[],a=C.createCompilerHost(un,!0),l=t?Wc(o,un,a):()=>null,d=new Set,c=new Set,p=n.map(L=>ln.join(o,L)),u=[],f=new Map,m=new Map,h=new Map,y=new Map,_=new Set,S=(L,K,Y)=>{let le=`${String(L.length)}:${L}${K}`;_.has(le)||(_.add(le),r.push({code:"unresolved-specifier",path:L,detail:K,reason:Y}))},b=()=>null,k=0,w=(L,K)=>{let Y=m.get(L);return Y===void 0&&(Y=C.createSourceFile(L,K,C.ScriptTarget.ES2020,!0),m.set(L,Y)),{real:L,sf:Y}};for(;c.size<Ar;){let L=p.pop();if(L===void 0){if(k>=E_)break;k+=1;let z=[];for(let[M,X]of f)X.includes("readdir")&&(X.includes("require")||X.includes("import("))&&z.push(w(M,X));let Z=v_(z);if(Z.length===0)break;let de=[];for(let[M,X]of f)de.push(w(M,X));b=tu(de,Z,un,a,h);let x=!1;for(let M of z){let X=f.get(M.real);if(X!==void 0)for(let W of ru(M.real,X,o,a,b))c.has(W)||(p.push(W),x=!0)}if(!x)break;continue}let K;try{K=Qt(L)}catch{continue}if(c.has(K))continue;if(c.add(K),fn(o,K)===null){r.push({code:"out-of-root",path:L,detail:"resolved outside app root"});continue}let Y=$s(K,Yt);if(Y.kind==="too-large"){r.push({code:"limit-exceeded",path:K,detail:`file is ${String(Math.round(Y.bytes/1048576))}MiB, over the ${String(Yt/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(Y.kind==="not-regular"){r.push({code:"parse-error",path:K,detail:"unreadable or not a regular file"});continue}let le=Y.text;d.add(K),f.set(K,le);for(let z of au(K,le)){let Z=z.runtime?l(z.text,K):null;if(Z===null&&Ze(z.text)==="package-root"){z.runtime&&u.push({containingFile:K,packageName:Dn(z.text)});continue}let de=Z??Fn(z.text,K,un,a),x=de!==null?[de]:z.runtime&&Z===null?Ls(z.text,K,un,a):[];if(x.length===0){if(z.runtime){let M=Ze(z.text);if(!(M==="package-subpath"&&ya(Dn(z.text)))){if(M==="package-subpath")S(K,`runtime package-subpath import "${z.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,So(z.text,K,un,a));else if(M==="relative"){let X=Kc(z.text,K,o,y);X.kind==="unanalyzable"?S(K,`runtime relative import "${z.text}" did not resolve and its absence could not be proven \u2014 ${X.reason}; a bundler/loader may load a module the analyzer never saw`,X.why):X.kind==="absent"&&z.unguarded&&y_(o,K)&&S(K,`runtime relative import "${z.text}" runs whenever its module runs, but nothing is on disk at its target \u2014 the module the running app loads there (a build output, a generated file) was never analyzed`,"absent-unguarded")}}}continue}x.length>=2&&i.push({path:fn(o,K)??K,specifier:z.text,candidates:x.map(M=>fn(o,M)??M)});for(let M of x){if(fn(o,M)===null){r.push({code:"out-of-root",path:M,detail:`specifier "${z.text}" resolved outside app root`});continue}if(z.runtime&&Rn(M)){r.push({code:"declaration-shadow",path:M,detail:`runtime import "${z.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(z.runtime&&!xr(M)){r.push({code:"unanalyzable-module",path:M,detail:`runtime import "${z.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}p.push(M)}}for(let z of ru(K,le,o,a,b))c.has(z)||p.push(z)}c.size>=Ar&&p.length>0&&r.push({code:"limit-exceeded",path:o,detail:`reachable file set exceeds ${String(Ar)}; analysis truncated (${String(p.length)}+ files not analyzed)`});let N=U_(o,a,d,u,r),R=new Set,v=new Set,I=L=>{let K=fn(o,L);return K!==null&&s.has(K)};for(let L of d){if(!k_(L))continue;let K=f.get(L);if(K===void 0)continue;let Y=w_(K);if(Y==="other"){if(!I(L))continue;v.add(L),r.push({code:"parse-error",path:L,detail:"extensionless entrypoint declares a non-node interpreter in its shebang; it is not a JavaScript module, and the code it runs was NOT analyzed (degraded to unknown)"});continue}Y==="none"&&!I(L)||R.add(L)}let A=C.createProgram({rootNames:[...d],options:un,host:a}),B=new Set,O=new Map;for(let L of A.getSourceFiles()){if(L.isDeclarationFile||A.isSourceFileDefaultLibrary(L)||fn(o,L.fileName)===null||!_a(L.fileName))continue;let K=A.getSyntacticDiagnostics(L).length>0;if(!K&&!L.text.includes("<")||x_(L.text,C.ScriptKind.TSX)!==0)continue;let Y=C.createSourceFile(L.fileName,L.text,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);(K||ou(Y)>ou(L))&&(B.add(L.fileName),O.set(L.fileName,L.text))}let V=A;if(B.size>0||R.size>0){let L=a.getSourceFile.bind(a);a.getSourceFile=(Y,le,z,Z)=>{let de=O.get(Y);if(de!==void 0)return C.createSourceFile(Y,de,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);let x=R.has(Y)?f.get(Y):void 0;return x!==void 0?C.createSourceFile(Y,x,C.ScriptTarget.ES2020,!0,C.ScriptKind.JS):L(Y,le,z,Z)};let K=Y=>A.getSourceFile(Y)!==void 0;V=C.createProgram({rootNames:[...d].filter(Y=>R.has(Y)||K(Y)),options:R.size>0?{...un,allowNonTsExtensions:!0}:un,host:a,...R.size>0?{}:{oldProgram:A}})}let E=V.getTypeChecker();for(let L of n){if(!s.has(L))continue;let K;try{K=Qt(ln.join(o,L))}catch{continue}!d.has(K)||v.has(K)||V.getSourceFile(K)===void 0&&(v.add(K),r.push({code:"parse-error",path:K,detail:"entrypoint is not a module cupel can parse (an unrecognised file type); the code it runs was NOT analyzed (degraded to unknown)"}))}let D=[];for(let L of V.getSourceFiles()){if(L.isDeclarationFile||V.isSourceFileDefaultLibrary(L)||fn(o,L.fileName)===null)continue;D.push(L);let K=V.getSyntacticDiagnostics(L);if(K.length>0){let z=K[0],Z=z!==void 0?C.flattenDiagnosticMessageText(z.messageText," "):"syntax error";r.push({code:"parse-error",path:L.fileName,detail:`${String(K.length)} syntax error(s): ${Z}`})}let Y=fn(o,L.fileName),le=Y===null?null:gu(L.fileName,L.text,L);Y!==null&&le!==null&&le.size>0&&r.push({code:"loader-escape",path:Y,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...le].sort()})}return{program:V,checker:E,host:a,options:un,appRoot:o,sourceFiles:D,diagnostics:r,depReach:N,conditionUnions:[...i,...N.conditionUnions],provenAbsent:N.provenAbsent,resolveParamDirs:b,toRel:L=>fn(o,L)}}import{opendirSync as W_,statSync as H_}from"node:fs";import ba from"node:path";var q_=8192,V_=2e4,X_=new Set(["node_modules"]),_u=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),Y_=16;function Pr(e,n,t,s,o={}){let r=o.maxEntries??V_,i=o.prune,a=[],l=!1,d=0,c=[{dir:ba.join(e,n),rel:n,depth:0}];for(;c.length>0;){let p=c.pop();if(p===void 0)break;if(p.depth>Y_){l=!0;continue}let u;try{u=W_(p.dir)}catch{l=!0;continue}try{let f=0;for(;;){let m=u.readSync();if(m===null)break;if(f+=1,d+=1,f>q_||d>r){l=!0;break}let h=p.rel+m.name;if(m.isSymbolicLink()){let y;try{y=H_(ba.join(p.dir,m.name)).isDirectory()}catch{l=!0;continue}if(y){l=!0;continue}}else if(m.isDirectory()){if(X_.has(m.name)||m.name.startsWith(".")||i?.has(m.name)===!0){l=!0;continue}c.push({dir:ba.join(p.dir,m.name),rel:`${h}/`,depth:p.depth+1});continue}else if(!m.isFile())continue;if(t(h)){if(a.length>=s){l=!0;break}a.push(h)}}}finally{try{u.closeSync()}catch{}}}return{matches:a,truncated:l}}var J_=64;function bu(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let s=n.slice(0,t),o=n.slice(t+1);if(s.startsWith("./")&&(s=s.slice(2)),s.startsWith("/")||o.includes("/")||s.split("/").includes("..")||s.includes("\\")||n.includes("\0"))return null;let r=s.slice(0,s.lastIndexOf("/")+1);return Pr(e,r,i=>i.length>=s.length+o.length&&i.startsWith(s)&&i.endsWith(o),J_)}import{existsSync as Z_}from"node:fs";import Q_ from"node:path";var eb=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],nb=["dependencies","devDependencies"];function tb(e,n){for(let t of nb){let s=e[t];if(!(typeof s!="object"||s===null||Array.isArray(s))&&Object.hasOwn(s,n))return!0}return!1}function Sa(e,n){if(n===null)return null;for(let t of eb)if(tb(n,t.dependency)){for(let s of t.configFiles)if(Z_(Q_.join(e,s)))return{name:t.name,configFile:s,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function xa(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var sb=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],ob=256,rb=12e4;function ka(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let s=Pr(e,"",o=>{let r=o.split("/");for(let i=0;i<r.length-1;i+=1){let a=r[i];if(a!==void 0&&t.has(a))return sb.some(l=>o.endsWith(l))}return!1},ob,{maxEntries:rb,prune:_u});return{roots:s.matches,truncated:s.truncated}}function jn(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let s of n){let o=s.codePointAt(0)??0;t+=o<32||o>=127&&o<=159?`\\x${o.toString(16).padStart(2,"0")}`:s}return t}function ib(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function ab(e){let n=!1;for(let t=0;t<e.length;t+=1){let s=e.charAt(t),o=s.codePointAt(0)??0;if(o<32||o===127||o>=128&&o<=159)return null;if(s==="\\"){n=!0;let r=e.charAt(t+1);if(!(r>="a"&&r<="z"||r>="A"&&r<="Z"||r>="0"&&r<="9"||r==="."||r==="_"||r==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(s))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function lb(e){let n=[],t="";for(let s of e){if(s===" "||s==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=s}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var db=/^[A-Za-z_][A-Za-z0-9_]*=/u;function cb(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var Su=new Set(["flask","granian","gunicorn","hypercorn","php","php-fpm","puma","python","python2","python3","rails","ruby","streamlit","unicorn","uvicorn","uwsgi","waitress-serve"]);function ub(e){let n=e.slice(e.lastIndexOf("/")+1);return Su.has(n)||Su.has(n.replace(/[0-9.]+$/u,""))}var fb=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),pb=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),mb=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function ku(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function xu(e){if(ku(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return mb.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:fb.has(t)||n!==-1&&pb.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var hb=[".js",".cjs",".mjs",".ts",".mts",".cts"];function gb(e){return hb.some(n=>e.endsWith(n))}var yb=new Set(["npm","yarn","pnpm"]);function _b(e){let n=e[0];return n===void 0||!yb.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function va(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!ib(n))return wa(n);let t=ab(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let s=wa(t.windows),o=wa(t.posixShell);if(s.kind==="file"){let r=o.kind==="file"?o.specifier:void 0;return r===void 0||r===s.specifier?{kind:"file",specifier:s.specifier}:{kind:"file",specifier:s.specifier,alt:r}}return o.kind==="file"?{kind:"file",specifier:o.specifier}:s}function wa(e){let n=lb(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let r=n[t];if(r===void 0||!db.test(r))break;if(ku(r))return{kind:"unparsed",reason:`environment \`${jn(r)}\` preloads another module; the launch surface is more than one file`};let i=r.indexOf("=");if(r.slice(0,i)==="NODE_OPTIONS")for(let a of r.slice(i+1).split(/\s+/u)){if(a===""||!a.startsWith("-"))continue;let l=xu(a);if(l!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${jn(l.token)}\` ${l.why}`}}}let s=n[t];if(s===void 0)return{kind:"unparsed",reason:"no program in the command"};if(_b(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!cb(s))return ub(s)?{kind:"foreign",binary:s}:{kind:"unparsed",reason:`runs \`${jn(s)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let r=n[t];if(r===void 0||!r.startsWith("-"))break;let i=xu(r);if(i!==null)return{kind:"unparsed",reason:`node flag \`${jn(i.token)}\` ${i.why}`}}let o=n[t];return o===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:gb(o)?{kind:"file",specifier:o}:{kind:"unparsed",reason:`\`${jn(o)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function bb(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Sb=64,Ea=64*1024,xb=64;function Aa(e){let n=[],t=!1;for(let s of e.split(/\r?\n/u)){if(n.length>=xb){t=!0;break}let o=/^\s*(CMD|ENTRYPOINT)\s+(.*\S)\s*$/iu.exec(s),r=/^\s*(command|entrypoint):\s*(.*\S)\s*$/u.exec(s),i=o??r;if(i?.[1]===void 0||i[2]===void 0)continue;let a=kb(i[2]);a!==null&&n.push({label:i[1].toUpperCase(),command:a})}return{commands:n,truncated:t}}function kb(e){let n=e.trim();if(!n.startsWith("["))return n===""?null:n;let t;try{t=JSON.parse(n)}catch{return null}if(!Array.isArray(t))return null;let s=t.filter(o=>typeof o=="string");return s.length===0||s.length!==t.length?null:s.join(" ")}function Na(e){let n=e.split(`
+`),t=n.length>64,s=[],o=0;for(let r of n.slice(0,64)){let i=r.trim();if(i.length===0||i.startsWith("#"))continue;let a=i.indexOf(":");if(a<=0)continue;let l=i.slice(a+1).trim();if(l.length===0)continue;let d=i.slice(0,a);if(d.length>Sb||!bb(d)){o+=1;continue}s.push({name:d,command:l})}return s.sort((r,i)=>r.name===i.name?0:r.name==="web"?-1:i.name==="web"?1:0),{entries:s,truncated:t,unnamedLines:o}}import{realpathSync as zu}from"node:fs";import On from"node:path";import g from"typescript";import P from"typescript";import wu from"node:path";import ue from"typescript";var wb=/^lib\.(?:es5|es20\d\d(?:\.[a-z0-9]+)*|esnext(?:\.[a-z0-9]+)*|decorators(?:\.legacy)?)\.d\.ts$/u,vb=/^lib\.(?:dom|webworker|scripthost)(?:\.[a-z0-9]+)*\.d\.ts$/u;function Eb(e,n){if(e.isSourceFileDefaultLibrary(n)){let t=wu.basename(n.fileName);return wb.test(t)?"ecmascript":vb.test(t)?"host-lib":"unknown"}return n.fileName.split(wu.sep).join("/").includes("/node_modules/")?"dependency":"app"}function Ab(e,n,t){if(t===void 0)return"unknown";let s=t;if(s.flags&ue.SymbolFlags.Alias)try{s=n.getAliasedSymbol(s)}catch{return"unknown"}let o=s.declarations??[];if(o.length===0)return"unknown";let r=new Set(o.map(i=>Eb(e,i.getSourceFile())));return r.size===1?[...r][0]:"unknown"}function Ia(e,n,t){let s=t;for(;ue.isParenthesizedExpression(s);)s=s.expression;let o;if(ue.isIdentifier(s)?o=s:ue.isPropertyAccessExpression(s)?o=s.name:ue.isElementAccessExpression(s)&&ue.isStringLiteralLike(s.argumentExpression)&&(o=s.argumentExpression),o===void 0)return"unknown";let r;try{r=n.getSymbolAtLocation(o)}catch{return"unknown"}return Ab(e,n,r)}function Nb(e){if(ue.isVariableDeclaration(e)){let n=e.parent;return ue.isVariableDeclarationList(n)&&ue.isVariableStatement(n.parent)&&ue.isSourceFile(n.parent.parent)}return ue.isFunctionDeclaration(e)||ue.isClassDeclaration(e)?ue.isSourceFile(e.parent):ue.isImportClause(e)||ue.isImportSpecifier(e)||ue.isNamespaceImport(e)}function vu(e,n,t){let s;try{s=n.getSymbolAtLocation(t)}catch{return"unknown"}let o=s?.declarations??[];if(o.length===0)return"unknown";let r=t.getSourceFile();return o.every(i=>i.getSourceFile()===r&&Nb(i))?"module":o.every(i=>e.isSourceFileDefaultLibrary(i.getSourceFile()))?"global":"unknown"}var Ib=ue.TypeFlags.StringLike|ue.TypeFlags.NumberLike|ue.TypeFlags.BooleanLike|ue.TypeFlags.BigIntLike|ue.TypeFlags.ESSymbolLike|ue.TypeFlags.Null|ue.TypeFlags.Undefined|ue.TypeFlags.Void;function Eu(e){return e.flags&(ue.TypeFlags.Any|ue.TypeFlags.Unknown|ue.TypeFlags.Never)?!1:e.isUnion()?e.types.every(Eu):(e.flags&Ib)!==0&&(e.flags&ue.TypeFlags.Object)===0}var Rb=new Set([ue.SyntaxKind.EqualsEqualsToken,ue.SyntaxKind.EqualsEqualsEqualsToken,ue.SyntaxKind.ExclamationEqualsToken,ue.SyntaxKind.ExclamationEqualsEqualsToken,ue.SyntaxKind.LessThanToken,ue.SyntaxKind.LessThanEqualsToken,ue.SyntaxKind.GreaterThanToken,ue.SyntaxKind.GreaterThanEqualsToken,ue.SyntaxKind.InstanceOfKeyword,ue.SyntaxKind.InKeyword,ue.SyntaxKind.PlusToken,ue.SyntaxKind.MinusToken,ue.SyntaxKind.AsteriskToken,ue.SyntaxKind.AsteriskAsteriskToken,ue.SyntaxKind.SlashToken,ue.SyntaxKind.PercentToken,ue.SyntaxKind.AmpersandToken,ue.SyntaxKind.BarToken,ue.SyntaxKind.CaretToken,ue.SyntaxKind.LessThanLessThanToken,ue.SyntaxKind.GreaterThanGreaterThanToken,ue.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]),Ob=new Set([ue.SyntaxKind.AmpersandAmpersandToken,ue.SyntaxKind.BarBarToken,ue.SyntaxKind.QuestionQuestionToken]);function Ao(e,n,t,s=0){if(s>8)return!1;let o=t;for(;ue.isParenthesizedExpression(o);)o=o.expression;let r=i=>Ao(e,n,i,s+1);if(ue.isStringLiteral(o)||ue.isNoSubstitutionTemplateLiteral(o)||ue.isTemplateExpression(o)||ue.isNumericLiteral(o)||ue.isBigIntLiteral(o)||o.kind===ue.SyntaxKind.TrueKeyword||o.kind===ue.SyntaxKind.FalseKeyword||o.kind===ue.SyntaxKind.NullKeyword||ue.isTypeOfExpression(o)||ue.isVoidExpression(o)||ue.isPrefixUnaryExpression(o)||ue.isPostfixUnaryExpression(o)||ue.isIdentifier(o)&&o.text==="undefined")return!0;if(ue.isBinaryExpression(o)){let i=o.operatorToken.kind;return Rb.has(i)?!0:Ob.has(i)?r(o.left)&&r(o.right):i===ue.SyntaxKind.CommaToken?r(o.right):!1}if(ue.isConditionalExpression(o))return r(o.whenTrue)&&r(o.whenFalse);if(ue.isCallExpression(o)){if(Ia(e,n,o.expression)!=="ecmascript")return!1;try{let i=n.getResolvedSignature(o);return i!==void 0&&Eu(n.getReturnTypeOfSignature(i))}catch{return!1}}if(ue.isIdentifier(o)){let i;try{i=n.getSymbolAtLocation(o)}catch{return!1}let a=i?.declarations??[],l=a.length===1?a[0]:void 0;return l===void 0||!ue.isVariableDeclaration(l)||l.initializer===void 0||!ue.isIdentifier(l.name)||!ue.isVariableDeclarationList(l.parent)||(l.parent.flags&ue.NodeFlags.Const)===0?!1:r(l.initializer)}return!1}import qn from"typescript";var _n={kind:"receiver"},yn=e=>({kind:"arg",index:e}),Ra=e=>({kind:"args-from",index:e}),sn=Ra(0),Ct=(e=[sn])=>({result:[sn],mutates:[],callsProgram:e}),et=(e=[_n,sn])=>({result:[_n,sn],mutates:[],callsProgram:e}),Qn=(e=[])=>({result:[_n],mutates:[],callsProgram:e}),Pb={result:[],mutates:[]},Oa=new Map,be=(e,n)=>{for(let t of e)Oa.set(t,n)};be(["String","Number","BigInt"],{result:[yn(0)],mutates:[],callsProgram:[yn(0)]});be(["Boolean"],{result:[yn(0)],mutates:[]});be(["parseInt","parseFloat","isNaN","isFinite","encodeURIComponent","encodeURI","decodeURIComponent","decodeURI","escape","unescape"],Ct());be(["Array","Object"],{result:[sn],mutates:[]});be(["String.fromCharCode","String.fromCodePoint","String.raw"],Ct());be(["at","charAt","charCodeAt","codePointAt","concat","endsWith","includes","indexOf","isWellFormed","lastIndexOf","localeCompare","match","matchAll","normalize","padEnd","padStart","repeat","replace","replaceAll","search","slice","split","startsWith","substr","substring","toLocaleLowerCase","toLocaleUpperCase","toLowerCase","toString","toUpperCase","toWellFormed","trim","trimEnd","trimLeft","trimRight","trimStart","valueOf"].map(e=>`String.prototype.${e}`),et());be(["Object.keys","Object.values","Object.entries","Object.getOwnPropertyNames","Object.getOwnPropertySymbols","Object.getPrototypeOf","Object.fromEntries","Object.freeze","Object.seal","Object.preventExtensions","Object.isFrozen","Object.isSealed","Object.isExtensible"],{result:[yn(0)],mutates:[],callsProgram:[yn(0)]});be(["Object.is","Object.hasOwn","Object.create"],Ct());be(["Object.assign"],{result:[sn],mutates:[{into:yn(0),from:[Ra(1)]}],callsProgram:[sn]});be(["Object.defineProperty"],{result:[yn(0)],mutates:[{into:yn(0),from:[yn(2)]}],callsProgram:[sn]});be(["Object.prototype.hasOwnProperty","Object.prototype.isPrototypeOf","Object.prototype.propertyIsEnumerable","Object.prototype.toString","Object.prototype.toLocaleString","Object.prototype.valueOf"],et());be(["Array.isArray"],{result:[yn(0)],mutates:[]});be(["Array.of"],{result:[sn],mutates:[]});be(["Array.from"],Ct());var Cb=["at","concat","entries","flat","includes","indexOf","join","keys","lastIndexOf","slice","toLocaleString","toReversed","toSpliced","toString","values","with"];be(Cb.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),et([_n,sn]));var Mb=["every","filter","find","findIndex","findLast","findLastIndex","flatMap","forEach","map","reduce","reduceRight","some","toSorted"];be(Mb.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),et([_n,sn]));be(["Array.prototype.push","Array.prototype.unshift"],{result:[_n,sn],mutates:[{into:_n,from:[sn]}]});be(["Array.prototype.splice"],{result:[_n],mutates:[{into:_n,from:[Ra(2)]}],callsProgram:[sn]});be(["Array.prototype.fill"],{result:[_n,yn(0)],mutates:[{into:_n,from:[yn(0)]}],callsProgram:[sn]});be(["Array.prototype.pop","Array.prototype.shift"],Qn());be(["Array.prototype.reverse","Array.prototype.copyWithin"],Qn([sn]));be(["Array.prototype.sort"],Qn([_n,sn]));for(let e of["Map","WeakMap","ReadonlyMap"])be([`${e}.prototype.get`],Qn()),be([`${e}.prototype.has`],et([])),be([`${e}.prototype.delete`],et([])),be([`${e}.prototype.set`],{result:[_n],mutates:[{into:_n,from:[yn(0),yn(1)]}]}),be([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],Qn()),be([`${e}.prototype.forEach`],Qn([sn]));for(let e of["Set","WeakSet","ReadonlySet"])be([`${e}.prototype.has`],et([])),be([`${e}.prototype.delete`],et([])),be([`${e}.prototype.add`],{result:[_n],mutates:[{into:_n,from:[yn(0)]}]}),be([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],Qn()),be([`${e}.prototype.forEach`],Qn([sn]));be(["Map.prototype.clear","Set.prototype.clear"],Qn());be(["JSON.parse","JSON.stringify"],Ct());be(["Number.isInteger","Number.isFinite","Number.isNaN","Number.isSafeInteger"],{result:[yn(0)],mutates:[]});be(["Number.parseInt","Number.parseFloat"],Ct());be(["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"].map(e=>`Number.prototype.${e}`),et([sn]));be(["abs","acos","acosh","asin","asinh","atan","atan2","atanh","cbrt","ceil","clz32","cos","cosh","exp","expm1","floor","fround","hypot","imul","log","log10","log1p","log2","max","min","pow","round","sign","sin","sinh","sqrt","tan","tanh","trunc"].map(e=>`Math.${e}`),Ct());be(["Math.random","Date.now"],Pb);be(["RegExp.prototype.test","RegExp.prototype.exec"],et());be(["RegExp.prototype.toString"],Qn());be(["Date.parse","Date.UTC"],Ct());be(["getDate","getDay","getFullYear","getHours","getMilliseconds","getMinutes","getMonth","getSeconds","getTime","getTimezoneOffset","toDateString","toISOString","toJSON","toLocaleDateString","toLocaleString","toLocaleTimeString","toString","toTimeString","toUTCString","valueOf"].map(e=>`Date.prototype.${e}`),Qn());be(["Promise.resolve","Promise.all","Promise.allSettled","Promise.any","Promise.race"],Ct());be(["Promise.prototype.then","Promise.prototype.catch","Promise.prototype.finally"],et());var Tb=new Set(["JSON","Math","Reflect","Atomics"]);function Au(e,n){let t=n;for(;qn.isParenthesizedExpression(t);)t=t.expression;let s=qn.isIdentifier(t)?t:qn.isPropertyAccessExpression(t)?t.name:void 0;if(s===void 0)return null;let o;try{o=e.getSymbolAtLocation(s),o!==void 0&&o.flags&qn.SymbolFlags.Alias&&(o=e.getAliasedSymbol(o))}catch{return null}let r=o?.valueDeclaration??o?.declarations?.[0];if(r===void 0)return null;if(qn.isIdentifier(t))return(qn.isVariableDeclaration(r)||qn.isFunctionDeclaration(r))&&r.name!==void 0&&qn.isIdentifier(r.name)?r.name.text:null;let i=r.parent;if(qn.isModuleBlock(i)&&qn.isModuleDeclaration(i.parent)&&qn.isIdentifier(i.parent.name))return`${i.parent.name.text}.${s.text}`;if(!qn.isInterfaceDeclaration(i))return null;let a=i.name.text,l=s.text;return Tb.has(a)?`${a}.${l}`:a.endsWith("Constructor")?`${a.slice(0,-11)}.${l}`:`${a}.prototype.${l}`}function Nu(e){let n=Oa.get(e);return n===void 0?void 0:{id:`ecmascript:${e}`,...n}}var cO=Oa.size;import ms from"typescript";var Pa=["get","post","put","patch","delete","options","head","all"],$b=[{id:"express@4-source-v1",packages:["express"],members:new Set([...Pa,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://expressjs.com/en/4x/api.html#app.METHOD \u2014 callbacks receive (req, res, next); error-handling middleware receives (err, req, res, next)"},{id:"koa@2-source-v1",packages:["koa","@koa/router","koa-router"],members:new Set([...Pa,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://koajs.com/#context \u2014 middleware receives (ctx, next); ctx.request carries the request"},{id:"fastify@4-source-v1",packages:["fastify"],members:new Set(Pa),sourceClass:"remote-unauthenticated",evidence:"https://fastify.dev/docs/latest/Reference/Routes/ \u2014 handler receives (request, reply)"}];function Iu(e){let n=new Set(e.map(t=>t.startsWith("@")?t.split("/").slice(0,2).join("/"):t.split("/")[0]));return $b.filter(t=>t.packages.some(s=>n.has(s)))}function Cr(e,n){if(n.length===0)return null;let t=e.expression;for(;ms.isParenthesizedExpression(t);)t=t.expression;if(!ms.isPropertyAccessExpression(t))return null;let s=t.name.text,o=n.find(a=>a.members.has(s));if(o===void 0)return null;let r=e.arguments.filter(a=>ms.isArrowFunction(a)||ms.isFunctionExpression(a)||ms.isIdentifier(a)||ms.isPropertyAccessExpression(a)),i=e.arguments.filter(ms.isCallExpression);return r.length>0||i.length>0?{model:o,handlers:r,forwarded:i}:null}function No(e,n){return e.id.startsWith("express@")&&n===4?1:0}function hs(e){return P.isFunctionDeclaration(e)||P.isFunctionExpression(e)||P.isArrowFunction(e)||P.isMethodDeclaration(e)||P.isConstructorDeclaration(e)||P.isGetAccessorDeclaration(e)||P.isSetAccessorDeclaration(e)}var Mr=(e,n,t)=>({path:e,start:n.getStart(t,!1),end:n.getEnd()});function Lb(e,n,t){let s=[];for(let o of e.parameters){if(P.isIdentifier(o.name)&&o.name.text==="this")continue;let r=P.isIdentifier(o.name)?o.name.text:void 0;s.push({index:s.length,kind:o.dotDotDotToken!==void 0?"rest":"positional",...r!==void 0?{name:r}:{},destructured:r===void 0,hasDefault:o.initializer!==void 0,range:Mr(n,o,t)})}return s}function Db(e){return P.isArrowFunction(e)?"lexical":"call"}function Fb(e){let n=!1,t=s=>{if(!n&&!(s!==e&&hs(s)&&!P.isArrowFunction(s))){if(P.isIdentifier(s)&&s.text==="arguments"){let o=s.parent;P.isPropertyAccessExpression(o)&&o.name===s||P.isPropertyAssignment(o)&&o.name===s||(n=!0)}P.isCallExpression(s)&&P.isIdentifier(s.expression)&&s.expression.text==="eval"&&(n=!0),P.forEachChild(s,t)}};e.body!==void 0&&P.forEachChild(e.body,t);for(let s of e.parameters)s.initializer!==void 0&&t(s.initializer);return n}function Ma(e,n,t,s=[],o,r=new Map){let i=new Map;if(s.length>0){let u=f=>{if(P.isCallExpression(f)){let m=Cr(f,s);for(let h of m?.handlers??[])m!==null&&(P.isArrowFunction(h)||P.isFunctionExpression(h))&&i.set(h,{model:m.model,index:No(m.model,h.parameters.length),registeredAt:Mr(t,f,n)})}P.forEachChild(f,u)};u(n)}for(let[u,f]of r)i.has(u)||i.set(u,f);let a=[],l=u=>{hs(u)&&a.push({start:u.getStart(n,!1),end:u.getEnd(),node:u}),P.forEachChild(u,l)};l(n),a.sort((u,f)=>u.start-f.start||f.end-u.end);let d=u=>{let f=0,m=a.length;for(;f<m;){let h=f+m>>>1;(a[h]?.start??1/0)<u?f=h+1:m=h}return f},c=e.map(u=>{if(u.declRange.path!==t||u.name==="<toplevel>")return;let{start:f,end:m}=u.declRange,h=d(f);for(;h<a.length&&(a[h]?.start??1/0)<m&&(a[h]?.end??0)>m;)h+=1;let y=a[h];if(y===void 0||y.start>=m||y.end>m)return;let _=a[d(y.end)];if(!(_!==void 0&&_.start<m&&_.end<=m))return y.node}),p=new Set(c.filter(u=>u!==void 0));return e.map((u,f)=>{if(u.name==="<toplevel>"&&u.declRange.path===t){let _=Ou(n,p,n,i,o);return _!==void 0?{...u,valueFlows:_}:u}let m=c[f];if(m===void 0)return u;let h=Ou(m,p,n,i,o),y=i.get(m);return{...u,...y!==void 0?{sourceParams:[{index:y.index,sourceClass:y.model.sourceClass,model:y.model.id,registeredAt:y.registeredAt}]}:{},params:Lb(m,t,n),receiver:Db(m),reflectiveArguments:Fb(m),...h!==void 0?{valueFlows:h}:{}}})}var jb=new Set(["call","apply","bind"]),Ru=new WeakMap;function Mu(e,n){let t=Ru.get(n.checker);t===void 0&&(t=new WeakMap,Ru.set(n.checker,t));let s=t.get(e);if(s!==void 0)return s;let o=Ia(n.program,n.checker,e),r=o==="ecmascript"?Au(n.checker,e):null,i=r!==null?Nu(r):void 0,a={calleeDecl:o,identity:r,...i!==void 0?{summary:i}:{}};return t.set(e,a),a}function Ta(e,n,t,s,o){let r=n;for(;P.isParenthesizedExpression(r);)r=r.expression;let i=P.isPropertyAccessExpression(r)||P.isElementAccessExpression(r)?r.expression:void 0,a=i!==void 0?{receiverRange:Mr(t,i,s)}:{},l={repeats:Bb(e)},d=o!==void 0?Mu(n,o):void 0,c=d?.calleeDecl,p=d?.identity??null,u=d?.summary,f={...c!==void 0?{calleeDecl:c}:{},...u!==void 0?{summary:u}:{},...p!==null?{runtimeId:`ecmascript:${p}`}:{},...o!==void 0&&i!==void 0&&Ao(o.program,o.checker,i)?{receiverPrimitive:!0}:{}};if(P.isTaggedTemplateExpression(e))return{convention:"unknown",...a,...l,...f};let m=P.isPropertyAccessExpression(r)&&jb.has(r.name.text);return{args:e.arguments.map((y,_)=>({index:_,spread:P.isSpreadElement(y)?"positional":!1,range:Mr(t,y,s),...o!==void 0&&!P.isSpreadElement(y)&&Ao(o.program,o.checker,y)?{primitive:!0}:{}})),convention:m?"unknown":"direct",...a,...l,...f}}function Bb(e){for(let n=e.parent;n!==void 0;n=n.parent){if(P.isForStatement(n)||P.isForInStatement(n)||P.isForOfStatement(n)||P.isWhileStatement(n)||P.isDoStatement(n))return!0;if(P.isFunctionDeclaration(n)||P.isMethodDeclaration(n)||P.isConstructorDeclaration(n)||P.isGetAccessorDeclaration(n)||P.isSetAccessorDeclaration(n))return!1;if(P.isFunctionExpression(n)||P.isArrowFunction(n))return!(P.isVariableDeclaration(n.parent)&&n.parent.initializer===n)}return!0}var Tu=2e4,Fs={kind:"constant"},pn=e=>({kind:"opaque",reason:e}),Tr=class extends Error{},Gb=new Set([P.SyntaxKind.BarBarToken,P.SyntaxKind.AmpersandAmpersandToken,P.SyntaxKind.QuestionQuestionToken,P.SyntaxKind.BarBarEqualsToken,P.SyntaxKind.AmpersandAmpersandEqualsToken,P.SyntaxKind.QuestionQuestionEqualsToken]),Kb=new Set([P.SyntaxKind.EqualsToken,P.SyntaxKind.BarBarEqualsToken,P.SyntaxKind.AmpersandAmpersandEqualsToken,P.SyntaxKind.QuestionQuestionEqualsToken]);function Mt(e){switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${String(e.at)}-${String(e.end)}`;case"argument":return`a${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"call-receiver":return`r${String(e.at)}-${String(e.end)}`;case"mutated-by-call":return`m${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"source":return`s${e.model}`;case"shared":return`h${String(e.id)}`;default:return e.kind}}var Io=e=>e.kind==="local"||e.kind==="param"||e.kind==="receiver"||e.kind==="free";function Ca(e){if(P.isIdentifier(e))return[];let n=[];for(let t of e.elements)P.isOmittedExpression(t)||(t.initializer!==void 0&&n.push(t),n.push(...Ca(t.name)));return n}function zb(e){return P.isWithStatement(e)||P.isCallExpression(e)&&P.isIdentifier(e.expression)&&e.expression.text==="eval"}function Ou(e,n,t,s,o){let r=[],i=(x,M,X)=>{for(let W of x)for(let q of M)if(r.push({from:W,to:q,kind:X}),r.length>Tu)throw new Tr},a=x=>x.getStart(t,!1),l=x=>({at:x.getStart(t,!1),end:x.getEnd()}),d=x=>o!==void 0&&Ao(o.program,o.checker,x),c=new Map,p=new Map,u=(x,M)=>{p.set(x,M);let X=c.get(x.text);X===void 0?c.set(x.text,[M]):X.push(M)},f=x=>{if(P.isIdentifier(x))return[x];let M=[];for(let X of x.elements)P.isOmittedExpression(X)||M.push(...f(X.name));return M},m=x=>({kind:"local",name:x.text,declStart:a(x)}),h=P.isSourceFile(e)?[]:e.parameters.filter(x=>!(P.isIdentifier(x.name)&&x.name.text==="this"));h.forEach((x,M)=>{if(P.isIdentifier(x.name))u(x.name,{kind:"param",index:M});else for(let X of f(x.name))u(X,m(X))});let y=x=>{for(let M=x.parent;M!==void 0&&M!==e;M=M.parent)if(hs(M)&&!P.isArrowFunction(M))return!0;return!1},_=x=>{if(x!==e&&hs(x)){if(n.has(x))return;for(let M of x.parameters)for(let X of f(M.name))u(X,m(X))}else if(P.isVariableDeclaration(x))for(let M of f(x.name))u(M,m(M));else if((P.isFunctionDeclaration(x)||P.isClassDeclaration(x))&&x.name!==void 0&&x!==e)u(x.name,m(x.name));else if(P.isCatchClause(x)&&x.variableDeclaration!==void 0)for(let M of f(x.variableDeclaration.name))u(M,m(M));P.forEachChild(x,_)},S=[];P.isSourceFile(e)?S.push(e):e.body!==void 0&&S.push(e.body);for(let x of h){x.initializer!==void 0&&S.push(x.initializer);for(let M of Ca(x.name))M.initializer!==void 0&&S.push(M.initializer)}for(let x of S)_(x);let b=x=>o===void 0?{kind:"free",name:x.text}:{kind:"free",name:x.text,binding:vu(o.program,o.checker,x)},k=x=>{if(o===void 0)return;let M;try{let F=x.parent;M=F!==void 0&&P.isShorthandPropertyAssignment(F)&&F.name===x?o.checker.getShorthandAssignmentValueSymbol(F):o.checker.getSymbolAtLocation(x)}catch{return}let X=M?.declarations??[];if(X.length===0)return;let W=[],q=!1;for(let F of X){let ne=P.getNameOfDeclaration(F),pe=ne===void 0?void 0:p.get(ne);pe===void 0?q=!0:W.push(pe)}return q&&W.push(b(x)),W},w=x=>{if(x.text==="undefined")return[Fs];if(x.text==="arguments")return[pn("reflective")];let M=k(x);return M!==void 0?M:c.get(x.text)??[b(x)]},N=x=>{if(n.has(x))return[];if(P.isArrowFunction(x)&&!P.isBlock(x.body))return[x.body];let M=[],X=W=>{hs(W)||((P.isReturnStatement(W)||P.isYieldExpression(W))&&W.expression!==void 0&&M.push(W.expression),P.forEachChild(W,X))};return x.body!==void 0&&P.forEachChild(x.body,X),M},R=x=>{if(P.isStringLiteral(x)||P.isNumericLiteral(x)||P.isBigIntLiteral(x)||P.isNoSubstitutionTemplateLiteral(x)||P.isRegularExpressionLiteral(x)||x.kind===P.SyntaxKind.TrueKeyword||x.kind===P.SyntaxKind.FalseKeyword||x.kind===P.SyntaxKind.NullKeyword||P.isVoidExpression(x)||P.isDeleteExpression(x))return[Fs];if(P.isFunctionExpression(x)||P.isArrowFunction(x)||P.isClassExpression(x))return[pn("unmodeled")];if(P.isIdentifier(x))return w(x);if(x.kind===P.SyntaxKind.ThisKeyword)return y(x)||P.isSourceFile(e)?[pn("unmodeled")]:[{kind:"receiver"}];if(P.isParenthesizedExpression(x)||P.isAsExpression(x)||P.isNonNullExpression(x)||P.isTypeAssertionExpression(x)||P.isSatisfiesExpression(x)||P.isSpreadElement(x)||P.isTypeOfExpression(x)||P.isAwaitExpression(x))return R(x.expression);if(P.isYieldExpression(x))return[pn("unmodeled")];if(P.isPropertyAccessExpression(x)||P.isElementAccessExpression(x))return R(x.expression);if(P.isCallExpression(x)){if(P.isIdentifier(x.expression)&&x.expression.text==="require"){let M=x.arguments[0];return M!==void 0&&P.isStringLiteralLike(M)?[Fs]:[pn("unmodeled")]}return x.expression.kind===P.SyntaxKind.ImportKeyword?[pn("unmodeled")]:[{kind:"call-result",...l(x)}]}if(P.isTaggedTemplateExpression(x))return[{kind:"call-result",...l(x)}];if(P.isNewExpression(x))return[pn("construct")];if(P.isConditionalExpression(x))return[...R(x.whenTrue),...R(x.whenFalse)];if(P.isBinaryExpression(x)){let M=x.operatorToken.kind;return M===P.SyntaxKind.CommaToken||M===P.SyntaxKind.EqualsToken?R(x.right):[...R(x.left),...R(x.right)]}return P.isPrefixUnaryExpression(x)||P.isPostfixUnaryExpression(x)?R(x.operand):P.isTemplateExpression(x)?x.templateSpans.flatMap(M=>R(M.expression)):P.isArrayLiteralExpression(x)?x.elements.length===0?[Fs]:x.elements.flatMap(M=>R(M)):P.isObjectLiteralExpression(x)?x.properties.length===0?[Fs]:x.properties.flatMap(M=>P.isPropertyAssignment(M)?R(M.initializer):P.isShorthandPropertyAssignment(M)?w(M.name):P.isSpreadAssignment(M)?R(M.expression):P.isSetAccessorDeclaration(M)?[Fs]:[pn("unmodeled")]):[pn("unmodeled")]},v=x=>{if(P.isIdentifier(x))return w(x).filter(Io);if(x.kind===P.SyntaxKind.ThisKeyword)return R(x).filter(Io);if(P.isParenthesizedExpression(x)||P.isAsExpression(x)||P.isNonNullExpression(x)||P.isTypeAssertionExpression(x)||P.isSatisfiesExpression(x)||P.isSpreadElement(x)||P.isAwaitExpression(x)||P.isPropertyAccessExpression(x)||P.isElementAccessExpression(x))return v(x.expression);if(P.isConditionalExpression(x))return[...v(x.whenTrue),...v(x.whenFalse)];if(P.isBinaryExpression(x)){let M=x.operatorToken.kind;return M===P.SyntaxKind.CommaToken||M===P.SyntaxKind.EqualsToken?v(x.right):Gb.has(M)?[...v(x.left),...v(x.right)]:[]}if(P.isArrayLiteralExpression(x))return x.elements.flatMap(M=>v(M));if(P.isObjectLiteralExpression(x))return x.properties.flatMap(M=>P.isPropertyAssignment(M)?v(M.initializer):P.isShorthandPropertyAssignment(M)?w(M.name).filter(Io):P.isSpreadAssignment(M)?v(M.expression):P.isMethodDeclaration(M)||P.isGetAccessorDeclaration(M)?N(M).flatMap(X=>v(X)):[]);if(P.isCallExpression(x)||P.isNewExpression(x)||P.isTaggedTemplateExpression(x)){if(P.isCallExpression(x)&&Pu(x))return[];if(d(x))return[];let M=P.isTaggedTemplateExpression(x)?P.isTemplateExpression(x.template)?x.template.templateSpans.map(q=>q.expression):[]:[...x.arguments??[]],X=P.isTaggedTemplateExpression(x)?x.tag:x.expression;for(;P.isParenthesizedExpression(X);)X=X.expression;let W=P.isPropertyAccessExpression(X)||P.isElementAccessExpression(X)?v(X.expression):v(X).filter(q=>q.kind!=="free");return[...M.flatMap(q=>d(q)?[]:v(q)),...W]}return P.isFunctionExpression(x)||P.isArrowFunction(x)?N(x).flatMap(M=>v(M)):[]},I=x=>P.isIdentifier(x)?w(x):P.isParenthesizedExpression(x)||P.isNonNullExpression(x)||P.isAsExpression(x)||P.isSatisfiesExpression(x)||P.isTypeAssertionExpression(x)?I(x.expression):P.isPropertyAccessExpression(x)||P.isElementAccessExpression(x)?v(x.expression):P.isArrayLiteralExpression(x)?x.elements.flatMap(M=>I(M)):P.isObjectLiteralExpression(x)?x.properties.flatMap(M=>P.isShorthandPropertyAssignment(M)?w(M.name):P.isPropertyAssignment(M)?I(M.initializer):P.isSpreadAssignment(M)?I(M.expression):[]):P.isSpreadElement(x)?I(x.expression):P.isBinaryExpression(x)&&x.operatorToken.kind===P.SyntaxKind.EqualsToken?I(x.left):[],A=x=>P.isParenthesizedExpression(x)||P.isNonNullExpression(x)||P.isAsExpression(x)||P.isSatisfiesExpression(x)||P.isTypeAssertionExpression(x)||P.isSpreadElement(x)?A(x.expression):P.isPropertyAccessExpression(x)||P.isElementAccessExpression(x)?v(x.expression):P.isArrayLiteralExpression(x)?x.elements.flatMap(M=>A(M)):P.isObjectLiteralExpression(x)?x.properties.flatMap(M=>P.isPropertyAssignment(M)?A(M.initializer):P.isSpreadAssignment(M)?A(M.expression):[]):P.isBinaryExpression(x)&&x.operatorToken.kind===P.SyntaxKind.EqualsToken?A(x.left):[],B=x=>v(x).filter(M=>M.kind==="local"||M.kind==="param"||M.kind==="receiver"),O=new Map,V=new Map,E=x=>{let M=x;for(let X=O.get(M);X!==void 0&&X!==M;X=O.get(M))M=X;for(let X=x;X!==M;){let W=O.get(X)??M;O.set(X,M),X=W}return M},D=(x,M)=>{let X=Mt(x),W=Mt(M);V.has(X)||(V.set(X,x),O.set(X,X)),V.has(W)||(V.set(W,M),O.set(W,W));let q=E(X),F=E(W);q!==F&&O.set(q,F)},L=(x,M)=>{let X=x.filter(Io);if(X.length===0)return;let W=v(M),q=W[0];if(q!==void 0){for(let F of W)D(q,F);for(let F of X)D(q,F)}},K=new Map,Y=(x,M)=>{for(let X of x){if(!Io(X))continue;let W=Mt(X),q=K.get(W);q===void 0&&(q=new Map,K.set(W,q));for(let F of M)q.set(Mt(F),F)}};h.forEach((x,M)=>{let X={kind:"param",index:M};if(x.initializer!==void 0&&(i(R(x.initializer),[X],"copy"),L([X],x.initializer)),!P.isIdentifier(x.name)){let W=f(x.name).map(m);i([X],W,"field");for(let q of W)D(X,q);for(let q of Ca(x.name)){if(q.initializer===void 0)continue;let F=f(q.name).map(m);i(R(q.initializer),F,"copy"),L(F,q.initializer)}}});let le=x=>{if(x!==e&&hs(x)){if(n.has(x))return;let M=s.get(x);x.parameters.forEach((X,W)=>{let q=M!==void 0&&W===M.index?{kind:"source",sourceClass:M.model.sourceClass,model:M.model.id}:pn("inner-function-param");i([q],f(X.name).map(m),"copy")})}else if(P.isVariableDeclaration(x)&&x.initializer!==void 0){let M=f(x.name).map(m);i(R(x.initializer),M,P.isIdentifier(x.name)?"copy":"field"),L(M,x.initializer)}else if(P.isBindingElement(x)&&x.initializer!==void 0){let M=f(x.name).map(m);i(R(x.initializer),M,"copy"),L(M,x.initializer)}else if(P.isCatchClause(x)&&x.variableDeclaration!==void 0)i([pn("caught")],f(x.variableDeclaration.name).map(m),"copy");else if(P.isTryStatement(x)&&x.catchClause?.variableDeclaration!==void 0){let M=f(x.catchClause.variableDeclaration.name).map(m),X=[],W=q=>{if(!n.has(q)){if(P.isThrowStatement(q))X.push(q.expression);else if(P.isCallExpression(q)||P.isNewExpression(q)){X.push(...q.arguments??[]);let F=q.expression;for(;P.isParenthesizedExpression(F);)F=F.expression;(P.isPropertyAccessExpression(F)||P.isElementAccessExpression(F))&&X.push(F.expression)}P.forEachChild(q,W)}};W(x.tryBlock);for(let q of X)d(q)||L(M,q)}else if((P.isFunctionDeclaration(x)||P.isClassDeclaration(x))&&x.name!==void 0&&x!==e)i([pn("unmodeled")],[m(x.name)],"copy");else if(P.isForOfStatement(x)||P.isForInStatement(x)){let M=x.initializer,X=P.isVariableDeclarationList(M)?M.declarations.flatMap(q=>f(q.name).map(m)):I(M),W=R(x.expression);i(W,X,"derive"),P.isVariableDeclarationList(M)||Y(A(M),W),P.isForOfStatement(x)&&L(X,x.expression)}else if(P.isBinaryExpression(x)&&Ub(x.operatorToken.kind)){let M=x.operatorToken.kind===P.SyntaxKind.EqualsToken?R(x.right):[...R(x.left),...R(x.right)],X=I(x.left);i(M,X,P.isIdentifier(x.left)?"copy":"field"),Y(A(x.left),M),Kb.has(x.operatorToken.kind)&&L(X,x.right)}else if(P.isShorthandPropertyAssignment(x)&&x.objectAssignmentInitializer!==void 0){let M=w(x.name);i(R(x.objectAssignmentInitializer),M,"copy"),L(M,x.objectAssignmentInitializer)}else if(P.isReturnStatement(x)&&x.expression!==void 0&&Cu(x)===e)i(R(x.expression),[{kind:"return"}],"return");else if(P.isYieldExpression(x)&&x.expression!==void 0&&Cu(x)===e)i(R(x.expression),[{kind:"return"}],"return");else if(P.isCallExpression(x)&&!Pu(x)){let M=l(x);x.arguments.forEach((ne,pe)=>{if(i(R(ne),[{kind:"argument",...M,index:pe}],"argument"),!d(ne)){let Se={kind:"mutated-by-call",...M,index:pe},Ie=B(ne);i([Se],Ie,"mutation"),Y(Ie,[Se])}});let X=x.expression;for(;P.isParenthesizedExpression(X);)X=X.expression;let W=P.isPropertyAccessExpression(X)||P.isElementAccessExpression(X)?X.expression:void 0,q=ne=>ne.kind==="receiver"?W!==void 0?[W]:[]:ne.kind==="arg"?x.arguments.slice(ne.index,ne.index+1):x.arguments.slice(ne.index),F=o!==void 0?Mu(x.expression,o):void 0;for(let ne of F?.summary?.mutates??[]){let pe=[...q(ne.into),...ne.from.flatMap(q)].filter(Ie=>!d(Ie)).flatMap(Ie=>v(Ie)),Se=pe[0];if(Se!==void 0)for(let Ie of pe)D(Se,Ie)}if((P.isPropertyAccessExpression(X)||P.isElementAccessExpression(X))&&(i(R(X.expression),[{kind:"call-receiver",...M}],"argument"),!d(X.expression))){let ne={kind:"mutated-by-call",...M,index:-1},pe=B(X.expression);i([ne],pe,"mutation"),Y(pe,[ne])}}else if(P.isNewExpression(x))for(let M of x.arguments??[]){if(d(M))continue;let X=B(M);i([pn("construct")],X,"mutation"),Y(X,[pn("construct")])}P.forEachChild(x,le)},z=()=>{let x=new Map,M=q=>{for(let F of q)F.kind==="local"&&x.set(Mt(F),F)},X=q=>{let F=q.parent;F!==void 0&&F.name===q&&!P.isShorthandPropertyAssignment(F)||F!==void 0&&(P.isCallExpression(F)||P.isNewExpression(F)||P.isTaggedTemplateExpression(F))&&(P.isTaggedTemplateExpression(F)?F.tag:F.expression)===q||d(q)||M(k(q)??c.get(q.text)??[])},W=(q,F)=>{let ne=F||n.has(q);ne&&P.isIdentifier(q)&&X(q),P.forEachChild(q,pe=>{W(pe,ne)})};W(t,!1);for(let q of t.statements){let F=P.canHaveModifiers(q)&&(P.getModifiers(q)??[]).some(ne=>ne.kind===P.SyntaxKind.ExportKeyword);if(F&&P.isVariableStatement(q))for(let ne of q.declarationList.declarations)M(f(ne.name).map(m));else if(F&&(P.isFunctionDeclaration(q)||P.isClassDeclaration(q))&&q.name!==void 0)M([m(q.name)]);else if(P.isExportDeclaration(q)&&q.moduleSpecifier===void 0&&q.exportClause!==void 0&&P.isNamedExports(q.exportClause))for(let ne of q.exportClause.elements)M(c.get((ne.propertyName??ne.name).text)??[]);else P.isExportAssignment(q)&&M(v(q.expression))}return[...x.values()]},Z=()=>{let x=!1,M=X=>{if(!x&&!(X!==e&&n.has(X)&&!P.isSourceFile(e))){if(zb(X)){x=!0;return}P.forEachChild(X,M)}};for(let X of S)M(X);return x},de=()=>{let x=new Map;for(let[X,W]of V){let q=E(X),F=x.get(q);F===void 0?x.set(q,[W]):F.push(W)}let M=0;for(let X of x.values()){if(X.length<2)continue;let W=new Map;for(let F of X)for(let[ne,pe]of K.get(Mt(F))??[])W.set(ne,pe);for(let F of X)F.kind==="free"&&W.set(Mt(F),F);if(W.size>0){let F={kind:"shared",id:M};M+=1,i([...W.values()],[F],"mutation"),i([F],X.filter(ne=>ne.kind!=="free"),"mutation")}let q=X.filter(F=>F.kind==="param"||F.kind==="receiver");if(q.length>=2)for(let F of q)i(q.filter(ne=>Mt(ne)!==Mt(F)),[F],"mutation")}};try{for(let x of S)le(x);if(!P.isSourceFile(e)&&P.isArrowFunction(e)&&!P.isBlock(e.body)&&i(R(e.body),[{kind:"return"}],"return"),P.isSourceFile(e)){let x=z();i([pn("unmodeled")],x,"mutation"),Y(x,[pn("unmodeled")])}if(Z()){let x=[...c.values()].flat(),M=h.map((W,q)=>({kind:"param",index:q})),X=P.isSourceFile(e)?[]:[{kind:"receiver"}];i([pn("reflective")],[...x,...M,...X],"mutation")}de()}catch(x){if(x instanceof Tr)return;throw x}return r}function Ub(e){return e>=P.SyntaxKind.FirstAssignment&&e<=P.SyntaxKind.LastAssignment}function Pu(e){return P.isIdentifier(e.expression)&&e.expression.text==="require"||e.expression.kind===P.SyntaxKind.ImportKeyword}function Cu(e){for(let n=e.parent;n!==void 0;n=n.parent)if(hs(n))return n}import fe from"typescript";var Du=4,Wb=[{id:"express-async-handler@1-forwarder-v1",package:"express-async-handler",versions:"0.0.1 - 1.2.0: all 13 published versions, read 2026-09-24",shape:{param:0,arity:[3,0],passes:3},evidence:"index.js, 1.1.4 and 1.2.0 (npm dist.shasum 225a84908df63b35ae9df94b6f0f1af061266426, ffc9896061d90f8d2e71a2d2b8668db5b0934391): `const asyncUtil = fn => function asyncUtilWrap(...args) { const fnReturn = fn(...args) ...`, `module.exports = asyncUtil`. 0.0.1-1.0.2: `(req, res, next) => ... fn(req, res, next)`; 1.0.3-1.1.3: `(req, res, next, ...args)` calling `fn(req, res, next, ...args)` (1.1.0 on both branches of `fn instanceof Promise`). https://github.com/Abazhenov/express-async-handler"}];function Fu(e){return Wb.find(n=>n.package===e)}var Hb=8;function ju(e){if(!(fe.isFunctionDeclaration(e)||fe.isFunctionExpression(e)||fe.isArrowFunction(e)||fe.isMethodDeclaration(e))||e.body===void 0||qb(e)||!fe.isArrowFunction(e)&&e.asteriskToken!==void 0||fe.canHaveDecorators(e)&&(fe.getDecorators(e)??[]).length>0||Xb(e))return null;let n=Yb(e);if(n===null||fe.isFunctionExpression(n)&&n.asteriskToken!==void 0)return null;let t=Vb(n);if(t===null||t.length===0)return null;let s=t.map(f=>f.text),o=new Set(s),r=new Map,i=Bu(e);for(let f=0;f<i.length;f+=1){let m=i[f];if(m===void 0)continue;let h=m.name;if(fe.isIdentifier(h)){if(r.has(h.text))return null;m.dotDotDotToken!==void 0||m.initializer!==void 0||o.has(h.text)||r.set(h.text,{index:f,decl:h})}}let a=[...Jb(n,r,s)],l=a[0];if(a.length!==1||l===void 0||l[1].length>Hb)return null;let[d,c]=l,p=r.get(d);if(p===void 0)return null;let u=0;for(let f of c)Zb(f,n)&&(u=Math.max(u,f.arguments.length));return u===0||!Lu(e,new Map([[d,p.decl]]))||!Lu(n,new Map(t.slice(0,u).map(f=>[f.text,f])))?null:{param:p.index,arity:[t.length],passes:u}}function Bu(e){return e.parameters.filter(n=>!(fe.isIdentifier(n.name)&&n.name.text==="this"))}function qb(e){return fe.canHaveModifiers(e)&&(fe.getModifiers(e)??[]).some(n=>n.kind===fe.SyntaxKind.AsyncKeyword)}function Vb(e){let n=[],t=new Set;for(let s of Bu(e)){let o=s.name;if(!fe.isIdentifier(o)||s.dotDotDotToken!==void 0||s.initializer!==void 0||t.has(o.text))return null;t.add(o.text),n.push(o)}return n}function Xb(e){let n=!1,t=s=>{n||((fe.isWithStatement(s)||fe.isIdentifier(s)&&(s.text==="arguments"||s.text==="eval")&&!Gu(s))&&(n=!0),fe.forEachChild(s,t))};return fe.forEachChild(e,t),n}function Yb(e){let n=e.body;if(n===void 0)return null;let t=i=>{if(i===void 0)return null;let a=rn(i);return fe.isArrowFunction(a)||fe.isFunctionExpression(a)?a:null};if(!fe.isBlock(n))return t(n);let s=[],o=i=>{fe.isFunctionLike(i)||fe.isClassLike(i)||(fe.isReturnStatement(i)&&s.push(i),fe.forEachChild(i,o))};fe.forEachChild(n,o);let r=s[0];return s.length!==1||r===void 0||r.parent!==n?null:t(r.expression)}function Jb(e,n,t){let s=new Map,o=i=>{if(fe.isCallExpression(i)&&fe.isIdentifier(i.expression)&&n.has(i.expression.text)&&i.questionDotToken===void 0&&i.arguments.length>0&&i.arguments.length<=t.length&&i.arguments.every((a,l)=>fe.isIdentifier(a)&&a.text===t[l])){let a=s.get(i.expression.text);a===void 0?s.set(i.expression.text,[i]):a.push(i)}fe.forEachChild(i,o)},r=e.body;return fe.isBlock(r)?fe.forEachChild(r,o):o(r),s}function Zb(e,n){let t=e;for(;;){let s=t.parent;if(s===n)return fe.isArrowFunction(n)&&n.body===t;if(fe.isParenthesizedExpression(s)||fe.isAwaitExpression(s)||fe.isAsExpression(s)||fe.isNonNullExpression(s)||fe.isSatisfiesExpression(s)||fe.isTypeAssertionExpression(s)){t=s;continue}if((fe.isPropertyAccessExpression(s)||fe.isElementAccessExpression(s))&&s.expression===t){t=s;continue}if(fe.isCallExpression(s)){if(s.expression===t){t=s;continue}if(!fe.isOptionalChain(s)&&s.arguments.some(o=>o===t)){t=s;continue}return!1}if(fe.isVariableDeclaration(s)&&s.initializer===t){let r=s.parent.parent;return fe.isVariableStatement(r)&&$u(r,n)}return(fe.isExpressionStatement(s)||fe.isReturnStatement(s))&&s.expression===t?$u(s,n):!1}}function $u(e,n){let t=e;for(;;){let s=t.parent;if(!fe.isBlock(s))return!1;for(let r of s.statements){if(r===t)break;if(!(fe.isExpressionStatement(r)||fe.isVariableStatement(r)||fe.isEmptyStatement(r)))return!1}if(s===n.body)return!0;let o=s.parent;if(!fe.isTryStatement(o)||o.tryBlock!==s)return!1;t=o}}function Lu(e,n){let t=!0,s=o=>{if(t){if(fe.isIdentifier(o)){let r=n.get(o.text);r!==void 0&&o!==r&&!Gu(o)&&!Qb(o)&&(t=!1)}fe.forEachChild(o,s)}};return fe.forEachChild(e,s),t}function Qb(e){let n=e.parent;return fe.isCallExpression(n)&&(n.expression===e||n.arguments.some(t=>t===e))||fe.isNewExpression(n)&&(n.arguments??[]).some(t=>t===e)||fe.isTypeOfExpression(n)||(fe.isPropertyAccessExpression(n)||fe.isElementAccessExpression(n))&&n.expression===e}function Gu(e){let n=e.parent;return(fe.isPropertyAccessExpression(n)||fe.isPropertyAssignment(n)||fe.isMethodDeclaration(n)||fe.isPropertyDeclaration(n)||fe.isGetAccessorDeclaration(n)||fe.isSetAccessorDeclaration(n))&&n.name===e||fe.isBindingElement(n)&&n.propertyName===e}function Ku(e,n,t){let s=null,o=r=>{if(s!==null)return;let i=r.getStart(e,!1),a=r.getEnd();if(i===n&&a===t){if(fe.isVariableDeclaration(r)&&r.initializer!==void 0){let l=rn(r.initializer);s=fe.isArrowFunction(l)||fe.isFunctionExpression(l)?l:null}else(fe.isFunctionDeclaration(r)||fe.isFunctionExpression(r)||fe.isArrowFunction(r)||fe.isMethodDeclaration(r))&&(s=r);if(s!==null)return}r.pos<=n&&a>=t&&fe.forEachChild(r,o)};return o(e),s}var Uu=3;function Fe(e,n,t){if(e===void 0)return;let s=e[n]??={fired:0,refused:{}};t===null?s.fired+=1:s.refused[t]=(s.refused[t]??0)+1}function _t(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var Lr=16,Fa=256,$a=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let s=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.fns.has(s)||(this.moduleFor(n),this.fns.set(s,{id:o,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),o}classFor(n,t){let s=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.classNodes.has(s)||(this.moduleFor(n),this.classNodes.set(s,{id:o,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(s,[])),o}methodFor(n,t,s,o){let r=`${n}#${t}.${s}`,i=`pkg:${n}#${t}.${s}`;if(!this.fns.has(r)){let a=this.classFor(n,t);this.fns.set(r,{id:i,moduleId:`pkg:${n}`,name:s,kind:o,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(i)}return i}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function Qu(e,n){let t="node_modules/",s=e.lastIndexOf(t);if(s===-1)return n;let r=e.slice(s+t.length).split("/");return r[0]?.startsWith("@")&&r.length>=2?`${r[0]}/${r[1]}`:r[0]??n}function Wu(e,n,t){let s=On.dirname(e),o=On.dirname(n),r=[];for(;;){let a=t.get(s);if(a!==void 0){for(let d of r)t.set(d,a);return a}r.push(s);let l=gn(On.join(s,"package.json"));if(l!==null)try{let d=JSON.parse(l),c={name:d.name??"app",version:d.version??"0.0.0",dir:s};for(let p of r)t.set(p,c);return c}catch{}if(s===o||s===On.dirname(s))break;s=On.dirname(s)}let i={name:"app",version:"0.0.0",dir:null};for(let a of r)t.set(a,i);return i}function La(e){return g.isParenthesizedExpression(e)?La(e.expression):g.isStringLiteralLike(e)?e.text:g.isTemplateExpression(e)?e.head.text:g.isBinaryExpression(e)&&e.operatorToken.kind===g.SyntaxKind.PlusToken?La(e.left):null}function eS(e){if(!g.isCallExpression(e))return!1;let n=e.expression,t=g.isPropertyAccessExpression(n)?n.name.text:g.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let s=e.arguments[0];return s!==void 0&&g.isIdentifier(s)&&(s.text==="__dirname"||s.text==="__filename")}function ef(e){let n=La(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":eS(e)?"relative-bounded":"unknown"}function nS(e){let n=[],t=o=>{if(e.isDeclarationFile)return!0;for(let r=o.parent;r!==void 0;r=r.parent)if(g.isModuleDeclaration(r)&&(g.getCombinedModifierFlags(r)&g.ModifierFlags.Ambient)!==0)return!0;return!1},s=o=>{if(g.isImportDeclaration(o)&&g.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1,at:o.getStart(e),runsBody:o.importClause?.isTypeOnly!==!0&&!t(o),loadShape:"require"});else if(g.isImportEqualsDeclaration(o)&&g.isExternalModuleReference(o.moduleReference)&&g.isStringLiteralLike(o.moduleReference.expression))n.push({specifier:o.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1,at:o.getStart(e),runsBody:!o.isTypeOnly&&!t(o),loadShape:"require"});else if(g.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&g.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1,at:o.getStart(e),runsBody:!o.isTypeOnly&&!t(o),loadShape:"require"});else if(g.isCallExpression(o)){let r=Eo(o);if(r!==null){let i=r.specifierArg,a=i!==void 0&&g.isStringLiteralLike(i);n.push({specifier:a?i.text:void 0,specifierIsLiteral:a,dynamic:!0,...i!==void 0&&!a?{computedArg:i,loadPos:o.getStart(e)}:{},at:o.getStart(e),runsBody:!t(o),loadShape:Ve(o.expression).kind===g.SyntaxKind.ImportKeyword?"dynamic-import":"require"})}}g.forEachChild(o,s)};return s(e),n}function tS(e,n,t){let s=new Map,o=Wu(On.join(e.appRoot,"package.json"),e.appRoot,s),r=[],i=[],a=[],l=new Map,d=new Map,c=new Set,p=[],u=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&u.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let h=Wu(f.fileName,e.appRoot,s),y=Qu(m,o.name),_=m.includes("node_modules/");r.push({id:m,packageName:_&&h.name!==o.name?h.name:y,versionRange:h.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),h.dir===o.dir&&c.add(m);let S=0,b=null;for(let k of nS(f)){let w=`${m}#import${String(S)}`;S+=1;let N=null,R=[];if(k.specifier!==void 0)if(Ze(k.specifier)==="package-root")N=t.moduleFor(Dn(k.specifier));else{let v=Fn(k.specifier,f.fileName,e.options,e.host),I=v!==null?e.toRel(v):null;if(I!==null)N=I;else if(k.specifier!==void 0){let[A,...B]=Ls(k.specifier,f.fileName,e.options,e.host).map(O=>e.toRel(O)).filter(O=>O!==null&&u.has(O));A!==void 0&&B.length>=1&&(N=A,R=B.map(O=>O))}}i.push({id:w,moduleId:m,specifier:k.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:k.dynamic,specifierIsLiteral:k.specifierIsLiteral,...N!==null?{resolvedModuleId:N}:{}}),N!==null&&a.push({importId:w,resolvedModuleId:N});for(let v of R)a.push({importId:w,resolvedModuleId:v});if(k.specifierIsLiteral&&k.runsBody&&N!==null){let v=[N,...R].map(I=>String(I)).filter(I=>u.has(I));if(v.length>0){let I=d.get(m)??[];I.push({pos:k.at,shape:k.loadShape,targetRels:v}),d.set(m,I)}}if(k.computedArg!==void 0&&k.loadPos!==void 0&&p.push({importId:String(w),path:m,pos:k.loadPos,shape:ef(k.computedArg),text:k.computedArg.getText(f).slice(0,160)}),k.computedArg!==void 0&&k.loadPos!==void 0){b??=ps(f,f.fileName,e.resolveParamDirs);let v=[];for(let I of vr(k.computedArg,b,e.appRoot,e.options,e.host)){let A=e.toRel(I);if(A===null||!u.has(A))continue;let B=A,O=`${m}#import${String(S)}`;S+=1,i.push({id:O,moduleId:m,specifier:A,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:B}),a.push({importId:O,resolvedModuleId:B}),v.push(A)}if(v.length>0){let I=ko(k.computedArg,b)!==null||wr(k.computedArg),A=l.get(m)??[];A.push({pos:k.loadPos,candidateRels:v,seedable:I}),l.set(m,A)}}}}return{modules:r,imports:i,importEdges:a,computedLoads:l,literalLoads:d,appOwnedPaths:c,loadSites:p}}function sS(e){let n=gn(e);if(n===null)return null;let t=g.createSourceFile(e,n,g.ScriptTarget.Latest,!0),s=o=>t.statements.some(r=>g.isFunctionDeclaration(r)?r.name?.text===o:g.isVariableStatement(r)?r.declarationList.declarations.some(i=>g.isIdentifier(i.name)&&i.name.text===o&&i.initializer!==void 0&&(g.isFunctionExpression(i.initializer)||g.isArrowFunction(i.initializer))):!1);for(let o of t.statements){if(g.isFunctionDeclaration(o)&&o.name!==void 0&&o.modifiers?.some(i=>i.kind===g.SyntaxKind.DefaultKeyword)===!0)return o.name.text;if(!g.isExpressionStatement(o)||!g.isBinaryExpression(o.expression))continue;let r=o.expression;if(r.operatorToken.kind===g.SyntaxKind.EqualsToken&&oS(r.left)){if(g.isFunctionExpression(r.right)&&r.right.name!==void 0)return r.right.name.text;if(g.isIdentifier(r.right)&&s(r.right.text))return r.right.text}}return null}function oS(e){return g.isPropertyAccessExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:g.isElementAccessExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="module"&&g.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function rS(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let s=d=>"surface"in d?n.moduleFor(d.surface):d.module,o=[],r=new Set;for(let d of e.modules)t.has(d)||r.has(d)||(r.add(d),o.push({id:d,packageName:e.entryRealNames[d]??Qu(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let i=[],a=[],l=0;for(let d of e.edges){let c=s(d.from),p=s(d.to),u=`${String(c)}#depreach${String(l)}`;l+=1,i.push({id:u,moduleId:c,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),a.push({importId:u,resolvedModuleId:p})}return{modules:o,imports:i,importEdges:a}}function Hu(e,n,t){let s=e.expression;if(g.isIdentifier(s)&&!t.has(s.text)){let o=n.get(s.text);if(o?.kind==="package-export")return{kind:"package-instance",packageName:o.packageName,className:o.exportName};if(o?.kind==="app-class")return{kind:"app-instance",cls:o.cls}}else if(g.isPropertyAccessExpression(s)&&g.isIdentifier(s.expression)&&!t.has(s.expression.text)){let o=n.get(s.expression.text);if(o?.kind==="package-surface")return{kind:"package-instance",packageName:o.packageName,className:s.name.text}}return null}function gs(e){return g.canHaveModifiers(e)&&(g.getModifiers(e)?.some(n=>n.kind===g.SyntaxKind.ExportKeyword)??!1)}function iS(e){let n=new Set,t;for(let s of e.statements){if(g.isExpressionStatement(s)&&g.isBinaryExpression(s.expression)){let o=s.expression;if(o.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isPropertyAccessExpression(o.left)&&g.isIdentifier(o.left.expression)&&o.left.expression.text==="module"&&o.left.name.text==="exports"){if(g.isIdentifier(o.right))n.add(o.right.text),t=o.right.text;else if(g.isObjectLiteralExpression(o.right))for(let r of o.right.properties)g.isShorthandPropertyAssignment(r)?n.add(r.name.text):g.isPropertyAssignment(r)&&g.isIdentifier(r.initializer)&&n.add(r.initializer.text)}continue}if(g.isFunctionDeclaration(s)&&s.name!==void 0&&gs(s))n.add(s.name.text);else if(g.isVariableStatement(s)&&gs(s))for(let o of s.declarationList.declarations)g.isIdentifier(o.name)&&n.add(o.name.text);else if(g.isExportDeclaration(s)&&s.exportClause&&g.isNamedExports(s.exportClause))for(let o of s.exportClause.elements)n.add((o.propertyName??o.name).text);else g.isExportAssignment(s)&&g.isIdentifier(s.expression)&&(n.add(s.expression.text),t=s.expression.text)}return{reachableLocals:n,defaultTarget:t}}function aS(e){for(let n of e.statements){if(g.isFunctionDeclaration(n)&&n.name!==void 0&&gs(n)&&g.getModifiers(n)?.some(t=>t.kind===g.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(g.isExportAssignment(n)&&!n.isExportEquals&&g.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(g.isExpressionStatement(n)&&g.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===g.SyntaxKind.EqualsToken&&wn(t.left)&&g.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function bt(e){if(g.isCallExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&g.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function wn(e){return g.isPropertyAccessExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:g.isElementAccessExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="module"&&g.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function nt(e){if(wn(e))return!0;if(!g.isPropertyAccessExpression(e)&&!g.isElementAccessExpression(e))return!1;let n=e.expression;return g.isIdentifier(n)&&n.text==="exports"?!0:wn(n)}function Bs(e){return g.isPropertyAccessExpression(e.expression)&&g.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function nf(e){let n=!1,t=s=>{if(!n){if(g.isCallExpression(s)){let o=bt(s);if(o!==void 0&&Ze(o)!=="package-root"){n=!0;return}}g.forEachChild(s,t)}};return t(e),n}function tf(e){let n=new Set,t=o=>o!==void 0&&nf(o),s=o=>{g.isVariableDeclaration(o)&&t(o.initializer)&&xo(o.name,n),g.isBinaryExpression(o)&&o.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(o.left)&&t(o.right)&&n.add(o.left.text),g.forEachChild(o,s)};return s(e),n}function sf(e,n){for(let t of e.properties)g.isShorthandPropertyAssignment(t)?n.add(t.name.text):g.isPropertyAssignment(t)&&g.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function lS(e){let n=new Set;for(let a of e.statements)if(g.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(g.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(g.isVariableStatement(a))for(let l of a.declarationList.declarations)g.isIdentifier(l.name)&&l.initializer!==void 0&&(g.isFunctionExpression(l.initializer)||g.isArrowFunction(l.initializer)||g.isObjectLiteralExpression(l.initializer))&&n.add(l.name.text);let t=a=>g.isFunctionExpression(a)||g.isArrowFunction(a)||g.isObjectLiteralExpression(a)||g.isIdentifier(a)&&n.has(a.text),s=new Set,o=a=>{g.isIdentifier(a)?s.add(a.text):g.isObjectLiteralExpression(a)&&sf(a,s)},r=!1,i=a=>{if(!r){if(g.isBinaryExpression(a)&&a.operatorToken.kind===g.SyntaxKind.EqualsToken)if(wn(a.left)){o(a.right);let l=a.right;(g.isObjectLiteralExpression(l)?l.properties.every(c=>g.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||g.isPropertyAssignment(c)&&t(c.initializer)):t(l))||(r=!0)}else nt(a.left)&&(t(a.right)||(r=!0));else(g.isCallExpression(a)&&Bs(a)&&a.arguments[0]!==void 0&&ys(a.arguments[0])||g.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(r=!0);r||g.forEachChild(a,i)}};if(i(e),!r&&s.size>0){for(let a of lf(e))if(s.has(a)){r=!0;break}}return r}function ys(e){return nt(e)||g.isIdentifier(e)&&e.text==="exports"}function of(e){if(!g.isPropertyAccessExpression(e.expression)||!g.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function ja(e){return of(e)&&e.arguments[0]!==void 0&&ys(e.arguments[0])}function dS(e){return of(e)&&e.arguments[0]!==void 0&&g.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function cS(e){for(let n of e.declarations??[])if(g.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(g.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(g.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(g.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function uS(e,n,t,s,o){let r=(e.declarations??[]).filter(a=>!g.isSourceFile(a)&&!g.isModuleDeclaration(a));for(let a of r){let l=a.getSourceFile(),d=n.toRel(l.fileName);if(d===null||o.has(d))continue;let c=t.get(`${d}::${String(a.getStart(l,!1))}`);if(c!==void 0)return c}let i=e.getName();for(let a of r){let l=n.toRel(a.getSourceFile().fileName);if(l===null||o.has(l))continue;let d=s.get(`${l}::${i}`);if(d!==void 0)return d}}function Dr(e){return g.isPropertyAccessExpression(e)?e.name.text:g.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Ba=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Ga(e){let n=g.isPropertyAccessExpression(e)||g.isElementAccessExpression(e)?Dr(e):void 0;return n!==void 0&&n!=="__proto__"&&Ba.test(n)?n:void 0}function fS(e){return e!=="__proto__"&&Ba.test(e)}function qu(e){let n=Ve(e);return g.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||wn(n)}function pS(e){if(!g.isArrayLiteralExpression(e)&&!g.isObjectLiteralExpression(e))return!1;let n=!1,t=s=>{n||(nt(s)?n=!0:g.forEachChild(s,t))};return t(e),n}function Ka(e){let n=!1,t=new Map,s=o=>{if(!n){if(g.isBinaryExpression(o)&&o.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=g.SyntaxKind.LastAssignment){if(wn(o.left)||g.isIdentifier(o.left)&&o.left.text==="exports")n=!0;else if(o.operatorToken.kind===g.SyntaxKind.EqualsToken&&qu(o.right))n=!0;else if(pS(o.left))n=!0;else if(nt(o.left)){let r=Ga(o.left);r===void 0?n=!0:t.set(r,(t.get(r)??0)+1)}}else(g.isCallExpression(o)&&Bs(o)&&o.arguments[0]!==void 0&&ys(o.arguments[0])||g.isCallExpression(o)&&ja(o)||g.isCallExpression(o)&&dS(o)||g.isVariableDeclaration(o)&&o.initializer!==void 0&&qu(o.initializer))&&(n=!0);n||g.forEachChild(o,s)}};return s(e),{surfaceEscapes:n,assignCount:t}}function za(e){let n=[];for(let t of e.statements){if(!g.isExpressionStatement(t)||!g.isBinaryExpression(t.expression))continue;let s=t.expression;s.operatorToken.kind===g.SyntaxKind.EqualsToken&&(!nt(s.left)||wn(s.left)||n.push({bin:s,name:Ga(s.left)}))}return n}function mS(e){let{surfaceEscapes:n,assignCount:t}=Ka(e);if(n)return[];let s=[];for(let{bin:o,name:r}of za(e))r===void 0||(t.get(r)??0)!==1||(g.isFunctionExpression(o.right)||g.isArrowFunction(o.right))&&s.push({name:r,value:o.right});return s}function hS(e,n){let{surfaceEscapes:t,assignCount:s}=Ka(e);if(t)return[];let o=[];for(let{bin:r,name:i}of za(e))i===void 0||(s.get(i)??0)!==1||g.isIdentifier(r.right)&&!n.has(r.right.text)&&o.push(r.right.text);return o}function gS(e,n){let{surfaceEscapes:t,assignCount:s}=Ka(e);for(let{bin:o,name:r}of za(e)){let i=o.right;if(!(g.isFunctionExpression(i)||g.isArrowFunction(i)||g.isIdentifier(i)))continue;let l=g.isFunctionExpression(i)||g.isArrowFunction(i)||g.isIdentifier(i)&&!n.has(i.text);if(!(!t&&r!==void 0&&(s.get(r)??0)===1&&l))return!0}return!1}function yS(e){let n=g.isPropertyAccessExpression(e)||g.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&g.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Vu(e){let n=e.parent;return n===void 0?!1:g.isPropertyAccessExpression(n)?n.name===e:g.isQualifiedName(n)?n.right===e:g.isBindingElement(n)||g.isImportSpecifier(n)?n.propertyName===e:g.isExportSpecifier(n)?!0:g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isPropertySignature(n)||g.isMethodDeclaration(n)||g.isMethodSignature(n)||g.isGetAccessorDeclaration(n)||g.isSetAccessorDeclaration(n)||g.isEnumMember(n)?n.name===e:!1}function Xu(e){for(let n=e.parent;n!==void 0;n=n.parent){if(g.isSourceFile(n))return!0;if(!g.isArrowFunction(n)&&(g.isFunctionLike(n)||g.isClassLike(n)))return!1}return!0}function _S(e,n){let t=s=>{g.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&n.add(s),g.forEachChild(s,t)};t(e)}function bS(e){let n=[],t=new Set;for(let r of e.statements){if(g.isExportDeclaration(r)||g.isExportAssignment(r)||g.isImportDeclaration(r)||g.isImportEqualsDeclaration(r)||gs(r))return null;if(!g.isExpressionStatement(r)||!g.isBinaryExpression(r.expression))continue;let i=r.expression;if(i.operatorToken.kind===g.SyntaxKind.EqualsToken){if(wn(i.left))n.push({kind:"whole",value:i.right});else if(nt(i.left)){let a=Ga(i.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:i.right,root:yS(i.left)})}else continue;_S(i.left,t)}}let s=!1,o=r=>{if(!s){if(g.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&!t.has(r)&&!Vu(r)){s=!0;return}if(r.kind===g.SyntaxKind.ThisKeyword&&Xu(r)){s=!0;return}if(g.isIdentifier(r)&&r.text==="arguments"&&!Vu(r)&&Xu(r)){s=!0;return}g.forEachChild(r,o)}};return o(e),s?null:n}function Da(e){return g.isIdentifier(e)||g.isStringLiteralLike(e)?e.text:void 0}function Yu(e,n,t){return g.isIdentifier(e)?n(e.text):t?.(e)}function SS(e,n,t,s){let o=new Map,r=bS(e);if(r===null||r.filter(f=>f.kind==="whole").length>1)return o;let i=r.findIndex(f=>f.kind==="whole"),a=(f,m)=>i>=0&&m>i&&f.kind==="member"&&f.root==="exports",l=r.some(a);if(l){let f=r[i];if(f===void 0||f.kind!=="whole"||!g.isObjectLiteralExpression(f.value))return o}let d=l?r.filter((f,m)=>!a(f,m)):r,c=new Map;for(let f of d)f.kind==="member"&&c.set(f.name,(c.get(f.name)??0)+1);let p=f=>n.has(f)?void 0:t(f),u=(f,m)=>{m===void 0?o.delete(f):o.set(f,m)};for(let f of d){if(f.kind==="member"){u(f.name,(c.get(f.name)??0)>1?void 0:Yu(f.value,p,s));continue}o.clear();let m=f.value;if(g.isObjectLiteralExpression(m))for(let h of m.properties){if(g.isSpreadAssignment(h))return new Map;if(g.isShorthandPropertyAssignment(h)){u(h.name.text,p(h.name.text));continue}let y=Da(h.name);if(y===void 0)return new Map;u(y,g.isPropertyAssignment(h)?Yu(h.initializer,p,s):void 0)}}return o}function rf(e,n,t,s){let o=new Map,r=a=>a!==void 0&&Ze(a)==="relative"?t.get(`${n}::${a}`):void 0,i=a=>{if(g.isVariableDeclaration(a)&&a.initializer!==void 0){let l=a.initializer;if(g.isIdentifier(a.name)&&!s.has(a.name.text)){let d=r(bt(l));if(d!==void 0)o.set(a.name.text,{kind:"whole",target:d});else if((g.isPropertyAccessExpression(l)||g.isElementAccessExpression(l))&&g.isCallExpression(l.expression)){let c=r(bt(l.expression)),p=Dr(l);c!==void 0&&p!==void 0&&o.set(a.name.text,{kind:"member",target:c,member:p})}}else if(g.isObjectBindingPattern(a.name)){let d=r(bt(l));if(d!==void 0){for(let c of a.name.elements)if(g.isIdentifier(c.name)&&!s.has(c.name.text)){let p=c.propertyName!==void 0&&g.isIdentifier(c.propertyName)?c.propertyName.text:c.name.text;o.set(c.name.text,{kind:"member",target:d,member:p})}}}}g.forEachChild(a,i)};return i(e),o}function xS(e,n,t,s){let o=i=>i!==void 0&&Ze(i)==="relative"?t.get(`${n}::${i}`):void 0,r=o(bt(e));if(r!==void 0)return{kind:"whole",target:r};if(g.isPropertyAccessExpression(e)||g.isElementAccessExpression(e)){let i=Dr(e);if(i===void 0)return;let a=o(bt(e.expression));if(a!==void 0)return{kind:"member",target:a,member:i};if(g.isIdentifier(e.expression)){let l=s.get(e.expression.text);if(l?.kind==="whole")return{kind:"member",target:l.target,member:i}}return}if(g.isIdentifier(e))return s.get(e.text)}function af(e,n,t,s,o){let r=[],i=!1,a=p=>{if(nf(p))return!0;let u=!1,f=m=>{u||(g.isIdentifier(m)&&o.has(m.text)?u=!0:g.forEachChild(m,f))};return f(p),u},l=(p,u)=>{let f=xS(p,n,t,s);f!==void 0?r.push({source:f,exportedName:u}):a(p)&&(i=!0)},d=p=>{if(g.isObjectLiteralExpression(p)){for(let u of p.properties)if(g.isSpreadAssignment(u))l(u.expression,"default");else if(g.isPropertyAssignment(u)){let f=g.isIdentifier(u.name)||g.isStringLiteralLike(u.name)?u.name.text:"default";l(u.initializer,f)}else if(g.isShorthandPropertyAssignment(u)){let f=s.get(u.name.text);f!==void 0&&r.push({source:f,exportedName:u.name.text})}return}l(p,"default")},c=p=>{if(g.isBinaryExpression(p)&&p.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=g.SyntaxKind.LastAssignment){if(wn(p.left)){d(p.right);return}if(nt(p.left)){let u=g.isPropertyAccessExpression(p.left)?p.left.name.text:g.isElementAccessExpression(p.left)&&g.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";l(p.right,u);return}}else if(g.isExportAssignment(p)&&p.isExportEquals){l(p.expression,"default");return}else if(g.isCallExpression(p)&&Bs(p)&&p.arguments[0]!==void 0&&ys(p.arguments[0])){for(let u of p.arguments.slice(1))d(u);return}g.forEachChild(p,c)};return c(e),{sources:r,residual:i}}function lf(e){let n=new Set,t=o=>{let r=o;for(;g.isPropertyAccessExpression(r)||g.isElementAccessExpression(r);)r=r.expression;return g.isIdentifier(r)?r.text:void 0},s=o=>{let r=df(o);if(r!==void 0){let i=t(r);i!==void 0&&n.add(i)}g.forEachChild(o,s)};return s(e),n}function df(e){return g.isBinaryExpression(e)&&e.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=g.SyntaxKind.LastAssignment&&(g.isPropertyAccessExpression(e.left)||g.isElementAccessExpression(e.left))?e.left:void 0}function $r(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isBindingElement(t)&&n.push(...$r(t.name));return n}function kn(e){if(g.isIdentifier(e))return[e.text];if(g.isParenthesizedExpression(e)||g.isAsExpression(e)||g.isNonNullExpression(e)||g.isSatisfiesExpression(e)||g.isTypeAssertionExpression(e)||g.isAwaitExpression(e))return kn(e.expression);if(g.isYieldExpression(e))return e.expression!==void 0?kn(e.expression):[];if(g.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===g.SyntaxKind.BarBarToken||n===g.SyntaxKind.AmpersandAmpersandToken||n===g.SyntaxKind.QuestionQuestionToken?[...kn(e.left),...kn(e.right)]:n===g.SyntaxKind.CommaToken?kn(e.right):[]}return g.isConditionalExpression(e)?[...kn(e.whenTrue),...kn(e.whenFalse)]:g.isArrayLiteralExpression(e)?e.elements.flatMap(n=>g.isSpreadElement(n)?kn(n.expression):g.isOmittedExpression(n)?[]:kn(n)):g.isObjectLiteralExpression(e)?e.properties.flatMap(n=>g.isShorthandPropertyAssignment(n)?[n.name.text]:g.isPropertyAssignment(n)?kn(n.initializer):g.isSpreadAssignment(n)?kn(n.expression):[]):[]}function cf(e,n){let t=[],s=(a,l)=>{for(let d of a)for(let c of l)d!==c&&t.push({a:d,b:c})},o=a=>g.isIdentifier(a)?[a.text]:g.isArrayLiteralExpression(a)?a.elements.flatMap(o):g.isObjectLiteralExpression(a)?a.properties.flatMap(l=>g.isShorthandPropertyAssignment(l)?[l.name.text]:g.isPropertyAssignment(l)?o(l.initializer):[]):[],r=a=>{g.isBinaryExpression(a)&&a.operatorToken.kind===g.SyntaxKind.EqualsToken?s(o(a.left),kn(a.right)):g.isVariableDeclaration(a)&&a.initializer!==void 0?s($r(a.name),kn(a.initializer)):(g.isForOfStatement(a)||g.isForInStatement(a))&&g.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&s($r(a.initializer.declarations[0].name),kn(a.expression)),g.forEachChild(a,r)};r(e);let i=new Set(n);for(let a=!0;a;){a=!1;for(let{a:l,b:d}of t)i.has(l)&&!i.has(d)&&(i.add(d),a=!0),i.has(d)&&!i.has(l)&&(i.add(l),a=!0)}return i}function uf(e,n){let t=a=>{if(!g.isPropertyAccessExpression(a)&&!g.isElementAccessExpression(a))return;let l=a;for(;g.isPropertyAccessExpression(l)||g.isElementAccessExpression(l);)l=l.expression;return g.isIdentifier(l)?l.text:void 0},s=[],o=(a,l)=>{for(let c of kn(l))s.push({name:a,root:c});let d=t(l);d!==void 0&&s.push({name:a,root:d})},r=a=>{g.isVariableDeclaration(a)&&g.isIdentifier(a.name)&&a.initializer!==void 0?o(a.name.text,a.initializer):g.isBinaryExpression(a)&&a.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(a.left)&&o(a.left.text,a.right),g.forEachChild(a,r)};r(e);let i=new Map(n);for(let a=!0;a;){a=!1;for(let{name:l,root:d}of s){let c=i.get(d);c!==void 0&&!i.has(l)&&(i.set(l,c),a=!0)}}return i}function ff(e){return cf(e,lf(e))}function kS(e,n){let t=l=>l>=g.SyntaxKind.FirstAssignment&&l<=g.SyntaxKind.LastAssignment,s=l=>{let d=l.parent;if(d===void 0||!g.isObjectLiteralExpression(d))return!1;let c=d.parent;return c!==void 0&&g.isBinaryExpression(c)&&c.operatorToken.kind===g.SyntaxKind.EqualsToken&&c.right===d&&nt(c.left)?!0:c!==void 0&&g.isCallExpression(c)&&Bs(c)&&c.arguments[0]!==void 0&&ys(c.arguments[0])&&c.arguments.indexOf(d)>0},o=(l,d)=>{if((g.isFunctionDeclaration(d)||g.isFunctionExpression(d))&&d.name===l||g.isVariableDeclaration(d)&&d.name===l||g.isParameter(d)&&d.name===l||g.isBindingElement(d)&&d.name===l||(g.isCallExpression(d)||g.isNewExpression(d))&&d.expression===l)return!0;if((g.isPropertyAccessExpression(d)||g.isElementAccessExpression(d))&&d.expression===l){let c=d;for(;c.parent!==void 0&&(g.isPropertyAccessExpression(c.parent)||g.isElementAccessExpression(c.parent))&&c.parent.expression===c;)c=c.parent;let p=c.parent;return!(p!==void 0&&g.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===c)}return g.isBinaryExpression(d)&&d.operatorToken.kind===g.SyntaxKind.EqualsToken&&d.right===l&&nt(d.left)?!0:g.isShorthandPropertyAssignment(d)&&d.name===l||g.isPropertyAssignment(d)&&d.initializer===l?s(d):!!(g.isExportAssignment(d)&&d.expression===l||g.isExportSpecifier(d))},r=(l,d)=>g.isPropertyAccessExpression(d)&&d.name===l||g.isPropertyAssignment(d)&&d.name===l||(g.isMethodDeclaration(d)||g.isGetAccessorDeclaration(d)||g.isSetAccessorDeclaration(d))&&d.name===l,i=!1,a=(l,d)=>{if(!i){if(g.isIdentifier(l)&&d!==void 0&&n.has(l.text)&&!r(l,d)&&!o(l,d)){i=!0;return}g.forEachChild(l,c=>a(c,l))}};return a(e,void 0),i}function wS(e){let n=new Set;for(let l of e.statements)if(g.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(g.isVariableStatement(l))for(let d of l.declarationList.declarations)g.isIdentifier(d.name)&&d.initializer!==void 0&&(g.isFunctionExpression(d.initializer)||g.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,s=l=>{g.isBinaryExpression(l)&&l.operatorToken.kind===g.SyntaxKind.EqualsToken?(wn(l.left)&&(g.isIdentifier(l.right)?t.add(l.right.text):g.isObjectLiteralExpression(l.right)&&sf(l.right,t)),wn(l.right)&&g.isIdentifier(l.left)&&t.add(l.left.text)):g.isVariableDeclaration(l)&&g.isIdentifier(l.name)&&l.initializer!==void 0&&wn(l.initializer)&&t.add(l.name.text),g.forEachChild(l,s)};if(s(e),t.size>0){if(kS(e,t))return!0;let l=uf(e,new Map([...t].map(c=>[c,c]))),d=ff(e);for(let c of l.keys())if(d.has(c))return!0}let o=l=>g.isIdentifier(l)&&n.has(l.text),r=l=>l.properties.every(d=>g.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||g.isPropertyAssignment(d)&&o(d.initializer)),i=!1,a=l=>{if(!i){if(g.isBinaryExpression(l)){let d=l.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&l.operatorToken.kind<=g.SyntaxKind.LastAssignment;d&&wn(l.left)?l.operatorToken.kind===g.SyntaxKind.EqualsToken&&(o(l.right)||g.isObjectLiteralExpression(l.right)&&r(l.right))||(i=!0):d&&nt(l.left)&&(i=!0)}else g.isCallExpression(l)?(Bs(l)&&l.arguments[0]!==void 0&&ys(l.arguments[0])||ja(l))&&(i=!0):(g.isExportAssignment(l)&&l.isExportEquals&&!g.isIdentifier(l.expression)||g.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(i=!0);i||g.forEachChild(l,a)}};return a(e),i}var vS=8;function Ju(e,n,t){let s=new Set,o=rf(e,n,t,Ds(e)),r=af(e,n,t,o,tf(e));for(let{source:i}of r.sources)s.add(i.target);for(let i of e.statements)if(g.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&g.isStringLiteralLike(i.moduleSpecifier)&&Ze(i.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${i.moduleSpecifier.text}`);a!==void 0&&s.add(a)}return s}function ES(e,n,t,s=new Map){let o=new Set(n.modules.filter(w=>w.isEntrypoint).map(w=>String(w.id)));if(o.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let r=new Set(n.modules.filter(w=>w.externalSurface===!0).map(w=>String(w.id))),i=new Map,a=new Map,l=new Map,d=new Map;for(let w of t){if(w.name==="<toplevel>"){d.set(String(w.moduleId),w);continue}if(i.set(`${String(w.moduleId)}::${String(w.declRange.start)}`,w),w.name!==void 0&&a.set(`${String(w.moduleId)}::${w.name}`,w),w.isExported&&w.name!==void 0){let N=l.get(String(w.moduleId))??[];N.push(w),l.set(String(w.moduleId),N)}}if(s.size>0){let w=new Map(t.map(N=>[String(N.id),N]));for(let[N,R]of s){let v=w.get(String(R));v!==void 0&&!i.has(N)&&i.set(N,v)}}let c=new Map;for(let w of n.imports)w.resolvedModuleId!==void 0&&c.set(`${w.moduleId}::${w.specifier}`,String(w.resolvedModuleId));let p=new Map;for(let w of e.sourceFiles){let N=e.toRel(w.fileName);N!==null&&p.set(N,w)}let u=new Map,f=w=>{let N=u.get(w);if(N!==void 0)return N;let R=p.get(w),v=R===void 0?!0:wS(R);return u.set(w,v),v},m=new Set,h=(w,N)=>N!==void 0&&Ze(N)==="relative"?c.get(`${w}::${N}`):void 0,y=w=>{if(g.isIdentifier(w))return w.text;if(g.isPropertyAccessExpression(w)){let N=y(w.expression);return N===void 0?void 0:`${N}.${w.name.text}`}if(g.isElementAccessExpression(w)&&g.isStringLiteralLike(w.argumentExpression)){let N=y(w.expression);return N===void 0?void 0:`${N}.${w.argumentExpression.text}`}},_=w=>{let N=w;for(;g.isPropertyAccessExpression(N)||g.isElementAccessExpression(N);)N=N.expression;return bt(N)};for(let w of e.sourceFiles){let N=e.toRel(w.fileName);if(N===null)continue;let R=new Map,v=new Map,I=(O,V)=>{let E=h(N,bt(V));if(E!==void 0){if(g.isIdentifier(O))v.set(O.text,E),R.set(O.text,E);else if(g.isObjectBindingPattern(O)||g.isArrayBindingPattern(O))for(let D of $r(O))v.set(D,E);else if(g.isPropertyAccessExpression(O)||g.isElementAccessExpression(O)){let D=y(O);D!==void 0&&R.set(D,E)}}},A=O=>{g.isVariableDeclaration(O)&&O.initializer!==void 0?I(O.name,O.initializer):g.isBinaryExpression(O)&&O.operatorToken.kind===g.SyntaxKind.EqualsToken&&I(O.left,O.right),g.forEachChild(O,A)};A(w);let B=O=>{let V=df(O);if(V!==void 0){let E=V.expression,D=h(N,_(E));D!==void 0&&m.add(D);let L=y(E),K=L!==void 0?R.get(L):void 0;K!==void 0&&m.add(K)}g.forEachChild(O,B)};if(B(w),v.size>0){let O=uf(w,v),V=ff(w);for(let[E,D]of O)V.has(E)&&m.add(D)}}let S=[],b=[],k=[];for(let w of e.sourceFiles){let N=e.toRel(w.fileName);if(N===null||!o.has(N))continue;let R=e.checker.getSymbolAtLocation(w),v=new Set,I=new Set,A=0,B=(z,Z)=>{if(r.has(String(z.moduleId))||v.has(String(z.id)))return;v.add(String(z.id));let de=`${N}#reexport:${String(A)}:${Z}`;A+=1,S.push({id:de,moduleId:N,exportedName:Z,kind:"value",reexportOf:{moduleId:String(z.moduleId),name:z.name??Z}}),b.push({exportId:de,target:{kind:"function",functionId:z.id}})},O=z=>{if(cS(z))return;let Z=z;if((z.flags&g.SymbolFlags.Alias)!==0)try{Z=e.checker.getAliasedSymbol(z)}catch{return}let de=uS(Z,e,i,a,r);if(de!==void 0){B(de,z.getName());return}if((Z.flags&g.SymbolFlags.Module)!==0&&!I.has(Z)){I.add(Z);try{for(let x of e.checker.getExportsOfModule(Z))O(x)}catch{}}};if(R!==void 0)for(let z of e.checker.getExportsOfModule(R))O(z);let V=rf(w,N,c,Ds(w)),E=af(w,N,c,V,tf(w)),D=new Set,L=E.residual,K=z=>{let Z=p.get(z);z.includes("node_modules/")||Z===void 0||lS(Z)?L=!0:D.add(z)};for(let{source:z,exportedName:Z}of E.sources){let de=l.get(z.target)??[],x=m.has(z.target);if(z.kind==="whole"){for(let M of de)B(M,M.name??Z);x?L=!0:(de.length===0||f(z.target))&&K(z.target)}else{let M=de.filter(X=>X.name===z.member);for(let X of M)B(X,Z);x?L=!0:(M.length===0||f(z.target))&&K(z.target)}}let Y=new Set,le=[];for(let z of Ju(w,N,c))le.push({target:z,depth:1});for(;le.length>0;){let z=le.shift();if(z===void 0)break;let{target:Z,depth:de}=z;if(Y.has(Z)||de>vS||(Y.add(Z),Z.split("/").includes("node_modules")))continue;let x=p.get(Z);if(x===void 0)continue;let M=d.get(Z);M!==void 0&&!f(Z)&&B(M,"<load>");for(let X of Ju(x,Z,c))Y.has(X)||le.push({target:X,depth:de+1})}gS(w,Ds(w))&&(L=!0);for(let z of D)k.push({code:"unresolved-reexport",path:N,detail:`entrypoint whole/member re-exports app-owned relative module ${z} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:z});L&&k.push({code:"unresolved-reexport",path:N,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:S,exportBindings:b,diagnostics:k}}var js=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),AS=new Set(["defineProperty","defineProperties","create"]);function NS(e){let n=!0,t=o=>g.isIdentifier(o)||g.isStringLiteral(o)||g.isNumericLiteral(o)?js.has(o.text):g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?js.has(o.expression.text):!1,s=o=>{if(n){if(g.isNewExpression(o)||g.isForOfStatement(o)||g.isSpreadElement(o)||g.isSpreadAssignment(o)||g.isArrayBindingPattern(o)||g.isGetAccessorDeclaration(o)||g.isSetAccessorDeclaration(o)||g.isYieldExpression(o)&&o.asteriskToken!==void 0||g.canHaveDecorators(o)&&(g.getDecorators(o)?.length??0)>0){n=!1;return}if((g.isPropertyAccessExpression(o)||g.isMethodDeclaration(o)||g.isPropertyAssignment(o))&&t(o.name)||g.isPropertyDeclaration(o)&&t(o.name)||g.isShorthandPropertyAssignment(o)&&t(o.name)||g.isBindingElement(o)&&t(o.propertyName??o.name)||g.isElementAccessExpression(o)&&g.isStringLiteralLike(o.argumentExpression)&&js.has(o.argumentExpression.text)){n=!1;return}if(g.isCallExpression(o)&&g.isPropertyAccessExpression(o.expression)&&g.isIdentifier(o.expression.expression)&&o.expression.expression.text==="Object"&&AS.has(o.expression.name.text)){n=!1;return}g.forEachChild(o,s)}};return s(e),n}function Fr(e){if(g.isIdentifier(e)||g.isStringLiteral(e)||g.isNumericLiteral(e))return e.text}function pf(e){let n=t=>g.canHaveDecorators(t)&&(g.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function IS(e){let n=!1,t=new Set,s=[],o=new Map,r=(u,f)=>{let m=o.get(u);m===void 0?o.set(u,[f]):m.push(f)},i=u=>{g.isIdentifier(u)?t.add(u.text):s.push(u)},a=u=>{for(let f of u.properties)g.isShorthandPropertyAssignment(f)?t.add(f.name.text):g.isPropertyAssignment(f)?s.push(f.initializer):n=!0},l=u=>{if(g.isBinaryExpression(u)&&u.operatorToken.kind===g.SyntaxKind.EqualsToken){let f=u.left,m=u.right;wn(f)?g.isObjectLiteralExpression(m)?a(m):g.isIdentifier(m)||g.isFunctionExpression(m)||g.isArrowFunction(m)||g.isClassExpression(m)?i(m):n=!0:nt(f)?(g.isElementAccessExpression(f)&&!g.isStringLiteralLike(f.argumentExpression)&&(n=!0),i(m)):g.isIdentifier(f)?r(f.text,m):(g.isPropertyAccessExpression(f)||g.isElementAccessExpression(f))&&g.isIdentifier(f.expression)&&r(f.expression.text,m)}else if(g.isCallExpression(u))(Bs(u)&&u.arguments[0]!==void 0&&ys(u.arguments[0])||ja(u))&&(n=!0);else if(g.isVariableDeclaration(u)&&g.isIdentifier(u.name)&&u.initializer!==void 0)r(u.name.text,u.initializer);else if((g.isFunctionDeclaration(u)||g.isClassDeclaration(u))&&u.name!==void 0)r(u.name.text,u),gs(u)&&t.add(u.name.text);else if(g.isExportDeclaration(u)){if(u.exportClause===void 0)n=!0;else if(u.moduleSpecifier===void 0&&g.isNamedExports(u.exportClause))for(let f of u.exportClause.elements)t.add((f.propertyName??f.name).text)}else if(g.isExportAssignment(u))u.isExportEquals&&!g.isIdentifier(u.expression)?n=!0:i(u.expression);else if(g.isVariableStatement(u)&&gs(u))for(let f of u.declarationList.declarations)g.isIdentifier(f.name)&&t.add(f.name.text);g.forEachChild(u,l)};l(e);let d=new Set,c=[...t],p=u=>{let f=m=>{g.isIdentifier(m)&&c.push(m.text),g.forEachChild(m,f)};f(u)};for(let u of s)p(u);for(;c.length>0;){let u=c.pop();if(!(u===void 0||d.has(u))){d.add(u);for(let f of o.get(u)??[])p(f)}}return{names:d,opaque:n}}var RS=512,OS=new Set(["get","post","put","patch","delete","options","head"]);function PS(e){for(let n of e.statements){if(g.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(g.isExpressionStatement(n)&&g.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isPropertyAccessExpression(n.expression.left)&&g.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,s=n.expression.left.name.text;if(t==="module"&&s==="exports"||t==="exports"&&s==="default")return n.expression.right}}return null}function CS(e){let n=new Map,t=PS(e);if(t===null)return n;let s=r=>{for(let i of r.properties)if(g.isPropertyAssignment(i)&&g.isObjectLiteralExpression(i.initializer)){let a=Fr(i.name);a!==void 0&&n.set(a,i.initializer)}};if(g.isObjectLiteralExpression(t))return s(t),n;if(!g.isIdentifier(t))return n;let o=t.text;for(let r of e.statements)if(g.isVariableStatement(r))for(let i of r.declarationList.declarations)g.isIdentifier(i.name)&&i.name.text===o&&i.initializer!==void 0&&g.isObjectLiteralExpression(i.initializer)&&s(i.initializer);else if(g.isExpressionStatement(r)&&g.isBinaryExpression(r.expression)&&r.expression.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isPropertyAccessExpression(r.expression.left)&&g.isIdentifier(r.expression.left.expression)&&r.expression.left.expression.text===o&&g.isObjectLiteralExpression(r.expression.right)){let i=r.expression.left.name.text;n.set(i,r.expression.right)}return n}function MS(e){for(let n of e.properties){if(g.isMethodDeclaration(n)&&g.isIdentifier(n.name)&&n.name.text==="handler")return n;if(g.isPropertyAssignment(n)&&g.isIdentifier(n.name)&&n.name.text==="handler"&&(g.isArrowFunction(n.initializer)||g.isFunctionExpression(n.initializer)))return n.initializer}return null}function TS(e,n){for(let s of e.properties){let o;if(g.isPropertyAssignment(s)||g.isMethodDeclaration(s)?o=Fr(s.name):g.isShorthandPropertyAssignment(s)&&(o=s.name.text),o==="method"||o==="url"||o==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function $S(e,n){let t=[],s=new Set,o=(a,l,d)=>{if(t.length>=RS||a==="__proto__"||!Ba.test(a))return;let c=`${e}#handler:${a}`;s.has(c)||(s.add(c),t.push({id:c,node:l,memberPath:a,idiom:d}))};for(let[a,l]of CS(n)){let d=MS(l);d!==null&&TS(l,d)&&o(a,d,"descriptor-object")}let r=0,i=a=>{if(g.isCallExpression(a)&&g.isPropertyAccessExpression(a.expression)&&g.isIdentifier(a.expression.expression)&&OS.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&g.isStringLiteralLike(a.arguments[0])){let l=a.expression.name.text;for(let d=1;d<a.arguments.length;d+=1){let c=a.arguments[d];c!==void 0&&(g.isArrowFunction(c)||g.isFunctionExpression(c))&&o(`${l}_${String(r)}_${String(d)}`,c,"router-verb")}r+=1}g.forEachChild(a,i)};return i(n),t}function LS(e,n,t,s,o,r){let i=`${e}#class:${t}`,a=[],l=new Set;for(let d of s.members){let c,p,u;if(g.isConstructorDeclaration(d))c="constructor",p="ctor",u=!1;else if(g.isMethodDeclaration(d))c=Fr(d.name),p="method",u=c!==void 0&&!js.has(c);else continue;if(c===void 0||l.has(c))continue;l.add(c);let f=`${e}#${t}.${c}`;o.push({id:f,moduleId:e,name:c,kind:p,enclosingClassId:i,declRange:_t(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),u&&r.push({start:d.getStart(n,!1),end:d.getEnd(),id:f})}return{id:i,moduleId:e,name:t,implementsRefs:[],members:a}}function DS(e,n,t=[],s=!1,o){let r=[],i=new Map,a=[],{reachableLocals:l,defaultTarget:d}=iS(n),c=Ds(n),p=`${e}#<toplevel>`;r.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let u=(N,R)=>{let v=`${e}#${N}`;return r.push({id:v,moduleId:e,name:N,kind:"function",declRange:_t(e,R,n),isExported:l.has(N),publicSurfaceReachable:l.has(N)}),i.set(N,{kind:"function",functionId:v}),a.push({start:R.getStart(n,!1),end:R.getEnd(),id:v}),v},f=[],m=!e.split("/").includes("node_modules");if(m)for(let N of hS(n,c))l.add(N);let h=m?IS(n):void 0,y=(N,R,v)=>{h===void 0||h.opaque||h.names.has(N)||gs(v)||pf(R)||f.push(LS(e,n,N,R,r,a))};for(let N of n.statements)if(g.isFunctionDeclaration(N)&&N.name!==void 0)u(N.name.text,N);else if(g.isClassDeclaration(N)&&N.name!==void 0)y(N.name.text,N,N);else if(g.isVariableStatement(N))for(let R of N.declarationList.declarations){if(g.isObjectBindingPattern(R.name)&&R.initializer!==void 0&&g.isCallExpression(R.initializer)&&g.isIdentifier(R.initializer.expression)&&R.initializer.expression.text==="require"&&R.initializer.arguments.length===1&&R.initializer.arguments[0]!==void 0&&g.isStringLiteralLike(R.initializer.arguments[0])){let I=R.initializer.arguments[0].text;for(let A of R.name.elements){if(A.dotDotDotToken!==void 0||A.initializer!==void 0||!g.isIdentifier(A.name))continue;let B=A.propertyName??A.name;!g.isIdentifier(B)&&!g.isStringLiteralLike(B)||i.set(A.name.text,{kind:"import",specifier:I,form:{named:B.text}})}continue}if(!g.isIdentifier(R.name)||R.initializer===void 0)continue;let v=R.initializer;if(g.isFunctionExpression(v)||g.isArrowFunction(v))u(R.name.text,R);else if(g.isClassExpression(v))y(R.name.text,v,N);else if(g.isCallExpression(v)&&g.isIdentifier(v.expression)&&v.expression.text==="require"&&v.arguments.length===1&&v.arguments[0]!==void 0&&g.isStringLiteralLike(v.arguments[0]))i.set(R.name.text,{kind:"import",specifier:v.arguments[0].text,form:"whole"});else if((g.isPropertyAccessExpression(v)||g.isElementAccessExpression(v))&&Dr(v)==="default"&&g.isCallExpression(v.expression)){let I=bt(v.expression);I!==void 0&&i.set(R.name.text,{kind:"import",specifier:I,form:"require-default"})}}else if(g.isImportDeclaration(N)&&g.isStringLiteralLike(N.moduleSpecifier)){let R=N.moduleSpecifier.text,v=N.importClause;if(v!==void 0){v.name!==void 0&&i.set(v.name.text,{kind:"import",specifier:R,form:"default"});let I=v.namedBindings;if(I!==void 0&&g.isNamespaceImport(I))i.set(I.name.text,{kind:"import",specifier:R,form:"namespace"});else if(I!==void 0&&g.isNamedImports(I))for(let A of I.elements){let B=(A.propertyName??A.name).text;i.set(A.name.text,{kind:"import",specifier:R,form:{named:B}})}}}else g.isImportEqualsDeclaration(N)&&g.isExternalModuleReference(N.moduleReference)&&g.isStringLiteralLike(N.moduleReference.expression)&&i.set(N.name.text,{kind:"import",specifier:N.moduleReference.expression.text,form:"whole"});let _=new Map,S,b=new Map,k=new Map;if(m)for(let{name:N,value:R}of mS(n)){let v=`${e}#member-export:${N}`;r.push({id:v,moduleId:e,name:N,kind:g.isArrowFunction(R)?"arrow":"function",declRange:_t(e,R,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:R.getStart(n,!1),end:R.getEnd(),id:v}),_.set(R.getStart(n,!1),v)}if(s&&m){let N=B=>{let O=rn(B);return g.isFunctionExpression(O)||g.isArrowFunction(O)?O:void 0},R=(B,O)=>{let V=B;return r.push({id:V,moduleId:e,kind:g.isArrowFunction(O)?"arrow":"function",declRange:_t(e,O,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:O.getStart(n,!1),end:O.getEnd(),id:V}),_.set(O.getStart(n,!1),V),V},v=[],I=[],A=[];for(let B of n.statements)g.isExportAssignment(B)&&!B.isExportEquals?v.push(B):g.isFunctionDeclaration(B)&&g.getModifiers(B)?.some(O=>O.kind===g.SyntaxKind.DefaultKeyword)===!0?I.push(B):g.isExpressionStatement(B)&&g.isBinaryExpression(B.expression)&&B.expression.operatorToken.kind===g.SyntaxKind.EqualsToken&&wn(B.expression.left)&&A.push(B.expression);if(v.length+I.length+A.length===1){let B=v[0],O=I[0],V=A[0];if(B!==void 0){let E=N(B.expression);if(E!==void 0){let D=R(`${e}#<default>`,E);S={id:D,esm:!0},k.set(B.getStart(n,!1),D),Fe(o,"2a-default",null)}}else if(O!==void 0&&O.name===void 0&&O.body!==void 0){let E=R(`${e}#<default>`,O);S={id:E,esm:!0},k.set(O.getStart(n,!1),E),Fe(o,"2a-default",null)}else if(V!==void 0){let E=N(V.right);if(E!==void 0){let D=R(`${e}#<default>`,E);S={id:D,esm:!1},k.set(V.getStart(n,!1),D),Fe(o,"2a-default",null)}else if(g.isObjectLiteralExpression(V.right)){let D=V.right,L=[],K=!0;for(let Y of D.properties){if(g.isSpreadAssignment(Y)){K=!1;break}let le=Y.name,z=le===void 0?void 0:Da(le);if(z===void 0){K=!1;break}L.push(z)}if(K){let Y=new Map;for(let le of L)Y.set(le,(Y.get(le)??0)+1);for(let le of D.properties){if(!g.isPropertyAssignment(le))continue;let z=Da(le.name),Z=N(le.initializer);if(z!==void 0){if(!fS(z)){Z!==void 0&&Fe(o,"2a-member","charset-refused");continue}if((Y.get(z)??0)!==1){Z!==void 0&&Fe(o,"2a-member","duplicate-key");continue}if(Z!==void 0){let de=R(`${e}#<cjs>.${z}`,Z);b.set(z,de),k.set(le.getStart(n,!1),de),Fe(o,"2a-member",null)}}}}else for(let Y of D.properties)g.isPropertyAssignment(Y)&&N(Y.initializer)!==void 0&&Fe(o,"2a-member","spread-or-computed-literal")}}}else{for(let B of v)N(B.expression)!==void 0&&Fe(o,"2a-default","duplicate-default-sources");for(let B of I)B.name===void 0&&Fe(o,"2a-default","duplicate-default-sources");for(let B of A)if(N(B.right)!==void 0)Fe(o,"2a-default","duplicate-default-sources");else if(g.isObjectLiteralExpression(B.right))for(let O of B.right.properties)g.isPropertyAssignment(O)&&N(O.initializer)!==void 0&&Fe(o,"2a-member","duplicate-default-sources")}}for(let N of t)r.push({id:N.id,moduleId:e,name:`handler:${N.memberPath}`,kind:g.isArrowFunction(N.node)?"arrow":"function",declRange:_t(e,N.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:N.node.getStart(n,!1),end:N.node.getEnd(),id:N.id});a.sort((N,R)=>N.end-N.start-(R.end-R.start));let w=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:r,bindings:i,exportedFunctionId:w,exportedNames:l,tainted:c,fnRanges:a,toplevelId:p,classes:f,mintedByPos:_,mintedDefault:S,mintedMembers:b,mintSeedAliases:k}}function FS(e){return g.isIdentifier(e)?"identifier":g.isPropertyAccessExpression(e)?"member":g.isElementAccessExpression(e)?"computed-member":e.kind===g.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function Zu(e,n){let t=s=>{if(g.isBinaryExpression(s)&&s.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=g.SyntaxKind.LastAssignment){let o=s.left;g.isPropertyAccessExpression(o)&&g.isIdentifier(o.expression)?n(o.expression.text,o.name.text):g.isElementAccessExpression(o)&&g.isIdentifier(o.expression)&&n(o.expression.text,g.isStringLiteralLike(o.argumentExpression)?o.argumentExpression.text:null)}else if(g.isCallExpression(s)&&g.isPropertyAccessExpression(s.expression)){let o=s.expression,r=s.arguments[0];g.isIdentifier(o.expression)&&r!==void 0&&g.isIdentifier(r)&&(o.expression.text==="Object"&&(o.name.text==="assign"||o.name.text==="defineProperty"||o.name.text==="defineProperties")||o.expression.text==="Reflect"&&o.name.text==="defineProperty")&&n(r.text,null)}g.forEachChild(s,t)};t(e)}function jS(e){let n=!1,t=s=>{if(!n){if(g.isVariableDeclaration(s)||g.isParameter(s)){let o=new Set;if(xo(s.name,o),o.has("require")){n=!0;return}}else if((g.isFunctionDeclaration(s)||g.isClassDeclaration(s))&&s.name!==void 0&&s.name.text==="require"){n=!0;return}g.forEachChild(s,t)}};return t(e),n}function BS(e,n,t,s=new Map,o={}){let r=o.additiveForms===!0,i=o.namelessExports===!0,a=r||i?{}:void 0,l=new Map,d=new Map;for(let E of n.imports)E.resolvedModuleId!==void 0&&d.set(`${E.moduleId}::${E.specifier}`,E.resolvedModuleId);for(let E of e.sourceFiles){let D=e.toRel(E.fileName);D!==null&&l.set(D,DS(D,E,s.get(D)??[],i,a))}let c=new Map;if(r)for(let E of l.values()){let D=new Map;for(let[L,K]of E.bindings)if(K.kind==="import"&&K.form==="whole"&&Ze(K.specifier)!=="package-root"){let Y=d.get(`${E.rel}::${K.specifier}`);Y!==void 0&&D.set(L,String(Y))}D.size!==0&&Zu(E.sf,(L,K)=>{let Y=D.get(L);if(Y===void 0)return;let le=c.get(Y);if(le!=="*"){if(K===null){c.set(Y,"*");return}le===void 0?c.set(Y,new Set([K])):le.add(K)}})}let p=new Map;for(let E of l.values())E.exportedFunctionId!==void 0&&p.set(E.rel,E.exportedFunctionId);let u=new Map;for(let E of l.values()){if(E.rel.split("/").includes("node_modules"))continue;let D=aS(E.sf);if(D===void 0){i&&E.mintedDefault!==void 0&&u.set(E.rel,E.mintedDefault);continue}let L=E.bindings.get(D.name);L?.kind==="function"&&u.set(E.rel,{id:L.functionId,esm:D.esm})}let f=new Map;for(let E of l.values()){let D;for(let L of E.exportedNames){let K=E.bindings.get(L);K?.kind==="function"&&(D??=new Map,D.set(L,K.functionId))}D!==void 0&&f.set(E.rel,D)}let m=new Map;for(let E of l.values()){if(E.rel.split("/").includes("node_modules"))continue;let D=SS(E.sf,E.tainted,L=>{let K=E.bindings.get(L);return K?.kind==="function"?K.functionId:void 0},i?L=>{let K=rn(L);return g.isFunctionExpression(K)||g.isArrowFunction(K)?E.mintedByPos.get(K.getStart(E.sf,!1)):void 0}:void 0);D.size>0&&m.set(E.rel,D)}let h=[],y=[],_=[],S=[],b=[],k=[],w=new Map;for(let E of n.imports){let D=w.get(E.moduleId)??[];D.push(E.specifier),w.set(E.moduleId,D)}let N=E=>Iu(w.get(E)??[]),R=new Map,v=new Map,I=new Map,A=new Map;for(let E of l.values())if(!E.rel.split("/").includes("node_modules"))for(let D of E.functions)D.id!==E.toplevelId&&A.set(D.id,{fn:D,sf:E.sf});let B=new Map,O=E=>{let D=B.get(E);if(D===void 0){let L=A.get(E),K=L===void 0?null:Ku(L.sf,L.fn.declRange.start,L.fn.declRange.end);D=K===null?null:ju(K),B.set(E,D)}return D};for(let E of l.values()){k.push(...E.classes);for(let G of E.exportedNames){let J=E.bindings.get(G);if(J?.kind==="function"){let ee=`${E.rel}#export:${G}`;S.push({id:ee,moduleId:E.rel,exportedName:G,kind:"value"}),b.push({exportId:ee,target:{kind:"function",functionId:J.functionId}})}}if(i){if(E.mintedDefault!==void 0){let G=`${E.rel}#export:<default>`;S.push({id:G,moduleId:E.rel,exportedName:"default",kind:"value"}),b.push({exportId:G,target:{kind:"function",functionId:E.mintedDefault.id}})}for(let[G,J]of E.mintedMembers){let ee=`${E.rel}#export:<cjs>.${G}`;S.push({id:ee,moduleId:E.rel,exportedName:G,kind:"value"}),b.push({exportId:ee,target:{kind:"function",functionId:J}})}}let D=new Map;for(let[G,J]of E.bindings){if(J.kind==="function"){D.set(G,J);continue}if(Ze(J.specifier)==="package-root"){let ae=Dn(J.specifier);typeof J.form=="object"?D.set(G,{kind:"package-export",packageName:ae,exportName:J.form.named}):J.form==="require-default"?D.set(G,{kind:"package-default",packageName:ae}):D.set(G,{kind:"package-surface",packageName:ae})}else{let ae=d.get(`${E.rel}::${J.specifier}`);if(ae!==void 0&&typeof J.form=="object"){let we=f.get(String(ae))?.get(J.form.named);we!==void 0&&D.set(G,{kind:"app-named-fn",functionId:we})}else if(ae!==void 0&&J.form==="require-default"){let we=u.get(String(ae));we!==void 0&&we.esm&&D.set(G,{kind:"app-default-fn",functionId:we.id})}else ae!==void 0&&typeof J.form!="object"&&J.form!=="require-default"&&D.set(G,{kind:"module",resolvedModuleId:ae})}}let L=new Map;for(let G of E.functions){if(G.enclosingClassId===void 0||G.name===void 0)continue;let J=L.get(G.enclosingClassId);J===void 0&&(J=new Map,L.set(G.enclosingClassId,J)),J.set(G.name,G.id)}for(let G of E.classes)G.name===void 0||E.tainted.has(G.name)||D.has(G.name)||D.set(G.name,{kind:"app-class",cls:{classId:G.id,className:G.name,memberIds:L.get(G.id)??new Map}});let K=G=>{if(g.isVariableDeclaration(G)&&g.isIdentifier(G.name)&&G.initializer!==void 0&&g.isNewExpression(G.initializer)&&!E.tainted.has(G.name.text)&&!D.has(G.name.text)){let J=Hu(G.initializer,D,E.tainted);J!==null&&D.set(G.name.text,J)}g.forEachChild(G,K)};K(E.sf);let Y=G=>{for(let J of E.fnRanges)if(G>=J.start&&G<J.end)return J.id;return E.toplevelId},le=new Map,z=new Map,Z=new Map,de=(G,J,ee)=>{if(ee===null){G.set(J,"*");return}let ae=G.get(J);ae!=="*"&&(ae===void 0?G.set(J,new Set([ee])):ae.add(ee))},x=(G,J)=>{de(le,G,J);let ee=D.get(G);ee?.kind==="package-surface"?de(z,ee.packageName,J):ee?.kind==="module"&&de(Z,String(ee.resolvedModuleId),J)};Zu(E.sf,x);let M=new Map,X=256,W=G=>{let J=M.get(G);return J===void 0&&(J=M.size>=X?new Set([G]):cf(E.sf,new Set([G])),M.set(G,J)),J},q=(G,J)=>G==="*"||G!==void 0&&G.has(J),F=(G,J)=>{let ee=D.get(G);if(ee?.kind==="package-surface"&&q(z.get(ee.packageName),J)||ee?.kind==="module"&&q(Z.get(String(ee.resolvedModuleId)),J))return!0;for(let ae of W(G))if(q(le.get(ae),J))return!0;return!1},ne=G=>{if(g.isIdentifier(G)){let J=E.tainted.has(G.text)?void 0:D.get(G.text);return J?.kind==="function"?J.functionId:J?.kind==="module"?p.get(String(J.resolvedModuleId))??null:J?.kind==="package-export"?t.exportFor(J.packageName,J.exportName):null}if(g.isPropertyAccessExpression(G)&&g.isIdentifier(G.expression)){let J=G.expression.text;if(F(J,G.name.text))return null;let ee=E.tainted.has(J)?void 0:D.get(J);return ee?.kind==="package-surface"?t.exportFor(ee.packageName,G.name.text):ee?.kind==="package-export"?t.methodFor(ee.packageName,ee.exportName,G.name.text,"method"):ee?.kind==="package-instance"?t.methodFor(ee.packageName,ee.className,G.name.text,"method"):null}return null},pe=G=>{for(let J=G.parent;J!==void 0;J=J.parent)if(!g.isArrowFunction(J)){if(g.isFunctionExpression(J)||g.isFunctionDeclaration(J))return null;if(g.isMethodDeclaration(J)||g.isConstructorDeclaration(J)||g.isGetAccessorDeclaration(J)||g.isSetAccessorDeclaration(J)){let ee=J.parent;if(!g.isClassLike(ee)||ee.name===void 0)return null;let ae=E.tainted.has(ee.name.text)?void 0:D.get(ee.name.text);return ae?.kind==="app-class"?ae.cls:null}}return null},Se=r&&!E.tainted.has("require")&&!jS(E.sf),Ie=G=>{if(g.isIdentifier(G)){let ae=E.tainted.has(G.text)?void 0:D.get(G.text);return ae?.kind==="package-surface"||ae?.kind==="package-default"?t.exportFor(ae.packageName,"default"):ae?.kind==="app-named-fn"||ae?.kind==="app-default-fn"?ae.functionId:ae?.kind==="module"?u.get(String(ae.resolvedModuleId))?.id??null:ae?.kind==="member-value"?ae.functionId:null}if(!g.isPropertyAccessExpression(G))return null;let J=G.expression;if(r&&g.isCallExpression(rn(J))){let ae=bt(rn(J));if(ae!==void 0)if(!Se)Fe(a,"2b","require-shadow");else if(Ze(ae)==="package-root")Fe(a,"2b","package-root");else{let we=d.get(`${E.rel}::${ae}`);if(we===void 0)Fe(a,"2b","unresolved-module");else{let Me=G.name.text,xn=c.get(String(we));if(xn==="*"||xn!==void 0&&xn.has(Me))Fe(a,"2b","module-mutation-gate");else{let zn=m.get(String(we))?.get(Me);if(zn!==void 0)return Fe(a,"2b",null),zn;if(Me==="default"){let Un=u.get(String(we));if(Un!==void 0&&Un.esm)return Fe(a,"2b",null),Un.id;Fe(a,"2b","non-esm-default")}else Fe(a,"2b","unknown-member")}}}return null}let ee;if(g.isIdentifier(J)){let ae=E.tainted.has(J.text)?void 0:D.get(J.text);if(ae?.kind==="app-class"||ae?.kind==="app-instance")ee=ae.cls.memberIds;else if(ae?.kind==="object-literal")ee=ae.obj.members;else if(ae?.kind==="module"){let we=m.get(String(ae.resolvedModuleId));we?.has(G.name.text)===!0&&!F(J.text,G.name.text)&&(ee=we)}}else if(g.isNewExpression(J)){let ae=Hu(J,D,E.tainted);ae?.kind==="app-instance"&&(ee=ae.cls.memberIds)}else J.kind===g.SyntaxKind.ThisKeyword&&(ee=pe(G)?.memberIds);return ee?.get(G.name.text)??null},$=new Map,T=G=>{if(g.isVariableDeclaration(G)&&g.isIdentifier(G.name)&&G.initializer!==void 0&&g.isObjectLiteralExpression(G.initializer)&&!E.tainted.has(G.name.text)&&!D.has(G.name.text)&&!$.has(G.name.text)){let J=new Map;for(let ee of G.initializer.properties)if(g.isPropertyAssignment(ee)&&g.isIdentifier(ee.name)){let ae=ne(ee.initializer);ae!==null&&J.set(ee.name.text,ae)}$.set(G.name.text,J)}g.forEachChild(G,T)};T(E.sf);let j=G=>{if(g.isBinaryExpression(G)&&G.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isPropertyAccessExpression(G.left)&&g.isIdentifier(G.left.expression)&&!E.tainted.has(G.left.expression.text)){let J=$.get(G.left.expression.text);if(J!==void 0){let ee=ne(G.right);ee!==null&&J.set(G.left.name.text,ee)}}g.forEachChild(G,j)};j(E.sf);for(let[G,J]of $)D.set(G,{kind:"object-literal",obj:{members:J}});let U=(G,J=0)=>{if(J>Uu)return null;let ee=rn(G);if(g.isCallExpression(ee)&&g.isPropertyAccessExpression(ee.expression)&&ee.expression.name.text==="bind")return U(ee.expression.expression,J+1);if(g.isIdentifier(ee)){let ae=ne(ee);if(ae!==null)return ae;let we=E.tainted.has(ee.text)?void 0:D.get(ee.text);return we?.kind==="member-value"?we.functionId:null}return g.isPropertyAccessExpression(ee)?ne(ee)??Ie(ee):null},Q=(G,J=0)=>{if(J>Uu)return"depth-cap";let ee=rn(G);if(g.isCallExpression(ee)&&g.isPropertyAccessExpression(ee.expression)&&ee.expression.name.text==="bind")return Q(ee.expression.expression,J+1);if(g.isIdentifier(ee))return E.tainted.has(ee.text)?"tainted-receiver":"unresolved-receiver";if(g.isPropertyAccessExpression(ee)&&g.isIdentifier(ee.expression)){if(E.tainted.has(ee.expression.text))return"tainted-receiver";if(F(ee.expression.text,ee.name.text))return"mutated-member"}return"unresolved-receiver"},te=G=>{if(g.isVariableDeclaration(G)&&g.isIdentifier(G.name)&&G.initializer!==void 0){let J=rn(G.initializer),ee=g.isPropertyAccessExpression(J),ae=g.isCallExpression(J)&&g.isPropertyAccessExpression(J.expression)&&J.expression.name.text==="bind";if(ee||ae){let we=ee?"D1":"A2";if(E.tainted.has(G.name.text))Fe(a,we,"tainted-alias");else if(D.has(G.name.text))Fe(a,we,"already-bound");else{let Me=U(J);Me!==null?(D.set(G.name.text,{kind:"member-value",functionId:Me}),Fe(a,we,null)):Fe(a,we,Q(J))}}}g.forEachChild(G,te)};r&&te(E.sf);let ie=N(E.rel),me=new Map,ge=new Map,Re=G=>{let J=rn(G);if(!g.isIdentifier(J))return null;let ee=E.tainted.has(J.text)?void 0:D.get(J.text),ae=ee?.kind==="package-surface"||ee?.kind==="package-export"&&ee.exportName==="default"?ee.packageName:null;return ae===null?null:Fu(ae)?.shape??null},Oe=(G,J)=>{let ee=new Set((J.arity??[]).map(Me=>No(J.model,Me))),[ae]=[...ee];if(ee.size!==1||ae===void 0||ae>=J.passes)return;let we={model:J.model,index:ae,registeredAt:J.registeredAt};if(g.isArrowFunction(G)||g.isFunctionExpression(G))ge.has(G)||ge.set(G,we);else if(g.isIdentifier(G)||g.isPropertyAccessExpression(G)){let Me=ne(G)??Ie(G);Me!==null&&!R.has(Me)&&(R.set(Me,J.model),v.set(Me,J.registeredAt),I.set(Me,ae))}},_e=(G,J,ee)=>{let ae=me.get(G);if(ae===void 0)return;let we=Re(J)??(ee===null?null:O(ee));if(we===null||G.questionDotToken!==void 0||G.arguments.some(g.isSpreadElement))return;let Me=G.arguments[we.param];if(Me===void 0)return;let xn={...ae,depth:ae.depth+1,arity:ae.arity??we.arity,passes:Math.min(ae.passes,we.passes)},zn=rn(Me);g.isCallExpression(zn)?xn.depth<Du&&me.set(zn,xn):Oe(zn,xn)},Ge=0,Ue=G=>{let J,ee;if(g.isCallExpression(G)){let ae=G.expression,we=g.isIdentifier(ae)&&ae.text==="require",Me=ae.kind===g.SyntaxKind.ImportKeyword;!we&&!Me&&(J=ae,ee=G.arguments)}else g.isTaggedTemplateExpression(G)&&(J=G.tag);if(J!==void 0){let ae=FS(J),we=G.getStart(E.sf,!1),Me=`${E.rel}#call${String(Ge)}`;Ge+=1;let xn="unresolved",zn=[],Un=ne(J);if(Un!==null&&(xn="resolved",zn.push(Un)),y.push({id:Me,enclosingFunctionId:Y(we),calleeExprShape:ae,resolvedTargetIds:zn,resolution:xn,range:_t(E.rel,G,E.sf),...Ta(G,J,E.rel,E.sf,{program:e.program,checker:e.checker})}),g.isCallExpression(G)){let Ye=Cr(G,ie);for(let Yn of Ye?.handlers??[]){if(Ye===null||!(g.isIdentifier(Yn)||g.isPropertyAccessExpression(Yn)))continue;let ft=ne(Yn)??Ie(Yn);ft!==null&&!R.has(ft)&&(R.set(ft,Ye.model),v.set(ft,_t(E.rel,G,E.sf)))}for(let Yn of Ye?.forwarded??[])Ye!==null&&me.set(Yn,{model:Ye.model,registeredAt:_t(E.rel,G,E.sf),depth:0,arity:null,passes:Number.POSITIVE_INFINITY})}for(let Ye of zn)_.push({callSiteId:Me,calleeFunctionId:Ye,resolution:xn,invocation:"direct"});let io=Un===null?Ie(J):null;if(Un===null){if(io!==null)_.push({callSiteId:Me,calleeFunctionId:io,resolution:"field-based",invocation:"direct"});else if(r&&g.isPropertyAccessExpression(J)&&(J.name.text==="call"||J.name.text==="apply")){let Ye=U(J.expression);Ye!==null?(_.push({callSiteId:Me,calleeFunctionId:Ye,resolution:"field-based"}),Fe(a,"A3",null)):Fe(a,"A3",Q(J.expression))}}g.isCallExpression(G)&&_e(G,J,Un??io);for(let Ye of ee??[]){let Yn=ne(Ye);if(Yn!==null)_.push({callSiteId:Me,calleeFunctionId:Yn,resolution:"field-based",invocation:"callback"});else{let ft=Ie(Ye);if(ft!==null)_.push({callSiteId:Me,calleeFunctionId:ft,resolution:"field-based",invocation:"callback"});else if(r){let Ns=U(Ye),H=rn(Ye),ye=H!==Ye||g.isCallExpression(H)&&g.isPropertyAccessExpression(H.expression)&&H.expression.name.text==="bind";Ns!==null?(_.push({callSiteId:Me,calleeFunctionId:Ns,resolution:"field-based"}),ye&&Fe(a,"A2p",null)):ye&&Fe(a,"A2p",Q(Ye))}}}}g.forEachChild(G,Ue)};Ue(E.sf),h.push(...Ma(E.functions,E.sf,E.rel,ie,{program:e.program,checker:e.checker},ge));for(let G of n.computedLoads.get(E.rel)??[]){let J=G.candidateRels.filter(ae=>l.has(ae)).map(ae=>`${ae}#<toplevel>`);if(J.length===0)continue;let ee=`${E.rel}#dirload${String(Ge)}`;Ge+=1,y.push({id:ee,enclosingFunctionId:Y(G.pos),calleeExprShape:"require",resolvedTargetIds:J,resolution:"field-based",range:{path:E.rel,start:G.pos,end:G.pos}});for(let ae of J)_.push({callSiteId:ee,calleeFunctionId:ae,resolution:"field-based"})}let In=0;for(let G of n.literalLoads.get(E.rel)??[]){let J=[];for(let ae of G.targetRels){let we=l.get(ae);we!==void 0&&J.push(we.toplevelId)}if(J.length===0)continue;let ee=`${E.rel}#load${String(In)}`;In+=1,y.push({id:ee,enclosingFunctionId:Y(G.pos),calleeExprShape:G.shape,resolvedTargetIds:J,resolution:"resolved",range:{path:E.rel,start:G.pos,end:G.pos}});for(let ae of J)_.push({callSiteId:ee,calleeFunctionId:ae,resolution:"resolved"})}let Kn=0;for(let G of s.get(E.rel)??[]){let J=`${E.rel}#handlerseed${String(Kn)}`;Kn+=1;let ee=G.node.getStart(E.sf,!1);y.push({id:J,enclosingFunctionId:E.toplevelId,calleeExprShape:"member",resolvedTargetIds:[G.id],resolution:"field-based",range:{path:E.rel,start:ee,end:ee}}),_.push({callSiteId:J,calleeFunctionId:G.id,resolution:"field-based"})}}let V=new Map;if(i)for(let E of l.values())for(let[D,L]of E.mintSeedAliases)V.set(`${E.rel}::${String(D)}`,L);return{functions:h.map(E=>{let D=R.get(E.id);if(D===void 0||E.sourceParams!==void 0)return E;let L=v.get(E.id);return{...E,sourceParams:[{index:I.get(E.id)??No(D,E.params?.length??0),sourceClass:D.sourceClass,model:D.id,...L!==void 0?{registeredAt:L}:{}}]}}),callSites:y,callEdges:_,exports:S,exportBindings:b,classes:k,mintSeedAliases:V,bindingApplicability:a}}function GS(e,n,t){let s=l=>l.length===0||On.isAbsolute(l)||l.includes("\\")||/^[a-zA-Z]:/u.test(l)||l.split("/").some(d=>d===".."||d==="");if(s(n)||s(t))return null;let o=e.endsWith(On.sep)?e:e+On.sep,r;try{r=zu(On.resolve(e,n))}catch{return null}if(!r.startsWith(o))return null;let i=r.endsWith(On.sep)?r:r+On.sep,a;try{a=zu(On.resolve(r,t))}catch{return null}return a.startsWith(i)?a:null}function mf(e,n,t){let s=`${e}#class:${t}`,o=[],r=[],i=[],a=new Set;return{pushMember(l,d,c,p){if(l==="__proto__"||a.has(l))return;a.add(l);let u=`${e}#${t}.${l}`;o.push({id:u,moduleId:e,name:l,kind:c,enclosingClassId:s,declRange:_t(e,d,n),isExported:!1,publicSurfaceReachable:!1}),i.push(u),r.push({name:l,id:u,kind:c,body:p})},finish(){return r.length===0?null:{functions:o,classNode:{id:s,moduleId:e,name:t,implementsRefs:[],members:i},members:r}}}}function KS(e,n,t,s){if(pf(s)||s.members.length>Fa)return null;let o=mf(e,n,t);for(let r of s.members){let i,a,l;if(g.isConstructorDeclaration(r))i="constructor",a="ctor",l=void 0;else if(g.isMethodDeclaration(r))i=Fr(r.name),a="method",l=i!==void 0&&!js.has(i)?r.body??void 0:void 0;else continue;i!==void 0&&o.pushMember(i,r,a,l)}return o.finish()}function zS(e,n,t){let s;for(let i of n.statements)if(g.isFunctionDeclaration(i)&&i.name?.text===t){s=i;break}if(s===void 0)return null;let o=[];for(let i of n.statements){if(!g.isExpressionStatement(i))continue;let a=i.expression;if(!g.isBinaryExpression(a)||a.operatorToken.kind!==g.SyntaxKind.EqualsToken)continue;let l=a.left;if(g.isPropertyAccessExpression(l)&&g.isPropertyAccessExpression(l.expression)&&g.isIdentifier(l.expression.expression)&&l.expression.expression.text===t&&l.expression.name.text==="prototype"){let d=l.name.text;g.isFunctionExpression(a.right)?o.push({name:d,fn:a.right,walk:!0}):g.isArrowFunction(a.right)&&o.push({name:d,fn:a.right,walk:!1})}}if(o.length===0||o.length+1>Fa)return null;let r=mf(e,n,t);r.pushMember("constructor",s,"ctor",void 0);for(let i of o){let a=i.walk&&!js.has(i.name)&&g.isFunctionExpression(i.fn)?i.fn.body:void 0;r.pushMember(i.name,i.fn,"method",a)}return r.finish()}function US(e,n,t){for(let s of n.statements)if(g.isClassDeclaration(s)&&s.name?.text===t)return KS(e,n,t,s);return zS(e,n,t)}function WS(e,n,t,s,o){let r={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return r;let i=new Set(t.map(p=>p.packageName)),a=new Set(t.map(p=>p.path)),l=new Set,d=new Set,c=0;for(let p of n){if(!i.has(p.packageName))continue;let u=GS(e.appRoot,p.packageRootRel,p.sourcePath);if(u===null)continue;let f=e.toRel(u);if(f===null)continue;let m=`${f}#${p.container}`;if(d.has(m)||!l.has(f)&&l.size>=Lr)continue;let h=gn(u);if(h===null)continue;let y;try{y=g.createSourceFile(f,h,g.ScriptTarget.Latest,!0,g.ScriptKind.JS)}catch{continue}let _=US(f,y,p.container);if(_===null)continue;l.add(f),d.add(m);let S=new Map,b=new Map;for(let w of _.members){let N=o.methodFor(p.packageName,p.container,w.name,w.kind);S.set(w.name,N),b.set(N,w.id)}let k=0;for(let w of _.members){if(w.body===void 0)continue;let N=(R,v)=>{if(v&&g.isCallExpression(R)&&g.isPropertyAccessExpression(R.expression)&&R.expression.expression.kind===g.SyntaxKind.ThisKeyword){let B=S.get(R.expression.name.text);if(B!==void 0){let O=`${f}#depclass:${p.container}.${w.name}#c${String(k)}`;k+=1,r.callSites.push({id:O,enclosingFunctionId:w.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:_t(f,R,y)}),r.callEdges.push({callSiteId:O,calleeFunctionId:B,resolution:"field-based"})}}let I=g.isFunctionExpression(R)||g.isFunctionDeclaration(R)||g.isMethodDeclaration(R)||g.isConstructorDeclaration(R)||g.isGetAccessorDeclaration(R)||g.isSetAccessorDeclaration(R)||g.isClassLike(R),A=g.isArrowFunction(R)?v:I?!1:v;g.forEachChild(R,B=>{N(B,A)})};N(w.body,!0)}for(let w of s){let N=b.get(w.calleeFunctionId);N!==void 0&&r.callEdges.push({callSiteId:w.callSiteId,calleeFunctionId:N,resolution:"field-based"})}if(r.functions.push(..._.functions),r.classes.push(_.classNode),!a.has(f)){a.add(f),r.modules.push({id:f,packageName:p.packageName,versionRange:"",path:f,moduleSystem:"cjs",isEntrypoint:!1});let w=o.moduleFor(p.packageName),N=`${String(w)}#depclass${String(c)}`;c+=1,r.imports.push({id:N,moduleId:w,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),r.importEdges.push({importId:N,resolvedModuleId:f})}r.diagnostics.push({code:"dep-class-corridor",path:f,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(_.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return r}function HS(e,n,t,s){let o=new Set(e.modules.filter(l=>l.isEntrypoint).map(l=>l.packageName)),r=new Map(e.functions.map(l=>[l.id,l.moduleId])),i=new Map;for(let l of e.callSites){if(l.resolution!=="unresolved")continue;let d=r.get(l.enclosingFunctionId);d!==void 0&&i.set(d,(i.get(d)??0)+1)}let a=[];for(let l of e.modules){if(l.externalSurface===!0)continue;let d=n.get(l.path);if(d===void 0||t.has(l.path)||o.has(l.packageName)&&s.has(l.path)&&!l.path.split("/").includes("node_modules"))continue;let c=i.get(l.id)??0;if(c===0&&NS(d))continue;let p=c>0?`${String(c)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:l.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:l.id})}return a}function hf(e,n,t=[],s={},o=!1){let r=new $a,i=tS(e,n,r),a=new Set;for(let k of i.computedLoads.values())for(let w of k)if(w.seedable)for(let N of w.candidateRels)a.add(N);let l=new Map;for(let k of e.sourceFiles){let w=e.toRel(k.fileName);if(w===null||!a.has(w)||w.split("/").includes("node_modules"))continue;let N=$S(w,k);N.length>0&&l.set(w,N)}let d=l.size===0?i.modules:i.modules.map(k=>l.has(k.path)&&!k.isEntrypoint?{...k,isEntrypoint:!0}:k),c={...i,modules:d},p=BS(e,c,r,l,s),u=ES(e,i,p.functions,p.mintSeedAliases),f=new Set(i.modules.map(k=>k.path)),m=rS(e.depReach,r,f),h=[...c.modules,...m.modules,...r.modules()],y=WS(e,t,h,p.callEdges,r),_=[];if(o){let k="#default",w=new Set;for(let R of p.callEdges){let v=String(R.calleeFunctionId);!v.startsWith("pkg:")||!v.endsWith(k)||w.add(v.slice(4,v.length-k.length))}let N=new Map;for(let R of e.depReach.edges){if(!("surface"in R.from)||"surface"in R.to)continue;let v=R.from.surface;N.set(v,N.has(v)?null:R.to.module)}for(let R of w){let v=N.get(R);if(v==null)continue;let I=sS(On.join(e.appRoot,v));if(I===null||I==="default")continue;let A=r.exportFor(R,I),B=`pkg:${R}${k}`;for(let O of p.callEdges)String(O.calleeFunctionId)===B&&_.push({callSiteId:O.callSiteId,calleeFunctionId:A,resolution:"field-based"})}}let S={modules:[...c.modules,...m.modules,...y.modules,...r.modules()],exports:[...p.exports,...u.exports],imports:[...i.imports,...m.imports,...y.imports],functions:[...p.functions,...r.functions(),...y.functions],callSites:[...p.callSites,...y.callSites],classes:[...p.classes,...r.classes(),...y.classes],callEdges:[...p.callEdges,...y.callEdges,..._],importEdges:[...i.importEdges,...m.importEdges,...y.importEdges],exportBindings:[...p.exportBindings,...u.exportBindings],inheritEdges:[]},b=new Map;for(let k of e.sourceFiles){let w=e.toRel(k.fileName);w!==null&&b.set(w,k)}return{graph:S,diagnostics:[...u.diagnostics,...y.diagnostics,...HS(S,b,new Set(e.diagnostics.filter(k=>k.code==="dependency-body").map(k=>k.path)),i.appOwnedPaths)],loadSites:i.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var qS=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,jr=/^[A-Za-z0-9_$.-]{1,128}$/u;function VS(e){return qS.test(e.calleePackage)?jr.test(e.anchorExport)?jr.test(e.calleeExport)?e.anchorContainer!==null&&!jr.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!jr.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Ro(e,n){let t=[],s=[],o=new Map(e.modules.map(d=>[d.id,d])),r=new Map(e.classes.map(d=>[d.id,d.name])),i=(d,c,p)=>e.functions.some(u=>{if(u.name!==c)return!1;let f=o.get(u.moduleId);return f===void 0||f.packageName!==d?!1:(u.enclosingClassId!==void 0?r.get(u.enclosingClassId)??null:null)===p}),a=(d,c,p)=>{for(let u of e.functions){if(u.name!==c)continue;let f=o.get(u.moduleId);if(!(f===void 0||f.packageName!==d||(u.enclosingClassId!==void 0?r.get(u.enclosingClassId)??null:null)!==p))return u.id}return null},l=[...n].sort((d,c)=>d.modelId<c.modelId?-1:d.modelId>c.modelId?1:0);for(let d of l){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let c=d.edges.map(VS).find(f=>f!==null);if(c!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${c} \u2014 model refused WHOLE`);continue}let p=0,u=0;for(let f of d.edges){if(!i(d.packageName,f.anchorExport,f.anchorContainer)){u+=1;continue}s.push({modelId:d.modelId,kind:f.kind,anchor:{packageName:d.packageName,exportName:f.anchorExport,container:f.anchorContainer},callee:{packageName:f.calleePackage,exportName:f.calleeExport,container:f.calleeContainer,realFunctionId:a(f.calleePackage,f.calleeExport,f.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${d.modelId}: ${String(p)} edge(s) lowered, ${String(u)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(u)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:s,notes:t}}}var XS={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Ha(e){try{let n=yu(e.appRoot,e.entrypoints,e.tsconfigPaths===!0,new Set((e.executedEntrypoints??[]).map(a=>a.split(Pn.sep).join("/")))),t=new Set(e.entrypoints.map(a=>a.split(Pn.sep).join("/"))),{graph:s,diagnostics:o,loadSites:r,bindingApplicability:i}=hf(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:s,diagnostics:[...n.diagnostics,...o],loadSites:r,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...i!==void 0?{bindingApplicability:i}:{}}}catch(n){return{graph:XS,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function gf(e,n){let t=512,s=(o,r,i)=>{if(!(t<=0||r>12)){if(t-=1,typeof o=="string"){n(o,i);return}if(Array.isArray(o)){for(let a of o)s(a,r+1,i);return}if(o!==null&&typeof o=="object")for(let[a,l]of Object.entries(o))a==="types"||a==="typings"||s(l,r+1,i||a.includes("*"))}};s(e,0,!1)}function bf(e,n,t,s=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let o;try{o=Tt(Pn.resolve(e,t))}catch{return null}return o!==e&&!o.startsWith(n)||s&&!yt(o)?null:o===e?"":o.slice(n.length).split(Pn.sep).join("/")}var YS=1024*1024,JS=4096;function yf(e,n){let t=e.toLowerCase(),s=0;for(;;){let o=t.indexOf(n,s);if(o===-1)return null;let r=o===0?" ":t[o-1],i=o+n.length;for(;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
+`||e[i]==="\r");)i+=1;if(/[a-z0-9_:-]/i.test(r??" ")||e[i]!=="="){s=o+n.length;continue}for(i+=1;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
+`||e[i]==="\r");)i+=1;let a=e[i];if(a==='"'||a==="'"){let d=e.indexOf(a,i+1);return d===-1?null:e.slice(i+1,d)}let l=i;for(;l<e.length&&!/[\s>]/.test(e[l]??"");)l+=1;return e.slice(i,l)}}function ZS(e){let n=[],t=e.toLowerCase(),s=0;for(;;){let o=t.indexOf("<script",s);if(o===-1)break;let r=t[o+7];if(r!==void 0&&/[a-z0-9-]/.test(r)){s=o+7;continue}let i=e.indexOf(">",o);if(i===-1)break;s=i+1;let a=e.slice(o+7,i);if(a.length>JS)continue;let l=yf(a,"type");n.push({module:(l??"").trim().toLowerCase()==="module",src:yf(a,"src")})}return n}function QS(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function ex(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function nx(e){let n=Tt(e),t=n.endsWith(Pn.sep)?n:n+Pn.sep,s=new Set,o=[],r=[],i=[],a=[],l=[],d=!1,c=(E,D,L=!1,K)=>{let Y=bf(n,t,E);return Y===null||Y.length===0?"unresolved":s.has(Y)?"duplicate":(s.add(Y),o.push(Y),r.push({source:D,specifier:jn(K??(typeof E=="string"?E:"")),entrypoint:Y,launch:L}),"added")},p=new Set,u=(E,D,L=!1)=>{let K=c(E,D),Y=typeof E=="string"&&E.includes("\\")?c(E.split("\\").join("/"),D,!1,E):"unresolved";if(K!=="unresolved"||Y!=="unresolved"||typeof E!="string"||E.trim().length===0||E.endsWith(".d.ts")||E.endsWith(".d.mts")||E.endsWith(".d.cts"))return;if(L&&E.includes("*")){let z=bu(n,E),Z=!1;if(z!==null){for(let de of z.matches)c(de,D,!1,E)!=="unresolved"&&(Z=!0);if(!z.truncated&&Z)return}a.push({source:D,file:"package.json",detail:`\`${jn(E)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let le=`${D}\0${E}`;p.has(le)||(p.add(le),a.push({source:D,file:"package.json",detail:`\`${jn(E)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},f=[],m=(E,D)=>{i.push({source:E,file:E,detail:D.detail}),f.push({code:D.code,path:E,detail:`${E} ${D.detail}`})},h,y,_,S=null,b=Br(n,t,"package.json",Yt);b.kind==="refused"&&m("package.json",b);try{let E=b.kind==="ok"?JSON.parse(b.text):{};if(S=b.kind==="ok"?E:null,u(E.main,"main"),typeof E.bin=="string")u(E.bin,"bin");else if(E.bin!==null&&typeof E.bin=="object")for(let L of Object.values(E.bin))u(L,"bin");gf(E.exports,(L,K)=>{u(L,"exports",K)}),typeof E.browser=="string"?u(E.browser,"browser"):gf(E.browser,L=>{c(L,"browser")});let D=E.scripts;if(D!==null&&typeof D=="object"){let L=D;h=L.start,y=L.prestart,_=L.poststart}}catch{}if(o.length===0)try{Tt(Pn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let k=(E,D)=>{if(typeof E=="string"&&E.trim().length>0){let L=Ua(E,D,"package.json",c,i,!1)==="used";return L&&(d=!0),L?"resolved":"gapped"}return E===void 0||typeof E=="string"?"absent":(i.push({source:D,file:"package.json",detail:`${D} is not a string; no entry file could be read from it`}),"gapped")},w=k(h,"scripts.start"),N=k(y,"scripts.prestart"),R=k(_,"scripts.poststart"),v=w==="resolved"&&N!=="gapped"&&R!=="gapped",I=Br(n,t,"Procfile",65536);if(I.kind==="refused")m("Procfile",I);else if(I.kind==="ok"){let{entries:E,truncated:D,unnamedLines:L}=Na(I.text);D&&i.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),L>0&&i.push({source:"Procfile",file:"Procfile",detail:`${String(L)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let K of E)Ua(K.command,`Procfile:${K.name}`,"Procfile",c,i,v)==="used"&&(d=!0)}for(let E of["Dockerfile","docker-compose.yml","docker-compose.yaml","compose.yml"]){let D=Br(n,t,E,Ea);if(D.kind==="refused"){m(E,D);continue}if(D.kind!=="ok")continue;let{commands:L,truncated:K}=Aa(D.text);K&&i.push({source:E,file:E,detail:`${E} declares more launch commands than cupel parses; the remainder was not read`});for(let Y of L)Ua(Y.command,`${E}:${Y.label}`,E,c,i,v)==="used"&&(d=!0)}let A=o.length===0,B=Br(n,t,"index.html",YS);if(B.kind==="ok")for(let E of ZS(B.text)){if(E.src===null)continue;let D=jn(E.src);if(!E.module){l.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${D}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(QS(E.src)){l.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${D}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}c(ex(E.src),"index.html",!1,E.src)==="unresolved"&&i.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${D}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else B.kind==="refused"&&l.push({kind:B.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${B.detail}`,root:""});let O=A?Sa(n,S):null;if(O!==null){let E=0;for(let D of ka(n,O).roots)c(D,`framework:${O.name}`)==="added"&&(E+=1);E>0&&f.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${O.name}'s directory conventions (recognised via ${O.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let V=E=>E.map(D=>({...D,root:""}));return{entrypoints:o,sources:V(r),gaps:V(i),surfaceGaps:V(a),launchResolved:d,diagnostics:f,framework:O,observations:l}}function Br(e,n,t,s){let o;try{o=Tt(Pn.join(e,t))}catch{return{kind:"absent"}}if(!o.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let r=$s(o,s);return r.kind==="ok"?r:r.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(r.bytes)} bytes, over the ${String(s)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Ua(e,n,t,s,o,r){let i=va(e);if(i.kind==="delegates")return r?"used":(o.push({source:n,file:t,detail:`\`${jn(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(i.kind==="foreign")return"foreign";if(i.kind==="unparsed")return o.push({source:n,file:t,detail:`\`${jn(e)}\`: ${i.reason}`}),"gapped";let a=s(i.specifier,n,!0),l=i.alt===void 0?"unresolved":s(i.alt,n,!0);return a==="unresolved"&&l==="unresolved"?(o.push({source:n,file:t,detail:`\`${jn(i.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function Gs(e,n){return e===""?n:`${e}/${n}`}function Sf(e,n){let t=Tt(e),s=t.endsWith(Pn.sep)?t:t+Pn.sep,o=new Set,r=[],i=[],a=[],l=[],d=[],c=[],p=!1,u=null,f=[...n].sort((m,h)=>m.rel===""?-1:h.rel===""?1:m.rel<h.rel?-1:m.rel>h.rel?1:0);for(let m of f){let h=Gs(m.rel,"package.json"),y=m.rel===""?".":m.rel,_;try{_=Tt(m.abs)}catch{a.push({source:"root",file:h,detail:`root \`${y}\` could not be resolved; not seeded`,root:m.rel});continue}if(_!==t&&!_.startsWith(s)){a.push({source:"root",file:h,detail:`root \`${y}\` resolves outside the scan root; refused, not seeded`,root:m.rel});continue}let S;try{S=nx(_)}catch{a.push({source:"root",file:h,detail:`root \`${y}\` could not be read; not seeded`,root:m.rel});continue}for(let b of S.sources){let k=Gs(m.rel,b.entrypoint),w,N;try{w=Tt(Pn.resolve(t,k)),N=Tt(Pn.resolve(_,b.entrypoint))}catch{a.push({source:b.source,file:h,detail:`\`${b.specifier}\` re-based to \`${k}\` did not resolve; not seeded`,root:m.rel});continue}if(!w.startsWith(s)||w!==N){a.push({source:b.source,file:h,detail:`\`${b.specifier}\` re-based to \`${k}\` escapes the scan root or names another file; refused, not seeded`,root:m.rel});continue}o.has(k)||(o.add(k),r.push(k),i.push({...b,entrypoint:k,root:m.rel}))}S.launchResolved&&(p=!0);for(let b of S.gaps)a.push({...b,file:Gs(m.rel,b.file),root:m.rel});for(let b of S.surfaceGaps)l.push({...b,file:Gs(m.rel,b.file),root:m.rel});for(let b of S.diagnostics)d.push({...b,path:Gs(m.rel,b.path)});for(let b of S.observations)c.push({...b,file:Gs(m.rel,b.file),root:m.rel});m.rel===""&&(u=S.framework)}return{entrypoints:r,sources:i,gaps:a,surfaceGaps:l,launchResolved:p,diagnostics:d,framework:u,observations:c}}function qa(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let s=n.slice(0,3).map(o=>o.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${s}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Va(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let s=[...new Set(t.slice(0,3).map(o=>o.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${s}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function xf(e,n){let t=Tt(e),s=t.endsWith(Pn.sep)?t:t+Pn.sep,o=new Set,r=[],i=[];for(let a of n){let l=bf(t,s,a,!0);if(l===null||l.length===0){i.push(a);continue}o.has(l)||(o.add(l),r.push(l))}return{entrypoints:r,rejected:i}}import{readdirSync as ip,readFileSync as ml,realpathSync as hl,statSync as zo}from"node:fs";import it from"node:path";function tx(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let s=t+2;for(;s<e.length&&e.charCodeAt(s)===32;)s+=1;let o=e.charCodeAt(s);return o===38||o===42}function tt(e,n,t){let s=n.maxLines??2e6,o=n.maxLineBytes??16384,r=!1,i=!1,a=0,l=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let c=e.indexOf(`
+`,d),p=c===-1;p&&(c=e.length);let u=c>d&&e.charCodeAt(c-1)===13?c-1:c;if(l+=1,l>s){r=!0;break}if(u-d>o)a+=1;else{let f=d;for(;f<u&&e.charCodeAt(f)===32;)f+=1;let m=f-d,h=u;for(;h>f&&(e.charCodeAt(h-1)===32||e.charCodeAt(h-1)===9);)h-=1;if(f<h&&e.charCodeAt(f)!==35){let y=e.slice(f,h);if(tx(y)){i=!0;break}t(m,y)}}if(p)break;d=c+1}return{truncated:r||a>0,refusedAnchors:i,oversizeLines:a}}function St(e){let n=e.charCodeAt(0);if(n===34||n===39){let s=e.indexOf(String.fromCharCode(n),1);if(s===-1)return null;let o=s+1;for(;o<e.length&&e.charCodeAt(o)===32;)o+=1;return e.charCodeAt(o)===58?e.slice(0,s+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function Vn(e){return e.endsWith(":")}function $e(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function Gr(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,s=t.indexOf("/");if(n){if(s<=0||t.indexOf("/",s+1)!==-1)return!1}else if(s!==-1)return!1;let o=n?[t.slice(0,s),t.slice(s+1)]:[t];for(let r of o){if(r.length===0||r.charCodeAt(0)===46||r.charCodeAt(0)===95)return!1;for(let i=0;i<r.length;i+=1){let a=r.charCodeAt(i);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function Oo(e){return Gr(e)?`node_modules/${e}`:""}function Po(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Kr=2e5,kf=64,zr=1024,sx=5,ox=[1,2,3];function rx(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let s=e.slice(t+n.length);if(s==="")return null;let o=s.split("/");return o[0]?.startsWith("@")?o.length>=2?`${o[0]}/${o[1]}`:null:o[0]??null}function wf(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let s=t.indexOf("@",1);if(s>0){let o=t.slice(0,s),r=t.slice(s+1);if(o.length>0&&r.length>0)return[{name:o,version:r}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function st(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function vf(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Ef(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Af(e,n,t,s,o=!1){let r=JSON.stringify([n,t,s]);if(!e.seen.has(r)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(r),e.deps.push({name:n,version:t,lockKey:s,dev:o})}}function ix(e,n){for(let[t,s]of Object.entries(e)){if(t==="")continue;if(!Ef(n))return;let o=t.startsWith("node_modules/")||t.includes("/node_modules/"),r=st(s);if(r===null){n.unread+=1;continue}if(r.link===!0)continue;let i=r.name,a=typeof i=="string"&&i!==""?i:rx(t),l=r.version;if(a===null||typeof l!="string"){o&&(n.unread+=1);continue}let d=r.dev===!0||r.devOptional===!0;for(let c of wf(a,l))Af(n,c.name,c.version,t,d)}}function Nf(e,n,t){let s=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],o=!1;for(let r=0;r<s.length;r+=1){let i=s[r];if(i===void 0)break;for(let[a,l]of Object.entries(i.deps)){if(!Ef(n))return{depthCapped:o};if(a===""){n.unread+=1;continue}let d=st(l);if(d===null){n.unread+=1;continue}let c=i.pathSafe&&Gr(a),p=c?`${i.prefix}node_modules/${a}`:"",u=c&&p.length<=zr,f=u?p:"",m=d.version,h=d.dev===!0||i.dev;if(d.link!==!0&&typeof m=="string"&&m!=="")for(let _ of wf(a,m))Af(n,_.name,_.version,f,h);else n.unread+=1;let y=st(d.dependencies);if(y!==null){if(i.depth+1>t){o=!0;continue}s.push({deps:y,prefix:u?`${f}/`:i.prefix,depth:i.depth+1,pathSafe:u,dev:h})}}}return{depthCapped:o}}function ax(e,n,t){let s=vf(n.maxEntries),{depthCapped:o}=Nf(e,s,t),r=[],i=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),a=new Set,l=[];for(let d of s.deps){if(d.version.includes(":"))continue;let c=JSON.stringify([d.name,d.version]);i.has(c)||a.has(c)||(a.add(c),l.length<sx&&l.push(Po(d.name,d.version)))}if(a.size>0){let d=a.size-l.length;r.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${l.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(s.capped||o)&&r.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),r}function Ur(e,n={}){let t=[],s;try{s=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let o=st(s);if(o===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let r=o.lockfileVersion,i=typeof r=="number"&&Number.isInteger(r)?r:null,a=typeof r=="number"?String(r):"?",l=st(o.packages),d=st(o.dependencies);if(l===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(i===null||!ox.includes(i))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let c=n.maxDepth??kf,p=vf(n.maxEntries??Kr),u=!1;return l!==null?(ix(l,p),d!==null&&t.push(...ax(d,p,c))):d!==null&&(u=Nf(d,p,c).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),u&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(c)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||u}}var lx=["workspace:","link:","portal:","file:","exec:"];function dx(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Xa(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let s=n.slice(0,t),o=n.slice(t+1);if(s.length===0)return[];for(let a of lx)if(o.startsWith(a))return[];if(!o.startsWith("npm:"))return[s];let r=o.slice(4),i=r.indexOf("@",1);if(i>0){let a=r.slice(0,i);return a.length>0?[a]:[s]}return r.length===0||dx(r)?[s]:[s,r]}function cx(e){if(Vn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let s=e.charCodeAt(t);if(s===34||s===39){n===0?n=s:n===s&&(n=0);continue}if(n===0&&s===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function ux(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let s of n.split(",")){let o=s.trim();o.length>0&&t.push(o)}return t}function fx(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let s=t.length;for(;s<n.length&&s<t.length+3;){let r=n.charCodeAt(s);if(r<48||r>57)break;s+=1}let o=n.slice(t.length,s);return o.length>0?o:null}function If(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=$e(e.slice(8).trim());return t.length>0?t:null}function Ya(e,n={}){let t=[],s=[],o=new Set,r=n.maxEntries??2e5,i=!1,a=null,l=!1,d=[],c=!1,p=-1,u=!1,f=0,m=()=>{d.length>0&&!c&&(f+=1)},h=tt(e,n,(b,k)=>{if(b===0){m(),d=[],c=!1,p=-1,l=!1;let N=cx(k);if(N===null)return;let R=$e(N.trim());if(R==="__metadata"){i=!0,l=Vn(k);return}for(let v of ux(R))d.push(...Xa(v));return}if(l){if(b===2&&a===null){let N=If(k);N!==null&&(a=N)}return}if(d.length===0||(p===-1&&(p=b),b!==p||c))return;let w=If(k);if(w!==null){c=!0;for(let N of d){let R=JSON.stringify([N,w]);if(!o.has(R)){if(s.length>=r){u=!0;return}o.add(R),s.push({name:N,version:w,lockKey:Oo(N),dev:!1})}}}});m();let y=i?"yarn.lock (Berry)":"yarn.lock (v1)";if(h.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};h.oversizeLines>0&&t.push(`${y} has ${String(h.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),u&&t.push(`${y} exceeds ${String(r)} entries; truncated`);let _=a??fx(e),S=_===null?null:Number(_.split(".")[0]);return _!==null&&(S===null||!Number.isInteger(S)||S<1||S>8)&&t.push(`${y} declares unsupported lockfileVersion ${_} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),f>0&&t.push(`${y} has ${String(f)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:s,diagnostics:t,truncated:h.truncated||u}}function Ja(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.indexOf("_");return s!==-1&&(n=n.slice(0,s)),n.trim()}function Za(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Hr(e){let n=$e(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.charCodeAt(0)===47;if(s&&(n=n.slice(1)),n.length===0)return null;if(!s&&n.charCodeAt(0)!==64){let c=n.indexOf("/"),p=n.indexOf("@",1);c>0&&(p===-1||c<p)&&n.slice(0,c).includes(".")&&n.indexOf("/",c+1)!==-1&&(n=n.slice(c+1))}let o=n.charCodeAt(0)===64,r=o?n.indexOf("/"):-1;if(o&&r<=0)return null;let i=o?r+1:0,a=-1;for(let c=i;c<n.length;c+=1){let p=n.charCodeAt(c);if(p===47||p===64){a=c;break}}if(a<=i)return null;let l=n.slice(0,a),d=Ja(n.slice(a+1));return Za(d)?{name:l,version:d}:null}var px=new Set(["packages","snapshots","importers"]),mx=new Set([5,6,7,8,9]);function hx(e){let n=$e(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function Wr(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:$e(e.slice(0,n).trim()),value:$e(t)}}function Qa(e,n={}){let t=[],s=[],o=new Set,r=n.maxEntries??2e5,i="",a=null,l=!1,d=0,c=[],p=(f,m)=>{let h=JSON.stringify([f,m]);if(!o.has(h)){if(s.length>=r){l=!0;return}o.add(h),s.push({name:f,version:m,lockKey:Oo(f),dev:!1})}},u=tt(e,n,(f,m)=>{if(f===0){let h=St(m);if(i=h===null?"":$e(h.trim()),a=null,i==="lockfileVersion"){let y=Wr(m),_=y===null?null:hx(y.value);y!==null&&(_===null||!mx.has(_))&&c.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),i="";return}if(px.has(i)&&!Vn(m)){let y=Wr(m)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(d+=1),i=""}return}if(i==="packages"||i==="snapshots"){if(f!==2)return;let h=St(m),y=h===null?null:Hr(h);if(y===null){d+=1;return}p(y.name,y.version);return}if(i==="importers"){if(f===6){let h=Wr(m);if(h===null){a=m.endsWith(":")?$e(m.slice(0,-1).trim()):null;return}a=null;let y=Ja(h.value);Za(y)&&p(h.key,y);return}if(f===8&&a!==null){let h=Wr(m);if(h===null||h.key!=="version")return;let y=Ja(h.value);Za(y)&&p(a,y)}}});return u.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...c),u.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(u.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),l&&t.push(`pnpm-lock.yaml exceeds ${String(r)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:s,diagnostics:t,truncated:u.truncated||l})}function xt(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var Pf=1e6,Rf=2e5,gx=4096,yx=65536,_x=262144,Co=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Cf(e){let n=[];for(let t of e.split(/\r?\n/u)){if(t==="")break;let s=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(t);s!==null&&n.push([(s[1]??"").toLowerCase(),s[2]??""])}return n}function Mf(e){if(e.length>Pf)return null;let n,t;for(let[s,o]of Cf(e))s==="name"&&n===void 0?n=o.trim():s==="version"&&t===void 0&&(t=o.trim());return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}var bx=/^([A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)/u;function Tf(e){if(e.length>Pf)return[];let n=new Set;for(let[t,s]of Cf(e)){if(t!=="requires-dist")continue;let o=bx.exec(s.trim())?.[1];o!==void 0&&n.add(xt(o))}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function $f(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&Co.test(n))}function Lf(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let s=e[t];if(s==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=s}return n}function Df(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Ff(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function jf(e){let n=e.split(/\r?\n/u);return n.length>Rf?n.slice(0,Rf):n}function Bf(e){let n=new Set;for(let t of jf(e)){if(t==="")continue;let s=Lf(t).split("/"),o=s[0]??"";if(Df(o))continue;if(s.length>1){Co.test(o)&&n.add(o);continue}let r=Ff(o);r!==null&&Co.test(r)&&n.add(r)}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function Sx(e){let n=e.split("/"),t=n[0]??"";if(Df(t))return null;let s=n[n.length-1]??"",o=Ff(s);if(o===null)return null;let r=n.slice(0,-1);if(r.some(a=>!Co.test(a)||a==="__pycache__"))return null;let i=o==="__init__"?r:[...r,o];return i.length===0||!Co.test(o==="__init__"?r[r.length-1]??"":o)?null:i}function Gf(e,n=gx){let t=new Set,s=0,o=0,r=!1;for(let i of jf(e)){if(i==="")continue;let a=Lf(i),l=Sx(a);if(l!==null){s+=1,(a.endsWith(".so")||a.endsWith(".pyd"))&&(o+=1);for(let d=1;d<=Math.min(2,l.length);d+=1){let c=l.slice(0,d).join(".");if(!t.has(c)){if(t.size>=n){r=!0;break}t.add(c)}}}}return{prefixes:[...t].sort((i,a)=>i<a?-1:i>a?1:0),moduleFiles:s,extensionModules:o,capped:r}}function xx(e){if(e.length>_x)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let s=t.trim();if(!(s===""||s.startsWith("#")||s.startsWith(";"))){if(s.startsWith("[")){let o=s.slice(1,s.endsWith("]")?-1:void 0).trim();n=o==="console_scripts"||o==="gui_scripts";continue}if(n&&s.includes("="))return!0}}return!1}function Kf(e){if(e.length>yx)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,s=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:s?.editable===!0}}function Mo(e,n){let t=Mf(e);if(t===null)return null;let s=n.topLevelText!==void 0?$f(n.topLevelText):[],o=s.length>0?s:n.recordText!==void 0?Bf(n.recordText):[],r=n.recordText!==void 0?Gf(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},i=n.entryPointsText!==void 0?xx(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",a=n.directUrlText!==void 0?Kf(n.directUrlText)?.editable??!1:!1;return{name:xt(t.name),version:t.version,importNames:o,modulePrefixes:r.prefixes,moduleFiles:r.moduleFiles,editable:a,consoleScripts:i,extensionModules:r.extensionModules,recordKnown:n.recordText!==void 0,requiresDist:Tf(e)}}function Of(e,n,t){let s=e.get(n);s===void 0?e.set(n,[t]):s.includes(t)||s.push(t)}function qr(e){let n=new Map,t=new Map,s=[];for(let o of e){if(o.importNames.length===0){s.push(o);continue}for(let r of o.importNames)Of(n,r,o);for(let r of o.modulePrefixes)Of(t,r,o)}return{byImportName:n,byModulePrefix:t,unmapped:s}}function To(e,n){let t=n.split(".").filter(o=>o.length>0),s=t[0];if(s===void 0)return[];for(let o=Math.min(2,t.length);o>=1;o-=1){let r=e.byModulePrefix.get(t.slice(0,o).join("."));if(r!==void 0&&r.length>0)return r}return e.byImportName.get(s)??[]}var $o=class{nodes=new Map;children=new Map;importers=new Map;over=!1;node(n,t,s){if(!this.nodes.has(n)){if(this.nodes.size>=2e5){this.over=!0;return}this.nodes.set(n,{name:t,version:s})}}edge(n,t){let s=this.children.get(n);s===void 0?this.children.set(n,[t]):s.includes(t)||s.push(t)}done(){return this.over||this.importers.size===0?null:{nodes:this.nodes,children:this.children,importers:this.importers}}},es="importer:",_s="node_modules/";function nl(e){let n;try{n=JSON.parse(e)}catch{return null}let t=st(st(n)?.packages);if(t===null)return null;let s=new $o,o=new Map;for(let[d,c]of Object.entries(t)){let p=st(c);p!==null&&o.set(d,p)}let r=d=>d.startsWith(_s)||d.includes(`/${_s}`),i=d=>{let c=d;for(let p=0;p<8;p+=1){let u=o.get(c);if(u===void 0)return null;if(u.link!==!0)return c;let f=u.resolved;if(typeof f!="string")return null;c=f}return null},a=d=>r(d)?d:`${es}${d}`,l=(d,c)=>{let p=d;for(;;){let u=p===""?`${_s}${c}`:`${p}/${_s}${c}`;if(o.has(u))return i(u);if(p==="")return null;let f=p.lastIndexOf(`/${_s}`);p=f===-1?"":p.slice(0,f)}};for(let[d,c]of o){if(c.link===!0)continue;let p=r(d);if(p){let f=typeof c.name=="string"&&c.name!==""?c.name:d.slice(d.lastIndexOf(_s)+_s.length),m=c.version;if(typeof m!="string")continue;s.node(d,f,m)}else s.importers.set(`${es}${d}`,d===""?"package.json":`${d}/package.json`);let u=p?["dependencies","optionalDependencies","peerDependencies"]:["dependencies","devDependencies","optionalDependencies","peerDependencies"];for(let f of u){let m=st(c[f]);if(m!==null)for(let h of Object.keys(m)){let y=l(d,h);y!==null&&y!==d&&s.edge(a(d),a(y))}}}return s.done()}function Vr(e){let n=St(e);if(n===null)return null;let t=e.slice(n.length+1).trim();return t.length===0?null:{key:$e(n.trim()),value:$e(t)}}var el=new Set(["dependencies","optionalDependencies","devDependencies"]);function tl(e,n={}){let t=new $o,s=[],o="",r=!1,i=null,a="",l=null,d=u=>u==="."||u===""?"package.json":`${u}/package.json`,c=(u,f,m,h)=>{if(m===f){let y=Vr(h);l=y===null&&Vn(h)?$e(h.slice(0,-1).trim()):null,y!==null&&s.push({from:u,name:y.key,token:y.value});return}if(m===f+2&&l!==null){let y=Vr(h);y?.key==="version"&&s.push({from:u,name:l,token:y.value})}},p=tt(e,n,(u,f)=>{if(u===0){let m=St(f);o=m===null?"":$e(m.trim()),o==="lockfileVersion"&&(r=(Vr(f)?.value??"").startsWith("5")),i=null,el.has(o)&&Vn(f)&&(i=`${es}.`,t.importers.set(i,"package.json"),a=o,l=null);return}if(el.has(o)){i!==null&&c(i,2,u,f);return}if(o==="importers"){if(u===2){let m=St(f),h=m===null?".":$e(m.trim());i=`${es}${h}`,t.importers.set(i,d(h)),a="";return}if(i===null)return;if(u===4){a=Vn(f)?$e(f.slice(0,-1).trim()):"",l=null;return}el.has(a)&&c(i,6,u,f);return}if(!(o!=="packages"&&o!=="snapshots")){if(u===2){let m=St(f);if(m===null){i=null;return}let h=$e(m.trim()),y=h.startsWith("/")?h.slice(1):h,_=Hr(h);i=_===null?null:y,_!==null&&t.node(y,_.name,_.version),a="";return}if(i!==null){if(u===4){a=Vn(f)?$e(f.slice(0,-1).trim()):"";return}if(u===6&&(a==="dependencies"||a==="optionalDependencies")){let m=Vr(f);m!==null&&s.push({from:i,name:m.key,token:m.value})}}}});if(p.refusedAnchors||p.truncated)return null;for(let u of s){if(u.token.startsWith("link:"))continue;let m=(u.token.startsWith("/")?u.token.slice(1):null)??(r?`${u.name}/${u.token}`:`${u.name}@${u.token}`);t.nodes.has(m)&&t.edge(u.from,m)}return t.done()}function kx(e,n){let t=e.indexOf("@npm:",1);return t<=0?null:e.slice(t+5)===n?e.slice(0,t):null}function sl(e,n,t={}){let s=new $o,o=new Map,r=[],i=null,a=-1,l=!1,d=-1,c=[],p=null,u=null,f=0,m=tt(e,t,(h,y)=>{if(h===0){l=!1,a=-1,p=null,u=null;let k=Vn(y)?y.slice(0,-1):null;if(i=null,c=[],k===null)return;let w=$e(k.trim());if(w==="__metadata"||(c=w.split(",").map(R=>$e(R.trim())).filter(R=>R.length>0),c.length===0))return;f+=1,i=`y${String(f)}`;for(let R of c)o.set(R,i);let N=c.find(R=>R.includes("@workspace:"));if(N!==void 0){let R=N.slice(N.indexOf("@workspace:")+11),v=`${es}${R}`;s.importers.set(v,R==="."||R===""?"package.json":`${R}/package.json`),i=v;for(let I of c)o.set(I,v)}return}if(i===null)return;if(a===-1&&(a=h),h===a){if(l=!1,y==="dependencies:"||y==="optionalDependencies:"){l=!0,d=-1;return}if(y.startsWith("version ")||y.startsWith("version:"))p=$e(y.slice(8).trim());else if(y.startsWith("resolution:"))u=$e(y.slice(11).trim());else return;let k=c[0];if(p!==null&&k!==void 0&&!i.startsWith(es)){let w=Xa(k);if(w.length===1&&w[0]!==void 0)s.node(i,w[0],p);else if(u!==null){let N=kx(u,p);N!==null&&s.node(i,N,p)}}return}if(!l||h<=a||(d===-1&&(d=h),h!==d))return;let _=St(y),S,b;if(_!==null&&y.charCodeAt(_.length)===58)S=$e(_.trim()),b=$e(y.slice(_.length+1).trim());else{let k=y.indexOf(" ");if(k<=0)return;S=$e(y.slice(0,k)),b=$e(y.slice(k+1).trim())}S.length>0&&b.length>0&&r.push({from:i,descriptor:`${S}@${b}`})});if(m.refusedAnchors||m.truncated)return null;if(s.importers.size===0){s.importers.set(`${es}.`,"package.json");for(let[h,y]of n)r.push({from:`${es}.`,descriptor:`${h}@${y}`})}for(let h of r){let y=h.descriptor.indexOf("@",1),_=h.descriptor.slice(y+1),S=_.includes(":")?h.descriptor:`${h.descriptor.slice(0,y)}@npm:${_}`,b=o.get(h.descriptor)??o.get(S);b!==void 0&&b!==h.from&&s.edge(h.from,b)}return s.done()}function ol(e,n,t,s){let o=new Map;for(let[k,w]of e.children)for(let N of w){let R=o.get(N);R===void 0?o.set(N,[k]):R.push(k)}let r=new Set,i=[...e.importers.keys()];for(let k=0;k<i.length;k+=1)for(let w of e.children.get(i[k])??[])r.has(w)||e.importers.has(w)||(r.add(w),i.push(w));let a=[...e.nodes].filter(([k,w])=>w.name===n&&w.version===t&&r.has(k)).map(([k])=>k).sort();if(a.length===0)return null;let l=new Map(a.map(k=>[k,0])),d=[...a];for(let k=0;k<d.length;k+=1){let w=d[k];for(let N of o.get(w)??[])l.has(N)||!r.has(N)||(l.set(N,(l.get(w)??0)+1),d.push(N))}let c=[...l.keys()].sort((k,w)=>(l.get(k)??0)-(l.get(w)??0)||(k<w?-1:k>w?1:0)),p=c.filter(k=>e.nodes.has(k)),u=c.length-p.length,f=new Map(p.map((k,w)=>[k,w])),m=[];for(let k of p)for(let w of e.children.get(k)??[])f.has(w)&&m.push([k,w]);let h=new Array(p.length).fill(0);for(let[k,w]of m){let N=Math.max(f.get(k)??0,f.get(w)??0);h[N]=(h[N]??0)+1}let y=0,_=0;for(;y<p.length&&y<s.maxNodes;){let k=h[y]??0;if(_+k>s.maxEdges)break;_+=k,y+=1}let S=new Map(p.slice(0,y).map((k,w)=>[k,`p${String(w)}`])),b=k=>{let N=(o.get(k)??[]).filter(R=>e.importers.has(R)).sort()[0];return N===void 0?null:e.importers.get(N)??null};return{nodes:p.slice(0,y).map(k=>{let w=e.nodes.get(k);return{id:S.get(k),name:w.name,version:w.version,directFrom:b(k)}}),edges:m.flatMap(([k,w])=>{let N=S.get(k),R=S.get(w);return N===void 0||R===void 0?[]:[{from:N,to:R}]}),truncated:p.length-y+u}}function rl(e){let n=new Map,t=new Set(["dependencies","devDependencies","optionalDependencies","peerDependencies"]),s=[],o=1,r=!1,i=e.charCodeAt(0)===65279?1:0;for(;i<e.length;){let a=e.charCodeAt(i);if(a===10)o+=1;else if(a===123||a===91){if(s.length>=64)return null;s.push({kind:a===123?"{":"[",key:null}),r=a===123}else if(a===125||a===93)s.pop(),r=!1;else if(a===44)r=s.at(-1)?.kind==="{";else if(a===58)r=!1;else if(a===34){let l=o,d=i+1;for(;d<e.length&&e.charCodeAt(d)!==34;){if(e.charCodeAt(d)===92)d+=1;else if(e.charCodeAt(d)===10)return null;d+=1}if(d>=e.length)return null;let c=s.at(-1);if(r&&c?.kind==="{"){let p;try{p=JSON.parse(e.slice(i,d+1))}catch{return null}c.key=p;let u=s.length===2?s[0]?.key:null;u!=null&&t.has(u)&&!n.has(p)&&n.set(p,l)}r=!1,i=d}i+=1}return s.length===0?n:null}var il="importer:";function Xr(e){let n=e.indexOf(" = ");if(n<=0)return null;let t=e.slice(n+3).trim();if(t.length<2||!t.startsWith('"')||!t.endsWith('"'))return null;let s=t.slice(1,-1);return s.includes('"')?null:{key:e.slice(0,n).trim(),value:s}}function wx(e){let n=[],t=0;for(;;){let s=e.indexOf('"',t);if(s===-1)return n;let o=e.indexOf('"',s+1);if(o===-1)return n;n.push(e.slice(s+1,o)),t=o+1}}function vx(e){let n=[],t=0;for(;;){let s=e.indexOf("{",t);if(s===-1)return n;let o=e.indexOf("}",s);if(o===-1)return n;let r=e.slice(s+1,o),i=[],a=r.indexOf("extra = [");if(a!==-1){let c=r.indexOf("]",a);c!==-1&&(i=wx(r.slice(a,c)),r=r.slice(0,a)+r.slice(c+1))}let l=null,d=null;for(let c of r.split(",")){let p=Xr(c.trim());p?.key==="name"?l=p.value:p?.key==="version"&&(d=p.value)}l!==null&&n.push({name:l,version:d,extras:i}),t=o+1}}function zf(e,n,t,s,o=new Map){if(s||n.size===0)return null;let r=new Map;for(let[d,c]of e){let p=r.get(c.name);p===void 0?r.set(c.name,[d]):p.push(d)}let i=new Map,a=[...t],l=new Set;for(let d=0;d<a.length;d+=1){let c=a[d],p=xt(c.name),u=r.get(p)??[],f=c.version!==null?`${p}@${c.version}`:u.length===1?u[0]??null:null;if(f===null||!e.has(f)||f===c.from)continue;let m=i.get(c.from);m===void 0?i.set(c.from,[f]):m.includes(f)||m.push(f);for(let h of c.extras){let y=JSON.stringify([f,h]);if(!l.has(y)){l.add(y);for(let _ of o.get(f)?.get(h)??[])a.push({from:f,..._})}}}return{nodes:e,children:i,importers:n}}function ll(e,n={}){let t=new Map,s=new Map,o=[],r=!1,i=null,a=null,l=null,d=[],c=new Map,p=new Map,u="",f=!1,m="",h=null,y=b=>{let k=vx(b);h===null?d.push(...k):c.set(h,[...c.get(h)??[],...k])},_=()=>{if(i===null)return;let b=xt(i),k=null;if(l!==null?(k=`${il}${l}`,s.set(k,l==="."?"pyproject.toml":`${l}/pyproject.toml`)):a!==null&&(k=`${b}@${a}`,t.size>=2e5?r=!0:t.set(k,{name:b,version:a})),k!==null){for(let w of d)o.push({from:k,...w});c.size>0&&p.set(k,c)}i=null,a=null,l=null,d=[],c=new Map},S=tt(e,n,(b,k)=>{if(f){m+=k,k.startsWith("]")&&(y(m),f=!1);return}if(k==="[[package]]"){_(),u="package";return}if(k.startsWith("[")){u=k==="[package.dev-dependencies]"?"dev":k==="[package.optional-dependencies]"?"optional":"other";return}if(u==="other")return;let w=k.indexOf(" = ");if(w<=0)return;let N=k.slice(0,w).trim(),R=k.slice(w+3).trim();if((u==="optional"||(u==="dev"?l!==null:N==="dependencies"))&&R.startsWith("[")){h=u==="optional"?N.replaceAll('"',""):null,R.endsWith("]")?y(R):(f=!0,m=R);return}if(u!=="package")return;if(N==="source"){let A=R.startsWith("{")&&R.endsWith("}")?R.slice(1,-1):"";for(let B of A.split(",")){let O=Xr(B.trim());(O?.key==="editable"||O?.key==="virtual")&&(l=O.value)}return}let I=Xr(k);I?.key==="name"?i=I.value:I?.key==="version"&&(a=I.value)});return _(),S.refusedAnchors||S.truncated?null:zf(t,s,o,r,p)}function dl(e,n,t={}){let s=new Map,o=new Map([[`${il}.`,"pyproject.toml"]]),r=n.map(f=>({from:`${il}.`,name:f,version:null,extras:[]})),i=!1,a=null,l=null,d=[],c="",p=()=>{if(a!==null&&l!==null){let f=xt(a),m=`${f}@${l}`;s.size>=2e5?i=!0:s.set(m,{name:f,version:l});for(let h of d)r.push({from:m,name:h,version:null,extras:[]})}a=null,l=null,d=[]},u=tt(e,t,(f,m)=>{if(m==="[[package]]"){p(),c="package";return}if(m.startsWith("[")){c=m==="[package.dependencies]"?"deps":"other";return}if(c==="package"){let _=Xr(m);_?.key==="name"?a=_.value:_?.key==="version"&&(l=_.value);return}if(c!=="deps")return;let h=m.indexOf(" = ");h<=0||m.slice(h+3).includes("optional = true")||d.push(m.slice(0,h).trim().replaceAll('"',""))});return p(),u.refusedAnchors||u.truncated?null:zf(s,o,r,i)}function al(e){let n=0;for(;n<e.length;){let t=e.charCodeAt(n);if(!(t>=97&&t<=122||t>=65&&t<=90||t>=48&&t<=57||t===45||t===46||t===95))break;n+=1}return n===0?null:xt(e.slice(0,n))}function Ex(e){return e==="tool.poetry.dependencies"||e==="tool.poetry.dev-dependencies"||e.startsWith("tool.poetry.group.")&&e.endsWith(".dependencies")}function Yr(e){let n=new Map,t="",s=!1,o=0,r=d=>{d!==null&&d!=="python"&&!n.has(d)&&n.set(d,o)},i=d=>{let c=0;for(;;){let p=d.indexOf('"',c);if(p===-1)return;let u=d.indexOf('"',p+1);if(u===-1)return;r(al(d.slice(p+1,u))),c=u+1}},a=(d,c)=>d==="project"&&c==="dependencies"||d==="project.optional-dependencies"||d==="dependency-groups"||d==="tool.uv"&&c==="dev-dependencies",l=e.charCodeAt(0)===65279?1:0;for(;l<=e.length&&o<2e5;){let d=e.indexOf(`
+`,l);d===-1&&(d=e.length),o+=1;let c=e.slice(l,d);l=d+1;let p=c.indexOf("#"),u=(p===-1?c:c.slice(0,p)).trim();if(u.length>4096)continue;if(s){i(u),u.includes("]")&&(s=!1);continue}if(u.startsWith("[")&&!u.startsWith("[[")){t=u.slice(1,u.indexOf("]")===-1?u.length:u.indexOf("]")).trim();continue}let f=u.indexOf("=");if(f<=0)continue;let m=u.slice(0,f).trim().replaceAll('"',""),h=u.slice(f+1).trim();if(Ex(t)){r(al(m));continue}if(a(t,m)&&h.startsWith("[")&&(i(h),s=!h.includes("]")),d===e.length)break}return n}function cl(e){let n=new Map,t=0,s=0;for(;s<=e.length&&t<2e5;){let o=e.indexOf(`
+`,s);o===-1&&(o=e.length),t+=1;let r=e.slice(s,o);s=o+1;let i=r.trim();if(i.length>0&&i.length<=4096&&!i.startsWith("#")&&!i.startsWith("-")){let a=al(i);a!==null&&!n.has(a)&&n.set(a,t)}if(o===e.length)break}return n}import{statSync as Jx}from"node:fs";import Zx from"node:path";import{lstatSync as Ix,readFileSync as Rx,readdirSync as Ox,realpathSync as ul,statSync as Fo}from"node:fs";import je from"node:path";function Ax(e,n){let t=e.charAt(n),s="",o=n+1;for(;o<e.length;){let r=e.charAt(o);if(r===t)return{value:s,end:o+1};if(t==='"'&&r==="\\"){let i=e.charAt(o+1);if(i!=="\\"&&i!=='"')return null;s+=i,o+=2;continue}s+=r,o+=1}return null}function Nx(e){let n=[],t=0;for(;t<e.length;){let s=e.charAt(t);if(s===" "||s==="	"||s==="\r"||s==="\f"||s==="\v"){t+=1;continue}if(s==="/"&&e.charAt(t+1)==="/")break;if(s==="("||s===")"){n.push({kind:s}),t+=1;continue}if(s==='"'||s==="`"){let i=Ax(e,t);if(i===null||i.value.length>4096)return null;n.push({kind:"quoted",text:i.value}),t=i.end;continue}let o=t;for(;o<e.length;){let i=e.charAt(o);if(i===" "||i==="	"||i==="\r"||i==="("||i===")"||i==='"'||i==="`"||i==="/"&&e.charAt(o+1)==="/")break;o+=1}let r=e.slice(t,o);if(r.length>4096)return null;n.push({kind:"word",text:r}),t=o}return n}function Uf(e){return e.kind==="word"||e.kind==="quoted"?e.text:null}function Ks(e){let n=[],t=null;for(let s of e.split(`
+`)){if(n.length>=1e5)break;let o=Nx(s);if(o===null||o.length===0)continue;if(t!==null){if(o[0]?.kind===")"){t=null;continue}let l=o.map(Uf);if(l.some(d=>d===null)||l.length>16)continue;n.push({verb:t,args:l});continue}let r=o[0];if(r?.kind!=="word")continue;let i=r.text;if(o.length===2&&o[1]?.kind==="("){t=i;continue}let a=o.slice(1).map(Uf);a.some(l=>l===null)||a.length>16||n.push({verb:i,args:a})}return n}function Lo(e,n){for(let t of e)if(t.verb===n&&t.args.length>0)return t.args[0]??null;return null}function Do(e){let n=[],t=[];for(let s of e){if(s.verb!=="use")continue;let o=s.args[0];if(o===void 0||o.length===0||o.includes("\0"))continue;let r=o.replace(/\\/gu,"/");if(r.startsWith("/")||/^[A-Za-z]:\//u.test(r)){t.push(o);continue}let i=[],a=!1;for(let l of r.split("/"))if(!(l===""||l===".")){if(l===".."){if(i.length===0){a=!0;break}i.pop();continue}i.push(l)}a?t.push(o):n.push(i.join("/"))}return{inside:n,outside:t}}function jo(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}function Bo(e){return e.ecosystem==="Go"||e.alsoGo===!0}var Vf=2e4,Xf=32,Yf=256,Px=2*1024*1024,Cx=256*1024,Jf=256,Mx=16,Tx=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],$x=["pyproject.toml","setup.py","setup.cfg"],Lx=["requirements.txt","Pipfile"],Dx=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],Zf=["go.sum","vendor/modules.txt"],Fx=256*1024;function jx(e){return e===""?!1:e.split("/").some(n=>n==="vendor"||n==="testdata"||n.startsWith("_"))}var Wf={candidate:"absent",witnesses:[],admitted:!1};function Bx(e){let n=fl(je.join(e,"go.work"),Fx);return n===null?new Set:new Set(Do(Ks(n)).inside)}var Qf={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function fl(e,n){try{let t=Fo(e);return!t.isFile()||t.size>n?null:Rx(e,"utf8")}catch{return null}}function ot(e){let n;try{n=Fo(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function Gx(e){try{return Fo(e).isDirectory()}catch{return!1}}function Kx(e,n){let t=0,s=0,o=-1,r=0;for(;s<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(s)))t+=1,s+=1;else if(t<e.length&&e.charAt(t)==="*")o=t,r=s,t+=1;else if(o>=0)t=o+1,r+=1,s=r;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function zx(e,n){let t=(s,o)=>{if(s===e.length)return o===n.length;let r=e[s]??"";if(r==="**"){for(let a=o;a<=n.length;a+=1)if(t(s+1,a))return!0;return!1}if(o>=n.length)return!1;let i=n[o]??"";return(r.includes("*")||r.includes("?")?Kx(r,i):r===i)?t(s+1,o+1):!1};return t(0,0)}function Ux(e){let n=[],t=fl(je.join(e,"package.json"),Px);if(t!==null)try{let i=JSON.parse(t)?.workspaces;if(Array.isArray(i))for(let a of i)typeof a=="string"&&n.push(a);else if(typeof i=="object"&&i!==null){let a=i.packages;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l)}}catch{}let s=fl(je.join(e,"pnpm-workspace.yaml"),Cx);s!==null&&n.push(...Wx(s));let o=[];for(let r of n){if(o.length>=Jf)break;let i=r.trim();if(i.length===0)continue;for(;i.startsWith("./");)i=i.slice(2);if(i.startsWith("/")||je.isAbsolute(i))continue;let a=i.split("/").filter(l=>l.length>0);a.length===0||a.length>Mx||a.includes("..")||o.push(a.join("/"))}return o}function Wx(e){let n=[],t=!1;for(let s of e.split(`
+`)){if(n.length>=Jf)break;if(/^packages:\s*(#.*)?$/.test(s)){t=!0;continue}if(!t)continue;let o=/^\s+-\s*(.*?)\s*$/.exec(s);if(o===null){s.trim().length>0&&(t=!1);continue}let r=(o[1]??"").trim(),i=r.indexOf(" #");i>=0&&(r=r.slice(0,i).trim()),(r.startsWith('"')&&r.endsWith('"')&&r.length>=2||r.startsWith("'")&&r.endsWith("'")&&r.length>=2)&&(r=r.slice(1,-1)),r.length>0&&n.push(r)}return n}function Hf(e,n){let t=je.relative(n,e);return t.length===0?!1:t.split(je.sep).includes("node_modules")}function qf(e,n){return je.relative(e,n).split(je.sep).join("/")}function Go(e,n){let t=n?.maxDirs??Vf,s=n?.maxDepth??Xf,o=n?.maxRoots??Yf,r=n?.discoverPythonRoots??!0,i=n?.discoverGoRoots??!1,a;try{a=ul(e)}catch{return{...Qf,observations:[{kind:"refused-unreadable",rel:""}]}}let l=[],d=[],c=new Set([a]),p=0,u=0,f=0,m="complete",h=Ux(a).map(I=>I.split("/")),y=i?Bx(a):new Set,_=new Set,S=new Set,b=I=>{let A="absent";for(let O of $x){let V=ot(je.join(I,O));if(V==="regular"){A="declared";break}V==="refused"&&(A="refused")}if(A==="absent"&&Lx.some(O=>ot(je.join(I,O))==="regular")&&(A="listed"),A==="absent")return{candidate:A,witnesses:[]};let B=[];return Dx.some(O=>ot(je.join(I,O))==="regular")&&B.push("own-lockfile"),Gx(je.join(I,".venv"))&&B.push("installed-env"),{candidate:A,witnesses:B}},k=(I,A)=>{if(!i||jx(A))return Wf;let B=ot(je.join(I,"go.mod"));if(B==="absent")return Wf;let O=B==="regular"?"declared":"refused",V=[];Zf.some(D=>ot(je.join(I,D))==="regular")&&V.push("own-lockfile"),y.has(A)&&V.push("workspace-declared");let E=A===""||O==="refused"||V.length>0;return{candidate:O,witnesses:V,admitted:E}},w=(I,A,B)=>B.admitted?l.length>=o?"exhausted":(l.push({rel:A,abs:I,witnesses:B.witnesses,manifestRefused:B.candidate==="refused",ecosystem:"Go"}),_.add(I),S.add(I),"root"):"not-root",N=(I,A,B)=>{let O=b(I);return O.candidate==="absent"?"not-root":(O.candidate!=="listed"&&(u+=1),O.witnesses.length===0&&O.candidate!=="refused"?O.candidate==="declared"?(d.push({kind:"undeclared-manifest",rel:A}),"observed"):"not-root":l.length>=o?"exhausted":(l.push({rel:A,abs:I,witnesses:O.witnesses,manifestRefused:O.candidate==="refused",ecosystem:"PyPI",...B.admitted?{alsoGo:!0}:{}}),B.admitted&&_.add(I),"root"))},R=(I,A)=>{if(A.length===0){let L=ot(je.join(I,"package.json"))!=="absent",K=r?b(I):{candidate:"absent",witnesses:[]},Y=k(I,A);return Y.admitted&&_.add(I),!L&&K.candidate!=="absent"?(l.push({rel:"",abs:I,witnesses:["scan-root",...K.witnesses],manifestRefused:!1,ecosystem:"PyPI",...Y.admitted?{alsoGo:!0}:{}}),"root"):!L&&Y.admitted?(l.push({rel:"",abs:I,witnesses:["scan-root",...Y.witnesses],manifestRefused:!1,ecosystem:"Go"}),"root"):(l.push({rel:"",abs:I,witnesses:["scan-root",...K.witnesses],manifestRefused:!1,...K.witnesses.length>0?{alsoPython:!0}:{},...Y.admitted?{alsoGo:!0}:{}}),"root")}let B=ot(je.join(I,"package.json")),O=k(I,A);if(O.candidate!=="absent"&&(u+=1),B==="absent"){let L=r?N(I,A,O):"not-root";if(L==="root"||L==="exhausted")return L;let K=w(I,A,O);return K==="not-root"&&O.candidate==="declared"&&L!=="observed"&&d.push({kind:"undeclared-manifest",rel:A}),K}u+=1;let V=[],E=A.split("/");h.some(L=>zx(L,E))&&V.push("workspace-declared"),Tx.some(L=>ot(je.join(I,L))==="regular")&&V.push("own-lockfile");let D=r?b(I):{candidate:"absent",witnesses:[]};for(let L of D.witnesses)V.includes(L)||V.push(L);return V.length===0&&B!=="refused"?(d.push({kind:"undeclared-manifest",rel:A}),w(I,A,O)):l.length>=o?"exhausted":(l.push({rel:A,abs:I,witnesses:V,manifestRefused:B==="refused",...D.witnesses.length>0?{alsoPython:!0}:{},...O.admitted?{alsoGo:!0}:{}}),O.admitted&&_.add(I),"root")},v=[{abs:a,rel:"",depth:0}];for(;v.length>0;){let I=v.pop();if(I===void 0)break;if(p>=t){m="dirs-exhausted";break}p+=1;let A=R(I.abs,I.rel);if(A==="exhausted"){m="roots-exhausted";break}let B=A==="root";if(I.depth>=s){m=m==="complete"?"depth-clamped":m;continue}let O;try{O=Ox(I.abs)}catch{d.push({kind:"refused-unreadable",rel:I.rel});continue}O.sort().reverse();for(let V of O){let E=je.join(I.abs,V),D=I.rel.length===0?V:`${I.rel}/${V}`,L;try{let le=Ix(E);L=le.isDirectory()||le.isSymbolicLink()&&Fo(E).isDirectory()}catch{continue}if(!L)continue;if(V==="node_modules"){(!B||S.has(I.abs))&&d.push({kind:"unenumerated-install",rel:D});continue}if(V==="vendor"&&_.has(I.abs)&&ot(je.join(E,"modules.txt"))==="regular")continue;if(V.startsWith(".")){f+=1,d.push({kind:"skipped-dot-directory",rel:D}),ot(je.join(E,"package.json"))!=="absent"&&d.push({kind:"undeclared-manifest",rel:D});continue}let K;try{K=ul(E)}catch{d.push({kind:"refused-unreadable",rel:D});continue}let Y=a.endsWith(je.sep)?a:a+je.sep;if(K!==a&&!K.startsWith(Y)){d.push({kind:"refused-out-of-root",rel:D});continue}Hf(K,a)||c.has(K)||(c.add(K),v.push({abs:K,rel:qf(a,K),depth:I.depth+1}))}}for(let I of n?.operatorRoots??[]){let A=typeof I=="string"?I.slice(0,512):"",B=()=>{d.push({kind:"refused-operator-root",rel:A})};if(A.length===0||A.includes("\0")){B();continue}let O;try{O=ul(je.resolve(a,A))}catch{B();continue}let V=a.endsWith(je.sep)?a:a+je.sep;if(O!==a&&(!O.startsWith(V)||Hf(O,a))){B();continue}let E;try{E=Fo(O).isDirectory()}catch{E=!1}if(!E||ot(je.join(O,"package.json"))!=="regular"){B();continue}let D=l.findIndex(Y=>Y.abs===O);if(D>=0){let Y=l[D];Y!==void 0&&!Y.witnesses.includes("operator")&&(l[D]={...Y,witnesses:[...Y.witnesses,"operator"]});continue}let L=qf(a,O);l.push({rel:L,abs:O,witnesses:["operator"],manifestRefused:!1});let K=d.findIndex(Y=>Y.kind==="undeclared-manifest"&&Y.rel===L);K>=0&&d.splice(K,1)}return l.sort((I,A)=>I.rel<A.rel?-1:I.rel>A.rel?1:0),d.sort((I,A)=>I.kind!==A.kind?I.kind<A.kind?-1:1:I.rel<A.rel?-1:I.rel>A.rel?1:0),{roots:l,observations:d,budget:m,counts:{dirsWalked:p,manifestsSeen:u,rootsAdmitted:l.length,dotDirectoriesSkipped:f}}}import{lstatSync as ep,readdirSync as Hx,readFileSync as qx,realpathSync as sp,statSync as op}from"node:fs";import Cn from"node:path";var rt={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},Vx=/^python\d+\.\d+$/u;function ns(e,n){let t;try{t=op(e)}catch(s){return{why:s?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:qx(e,"utf8")}}catch{return{why:"unreadable"}}}function pl(e,n){let t;try{if(t=sp(n),!op(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+Cn.sep)?t:null}function np(e,n){return Cn.relative(e,n).split(Cn.sep).join("/")}function tp(e){try{return Hx(e).sort()}catch{return null}}function Xx(e){let n=[],t=[],s=0;for(let o of e.split(/\r?\n/u)){let r=o.trim();if(!(r===""||r.startsWith("#"))){if(/^import[ \t]/u.test(r)){s+=1;let i=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(r);i?.[1]!==void 0&&t.length<rt.maxPthPaths&&t.push(i[1]);continue}n.length<rt.maxPthPaths&&n.push(r)}}return{paths:n,importLines:s,importModules:t}}function Yx(e){let n=null;for(let t of e.split(/\r?\n/u)){let s=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(s!==null){if(s[1]==="version_info")return s[2]??null;n??=s[2]??null}}return n}function Ko(e,n){let t=n?.envDir??rt.envDir,s=n?.maxDistributions??rt.maxDistributions,o=n?.maxMetadataBytes??rt.maxMetadataBytes,r=n?.maxRecordBytes??rt.maxRecordBytes,i=n?.maxTopLevelBytes??rt.maxTopLevelBytes,a=n?.maxDirectUrlBytes??rt.maxDirectUrlBytes,l=rt.maxEntryPointsBytes,d=t,c=[],p=(I,A,B=null)=>({envRel:d,refused:I,sitePackages:[],interpreter:B,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...c,A],truncated:!1}),u;try{u=sp(e)}catch{return p("absent","the root itself could not be resolved")}let f=Cn.join(u,t),m;try{m=ep(f)}catch(I){return I?.code==="ENOENT"?p("absent",`${d}: absent`):p("not-a-directory",`${d}: could not be inspected`)}if(!m.isDirectory()&&!m.isSymbolicLink())return p("not-a-directory",`${d}: not a directory`);let h=pl(u,f);if(h===null)return p("escapes-root",`${d}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let y=ns(Cn.join(h,"pyvenv.cfg"),rt.maxPyvenvCfgBytes),_="text"in y?Yx(y.text):null;"text"in y||c.push(`${d}/pyvenv.cfg: ${y.why} \u2014 interpreter version unknown`);let S=[];for(let I of["lib","lib64"]){let A=tp(Cn.join(h,I));if(A!==null)for(let B of A)Vx.test(B)&&S.push(Cn.join(h,I,B,"site-packages"))}S.push(Cn.join(h,"Lib","site-packages"));let b=[],k=new Set;for(let I of S){let A=pl(h,I);A===null||k.has(A)||(k.add(A),b.push(A))}if(b.length===0)return p("no-site-packages",`${d}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,_);b.length>1&&c.push(`${d}: ${String(b.length)} site-packages directories; all enumerated`);let w=[],N=[],R=0,v=!1;e:for(let I of b){let A=np(u,I),B=tp(I);if(B===null){c.push(`${A}: unreadable; nothing enumerated there`);continue}for(let O of B){let V=Cn.join(I,O),E=O.endsWith(".dist-info"),D=O.endsWith(".egg-info");if(O.endsWith(".pth")){let M=ns(V,rt.maxPthBytes);if(!("text"in M)){c.push(`${A}/${O}: ${M.why}; the paths it adds were NOT enumerated`);continue}N.push({name:O,sitePackages:A,...Xx(M.text)});continue}if(!E&&!D)continue;if(w.length>=s){v=!0,c.push(`${A}: the distribution cap (${String(s)}) was hit at ${O}; the enumeration is INCOMPLETE`);break e}let L;try{L=ep(V)}catch{R+=1,c.push(`${A}/${O}: could not be inspected; not enumerated`);continue}let K=E?"dist-info":"egg-info";if(L.isFile()&&D){let M=ns(V,o);"text"in M?w.push({dir:O,kind:K,metadata:M.text,entryPointsUnknown:!0}):(R+=1,c.push(`${A}/${O}: ${M.why}; not enumerated`));continue}let Y=pl(h,V);if(Y===null){R+=1,c.push(`${A}/${O}: not a directory inside the environment; not enumerated`);continue}let le=E?"METADATA":"PKG-INFO",z=ns(Cn.join(Y,le),o);if(!("text"in z)){R+=1,c.push(`${A}/${O}: ${le} ${z.why}; not enumerated`);continue}let Z={dir:O,kind:K,metadata:z.text},de=ns(Cn.join(Y,"entry_points.txt"),l);"text"in de?Z.entryPoints=de.text:de.why!=="absent"&&(Z.entryPointsUnknown=!0,c.push(`${A}/${O}/entry_points.txt: ${de.why}; the commands it declares are UNKNOWN`));let x=ns(Cn.join(Y,"top_level.txt"),i);if("text"in x?Z.topLevel=x.text:x.why!=="absent"&&c.push(`${A}/${O}/top_level.txt: ${x.why}; ignored`),E){let M=ns(Cn.join(Y,"RECORD"),r);"text"in M?Z.record=M.text:c.push(`${A}/${O}/RECORD: ${M.why}; import names from top_level.txt only`);let X=ns(Cn.join(Y,"direct_url.json"),a);"text"in X&&(Z.directUrl=X.text)}w.push(Z)}}return{envRel:d,refused:null,sitePackages:b.map(I=>np(u,I)),interpreter:_,distInfos:w,pthFiles:N,unreadable:R,diagnostics:c,truncated:v}}var Qx=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function ek(e,n){for(let t of n)try{if(Jx(Zx.join(e,t)).isFile())return t}catch{}return null}function rp(e){let n=[],t=[],s=(p,u)=>{t.push({kind:p,detail:u,blindsAnalysis:!1,rootRel:""}),n.push(u)},o=ek(e,Qx),r=Ko(e);if(r.refused!==null){let p=r.refused==="absent"?`no \`${r.envRel}\` is installed`:`\`${r.envRel}\` could not be read (${r.refused})`;return s("no-installed-env",`${o??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:o,diagnostics:[...n,...r.diagnostics],truncated:!1,gaps:t}}let i=[],a=new Set,l=[],d=0;for(let p of r.distInfos){let u=Mo(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(u===null){d+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let f=JSON.stringify([u.name,u.version]);a.has(f)||(a.add(f),u.importNames.length===0&&l.push(u.name),i.push({name:u.name,version:u.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...r.diagnostics);let c=r.unreadable+d;return c>0&&s("installed-env-partial",`${String(c)} entr${c===1?"y":"ies"} under ${r.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(i.length)} enumerated were assessed normally.`),r.truncated&&s("installed-env-partial",`the environment walk under ${r.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),l.length>0&&n.push(`${String(l.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${l.slice(0,5).join(", ")}${l.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:i,source:i.length>0?"installed-env":"none",lockfilePath:o,diagnostics:n,truncated:r.truncated,gaps:t}}var gl=128*1024*1024,nk=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>Ur(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>Ur(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Ya(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Qa(e,n===void 0?{}:{maxEntries:n})}],tk=[".pnp.cjs",".pnp.data.json",".pnp.js"];function yl(e,n){let t;try{t=hl(it.join(e,n))}catch{return null}let s=e.endsWith(it.sep)?e:e+it.sep;return t.startsWith(s)?t:null}function ap(e,n){let t=it.join(e,"package.json"),s;try{s=hl(t)}catch{return null}if(!s.startsWith(n+it.sep))return null;try{if(!zo(s).isFile())return null;let o=JSON.parse(ml(s,"utf8"));return typeof o.name!="string"||typeof o.version!="string"?null:{name:o.name,version:o.version}}catch{return null}}function lp(e,n){try{return zo(it.join(e,n)),!0}catch{return!1}}function sk(e,n){if(lp(e,"pnpm-workspace.yaml"))return!0;let t=yl(e,"package.json");if(t===null)return lp(e,"package.json");let s;try{let i=zo(t);if(!i.isFile()||i.size>n)return!0;s=ml(t,"utf8")}catch{return!0}let o;try{o=JSON.parse(s)}catch{return!0}for(let i of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=o[i];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let r=o.workspaces;return Array.isArray(r)?r.length>0:typeof r=="object"&&r!==null}function dp(e,n){let t=it.join(e,"node_modules"),s=[],o;try{o=ip(t,{withFileTypes:!0})}catch{return s}for(let r of o){let i=r.name;if(i.startsWith("."))continue;if(i.startsWith("@")){let l;try{l=ip(it.join(t,i),{withFileTypes:!0})}catch{continue}for(let d of l){let c=ap(it.join(t,i,d.name),n);c!==null&&s.push({dev:!1,name:c.name,version:c.version,lockKey:`node_modules/${i}/${d.name}`,linked:d.isSymbolicLink()||r.isSymbolicLink()})}continue}let a=ap(it.join(t,i),n);a!==null&&s.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${i}`,linked:r.isSymbolicLink()})}return s}var ok=5;function rk(e,n,t){let s=yl(e,n);if(s===null){try{zo(it.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let o;try{o=zo(s)}catch{return null}if(!o.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(o.size>t)return{gap:`${n} is ${String(o.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:ml(s,"utf8")}}catch{return{gap:`${n} could not be read`}}}function ik(e,n){let t=hl(e),s=[],o=[],r=n?.maxLockfileBytes??gl,i=[],a=new Set,l=[],d=sk(t,r),c=null,p=!1,u=(m,h,y)=>{o.push({kind:m,detail:h,blindsAnalysis:y,rootRel:""}),s.push(h)};for(let m of nk){let h=rk(t,m.file,r);if(h===null)continue;if("gap"in h){u("lockfile-unreadable",h.gap,!1);continue}let y=m.parse(h.text,n?.maxLockfileEntries);if(y.truncated&&(p=!0),y.deps.length===0){if(y.diagnostics.length>0||d){let _=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";u("lockfile-unparsed",`${m.file} yielded NO dependencies (${_}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&u("lockfile-partial",`${m.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),c===null&&(c=m.file),l.includes(m.source)||l.push(m.source);for(let _ of y.deps){let S=JSON.stringify([_.name,_.version,_.lockKey]);a.has(S)||(a.add(S),i.push({..._,declaredIn:m.file}))}}for(let m of tk)if(yl(t,m)!==null){u("yarn-pnp",`${m} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(i.length>0){let m=l.length===1?l[0]??"none":"multi-lockfile";l.length>1&&s.push(`multiple lockfiles present (${l.join(", ")}); enumerated the UNION of all of them`);let h=new Set(i.map(S=>JSON.stringify([S.name,S.version]))),y=new Set,_=[];for(let S of dp(t,t)){let b=JSON.stringify([S.name,S.version,S.lockKey]);a.has(b)||(a.add(b),i.push({name:S.name,version:S.version,lockKey:S.lockKey,dev:S.dev,declaredIn:""}));let k=JSON.stringify([S.name,S.version]);S.linked||h.has(k)||y.has(k)||(y.add(k),_.length<ok&&_.push(Po(S.name,S.version)))}if(y.size>0){let S=y.size-_.length;u("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${_.join(", ")}${S>0?`, and ${String(S)} more`:""}): ${c??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:i,source:m,lockfilePath:c,diagnostics:s,truncated:p,gaps:o}}let f=dp(t,t);return f.length>0?(u("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(f.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:f.map(m=>({name:m.name,version:m.version,lockKey:m.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:s,truncated:p,gaps:o}):(d&&u("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:s,truncated:p,gaps:o})}function cp(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function ak(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function pp(e){return e===""||e.split("/").every(ak)}function lk(e,n){if(e===""||n==="")return n;if(!pp(e))return"";let t=`${e}/${n}`;return t.length<=zr?t:""}function up(e,n){return e===""?n:`${e}: ${n}`}function dk(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function mp(e,n,t,s){let o=t?.maxUnionEntries??Kr,r=n.roots.filter(h=>cp(h)||s?.has(h.rel)===!0),i=r.some(h=>h.rel==="")?r:[dk(e),...r],a=[],l=[],d=new Set,c=[],p=[],u=!1,f=!1;for(let h of i){let y=h.rel===""?e:h.abs,S=h.rel===""||h.ecosystem!=="Go"&&cp(h)?ik(y,t):pk,b=jo(h)?rp(y):null,k=s?.get(h.rel)??null,w=b===null?S:fp(S,b),N=k===null?w:fp(w,k),R=N.diagnostics.map(I=>up(h.rel,I));!pp(h.rel)&&N.packages.length>0&&R.push(`${h.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(N.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let v={...N,rootRel:h.rel,...h.ecosystem!==void 0?{ecosystem:h.ecosystem}:{},...b!==null?{pythonLockfilePath:b.lockfilePath===null||h.rel===""?b.lockfilePath:`${h.rel}/${b.lockfilePath}`}:{},...k!==null?{goModPath:h.rel===""?"go.mod":`${h.rel}/go.mod`}:{},packages:N.packages.map(I=>({...I,lockKey:lk(h.rel,I.lockKey),declaredIn:I.declaredIn===""||h.rel===""?I.declaredIn:`${h.rel}/${I.declaredIn}`})),lockfilePath:N.lockfilePath===null||h.rel===""?N.lockfilePath:`${h.rel}/${N.lockfilePath}`,gaps:N.gaps.map(I=>({...I,rootRel:h.rel,detail:up(h.rel,I.detail)})),diagnostics:R};a.push(v),N.truncated&&(u=!0);for(let I of v.packages){let A=JSON.stringify(I.ecosystem==="Go"?[I.name,I.version,I.lockKey,"Go"]:[I.name,I.version,I.lockKey]);if(!d.has(A)){if(l.length>=o){f=!0;break}d.add(A),l.push(I)}}c.push(...v.gaps),p.push(...v.diagnostics)}f&&(u=!0,p.push(`the union of installed sets across ${String(i.length)} roots exceeds its ceiling of ${String(o)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let m=a[0];if(m===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:m.source,lockfilePath:m.lockfilePath,diagnostics:p,truncated:u,gaps:c,perRoot:a}}function ck(e,n){let t;for(let s of e.perRoot){if(s.rootRel===""){t??=s;continue}n.startsWith(`${s.rootRel}/`)&&(t===void 0||s.rootRel.length>t.rootRel.length)&&(t=s)}return t}function Jr(e,n){return n.declaredIn!==""?n.declaredIn:ck(e,n.lockKey)?.lockfilePath??null}function hp(e,n){let t=e.perRoot.find(o=>o.rootRel===n.rootRel);if(fk.has(n.kind))return t?.goModPath??(n.rootRel===""?"go.mod":`${n.rootRel}/go.mod`);if(uk.has(n.kind))return t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`;if(t?.lockfilePath!==void 0&&t.lockfilePath!==null)return t.lockfilePath;if(n.rootRel==="")return null;let s=t?.ecosystem==="PyPI"?"pyproject.toml":t?.ecosystem==="Go"?"go.mod":"package.json";return`${n.rootRel}/${s}`}var uk=new Set(["no-installed-env","installed-env-partial"]),fk=new Set(["go-toolchain-missing","go-list-failed","go-module-missing"]),pk={packages:[],source:"none",lockfilePath:null,diagnostics:[],truncated:!1,gaps:[]};function fp(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function gp(e){let n=new Map;for(let t of e){let s=n.get(t.name)??new Set;s.add(t.version),n.set(t.name,s)}return t=>{let s=n.get(t);if(s===void 0)return;let o=[...s].sort();return o.length===1?o[0]:o}}function Uo(e){return new Set(e.map(n=>n.root))}function zs(e,n){let t=Uo(n);return e.roots.filter(s=>!t.has(s.rel)&&(s.rel===""||s.ecosystem!=="PyPI"&&s.ecosystem!=="Go"))}function _l(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function bl(e,n){return zs(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function yp(e){let n=[],t=e.observations.filter(s=>s.kind==="unenumerated-install").map(s=>s.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${_l(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let s=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(s.dirsWalked)} dirs walked, ${String(s.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function _p(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as bv}from"node:fs";import ws from"node:path";import{spawnSync as Fw}from"node:child_process";function Wo(e){{let n=oe[e];if(n===void 0)throw new Error(`the bundle does not embed ${e}; this is a cupel build defect`);return["-c",n]}}var bp=["get","post","put","patch","delete","options","head","trace"],Mn=(e,n)=>e.map(t=>`${t}.${n}()`),bn=(e,...n)=>e.flatMap(t=>n.map(s=>`${t}.${s}`)),Bn={id:"fastapi@0-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://fastapi.tiangolo.com/reference/apirouter/ \u2014 APIRouter.api_route's decorator calls add_api_route(path, func) and returns func (fastapi/routing.py, 0.141.1); FastAPI.get/\u2026 delegate to self.router","https://fastapi.tiangolo.com/tutorial/dependencies/ \u2014 a Depends parameter receives the dependency's return","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/dependencies/utils.py \u2014 add_non_field_param_to_dependency: Request, WebSocket, HTTPConnection, Response, BackgroundTasks, SecurityScopes are injected","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/security/http.py \u2014 HTTPBearer.__call__ returns HTTPAuthorizationCredentials read from the request's Authorization header"],apps:[...Mn(["fastapi","fastapi.applications"],"FastAPI"),...Mn(["fastapi","fastapi.routing"],"APIRouter")],decorators:[...bp,"api_route"],addRoute:"add_api_route",depends:bn(["fastapi","fastapi.params","fastapi.param_functions"],"Depends","Security"),injected:[...bn(["fastapi","fastapi.responses","starlette.responses"],"Response","JSONResponse","HTMLResponse","PlainTextResponse","RedirectResponse","StreamingResponse","FileResponse","ORJSONResponse","UJSONResponse","EventSourceResponse"),...bn(["fastapi","fastapi.background","starlette.background"],"BackgroundTasks"),...bn(["fastapi.security","fastapi.security.oauth2"],"SecurityScopes")],schemes:[...Mn(["fastapi.security","fastapi.security.http"],"HTTPBearer"),...Mn(["fastapi.security","fastapi.security.http"],"HTTPBasic"),...Mn(["fastapi.security","fastapi.security.http"],"HTTPDigest"),...Mn(["fastapi.security","fastapi.security.oauth2"],"OAuth2"),...Mn(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordBearer"),...Mn(["fastapi.security","fastapi.security.oauth2"],"OAuth2AuthorizationCodeBearer"),...Mn(["fastapi.security","fastapi.security.open_id_connect_url"],"OpenIdConnect"),...Mn(["fastapi.security","fastapi.security.api_key"],"APIKeyHeader"),...Mn(["fastapi.security","fastapi.security.api_key"],"APIKeyQuery"),...Mn(["fastapi.security","fastapi.security.api_key"],"APIKeyCookie")],forms:bn(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordRequestForm","OAuth2PasswordRequestFormStrict")},Xn={id:"flask@3-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://flask.palletsprojects.com/en/stable/api/#flask.Flask.route \u2014 Scaffold.route's decorator calls add_url_rule(rule, endpoint, f) and returns f (flask/sansio/scaffold.py, 3.1.3); get/post/put/delete/patch are route(methods=[\u2026])","https://flask.palletsprojects.com/en/stable/quickstart/#variable-rules \u2014 <converter:variable> sections are passed to the view as keyword arguments (werkzeug/routing/rules.py _part_re)","https://flask.palletsprojects.com/en/stable/api/#flask.request \u2014 the request object for the active context (flask/globals.py: a LocalProxy)"],apps:[...Mn(["flask","flask.app"],"Flask"),...Mn(["flask","flask.blueprints"],"Blueprint")],decorators:["route","get","post","put","delete","patch"],addRule:"add_url_rule",proxies:["flask.request","flask.globals.request"]},vn={id:"django@6-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://docs.djangoproject.com/en/6.1/topics/http/urls/#how-django-processes-a-request \u2014 the view is called with the HttpRequest, then the captured values (django/urls/resolvers.py, 6.1.1)","https://docs.djangoproject.com/en/6.1/ref/class-based-views/base/#django.views.generic.base.View.dispatch \u2014 as_view()'s view calls dispatch(request, *args, **kwargs), which calls the method named for the verb","https://docs.djangoproject.com/en/3.2/ref/urls/#url \u2014 url() (removed in 4.0) is re_path()","https://www.django-rest-framework.org/api-guide/views/#api_view \u2014 the decorated function is called by a generated APIView's handler with (request, *args, **kwargs) (rest_framework/decorators.py, 3.18.1)","https://docs.djangoproject.com/en/6.1/topics/http/decorators/ \u2014 Django's view decorators; each wrapper calls the view with (request, *args, **kwargs) (django/views/decorators/*.py, django/contrib/auth/decorators.py user_passes_test, django/utils/decorators.py make_middleware_decorator, 6.1.1)"],paths:["django.urls.path","django.urls.conf.path"],regexes:["django.urls.re_path","django.urls.conf.re_path","django.conf.urls.url"],methods:bp,passThrough:[...bn(["django.contrib.auth.decorators"],"login_required","login_required()","login_not_required","permission_required()","user_passes_test()"),...bn(["django.contrib.admin.views.decorators"],"staff_member_required","staff_member_required()"),...bn(["django.views.decorators.http"],"require_http_methods()","require_GET","require_POST","require_safe","condition()","etag()","last_modified()","conditional_page"),...bn(["django.views.decorators.csrf"],"csrf_exempt","csrf_protect","requires_csrf_token","ensure_csrf_cookie"),...bn(["django.views.decorators.cache"],"cache_page()","cache_control()","never_cache"),...bn(["django.views.decorators.vary"],"vary_on_headers()","vary_on_cookie"),...bn(["django.views.decorators.clickjacking"],"xframe_options_deny","xframe_options_sameorigin","xframe_options_exempt"),...bn(["django.views.decorators.gzip"],"gzip_page"),...bn(["django.views.decorators.debug"],"sensitive_post_parameters()","sensitive_variables()"),...bn(["django.views.decorators.common"],"no_append_slash")],apiView:"rest_framework.decorators.api_view()",apiViewSetters:bn(["rest_framework.decorators"],"renderer_classes()","parser_classes()","authentication_classes()","throttle_classes()","permission_classes()","schema()")};function Sp(e){return Xn.proxies.includes(e)?{kind:"source",sourceClass:Xn.sourceClass,model:Xn.id}:null}var mk=[Bn.addRoute,Xn.addRule,...new Set([...vn.paths,...vn.regexes].map(e=>e.slice(e.lastIndexOf(".")+1)))],hk=[...new Set([...vn.passThrough,vn.apiView,...vn.apiViewSetters].map(e=>e.split(".")[0]??e))];function xp(e){return{proxies:Xn.proxies.filter(n=>!e(n.split(".")[0]??n)),calls:mk,roots:hk.filter(n=>!e(n))}}import{readdirSync as vp,realpathSync as kp,statSync as Ep}from"node:fs";import Lt from"node:path";var Ap=32,gk=512,yk=/^[A-Za-z_][A-Za-z0-9_]*$/u,_k=[".so",".pyd",".dylib"],Zr=e=>({resolved:e,failure:null}),Us=e=>({resolved:null,failure:e});function bk(e){if(e.length===0||e.length>gk)return null;let n=e.split(".");return n.length>Ap?null:n.every(t=>yk.test(t))?n:null}function Sl(e){try{return Ep(e).isDirectory()}catch{return!1}}function Hs(e){try{return Ep(e).isFile()}catch{return!1}}var wp=new WeakMap;function Ws(e,n,t){let s=wp.get(e);s===void 0&&(s=new Map,wp.set(e,s));let o=s.get(n);if(o===void 0){try{o=new Set(vp(n))}catch{o=null}s.set(n,o)}return o?.has(t)===!0}function Ho(e,n){let t,s;try{t=kp(n),s=kp(e)}catch{return null}return t===s||t.startsWith(s+Lt.sep)?t:null}function Sk(e,n){let t;try{t=vp(e)}catch{return null}for(let s of t)if(s.startsWith(`${n}.`)&&_k.some(o=>s.endsWith(o))&&Hs(Lt.join(e,s)))return Lt.join(e,s);return null}function Dt(e,n){let t=bk(n);if(t===null)return Us("refused");let s=null,o=!1;for(let[r,i]of e.roots.entries()){let a=i,l=!1;for(let h of t.slice(0,-1)){let y=Lt.join(a,h);if(Ws(e,a,h)&&(Hs(Lt.join(y,"__init__.py"))||Sl(y))){if(!Sl(y)){l=!0;break}a=y;continue}l=!0,Ws(e,a,`${h}.py`)&&Hs(`${y}.py`)&&(o=!0);break}if(l)continue;let d=t[t.length-1];if(d===void 0)return Us("refused");let c=Lt.join(a,d,"__init__.py");if(Ws(e,a,d)&&Hs(c)){let h=Ho(i,c);return h===null?Us("escapes-root"):Zr({module:n,kind:"package",path:h,rootIndex:r})}let p=Lt.join(a,`${d}.py`);if(Ws(e,a,`${d}.py`)&&Hs(p)){let h=Ho(i,p);return h===null?Us("escapes-root"):Zr({module:n,kind:"module",path:h,rootIndex:r})}let u=Sk(a,d);if(u!==null){let h=Ho(i,u);return h===null?Us("escapes-root"):Zr({module:n,kind:"extension",path:h,rootIndex:r})}let f=Lt.join(a,d);if(s===null&&Ws(e,a,d)&&Sl(f)){let h=Ho(i,f);h!==null&&(s={module:n,kind:"namespace",path:h,rootIndex:r});continue}let m=Lt.join(a,`${d}.pyi`);if(s===null&&Ws(e,a,`${d}.pyi`)&&Hs(m)){let h=Ho(i,m);h!==null&&(s={module:n,kind:"stub-only",path:h,rootIndex:r})}}return s!==null?Zr(s):Us(o?"not-a-package":"not-found")}function Qr(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function qs(e,n,t,s){if(t<1||t>Ap)return{failure:"refused"};let o=Qr(e,n),r=o===""?[]:o.split("."),i=t-1;if(i>r.length)return{failure:"beyond-top-level"};let a=r.slice(0,r.length-i),l=s===null||s===""?[]:s.split("."),d=[...a,...l].join(".");return d===""?{failure:"beyond-top-level"}:{dotted:d}}function qo(e,n,t){if(e===null)return null;let s=r=>r.kind!=="declared-param"?r:r.index>=t?null:n==="none"?{kind:"param",index:r.index}:r.index===0?{kind:"receiver"}:{kind:"param",index:r.index-1},o=[];for(let r of e){let i=s(r.from),a=s(r.to);if(i===null||a===null)return null;o.push({from:i,to:a,kind:r.kind})}return o}var kl="https://docs.python.org/3.13/",xk=`${kl}builtins/functions.html#`,bs=`${kl}builtins/stdtypes.html#`,kt=e=>`${kl}library/${e}.html#`;function ei(e){return e===""?[]:e.split(",").map(n=>{if(n==="r")return{kind:"receiver"};let t=n.endsWith("+"),s=Number(t?n.slice(0,-1):n);if(!Number.isSafeInteger(s)||s<0)throw new Error(`runtime table: input ${n}`);return t?{kind:"args-from",index:s}:{kind:"arg",index:s}})}var Ip=new Map;function xe(e,n,t){let s=(t.mutates??"").split(";").filter(i=>i!=="").map(i=>{let[a,l]=i.split("<"),d=ei(a??"");if(d.length!==1||d[0]===void 0||l===void 0)throw new Error(`runtime table: mutation ${i}`);return{into:d[0],from:ei(l)}}),o=ei(t.program??""),r=t.returns;Ip.set(e,{summary:{id:`python:${e}`,result:ei(t.result),mutates:s,...o.length>0?{callsProgram:o}:{}},...r!==void 0?{returns:r.endsWith("?")?{type:r.slice(0,-1),exact:"inputs"}:{type:r,exact:"always"}}:{},doc:n})}function wl(e,n,t){for(let s of e)xe(s,n(s),t)}var kk=(e,n=e)=>`${xk}${n}`,Be=(e,n,t=e)=>xe(`builtins.${e}`,kk(e,t),n);Be("len",{result:"0",program:"0",returns:"int"});Be("isinstance",{result:"0+",program:"0+",returns:"bool"});Be("issubclass",{result:"0+",program:"0+",returns:"bool"});Be("callable",{result:"0",returns:"bool"});Be("str",{result:"0+",program:"0+",returns:"str?"},"func-str");Be("repr",{result:"0",program:"0",returns:"str?"});Be("ascii",{result:"0",program:"0",returns:"str?"});Be("format",{result:"0+",program:"0+",returns:"str?"});Be("bytes",{result:"0+",program:"0+",returns:"bytes?"},"func-bytes");Be("int",{result:"0+",program:"0+",returns:"int"});Be("float",{result:"0",program:"0",returns:"float"});Be("bool",{result:"0",program:"0",returns:"bool"});Be("ord",{result:"0",returns:"int"});Be("chr",{result:"0",program:"0",returns:"str"});for(let e of["hex","oct","bin"])Be(e,{result:"0",program:"0",returns:"str"});Be("hash",{result:"0",program:"0",returns:"int"});for(let e of["any","all"])Be(e,{result:"0",program:"0",returns:"bool"});for(let e of["abs","reversed","frozenset"])Be(e,{result:"0",program:"0"},e==="frozenset"?"func-frozenset":e);for(let e of["round","min","max","sum","enumerate","zip","map","iter","next"])Be(e,{result:"0+",program:"0+"});Be("range",{result:"0+",program:"0+"},"func-range");Be("filter",{result:"1",program:"0+"});Be("sorted",{result:"0",program:"0+",returns:"list"});Be("list",{result:"0",program:"0",returns:"list"},"func-list");Be("tuple",{result:"0",program:"0",returns:"tuple"},"func-tuple");Be("dict",{result:"0+",program:"0+",returns:"dict"},"func-dict");Be("set",{result:"0",program:"0",returns:"set"},"func-set");var Ft=e=>n=>`${e}.${n}`,Vs=e=>n=>`${bs}${e}.${n}`,wk=["capitalize","center","expandtabs","join","ljust","lower","lstrip","removeprefix","removesuffix","replace","rjust","rstrip","strip","swapcase","title","translate","upper","zfill"],vk=["endswith","isalnum","isalpha","isascii","isdigit","islower","isspace","istitle","isupper","startswith"],Ek=["count","find","index","rfind","rindex"];for(let e of["str","bytes"]){let n=(t,s)=>{for(let o of t)xe(Ft(e)(o),Vs(e)(o),s)};n(wk,{result:"r,0+",program:"0+",returns:e}),n(vk,{result:"r,0+",program:"0+",returns:"bool"}),n(Ek,{result:"r,0+",program:"0+",returns:"int"}),n(["split","rsplit","splitlines"],{result:"r,0+",program:"0+",returns:"list"}),n(["partition","rpartition"],{result:"r,0+",program:"0+",returns:"tuple"})}wl(["casefold","format","format_map"].map(Ft("str")),e=>`${bs}${e}`,{result:"r,0+",program:"0+",returns:"str"});wl(["isdecimal","isidentifier","isnumeric","isprintable"].map(Ft("str")),e=>`${bs}${e}`,{result:"r",returns:"bool"});xe("str.encode",`${bs}str.encode`,{result:"r,0+",program:"0+",returns:"bytes?"});xe("bytes.decode",`${bs}bytes.decode`,{result:"r,0+",program:"0+",returns:"str?"});xe("bytes.hex",`${bs}bytes.hex`,{result:"r,0+",program:"0+",returns:"str"});var Xs=Vs("dict");xe("dict.get",Xs("get"),{result:"r,1",program:"r,0"});xe("dict.pop",Xs("pop"),{result:"r,1",program:"r,0"});xe("dict.setdefault",Xs("setdefault"),{result:"r,1",mutates:"r<0,1",program:"r,0"});xe("dict.update",Xs("update"),{result:"",mutates:"r<0+",program:"r,0+"});wl(["keys","values","items","popitem"].map(Ft("dict")),e=>`${bs}${e}`,{result:"r"});xe("dict.copy",Xs("copy"),{result:"r",returns:"dict"});xe("dict.clear",Xs("clear"),{result:""});var jt=Vs("list");xe("list.append",jt("append"),{result:"",mutates:"r<0"});xe("list.extend",jt("extend"),{result:"",mutates:"r<0",program:"0"});xe("list.insert",jt("insert"),{result:"",mutates:"r<1",program:"0"});xe("list.pop",jt("pop"),{result:"r",program:"0"});xe("list.remove",jt("remove"),{result:"",program:"r,0"});xe("list.sort",jt("sort"),{result:"",program:"r,0+"});xe("list.reverse",jt("reverse"),{result:""});xe("list.clear",jt("clear"),{result:""});xe("list.copy",jt("copy"),{result:"r",returns:"list"});for(let e of["list","tuple"])for(let n of["index","count"])xe(Ft(e)(n),Vs(e)(n),{result:"r,0+",program:"r,0+",returns:"int"});var Ys=Vs("set"),vl=Vs("frozenset");xe("set.add",Ys("add"),{result:"",mutates:"r<0",program:"0"});xe("set.update",Ys("update"),{result:"",mutates:"r<0+",program:"0+"});for(let e of["intersection_update","difference_update","symmetric_difference_update"])xe(Ft("set")(e),Ys(e),{result:"",mutates:"r<0+",program:"r,0+"});for(let e of["discard","remove"])xe(Ft("set")(e),Ys(e),{result:"",program:"r,0"});xe("set.pop",Ys("pop"),{result:"r"});xe("set.clear",Ys("clear"),{result:""});xe("set.copy",vl("copy"),{result:"r",returns:"set"});for(let e of["union","intersection","difference","symmetric_difference"])xe(Ft("set")(e),vl(e),{result:"r,0+",program:"r,0+",returns:"set"});for(let e of["issubset","issuperset","isdisjoint"])xe(Ft("set")(e),vl(e),{result:"r,0+",program:"r,0+",returns:"bool"});xe("json.loads",`${kt("json")}json.loads`,{result:"0+",program:"0+"});xe("json.dumps",`${kt("json")}json.dumps`,{result:"0+",program:"0+"});xe("copy.copy",`${kt("copy")}copy.copy`,{result:"0",program:"0"});xe("copy.deepcopy",`${kt("copy")}copy.deepcopy`,{result:"0+",mutates:"1<0",program:"0+"});for(let e of["b64encode","b64decode","standard_b64encode","standard_b64decode","urlsafe_b64encode","urlsafe_b64decode"])xe(`base64.${e}`,`${kt("base64")}base64.${e}`,{result:"0+",program:"0+",returns:"bytes"});xe("unicodedata.normalize",`${kt("unicodedata")}unicodedata.normalize`,{result:"0+",returns:"str?"});for(let e of["category","bidirectional"])xe(`unicodedata.${e}`,`${kt("unicodedata")}unicodedata.${e}`,{result:"0",returns:"str"});for(let e of["bisect_left","bisect_right","bisect"])xe(`bisect.${e}`,`${kt("bisect")}bisect.${e}`,{result:"0+",program:"0+",returns:"int"});for(let e of["insort_left","insort_right","insort"])xe(`bisect.${e}`,`${kt("bisect")}bisect.${e}`,{result:"",mutates:"0<1",program:"0+"});for(let e of["join","basename","dirname","normpath","splitext","split"])xe(`os.path.${e}`,`${kt("os.path")}os.path.${e}`,{result:"0+",program:"0+"});var Np=new Set(["str","bytes","int","float","complex","bool","none","scalar"]),Ak=new Set(["str","bytes","int","float","complex","bool","tuple","list","dict","set"]),at={decl:"unknown"},Nk=8;function Rp(e,n){let t=new Map,s=c=>c==null||c.unlessWritten!==void 0&&n.written(c.unlessWritten)?null:{type:c.type,exact:!0},o=(c,p)=>c.get(xl(p))?.value??null,r=(c,p,u)=>{if(u>Nk)return at;let f=n.decls.get(c),m=f?.moduleBindings?.get(p),h=e.packageOf(c);if(m==="def"||m==="class")return h===void 0?at:{decl:h===""?"app":"dependency"};if(m!=="import"||f?.aliases.get(p)?.rows!==1)return at;let y=n.envs.get(c),_=y?.names.get(p);if(_!==void 0)return r(_.moduleId,_.name,u+1);let S=y?.externalOrigins?.get(p);return S!==void 0?i(S,u+1):at},i=(c,p)=>{let u=c.split(".");for(let m=u.length;m>=1;m-=1){let h=e.placed(u.slice(0,m).join("."));if(h===null)continue;if(h.kind==="surface")return{decl:"dependency"};let y=u.slice(m);return y.length===1&&y[0]!==void 0?r(h.id,y[0],p):at}let f=u[0];return f!==void 0&&e.stdlib.has(f)?{decl:"runtime",identity:c}:at},a=(c,p)=>{if(p.startsWith("~")){let y=e.packageOf(c);return y===void 0?at:{decl:y===""?"app":"dependency"}}let u=p,f=/^\.+/u.exec(p)?.[0].length??0;if(f>0){let y=e.dottedOf(c);if(y===void 0)return at;let _=p.slice(f),S=qs(y.dotted,y.isPackage,f,_===""?null:_);if("failure"in S)return at;u=S.dotted}let[m,h]=u.split(".");return m==="builtins"?h!==void 0&&e.builtins.has(h)?{decl:"runtime",identity:u}:at:i(u,0)},l=(c,p,u)=>{let h=(p.args??[]).map((R,v)=>{let I=p.argProofs?.[v],A=I?.unlessWritten===void 0?s(I):null;return A!==null||R.kind!=="positional"?A:o(u,R)}).map(R=>R!==null&&R.exact&&Np.has(R.type)),y=p.attr===null||p.receiverRange===null?null:s(p.receiverProof)??o(u,p.receiverRange),_=y!==null&&y.exact&&Np.has(y.type),S=at;y!==null&&p.attr!==null?Ak.has(y.type)&&e.typeAttrs.get(y.type)?.has(p.attr)===!0&&(S={decl:"runtime",identity:`${y.type}.${p.attr}`,method:!0}):p.calleeOrigin!==null&&(S=a(c,p.calleeOrigin));let b=S.identity===void 0?void 0:Ip.get(S.identity),k=b?.summary;k!==void 0&&S.method===!0&&y?.exact!==!0&&(k={...k,callsProgram:[{kind:"receiver"},...k.callsProgram??[]]});let w=b?.returns,N=w===void 0?void 0:{type:w.type,exact:w.exact==="always"||h.every(Boolean)&&(S.method!==!0||_)};return{calleeDecl:S.decl,...S.identity!==void 0?{runtimeId:`python:${S.identity}`}:{},...k!==void 0?{summary:k}:{},..._?{receiverPrimitive:!0}:{},...S.method===!0&&y?.exact===!0?{receiverMethod:y.type}:{},argPrimitive:h,...N!==void 0?{value:N}:{}}},d=c=>{let p=t.get(c);if(p!==void 0)return p;let u=new Map,f=h=>h.range.end-h.range.start,m=[...n.calls.get(c)??[]].sort((h,y)=>f(h)-f(y)||h.range.start-y.range.start);for(let h of m)f(h)>0&&u.set(xl(h.range),l(c,h,u));return t.set(c,u),u};return(c,p)=>{let u=d(c),f=u.get(xl(p.range))??l(c,p,u),{value:m,...h}=f;return h}}function xl(e){return`${String(e.start)}-${String(e.end)}`}var Il="<toplevel>",Dp=64,Ik=new Set(["self","cls"]),Xo=8,Rk=new Set(["__new__","__init_subclass__","__class_getitem__"]),ri=new Set(["__del__","__repr__","__str__","__bytes__","__format__","__lt__","__le__","__eq__","__ne__","__gt__","__ge__","__hash__","__bool__","__getattr__","__getattribute__","__setattr__","__delattr__","__dir__","__get__","__set__","__delete__","__init_subclass__","__set_name__","__mro_entries__","__prepare__","__instancecheck__","__subclasscheck__","__class_getitem__","__call__","__len__","__length_hint__","__getitem__","__setitem__","__delitem__","__missing__","__iter__","__reversed__","__contains__","__add__","__sub__","__mul__","__matmul__","__truediv__","__floordiv__","__mod__","__divmod__","__pow__","__lshift__","__rshift__","__and__","__xor__","__or__","__radd__","__rsub__","__rmul__","__rmatmul__","__rtruediv__","__rfloordiv__","__rmod__","__rdivmod__","__rpow__","__rlshift__","__rrshift__","__rand__","__rxor__","__ror__","__iadd__","__isub__","__imul__","__imatmul__","__itruediv__","__ifloordiv__","__imod__","__ipow__","__ilshift__","__irshift__","__iand__","__ixor__","__ior__","__neg__","__pos__","__abs__","__invert__","__complex__","__int__","__float__","__index__","__round__","__trunc__","__floor__","__ceil__","__enter__","__exit__","__buffer__","__release_buffer__","__await__","__aiter__","__anext__","__aenter__","__aexit__","__next__","__fspath__","__post_init__","__copy__","__deepcopy__","__reduce__","__reduce_ex__","__getstate__","__setstate__","__getnewargs__","__getnewargs_ex__","__subclasshook__","__sizeof__","_missing_","_generate_next_value_"]),Fp=new Set(["__getattr__","__dir__"]),Ok=new Set(["property","cached_property","abstractproperty","getter","setter","deleter"]),Pk=e=>e.some(n=>n!==null&&Ok.has(n.split(".").pop()??n)),Op=["__new__","__init__"],jp=new Set(["object","BaseException","Exception","ArithmeticError","AssertionError","AttributeError","BufferError","EOFError","FloatingPointError","ImportError","IndexError","KeyError","LookupError","MemoryError","ModuleNotFoundError","NameError","NotImplementedError","OSError","OverflowError","RecursionError","ReferenceError","RuntimeError","StopAsyncIteration","StopIteration","SystemError","TimeoutError","TypeError","UnboundLocalError","UnicodeError","ValueError","ZeroDivisionError","Warning","UserWarning","DeprecationWarning","RuntimeWarning"]),si=new Set([...jp,"type","dict","list","set","frozenset","tuple","str","bytes","bytearray","int","float","complex"]),Ck=new Map([["keys","any"],["get","mapping"],["close","iterator"]]),Bp=new Set(["excepthook","unraisablehook","displayhook","breakpointhook","__import__"]),Mk=new Map([["dataclass",{module:"dataclasses",name:"dataclass"}],["dataclasses.dataclass",{module:"dataclasses",name:null}],["total_ordering",{module:"functools",name:"total_ordering"}],["functools.total_ordering",{module:"functools",name:null}],["unique",{module:"enum",name:"unique"}],["enum.unique",{module:"enum",name:null}],["final",{module:"typing",name:"final"}],["typing.final",{module:"typing",name:null}]]),Pp=new Map([["ABCMeta",{module:"abc",name:"ABCMeta"}],["abc.ABCMeta",{module:"abc",name:null}],["type",null]]);function Js(e,n){return{path:e,start:n.start,end:n.end}}function Cp(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function Ol(e,n,t,s){let o=[],r=[],i=[],a=[],l=new Map,d=new Map,c=new Map,p=new Map,u=new Map,f=new Map,m=new Map,h=new Map,y=new Map,_=new Map,S=new Set,b=new Set,k=new Set,w=new Map,N=new Set,R=new Map,v=W=>{let q=new Map;for(let F of W)q.set(F,(q.get(F)??0)+1);return q},I=v(e.functions.map(W=>W.qualname)),A=v(e.classes.map(W=>W.qualname)),B=new Map(e.classes.map(W=>[W.qualname,W])),O=Fk(e),V=(W,q)=>q!==void 0&&Dk(W,q,e.moduleBindings,O),E=W=>!W.rebound&&W.decorators.every(q=>q!==null&&V(q,Mk.get(q)))&&(W.metaclass===null||V(W.metaclass,Pp.get(W.metaclass))),D=`${n}#${Il}`,L=qo(e.toplevelFlows,"none",0);o.push({id:D,moduleId:n,name:Il,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1,...L!==null?{valueFlows:L}:{}});let K=new Set,Y=new Set,le=new Set,z=new Map,Z=new Map,de=new Map,x=new Map,M=[];for(let W of e.classes){let q=`${n}#class:${W.qualname}`;W.decorators.length>0&&le.add(q),de.has(q)||de.set(q,W.range.start),c.set(W.qualname,q),_.set(q,W.qualname),W.bases.length>1&&S.add(q),W.interceptsLookup&&b.add(q),w.set(q,W.nonDefBinds),R.set(q,W.valueBases),(!E(W)||A.get(W.qualname)!==1)&&N.add(q),W.metaclass!==null&&!V(W.metaclass,Pp.get(W.metaclass))&&k.add(q);let F=u.get(q),ne=W.valueBases??W.bases;u.set(q,F===void 0?[...ne]:[...F,...ne]);let pe=W.qualname.includes(".")?W.qualname:W.name;if(r.push({id:q,moduleId:n,name:pe,implementsRefs:[],members:[]}),!x.has(q)){let Se=`${n}#<class:${W.qualname}>`;x.set(q,Se),M.push({id:Se,moduleId:n,name:pe,kind:"class",declRange:Js(t,W.range),isExported:!1,publicSurfaceReachable:!1})}}for(let W of e.functions){let q=`${n}#${W.qualname}`;l.set(W.qualname,q),h.set(W.qualname,W.params===null?null:new Set(W.params.map(Q=>Q.name)));let F=W.enclosingClass,ne=F!==null&&W.qualname===`${F}.${W.name}`,pe=ne?c.get(F):void 0,Se=F===null&&W.enclosingFunction===null,Ie=!Se&&!ne&&W.qualname===`${W.enclosingFunction??""}.${W.name}`?W.enclosingFunction:null,$=Se?Cp(W.name,e.all):ne&&!F.includes(".")?Cp(F,e.all):!1,T=ne?B.get(F):void 0,j=I.get(W.qualname)===1&&(T===void 0||A.get(T.qualname)===1)?Lk(W,T===void 0?void 0:E(T),t):null;if(j!==null&&y.set(q,j.kind),z.set(q,W.name),W.decorators.length>0&&Y.add(q),Z.get(q)!=="other"&&Z.set(q,W.decorated),(ne?ri.has(W.name)||Pk(W.decorators):Se&&Fp.has(W.name))&&K.add(q),o.push({id:q,moduleId:n,name:Se||ne?W.name:W.qualname,kind:pe!==void 0?W.name==="__init__"?"ctor":"method":"function",...pe!==void 0?{enclosingClassId:pe}:{},declRange:Js(t,W.range),isExported:$,publicSurfaceReachable:$,...j!==null?j.fields:{}}),Se&&(d.set(W.name,q),$)){let Q=s();i.push({id:Q,moduleId:n,exportedName:W.name,kind:"value"}),a.push({exportId:Q,target:{kind:"function",functionId:q}})}if(ne){let Q=p.get(F)??new Map;Q.set(W.name,q),p.set(F,Q)}if(Ie!==null){let Q=f.get(Ie)??new Map;Q.set(W.name,q),f.set(Ie,Q)}!Se&&!ne&&m.set(W.name,[...m.get(W.name)??[],q])}o.push(...M);let X=r.map(W=>{let q=[...c.entries()].find(([,ne])=>ne===W.id)?.[0],F=q===void 0?void 0:p.get(q);return F===void 0?W:{...W,members:[...F.values()]}});return{moduleId:n,functions:o,classes:X,exports:i,exportBindings:a,byQualname:l,topLevel:d,classByName:c,methods:p,baseSlots:u,nested:f,closures:m,paramNames:h,all:e.all,allComputed:e.allComputed,toplevelId:D,callable:y,moduleBindings:e.moduleBindings,staticBindings:e.staticBindings,aliases:O,classQualname:_,multiBase:S,intercepts:b,customMeta:k,nonDefBinds:w,rewrites:N,valueBases:R,starImport:e.starImport,attrWrites:e.attrWrites,implicitRoots:K,decoratedDefs:Y,decoration:Z,classStarts:de,decoratedClasses:le,defNames:z,classObjects:x,valueNames:e.valueNames,valueAttrs:e.valueAttrs,computedAccess:e.computedAccess,classBinds:e.classBinds,moduleBinds:e.moduleBinds,dunderWrites:e.dunderWrites,moduleCalls:e.moduleCalls,importRenames:e.imports.flatMap(W=>W.form==="from"?W.names.flatMap(q=>q.asname!==null?[[q.asname,q.name]]:[]):[])}}function Tk(e,n){let t=new Set,s=!1;for(let i of e.values())if(i.attrWrites===null)s=!0;else for(let a of i.attrWrites)t.add(a);let o=t.has("__class__")||t.has("__getattribute__"),r=new Map;for(let[i,a]of e){let l=new Map;for(let c of a.functions){let p=a.callable.get(c.id);if(p===void 0||s||c.name!==void 0&&t.has(c.name))continue;let u=p!=="function";u&&o||u&&c.enclosingClassId!==void 0&&n.has(c.enclosingClassId)||l.set(c.id,p)}if(l.size===a.callable.size){r.set(i,a);continue}let d=a.functions.map(c=>{if(!a.callable.has(c.id)||l.has(c.id))return c;let{params:p,receiver:u,reflectiveArguments:f,valueFlows:m,...h}=c;return h});r.set(i,{...a,functions:d,callable:l})}return r}var En={kind:"unknown"},oi={kind:"external"};function Rl(e,n,t,s,o=0,r=new Set){let[i,...a]=e;if(i===void 0||o>Xo)return En;let l=`${n}${e.join(".")}`;if(r.has(l))return En;r.add(l);let d=t.get(n),c=d?.moduleBindings;if(d===void 0||c===void 0||c===null)return En;let p=c.get(i);if(p===void 0)return o===0&&!d.starImport?oi:En;if(p==="class"){let y=a.length===0?d.classByName.get(i):void 0;return y===void 0?En:{kind:"class",id:y}}let u=d.aliases.get(i);if(p!=="import"||u?.rows!==1)return En;let f=s.get(n),m=f?.names.get(i);if(m!==void 0)return Rl([m.name,...a],m.moduleId,t,s,o+1,r);let h=f?.modules.get(i);return h!==void 0?u.exactModule&&a.length>0?Rl(a,h,t,s,o+1,r):En:f?.external?.has(i)===!0?oi:En}function $k(e,n){let t=new Map,s=new Map,o=[],r=(i,a,l)=>{let d=i.get(a);d===void 0?i.set(a,[l]):d.push(l)};for(let[i,a]of e)for(let[l,d]of a.classByName){let c=a.valueBases.get(d);if(c==null){o.push(d);continue}if(l.includes(".")){c.length>0&&o.push(d);continue}let p=!0;for(let u of c){let f=u===null?En:Rl(u.split("."),i,e,n);f.kind==="unknown"&&(p=!1),f.kind==="class"&&(r(t,f.id,d),r(s,d,f.id))}p||o.push(d)}return{sub:t,sup:s,unknown:Ss(o,t)}}function Ss(e,n){let t=new Set,s=[...e];for(let o=s.pop();o!==void 0;o=s.pop())if(!t.has(o)){t.add(o);for(let r of n.get(o)??[])s.push(r)}return t}function Lk(e,n,t){if(e.params===null||e.rebound)return null;let s;if(e.method){if(n!==!0)return null;if(e.decorated==="staticmethod")s="static-method";else if(e.decorated==="classmethod")s="class-method";else if(e.decorated==="none"&&!Rk.has(e.name))s="instance-method";else return null}else{if(e.decorated!=="none")return null;s="function"}let o=e.params;if(s==="instance-method"||s==="class-method"){let i=o[0];if(i===void 0||i.kind!=="positional"&&i.kind!=="positional-only")return null;o=o.slice(1)}let r=qo(e.valueFlows,o.length<e.params.length?"first":"none",e.params.length);return{kind:s,fields:{params:o.map((i,a)=>({index:a,kind:i.kind==="positional-only"?"positional":i.kind,...i.kind==="positional-only"?{}:{name:i.name},destructured:!1,hasDefault:i.hasDefault,range:{path:t,start:i.start,end:i.end}})),receiver:s==="instance-method"||s==="class-method"?"call":"none",reflectiveArguments:e.reflective,...r!==null?{valueFlows:r}:{}}}}function Dk(e,n,t,s){if(t===null)return!1;if(n===null)return!t.has(e);let o=e.split(".")[0]??e,r=s.get(o)?.source;return t.get(o)!=="import"||r===void 0||r.level!==0?!1:n.name===null?r.form==="import"&&r.name===n.module&&o===n.module:r.form==="from"&&r.module===n.module&&r.name===n.name&&o===n.name}function Fk(e){let n=new Map,t=(s,o,r)=>{let i=n.get(s);n.set(s,i===void 0?{rows:1,exactModule:o,...r!==void 0?{source:r}:{}}:{rows:i.rows+1,exactModule:!1})};for(let s of e.imports)for(let o of s.names){let r={form:s.form,module:s.module,level:s.level,name:o.name};s.form==="import"?t(o.asname??o.name.split(".")[0]??o.name,o.asname!==null||!o.name.includes("."),o.asname===null?r:void 0):t(o.asname??o.name,!0,o.asname===null?r:void 0)}return n}function Pl(e){let{envs:n}=e,t=e.children??new Map,s=jk(e.decls,{decls:e.decls,envs:n,children:t}),{inheritEdges:o}=s,r=$k(e.decls,n),i=[];for(let $ of e.decls.values())i.push(...$.customMeta);let a=Ss(i,r.sub),l=new Set(a);if(i.length>0)for(let $ of r.unknown)l.add($);let d=Tk(e.decls,l),c=new Map,p=($,T)=>{let j=c.get($)??[];j.includes(T)||j.push(T),c.set($,j)};for(let $ of d.values()){for(let T of $.methods.values())for(let[j,U]of T)p(j,U);for(let[T,j]of $.closures)for(let U of j)p(T,U)}for(let $ of e.rebinds??[]){let T=d.get($.moduleId)?.topLevel.get($.target);T!==void 0&&p($.attr,T)}let u=new Map;for(let $ of d.values())for(let T of $.classByName.values())u.set(T,$);let f=new Map,m=new Set,h=new Set,y=new Set(a),_=new Map;for(let $ of d.values()){for(let[T,j]of $.callable)f.set(T,j);for(let T of $.multiBase)m.add(T);for(let T of $.intercepts)h.add(T);for(let T of $.rewrites)y.add(T);for(let[T,j]of $.nonDefBinds)_.set(T,j)}let S=$=>{let T=_.get($),j=u.get($),U=j?.classQualname.get($);return T==null||j===void 0||U===void 0?null:new Set([...T,...j.methods.get(U)?.keys()??[]])},b=[],k=new Map;for(let $ of r.unknown){let T=new Set,j=!1;for(let U of Ss([$],r.sup)){let Q=S(U);if(Q===null||y.has(U)||h.has(U)){j=!0;break}for(let te of Q)T.add(te)}if(j){b.push($);continue}for(let U of T){let Q=k.get(U);Q===void 0?k.set(U,[$]):Q.push($)}}let w=$=>{let T=new Map;return j=>{let U=T.get(j);return U===void 0&&(U=Ss([j],$),T.set(j,U)),U}},N={decls:d,envs:n,kindOf:f,classOwner:u,multiBase:m,intercepts:h,rewrites:y,nonDefBinds:_,below:w(r.sub),above:w(r.sup),unplaced:r.unknown,unplacedAnyName:b,unplacedByName:k},R=[],v=[],I=0,A=0,B=new Set,O=!1,V=new Map;for(let $ of d.values()){if($.attrWrites===null)O=!0;else for(let T of $.attrWrites)B.add(T);for(let[T,j]of $.closures)V.set(T,[...V.get(T)??[],...j])}let E=new Set;for(let $ of d.values())for(let T of $.decoratedClasses)E.add(T);let D=new Map;for(let $ of d.values())for(let[T,j]of $.decoration)D.set(T,j);let L={hier:s,rewrites:y,decorated:E},K={byMethodName:c,children:t,selfTargets:Bk(s,c,{installable:$=>O||B.has($),closures:V,intercepts:h}),construct:Uk(L,$=>O||B.has($)),written:$=>O||B.has($),decoration:$=>D.get($)??"other"},Y=new Map;for(let{moduleId:$,call:T}of e.pending){let j=Y.get($);j===void 0?Y.set($,[T]):j.push(T)}let le=e.runtime===void 0?void 0:Rp(e.runtime,{decls:d,envs:n,written:K.written,calls:Y}),z=new Set,Z=new Map,de=[],x=new Map;for(let $ of e.pending){let{moduleId:T,path:j,call:U}=$,Q=d.get(T);if(Q===void 0)continue;if(U.raisedCall!==null){de.push($);continue}let te=U.enclosingFunction===null?Q.toplevelId:Q.byQualname.get(U.enclosingFunction)??Q.toplevelId,ie=Zk(U,T,Q,n.get(T),d,n,K),me=ew(U,T,Q,ie,N),ge=le?.(T,U);ie.how==="name-match"&&ie.resolution!=="unresolved"&&me.direct.size===0&&(ie=ts(ie)),Z.set(`${T}${String(U.range.start)}${String(U.range.end)}`,ie),e.preciseNames!==!1&&ie.how==="name-match"&&ie.resolution==="unresolved"&&ge?.receiverMethod!==void 0&&(ie={ids:[],resolution:"unresolved",how:"name-match"});let Re=`py-call:${T}:${String(I)}`;I+=1,x.set($,Re);let Oe=ie.resolution==="unresolved";Oe&&(A+=1,U.attr!==null&&z.add(U.attr),me=Sn),R.push({id:Re,enclosingFunctionId:te,calleeExprShape:U.receiver===null?"identifier":"member",resolvedTargetIds:Oe?[]:ie.ids,resolution:ie.resolution,range:Js(j,U.range),...tw(j,U,me.convention,ge?.argPrimitive),...ow(ge)});for(let _e of ie.ids)v.push({callSiteId:Re,calleeFunctionId:_e,resolution:Oe?"field-based":ie.resolution,...me.direct.has(_e)?{invocation:"direct"}:{}})}let M=$=>{let T=K.decoration($);return T==="none"||T==="staticmethod"||T==="classmethod"},X=Wk({decls:d,envs:n,hier:s,facts:L,intercepts:h,written:K.written,constructs:($,T)=>Z.get(`${$}${String(T.start)}${String(T.end)}`),certainTarget:M}),W=[];for(let[$,T]of x){let j=X($.moduleId,$.call);j!==void 0&&W.push({site:T,target:j})}if(W.length>0){let $=new Set(W.map(j=>j.site)),T=new Set;for(let j of v)$.has(j.callSiteId)&&T.add(`${j.callSiteId}${j.calleeFunctionId}`);for(let j of W)T.has(`${j.site}${j.target}`)||(T.add(`${j.site}${j.target}`),v.push({callSiteId:j.site,calleeFunctionId:j.target,resolution:"field-based"}))}for(let{moduleId:$,path:T,call:j}of de){let U=d.get($),Q=j.raisedCall;if(U===void 0||Q===null)continue;let te=Z.get(`${$}${String(Q.start)}${String(Q.end)}`);if(te===void 0||te.how==="construct"||te.ids.length===0)continue;let ie=`py-raise:${$}:${String(I)}`;I+=1,A+=1,R.push({id:ie,enclosingFunctionId:j.enclosingFunction===null?U.toplevelId:U.byQualname.get(j.enclosingFunction)??U.toplevelId,calleeExprShape:"unknown",resolvedTargetIds:[],resolution:"unresolved",range:Js(T,j.range)})}let q=new Map;for(let $ of e.loads??[]){let T=[$.moduleId,$.enclosingFunction??"",String($.at),$.shape].join(""),j=q.get(T);if(j===void 0)q.set(T,{load:$,targets:new Set($.targets)});else for(let U of $.targets)j.targets.add(U)}let F=0;for(let{load:$,targets:T}of q.values()){let j=d.get($.moduleId);if(j===void 0)continue;let U=new Set;for(let te of T){let ie=d.get(te)?.toplevelId;ie!==void 0&&U.add(ie)}if(U.size===0)continue;let Q=`py-load:${$.moduleId}:${String(F)}`;F+=1,R.push({id:Q,enclosingFunctionId:$.enclosingFunction===null?j.toplevelId:j.byQualname.get($.enclosingFunction)??j.toplevelId,calleeExprShape:$.shape,resolvedTargetIds:[...U],resolution:"resolved",range:{path:$.path,start:$.at,end:$.at}});for(let te of U)v.push({callSiteId:Q,calleeFunctionId:te,resolution:"resolved"})}let ne=[...d.values()].flatMap($=>$.functions),pe=new Map(ne.map($=>[$.id,$.declRange])),Se=new Set;for(let $ of R)for(let T of $.resolvedTargetIds)Se.add(`${$.enclosingFunctionId}${T}`);for(let[$,T]of d)for(let[j,U]of T.nested){let Q=T.byQualname.get(j);if(Q!==void 0)for(let te of U.values()){let ie=pe.get(te);if(ie===void 0||Se.has(`${Q}${te}`))continue;let me=`py-closure:${$}:${String(I)}`;I+=1,R.push({id:me,enclosingFunctionId:Q,calleeExprShape:"identifier",resolvedTargetIds:[te],resolution:"field-based",range:{path:ie.path,start:ie.start,end:ie.start}}),v.push({callSiteId:me,calleeFunctionId:te,resolution:"field-based"})}}let Ie=($,T,j,U,Q=$.toplevelId)=>{let te=[...new Set(j)];if(te.length===0&&!U)return;let ie=`py-implicit:${$.moduleId}:${String(I)}`;I+=1,U&&(A+=1),R.push({id:ie,enclosingFunctionId:Q,calleeExprShape:"unknown",resolvedTargetIds:U?[]:te,resolution:U?"unresolved":"field-based",range:{path:T.path,start:T.start,end:T.start}});for(let me of te)v.push({callSiteId:ie,calleeFunctionId:me,resolution:"field-based"})};for(let $ of d.values()){for(let U of $.implicitRoots){let Q=pe.get(U);Q!==void 0&&Ie($,Q,[U],!1)}let T=pe.get($.toplevelId)?.path??String($.moduleId),j=(U,Q)=>{let te=n.get($.moduleId),ie=Vk(U,{d:$,env:te,classQual:Q,decls:d,envs:n,facts:L});ie!==null&&Ie($,{path:T,start:U.at},ie.ids,ie.unnamed)};for(let[U,Q]of $.classBinds??[])for(let te of Q)j(te,U);for(let U of $.moduleBinds??[])Fp.has(U.name)&&j(U,null);for(let U of $.dunderWrites??[])(ri.has(U.name)||Bp.has(U.name))&&j(U,null);for(let[U,Q]of $.classByName){let te=$.methods.get(U);for(let[ie,me]of Ck){let ge=te?.get(ie),Re=ge===void 0?void 0:pe.get(ge);if(ge===void 0||Re===void 0)continue;(me==="any"||me==="mapping"&&El(s,Q,Gk).leaves||me==="iterator"&&El(s,Q,si,"__next__").reaches)&&Ie($,Re,[ge],!1)}if(El(s,Q,si).leaves){let ie=$.classStarts.get(Q);ie!==void 0&&Ie($,{path:T,start:ie},[],!0,Kk($,U))}}}for(let $ of d.values()){let T=pe.get($.toplevelId)?.path??String($.moduleId);for(let[j,U]of $.classObjects){let Q=new Set;for(let me of s.basesOf.get(j)??[]){if(me.kind!=="class")continue;let ge=s.classOwner.get(me.id)?.classObjects.get(me.id);ge!==void 0&&ge!==U&&Q.add(ge)}if(Q.size===0)continue;let te=`py-isa:${$.moduleId}:${String(I)}`;I+=1;let ie=$.classStarts.get(j)??0;R.push({id:te,enclosingFunctionId:U,calleeExprShape:"unknown",resolvedTargetIds:[...Q],resolution:"field-based",range:{path:T,start:ie,end:ie}});for(let me of Q)v.push({callSiteId:te,calleeFunctionId:me,resolution:"field-based"})}}return{functions:Xk(d,z),callSites:R,callEdges:v,inheritEdges:o,unresolved:A}}function Gp(e,n){return e===void 0?!1:e.allComputed?!0:e.all!==null?e.all.includes(n):!n.startsWith("_")}function ti(e,n,t,s=0,o=new Set){let[r,...i]=e;if(r===void 0||s>Xo)return En;let a=`${n}${e.join(".")}`;if(o.has(a))return En;o.add(a);let l=t.decls.get(n);if(l===void 0)return En;let d=l.classByName.get(e.join("."));if(d!==void 0)return{kind:"class",id:d};let c=t.envs.get(n),p=c?.names.get(r);if(p!==void 0){let u=ti([p.name,...i],p.moduleId,t,s+1,o);if(u.kind!=="unknown")return u}if(i.length>0){let u=c?.modules.get(r)??t.children.get(n)?.get(r);if(u!==void 0){let f=ti(i,u,t,s+1,o);if(f.kind!=="unknown")return f}}if(c?.external?.has(r)===!0)return oi;for(let u of c?.stars??[]){if(!Gp(t.decls.get(u),r))continue;let f=ti(e,u,t,s+1,o);if(f.kind!=="unknown")return f}return s===0&&l.moduleBindings!==null&&!l.moduleBindings.has(r)&&!l.starImport?oi:En}var Kp=256;function jk(e,n){let t=[],s=new Map,o=new Map,r=new Map,i=new Map,a=[],l=(m,h,y)=>{let _=m.get(h);_===void 0?m.set(h,[y]):_.push(y)};for(let[m,h]of e)for(let[y,_]of h.classByName){i.set(_,h);let S=h.baseSlots.get(_)??[],b=S.map(w=>w===null?En:ti(w.split("."),m,n));y.includes(".")&&S.length>0&&b.push(En),s.set(_,b),b.some(w=>w.kind==="unknown")&&a.push(_);let k=new Set;for(let w of b)w.kind==="class"&&k.add(w.id);for(let w of k)t.push({subclassId:_,superclassId:w,relation:"extends"}),l(o,w,_),l(r,_,w)}let d=Ss(a,o),c=new Map;for(let m of Ss(d,r)){let h=i.get(m),y=h?.classQualname.get(m),_=y===void 0?void 0:h?.methods.get(y);for(let[S,b]of _??[]){let k=c.get(S);k===void 0?c.set(S,[b]):k.push(b)}}let p=new Map,u=(m,h)=>{let y=p.get(m);if(y!==void 0)return y;if(h>Kp)return 2;p.set(m,0);let _=0;for(let b of s.get(m)??[])if(_+=b.kind==="unknown"?1:b.kind==="class"?u(b.id,h+1):0,_>=2)break;let S=Math.min(_,2);return p.set(m,S),S},f=!1;for(let m of d)if(u(m,0)>=2){f=!0;break}return{inheritEdges:t,basesOf:s,subclassesOf:o,classOwner:i,unplacedDefs:c,unplacedMixin:f}}function Cl(e,n,t){let s=e.classOwner.get(n),o=s?.classQualname.get(n);return o===void 0?void 0:s?.methods.get(o)?.get(t)}function Vo(e,n,t){let s=new Set,o=!1,r=!1,i=!1,a=new Set,l=[...n];for(let d=l.pop();d!==void 0;d=l.pop()){if(a.has(d))continue;a.add(d);let c=Cl(e,d,t);c!==void 0&&s.add(c);let p=e.classOwner.get(d),u=p?.nonDefBinds.get(d);if(u===null||u?.has(t)===!0)r=!0;else if(c===void 0){let f=p?.baseSlots.get(d)??[];for(let[m,h]of(e.basesOf.get(d)??[]).entries())h.kind==="class"?l.push(h.id):h.kind==="unknown"?o=!0:(p===void 0||!Ml(jp,f[m],p))&&(i=!0)}}return{ids:s,open:o,alias:r,outside:i}}function Bk(e,n,t){let s=new Map,o=new Map;return(r,i)=>{let a=`${r}${i}`,l=o.get(a);if(l!==void 0)return l;let d=s.get(r);d===void 0&&(d=Ss([r],e.subclassesOf),s.set(r,d));let{ids:c,open:p,alias:u,outside:f}=Vo(e,d,i),m=u,h=k=>{c.has(k)||(c.add(k),m=!0)};for(let k of e.unplacedDefs.get(i)??[])h(k);let y=t.installable(i)?t.closures.get(i)??[]:[];for(let k of y)h(k);let _="self",S;if(p||e.unplacedMixin){let k=new Set([...c,...n.get(i)??[]]);if(k.size<=Dp){if(k.size>c.size||p){for(let w of k)c.add(w);m=!0,_="name-match"}}else p&&(y.length>0||[...d].some(N=>Cl(e,N,i)!==void 0)||(S=xs),m=!0)}let b=!m&&!p&&!f&&!e.unplacedMixin&&!zp(e,d,t.intercepts);return S??=c.size===0?xs:{ids:[...c],resolution:b?c.size===1?"resolved":"field-based":"unresolved",how:_},o.set(a,S),S}}var Gk=new Set([...si].filter(e=>e!=="dict"));function El(e,n,t,s){let o=!1,r=!1,i=new Set,a=[n];for(let l=a.pop();l!==void 0;l=a.pop()){if(i.has(l))continue;i.add(l);let d=e.classOwner.get(l);if(s!==void 0){let p=d?.nonDefBinds.get(l);(Cl(e,l,s)!==void 0||p===null||p?.has(s)===!0)&&(r=!0)}let c=d?.baseSlots.get(l)??[];for(let[p,u]of(e.basesOf.get(l)??[]).entries())u.kind==="class"?a.push(u.id):(u.kind==="unknown"||d===void 0||!Ml(t,c[p],d))&&(o=!0)}return{leaves:o,reaches:o||r}}function Kk(e,n){for(let t=n;t.includes(".");){t=t.slice(0,t.lastIndexOf("."));let s=e.byQualname.get(t);if(s!==void 0)return s}return e.toplevelId}function zp(e,n,t){if(t.size===0)return!1;let s=new Set,o=[...n];for(let r=o.pop();r!==void 0;r=o.pop())if(!s.has(r)){if(s.add(r),t.has(r))return!0;for(let i of e.basesOf.get(r)??[])i.kind==="class"&&o.push(i.id)}return!1}var Ml=(e,n,t)=>typeof n=="string"&&e.has(n)&&t.moduleBindings!==null&&!t.moduleBindings.has(n)&&!t.starImport,zk=(e,n)=>Ml(si,e,n);function Tl(e,n){let t=new Set,s=[e];for(let o=s.pop();o!==void 0;o=s.pop()){if(t.has(o))continue;if(t.add(o),t.size>Kp||n.rewrites.has(o)||n.decorated.has(o))return!1;let r=n.hier.classOwner.get(o);if(r===void 0)return!1;let i=r.baseSlots.get(o)??[];for(let[a,l]of(n.hier.basesOf.get(o)??[]).entries())if(l.kind==="class")s.push(l.id);else if(l.kind==="unknown"||!zk(i[a],r))return!1}return!0}function Uk(e,n){let t=new Map;return s=>{let o=t.get(s);if(o!==void 0)return o;let r=e.hier.classOwner.get(s),i=r?.classQualname.get(s)??"",a=Op.map(p=>Vo(e.hier,[s],p)),l=i!==""&&!Op.some(n)&&!n(i.split(".").pop()??i)&&a.every(p=>!p.open&&!p.alias)&&Tl(s,e),d=r?.classObjects.get(s),c={ids:[...d!==void 0?[d]:[],...a.flatMap(p=>[...p.ids])],resolution:l?a.every(p=>p.ids.size<=1)?"resolved":"field-based":"unresolved",how:"construct",classId:s};return t.set(s,c),c}}function Zs(e,n,t,s,o=0,r=new Set,i=!1){if(o>Xo||r.has(`${e}${n}`))return;r.add(`${e}${n}`);let a=t.get(e),d=(a?.moduleBindings??(i?a?.staticBindings:null))?.get(n);if(d==="class")return a?.classByName.get(n);if(d!=="import"||a?.aliases.get(n)?.rows!==1)return;let c=s.get(e)?.names.get(n);return c===void 0?void 0:Zs(c.moduleId,c.name,t,s,o+1,r,i)}function Mp(e,n,t,s){return Zs(e,n,t,s,0,new Set,!0)}function Wk(e){let n=(o,r,i)=>{if(i>Xo)return;let a=e.decls.get(o),l=a?.moduleBindings?.get(r);if(a===void 0||l===void 0)return;if(l==="import"){let p=a.aliases.get(r)?.rows===1?e.envs.get(o)?.names.get(r):void 0;return p===void 0?void 0:n(p.moduleId,p.name,i+1)}let d=l==="other"?a.moduleCalls?.get(r):void 0,c=d===void 0?void 0:e.constructs(o,d);return c?.how==="construct"?c.classId:void 0},t=new Map,s=o=>{let r=t.get(o);if(r===void 0){let i=e.hier.classOwner.get(o)?.classQualname.get(o),a=Vo(e.hier,[o],"__new__");r=i!==void 0&&!i.includes(".")&&!e.written(i)&&!e.written("__new__")&&a.ids.size===0&&!a.open&&!a.alias&&!a.outside&&Tl(o,e.facts),t.set(o,r)}return r};return(o,r)=>{let i=r.receiver;if(r.attr===null||i===null||i.includes(".")||r.nameScope!=="module"||r.root!=="global"||e.written(i))return;let a=n(o,i,0);if(a===void 0||!s(a)||e.written(r.attr)||e.written("__class__")||e.written("__getattribute__")||zp(e.hier,[a],e.intercepts))return;let l=Vo(e.hier,[a],r.attr);if(l.open||l.alias||l.outside||l.ids.size!==1)return;let[d]=l.ids;return d!==void 0&&e.certainTarget(d)?d:void 0}}function Up(e,n,t){let s=n.aliases.get(e);return!e.includes(".")&&n.moduleBindings?.get(e)==="import"&&s?.rows===1&&s.exactModule?t?.modules.get(e):void 0}function Hk(e,n){let t=e.split(".");for(let s=t.length-1;s>0;s-=1)if(n.byQualname.has(t.slice(0,s).join(".")))return!0;return!1}function Al(e,n,t){let[s,...o]=n;if(s===void 0||o.length>0||!Tl(e,t))return null;let r=Vo(t.hier,[e],s);return r.open||r.alias?null:[...r.ids]}function qk(e,n){let[t,...s]=e.split("."),{d:o,env:r,classQual:i}=n;if(t===void 0||t==="")return null;if(i!==null){if(Hk(i,o))return null;let m=o.classByName.get(i),h=m===void 0?null:o.nonDefBinds.get(m)??null;if(h===null||h.has(t))return null;let y=o.methods.get(i)?.get(t);if(y!==void 0)return s.length===0?[y]:null}let a=o.moduleBindings?.get(t);if(o.moduleBindings===null)return null;if(a===void 0)return o.starImport||o.topLevel.has("__getattr__")?null:[];if(a==="def"){let m=o.topLevel.get(t);return m!==void 0&&s.length===0?[m]:null}if(a==="class"){let m=o.classByName.get(t);return m===void 0?null:Al(m,s,n.facts)}if(a!=="import"||o.aliases.get(t)?.rows!==1)return null;let l=r?.names.get(t);if(l!==void 0){let m=s.length===0?lt(l.moduleId,l.name,n.decls,n.envs,!0):void 0;if(m!==void 0)return[m];let h=Zs(l.moduleId,l.name,n.decls,n.envs);return h===void 0?null:Al(h,s,n.facts)}let d=Up(t,o,r),[c,...p]=s;if(d===void 0||c===void 0)return null;let u=p.length===0?lt(d,c,n.decls,n.envs,!0):void 0;if(u!==void 0)return[u];let f=Zs(d,c,n.decls,n.envs);return f===void 0?null:Al(f,p,n.facts)}function Vk(e,n){let t=e.value;if(t.kind==="const"||t.kind==="lambda"||t.kind!=="property"&&!ri.has(e.name)&&!Bp.has(e.name))return null;if(t.kind==="other")return{ids:[],unnamed:!0};let s=t.kind==="name"?[t.dotted]:t.accessors.flatMap(i=>i.kind==="name"?[i.dotted]:i.kind==="other"?[null]:[]),o=[],r=!1;for(let i of s){let a=i===null?null:qk(i,n);a===null?r=!0:o.push(...a)}return{ids:o,unnamed:r}}function Xk(e,n){let t=!1,s=new Set(n),o=new Map;for(let i of e.values()){(i.computedAccess||i.valueNames===null||i.valueAttrs===null)&&(t=!0);for(let a of i.valueNames??[])s.add(a);for(let a of i.valueAttrs??[])s.add(a);for(let[a,l]of i.importRenames){let d=o.get(a);d===void 0?o.set(a,[l]):d.push(l)}}let r=[...s];for(let i=r.pop();i!==void 0;i=r.pop())for(let a of o.get(i)??[])s.has(a)||(s.add(a),r.push(a));return[...e.values()].flatMap(i=>i.functions.map(a=>{let l=i.defNames.get(a.id)??"",d=a.id!==i.toplevelId&&(t||a.kind==="class"||a.enclosingClassId!==void 0||s.has(l)||i.decoratedDefs.has(a.id));return{...a,addressTaken:d}}))}function lt(e,n,t,s,o=!1,r=new Set,i=0){if(i>Xo)return;let a=`${e}${n}`;if(r.has(a))return;r.add(a);let l=t.get(e),d=l?.moduleBindings?.get(n),c=l?.topLevel.get(n);if(c!==void 0)return!o||d==="def"?c:void 0;let p=s.get(e),u=p?.names.get(n);if(u!==void 0)return o&&(d!=="import"||l?.aliases.get(n)?.rows!==1)?void 0:lt(u.moduleId,u.name,t,s,o,r,i+1);if(!o)for(let f of p?.stars??[]){if(!Gp(t.get(f),n))continue;let m=lt(f,n,t,s,!1,r,i+1);if(m!==void 0)return m}}var xs={ids:[],resolution:"unresolved",how:"none"};function Nl(e,n){let t=n.byMethodName.get(e)??[];return t.length===0||t.length>Dp?xs:{ids:t,resolution:"field-based",how:"name-match"}}function Yk(e,n,t){for(let s=n;s!==null&&s!=="";){if(t.byQualname.has(s)){let r=t.nested.get(s)?.get(e);if(r!==void 0)return{kind:"def",id:r};if(t.paramNames.get(s)?.has(e)===!0)return{kind:"param"}}let o=s.lastIndexOf(".");s=o<0?null:s.slice(0,o)}return{kind:"none"}}function Jk(e,n,t,s){let[o,...r]=e.split(".");if(o===void 0||o==="")return;let i=n?.modules.get(o);for(let a of r){if(i===void 0)return;i=t.get(i)?.modules.get(a)??s.get(i)?.get(a)}return i}function Zk(e,n,t,s,o,r,i){let a=e.attr,l=e.nameScope;if(a===null){if(e.callee===null||e.receiver!==null)return xs;let p=e.callee,u=Yk(p,e.enclosingFunction,t);if(l==="local-def"&&u.kind==="def")return ni({ids:[u.id],resolution:"resolved",how:"local"},i,null);let f=Qk(p,u,n,t,s,o,r);if(l!=="module")return ts(f);let m=lt(n,p,o,r,!0);if(m!==void 0&&f.ids[0]===m)return ni({ids:[m],resolution:"resolved",how:"bare"},i,p);if(f.ids.length>0)return ts(f);let h=Zs(n,p,o,r);if(h!==void 0)return i.construct(h);let y=Mp(n,p,o,r);return y===void 0?xs:Tp(i.construct(y))}if(e.receiver===null)return Nl(a,i);let d=e.receiver;if(Ik.has(d)&&e.enclosingFunction!==null){let p=e.enclosingFunction.split(".").slice(0,-1).join("."),u=t.classByName.get(p);if(u!==void 0){let f=i.selfTargets(u,a),m=t.byQualname.get(e.enclosingFunction),h=m===void 0?"other":i.decoration(m),y=e.root==="param0"&&(h==="none"||h==="classmethod");return f.resolution==="unresolved"||!y?ts(f):ni(f,i,a)}}let c=Jk(d,s,r,i.children);if(c!==void 0){let p=d.split("."),u=p[0]??d,f=l==="module"&&t.moduleBindings?.get(u)==="import"&&t.aliases.get(u)?.rows===1&&p.slice(1).every(b=>!i.written(b)),m=lt(c,a,o,r);if(m!==void 0){let b={ids:[m],resolution:"resolved",how:"module"};return f&&lt(c,a,o,r,!0)===m?ni(b,i,a):ts(b)}let h=Nl(a,i),y=f&&Up(d,t,s)===c,_=y?Zs(c,a,o,r):void 0;if(_===void 0){let b=y?Mp(c,a,o,r):void 0;if(b===void 0)return ts(h);let k=Tp(i.construct(b));return h.ids.length===0?k:{ids:[...new Set([...k.ids,...h.ids])],resolution:"unresolved",how:"construct"}}let S=i.construct(_);return h.ids.length===0?S:{ids:[...new Set([...S.ids,...h.ids])],resolution:S.resolution==="unresolved"?"unresolved":"field-based",how:"construct",classId:_}}return Nl(a,i)}function Qk(e,n,t,s,o,r,i){if(n.kind==="def")return{ids:[n.id],resolution:"resolved",how:"local"};let a=s.topLevel.get(e);if(a!==void 0)return{ids:[a],resolution:"resolved",how:"bare"};let l=o?.names.get(e),d=l!==void 0?lt(l.moduleId,l.name,r,i):lt(t,e,r,i);return d!==void 0?{ids:[d],resolution:"resolved",how:"bare"}:xs}function ts(e){return e.ids.length===0?xs:{...e,resolution:"unresolved"}}function Tp(e){let{classId:n,...t}=e;return ts(t)}function ni(e,n,t){return e.ids.some(o=>{let r=n.decoration(o);return r!=="none"&&r!=="staticmethod"&&r!=="classmethod"})||t!==null&&n.written(t)?ts(e):e}var Sn={direct:new Set,convention:"unknown"};function $p(e,n,t){return e!==void 0&&n.ids.length===1&&n.ids[0]===e&&t.get(e)==="function"?{direct:new Set([e]),convention:"direct"}:Sn}function Lp(e){return e.length>0&&e.every(n=>n==="instance-method")?"shifted":e.length>0&&e.every(n=>n==="class-method"||n==="static-method")?"direct":"unknown"}function ew(e,n,t,s,o){if(e.root!==(s.how==="self"?"param0":"global"))return Sn;let r=o.envs.get(n);switch(s.how){case"bare":return e.callee===null?Sn:$p(lt(n,e.callee,o.decls,o.envs,!0),s,o.kindOf);case"module":{let i=e.receiver===null?void 0:t.aliases.get(e.receiver),a=e.receiver===null?void 0:r?.modules.get(e.receiver);return e.receiver===null||e.attr===null||a===void 0||t.moduleBindings?.get(e.receiver)!=="import"||i?.rows!==1||!i.exactModule?Sn:$p(lt(a,e.attr,o.decls,o.envs,!0),s,o.kindOf)}case"self":{let i=e.attr,a=e.enclosingFunction===null?void 0:t.byQualname.get(e.enclosingFunction),l=a===void 0?void 0:o.kindOf.get(a);if(i===null||l!=="instance-method"&&l!=="class-method")return Sn;let d=(e.enclosingFunction??"").split(".").slice(0,-1).join("."),c=t.classByName.get(d),p=t.methods.get(d)?.get(i);if(c===void 0||p===void 0||!s.ids.includes(p))return Sn;let u=[];for(let y of s.ids){let _=o.kindOf.get(y);if(_===void 0||_==="function")return Sn;u.push(_)}let f=o.below(c),m=o.above(c);for(let y of f){if(y===c)continue;let _=o.nonDefBinds.get(y);if(o.multiBase.has(y)||o.rewrites.has(y)||o.intercepts.has(y)||_===void 0||_===null||_.has(i))return Sn;let S=o.classOwner.get(y),b=S?.classQualname.get(y),k=b===void 0?void 0:S?.methods.get(b)?.get(i);if(k!==void 0&&!s.ids.includes(k))return Sn}for(let y of m)if(o.intercepts.has(y))return Sn;if(o.unplaced.has(c)&&o.intercepts.size>0)return Sn;let h=y=>f.has(y)||m.has(y);return o.unplacedAnyName.some(y=>!h(y))||(o.unplacedByName.get(i)??[]).some(y=>!h(y))?Sn:{direct:new Set(s.ids),convention:l==="instance-method"?"direct":Lp(u)}}case"name-match":{let i=e.receiver===null||e.receiver.includes(".")?void 0:nw(e.receiver,t,r,o.decls),a=i===void 0?void 0:o.classOwner.get(i),l=i===void 0?void 0:a?.classQualname.get(i),d=l===void 0||e.attr===null?void 0:a?.methods.get(l)?.get(e.attr),c=d===void 0?void 0:o.kindOf.get(d);return d===void 0||c===void 0||c==="function"||!s.ids.includes(d)?Sn:{direct:new Set([d]),convention:Lp([c])}}default:return Sn}}function nw(e,n,t,s){let o=n.moduleBindings?.get(e);if(o==="class")return n.classByName.get(e);let r=t?.names.get(e);if(o!=="import"||r===void 0||n.aliases.get(e)?.rows!==1)return;let i=s.get(r.moduleId);return i?.moduleBindings?.get(r.name)==="class"?i.classByName.get(r.name):void 0}function tw(e,n,t,s=[]){let o=n.args,r=t==="shifted"&&o?.[0]?.kind!=="positional"?"unknown":t;return{...o!==null?{args:o.map((i,a)=>sw(e,i,a,s[a]===!0)),convention:r}:{},...n.receiverRange!==null?{receiverRange:Js(e,n.receiverRange)}:{},repeats:n.repeats}}function sw(e,n,t,s){return{index:t,...n.kind==="keyword"&&n.keyword!==void 0?{keyword:n.keyword}:{},spread:n.kind==="star"?"positional":n.kind==="double-star"?"keyword":!1,range:Js(e,n),...s?{primitive:!0}:{}}}function ow(e){return e===void 0?{}:{calleeDecl:e.calleeDecl,...e.runtimeId!==void 0?{runtimeId:e.runtimeId}:{},...e.summary!==void 0?{summary:e.summary}:{},...e.receiverPrimitive===!0?{receiverPrimitive:!0}:{}}}var rw=8,iw=new Set(["__new__","__init_subclass__","__class_getitem__"]),ii=e=>e.map(n=>n.name+"()".repeat(n.calls)).join(".");function aw(e){let n=/^(~|\.*)(.*)$/u.exec(e);if(n===null)return null;let t=[];for(let s of(n[2]??"").split(".")){let o=s.replace(/(?:\(\))+$/u,"");if(o==="")return null;t.push({name:o,calls:(s.length-o.length)/2})}return{lead:n[1]??"",segs:t}}function lw(e){let n=new Map,t=e.moduleBindings;if(t===null)return n;for(let s of e.imports)if(!(s.enclosingFunction!==null||s.guards.includes("type-checking")))for(let o of s.names){let r=o.name.split(".")[0]??o.name,i=o.asname??(s.form==="import"?r:o.name);if(t.get(i)!=="import")continue;let a=s.form==="import"?o.asname!==null?o.name:r:`${".".repeat(s.level)}${s.module!==null&&s.module!==""?`${s.module}.`:""}${o.name}`;n.set(i,a)}return n}function Vp(e,n){let t=new Map;for(let[f,m]of n.modules){let h=new Map;for(let _ of m.file.functions)h.set(_.qualname,(h.get(_.qualname)??0)+1);let y=new Map(m.file.functions.filter(_=>h.get(_.qualname)===1).map(_=>[_.qualname,_]));t.set(f,{...m,id:f,imports:lw(m.file),rows:y})}let s=(f,m,h=0)=>{if(h>rw)return null;let y=aw(f);if(y===null)return null;if(y.lead==="~"){let[S,...b]=y.segs;return S===void 0?null:o(m,S,b,h)}let _=y.segs;if(y.lead.length>0){let S=Qr(m.dotted,m.isPackage),b=S===""?[]:S.split("."),k=y.lead.length-1;if(k>=b.length)return null;_=[...b.slice(0,b.length-k).map(w=>({name:w,calls:0})),..._]}for(let S=_.length;S>=1;S-=1){if(_.slice(0,S).some(N=>N.calls>0))continue;let b=n.byDotted.get(ii(_.slice(0,S)));if(b===void 0)continue;let k=t.get(b);if(k===void 0||!k.app)return{kind:"name",text:ii(_)};let w=_[S];return w===void 0?null:o(k,w,_.slice(S+1),h)}return{kind:"name",text:ii(_)}},o=(f,m,h,y)=>{let _="()".repeat(m.calls)+h.map(N=>`.${ii([N])}`).join(""),S=f.file.moduleOrigins?.get(m.name);if(S!==void 0)return s(S+_,f,y+1);let b=f.imports.get(m.name);if(b!==void 0)return s(b+_,f,y+1);let k=f.file.moduleBindings?.get(m.name);if(k==="def"&&m.calls===0){let N=f.decls.topLevel.get(m.name),R=f.rows.get(m.name);return N===void 0||R===void 0?null:{kind:"function",module:f,id:N,row:R,rest:h}}if(k==="class"&&f.decls.classByName.has(m.name))return{kind:"class",module:f,qualname:m.name,calls:m.calls,rest:h};let w=f.file.annotatedAliases?.get(m.name);return w!==void 0&&m.calls===0&&h.length===0?{kind:"annotated",module:f,value:w}:null},r=(f,m)=>{if(f===null)return null;let h=s(f,m);return h?.kind==="name"?h.text:null},i=(f,m)=>f!==null&&m.includes(f),a=(f,m,h)=>f!==null&&m.some(y=>h.some(_=>f===`${y}.${_}()`)),l=new Map,d=new Set,c=(f,m,h)=>{let y=l.get(f);y===void 0?l.set(f,{row:m,regs:[h]}):y.regs.push(h)};for(let f of t.values()){for(let m of f.file.functions){let h=m.decoratorFacts;if(h===null||h.length===0||m.method||m.params===null)continue;let y=f.decls.byQualname.get(m.qualname);if(y===void 0||f.rows.get(m.qualname)!==m)continue;let _=h.map(b=>r(b.origin,f)),S=b=>{let k=_[b]??null;return a(k,Bn.apps,Bn.decorators)?Bn:a(k,Xn.apps,Xn.decorators)?Xn:null};h.forEach((b,k)=>{let w=S(k);if(w===null)return;d.add(y);for(let v=k+1;v<h.length;v+=1)if(S(v)===null)return;let N={path:f.path,start:b.start,end:b.end},R=w===Bn?Wp(m,f,s):Hp(m,b.rule);c(y,m,{model:w,at:N,params:R,form:"decorator"})})}for(let m of f.file.calls){let h=m.registration;if(h===null||m.args===null||m.args.length!==h.args.length)continue;let y=r(h.callee,f);if(y===null)continue;let _={path:f.path,start:m.range.start,end:m.range.end},S=(k,w)=>dw(m,k,w),b=k=>{let w=k===null?null:h.args[k]?.origin??null,N=w===null?null:s(w,f);return N?.kind!=="function"||N.rest.length!==0?null:(N.row.decoratorFacts??[null]).length===0?{id:N.id,row:N.row,ctx:N.module}:null};if(Bn.apps.some(k=>y===`${k}.${Bn.addRoute}`)){let k=b(S("endpoint",1));k!==null&&c(k.id,k.row,{model:Bn,at:_,params:Wp(k.row,k.ctx,s),form:"call"})}else if(Xn.apps.some(k=>y===`${k}.${Xn.addRule}`)){let k=b(S("view_func",2)),w=S("rule",0);k!==null&&c(k.id,k.row,{model:Xn,at:_,params:Hp(k.row,w===null?null:h.args[w]?.literal??null),form:"call"})}else if(i(y,vn.paths)||i(y,vn.regexes)){let k=i(y,vn.regexes),w=S("route",0),N=w===null?null:h.args[w]?.literal??null,R=S("view",1),v=R===null?null:h.args[R]?.origin??null,I=v===null?null:s(v,f);if(I?.kind==="function"&&I.rest.length===0&&hw(I.row,I.module,r))c(I.id,I.row,{model:vn,at:_,params:qp(I.row,0,N,k),form:"call"});else if(I?.kind==="class"&&I.calls===0&&I.rest.length===1&&I.rest[0]?.name==="as_view"&&I.rest[0].calls===1){let A=I.module.decls.methods.get(I.qualname);for(let B of vn.methods){let O=A?.get(B),V=I.module.rows.get(`${I.qualname}.${B}`);O===void 0||V===void 0||V.decorated!=="none"||c(O,V,{model:vn,at:_,params:qp(V,1,N,k),form:"call"})}}}}}let p=[];for(let[f,{regs:m}]of l)for(let h of m)p.push({handler:f,at:h.at,form:h.form});return{functions:e.map(f=>{let m=l.get(f.id),h=m?.row??cw(f,t),y=f;if(m!==void 0){let _=fw(m.row,m.regs);_.length>0&&(y={...y,sourceParams:_})}if(y.valueFlows===void 0&&h!==void 0&&h.valueFlows!==null){let S=m!==void 0||d.has(f.id)||h.valueFlows.some(b=>b.from.kind==="source")?uw(h):null;S!==null&&(y={...y,valueFlows:S})}return y}),registrations:p}}function dw(e,n,t){let s=e.args??[],o=s.findIndex(i=>i.kind==="keyword"&&i.keyword===n);if(o>=0)return o;let r=0;for(let i=0;i<s.length;i+=1){let a=s[i];if(a===void 0)break;if(a.kind==="star"||a.kind==="double-star")return null;if(a.kind==="positional"){if(r===t)return i;r+=1}}return null}function cw(e,n){let t=n.get(e.moduleId);if(t===void 0)return;let s=e.id.slice(`${e.moduleId}#`.length);return t.decls.byQualname.get(s)===e.id?t.rows.get(s):void 0}function uw(e){if(e.params===null)return null;let n;if(!e.method)n="none";else if(e.decorated==="staticmethod")n="none";else if(e.decorated==="none"&&!iw.has(e.name)||e.decorated==="classmethod")n="first";else return null;if(n==="first"){let t=e.params[0];if(t===void 0||t.kind!=="positional"&&t.kind!=="positional-only")return null}return qo(e.valueFlows,n,e.params.length)}function fw(e,n){let t=e.method&&e.decorated!=="staticmethod"?1:0,s=new Map,o=[...n].sort((r,i)=>r.at.path.localeCompare(i.at.path)||r.at.start-i.at.start);for(let r of o)for(let i of[...r.params].sort((a,l)=>a-l)){let a=i-t;a<0||s.has(a)||s.set(a,{index:a,sourceClass:r.model.sourceClass,model:r.model.id,registeredAt:r.at})}return[...s.values()].sort((r,i)=>r.index-i.index)}function Wp(e,n,t){let s=new Set,o=(a,l)=>{if(a===null)return null;let d=t(a,l);return d?.kind==="name"?d.text:null},r=(a,l)=>a!==null&&Bn.depends.includes(o(a.callee,l)??""),i=(a,l)=>Bn.schemes.includes(o(a.arg0,l)??"");return(e.params??[]).forEach((a,l)=>{let d=e.paramFacts?.[l]??null;if(d===null){s.add(l);return}let c=d.annotated!==null?{value:d.annotated,from:n}:null;if(c===null&&d.annotation!==null){let f=t(d.annotation,n);f?.kind==="annotated"&&(c={value:f.value,from:f.module})}let p=c!==null?o(c.value.type,c.from):o(d.annotation,n),u=[];r(d.default,n)&&d.default!==null&&u.push({call:d.default,from:n});for(let f of c?.value.meta??[])f!==null&&c!==null&&r(f,c.from)&&u.push({call:f,from:c.from});if(u.length>0){u.some(m=>i(m.call,m.from)||m.call.arg0===null&&Bn.forms.includes(p??""))&&s.add(l);return}Bn.injected.includes(p??"")||s.add(l)}),s}var pw=/<(?:[a-zA-Z_][a-zA-Z0-9_]*(?:\([^)]*\))?:)?([a-zA-Z_][a-zA-Z0-9_]*)>/gu;function Hp(e,n){let t=n===null?null:new Set([...n.matchAll(pw)].map(s=>s[1]));return Xp(e,0,t)}function qp(e,n,t,s){let o=e.params??[],r=o[n];if(r===void 0||r.kind!=="positional"&&r.kind!=="positional-only")return new Set;let i=new Set([n]);if(t===null)return o.forEach((c,p)=>{p>n&&i.add(p)}),i;let a=s?[...t.matchAll(/\(\?P<([^>]+)>/gu)].map(c=>c[1]):[...t.matchAll(/<(?:[^>:]+:)?([^>]+)>/gu)].map(c=>c[1]);if(a.length>0){for(let c of Xp(e,n+1,new Set(a)))i.add(c);return i}let l=s?[...t.matchAll(/(?<!\\)\((?!\?)/gu)].length:0,d=0;return o.forEach((c,p)=>{p<=n||d>=l||(c.kind==="positional"||c.kind==="positional-only"?(i.add(p),d+=1):c.kind==="rest"&&(i.add(p),d=l))}),i}function Xp(e,n,t){let s=new Set,o=t===null||t.size>0;return(e.params??[]).forEach((r,i)=>{i<n||(r.kind==="keyword-rest"?o&&s.add(i):(r.kind==="positional"||r.kind==="keyword-only")&&(t===null||t.has(r.name))&&s.add(i))}),s}var mw=new Set([...vn.passThrough,vn.apiView,...vn.apiViewSetters]);function hw(e,n,t){let s=e.decoratorFacts;return s===null?!1:s.every(o=>mw.has(t(o.origin,n)??""))}var gw=5e3,Yp=200,Jp=100,yw=new Set(["args","params","flows"]),Zp={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Qp(e){return`pkg:${e}`}function wt(e){return e.split(/[\\/]+/u).join("/")}function $l(e,n){let t=e.endsWith("/")?e:`${e}/`,s=wt(n),o=wt(t);return s.startsWith(o)?s.slice(o.length):null}function em(e){let n=wt(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let s=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),s].filter(o=>o!=="").join("."),isPackage:!1}}function Ll(e){return e.split(".")[0]??e}var _w="site-packages:";function Dl(e){let n=e.extract??ai,t=e.maxModules??gw,s=(e.externalRoots??[]).map(T=>wt(T).endsWith("/")?wt(T):`${wt(T)}/`),o=T=>{let j=wt(T);return s.find(U=>j.startsWith(U))??null},r=T=>o(T)!==null,i=[],a=new Map,l=[],d=[],c=new Set,p=new Set,u=new Map,f=new Map,m=[],h=[],y=new Map,_=new Set,S=new Set,b=[],k=0,w=()=>{let T=`py-export:${String(k)}`;return k+=1,T},N=null,R=!1,v=new Set,I=new Set,A=new Map,B=new Map,O=xp(T=>{let j=Dt(e.paths,T).resolved;return j!==null&&$l(e.projectRoot,j.path)!==null&&!r(j.path)}),V=new Map,E=[];for(let T of e.entryFiles){let j=$l(e.projectRoot,T);if(j===null){i.push({code:"unresolved-import",where:wt(T),detail:"entrypoint lies outside the project root; not analyzed"});continue}c.has(T)||(c.add(T),E.push({file:T,rel:j,isEntry:!0,packageName:"",modulePath:j}))}let D=T=>{let j=Qp(T);return a.has(j)||(p.add(T),a.set(j,{id:j,packageName:T,versionRange:"",path:T,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),j},L=0,K=(T,j,U,Q)=>{let te=`py-import:${String(L)}`;L+=1,l.push({id:te,moduleId:T,specifier:j,...U!==null?{resolvedModuleId:U}:{},isNamespace:!1,isDefault:!1,dynamic:Q,specifierIsLiteral:!0}),U!==null&&d.push({importId:te,resolvedModuleId:U})};for(let T=0;T<Jp&&E.length>0;T+=1){let j=E.slice(0,Yp);E=E.slice(Yp);let U=n(j.map(te=>te.file),e.python!==void 0?{python:e.python,hints:O}:{hints:O});if(N??=U.interpreter,v.size===0&&U.stdlib.length>0&&(v=new Set(U.stdlib)),I.size===0&&U.builtins.length>0&&(I=new Set(U.builtins)),A.size===0&&U.typeAttrs.size>0&&(A=U.typeAttrs),U.refused!==null)return i.push({code:"extract-refused",where:"",detail:`${U.refused}: ${U.diagnostics.join("; ")}`}),{graph:Zp,diagnostics:i,interpreter:U.interpreter,counts:{modules:0,surfaces:0},opaqueCode:[]};let Q=new Map(U.files.map(te=>[te.path,te]));for(let te of j){let ie=Q.get(te.file),me=te.rel,ge=em(te.modulePath);if(B.set(me,ge),a.set(me,{id:me,packageName:te.packageName,versionRange:"",path:te.modulePath,moduleSystem:"dual",isEntrypoint:te.isEntry}),ie===void 0||ie.refused!==null){i.push({code:"file-refused",where:te.rel,detail:ie?.refused??"no row was returned for this file"});continue}Y(ie,me,ge),x(ie,te.rel);let Re=ie.truncated.filter(Oe=>!yw.has(Oe));Re.length>0&&i.push({code:"extract-truncated",where:te.rel,detail:`the extract stopped at its per-file bound for ${Re.join(", ")}; what lies past it is not in this graph`}),u.set(me,Ol(ie,me,te.rel,w)),f.set(me,de(ie,me,ge)),V.set(me,{file:ie,decls:u.get(me),dotted:ge.dotted,isPackage:ge.isPackage,app:te.packageName==="",path:te.rel});for(let Oe of ie.calls)m.push({moduleId:me,path:te.rel,call:Oe});for(let Oe of ie.escapes){if(Oe.kind!=="attr-rebind")continue;let _e=Oe.attr??null;_e===null||Oe.target===null||b.push({moduleId:me,attr:_e,target:Oe.target})}}}function Y(T,j,U){for(let Q of T.imports){if(Q.guards.includes("type-checking"))continue;let te=[];if(Q.level>0){let ge=qs(U.dotted,U.isPackage,Q.level,Q.module);if("failure"in ge){i.push({code:"unresolved-import",where:T.path,detail:`relative import (level ${String(Q.level)}) ${ge.failure}`});continue}te.push(ge.dotted);for(let Re of Q.names)te.push(`${ge.dotted}.${Re.name}`)}else if(Q.module!==null){te.push(Q.module);for(let ge of Q.names)te.push(`${Q.module}.${ge.name}`)}else continue;let ie=!1,me=new Set;for(let ge of te)le(ge,j,Q.deferred,me)&&(ie=!0);if(me.size>0&&h.push({moduleId:j,path:j,enclosingFunction:Q.enclosingFunction,at:Q.range.start,shape:"require",targets:[...me]}),!ie){let ge=te[0]??"";K(j,ge,null,Q.deferred);let Re=Ll(ge);if(v.has(Re)||Q.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf(Re)===null)continue;i.push({code:"unresolved-import",where:T.path,detail:`\`${ge}\` did not resolve on the search path`})}}}function le(T,j,U,Q){let te=T.split("."),ie=!1;for(let me=1;me<=te.length;me+=1){let ge=te.slice(0,me).join("."),Re=Dt(e.paths,ge);if(Re.resolved===null)continue;let Oe=Z(Re.resolved,j,ge,U);Oe!==null&&Q.add(Oe),me===te.length&&(ie=!0)}return ie}function z(T){return c.has(T.file)||a.has(T.rel)?!0:c.size>=t?(R||(R=!0,i.push({code:"module-cap",where:T.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(c.add(T.file),E.push(T),!0)}function Z(T,j,U,Q){if(T.kind==="stub-only")return null;let te=T.kind==="module"||T.kind==="package",ie=$l(e.projectRoot,T.path);if(ie!==null&&!r(T.path)&&te){let Oe=ie;return K(j,U,Oe,Q),y.set(U,Oe),z({file:T.path,rel:ie,isEntry:!1,packageName:"",modulePath:ie}),Oe}let me=e.distributionOf(Ll(U));if(me===null)return K(j,U,null,Q),i.push({code:"unresolved-import",where:U,detail:`resolved to ${T.kind} outside the project, but no installed distribution provides \`${Ll(U)}\``}),null;let ge=o(T.path);if(!te||ge===null)return K(j,U,D(me),Q),_.add(U),(T.kind==="extension"||te&&ge===null)&&S.add(U),null;let Re=`${_w}${wt(T.path).slice(ge.length)}`;return K(j,U,Re,Q),y.set(U,Re),z({file:T.path,rel:Re,isEntry:!1,packageName:me,modulePath:wt(T.path).slice(ge.length)}),Re}function de(T,j,U){let Q=new Map,te=new Map,ie=new Set,me=new Map,ge=(_e,Ge)=>{ie.add(_e),me.set(_e,Ge)},Re=[],Oe=_e=>v.has(_e.split(".")[0]??_e)||_.has(_e);for(let _e of T.imports){if(_e.guards.includes("type-checking"))continue;let Ge=_e.module;if(_e.level>0){let Ue=qs(U.dotted,U.isPackage,_e.level,_e.module);if("failure"in Ue)continue;Ge=Ue.dotted}if(Ge!==null){if(_e.star){let Ue=y.get(Ge);Ue!==void 0&&!Re.includes(Ue)&&Re.push(Ue)}if(_e.form==="import"){let Ue=_e.names[0]?.asname??null;if(Ue!==null){let G=y.get(Ge);G!==void 0?Q.set(Ue,G):Oe(Ge)&&ge(Ue,Ge);continue}let In=Ge.split(".")[0]??Ge,Kn=y.get(In)??y.get(Ge);Kn!==void 0?Q.set(In,Kn):Oe(In)&&ge(In,In);continue}for(let Ue of _e.names){let In=Ue.asname??Ue.name,Kn=y.get(`${Ge}.${Ue.name}`);if(Kn!==void 0){Q.set(In,Kn);continue}let G=y.get(Ge);G!==void 0?te.set(In,{moduleId:G,name:Ue.name}):(Oe(Ge)||Oe(`${Ge}.${Ue.name}`))&&ge(In,`${Ge}.${Ue.name}`)}}}return Q.set("",j),{modules:Q,names:te,external:ie,externalOrigins:me,stars:Re}}function x(T,j){for(let U of T.escapes)switch(U.kind){case"loader-escape":i.push({code:"loader-escape",where:j,detail:`${U.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":i.push({code:"dynamic-load-set",where:j,detail:`${U.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":i.push({code:"module-registry-write",where:j,detail:`${U.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let Q=U.target;if(Q===null)break;let te=new Set;le(Q,j,!0,te),te.size>0&&h.push({moduleId:j,path:j,enclosingFunction:U.enclosingFunction,at:U.range.start,shape:"dynamic-import",targets:[...te]});break}case"dispatch-escape":break}}E.length>0&&i.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(Jp)} waves; the graph is INCOMPLETE`});let M=new Map;for(let[T,j]of y){let U=T.lastIndexOf(".");if(U<0)continue;let Q=y.get(T.slice(0,U));if(Q===void 0||Q===j)continue;let te=M.get(Q)??new Map;te.set(T.slice(U+1),j),M.set(Q,te)}let X=Pl({decls:u,envs:f,pending:m,rebinds:b,loads:h,children:M,preciseNames:e.preciseNames!==!1,runtime:{builtins:I,typeAttrs:A,stdlib:v,placed:T=>{let j=y.get(T);return j!==void 0?{kind:"module",id:j}:_.has(T)?{kind:"surface"}:null},packageOf:T=>a.get(T)?.packageName,dottedOf:T=>B.get(T)}}),{functions:W,registrations:q}=Vp(X.functions,{modules:V,byDotted:y}),F=new Map;for(let T of X.callSites)T.id.startsWith("py-call:")&&F.set(`${T.range.path}${String(T.range.start)}${String(T.range.end)}`,T.id);let ne=[],pe=new Set;for(let T of q){let j=T.form==="decorator"?T.at.end:T.at.start,U=F.get(`${T.at.path}${String(j)}${String(T.at.end)}`);U===void 0||pe.has(`${U}${T.handler}`)||(pe.add(`${U}${T.handler}`),ne.push({callSiteId:U,calleeFunctionId:T.handler,resolution:"field-based",invocation:"callback"}))}let Se=[...u.values()].flatMap(T=>T.classes),Ie=[...u.values()].flatMap(T=>T.exports),$=[...u.values()].flatMap(T=>T.exportBindings);return{graph:{...Zp,modules:[...a.values()],imports:l,importEdges:d,functions:W,classes:Se,exports:Ie,exportBindings:$,callSites:X.callSites,callEdges:[...X.callEdges,...ne],inheritEdges:X.inheritEdges},diagnostics:i,interpreter:N,counts:{modules:a.size-p.size,surfaces:p.size},opaqueCode:[...S].sort()}}import{readdirSync as bw,readFileSync as tm,statSync as li}from"node:fs";import An from"node:path";import{spawnSync as Sw}from"node:child_process";var xw="python3",kw=256*1024,ww=8*1024*1024,sm=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,vw=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function ss(e){try{return li(e).isFile()}catch{return!1}}function nm(e){try{return li(e).isDirectory()}catch{return!1}}function Ew(e,n){return An.relative(e,n).split(An.sep).join("/")}function Aw(e){let n=e.python??process.env.CUPEL_PYTHON??xw,t=Sw(n,["-I","-S",...Wo("metadata.py"),e.projectRoot],{encoding:"utf8",maxBuffer:ww,timeout:6e4}),s=l=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:l}]});if(t.error!==void 0||t.status!==0)return s("the declared entry surface could not be read; it is unknown, not empty");let o;try{o=JSON.parse(t.stdout)}catch{return s("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof o!="object"||o===null)return{entries:[],projectName:null,gaps:[]};let r=o,i=(Array.isArray(r.entryPoints)?r.entryPoints:[]).filter(l=>typeof l=="object"&&l!==null&&typeof l.name=="string"&&typeof l.target=="string"&&typeof l.kind=="string"),a=(Array.isArray(r.gaps)?r.gaps:[]).flatMap(l=>{if(typeof l!="object"||l===null)return[];let d=l,c=typeof d.file=="string"?d.file:"",p=typeof d.why=="string"?d.why:"";return[{source:"metadata",declaration:c,detail:p==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":p}]});return{entries:i,gaps:a,projectName:typeof r.projectName=="string"?r.projectName:null}}function Fl(e,n){let t=sm.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let s=t[1]??"",o=Dt(e.paths,s);if(o.resolved===null)return{detail:`\`${s}\` ${o.failure??"did not resolve"}`};if(o.resolved.kind==="namespace"||o.resolved.kind==="stub-only")return{detail:`\`${s}\` resolved to a ${o.resolved.kind}, which runs no code`};let r=Ew(e.projectRoot,o.resolved.path);return r.startsWith("..")?{detail:`\`${s}\` resolves outside the project root; not seeded`}:{file:r}}function Nw(e){let n=[];ss(An.join(e,"__main__.py"))&&n.push("__main__.py");let t=(s,o)=>{let r;try{r=bw(s).sort()}catch{return}for(let i of r){if(i.startsWith("."))continue;let a=An.join(s,i);nm(a)&&ss(An.join(a,"__init__.py"))&&ss(An.join(a,"__main__.py"))&&n.push(`${o}${i}/__main__.py`)}};return t(e,""),nm(An.join(e,"src"))&&t(An.join(e,"src"),"src/"),n}function Iw(e,n){let t=An.join(e,"Procfile");if(!ss(t))return[];let s;try{if(li(t).size>n)return[];s=tm(t,"utf8")}catch{return[]}let o=[];for(let r of s.split(/\r?\n/u)){let i=vw.exec(r);i?.[1]!==void 0&&o.push(i[1])}return o}var Rw=256*1024,Ow=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,Pw=/^\s*WORKDIR\s+(\S+)\s*$/imu,Cw=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,Mw=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,Tw=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function $w(e){let n=Pw.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let s=Cw.exec(t),o=s?.[1],r=s?.[2]?.replace(/\/+$/u,"");if(o===void 0||r===void 0||r!==n)continue;let i=o.replace(/\/+$/u,"");return i==="."?null:i}return null}function Lw(e,n){let t=[],s=r=>{let i=An.join(e,r);if(!ss(i))return null;try{return li(i).size>n?null:tm(i,"utf8")}catch{return null}},o=s("Dockerfile");if(o!==null){let r=$w(o);for(let i of o.split(/\r?\n/u)){let a=Ow.exec(i);a?.[1]!==void 0&&t.push({command:a[1],from:"Dockerfile",srcRoot:r})}}for(let r of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let i=s(r);if(i!==null)for(let a of i.split(/\r?\n/u)){let l=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(a);l?.[1]!==void 0&&t.push({command:l[1],from:r,srcRoot:null})}}return t}function Dw(e,n,t){let s=e.projectRoot,o=Tw.exec(n)?.[1];if(o!==void 0){for(let a of t===null?[o]:[An.join(t,o),o])if(ss(An.join(s,a)))return{file:a}}let r=Mw.exec(n)?.[1];if(r===void 0)return o===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${o}\` is not a file in this repository`};let i=sm.exec(r)?.[1]??"";for(let a of t===null?[""]:[t,""])for(let l of[`${i.replace(/\./gu,"/")}.py`,`${i.replace(/\./gu,"/")}/__init__.py`]){let d=a===""?l:An.join(a,l);if(ss(An.join(s,d)))return{file:d}}return Fl(e,r)}function jl(e){let n=[],t=[],s=new Set,o=(a,l,d)=>{let c=`${a} ${l}`;s.has(c)||(s.add(c),n.push({file:a,source:l,declaration:d}))},r=Aw(e);t.push(...r.gaps);for(let a of r.entries){let l=a.kind==="entry-point-group"?"entry-point-group":"console-script",d=Fl(e,a.target);"file"in d?o(d.file,l,`${a.name} = ${a.target}`):t.push({source:l,declaration:`${a.name} = ${a.target}`,detail:d.detail})}for(let a of Nw(e.projectRoot))o(a,"dunder-main",a);ss(An.join(e.projectRoot,"manage.py"))&&o("manage.py","manage-py","manage.py");let i=e.maxProcfileBytes??kw;for(let a of Iw(e.projectRoot,i)){let l=Fl(e,a);"file"in l?o(l.file,"launch-declaration",a):t.push({source:"launch-declaration",declaration:a,detail:l.detail})}for(let a of Lw(e.projectRoot,Rw)){let l=Dw(e,a.command,a.srcRoot),d=`${a.from}: ${a.command.trim()}`;"file"in l?o(l.file,"launch-declaration",d):t.push({source:"launch-declaration",declaration:d,detail:l.detail})}return{entrypoints:n,gaps:t,projectName:r.projectName}}var oM=256*1024*1024;var om="CUPEL_PYTHON",jw=["-I","-S"],Bw="python3",Gw=256*1024*1024,Kw=12e4,zw=512,rm=2e4,dm=new Set(["str","bytes","int","float","complex","bool","none","scalar","tuple","list","dict","set"]),Uw=new Set(["module","local-def","local","class"]);function ke(e,n=zw){return typeof e=="string"&&e.length<=n?e:null}function ks(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function Yo(e){let n=Nn(e)?e:{};return{line:ks(n.line),endLine:ks(n.endLine),col:ks(n.col),start:ks(n.start),end:ks(n.end)}}function Nn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function os(e){return Array.isArray(e)?e:[]}function Qs(e){return os(e).map(n=>ke(n))}function rs(e,n){return Number.isSafeInteger(e)&&Number.isSafeInteger(n)&&e>=0&&n>=e?{start:e,end:n}:null}var Ww={o:"positional-only",p:"positional",r:"rest",k:"keyword-only",K:"keyword-rest"},Hw={p:"positional",s:"star",k:"keyword",d:"double-star"};function eo(e,n){if(!Array.isArray(e))return null;let t=[];for(let s of e){let o=Array.isArray(s)?n(s):null;if(o===null)return null;t.push(o)}return t}function qw(e){return eo(e,([n,t,s,o,r])=>{let i=typeof n=="string"?Ww[n]:void 0,a=ke(t),l=rs(o,r);return i===void 0||a===null||a===""||typeof s!="boolean"||l===null?null:{kind:i,name:a,hasDefault:s,...l}})}function Vw(e){return eo(e,([n,t,s,o])=>{let r=typeof n=="string"?Hw[n]:void 0,i=rs(t,s);if(r===void 0||i===null)return null;if(r!=="keyword")return o===void 0?{kind:r,...i}:null;let a=ke(o);return a!==null&&a!==""?{kind:r,keyword:a,...i}:null})}var Xw=new Set(["def","class","import","other","multi"]);function im(e){if(!Nn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e))ke(t)!==null&&typeof s=="string"&&Xw.has(s)&&n.set(t,s);return n}var Yw=new Map([["c","copy"],["d","derive"],["f","field"],["w","await"],["r","return"],["a","argument"],["m","mutation"]]),Jw=new Map([["m","module"],["g","global"],["u","unknown"]]),Zw=new Set(["unmodeled","reflective","inner-function-param","caught","construct"]),Qw=256;function am(e,n){return Number.isSafeInteger(e)&&e>=n&&e<Qw?e:null}function ev(e,n){let[t,s,o,r]=e;switch(t){case"p":{let i=e.length===2&&n?am(s,0):null;return i===null?null:{kind:"declared-param",index:i}}case"l":{let i=ke(s);return e.length===3&&i!==null&&i!==""&&Number.isSafeInteger(o)&&o>=0?{kind:"local",name:i,declStart:o}:null}case"f":{let i=ke(s),a=Jw.get(o);return e.length===3&&i!==null&&i!==""&&a!==void 0?{kind:"free",name:i,binding:a}:null}case"c":case"r":{let i=e.length===3?rs(s,o):null;return i===null?null:{kind:t==="c"?"call-result":"call-receiver",at:i.start,end:i.end}}case"a":case"m":{let i=e.length===4?rs(s,o):null,a=am(r,t==="m"?-1:0);return i===null||a===null?null:{kind:t==="a"?"argument":"mutated-by-call",at:i.start,end:i.end,index:a}}case"R":return e.length===1?{kind:"return"}:null;case"k":return e.length===1?{kind:"constant"}:null;case"s":{let i=e.length===2?ke(s):null;return i===null?null:Sp(i)}case"o":return e.length===2&&Zw.has(s)?{kind:"opaque",reason:s}:null;default:return null}}function lm(e,n){if(!Nn(e))return null;let t=e.refs,s=e.edges;if(!Array.isArray(t)||!Array.isArray(s)||s.length>rm||t.length>2*rm)return null;let o=eo(t,r=>ev(r,n));return o===null?null:eo(s,([r,i,a])=>{let l=Number.isSafeInteger(r)?o[r]:void 0,d=Number.isSafeInteger(i)?o[i]:void 0,c=Yw.get(a);return l===void 0||d===void 0||c===void 0?null:{from:l,to:d,kind:c}})}var nv=/^(?:~|\.*)[^\s.()~]+(?:\(\))*(?:\.[^\s.()~]+(?:\(\))*)*$/u,tv=2048;function is(e){let n=ke(e);return n!==null&&nv.test(n)?n:null}function cm(e){return ke(e,tv)}function um(e){return Array.isArray(e)&&e.length===2?{callee:is(e[0]),arg0:is(e[1])}:null}function fm(e){return!Nn(e)||!Array.isArray(e.m)?null:{type:is(e.t),meta:e.m.map(um)}}function sv(e){return eo(e,([n,t,s,o])=>{let r=rs(t,s);return r===null?null:{origin:is(n),rule:cm(o),...r}})}function ov(e){return Array.isArray(e)?e.map(n=>{if(!Array.isArray(n)||n.length!==2)return null;let t=n[1];return{default:um(n[0]),annotated:fm(t),annotation:Nn(t)?is(t.o):null}}):null}function rv(e){if(!Array.isArray(e)||e.length!==2||!Array.isArray(e[1]))return null;let n=e[1].map(t=>Array.isArray(t)?{origin:is(t[0]),literal:cm(t[1])}:{origin:null,literal:null});return{callee:is(e[0]),args:n}}function Bl(e,n){if(!Nn(e))return null;let t=new Map;for(let[s,o]of Object.entries(e)){let r=n(o);ke(s)!==null&&r!==null&&t.set(s,r)}return t}var iv=/^(?:~|\.*)[^\s.()~]+(?:\.[^\s.()~]+)*$/u;function av(e){let n=ke(e);return n!==null&&iv.test(n)?n:null}function pm(e){if(!Array.isArray(e)||e.length<1||e.length>2||!dm.has(e[0]))return null;let n=e[0];if(e.length===1)return{type:n};let t=ke(e[1]);return t!==null&&t!==""?{type:n,unlessWritten:t}:null}function lv(e,n){return!Array.isArray(e)||n===null||e.length!==n.length?null:e.map(t=>t===null?null:pm(t))}var dv=new Set(["none","staticmethod","classmethod","other"]);function di(e){if(!Array.isArray(e))return null;let n=new Set;for(let t of e){let s=ke(t);if(s===null)return null;n.add(s)}return n}function cv(e){if(e===!0)return{kind:"lambda"};if(e===!1)return{kind:"const"};if(e===null)return{kind:"other"};let n=ke(e);return n!==null&&n!==""?{kind:"name",dotted:n}:null}function uv(e){if(!Array.isArray(e))return null;let n=e,[t,s]=n;if(t==="k"&&n.length===1)return{kind:"const"};if(t==="l"&&n.length===1)return{kind:"lambda"};if(t==="o"&&n.length===1)return{kind:"other"};if(t==="n"&&n.length===2){let o=ke(s);return o!==null&&o!==""?{kind:"name",dotted:o}:null}if(t==="p"&&n.length===2&&Array.isArray(s)){let o=[];for(let r of s){let i=cv(r);if(i===null)return null;o.push(i)}return{kind:"property",accessors:o}}return null}function Gl(e){return eo(e,([n,t,s])=>{let o=ke(n),r=uv(t);return o===null||o===""||r===null||!Number.isSafeInteger(s)||s<0?null:{name:o,value:r,at:s}})}function fv(e){if(!Nn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e)){let o=ke(t)===null?null:Gl(s);if(o===null)return null;n.set(t,o)}return n}var pv=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),mv=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function hv(e,n){if(n!==null)return[];let t=e.truncated;return Array.isArray(t)?t.map(s=>ke(s,64)??"unreadable"):["unreported"]}function gv(e){let n=Vw(e.args);return{args:n,calleeOrigin:av(e.calleeOrigin),receiverProof:pm(e.receiverProof),argProofs:lv(e.argProofs,n)}}function yv(e){let n=ke(e.path,4096);if(n===null)return null;let t=e.refused,s=typeof t=="string"&&mv.has(t)?t:null,o=ke(e.detail,200),r=os(e.imports).filter(Nn).map(b=>({form:b.form==="import"?"import":"from",module:ke(b.module),level:ks(b.level),names:os(b.names).filter(Nn).map(k=>({name:ke(k.name)??"",asname:ke(k.asname)})).filter(k=>k.name!==""),star:b.star===!0,deferred:b.deferred===!0,enclosingFunction:ke(b.enclosingFunction),guards:Qs(b.guards).filter(k=>k!==null),range:Yo(b.range)})),i=os(e.functions).filter(Nn).flatMap(b=>{let k=ke(b.name),w=ke(b.qualname);return k===null||w===null?[]:[{name:k,qualname:w,kind:b.kind==="async-function"?"async-function":"function",enclosingClass:ke(b.enclosingClass),enclosingFunction:ke(b.enclosingFunction),decorators:Qs(b.decorators),range:Yo(b.range),params:qw(b.params),method:b.method===!0,decorated:typeof b.decorated=="string"&&dv.has(b.decorated)?b.decorated:"other",rebound:b.rebound!==!1,reflective:b.reflective!==!1,valueFlows:lm(b.flows,!0),decoratorFacts:sv(b.decoratorFacts),paramFacts:ov(b.paramFacts)}]}),a=os(e.classes).filter(Nn).flatMap(b=>{let k=ke(b.name),w=ke(b.qualname);return k===null||w===null?[]:[{name:k,qualname:w,bases:Qs(b.bases),decorators:Qs(b.decorators),range:Yo(b.range),metaclass:b.metaclass===null?null:ke(b.metaclass)??"?",rebound:b.rebound!==!1,interceptsLookup:b.interceptsLookup!==!1,nonDefBinds:di(b.nonDefBinds),valueBases:Array.isArray(b.valueBases)?Qs(b.valueBases):null}]}),l=os(e.calls).filter(Nn).map(b=>({...gv(b),callee:ke(b.callee),attr:ke(b.attr),receiver:ke(b.receiver),enclosingFunction:ke(b.enclosingFunction),argCount:ks(b.argCount),range:Yo(b.range),receiverRange:Array.isArray(b.receiverRange)?rs(b.receiverRange[0],b.receiverRange[1]):null,root:b.root===null?null:b.root==="param0"||b.root==="global"?b.root:"other",nameScope:b.nameScope===null&&b.callee===null?null:Uw.has(b.nameScope)?b.nameScope:"local",raisedCall:Array.isArray(b.raisedCall)?rs(b.raisedCall[0],b.raisedCall[1]):null,repeats:b.repeats!==!1,registration:rv(b.registration)})),d=os(e.escapes).filter(Nn).flatMap(b=>{let k=b.kind,w=ke(b.callee);return typeof k!="string"||!pv.has(k)||w===null?[]:[{kind:k,callee:w,target:ke(b.target),attr:ke(b.attr),enclosingFunction:ke(b.enclosingFunction),range:Yo(b.range)}]}),c=e.all,p=Array.isArray(c)?Qs(c).filter(b=>b!==null):null,u=di(e.attrWrites),f=fv(e.classBinds),m=Gl(e.moduleBinds),h=Gl(e.dunderWrites),y=im(e.moduleBindings),_=hv(e,s),S=f===null&&a.length>0||m===null&&(y===null||y.has("__getattr__")||y.has("__dir__"))||h===null&&(u===null||[...u].some(b=>/^__.+__$/u.test(b))||l.length>0||i.length>0);return s===null&&S&&!_.includes("bindings")&&_.push("bindings"),{path:n,refused:s,...o!==null?{detail:o}:{},imports:r,functions:i,classes:a,calls:l,toplevelFlows:lm(e.toplevelFlows,!1),flowsRefused:e.flowsRefused===null?null:ke(e.flowsRefused,64)??"unreadable",escapes:d,all:p,allComputed:e.allComputed===!0,truncated:_,moduleBindings:y,staticBindings:y===null?im(e.staticBindings):null,attrWrites:u,starImport:e.starImport!==!1,moduleOrigins:Bl(e.moduleOrigins,is),annotatedAliases:Bl(e.annotatedAliases,fm),moduleCalls:Bl(e.moduleCalls,b=>Array.isArray(b)&&b.length===2?rs(b[0],b[1]):null),valueNames:di(e.valueNames),valueAttrs:di(e.valueAttrs),computedAccess:e.computedAccess!==!1,classBinds:f,moduleBinds:m,dunderWrites:h}}function ai(e,n={}){let t=n.env??process.env,s=n.python??t[om]??Bw,o=[],r=e.filter(h=>!h.includes(`
+`));r.length!==e.length&&o.push(`${String(e.length-r.length)} path(s) carried a newline and were not extracted`);let i=[...jw,...Wo("extract.py")];n.maxBytesPerFile!==void 0&&i.push("--max-bytes",String(n.maxBytesPerFile)),n.hints!==void 0&&i.push("--hints",JSON.stringify(n.hints));let a=Fw(s,i,{input:r.length>0?`${r.join(`
 `)}
-`:"",encoding:"utf8",maxBuffer:zS,timeout:n.timeoutMs??US,env:t});if(a.error!==void 0){let g=a.error.code,y=g==="ENOENT";return{refused:y?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,y?`no Python interpreter: \`${s}\` is not on PATH (set ${np} to the interpreter this project runs under)`:`the Python extract could not run (${g??a.error.message})`]}}if(a.status!==0){let g=(a.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,`the Python extract exited ${String(a.status??"on a signal")}${g!==""?`: ${g}`:""}`]}}let d=(a.stdout??"").split(`
-`).filter(g=>g.trim()!==""),l=null,c=[],p=[],u=new Map,f=[];for(let g of d){let y;try{y=JSON.parse(g)}catch{r.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!bn(y))continue;if(y.kind==="header"){l=xe(y.interpreter,64);let b=y.stdlib;Array.isArray(b)&&(c=b.filter(x=>typeof x=="string"&&x.length<=128)),p=Ft(y.builtins).filter(x=>typeof x=="string"&&x.length<=128),u=bk(y.typeAttrs);continue}let _=xk(y);if(_===null){r.push("the Python extract emitted a file row without a path; it was skipped");continue}f.push(_)}if(l===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,"the Python extract did not report an interpreter version"]};let h=i.length-f.length;return h>0&&r.push(`${String(h)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:l,files:f,stdlib:c,diagnostics:r,builtins:p,typeAttrs:u}}function bk(e){let n=new Map;if(!bn(e))return n;for(let[t,s]of Object.entries(e))!ip.has(t)||!Array.isArray(s)||n.set(t,new Set(s.filter(r=>typeof r=="string"&&r.length<=128)));return n}var kk="python3",wk={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","extract-truncated":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function vk(e,n,t=s=>Oo([],{python:s}).refused===null){let s=rs.resolve(e,n.envRel);for(let r of["bin/python3","bin/python","Scripts/python.exe"]){let i=rs.join(s,r);try{if(!Sk(i).isFile())continue}catch{continue}if(t(i))return i}return kk}function Ek(e,n){let t=[e];for(let s of n.sitePackages)t.push(rs.resolve(e,s));for(let s of n.pthFiles)for(let r of s.paths)t.push(rs.isAbsolute(r)?r:rs.resolve(e,s.sitePackages,r));return{roots:[...new Set(t)]}}function Nk(e){let n=[];for(let t of e.distInfos){let s=ar(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});s!==null&&n.push(s)}return n}function fp(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function Ak(e,n,t={}){let r=(t.readEnvironment??fr)(n),i=Nk(r),o=ho(i),a=r.diagnostics.map(_=>_),d=t.python??vk(n,r),l=Ek(n,r),c=Mk(r,o,l),p=new Map;for(let _ of i)p.set(_.name,Pk(_,c.distributions));for(let _ of c.seen)a.push(`startup hook: ${_}`);for(let _ of c.unattributed)a.push(`startup escape: ${_} \u2014 a module runs at interpreter start that no installed distribution claims`);let u=Ja({projectRoot:n,paths:l,python:d});for(let _ of u.gaps)a.push(`entrypoint \`${_.declaration}\` (${_.source}): ${_.detail}`);if(u.entrypoints.length===0)return a.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,graph:Ps,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:u.gaps,interpreter:null,diagnostics:a,execution:p};let f=Xa({projectRoot:n,paths:l,entryFiles:u.entrypoints.map(_=>rs.join(n,_.file)),environmentComplete:!r.truncated&&r.refused===null,externalRoots:r.sitePackages.map(_=>rs.resolve(n,_)),distributionOf:fp(o),python:d,...t.maxModules!==void 0?{maxModules:t.maxModules}:{}});for(let _ of f.diagnostics)a.push(`${_.code} at ${_.where}: ${_.detail}`);if(f.graph.modules.length===0)return{rootRel:e,graph:Ps,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:f.interpreter,diagnostics:a,execution:p};let h=new Map;for(let _ of f.graph.modules)h.set(_.id,_.id),h.set(_.path,_.id);let g=f.graph.modules[0]?.id,y=f.diagnostics.map(_=>({source:h.get(_.where)??g,cause:wk[_.code],reach:{kind:"unbounded"}}));if(c.unattributed.length>0&&y.push({source:g,cause:"dynamic-load",reach:{kind:"unbounded"}}),y.push(...Rk(f.graph)),f.opaqueCode.length>0){let _=f.graph.modules.find(x=>x.isEntrypoint)?.id??g,b=Ik(f.graph,f.opaqueCode,i);y.push({source:_,cause:"dep-opaque",reach:{kind:"loaded-package",ecosystem:"PyPI",alsoLoaded:b}}),a.push(`code no analysis reads is loaded (${up(f.opaqueCode)}): a loaded package is not reported unreachable, and neither is any of the ${String(b.length)} package(s) in the declared-dependency closure of the distributions that ship it (${up(b)})`)}return{rootRel:e,graph:f.graph,incompleteness:y,analysisAborted:null,entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:f.interpreter,diagnostics:a,execution:p}}var up=e=>`${e.slice(0,5).join(", ")}${e.length>5?", \u2026":""}`;function Ik(e,n,t){let s=new Set(e.modules.map(c=>c.packageName).filter(c=>c!=="")),r=new Map;for(let c of t){let p=r.get(c.name);if(p===void 0)r.set(c.name,new Set(c.requiresDist));else for(let u of c.requiresDist)p.add(u)}let i=new Set,o=ho(t),a=fp(o);for(let c of n){let p=a(c.split(".")[0]??c);p!==null&&i.add(p);for(let u of lr(o,c))i.add(u.name)}for(let c of t)s.has(c.name)&&(c.extensionModules>0||!c.recordKnown)&&i.add(c.name);let d=new Set,l=[...i];for(let c=l.pop();c!==void 0;c=l.pop())if(!d.has(c)){d.add(c);for(let p of r.get(c)??[])r.has(p)&&!d.has(p)&&l.push(p)}return[...d].sort((c,p)=>c<p?-1:c>p?1:0)}function Rk(e){let n=new Map(e.functions.map(r=>[r.id,r.moduleId])),t=new Set(e.modules.filter(r=>r.packageName!==""&&r.externalSurface!==!0).map(r=>r.id)),s=new Set;for(let r of e.callSites){if(r.resolution!=="unresolved")continue;let i=n.get(r.enclosingFunctionId);i!==void 0&&t.has(i)&&s.add(i)}return[...s].map(r=>({source:r,cause:"dep-opaque",reach:{kind:"dependency-dispatch"}}))}var Ps={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Ok(e){if(e.length===0)return null;let n=[],t=new Map;for(let _ of e){let b=_.rootRel===""?".":_.rootRel;for(let x of _.diagnostics)n.push(`${b}: ${x}`);for(let[x,k]of _.execution){let w=t.get(x);t.set(x,w===void 0?k:[...new Set([...w,...k])])}}let s=e.filter(_=>_.analysisAborted===null);if(s.length===0)return{graph:Ps,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let r=[],i=[],o=[],a=[],d=[],l=[],c=[],p=[],u=[],f=[],h=[],g=new Set;for(let _ of s){let b=_.rootRel===""?"":`${_.rootRel}::`,x=new Set(_.graph.modules.filter(R=>R.externalSurface===!0).map(R=>R.id)),k=R=>x.has(R)?R:`${b}${R}`,w=R=>`${b}${R}`,I=R=>`${b}${R}`,N=R=>`${b}${R}`,v=R=>`${b}${R}`,C=R=>`${b}${R}`;for(let R of _.graph.modules){if(R.externalSurface===!0){if(g.has(R.id))continue;g.add(R.id),r.push(R);continue}r.push({...R,id:k(R.id)})}for(let R of _.graph.imports)i.push({...R,id:w(R.id),moduleId:k(R.moduleId),...R.resolvedModuleId!==void 0?{resolvedModuleId:k(R.resolvedModuleId)}:{}});for(let R of _.graph.importEdges)o.push({importId:w(R.importId),resolvedModuleId:k(R.resolvedModuleId)});for(let R of _.incompleteness)h.push({...R,source:k(R.source)});for(let R of _.graph.functions)a.push({...R,id:I(R.id),moduleId:k(R.moduleId),...R.enclosingClassId!==void 0?{enclosingClassId:N(R.enclosingClassId)}:{}});for(let R of _.graph.classes)d.push({...R,id:N(R.id),moduleId:k(R.moduleId),members:R.members.map(I)});for(let R of _.graph.exports)l.push({...R,id:C(R.id),moduleId:k(R.moduleId)});for(let R of _.graph.exportBindings)c.push({exportId:C(R.exportId),target:R.target.kind==="function"?{kind:"function",functionId:I(R.target.functionId)}:{kind:"module",moduleId:k(R.target.moduleId)}});for(let R of _.graph.callSites)p.push({...R,id:v(R.id),enclosingFunctionId:I(R.enclosingFunctionId),resolvedTargetIds:R.resolvedTargetIds.map(I)});for(let R of _.graph.callEdges)u.push({...R,callSiteId:v(R.callSiteId),calleeFunctionId:I(R.calleeFunctionId)});for(let R of _.graph.inheritEdges)f.push({...R,subclassId:N(R.subclassId),superclassId:N(R.superclassId)})}let y=r[0]?.id;for(let _ of e)_.analysisAborted===null||y===void 0||h.push({source:y,cause:_.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:r,imports:i,importEdges:o,functions:a,classes:d,exports:l,exportBindings:c,callSites:p,callEdges:u,inheritEdges:f},incompleteness:h,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function pp(e,n={}){let t=e.filter(s=>ur(s));return t.length===0?null:Ok(t.map(s=>Ak(s.rel,s.abs,n)))}function Pk(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var Ck=["sitecustomize","usercustomize"];function Mk(e,n,t){let s=new Set,r=[],i=[];for(let o of e.pthFiles){for(let d of o.importModules){let l=lr(n,d);for(let p of l)s.add(p.name);let c=wt(t,d);if(c.resolved!==null){i.push(`${o.sitePackages}/${o.name}: \`import ${d}\` runs ${c.resolved.path}`);continue}l.length===0&&r.push(`${o.sitePackages}/${o.name}: \`import ${d}\``)}let a=o.importModules.length;o.importLines>a&&r.push(`${o.sitePackages}/${o.name}: ${String(o.importLines-a)} import line(s) whose module could not be read`)}for(let o of Ck){let a=wt(t,o);if(a.resolved===null)continue;let d=lr(n,o);for(let l of d)s.add(l.name);d.length===0?r.push(`${a.resolved.path}: \`import ${o}\` runs at every interpreter start`):i.push(`${o}: \`import ${o}\` runs ${a.resolved.path}`)}return{distributions:s,unattributed:r,seen:i}}import{readdirSync as Tk,readFileSync as $k}from"node:fs";import Lk from"node:path";var Dk=new Set(["summarized","crashed","over-cap"]),Fk=new Set(["function","method","ctor"]);function Ue(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function Qa(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function jk(e,n){Qa(e)||Ue(n,"edge is not an object");let{entryPath:t,entryExport:s,entryContainer:r,hops:i}=e;(typeof t!="string"||typeof s!="string")&&Ue(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&Ue(n,"entryContainer must be string or null"),(typeof i!="number"||!Number.isInteger(i)||i<0)&&Ue(n,"hops must be a non-negative integer");let o=e.target;if(Qa(o)||Ue(n,"edge target missing"),o.kind==="symbol"){let{exportName:a,container:d,symbolKind:l}=o;return typeof a!="string"&&Ue(n,"symbol target exportName"),d!==null&&typeof d!="string"&&Ue(n,"symbol target container"),(typeof l!="string"||!Fk.has(l))&&Ue(n,`symbol target kind ${JSON.stringify(l)}`),{entryPath:t,entryExport:s,entryContainer:r,target:{kind:"symbol",exportName:a,container:d,symbolKind:l},hops:i}}if(o.kind==="dep"){let{calleePackage:a,calleeSubpath:d,calleeExport:l}=o;return(typeof a!="string"||a.length===0)&&Ue(n,"dep target calleePackage"),d!==null&&typeof d!="string"&&Ue(n,"dep target calleeSubpath"),(typeof l!="string"||l.length===0)&&Ue(n,"dep target calleeExport"),{entryPath:t,entryExport:s,entryContainer:r,target:{kind:"dep",calleePackage:a,calleeSubpath:d,calleeExport:l},hops:i}}Ue(n,`unknown target kind ${JSON.stringify(o.kind)}`)}function Bk(e,n){Qa(e)||Ue(n,"root is not an object");let{packageName:t,analyzedVersion:s,tool:r,toolVersion:i,maxIndirections:o,status:a}=e;(typeof t!="string"||t.length===0)&&Ue(n,"packageName"),typeof s!="string"&&Ue(n,"analyzedVersion"),r!=="jelly"&&Ue(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof i!="string"&&Ue(n,"toolVersion"),typeof o!="number"&&Ue(n,"maxIndirections"),(typeof a!="string"||!Dk.has(a))&&Ue(n,`status ${JSON.stringify(a)} not in the enum`);let d=e.edges;return Array.isArray(d)||Ue(n,"edges is not an array"),a!=="summarized"&&d.length>0&&Ue(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:s,tool:r,toolVersion:i,maxIndirections:o,status:a,edges:d.map(l=>jk(l,n))}}function mp(e){let n=new Map,t=Tk(e).filter(s=>s.endsWith(".summary.json"));for(let s of t){let r=Lk.join(e,s),i;try{i=JSON.parse($k(r,"utf8"))}catch(d){Ue(s,`unparseable JSON: ${d instanceof Error?d.message:String(d)}`)}let o=Bk(i,s),a=n.get(o.packageName);a===void 0?n.set(o.packageName,[o]):a.push(o)}return n}import ut from"node:path";function Kk(e,n){let t=e.read(n);if(t===null)return null;let s=t.toString("utf8"),r=ut.posix.basename(n);if(r==="package-lock.json"||r==="npm-shrinkwrap.json")return pa(s);if(r==="pnpm-lock.yaml")return ma(s);if(r==="yarn.lock")return ha(s,zk(e,n));if(r==="uv.lock")return ba(s);if(r==="poetry.lock"){let i=e.read(ut.posix.join(ut.posix.dirname(n),"pyproject.toml")),o=i===null?[]:[..._o(i.toString("utf8")).keys()];return Sa(s,o)}return null}function zk(e,n){let t=new Map,s=e.read(ut.posix.join(ut.posix.dirname(n),"package.json"));if(s===null)return t;let r;try{r=JSON.parse(s.toString("utf8"))}catch{return t}if(typeof r!="object"||r===null)return t;for(let i of["dependencies","devDependencies","optionalDependencies"]){let o=r[i];if(!(typeof o!="object"||o===null||Array.isArray(o)))for(let[a,d]of Object.entries(o))typeof d=="string"&&!t.has(a)&&t.set(a,d)}return t}function hp(e,n,t=[]){let s=new Nt(e,Ia),r=new Map,i=new Map,o=new Map,a=[],d=u=>{if(!i.has(u)){let h=s.read(u)?.toString("utf8")??null,g=ut.posix.basename(u);i.set(u,h===null?null:g==="pyproject.toml"?_o(h):g.endsWith(".txt")?ka(h):ya(h))}return i.get(u)??null},l=(u,f)=>{let h=u.endsWith("pyproject.toml"),g=h?lt(f):f,y=h?[u,ut.posix.join(ut.posix.dirname(u),"requirements.txt")]:[u];for(let _ of y){let b=d(_)?.get(g);if(b!==void 0)return{path:_,line:b}}return null},c=(u,f,h)=>{let g=JSON.stringify([u,f,h]),y=o.get(g);if(y!==void 0)return y;r.has(u)||r.set(u,Kk(s,u));let _=r.get(u)??null,b=_===null?null:ga(_,f,h,{maxNodes:Ot.maxPackageGraphNodes,maxEdges:Ot.maxPackageGraphEdges}),x=null;if(b!==null&&a.length<Ot.maxPackageGraphs){x=`g${String(a.length)}`;let k=ut.posix.dirname(u);a.push({id:x,nodes:b.nodes.map(w=>{let I=w.directFrom===null?null:ut.posix.join(k,w.directFrom);return{id:w.id,name:w.name,version:w.version,direct:w.directFrom!==null,declaredIn:I===null?null:l(I,w.name)}}),edges:b.edges.map(w=>({from:w.from,to:w.to})),truncated:b.truncated})}return o.set(g,x),x},p=n.map(u=>{if(u.tier==="not-affected")return null;if(u.ecosystem==="PyPI"){for(let f of t){let h=c(f,u.packageName,u.version);if(h!==null)return h}return null}return u.packageLocation===null?null:c(u.packageLocation,u.packageName,u.version)});return{graphs:a,idOf:p}}import{isBuiltin as gp}from"node:module";function te(e){let n="";for(let t of e){let s=t.charCodeAt(0),r=s<32||s>=127&&s<=159;n+=r?"\\x"+s.toString(16).padStart(2,"0"):t}return n}var yp=1024,_p=4096,Mo=8,xp=512,bp=512,el=8,Uk=160,qk=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),nl=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),Hk=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,Wk=/\.[cm]?[jt]sx?$/u;function Sp(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let s=e.lastIndexOf("node_modules/");if(s!==-1){let r=e.slice(s+13).split("/"),i=r[0]??"";return i.startsWith("@")?r[1]===void 0?null:`${i}/${r[1]}`:i===""?null:i}return Hk.test(e)&&!Wk.test(e)?e:null}function Gk(e){return te(`${e.code} ${e.path}: ${e.detail}`.slice(0,Uk))}function kp(e){let{graph:n,facts:t,diagnostics:s}=e,r=new Map(n.modules.map(D=>[D.id,D])),i=new Map(n.modules.map(D=>[D.path,D])),o=qn(n),a=new Set;for(let D of o){let $=r.get(D);$!==void 0&&a.add($.packageName)}let d=new Map,l=0,c=!1,p=!1,u=D=>D.startsWith(`${e.appRootReal}/`)?D.slice(e.appRootReal.length+1):D;for(let D of s){if(D.code==="limit-exceeded"&&D.path===e.appRootReal){c=!0;continue}let $=Sp(u(D.path),i);if($===null){D.code==="out-of-root"&&l++,nl.has(D.code)&&(p=!0);continue}let L=i.get(u(D.path));L!==void 0&&nl.has(D.code)&&!L.path.includes("node_modules/")&&(p=!0);let H=d.get($);H===void 0?d.set($,[D]):H.push(D)}let f=new Map(n.imports.map(D=>[D.id,D])),h=new Set;for(let D of n.importEdges){let $=f.get(D.importId);$!==void 0&&r.get($.moduleId)?.externalSurface===!0&&h.add($.moduleId)}let g=[],y=new Set,_=n.modules.filter(D=>D.externalSurface===!0);for(let D of _){let $=d.get(D.packageName)??[],L=h.has(D.id),H=[],z=Ae=>Ae.code==="dependency-body"&&Ae.anchor===void 0&&/syntax/u.test(Ae.detail),Z=Ae=>Ae.code==="loader-escape"||Ae.code==="dependency-body"&&Ae.anchor===void 0&&!/syntax/u.test(Ae.detail),ie=$.filter(Ae=>qk.has(Ae.code)),ae=$.filter(Z),pe=$.filter(Ae=>nl.has(Ae.code)||z(Ae)),he=$.filter(Ae=>Ae.code==="out-of-root"),we=L&&ie.length===0,Ne=ae.length===0,Ie=!c&&pe.length===0,Fe=l===0&&he.length===0;L||H.push("(a) the package's entry was never followed to a module");for(let Ae of[...ie,...ae,...pe,...he]){if(H.length>=el)break;H.push(Gk(Ae))}c&&H.length<el&&H.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),l>0&&H.length<el&&H.push(`(d) ${String(l)} out-of-root diagnostic(s) no package can be read from`);let Le=["a","b","c","d"].filter(Ae=>!{a:we,b:Ne,c:Ie,d:Fe}[Ae]),Je=Le.length===0;Je&&y.add(D.id),g.push({packageName:te(D.packageName),module:te(String(D.id)),inReach:o.has(D.id),builtin:gp(D.packageName),followed:L,d1:{a:we,b:Ne,c:Ie,d:Fe},failing:Le,transparent:Je,evidence:H})}let b=new Set;for(let D of t)D.reach.kind==="unbounded"&&b.add(D.source);let x=D=>({module:te(String(D.module)),kind:D.kind,packageName:r.get(D.module)?.packageName??null}),k=new Set(_.filter(D=>gp(D.packageName)).map(D=>D.id)),w=new Set([...y,...k]),I=[],N=new Map,v=0,C=0,R=0,F=0,P=[],U=new Set;for(let D of t)D.reach.kind==="unbounded"&&U.add(D.cause);for(let D of t){if(D.reach.kind==="class-scope"){P.push({packageName:D.reach.packageName,container:D.reach.container});continue}if(D.reach.kind==="unbounded"||D.reach.kind==="dependency-dispatch"||D.reach.kind==="loaded-package")continue;F++;let $=D.reach.anchor,L=N.get(String($));L===void 0&&(L={today:Bs(n,$,b),d1:Bs(n,$,b,y),d1Builtins:Bs(n,$,b,w)},N.set(String($),L)),L.d1Builtins.length>0&&R++,L.today.length>0&&(v++,U.add(D.cause)),L.d1.length>0&&C++,I.length<_p&&I.push({anchor:te(String($)),packageName:te(r.get($)?.packageName??""),cause:D.cause,reachKind:D.reach.kind,blockersToday:L.today.slice(0,Mo).map(x),blockersUnderD1:L.d1.slice(0,Mo).map(x),blockedUnderD1Builtins:L.d1Builtins.length>0,moreToday:Math.max(0,L.today.length-Mo),moreUnderD1:Math.max(0,L.d1.length-Mo)})}let E=s.filter(D=>D.anchor===void 0&&D.classScope===void 0),T=new Map(e.loadSites.map(D=>[D.importId,D])),K=new Map;for(let D of e.loadSites){let $=K.get(D.path);$===void 0?K.set(D.path,[D.shape]):$.push(D.shape)}let J=D=>{if(D.code!=="loader-escape")return!1;let $=D.escapes??[];if($.length===0||$.some(H=>H!=="non-literal-load"))return!1;let L=K.get(D.path)??[];return L.length>0&&L.every(H=>H==="relative-bounded")},W=E.slice(0,bp).map(D=>({cause:e.causeOf(D.code),code:D.code,path:te(u(D.path)),attributedPackage:Sp(u(D.path),i),...D.escapes!==void 0?{escapes:[...D.escapes]}:{},...D.reason!==void 0?{reason:D.reason}:{},d2Dischargeable:J(D)})),se={};for(let D of E){if(D.code!=="unresolved-specifier")continue;let $=D.reason??"(none)";se[$]=(se[$]??0)+1}let Y=b.size===0?0:t.filter(D=>D.reach.kind==="unbounded").length,V=Math.max(0,Y-E.length),fe=Y-E.filter(J).length,S=[],A=0,j=0,ne=0;for(let D of n.imports){if(D.specifierIsLiteral)continue;ne++;let $=o.has(D.moduleId),L=T.get(String(D.id)),H=L?.shape??"unrecorded";$&&(A++,H==="relative-bounded"&&j++),S.length<xp&&S.push({importId:te(String(D.id)),path:te(r.get(D.moduleId)?.path??""),shape:H,text:te(L?.text??""),inReach:$})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:c,appCapHit:p,unattributedOutOfRoot:l,blindUnbounded:V,unbounded:W,anchors:I,surfaces:g.slice(0,yp),loads:S,counts:{modules:n.modules.length,reachMods:o.size,surfaces:_.length,surfacesInReach:g.filter(D=>D.inReach).length,transparentSurfaces:y.size,builtinSurfaces:k.size,anchors:F,anchorsBlockedToday:v,anchorsBlockedUnderD1:C,anchorsBlockedUnderD1Builtins:R,unbounded:Y,loadsInReach:A,loadsRelativeBounded:j,unresolvedByReason:se,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,g.length-yp),anchors:Math.max(0,F-_p),loads:Math.max(0,ne-xp),unbounded:Math.max(0,E.length-bp)}},reachedPackages:a,aborted:e.analysisAborted,unboundedFacts:Y,unboundedHard:fe,anchorsBlockedToday:v,anchorsBlockedUnderD1:C,anchorsBlockedUnderD1Builtins:R,loadsInReach:A,loadsAllBounded:A>0&&j===A,d2Eligible:e.rootBudget==="complete"&&!p&&!c,classScope:P,taintCausesToday:U}}var Vk=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),Xk=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function wp(e,n,t,s,r){if(t===null||e.reachedPackages.has(t.packageName))return;let i=e.classScope.some(v=>v.packageName===t.packageName&&v.container===t.container),o=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||i,a=t.symbolKind==="method"||t.symbolKind==="ctor",l=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||a||n.unknownKind!==void 0&&Vk.has(n.unknownKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":o?"taint":s>0?"oog":"unexpected",c=new Set(e.taintCausesToday);i&&c.add("dep-opaque");let p=e.aborted!==null?e.aborted:Xk.find(v=>c.has(v)),u=l==="pre-2b"?n.tier==="unknown"&&(a?n.unknownKind==="dep-opaque":!0):l==="denial"?n.tier==="not-reachable":l==="load"?n.tier==="unknown"&&n.unknownKind==="dynamic-load":l==="taint"?n.tier==="unknown"&&n.unknownKind===p:l==="oog"?n.tier==="unknown"&&n.unknownKind==="analysis-cap":!1,f=t.verified&&r===!0,h=e.aborted===null&&e.unboundedFacts===0&&!i&&s===0,g=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,y=f&&l==="taint"&&h&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,_=f&&l==="load"&&h&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,b=f&&(l==="load"||l==="taint")&&h&&g&&e.anchorsBlockedUnderD1===0,x=e.aborted===null&&e.unboundedHard===0&&!i&&s===0,k=f&&l==="load"&&x&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,w=f&&(l==="load"||l==="taint")&&x&&g&&e.anchorsBlockedUnderD1===0,I=f&&l==="taint"&&h&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,N=f&&(l==="load"||l==="taint")&&x&&g&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:l,agrees:u,verified:t.verified,surfaceComplete:r,oog:s,classScoped:i,predicted:{d1:y,d2:_,d1d2:b,d2Amended:k,d1d2Amended:w,d1Builtins:I,d1d2AmendedBuiltins:N}}}import{readFileSync as Yk,statSync as Jk}from"node:fs";var sl=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,To=/^[A-Za-z0-9_$.-]{1,128}$/u,vp=64,Ep=1024*1024,Np=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Ap=/^[A-Za-z0-9@_.-]{1,128}$/u;function Ge(e){throw new Error(`model claims rejected: ${e}`)}function tl(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Zk(e,n){tl(e)||Ge(`${n}: edge is not an object`);let{kind:t,anchorExport:s,anchorContainer:r,calleePackage:i,calleeContainer:o,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&Ge(`${n}: edge kind`),(typeof s!="string"||!To.test(s))&&Ge(`${n}: anchorExport ${JSON.stringify(s)}`),r!==null&&(typeof r!="string"||!To.test(r))&&Ge(`${n}: anchorContainer`),(typeof i!="string"||!sl.test(i))&&Ge(`${n}: calleePackage ${JSON.stringify(i)}`),o!==null&&(typeof o!="string"||!To.test(o))&&Ge(`${n}: calleeContainer`),(typeof a!="string"||!To.test(a))&&Ge(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:s,anchorContainer:r,calleePackage:i,calleeContainer:o,calleeExport:a}}function Ip(e){let n=Jk(e).size;n>Ep&&Ge(`file is ${String(n)} bytes, over the ${String(Ep)} cap`);let t;try{t=JSON.parse(Yk(e,"utf8"))}catch(r){Ge(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||Ge("root is not an array"),t.length>vp&&Ge(`${String(t.length)} claims over cap ${String(vp)}`);let s=[];for(let r of t){tl(r)||Ge("claim is not an object");let{packageName:i,modelId:o,range:a,edges:d}=r;(typeof i!="string"||!sl.test(i))&&Ge("packageName"),(typeof o!="string"||!Ap.test(o))&&Ge("modelId (identifier charset, 1-128 chars)"),s.some(c=>c.model.modelId===o)&&Ge(`duplicate modelId ${o} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!tl(a)||typeof a.introduced!="string")&&Ge(`${o}: range`),Np.test(a.introduced)||Ge(`${o}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let l=a.fixedBefore;l!==null&&typeof l!="string"&&Ge(`${o}: fixedBefore`),typeof l=="string"&&!Np.test(l)&&Ge(`${o}: range.fixedBefore ${JSON.stringify(l)} is not an exact x.y.z triple`),Array.isArray(d)||Ge(`${o}: edges`),d.length>64&&Ge(`${o}: ${String(d.length)} edges over cap ${String(64)}`),s.push({model:{packageName:i,modelId:o,edges:d.map(c=>Zk(c,o))},introduced:a.introduced,fixedBefore:l})}return s}var Qk=["in-app-purchase@1-v1"];function rl(e,n,t){let s=[],r=[],i=[],o=(a,d,l,c)=>{r.push(l),i.push({modelId:c??a.model.modelId,status:d,reason:l,edgeCount:a.model.edges.length})};for(let a of e){if(!sl.test(a.model.packageName)||!Ap.test(a.model.modelId)){o(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Qk.includes(a.model.modelId)){o(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(c=>c.kind!=="alias"&&c.kind!=="dispatch")){o(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let d=n(a.model.packageName);if(typeof d!="string"&&d!==void 0){o(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} installed at more than one version (${d.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(d===void 0){o(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let l;try{l=zt(d,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{o(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${d} not an exact triple \u2014 inert (never guessed)`);continue}if(!l){o(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${d} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}s.push(a.model),i.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:s,notes:r,dispositions:i}}var nw=4,tw={additiveForms:!0,namelessExports:!0},sw=new Set(["dep-opaque","dynamic-load","dispatch"]),rw={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function fl(e,n,t){return e.tier==="unknown"&&rw[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&sw.has(e.unknownKind)&&n!==null&&n.verified}var ow=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),et=class extends Error{},pl="cupel/coverage-gap",Cp={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function kr(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Rp(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Op(e,n,t){let s=new Map(e.modules.map(o=>[o.path,o.id])),r=e.modules[0]?.id;if(r===void 0)return[];let i=n.map(o=>({source:s.get(o.path)??r,cause:Cp[o.code],reach:o.classScope!==void 0?{kind:"class-scope",packageName:o.classScope.packageName,container:o.classScope.container}:o.anchor!==void 0?{kind:"via-module",anchor:o.anchor}:{kind:"unbounded"}}));for(let o of t)i.push({source:r,reach:{kind:"unbounded"},cause:o});return i}function dl(e,n,t,s,r){let i=t.filter(o=>o.exportName!==null&&(s===1||r||o.verified!==1));return i.length>0?i.map(o=>({advisoryId:e,packageName:n,exportName:o.exportName??"",container:o.container,symbolKind:o.symbolKind,sourcePath:o.sourcePath??"",derivation:o.derivation,confidence:o.confidence,verified:o.verified===1})):t.length===0||t.every(o=>o.exportName!==null&&o.verified===1)?[null]:[]}function iw(e,n){let t;try{t=wr(e)}catch{return!0}let s=3,r=(i,o)=>{if(o>s)return!1;let a;try{a=Pp(i)}catch{return!1}for(let d of a){if(d==="node_modules"||d.startsWith("."))continue;let l=nt.join(i,d),c;try{c=ul(l)}catch{continue}if(!c.isDirectory())continue;let p=nt.relative(t,l).split(nt.sep).join("/");try{if(ul(nt.join(l,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(r(l,o+1))return!0}return!1};return r(t,1)}function aw(e,n){let t="";for(let s of e)s.rel!==""&&n.startsWith(`${s.rel}/`)&&s.rel.length>t.length&&(t=s.rel);return t}function lw(e,n,t){let s=[];if(t&&s.push("nested-app-root"),n==="")return[...s,"manifest-unreadable"];let r;try{if(r=wr(nt.resolve(e,n)),!r.startsWith(wr(e)+nt.sep))return[...s,"manifest-unreadable"]}catch{return[...s,"manifest-unreadable"]}let i;try{let c=nt.join(r,"package.json");if(!ul(c).isFile())return[...s,"manifest-unreadable"];i=ew(c,"utf8")}catch{return[...s,"manifest-unreadable"]}let o;try{o=JSON.parse(i)}catch{return[...s,"manifest-unreadable"]}if(typeof o!="object"||o===null)return[...s,"manifest-unreadable"];let a=o;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&s.push("bin");let d=["preinstall","install","postinstall","prepare","prepublish"],l=a.scripts;if(typeof l=="object"&&l!==null){let c=l;d.some(p=>typeof c[p]=="string")&&s.push("install-script")}return(a.gypfile===!0||dw(r))&&s.push("native-artifact"),s}function dw(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=nt.join(e,n),s;try{s=Pp(t)}catch{continue}if(s.some(r=>r.endsWith(".node")))return!0}return!1}function cw(e){return new Set(["npm",...e.ecosystems?.()??[]])}function ml(e){return e.ecosystem??"npm"}function uw(e,n){let t=[];for(let s of e.perRoot){let r=new Map;for(let i of s.packages){let o=ml(i);n.has(o)||r.set(o,(r.get(o)??0)+1)}for(let[i,o]of[...r.entries()].sort())t.push({kind:"ecosystem-uncovered",detail:`${s.rootRel===""?"":`${s.rootRel}: `}${String(o)} ${i} distribution(s) were enumerated but the loaded shard carries no ${i} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${i} shard to assess them (ADR-109 D5).`,blindsAnalysis:!1,rootRel:s.rootRel})}return t}function fw(e,n,t){let s=new Set(e.perRoot.flatMap(o=>o.packages.map(ml))),r=new Map([...s].filter(o=>t.has(o)).map(o=>[o,pw(n,o)])),i=[];for(let o of e.perRoot)for(let a of[...new Set(o.packages.map(ml))].sort()){let d=r.get(a);if(d===void 0||d==="census")continue;let l=d==="project"?"one project's installed set":d==="corpus"?"a vetted corpus slice":"an undeclared population";i.push({kind:"shard-population-narrow",detail:`${o.rootRel===""?"":`${o.rootRel}: `}the loaded ${a} shard's population is ${l}, not the whole ${a} ecosystem: a package outside it carries no advisory row here, so it reports no findings \u2014 which is NOT a clean bill of health for it. Scan with a census shard to assess every package (ADR-114 D5).`,blindsAnalysis:!1,rootRel:o.rootRel})}return i}function pw(e,n){return e.populationModeFor!==void 0?e.populationModeFor(n):e.populationMode?.()}function Mp(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function mw(e,n,t){return new Map(n.map(s=>[Mp(s),lw(e,s.lockKey,t)]))}function hw(e){let n=new Map;for(let t of e){let s=n.get(t.advisory.id);s===void 0?n.set(t.advisory.id,[t]):s.push(t)}return n}function gw(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(r=>r.packageName===t.name)?e:{...e,tier:"unknown",reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,unknownKind:"symbol-unsupported",basis:void 0,path:void 0}}function yw(e,n,t,s,r,i,o){let{finding:a}=Sr(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:o(t)},kr(s.advisory.id,t.name,s.affected),null,r,i);return a.decidedAtStage!=="presence"&&a.decidedAtStage!=="version-match"}function Sr(e,n,t,s,r,i,o){let a=Qo({graph:e,installed:t,range:s,symbol:r,coverage:null,incompleteness:i,analysisAborted:o});if(n!==null&&r!==null&&fl(a,r,"base")){let d=Ks(e,n.modulesById,n.reachMods,r,n.records);if(d!==null)return{finding:a,hit:d}}return{finding:a,hit:null}}function _w(e,n){let t=new Set,s=[];for(let r of e.packages)if((r.ecosystem??"npm")==="npm")for(let{advisory:i,affected:o}of n.advisoriesForPackage(r.ecosystem??"npm",r.name)){let a=kr(i.id,r.name,o),d;try{d=zt(r.version,a)}catch{continue}if(d)for(let l of n.symbolsForAffected(o.id)){if(l.verified!==1||l.symbolKind!=="method"&&l.symbolKind!=="ctor"||l.container===null||l.sourcePath===null)continue;let c=`${r.lockKey}\0${l.container}\0${l.sourcePath}`;t.has(c)||(t.add(c),s.push({packageName:r.name,packageRootRel:r.lockKey,container:l.container,sourcePath:l.sourcePath}))}}return s.sort((r,i)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`)),s.slice(0,so)}function xw(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),r=new Map(e.classes.map(a=>[a.id,a.name])),i=new Map(e.callSites.map(a=>[a.id,a])),o=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let d=i.get(a.callSiteId);if(d===void 0)continue;let l=s.get(d.enclosingFunctionId);if(l===void 0||!t.has(l.moduleId))continue;let c=n.get(l.moduleId);if(c===void 0)continue;let p=s.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&o.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:l.id})}return o}function bw(e){let n=new Set(e.modules.filter(c=>c.isEntrypoint).map(c=>c.id)),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.functions.map(c=>[c.id,c])),r=new Set;for(let c of e.functions)n.has(c.moduleId)&&(c.publicSurfaceReachable||c.name==="<toplevel>")&&r.add(c.id);let i=new Map(e.exports.map(c=>[c.id,c]));for(let c of e.exportBindings){if(c.target.kind!=="function")continue;let p=i.get(c.exportId);if(p===void 0||!n.has(p.moduleId))continue;let u=s.get(c.target.functionId);u===void 0||t.get(u.moduleId)?.externalSurface===!0||r.add(u.id)}let o=new Map(e.callSites.map(c=>[c.id,c.enclosingFunctionId])),a=new Map;for(let c of e.callEdges){if(c.resolution!=="resolved"&&c.resolution!=="field-based")continue;let p=o.get(c.callSiteId);if(p===void 0)continue;let u=a.get(p);u===void 0?a.set(p,[c.calleeFunctionId]):u.push(c.calleeFunctionId)}let d=new Set(r),l=[...r];for(;l.length>0;){let c=l.pop();if(c!==void 0)for(let p of a.get(c)??[])d.has(p)||(d.add(p),l.push(p))}return d}function Sw(e,n,t,s){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let i=t.filter(a=>a.packageName===r.anchor.packageName&&a.exportName===r.anchor.exportName&&a.container===r.anchor.container),o=i.find(a=>a.resolution==="resolved")??i[0];if(o!==void 0)return s.has(o.callerFunctionId)}return null}function kw(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(i=>i.modelId!==void 0);let s=new Set(t),r=i=>s.has(i)||s.has(Rn[i]??"");return e.some(i=>i.tier==="unknown"&&i.unknownKind!==void 0&&r(i.unknownKind)||i.modelPromotedFromKind!==void 0&&r(i.modelPromotedFromKind))}function hl(e){let n=Cs.now(),t=wr(e.dir),s=e.reader??(e.shardPathPypi!==void 0?mi([Ws(e.shardPath),Ws(e.shardPathPypi)]):Ws(e.shardPath)),r=e.partialRows===!0;try{if(!/^\d+$/u.test(s.schemaVersion)||Number(s.schemaVersion)>Number(ps))throw new et(`shard schema ${JSON.stringify(s.schemaVersion)} is unreadable or newer than this cupel understands (v${ps})`);let i=null;if(e.summaryShadow!==void 0)try{i=mp(e.summaryShadow)}catch(G){throw new et(`--summary-shadow facts dir rejected: ${G instanceof Error?G.message:String(G)}`)}let o=null;if(e.modelShadow!==void 0)try{o=Ip(e.modelShadow.claimsPath)}catch(G){throw new et(`--model-shadow claims rejected: ${G instanceof Error?G.message:String(G)}`)}let a=va(t,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{}}),d=pf(t,a,e.installedSet);if(d.truncated){let G=d.perRoot.filter(ue=>ue.truncated).map(ue=>ue.rootRel===""?"the scan root":`\`${ue.rootRel}\``);throw new et(`the dependency enumeration hit a hard cap and is incomplete at ${G.length>0?G.join(", "):"the union across roots"} (${d.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let l=pp(a.roots),c=l?.execution??null,p=hf(d.packages.filter(G=>(G.ecosystem??"npm")==="npm")),u=e.entry??[],f=u.length>0?wu(t,u):{entrypoints:[],rejected:[]},h=f.rejected,g=ku(t,a.roots),y=[...new Set([...g.entrypoints,...f.entrypoints])],_=[...g.sources];for(let G of f.entrypoints)g.entrypoints.includes(G)||_.push({source:"--entry",specifier:G,entrypoint:G,launch:!1,root:aw(a.roots,G)});let b=[..._];for(let G of l?.roots??[])for(let ue of G.entrypoints)_.push({source:`python:${ue.source}`,specifier:ue.declaration,entrypoint:G.rootRel===""?ue.file:`${G.rootRel}/${ue.file}`,launch:ue.source==="console-script"||ue.source==="launch-declaration",root:G.rootRel});let x=_w(d,s),k=e.bindingForms??tw,w=e.callablePackageResolver===!0,I=e.tsconfigPaths!==!1,N=iw(t,mr(_)),v=mw(t,d.packages,N),C=G=>(G.ecosystem??"npm")!=="npm"?c?.get(G.name)??["manifest-unreadable"]:v.get(Mp(G))??["manifest-unreadable"],R=ra({appRoot:t,entrypoints:y,depClassAnchors:x,bindingForms:k,callablePackageResolver:w,tsconfigPaths:I}),F=R.graph,P=Zo(F),U=[...g.diagnostics,...oa(g),...ia(g,y.length),...Pa(a,b),...R.diagnostics],E=Rp(y.length,F),T=G=>d.packages.some(ue=>(ue.ecosystem??"npm")===G),K=l===null?"no-entrypoint":l.analysisAborted,J=(T("npm")?E:null)??(T("PyPI")?K:null)??(T("npm")||T("PyPI")?null:E),W=cw(s),se=[...d.gaps,...gf(a),...uw(d,W),...fw(d,s,W)],Y=yf(se),V=Op(F,U,Y),fe={graph:Ps,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},S=G=>(G.ecosystem??"npm")==="npm"?{graph:F,incompleteness:V,analysisAborted:E,symbolsDecidable:!0}:l===null?fe:{...l,symbolsDecidable:!0},A=t;try{A=wr(t)}catch{}let j=kp({graph:F,facts:V,diagnostics:U,analysisAborted:E,loadSites:R.loadSites,conditionUnions:R.conditionUnions,provenAbsent:R.provenAbsent,appRootReal:A,rootBudget:a.budget,causeOf:G=>Cp[G]}),ne=s.allModels?.()??[],X=rl(ne.map(G=>({model:{packageName:G.packageName,modelId:G.modelId,edges:G.edges},introduced:G.introduced,fixedBefore:G.fixedBefore})),p),D=X.models.length>0?sr(F,X.models).delta:null,$=D!==null?{records:D.records,reachMods:qn(F),modulesById:new Map(F.modules.map(G=>[G.id,G]))}:null,L=Cs.now(),H=[],z=new Map,Z=ow(),ie=[],ae=[];for(let G of d.packages){let ue=S(G),ye=(G.ecosystem??"npm")==="npm"?$:null;for(let[,be]of hw(s.advisoriesForPackage(G.ecosystem??"npm",G.name))){let Ke=be[0];if(Ke!==void 0){let Be=z.get(Ke.advisory.id),Kn=be.map(Qe=>Qe.affected);if(Be===void 0)z.set(Ke.advisory.id,{advisory:Ke.advisory,ranges:Kn});else{let Qe=new Set(Be.ranges.map(pn=>pn.id));for(let pn of Kn)Qe.has(pn.id)||(Qe.add(pn.id),Be.ranges.push(pn))}}let Pe=be.filter(Be=>yw(ue.graph,ye,G,Be,ue.incompleteness,ue.analysisAborted,C)),Dn=Pe.length>0?Pe:be.slice(0,1),pt=Pe.length===0;for(let{advisory:Be,affected:Kn}of Dn){let Qe=kr(Be.id,G.name,Kn),pn=Be.cveId??Be.id,Bt=pt?[]:s.symbolsForAffected(Kn.id),$s=Bt.filter(je=>je.exportName===null),mt=dl(Be.id,G.name,Bt,Kn.surfaceComplete,r),ht=Sr(ue.graph,ye,{name:G.name,version:G.version,...G.ecosystem!==void 0?{ecosystem:G.ecosystem}:{},devOnly:G.dev,outOfGraphExecution:C(G)},Qe,null,ue.incompleteness,ue.analysisAborted).finding;if(ht.decidedAtStage==="presence"||ht.decidedAtStage==="version-match"){Z[ht.tier]+=1,H.push({...ht,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:Qe.surfaceComplete,advisoryId:Be.id,displayId:pn,packageName:G.name,version:G.version,ecosystem:G.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:Be.severity,packageLocation:xo(d,G)});continue}for(let je of mt){let{finding:zn,hit:In}=Sr(ue.graph,ye,{name:G.name,version:G.version,...G.ecosystem!==void 0?{ecosystem:G.ecosystem}:{},devOnly:G.dev,outOfGraphExecution:C(G)},Qe,je,ue.incompleteness,ue.analysisAborted),re=gw(zn,ue,G),me,Ee;In!==null&&je!==null&&(me=In.modelId,Ee=zn.unknownKind,re={basis:void 0,tier:In.tier,decidedAtStage:zn.decidedAtStage,reason:`boundary model ${In.modelId}: ${In.anchorPackage}.${In.entryExport} reaches ${je.exportName} [${In.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Lr(je),path:void 0,unresolvedSites:zn.unresolvedSites,unresolvedEvidence:zn.unresolvedEvidence}),Z[re.tier]+=1;let en=wp(j,re,je,C(G).length,Qe.surfaceComplete),Ce={...re,...en!==void 0?{adr105:en}:{},modelId:me,modelPromotedFromKind:Ee,surfaceComplete:Qe.surfaceComplete,advisoryId:Be.id,displayId:pn,packageName:G.name,version:G.version,ecosystem:G.ecosystem??"npm",symbolName:je?.exportName??null,symbolPath:je?.sourcePath||null,symbolContainer:je?.container??null,severity:Be.severity,packageLocation:xo(d,G)};H.push(Ce);let Oe=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&Ce.tier==="unknown"&&Ce.decidedAtStage==="symbol-reachable"&&Ce.unknownKind!==void 0&&Oe.has(Ce.unknownKind)&&je!==null&&ie.push({finding:Ce,symbol:je}),o!==null&&Ce.tier==="unknown"&&je!==null&&ae.push({finding:Ce,symbol:je})}for(let je of $s)Z.unknown+=1,H.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:Qe.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${pn} carries a ${je.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Be.id,displayId:pn,packageName:G.name,version:G.version,ecosystem:G.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:Be.severity,packageLocation:xo(d,G)})}}}for(let G of se)Z.unknown+=1,H.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:G.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:pl,displayId:pl,packageName:G.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:null,unknownKind:"coverage-gap",packageLocation:mf(d,G)});let pe=Cs.now()-L,he=Z["reachable-high"]+Z["reachable-medium"],we=e.failOnReachable===!0&&he>0,Ne=kw(H,Z.unknown,e.failOnUnknown),Ie=e.requireCompleteDenial===!0&&H.some(G=>G.tier==="not-reachable"&&G.basis==="loader-assumption"),Fe=we||Ne||Ie?2:0,Le;if(i!==null){let G=qn(F),ue=new Map(F.modules.map(be=>[be.id,be])),ye=[];for(let{finding:be,symbol:Ke}of ie){let Pe=Vo(F,ue,G,Ke,i,nw);ye.push({advisoryId:be.advisoryId,packageName:be.packageName,symbolName:be.symbolName,unknownKind:be.unknownKind??null,wouldPromote:Pe!==null,...Pe!==null?{anchorPackage:Pe.anchorPackage,entryExport:Pe.entryExport,viaPackages:Pe.viaPackages,totalHops:Pe.totalHops}:{}})}Le={records:ye}}let Je;if(o!==null&&e.modelShadow!==void 0){let G=e.modelShadow.widened===!0?"widened":"base",{models:ue,notes:ye,dispositions:be}=rl(o,p,{shadowConsultDenylisted:!0}),{delta:Ke}=sr(F,ue),Pe=qn(F),Dn=new Map(F.modules.map(re=>[re.id,re])),pt=xw(F,Dn,Pe),Be=bw(F),Kn=Ke.records.some(re=>pt.some(me=>me.packageName===re.anchor.packageName&&me.exportName===re.anchor.exportName&&me.container===re.anchor.container)),Qe=[],pn=Date.now();for(let{finding:re,symbol:me}of ae){let Ee=Ke.records,en=fl(re,me,G),Ce=en?Ks(F,Dn,Pe,me,Ee):null,Oe=Ke.records.filter(sn=>sn.callee.packageName===me.packageName&&sn.callee.exportName===me.exportName&&sn.callee.container===me.container||sn.callee.packageName===me.packageName&&sn.callee.realFunctionId!==null);Qe.push({advisoryId:re.advisoryId,packageName:re.packageName,symbolName:re.symbolName,unknownKind:re.unknownKind??null,decidedAtStage:re.decidedAtStage,consultSurface:G,noHitReason:Ce!==null?null:en?Kn?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Ce!==null?Sw(Ce,Ee,pt,Be):null,verdictBefore:re.tier,verdictAfter:Ce!==null?"reachable-low":re.tier,wouldPromote:Ce!==null,...Ce!==null?{modelId:Ce.modelId,anchorPackage:Ce.anchorPackage,entryExport:Ce.entryExport,pathLabels:Ce.pathLabels,calleeBinding:Oe.find(sn=>sn.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:en?Oe.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Oe[0]?.anchor.packageName??"?"}#${Oe[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Bt=Date.now()-pn,$s=be.map(re=>{if(re.status!=="active")return{modelId:re.modelId,state:re.status,reason:re.reason,edgesLowered:0,edgesReferenceGated:0};let me=Ke.records.filter(en=>en.modelId===re.modelId).length;if(me>0)return{modelId:re.modelId,state:"lowered",reason:null,edgesLowered:me,edgesReferenceGated:re.edgeCount-me};let Ee=Ke.notes.find(en=>en.startsWith(`model ${re.modelId}:`)||en.startsWith(`model-edge ${re.modelId}:`));return{modelId:re.modelId,state:"refused",reason:Ee??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:re.edgeCount}}),mt=Qe.filter(re=>re.wouldPromote).length,ht=Z.unknown-mt,je=Z["reachable-high"]+Z["reachable-medium"],zn=re=>({none:0,"fail-on-reachable":je>0?2:0,"fail-on-unknown":re>0?2:0,both:je>0||re>0?2:0});Je={records:Qe,notes:[...ye,...Ke.notes],laneStates:$s,exitCodes:{baseline:zn(Z.unknown),withModels:zn(ht)},overlayWallMs:Bt},il(nt.dirname(e.modelShadow.outPath),{recursive:!0});let In=`${e.modelShadow.outPath}.tmp-${ol(8).toString("hex")}`;ll(In,`${JSON.stringify(Je,null,2)}
-`,{encoding:"utf8",flag:"wx"}),al(In,e.modelShadow.outPath)}let Ae;if(e.bindingShadow!==void 0){let G=Date.now(),ue=re=>X.models.length>0?{records:sr(re,X.models).delta.records,reachMods:qn(re),modulesById:new Map(re.modules.map(me=>[me.id,me]))}:null,ye=(re,me,Ee,en)=>{let Ce=[];for(let Oe of d.packages)for(let{advisory:sn,affected:Kt}of s.advisoriesForPackage(Oe.ecosystem??"npm",Oe.name)){let ls=kr(sn.id,Oe.name,Kt),km=dl(sn.id,Oe.name,s.symbolsForAffected(Kt.id),Kt.surfaceComplete,r);for(let Dl of km){let{finding:Fl,hit:Wo}=Sr(re,en,{name:Oe.name,version:Oe.version,...Oe.ecosystem!==void 0?{ecosystem:Oe.ecosystem}:{},devOnly:Oe.dev,outOfGraphExecution:C(Oe)},ls,Dl,me,Ee);Ce.push({advisoryId:sn.id,packageName:Oe.name,symbolName:Dl?.exportName??null,tier:Wo!==null?Wo.tier:Fl.tier,unknownKind:Wo!==null?null:Fl.unknownKind??null})}}return Ce},be=re=>{let me=ra({appRoot:t,entrypoints:y,depClassAnchors:x,bindingForms:re,callablePackageResolver:w,tsconfigPaths:I}),Ee=[...g.diagnostics,...oa(g),...ia(g,y.length),...Pa(a,b),...me.diagnostics];return{graph:me.graph,inc:Op(me.graph,Ee,Y),aborted:Rp(y.length,me.graph),live:ue(me.graph),applicability:me.bindingApplicability}},Ke=re=>{let me=be(re);return ye(me.graph,me.inc,me.aborted,me.live)},Pe=be({}),Dn=ye(Pe.graph,Pe.inc,Pe.aborted,Pe.live),pt=ye(F,V,E,$);if(pt.length!==Dn.length)throw new et("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let Be=(re,me)=>me.tier!==re.tier||me.unknownKind!==re.unknownKind,Kn=Dn.some((re,me)=>{let Ee=pt[me];return Ee!==void 0&&Be(re,Ee)}),Qe=Kn?Ke({additiveForms:!0}):null,pn=Kn?Ke({namelessExports:!0}):null,Bt=0,$s=Dn.map((re,me)=>{let Ee=pt[me];if(Ee===void 0||Ee.advisoryId!==re.advisoryId||Ee.packageName!==re.packageName||Ee.symbolName!==re.symbolName)throw new et("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let en={advisoryId:re.advisoryId,packageName:re.packageName,symbolName:re.symbolName,unknownKind:re.unknownKind,verdictBefore:re.tier,verdictAfter:Ee.tier,wouldPromote:Ee.tier!==re.tier&&(Ee.tier==="reachable-high"||Ee.tier==="reachable-medium"||Ee.tier==="reachable-low")};if(!Be(re,Ee)||Qe===null||pn===null)return en;Bt+=1;let Ce=Qe[me],Oe=pn[me],sn=Ce!==void 0&&Be(re,Ce),Kt=Oe!==void 0&&Be(re,Oe);return{...en,attributedArm:sn&&!Kt?"additiveForms":Kt&&!sn?"namelessExports":"both",...Ce!==void 0?{verdictArmA:Ce.tier}:{},...Oe!==void 0?{verdictArmB:Oe.tier}:{}}}),mt={...Z};Dn.forEach((re,me)=>{let Ee=pt[me];Ee!==void 0&&Ee.tier!==re.tier&&(mt[Ee.tier]-=1,mt[re.tier]+=1)});let ht=(re,me)=>({none:0,"fail-on-reachable":re>0?2:0,"fail-on-unknown":me>0?2:0,both:re>0||me>0?2:0}),je;if(X.models.length>0&&$!==null){je=[];for(let re of d.packages)for(let{advisory:me,affected:Ee}of s.advisoriesForPackage(re.ecosystem??"npm",re.name)){let en=kr(me.id,re.name,Ee),Ce=dl(me.id,re.name,s.symbolsForAffected(Ee.id),Ee.surfaceComplete,r);for(let Oe of Ce){if(Oe===null||!Oe.verified)continue;let sn=Sr(Pe.graph,Pe.live,{name:re.name,version:re.version,...re.ecosystem!==void 0?{ecosystem:re.ecosystem}:{},devOnly:re.dev,outOfGraphExecution:C(re)},en,Oe,Pe.inc,Pe.aborted);if(!(sn.hit===null&&fl(sn.finding,Oe,"base")))continue;let ls=Ks(F,$.modulesById,$.reachMods,Oe,$.records);je.push({advisoryId:me.id,packageName:re.name,symbolName:Oe.exportName,modelWouldPromote:ls!==null,...ls!==null?{modelId:ls.modelId}:{},anchorCleared:ls!==null})}}}let zn=H.some(re=>re.modelId!==void 0);Ae={records:$s,deltas:Bt,exitCodes:{baseline:ht(mt["reachable-high"]+mt["reachable-medium"],mt.unknown+(zn?1:0)),withBindingForms:ht(Z["reachable-high"]+Z["reachable-medium"],Z.unknown+(zn?1:0))},dualRunWallMs:Date.now()-G,...R.bindingApplicability!==void 0?{applicability:R.bindingApplicability}:{},...je!==void 0?{modelProbe:je}:{}},il(nt.dirname(e.bindingShadow.outPath),{recursive:!0});let In=`${e.bindingShadow.outPath}.tmp-${ol(8).toString("hex")}`;ll(In,`${JSON.stringify(Ae,null,2)}
-`,{encoding:"utf8",flag:"wx"}),al(In,e.bindingShadow.outPath)}let tn=new Nt(t),Ms=new Map,Ts=G=>{let ue=Ms.get(G);if(ue!==void 0)return ue;let ye=G==="npm"?new Hs(F,tn,zs("npm"),()=>""):new Hs(l?.graph??Ps,tn,zs("PyPI"),ci((l?.roots??[]).map(be=>be.rootRel)));return Ms.set(G,ye),ye},B=ne.length>0||X.notes.length>0?{active:X.models.length,stored:ne.length,promoted:H.filter(G=>G.modelId!==void 0).length,notes:[...X.notes,...D!==null?D.notes:[]]}:void 0,q=ww(H,n,pe),Q=q.findings.map(G=>G.path===void 0?G:{...G,located:Ts(G.ecosystem).locate(G)}),oe=new Map,ke=G=>{let ue=oe.get(G);if(ue!==void 0)return ue;let ye=G==="npm"?bd(F,tn):l===null?null:Sd(l.graph,Ts("PyPI"),tn);return oe.set(G,ye),ye},Re=Q.map(G=>{let ue=G.located?.nodeOf,ye=G.path?.[G.path.length-1]?.functionId;if(G.influence===void 0||ue===void 0||ue===null||ye===void 0)return G;let be=ke(G.ecosystem);return be===null?G:{...G,influenceOverlay:kd(be.index,ye,ue,be.lineOf,be.pathOf)}}),En=()=>{if(l===null)return null;let G=new Map(l.graph.modules.map(ye=>[ye.id,ye])),ue=ci(l.roots.map(ye=>ye.rootRel));return{graph:Dr(l.graph),lineOf:ye=>{let be=G.get(ye.path);if(be===void 0||be.id.includes("site-packages:"))return null;let Ke=ue(be.id),Pe=Ke===""?be.path:`${Ke}/${be.path}`;return At(tn,{...ye,path:Pe},"utf8-bytes")?.startLine??null}}},Nn=hp(t,Re,d.perRoot.flatMap(G=>G.pythonLockfilePath?[G.pythonLockfilePath]:[])),An;if(e.influenceShadow!==void 0){let G=ad(F,q.findings,()=>Cs.now(),ye=>At(tn,ye,"utf16-units")?.startLine??null,En());il(nt.dirname(e.influenceShadow.outPath),{recursive:!0});let ue=`${e.influenceShadow.outPath}.tmp-${ol(8).toString("hex")}`;ll(ue,`${JSON.stringify(G,null,2)}
-`,{encoding:"utf8",flag:"wx"}),al(ue,e.influenceShadow.outPath),An={ports:G.totals.ports,byOutcome:G.totals.byOutcome,wallMs:G.wallMs}}return{...An!==void 0?{influenceShadow:An}:{},...Le!==void 0?{summaryShadow:Le}:{},...Je!==void 0?{modelShadow:Je}:{},...Ae!==void 0?{bindingShadow:Ae}:{},...B!==void 0?{modelLane:B}:{},dir:t,shardSchemaVersion:s.schemaVersion,installed:d,findings:Re.map((G,ue)=>{let ye=Nn.idOf[ue]??null;return ye===null?G:{...G,introducedBy:ye}}),packageGraphs:Nn.graphs,timings:q.timings,counts:Z,analyzerDiagnostics:U,pythonDiagnostics:l?.diagnostics??[],analysisAborted:J,rejectedEntries:h,entrypointSources:_,entrypointGaps:[...g.gaps,...g.surfaceGaps],entrypointObservations:g.observations,framework:g.framework,unresolved:P,advisories:[...z.values()],rootSet:a,exitCode:Fe,adr105:j.report}}finally{e.reader===void 0&&s.close()}}var cl=e=>Math.round(e*10)/10;function ww(e,n,t){let s=Cs.now(),r=e.map(o=>{let a=Yo(o.tier);return a===void 0?o:{...o,influence:a}}),i=Cs.now()-s;return{findings:r,timings:{scanMs:cl(s-n),cascadeMs:cl(t),stage6Ms:cl(i)}}}var vw="cupel",Ew="reachability-first SCA \u2014 verdict + call path + confidence";function gl(e){return[`${vw} v${e} \u2014 ${Ew}`,`cascade: ${Ql.join(" \u2192 ")}`,`verdicts: ${ed.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
-`)}var Nw=new Set([...ei,...ni]);function ft(e,n,t){let s=e[n+1];if(s===void 0||s.startsWith("--"))throw new Error(`${t} requires a value`);return s}function Aw(e){let n=e.split(",").map(r=>r.trim()),t=[...ei,...ni].join(", ");if(n.length===0||n.some(r=>r===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let s=[];for(let r of n){if(!Nw.has(r))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(r)}; valid: ${t}`);s.push(r)}return s}function Tp(e){let n=".",t,s,r,i=!1,o=!1,a=!1,d=!1,l=!1,c,p,u,f=!1,h=!1,g,y,_=!1,b=!0,x=!1,k,w=[],I=[];for(let N=0;N<e.length;N+=1){let v=e[N];if(v==="--require-complete-denial"){o=!0;continue}if(v==="--fail-on-reachable")i=!0;else if(v==="--fail-on-unknown")a="all";else if(v!==void 0&&v.startsWith("--fail-on-unknown="))a=Aw(v.slice(18));else if(v==="--offline")d=!0;else if(v==="--sarif")t=ft(e,N,"--sarif"),N+=1;else if(v==="--shard")s=ft(e,N,"--shard"),N+=1;else if(v==="--shard-pypi")r=ft(e,N,"--shard-pypi"),N+=1;else if(v==="--entry")w.push(ft(e,N,"--entry")),N+=1;else if(v==="--root")I.push(ft(e,N,"--root")),N+=1;else if(v==="--summary-shadow")c=ft(e,N,"--summary-shadow"),N+=1;else if(v==="--model-shadow")p=ft(e,N,"--model-shadow"),N+=1;else if(v==="--model-shadow-out")u=ft(e,N,"--model-shadow-out"),N+=1;else if(v==="--model-shadow-widened")f=!0;else if(v==="--binding-shadow")h=!0;else if(v==="--x-influence-shadow")y=ft(e,N,"--x-influence-shadow"),N+=1;else if(v==="--binding-shadow-out")g=ft(e,N,"--binding-shadow-out"),N+=1;else if(v==="--x-partial-rows")_=!0;else if(v==="--no-tsconfig-paths")b=!1;else if(v==="--x-tsconfig-paths")b=!0;else if(v==="--push")x=!0;else if(v!==void 0&&v.startsWith("--auth=")){let C=v.slice(7);if(C!=="oidc"&&C!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(C)}`);k=C}else{if(v!==void 0&&v.startsWith("--"))throw new Error(`unknown flag ${v}`);v!==void 0&&!l&&(n=v,l=!0)}}if(p===void 0!=(u===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(f&&p===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(g!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(k!==void 0&&!x)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:s,shardPypi:r,failOnReachable:i,requireCompleteDenial:o,failOnUnknown:a,offline:d,entry:w,root:I,summaryShadow:c,modelShadow:p,modelShadowOut:u,modelShadowWidened:f,push:x,auth:k,bindingShadow:h,bindingShadowOut:g,influenceShadowOut:y,partialRows:_,tsconfigPaths:b}}import{chmodSync as Tw,mkdirSync as $w,readFileSync as Lw,renameSync as Dw,statSync as Fw,unlinkSync as jw,writeFileSync as Bw}from"node:fs";import{randomBytes as Kw}from"node:crypto";import{homedir as zw}from"node:os";import is from"node:path";import{createPublicKey as Iw,verify as Rw}from"node:crypto";var Se=class extends Error{constructor(n){super(n),this.name="DistError"}},os=class extends Se{constructor(n){super(n),this.name="NoCachedShardError"}},Ow=Buffer.from("302a300506032b6570032100","hex"),Pw=32;function Fp(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Pw)try{return Iw({key:Buffer.concat([Ow,n]),format:"der",type:"spki"})}catch{return}}function yl(e,n,t){for(let s of t){let r=Fp(s);if(r!==void 0)try{if(Rw(null,e,r,n))return!0}catch{}}return!1}function jp(e){return e.some(n=>Fp(n)!==void 0)}var Cw=/^[0-9a-f]{64}$/u,Mw=/^[a-z0-9-]+$/u;function $p(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new Se(`${n} must be an object`);return e}function Lp(e,n){if(!Array.isArray(e))throw new Se(`${n} must be an array`);return e}function $o(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new Se(`${n} must be an integer`);return e}function Lo(e,n){if(typeof e!="string")throw new Se(`${n} must be a string`);return e}function Dp(e,n){let t=Lo(e,n);if(Number.isNaN(Date.parse(t)))throw new Se(`${n} is not a valid timestamp: ${t}`);return t}function _l(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new Se("distribution index is not valid JSON")}let s=$p(t,"index"),r=$o(s.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new Se(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let i=$o(s.sequence,"sequence");if(i<0)throw new Se("sequence must be non-negative");let o=Dp(s.generated,"generated"),a=Lp(s.shards,"shards"),d;for(let h of a){let g=$p(h,"shard entry"),y=Lo(g.ecosystem,"ecosystem");if(!Mw.test(y))throw new Se(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){d=g;break}}if(d===void 0)throw new Se(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);Dp(d.built,"built");let l=$o(d.db_schema_version,"db_schema_version");if(l<1)throw new Se("db_schema_version must be >= 1");if(l>n.supportedDbSchemaVersion)throw new Se(`this shard needs a newer cupel (db_schema_version ${String(l)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let c=Lo(d.sha256,"sha256");if(!Cw.test(c))throw new Se(`sha256 must be 64 lowercase hex, got ${JSON.stringify(c)}`);let p=$o(d.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new Se(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let u=Lp(d.urls,"urls");if(u.length===0)throw new Se("urls must be a non-empty array");let f=[];for(let h of u){let g=Lo(h,"url");try{f.push(On(g,n.shardHosts))}catch(y){throw new Se(`refusing shard url ${JSON.stringify(g)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:c,sizeBytes:p,dbSchemaVersion:l,urls:f,sequence:i,generated:o}}var Bp="CUPEL_CONFIG_DIR",Kp="credentials.json",xl="cpd_",Uw="cpl_",qw=xl.length+6+32,Hw=200,Ww=/^[A-Za-z0-9_-]+$/u,vr=class extends Se{constructor(n){super(n),this.name="StoredCredentialError"}};function zp(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=zw();if(process.platform==="darwin")return is.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let i=e.APPDATA,o=i!==void 0&&i!==""?i:is.join(t,"AppData","Roaming");return is.join(o,"cupel")}let s=e.XDG_CONFIG_HOME,r=s!==void 0&&s!==""?s:is.join(t,".config");return is.join(r,"cupel")}function Do(e){return is.join(zp(e),Kp)}function bl(e){let n=e.trim();return n.startsWith(Uw)?{ok:!1,reason:"push-token"}:n.startsWith(xl)?n.length<qw||n.length>Hw?{ok:!1,reason:"malformed"}:Ww.test(n.slice(xl.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function Up(e,n){let t=zp(e),s=is.join(t,Kp);$w(t,{recursive:!0,mode:448}),process.platform!=="win32"&&Tw(t,448);let r=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),i=`${s}.tmp-${Kw(8).toString("hex")}`;return Bw(i,`${r}
-`,{flag:"wx",mode:384}),Dw(i,s),s}function qp(e){let n=Do(e),t;try{t=Fw(n)}catch(o){if(o instanceof Error&&o.code==="ENOENT")return;throw o}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new vr(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let s;try{s=JSON.parse(Lw(n,"utf8"))}catch{throw new vr(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let r=typeof s=="object"&&s!==null&&"delivery_token"in s?s.delivery_token:void 0,i=bl(typeof r=="string"?r:"");if(!i.ok)throw new vr(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return i.token}function Hp(e){try{return jw(Do(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var Er="CUPEL_DELIVERY_TOKEN",Sl=class extends Se{constructor(n){super(n),this.name="NoDeliveryTokenError"}},kl=class extends Se{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Gw(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function Wp(e,n,t=()=>{}){let s=Gw(e)??t();return s!==void 0?()=>Promise.resolve(s):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function Gp(e){if(e===void 0)throw new Sl(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${Er} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new kl(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Vw="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function Xw(){return new Promise(e=>{let n=process.stdin;process.stderr.write(Vw),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",s=i=>{n.setRawMode(!1),n.pause(),n.removeListener("data",r),process.stderr.write(`
-`),i===null&&process.exit(130),e(i)},r=i=>{for(let o of i){if(o==="")return s(null);if(o==="\r"||o===`
-`)return s(t);if(o==="\x7F"||o==="\b"){t=t.slice(0,-1);continue}t+=o}};n.on("data",r)})}async function Yw(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function Vp(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${te(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
-`),!0)}async function Xp(e){if(Vp(e,"login"))return 1;let n=process.stdin.isTTY?await Xw():await Yw(),t=bl(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
+`:"",encoding:"utf8",maxBuffer:Gw,timeout:n.timeoutMs??Kw,env:t});if(a.error!==void 0){let h=a.error.code,y=h==="ENOENT";return{refused:y?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...o,y?`no Python interpreter: \`${s}\` is not on PATH (set ${om} to the interpreter this project runs under)`:`the Python extract could not run (${h??a.error.message})`]}}if(a.status!==0){let h=(a.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...o,`the Python extract exited ${String(a.status??"on a signal")}${h!==""?`: ${h}`:""}`]}}let l=(a.stdout??"").split(`
+`).filter(h=>h.trim()!==""),d=null,c=[],p=[],u=new Map,f=[];for(let h of l){let y;try{y=JSON.parse(h)}catch{o.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!Nn(y))continue;if(y.kind==="header"){d=ke(y.interpreter,64);let S=y.stdlib;Array.isArray(S)&&(c=S.filter(b=>typeof b=="string"&&b.length<=128)),p=os(y.builtins).filter(b=>typeof b=="string"&&b.length<=128),u=_v(y.typeAttrs);continue}let _=yv(y);if(_===null){o.push("the Python extract emitted a file row without a path; it was skipped");continue}f.push(_)}if(d===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...o,"the Python extract did not report an interpreter version"]};let m=r.length-f.length;return m>0&&o.push(`${String(m)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:d,files:f,stdlib:c,diagnostics:o,builtins:p,typeAttrs:u}}function _v(e){let n=new Map;if(!Nn(e))return n;for(let[t,s]of Object.entries(e))!dm.has(t)||!Array.isArray(s)||n.set(t,new Set(s.filter(o=>typeof o=="string"&&o.length<=128)));return n}var Sv="python3",xv={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","extract-truncated":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function kv(e,n){let t=xv[e.code];return t!=="dynamic-load"?t:n!==void 0&&n.packageName!==""?"dep-opaque":t}function wv(e,n,t=s=>ai([],{python:s}).refused===null){let s=ws.resolve(e,n.envRel);for(let o of["bin/python3","bin/python","Scripts/python.exe"]){let r=ws.join(s,o);try{if(!bv(r).isFile())continue}catch{continue}if(t(r))return r}return Sv}function vv(e,n){let t=[e];for(let s of n.sitePackages)t.push(ws.resolve(e,s));for(let s of n.pthFiles)for(let o of s.paths)t.push(ws.isAbsolute(o)?o:ws.resolve(e,s.sitePackages,o));return{roots:[...new Set(t)]}}function Ev(e){let n=[];for(let t of e.distInfos){let s=Mo(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});s!==null&&n.push(s)}return n}function hm(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function Av(e,n,t={}){let o=(t.readEnvironment??Ko)(n),r=Ev(o),i=qr(r),a=o.diagnostics.map(b=>b),l=t.python??wv(n,o),d=vv(n,o),c=Cv(o,i,d),p=new Map;for(let b of r)p.set(b.name,Ov(b,c.distributions));for(let b of c.seen)a.push(`startup hook: ${b}`);for(let b of c.unattributed)a.push(`startup escape: ${b} \u2014 a module runs at interpreter start that no installed distribution claims`);let u=jl({projectRoot:n,paths:d,python:l});for(let b of u.gaps)a.push(`entrypoint \`${b.declaration}\` (${b.source}): ${b.detail}`);if(u.entrypoints.length===0)return a.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,graph:no,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:u.gaps,interpreter:null,diagnostics:a,execution:p};let f=Dl({projectRoot:n,paths:d,entryFiles:u.entrypoints.map(b=>ws.join(n,b.file)),environmentComplete:!o.truncated&&o.refused===null,externalRoots:o.sitePackages.map(b=>ws.resolve(n,b)),distributionOf:hm(i),python:l,...t.maxModules!==void 0?{maxModules:t.maxModules}:{},preciseNames:t.preciseNames!==!1});for(let b of f.diagnostics)a.push(`${b.code} at ${b.where}: ${b.detail}`);if(f.graph.modules.length===0)return{rootRel:e,graph:no,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:f.interpreter,diagnostics:a,execution:p};let m=new Map;for(let b of f.graph.modules)m.set(b.id,b.id),m.set(b.path,b.id);let h=new Map(f.graph.modules.map(b=>[b.id,b])),y=b=>h.get(b)??h.get(m.get(b)??""),_=f.graph.modules[0]?.id,S=f.diagnostics.map(b=>{let k=y(b.where);return{source:k?.id??_,cause:kv(b,k),reach:{kind:"unbounded"}}});if(c.unattributed.length>0&&S.push({source:_,cause:"dynamic-load",reach:{kind:"unbounded"}}),S.push(...Iv(f.graph)),f.opaqueCode.length>0){let b=f.graph.modules.find(w=>w.isEntrypoint)?.id??_,k=Nv(f.graph,f.opaqueCode,r);S.push({source:b,cause:"dep-opaque",reach:{kind:"loaded-package",ecosystem:"PyPI",alsoLoaded:k}}),a.push(`code no analysis reads is loaded (${mm(f.opaqueCode)}): a loaded package is not reported unreachable, and neither is any of the ${String(k.length)} package(s) in the declared-dependency closure of the distributions that ship it (${mm(k)})`)}return{rootRel:e,graph:f.graph,incompleteness:S,analysisAborted:null,entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:f.interpreter,diagnostics:a,execution:p}}var mm=e=>`${e.slice(0,5).join(", ")}${e.length>5?", \u2026":""}`;function Nv(e,n,t){let s=new Set(e.modules.map(c=>c.packageName).filter(c=>c!=="")),o=new Map;for(let c of t){let p=o.get(c.name);if(p===void 0)o.set(c.name,new Set(c.requiresDist));else for(let u of c.requiresDist)p.add(u)}let r=new Set,i=qr(t),a=hm(i);for(let c of n){let p=a(c.split(".")[0]??c);p!==null&&r.add(p);for(let u of To(i,c))r.add(u.name)}for(let c of t)s.has(c.name)&&(c.extensionModules>0||!c.recordKnown)&&r.add(c.name);let l=new Set,d=[...r];for(let c=d.pop();c!==void 0;c=d.pop())if(!l.has(c)){l.add(c);for(let p of o.get(c)??[])o.has(p)&&!l.has(p)&&d.push(p)}return[...l].sort((c,p)=>c<p?-1:c>p?1:0)}function Iv(e){let n=new Map(e.functions.map(o=>[o.id,o.moduleId])),t=new Set(e.modules.filter(o=>o.packageName!==""&&o.externalSurface!==!0).map(o=>o.id)),s=new Set;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let r=n.get(o.enclosingFunctionId);r!==void 0&&t.has(r)&&s.add(r)}return[...s].map(o=>({source:o,cause:"dep-opaque",reach:{kind:"dependency-dispatch"}}))}var no={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Rv(e){if(e.length===0)return null;let n=[],t=new Map;for(let _ of e){let S=_.rootRel===""?".":_.rootRel;for(let b of _.diagnostics)n.push(`${S}: ${b}`);for(let[b,k]of _.execution){let w=t.get(b);t.set(b,w===void 0?k:[...new Set([...w,...k])])}}let s=e.filter(_=>_.analysisAborted===null);if(s.length===0)return{graph:no,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let o=[],r=[],i=[],a=[],l=[],d=[],c=[],p=[],u=[],f=[],m=[],h=new Set;for(let _ of s){let S=_.rootRel===""?"":`${_.rootRel}::`,b=new Set(_.graph.modules.filter(A=>A.externalSurface===!0).map(A=>A.id)),k=A=>b.has(A)?A:`${S}${A}`,w=A=>`${S}${A}`,N=A=>`${S}${A}`,R=A=>`${S}${A}`,v=A=>`${S}${A}`,I=A=>`${S}${A}`;for(let A of _.graph.modules){if(A.externalSurface===!0){if(h.has(A.id))continue;h.add(A.id),o.push(A);continue}o.push({...A,id:k(A.id)})}for(let A of _.graph.imports)r.push({...A,id:w(A.id),moduleId:k(A.moduleId),...A.resolvedModuleId!==void 0?{resolvedModuleId:k(A.resolvedModuleId)}:{}});for(let A of _.graph.importEdges)i.push({importId:w(A.importId),resolvedModuleId:k(A.resolvedModuleId)});for(let A of _.incompleteness)m.push({...A,source:k(A.source)});for(let A of _.graph.functions)a.push({...A,id:N(A.id),moduleId:k(A.moduleId),...A.enclosingClassId!==void 0?{enclosingClassId:R(A.enclosingClassId)}:{}});for(let A of _.graph.classes)l.push({...A,id:R(A.id),moduleId:k(A.moduleId),members:A.members.map(N)});for(let A of _.graph.exports)d.push({...A,id:I(A.id),moduleId:k(A.moduleId)});for(let A of _.graph.exportBindings)c.push({exportId:I(A.exportId),target:A.target.kind==="function"?{kind:"function",functionId:N(A.target.functionId)}:{kind:"module",moduleId:k(A.target.moduleId)}});for(let A of _.graph.callSites)p.push({...A,id:v(A.id),enclosingFunctionId:N(A.enclosingFunctionId),resolvedTargetIds:A.resolvedTargetIds.map(N)});for(let A of _.graph.callEdges)u.push({...A,callSiteId:v(A.callSiteId),calleeFunctionId:N(A.calleeFunctionId)});for(let A of _.graph.inheritEdges)f.push({...A,subclassId:R(A.subclassId),superclassId:R(A.superclassId)})}let y=o[0]?.id;for(let _ of e)_.analysisAborted===null||y===void 0||m.push({source:y,cause:_.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:o,imports:r,importEdges:i,functions:a,classes:l,exports:d,exportBindings:c,callSites:p,callEdges:u,inheritEdges:f},incompleteness:m,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function gm(e,n={}){let t=e.filter(s=>jo(s));return t.length===0?null:Rv(t.map(s=>Av(s.rel,s.abs,n)))}function Ov(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var Pv=["sitecustomize","usercustomize"];function Cv(e,n,t){let s=new Set,o=[],r=[];for(let i of e.pthFiles){for(let l of i.importModules){let d=To(n,l);for(let p of d)s.add(p.name);let c=Dt(t,l);if(c.resolved!==null){r.push(`${i.sitePackages}/${i.name}: \`import ${l}\` runs ${c.resolved.path}`);continue}d.length===0&&o.push(`${i.sitePackages}/${i.name}: \`import ${l}\``)}let a=i.importModules.length;i.importLines>a&&o.push(`${i.sitePackages}/${i.name}: ${String(i.importLines-a)} import line(s) whose module could not be read`)}for(let i of Pv){let a=Dt(t,i);if(a.resolved===null)continue;let l=To(n,i);for(let d of l)s.add(d.name);l.length===0?o.push(`${a.resolved.path}: \`import ${i}\` runs at every interpreter start`):r.push(`${i}: \`import ${i}\` runs ${a.resolved.path}`)}return{distributions:s,unattributed:o,seen:r}}import{spawnSync as Mv}from"node:child_process";import{closeSync as Tv,lstatSync as $v,openSync as Lv,readdirSync as Am,readFileSync as Dv,readSync as Fv,realpathSync as zl,statSync as so}from"node:fs";import{homedir as ym,tmpdir as jv}from"node:os";import Le from"node:path";var Bv="ImportPath,Dir,Standard,Module,IgnoredGoFiles,Error,DepsErrors",_m=21,Nm="CUPEL_GO",Gv=3e5,Kv=256*1024*1024,zv=1e5,Uv=8,Wv=1e5,Hv=5e4,bm=1024*1024,Sm=4*1024*1024,xm=16*1024*1024,km=8,wm=200,Bt=8;function Ul(e,n,t){let s={...e};return s.GOTOOLCHAIN="local",s.GOPROXY="off",s.GOFLAGS=`-mod=${n}`,s.GO111MODULE="on",s.GOCACHE="off",t!==null&&(s.GOWORK=t),s}function Wl(e,n,t,s){let o=Mv(e.go,n,{cwd:t,env:s,encoding:"utf8",timeout:e.timeoutMs,killSignal:"SIGKILL",maxBuffer:e.maxOutputBytes,stdio:["ignore","pipe","pipe"],windowsHide:!0,shell:!1});if(o.error!==void 0){let r=o.error.code;return r==="ENOENT"?{kind:"missing"}:r==="ETIMEDOUT"?{kind:"failed",detail:`timed out after ${String(e.timeoutMs/1e3)} s`}:r==="ENOBUFS"?{kind:"failed",detail:`printed more than ${String(e.maxOutputBytes)} bytes`}:{kind:"failed",detail:`could not run (${r??"spawn error"})`}}return o.signal!==null?{kind:"failed",detail:`was killed (${o.signal})`}:{kind:"ran",status:o.status??1,stdout:o.stdout,stderr:o.stderr}}function to(e){let n="";for(let t of e.slice(-600)){let s=t.charCodeAt(0);n+=s<32||s===127||s>=128&&s<=159?" ":t}return n.replace(/ {2,}/gu," ").trim()}function Im(e){let n=e.split(" ")[0]??"",t=/^go(\d{1,4})\.(\d{1,4})(?:\.(\d{1,4}))?(?:(alpha|beta|rc)(\d{1,4}))?$/u.exec(n);if(t===null)return null;let[,s,o,r,i,a]=t,l=`${s??"0"}.${o??"0"}.${r??"0"}`;return i===void 0?l:`${l}-${i}.${a??"0"}`}function qv(e){let n=Wl(e,["env","-json","GOVERSION","GOOS","GOARCH","CGO_ENABLED","GOEXPERIMENT","GOROOT","GOMODCACHE"],jv(),Ul(e.env,"readonly","off"));if(n.kind==="missing")return{refused:"missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH (set ${Nm} to point at one)`};if(n.kind==="failed")return{refused:"unusable",detail:`\`${e.go} env\` ${n.detail}`};if(n.status!==0)return{refused:"unusable",detail:`\`${e.go} env\` exited ${String(n.status)}: ${to(n.stderr)}`};let t;try{t=JSON.parse(n.stdout)}catch{t=null}let s=typeof t=="object"&&t!==null?t:{},o=s.GOVERSION,r=s.GOOS,i=s.GOARCH,a=s.CGO_ENABLED,l=s.GOEXPERIMENT,d=f=>typeof f=="string"&&f.length>1&&f.length<=4096&&Le.isAbsolute(f)?f:null,c=f=>typeof f=="string"&&f.length>0&&f.length<=64&&/^[A-Za-z0-9_]+$/u.test(f);if(typeof o!="string"||o.length===0||o.length>256||!c(r)||!c(i))return{refused:"unusable",detail:`\`${e.go} env -json\` did not report GOVERSION, GOOS and GOARCH`};let p=Im(o),u=/^go1\.(\d+)/u.exec(o)?.[1];return p!==null&&u!==void 0&&Number(u)<_m?{refused:"unusable",detail:`the Go toolchain on PATH is ${to(o)}; the Go scan needs go1.${String(_m)} or later`}:{toolchain:{goversion:to(o),release:p,goos:r,goarch:i,cgo:a==="1",experiment:typeof l=="string"?to(l).slice(0,200):"",goroot:d(s.GOROOT),gomodcache:d(s.GOMODCACHE)}}}function vm(e){let n=e.filter(t=>t[0]!==null&&t[0].length>1).sort((t,s)=>s[0].length-t[0].length);return t=>{let s=t;for(let[o,r]of n)s=s.split(o).join(r);return s.replace(/(^|[\s(["'`=])\/[^\s:"'`()\]]+/gu,"$1<path>")}}function Rm(e,n){for(let t=0;t<e.length;t+=1){let s=e.charCodeAt(t);if(!(n&&(s===10||s===9))&&(s<32||s===127||s>=128&&s<=159))return!0}return!1}function ci(e,n){if(typeof e!="string"||e.length===0||e.length>n)return!1;for(let t=0;t<e.length;t+=1){let s=e.charCodeAt(t);if(s<=32||s>=127||s===34||s===39||s===92||s===96)return!1}return!0}function Om(e){return typeof e=="string"&&e.length>3&&e.length<=255&&e.endsWith(".go")&&!e.includes("/")&&!e.includes("\\")&&!Rm(e,!1)}var dn=class extends Error{};function Pm(e,n){if(e===void 0)return!1;if(typeof e!="boolean")throw new dn(`${n} is not a boolean`);return e}function Jo(e,n,t,s=!1){if(e==null)return null;if(typeof e!="string"||e.length>t||Rm(e,s))throw new dn(`${n} is not a bounded string`);return e}function Vv(e,n){if(e==null)return null;if(typeof e!="object"||Array.isArray(e))throw new dn(`${n}.Module is not an object`);let t=e;if(!ci(t.Path,1024))throw new dn(`${n}.Module.Path is not a module path`);let s=t.Version===void 0?"":t.Version;if(s!==""&&!ci(s,256))throw new dn(`${n}.Module.Version is not a version`);let o=null,r=t.Replace;if(r!=null){if(typeof r!="object"||Array.isArray(r))throw new dn(`${n}.Module.Replace is not an object`);let a=r,l=Jo(a.Path,`${n}.Module.Replace.Path`,4096),d=a.Version===void 0?"":a.Version;if(l===null||l.length===0)throw new dn(`${n}.Module.Replace.Path is missing`);if(d!==""&&!ci(d,256))throw new dn(`${n}.Module.Replace.Version is not a version`);o={path:l,version:d}}let i=Jo(t.Dir,`${n}.Module.Dir`,4096);if(i!==null&&!Le.isAbsolute(i))throw new dn(`${n}.Module.Dir is not absolute`);return{path:t.Path,version:s,main:Pm(t.Main,`${n}.Module.Main`),replace:o,dir:i}}function Xv(e,n){let t=`package ${String(n)}`;if(typeof e!="object"||e===null||Array.isArray(e))throw new dn(`${t} is not an object`);let s=e,o=Jo(s.ImportPath,`${t}.ImportPath`,1024);if(o===null||o.length===0)throw new dn(`${t} has no ImportPath`);let r=Jo(s.Dir,`${t}.Dir`,4096);if(r!==null&&!Le.isAbsolute(r))throw new dn(`${t}.Dir is not absolute`);let i=s.IgnoredGoFiles,a=[];if(i!=null){if(!Array.isArray(i)||i.length>1e5)throw new dn(`${t}.IgnoredGoFiles is not a bounded list`);a=i.map(p=>{if(!Om(p))throw new dn(`${t}.IgnoredGoFiles holds a name that is not a file`);return p})}let l=null,d=s.Error;if(d!=null){if(typeof d!="object"||Array.isArray(d))throw new dn(`${t}.Error is not an object`);l=Jo(d.Err,`${t}.Error.Err`,65536,!0),l??="error without a message"}let c=s.DepsErrors;if(c!=null&&!Array.isArray(c))throw new dn(`${t}.DepsErrors is not a list`);return{importPath:o,dir:r,standard:Pm(s.Standard,`${t}.Standard`),module:Vv(s.Module,t),ignoredGoFiles:a,error:l}}function Yv(e,n){let t=[],s=0,o=-1,r=!1,i=!1;try{for(let a=0;a<e.length;a+=1){let l=e.charCodeAt(a);if(r){i?i=!1:l===92?i=!0:l===34&&(r=!1);continue}if(s===0){if(l===123){s=1,o=a;continue}if(l===32||l===10||l===13||l===9)continue;return{refused:`a byte outside any object at offset ${String(a)}`}}if(l===34)r=!0;else if(l===123||l===91){if(s+=1,s>km)return{refused:`an object nested deeper than ${String(km)}`}}else if((l===125||l===93)&&(s-=1,s===0)){if(a+1-o>xm)return{refused:"an object over the size bound"};if(t.length>=n)return{refused:`more than ${String(n)} packages`};t.push(Xv(JSON.parse(e.slice(o,a+1)),t.length))}if(s>0&&a+1-o>xm)return{refused:"an object over the size bound"}}}catch(a){return{refused:a instanceof Error?a.message:"an object that is not JSON"}}return s!==0||r?{refused:"the stream ends inside an object"}:{packages:t}}function Jv(e){let n=0,t=!1,s=!1,o=null,r=e.charCodeAt(0)===65279?1:0;e:for(;r<e.length;){let i=e.indexOf(`
+`,r),a=(i<0?e.slice(r):e.slice(r,i)).trim();if(r=i<0?e.length:i+1,a.length===0&&!t){n=r;continue}if(a.startsWith("//")||(t=!0),!s&&a.startsWith("//go:build")){let l=a.slice(10);if(l.length===0||l.trim().length<l.length){if(o!==null)return!1;o=l.trim()}}for(;a.length>0;){if(s){let l=a.indexOf("*/");if(l<0)continue e;s=!1,a=a.slice(l+2).trim();continue}if(a.startsWith("//"))continue e;if(a.startsWith("/*")){s=!0,a=a.slice(2).trim();continue}break e}}if(o!==null)return o==="ignore";for(let i of e.slice(0,n).split(`
+`)){let a=i.trim();if(!a.startsWith("//"))continue;let l=a.slice(2).trim();if(!l.startsWith("+build"))continue;let d=l.slice(6);if(!(d.length>0&&d.charAt(0)!==" ")&&d.trim()==="ignore")return!0}return!1}function Zv(e){if(e.length===0||e.length>1024||e.startsWith("-")||e.startsWith(".")||e.startsWith("/")||e.endsWith("/"))return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<=32||t===127||t>=128&&t<=159||t===34||t===39||t===92||t===96||t===58)return!1}return!e.split("/").some(n=>n===""||n==="."||n==="..")}function Qv(e){let n=e.charCodeAt(0)===65279?1:0,t=e.length,s=()=>{for(;;){for(;n<t;){let d=e.charCodeAt(n);if(d===32||d===9||d===10||d===13)n+=1;else break}if(n>=t)return{kind:"eof",text:""};if(e.startsWith("//",n)){let d=e.indexOf(`
+`,n);n=d<0?t:d+1;continue}if(e.startsWith("/*",n)){let d=e.indexOf("*/",n+2);if(d<0)return{bad:"an unterminated comment"};n=d+2;continue}break}let a=e.charAt(n);if(a==='"'){let d="";for(n+=1;n<t;){let c=e.charAt(n);if(c==='"')return n+=1,{kind:"string",text:d};if(c===`
+`)return{bad:"a string broken by a newline"};if(c==="\\"){let p=e.charAt(n+1);if(p!=="\\"&&p!=='"')return{bad:"an escape in an import path"};d+=p,n+=2;continue}d+=c,n+=1}return{bad:"an unterminated string"}}if(a==="`"){let d=e.indexOf("`",n+1);if(d<0)return{bad:"an unterminated raw string"};let c=e.slice(n+1,d);return n=d+1,{kind:"string",text:c}}if(a==="("||a===")"||a===";"||a===".")return n+=1,{kind:"punct",text:a};let l=n;for(;n<t;){let d=e.charCodeAt(n);if(!(d>=48&&d<=57||d>=65&&d<=90||d>=97&&d<=122||d===95||d>127))break;n+=1}return n===l?(n+=1,{kind:"punct",text:a}):{kind:"ident",text:e.slice(l,n)}},o=[],r=s();if("bad"in r)return{refused:r.bad};if(r.kind!=="ident"||r.text!=="package")return{refused:"no package clause"};if(r=s(),"bad"in r)return{refused:r.bad};if(r.kind!=="ident")return{refused:"no package name"};let i=a=>{let l=a;return(l.kind==="ident"||l.kind==="punct"&&l.text===".")&&(l=s()),"bad"in l?l:l.kind!=="string"?{bad:"an import without a path"}:l.text};for(;;){if(r=s(),"bad"in r)return{refused:r.bad};if(!(r.kind==="punct"&&r.text===";")){if(r.kind!=="ident"||r.text!=="import")break;if(r=s(),"bad"in r)return{refused:r.bad};if(r.kind==="punct"&&r.text==="(")for(;;){if(r=s(),"bad"in r)return{refused:r.bad};if(r.kind==="punct"&&r.text===";")continue;if(r.kind==="punct"&&r.text===")")break;if(r.kind==="eof")return{refused:"an unterminated import block"};let a=i(r);if(typeof a!="string")return{refused:a.bad};o.push(a)}else{if(r.kind==="eof")return{refused:"an import declaration without a path"};let a=i(r);if(typeof a!="string")return{refused:a.bad};o.push(a)}}}return{imports:o}}function Cm(e){let n;try{let t=so(e);if(!t.isFile())return null;n=Lv(e,"r");let s=Buffer.alloc(Math.min(t.size,bm)),o=0;for(;o<s.length;){let r=Fv(n,s,o,s.length-o,o);if(r===0)break;o+=r}return{text:s.subarray(0,o).toString("utf8"),whole:t.size<=bm}}catch{return null}finally{n!==void 0&&Tv(n)}}function Em(e,n){try{let t=so(e);return!t.isFile()||t.size>n?null:Dv(e,"utf8")}catch{return null}}function eE(e){try{return so(e).isDirectory()}catch{return!1}}function nE(e,n){if(e===n)return!0;let t=n.endsWith(Le.sep)?n:n+Le.sep;return e.startsWith(t)}function tE(e,n,t){let s=/^(\d{1,4})\.(\d{1,4})/u.exec(e);if(s===null)return!1;let o=Number(s[1]),r=Number(s[2]);return o>n||o===n&&r>=t}function sE(e,n){let t=Im(e.split("+")[0]??"");if(t===null||n===null)return!0;try{return Rt(n,{advisoryId:"",packageName:"",ecosystem:"Go",introduced:"0",fixed:t,surfaceComplete:!1})}catch{return!0}}function Kl(e){return/module lookup disabled by GOPROXY=off/u.test(e)?"go-module-missing":"go-list-failed"}function Mm(e,n){if(!nE(e,n))return"a go.work outside the scan root";let t=Le.relative(n,e).split(Le.sep).join("/");return t.length===0?"go.work":t}function oE(e,n,t){let s=Wl(e,["env","-json","GOWORK","GOMOD"],t,Ul(e.env,"readonly",null));if(s.kind==="missing")return{failed:{kind:"go-toolchain-missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH`}};if(s.kind==="failed"||s.status!==0)return{failed:{kind:"go-list-failed",detail:`\`go env\` in the module ${s.kind==="failed"?s.detail:`exited ${String(s.status)}: ${to(s.stderr)}`}`}};let o={};try{let b=JSON.parse(s.stdout);typeof b=="object"&&b!==null&&(o=b)}catch{}let r=typeof o.GOMOD=="string"?o.GOMOD:"",i;try{i=r.length>0&&Le.isAbsolute(r)?Le.join(zl(Le.dirname(r)),Le.basename(r)):""}catch{i=""}if(i!==Le.join(t,"go.mod"))return{failed:{kind:"go-list-failed",detail:"the go command does not read this directory's go.mod as its module (GOMOD is another file, or none)"}};let a=Em(Le.join(t,"go.mod"),Sm),l=a===null?[]:Ks(a),d=[],c=typeof o.GOWORK=="string"?o.GOWORK:"",p=null,u=[];if(c.length>0&&c!=="off"&&Le.isAbsolute(c)){let b=Em(c,Sm);if(b===null)p=c;else{u=Ks(b);let k=Le.dirname(c),w=Do(u);[...w.inside,...w.outside].some(R=>{try{return zl(Le.resolve(k,R))===t}catch{return!1}})?p=c:d.push(`${Mm(c,n)} governs this directory but does not \`use\` this module, so the go command builds it only on its own (GOWORK=off) \u2014 that is how it was listed`)}}let f=p!==null?u:l,m=Lo(f,"go"),h=Lo(f,"toolchain"),y=Le.join(p!==null?Le.dirname(p):t,"vendor"),_="readonly";if(eE(y))if(m===null||!tE(m,1,14))d.push("a vendor directory is present, but the governing go line is older than 1.14 (or absent), so the go command does not use it: listed -mod=readonly");else{let k=(Cm(Le.join(y,"modules.txt"))?.text.slice(0,512)??"").split(`
+`)[0]??"";(k.startsWith("## ")&&k.slice(3).split(";").some(N=>N.trim()==="workspace"))===(p!==null)?_="vendor":d.push("a vendor directory is present for the other mode (workspace vs module), so the go command does not use it: listed -mod=readonly")}let S=l.filter(b=>b.verb==="tool").map(b=>b.args[0]??"").filter(b=>b.length>0);return{mode:_,gowork:p??"off",workspaceFile:p,facts:d,goLine:m,toolchainLine:h,modulePath:Lo(l,"module"),tools:S}}function rE(e,n){for(let s of n)if(e===s||e.startsWith(`${s}/`))return!1;return!(e.split("/")[0]??"").includes(".")}function iE(e,n,t){let s=[],o=[e],r=0;for(;o.length>0;){let i=o.pop();if(i===void 0)break;if(r+=1,r>t)return{dirs:s,truncated:!0};let a;try{a=Am(i).sort()}catch{continue}let l=[];for(let d of a){let c=Le.join(i,d),p;try{p=$v(c)}catch{continue}if(p.isDirectory()){if(d.startsWith(".")||d.startsWith("_")||d==="testdata"||d==="vendor")continue;try{if(so(Le.join(c,"go.mod")).isFile())continue}catch{}o.push(c)}else p.isFile()&&d.endsWith(".go")&&!d.endsWith("_test.go")&&Om(d)&&l.push(d)}l.length>0&&!n.has(i)&&s.push({dir:i,files:l})}return{dirs:s,truncated:!1}}function Tm(e,n,t,s,o){return{rootRel:e,status:"failed",mode:n,workspace:null,packages:0,otherConfiguration:0,rows:[],gaps:t,diagnostics:s,facts:o,loadedPackages:new Set,otherConfigPackages:new Set,modules:new Map,loadedNames:new Set,importsPlugin:!1,packageModules:new Map,moduleDirs:new Map}}function aE(e,n,t,s,o){let r=t.abs,i=[],a=[],l=[],d=($,T)=>{let j=o(T);i.push({kind:$,detail:j,blindsAnalysis:!1,rootRel:""}),a.push(j)},c=($,T=null)=>(d($.kind,`${$.detail} \u2014 NO Go module of this root was enumerated, so this scan says nothing about them; it is not a clean bill of health (ADR-108 D6)`),Tm(t.rel,T,i,a,l.map(o))),p=oE(e,n,r);if("failed"in p)return c(p.failed);l.push(...p.facts);let u=Ul(e.env,p.mode,p.gowork),f=$=>{let T=Wl(e,["list",`-mod=${p.mode}`,"-e","-deps",`-json=${Bv}`,"--",...$],r,u);if(T.kind==="missing")return{failed:{kind:"go-toolchain-missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH`}};if(T.kind==="failed")return{failed:{kind:"go-list-failed",detail:`\`go list\` ${T.detail}`}};if(T.status!==0){let U=to(T.stderr);return{failed:{kind:Kl(U),detail:`\`go list\` exited ${String(T.status)}: ${U}`}}}let j=Yv(T.stdout,e.maxPackages);return"refused"in j?{failed:{kind:"go-list-failed",detail:`\`go list\` printed output that was refused as malformed (${j.refused})`}}:j},m=f(["./..."]);if("failed"in m)return c(m.failed,p.mode);let h=new Map,y=new Set;p.modulePath!==null&&y.add(p.modulePath);let _=[],S=[],b=($,T)=>{T.length>=1e3||T.push(`${$.importPath} (${($.error??"").split(`
+`)[0]?.slice(0,200)??""})`)};for(let $ of m.packages)$.module!==null&&y.add($.module.path);for(let $ of m.packages){if($.importPath.startsWith(".")||$.importPath.includes("...")){$.error!==null&&b($,S);continue}$.error!==null?b($,Kl($.error)==="go-module-missing"?_:S):!$.standard&&$.module===null&&S.length<1e3&&S.push(`${$.importPath} (a package outside any module)`),h.set($.importPath,$)}let k=new Map,w=!0,N=[],R=$=>{w=!1,N.length<Bt&&N.push($)},v=h.has("plugin"),I=new Set;for(let $ of h.values())$.dir!==null&&I.add($.dir);let A=iE(r,I,e.maxWalkDirs);A.truncated&&R(`the module has more than ${String(e.maxWalkDirs)} directories`);let B=new Set([...I,...A.dirs.map($=>$.dir)]),O=p.modulePath,V=0,E=new Set,D=$=>h.has($)||k.has($),L=($,T,j)=>{if(T.endsWith("_test.go"))return;if(V+=1,V>e.maxFiles){V===e.maxFiles+1&&R(`more than ${String(e.maxFiles)} excluded files`);return}let U=Cm(Le.join($,T));if(U===null){R(`${j}/${T} could not be read`);return}if(Jv(U.text))return;let Q=Qv(U.text);if("refused"in Q){R(`${j}/${T}: ${U.whole?Q.refused:"its import clause runs past the byte bound"}`);return}for(let te of Q.imports)if(te==="plugin"&&(v=!0),!(te==="C"||!Zv(te)||rE(te,y)||D(te))){if(O!==null&&(te===O||te.startsWith(`${O}/`))){let ie=Le.join(r,...te.slice(O.length).split("/").filter(me=>me!==""));if(B.has(ie))continue}E.add(te)}};for(let $ of h.values())if(!($.standard||$.dir===null))for(let T of $.ignoredGoFiles)L($.dir,T,$.importPath);for(let $ of A.dirs){let T=Le.relative(r,$.dir).split(Le.sep).join("/");for(let j of $.files)L($.dir,j,T)}let K=0,Y=!1;for(;E.size>0&&!Y;){if(K+=1,K>e.maxRounds){R(`the closure did not finish in ${String(e.maxRounds)} rounds`);break}let $=[...E].sort();E.clear();let T=[];for(let j=0;j<$.length;j+=wm){let U=f($.slice(j,j+wm));if("failed"in U){R(`listing what another configuration imports: ${U.failed.detail.slice(0,300)}`),U.failed.kind==="go-module-missing"&&_.length<1e3&&_.push(`(another configuration) ${U.failed.detail.slice(0,200)}`);continue}T.push(...U.packages)}for(let j of T)if(!(D(j.importPath)||j.importPath.startsWith("."))){if(j.importPath==="plugin"&&(v=!0),j.error!==null&&!j.error.startsWith("build constraints exclude all Go files")&&(R(`${j.importPath}: ${j.error.split(`
+`)[0]?.slice(0,200)??""}`),Kl(j.error)==="go-module-missing"&&b(j,_)),!j.standard&&j.module===null){R(`${j.importPath} lies in no module the build list names`);continue}if(k.size+h.size>=e.maxPackages){R(`more than ${String(e.maxPackages)} packages`),Y=!0;break}if(k.set(j.importPath,j),!j.standard&&j.dir!==null)for(let U of j.ignoredGoFiles)L(j.dir,U,j.importPath)}}let le=[],z=new Map,Z=new Set,de=new Set,x=new Set,M=new Map,X=new Map,W=new Map,q=($,T)=>{if($.standard||$.module===null||(M.set($.importPath,$.module.path),X.has($.module.path)||X.set($.module.path,$.module.dir),$.module.main))return;let j=W.get($.module.path);j===void 0?W.set($.module.path,{module:$.module,inGraph:T}):T&&(j.inGraph=!0)};for(let $ of h.values())$.standard||Z.add($.importPath),q($,!0);for(let $ of k.values())$.standard||de.add($.importPath),q($,!1);let F=p.toolchainLine!==null&&sE(p.toolchainLine,s.release)?p.toolchainLine:null,ne=$=>p.tools.some(T=>T===$||T.startsWith(`${$}/`)),pe=[];for(let[$,T]of[...W.entries()].sort((j,U)=>j[0]<U[0]?-1:1)){let j=T.module.replace,U=j!==null&&j.path===$&&j.version!=="",Q=U?j.version:T.module.version;z.set($,Q),T.inGraph&&x.add($);let te={};if(j!==null){let ie=j.version===""?j.path:`${j.path}@${j.version}`;pe.push(`${$}@${T.module.version===""?"?":T.module.version} => ${ie}`),U||(te.replacedBy=o(ie))}T.inGraph||(te.otherConfiguration=!0),ne($)&&(te.tool=!0),le.push({name:$,version:Q,flags:te}),j!==null&&!U&&j.version!==""&&ci(j.path,1024)&&/^[A-Za-z0-9]/u.test(j.path)&&(T.inGraph&&x.add(j.path),le.push({name:j.path,version:j.version,flags:{replacementOf:$,...T.inGraph?{}:{otherConfiguration:!0}}}))}if(pe.length>0&&l.push(`resolution divergence: ${String(pe.length)} module(s) replaced (${pe.slice(0,Bt).join(", ")}${pe.length>Bt?", \u2026":""}); a replacement by other code or a local directory withholds the version verdict, never the import graph`),h.size>0||A.dirs.length>0){let $=s.release??s.goversion,T=F!==null?{toolchainAhead:F}:{};le.push({name:"stdlib",version:$,flags:T}),le.push({name:"toolchain",version:$,flags:T}),x.add("stdlib"),x.add("toolchain")}else l.push("the module holds no Go package, so it contributes no row");F!==null&&l.push(`the governing toolchain line is \`${F}\`, newer than ${s.goversion} on PATH: a build under GOTOOLCHAIN=auto uses that one, so the stdlib and toolchain version verdicts are withheld`),_.length>0&&d("go-module-missing",`the module cache lacks what ${String(_.length)} package(s) of this build need (${_.slice(0,Bt).join("; ")}${_.length>Bt?"; \u2026":""}) \u2014 nothing is fetched (GOPROXY=off), so their modules are MISSING from this scan. Run \`go mod download\` and re-scan`),S.length>0&&d("go-list-failed",`\`go list\` could not load ${String(S.length)} package(s) of this build (${S.slice(0,Bt).join("; ")}${S.length>Bt?"; \u2026":""}) \u2014 what they import is missing from this scan`),w||d("go-list-failed",`the packages another build configuration imports could not all be read (${N.join("; ")}) \u2014 a module imported only there may be missing from this scan`);let Ie=_.length>0||S.length>0||!w?"partial":"ok";return{rootRel:t.rel,status:Ie,mode:p.mode,workspace:p.workspaceFile===null?null:Mm(p.workspaceFile,n),packages:h.size,otherConfiguration:k.size,rows:le,gaps:i,diagnostics:a,facts:l.map(o),loadedPackages:Z,otherConfigPackages:de,modules:z,loadedNames:x,importsPlugin:v,packageModules:M,moduleDirs:X}}function $m(e,n,t={}){let s=n.filter(Bo);if(s.length===0)return null;let o=t.env??process.env,r=o[Nm],i={go:t.go??(r!==void 0&&r!==""?r:"go"),env:o,timeoutMs:t.timeoutMs??Gv,maxOutputBytes:t.maxOutputBytes??Kv,maxPackages:t.maxPackages??zv,maxRounds:t.maxRounds??Uv,maxFiles:t.maxFiles??Wv,maxWalkDirs:t.maxWalkDirs??Hv},a=e;try{a=zl(e)}catch{}let l=qv(i);if("refused"in l){let h=vm([[a,"."],[ym(),"~"]])(`${l.detail} \u2014 the Go scan needs one (ADR-108 F-108-B); NO Go module of this root was enumerated, so this scan says nothing about them; it is not a clean bill of health`);return{toolchain:null,roots:s.map(y=>Tm(y.rel,null,[{kind:"go-toolchain-missing",detail:h,blindsAnalysis:!1,rootRel:""}],[h],[])),blockers:["no Go toolchain read the build"],facts:[]}}let d=l.toolchain,c=vm([[a,"."],[d.gomodcache,"$GOMODCACHE"],[d.goroot,"$GOROOT"],[ym(),"~"]]),p=s.map(h=>aE(i,a,h,d,c)),u=[],f=p.filter(h=>h.status!=="ok").map(h=>h.rootRel===""?".":h.rootRel);f.length>0&&u.push(`the Go build of ${f.slice(0,Bt).join(", ")}${f.length>Bt?", \u2026":""} was not read completely, and what it imports may be what this finding is about`),p.some(h=>h.importsPlugin)&&u.push("the build imports `plugin`: a plugin brings in packages no import graph here holds");let m=[`read with ${d.goversion} ${d.goos}/${d.goarch}, CGO_ENABLED=${d.cgo?"1":"0"}${d.experiment.length>0?`, GOEXPERIMENT=${d.experiment}`:""}, default build tags, GOFLAGS cleared, GOTOOLCHAIN=local, GOPROXY=off \u2014 the import graph is this configuration's; a package only another configuration imports is enumerated and never denied; tests, tools and plugins' own builds are outside it`];return{toolchain:d,roots:p,blockers:u,facts:m}}function ui(e,n){return JSON.stringify([e,n])}function lE(e,n){let t=n.split("/");if(t.some(o=>o===""||o==="."||o===".."||o.includes("\\")))return!1;let s=e;for(let o of t){s=Le.join(s,o);try{if(so(Le.join(s,"go.mod")).isFile())return!1}catch{}}try{return Am(s).some(o=>o.endsWith(".go")&&!o.endsWith("_test.go")&&so(Le.join(s,o)).isFile())}catch{return!1}}function Lm(e,n,t){let s=[],o=new Map(e.rows.map(i=>[i.name,i])),r=i=>{let a=e.packageModules.get(i);if(a!==void 0)return a;let l=null;for(let p of n)i.startsWith(`${p}/`)&&(l===null||p.length>l.length)&&(l=p);if(l===null)return null;let d=i.slice(l.length+1);if(/^v[0-9]+(\/|$)/u.test(d))return null;let c=e.moduleDirs.get(l)??null;return c!==null&&lE(c,d)?l:null};for(let[i,a]of[...e.modules.entries()].sort())for(let l of t(`${i}/`)){if(n.has(l)||r(l)!==i)continue;let d=o.get(i)?.flags??{},c={packageOf:i,...d.replacedBy!==void 0?{replacedBy:d.replacedBy}:{},...d.tool===!0?{tool:!0}:{},...!e.loadedPackages.has(l)&&e.otherConfigPackages.has(l)?{otherConfiguration:!0}:{}};s.push({name:l,version:a,flags:c})}return s}import{readdirSync as dE,readFileSync as cE}from"node:fs";import uE from"node:path";var fE=new Set(["summarized","crashed","over-cap"]),pE=new Set(["function","method","ctor"]);function Xe(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function Hl(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function mE(e,n){Hl(e)||Xe(n,"edge is not an object");let{entryPath:t,entryExport:s,entryContainer:o,hops:r}=e;(typeof t!="string"||typeof s!="string")&&Xe(n,"edge entry fields must be strings"),o!==null&&typeof o!="string"&&Xe(n,"entryContainer must be string or null"),(typeof r!="number"||!Number.isInteger(r)||r<0)&&Xe(n,"hops must be a non-negative integer");let i=e.target;if(Hl(i)||Xe(n,"edge target missing"),i.kind==="symbol"){let{exportName:a,container:l,symbolKind:d}=i;return typeof a!="string"&&Xe(n,"symbol target exportName"),l!==null&&typeof l!="string"&&Xe(n,"symbol target container"),(typeof d!="string"||!pE.has(d))&&Xe(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:s,entryContainer:o,target:{kind:"symbol",exportName:a,container:l,symbolKind:d},hops:r}}if(i.kind==="dep"){let{calleePackage:a,calleeSubpath:l,calleeExport:d}=i;return(typeof a!="string"||a.length===0)&&Xe(n,"dep target calleePackage"),l!==null&&typeof l!="string"&&Xe(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&Xe(n,"dep target calleeExport"),{entryPath:t,entryExport:s,entryContainer:o,target:{kind:"dep",calleePackage:a,calleeSubpath:l,calleeExport:d},hops:r}}Xe(n,`unknown target kind ${JSON.stringify(i.kind)}`)}function hE(e,n){Hl(e)||Xe(n,"root is not an object");let{packageName:t,analyzedVersion:s,tool:o,toolVersion:r,maxIndirections:i,status:a}=e;(typeof t!="string"||t.length===0)&&Xe(n,"packageName"),typeof s!="string"&&Xe(n,"analyzedVersion"),o!=="jelly"&&Xe(n,`tool ${JSON.stringify(o)} (only 'jelly' exists)`),typeof r!="string"&&Xe(n,"toolVersion"),typeof i!="number"&&Xe(n,"maxIndirections"),(typeof a!="string"||!fE.has(a))&&Xe(n,`status ${JSON.stringify(a)} not in the enum`);let l=e.edges;return Array.isArray(l)||Xe(n,"edges is not an array"),a!=="summarized"&&l.length>0&&Xe(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:s,tool:o,toolVersion:r,maxIndirections:i,status:a,edges:l.map(d=>mE(d,n))}}function Dm(e){let n=new Map,t=dE(e).filter(s=>s.endsWith(".summary.json"));for(let s of t){let o=uE.join(e,s),r;try{r=JSON.parse(cE(o,"utf8"))}catch(l){Xe(s,`unparseable JSON: ${l instanceof Error?l.message:String(l)}`)}let i=hE(r,s),a=n.get(i.packageName);a===void 0?n.set(i.packageName,[i]):a.push(i)}return n}import vt from"node:path";function gE(e,n){let t=e.read(n);if(t===null)return null;let s=t.toString("utf8"),o=vt.posix.basename(n);if(o==="package-lock.json"||o==="npm-shrinkwrap.json")return nl(s);if(o==="pnpm-lock.yaml")return tl(s);if(o==="yarn.lock")return sl(s,yE(e,n));if(o==="uv.lock")return ll(s);if(o==="poetry.lock"){let r=e.read(vt.posix.join(vt.posix.dirname(n),"pyproject.toml")),i=r===null?[]:[...Yr(r.toString("utf8")).keys()];return dl(s,i)}return null}function yE(e,n){let t=new Map,s=e.read(vt.posix.join(vt.posix.dirname(n),"package.json"));if(s===null)return t;let o;try{o=JSON.parse(s.toString("utf8"))}catch{return t}if(typeof o!="object"||o===null)return t;for(let r of["dependencies","devDependencies","optionalDependencies"]){let i=o[r];if(!(typeof i!="object"||i===null||Array.isArray(i)))for(let[a,l]of Object.entries(i))typeof l=="string"&&!t.has(a)&&t.set(a,l)}return t}function Fm(e,n,t=[]){let s=new Ut(e,gl),o=new Map,r=new Map,i=new Map,a=[],l=u=>{if(!r.has(u)){let m=s.read(u)?.toString("utf8")??null,h=vt.posix.basename(u);r.set(u,m===null?null:h==="pyproject.toml"?Yr(m):h.endsWith(".txt")?cl(m):rl(m))}return r.get(u)??null},d=(u,f)=>{let m=u.endsWith("pyproject.toml"),h=m?xt(f):f,y=m?[u,vt.posix.join(vt.posix.dirname(u),"requirements.txt")]:[u];for(let _ of y){let S=l(_)?.get(h);if(S!==void 0)return{path:_,line:S}}return null},c=(u,f,m)=>{let h=JSON.stringify([u,f,m]),y=i.get(h);if(y!==void 0)return y;o.has(u)||o.set(u,gE(s,u));let _=o.get(u)??null,S=_===null?null:ol(_,f,m,{maxNodes:Vt.maxPackageGraphNodes,maxEdges:Vt.maxPackageGraphEdges}),b=null;if(S!==null&&a.length<Vt.maxPackageGraphs){b=`g${String(a.length)}`;let k=vt.posix.dirname(u);a.push({id:b,nodes:S.nodes.map(w=>{let N=w.directFrom===null?null:vt.posix.join(k,w.directFrom);return{id:w.id,name:w.name,version:w.version,direct:w.directFrom!==null,declaredIn:N===null?null:d(N,w.name)}}),edges:S.edges.map(w=>({from:w.from,to:w.to})),truncated:S.truncated})}return i.set(h,b),b},p=n.map(u=>{if(u.tier==="not-affected"||u.ecosystem==="Go")return null;if(u.ecosystem==="PyPI"){for(let f of t){let m=c(f,u.packageName,u.version);if(m!==null)return m}return null}return u.packageLocation===null?null:c(u.packageLocation,u.packageName,u.version)});return{graphs:a,idOf:p}}import{isBuiltin as jm}from"node:module";function re(e){let n="";for(let t of e){let s=t.charCodeAt(0),o=s<32||s>=127&&s<=159;n+=o?"\\x"+s.toString(16).padStart(2,"0"):t}return n}var Bm=1024,Gm=4096,fi=8,Km=512,zm=512,ql=8,_E=160,bE=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),Vl=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),SE=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,xE=/\.[cm]?[jt]sx?$/u;function Um(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let s=e.lastIndexOf("node_modules/");if(s!==-1){let o=e.slice(s+13).split("/"),r=o[0]??"";return r.startsWith("@")?o[1]===void 0?null:`${r}/${o[1]}`:r===""?null:r}return SE.test(e)&&!xE.test(e)?e:null}function kE(e){return re(`${e.code} ${e.path}: ${e.detail}`.slice(0,_E))}function Wm(e){let{graph:n,facts:t,diagnostics:s}=e,o=new Map(n.modules.map(F=>[F.id,F])),r=new Map(n.modules.map(F=>[F.path,F])),i=Zn(n),a=new Set;for(let F of i){let ne=o.get(F);ne!==void 0&&a.add(ne.packageName)}let l=new Map,d=0,c=!1,p=!1,u=F=>F.startsWith(`${e.appRootReal}/`)?F.slice(e.appRootReal.length+1):F;for(let F of s){if(F.code==="limit-exceeded"&&F.path===e.appRootReal){c=!0;continue}let ne=Um(u(F.path),r);if(ne===null){F.code==="out-of-root"&&d++,Vl.has(F.code)&&(p=!0);continue}let pe=r.get(u(F.path));pe!==void 0&&Vl.has(F.code)&&!pe.path.includes("node_modules/")&&(p=!0);let Se=l.get(ne);Se===void 0?l.set(ne,[F]):Se.push(F)}let f=new Map(n.imports.map(F=>[F.id,F])),m=new Set;for(let F of n.importEdges){let ne=f.get(F.importId);ne!==void 0&&o.get(ne.moduleId)?.externalSurface===!0&&m.add(ne.moduleId)}let h=[],y=new Set,_=n.modules.filter(F=>F.externalSurface===!0);for(let F of _){let ne=l.get(F.packageName)??[],pe=m.has(F.id),Se=[],Ie=_e=>_e.code==="dependency-body"&&_e.anchor===void 0&&/syntax/u.test(_e.detail),$=_e=>_e.code==="loader-escape"||_e.code==="dependency-body"&&_e.anchor===void 0&&!/syntax/u.test(_e.detail),T=ne.filter(_e=>bE.has(_e.code)),j=ne.filter($),U=ne.filter(_e=>Vl.has(_e.code)||Ie(_e)),Q=ne.filter(_e=>_e.code==="out-of-root"),te=pe&&T.length===0,ie=j.length===0,me=!c&&U.length===0,ge=d===0&&Q.length===0;pe||Se.push("(a) the package's entry was never followed to a module");for(let _e of[...T,...j,...U,...Q]){if(Se.length>=ql)break;Se.push(kE(_e))}c&&Se.length<ql&&Se.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&Se.length<ql&&Se.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let Re=["a","b","c","d"].filter(_e=>!{a:te,b:ie,c:me,d:ge}[_e]),Oe=Re.length===0;Oe&&y.add(F.id),h.push({packageName:re(F.packageName),module:re(String(F.id)),inReach:i.has(F.id),builtin:jm(F.packageName),followed:pe,d1:{a:te,b:ie,c:me,d:ge},failing:Re,transparent:Oe,evidence:Se})}let S=new Set;for(let F of t)F.reach.kind==="unbounded"&&S.add(F.source);let b=F=>({module:re(String(F.module)),kind:F.kind,packageName:o.get(F.module)?.packageName??null}),k=new Set(_.filter(F=>jm(F.packageName)).map(F=>F.id)),w=new Set([...y,...k]),N=[],R=new Map,v=0,I=0,A=0,B=0,O=[],V=new Set;for(let F of t)F.reach.kind==="unbounded"&&V.add(F.cause);for(let F of t){if(F.reach.kind==="class-scope"){O.push({packageName:F.reach.packageName,container:F.reach.container});continue}if(F.reach.kind==="unbounded"||F.reach.kind==="dependency-dispatch"||F.reach.kind==="loaded-package")continue;B++;let ne=F.reach.anchor,pe=R.get(String(ne));pe===void 0&&(pe={today:fo(n,ne,S),d1:fo(n,ne,S,y),d1Builtins:fo(n,ne,S,w)},R.set(String(ne),pe)),pe.d1Builtins.length>0&&A++,pe.today.length>0&&(v++,V.add(F.cause)),pe.d1.length>0&&I++,N.length<Gm&&N.push({anchor:re(String(ne)),packageName:re(o.get(ne)?.packageName??""),cause:F.cause,reachKind:F.reach.kind,blockersToday:pe.today.slice(0,fi).map(b),blockersUnderD1:pe.d1.slice(0,fi).map(b),blockedUnderD1Builtins:pe.d1Builtins.length>0,moreToday:Math.max(0,pe.today.length-fi),moreUnderD1:Math.max(0,pe.d1.length-fi)})}let E=s.filter(F=>F.anchor===void 0&&F.classScope===void 0),D=new Map(e.loadSites.map(F=>[F.importId,F])),L=new Map;for(let F of e.loadSites){let ne=L.get(F.path);ne===void 0?L.set(F.path,[F.shape]):ne.push(F.shape)}let K=F=>{if(F.code!=="loader-escape")return!1;let ne=F.escapes??[];if(ne.length===0||ne.some(Se=>Se!=="non-literal-load"))return!1;let pe=L.get(F.path)??[];return pe.length>0&&pe.every(Se=>Se==="relative-bounded")},Y=E.slice(0,zm).map(F=>({cause:e.causeOf(F.code),code:F.code,path:re(u(F.path)),attributedPackage:Um(u(F.path),r),...F.escapes!==void 0?{escapes:[...F.escapes]}:{},...F.reason!==void 0?{reason:F.reason}:{},d2Dischargeable:K(F)})),le={};for(let F of E){if(F.code!=="unresolved-specifier")continue;let ne=F.reason??"(none)";le[ne]=(le[ne]??0)+1}let z=S.size===0?0:t.filter(F=>F.reach.kind==="unbounded").length,Z=Math.max(0,z-E.length),de=z-E.filter(K).length,x=[],M=0,X=0,W=0;for(let F of n.imports){if(F.specifierIsLiteral)continue;W++;let ne=i.has(F.moduleId),pe=D.get(String(F.id)),Se=pe?.shape??"unrecorded";ne&&(M++,Se==="relative-bounded"&&X++),x.length<Km&&x.push({importId:re(String(F.id)),path:re(o.get(F.moduleId)?.path??""),shape:Se,text:re(pe?.text??""),inReach:ne})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:c,appCapHit:p,unattributedOutOfRoot:d,blindUnbounded:Z,unbounded:Y,anchors:N,surfaces:h.slice(0,Bm),loads:x,counts:{modules:n.modules.length,reachMods:i.size,surfaces:_.length,surfacesInReach:h.filter(F=>F.inReach).length,transparentSurfaces:y.size,builtinSurfaces:k.size,anchors:B,anchorsBlockedToday:v,anchorsBlockedUnderD1:I,anchorsBlockedUnderD1Builtins:A,unbounded:z,loadsInReach:M,loadsRelativeBounded:X,unresolvedByReason:le,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,h.length-Bm),anchors:Math.max(0,B-Gm),loads:Math.max(0,W-Km),unbounded:Math.max(0,E.length-zm)}},reachedPackages:a,aborted:e.analysisAborted,unboundedFacts:z,unboundedHard:de,anchorsBlockedToday:v,anchorsBlockedUnderD1:I,anchorsBlockedUnderD1Builtins:A,loadsInReach:M,loadsAllBounded:M>0&&X===M,d2Eligible:e.rootBudget==="complete"&&!p&&!c,classScope:O,taintCausesToday:V}}var wE=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),vE=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Hm(e,n,t,s,o){if(t===null||e.reachedPackages.has(t.packageName))return;let r=e.classScope.some(v=>v.packageName===t.packageName&&v.container===t.container),i=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||r,a=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||a||n.reasonKind!==void 0&&wE.has(n.reasonKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":i?"taint":s>0?"oog":"unexpected",c=new Set(e.taintCausesToday);r&&c.add("dep-opaque");let p=e.aborted!==null?e.aborted:vE.find(v=>c.has(v)),u=d==="pre-2b"?He(n.tier)&&(a?n.reasonKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?He(n.tier)&&n.reasonKind==="dynamic-load":d==="taint"?He(n.tier)&&n.reasonKind===p:d==="oog"?He(n.tier)&&n.reasonKind==="analysis-cap":!1,f=t.verified&&o===!0,m=e.aborted===null&&e.unboundedFacts===0&&!r&&s===0,h=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,y=f&&d==="taint"&&m&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,_=f&&d==="load"&&m&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,S=f&&(d==="load"||d==="taint")&&m&&h&&e.anchorsBlockedUnderD1===0,b=e.aborted===null&&e.unboundedHard===0&&!r&&s===0,k=f&&d==="load"&&b&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,w=f&&(d==="load"||d==="taint")&&b&&h&&e.anchorsBlockedUnderD1===0,N=f&&d==="taint"&&m&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,R=f&&(d==="load"||d==="taint")&&b&&h&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:u,verified:t.verified,surfaceComplete:o,oog:s,classScoped:r,predicted:{d1:y,d2:_,d1d2:S,d2Amended:k,d1d2Amended:w,d1Builtins:N,d1d2AmendedBuiltins:R}}}import{readFileSync as EE,statSync as AE}from"node:fs";var Yl=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,pi=/^[A-Za-z0-9_$.-]{1,128}$/u,qm=64,Vm=1024*1024,Xm=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Ym=/^[A-Za-z0-9@_.-]{1,128}$/u;function Qe(e){throw new Error(`model claims rejected: ${e}`)}function Xl(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function NE(e,n){Xl(e)||Qe(`${n}: edge is not an object`);let{kind:t,anchorExport:s,anchorContainer:o,calleePackage:r,calleeContainer:i,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&Qe(`${n}: edge kind`),(typeof s!="string"||!pi.test(s))&&Qe(`${n}: anchorExport ${JSON.stringify(s)}`),o!==null&&(typeof o!="string"||!pi.test(o))&&Qe(`${n}: anchorContainer`),(typeof r!="string"||!Yl.test(r))&&Qe(`${n}: calleePackage ${JSON.stringify(r)}`),i!==null&&(typeof i!="string"||!pi.test(i))&&Qe(`${n}: calleeContainer`),(typeof a!="string"||!pi.test(a))&&Qe(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:s,anchorContainer:o,calleePackage:r,calleeContainer:i,calleeExport:a}}function Jm(e){let n=AE(e).size;n>Vm&&Qe(`file is ${String(n)} bytes, over the ${String(Vm)} cap`);let t;try{t=JSON.parse(EE(e,"utf8"))}catch(o){Qe(`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}Array.isArray(t)||Qe("root is not an array"),t.length>qm&&Qe(`${String(t.length)} claims over cap ${String(qm)}`);let s=[];for(let o of t){Xl(o)||Qe("claim is not an object");let{packageName:r,modelId:i,range:a,edges:l}=o;(typeof r!="string"||!Yl.test(r))&&Qe("packageName"),(typeof i!="string"||!Ym.test(i))&&Qe("modelId (identifier charset, 1-128 chars)"),s.some(c=>c.model.modelId===i)&&Qe(`duplicate modelId ${i} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Xl(a)||typeof a.introduced!="string")&&Qe(`${i}: range`),Xm.test(a.introduced)||Qe(`${i}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let d=a.fixedBefore;d!==null&&typeof d!="string"&&Qe(`${i}: fixedBefore`),typeof d=="string"&&!Xm.test(d)&&Qe(`${i}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(l)||Qe(`${i}: edges`),l.length>64&&Qe(`${i}: ${String(l.length)} edges over cap ${String(64)}`),s.push({model:{packageName:r,modelId:i,edges:l.map(c=>NE(c,i))},introduced:a.introduced,fixedBefore:d})}return s}var IE=["in-app-purchase@1-v1"];function Jl(e,n,t){let s=[],o=[],r=[],i=(a,l,d,c)=>{o.push(d),r.push({modelId:c??a.model.modelId,status:l,reason:d,edgeCount:a.model.edges.length})};for(let a of e){if(!Yl.test(a.model.packageName)||!Ym.test(a.model.modelId)){i(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&IE.includes(a.model.modelId)){i(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(c=>c.kind!=="alias"&&c.kind!=="dispatch")){i(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let l=n(a.model.packageName);if(typeof l!="string"&&l!==void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} installed at more than one version (${l.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(l===void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let d;try{d=Rt(l,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${l} is not a version cupel can order \u2014 inert (never guessed)`);continue}if(!d){i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${l} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}s.push(a.model),r.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:s,notes:o,dispositions:r}}var OE=4,PE={additiveForms:!0,namelessExports:!0},CE=new Set(["dep-opaque","dynamic-load","dispatch"]),ME={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function rd(e,n,t){return He(e.tier)&&ME[t].has(e.decidedAtStage)&&e.reasonKind!==void 0&&CE.has(e.reasonKind)&&n!==null&&n.verified}var TE=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,"potentially-reachable-not-ruled-out":0,"potentially-reachable-not-analysed":0}),dt=class extends Error{},id="cupel/coverage-gap",th={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function Qo(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:t.ecosystem==="Go"?{ecosystem:"Go"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Zm(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Qm(e,n,t){let s=new Map(e.modules.map(i=>[i.path,i.id])),o=e.modules[0]?.id;if(o===void 0)return[];let r=n.map(i=>({source:s.get(i.path)??o,cause:th[i.code],reach:i.classScope!==void 0?{kind:"class-scope",packageName:i.classScope.packageName,container:i.classScope.container}:i.anchor!==void 0?{kind:"via-module",anchor:i.anchor}:{kind:"unbounded"}}));for(let i of t)r.push({source:o,reach:{kind:"unbounded"},cause:i});return r}function td(e,n,t,s,o){let r=t.filter(i=>i.exportName!==null&&(s===1||o||i.verified!==1));return r.length>0?r.map(i=>({advisoryId:e,packageName:n,exportName:i.exportName??"",container:i.container,symbolKind:i.symbolKind,sourcePath:i.sourcePath??"",derivation:i.derivation,confidence:i.confidence,verified:i.verified===1})):t.length===0||t.every(i=>i.exportName!==null&&i.verified===1)?[null]:[]}function $E(e,n){let t;try{t=er(e)}catch{return!0}let s=3,o=(r,i)=>{if(i>s)return!1;let a;try{a=nh(r)}catch{return!1}for(let l of a){if(l==="node_modules"||l.startsWith("."))continue;let d=ct.join(r,l),c;try{c=od(d)}catch{continue}if(!c.isDirectory())continue;let p=ct.relative(t,d).split(ct.sep).join("/");try{if(od(ct.join(d,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(o(d,i+1))return!0}return!1};return o(t,1)}function LE(e,n){let t="";for(let s of e)s.rel!==""&&n.startsWith(`${s.rel}/`)&&s.rel.length>t.length&&(t=s.rel);return t}function DE(e,n,t){let s=[];if(t&&s.push("nested-app-root"),n==="")return[...s,"manifest-unreadable"];let o;try{if(o=er(ct.resolve(e,n)),!o.startsWith(er(e)+ct.sep))return[...s,"manifest-unreadable"]}catch{return[...s,"manifest-unreadable"]}let r;try{let c=ct.join(o,"package.json");if(!od(c).isFile())return[...s,"manifest-unreadable"];r=RE(c,"utf8")}catch{return[...s,"manifest-unreadable"]}let i;try{i=JSON.parse(r)}catch{return[...s,"manifest-unreadable"]}if(typeof i!="object"||i===null)return[...s,"manifest-unreadable"];let a=i;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&s.push("bin");let l=["preinstall","install","postinstall","prepare","prepublish"],d=a.scripts;if(typeof d=="object"&&d!==null){let c=d;l.some(p=>typeof c[p]=="string")&&s.push("install-script")}return(a.gypfile===!0||FE(o))&&s.push("native-artifact"),s}function FE(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=ct.join(e,n),s;try{s=nh(t)}catch{continue}if(s.some(o=>o.endsWith(".node")))return!0}return!1}function jE(e){return new Set(["npm",...e.ecosystems?.()??[]])}function ad(e){return e.ecosystem??"npm"}function BE(e,n){let t=[];for(let s of e.perRoot){let o=new Map;for(let r of s.packages){let i=ad(r);n.has(i)||o.set(i,(o.get(i)??0)+1)}for(let[r,i]of[...o.entries()].sort()){let a=r==="Go"?"module(s)":"distribution(s)",l=r==="Go"?"ADR-108 D6":"ADR-109 D5";t.push({kind:"ecosystem-uncovered",detail:`${s.rootRel===""?"":`${s.rootRel}: `}${String(i)} ${r} ${a} were enumerated but the loaded shard carries no ${r} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${r} shard to assess them (${l}).`,blindsAnalysis:!1,rootRel:s.rootRel})}}return t}function GE(e,n,t){let s=new Set(e.perRoot.flatMap(i=>i.packages.map(ad))),o=new Map([...s].filter(i=>t.has(i)).map(i=>[i,KE(n,i)])),r=[];for(let i of e.perRoot)for(let a of[...new Set(i.packages.map(ad))].sort()){let l=o.get(a);if(l===void 0||l==="census")continue;let d=l==="project"?"one project's installed set":l==="corpus"?"a vetted corpus slice":"an undeclared population";r.push({kind:"shard-population-narrow",detail:`${i.rootRel===""?"":`${i.rootRel}: `}the loaded ${a} shard's population is ${d}, not the whole ${a} ecosystem: a package outside it carries no advisory row here, so it reports no findings \u2014 which is NOT a clean bill of health for it. Scan with a census shard to assess every package (ADR-114 D5).`,blindsAnalysis:!1,rootRel:i.rootRel})}return r}function KE(e,n){return e.populationModeFor!==void 0?e.populationModeFor(n):e.populationMode?.()}function sh(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function zE(e,n,t){return new Map(n.map(s=>[sh(s),DE(e,s.lockKey,t)]))}function UE(e){let n=new Map;for(let t of e){let s=n.get(t.advisory.id);s===void 0?n.set(t.advisory.id,[t]):s.push(t)}return n}function WE(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(o=>o.packageName===t.name)?e:{...e,tier:Te("symbol-unsupported"),reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,reasonKind:"symbol-unsupported",basis:void 0,path:void 0}}function eh(e,n,t){if(n.ecosystem!=="Go")return e;let s=t?.flags(n.name,n.version)??{};if(e.tier==="not-affected"&&e.decidedAtStage==="version-match")return s.replacedBy!==void 0?{...e,tier:Te("resolution-divergence"),reason:`${n.name} is replaced by ${s.replacedBy} (a go.mod replace): the code that is built is not ${n.name}@${n.version}, so its version cannot place it outside the advisory's range`,reasonKind:"resolution-divergence",basis:void 0}:s.toolchainAhead!==void 0?{...e,tier:Te("version-undecidable"),reason:`the Go on PATH is ${n.version}, but the governing toolchain line names ${s.toolchainAhead}, which a build under GOTOOLCHAIN=auto uses instead \u2014 which release builds the program is not known here`,reasonKind:"version-undecidable",basis:void 0}:e;if(e.tier!=="not-reachable")return e;let o=s.otherConfiguration===!0?"another build configuration imports it (a file this configuration excludes by a build constraint)":t===null?"no Go lane read the build":t.blockers[0];return o===void 0&&t!==null?{...e,reason:`${n.name} is imported by no package of this build \u2014 not in the import graph \`go list -deps\` reports for ${t.configuration}, and by no file another build configuration compiles (tests excepted): a package-level denial, saying nothing about symbols`}:o===void 0?e:{...e,tier:Te("analysis-cap"),reason:`${n.name} is not imported by this build's graph, but ${o} \u2014 cannot confirm it is unreachable`,reasonKind:"analysis-cap",basis:void 0,path:void 0}}function HE(e,n){return e===void 0?n:{...e.replacedBy!==void 0||n.replacedBy!==void 0?{replacedBy:e.replacedBy??n.replacedBy}:{},...e.replacementOf!==void 0||n.replacementOf!==void 0?{replacementOf:e.replacementOf??n.replacementOf}:{},...e.otherConfiguration===!0||n.otherConfiguration===!0?{otherConfiguration:!0}:{},...e.toolchainAhead!==void 0||n.toolchainAhead!==void 0?{toolchainAhead:e.toolchainAhead??n.toolchainAhead}:{},...e.tool===!0||n.tool===!0?{tool:!0}:{},...e.packageOf!==void 0||n.packageOf!==void 0?{packageOf:e.packageOf??n.packageOf}:{}}}function qE(e,n){let t=new Set;for(let l of e.roots)for(let d of l.modules.keys())t.add(d);let s=l=>n.packageNamesUnder?.("Go",l)??[],o=new Map,r=new Set,i=new Map;for(let l of e.roots){let d=Lm(l,t,s),c=[...l.rows,...d];for(let p of c){let u=ui(p.name,p.version);o.set(u,HE(o.get(u),p.flags))}for(let p of l.loadedNames)r.add(p);for(let p of d)l.loadedPackages.has(p.name)&&r.add(p.name);i.set(l.rootRel,{packages:c.map(p=>({name:p.name,version:p.version,lockKey:"",dev:!1,declaredIn:"go.mod",ecosystem:"Go"})),source:c.length>0?"go-list":"none",lockfilePath:null,diagnostics:l.diagnostics,truncated:!1,gaps:l.gaps})}let a=[...r].sort().map(l=>({id:`go:${l}`,packageName:l,versionRange:"",path:l,moduleSystem:"esm",isEntrypoint:!0}));return{sets:i,flags:o,graph:{...ld,modules:a},analyzed:e.roots.some(l=>l.status!=="failed")}}var ld={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function VE(e,n,t,s,o,r,i){let{finding:a}=Zo(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:i(t)},Qo(s.advisory.id,t.name,s.affected),null,o,r);return a.decidedAtStage!=="presence"&&a.decidedAtStage!=="version-match"?"inside":a.tier==="not-affected"?"outside":"undecidable"}function Zo(e,n,t,s,o,r,i){let a=Ki({graph:e,installed:t,range:s,symbol:o,coverage:null,incompleteness:r,analysisAborted:i});if(n!==null&&o!==null&&rd(a,o,"base")){let l=po(e,n.modulesById,n.reachMods,o,n.records);if(l!==null)return{finding:a,hit:l}}return{finding:a,hit:null}}function XE(e,n){let t=new Set,s=[];for(let o of e.packages)if((o.ecosystem??"npm")==="npm")for(let{advisory:r,affected:i}of n.advisoriesForPackage(o.ecosystem??"npm",o.name)){let a=Qo(r.id,o.name,i),l;try{l=Rt(o.version,a)}catch{continue}if(l)for(let d of n.symbolsForAffected(i.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let c=`${o.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(c)||(t.add(c),s.push({packageName:o.name,packageRootRel:o.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return s.sort((o,r)=>`${o.packageRootRel}\0${o.container}\0${o.sourcePath}`.localeCompare(`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`)),s.slice(0,Lr)}function YE(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),o=new Map(e.classes.map(a=>[a.id,a.name])),r=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let l=r.get(a.callSiteId);if(l===void 0)continue;let d=s.get(l.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let c=n.get(d.moduleId);if(c===void 0)continue;let p=s.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&i.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:d.id})}return i}function JE(e){let n=new Set(e.modules.filter(c=>c.isEntrypoint).map(c=>c.id)),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.functions.map(c=>[c.id,c])),o=new Set;for(let c of e.functions)n.has(c.moduleId)&&(c.publicSurfaceReachable||c.name==="<toplevel>")&&o.add(c.id);let r=new Map(e.exports.map(c=>[c.id,c]));for(let c of e.exportBindings){if(c.target.kind!=="function")continue;let p=r.get(c.exportId);if(p===void 0||!n.has(p.moduleId))continue;let u=s.get(c.target.functionId);u===void 0||t.get(u.moduleId)?.externalSurface===!0||o.add(u.id)}let i=new Map(e.callSites.map(c=>[c.id,c.enclosingFunctionId])),a=new Map;for(let c of e.callEdges){if(c.resolution!=="resolved"&&c.resolution!=="field-based")continue;let p=i.get(c.callSiteId);if(p===void 0)continue;let u=a.get(p);u===void 0?a.set(p,[c.calleeFunctionId]):u.push(c.calleeFunctionId)}let l=new Set(o),d=[...o];for(;d.length>0;){let c=d.pop();if(c!==void 0)for(let p of a.get(c)??[])l.has(p)||(l.add(p),d.push(p))}return l}function ZE(e,n,t,s){for(let o of n){if(o.modelId!==e.modelId||o.anchor.packageName!==e.anchorPackage||o.anchor.exportName!==e.entryExport)continue;let r=t.filter(a=>a.packageName===o.anchor.packageName&&a.exportName===o.anchor.exportName&&a.container===o.anchor.container),i=r.find(a=>a.resolution==="resolved")??r[0];if(i!==void 0)return s.has(i.callerFunctionId)}return null}function QE(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(r=>r.modelId!==void 0);let s=new Set(t),o=r=>s.has(r)||s.has($n[r]??"")||s.has(mt[r]??"");return e.some(r=>He(r.tier)&&r.reasonKind!==void 0&&o(r.reasonKind)||r.modelPromotedFromKind!==void 0&&o(r.modelPromotedFromKind))}function dd(e){let n=oo.now(),t=er(e.dir),s=e.xGo===!0,o=e.reader??(s&&e.shardPathGo!==void 0?br([Xt(e.shardPath),...e.shardPathPypi!==void 0?[Xt(e.shardPathPypi)]:[],Xt(e.shardPathGo)]):e.shardPathPypi!==void 0?br([Xt(e.shardPath),Xt(e.shardPathPypi)]):Xt(e.shardPath)),r=e.partialRows===!0;try{if(!/^\d+$/u.test(o.schemaVersion)||Number(o.schemaVersion)>Number(ht))throw new dt(`shard schema ${JSON.stringify(o.schemaVersion)} is unreadable or newer than this cupel understands (v${ht})`);let i=null;if(e.summaryShadow!==void 0)try{i=Dm(e.summaryShadow)}catch(H){throw new dt(`--summary-shadow facts dir rejected: ${H instanceof Error?H.message:String(H)}`)}let a=null;if(e.modelShadow!==void 0)try{a=Jm(e.modelShadow.claimsPath)}catch(H){throw new dt(`--model-shadow claims rejected: ${H instanceof Error?H.message:String(H)}`)}let l=Go(t,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{},discoverGoRoots:s}),d=s?$m(t,l.roots,e.goScan):null,c=d===null?null:qE(d,o),p=mp(t,l,e.installedSet,c?.sets);if(p.truncated){let H=p.perRoot.filter(ye=>ye.truncated).map(ye=>ye.rootRel===""?"the scan root":`\`${ye.rootRel}\``);throw new dt(`the dependency enumeration hit a hard cap and is incomplete at ${H.length>0?H.join(", "):"the union across roots"} (${p.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let u=gm(l.roots,{preciseNames:e.pyPreciseNames!==!1}),f=u?.execution??null,m=gp(p.packages.filter(H=>(H.ecosystem??"npm")==="npm")),h=e.entry??[],y=h.length>0?xf(t,h):{entrypoints:[],rejected:[]},_=y.rejected,S=Sf(t,l.roots.filter(H=>H.rel===""||H.ecosystem!=="Go")),b=[...new Set([...S.entrypoints,...y.entrypoints])],k=[...new Set([...S.sources.filter(H=>H.source!=="exports"&&H.source!=="browser").map(H=>H.entrypoint),...y.entrypoints])],w=[...S.sources];for(let H of y.entrypoints)S.entrypoints.includes(H)||w.push({source:"--entry",specifier:H,entrypoint:H,launch:!1,root:LE(l.roots,H)});let N=[...w];for(let H of u?.roots??[])for(let ye of H.entrypoints)w.push({source:`python:${ye.source}`,specifier:ye.declaration,entrypoint:H.rootRel===""?ye.file:`${H.rootRel}/${ye.file}`,launch:ye.source==="console-script"||ye.source==="launch-declaration",root:H.rootRel});let R=XE(p,o),v=e.bindingForms??PE,I=e.callablePackageResolver===!0,A=e.tsconfigPaths!==!1,B=$E(t,Uo(w)),O=zE(t,p.packages,B),V=H=>H.ecosystem==="Go"?c?.flags.get(ui(H.name,H.version))?.tool===!0?["bin"]:[]:(H.ecosystem??"npm")!=="npm"?f?.get(H.name)??["manifest-unreadable"]:O.get(sh(H))??["manifest-unreadable"],E=Ha({appRoot:t,entrypoints:b,executedEntrypoints:k,depClassAnchors:R,bindingForms:v,callablePackageResolver:I,tsconfigPaths:A}),D=E.graph,L=Gi(D),K=[...S.diagnostics,...qa(S),...Va(S,b.length),...bl(l,N),...E.diagnostics],Y=Zm(b.length,D),le=H=>p.packages.some(ye=>(ye.ecosystem??"npm")===H),z=u===null?"no-entrypoint":u.analysisAborted,Z=(le("npm")?Y:null)??(le("PyPI")?z:null)??(le("npm")||le("PyPI")||le("Go")||d!==null?null:Y),de=jE(o),x=[...p.gaps,...yp(l),...BE(p,de),...GE(p,o,de)],M=_p(x),X=Qm(D,K,M),W={graph:no,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},q=c===null?{...W,graph:ld}:{graph:c.graph,incompleteness:[],analysisAborted:c.analyzed?null:"no-entrypoint",symbolsDecidable:!1},F=d===null||c===null?null:{flags:(H,ye)=>c.flags.get(ui(H,ye)),blockers:d.blockers,configuration:d.toolchain===null?"no toolchain":`${d.toolchain.goos}/${d.toolchain.goarch}, CGO_ENABLED=${d.toolchain.cgo?"1":"0"}, default tags`},ne=H=>(H.ecosystem??"npm")==="npm"?{graph:D,incompleteness:X,analysisAborted:Y,symbolsDecidable:!0}:H.ecosystem==="Go"?q:u===null?W:{...u,symbolsDecidable:!0},pe=t;try{pe=er(t)}catch{}let Se=Wm({graph:D,facts:X,diagnostics:K,analysisAborted:Y,loadSites:E.loadSites,conditionUnions:E.conditionUnions,provenAbsent:E.provenAbsent,appRootReal:pe,rootBudget:l.budget,causeOf:H=>th[H]}),Ie=o.allModels?.()??[],$=Jl(Ie.map(H=>({model:{packageName:H.packageName,modelId:H.modelId,edges:H.edges},introduced:H.introduced,fixedBefore:H.fixedBefore})),m),T=$.models.length>0?Ro(D,$.models).delta:null,j=T!==null?{records:T.records,reachMods:Zn(D),modulesById:new Map(D.modules.map(H=>[H.id,H]))}:null,U=oo.now(),Q=[],te=new Map,ie=TE(),me=[],ge=[];for(let H of p.packages){let ye=ne(H),Ae=(H.ecosystem??"npm")==="npm"?j:null;for(let[,Pe]of UE(o.advisoriesForPackage(H.ecosystem??"npm",H.name))){let on=Pe[0];if(on!==void 0){let an=te.get(on.advisory.id),We=Pe.map(Tn=>Tn.affected);if(an===void 0)te.set(on.advisory.id,{advisory:on.advisory,ranges:We});else{let Tn=new Set(an.ranges.map(mn=>mn.id));for(let mn of We)Tn.has(mn.id)||(Tn.add(mn.id),an.ranges.push(mn))}}let Ke=Pe.map(an=>VE(ye.graph,Ae,H,an,ye.incompleteness,ye.analysisAborted,V)),pt=new Set(Pe.filter((an,We)=>Ke[We]==="inside")),Et=Ke.indexOf("undecidable"),At=Pe.filter((an,We)=>pt.has(an)||We===Et),Is=At.length>0?At:Pe.slice(0,1);for(let an of Is){let{advisory:We,affected:Tn}=an,mn=Qo(We.id,H.name,Tn),Wn=We.cveId??We.id,ls=pt.has(an)?o.symbolsForAffected(Tn.id):[],Nt=ls.filter(se=>se.exportName===null),ds=td(We.id,H.name,ls,Tn.surfaceComplete,r),It=Zo(ye.graph,Ae,{name:H.name,version:H.version,...H.ecosystem!==void 0?{ecosystem:H.ecosystem}:{},devOnly:H.dev,outOfGraphExecution:V(H)},mn,null,ye.incompleteness,ye.analysisAborted).finding;if(It.decidedAtStage==="presence"||It.decidedAtStage==="version-match"){let se=eh(It,H,F);ie[se.tier]+=1,Q.push({...se,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:mn.surfaceComplete,advisoryId:We.id,displayId:Wn,packageName:H.name,version:H.version,ecosystem:H.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:We.severity,packageLocation:Jr(p,H)});continue}for(let se of ds){let{finding:he,hit:ve}=Zo(ye.graph,Ae,{name:H.name,version:H.version,...H.ecosystem!==void 0?{ecosystem:H.ecosystem}:{},devOnly:H.dev,outOfGraphExecution:V(H)},mn,se,ye.incompleteness,ye.analysisAborted),en=eh(WE(he,ye,H),H,F),ze,Ce;ve!==null&&se!==null&&(ze=ve.modelId,Ce=he.reasonKind,en={basis:void 0,tier:ve.tier,decidedAtStage:he.decidedAtStage,reason:`boundary model ${ve.modelId}: ${ve.anchorPackage}.${ve.entryExport} reaches ${se.exportName} [${ve.pathLabels.join(" \u2192 ")}]`,reasonKind:void 0,attribution:pr(se),path:void 0,unresolvedSites:he.unresolvedSites,unresolvedEvidence:he.unresolvedEvidence}),ie[en.tier]+=1;let nn=Hm(Se,en,se,V(H).length,mn.surfaceComplete),hn={...en,...nn!==void 0?{adr105:nn}:{},modelId:ze,modelPromotedFromKind:Ce,surfaceComplete:mn.surfaceComplete,advisoryId:We.id,displayId:Wn,packageName:H.name,version:H.version,ecosystem:H.ecosystem??"npm",symbolName:se?.exportName??null,symbolPath:se?.sourcePath||null,symbolContainer:se?.container??null,severity:We.severity,packageLocation:Jr(p,H)};Q.push(hn);let Kt=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&He(hn.tier)&&hn.decidedAtStage==="symbol-reachable"&&hn.reasonKind!==void 0&&Kt.has(hn.reasonKind)&&se!==null&&me.push({finding:hn,symbol:se}),a!==null&&He(hn.tier)&&se!==null&&ge.push({finding:hn,symbol:se})}for(let se of Nt)ie[Te("symbol-unsupported")]+=1,Q.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:mn.surfaceComplete,tier:Te("symbol-unsupported"),decidedAtStage:"symbol-reachable",reason:`advisory ${Wn} carries a ${se.symbolKind} pattern symbol; pattern matching is not evaluated yet`,reasonKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:We.id,displayId:Wn,packageName:H.name,version:H.version,ecosystem:H.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:We.severity,packageLocation:Jr(p,H)})}}}for(let H of x)ie[Te("coverage-gap")]+=1,Q.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:Te("coverage-gap"),decidedAtStage:"presence",reason:H.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:id,displayId:id,packageName:H.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:null,reasonKind:"coverage-gap",packageLocation:hp(p,H)});let Re=oo.now()-U,Oe=ie["reachable-high"]+ie["reachable-medium"],_e=e.failOnReachable===!0&&Oe>0,Ge=QE(Q,zt(ie),e.failOnPotentiallyReachable),Ue=e.requireCompleteDenial===!0&&Q.some(H=>H.tier==="not-reachable"&&H.basis==="loader-assumption"),In=_e||Ge||Ue?2:0,Kn;if(i!==null){let H=Zn(D),ye=new Map(D.modules.map(Pe=>[Pe.id,Pe])),Ae=[];for(let{finding:Pe,symbol:on}of me){let Ke=$i(D,ye,H,on,i,OE);Ae.push({advisoryId:Pe.advisoryId,packageName:Pe.packageName,symbolName:Pe.symbolName,reasonKind:Pe.reasonKind??null,wouldPromote:Ke!==null,...Ke!==null?{anchorPackage:Ke.anchorPackage,entryExport:Ke.entryExport,viaPackages:Ke.viaPackages,totalHops:Ke.totalHops}:{}})}Kn={records:Ae}}let G;if(a!==null&&e.modelShadow!==void 0){let H=e.modelShadow.widened===!0?"widened":"base",{models:ye,notes:Ae,dispositions:Pe}=Jl(a,m,{shadowConsultDenylisted:!0}),{delta:on}=Ro(D,ye),Ke=Zn(D),pt=new Map(D.modules.map(se=>[se.id,se])),Et=YE(D,pt,Ke),At=JE(D),Is=on.records.some(se=>Et.some(he=>he.packageName===se.anchor.packageName&&he.exportName===se.anchor.exportName&&he.container===se.anchor.container)),an=[],We=Date.now();for(let{finding:se,symbol:he}of ge){let ve=on.records,en=rd(se,he,H),ze=en?po(D,pt,Ke,he,ve):null,Ce=on.records.filter(nn=>nn.callee.packageName===he.packageName&&nn.callee.exportName===he.exportName&&nn.callee.container===he.container||nn.callee.packageName===he.packageName&&nn.callee.realFunctionId!==null);an.push({advisoryId:se.advisoryId,packageName:se.packageName,symbolName:se.symbolName,reasonKind:se.reasonKind??null,decidedAtStage:se.decidedAtStage,consultSurface:H,noHitReason:ze!==null?null:en?Is?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:ze!==null?ZE(ze,ve,Et,At):null,verdictBefore:se.tier,verdictAfter:ze!==null?"reachable-low":se.tier,wouldPromote:ze!==null,...ze!==null?{modelId:ze.modelId,anchorPackage:ze.anchorPackage,entryExport:ze.entryExport,pathLabels:ze.pathLabels,calleeBinding:Ce.find(nn=>nn.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:en?Ce.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Ce[0]?.anchor.packageName??"?"}#${Ce[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Tn=Date.now()-We,mn=Pe.map(se=>{if(se.status!=="active")return{modelId:se.modelId,state:se.status,reason:se.reason,edgesLowered:0,edgesReferenceGated:0};let he=on.records.filter(en=>en.modelId===se.modelId).length;if(he>0)return{modelId:se.modelId,state:"lowered",reason:null,edgesLowered:he,edgesReferenceGated:se.edgeCount-he};let ve=on.notes.find(en=>en.startsWith(`model ${se.modelId}:`)||en.startsWith(`model-edge ${se.modelId}:`));return{modelId:se.modelId,state:"refused",reason:ve??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:se.edgeCount}}),Wn=an.filter(se=>se.wouldPromote).length,ls=zt(ie)-Wn,Nt=ie["reachable-high"]+ie["reachable-medium"],ds=se=>({none:0,"fail-on-reachable":Nt>0?2:0,"fail-on-potentially-reachable":se>0?2:0,both:Nt>0||se>0?2:0});G={records:an,notes:[...Ae,...on.notes],laneStates:mn,exitCodes:{baseline:ds(zt(ie)),withModels:ds(ls)},overlayWallMs:Tn},Ql(ct.dirname(e.modelShadow.outPath),{recursive:!0});let It=`${e.modelShadow.outPath}.tmp-${Zl(8).toString("hex")}`;nd(It,`${JSON.stringify(G,null,2)}
+`,{encoding:"utf8",flag:"wx"}),ed(It,e.modelShadow.outPath)}let J;if(e.bindingShadow!==void 0){let H=Date.now(),ye=se=>$.models.length>0?{records:Ro(se,$.models).delta.records,reachMods:Zn(se),modulesById:new Map(se.modules.map(he=>[he.id,he]))}:null,Ae=(se,he,ve,en)=>{let ze=[];for(let Ce of p.packages)for(let{advisory:nn,affected:hn}of o.advisoriesForPackage(Ce.ecosystem??"npm",Ce.name)){let Kt=Qo(nn.id,Ce.name,hn),eg=td(nn.id,Ce.name,o.symbolsForAffected(hn.id),hn.surfaceComplete,r);for(let Pd of eg){let{finding:Cd,hit:Ai}=Zo(se,en,{name:Ce.name,version:Ce.version,...Ce.ecosystem!==void 0?{ecosystem:Ce.ecosystem}:{},devOnly:Ce.dev,outOfGraphExecution:V(Ce)},Kt,Pd,he,ve);ze.push({advisoryId:nn.id,packageName:Ce.name,symbolName:Pd?.exportName??null,tier:Ai!==null?Ai.tier:Cd.tier,reasonKind:Ai!==null?null:Cd.reasonKind??null})}}return ze},Pe=se=>{let he=Ha({appRoot:t,entrypoints:b,executedEntrypoints:k,depClassAnchors:R,bindingForms:se,callablePackageResolver:I,tsconfigPaths:A}),ve=[...S.diagnostics,...qa(S),...Va(S,b.length),...bl(l,N),...he.diagnostics];return{graph:he.graph,inc:Qm(he.graph,ve,M),aborted:Zm(b.length,he.graph),live:ye(he.graph),applicability:he.bindingApplicability}},on=se=>{let he=Pe(se);return Ae(he.graph,he.inc,he.aborted,he.live)},Ke=Pe({}),pt=Ae(Ke.graph,Ke.inc,Ke.aborted,Ke.live),Et=Ae(D,X,Y,j);if(Et.length!==pt.length)throw new dt("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let At=(se,he)=>he.tier!==se.tier||he.reasonKind!==se.reasonKind,Is=pt.some((se,he)=>{let ve=Et[he];return ve!==void 0&&At(se,ve)}),an=Is?on({additiveForms:!0}):null,We=Is?on({namelessExports:!0}):null,Tn=0,mn=pt.map((se,he)=>{let ve=Et[he];if(ve===void 0||ve.advisoryId!==se.advisoryId||ve.packageName!==se.packageName||ve.symbolName!==se.symbolName)throw new dt("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let en={advisoryId:se.advisoryId,packageName:se.packageName,symbolName:se.symbolName,reasonKind:se.reasonKind,verdictBefore:se.tier,verdictAfter:ve.tier,wouldPromote:ve.tier!==se.tier&&(ve.tier==="reachable-high"||ve.tier==="reachable-medium"||ve.tier==="reachable-low")};if(!At(se,ve)||an===null||We===null)return en;Tn+=1;let ze=an[he],Ce=We[he],nn=ze!==void 0&&At(se,ze),hn=Ce!==void 0&&At(se,Ce);return{...en,attributedArm:nn&&!hn?"additiveForms":hn&&!nn?"namelessExports":"both",...ze!==void 0?{verdictArmA:ze.tier}:{},...Ce!==void 0?{verdictArmB:Ce.tier}:{}}}),Wn={...ie};pt.forEach((se,he)=>{let ve=Et[he];ve!==void 0&&ve.tier!==se.tier&&(Wn[ve.tier]-=1,Wn[se.tier]+=1)});let ls=(se,he)=>({none:0,"fail-on-reachable":se>0?2:0,"fail-on-potentially-reachable":he>0?2:0,both:se>0||he>0?2:0}),Nt;if($.models.length>0&&j!==null){Nt=[];for(let se of p.packages)for(let{advisory:he,affected:ve}of o.advisoriesForPackage(se.ecosystem??"npm",se.name)){let en=Qo(he.id,se.name,ve),ze=td(he.id,se.name,o.symbolsForAffected(ve.id),ve.surfaceComplete,r);for(let Ce of ze){if(Ce===null||!Ce.verified)continue;let nn=Zo(Ke.graph,Ke.live,{name:se.name,version:se.version,...se.ecosystem!==void 0?{ecosystem:se.ecosystem}:{},devOnly:se.dev,outOfGraphExecution:V(se)},en,Ce,Ke.inc,Ke.aborted);if(!(nn.hit===null&&rd(nn.finding,Ce,"base")))continue;let Kt=po(D,j.modulesById,j.reachMods,Ce,j.records);Nt.push({advisoryId:he.id,packageName:se.name,symbolName:Ce.exportName,modelWouldPromote:Kt!==null,...Kt!==null?{modelId:Kt.modelId}:{},anchorCleared:Kt!==null})}}}let ds=Q.some(se=>se.modelId!==void 0);J={records:mn,deltas:Tn,exitCodes:{baseline:ls(Wn["reachable-high"]+Wn["reachable-medium"],zt(Wn)+(ds?1:0)),withBindingForms:ls(ie["reachable-high"]+ie["reachable-medium"],zt(ie)+(ds?1:0))},dualRunWallMs:Date.now()-H,...E.bindingApplicability!==void 0?{applicability:E.bindingApplicability}:{},...Nt!==void 0?{modelProbe:Nt}:{}},Ql(ct.dirname(e.bindingShadow.outPath),{recursive:!0});let It=`${e.bindingShadow.outPath}.tmp-${Zl(8).toString("hex")}`;nd(It,`${JSON.stringify(J,null,2)}
+`,{encoding:"utf8",flag:"wx"}),ed(It,e.bindingShadow.outPath)}let ee=new Ut(t),ae=new Map,we=H=>{let ye=ae.get(H);if(ye!==void 0)return ye;let Ae=H==="npm"?new Ts(D,ee,Ms("npm"),()=>""):H==="Go"?new Ts(ld,ee,Ms("Go"),()=>""):new Ts(u?.graph??no,ee,Ms("PyPI"),Zi((u?.roots??[]).map(Pe=>Pe.rootRel)));return ae.set(H,Ae),Ae},Me=Ie.length>0||$.notes.length>0?{active:$.models.length,stored:Ie.length,promoted:Q.filter(H=>H.modelId!==void 0).length,notes:[...$.notes,...T!==null?T.notes:[]]}:void 0,xn=e0(Q,n,Re),zn=xn.findings.map(H=>H.path===void 0?H:{...H,located:we(H.ecosystem).locate(H)}),Un=new Map,io=H=>{let ye=Un.get(H);if(ye!==void 0)return ye;let Ae=H==="npm"?gc(D,ee):H==="Go"||u===null?null:yc(u.graph,we("PyPI"),ee);return Un.set(H,Ae),Ae},Ye=zn.map(H=>{let ye=H.located?.nodeOf,Ae=H.path?.[H.path.length-1]?.functionId;if(H.influence===void 0||ye===void 0||ye===null||Ae===void 0)return H;let Pe=io(H.ecosystem);return Pe===null?H:{...H,influenceOverlay:_c(Pe.index,Ae,ye,Pe.lineOf,Pe.pathOf)}}),Yn=()=>{if(u===null)return null;let H=new Map(u.graph.modules.map(Ae=>[Ae.id,Ae])),ye=Zi(u.roots.map(Ae=>Ae.rootRel));return{graph:mr(u.graph),lineOf:Ae=>{let Pe=H.get(Ae.path);if(Pe===void 0||Pe.id.includes("site-packages:"))return null;let on=ye(Pe.id),Ke=on===""?Pe.path:`${on}/${Pe.path}`;return Wt(ee,{...Ae,path:Ke},"utf8-bytes")?.startLine??null}}},ft=Fm(t,Ye,p.perRoot.flatMap(H=>H.pythonLockfilePath?[H.pythonLockfilePath]:[])),Ns;if(e.influenceShadow!==void 0){let H=sc(D,xn.findings,()=>oo.now(),Ae=>Wt(ee,Ae,"utf16-units")?.startLine??null,Yn());Ql(ct.dirname(e.influenceShadow.outPath),{recursive:!0});let ye=`${e.influenceShadow.outPath}.tmp-${Zl(8).toString("hex")}`;nd(ye,`${JSON.stringify(H,null,2)}
+`,{encoding:"utf8",flag:"wx"}),ed(ye,e.influenceShadow.outPath),Ns={ports:H.totals.ports,byOutcome:H.totals.byOutcome,wallMs:H.wallMs}}return{...Ns!==void 0?{influenceShadow:Ns}:{},...Kn!==void 0?{summaryShadow:Kn}:{},...G!==void 0?{modelShadow:G}:{},...J!==void 0?{bindingShadow:J}:{},...Me!==void 0?{modelLane:Me}:{},dir:t,shardSchemaVersion:o.schemaVersion,installed:p,findings:Ye.map((H,ye)=>{let Ae=ft.idOf[ye]??null;return Ae===null?H:{...H,introducedBy:Ae}}),packageGraphs:ft.graphs,timings:xn.timings,counts:ie,analyzerDiagnostics:K,pythonDiagnostics:u?.diagnostics??[],...d!==null?{go:{toolchain:d.toolchain===null?null:`${d.toolchain.goversion} ${d.toolchain.goos}/${d.toolchain.goarch}`,facts:d.facts,blockers:d.blockers,roots:d.roots.map(H=>({rootRel:H.rootRel,status:H.status,mode:H.mode,workspace:H.workspace,packages:H.packages,otherConfiguration:H.otherConfiguration,modules:H.modules.size,facts:H.facts}))}}:{},analysisAborted:Z,rejectedEntries:_,entrypointSources:w,entrypointGaps:[...S.gaps,...S.surfaceGaps],entrypointObservations:S.observations,framework:S.framework,unresolved:L,advisories:[...te.values()],rootSet:l,exitCode:In,adr105:Se.report}}finally{e.reader===void 0&&o.close()}}var sd=e=>Math.round(e*10)/10;function e0(e,n,t){let s=oo.now(),o=e.map(i=>{let a=Di(i.tier);return a===void 0?i:{...i,influence:a}}),r=oo.now()-s;return{findings:o,timings:{scanMs:sd(s-n),cascadeMs:sd(t),stage6Ms:sd(r)}}}var n0="cupel",t0="reachability-first SCA \u2014 verdict + call path + confidence";function cd(e){return[`${n0} v${e} \u2014 ${t0}`,`cascade: ${Vd.join(" \u2192 ")}`,`verdicts: ${Xd.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-potentially-reachable]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-potentially-reachable","                        exit 2 when any potentially reachable finding is present (strict CI;","                        --fail-on-unknown is the old name, still accepted, with a warning)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
+`)}var s0=new Set([...mo,...zi,...cs]),nr="--fail-on-potentially-reachable",ro="--fail-on-unknown",oh=`${ro} is deprecated: use ${nr} (the same gate, renamed by ADR-128). The old spelling keeps working, with this warning, until the next major version.`;function ut(e,n,t){let s=e[n+1];if(s===void 0||s.startsWith("--"))throw new Error(`${t} requires a value`);return s}function o0(e,n){let t=n.split(",").map(r=>r.trim()),s=[...mo,...zi,...cs].join(", ");if(t.length===0||t.some(r=>r===""))throw new Error(`${e}= requires a non-empty comma-separated list of: ${s} (or pass the bare ${e} to fail on every kind)`);let o=[];for(let r of t){if(!s0.has(r))throw new Error(`unrecognised ${e} selector ${JSON.stringify(r)}; valid: ${s}`);o.push(r)}return o}function rh(e){let n=".",t,s,o,r,i=!1,a=!1,l=!1,d=!1,c=!1,p=!1,u,f,m,h=!1,y=!1,_,S,b=!1,k=!1,w=!0,N=!0,R=!1,v,I=[],A=[];for(let B=0;B<e.length;B+=1){let O=e[B];if(O==="--require-complete-denial"){a=!0;continue}if(O==="--fail-on-reachable")i=!0;else if(O===nr||O===ro)l="all",O===ro&&(d=!0);else if(O!==void 0&&(O.startsWith(`${nr}=`)||O.startsWith(`${ro}=`))){let V=O.startsWith(`${nr}=`)?nr:ro;l=o0(V,O.slice(V.length+1)),V===ro&&(d=!0)}else if(O==="--offline")c=!0;else if(O==="--sarif")t=ut(e,B,"--sarif"),B+=1;else if(O==="--shard")s=ut(e,B,"--shard"),B+=1;else if(O==="--shard-pypi")o=ut(e,B,"--shard-pypi"),B+=1;else if(O==="--shard-go")r=ut(e,B,"--shard-go"),B+=1;else if(O==="--entry")I.push(ut(e,B,"--entry")),B+=1;else if(O==="--root")A.push(ut(e,B,"--root")),B+=1;else if(O==="--summary-shadow")u=ut(e,B,"--summary-shadow"),B+=1;else if(O==="--model-shadow")f=ut(e,B,"--model-shadow"),B+=1;else if(O==="--model-shadow-out")m=ut(e,B,"--model-shadow-out"),B+=1;else if(O==="--model-shadow-widened")h=!0;else if(O==="--binding-shadow")y=!0;else if(O==="--x-influence-shadow")S=ut(e,B,"--x-influence-shadow"),B+=1;else if(O==="--binding-shadow-out")_=ut(e,B,"--binding-shadow-out"),B+=1;else if(O==="--x-partial-rows")b=!0;else if(O==="--x-go")k=!0;else if(O==="--no-py-precise-names")w=!1;else if(O==="--x-py-precise-names")w=!0;else if(O==="--no-tsconfig-paths")N=!1;else if(O==="--x-tsconfig-paths")N=!0;else if(O==="--push")R=!0;else if(O!==void 0&&O.startsWith("--auth=")){let V=O.slice(7);if(V!=="oidc"&&V!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(V)}`);v=V}else{if(O!==void 0&&O.startsWith("--"))throw new Error(`unknown flag ${O}`);O!==void 0&&!p&&(n=O,p=!0)}}if(f===void 0!=(m===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(h&&f===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(y!==(_!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(v!==void 0&&!R)throw new Error("--auth only means something with --push");if(r!==void 0&&!k)throw new Error("--shard-go only means something with --x-go");return{dir:n,sarif:t,shard:s,shardPypi:o,shardGo:r,failOnReachable:i,requireCompleteDenial:a,failOnPotentiallyReachable:l,legacyGateFlag:d,offline:c,entry:I,root:A,summaryShadow:u,modelShadow:f,modelShadowOut:m,modelShadowWidened:h,push:R,auth:v,bindingShadow:y,bindingShadowOut:_,influenceShadowOut:S,partialRows:b,xGo:k,pyPreciseNames:w,tsconfigPaths:N}}import{chmodSync as u0,mkdirSync as f0,readFileSync as p0,renameSync as m0,statSync as h0,unlinkSync as g0,writeFileSync as y0}from"node:fs";import{randomBytes as _0}from"node:crypto";import{homedir as b0}from"node:os";import vs from"node:path";import{createPublicKey as r0,verify as i0}from"node:crypto";var Ee=class extends Error{constructor(n){super(n),this.name="DistError"}},Gt=class extends Ee{constructor(n){super(n),this.name="NoCachedShardError"}},a0=Buffer.from("302a300506032b6570032100","hex"),l0=32;function dh(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===l0)try{return r0({key:Buffer.concat([a0,n]),format:"der",type:"spki"})}catch{return}}function ud(e,n,t){for(let s of t){let o=dh(s);if(o!==void 0)try{if(i0(null,e,o,n))return!0}catch{}}return!1}function ch(e){return e.some(n=>dh(n)!==void 0)}var d0=/^[0-9a-f]{64}$/u,c0=/^[a-z0-9-]+$/u;function ih(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new Ee(`${n} must be an object`);return e}function ah(e,n){if(!Array.isArray(e))throw new Ee(`${n} must be an array`);return e}function mi(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new Ee(`${n} must be an integer`);return e}function hi(e,n){if(typeof e!="string")throw new Ee(`${n} must be a string`);return e}function lh(e,n){let t=hi(e,n);if(Number.isNaN(Date.parse(t)))throw new Ee(`${n} is not a valid timestamp: ${t}`);return t}function fd(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new Ee("distribution index is not valid JSON")}let s=ih(t,"index"),o=mi(s.schema_version,"schema_version");if(o!==n.supportedIndexSchemaVersion)throw new Ee(`index schema_version ${String(o)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let r=mi(s.sequence,"sequence");if(r<0)throw new Ee("sequence must be non-negative");let i=lh(s.generated,"generated"),a=ah(s.shards,"shards"),l;for(let m of a){let h=ih(m,"shard entry"),y=hi(h.ecosystem,"ecosystem");if(!c0.test(y))throw new Ee(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){l=h;break}}if(l===void 0)throw new Ee(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);lh(l.built,"built");let d=mi(l.db_schema_version,"db_schema_version");if(d<1)throw new Ee("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new Ee(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let c=hi(l.sha256,"sha256");if(!d0.test(c))throw new Ee(`sha256 must be 64 lowercase hex, got ${JSON.stringify(c)}`);let p=mi(l.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new Ee(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let u=ah(l.urls,"urls");if(u.length===0)throw new Ee("urls must be a non-empty array");let f=[];for(let m of u){let h=hi(m,"url");try{f.push(Ln(h,n.shardHosts))}catch(y){throw new Ee(`refusing shard url ${JSON.stringify(h)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:c,sizeBytes:p,dbSchemaVersion:d,urls:f,sequence:r,generated:i}}var uh="CUPEL_CONFIG_DIR",fh="credentials.json",pd="cpd_",S0="cpl_",x0=pd.length+6+32,k0=200,w0=/^[A-Za-z0-9_-]+$/u,tr=class extends Ee{constructor(n){super(n),this.name="StoredCredentialError"}};function ph(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=b0();if(process.platform==="darwin")return vs.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let r=e.APPDATA,i=r!==void 0&&r!==""?r:vs.join(t,"AppData","Roaming");return vs.join(i,"cupel")}let s=e.XDG_CONFIG_HOME,o=s!==void 0&&s!==""?s:vs.join(t,".config");return vs.join(o,"cupel")}function gi(e){return vs.join(ph(e),fh)}function md(e){let n=e.trim();return n.startsWith(S0)?{ok:!1,reason:"push-token"}:n.startsWith(pd)?n.length<x0||n.length>k0?{ok:!1,reason:"malformed"}:w0.test(n.slice(pd.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function mh(e,n){let t=ph(e),s=vs.join(t,fh);f0(t,{recursive:!0,mode:448}),process.platform!=="win32"&&u0(t,448);let o=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),r=`${s}.tmp-${_0(8).toString("hex")}`;return y0(r,`${o}
+`,{flag:"wx",mode:384}),m0(r,s),s}function hh(e){let n=gi(e),t;try{t=h0(n)}catch(i){if(i instanceof Error&&i.code==="ENOENT")return;throw i}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new tr(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let s;try{s=JSON.parse(p0(n,"utf8"))}catch{throw new tr(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let o=typeof s=="object"&&s!==null&&"delivery_token"in s?s.delivery_token:void 0,r=md(typeof o=="string"?o:"");if(!r.ok)throw new tr(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return r.token}function gh(e){try{return g0(gi(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var sr="CUPEL_DELIVERY_TOKEN",hd=class extends Ee{constructor(n){super(n),this.name="NoDeliveryTokenError"}},gd=class extends Ee{constructor(n){super(n),this.name="DeliveryCredentialError"}};function v0(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function yh(e,n,t=()=>{}){let s=v0(e)??t();return s!==void 0?()=>Promise.resolve(s):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function _h(e){if(e===void 0)throw new hd(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${sr} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new gd(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var E0="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function A0(){return new Promise(e=>{let n=process.stdin;process.stderr.write(E0),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",s=r=>{n.setRawMode(!1),n.pause(),n.removeListener("data",o),process.stderr.write(`
+`),r===null&&process.exit(130),e(r)},o=r=>{for(let i of r){if(i==="")return s(null);if(i==="\r"||i===`
+`)return s(t);if(i==="\x7F"||i==="\b"){t=t.slice(0,-1);continue}t+=i}};n.on("data",o)})}async function N0(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function bh(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${re(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
+`),!0)}async function Sh(e){if(bh(e,"login"))return 1;let n=process.stdin.isTTY?await A0():await N0(),t=md(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
 `:`cupel login: that is not a delivery token. Paste the whole token as shown once on app.cupel.sh (Settings \u2192 Tokens); it starts with cpd_.
-`),1;let s=Up(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${s} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${Er} in the environment still wins, and \`cupel logout\` forgets it.
-`),0}function Yp(e){if(Vp(e,"logout"))return 1;let n=Do(process.env);return Hp(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
-`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${Bp} would point elsewhere).
-`),0}import Iv from"node:path";import{randomBytes as Jw,createHash as Zw}from"node:crypto";import{mkdirSync as Qw,readFileSync as ev,renameSync as nv,writeFileSync as tv}from"node:fs";import{homedir as sv}from"node:os";import as from"node:path";var wl="latest.json",vl="latest.json.sig";function Fo(e){return Zw("sha256").update(e).digest("hex")}function El(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=sv();if(process.platform==="darwin")return as.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,i=r!==void 0&&r!==""?r:as.join(n,"AppData","Local");return as.join(i,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,s=t!==void 0&&t!==""?t:as.join(n,".cache");return as.join(s,"cupel","shards")}function Nl(e,n,t){return as.join(e,`${n}-${t}.sqlite`)}function jo(e,n){Qw(as.dirname(e),{recursive:!0});let t=`${e}.tmp-${Jw(8).toString("hex")}`;tv(t,n,{flag:"wx"}),nv(t,e)}function Nr(e){try{return ev(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function Jp(e,n,t,s){let r=Nl(e,n,t),i=Nr(r);if(i===void 0)return;let o=Fo(i);if(o!==t)throw s(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${o})`);return{path:r,bytes:i}}var Zp="api.cupel.sh",Bo=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Qp=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Ko from"node:path";var rv="/v1/resolve",Al=1024*1024,Il=4096,em=Al+Il+64*1024,ov=8,iv=2048,av=/^[A-Za-z0-9+/]+={0,2}$/u,lv=3e4,nn=class extends Se{constructor(n){super(n),this.name="DeliveryRefusedError"}},Ar=class extends nn{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},Ir=class extends Se{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Rr=class extends Se{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function dv(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function cv(e){if(typeof e!="string"||e.length===0)throw new nn("the delivery response carried no index signature");if(e.length>Il||!av.test(e))throw new nn("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new nn("the delivery response's index signature is not canonical base64");return n}function uv(e){if(typeof e!="string"||e.length===0)throw new nn("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Al)throw new nn("the delivery response's index is larger than one can be");return n}function fv(e){if(!Array.isArray(e)||e.length===0)throw new nn("the delivery response named no shard urls");if(e.length>ov)throw new nn("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>iv)throw new nn("the delivery response carried a malformed shard url");n.push(t)}return n}function pv(e,n){throw e===401||e===403?new nn(`${n} rejected the delivery credential \u2014 check ${Er} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new Ar(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Rr(`${n} holds nothing newer than the shard index already cached`):e===429?new Ir(`${n} rate-limited the delivery request`):e>=500?new Ir(`${n} answered ${String(e)}`):new nn(`${n} refused the delivery request with status ${String(e)}`)}async function nm(e,n,t,s,r=lv){let i=On(`https://${e}${rv}`,new Set([e])),o=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await s(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},o,r)}catch{throw new Ir(`${e} could not be reached`)}if(a.status!==200&&pv(a.status,e),Buffer.byteLength(a.body,"utf8")>em)throw new nn(`${e} returned a delivery response larger than one can be`);let d;try{d=JSON.parse(a.body)}catch{throw new nn(`${e} returned a delivery response that is not JSON`)}if(!dv(d))throw new nn(`${e} returned a delivery response that is not an object`);return{index:uv(d.index),sig:cv(d.signature),shardUrls:fv(d.shardUrls)}}var tm=async(e,n,t,s)=>await Us("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,em,s);var mv=8,Ol=class extends Se{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Rl(e){return`${e.origin}${e.pathname}`}function sm(e,n,t){let s=new Map;for(let o of n)s.set(Rl(o),o);let r=[],i=[];for(let o of e.slice(0,mv)){let a;try{a=On(o,t)}catch(c){i.push(c.message);continue}if(a.hash!==""){i.push("a candidate carried a fragment");continue}let d=s.get(Rl(a));if(d===void 0){i.push("a candidate named an object the signed index does not list");continue}let l=new URL(`${Rl(d)}${a.search}`);r.push(On(l.href,t))}if(r.length===0)throw new Ol(`no pre-signed shard url matched the signed index (${i.length===0?"none offered":i.join("; ")})`);return r}var gv=1,yv=1024*1024*1024;function _v(e=Bo){return{async resolve(n){return await nm(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},tm)},async fetchShard(n,t){return On(n.href,e),await fd(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Pl(e){return e instanceof Error?e.message:String(e)}function rm(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:gv,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:yv}}function xv(e){let n=Nr(Ko.join(e.cacheDir,wl)),t=Nr(Ko.join(e.cacheDir,vl));if(!(n===void 0||t===void 0)&&yl(n,t,e.pubkeys))try{return _l(n,rm(e))}catch{return}}function om(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let s=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(s)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function zo(e,n,t){let s=Jp(n.cacheDir,e.ecosystem,e.sha256,r=>new Se(r));if(s===void 0)throw new Se(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:s.path,fromCache:!0,warnings:[...t,...om(e,n)],sequence:e.sequence}}async function bv(e,n,t,s){let r=Nl(t.cacheDir,e.ecosystem,e.sha256),i=Nr(r);if(i!==void 0&&Fo(i)===e.sha256)return{path:r,downloaded:!1};let o="no shard urls";for(let a of n){let d;try{d=await s.fetchShard(a,e.sizeBytes)}catch(c){o=Pl(c);continue}let l=Fo(d);if(l!==e.sha256){o=`sha256 mismatch (expected ${e.sha256}, got ${l})`;continue}return jo(r,d),{path:r,downloaded:!0}}throw new Se(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${o}`)}function Sv(e,n,t){if(e instanceof nn)throw e;if(e instanceof Rr){if(n===void 0)throw new Se(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return zo(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new os(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Pl(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return zo(n,t,[`could not refresh the shard index (${Pl(e)}); using the cached shard`])}async function im(e,n){if(!e.activated)throw new Se("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??_v(e.shardHosts);if(!jp(e.pubkeys))throw new Se("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let s=xv(e);if(e.offline){if(s===void 0)throw new os(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return zo(s,e,[])}let r=await Gp(e.credential),i;try{i=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:s?.sequence??0})}catch(l){return Sv(l,s,e)}if(!yl(i.index,i.sig,e.pubkeys))throw new Se("shard index signature did not verify against any pinned key");let o=_l(i.index,rm(e));if(s!==void 0&&o.sequence<s.sequence)return zo(s,e,[`refusing a rolled-back shard index (served sequence ${String(o.sequence)} < cached ${String(s.sequence)}); keeping the newer cached shard`]);let a=sm(i.shardUrls,o.urls,e.shardHosts),d=await bv(o,a,e,t);return jo(Ko.join(e.cacheDir,wl),i.index),jo(Ko.join(e.cacheDir,vl),i.sig),{path:d.path,fromCache:!d.downloaded,warnings:om(o,e),sequence:o.sequence}}var kv="https://api.cupel.sh",am=".actions.githubusercontent.com",wv=8192;function lm(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Ln=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function vv(e){let n;try{n=new URL(e).hostname}catch{throw new Ln("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=am.slice(1);if(n!==t&&!n.endsWith(am))throw new Ln(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return On(e,new Set([n]))}catch{throw new Ln(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Uo(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,s=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Ln("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(s===void 0||s==="")throw new Ln("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=vv(t);r.searchParams.set("audience",kv);let i;try{i=await n(r.href,{authorization:`Bearer ${s}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Ln("the ID-token request failed")}if(i.length>wv)throw new Ln("the ID-token response was larger than a token can be");let o;try{o=JSON.parse(i)}catch{throw new Ln("the ID-token response was not JSON")}let a=typeof o=="object"&&o!==null?o.value:void 0;if(typeof a!="string"||a.length===0)throw new Ln("the ID-token response carried no token");return a}async function dm(e,n,t={}){let s=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!s)throw new Ln("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Uo(e,n)};if(s)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await Uo(e,n)};throw new Ln("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Ev=64*1024,Nv=64*1024,qo=async(e,n,t,s)=>{if(Buffer.byteLength(t,"utf8")>Ut)throw new Error("findings payload is over the size limit");return await Us("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Nv,s)};async function Ho(e,n){let t=await Us("GET",e,n,void 0,Ev,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var Rv=720*60*60*1e3,Ov=Number(ps);function cm(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function um(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new et("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Cl(e){let n=e.ecosystem??"npm",t=await im({ecosystem:n,activated:!0,pubkeys:Qp,indexHost:Zp,shardHosts:Bo,credential:Wp(process.env,()=>Uo(process.env,Ho),()=>qp(process.env)),cacheDir:n==="npm"?El():Iv.join(El(),n),offline:e.offline,now:Date.now(),maxAgeMs:Rv,supportedDbSchemaVersion:Ov});for(let s of t.warnings)process.stderr.write(`cupel: ${s}
-`);return{path:t.path,sequence:t.sequence}}var Pv=`https://${qs}/v1/scan-failed`,Cv=400;async function Ml(e,n,t,s,r=1e4){try{let i=JSON.stringify({kind:e,detail:n.slice(0,Cv)});await s(Pv,{authorization:`Bearer ${t}`,"content-type":"application/json","content-length":String(Buffer.byteLength(i,"utf8"))},i,r)}catch{}}function Mv(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var Tv={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},fm=4,Tl=3,$l=10,pm={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},$v="(symbol set known incomplete)";function Lv(e){let n=(e.path??[]).map(t=>te(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function mm(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function Dv(e){let n=e.findings.filter(l=>l.tier==="unknown"&&l.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let l of n){let c=t.get(l.unknownKind)??[];c.push(l),t.set(l.unknownKind,c)}let s={cupel:0,project:0};for(let[l,c]of t)s[Rn[l]]+=c.length;let r=[];r.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let i=(l,c)=>{if(s[l]===0)return;r.push(""),r.push(`   ${c} (${String(s[l])}):`);let p=[...t.entries()].filter(([f])=>Rn[f]===l).sort((f,h)=>h[1].length-f[1].length||f[0].localeCompare(h[0])),u=p.slice(0,fm);for(let[f,h]of u){let g=l==="project"?[...new Set(h.flatMap(mm))]:[],y=g.slice(0,Tl).map(te).join(", "),_=g.length>Tl?` (+${String(g.length-Tl)} more files)`:"";r.push(`     ${f.padEnd(21)} ${String(h.length).padStart(4)}  ${pm[f]}`+(y!==""?`
-       ${y}${_}`:""))}for(let[f,h]of p.slice(fm))r.push(`     ${f.padEnd(21)} ${String(h.length).padStart(4)}  ${pm[f]}`)};i("project","Your code \u2014 a change on your side would produce a real verdict"),i("cupel","cupel's gap \u2014 nothing you can do today");let o=new Map;for(let l of n)if(Rn[l.unknownKind]==="project")for(let c of mm(l))o.set(c,(o.get(c)??0)+1);let a=[...o.entries()].sort((l,c)=>c[1]-l[1]||l[0].localeCompare(c[0]))[0];a!==void 0&&s.project>0&&(r.push(""),r.push(`   \u279C Start here: ${te(a[0])} appears in ${String(a[1])} of your ${String(s.project)} finding(s), across ${String(o.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let d=n.filter(l=>Rn[l.unknownKind]==="project");if(d.length>0){r.push("");for(let l of d.slice(0,$l))r.push(`     ${te(l.displayId)}  ${te(l.packageName)}@${te(l.version)}  [${l.unknownKind}] ${te(l.reason)}`);d.length>$l&&r.push(`     \u2026 and ${String(d.length-$l)} more`)}return r.push(""),r}function hm(e){let n=[],t=e.counts,s=e.findings.filter(l=>l.tier==="reachable-high"||l.tier==="reachable-medium"||l.tier==="reachable-low");if(n.push(`cupel scan: ${te(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let l=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+l.map(c=>`${te(c.entrypoint)} [${te(c.source)}]`).join(", ")+(e.entrypointSources.length>l.length?`, \u2026 and ${String(e.entrypointSources.length-l.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let l=new Map;for(let c of e.entrypointObservations)l.set(c.kind,(l.get(c.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...l.entries()].map(([c,p])=>`${String(p)} ${c}`).join(", ")+` (${te(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let l=e.rootSet,c=l.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(l.counts.rootsAdmitted)}): `+c.map(f=>`${te(f.rel===""?".":f.rel)} [${f.witnesses.join("+")}${f.ecosystem==="PyPI"?"; PyPI":f.alsoPython===!0?"; npm+PyPI":""}]`).join(", ")+(l.roots.length>c.length?`, \u2026 and ${String(l.roots.length-c.length)} more`:"")),l.observations.length>0){let f=new Map;for(let h of l.observations)f.set(h.kind,(f.get(h.kind)??0)+1);n.push("    not admitted: "+[...f.entries()].map(([h,g])=>`${String(g)} ${h}`).join(", "))}n.push(`    walk: ${String(l.counts.dirsWalked)} dirs, ${String(l.counts.manifestsSeen)} manifests seen, ${String(l.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${l.budget}`);let p=e.installed.perRoot.filter(f=>f.rootRel!=="");p.length>0&&n.push(`    enumerated (${String(p.length)} nested root${p.length===1?"":"s"}): `+p.slice(0,8).map(f=>`${te(f.rootRel)} (${String(f.packages.length)} packages, ${f.source})`).join(", ")+(p.length>8?`, \u2026 and ${String(p.length-8)} more`:""));let u=Ss(l,e.entrypointSources);u.length>0&&n.push(`    NOT analyzed (${String(u.length)}): ${te(Oa(u.map(f=>f.rel===""?".":f.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at unknown until they are analyzed`),l.budget!=="complete"&&l.budget!=="not-attempted"&&n.push(`    the walk did not finish (${l.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at unknown`),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let l of e.entrypointGaps.slice(0,5))n.push(`  - ${te(l.source)} (${te(l.file)}): ${te(l.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(te).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${Mi(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,i=r.find(l=>l.kind==="no-enumeration")??null;i!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${te(i.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let o=r.filter(l=>l!==i);if(o.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(o.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let l of o.slice(0,10))n.push(`  - [${te(l.kind)}] ${te(l.detail)}`);o.length>10&&n.push(`  \u2026 and ${String(o.length-10)} more`),n.push("")}let a=new Set(r.map(l=>l.detail)),d=[...e.analyzerDiagnostics.map(l=>`${te(l.code)}: ${te(l.detail)}`),...e.pythonDiagnostics.map(l=>`python: ${te(l)}`),...e.installed.diagnostics.filter(l=>!a.has(l)).map(te)];if(d.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(d.length)}) \u2014 verdicts are conservative:`);for(let l of d.slice(0,10))n.push(`  - ${l}`);d.length>10&&n.push(`  \u2026 and ${String(d.length-10)} more`),n.push("")}if(s.length>0){n.push(`\u{1F3AF} Reachable (${String(s.length)}) \u2014 fix these:`);for(let l of s)n.push(`  ${Tv[l.tier]} ${te(l.displayId)}  ${te(l.packageName)}@${te(l.version)}  ${te(l.symbolName??"")}`+(l.surfaceComplete===!1?`  ${$v}`:"")),n.push(`        path: ${Lv(l)}`);n.push("")}return n.push(...Dv(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${Mv(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as Fv}from"node:crypto";var jv="https://json.schemastore.org/sarif-2.1.0.json",gm="cupel-reachability",Ll=new Set(["dispatch","dynamic-load","coverage-gap"]);function Bv(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var Kv=500,zv=10;function Uv(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function qv(e,n){return`${e}::${n}`}function Hv(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Wv(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Fv("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Gv(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Ll.has(e.unknownKind)}var ym={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function _m(e){let n=[],t=new Map,s=[],r=new Nt(e.dir);for(let l of e.findings){if(!Gv(l))continue;let c=qv(l.displayId,l.packageName);if(!t.has(c)){t.set(c,n.length);let v=Hv(l.severity);n.push({id:te(c),properties:{tags:l.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${te(l.packageName)}`]:["security","reachability",`package/${te(l.packageName)}`],...v!==void 0?{"security-severity":v}:{}}})}let p=l.tier==="reachable-high"||l.tier==="reachable-medium"||l.tier==="reachable-low",u=l.path??[],f=u.findIndex(v=>v.modulePath!==""),h=f===-1?void 0:u[f],g=zs(l.ecosystem),y=l.located?.path??null,_=v=>y?.[v]?.modulePath??u[v]?.modulePath??"",b=(v,C)=>{if(C===null)return;let R=_(v);return At(r,R===""?C:{...C,path:R},g)??void 0},x=u[f+1]?.calledAt??null,k=h!==void 0&&x!==null&&x.path===h.modulePath?b(f,x):void 0,w=[...new Set(l.unresolvedSites.map(v=>v.path).filter(v=>v!==""))],I=p?h!==void 0?{physicalLocation:{artifactLocation:{uri:te(_(f))},...k!==void 0?{region:k}:{}},message:{text:`calls ${te(l.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:te(l.packageLocation??"package-lock.json")}}}:w[0]!==void 0?{physicalLocation:{artifactLocation:{uri:te(w[0])}},message:{text:`unresolved ${te(l.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:te(l.packageLocation??(l.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},N=p?u.map((v,C)=>({physicalLocation:{artifactLocation:{uri:te(_(C)||"package-lock.json")}},message:{text:te(v.functionName??"<step>")}})):w.slice(1,zv+1).map(v=>({physicalLocation:{artifactLocation:{uri:te(v)}},message:{text:"also blocked here"}}));s.push({ruleId:te(c),ruleIndex:t.get(c),level:p?"error":"warning",message:{text:te(`[${l.tier}] ${l.displayId} in ${l.packageName}@${l.version}`+(l.symbolName!==null?` \u2014 reaches ${l.symbolName}`:"")+(l.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${l.reason}`)},locations:[I],...N.length>0?{relatedLocations:N}:{},...p&&u.length>0?{codeFlows:[{threadFlows:[{locations:u.map((v,C)=>{let R=v.calledAt===null?void 0:b(C-1,v.calledAt),F=v.calledAt===null?_(C):_(C-1)||v.calledAt.path;return{location:{physicalLocation:{artifactLocation:{uri:te(F||"package-lock.json")},...R!==void 0?{region:R}:{}},message:{text:te(C===0?`entry ${v.functionName??"<step>"}`:`calls ${v.functionName??"<step>"}`)}}}})}]}]}:{},partialFingerprints:{"cupelReachability/v1":Wv(l)},properties:{tier:l.tier,advisoryId:te(l.advisoryId),...l.surfaceComplete===!1?{surfaceComplete:!1}:{},...l.modelId!==void 0?{modelId:te(l.modelId),modelPromotedFromKind:l.modelPromotedFromKind}:{},...l.unknownKind!==void 0?{unknownKind:l.unknownKind,unknownOwner:Rn[l.unknownKind],unresolvedSiteCount:l.unresolvedSites.length}:{},...l.adr105!==void 0?{adr105:l.adr105}:{},...l.influence!==void 0?{influence:{value:l.influence.value,kind:l.influence.kind,owner:Fs[l.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null}}:{}}})}let i=new Map,o=new Map;for(let l of e.findings){if(l.tier!=="unknown"||l.unknownKind===void 0||(i.set(l.unknownKind,(i.get(l.unknownKind)??0)+1),Ll.has(l.unknownKind)))continue;let c=o.get(l.unknownKind)??[];c.length<Kv&&c.push({advisory:te(l.displayId),package:te(l.packageName),version:te(l.version)}),o.set(l.unknownKind,c)}let a={cupel:0,project:0};for(let[l,c]of i)a[Rn[l]]+=c;let d={};for(let[l,c]of o){let p=i.get(l)??c.length;d[l]={count:p,owner:Rn[l],note:ym[l],truncated:p>c.length,advisories:c}}return{$schema:jv,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:gm},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:te(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(l=>`${l.entrypoint} (${l.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...i.keys()].filter(l=>!Ll.has(l)&&!Bv(l,e.analysisAborted)).sort().map(l=>({descriptor:{id:`unknown-${l}`},level:"warning",message:{text:`${String(i.get(l)??0)} finding(s) are unknown because ${ym[l]} (owner: ${Rn[l]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${l}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(l=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:te(`${l.source} (${l.file}): ${l.detail}`)}})),...e.rejectedEntries.map(l=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:te(`--entry did not resolve to a file inside the app root: ${l}`)}})),...e.entrypointObservations.map(l=>({descriptor:{id:`entrypoint-observation:${l.kind}`},level:"note",message:{text:te(`${l.detail} (${l.file})`)}})),...e.analyzerDiagnostics.map(l=>({descriptor:{id:l.code},level:"warning",message:{text:te(`${l.detail}${l.reason===void 0?"":` [reason: ${l.reason}]`} (${l.path})`)}})),...e.pythonDiagnostics.map(l=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:te(l)}})),...e.installed.diagnostics.map(l=>({descriptor:{id:"resolve"},level:"warning",message:{text:te(l)}}))]}],results:s,properties:{category:gm,summary:e.counts,...e.timings!==void 0?{timings:e.timings}:{},installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(l=>({path:te(l.rootRel),count:l.packages.length,source:l.source}))},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:Ss(e.rootSet,e.entrypointSources).length,named:Ss(e.rootSet,e.entrypointSources).slice(0,8).map(l=>te(l.rel===""?".":l.rel))},analyzed:[...mr(e.entrypointSources)].sort().slice(0,64).map(l=>te(l===""?".":l)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(l=>({path:te(l.rel),witnesses:l.witnesses,...l.manifestRefused?{manifestRefused:!0}:{},...l.ecosystem!==void 0?{ecosystem:l.ecosystem}:{},...l.alsoPython===!0?{alsoPython:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(l=>({kind:l.kind,path:te(l.rel)}))}}:{},...Uv(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...i].sort((l,c)=>c[1]-l[1])),byOwner:a,grouped:d},dbCoverageGaps:e.findings.filter(l=>l.tier==="unknown"&&l.unknownKind==="db-gap").map(l=>({advisory:te(l.displayId),package:te(l.packageName),version:te(l.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(l=>l.adr105!==void 0).map(l=>({advisory:te(l.displayId),package:te(l.packageName),version:te(l.version),symbol:te(l.symbolName??""),tier:l.tier,...l.unknownKind!==void 0?{unknownKind:l.unknownKind}:{},...l.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function xm(){try{let e=Vv(Jv(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Zv(e,n){let t=`${JSON.stringify(n,null,2)}
-`,s=`${e}.tmp-${bm(8).toString("hex")}`;Sm(s,t,{encoding:"utf8",flag:"wx"}),Xv(s,e)}async function Qv(e){let n=Tp(e),t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",s=t?{path:um(n.shard),sequence:null}:await Cl({offline:n.offline}),r=s.path,o=cm(n.shardPypi);if(o===void 0&&!t)try{o=(await Cl({offline:n.offline,ecosystem:"pypi"})).path}catch(d){if(d instanceof Ar||d instanceof os)process.stderr.write(`cupel: no PyPI shard available (${d.message}); Python distributions, if any, will be reported as not assessed
-`);else throw d}let a=hl({dir:n.dir,shardPath:r,...o!==void 0?{shardPathPypi:o}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.influenceShadowOut!==void 0?{influenceShadow:{outPath:n.influenceShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${hm(a)}
-`),a.modelLane!==void 0){let d=a.modelLane.notes.length>0?` (${a.modelLane.notes.map(l=>te(l)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(a.modelLane.active)}/${String(a.modelLane.stored)} active, ${String(a.modelLane.promoted)} promoted to reachable-low${d}
-`)}if(n.summaryShadow!==void 0&&a.summaryShadow!==void 0){let d=Yv.join(n.summaryShadow,"shadow-report.json");Sm(d,`${JSON.stringify(a.summaryShadow,null,2)}
-`),process.stdout.write(`summary-shadow: ${String(a.summaryShadow.records.length)} counterfactual record(s) -> ${d}
-`)}if(a.modelShadow!==void 0&&n.modelShadowOut!==void 0){let d=a.modelShadow.records.filter(l=>l.wouldPromote).length;process.stdout.write(`model-shadow: ${String(d)}/${String(a.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
-`)}if(a.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(a.bindingShadow.deltas)}/${String(a.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),a.influenceShadow!==void 0&&n.influenceShadowOut!==void 0){let d=a.influenceShadow.byOutcome;process.stderr.write(`influence-shadow: ${String(a.influenceShadow.ports)} port(s) \u2014 ${String(d.influenced)} influenced, ${String(d["no-source-reached"])} no-source-reached, ${String(d["reaches-entry-parameter"])} reaches-entry-parameter, ${String(d.unknown)} unknown (${String(a.influenceShadow.wallMs)} ms) -> ${n.influenceShadowOut}
-`)}if(n.sarif!==void 0&&Zv(n.sarif,_m(a)),n.push){let d=await dm(process.env,Ho,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
-`)}),l;try{l=gd(a,{scanId:bm(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:yd(a),shardSequence:s.sequence},{onCut:p=>process.stderr.write(`cupel: ${ud(p)}
-`)})}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
-`),await Ml("push-refused",u,d.value,qo),a.exitCode===0?1:a.exitCode}try{await pd(JSON.stringify(l),d.value,qo)}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
-`),await Ml("scan-error",u,d.value,qo),a.exitCode===0?1:a.exitCode}let c=s.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(l.findings.length)} finding(s) to api.cupel.sh (${lm(d)})${c}
-`)}return a.exitCode}async function eE(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Qv(e.slice(1))}catch(t){let s=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${s}
-`),1}if(e[0]==="login")return await Xp(e.slice(1));if(e[0]==="logout")return Yp(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${gl(xm())}
-`),0):(process.stderr.write(`cupel: unknown command '${te(n)}'
-`),process.stderr.write(`${gl(xm())}
-`),1)}eE().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`),1;let s=mh(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${s} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${sr} in the environment still wins, and \`cupel logout\` forgets it.
+`),0}function xh(e){if(bh(e,"logout"))return 1;let n=gi(process.env);return gh(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
+`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${uh} would point elsewhere).
+`),0}import rA from"node:path";import{randomBytes as I0,createHash as R0}from"node:crypto";import{mkdirSync as O0,readFileSync as P0,renameSync as C0,writeFileSync as M0}from"node:fs";import{homedir as T0}from"node:os";import Es from"node:path";var yd="latest.json",_d="latest.json.sig";function yi(e){return R0("sha256").update(e).digest("hex")}function bd(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=T0();if(process.platform==="darwin")return Es.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let o=process.env.LOCALAPPDATA,r=o!==void 0&&o!==""?o:Es.join(n,"AppData","Local");return Es.join(r,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,s=t!==void 0&&t!==""?t:Es.join(n,".cache");return Es.join(s,"cupel","shards")}function Sd(e,n,t){return Es.join(e,`${n}-${t}.sqlite`)}function _i(e,n){O0(Es.dirname(e),{recursive:!0});let t=`${e}.tmp-${I0(8).toString("hex")}`;M0(t,n,{flag:"wx"}),C0(t,e)}function or(e){try{return P0(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function kh(e,n,t,s){let o=Sd(e,n,t),r=or(o);if(r===void 0)return;let i=yi(r);if(i!==t)throw s(`cached shard ${o} failed sha256 re-verify (expected ${t}, got ${i})`);return{path:o,bytes:r}}var wh="api.cupel.sh",bi=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),vh=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];var $0="/v1/resolve",xd=1024*1024,kd=4096,Eh=xd+kd+64*1024,L0=8,D0=2048,F0=/^[A-Za-z0-9+/]+={0,2}$/u,j0=3e4,cn=class extends Ee{constructor(n){super(n),this.name="DeliveryRefusedError"}},As=class extends cn{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},rr=class extends Ee{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},ir=class extends Ee{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function B0(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function G0(e){if(typeof e!="string"||e.length===0)throw new cn("the delivery response carried no index signature");if(e.length>kd||!F0.test(e))throw new cn("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new cn("the delivery response's index signature is not canonical base64");return n}function K0(e){if(typeof e!="string"||e.length===0)throw new cn("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>xd)throw new cn("the delivery response's index is larger than one can be");return n}function z0(e){if(!Array.isArray(e)||e.length===0)throw new cn("the delivery response named no shard urls");if(e.length>L0)throw new cn("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>D0)throw new cn("the delivery response carried a malformed shard url");n.push(t)}return n}function U0(e,n){throw e===401||e===403?new cn(`${n} rejected the delivery credential \u2014 check ${sr} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new As(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new ir(`${n} holds nothing newer than the shard index already cached`):e===429?new rr(`${n} rate-limited the delivery request`):e>=500?new rr(`${n} answered ${String(e)}`):new cn(`${n} refused the delivery request with status ${String(e)}`)}async function Ah(e,n,t,s,o=j0){let r=Ln(`https://${e}${$0}`,new Set([e])),i=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await s(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},i,o)}catch{throw new rr(`${e} could not be reached`)}if(a.status!==200&&U0(a.status,e),Buffer.byteLength(a.body,"utf8")>Eh)throw new cn(`${e} returned a delivery response larger than one can be`);let l;try{l=JSON.parse(a.body)}catch{throw new cn(`${e} returned a delivery response that is not JSON`)}if(!B0(l))throw new cn(`${e} returned a delivery response that is not an object`);return{index:K0(l.index),sig:G0(l.signature),shardUrls:z0(l.shardUrls)}}var Nh=async(e,n,t,s)=>await ho("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Eh,s);import Si from"node:path";var W0=8,vd=class extends Ee{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function wd(e){return`${e.origin}${e.pathname}`}function Ih(e,n,t){let s=new Map;for(let i of n)s.set(wd(i),i);let o=[],r=[];for(let i of e.slice(0,W0)){let a;try{a=Ln(i,t)}catch(c){r.push(c.message);continue}if(a.hash!==""){r.push("a candidate carried a fragment");continue}let l=s.get(wd(a));if(l===void 0){r.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${wd(l)}${a.search}`);o.push(Ln(d.href,t))}if(o.length===0)throw new vd(`no pre-signed shard url matched the signed index (${r.length===0?"none offered":r.join("; ")})`);return o}var q0=1,V0=1024*1024*1024;function X0(e=bi){return{async resolve(n){return await Ah(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Nh)},async fetchShard(n,t){return Ln(n.href,e),await lc(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Ed(e){return e instanceof Error?e.message:String(e)}function Rh(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:q0,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:V0}}function Y0(e){let n=or(Si.join(e.cacheDir,yd)),t=or(Si.join(e.cacheDir,_d));if(!(n===void 0||t===void 0)&&ud(n,t,e.pubkeys))try{return fd(n,Rh(e))}catch{return}}function Oh(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let s=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(s)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function xi(e,n,t){let s=kh(n.cacheDir,e.ecosystem,e.sha256,o=>new Ee(o));if(s===void 0)throw new Ee(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:s.path,fromCache:!0,warnings:[...t,...Oh(e,n)],sequence:e.sequence}}async function J0(e,n,t,s){let o=Sd(t.cacheDir,e.ecosystem,e.sha256),r=or(o);if(r!==void 0&&yi(r)===e.sha256)return{path:o,downloaded:!1};let i="no shard urls";for(let a of n){let l;try{l=await s.fetchShard(a,e.sizeBytes)}catch(c){i=Ed(c);continue}let d=yi(l);if(d!==e.sha256){i=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return _i(o,l),{path:o,downloaded:!0}}throw new Ee(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${i}`)}function Z0(e,n,t){if(e instanceof cn)throw e;if(e instanceof ir){if(n===void 0)throw new Ee(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return xi(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new Gt(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Ed(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return xi(n,t,[`could not refresh the shard index (${Ed(e)}); using the cached shard`])}async function Ph(e,n){if(!e.activated)throw new Ee("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??X0(e.shardHosts);if(!ch(e.pubkeys))throw new Ee("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let s=Y0(e);if(e.offline){if(s===void 0)throw new Gt(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return xi(s,e,[])}let o=await _h(e.credential),r;try{r=await t.resolve({host:e.indexHost,token:o,ecosystem:e.ecosystem,sequenceFloor:s?.sequence??0})}catch(d){return Z0(d,s,e)}if(!ud(r.index,r.sig,e.pubkeys))throw new Ee("shard index signature did not verify against any pinned key");let i=fd(r.index,Rh(e));if(s!==void 0&&i.sequence<s.sequence)return xi(s,e,[`refusing a rolled-back shard index (served sequence ${String(i.sequence)} < cached ${String(s.sequence)}); keeping the newer cached shard`]);let a=Ih(r.shardUrls,i.urls,e.shardHosts),l=await J0(i,a,e,t);return _i(Si.join(e.cacheDir,yd),r.index),_i(Si.join(e.cacheDir,_d),r.sig),{path:l.path,fromCache:!l.downloaded,warnings:Oh(i,e),sequence:i.sequence}}var Q0="https://api.cupel.sh",Ch=".actions.githubusercontent.com",eA=8192;function Mh(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Gn=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function nA(e){let n;try{n=new URL(e).hostname}catch{throw new Gn("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=Ch.slice(1);if(n!==t&&!n.endsWith(Ch))throw new Gn(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Ln(e,new Set([n]))}catch{throw new Gn(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function ki(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,s=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Gn("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(s===void 0||s==="")throw new Gn("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let o=nA(t);o.searchParams.set("audience",Q0);let r;try{r=await n(o.href,{authorization:`Bearer ${s}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Gn("the ID-token request failed")}if(r.length>eA)throw new Gn("the ID-token response was larger than a token can be");let i;try{i=JSON.parse(r)}catch{throw new Gn("the ID-token response was not JSON")}let a=typeof i=="object"&&i!==null?i.value:void 0;if(typeof a!="string"||a.length===0)throw new Gn("the ID-token response carried no token");return a}async function Th(e,n,t={}){let s=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",o=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!s)throw new Gn("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await ki(e,n)};if(s)return o&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(o)return{kind:"oidc",value:await ki(e,n)};throw new Gn("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var tA=64*1024,sA=64*1024,wi=async(e,n,t,s)=>{if(Buffer.byteLength(t,"utf8")>us)throw new Error("findings payload is over the size limit");return await ho("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,sA,s)};async function vi(e,n){let t=await ho("GET",e,n,void 0,tA,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var iA=720*60*60*1e3,aA=Number(ht);function $h(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function lA(e){let n=process.env.CUPEL_SHARD_GO;return e??(n!==void 0&&n!==""?n:void 0)}function dA(e,n){return Go(e,{discoverGoRoots:!0,...n.length>0?{operatorRoots:n}:{}}).roots.some(Bo)}async function Lh(e,n={}){if(!e.xGo)return;let t=lA(e.shardGo);if(t!==void 0||e.explicitNpm)return t;if((n.holdsGoRoot??dA)(e.dir,e.root))try{return(await(n.zeroConfig??Ei)({offline:e.offline,ecosystem:"go"})).path}catch(s){if(s instanceof As||s instanceof Gt){(n.warn??(o=>process.stderr.write(o)))(`cupel: no Go shard available (${s.message}); Go modules will be reported as not assessed
+`);return}throw s}}function Dh(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new dt("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Ei(e){let n=e.ecosystem??"npm",t=await Ph({ecosystem:n,activated:!0,pubkeys:vh,indexHost:wh,shardHosts:bi,credential:yh(process.env,()=>ki(process.env,vi),()=>hh(process.env)),cacheDir:n==="npm"?bd():rA.join(bd(),n),offline:e.offline,now:Date.now(),maxAgeMs:iA,supportedDbSchemaVersion:aA});for(let s of t.warnings)process.stderr.write(`cupel: ${s}
+`);return{path:t.path,sequence:t.sequence}}var cA=`https://${go}/v1/scan-failed`,uA=400;async function Ad(e,n,t,s,o=1e4){try{let r=JSON.stringify({kind:e,detail:n.slice(0,uA)});await s(cA,{authorization:`Bearer ${t}`,"content-type":"application/json","content-length":String(Buffer.byteLength(r,"utf8"))},r,o)}catch{}}var fA={"reachable-high":"reachable","reachable-medium":"reachable","reachable-low":"reachable","potentially-reachable-not-ruled-out":"potentially-reachable","potentially-reachable-not-analysed":"potentially-reachable","not-reachable":"not-reachable","not-affected":"not-affected"};function Bh(e){let n=e.map(t=>fA[t.tier]);return n.includes("reachable")?"reachable":n.includes("potentially-reachable")?"potentially-reachable":n.length>0&&n.every(t=>t==="not-reachable")?"not-reachable":"not-affected"}function pA(e){return e.some(n=>n.tier==="potentially-reachable-not-ruled-out")?"potentially-reachable-not-ruled-out":"potentially-reachable-not-analysed"}function Fh(e,n){let t=new Map;for(let s of e){let o=n(s),r=t.get(o);r===void 0?t.set(o,[s]):r.push(s)}return[...t.values()]}function jh(e){let n={"potentially-reachable-not-ruled-out":0,"potentially-reachable-not-analysed":0},t=0,s=0,o=0,r=0,i=!1;for(let a of e){let l=Bh(a);l==="reachable"?t+=1:l==="potentially-reachable"?(s+=1,n[pA(a)]+=1):l==="not-reachable"?(o+=1,a.some(d=>d.basis==="loader-assumption")&&(i=!0)):r+=1}return{total:e.length,reachable:t,potentiallyReachable:s,byTier:n,notReachable:o,notAffected:r,notReachableAssumed:i}}function Gh(e){let n=(o,r)=>JSON.stringify([o.ecosystem,o.packageName,o.version,r]),t=Fh(e,o=>n(o,o.advisoryId)),s=0;for(let o of t)Bh(o)==="reachable"&&(s+=o.filter(r=>He(r.tier)).length);return{advisories:jh(t),vulnerabilities:jh(Fh(e,o=>n(o,o.displayId))),middleRowsInReachable:s}}function mA(e){if(e.counts["not-reachable"]===0)return"";let n=e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption");return Hh(n)}var Hh=e=>e?" (assumed: no dependency loader loads them)":" (nothing assumed)",Rd=e=>e===1?"advisory":"advisories",hA=e=>e===1?"finding":"findings",gA=mo.filter(e=>mt[e]==="potentially-reachable-not-ruled-out").join(", ");function Kh(e,n){return`${e} \u2014 ${String(n.reachable)} reachable, ${String(n.potentiallyReachable)} potentially reachable (${String(n.byTier["potentially-reachable-not-ruled-out"])} path not ruled out, ${String(n.byTier["potentially-reachable-not-analysed"])} not analysed), ${String(n.notReachable)} not-reachable${n.notReachable===0?"":Hh(n.notReachableAssumed)}, ${String(n.notAffected)} not-affected.`}function yA(e){let n=e.ecosystem==="PyPI"?"; PyPI":e.alsoPython===!0?"; npm+PyPI":"";return e.ecosystem==="Go"?"; Go":e.alsoGo!==!0?n:n===""?"; npm+Go":`${n}+Go`}var _A={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},zh=4,Nd=3,Id=10,bA={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version or advisory bound is not SemVer 2.0.0 / PEP 440 \u2014 cupel cannot order them","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},SA={"resolution-divergence":"a go.mod replace builds other code than the module@version the advisory names","version-undecidable":"the Go release that builds the program is not the one on PATH, or is not a release","analysis-cap":"another build configuration, a plugin, or an unread part of the build keeps the Go denial open","symbol-unsupported":"the package is imported; the Go scan reads packages, not calls, before S2"};function Uh(e,n){let t=SA[e];return t!==void 0&&n.length>0&&n.every(s=>s.ecosystem==="Go")?t:bA[e]}var xA="(symbol set known incomplete)";function kA(e){let n=(e.path??[]).map(t=>re(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Wh(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function wA(e,n){let t=e.findings.filter(f=>He(f.tier)&&f.reasonKind!==void 0);if(t.length===0)return[];let s=new Map;for(let f of t){let m=s.get(f.reasonKind)??[];m.push(f),s.set(f.reasonKind,m)}let o={cupel:0,project:0};for(let[f,m]of s)o[$n[f]]+=m.length;let r=[],i=n.advisories.potentiallyReachable;r.push(i>0?`\u2753 Potentially reachable (${String(i)}) \u2014 cupel could NOT rule out a path for ${String(i)} ${Rd(i)}. This is not a clean result.`:"\u2753 Potentially reachable (0) \u2014 every undecided finding sits in an advisory counted reachable above.");let a=n.advisories.byTier;r.push(`   Path not ruled out (${String(a["potentially-reachable-not-ruled-out"])}) \u2014 cupel analysed it and a path could not be ruled out (${gA}).`),r.push(`   Not analysed (${String(a["potentially-reachable-not-analysed"])}) \u2014 the function-level question could not be run (every other kind).`);let l=n.middleRowsInReachable;r.push(`   By kind, in findings (${String(t.length)}`+(l>0?`; ${String(l)} of them in advisories counted reachable above`:"")+"):");let d=(f,m)=>{if(o[f]===0)return;r.push(""),r.push(`   ${m} (${String(o[f])}):`);let h=[...s.entries()].filter(([_])=>$n[_]===f).sort((_,S)=>S[1].length-_[1].length||_[0].localeCompare(S[0])),y=h.slice(0,zh);for(let[_,S]of y){let b=f==="project"?[...new Set(S.flatMap(Wh))]:[],k=b.slice(0,Nd).map(re).join(", "),w=b.length>Nd?` (+${String(b.length-Nd)} more files)`:"";r.push(`     ${_.padEnd(21)} ${String(S.length).padStart(4)}  ${Uh(_,S)}`+(k!==""?`
+       ${k}${w}`:""))}for(let[_,S]of h.slice(zh))r.push(`     ${_.padEnd(21)} ${String(S.length).padStart(4)}  ${Uh(_,S)}`)};d("project","Your code \u2014 a change on your side would produce a real verdict"),d("cupel","cupel's gap \u2014 nothing you can do today");let c=new Map;for(let f of t)if($n[f.reasonKind]==="project")for(let m of Wh(f))c.set(m,(c.get(m)??0)+1);let p=[...c.entries()].sort((f,m)=>m[1]-f[1]||f[0].localeCompare(m[0]))[0];p!==void 0&&o.project>0&&(r.push(""),r.push(`   \u279C Start here: ${re(p[0])} appears in ${String(p[1])} of your ${String(o.project)} finding(s), across ${String(c.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let u=t.filter(f=>$n[f.reasonKind]==="project");if(u.length>0){r.push("");for(let f of u.slice(0,Id))r.push(`     ${re(f.displayId)}  ${re(f.packageName)}@${re(f.version)}  [${f.reasonKind}] ${re(f.reason)}`);u.length>Id&&r.push(`     \u2026 and ${String(u.length-Id)} more`)}return r.push(""),r}function vA(e){let n=e.go;if(n===void 0)return[];let t=[];t.push(`\u2139\uFE0F  Go, package level (${String(n.roots.length)} root${n.roots.length===1?"":"s"}): ${re(n.toolchain??"no usable Go toolchain")}`);for(let s of n.facts)t.push(`    ${re(s)}`);for(let s of n.roots.slice(0,8)){let o=s.rootRel===""?".":s.rootRel;t.push(`    ${re(o)}: ${s.status}`+(s.mode===null?"":`, -mod=${s.mode}`)+(s.workspace===null?"":`, workspace ${re(s.workspace)}`)+`, ${String(s.packages)} package(s) in the graph, ${String(s.modules)} module(s)`+(s.otherConfiguration>0?`, ${String(s.otherConfiguration)} package(s) only another build configuration imports`:""));for(let r of s.facts.slice(0,5))t.push(`      - ${re(r)}`)}return n.roots.length>8&&t.push(`    \u2026 and ${String(n.roots.length-8)} more`),n.blockers.length>0&&t.push(`    no Go not-reachable stands in this scan: ${re(n.blockers.join("; "))}`),t.push(""),t}function qh(e){let n=[],t=e.counts,s=e.findings.filter(u=>u.tier==="reachable-high"||u.tier==="reachable-medium"||u.tier==="reachable-low");if(n.push(`cupel scan: ${re(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let u=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+u.map(f=>`${re(f.entrypoint)} [${re(f.source)}]`).join(", ")+(e.entrypointSources.length>u.length?`, \u2026 and ${String(e.entrypointSources.length-u.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let u=new Map;for(let f of e.entrypointObservations)u.set(f.kind,(u.get(f.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...u.entries()].map(([f,m])=>`${String(m)} ${f}`).join(", ")+` (${re(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let u=e.rootSet,f=u.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(u.counts.rootsAdmitted)}): `+f.map(y=>`${re(y.rel===""?".":y.rel)} [${y.witnesses.join("+")}${yA(y)}]`).join(", ")+(u.roots.length>f.length?`, \u2026 and ${String(u.roots.length-f.length)} more`:"")),u.observations.length>0){let y=new Map;for(let _ of u.observations)y.set(_.kind,(y.get(_.kind)??0)+1);n.push("    not admitted: "+[...y.entries()].map(([_,S])=>`${String(S)} ${_}`).join(", "))}n.push(`    walk: ${String(u.counts.dirsWalked)} dirs, ${String(u.counts.manifestsSeen)} manifests seen, ${String(u.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${u.budget}`);let m=e.installed.perRoot.filter(y=>y.rootRel!=="");m.length>0&&n.push(`    enumerated (${String(m.length)} nested root${m.length===1?"":"s"}): `+m.slice(0,8).map(y=>`${re(y.rootRel)} (${String(y.packages.length)} packages, ${y.source})`).join(", ")+(m.length>8?`, \u2026 and ${String(m.length-8)} more`:""));let h=zs(u,e.entrypointSources);h.length>0&&n.push(`    NOT analyzed (${String(h.length)}): ${re(_l(h.map(y=>y.rel===""?".":y.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at potentially reachable until they are analyzed`),u.budget!=="complete"&&u.budget!=="not-attempted"&&n.push(`    the walk did not finish (${u.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at potentially reachable`),n.push("")}if(n.push(...vA(e)),e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let u of e.entrypointGaps.slice(0,5))n.push(`  - ${re(u.source)} (${re(u.file)}): ${re(u.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(re).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at potentially reachable, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${xa(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at potentially reachable, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let o=e.installed.gaps,r=o.find(u=>u.kind==="no-enumeration")??null;r!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${re(r.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let i=o.filter(u=>u!==r);if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let u of i.slice(0,10))n.push(`  - [${re(u.kind)}] ${re(u.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let a=new Set(o.map(u=>u.detail)),l=[...e.analyzerDiagnostics.map(u=>`${re(u.code)}: ${re(u.detail)}`),...e.pythonDiagnostics.map(u=>`python: ${re(u)}`),...e.installed.diagnostics.filter(u=>!a.has(u)).map(re)];if(l.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(l.length)}) \u2014 verdicts are conservative:`);for(let u of l.slice(0,10))n.push(`  - ${u}`);l.length>10&&n.push(`  \u2026 and ${String(l.length-10)} more`),n.push("")}let d=Gh(e.findings);if(s.length>0){let u=d.advisories.reachable;n.push(`\u{1F3AF} Reachable (${String(u)}) \u2014 fix these: ${String(u)} ${Rd(u)}, ${String(s.length)} ${hA(s.length)}, each with its call path.`);for(let f of s)n.push(`  ${_A[f.tier]} ${re(f.displayId)}  ${re(f.packageName)}@${re(f.version)}  ${re(f.symbolName??"")}`+(f.surfaceComplete===!1?`  ${xA}`:"")),n.push(`        path: ${kA(f)}`);n.push("")}n.push(...wA(e,d));let c=d.advisories,p=d.vulnerabilities;return n.push(`Summary: ${Kh(`${String(c.total)} ${Rd(c.total)}`,c)}`),n.push(`         ${Kh(`${String(p.total)} ${p.total===1?"vulnerability":"vulnerabilities"} (deduplicated by CVE)`,p)}`),n.push(`Findings: ${String(e.findings.length)} \u2014 ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t["potentially-reachable-not-ruled-out"]+t["potentially-reachable-not-analysed"])} potentially reachable (${String(t["potentially-reachable-not-ruled-out"])} path not ruled out, ${String(t["potentially-reachable-not-analysed"])} not analysed), ${String(t["not-reachable"])} not-reachable${mA(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as EA}from"node:crypto";var AA="https://json.schemastore.org/sarif-2.1.0.json",Vh="cupel-reachability",Od=new Set(["dispatch","dynamic-load","coverage-gap"]);function NA(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var IA=500,RA=10;function OA(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function PA(e,n){return`${e}::${n}`}function CA(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function MA(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return EA("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function TA(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:!He(e.tier)||e.reasonKind===void 0?!1:Od.has(e.reasonKind)}var Xh={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range: one of them is not a valid version for its ecosystem (npm: SemVer 2.0.0; PyPI: PEP 440)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function Yh(e){let n=[],t=new Map,s=[],o=new Ut(e.dir);for(let d of e.findings){if(!TA(d))continue;let c=PA(d.displayId,d.packageName);if(!t.has(c)){t.set(c,n.length);let v=CA(d.severity);n.push({id:re(c),properties:{tags:d.reasonKind==="coverage-gap"?["security","coverage-gap",`gap/${re(d.packageName)}`]:["security","reachability",`package/${re(d.packageName)}`],...v!==void 0?{"security-severity":v}:{}}})}let p=d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low",u=d.path??[],f=u.findIndex(v=>v.modulePath!==""),m=f===-1?void 0:u[f],h=Ms(d.ecosystem),y=d.located?.path??null,_=v=>y?.[v]?.modulePath??u[v]?.modulePath??"",S=(v,I)=>{if(I===null)return;let A=_(v);return Wt(o,A===""?I:{...I,path:A},h)??void 0},b=u[f+1]?.calledAt??null,k=m!==void 0&&b!==null&&b.path===m.modulePath?S(f,b):void 0,w=[...new Set(d.unresolvedSites.map(v=>v.path).filter(v=>v!==""))],N=p?m!==void 0?{physicalLocation:{artifactLocation:{uri:re(_(f))},...k!==void 0?{region:k}:{}},message:{text:`calls ${re(d.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:re(d.packageLocation??"package-lock.json")}}}:w[0]!==void 0?{physicalLocation:{artifactLocation:{uri:re(w[0])}},message:{text:`unresolved ${re(d.reasonKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:re(d.packageLocation??(d.reasonKind==="coverage-gap"?"package.json":"package-lock.json"))}}},R=p?u.map((v,I)=>({physicalLocation:{artifactLocation:{uri:re(_(I)||"package-lock.json")}},message:{text:re(v.functionName??"<step>")}})):w.slice(1,RA+1).map(v=>({physicalLocation:{artifactLocation:{uri:re(v)}},message:{text:"also blocked here"}}));s.push({ruleId:re(c),ruleIndex:t.get(c),level:p?"error":"warning",message:{text:re(`[${d.tier}] ${d.displayId} in ${d.packageName}@${d.version}`+(d.symbolName!==null?` \u2014 reaches ${d.symbolName}`:"")+(d.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${d.reason}`)},locations:[N],...R.length>0?{relatedLocations:R}:{},...p&&u.length>0?{codeFlows:[{threadFlows:[{locations:u.map((v,I)=>{let A=v.calledAt===null?void 0:S(I-1,v.calledAt),B=v.calledAt===null?_(I):_(I-1)||v.calledAt.path;return{location:{physicalLocation:{artifactLocation:{uri:re(B||"package-lock.json")},...A!==void 0?{region:A}:{}},message:{text:re(I===0?`entry ${v.functionName??"<step>"}`:`calls ${v.functionName??"<step>"}`)}}}})}]}]}:{},partialFingerprints:{"cupelReachability/v1":MA(d)},properties:{tier:d.tier,advisoryId:re(d.advisoryId),...d.surfaceComplete===!1?{surfaceComplete:!1}:{},...d.modelId!==void 0?{modelId:re(d.modelId),modelPromotedFromKind:d.modelPromotedFromKind}:{},...d.reasonKind!==void 0?{reasonKind:d.reasonKind,reasonOwner:$n[d.reasonKind],unresolvedSiteCount:d.unresolvedSites.length}:{},...d.adr105!==void 0?{adr105:d.adr105}:{},...d.influence!==void 0?{influence:{value:d.influence.value,kind:d.influence.kind,owner:co[d.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null}}:{}}})}let r=new Map,i=new Map;for(let d of e.findings){if(!He(d.tier)||d.reasonKind===void 0||(r.set(d.reasonKind,(r.get(d.reasonKind)??0)+1),Od.has(d.reasonKind)))continue;let c=i.get(d.reasonKind)??[];c.length<IA&&c.push({advisory:re(d.displayId),package:re(d.packageName),version:re(d.version)}),i.set(d.reasonKind,c)}let a={cupel:0,project:0};for(let[d,c]of r)a[$n[d]]+=c;let l={};for(let[d,c]of i){let p=r.get(d)??c.length;l[d]={count:p,owner:$n[d],note:Xh[d],truncated:p>c.length,advisories:c}}return{$schema:AA,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Vh},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:re(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(d=>`${d.entrypoint} (${d.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...r.keys()].filter(d=>!Od.has(d)&&!NA(d,e.analysisAborted)).sort().map(d=>({descriptor:{id:`potentially-reachable-${d}`},level:"warning",message:{text:`${String(r.get(d)??0)} finding(s) are Potentially reachable because ${Xh[d]} (owner: ${$n[d]}). These are counted in counts["${mt[d]}"] and itemised in run.properties.potentiallyReachable.grouped["${d}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(d=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:re(`${d.source} (${d.file}): ${d.detail}`)}})),...e.rejectedEntries.map(d=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:re(`--entry did not resolve to a file inside the app root: ${d}`)}})),...e.entrypointObservations.map(d=>({descriptor:{id:`entrypoint-observation:${d.kind}`},level:"note",message:{text:re(`${d.detail} (${d.file})`)}})),...e.analyzerDiagnostics.map(d=>({descriptor:{id:d.code},level:"warning",message:{text:re(`${d.detail}${d.reason===void 0?"":` [reason: ${d.reason}]`} (${d.path})`)}})),...e.pythonDiagnostics.map(d=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:re(d)}})),...(e.go?.facts??[]).map(d=>({descriptor:{id:"go-build-context"},level:"note",message:{text:re(d)}})),...(e.go?.blockers??[]).map(d=>({descriptor:{id:"go-denial-withheld"},level:"warning",message:{text:re(`no Go not-reachable stands in this scan: ${d}`)}})),...e.installed.diagnostics.map(d=>({descriptor:{id:"resolve"},level:"warning",message:{text:re(d)}}))]}],results:s,properties:{category:Vh,summary:e.counts,...e.timings!==void 0?{timings:e.timings}:{},installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(d=>({path:re(d.rootRel),count:d.packages.length,source:d.source}))},...e.go!==void 0?{go:{toolchain:e.go.toolchain===null?null:re(e.go.toolchain),deniesWithheld:e.go.blockers.map(re),roots:e.go.roots.slice(0,64).map(d=>({path:re(d.rootRel),status:d.status,mode:d.mode,workspace:d.workspace===null?null:re(d.workspace),packages:d.packages,otherConfiguration:d.otherConfiguration,modules:d.modules}))}}:{},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:zs(e.rootSet,e.entrypointSources).length,named:zs(e.rootSet,e.entrypointSources).slice(0,8).map(d=>re(d.rel===""?".":d.rel))},analyzed:[...Uo(e.entrypointSources)].sort().slice(0,64).map(d=>re(d===""?".":d)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(d=>({path:re(d.rel),witnesses:d.witnesses,...d.manifestRefused?{manifestRefused:!0}:{},...d.ecosystem!==void 0?{ecosystem:d.ecosystem}:{},...d.alsoPython===!0?{alsoPython:!0}:{},...d.alsoGo===!0?{alsoGo:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(d=>({kind:d.kind,path:re(d.rel)}))}}:{},...OA(e),potentiallyReachable:{total:zt(e.counts),byTier:Object.fromEntries(cs.map(d=>[d,e.counts[d]])),byKind:Object.fromEntries([...r].sort((d,c)=>c[1]-d[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(d=>He(d.tier)&&d.reasonKind==="db-gap").map(d=>({advisory:re(d.displayId),package:re(d.packageName),version:re(d.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(d=>d.adr105!==void 0).map(d=>({advisory:re(d.displayId),package:re(d.packageName),version:re(d.version),symbol:re(d.symbolName??""),tier:d.tier,...d.reasonKind!==void 0?{reasonKind:d.reasonKind}:{},...d.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function Jh(){try{let e=$A(FA(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function jA(e,n){let t=`${JSON.stringify(n,null,2)}
+`,s=`${e}.tmp-${Zh(8).toString("hex")}`;Qh(s,t,{encoding:"utf8",flag:"wx"}),LA(s,e)}async function BA(e){let n=rh(e);n.legacyGateFlag&&process.stderr.write(`cupel: ${oh}
+`);let t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",s=t?{path:Dh(n.shard),sequence:null}:await Ei({offline:n.offline}),o=s.path,i=$h(n.shardPypi);if(i===void 0&&!t)try{i=(await Ei({offline:n.offline,ecosystem:"pypi"})).path}catch(d){if(d instanceof As||d instanceof Gt)process.stderr.write(`cupel: no PyPI shard available (${d.message}); Python distributions, if any, will be reported as not assessed
+`);else throw d}let a=await Lh({xGo:n.xGo,shardGo:n.shardGo,dir:n.dir,root:n.root,offline:n.offline,explicitNpm:t}),l=dd({dir:n.dir,shardPath:o,...i!==void 0?{shardPathPypi:i}:{},...n.xGo?{xGo:!0}:{},...a!==void 0?{shardPathGo:a}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnPotentiallyReachable:n.failOnPotentiallyReachable,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.influenceShadowOut!==void 0?{influenceShadow:{outPath:n.influenceShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},pyPreciseNames:n.pyPreciseNames,tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${qh(l)}
+`),l.modelLane!==void 0){let d=l.modelLane.notes.length>0?` (${l.modelLane.notes.map(c=>re(c)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(l.modelLane.active)}/${String(l.modelLane.stored)} active, ${String(l.modelLane.promoted)} promoted to reachable-low${d}
+`)}if(n.summaryShadow!==void 0&&l.summaryShadow!==void 0){let d=DA.join(n.summaryShadow,"shadow-report.json");Qh(d,`${JSON.stringify(l.summaryShadow,null,2)}
+`),process.stdout.write(`summary-shadow: ${String(l.summaryShadow.records.length)} counterfactual record(s) -> ${d}
+`)}if(l.modelShadow!==void 0&&n.modelShadowOut!==void 0){let d=l.modelShadow.records.filter(c=>c.wouldPromote).length;process.stdout.write(`model-shadow: ${String(d)}/${String(l.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
+`)}if(l.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(l.bindingShadow.deltas)}/${String(l.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
+`),l.influenceShadow!==void 0&&n.influenceShadowOut!==void 0){let d=l.influenceShadow.byOutcome;process.stderr.write(`influence-shadow: ${String(l.influenceShadow.ports)} port(s) \u2014 ${String(d.influenced)} influenced, ${String(d["no-source-reached"])} no-source-reached, ${String(d["reaches-entry-parameter"])} reaches-entry-parameter, ${String(d.unknown)} unknown (${String(l.influenceShadow.wallMs)} ms) -> ${n.influenceShadowOut}
+`)}if(n.sarif!==void 0&&jA(n.sarif,Yh(l)),n.push){let d=await Th(process.env,vi,{...n.auth!==void 0?{auth:n.auth}:{},warn:u=>process.stderr.write(`cupel: ${u}
+`)}),c;try{c=fc(l,{scanId:Zh(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:pc(l),shardSequence:s.sequence},{onCut:u=>process.stderr.write(`cupel: ${ac(u)}
+`)})}catch(u){let f=u instanceof Error?u.message:String(u);return process.stderr.write(`cupel: ${f}
+`),await Ad("push-refused",f,d.value,wi),l.exitCode===0?1:l.exitCode}try{await dc(JSON.stringify(c),d.value,wi)}catch(u){let f=u instanceof Error?u.message:String(u);return process.stderr.write(`cupel: ${f}
+`),await Ad("scan-error",f,d.value,wi),l.exitCode===0?1:l.exitCode}let p=s.sequence===null?" \u2014 shard version unverified, shown as unverifiable on the dashboard":"";process.stdout.write(`pushed ${String(c.findings.length)} finding(s) to api.cupel.sh (${Mh(d)})${p}
+`)}return l.exitCode}async function GA(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await BA(e.slice(1))}catch(t){let s=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${s}
+`),1}if(e[0]==="login")return await Sh(e.slice(1));if(e[0]==="logout")return xh(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${cd(Jh())}
+`),0):(process.stderr.write(`cupel: unknown command '${re(n)}'
+`),process.stderr.write(`${cd(Jh())}
+`),1)}GA().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});