@cupel-sh/cli 0.10.0 → 0.12.0

package/bundle/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-var ee={"extract.py":`None
+var se={"extract.py":`None
 
 import ast
 import builtins
@@ -116,6 +116,7 @@ REFLECTIVE_ATTRS = frozenset(
 )
 
 NAMESPACE_WRITERS = frozenset({"update", "setdefault", "__setitem__", "__delitem__", "pop"})
+NAMESPACE_READERS = frozenset({"get", "items", "keys", "values", "copy", "__contains__", "__getitem__", "__iter__", "__len__"})
 
 _HINTS = {"proxies": frozenset(), "calls": frozenset(), "roots": frozenset()}
 MAX_HINTS = 256
@@ -220,6 +221,8 @@ class Scopes(ast.NodeVisitor):
         self.class_binds = {}
         self._vars_of_other = set()
         self.dynamic = False
+        self.rebinds = False
+        self._namespace_reads = set()
         self.star = False
         self._counts = {}
         self._last_star = 0
@@ -300,12 +303,14 @@ class Scopes(ast.NodeVisitor):
         self.class_binds[id(node)] = others if len(others) <= MAX_PER_KIND else None
 
     def _comprehension(self, node, results):
+        self._read(node.generators[0].iter)
         self.visit(node.generators[0].iter)
         own = self._open("comprehension")
         prev, self._cur = self._cur, own
         for i, g in enumerate(node.generators):
             self.visit(g.target)
             if i > 0:
+                self._read(g.iter)
                 self.visit(g.iter)
             for c in g.ifs:
                 self.visit(c)
@@ -350,6 +355,8 @@ class Scopes(ast.NodeVisitor):
             and id(node) not in self._vars_of_other
         ):
             self.dynamic = True
+            if id(node) not in self._namespace_reads:
+                self.rebinds = True
 
     def visit_Global(self, node):
         self._cur.globals.update(node.names)
@@ -407,12 +414,44 @@ class Scopes(ast.NodeVisitor):
             and not isinstance(node.args[0], ast.Starred)
         )
 
+
+    def _own_namespace(self, node):
+        None
+        return (
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Name)
+            and not node.args
+            and not node.keywords
+            and (node.func.id == "globals" or (node.func.id in ("locals", "vars") and self._cur.kind in ("module", "class")))
+        )
+
+    def _read(self, node):
+        None
+        if self._own_namespace(node):
+            self._namespace_reads.add(id(node.func))
+
+    def visit_Compare(self, node):
+        for op, right in zip(node.ops, node.comparators):
+            if isinstance(op, (ast.In, ast.NotIn)):
+                self._read(right)
+        self.generic_visit(node)
+
+    def visit_For(self, node):
+        self._read(node.iter)
+        self.generic_visit(node)
+
+    visit_AsyncFor = visit_For
+
     def visit_Attribute(self, node):
         if isinstance(node.ctx, (ast.Store, ast.Del)):
             self.attr_writes.add(node.attr)
+        elif node.attr in NAMESPACE_READERS:
+            self._read(node.value)
         self.generic_visit(node)
 
     def visit_Subscript(self, node):
+        if isinstance(node.ctx, ast.Load):
+            self._read(node.value)
         if isinstance(node.ctx, (ast.Store, ast.Del)) and self._namespace(node.value):
             key = node.slice
             if type(key).__name__ == "Index":
@@ -562,8 +601,15 @@ class Scopes(ast.NodeVisitor):
 
     def module_bindings(self):
         None
+        return None if self.dynamic else self._bindings_table()
+
+    def static_bindings(self):
+        None
+        return self._bindings_table() if self.dynamic and not self.rebinds else None
+
+    def _bindings_table(self):
         found = self._counts.get(id(self.module), {})
-        if self.dynamic or len(found) > MAX_PER_KIND:
+        if len(found) > MAX_PER_KIND:
             return None
         kind = lambda entry: "other" if entry[2] == "except" else entry[2]
         return {n: (kind(entry) if self.times(self.module, n) == 1 else "multi") for n, entry in sorted(found.items())}
@@ -669,6 +715,23 @@ class Scopes(ast.NodeVisitor):
             return None, None
         return dict(sorted(origins.items())), dict(sorted(aliases.items()))
 
+    def module_calls(self):
+        None
+        if self.dynamic:
+            return None
+        out = {}
+        for (sid, name), info in self.info.items():
+            if sid != id(self.module) or info[0] != "value" or self.times(self.module, name) != 1:
+                continue
+            if not isinstance(info[1], ast.Call):
+                continue
+            where = span(info[1])
+            if where is not None:
+                out[name] = [where[0], where[1]]
+        if len(out) > MAX_PER_KIND:
+            return None
+        return dict(sorted(out.items()))
+
 
 class Extract(ast.NodeVisitor):
     None
@@ -1351,6 +1414,12 @@ class _Refuse(Exception):
         self.reason = reason
 
 
+def _kwarg_name(H):
+    None
+    kw = H.node.args.kwarg
+    return None if kw is None else _mangle(H.private, kw.arg)
+
+
 def _params_in_order(args):
     None
     return [a for a in (*getattr(args, "posonlyargs", ()), *args.args, args.vararg, *args.kwonlyargs, args.kwarg) if a is not None]
@@ -2157,6 +2226,9 @@ class _FlowEmit:
         if H.kind != "class" and name not in params and self.stable(H):
             keys = self.fs.bound_by.get(key, ())
             got = _one_type({self.fs.literal.get(k) for k in keys})
+        elif H.kind == "def" and self.stable(H) and _kwarg_name(H) == name:
+            keys = self.fs.bound_by.get(key, ())
+            got = _one_type({"dict", *(self.fs.literal.get(k) for k in keys)})
         self._types[key] = got
         return got
 
@@ -2846,12 +2918,14 @@ def extract(path, max_bytes, max_nodes):
         "allComputed": ex.all_computed,
         "truncated": ex.truncated,
         "moduleBindings": scopes.module_bindings(),
+        "staticBindings": scopes.static_bindings(),
         "attrWrites": scopes.attribute_writes(),
         "starImport": scopes.star,
         "toplevelFlows": toplevel_flows,
         "flowsRefused": flows_refused,
         "moduleOrigins": module_origins,
         "annotatedAliases": annotated_aliases,
+        "moduleCalls": scopes.module_calls(),
         **refs,
     }
 
@@ -3018,64 +3092,91 @@ def main(argv):
 
 if __name__ == "__main__":
     sys.exit(main(sys.argv))
-`};import{randomBytes as bm}from"node:crypto";import{readFileSync as Vv,renameSync as Xv,writeFileSync as Sm}from"node:fs";import Yv from"node:path";import{fileURLToPath as Jv}from"node:url";var vm=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Em(e){let n=vm.exec(e);return n===null?null:{kind:"npm",release:[Number(n[1]),Number(n[2]),Number(n[3])]}}function Nm(e,n){for(let t=0;t<3;t+=1){let s=e.release[t]??0,r=n.release[t]??0;if(s!==r)return s<r?-1:1}return 0}var Am=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,Im={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function ds(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function Rm(e){let n=Am.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,s=(t.release??"").split(".");if(s.length===0||s.length>32)return null;let r=[];for(let c of s){let p=ds(c);if(p===null)return null;r.push(p)}let i=0;if(t.epoch!==void 0){let c=ds(t.epoch);if(c===null)return null;i=c}let o=null;if(t.preL!==void 0){let c=t.preN===void 0?0:ds(t.preN);if(c===null)return null;o=[Im[t.preL]??t.preL,c]}let a=null;if(t.postImplicit!==void 0){let c=ds(t.postImplicit);if(c===null)return null;a=c}else if(t.postL!==void 0){let c=t.postN===void 0?0:ds(t.postN);if(c===null)return null;a=c}let d=null;if(t.devL!==void 0){let c=t.devN===void 0?0:ds(t.devN);if(c===null)return null;d=c}let l=t.local===void 0?null:t.local.split(/[-_.]/u).map(c=>/^[0-9]+$/u.test(c)?Number(c):c);return{kind:"PyPI",epoch:i,release:r,pre:o,post:a,dev:d,local:l}}function cs(e,n){return e===n?0:e<n?-1:1}function jl(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function Om(e,n){let t=jl(e),s=jl(n),r=Math.max(t.length,s.length);for(let i=0;i<r;i+=1){let o=cs(t[i]??0,s[i]??0);if(o!==0)return o}return 0}function Bl(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function Pm(e,n){let t=Bl(e),s=Bl(n);return t!==s?t<s?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:cs(e.pre[1],n.pre[1])}function Cm(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:cs(e,n)}function Mm(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:cs(e,n)}function Tm(e,n){let t=typeof e=="number",s=typeof n=="number";return t&&s?cs(e,n):!t&&!s?e===n?0:e<n?-1:1:t?1:-1}function $m(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let s=0;s<t;s+=1){let r=e[s],i=n[s];if(r===void 0)return-1;if(i===void 0)return 1;let o=Tm(r,i);if(o!==0)return o}return 0}function Lm(e,n){let t=cs(e.epoch,n.epoch);if(t!==0)return t;let s=Om(e.release,n.release);if(s!==0)return s;let r=Pm(e,n);if(r!==0)return r;let i=Cm(e.post,n.post);if(i!==0)return i;let o=Mm(e.dev,n.dev);return o!==0?o:$m(e.local,n.local)}function Dm(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=e==="npm"?Em(n):Rm(n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function Ls(e,n){let t=Dm(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function Pr(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return Nm(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return Lm(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function Kl(e,n,t){let s=Ls(e,n);return!(t.introduced!=="0"&&Pr(s,Ls(e,t.introduced))<0||t.fixed!==void 0&&Pr(s,Ls(e,t.fixed))>=0||t.lastAffected!==void 0&&Pr(s,Ls(e,t.lastAffected))>0)}var Go=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function zt(e,n){return Kl(n.ecosystem??"npm",e,n)}function Cr(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),r=new Map(e.classes.map(a=>[a.id,a.name])),i=new Map(e.callSites.map(a=>[a.id,a])),o=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let d=i.get(a.callSiteId);if(d===void 0)continue;let l=s.get(d.enclosingFunctionId);if(l===void 0||!t.has(l.moduleId))continue;let c=n.get(l.moduleId);if(c===void 0)continue;let p=s.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&o.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:a.resolution})}return o}function Fm(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,s)=>t.analyzedVersion<s.analyzedVersion?1:t.analyzedVersion>s.analyzedVersion?-1:0)}function jm(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function zl(e,n,t,s,r,i){if(i<=0)return null;let o=null,a=d=>{(o===null||d.hops<o.hops)&&(o=d)};for(let d of Fm(e,n))for(let l of d.edges){if(l.entryExport!==t||l.entryContainer!==s)continue;if(jm(l,r,d.packageName)){a({viaPackages:[],hops:l.hops,provenance:{tool:d.tool,toolVersion:d.toolVersion,analyzedVersion:d.analyzedVersion}});continue}if(l.target.kind!=="dep")continue;let c=zl(e,l.target.calleePackage,l.target.calleeExport,null,r,i-1);c!==null&&a({viaPackages:[l.target.calleePackage,...c.viaPackages],hops:l.hops+c.hops,provenance:c.provenance})}return o}function Vo(e,n,t,s,r,i){let o=null;for(let a of Cr(e,n,t)){let d=zl(r,a.packageName,a.exportName,a.container,s,i);d!==null&&(o===null||d.hops<o.totalHops)&&(o={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:d.viaPackages,totalHops:d.hops,provenance:d.provenance})}return o}function Mr(e,n){let{args:t,convention:s}=e,r=n.params;if(t===void 0||s===void 0||r===void 0)return{known:!1,reason:"not-emitted"};if(s==="unknown")return{known:!1,reason:"convention"};if(n.reflectiveArguments===!0)return{known:!1,reason:"reflective-arguments"};if(s==="shifted"&&t[0]?.spread!==void 0&&t[0].spread!==!1)return{known:!1,reason:"convention"};let i=s==="shifted"?t.slice(1):t,o=[...r].sort((b,x)=>b.index-x.index),a=o.filter(b=>b.kind==="positional"),d=o.find(b=>b.kind==="rest"),l=o.find(b=>b.kind==="keyword-rest"),c=new Map,p=(b,x)=>{let k=c.get(b);k!=="unknown"&&c.set(b,[...k??[],x])},u=b=>{b!==void 0&&c.set(b,"unknown")},f=[],h=0,g=!1,y=!1;for(let b of i){if(b.spread==="positional"){g=!0;for(let k of a.slice(h))u(k);u(d);continue}if(b.spread==="keyword"){y=!0;for(let k of o)(k.kind==="positional"||k.kind==="keyword-only")&&!c.has(k)&&u(k);u(l);continue}if(b.keyword!==void 0){let k=o.find(w=>w.name===b.keyword&&(w.kind==="positional"||w.kind==="keyword-only"));k!==void 0?c.has(k)?u(k):p(k,b.index):l!==void 0?p(l,b.index):f.push(b.index);continue}if(g){for(let k of a.slice(h))u(k);u(d);continue}let x=a[h];x!==void 0?p(x,b.index):d!==void 0?p(d,b.index):f.push(b.index),h+=1}return{known:!0,params:o.map(b=>{let x=c.get(b);return x==="unknown"?{kind:"unknown"}:x!==void 0?{kind:"args",argIndexes:x}:y&&(b.kind==="positional"||b.kind==="keyword-only")?{kind:"unknown"}:b.kind==="rest"||b.kind==="keyword-rest"?{kind:"args",argIndexes:[]}:{kind:"absent"}}),receiver:Bm(e,n),unbound:f}}function Bm(e,n){if(n.receiver===void 0)return"unknown";if(n.receiver!=="call")return"none";switch(e.convention){case"construct":return"fresh";case"shifted":return(e.args?.length??0)>0?"first-argument":"none";case"direct":return e.receiverRange!==void 0?"receiver-expression":"none";default:return"unknown"}}var Xo=["builtin-call","host-lib-call","primitive-mutation","dependency-boundary","app-unresolved","untyped-call","dependency-callee","app-callee","module-binding","global","free-name","construct","opaque","unregistered-entry","binding","not-emitted","analysis-cap"],Ul=2e4,Km=4,Un=(e,n)=>`${String(e)}-${String(n)}`,Tr=e=>{switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${Un(e.at,e.end)}`;case"argument":return`a${Un(e.at,e.end)}:${String(e.index)}`;case"call-receiver":return`r${Un(e.at,e.end)}`;case"mutated-by-call":return`m${Un(e.at,e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"shared":return`h${String(e.id)}`;default:return e.kind}};function zm(e){if(e.kind==="entry-parameter")return"unregistered-entry";if(e.kind==="unknown")switch(e.reason){case"binding":return"binding";case"not-emitted":return"not-emitted";case"analysis-cap":return"analysis-cap";case"opaque":return e.detail==="construct"?"construct":"opaque";default:return}}function us(e){let n=new Map(e.functions.map(c=>[c.id,c])),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map;for(let c of e.functions){if(c.valueFlows===void 0)continue;let p=new Map;for(let u of c.valueFlows){let f=Tr(u.to),h=p.get(f);h===void 0?p.set(f,[u]):h.push(u)}s.set(c.id,p)}let r=new Map,i=new Map,o=0;for(let c of e.callSites){let p=`${c.range.path}\0${Un(c.range.start,c.range.end)}`;r.has(p)&&(o+=1),r.set(p,c),i.set(c.id,c)}let a=new Map,d=new Map,l=(c,p,u)=>{let f=c.get(p)??[];f.includes(u)||f.push(u),c.set(p,f)};for(let c of e.callEdges){let p=i.get(c.callSiteId);if(p===void 0)continue;let u=c.invocation==="direct";u&&l(a,p.id,c.calleeFunctionId);let f=d.get(c.calleeFunctionId)??[],h=f.find(g=>g.site===p);h===void 0?f.push({site:p,direct:u}):u&&(h.direct=!0),d.set(c.calleeFunctionId,f)}return{functions:n,modules:t,into:s,siteAt:r,identityCollisions:o,callees:a,callers:d}}function Um(e,n){let{args:t,convention:s}=e;if(t===void 0||s===void 0||s!=="direct"&&s!=="construct")return"unknown";for(let r=0;r<=n&&r<t.length;r+=1){let i=t[r];if(i===void 0||i.spread!==!1||i.keyword!==void 0)return"unknown"}return n<t.length?n:"absent"}var ql=e=>[...e.params??[]].sort((n,t)=>n.index-t.index);function qm(e,n,t){if(n===-1)return e.receiver==="receiver-expression"?{kind:"receiver"}:e.receiver==="unknown"?"unknown":null;if(e.receiver==="first-argument"&&n===0)return{kind:"receiver"};let s=e.params.findIndex(r=>r.kind==="args"&&r.argIndexes.includes(n));if(s>=0){let r=ql(t)[s];return r!==void 0?{kind:"param",index:r.index}:"unknown"}return e.unbound.includes(n)?null:"unknown"}function Ds(e,n){let t=new Map,s=v=>{let C=v.class??zm(v),R=v.site===void 0?"":`${v.site.path}:${String(v.site.start)}-${String(v.site.end)}`;t.set(`${v.kind}|${v.functionId}|${v.reason??""}|${v.detail??""}|${R}|${v.via??""}`,C===void 0?v:{...v,class:C})},r=new Map,i=v=>{r.set(`${v.site.path}:${String(v.site.start)}-${String(v.site.end)}|${v.reason}`,v)},o=(v,C)=>{if(C.kind==="receiver")return v.receiverPrimitive===!0;let R=v.args??[];return C.kind==="arg"?R[C.index]?.primitive===!0:R.slice(C.index).every(F=>F.primitive===!0)},a=(v,C,R,F)=>{let P=C.range.start,U=C.range.end,E=Un(P,U),T=C.args,K=T!==void 0&&T.every(V=>V.spread===!1&&V.keyword===void 0),J=T!==void 0&&!K&&T.every(V=>V.spread===!1)&&T.some(V=>V.keyword!==void 0),W=J?T.findIndex(V=>V.keyword!==void 0):Number.POSITIVE_INFINITY,se=(V,fe)=>fe===-1?V.kind==="receiver":fe<W?V.kind==="arg"&&V.index===fe||V.kind==="args-from"&&fe>=V.index:V.kind==="args-from"||V.kind==="arg"&&V.index>=W,Y=F.kind==="call-result"?R.result:R.mutates.filter(V=>se(V.into,F.index)).flatMap(V=>V.from);for(let V of Y){if(V.kind==="receiver"){C.receiverRange!==void 0&&y({fn:v.fn,ref:{kind:"call-receiver",at:P,end:U},stack:v.stack,tracing:E});continue}if(T===void 0||!K&&!J){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:"summary input",site:C.range});continue}let[fe,S]=V.kind==="arg"&&V.index<W?[V.index,Math.min(V.index+1,T.length)]:[Math.min(V.index,W),T.length];for(let A=fe;A<S;A+=1)y({fn:v.fn,ref:{kind:"argument",at:P,end:U,index:A},stack:v.stack,tracing:E})}R.reviewed!==!0&&i({site:C.range,id:R.id,reason:"unreviewed-summary"}),(R.callsProgram??[]).some(V=>!o(C,V))&&i({site:C.range,id:R.id,reason:"calls-program"})},d=(v,C,R,F)=>{if(C.kind==="mutated-by-call"&&C.index>=0&&v.args?.[C.index]?.primitive===!0)return"primitive-mutation";if(R!==null){let P=e.modules.get(R.moduleId),U=e.modules.get(F.moduleId);return P===void 0?"not-emitted":P.externalSurface===!0||P.packageName!==U?.packageName?"dependency-callee":"app-callee"}switch(v.calleeDecl){case"ecmascript":case"runtime":return"builtin-call";case"host-lib":return"host-lib-call";case"dependency":return"dependency-boundary";case"app":return"app-unresolved";default:return"untyped-call"}},l=new Set,c=[],p=new Map,u=null,f,h=v=>`${v.fn}\0${Tr(v.ref)}\0${v.stack.map(C=>C.id).join(",")}\0${String(v.tracing??"")}`,g=v=>{if(f!==void 0)return;let C=[{functionId:v.fn,ref:v.ref}];for(let R=u;R!==null;){let F=p.get(R);if(F===void 0)break;C.push({functionId:F.state.fn,ref:F.state.ref}),R=F.key}f=C},y=v=>{let C=h(v);l.has(C)||(l.add(C),p.set(C,{key:u,state:v}),c.push(v))},_=n.site.enclosingFunctionId,b=n.site.range.start,x=n.site.range.end;if(n.port.kind==="receiver")y({fn:_,ref:{kind:"call-receiver",at:b,end:x},stack:[],tracing:Un(b,x)});else{let v=Um(n.site,n.port.index);v==="unknown"?s({kind:"unknown",functionId:_,reason:"binding"}):v==="absent"?s({kind:"constant",functionId:_,detail:"no argument"}):y({fn:_,ref:{kind:"argument",at:b,end:x,index:v},stack:[],tracing:Un(b,x)})}let k=0;for(;c.length>0;){if(k+=1,k>Ul){s({kind:"unknown",functionId:_,reason:"analysis-cap"});break}let v=c.pop();u=h(v);let C=e.into.get(v.fn),R=e.functions.get(v.fn);if(C===void 0||R===void 0){s({kind:"unknown",functionId:v.fn,reason:"not-emitted"});continue}let F=C.get(Tr(v.ref));if(F!==void 0&&F.length>0){for(let U of F)v.tracing!==void 0&&U.from.kind==="mutated-by-call"&&Un(U.from.at,U.from.end)===v.tracing&&e.siteAt.get(`${R.declRange.path}\0${v.tracing}`)?.repeats===!1||y({...v,ref:U.from});if(v.ref.kind!=="param"&&v.ref.kind!=="receiver"&&v.ref.kind!=="call-result"&&v.ref.kind!=="mutated-by-call"&&v.ref.kind!=="free")continue}let P=v.ref;switch(P.kind){case"constant":s({kind:"constant",functionId:v.fn});break;case"opaque":s({kind:"unknown",functionId:v.fn,reason:"opaque",detail:P.reason});break;case"source":s({kind:"source",functionId:v.fn,sourceClass:P.sourceClass,model:P.model}),g(v);break;case"free":s({kind:"unknown",functionId:v.fn,reason:"free",detail:P.name,class:P.binding==="module"?"module-binding":P.binding==="global"?"global":"free-name"});break;case"local":case"return":(F===void 0||F.length===0)&&s({kind:"constant",functionId:v.fn,detail:"undefined"});break;case"param":case"receiver":{let U=P.kind==="param"?R.sourceParams?.find(W=>W.index===P.index):void 0;U!==void 0&&(s({kind:"source",functionId:v.fn,sourceClass:U.sourceClass,model:U.model}),g(v));let E=v.stack[v.stack.length-1],T=E!==void 0?[{site:E,direct:!0}]:e.callers.get(v.fn)??[],K=U!==void 0?T.filter(W=>W.direct&&W.site.args!==void 0):T;if(U!==void 0&&K.length===0)break;let J=E!==void 0?v.stack.slice(0,-1):[];if(K.length===0){s({kind:"entry-parameter",functionId:v.fn,detail:P.kind==="param"?`param ${String(P.index)}`:"receiver"});break}for(let{site:W,direct:se}of K){if(!se){s({kind:"unknown",functionId:W.enclosingFunctionId,reason:"binding",detail:"callback"});continue}let Y=Mr(W,R);if(!Y.known){s({kind:"unknown",functionId:W.enclosingFunctionId,reason:"binding",detail:Y.reason});continue}let V=W.range.start,fe=W.range.end,S=Un(V,fe),A=W.enclosingFunctionId;if(P.kind==="receiver"){Y.receiver==="receiver-expression"?y({fn:A,ref:{kind:"call-receiver",at:V,end:fe},stack:J,tracing:S}):Y.receiver==="first-argument"?y({fn:A,ref:{kind:"argument",at:V,end:fe,index:0},stack:J,tracing:S}):Y.receiver==="none"?s({kind:"constant",functionId:A,detail:"no receiver"}):s({kind:"unknown",functionId:A,reason:"binding",detail:`receiver ${Y.receiver}`});continue}let j=ql(R).findIndex(X=>X.index===P.index),ne=Y.params[j];if(ne===void 0||ne.kind==="unknown")s({kind:"unknown",functionId:A,reason:"binding"});else if(ne.kind==="absent")(F===void 0||F.length===0)&&s({kind:"constant",functionId:v.fn,detail:"no argument"});else for(let X of ne.argIndexes)y({fn:A,ref:{kind:"argument",at:V,end:fe,index:X},stack:J,tracing:S})}break}case"call-result":case"mutated-by-call":{let U=e.siteAt.get(`${R.declRange.path}\0${Un(P.at,P.end)}`);if(U===void 0){s({kind:"unknown",functionId:v.fn,reason:"unresolved-call",detail:"no call site at offset",class:"not-emitted"});break}let E=e.callees.get(U.id)??[];if(E.length===0&&U.summary!==void 0){a(v,U,U.summary,P);break}if(E.length===0){s({kind:"unknown",functionId:v.fn,reason:"unresolved-call",...U.runtimeId!==void 0?{detail:U.runtimeId}:{},site:U.range,via:P.kind==="call-result"?"result":"mutation",class:d(U,P,null,R)});break}let T=v.stack.length>=Km?[]:[...v.stack,U];for(let K of E){let J=e.functions.get(K);if(J===void 0||!e.into.has(K)){s({kind:"unknown",functionId:v.fn,reason:"opaque-callee",detail:K,site:U.range,via:P.kind==="call-result"?"result":"mutation",class:J===void 0?"not-emitted":d(U,P,J,R)});continue}if(P.kind==="call-result"){y({fn:K,ref:{kind:"return"},stack:T});continue}let W=Mr(U,J);if(!W.known){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:W.reason});continue}let se=qm(W,P.index,J);if(se==="unknown"){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:"mutation target",site:U.range});continue}if(se===null)continue;let Y=(e.into.get(K)?.get(Tr(se))??[]).filter(V=>V.kind==="field"||V.kind==="mutation");for(let V of Y)y({fn:K,ref:V.from,stack:T})}break}case"argument":case"call-receiver":(F===void 0||F.length===0)&&s({kind:"unknown",functionId:v.fn,reason:"not-emitted",detail:"no flow into the argument"});break}}let w=[...t.values()],I=[...r.values()];return{outcome:w.some(v=>v.kind==="source")?"influenced":w.some(v=>v.kind==="unknown")||I.length>0?"unknown":w.some(v=>v.kind==="entry-parameter")?"reaches-entry-parameter":"no-source-reached",leaves:w,caveats:I,visited:l.size,...f!==void 0?{witness:f}:{}}}var Fs={"no-contract":"cupel","no-source-model":"cupel","control-influence-unsupported":"cupel","analysis-cap":"cupel"};function Yo(e){if(Hl.includes(e))return{value:"unknown",kind:"no-contract"}}function js(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function fs(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function $r(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let r=t.get(s.importId);if(r===void 0)continue;let i=n.get(r.moduleId)??[];i.push(s.resolvedModuleId),n.set(r.moduleId,i)}return n}function Hm(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let r=t.get(s.importId);if(r===void 0)continue;let i=n.get(s.resolvedModuleId)??[];i.push(r.moduleId),n.set(s.resolvedModuleId,i)}return n}function qn(e){let n=$r(e),t=new Set,s=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;s.length>0;){let r=s.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let i of n.get(r)??[])t.has(i)||s.push(i)}}return t}function Wm(e,n){let t=Hm(e),s=new Set,r=[n];for(;r.length>0;){let i=r.pop();if(!(i===void 0||s.has(i))){s.add(i);for(let o of t.get(i)??[])s.has(o)||r.push(o)}}return s}function Gm(e,n,t){let s=$r(e),r=fs(e),i=new Set,o=[n];for(;o.length>0;){let a=o.pop();if(a===void 0||i.has(a))continue;i.add(a);let d=r.get(a);if(d===void 0||d.externalSurface===!0||t.has(a))return!0;for(let l of s.get(a)??[])i.has(l)||o.push(l)}return!1}function Bs(e,n,t,s=new Set){let r=$r(e),i=fs(e),o=new Set,a=[],d=[n];for(;d.length>0;){let l=d.pop();if(l===void 0||o.has(l))continue;o.add(l);let c=i.get(l);if(c===void 0){a.push({module:l,kind:"absent"});continue}if(t.has(l)){a.push({module:l,kind:"unbounded"});continue}if(c.externalSurface===!0&&!s.has(l)){a.push({module:l,kind:"surface"});continue}for(let p of r.get(l)??[])o.has(p)||d.push(p)}return a}function Xl(e){let n=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.id)),t=new Map(e.functions.map(o=>[o.id,o])),s=fs(e),r=new Map;for(let o of e.functions)n.has(o.moduleId)&&(o.publicSurfaceReachable||o.name==="<toplevel>")&&r.set(o.id,o);let i=new Map(e.exports.map(o=>[o.id,o]));for(let o of e.exportBindings){if(o.target.kind!=="function")continue;let a=i.get(o.exportId);if(a===void 0||!n.has(a.moduleId))continue;let d=t.get(o.target.functionId);d===void 0||s.get(d.moduleId)?.externalSurface===!0||r.set(d.id,d)}return[...r.values()]}function Yl(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),i=r[0]?.startsWith("@")===!0?2:1;return r.slice(i).join("/")}function Vm(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let s=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(i=>[i.id,i]));return e.functions.find(i=>{if(i.name!==t.exportName)return!1;let o=n.get(i.moduleId);if(o===void 0||o.packageName!==t.packageName)return!1;if(s){if(i.kind!==t.symbolKind||i.enclosingClassId===void 0||r.get(i.enclosingClassId)?.name!==t.container)return!1}else if(i.kind!=="function")return!1;return o.externalSurface===!0?!0:Yl(o.path)===t.sourcePath})}function Wl(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Yl(t.path)===n.sourcePath)}function Xm(e,n,t,s){let r=new Map(e.functions.map(i=>[i.id,i]));return e.callSites.some(i=>i.calleeExprShape!=="member"||i.resolution!=="resolved"?!1:i.resolvedTargetIds.some(o=>{let a=r.get(o);if(a?.name!==s.exportName)return!1;let d=n.get(a.moduleId);return d?.externalSurface===!0&&d.packageName===s.packageName&&t.has(a.moduleId)}))}function Ym(e,n,t){return t.container===null?!0:e.classes.some(s=>{if(s.name!==t.container)return!1;let r=n.get(s.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function Jm(e,n,t){let s=new Map(e.callSites.map(d=>[d.id,d.enclosingFunctionId])),r=new Map;for(let d of e.callEdges){let l=s.get(d.callSiteId);if(l===void 0)continue;let c=r.get(l)??[];c.push({to:d.calleeFunctionId,res:d.resolution,site:d.callSiteId}),r.set(l,c)}let i=d=>{let l=new Set,c=n.map(p=>({id:p.id,prev:null,via:null}));for(let p of c)l.add(p.id);for(;c.length>0;){let p=c.shift();if(p===void 0)break;if(p.id===t){let u=[],f=[];for(let h=p;h!==null;h=h.prev)u.unshift(h.id),f.unshift(h.via);return{path:u,via:f}}for(let u of r.get(p.id)??[])u.res!=="unresolved"&&(u.res==="field-based"&&!d||l.has(u.to)||(l.add(u.to),c.push({id:u.to,prev:p,via:u.site})))}return null},o=i(!1);if(o!==null)return{...o,usedFieldBased:!1};let a=i(!0);return a!==null?{...a,usedFieldBased:!0}:null}function Jo(e,n,t){let s=new Map(e.callSites.map(y=>[y.id,y.enclosingFunctionId])),r=new Map,i=new Map,o=[],a=(y,_,b)=>{let x=y.get(_);x===void 0?y.set(_,[b]):x.push(b)};for(let y of e.callEdges){if(y.resolution==="unresolved"||y.resolution==="field-based"&&!t)continue;let _=s.get(y.callSiteId);if(_===void 0)continue;let b=y.calleeFunctionId;a(r,_,b),a(i,b,_),o.push({from:_,to:b,site:y.callSiteId})}let d=new Set,l=Xl(e).map(y=>y.id);for(let y of l)d.add(y);for(let y=0;y<l.length;y+=1)for(let _ of r.get(l[y])??[])d.has(_)||(d.add(_),l.push(_));if(!d.has(n))return null;let c=new Map([[n,0]]),p=[n];for(let y=0;y<p.length;y+=1){let _=p[y],b=(c.get(_)??0)+1;for(let x of i.get(_)??[])c.has(x)||!d.has(x)||(c.set(x,b),p.push(x))}let u=(y,_)=>y<_?-1:y>_?1:0,f=[...c].map(([y,_])=>({functionId:y,distance:_})).sort((y,_)=>y.distance-_.distance||u(y.functionId,_.functionId)),h=new Set,g=o.filter(y=>c.has(y.from)&&c.has(y.to)).filter(y=>{let _=JSON.stringify([y.from,y.to,y.site]);return h.has(_)?!1:(h.add(_),!0)}).sort((y,_)=>u(y.from,_.from)||u(y.to,_.to)||u(y.site,_.site));return{functions:f,edges:g}}function Gl(e,n){let t=new Set,s=[...e];for(let r=s.pop();r!==void 0;r=s.pop())if(!t.has(r)){t.add(r);for(let i of n(r)??[])t.has(i)||s.push(i)}return t}var Vl=new WeakMap;function Zm(e,n){let t=Vl.get(n);if(t!==void 0&&t.graph===e)return t.reach;let s=qn(e),r=n.filter(o=>o.reach.kind==="dependency-dispatch"&&s.has(o.source)).map(o=>o.source),i=new Set;if(r.length>0){let o=$r(e),a=Gl(r,p=>o.get(p)),d=e.functions.filter(p=>s.has(p.moduleId)&&(a.has(p.moduleId)||p.addressTaken!==!1)).map(p=>p.id),l=new Map(e.callSites.map(p=>[p.id,p.enclosingFunctionId])),c=new Map;for(let p of e.callEdges){if(p.resolution==="unresolved")continue;let u=l.get(p.callSiteId);if(u===void 0)continue;let f=c.get(u);f===void 0?c.set(u,[p.calleeFunctionId]):f.push(p.calleeFunctionId)}i=Gl(d,p=>c.get(p))}return Vl.set(n,{graph:e,reach:i}),i}function Zo(e){return Jl(e,fs(e),qn(e),Zl(e))}function Jl(e,n,t,s){let r=[],i=[],o=new Map(e.functions.map(d=>[d.id,d.moduleId])),a=d=>d!==void 0&&t.has(d)&&s.has(n.get(d)?.packageName??"");for(let d of e.callSites)d.resolution==="unresolved"&&a(o.get(d.enclosingFunctionId))&&r.push(d.range);for(let d of e.imports)!d.specifierIsLiteral&&t.has(d.moduleId)&&i.push({path:n.get(d.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:i}}function Zl(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function Qm(e,n,t){let s=new Map(e.functions.map(o=>[o.id,o])),r=fs(e),i=new Map(e.callSites.map(o=>[o.id,o]));return n.map((o,a)=>{let d=s.get(o),l=d!==void 0?r.get(d.moduleId):void 0,c=t[a];return{functionId:o,functionName:d?.name,modulePath:l?.path??"",calledAt:c==null?null:i.get(c)?.range??null}})}function Qo(e){let{graph:n,installed:t,range:s,symbol:r,coverage:i}=e,o=[],a={unresolvedSites:o,unresolvedEvidence:{own:o,sets:[]}},d=W=>({unresolvedSites:W,unresolvedEvidence:{own:W,sets:[]}}),l=Zl(n),c=new Set;for(let W of e.incompleteness)W.reach.kind==="unbounded"&&c.add(W.source);let p=e.incompleteness.some(W=>W.reach.kind==="assumed-bounded")?"loader-assumption":"complete",u=W=>W==="not-reachable"?p:void 0,f=new Map,h=W=>{let se=f.get(W);return se===void 0&&(se=Gm(n,W,c),f.set(W,se)),se},g=W=>W.reach.kind==="class-scope"&&r!==null&&r.packageName===W.reach.packageName&&r.container===W.reach.container,y=W=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let se of Go)for(let Y of e.incompleteness)if(Y.cause===se&&W(Y))return{cause:Y.cause,source:Y.source};return null},_=(W,se)=>{let Y;return y(V=>V.reach.kind==="unbounded"?!0:V.reach.kind==="class-scope"?g(V):V.reach.kind==="dependency-dispatch"?se===void 0||Zm(n,e.incompleteness).has(se):V.reach.kind==="loaded-package"?(s.ecosystem??"npm")===V.reach.ecosystem:W===void 0||h(V.reach.anchor)?!0:(Y??=Wm(n,W),Y.has(V.reach.anchor)))},b=()=>y(W=>W.reach.kind==="unbounded"?!0:W.reach.kind==="class-scope"?g(W):W.reach.kind==="dependency-dispatch"?!1:W.reach.kind==="loaded-package"?(s.ecosystem??"npm")===W.reach.ecosystem&&(W.reach.alsoLoaded?.includes(s.packageName)??!1):h(W.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${s.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let x;try{if((t.ecosystem??"npm")!==(s.ecosystem??"npm"))throw new Error("ecosystem mismatch");x=zt(t.version,s)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:u("unknown"),path:void 0,...a}}if(!x)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${s.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let k=fs(n),w=qn(n),I=W=>{if(W.cause!=="dynamic-load"||W.source===null)return o;let se=k.get(W.source);return se===void 0?o:[{path:se.path,start:0,end:0}]},{dispatch:N,load:v}=Jl(n,k,w,l),C=[...N,...v],R={unresolvedSites:v,unresolvedEvidence:{own:o,sets:["load"]}},F={unresolvedSites:C,unresolvedEvidence:{own:o,sets:["dispatch","load"]}},P=W=>{for(let se of w)if(k.get(se)?.packageName===W)return!0;return!1},U=W=>({tier:"unknown",decidedAtStage:W,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:u("unknown"),path:void 0,...a}),E=()=>{if(!P(s.packageName)){if(v.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:u("unknown"),path:void 0,...R};let W=b();return W!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:W.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(I(W))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${s.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:u("unknown"),path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${s.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${s.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}}return null};if(r===null||!r.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,basis:u("unknown"),path:void 0,...F};if(i!==null&&!i.comparedPaths.has(r.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:u("unknown"),path:void 0,...F};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:u("unknown"),path:void 0,...F};let T=Vm(n,k,r);if(T===void 0||!w.has(T.moduleId)){if(T===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&Xm(n,k,w,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...F};if(T===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!Ym(n,k,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...F};let W=E();if(W!==null)return W;if(C.length>0){let V=T!==void 0?k.get(T.moduleId):Wl(n,r),fe=T===void 0&&V!==void 0&&V.externalSurface!==!0&&w.has(V.id)&&!l.has(V.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:v.length>0?"dynamic-load":fe?"dep-opaque":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,...F}}let se=T!==void 0?k.get(T.moduleId):Wl(n,r);if(T===void 0&&se!==void 0&&se.externalSurface!==!0&&w.has(se.id)&&!l.has(se.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,...a};let Y=se!==void 0?_(se.id,T?.id):b();return Y!==null?{tier:"unknown",decidedAtStage:T===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:Y.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(I(Y))}:s.surfaceComplete?{tier:"not-reachable",decidedAtStage:T===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:U(T===void 0?"symbol-reachable":"module-reachable")}let K=Jm(n,Xl(n),T.id);if(K!==null)return{tier:js(K.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Lr(r),basis:u("reachable-high"),path:Qm(n,K.path,K.via),...a};if(C.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but unresolved edges exist`,unknownKind:v.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,...F};let J=_(T.moduleId,T.id);return J!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:J.cause,attribution:void 0,basis:u("unknown"),path:void 0,...d(I(J))}:s.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:U("call-path-confirmed")}function eh(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function nh(e,n,t){let s=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let i=n.get(r.moduleId);if(!(i===void 0||i.packageName!==t.packageName||(r.enclosingClassId!==void 0?s.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function th(e,n,t){if(n===t)return[];let s=new Map(e.functions.map(d=>[d.id,d])),r=new Map(e.callSites.map(d=>[d.id,d])),i=new Map;for(let d of e.callEdges){if(d.resolution!=="resolved"&&d.resolution!=="field-based")continue;let l=r.get(d.callSiteId);if(l===void 0)continue;let c=l.enclosingFunctionId;if(!s.has(c)||!s.has(d.calleeFunctionId))continue;let p=i.get(c),u={to:d.calleeFunctionId,label:d.resolution};p===void 0?i.set(c,[u]):p.push(u)}let o=new Set([n]),a=[{at:n,labels:[]}];for(let d=0;d<a.length;d++){let l=a[d];for(let c of i.get(l.at)??[]){if(o.has(c.to))continue;let p=[...l.labels,c.label];if(c.to===t)return p;o.add(c.to),a.push({at:c.to,labels:p})}}return null}function Ks(e,n,t,s,r){if(r.length===0)return null;let i=Cr(e,n,t);if(i.length===0)return null;let o=nh(e,n,s);for(let a of r){let d=i.filter(c=>c.packageName===a.anchor.packageName&&c.exportName===a.anchor.exportName&&c.container===a.anchor.container),l=d.find(c=>c.resolution==="resolved")??d[0];if(l!==void 0){if(eh(a.callee,s))return{tier:js("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[l.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&o!==null){let c=th(e,a.callee.realFunctionId,o);if(c!==null)return{tier:js("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[l.resolution,"modeled",...c]}}}}return null}var Ql=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],ed=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"],Hl=["reachable-high","reachable-medium","reachable-low"];function Lr(e){return e.verified?"gated":"candidate"}var ei=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],ni=["cupel","project"],Rn={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function nd(e){return Rn[e]}import{randomBytes as ol}from"node:crypto";import{performance as Cs}from"node:perf_hooks";import xd from"node:path";import{closeSync as sh,constants as td,fstatSync as rh,openSync as oh,readSync as ih,realpathSync as sd}from"node:fs";import ti from"node:path";var ah=8*1024*1024;function zs(e){return e==="PyPI"?"utf8-bytes":"utf16-units"}var Nt=class{#e;#t;#n=new Map;constructor(n,t=ah){this.#t=t;let s;try{s=sd(n)}catch{s=null}this.#e=s}read(n){let t=this.#n.get(n);if(t!==void 0)return t;let s=this.#s(n);return this.#n.set(n,s),s}#s(n){let t=this.#e;if(t===null||n===""||ti.isAbsolute(n))return null;let s;try{s=sd(ti.join(t,n))}catch{return null}if(s!==t&&!s.startsWith(`${t}${ti.sep}`))return null;let r;try{r=oh(s,td.O_RDONLY|td.O_NONBLOCK)}catch{return null}try{let i=rh(r);if(!i.isFile()||i.size>this.#t)return null;let o=Buffer.alloc(i.size),a=0;for(;a<i.size;){let d=ih(r,o,a,i.size-a,a);if(d===0)break;a+=d}return a===i.size?o:null}catch{return null}finally{sh(r)}}};function rd(e,n,t){if(!Number.isInteger(n)||n<0)return null;if(t==="utf8-bytes"){if(n>e.length)return null;let o=e.subarray(0,n),a=1;for(let l of o)l===10&&(a+=1);let d=o.lastIndexOf(10)+1;return[a,e.subarray(d,n).toString("utf8").length+1]}let s=e.toString("utf8");if(n>s.length)return null;let r=s.slice(0,n),i=1;for(let o=0;o<r.length;o+=1)r.charCodeAt(o)===10&&(i+=1);return[i,n-(r.lastIndexOf(`
-`)+1)+1]}function At(e,n,t){if(n.end<n.start)return null;let s=e.read(n.path);if(s===null)return null;let r=rd(s,n.start,t),i=rd(s,n.end,t);return r===null||i===null?null:{startLine:r[0],startColumn:r[1],endLine:i[0],endColumn:i[1]}}var lh="cupel/influence-shadow/2",od=64,id=16,dh=e=>e.startsWith("reachable-");function Dr(e){let n=new Map(e.functions.map(t=>[t.id,t.moduleId]));return{...e,functions:e.functions.map(t=>({...t,declRange:{...t.declRange,path:t.moduleId}})),callSites:e.callSites.map(t=>{let s=n.get(t.enclosingFunctionId);return s===void 0?t:{...t,range:{...t.range,path:s}}})}}function ad(e,n,t,s=()=>null,r=null){let i=t(),o={graph:e,lineOf:s},a={npm:o,PyPI:r},d=new Map,l=b=>{let x=d.get(b);return x===void 0&&(x=us(b.graph),d.set(b,x)),x};l(o);let c=Object.fromEntries(Xo.map(b=>[b,0])),p=0,u=0,f=b=>x=>{let{site:k,...w}=x;return k===void 0?w:{...w,site:{...k,line:b.lineOf?.(k)??null}}},h={influenced:0,"no-source-reached":0,"reaches-entry-parameter":0,unknown:0},g={},y=0,_=[];for(let b of n){if(!dh(b.tier))continue;let x={advisoryId:b.advisoryId,packageName:b.packageName,version:b.version,ecosystem:b.ecosystem,symbol:b.symbolName,tier:b.tier},k=b.ecosystem==="npm"||b.ecosystem==="PyPI"?a[b.ecosystem]:null;if(k===null){_.push({...x,skipped:b.ecosystem==="PyPI"?"this scan holds no Python graph to ask":`no front-end emits value flows for ${b.ecosystem}`,sites:[],truncatedSites:!1});continue}let w=l(k),I=f(k),N=b.path?.[b.path.length-1]?.functionId,v=N!==void 0?(w.callers.get(N)??[]).filter(R=>R.direct).map(R=>R.site):[],C=[];for(let R of v.slice(0,od)){let F=[],P=R.args?.length??1,U=(E,T)=>{let K=Ds(w,{site:R,port:T});y+=1,h[K.outcome]+=1,K.caveats.length>0&&(u+=1);for(let J of K.leaves)J.kind==="unknown"&&J.reason!==void 0&&(g[J.reason]=(g[J.reason]??0)+1),(J.kind==="unknown"||J.kind==="entry-parameter")&&(J.class===void 0?p+=1:c[J.class]+=1);F.push({port:E,outcome:K.outcome,leaves:K.leaves.map(I),caveats:K.caveats,visited:K.visited,...K.witness!==void 0?{witness:K.witness}:{}})};for(let E=0;E<Math.min(P,id);E+=1)U(`arg[${String(E)}]`,{kind:"arg",index:E});R.receiverRange!==void 0&&U("receiver",{kind:"receiver"}),C.push({path:R.range.path,start:R.range.start,enclosing:R.enclosingFunctionId,ports:F,truncatedArgs:P>id})}_.push({...x,sites:C,truncatedSites:v.length>od})}return{format:lh,findings:_,totals:{findings:_.length,ports:y,byOutcome:h,unknownReasons:g,identityCollisions:[...d.values()].reduce((b,x)=>b+x.identityCollisions,0),byClass:c,unclassified:p,portsWithCaveats:u},wallMs:Math.round((t()-i)*10)/10}}function Ve(e){return Buffer.byteLength(JSON.stringify(e),"utf8")}function Fr(e,n){return 2+e+Math.max(n-1,0)}function ld(e){return String(e).length}var It=class{#e;constructor(n,t){let s=new Float64Array(n+2);for(let[r,i]of t)s[r+1]=(s[r+1]??0)+i;for(let r=1;r<s.length;r+=1)s[r]=(s[r]??0)+(s[r-1]??0);this.#e=s}below(n){return this.#e[n]??0}},ri=class{index;finding;key;size;kept;#e;#t;#n;#s;#o;#i;#a;#r;#l;#d;#c;#u;#f;constructor(n,t,s,r){this.index=n,this.finding=t,this.key=r,this.size=s.nodes.length,this.kept=s.nodes.length,this.#e=s,this.#t=t.influence?.overlay??null;let i=this.size,o=new Map;s.nodes.forEach((f,h)=>{o.has(f.id)||o.set(f.id,h)}),this.#n=o;let a=f=>o.get(f)??i,d=f=>Math.max(a(f.from),a(f.to));this.#s=new It(i,s.nodes.map((f,h)=>[h,Ve(f)])),this.#o=new It(i,s.edges.map(f=>[d(f),Ve(f)])),this.#i=new It(i,s.edges.map(f=>[d(f),1])),this.#c=Ve({...s,nodes:[],edges:[],truncated:0})-5;let l=this.#t,c=l?.inputs??[];this.#a=new It(i,c.map(f=>[a(f.node),Ve(f)])),this.#r=new It(i,c.map(f=>[a(f.node),1]));let p=0,u=[];for(let f of l?.blockers??[]){let h=Ve(f.node===null?f:{...f,node:null});p+=h,f.node!==null&&u.push([a(f.node),Ve(f)-h])}this.#l=new It(i,u),this.#d=p,this.#u=l===null?0:Ve({...l,inputs:[],blockers:[],truncated:0})-5,this.#f=Ve(s)+(l===null?0:Ve(l))}bytesAt(n){if(n===this.size)return this.#f;let t=this.#c+Fr(this.#s.below(n),n)+Fr(this.#o.below(n),this.#i.below(n))+ld(this.#e.truncated+(this.size-n)),s=this.#t;if(s===null)return t;let r=this.#r.below(n);return t+this.#u+Fr(this.#a.below(n),r)+Fr(this.#d+this.#l.below(n),s.blockers.length)+ld(s.truncated+(s.inputs.length-r))}cut(){let n=this.kept,t=u=>(this.#n.get(u)??this.size)<n,s=this.#e,r=s.edges.filter(u=>t(u.from)&&t(u.to)),i={...s,nodes:s.nodes.slice(0,n),edges:r,truncated:s.truncated+(this.size-n)},o=this.#t,a=this.finding;if(o===null||a.influence===null)return{finding:{...a,reach:i},calls:s.edges.length-r.length,inputs:0,offGraph:0};let d=o.inputs.filter(u=>t(u.node)),l=0,c=o.blockers.map(u=>u.node===null||t(u.node)?u:(l+=1,{...u,node:null})),p={...o,inputs:d,blockers:c,truncated:o.truncated+(o.inputs.length-d.length)};return{finding:{...a,reach:i,influence:{...a.influence,overlay:p}},calls:s.edges.length-r.length,inputs:o.inputs.length-d.length,offGraph:l}}};function si(e,n){return e<n?-1:e>n?1:0}function ch(e,n){return si(e.finding.advisoryId,n.finding.advisoryId)||si(e.finding.packageName,n.finding.packageName)||si(e.key,n.key)}function dd(e,n,t){let s=Ve(e);if(s<=n)return{payload:e,bytes:s,cut:null};let r=e.findings.flatMap((g,y)=>g.reach!==null&&g.reach.nodes.length>1?[new ri(y,g,g.reach,t(g))]:[]);if(r.length===0)return{payload:e,bytes:s,cut:null};r.sort(ch);let i=r.reduce((g,y)=>Math.max(g,y.size),0),o=s;for(let g=i;g>1&&o>n;g-=1)for(let y of r){if(o<=n)break;y.size<g||(o+=y.bytesAt(y.kept-1)-y.bytesAt(y.kept),y.kept-=1)}let a=new Map(r.filter(g=>g.kept<g.size).map(g=>[g.index,g]));if(a.size===0)return{payload:e,bytes:s,cut:null};let d=0,l=0,c=0,p=0,u=e.findings.map((g,y)=>{let _=a.get(y);if(_===void 0)return g;let b=_.cut();return d+=_.size-_.kept,l+=b.calls,c+=b.inputs,p+=b.offGraph,b.finding}),f={...e,findings:u},h=Ve(f);return{payload:f,bytes:h,cut:{budget:n,bytesBefore:s,bytesAfter:h,graphsCut:a.size,functionsCut:d,callsCut:l,inputsCut:c,blockersOffGraph:p,exhausted:h>n}}}function cd(e){let n=0,t=0,s=0,r=0;for(let d of e.findings){d.reach!==null&&(n+=Ve(d.reach));let l=d.influence?.overlay??null;l!==null&&(t+=Ve(l)),d.path!==null&&(s+=Ve(d.path)),r+=Ve(d.unresolvedSites)}let i=0;for(let d of e.advisories)d.details!==null&&(i+=Ve(d.details));let o=Ve(e.findings),a=Ve(e.advisories);return[{name:"the reach graphs",bytes:n},{name:"the influence overlays",bytes:t},{name:"the call paths",bytes:s},{name:"the findings' own unresolved sites",bytes:r},{name:"the rest of the findings",bytes:o-n-t-s-r},{name:"the app-global unresolved sets",bytes:Ve(e.unresolved)},{name:"the advisory descriptions",bytes:i},{name:"the rest of the advisory records",bytes:a-i},{name:"the package graphs",bytes:Ve(e.packageGraphs)}].sort((d,l)=>l.bytes-d.bytes)}function ud(e){let n=e.exhausted?`; every graph is down to its vulnerable function and the payload is still ${String(e.bytesAfter)} bytes`:"";return`the findings payload was ${String(e.bytesBefore)} bytes, over its ${String(e.budget)}-byte budget, so ${String(e.graphsCut)} reach graph(s) were cut nearest the vulnerable function first (ADR-120): ${String(e.functionsCut)} function(s) dropped and counted in each graph's \`truncated\`, with the ${String(e.callsCut)} call(s) that touched them and the ${String(e.inputsCut)} overlay input(s) on them${n}`}function On(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function fd(e,n={}){let t=n.maxBytes??1073741824,s=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((i,o)=>{let a=r(e,n.headers!==void 0?{headers:n.headers}:{},d=>{let l=d.statusCode??0;if(l<200||l>=300){d.resume(),o(new Error(`GET ${e} \u2192 HTTP ${String(l)}`));return}let c=[],p=0;d.on("data",u=>{if(p+=u.length,p>t){d.destroy(),o(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}c.push(u)}),d.on("end",()=>{i(Buffer.concat(c))}),d.on("error",o)});a.on("error",o),a.setTimeout(s,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(s)}ms`))})})}async function Us(e,n,t,s,r,i=3e4){let{request:o}=await import("node:https"),a=new URL(n).hostname;return await new Promise((d,l)=>{let c=o(n,{method:e,headers:t},p=>{let u=[],f=0;p.on("data",h=>{if(f+=h.length,f>r){p.destroy(),l(new Error(`${e} to ${a} returned more than ${String(r)} bytes`));return}u.push(h)}),p.on("end",()=>{d({status:p.statusCode??0,body:Buffer.concat(u).toString("utf8")})}),p.on("error",()=>{l(new Error(`${e} to ${a} failed`))})});c.on("error",()=>{l(new Error(`${e} to ${a} failed`))}),c.setTimeout(i,()=>{c.destroy(new Error(`${e} to ${a} timed out after ${String(i)}ms`))}),s!==void 0&&c.write(s),c.end()})}var qs="api.cupel.sh",uh=`https://${qs}/v1/findings`,fh=64*1024,Ut=8*1024*1024,ph=3e4,Rt=class extends Error{constructor(n){super(n),this.name="PushError"}};async function pd(e,n,t,s={}){if(e.length>Ut)throw new Rt(`findings payload is ${String(e.length)} bytes, over the ${String(Ut)}-byte limit`);let r=On(uh,new Set([qs])),i;try{i=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,s.timeoutMs??ph)}catch{throw new Rt(`the findings push to ${qs} failed`)}if(i.body.length>fh)throw new Rt("the control plane returned a response larger than it should");if(!(i.status===202||i.status===200))throw i.status===401||i.status===403?new Rt("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):i.status===400?new Rt("the control plane rejected the findings payload as malformed"):new Rt(`the findings push was refused with status ${String(i.status)}`)}var mh=13,Ot={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:1024,maxAdvisoryDetails:8e3,maxReachNodes:512,maxReachEdges:2048,maxPackageGraphNodes:256,maxPackageGraphEdges:1024,maxPackageGraphs:2e4,maxSourcePosition:1e7},hh=7.5*1024*1024,tt=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function ii(e){return{path:e.path,start:e.start,end:e.end}}function gh(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new tt(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,s=e.modelPromotedFromKind??null;if(t===null!=(s===null))throw new tt(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new tt(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,symbolContainer:e.symbolContainer,symbolPath:e.symbolPath,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:nd(n),basis:e.basis??null,path:yh(e),unresolvedSites:e.unresolvedEvidence.own.map(ii),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:s,surfaceComplete:e.surfaceComplete??null,reach:_h(e),introducedBy:e.introducedBy??null,influence:e.influence===void 0?null:{value:e.influence.value,kind:e.influence.kind,owner:Fs[e.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null,overlay:e.influenceOverlay??null}}}function md(e){return e===null?null:{line:e.line,column:e.column}}function yh(e){if(e.path===void 0)return null;let n=e.located?.path??null;return n!==null&&n.length===e.path.length?n.map((t,s)=>({functionName:e.path?.[s]?.functionName??null,modulePath:t.modulePath,line:t.line,column:t.column,callSite:md(t.callSite)})):e.path.map(t=>({functionName:t.functionName??null,modulePath:t.modulePath,line:null,column:null,callSite:null}))}function _h(e){let n=e.located?.reach??null;return n===null?null:{nodes:n.nodes.map(t=>({id:t.id,functionName:t.functionName,modulePath:t.modulePath,line:t.line,column:t.column})),edges:n.edges.map(t=>({from:t.from,to:t.to,callSite:md(t.callSite)})),truncated:n.truncated}}var oi="";function hd(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];if(e.ecosystem==="npm")return n.join(oi);let{symbolContainer:t,symbolPath:s}=e;return t===null&&s===null?[...n,e.ecosystem].join(oi):[...n,e.ecosystem,t??"",s??""].join(oi)}function xh(e){let n=new Map;for(let t of e){let s=hd(t),r=n.get(s);if(r===void 0){n.set(s,t);continue}if(r.tier!==t.tier||r.unknownKind!==t.unknownKind)throw new tt(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function bh(e){let n=Ot,t=(s,r,i)=>{throw new tt(`${s} has ${String(r)} entries, over the ${String(i)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let s of["dispatch","load"]){let r=e.unresolved[s].length;r>n.maxUnresolvedSites&&t(`the app-global ${s} set`,r,n.maxUnresolvedSites)}for(let s of e.findings)s.path!==null&&s.path.length>n.maxPathSteps&&t(`the call path of finding ${s.advisoryId}`,s.path.length,n.maxPathSteps),s.reach!==null&&s.reach.nodes.length>n.maxReachNodes&&t(`the reach graph of finding ${s.advisoryId}`,s.reach.nodes.length,n.maxReachNodes),s.reach!==null&&s.reach.edges.length>n.maxReachEdges&&t(`the reach graph's calls of finding ${s.advisoryId}`,s.reach.edges.length,n.maxReachEdges),s.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${s.advisoryId}`,s.unresolvedSites.length,n.maxUnresolvedSites);e.packageGraphs.length>n.maxPackageGraphs&&t("the package graphs list",e.packageGraphs.length,n.maxPackageGraphs);for(let s of e.packageGraphs)s.nodes.length>n.maxPackageGraphNodes&&t(`package graph ${s.id}`,s.nodes.length,n.maxPackageGraphNodes),s.edges.length>n.maxPackageGraphEdges&&t(`the links of package graph ${s.id}`,s.edges.length,n.maxPackageGraphEdges);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let s of e.advisories){if(s.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${s.id}`,s.ranges.length,n.maxAdvisoryRanges),s.summary!==null&&s.summary.length>n.maxStringLength)throw new tt(`the summary of advisory ${s.id} is ${String(s.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(s.details!==null&&s.details.length>n.maxAdvisoryDetails)throw new tt(`the description of advisory ${s.id} is ${String(s.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function Sh(e,n){let t=new Set(n.map(s=>s.advisoryId));return e.advisories.filter(s=>t.has(s.advisory.id)).map(s=>({id:s.advisory.id,cveId:s.advisory.cveId,osvId:s.advisory.osvId,summary:s.advisory.summary,details:s.advisory.details??null,severity:s.advisory.severity,published:s.advisory.published,source:s.advisory.source,ranges:s.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function kh(e,n){let t=new Set(n.flatMap(s=>s.introducedBy===null?[]:[s.introducedBy]));return(e.packageGraphs??[]).filter(s=>t.has(s.id)).map(s=>({id:s.id,nodes:s.nodes.map(r=>({id:r.id,name:r.name,version:r.version,direct:r.direct,declaredIn:r.declaredIn===null?null:{path:r.declaredIn.path,line:r.declaredIn.line}})),edges:s.edges.map(r=>({from:r.from,to:r.to})),truncated:s.truncated}))}function wh(e){if(e.bytes<=Ut)return;let n=o=>`${o.name} (${String(o.bytes)} bytes, ${String(Math.round(100*o.bytes/e.bytes))}%)`,[t,s]=cd(e.payload),r=e.payload.findings.flatMap(o=>o.reach===null?[]:[o.reach]),i=r.length===0?"with no reach graph to cut":r.every(o=>o.nodes.length<=1)?"with every reach graph cut to its vulnerable function":"with its reach graphs as built";throw new tt(`the findings payload is ${String(e.bytes)} bytes, over the ${String(Ut)}-byte limit, ${i} (ADR-120); its largest part is ${t===void 0?"unknown":n(t)}${s===void 0?"":`, then ${n(s)}`}`)}function gd(e,n,t={}){let s=xh(e.findings.map(gh)),r={version:mh,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:s,unresolved:{dispatch:e.unresolved.dispatch.map(ii),load:e.unresolved.load.map(ii)},advisories:Sh(e,s),packageGraphs:kh(e,s)};bh(r);let i=dd(r,t.byteBudget??hh,hd);return i.cut!==null&&t.onCut?.(i.cut),wh(i),i.payload}function yd(e){let n=new Set(e.installed.packages.map(s=>s.ecosystem??"npm")),t=["npm","PyPI"].filter(s=>n.has(s));return t.length===0?"npm":t.join("+")}var di="site-packages:",li=class{#e;#t;#n=new Map;constructor(n,t){this.#e=n,this.#t=t}point(n,t){if(!Number.isInteger(t)||t<0)return null;let s=this.#s(n);if(s===null)return null;let r=(typeof s.text=="string",s.text.length);if(t>r)return null;let i=0,o=s.starts.length-1;for(;i<o;){let p=i+o+1>>1;(s.starts[p]??0)<=t?i=p:o=p-1}let a=s.starts[i]??0,d=typeof s.text=="string"?t-a+1:s.text.subarray(a,t).toString("utf8").length+1,l=i+1,c=Ot.maxSourcePosition;return l>c||d>c?null:{line:l,column:d}}#s(n){let t=this.#n.get(n);if(t!==void 0)return t;let s=this.#e.read(n),r=null;if(s!==null){let i=[0];if(this.#t==="utf8-bytes"){for(let o=0;o<s.length;o+=1)s[o]===10&&i.push(o+1);r={text:s,starts:i}}else{let o=s.toString("utf8");for(let a=0;a<o.length;a+=1)o.charCodeAt(a)===10&&i.push(a+1);r={text:o,starts:i}}}return this.#n.set(n,r),r}},Hs=class{#e;#t;#n;#s;#o;#i;constructor(n,t,s,r){this.#e=n,this.#t=new li(t,s),this.#n=r,this.#s=new Map(n.functions.map(i=>[i.id,i])),this.#o=new Map(n.modules.map(i=>[i.id,i])),this.#i=new Map(n.callSites.map(i=>[i.id,i]))}locate(n){let t=n.path;if(t===void 0||t.length===0)return{path:null,reach:null};let s=t.map((d,l)=>{let c=this.#s.get(d.functionId),p=c===void 0?"":this.#n(c.moduleId),u=c===void 0?null:this.#r(p,c.declRange),f=t[l+1]?.calledAt??null;return{modulePath:ai(p,d.modulePath),line:u?.line??null,column:u?.column??null,callSite:f===null?null:this.#r(p,f)}}),r=t[t.length-1]?.functionId,i=r===void 0?null:Jo(this.#e,r,n.tier==="reachable-medium");if(i===null)return{path:s,reach:null};let o=_d(i),a=new Map(i.functions.slice(0,o).map((d,l)=>[d.functionId,`n${String(l)}`]));return{path:s,reach:this.#a(i),nodeOf:a}}modulePathOf(n){let t=this.#o.get(n);return t===void 0?null:ai(this.#n(n),t.path)}#a(n){let t=_d(n),s=new Map(n.functions.slice(0,t).map((o,a)=>[o.functionId,a])),r=n.functions.slice(0,t).map((o,a)=>{let d=this.#s.get(o.functionId),l=d===void 0?"":this.#n(d.moduleId),c=d===void 0?null:this.#r(l,d.declRange);return{id:`n${String(a)}`,functionName:d?.name??null,modulePath:(d===void 0?null:this.modulePathOf(d.moduleId))??"",line:c?.line??null,column:c?.column??null}}),i=n.edges.flatMap(o=>{let a=s.get(o.from),d=s.get(o.to);if(a===void 0||d===void 0)return[];let l=this.#i.get(o.site),c=this.#s.get(o.from),p=c===void 0?"":this.#n(c.moduleId);return[{from:`n${String(a)}`,to:`n${String(d)}`,callSite:l===void 0?null:this.#r(p,l.range)}]});return{nodes:r,edges:i,truncated:n.functions.length-t}}#r(n,t){return t.path===""||t.path.startsWith(di)?null:this.#t.point(ai(n,t.path),t.start)}};function _d(e){let n=Ot,t=new Map(e.functions.map((o,a)=>[o.functionId,a])),s=new Array(e.functions.length).fill(0);for(let o of e.edges){let a=Math.max(t.get(o.from)??0,t.get(o.to)??0);s[a]=(s[a]??0)+1}let r=0,i=0;for(;i<e.functions.length&&i<n.maxReachNodes;){let o=s[i]??0;if(r+o>n.maxReachEdges)break;r+=o,i+=1}return i}function ai(e,n){return e===""||n===""?n:`${e}/${n}`}function ci(e){let n=e.filter(t=>t!=="").sort((t,s)=>s.length-t.length);return t=>n.find(s=>t.startsWith(`${s}::`))??""}var vh=512,Eh=2048,Nh=64*1024,Ah=255,Ih=1024,Rh=64,Oh=16,Ph=/^(?:pkg:[^\s\p{Cc}]{1,200}|ecmascript:[A-Za-z0-9_.$]{1,200})$/u;function ui(e){return e.length>0&&e.length<=Ih&&!new RegExp("\\p{Cc}","u").test(e)&&!xd.posix.isAbsolute(e)&&!xd.win32.isAbsolute(e)}function bd(e,n){return{index:us(e),lineOf:t=>At(n,t,"utf16-units")?.startLine??null,pathOf:t=>t.path}}function Sd(e,n,t){let s=new Map(e.modules.map(a=>[a.id,a])),r=(a,d)=>{let l=d.registeredAt;if(l===void 0)return d;let c=a.declRange.path,p=c!==""&&a.moduleId.endsWith(c)?a.moduleId.slice(0,a.moduleId.length-c.length):null,u=p===null?null:`${p}${l.path}`;return u!==null&&s.has(u)?{...d,registeredAt:{...l,path:u}}:{index:d.index,sourceClass:d.sourceClass,model:d.model}},i={...e,functions:e.functions.map(a=>a.sourceParams===void 0?a:{...a,sourceParams:a.sourceParams.map(d=>r(a,d))})},o=a=>a.packageName===""&&!a.id.includes(di);return{index:us(Dr(i)),lineOf:a=>{let d=s.get(a.path);if(d===void 0||!o(d))return null;let l=n.modulePathOf(d.id);return l===null?null:At(t,{...a,path:l},"utf8-bytes")?.startLine??null},pathOf:a=>s.has(a.path)?n.modulePathOf(a.path):null}}function kd(e,n,t,s,r=i=>i.path){let i=0,o=64,a=u=>{let f=Buffer.byteLength(JSON.stringify(u),"utf8")+1;return o+f>Nh?!1:(o+=f,!0)},d=[];for(let[u,f]of t)for(let h of e.functions.get(u)?.sourceParams??[]){if(d.length>=vh||h.index<0||h.index>Ah){i+=1;continue}let g=h.registeredAt,y=g===void 0?null:r(g),_=g===void 0||y===null||!ui(y)?null:s(g),b={node:f,param:h.index,sourceClass:h.sourceClass,model:h.model,registeredAt:y!==null&&_!==null?{path:y,line:_}:null};if(!a(b)){i+=1;continue}d.push(b)}let l=[],c=new Set,p=(e.callers.get(n)??[]).filter(u=>u.direct).map(u=>u.site);for(let u of p.slice(0,Rh)){let f=[],h=Math.min(u.args?.length??1,Oh);for(let g=0;g<h;g+=1)f.push({label:`arg[${String(g)}]`,port:{kind:"arg",index:g}});u.receiverRange!==void 0&&f.push({label:"receiver",port:{kind:"receiver"}});for(let{label:g,port:y}of f)for(let _ of Ds(e,{site:u,port:y}).leaves){if(_.kind!=="unknown"&&_.kind!=="entry-parameter"||_.class===void 0)continue;let b=_.site??e.functions.get(_.functionId)?.declRange;if(b===void 0||b.path==="")continue;let x=r(b);if(x===null)continue;let k={port:g,node:t.get(_.functionId)??null,path:x,line:ui(x)?s(b):null,class:_.class,owner:"cupel",callee:(_.reason==="opaque-callee"||_.reason==="unresolved-call")&&_.detail!==void 0&&Ph.test(_.detail)?_.detail:null},w=JSON.stringify(k);if(!c.has(w)){if(c.add(w),!ui(x)||l.length>=Eh||!a(k)){i+=1;continue}l.push(k)}}}return{inputs:d,blockers:l,truncated:i}}import{mkdirSync as il,readdirSync as Pp,readFileSync as ew,realpathSync as wr,renameSync as al,statSync as ul,writeFileSync as ll}from"node:fs";import nt from"node:path";import{createRequire as Ch}from"node:module";var Mh=Ch(import.meta.url);function Th(){try{return Mh("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function $h(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var jr={open(e,n){let{DatabaseSync:t}=Th(),s=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?s.exec("PRAGMA query_only = ON;"):s.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>s.exec(r),prepare:r=>$h(s.prepare(r)),close:()=>s.close()}}};var Nd=["data","control","state","call-only","config-only"],Ad=["patch-derived","pov-derived","drafted","reviewed"],Id=["remote-unauthenticated","remote-authenticated","rpc","message","upload","stored","upstream-response","cli","env","file"];var wd="[A-Za-z_$][A-Za-z0-9_$]{0,127}",Lh=new RegExp(`^(?:(?:arg\\[(?:0|[1-9][0-9]{0,2})\\]|receiver)(?:\\.${wd}){0,${String(4)}}|kwarg\\[${wd}\\])$`,"u");function Rd(e){return Lh.test(e)}var fi=(e,n)=>typeof e=="string"&&n.includes(e)?e:null,vd=e=>{if(e==null)return null;if(typeof e!="string"||e.length>4096)return!1;try{return JSON.parse(e),e}catch{return!1}},Ed=e=>e==null?null:typeof e=="string"&&e.length<=4096?e:!1,Br=e=>typeof e=="number"&&Number.isSafeInteger(e)?e:typeof e=="bigint"?Number(e):null;function pi(e){let n=Br(e.id),t=Br(e.vulnerable_symbol_id),s=fi(e.mode,Nd),r=fi(e.provenance,Ad);if(n===null||t===null||s===null||r===null)return null;let i=s==="call-only"||s==="config-only",o=e.port;if(i?o!==null:typeof o!="string"||!Rd(o))return null;let a=e.at_path,d=e.at_start===null?null:Br(e.at_start),l=e.at_end===null?null:Br(e.at_end),c=null;if(a!==null||e.at_start!==null||e.at_end!==null){if(typeof a!="string"||a===""||a.length>4096||d===null||l===null||d<0||l<d)return null;c={path:a,start:d,end:l}}let p;try{p=typeof e.accepted_sources=="string"&&e.accepted_sources.length<=4096?JSON.parse(e.accepted_sources):void 0}catch{return null}if(!Array.isArray(p))return null;let u=[];for(let _ of p){let b=fi(_,Id);if(b===null||u.includes(b))return null;u.push(b)}let f=vd(e.barriers),h=vd(e.trigger_predicate),g=Ed(e.evidence_ref),y=Ed(e.reviewer);return f===!1||h===!1||g===!1||y===!1||r==="reviewed"&&y===null?null:{id:n,vulnerableSymbolId:t,mode:s,port:i?null:o,at:c,acceptedSources:u,barriers:f,triggerPredicate:h,provenance:r,evidenceRef:g,reviewer:y}}function qe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function He(e){return typeof e=="string"?e:null}function st(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Dh=`
+`};import{randomBytes as Ey}from"node:crypto";import{readFileSync as QR,renameSync as ZR,writeFileSync as Ay}from"node:fs";import eO from"node:path";import{fileURLToPath as nO}from"node:url";var Ry=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function ta(e){let n=0;for(;n<e.length-1&&e.charCodeAt(n)===48;)n+=1;return e.slice(n)}function Oy(e){let n=la(e,!1);if(n!==null)return{kind:"npm",...n};let t=Ry.exec(e);return t===null?null:{kind:"npm",major:ta(t[1]??""),minor:ta(t[2]??""),patch:ta(t[3]??""),prerelease:"",build:""}}var Py=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,Cy={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function Bs(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function My(e){let n=Py.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,s=(t.release??"").split(".");if(s.length===0||s.length>32)return null;let r=[];for(let c of s){let f=Bs(c);if(f===null)return null;r.push(f)}let o=0;if(t.epoch!==void 0){let c=Bs(t.epoch);if(c===null)return null;o=c}let i=null;if(t.preL!==void 0){let c=t.preN===void 0?0:Bs(t.preN);if(c===null)return null;i=[Cy[t.preL]??t.preL,c]}let a=null;if(t.postImplicit!==void 0){let c=Bs(t.postImplicit);if(c===null)return null;a=c}else if(t.postL!==void 0){let c=t.postN===void 0?0:Bs(t.postN);if(c===null)return null;a=c}let l=null;if(t.devL!==void 0){let c=t.devN===void 0?0:Bs(t.devN);if(c===null)return null;l=c}let d=t.local===void 0?null:t.local.split(/[-_.]/u).map(c=>/^[0-9]+$/u.test(c)?Number(c):c);return{kind:"PyPI",epoch:o,release:r,pre:i,post:a,dev:l,local:d}}function Gs(e,n){return e===n?0:e<n?-1:1}function vc(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function Ty(e,n){let t=vc(e),s=vc(n),r=Math.max(t.length,s.length);for(let o=0;o<r;o+=1){let i=Gs(t[o]??0,s[o]??0);if(i!==0)return i}return 0}function Ec(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function $y(e,n){let t=Ec(e),s=Ec(n);return t!==s?t<s?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:Gs(e.pre[1],n.pre[1])}function Ly(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:Gs(e,n)}function Dy(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:Gs(e,n)}function Fy(e,n){let t=typeof e=="number",s=typeof n=="number";return t&&s?Gs(e,n):!t&&!s?e===n?0:e<n?-1:1:t?1:-1}function jy(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let s=0;s<t;s+=1){let r=e[s],o=n[s];if(r===void 0)return-1;if(o===void 0)return 1;let i=Fy(r,o);if(i!==0)return i}return 0}function By(e,n){let t=Gs(e.epoch,n.epoch);if(t!==0)return t;let s=Ty(e.release,n.release);if(s!==0)return s;let r=$y(e,n);if(r!==0)return r;let o=Ly(e.post,n.post);if(o!==0)return o;let i=Dy(e.dev,n.dev);return i!==0?i:jy(e.local,n.local)}var vo=46;function ia(e,n){let t=e.charCodeAt(n);return t>=48&&t<=57}function Nc(e,n){let t=e.charCodeAt(n);return t>=48&&t<=57||t>=65&&t<=90||t>=97&&t<=122||t===45}function aa(e){for(let n=0;n<e.length;n+=1)if(!ia(e,n))return!1;return!0}function Ac(e){return e.length>1&&e.startsWith("0")&&aa(e)}function sa(e){if(e.length===0||!ia(e,0))return null;let n=1;for(;n<e.length&&ia(e,n);)n+=1;return e.startsWith("0")&&n!==1?null:[e.slice(0,n),e.slice(n)]}function Gy(e){if(!e.startsWith("-"))return null;let n=1,t=1;for(;n<e.length&&e[n]!=="+";){if(!Nc(e,n)&&e.charCodeAt(n)!==vo)return null;if(e.charCodeAt(n)===vo){if(t===n||Ac(e.slice(t,n)))return null;t=n+1}n+=1}return t===n||Ac(e.slice(t,n))?null:[e.slice(0,n),e.slice(n)]}function Ky(e){if(!e.startsWith("+"))return null;let n=1,t=1;for(;n<e.length;){if(!Nc(e,n)&&e.charCodeAt(n)!==vo)return null;if(e.charCodeAt(n)===vo){if(t===n)return null;t=n+1}n+=1}return t===n?null:[e.slice(0,n),e.slice(n)]}function la(e,n){let t=sa(e);if(t===null)return null;let[s,r]=t;if(r==="")return n?{major:s,minor:"0",patch:"0",prerelease:"",build:""}:null;if(!r.startsWith("."))return null;let o=sa(r.slice(1));if(o===null)return null;let[i,a]=o;if(a==="")return n?{major:s,minor:i,patch:"0",prerelease:"",build:""}:null;if(!a.startsWith("."))return null;let l=sa(a.slice(1));if(l===null)return null;let[d,c]=l,f=c,p="",u="";if(f.startsWith("-")){let m=Gy(f);if(m===null)return null;[p,f]=m}if(f.startsWith("+")){let m=Ky(f);if(m===null)return null;[u,f]=m}return f!==""?null:{major:s,minor:i,patch:d,prerelease:p,build:u}}function zy(e){let n=la(e.startsWith("v")?e.slice(1):e,!0);return n===null?null:{kind:"Go",...n}}function Wy(e){let n=la(e,!1);return n===null?null:{kind:"crates.io",...n}}function ra(e,n){return e===n?0:e.length!==n.length?e.length<n.length?-1:1:e<n?-1:1}function Ic(e){let n=e.indexOf(".");return n<0?[e,""]:[e.slice(0,n),e.slice(n)]}function Uy(e,n){if(e===n)return 0;if(e==="")return 1;if(n==="")return-1;let t=e,s=n;for(;t!==""&&s!=="";){let[r,o]=Ic(t.slice(1)),[i,a]=Ic(s.slice(1));if(t=o,s=a,r!==i){let l=aa(r),d=aa(i);return l!==d?l?-1:1:l&&r.length!==i.length?r.length<i.length?-1:1:r<i?-1:1}}return t===""?-1:1}function oa(e,n){return ra(e.major,n.major)||ra(e.minor,n.minor)||ra(e.patch,n.patch)||Uy(e.prerelease,n.prerelease)}function Hy(e,n){return e==="npm"?Oy(n):e==="PyPI"?My(n):e==="crates.io"?Wy(n):zy(n)}function qy(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=Hy(e,n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function _r(e,n){let t=qy(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function wo(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return oa(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return By(e.parsed,n.parsed);if(e.parsed.kind==="Go"&&n.parsed.kind==="Go"||e.parsed.kind==="crates.io"&&n.parsed.kind==="crates.io")return oa(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function Rc(e,n,t){let s=_r(e,n);return!(t.introduced!=="0"&&wo(s,_r(e,t.introduced))<0||t.fixed!==void 0&&wo(s,_r(e,t.fixed))>=0||t.lastAffected!==void 0&&wo(s,_r(e,t.lastAffected))>0)}var da=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function $t(e,n){return Rc(n.ecosystem??"npm",e,n)}function Eo(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),r=new Map(e.classes.map(a=>[a.id,a.name])),o=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution==="unresolved")continue;let l=o.get(a.callSiteId);if(l===void 0)continue;let d=s.get(l.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let c=n.get(d.moduleId);if(c===void 0)continue;let f=s.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==c.packageName&&i.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:a.resolution})}return i}function Vy(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,s)=>t.analyzedVersion<s.analyzedVersion?1:t.analyzedVersion>s.analyzedVersion?-1:0)}function Xy(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Oc(e,n,t,s,r,o){if(o<=0)return null;let i=null,a=l=>{(i===null||l.hops<i.hops)&&(i=l)};for(let l of Vy(e,n))for(let d of l.edges){if(d.entryExport!==t||d.entryContainer!==s)continue;if(Xy(d,r,l.packageName)){a({viaPackages:[],hops:d.hops,provenance:{tool:l.tool,toolVersion:l.toolVersion,analyzedVersion:l.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let c=Oc(e,d.target.calleePackage,d.target.calleeExport,null,r,o-1);c!==null&&a({viaPackages:[d.target.calleePackage,...c.viaPackages],hops:d.hops+c.hops,provenance:c.provenance})}return i}function ca(e,n,t,s,r,o){let i=null;for(let a of Eo(e,n,t)){let l=Oc(r,a.packageName,a.exportName,a.container,s,o);l!==null&&(i===null||l.hops<i.totalHops)&&(i={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:l.viaPackages,totalHops:l.hops,provenance:l.provenance})}return i}function Ao(e,n){let{args:t,convention:s}=e,r=n.params;if(t===void 0||s===void 0||r===void 0)return{known:!1,reason:"not-emitted"};if(s==="unknown")return{known:!1,reason:"convention"};if(n.reflectiveArguments===!0)return{known:!1,reason:"reflective-arguments"};if(s==="shifted"&&t[0]?.spread!==void 0&&t[0].spread!==!1)return{known:!1,reason:"convention"};let o=s==="shifted"?t.slice(1):t,i=[...r].sort((_,S)=>_.index-S.index),a=i.filter(_=>_.kind==="positional"),l=i.find(_=>_.kind==="rest"),d=i.find(_=>_.kind==="keyword-rest"),c=new Map,f=(_,S)=>{let k=c.get(_);k!=="unknown"&&c.set(_,[...k??[],S])},p=_=>{_!==void 0&&c.set(_,"unknown")},u=[],m=0,g=!1,y=!1;for(let _ of o){if(_.spread==="positional"){g=!0;for(let k of a.slice(m))p(k);p(l);continue}if(_.spread==="keyword"){y=!0;for(let k of i)(k.kind==="positional"||k.kind==="keyword-only")&&!c.has(k)&&p(k);p(d);continue}if(_.keyword!==void 0){let k=i.find(v=>v.name===_.keyword&&(v.kind==="positional"||v.kind==="keyword-only"));k!==void 0?c.has(k)?p(k):f(k,_.index):d!==void 0?f(d,_.index):u.push(_.index);continue}if(g){for(let k of a.slice(m))p(k);p(l);continue}let S=a[m];S!==void 0?f(S,_.index):l!==void 0?f(l,_.index):u.push(_.index),m+=1}return{known:!0,params:i.map(_=>{let S=c.get(_);return S==="unknown"?{kind:"unknown"}:S!==void 0?{kind:"args",argIndexes:S}:y&&(_.kind==="positional"||_.kind==="keyword-only")?{kind:"unknown"}:_.kind==="rest"||_.kind==="keyword-rest"?{kind:"args",argIndexes:[]}:{kind:"absent"}}),receiver:Yy(e,n),unbound:u}}function Yy(e,n){if(n.receiver===void 0)return"unknown";if(n.receiver!=="call")return"none";switch(e.convention){case"construct":return"fresh";case"shifted":return(e.args?.length??0)>0?"first-argument":"none";case"direct":return e.receiverRange!==void 0?"receiver-expression":"none";default:return"unknown"}}var ua=["builtin-call","host-lib-call","primitive-mutation","dependency-boundary","app-unresolved","untyped-call","dependency-callee","app-callee","module-binding","global","free-name","construct","opaque","unregistered-entry","binding","not-emitted","analysis-cap"],Pc=2e4,Jy=4,nt=(e,n)=>`${String(e)}-${String(n)}`,Io=e=>{switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${nt(e.at,e.end)}`;case"argument":return`a${nt(e.at,e.end)}:${String(e.index)}`;case"call-receiver":return`r${nt(e.at,e.end)}`;case"mutated-by-call":return`m${nt(e.at,e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"shared":return`h${String(e.id)}`;default:return e.kind}};function Qy(e){if(e.kind==="entry-parameter")return"unregistered-entry";if(e.kind==="unknown")switch(e.reason){case"binding":return"binding";case"not-emitted":return"not-emitted";case"analysis-cap":return"analysis-cap";case"opaque":return e.detail==="construct"?"construct":"opaque";default:return}}function Ks(e){let n=new Map(e.functions.map(c=>[c.id,c])),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map;for(let c of e.functions){if(c.valueFlows===void 0)continue;let f=new Map;for(let p of c.valueFlows){let u=Io(p.to),m=f.get(u);m===void 0?f.set(u,[p]):m.push(p)}s.set(c.id,f)}let r=new Map,o=new Map,i=0;for(let c of e.callSites){let f=`${c.range.path}\0${nt(c.range.start,c.range.end)}`;r.has(f)&&(i+=1),r.set(f,c),o.set(c.id,c)}let a=new Map,l=new Map,d=(c,f,p)=>{let u=c.get(f)??[];u.includes(p)||u.push(p),c.set(f,u)};for(let c of e.callEdges){let f=o.get(c.callSiteId);if(f===void 0)continue;let p=c.invocation==="direct";p&&d(a,f.id,c.calleeFunctionId);let u=l.get(c.calleeFunctionId)??[],m=u.find(g=>g.site===f);m===void 0?u.push({site:f,direct:p}):p&&(m.direct=!0),l.set(c.calleeFunctionId,u)}return{functions:n,modules:t,into:s,siteAt:r,identityCollisions:i,callees:a,callers:l}}function Zy(e,n){let{args:t,convention:s}=e;if(t===void 0||s===void 0||s!=="direct"&&s!=="construct")return"unknown";for(let r=0;r<=n&&r<t.length;r+=1){let o=t[r];if(o===void 0||o.spread!==!1||o.keyword!==void 0)return"unknown"}return n<t.length?n:"absent"}var Cc=e=>[...e.params??[]].sort((n,t)=>n.index-t.index);function eb(e,n,t){if(n===-1)return e.receiver==="receiver-expression"?{kind:"receiver"}:e.receiver==="unknown"?"unknown":null;if(e.receiver==="first-argument"&&n===0)return{kind:"receiver"};let s=e.params.findIndex(r=>r.kind==="args"&&r.argIndexes.includes(n));if(s>=0){let r=Cc(t)[s];return r!==void 0?{kind:"param",index:r.index}:"unknown"}return e.unbound.includes(n)?null:"unknown"}function Sr(e,n){let t=new Map,s=E=>{let N=E.class??Qy(E),A=E.site===void 0?"":`${E.site.path}:${String(E.site.start)}-${String(E.site.end)}`;t.set(`${E.kind}|${E.functionId}|${E.reason??""}|${E.detail??""}|${A}|${E.via??""}`,N===void 0?E:{...E,class:N})},r=new Map,o=E=>{r.set(`${E.site.path}:${String(E.site.start)}-${String(E.site.end)}|${E.reason}`,E)},i=(E,N)=>{if(N.kind==="receiver")return E.receiverPrimitive===!0;let A=E.args??[];return N.kind==="arg"?A[N.index]?.primitive===!0:A.slice(N.index).every(U=>U.primitive===!0)},a=(E,N,A,U)=>{let $=N.range.start,W=N.range.end,w=nt($,W),P=N.args,j=P!==void 0&&P.every(Q=>Q.spread===!1&&Q.keyword===void 0),F=P!==void 0&&!j&&P.every(Q=>Q.spread===!1)&&P.some(Q=>Q.keyword!==void 0),B=F?P.findIndex(Q=>Q.keyword!==void 0):Number.POSITIVE_INFINITY,ne=(Q,Z)=>Z===-1?Q.kind==="receiver":Z<B?Q.kind==="arg"&&Q.index===Z||Q.kind==="args-from"&&Z>=Q.index:Q.kind==="args-from"||Q.kind==="arg"&&Q.index>=B,X=U.kind==="call-result"?A.result:A.mutates.filter(Q=>ne(Q.into,U.index)).flatMap(Q=>Q.from);for(let Q of X){if(Q.kind==="receiver"){N.receiverRange!==void 0&&y({fn:E.fn,ref:{kind:"call-receiver",at:$,end:W},stack:E.stack,tracing:w});continue}if(P===void 0||!j&&!F){s({kind:"unknown",functionId:E.fn,reason:"binding",detail:"summary input",site:N.range});continue}let[Z,x]=Q.kind==="arg"&&Q.index<B?[Q.index,Math.min(Q.index+1,P.length)]:[Math.min(Q.index,B),P.length];for(let T=Z;T<x;T+=1)y({fn:E.fn,ref:{kind:"argument",at:$,end:W,index:T},stack:E.stack,tracing:w})}A.reviewed!==!0&&o({site:N.range,id:A.id,reason:"unreviewed-summary"}),(A.callsProgram??[]).some(Q=>!i(N,Q))&&o({site:N.range,id:A.id,reason:"calls-program"})},l=(E,N,A,U)=>{if(N.kind==="mutated-by-call"&&N.index>=0&&E.args?.[N.index]?.primitive===!0)return"primitive-mutation";if(A!==null){let $=e.modules.get(A.moduleId),W=e.modules.get(U.moduleId);return $===void 0?"not-emitted":$.externalSurface===!0||$.packageName!==W?.packageName?"dependency-callee":"app-callee"}switch(E.calleeDecl){case"ecmascript":case"runtime":return"builtin-call";case"host-lib":return"host-lib-call";case"dependency":return"dependency-boundary";case"app":return"app-unresolved";default:return"untyped-call"}},d=new Set,c=[],f=new Map,p=null,u,m=E=>`${E.fn}\0${Io(E.ref)}\0${E.stack.map(N=>N.id).join(",")}\0${String(E.tracing??"")}`,g=E=>{if(u!==void 0)return;let N=[{functionId:E.fn,ref:E.ref}];for(let A=p;A!==null;){let U=f.get(A);if(U===void 0)break;N.push({functionId:U.state.fn,ref:U.state.ref}),A=U.key}u=N},y=E=>{let N=m(E);d.has(N)||(d.add(N),f.set(N,{key:p,state:E}),c.push(E))},b=n.site.enclosingFunctionId,_=n.site.range.start,S=n.site.range.end;if(n.port.kind==="receiver")y({fn:b,ref:{kind:"call-receiver",at:_,end:S},stack:[],tracing:nt(_,S)});else{let E=Zy(n.site,n.port.index);E==="unknown"?s({kind:"unknown",functionId:b,reason:"binding"}):E==="absent"?s({kind:"constant",functionId:b,detail:"no argument"}):y({fn:b,ref:{kind:"argument",at:_,end:S,index:E},stack:[],tracing:nt(_,S)})}let k=0;for(;c.length>0;){if(k+=1,k>Pc){s({kind:"unknown",functionId:b,reason:"analysis-cap"});break}let E=c.pop();p=m(E);let N=e.into.get(E.fn),A=e.functions.get(E.fn);if(N===void 0||A===void 0){s({kind:"unknown",functionId:E.fn,reason:"not-emitted"});continue}let U=N.get(Io(E.ref));if(U!==void 0&&U.length>0){for(let W of U)E.tracing!==void 0&&W.from.kind==="mutated-by-call"&&nt(W.from.at,W.from.end)===E.tracing&&e.siteAt.get(`${A.declRange.path}\0${E.tracing}`)?.repeats===!1||y({...E,ref:W.from});if(E.ref.kind!=="param"&&E.ref.kind!=="receiver"&&E.ref.kind!=="call-result"&&E.ref.kind!=="mutated-by-call"&&E.ref.kind!=="free")continue}let $=E.ref;switch($.kind){case"constant":s({kind:"constant",functionId:E.fn});break;case"opaque":s({kind:"unknown",functionId:E.fn,reason:"opaque",detail:$.reason});break;case"source":s({kind:"source",functionId:E.fn,sourceClass:$.sourceClass,model:$.model}),g(E);break;case"free":s({kind:"unknown",functionId:E.fn,reason:"free",detail:$.name,class:$.binding==="module"?"module-binding":$.binding==="global"?"global":"free-name"});break;case"local":case"return":(U===void 0||U.length===0)&&s({kind:"constant",functionId:E.fn,detail:"undefined"});break;case"param":case"receiver":{let W=$.kind==="param"?A.sourceParams?.find(B=>B.index===$.index):void 0;W!==void 0&&(s({kind:"source",functionId:E.fn,sourceClass:W.sourceClass,model:W.model}),g(E));let w=E.stack[E.stack.length-1],P=w!==void 0?[{site:w,direct:!0}]:e.callers.get(E.fn)??[],j=W!==void 0?P.filter(B=>B.direct&&B.site.args!==void 0):P;if(W!==void 0&&j.length===0)break;let F=w!==void 0?E.stack.slice(0,-1):[];if(j.length===0){s({kind:"entry-parameter",functionId:E.fn,detail:$.kind==="param"?`param ${String($.index)}`:"receiver"});break}for(let{site:B,direct:ne}of j){if(!ne){s({kind:"unknown",functionId:B.enclosingFunctionId,reason:"binding",detail:"callback"});continue}let X=Ao(B,A);if(!X.known){s({kind:"unknown",functionId:B.enclosingFunctionId,reason:"binding",detail:X.reason});continue}let Q=B.range.start,Z=B.range.end,x=nt(Q,Z),T=B.enclosingFunctionId;if($.kind==="receiver"){X.receiver==="receiver-expression"?y({fn:T,ref:{kind:"call-receiver",at:Q,end:Z},stack:F,tracing:x}):X.receiver==="first-argument"?y({fn:T,ref:{kind:"argument",at:Q,end:Z,index:0},stack:F,tracing:x}):X.receiver==="none"?s({kind:"constant",functionId:T,detail:"no receiver"}):s({kind:"unknown",functionId:T,reason:"binding",detail:`receiver ${X.receiver}`});continue}let q=Cc(A).findIndex(z=>z.index===$.index),G=X.params[q];if(G===void 0||G.kind==="unknown")s({kind:"unknown",functionId:T,reason:"binding"});else if(G.kind==="absent")(U===void 0||U.length===0)&&s({kind:"constant",functionId:E.fn,detail:"no argument"});else for(let z of G.argIndexes)y({fn:T,ref:{kind:"argument",at:Q,end:Z,index:z},stack:F,tracing:x})}break}case"call-result":case"mutated-by-call":{let W=e.siteAt.get(`${A.declRange.path}\0${nt($.at,$.end)}`);if(W===void 0){s({kind:"unknown",functionId:E.fn,reason:"unresolved-call",detail:"no call site at offset",class:"not-emitted"});break}let w=e.callees.get(W.id)??[];if(w.length===0&&W.summary!==void 0){a(E,W,W.summary,$);break}if(w.length===0){s({kind:"unknown",functionId:E.fn,reason:"unresolved-call",...W.runtimeId!==void 0?{detail:W.runtimeId}:{},site:W.range,via:$.kind==="call-result"?"result":"mutation",class:l(W,$,null,A)});break}let P=E.stack.length>=Jy?[]:[...E.stack,W];for(let j of w){let F=e.functions.get(j);if(F===void 0||!e.into.has(j)){s({kind:"unknown",functionId:E.fn,reason:"opaque-callee",detail:j,site:W.range,via:$.kind==="call-result"?"result":"mutation",class:F===void 0?"not-emitted":l(W,$,F,A)});continue}if($.kind==="call-result"){y({fn:j,ref:{kind:"return"},stack:P});continue}let B=Ao(W,F);if(!B.known){s({kind:"unknown",functionId:E.fn,reason:"binding",detail:B.reason});continue}let ne=eb(B,$.index,F);if(ne==="unknown"){s({kind:"unknown",functionId:E.fn,reason:"binding",detail:"mutation target",site:W.range});continue}if(ne===null)continue;let X=(e.into.get(j)?.get(Io(ne))??[]).filter(Q=>Q.kind==="field"||Q.kind==="mutation");for(let Q of X)y({fn:j,ref:Q.from,stack:P})}break}case"argument":case"call-receiver":(U===void 0||U.length===0)&&s({kind:"unknown",functionId:E.fn,reason:"not-emitted",detail:"no flow into the argument"});break}}let v=[...t.values()],I=[...r.values()];return{outcome:v.some(E=>E.kind==="source")?"influenced":v.some(E=>E.kind==="unknown")||I.length>0?"unknown":v.some(E=>E.kind==="entry-parameter")?"reaches-entry-parameter":"no-source-reached",leaves:v,caveats:I,visited:d.size,...u!==void 0?{witness:u}:{}}}var xr={"no-contract":"cupel","no-source-model":"cupel","control-influence-unsupported":"cupel","analysis-cap":"cupel"};function fa(e){if(pa.includes(e))return{value:"unknown",kind:"no-contract"}}function kr(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"name-match":return"reachable-low";case"modeled":return"reachable-low"}}function zs(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function No(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let r=t.get(s.importId);if(r===void 0)continue;let o=n.get(r.moduleId)??[];o.push(s.resolvedModuleId),n.set(r.moduleId,o)}return n}function nb(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let r=t.get(s.importId);if(r===void 0)continue;let o=n.get(s.resolvedModuleId)??[];o.push(r.moduleId),n.set(s.resolvedModuleId,o)}return n}function tt(e){let n=No(e),t=new Set,s=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;s.length>0;){let r=s.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let o of n.get(r)??[])t.has(o)||s.push(o)}}return t}function tb(e,n){let t=nb(e),s=new Set,r=[n];for(;r.length>0;){let o=r.pop();if(!(o===void 0||s.has(o))){s.add(o);for(let i of t.get(o)??[])s.has(i)||r.push(i)}}return s}function sb(e,n,t){let s=No(e),r=zs(e),o=new Set,i=[n];for(;i.length>0;){let a=i.pop();if(a===void 0||o.has(a))continue;o.add(a);let l=r.get(a);if(l===void 0||l.externalSurface===!0||t.has(a))return!0;for(let d of s.get(a)??[])o.has(d)||i.push(d)}return!1}function wr(e,n,t,s=new Set){let r=No(e),o=zs(e),i=new Set,a=[],l=[n];for(;l.length>0;){let d=l.pop();if(d===void 0||i.has(d))continue;i.add(d);let c=o.get(d);if(c===void 0){a.push({module:d,kind:"absent"});continue}if(t.has(d)){a.push({module:d,kind:"unbounded"});continue}if(c.externalSurface===!0&&!s.has(d)){a.push({module:d,kind:"surface"});continue}for(let f of r.get(d)??[])i.has(f)||l.push(f)}return a}function Lc(e){let n=new Set(e.modules.filter(i=>i.isEntrypoint).map(i=>i.id)),t=new Map(e.functions.map(i=>[i.id,i])),s=zs(e),r=new Map;for(let i of e.functions)n.has(i.moduleId)&&(i.publicSurfaceReachable||i.name==="<toplevel>")&&r.set(i.id,i);let o=new Map(e.exports.map(i=>[i.id,i]));for(let i of e.exportBindings){if(i.target.kind!=="function")continue;let a=o.get(i.exportId);if(a===void 0||!n.has(a.moduleId))continue;let l=t.get(i.target.functionId);l===void 0||s.get(l.moduleId)?.externalSurface===!0||r.set(l.id,l)}return[...r.values()]}function ma(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),o=r[0]?.startsWith("@")===!0?2:1;return r.slice(o).join("/")}function rb(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let s=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(o=>[o.id,o]));return e.functions.find(o=>{if(o.name!==t.exportName)return!1;let i=n.get(o.moduleId);if(i===void 0||i.packageName!==t.packageName)return!1;if(s){if(o.kind!==t.symbolKind||o.enclosingClassId===void 0||r.get(o.enclosingClassId)?.name!==t.container)return!1}else if(o.kind!=="function"&&o.kind!=="class")return!1;return i.externalSurface===!0?!0:ma(i.path)===t.sourcePath})}function Mc(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&ma(t.path)===n.sourcePath)}function ob(e,n,t){if(!(t.symbolKind!=="function"||t.container!==null))for(let s of e.classes){if(s.name!==t.exportName)continue;let r=n.get(s.moduleId);if(r!==void 0&&r.externalSurface!==!0&&r.packageName===t.packageName&&ma(r.path)===t.sourcePath)return r}}function ib(e,n,t,s){let r=new Map(e.functions.map(o=>[o.id,o]));return e.callSites.some(o=>o.calleeExprShape!=="member"||o.resolution!=="resolved"?!1:o.resolvedTargetIds.some(i=>{let a=r.get(i);if(a?.name!==s.exportName)return!1;let l=n.get(a.moduleId);return l?.externalSurface===!0&&l.packageName===s.packageName&&t.has(a.moduleId)}))}function ab(e,n,t){return t.container===null?!0:e.classes.some(s=>{if(s.name!==t.container)return!1;let r=n.get(s.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function Dc(e,n){switch(n){case"resolved":return!0;case"field-based":return e!=="all-resolved";case"name-match":return e==="name-match";case"unresolved":return!1}}function lb(e,n,t){let s=new Map(e.callSites.map(f=>[f.id,f.enclosingFunctionId])),r=new Map,o=[],i=f=>{let p=s.get(f.callSiteId);if(p===void 0)return;let u=r.get(p)??[];u.push({to:f.calleeFunctionId,res:f.resolution,site:f.callSiteId}),r.set(p,u)};for(let f of e.callEdges)f.resolution==="name-match"?o.push(f):i(f);for(let f of o)i(f);let a=f=>{let p=new Set,u=n.map(m=>({id:m.id,prev:null,via:null,label:null}));for(let m of u)p.add(m.id);for(;u.length>0;){let m=u.shift();if(m===void 0)break;if(m.id===t){let g=[],y=[],b=[];for(let _=m;_!==null;_=_.prev)g.unshift(_.id),y.unshift(_.via),b.unshift(_.label);return{path:g,via:y,labels:b}}for(let g of r.get(m.id)??[])g.res==="unresolved"||!Dc(f,g.res)||p.has(g.to)||(p.add(g.to),u.push({id:g.to,prev:m,via:g.site,label:g.res}))}return null},l=a("all-resolved");if(l!==null)return{...l,quality:"all-resolved"};let d=a("field-based");if(d!==null)return{...d,quality:"field-based"};if(o.length===0)return null;let c=a("name-match");return c!==null?{...c,quality:"name-match"}:null}function ga(e,n,t){let s=new Map(e.callSites.map(y=>[y.id,y.enclosingFunctionId])),r=new Map,o=new Map,i=[],a=(y,b,_)=>{let S=y.get(b);S===void 0?y.set(b,[_]):S.push(_)};for(let y of e.callEdges){if(!Dc(t,y.resolution))continue;let b=s.get(y.callSiteId);if(b===void 0)continue;let _=y.calleeFunctionId;a(r,b,_),a(o,_,b),i.push({from:b,to:_,site:y.callSiteId})}let l=new Set,d=Lc(e).map(y=>y.id);for(let y of d)l.add(y);for(let y=0;y<d.length;y+=1)for(let b of r.get(d[y])??[])l.has(b)||(l.add(b),d.push(b));if(!l.has(n))return null;let c=new Map([[n,0]]),f=[n];for(let y=0;y<f.length;y+=1){let b=f[y],_=(c.get(b)??0)+1;for(let S of o.get(b)??[])c.has(S)||!l.has(S)||(c.set(S,_),f.push(S))}let p=(y,b)=>y<b?-1:y>b?1:0,u=[...c].map(([y,b])=>({functionId:y,distance:b})).sort((y,b)=>y.distance-b.distance||p(y.functionId,b.functionId)),m=new Set,g=i.filter(y=>c.has(y.from)&&c.has(y.to)).filter(y=>{let b=JSON.stringify([y.from,y.to,y.site]);return m.has(b)?!1:(m.add(b),!0)}).sort((y,b)=>p(y.from,b.from)||p(y.to,b.to)||p(y.site,b.site));return{functions:u,edges:g}}function Tc(e,n){let t=new Set,s=[...e];for(let r=s.pop();r!==void 0;r=s.pop())if(!t.has(r)){t.add(r);for(let o of n(r)??[])t.has(o)||s.push(o)}return t}var $c=new WeakMap;function db(e,n){let t=$c.get(n);if(t!==void 0&&t.graph===e)return t.reach;let s=tt(e),r=n.filter(i=>i.reach.kind==="dependency-dispatch"&&s.has(i.source)).map(i=>i.source),o=new Set;if(r.length>0){let i=No(e),a=Tc(r,f=>i.get(f)),l=e.functions.filter(f=>s.has(f.moduleId)&&(a.has(f.moduleId)||f.addressTaken!==!1)).map(f=>f.id),d=new Map(e.callSites.map(f=>[f.id,f.enclosingFunctionId])),c=new Map;for(let f of e.callEdges){if(f.resolution==="unresolved")continue;let p=d.get(f.callSiteId);if(p===void 0)continue;let u=c.get(p);u===void 0?c.set(p,[f.calleeFunctionId]):u.push(f.calleeFunctionId)}o=Tc(l,f=>c.get(f))}return $c.set(n,{graph:e,reach:o}),o}function ha(e){return Fc(e,zs(e),tt(e),jc(e))}function Fc(e,n,t,s){let r=[],o=[],i=new Map(e.functions.map(l=>[l.id,l.moduleId])),a=l=>l!==void 0&&t.has(l)&&s.has(n.get(l)?.packageName??"");for(let l of e.callSites)l.resolution==="unresolved"&&a(i.get(l.enclosingFunctionId))&&r.push(l.range);for(let l of e.imports)!l.specifierIsLiteral&&t.has(l.moduleId)&&o.push({path:n.get(l.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:o}}function jc(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function cb(e,n,t,s){let r=new Map(e.functions.map(a=>[a.id,a])),o=zs(e),i=new Map(e.callSites.map(a=>[a.id,a]));return n.map((a,l)=>{let d=r.get(a),c=d!==void 0?o.get(d.moduleId):void 0,f=t[l];return{functionId:a,functionName:d?.name,modulePath:c?.path??"",calledAt:f==null?null:i.get(f)?.range??null,via:s[l]??null}})}function ya(e){return ub(fb(e))}function ub(e){if(He(e.tier)!==(e.reasonKind!==void 0))throw new Error(`engine invariant: tier ${e.tier} with reasonKind ${String(e.reasonKind)} (a reason kind is set iff the tier is Potentially reachable)`);if(e.reasonKind!==void 0&&yt[e.reasonKind]!==e.tier)throw new Error(`engine invariant: reasonKind ${e.reasonKind} belongs in ${yt[e.reasonKind]}, not ${e.tier}`);return e}function fb(e){let{graph:n,installed:t,range:s,symbol:r,coverage:o}=e,i=[],a={unresolvedSites:i,unresolvedEvidence:{own:i,sets:[]}},l=X=>({unresolvedSites:X,unresolvedEvidence:{own:X,sets:[]}}),d=jc(n),c=new Set;for(let X of e.incompleteness)X.reach.kind==="unbounded"&&c.add(X.source);let f=e.incompleteness.some(X=>X.reach.kind==="assumed-bounded")?"loader-assumption":"complete",p=X=>X==="not-reachable"?f:void 0,u=void 0,m=new Map,g=X=>{let Q=m.get(X);return Q===void 0&&(Q=sb(n,X,c),m.set(X,Q)),Q},y=X=>X.reach.kind==="class-scope"&&r!==null&&r.packageName===X.reach.packageName&&r.container===X.reach.container,b=X=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let Q of da)for(let Z of e.incompleteness)if(Z.cause===Q&&X(Z))return{cause:Z.cause,source:Z.source};return null},_=(X,Q)=>{let Z;return b(x=>x.reach.kind==="unbounded"?!0:x.reach.kind==="class-scope"?y(x):x.reach.kind==="dependency-dispatch"?Q===void 0||db(n,e.incompleteness).has(Q):x.reach.kind==="loaded-package"?(s.ecosystem??"npm")===x.reach.ecosystem:X===void 0||g(x.reach.anchor)?!0:(Z??=tb(n,X),Z.has(x.reach.anchor)))},S=()=>b(X=>X.reach.kind==="unbounded"?!0:X.reach.kind==="class-scope"?y(X):X.reach.kind==="dependency-dispatch"?!1:X.reach.kind==="loaded-package"?(s.ecosystem??"npm")===X.reach.ecosystem&&(X.reach.alsoLoaded?.includes(s.packageName)??!1):g(X.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${s.packageName} is not installed`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-affected"),path:void 0,...a};let k;try{if((t.ecosystem??"npm")!==(s.ecosystem??"npm"))throw new Error("ecosystem mismatch");k=$t(t.version,s)}catch{return{tier:$e("version-undecidable"),decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,reasonKind:"version-undecidable",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a}}if(!k)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${s.packageName}@${t.version} is outside the affected range`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-affected"),path:void 0,...a};let v=zs(n),I=tt(n),O=X=>{if(X.cause!=="dynamic-load"||X.source===null)return i;let Q=v.get(X.source);return Q===void 0?i:[{path:Q.path,start:0,end:0}]},{dispatch:E,load:N}=Fc(n,v,I,d),A=[...E,...N],U={unresolvedSites:N,unresolvedEvidence:{own:i,sets:["load"]}},$={unresolvedSites:A,unresolvedEvidence:{own:i,sets:["dispatch","load"]}},W=X=>{for(let Q of I)if(v.get(Q)?.packageName===X)return!0;return!1},w=X=>({tier:$e("incomplete-surface"),decidedAtStage:X,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,reasonKind:"incomplete-surface",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a}),P=()=>{if(!W(s.packageName)){if(N.length>0)return{tier:$e("dynamic-load"),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,reasonKind:"dynamic-load",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...U};let X=S();return X!==null?{tier:$e(X.cause),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,reasonKind:X.cause,attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...l(O(X))}:t!==null&&t.outOfGraphExecution.length>0?{tier:$e("analysis-cap"),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,reasonKind:"analysis-cap",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${s.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${s.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-reachable"),path:void 0,...a}}return null};if(r===null||!r.verified)return{tier:$e(r===null?"db-gap":"unverified-symbol"),decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",reasonKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};if(o!==null&&!o.comparedPaths.has(r.sourcePath))return{tier:$e("db-gap"),decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,reasonKind:"db-gap",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:$e("symbol-unsupported"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,reasonKind:"symbol-unsupported",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};let j=rb(n,v,r);if(j===void 0||!I.has(j.moduleId)){if(j===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&ib(n,v,I,r))return{tier:$e("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,reasonKind:"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};if(j===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!ab(n,v,r))return{tier:$e("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,reasonKind:"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};if(j===void 0){let x=ob(n,v,r);if(x!==void 0&&I.has(x.id))return{tier:$e(N.length>0?"dynamic-load":"dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a class a loaded module declares, and the graph holds no node for constructing it \u2014 a class cannot be shown unused without one`,reasonKind:N.length>0?"dynamic-load":"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$}}let X=P();if(X!==null)return X;if(A.length>0){let x=j!==void 0?v.get(j.moduleId):Mc(n,r),T=j===void 0&&x!==void 0&&x.externalSurface!==!0&&I.has(x.id)&&!d.has(x.packageName);return{tier:$e(N.length>0?"dynamic-load":T?"dep-opaque":"dispatch"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,reasonKind:N.length>0?"dynamic-load":T?"dep-opaque":"dispatch",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$}}let Q=j!==void 0?v.get(j.moduleId):Mc(n,r);if(j===void 0&&Q!==void 0&&Q.externalSurface!==!0&&I.has(Q.id)&&!d.has(Q.packageName))return{tier:$e("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,reasonKind:"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a};let Z=Q!==void 0?_(Q.id,j?.id):S();return Z!==null?{tier:$e(Z.cause),decidedAtStage:j===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,reasonKind:Z.cause,attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...l(O(Z))}:s.surfaceComplete?{tier:"not-reachable",decidedAtStage:j===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-reachable"),path:void 0,...a}:w(j===void 0?"symbol-reachable":"module-reachable")}let F=j.kind==="class",B=lb(n,Lc(n),j.id);if(B!==null)return{tier:kr(B.quality),decidedAtStage:"call-path-confirmed",reason:F?`${r.exportName} is a class, and a path from an application entrypoint constructs it or a class below it`:`${r.exportName} is called from an application entrypoint`,reasonKind:void 0,attribution:Ro(r),pathQuality:B.quality,basis:p("reachable-high"),path:cb(n,B.path,B.via,B.labels),...a};if(A.length>0)return{tier:$e(N.length>0?"dynamic-load":F?"dep-opaque":"dispatch"),decidedAtStage:"call-path-confirmed",reason:F?`no path constructs the class ${r.exportName}, but unresolved edges exist \u2014 and a class is used by more than its construction`:`no resolved call path to ${r.exportName}, but unresolved edges exist`,reasonKind:N.length>0?"dynamic-load":F?"dep-opaque":"dispatch",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};let ne=_(j.moduleId,j.id);return ne!==null?{tier:$e(ne.cause),decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,reasonKind:ne.cause,attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...l(O(ne))}:s.surfaceComplete?F?{tier:$e("dep-opaque"),decidedAtStage:"call-path-confirmed",reason:`no path constructs the class ${r.exportName}, but a class is also used through subclasses, class attributes and class methods, which the call graph does not enumerate \u2014 cannot confirm it is unused`,reasonKind:"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-reachable"),path:void 0,...a}:w("call-path-confirmed")}function pb(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function mb(e,n,t){let s=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let o=n.get(r.moduleId);if(!(o===void 0||o.packageName!==t.packageName||(r.enclosingClassId!==void 0?s.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function gb(e,n,t){if(n===t)return[];let s=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.callSites.map(l=>[l.id,l])),o=new Map;for(let l of e.callEdges){if(l.resolution==="unresolved")continue;let d=r.get(l.callSiteId);if(d===void 0)continue;let c=d.enclosingFunctionId;if(!s.has(c)||!s.has(l.calleeFunctionId))continue;let f=o.get(c),p={to:l.calleeFunctionId,label:l.resolution};f===void 0?o.set(c,[p]):f.push(p)}let i=new Set([n]),a=[{at:n,labels:[]}];for(let l=0;l<a.length;l++){let d=a[l];for(let c of o.get(d.at)??[]){if(i.has(c.to))continue;let f=[...d.labels,c.label];if(c.to===t)return f;i.add(c.to),a.push({at:c.to,labels:f})}}return null}function vr(e,n,t,s,r){if(r.length===0)return null;let o=Eo(e,n,t);if(o.length===0)return null;let i=mb(e,n,s);for(let a of r){let l=o.filter(c=>c.packageName===a.anchor.packageName&&c.exportName===a.anchor.exportName&&c.container===a.anchor.container),d=l.find(c=>c.resolution==="resolved")??l[0];if(d!==void 0){if(pb(a.callee,s))return{tier:kr("modeled"),pathQuality:"modeled",modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&i!==null){let c=gb(e,a.callee.realFunctionId,i);if(c!==null)return{tier:kr("modeled"),pathQuality:"modeled",modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[d.resolution,"modeled",...c]}}}}return null}var Bc=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Gc=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","potentially-reachable-not-ruled-out","potentially-reachable-not-analysed"],pa=["reachable-high","reachable-medium","reachable-low"],Kc=new Set(pa),ys=["potentially-reachable-not-ruled-out","potentially-reachable-not-analysed"],hb=new Set(ys);function He(e){return hb.has(e)}function Yt(e){return ys.reduce((n,t)=>n+e[t],0)}function Ro(e){return e.verified?"gated":"candidate"}var Er=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],ba=["cupel","project"],Fn={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function zc(e){return Fn[e]}var yt={dispatch:"potentially-reachable-not-ruled-out","dynamic-load":"potentially-reachable-not-ruled-out","dep-opaque":"potentially-reachable-not-ruled-out","no-entrypoint":"potentially-reachable-not-analysed","analyzer-crash":"potentially-reachable-not-analysed","version-undecidable":"potentially-reachable-not-analysed","db-gap":"potentially-reachable-not-analysed","unverified-symbol":"potentially-reachable-not-analysed","symbol-unsupported":"potentially-reachable-not-analysed","resolution-divergence":"potentially-reachable-not-analysed","analysis-cap":"potentially-reachable-not-analysed","coverage-gap":"potentially-reachable-not-analysed","incomplete-surface":"potentially-reachable-not-analysed"};function $e(e){return yt[e]}import{randomBytes as Gd}from"node:crypto";import{performance as hr}from"node:perf_hooks";import au from"node:path";import{closeSync as yb,constants as Wc,fstatSync as bb,openSync as _b,readSync as Sb,realpathSync as Uc}from"node:fs";import _a from"node:path";var xb=8*1024*1024;function Ws(e){return e==="PyPI"?"utf8-bytes":"utf16-units"}var Jt=class{#e;#n;#t=new Map;constructor(n,t=xb){this.#n=t;let s;try{s=Uc(n)}catch{s=null}this.#e=s}read(n){let t=this.#t.get(n);if(t!==void 0)return t;let s=this.#s(n);return this.#t.set(n,s),s}#s(n){let t=this.#e;if(t===null||n===""||_a.isAbsolute(n))return null;let s;try{s=Uc(_a.join(t,n))}catch{return null}if(s!==t&&!s.startsWith(`${t}${_a.sep}`))return null;let r;try{r=_b(s,Wc.O_RDONLY|Wc.O_NONBLOCK)}catch{return null}try{let o=bb(r);if(!o.isFile()||o.size>this.#n)return null;let i=Buffer.alloc(o.size),a=0;for(;a<o.size;){let l=Sb(r,i,a,o.size-a,a);if(l===0)break;a+=l}return a===o.size?i:null}catch{return null}finally{yb(r)}}};function Hc(e,n,t){if(!Number.isInteger(n)||n<0)return null;if(t==="utf8-bytes"){if(n>e.length)return null;let i=e.subarray(0,n),a=1;for(let d of i)d===10&&(a+=1);let l=i.lastIndexOf(10)+1;return[a,e.subarray(l,n).toString("utf8").length+1]}let s=e.toString("utf8");if(n>s.length)return null;let r=s.slice(0,n),o=1;for(let i=0;i<r.length;i+=1)r.charCodeAt(i)===10&&(o+=1);return[o,n-(r.lastIndexOf(`
+`)+1)+1]}function Qt(e,n,t){if(n.end<n.start)return null;let s=e.read(n.path);if(s===null)return null;let r=Hc(s,n.start,t),o=Hc(s,n.end,t);return r===null||o===null?null:{startLine:r[0],startColumn:r[1],endLine:o[0],endColumn:o[1]}}var kb="cupel/influence-shadow/2",qc=64,Vc=16,wb=e=>Kc.has(e);function Oo(e){let n=new Map(e.functions.map(t=>[t.id,t.moduleId]));return{...e,functions:e.functions.map(t=>({...t,declRange:{...t.declRange,path:t.moduleId}})),callSites:e.callSites.map(t=>{let s=n.get(t.enclosingFunctionId);return s===void 0?t:{...t,range:{...t.range,path:s}}})}}function Xc(e,n,t,s=()=>null,r=null){let o=t(),i={graph:e,lineOf:s},a={npm:i,PyPI:r},l=new Map,d=_=>{let S=l.get(_);return S===void 0&&(S=Ks(_.graph),l.set(_,S)),S};d(i);let c=Object.fromEntries(ua.map(_=>[_,0])),f=0,p=0,u=_=>S=>{let{site:k,...v}=S;return k===void 0?v:{...v,site:{...k,line:_.lineOf?.(k)??null}}},m={influenced:0,"no-source-reached":0,"reaches-entry-parameter":0,unknown:0},g={},y=0,b=[];for(let _ of n){if(!wb(_.tier))continue;let S={advisoryId:_.advisoryId,packageName:_.packageName,version:_.version,ecosystem:_.ecosystem,symbol:_.symbolName,tier:_.tier},k=_.ecosystem==="npm"||_.ecosystem==="PyPI"?a[_.ecosystem]:null;if(k===null){b.push({...S,skipped:_.ecosystem==="PyPI"?"this scan holds no Python graph to ask":`no front-end emits value flows for ${_.ecosystem}`,sites:[],truncatedSites:!1});continue}let v=d(k),I=u(k),O=_.path?.[_.path.length-1]?.functionId,E=O!==void 0?(v.callers.get(O)??[]).filter(A=>A.direct).map(A=>A.site):[],N=[];for(let A of E.slice(0,qc)){let U=[],$=A.args?.length??1,W=(w,P)=>{let j=Sr(v,{site:A,port:P});y+=1,m[j.outcome]+=1,j.caveats.length>0&&(p+=1);for(let F of j.leaves)F.kind==="unknown"&&F.reason!==void 0&&(g[F.reason]=(g[F.reason]??0)+1),(F.kind==="unknown"||F.kind==="entry-parameter")&&(F.class===void 0?f+=1:c[F.class]+=1);U.push({port:w,outcome:j.outcome,leaves:j.leaves.map(I),caveats:j.caveats,visited:j.visited,...j.witness!==void 0?{witness:j.witness}:{}})};for(let w=0;w<Math.min($,Vc);w+=1)W(`arg[${String(w)}]`,{kind:"arg",index:w});A.receiverRange!==void 0&&W("receiver",{kind:"receiver"}),N.push({path:A.range.path,start:A.range.start,enclosing:A.enclosingFunctionId,ports:U,truncatedArgs:$>Vc})}b.push({...S,sites:N,truncatedSites:E.length>qc})}return{format:kb,findings:b,totals:{findings:b.length,ports:y,byOutcome:m,unknownReasons:g,identityCollisions:[...l.values()].reduce((_,S)=>_+S.identityCollisions,0),byClass:c,unclassified:f,portsWithCaveats:p},wallMs:Math.round((t()-o)*10)/10}}function tn(e){return Buffer.byteLength(JSON.stringify(e),"utf8")}function Po(e,n){return 2+e+Math.max(n-1,0)}function Yc(e){return String(e).length}var Zt=class{#e;constructor(n,t){let s=new Float64Array(n+2);for(let[r,o]of t)s[r+1]=(s[r+1]??0)+o;for(let r=1;r<s.length;r+=1)s[r]=(s[r]??0)+(s[r-1]??0);this.#e=s}below(n){return this.#e[n]??0}},xa=class{index;finding;key;size;kept;#e;#n;#t;#s;#o;#r;#a;#i;#l;#d;#c;#u;#f;constructor(n,t,s,r){this.index=n,this.finding=t,this.key=r,this.size=s.nodes.length,this.kept=s.nodes.length,this.#e=s,this.#n=t.influence?.overlay??null;let o=this.size,i=new Map;s.nodes.forEach((u,m)=>{i.has(u.id)||i.set(u.id,m)}),this.#t=i;let a=u=>i.get(u)??o,l=u=>Math.max(a(u.from),a(u.to));this.#s=new Zt(o,s.nodes.map((u,m)=>[m,tn(u)])),this.#o=new Zt(o,s.edges.map(u=>[l(u),tn(u)])),this.#r=new Zt(o,s.edges.map(u=>[l(u),1])),this.#c=tn({...s,nodes:[],edges:[],truncated:0})-5;let d=this.#n,c=d?.inputs??[];this.#a=new Zt(o,c.map(u=>[a(u.node),tn(u)])),this.#i=new Zt(o,c.map(u=>[a(u.node),1]));let f=0,p=[];for(let u of d?.blockers??[]){let m=tn(u.node===null?u:{...u,node:null});f+=m,u.node!==null&&p.push([a(u.node),tn(u)-m])}this.#l=new Zt(o,p),this.#d=f,this.#u=d===null?0:tn({...d,inputs:[],blockers:[],truncated:0})-5,this.#f=tn(s)+(d===null?0:tn(d))}bytesAt(n){if(n===this.size)return this.#f;let t=this.#c+Po(this.#s.below(n),n)+Po(this.#o.below(n),this.#r.below(n))+Yc(this.#e.truncated+(this.size-n)),s=this.#n;if(s===null)return t;let r=this.#i.below(n);return t+this.#u+Po(this.#a.below(n),r)+Po(this.#d+this.#l.below(n),s.blockers.length)+Yc(s.truncated+(s.inputs.length-r))}cut(){let n=this.kept,t=p=>(this.#t.get(p)??this.size)<n,s=this.#e,r=s.edges.filter(p=>t(p.from)&&t(p.to)),o={...s,nodes:s.nodes.slice(0,n),edges:r,truncated:s.truncated+(this.size-n)},i=this.#n,a=this.finding;if(i===null||a.influence===null)return{finding:{...a,reach:o},calls:s.edges.length-r.length,inputs:0,offGraph:0};let l=i.inputs.filter(p=>t(p.node)),d=0,c=i.blockers.map(p=>p.node===null||t(p.node)?p:(d+=1,{...p,node:null})),f={...i,inputs:l,blockers:c,truncated:i.truncated+(i.inputs.length-l.length)};return{finding:{...a,reach:o,influence:{...a.influence,overlay:f}},calls:s.edges.length-r.length,inputs:i.inputs.length-l.length,offGraph:d}}};function Sa(e,n){return e<n?-1:e>n?1:0}function vb(e,n){return Sa(e.finding.advisoryId,n.finding.advisoryId)||Sa(e.finding.packageName,n.finding.packageName)||Sa(e.key,n.key)}function Jc(e,n,t){let s=tn(e);if(s<=n)return{payload:e,bytes:s,cut:null};let r=e.findings.flatMap((g,y)=>g.reach!==null&&g.reach.nodes.length>1?[new xa(y,g,g.reach,t(g))]:[]);if(r.length===0)return{payload:e,bytes:s,cut:null};r.sort(vb);let o=r.reduce((g,y)=>Math.max(g,y.size),0),i=s;for(let g=o;g>1&&i>n;g-=1)for(let y of r){if(i<=n)break;y.size<g||(i+=y.bytesAt(y.kept-1)-y.bytesAt(y.kept),y.kept-=1)}let a=new Map(r.filter(g=>g.kept<g.size).map(g=>[g.index,g]));if(a.size===0)return{payload:e,bytes:s,cut:null};let l=0,d=0,c=0,f=0,p=e.findings.map((g,y)=>{let b=a.get(y);if(b===void 0)return g;let _=b.cut();return l+=b.size-b.kept,d+=_.calls,c+=_.inputs,f+=_.offGraph,_.finding}),u={...e,findings:p},m=tn(u);return{payload:u,bytes:m,cut:{budget:n,bytesBefore:s,bytesAfter:m,graphsCut:a.size,functionsCut:l,callsCut:d,inputsCut:c,blockersOffGraph:f,exhausted:m>n}}}function Qc(e){let n=0,t=0,s=0,r=0;for(let l of e.findings){l.reach!==null&&(n+=tn(l.reach));let d=l.influence?.overlay??null;d!==null&&(t+=tn(d)),l.path!==null&&(s+=tn(l.path)),r+=tn(l.unresolvedSites)}let o=0;for(let l of e.advisories)l.details!==null&&(o+=tn(l.details));let i=tn(e.findings),a=tn(e.advisories);return[{name:"the reach graphs",bytes:n},{name:"the influence overlays",bytes:t},{name:"the call paths",bytes:s},{name:"the findings' own unresolved sites",bytes:r},{name:"the rest of the findings",bytes:i-n-t-s-r},{name:"the app-global unresolved sets",bytes:tn(e.unresolved)},{name:"the advisory descriptions",bytes:o},{name:"the rest of the advisory records",bytes:a-o},{name:"the package graphs",bytes:tn(e.packageGraphs)}].sort((l,d)=>d.bytes-l.bytes)}function Zc(e){let n=e.exhausted?`; every graph is down to its vulnerable function and the payload is still ${String(e.bytesAfter)} bytes`:"";return`the findings payload was ${String(e.bytesBefore)} bytes, over its ${String(e.budget)}-byte budget, so ${String(e.graphsCut)} reach graph(s) were cut nearest the vulnerable function first (ADR-120): ${String(e.functionsCut)} function(s) dropped and counted in each graph's \`truncated\`, with the ${String(e.callsCut)} call(s) that touched them and the ${String(e.inputsCut)} overlay input(s) on them${n}`}function jn(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function eu(e,n={}){let t=n.maxBytes??1073741824,s=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((o,i)=>{let a=r(e,n.headers!==void 0?{headers:n.headers}:{},l=>{let d=l.statusCode??0;if(d<200||d>=300){l.resume(),i(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let c=[],f=0;l.on("data",p=>{if(f+=p.length,f>t){l.destroy(),i(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}c.push(p)}),l.on("end",()=>{o(Buffer.concat(c))}),l.on("error",i)});a.on("error",i),a.setTimeout(s,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(s)}ms`))})})}async function Ar(e,n,t,s,r,o=3e4){let{request:i}=await import("node:https"),a=new URL(n).hostname;return await new Promise((l,d)=>{let c=i(n,{method:e,headers:t},f=>{let p=[],u=0;f.on("data",m=>{if(u+=m.length,u>r){f.destroy(),d(new Error(`${e} to ${a} returned more than ${String(r)} bytes`));return}p.push(m)}),f.on("end",()=>{l({status:f.statusCode??0,body:Buffer.concat(p).toString("utf8")})}),f.on("error",()=>{d(new Error(`${e} to ${a} failed`))})});c.on("error",()=>{d(new Error(`${e} to ${a} failed`))}),c.setTimeout(o,()=>{c.destroy(new Error(`${e} to ${a} timed out after ${String(o)}ms`))}),s!==void 0&&c.write(s),c.end()})}var Ir="api.cupel.sh",Eb=`https://${Ir}/v1/findings`,Ab=64*1024,bs=8*1024*1024,Ib=3e4,es=class extends Error{constructor(n){super(n),this.name="PushError"}};async function nu(e,n,t,s={}){if(e.length>bs)throw new es(`findings payload is ${String(e.length)} bytes, over the ${String(bs)}-byte limit`);let r=jn(Eb,new Set([Ir])),o;try{o=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,s.timeoutMs??Ib)}catch{throw new es(`the findings push to ${Ir} failed`)}if(o.body.length>Ab)throw new es("the control plane returned a response larger than it should");if(!(o.status===202||o.status===200))throw o.status===401||o.status===403?new es("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):o.status===400?new es("the control plane rejected the findings payload as malformed"):new es(`the findings push was refused with status ${String(o.status)}`)}var Nb=14,ns={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:1024,maxAdvisoryDetails:8e3,maxReachNodes:512,maxReachEdges:2048,maxPackageGraphNodes:256,maxPackageGraphEdges:1024,maxPackageGraphs:2e4,maxSourcePosition:1e7},Rb=7.5*1024*1024,Vn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function wa(e){return{path:e.path,start:e.start,end:e.end}}function Ob(e){let n=He(e.tier);if(n&&e.reasonKind===void 0)throw new Vn(`finding ${e.advisoryId} is ${e.tier} with no reason kind \u2014 a Potentially reachable finding without its kind is a hedge`);if(!n&&e.reasonKind!==void 0)throw new Vn(`finding ${e.advisoryId} is ${e.tier} but carries reason kind ${e.reasonKind} \u2014 only a Potentially reachable finding has one`);if(e.reasonKind!==void 0&&$e(e.reasonKind)!==e.tier)throw new Vn(`finding ${e.advisoryId} is ${e.tier} but its reason kind ${e.reasonKind} puts it in ${$e(e.reasonKind)}`);let t=n?e.reasonKind:null,s=e.modelId??null,r=e.modelPromotedFromKind??null;if(s===null!=(r===null))throw new Vn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(s!==null&&e.tier!=="reachable-low")throw new Vn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,symbolContainer:e.symbolContainer,symbolPath:e.symbolPath,severity:e.severity,tier:e.tier,reason:e.reason,reasonKind:t,reasonOwner:t===null?null:zc(t),basis:e.basis??null,path:Pb(e),unresolvedSites:e.unresolvedEvidence.own.map(wa),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:s,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null,reach:Cb(e),introducedBy:e.introducedBy??null,influence:e.influence===void 0?null:{value:e.influence.value,kind:e.influence.kind,owner:xr[e.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null,overlay:e.influenceOverlay??null}}}function tu(e){return e===null?null:{line:e.line,column:e.column}}function Pb(e){if(e.path===void 0)return null;let n=e.located?.path??null;return n!==null&&n.length===e.path.length?n.map((t,s)=>({functionName:e.path?.[s]?.functionName??null,modulePath:t.modulePath,line:t.line,column:t.column,callSite:tu(t.callSite)})):e.path.map(t=>({functionName:t.functionName??null,modulePath:t.modulePath,line:null,column:null,callSite:null}))}function Cb(e){let n=e.located?.reach??null;return n===null?null:{nodes:n.nodes.map(t=>({id:t.id,functionName:t.functionName,modulePath:t.modulePath,line:t.line,column:t.column})),edges:n.edges.map(t=>({from:t.from,to:t.to,callSite:tu(t.callSite)})),truncated:n.truncated}}var ka="";function su(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];if(e.ecosystem==="npm")return n.join(ka);let{symbolContainer:t,symbolPath:s}=e;return t===null&&s===null?[...n,e.ecosystem].join(ka):[...n,e.ecosystem,t??"",s??""].join(ka)}function Mb(e){let n=new Map;for(let t of e){let s=su(t),r=n.get(s);if(r===void 0){n.set(s,t);continue}if(r.tier!==t.tier||r.reasonKind!==t.reasonKind)throw new Vn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Tb(e){let n=ns,t=(s,r,o)=>{throw new Vn(`${s} has ${String(r)} entries, over the ${String(o)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let s of["dispatch","load"]){let r=e.unresolved[s].length;r>n.maxUnresolvedSites&&t(`the app-global ${s} set`,r,n.maxUnresolvedSites)}for(let s of e.findings)s.path!==null&&s.path.length>n.maxPathSteps&&t(`the call path of finding ${s.advisoryId}`,s.path.length,n.maxPathSteps),s.reach!==null&&s.reach.nodes.length>n.maxReachNodes&&t(`the reach graph of finding ${s.advisoryId}`,s.reach.nodes.length,n.maxReachNodes),s.reach!==null&&s.reach.edges.length>n.maxReachEdges&&t(`the reach graph's calls of finding ${s.advisoryId}`,s.reach.edges.length,n.maxReachEdges),s.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${s.advisoryId}`,s.unresolvedSites.length,n.maxUnresolvedSites);e.packageGraphs.length>n.maxPackageGraphs&&t("the package graphs list",e.packageGraphs.length,n.maxPackageGraphs);for(let s of e.packageGraphs)s.nodes.length>n.maxPackageGraphNodes&&t(`package graph ${s.id}`,s.nodes.length,n.maxPackageGraphNodes),s.edges.length>n.maxPackageGraphEdges&&t(`the links of package graph ${s.id}`,s.edges.length,n.maxPackageGraphEdges);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let s of e.advisories){if(s.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${s.id}`,s.ranges.length,n.maxAdvisoryRanges),s.summary!==null&&s.summary.length>n.maxStringLength)throw new Vn(`the summary of advisory ${s.id} is ${String(s.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(s.details!==null&&s.details.length>n.maxAdvisoryDetails)throw new Vn(`the description of advisory ${s.id} is ${String(s.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function $b(e,n){let t=new Set(n.map(s=>s.advisoryId));return e.advisories.filter(s=>t.has(s.advisory.id)).map(s=>({id:s.advisory.id,cveId:s.advisory.cveId,osvId:s.advisory.osvId,summary:s.advisory.summary,details:s.advisory.details??null,severity:s.advisory.severity,published:s.advisory.published,source:s.advisory.source,ranges:s.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function Lb(e,n){let t=new Set(n.flatMap(s=>s.introducedBy===null?[]:[s.introducedBy]));return(e.packageGraphs??[]).filter(s=>t.has(s.id)).map(s=>({id:s.id,nodes:s.nodes.map(r=>({id:r.id,name:r.name,version:r.version,direct:r.direct,declaredIn:r.declaredIn===null?null:{path:r.declaredIn.path,line:r.declaredIn.line}})),edges:s.edges.map(r=>({from:r.from,to:r.to})),truncated:s.truncated}))}function Db(e){if(e.bytes<=bs)return;let n=i=>`${i.name} (${String(i.bytes)} bytes, ${String(Math.round(100*i.bytes/e.bytes))}%)`,[t,s]=Qc(e.payload),r=e.payload.findings.flatMap(i=>i.reach===null?[]:[i.reach]),o=r.length===0?"with no reach graph to cut":r.every(i=>i.nodes.length<=1)?"with every reach graph cut to its vulnerable function":"with its reach graphs as built";throw new Vn(`the findings payload is ${String(e.bytes)} bytes, over the ${String(bs)}-byte limit, ${o} (ADR-120); its largest part is ${t===void 0?"unknown":n(t)}${s===void 0?"":`, then ${n(s)}`}`)}function ru(e,n,t={}){let s=Mb(e.findings.map(Ob)),r={version:Nb,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:s,unresolved:{dispatch:e.unresolved.dispatch.map(wa),load:e.unresolved.load.map(wa)},advisories:$b(e,s),packageGraphs:Lb(e,s)};Tb(r);let o=Jc(r,t.byteBudget??Rb,su);return o.cut!==null&&t.onCut?.(o.cut),Db(o),o.payload}function ou(e){let n=new Set(e.installed.packages.map(s=>s.ecosystem??"npm")),t=["npm","PyPI","Go"].filter(s=>n.has(s));return t.length===0?"npm":t.join("+")}var Aa="site-packages:",Ea=class{#e;#n;#t=new Map;constructor(n,t){this.#e=n,this.#n=t}point(n,t){if(!Number.isInteger(t)||t<0)return null;let s=this.#s(n);if(s===null)return null;let r=(typeof s.text=="string",s.text.length);if(t>r)return null;let o=0,i=s.starts.length-1;for(;o<i;){let f=o+i+1>>1;(s.starts[f]??0)<=t?o=f:i=f-1}let a=s.starts[o]??0,l=typeof s.text=="string"?t-a+1:s.text.subarray(a,t).toString("utf8").length+1,d=o+1,c=ns.maxSourcePosition;return d>c||l>c?null:{line:d,column:l}}#s(n){let t=this.#t.get(n);if(t!==void 0)return t;let s=this.#e.read(n),r=null;if(s!==null){let o=[0];if(this.#n==="utf8-bytes"){for(let i=0;i<s.length;i+=1)s[i]===10&&o.push(i+1);r={text:s,starts:o}}else{let i=s.toString("utf8");for(let a=0;a<i.length;a+=1)i.charCodeAt(a)===10&&o.push(a+1);r={text:i,starts:o}}}return this.#t.set(n,r),r}},Us=class{#e;#n;#t;#s;#o;#r;constructor(n,t,s,r){this.#e=n,this.#n=new Ea(t,s),this.#t=r,this.#s=new Map(n.functions.map(o=>[o.id,o])),this.#o=new Map(n.modules.map(o=>[o.id,o])),this.#r=new Map(n.callSites.map(o=>[o.id,o]))}locate(n){let t=n.path;if(t===void 0||t.length===0)return{path:null,reach:null};let s=t.map((d,c)=>{let f=this.#s.get(d.functionId),p=f===void 0?"":this.#t(f.moduleId),u=f===void 0?null:this.#i(p,f.declRange),m=t[c+1]?.calledAt??null;return{modulePath:va(p,d.modulePath),line:u?.line??null,column:u?.column??null,callSite:m===null?null:this.#i(p,m)}}),r=t[t.length-1]?.functionId,o=n.pathQuality==="modeled"?void 0:n.pathQuality,i=r===void 0||o===void 0?null:ga(this.#e,r,o);if(i===null)return{path:s,reach:null};let a=iu(i),l=new Map(i.functions.slice(0,a).map((d,c)=>[d.functionId,`n${String(c)}`]));return{path:s,reach:this.#a(i),nodeOf:l}}modulePathOf(n){let t=this.#o.get(n);return t===void 0?null:va(this.#t(n),t.path)}#a(n){let t=iu(n),s=new Map(n.functions.slice(0,t).map((i,a)=>[i.functionId,a])),r=n.functions.slice(0,t).map((i,a)=>{let l=this.#s.get(i.functionId),d=l===void 0?"":this.#t(l.moduleId),c=l===void 0?null:this.#i(d,l.declRange);return{id:`n${String(a)}`,functionName:l?.name??null,modulePath:(l===void 0?null:this.modulePathOf(l.moduleId))??"",line:c?.line??null,column:c?.column??null}}),o=n.edges.flatMap(i=>{let a=s.get(i.from),l=s.get(i.to);if(a===void 0||l===void 0)return[];let d=this.#r.get(i.site),c=this.#s.get(i.from),f=c===void 0?"":this.#t(c.moduleId);return[{from:`n${String(a)}`,to:`n${String(l)}`,callSite:d===void 0?null:this.#i(f,d.range)}]});return{nodes:r,edges:o,truncated:n.functions.length-t}}#i(n,t){return t.path===""||t.path.startsWith(Aa)?null:this.#n.point(va(n,t.path),t.start)}};function iu(e){let n=ns,t=new Map(e.functions.map((i,a)=>[i.functionId,a])),s=new Array(e.functions.length).fill(0);for(let i of e.edges){let a=Math.max(t.get(i.from)??0,t.get(i.to)??0);s[a]=(s[a]??0)+1}let r=0,o=0;for(;o<e.functions.length&&o<n.maxReachNodes;){let i=s[o]??0;if(r+i>n.maxReachEdges)break;r+=i,o+=1}return o}function va(e,n){return e===""||n===""?n:`${e}/${n}`}function Ia(e){let n=e.filter(t=>t!=="").sort((t,s)=>s.length-t.length);return t=>n.find(s=>t.startsWith(`${s}::`))??""}var Fb=512,jb=2048,Bb=64*1024,Gb=255,Kb=1024,zb=64,Wb=16,Ub=/^(?:pkg:[^\s\p{Cc}]{1,200}|ecmascript:[A-Za-z0-9_.$]{1,200})$/u;function Na(e){return e.length>0&&e.length<=Kb&&!new RegExp("\\p{Cc}","u").test(e)&&!au.posix.isAbsolute(e)&&!au.win32.isAbsolute(e)}function lu(e,n){return{index:Ks(e),lineOf:t=>Qt(n,t,"utf16-units")?.startLine??null,pathOf:t=>t.path}}function du(e,n,t){let s=new Map(e.modules.map(a=>[a.id,a])),r=(a,l)=>{let d=l.registeredAt;if(d===void 0)return l;let c=a.declRange.path,f=c!==""&&a.moduleId.endsWith(c)?a.moduleId.slice(0,a.moduleId.length-c.length):null,p=f===null?null:`${f}${d.path}`;return p!==null&&s.has(p)?{...l,registeredAt:{...d,path:p}}:{index:l.index,sourceClass:l.sourceClass,model:l.model}},o={...e,functions:e.functions.map(a=>a.sourceParams===void 0?a:{...a,sourceParams:a.sourceParams.map(l=>r(a,l))})},i=a=>a.packageName===""&&!a.id.includes(Aa);return{index:Ks(Oo(o)),lineOf:a=>{let l=s.get(a.path);if(l===void 0||!i(l))return null;let d=n.modulePathOf(l.id);return d===null?null:Qt(t,{...a,path:d},"utf8-bytes")?.startLine??null},pathOf:a=>s.has(a.path)?n.modulePathOf(a.path):null}}function cu(e,n,t,s,r=o=>o.path){let o=0,i=64,a=p=>{let u=Buffer.byteLength(JSON.stringify(p),"utf8")+1;return i+u>Bb?!1:(i+=u,!0)},l=[];for(let[p,u]of t)for(let m of e.functions.get(p)?.sourceParams??[]){if(l.length>=Fb||m.index<0||m.index>Gb){o+=1;continue}let g=m.registeredAt,y=g===void 0?null:r(g),b=g===void 0||y===null||!Na(y)?null:s(g),_={node:u,param:m.index,sourceClass:m.sourceClass,model:m.model,registeredAt:y!==null&&b!==null?{path:y,line:b}:null};if(!a(_)){o+=1;continue}l.push(_)}let d=[],c=new Set,f=(e.callers.get(n)??[]).filter(p=>p.direct).map(p=>p.site);for(let p of f.slice(0,zb)){let u=[],m=Math.min(p.args?.length??1,Wb);for(let g=0;g<m;g+=1)u.push({label:`arg[${String(g)}]`,port:{kind:"arg",index:g}});p.receiverRange!==void 0&&u.push({label:"receiver",port:{kind:"receiver"}});for(let{label:g,port:y}of u)for(let b of Sr(e,{site:p,port:y}).leaves){if(b.kind!=="unknown"&&b.kind!=="entry-parameter"||b.class===void 0)continue;let _=b.site??e.functions.get(b.functionId)?.declRange;if(_===void 0||_.path==="")continue;let S=r(_);if(S===null)continue;let k={port:g,node:t.get(b.functionId)??null,path:S,line:Na(S)?s(_):null,class:b.class,owner:"cupel",callee:(b.reason==="opaque-callee"||b.reason==="unresolved-call")&&b.detail!==void 0&&Ub.test(b.detail)?b.detail:null},v=JSON.stringify(k);if(!c.has(v)){if(c.add(v),!Na(S)||d.length>=jb||!a(k)){o+=1;continue}d.push(k)}}}return{inputs:l,blockers:d,truncated:o}}import{mkdirSync as Kd,readdirSync as Ah,readFileSync as jI,realpathSync as ho,renameSync as zd,statSync as Vd,writeFileSync as Wd}from"node:fs";import mt from"node:path";import{createRequire as Hb}from"node:module";var qb=Hb(import.meta.url);function Vb(){try{return qb("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function Xb(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Co={open(e,n){let{DatabaseSync:t}=Vb(),s=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?s.exec("PRAGMA query_only = ON;"):s.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>s.exec(r),prepare:r=>Xb(s.prepare(r)),close:()=>s.close()}}};var mu=["data","control","state","call-only","config-only"],gu=["patch-derived","pov-derived","drafted","reviewed"],hu=["remote-unauthenticated","remote-authenticated","rpc","message","upload","stored","upstream-response","cli","env","file"];var uu="[A-Za-z_$][A-Za-z0-9_$]{0,127}",Yb=new RegExp(`^(?:(?:arg\\[(?:0|[1-9][0-9]{0,2})\\]|receiver)(?:\\.${uu}){0,${String(4)}}|kwarg\\[${uu}\\])$`,"u");function yu(e){return Yb.test(e)}var Ra=(e,n)=>typeof e=="string"&&n.includes(e)?e:null,fu=e=>{if(e==null)return null;if(typeof e!="string"||e.length>4096)return!1;try{return JSON.parse(e),e}catch{return!1}},pu=e=>e==null?null:typeof e=="string"&&e.length<=4096?e:!1,Mo=e=>typeof e=="number"&&Number.isSafeInteger(e)?e:typeof e=="bigint"?Number(e):null;function Oa(e){let n=Mo(e.id),t=Mo(e.vulnerable_symbol_id),s=Ra(e.mode,mu),r=Ra(e.provenance,gu);if(n===null||t===null||s===null||r===null)return null;let o=s==="call-only"||s==="config-only",i=e.port;if(o?i!==null:typeof i!="string"||!yu(i))return null;let a=e.at_path,l=e.at_start===null?null:Mo(e.at_start),d=e.at_end===null?null:Mo(e.at_end),c=null;if(a!==null||e.at_start!==null||e.at_end!==null){if(typeof a!="string"||a===""||a.length>4096||l===null||d===null||l<0||d<l)return null;c={path:a,start:l,end:d}}let f;try{f=typeof e.accepted_sources=="string"&&e.accepted_sources.length<=4096?JSON.parse(e.accepted_sources):void 0}catch{return null}if(!Array.isArray(f))return null;let p=[];for(let b of f){let _=Ra(b,hu);if(_===null||p.includes(_))return null;p.push(_)}let u=fu(e.barriers),m=fu(e.trigger_predicate),g=pu(e.evidence_ref),y=pu(e.reviewer);return u===!1||m===!1||g===!1||y===!1||r==="reviewed"&&y===null?null:{id:n,vulnerableSymbolId:t,mode:s,port:o?null:i,at:c,acceptedSources:p,barriers:u,triggerPredicate:m,provenance:r,evidenceRef:g,reviewer:y}}var Nr="8",To=new Set(["vulndb-listed","vulndb-derived"]),bt="8";function Rr(e,n){return/^\d+$/u.test(e)&&Number(e)>=Number(n)}function qe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function Je(e){return typeof e=="string"?e:null}function _t(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Jb=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Fh=`
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Qb=`
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,jh=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
-                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Bh=5,Kh=6;function zh(e){let n=e>=Kh?"a.details":"NULL AS details",t=e>=Bh?"ap.surface_complete":jh;return`${Dh}, ${n}, ${t}${Fh}`}var Uh="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",qh="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Hh="SELECT value FROM ingest_meta WHERE key = 'schema_version'",Wh=7,Gh="SELECT * FROM vulnerability_contract WHERE vulnerable_symbol_id = :id ORDER BY id",Vh="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem",Xh="SELECT value FROM ingest_meta WHERE key = 'population_mode'";function Ws(e,n=jr){let t=n.open(e,"readonly"),s=t.prepare(Hh).get(),r=s!==void 0?qe(s.value):"",i=/^\d+$/u.test(r)?Number(r):0,o=t.prepare(zh(i)),a=t.prepare(Uh),d=t.prepare(qh),l=t.prepare(Vh),c=t.prepare(Xh),p=i>=Wh?t.prepare(Gh):null;return{schemaVersion:r,ecosystems(){return l.all({}).map(u=>qe(u.ecosystem))},populationMode(){let u=c.get();return u===void 0?null:qe(u.value)},advisoriesForPackage(u,f){return o.all({eco:u,name:f}).map(h=>({affected:{id:st(h.ap_id)??0,advisoryId:qe(h.advisory_id),ecosystem:qe(h.ecosystem),packageName:qe(h.package_name),introduced:He(h.introduced),fixed:He(h.fixed),lastAffected:He(h.last_affected),fixCommit:He(h.fix_commit),repoUrl:He(h.repo_url),surfaceComplete:st(h.surface_complete)===1?1:0},advisory:{id:qe(h.a_id),osvId:He(h.osv_id),cveId:He(h.cve_id),summary:He(h.summary),details:He(h.details),severity:He(h.severity),published:He(h.published),source:qe(h.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(u){return a.all({id:u}).map(f=>({id:st(f.id)??0,affectedPackageId:st(f.affected_package_id)??0,exportName:He(f.export_name),symbolKind:qe(f.symbol_kind),matchPattern:He(f.match_pattern),matchGlobs:He(f.match_globs),container:He(f.container),sourcePath:He(f.source_path),declStart:st(f.decl_start),declEnd:st(f.decl_end),astHashBefore:He(f.ast_hash_before),astHashAfter:He(f.ast_hash_after),derivation:qe(f.derivation),confidence:qe(f.confidence),verified:st(f.verified)===1?1:0}))},contractsForSymbol(u){if(p===null)return[];let f=[];for(let h of p.all({id:u})){let g=pi(h);if(g===null||g.vulnerableSymbolId!==u)return"unreadable";f.push(g)}return f},aliasesForSymbol(u){return d.all({id:u}).map(f=>({id:st(f.id)??0,vulnerableSymbolId:st(f.vulnerable_symbol_id)??0,aliasPath:qe(f.alias_path),aliasName:qe(f.alias_name)}))},allModels(){let u;try{u=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
-               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let f=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return u.map(h=>{let g=st(h.id)??0;return{packageName:qe(h.package_name),modelId:qe(h.evidence_ref),introduced:qe(h.introduced),fixedBefore:He(h.fixed_before),evidenceRef:qe(h.evidence_ref),edges:f.all({id:g}).map(y=>({kind:qe(y.kind),anchorExport:qe(y.anchor_export),anchorContainer:He(y.anchor_container),calleePackage:qe(y.callee_package),calleeContainer:He(y.callee_container),calleeExport:qe(y.callee_export)}))}})},close(){t.close()}}}function mi(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let f of e)if(f.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${f.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,s=new Map,r=new Map,i=new Map,o=1,a=(f,h,g,y)=>{let _=`${String(g)}:${String(y)}`,b=f.get(_);if(b!==void 0)return b;let x=o;o+=1,f.set(_,x);let k=e[g];if(k===void 0)throw new Error("unreachable: reader index out of range");return h.set(x,{reader:k,id:y}),x},d=e.map(f=>new Set(f.ecosystems?.()??[])),l=f=>{let h=e.map((g,y)=>y).filter(g=>d[g]?.has(f)===!0);return h.length>0?h:e.map((g,y)=>y).filter(g=>e[g]?.ecosystems===void 0)},c=(f,h)=>({...h,id:a(r,i,f,h.id),affectedPackageId:a(t,s,f,h.affectedPackageId)}),p=e.map((f,h)=>h),u=f=>{let h;for(let g of f){let y=e[g];if(y?.populationMode===void 0)continue;let _=y.populationMode();if(_!=="census")return _;h=_}return h};return{schemaVersion:n.schemaVersion,ecosystems(){let f=new Set;for(let h of d)for(let g of h)f.add(g);return[...f].sort()},populationMode(){return u(p)??null},populationModeFor(f){let h=l(f);return u(h.length>0?h:p)},advisoriesForPackage(f,h){let g=[];for(let y of l(f)){let _=e[y];if(_!==void 0)for(let b of _.advisoriesForPackage(f,h))g.push({...b,affected:{...b.affected,id:a(t,s,y,b.affected.id)}})}return g},symbolsForAffected(f){let h=s.get(f);if(h===void 0)return[];let g=e.indexOf(h.reader);return h.reader.symbolsForAffected(h.id).map(y=>c(g,y))},aliasesForSymbol(f){let h=i.get(f);if(h===void 0)return[];let g=e.indexOf(h.reader);return h.reader.aliasesForSymbol(h.id).map(y=>({...y,vulnerableSymbolId:a(r,i,g,y.vulnerableSymbolId)}))},contractsForSymbol(f){let h=i.get(f);if(h===void 0)return[];let g=h.reader.contractsForSymbol?.(h.id)??[];return g==="unreadable"?g:g.map(y=>({...y,vulnerableSymbolId:f}))},allModels(){return e.flatMap(f=>f.allModels?.()??[])},close(){for(let f of e)f.close()}}}var ps="7";import{realpathSync as bt}from"node:fs";import Tn from"node:path";import{realpathSync as Wt}from"node:fs";import{isBuiltin as Ri}from"node:module";import ln from"node:path";import M from"typescript";function hi(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function We(e){let n=hi(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Pn(e){let n=hi(e);if(n.startsWith("@")){let s=n.indexOf("/");if(s===-1)return n;let r=n.indexOf("/",s+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Od(e){let n=hi(e),t=Pn(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as ng,statSync as gi}from"node:fs";var Pt=16*1024*1024;function ms(e,n){try{let t=gi(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:ng(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function on(e){let n=ms(e,Pt);return n.kind==="ok"?n.text:null}function rt(e){try{return gi(e).isFile()}catch{return!1}}function Pd(e){try{let n=gi(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as tg,realpathSync as xi}from"node:fs";import ve from"node:path";import Kr from"typescript";var Dd=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Sn(e){return Dd.some(([n])=>e.endsWith(n))}function sg(e){for(let[n,t]of Dd)if(e.endsWith(n)){let s=e.slice(0,-n.length);return t.map(r=>s+r)}return[]}var rg=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function Fd(e){if(Sn(e))return e;for(let[n,t]of rg)if(e.endsWith(n)){let s=e.slice(0,-n.length);for(let r of t){let i=s+r;if(rt(i))return i}return e}return e}var bi=[Kr.ModuleKind.CommonJS,Kr.ModuleKind.ESNext],Si=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function Gs(e,n,t,s,r,i){let o=Kr.resolveModuleName(e,n,t,s,void 0,void 0,r).resolvedModule;if(o===void 0)return null;let a=o.resolvedFileName;if(i){for(let d of sg(a))if(rt(d))return d}return a}var jd=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],og=[".js",".json",".node"],ig=["index.js","index.json","index.node"];function zr(e){return!Sn(e)&&jd.some(n=>e.endsWith(n))}function Bd(e){if(rt(e))return e;for(let n of og)if(rt(e+n))return e+n;return null}function Cd(e){for(let n of ig){let t=ve.join(e,n);if(rt(t))return t}return null}var Kd=[".ts",".tsx",".cts",".mts",".jsx"];function ag(e){for(let n of Kd)if(rt(e+n))return e+n;return null}function lg(e){for(let n of Kd){let t=ve.join(e,"index"+n);if(rt(t))return t}return null}function ki(e){let n=on(ve.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let s=ve.join(e,t),r=Bd(s)??Cd(s);if(r!==null)return r}}catch{}return Cd(e)}function zd(e){return Bd(e)??ki(e)??ag(e)??lg(e)}function Ud(e){return zd(e)!==null}function dg(e,n){let t=e.split(ve.sep),s=n.split("/"),r=null;for(let o=t.length-s.length-1;o>=0;o-=1)if(t[o]==="node_modules"&&s.every((a,d)=>t[o+1+d]===a)){r=t.slice(0,o+1+s.length).join(ve.sep);break}if(r===null||r==="")return null;let i=on(ve.join(r,"package.json"));if(i===null)return null;try{let o=JSON.parse(i),a=o.exports,d=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(o.name!==n||d)return null}catch{return null}try{return xi(r)}catch{return null}}function cg(e,n){let t=zd(ve.join(e,n));if(t===null)return null;let s;try{s=xi(t)}catch{return null}let r=e.endsWith(ve.sep)?e:e+ve.sep;return s!==e&&!s.startsWith(r)||Sn(s)||!jd.some(i=>s.endsWith(i))?null:s}function ug(e,n){let t=Od(e);return t===""||t.includes("\0")||t.split("/").some(s=>s===""||s==="."||s===".."||s==="node_modules")?null:cg(n,t)}var qt={kind:"nothing-loads"},yi=8192;function _i(e,n){let t=n.get(e);if(t!==void 0)return t;let s,r=null;try{r=tg(e);let i=new Set,o=!1;for(;;){let a=r.readSync();if(a===null)break;if(i.size>=yi){o=!0;break}i.add(a.name)}s={names:i,truncated:o}}catch{s=null}finally{try{r?.closeSync()}catch{}}return n.set(e,s),s}var fg=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function qd(e){return fg.some(n=>e.length>n.length&&e.endsWith(n))}function Ct(e,n){let t=e.endsWith(ve.sep)?e:e+ve.sep;return n===e||n.startsWith(t)}function Md(e,n){let t;try{t=xi(n)}catch{return{kind:"missing"}}return Ct(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Td(e,n){let t=(n+".").toLowerCase(),s=[];for(let r of e){let i=r.toLowerCase();i.length>t.length&&i.startsWith(t)&&s.push(r)}return s}function pg(e,n,t){let s=ve.dirname(n);if(!Ct(e,s))return null;let r=_i(s,t);if(r===null)return null;let i=ve.basename(n);return r.names.has(i)?i:null}function $d(e,n){let t=e.filter(r=>!qd(r));if(t.length===0)return qt;let s=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${s}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Hd(e,n,t,s){let r=e,i=r.indexOf("?");i!==-1&&(r=r.slice(0,i));let o=r.indexOf("#");if(o!==-1&&(r=r.slice(0,o)),r===""||r.includes("\0"))return qt;let a=ve.resolve(ve.dirname(n),r);if(!Ct(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let d=Md(t,a);if(d.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(d.kind==="ok"){let f=Pd(d.real);if(f==="file"){let y=pg(t,d.real,s);return y!==null&&qd(y)?qt:{kind:"unanalyzable",reason:y===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${y}") the analyzer cannot parse`,why:y===null?"probe-refused":"sibling-unparsable"}}if(f!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let h=_i(d.real,s);if(h===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let g=$d(Td(h.names,"index"),"a directory index");return g.kind==="unanalyzable"?g:h.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:h.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(yi)} entries and was not fully probed`,why:"probe-refused"}:qt}let l=ve.basename(a);if(l===""||l==="."||l==="..")return qt;let c=Md(t,ve.dirname(a));if(c.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(c.kind==="missing")return qt;let p=_i(c.real,s);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let u=$d(Td(p.names,l),"a sibling file exists");return u.kind==="unanalyzable"?u:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(yi)} entries and was not fully probed`,why:"probe-refused"}:qt}function wi(e,n){let t=Pn(e),s=ve.dirname(n);for(let r=0;r<64;r+=1){let i=ve.join(s,"node_modules",...t.split("/"));if(on(ve.join(i,"package.json"))!==null)return i;let o=ve.dirname(s);if(o===s)return null;s=o}return null}function Ld(e,n,t,s,r){let i;for(let o of bi)for(let a of Si){let d={...t,noDtsResolution:!0,customConditions:[...a]},l=Gs(e,n,d,s,o,r);if(i===void 0)i=l;else if(i!==l)return null}return i??null}function Cn(e,n,t,s){let r=We(e);if(r==="relative")return Gs(e,n,t,s,void 0,!0);if(r==="package-root"){let a=Ld(e,n,t,s,!0);if(a!==null)return a;let d=wi(e,n);if(d===null||on(ve.join(d,"package.json"))?.includes('"exports"')===!0)return null;let l=ki(d);return l===null||Sn(l)?null:Ct(d,l)?l:null}let i=Ld(e,n,t,s,!1);if(i===null)return null;let o=dg(i,Pn(e));return o!==null?ug(e,o):Sn(i)?i:Fd(i)}function Wd(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function Vs(e,n,t,s){let r=We(e);if(r==="relative")return"no-candidate";if(Wd(e))return"alias-unmapped";let i=new Set;for(let h of bi)for(let g of Si){let y={...t,noDtsResolution:!0,customConditions:[...g]};i.add(Gs(e,n,y,s,h,r==="package-root"))}if(i.size>1)return"divergent-exports";let o=wi(e,n);if(o===null)return"not-installed";let a=on(ve.join(o,"package.json"));if(a===null)return"unreadable-manifest";let d;try{d=JSON.parse(a)}catch{return"unreadable-manifest"}if(typeof d!="object"||d===null)return"unreadable-manifest";let l=d,c=l.exports!==void 0&&l.exports!==null,p=typeof l.typesVersions=="object"&&l.typesVersions!==null,[u]=i;if(u!=null)return Ct(o,u)?!c&&p?"types-versions-remap":Sn(u)?"declaration-only":"no-candidate":"out-of-root";let f=Gs(e,n,t,s,void 0,!1);if(f!==null&&Sn(f))return!c&&p?"types-versions-remap":"declaration-only";if(r==="package-root"&&!c){let h=ki(o);if(h!==null&&!Ct(o,h))return"out-of-root"}return"no-candidate"}function hs(e,n,t,s){let r=Cn(e,n,t,s);if(r!==null)return[r];let i=We(e);if(i==="relative")return[];let o=new Set;for(let l of bi)for(let c of Si){let p={...t,noDtsResolution:!0,customConditions:[...c]};o.add(Gs(e,n,p,s,l,i==="package-root"))}if(o.size<2||o.has(null))return[];let a=wi(e,n);if(a===null)return[];let d=[];for(let l of o){if(l===null)return[];let c=Fd(l);if(Sn(c)||!Ct(a,c))return[];d.push(c)}return[...new Set(d)].sort()}function Gd(e,n){let t=ve.dirname(e);for(let s=0;s<64;s+=1){let r=on(ve.join(t,"package.json"));if(r!==null){try{let o=JSON.parse(r);if(typeof o!="object"||o===null)return!1;let a=o.optionalDependencies;if(typeof a=="object"&&a!==null&&n in a)return!0;let d=o.peerDependenciesMeta;if(typeof d=="object"&&d!==null){let l=d[n];if(typeof l=="object"&&l!==null)return l.optional===!0}}catch{return!1}return!1}let i=ve.dirname(t);if(i===t)return!1;t=i}return!1}function Vd(e,n,t){let s=on(ve.join(e,"tsconfig.json"));if(s===null)return()=>null;let r=Kr.parseConfigFileTextToJson(ve.join(e,"tsconfig.json"),s);if(r.error!==void 0)return()=>null;let i=r.config?.compilerOptions;if(typeof i!="object"||i===null)return()=>null;let o=i.paths;if(typeof o!="object"||o===null)return()=>null;let a=i.baseUrl,d=typeof a=="string"?ve.resolve(e,a):e,l=new Map,c=[];for(let[u,f]of Object.entries(o)){if(!Array.isArray(f))continue;let h=f.filter(y=>typeof y=="string");if(h.length===0)continue;let g=u.indexOf("*");g===-1?l.set(u,h):u.indexOf("*",g+1)===-1&&c.push({prefix:u.slice(0,g),suffix:u.slice(g+1),targets:h})}if(c.sort((u,f)=>f.prefix.length-u.prefix.length),l.size===0&&c.length===0)return()=>null;let p=u=>{let f=l.get(u);if(f!==void 0)return f;for(let h of c){if(u.length<h.prefix.length+h.suffix.length||!u.startsWith(h.prefix)||!u.endsWith(h.suffix))continue;let g=u.slice(h.prefix.length,u.length-h.suffix.length);return h.targets.map(y=>{let _=y.indexOf("*");return _===-1?y:y.slice(0,_)+g+y.slice(_+1)})}return[]};return(u,f)=>{let h=p(u);if(h.length===0||Cn(u,f,n,t)!==null)return null;for(let g of h){let y=ve.resolve(d,g),_=ve.relative(ve.dirname(f),y).split(ve.sep).join("/");if(_==="")continue;_.startsWith(".")||(_=`./${_}`);let b=Cn(_,f,n,t);if(b!==null&&Ct(e,b))return b}return null}}import{readdirSync as mg,realpathSync as hg}from"node:fs";import gt from"node:path";import le from"typescript";function Xs(e,n){if(le.isIdentifier(e))n.add(e.text);else for(let t of e.elements)le.isBindingElement(t)&&Xs(t.name,n)}function gs(e){let n=new Map,t=new Set,s=d=>{n.set(d,(n.get(d)??0)+1)},r=d=>{let l=Ze(d);if(le.isIdentifier(l))t.add(l.text);else if(le.isArrayLiteralExpression(l))for(let c of l.elements)r(c);else if(le.isObjectLiteralExpression(l))for(let c of l.properties)le.isShorthandPropertyAssignment(c)?t.add(c.name.text):le.isPropertyAssignment(c)?r(c.initializer):le.isSpreadAssignment(c)&&r(c.expression);else le.isSpreadElement(l)?r(l.expression):le.isBinaryExpression(l)&&l.operatorToken.kind===le.SyntaxKind.EqualsToken&&r(l.left)},i=d=>{let l=new Set;Xs(d,l);for(let c of l)s(c)},o=d=>{le.isVariableDeclaration(d)?i(d.name):le.isFunctionDeclaration(d)&&d.name!==void 0||le.isClassDeclaration(d)&&d.name!==void 0?s(d.name.text):le.isParameter(d)?i(d.name):((le.isFunctionExpression(d)||le.isClassExpression(d))&&d.name!==void 0&&le.isIdentifier(d.name)&&!(d.parent!==void 0&&le.isVariableDeclaration(d.parent)&&d.parent.initializer===d&&le.isIdentifier(d.parent.name)&&d.parent.name.text===d.name.text)||le.isImportClause(d)&&d.name!==void 0||le.isNamespaceImport(d)||le.isImportSpecifier(d)||le.isImportEqualsDeclaration(d))&&s(d.name.text),le.isBinaryExpression(d)&&d.operatorToken.kind>=le.SyntaxKind.FirstAssignment&&d.operatorToken.kind<=le.SyntaxKind.LastAssignment?r(d.left):(le.isPrefixUnaryExpression(d)||le.isPostfixUnaryExpression(d))&&(d.operator===le.SyntaxKind.PlusPlusToken||d.operator===le.SyntaxKind.MinusMinusToken)?r(d.operand):(le.isForOfStatement(d)||le.isForInStatement(d))&&!le.isVariableDeclarationList(d.initializer)&&r(d.initializer),le.forEachChild(d,o)};o(e);let a=new Set(t);for(let[d,l]of n)l>1&&a.add(d);return a}function Ht(e,n,t){let s=gs(e),r=new Map,i=o=>{le.isVariableDeclaration(o)&&le.isIdentifier(o.name)&&o.initializer!==void 0&&!s.has(o.name.text)&&!r.has(o.name.text)&&r.set(o.name.text,o.initializer),le.forEachChild(o,i)};return i(e),{containingFile:n,taintedNames:s,constBindings:r,resolveParamDirs:t}}var gg=1024,yg=32,_g=new Set(["filter","sort","slice","reverse"]),xg=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ze(e){let n=e;for(;le.isParenthesizedExpression(n);)n=n.expression;return n}function Xd(e,n){return le.isPropertyAccessExpression(e)&&le.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function Mt(e,n,t,s){if(t>yg)return null;let r=Ze(e);if(le.isStringLiteralLike(r))return r.text;if(le.isTemplateExpression(r)){let i=r.head.text;for(let o of r.templateSpans){let a=Mt(o.expression,n,t+1,s);if(a===null)return null;i+=a+o.literal.text}return i}if(le.isBinaryExpression(r)&&r.operatorToken.kind===le.SyntaxKind.PlusToken){let i=Mt(r.left,n,t+1,s);if(i===null)return null;let o=Mt(r.right,n,t+1,s);return o===null?null:i+o}if(le.isIdentifier(r)){if(r.text==="__dirname")return gt.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||s.has(r.text))return null;let i=n.constBindings.get(r.text);if(i===void 0)return null;s.add(r.text);let o=Mt(i,n,t+1,s);return s.delete(r.text),o}if(le.isCallExpression(r)){let i=Xd(r.expression,"join"),o=Xd(r.expression,"resolve");if(!i&&!o)return null;let a=[];for(let l of r.arguments){let c=Mt(l,n,t+1,s);if(c===null)return null;a.push(c)}let d=a[0];return d===void 0||o&&!gt.isAbsolute(d)?null:o?gt.resolve(...a):gt.join(...a)}return null}function Ur(e){let n=Ze(e);if(le.isBinaryExpression(n)&&n.operatorToken.kind===le.SyntaxKind.PlusToken)return[...Ur(n.left),...Ur(n.right)];if(le.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let s of n.templateSpans)t.push({expr:s.expression}),s.literal.text.length>0&&t.push({lit:s.literal.text});return t}return le.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Zd(e){let n=e,t=0;for(;t++<4096;){let s=n.parent;if(s===void 0)return null;if(le.isForOfStatement(s)&&s.statement===n){let r=s.initializer;if(le.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&le.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let i=Yd(s.expression);if(i!==null)return i}}if((le.isArrowFunction(n)||le.isFunctionExpression(n))&&le.isCallExpression(s)&&s.arguments.length>0&&s.arguments[0]===n&&le.isPropertyAccessExpression(s.expression)&&xg.has(s.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&le.isIdentifier(r.name)&&r.name.text===e.text){let i=Yd(s.expression.expression);if(i!==null)return i}}n=s}return null}function Yd(e){let n=Ze(e),t=0;for(;le.isCallExpression(n)&&t++<16;){let s=n.expression;if(le.isPropertyAccessExpression(s)){let r=s.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(_g.has(r)){n=Ze(s.expression);continue}return null}return le.isIdentifier(s)&&s.text==="readdirSync"?n.arguments[0]??null:null}return null}function bg(e,n){let t=Ur(e);if(t.length<2)return null;let s=t[t.length-1];if(s===void 0||!("expr"in s)||!le.isIdentifier(s.expr))return null;let r=s.expr;if(n.taintedNames.has(r.text))return null;let i="";for(let l=0;l<t.length-1;l+=1){let c=t[l];if(c===void 0)return null;if("lit"in c)i+=c.lit;else{let p=Mt(c.expr,n,0,new Set);if(p===null)return null;i+=p}}let o=Zd(r),a=o===null?null:Mt(o,n,0,new Set);if(a===null)return null;let d=gt.resolve(i);return d!==gt.resolve(a)?null:d}function Sg(e){if((le.isFunctionDeclaration(e)||le.isFunctionExpression(e))&&e.name!==void 0&&le.isIdentifier(e.name)||le.isMethodDeclaration(e)&&le.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&le.isVariableDeclaration(n)&&le.isIdentifier(n.name)?n.name.text:null}function kg(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!le.isFunctionLike(t))continue;let s=-1;for(let i=0;i<t.parameters.length;i+=1){let o=t.parameters[i];if(o!==void 0&&le.isIdentifier(o.name)&&o.name.text===n){s=i;break}}if(s<0)continue;let r=Sg(t);return r===null?null:{fnName:r,paramIndex:s}}return null}function Ys(e,n){let t=Ur(e);if(t.length!==2)return null;let[s,r]=t;if(s===void 0||!("expr"in s)||!le.isIdentifier(s.expr)||r===void 0||!("expr"in r)||!le.isIdentifier(r.expr))return null;let i=s.expr,o=r.expr;if(n.taintedNames.has(i.text)||n.taintedNames.has(o.text))return null;let a=Zd(o);return a===null||!le.isIdentifier(a)||a.text!==i.text?null:kg(i,i.text)}function wg(e,n){if(n.resolveParamDirs===void 0)return null;let t=Ys(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function qr(e){for(let n=e.parent;n!==void 0;n=n.parent){if(le.isSourceFile(n))return!0;if(!le.isArrowFunction(n)&&le.isFunctionLike(n))return!1}return!0}function vi(e,n){let t=Mt(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let s=bg(e,n);if(s!==null)return{kind:"dir",dir:s};let r=wg(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function Qd(e,n){let t;try{t=hg(e)}catch{return null}let s=n.endsWith(gt.sep)?n:n+gt.sep;return t===n||t.startsWith(s)?t:null}function ec(e,n,t,s,r){let i=Cn(e,n,s,r);return i===null||Sn(i)||!zr(i)?null:Qd(i,t)}function Jd(e,n,t,s,r){let i=Qd(e,t);if(i===null)return[];let o;try{o=mg(i)}catch{return[]}if(o.length===0||o.length>gg)return[];o.sort();let a=new Set,d=[];for(let l of o){let c=ec(gt.join(i,l),n,t,s,r);c!==null&&!a.has(c)&&(a.add(c),d.push(c))}return d}function Hr(e,n,t,s,r){let i=vi(e,n);if(i.kind==="const"){if(We(i.value)==="package-root")return[];let o=ec(i.value,n.containingFile,t,s,r);return o===null?[]:[o]}if(i.kind==="dir")return Jd(i.dir,n.containingFile,t,s,r);if(i.kind==="dirs"){let o=new Set,a=[];for(let d of i.dirs)for(let l of Jd(d,n.containingFile,t,s,r))o.has(l)||(o.add(l),a.push(l));return a}return[]}import vg from"node:path";import Te from"typescript";var Eg=32,Wr="\0",nc=(e,n)=>`${e}${Wr}${n}`,tc=(e,n,t)=>`${e}${Wr}${n}${Wr}${String(t)}`;function Ng(e){let n=new Map,t=new Set,s=(r,i)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,i)};for(let r of e.statements)if(Te.isImportDeclaration(r)&&Te.isStringLiteralLike(r.moduleSpecifier)){let i=r.moduleSpecifier.text,o=r.importClause;if(o===void 0)continue;o.name!==void 0&&s(o.name.text,{kind:"module",specifier:i});let a=o.namedBindings;if(a!==void 0&&Te.isNamespaceImport(a))s(a.name.text,{kind:"module",specifier:i});else if(a!==void 0&&Te.isNamedImports(a))for(let d of a.elements)s(d.name.text,{kind:"named",specifier:i,imported:(d.propertyName??d.name).text})}else if(Te.isImportEqualsDeclaration(r)&&Te.isExternalModuleReference(r.moduleReference)&&Te.isStringLiteralLike(r.moduleReference.expression))s(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(Te.isFunctionDeclaration(r)&&r.name!==void 0)s(r.name.text,{kind:"local"});else if(Te.isVariableStatement(r))for(let i of r.declarationList.declarations){if(i.initializer===void 0)continue;let o=i.initializer;if(Te.isIdentifier(i.name))Te.isArrowFunction(o)||Te.isFunctionExpression(o)?s(i.name.text,{kind:"local"}):sc(o)&&s(i.name.text,{kind:"module",specifier:rc(o)});else if(Te.isObjectBindingPattern(i.name)&&sc(o)){let a=rc(o);for(let d of i.name.elements){if(d.dotDotDotToken!==void 0||!Te.isIdentifier(d.name))continue;let l=d.propertyName??d.name;!Te.isIdentifier(l)&&!Te.isStringLiteralLike(l)||s(d.name.text,{kind:"named",specifier:a,imported:l.text})}}}return n}function sc(e){return Te.isCallExpression(e)&&Te.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&Te.isStringLiteralLike(e.arguments[0])}function rc(e){let n=e.arguments[0];return n!==void 0&&Te.isStringLiteralLike(n)?n.text:"\0"}function Ag(e){let n=e.expression;if(Te.isPropertyAccessExpression(n))return n.name.text;if(Te.isIdentifier(n))return n.text}function Ig(e,n,t,s,r,i){let o=e.expression,a=d=>{let l=`${d}${Wr}${n}`,c=i.get(l);if(c!==void 0||i.has(l))return c??null;let p=Cn(d,n,s,r),u=p===null?null:vg.resolve(p);return i.set(l,u),u};if(Te.isPropertyAccessExpression(o)&&Te.isIdentifier(o.expression)){let d=t.get(o.expression.text);if(d?.kind==="module"){let l=a(d.specifier);return l===null?null:{moduleReal:l,fnName:o.name.text}}return null}if(Te.isIdentifier(o)){let d=t.get(o.text);if(d?.kind==="named"){let l=a(d.specifier);return l===null?null:{moduleReal:l,fnName:d.imported}}return d?.kind==="local"?{moduleReal:n,fnName:o.text}:null}return null}function oc(e,n,t,s,r=new Map){if(n.length===0)return()=>null;let i=new Map,o=new Set;for(let d of n){let l=nc(d.definingModuleReal,d.fnName),c=i.get(l);c===void 0&&(c=new Set,i.set(l,c)),c.add(d.paramIndex),o.add(d.fnName)}let a=new Map;for(let d of e){let l=Ht(d.sf,d.real),c=Ng(d.sf),p=u=>{if(Te.isCallExpression(u)){let f=Ag(u);if(f!==void 0&&o.has(f)&&qr(u)){let h=Ig(u,d.real,c,t,s,r);if(h!==null){let g=i.get(nc(h.moduleReal,h.fnName));if(g!==void 0)for(let y of g){let _=u.arguments[y];if(_===void 0)continue;let b=vi(_,l);if(b.kind==="const"){let x=tc(h.moduleReal,h.fnName,y),k=a.get(x);k===void 0&&(k=new Set,a.set(x,k)),k.add(b.value)}}}}}Te.forEachChild(u,p)};p(d.sf)}return(d,l,c)=>{let p=a.get(tc(d,l,c));return p===void 0||p.size===0||p.size>Eg?null:[...p].sort()}}var an={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:M.ScriptTarget.ES2020,module:M.ModuleKind.CommonJS,moduleResolution:M.ModuleResolutionKind.Node10,types:[]},Gr=5e3;function mn(e,n){let t;try{t=Wt(n)}catch{t=ln.resolve(n)}let s=e.endsWith(ln.sep)?e:e+ln.sep;return t!==e&&!t.startsWith(s)?null:t===e?"":t.slice(s.length).split(ln.sep).join("/")}function Xe(e){let n=e;for(;;)if(M.isParenthesizedExpression(n))n=n.expression;else if(M.isBinaryExpression(n)&&n.operatorToken.kind===M.SyntaxKind.CommaToken)n=n.right;else return n}function yt(e){return M.isPropertyAccessExpression(e)?{receiver:Xe(e.expression),name:e.name.text}:M.isElementAccessExpression(e)&&M.isStringLiteralLike(e.argumentExpression)?{receiver:Xe(e.expression),name:e.argumentExpression.text}:null}function Qs(e){let n=Xe(e.expression);if(M.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===M.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=yt(n);if(t!==null){if(t.name==="require"&&M.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(M.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let s=e.arguments[1];return{specifierArg:s!==void 0&&M.isArrayLiteralExpression(s)?s.elements[0]:void 0}}}}return null}function ic(e){let n=[],t=s=>{if(M.isImportDeclaration(s)&&M.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.importClause?.isTypeOnly!==!0});else if(M.isImportEqualsDeclaration(s)&&M.isExternalModuleReference(s.moduleReference)&&M.isStringLiteralLike(s.moduleReference.expression))n.push({text:s.moduleReference.expression.text,runtime:!0});else if(M.isExportDeclaration(s)&&s.moduleSpecifier!==void 0&&M.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.isTypeOnly!==!0});else if(M.isCallExpression(s)){let r=Qs(s),i=r?.specifierArg;r!==null&&i!==void 0&&M.isStringLiteralLike(i)&&n.push({text:i.text,runtime:!0})}M.forEachChild(s,t)};return t(e),n}function Rg(e,n){let t=n===M.ScriptKind.TSX?"__scriptkind_probe.tsx":n===M.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",s=M.createSourceFile(t,e,M.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},i={getSourceFile:o=>o===t?s:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:o=>o,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:o=>o===t,readFile:o=>o===t?e:void 0};return M.createProgram({rootNames:[t],options:r,host:i}).getSyntacticDiagnostics(s).length}function Oi(e){return e.endsWith(".js")||e.endsWith(".jsx")}function ac(e){let n=0,t=s=>{(M.isCallExpression(s)||M.isNewExpression(s)||M.isTaggedTemplateExpression(s))&&(n+=1),M.forEachChild(s,t)};return t(e),n}function cc(e,n){let t=ic(M.createSourceFile(e,n,M.ScriptTarget.ES2020,!0));if(!Oi(e)||!n.includes("<")||!n.includes("require"))return t;let s=M.createSourceFile(e,n,M.ScriptTarget.ES2020,!0,M.ScriptKind.TSX),r=new Set(t.map(i=>`${i.runtime?"R":"T"}:${i.text}`));for(let i of ic(s)){let o=`${i.runtime?"R":"T"}:${i.text}`;r.has(o)||(r.add(o),t.push(i))}return t}function lc(e,n,t,s,r){if(!n.includes("require")&&!n.includes("import("))return[];let i=M.createSourceFile(e,n,M.ScriptTarget.ES2020,!0),o=Ht(i,e,r),a=[],d=new Set;return uc(i,l=>{for(let c of Hr(l,o,t,an,s))d.has(c)||(d.add(c),a.push(c))}),a}function uc(e,n){let t=s=>{if(M.isCallExpression(s)){let r=Qs(s),i=r?.specifierArg;r!==null&&i!==void 0&&!M.isStringLiteralLike(i)&&n(i)}M.forEachChild(s,t)};t(e)}function Og(e){let n=[];for(let t of e){let s=Ht(t.sf,t.real);uc(t.sf,r=>{let i=Ys(r,s);i!==null&&n.push({definingModuleReal:t.real,fnName:i.fnName,paramIndex:i.paramIndex})})}return n}var Pg=4,Ei=Gr,Ni=new Set(["eval","Function","createRequire"]),Cg=new Set(["require","eval","Function","createRequire"]),Yr=new Set(["module","Module","require","process","global","globalThis"]),Jr=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function Mg(e){return e===M.SyntaxKind.LessThanToken||e===M.SyntaxKind.GreaterThanToken||e===M.SyntaxKind.LessThanEqualsToken||e===M.SyntaxKind.GreaterThanEqualsToken||e===M.SyntaxKind.EqualsEqualsToken||e===M.SyntaxKind.EqualsEqualsEqualsToken||e===M.SyntaxKind.ExclamationEqualsToken||e===M.SyntaxKind.ExclamationEqualsEqualsToken||e===M.SyntaxKind.InstanceOfKeyword||e===M.SyntaxKind.InKeyword}function Tg(e){let n=e.parent;return(M.isParameter(n)||M.isVariableDeclaration(n)||M.isBindingElement(n)||M.isFunctionDeclaration(n)||M.isFunctionExpression(n)||M.isClassDeclaration(n)||M.isClassExpression(n)||M.isPropertyAssignment(n)||M.isPropertyDeclaration(n)||M.isMethodDeclaration(n))&&n.name===e?!0:M.isPropertyAccessExpression(n)&&n.name===e}function $g(e,n){return M.isCallExpression(n)&&n.expression===e||(M.isPropertyAccessExpression(n)||M.isElementAccessExpression(n))&&n.expression===e||M.isTypeOfExpression(n)||M.isVoidExpression(n)||M.isDeleteExpression(n)||M.isPrefixUnaryExpression(n)||M.isPostfixUnaryExpression(n)?!0:M.isBinaryExpression(n)&&Mg(n.operatorToken.kind)}function fc(e){let n=e,t=e.parent;for(;;)if(M.isParenthesizedExpression(t))n=t,t=t.parent;else if(M.isBinaryExpression(t)&&t.operatorToken.kind===M.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!$g(n,t)}function Lg(e){return Tg(e)?!1:fc(e)}function pc(e){let n=yt(e);if(n!==null&&Jr.has(n.name))return!0;if(M.isElementAccessExpression(e)&&!M.isStringLiteralLike(e.argumentExpression)){let t=Xe(e.expression);if(M.isIdentifier(t)&&Yr.has(t.text))return!0}return!1}function Js(e){let n=yt(e);if(n===null||n.name!=="constructor")return!1;let t=yt(n.receiver);return t!==null&&t.name==="constructor"}function mc(e){if(!M.isCallExpression(e))return!1;let n=Xe(e.expression);if(!M.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&M.isStringLiteralLike(t)&&t.text==="module"}var Dg={roots:new Map,nodes:new Set,saturated:!1};function hc(e){return M.isSourceFile(e)||M.isFunctionDeclaration(e)||M.isFunctionExpression(e)||M.isArrowFunction(e)||M.isMethodDeclaration(e)||M.isConstructorDeclaration(e)||M.isGetAccessorDeclaration(e)||M.isSetAccessorDeclaration(e)||M.isClassStaticBlockDeclaration(e)||M.isModuleDeclaration(e)}function gc(e,n){let t=e.parent;for(;t!==void 0;){if(hc(t))return t;t=t.parent}return n}function Fg(e){let n=new Set;if(M.isFunctionLike(e))for(let s of e.parameters)for(let r of Zs(s.name))n.add(r);let t=[e];for(;t.length>0;){let s=t.pop();if(s===void 0)break;if(!(s!==e&&hc(s))){if(M.isVariableDeclaration(s)&&M.isVariableDeclarationList(s.parent)&&!((s.parent.flags&M.NodeFlags.BlockScoped)!==0))for(let i of Zs(s.name))n.add(i);M.forEachChild(s,r=>{t.push(r)})}}return n}function jg(e,n,t){let s=gc(e,n);if(M.isSourceFile(s))return n;let r=t.get(s);return r===void 0&&(r=Fg(s),t.set(s,r)),r.has(e.text)?s:n}function Vr(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let s=n;for(;;){if(t.has(s))return!0;let r=s.parent;if(r===void 0)return!M.isSourceFile(s);s=r}}var Bg=12,Kg=8;function Xr(e,n){let t=Xe(e);for(;;){if(n.nodes.has(t))return!0;if(M.isIdentifier(t))return Yr.has(t.text)||Vr(n,t);if(M.isCallExpression(t))return mc(t);let s=yt(t);if(s!==null){if(s.name==="constructor")return!0;t=s.receiver;continue}if(M.isElementAccessExpression(t)){t=Xe(t.expression);continue}return!1}}function yc(e){let n=yt(Xe(e.expression));if(n===null||n.name!=="get"||!M.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function zg(e,n){let t=yc(e);if(t===null||!Xr(t.target,n))return!1;let s=t.key;return s===void 0||!M.isStringLiteralLike(s)?!0:Jr.has(s.text)}function Ai(e){if(!M.isFunctionExpression(e)&&!M.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,s=r=>{if(!(t||M.isFunctionExpression(r)||M.isFunctionDeclaration(r)||M.isClassLike(r))){if(M.isReturnStatement(r)&&r.expression!==void 0&&Xe(r.expression).kind===M.SyntaxKind.ThisKeyword){t=!0;return}M.forEachChild(r,s)}};return s(n),t}function Zs(e){if(M.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)M.isOmittedExpression(t)||n.push(...Zs(t.name));return n}function _c(e){return e.parameters.map(n=>Zs(n.name))}function Ug(e){let n=new Map,t=new Set,s=(i,o)=>{let a={fn:o,slots:_c(o)},d=n.get(i);d===void 0?n.set(i,[a]):d.push(a),Ai(o)&&t.add(i)},r=i=>{if(M.isFunctionDeclaration(i)&&i.name!==void 0)s(i.name.text,i);else if(M.isVariableDeclaration(i)&&M.isIdentifier(i.name)&&i.initializer!==void 0){let o=Xe(i.initializer);(M.isFunctionExpression(o)||M.isArrowFunction(o))&&s(i.name.text,o)}M.forEachChild(i,r)};return r(e),{params:n,thisReturning:t}}function qg(e){let n=new Map,t=new Set,s={roots:n,nodes:t},r=Ug(e),i=new Map,o=new Set(r.thisReturning),a=!0;for(let d=0;a;d+=1){if(d>=Bg)return{roots:n,nodes:t,saturated:!0};a=!1;let l=(g,y)=>{y!==""&&!g.has(y)&&(g.add(y),a=!0)},c=(g,y)=>{if(g==="")return;let _=n.get(g);_===void 0&&(_=new Set,n.set(g,_)),_.has(y)||(_.add(y),a=!0)},p=g=>{t.has(g)||(t.add(g),a=!0)},u=(g,y)=>{let _=Xe(g.expression);if(M.isIdentifier(_)&&Ni.has(_.text)||Js(_)||M.isCallExpression(g)&&mc(g)||Ai(_))return!0;let b=yt(_);if(b!==null&&(b.name==="call"||b.name==="apply"||b.name==="bind")){let x=b.receiver;if(Ai(x)||t.has(x)||M.isIdentifier(x)&&(Vr(s,x)||o.has(x.text)))return!0}if(t.has(_)||(M.isCallExpression(_)||M.isNewExpression(_))&&u(_,y+1)||M.isIdentifier(_)&&(Vr(s,_)||o.has(_.text)))return!0;if(M.isCallExpression(g)){let x=yc(g);if(x!==null&&Xr(x.target,s))return!0}return!1},f=(g,y)=>{if(y>=Kg)return!0;let _=Xe(g);if(t.has(_))return!0;if(M.isIdentifier(_))return Yr.has(_.text)||Vr(s,_);if(M.isBinaryExpression(_)){let b=_.operatorToken.kind;return b===M.SyntaxKind.BarBarToken||b===M.SyntaxKind.AmpersandAmpersandToken||b===M.SyntaxKind.QuestionQuestionToken?f(_.left,y+1)||f(_.right,y+1):!1}return M.isConditionalExpression(_)?f(_.whenTrue,y+1)||f(_.whenFalse,y+1):M.isPropertyAccessExpression(_)||M.isElementAccessExpression(_)?Xr(_,s):M.isCallExpression(_)||M.isNewExpression(_)?u(_,y+1):!1},h=(g,y)=>{if((M.isVariableDeclaration(g)||M.isParameter(g)||M.isBindingElement(g))&&g.initializer!==void 0){if(f(g.initializer,0)){let b=gc(g,e);for(let x of Zs(g.name))c(x,b)}}else if(M.isBinaryExpression(g)&&g.operatorToken.kind===M.SyntaxKind.EqualsToken&&M.isIdentifier(g.left)&&f(g.right,0))c(g.left.text,jg(g.left,e,i));else if(M.isReturnStatement(g)&&g.expression!==void 0&&y!==void 0&&f(g.expression,0))l(o,y);else if(M.isCallExpression(g)||M.isNewExpression(g)){u(g,0)&&p(g);let b=Xe(g.expression),x=yt(b),k=x!==null&&x.name==="call",w=x!==null&&x.name==="apply",I=k||w?x.receiver:b,N=k?1:0,v=[];M.isFunctionExpression(I)||M.isArrowFunction(I)?v.push({fn:I,slots:_c(I)}):M.isIdentifier(I)&&v.push(...r.params.get(I.text)??[]);let C=g.arguments??[];if(w){let R=C[1]===void 0?void 0:Xe(C[1]);for(let{fn:F,slots:P}of v)if(R!==void 0&&M.isArrayLiteralExpression(R))for(let U=0;U<R.elements.length;U+=1){let E=R.elements[U],T=P[U];if(!(E===void 0||T===void 0)&&f(E,0))for(let K of T)c(K,F)}else if(R!==void 0)for(let U of P)for(let E of U)c(E,F)}else for(let{fn:R,slots:F}of v)for(let P=N;P<C.length;P+=1){let U=C[P],E=F[P-N];if(!(U===void 0||E===void 0)&&f(U,0))for(let T of E)c(T,R)}}let _=y;if(M.isFunctionDeclaration(g))_=g.name?.text;else if(M.isFunctionExpression(g)||M.isArrowFunction(g)){let b=g.parent;_=M.isVariableDeclaration(b)&&M.isIdentifier(b.name)?b.name.text:void 0}M.forEachChild(g,b=>h(b,_))};h(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Hg(e){if(M.isIdentifier(e)&&Ni.has(e.text)||Js(e))return!0;let n=yt(e);if(n!==null&&(Jr.has(n.name)||(n.name==="call"||n.name==="apply")&&(M.isIdentifier(n.receiver)&&Ni.has(n.receiver.text)||Js(n.receiver)||(M.isPropertyAccessExpression(n.receiver)||M.isElementAccessExpression(n.receiver))&&pc(n.receiver))))return!0;if(M.isElementAccessExpression(e)&&!M.isStringLiteralLike(e.argumentExpression)){let t=Xe(e.expression);if(M.isIdentifier(t)&&Yr.has(t.text))return!0}return!1}var Wg=4;function dc(e,n){for(let t of e){if(!M.isStringLiteralLike(t)||n>=Wg)return!0;let s=M.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Zb=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
+                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,e_=5,n_=6;function t_(e){let n=e>=n_?"a.details":"NULL AS details",t=e>=e_?"ap.surface_complete":Zb;return`${Jb}, ${n}, ${t}${Qb}`}var s_="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",r_="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",o_="SELECT value FROM ingest_meta WHERE key = 'schema_version'",i_=7,a_="SELECT * FROM vulnerability_contract WHERE vulnerable_symbol_id = :id ORDER BY id",l_="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem",d_=`SELECT DISTINCT package_name FROM affected_package
+  WHERE ecosystem = :eco AND package_name >= :lo AND package_name < :hi ORDER BY package_name`,c_="SELECT value FROM ingest_meta WHERE key = 'population_mode'";function ts(e,n=Co){let t=n.open(e,"readonly"),s=t.prepare(o_).get(),r=s!==void 0?qe(s.value):"";if(Rr(r,String(Number(bt)+1)))throw t.close(),new Error(`shard schema ${JSON.stringify(r)} is newer than this cupel understands (v${bt})`);let o=Rr(r,Nr),i=/^\d+$/u.test(r)?Number(r):0,a=t.prepare(t_(i)),l=t.prepare(s_),d=t.prepare(r_),c=t.prepare(l_),f=t.prepare(d_),p=t.prepare(c_),u=i>=i_?t.prepare(a_):null;return{schemaVersion:r,ecosystems(){return c.all({}).map(m=>qe(m.ecosystem))},populationMode(){let m=p.get();return m===void 0?null:qe(m.value)},packageNamesUnder(m,g){if(g.length===0)return[];for(let _=0;_<g.length;_+=1){let S=g.charCodeAt(_);if(S<33||S>126)return[]}let y=g,b=g.slice(0,-1)+String.fromCharCode(g.charCodeAt(g.length-1)+1);return f.all({eco:m,lo:y,hi:b}).map(_=>qe(_.package_name))},advisoriesForPackage(m,g){return a.all({eco:m,name:g}).map(y=>({affected:{id:_t(y.ap_id)??0,advisoryId:qe(y.advisory_id),ecosystem:qe(y.ecosystem),packageName:qe(y.package_name),introduced:Je(y.introduced),fixed:Je(y.fixed),lastAffected:Je(y.last_affected),fixCommit:Je(y.fix_commit),repoUrl:Je(y.repo_url),surfaceComplete:_t(y.surface_complete)===1?1:0},advisory:{id:qe(y.a_id),osvId:Je(y.osv_id),cveId:Je(y.cve_id),summary:Je(y.summary),details:Je(y.details),severity:Je(y.severity),published:Je(y.published),source:qe(y.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(m){return l.all({id:m}).map(g=>{let y=qe(g.derivation);if(!o&&To.has(y))throw new Error(`shard stamped schema ${r===""?"(none)":r} carries a ${y} row, which only a v${Nr} shard may: its stamp is not the truth \u2014 refusing (ADR-108 D2)`);return{id:_t(g.id)??0,affectedPackageId:_t(g.affected_package_id)??0,exportName:Je(g.export_name),symbolKind:qe(g.symbol_kind),matchPattern:Je(g.match_pattern),matchGlobs:Je(g.match_globs),container:Je(g.container),sourcePath:Je(g.source_path),declStart:_t(g.decl_start),declEnd:_t(g.decl_end),astHashBefore:Je(g.ast_hash_before),astHashAfter:Je(g.ast_hash_after),derivation:y,confidence:qe(g.confidence),verified:_t(g.verified)===1?1:0}})},contractsForSymbol(m){if(u===null)return[];let g=[];for(let y of u.all({id:m})){let b=Oa(y);if(b===null||b.vulnerableSymbolId!==m)return"unreadable";g.push(b)}return g},aliasesForSymbol(m){return d.all({id:m}).map(g=>({id:_t(g.id)??0,vulnerableSymbolId:_t(g.vulnerable_symbol_id)??0,aliasPath:qe(g.alias_path),aliasName:qe(g.alias_name)}))},allModels(){let m;try{m=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let g=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return m.map(y=>{let b=_t(y.id)??0;return{packageName:qe(y.package_name),modelId:qe(y.evidence_ref),introduced:qe(y.introduced),fixedBefore:Je(y.fixed_before),evidenceRef:qe(y.evidence_ref),edges:g.all({id:b}).map(_=>({kind:qe(_.kind),anchorExport:qe(_.anchor_export),anchorContainer:Je(_.anchor_container),calleePackage:qe(_.callee_package),calleeContainer:Je(_.callee_container),calleeExport:qe(_.callee_export)}))}})},close(){t.close()}}}function $o(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let u of e)if(u.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${u.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,s=new Map,r=new Map,o=new Map,i=1,a=(u,m,g,y)=>{let b=`${String(g)}:${String(y)}`,_=u.get(b);if(_!==void 0)return _;let S=i;i+=1,u.set(b,S);let k=e[g];if(k===void 0)throw new Error("unreachable: reader index out of range");return m.set(S,{reader:k,id:y}),S},l=e.map(u=>new Set(u.ecosystems?.()??[])),d=u=>{let m=e.map((g,y)=>y).filter(g=>l[g]?.has(u)===!0);return m.length>0?m:e.map((g,y)=>y).filter(g=>e[g]?.ecosystems===void 0)},c=(u,m)=>({...m,id:a(r,o,u,m.id),affectedPackageId:a(t,s,u,m.affectedPackageId)}),f=e.map((u,m)=>m),p=u=>{let m;for(let g of u){let y=e[g];if(y?.populationMode===void 0)continue;let b=y.populationMode();if(b!=="census")return b;m=b}return m};return{schemaVersion:n.schemaVersion,ecosystems(){let u=new Set;for(let m of l)for(let g of m)u.add(g);return[...u].sort()},populationMode(){return p(f)??null},populationModeFor(u){let m=d(u);return p(m.length>0?m:f)},packageNamesUnder(u,m){let g=new Set;for(let y of d(u))for(let b of e[y]?.packageNamesUnder?.(u,m)??[])g.add(b);return[...g].sort()},advisoriesForPackage(u,m){let g=[];for(let y of d(u)){let b=e[y];if(b!==void 0)for(let _ of b.advisoriesForPackage(u,m))g.push({..._,affected:{..._.affected,id:a(t,s,y,_.affected.id)}})}return g},symbolsForAffected(u){let m=s.get(u);if(m===void 0)return[];let g=e.indexOf(m.reader);return m.reader.symbolsForAffected(m.id).map(y=>c(g,y))},aliasesForSymbol(u){let m=o.get(u);if(m===void 0)return[];let g=e.indexOf(m.reader);return m.reader.aliasesForSymbol(m.id).map(y=>({...y,vulnerableSymbolId:a(r,o,g,y.vulnerableSymbolId)}))},contractsForSymbol(u){let m=o.get(u);if(m===void 0)return[];let g=m.reader.contractsForSymbol?.(m.id)??[];return g==="unreadable"?g:g.map(y=>({...y,vulnerableSymbolId:u}))},allModels(){return e.flatMap(u=>u.allModels?.()??[])},close(){for(let u of e)u.close()}}}import{realpathSync as Gt}from"node:fs";import Tn from"node:path";import Pa from"typescript";var Do=class{#e;#n;#t;#s=[];reasons=new Set;constructor(n,t,s){this.#e=n,this.#n=t,this.#t=[...s].sort((r,o)=>r.start-o.start)}value(n,t){let[s,r]=Ca(this.#e,n,t);if(s>=r)return;let o=y_(this.#e.slice(s,Math.min(r,s+16)));this.#s.push({code:[{start:s,end:r}],lead:o?";(":";",between:[],tail:o?")":""})}call(n,t){let[s,r]=Ca(this.#e,n,t);if(s>=r)return;let o=h_(this.#e.slice(s,r));this.#s.push({code:[{start:s,end:r}],lead:o?";":";(",between:[],tail:o?"()":")()"})}namedCall(n,t){let[s,r]=t===null?[0,0]:Ca(this.#e,t.start,t.end);if(t===null||s>=r){this.#s.push({code:[n],lead:";",between:[],tail:"()"});return}this.#s.push({code:[n,{start:s,end:r}],lead:";",between:["("],tail:")"})}cannot(n){this.reasons.add(n)}write(){let n=[...this.#t.map(i=>({fixed:!0,seg:i})),...this.#s.map(i=>({fixed:!1,item:i}))],t=i=>i.fixed?i.seg.start:i.item.code[0]?.start??0,s=i=>i.fixed?i.seg.end:i.item.code[i.item.code.length-1]?.end??0;n.sort((i,a)=>t(i)-t(a));let r=0,o=null;for(let i=0;i<n.length;i+=1){let a=n[i];if(a===void 0)continue;let l=t(a);if(l<r){this.reasons.add("a template expression overlaps other code");return}if(a.fixed){r=a.seg.end,o=null;continue}let d=a.item,c=n[i+1],f=c===void 0?this.#e.length:t(c),p=c!==void 0&&!c.fixed?d.tail:`${d.tail};`,u=this.#o(r,l,d.lead.length);if(u===null){let _=o!==null&&d.code.length===1?o:null,S=_===null?null:this.#r(s(a),f,p.length-d.tail.length+1);if(_!==null&&S!==null){this.#n[_.close]=" ";for(let k of d.code)bu(this.#e,this.#n,k.start,k.end);Lo(this.#n,S,`)${p.slice(d.tail.length)}`),r=(S[S.length-1]??s(a))+1,o=null;continue}this.reasons.add("a template expression could not be placed in the module");continue}let m=[],g=!0;for(let _=0;_+1<d.code.length;_+=1){let S=d.code[_],k=d.code[_+1],v=d.between[_]??"";if(S===void 0||k===void 0)continue;let I=this.#r(S.end,k.start,v.length);I===null?g=!1:m.push(I)}let y=s(a),b=this.#r(y,f,p.length);if(!g||b===null){this.reasons.add("a template expression could not be placed in the module");continue}for(let _ of d.code)bu(this.#e,this.#n,_.start,_.end);Lo(this.#n,u,d.lead),m.forEach((_,S)=>{Lo(this.#n,_,d.between[S]??"")}),Lo(this.#n,b,p),r=b.length>0?(b[b.length-1]??y)+1:y,o=d.tail==="()"&&b.length>=2?{open:b[0]??y,close:b[1]??y}:null}}#o(n,t,s){let r=[];for(let o=t-1;o>=n&&r.length<s;o-=1){let i=this.#e[o];i!==`
+`&&i!=="\r"&&r.push(o)}return r.length===s?r.reverse():null}#r(n,t,s){let r=[];for(let o=n;o<t&&r.length<s;o+=1){let i=this.#e[o];i!==`
+`&&i!=="\r"&&r.push(o)}return r.length===s?r:null}};function bu(e,n,t,s){for(let r=t;r<s;r+=1)n[r]=e[r]??" "}function Lo(e,n,t){n.forEach((s,r)=>{e[s]=t[r]??" "})}function h_(e){if(e.length===0)return!1;let n=!0;for(let t of e){if(t==="."){if(n)return!1;n=!0;continue}let s=t>="a"&&t<="z"||t>="A"&&t<="Z"||t==="_"||t==="$",r=s||t>="0"&&t<="9";if(n?!s:!r)return!1;n=!1}return!n}function Ca(e,n,t){let s=n,r=t;for(;s<r&&Qe(e[s]??"");)s+=1;for(;r>s&&Qe(e[r-1]??"");)r-=1;return[s,r]}function Qe(e){return e===" "||e==="	"||e===`
+`||e==="\r"||e==="\f"}function y_(e){if(e.startsWith("{"))return!0;for(let n of["function","class","let","async"]){if(!e.startsWith(n))continue;let t=e[n.length]??"";if(!b_(t))return!0}return!1}function b_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"||e>="0"&&e<="9"||e==="_"||e==="$"}function Fo(e,n,t){let s=["b"],r=n+1;for(;r<t;){let o=s[s.length-1],i=e[r]??"";if(o==="t"){i==="\\"?r+=2:i==="`"?(s.pop(),r+=1):i==="$"&&e[r+1]==="{"?(s.push("s"),r+=2):r+=1;continue}if(i==="'"||i==='"'){for(r+=1;r<t&&e[r]!==i&&e[r]!==`
+`;)r+=e[r]==="\\"?2:1;r+=1;continue}if(i==="`"){s.push("t"),r+=1;continue}if(i==="/"&&e[r+1]==="/"){let a=e.indexOf(`
+`,r);r=a===-1?t:a+1;continue}if(i==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?t:a+2;continue}if(i==="{"){s.push("b"),r+=1;continue}if(i==="}"){let a=s.pop();if(s.length===0&&a==="b")return r;r+=1;continue}r+=1}return-1}var __=64,S_=32*1024;function _u(e,n,t){let s=0,r=n+1;for(;s<__;){let o=e.indexOf("}",r);if(o===-1||o>=t||o-n>S_)return-1;if(s+=1,x_(e.slice(n+1,o)))return o;r=o+1}return-1}function x_(e){if(e.trim().length===0)return!0;let n=e.trimStart().startsWith("...")?`[${e}
+];`:`(${e}
+);`,t=Pa.createSourceFile("probe.tsx",n,Pa.ScriptTarget.Latest,!1,Pa.ScriptKind.TSX),s=t.parseDiagnostics;return s!==void 0&&s.length>0?!1:t.statements.length===1}function Lt(e,n,t,s,r){let o=n+1,i=o;for(;o<t&&!Qe(e[o]??"")&&e[o]!==">"&&e[o]!=="/";)o+=1;let a=e.slice(i,o),l=[],d=[];for(;o<t;){for(;o<t&&Qe(e[o]??"");)o+=1;let c=e[o];if(c===void 0||o>=t)return null;if(c===">")return{name:a,start:n,end:o+1,selfClosing:!1,attributes:l,braces:d};if(c==="/"&&e[o+1]===">")return{name:a,start:n,end:o+2,selfClosing:!0,attributes:l,braces:d};if(c==="{"&&s){let y=r(o);if(y===-1)return null;d.push({open:o,close:y}),o=y+1;continue}let f=o;for(;o<t;){let y=e[o]??"";if(Qe(y)||y==="="||y===">"||y==="/"&&e[o+1]===">")break;o+=1}if(o===f){o+=1;continue}let p=o,u=o;for(;u<t&&Qe(e[u]??"");)u+=1;if(e[u]!=="="){l.push({name:e.slice(f,p),nameStart:f,nameEnd:p,value:null});continue}let m=u;for(u+=1;u<t&&Qe(e[u]??"");)u+=1;let g=e[u];if(g==='"'||g==="'"){let y=e.indexOf(g,u+1);if(y===-1||y>=t)return null;l.push({name:e.slice(f,p),nameStart:f,nameEnd:p,value:{kind:"quoted",start:u+1,end:y,delimiters:[m,u,y]}}),o=y+1}else if(g==="{"&&s){let y=r(u);if(y===-1)return null;l.push({name:e.slice(f,p),nameStart:f,nameEnd:p,value:{kind:"brace",start:u+1,end:y,delimiters:[m,u,y]}}),o=y+1}else{let y=u;for(;u<t&&!Qe(e[u]??"")&&e[u]!==">";)u+=1;l.push({name:e.slice(f,p),nameStart:f,nameEnd:p,value:{kind:"bare",start:y,end:u,delimiters:[m]}}),o=u}}return null}var k_=new Set(["component","slot","template","transition","transition-group","keep-alive","teleport","suspense","router-view","router-link"]),w_=new Set(["v-if","v-else-if","v-show","v-html","v-text","v-model","v-memo","v-bind","v-on"]),v_=new Set(["v-else","v-once","v-pre","v-cloak","v-slot"]);function xu(e,n,t){A_(e)&&n.cannot("text outside the component's blocks is not read");let s=E_(e);if(s===null)return;if(s.kind==="unclosed"){n.cannot("the <template> block is not closed");return}if(s.lang!==""&&s.lang!=="html"){n.cannot(`a template in lang "${$_(s.lang)}" is not read`);return}let{start:r,end:o}=s,i=r;for(;i<o;){let a=e.indexOf("<",i),l=e.indexOf("{{",i),d=a===-1||a>=o?o:a;if(l!==-1&&l<d){let f=e.indexOf("}}",l+2);if(f===-1||f>o){n.cannot("a {{ in the template is not closed");return}n.value(l+2,f),i=f+2;continue}if(d===o)break;if(e.startsWith("<!--",a)){let f=e.indexOf("-->",a+4);i=f===-1?o:f+3;continue}if(e[a+1]==="/"||!I_(e[a+1]??"")){let f=e.indexOf(">",a);i=e[a+1]==="/"&&f!==-1?f+1:a+1;continue}let c=Lt(e,a,o,!1,()=>-1);if(c===null){n.cannot("a tag in the template is not closed");return}N_(e,c.name,c.attributes,t,n);for(let f of c.attributes)R_(e,f,n);i=c.end}}function E_(e){let n=0;for(;n<e.length;){let t=e.indexOf("<",n);if(t===-1)return null;if(e.startsWith("<!--",t)){let a=e.indexOf("-->",t+4);if(a===-1)return null;n=a+3;continue}let s=Lt(e,t,e.length,!1,()=>-1);if(s===null)return null;let r=s.name.toLowerCase();if(r==="template"){let a=s.attributes.find(c=>c.name.toLowerCase()==="lang"),l=a?.value===null||a===void 0?"":e.slice(a.value.start,a.value.end);if(s.selfClosing)return{kind:"found",start:s.end,end:s.end,lang:l};let d=ku(e,s.end);return d===-1?{kind:"unclosed"}:{kind:"found",start:s.end,end:d,lang:l.toLowerCase()}}let o=s.selfClosing?s.end:wu(e,s.end,r);if(o===-1)return null;let i=e.indexOf(">",o);n=i===-1?e.length:i+1}return null}function A_(e){let n=0;for(;n<e.length;){let t=e[n]??"";if(Qe(t)||t==="\uFEFF"){n+=1;continue}if(t!=="<")return!0;if(e.startsWith("<!--",n)){let a=e.indexOf("-->",n+4);if(a===-1)return!0;n=a+3;continue}let s=Lt(e,n,e.length,!1,()=>-1);if(s===null)return!0;if(s.selfClosing){n=s.end;continue}let r=s.name.toLowerCase(),o=r==="template"?ku(e,s.end):wu(e,s.end,r);if(o===-1)return!0;let i=e.indexOf(">",o);n=i===-1?e.length:i+1}return!1}function ku(e,n){let t=1,s=n;for(;s<e.length;){let r=e.indexOf("<",s);if(r===-1)return-1;if(e.startsWith("<!--",r)){let a=e.indexOf("-->",r+4);if(a===-1)return-1;s=a+3;continue}let o=e[r+1]==="/",i=o?r+2:r+1;if(e.slice(i,i+8).toLowerCase()==="template"){let a=e[i+8]??"";if(a===">"||a==="/"||Qe(a))if(o){if(t-=1,t===0)return r}else{let l=Lt(e,r,e.length,!1,()=>-1);l!==null&&!l.selfClosing&&(t+=1)}}s=r+1}return-1}function wu(e,n,t){let s=`</${t}`,r=n;for(;r<e.length;){let o=e.indexOf("</",r);if(o===-1)return-1;if(e.slice(o,o+s.length).toLowerCase()===s)return o;r=o+2}return-1}function I_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function N_(e,n,t,s,r){if(!(n!==n.toLowerCase()||n.includes("-")||n.includes("."))&&n.toLowerCase()!=="component")return;let i=M_(n);if(k_.has(i)){if(i==="component"){let l=t.find(f=>f.name==="is"),d=t.find(f=>f.name===":is"||f.name==="v-bind:is");l!==void 0&&r.cannot("a <component is> names a component by string");let c=d?.value??null;if(c!==null){let f=e.slice(c.start,c.end).trimStart()[0]??"";(f==="'"||f==='"'||f==="`")&&r.cannot("a <component :is> names a component by string")}}return}let a=n.split(".")[0]??n;s.has(a)||s.has(Eu(a))||s.has(T_(a))||r.cannot("a component used without an import (it may be registered globally)")}function R_(e,n,t){let s=n.name,r=n.value;if(s.startsWith("#"))return;let o=s.startsWith(":")||s.startsWith("v-bind:")||s.startsWith("."),i=s.startsWith("@")||s.startsWith("v-on:");if(o||i){if((s.startsWith(":")||s.startsWith("@")||s.startsWith(".")?s.slice(1):s.slice(s.indexOf(":")+1)).startsWith("[")){t.cannot("a dynamic directive argument is not read");return}if(r===null)return;i?Su(e,r.start,r.end,t):t.value(r.start,r.end);return}if(!s.startsWith("v-"))return;let a=s.slice(0,O_(s));if(!v_.has(a)){if(a==="v-for"){if(r===null)return;let l=C_(e,r.start,r.end);l===-1?t.cannot("a v-for this reader cannot split"):t.value(l,r.end);return}if(w_.has(a)){r!==null&&(a==="v-on"?Su(e,r.start,r.end,t):t.value(r.start,r.end));return}t.cannot("a custom directive is not read")}}function O_(e){for(let n=0;n<e.length;n+=1){let t=e[n];if(t===":"||t===".")return n}return e.length}function Su(e,n,t,s){let r=e.slice(n,t).trim(),o=r.startsWith("function")||r.startsWith("async")||r.startsWith("(")&&r.includes("=>")||P_(r);vu(r)||o?s.call(n,t):s.value(n,t)}function P_(e){let n=e.indexOf("=>");return n>0&&vu(e.slice(0,n).trim())}function vu(e){if(e.length===0)return!1;let n=!0;for(let t of e){if(t==="."){if(n)return!1;n=!0;continue}let s=t>="a"&&t<="z"||t>="A"&&t<="Z"||t==="_"||t==="$",r=s||t>="0"&&t<="9";if(n?!s:!r)return!1;n=!1}return!n}function C_(e,n,t){let s=0;for(let r=n;r<t;r+=1){let o=e[r]??"";if(o==="("||o==="["||o==="{")s+=1;else if(o===")"||o==="]"||o==="}")s-=1;else if(s===0&&Qe(e[r-1]??"")){for(let i of["in","of"])if(e.startsWith(i,r)&&Qe(e[r+i.length]??""))return r+i.length}}return-1}function M_(e){let n="";for(let t=0;t<e.length;t+=1){let s=e[t]??"",r=s.toLowerCase();s!==r&&t>0&&(n+="-"),n+=r}return n}function Eu(e){return e.split("-").map(n=>n.length===0?"":(n[0]??"").toUpperCase()+n.slice(1)).join("")}function T_(e){let n=Eu(e);return n.length===0?n:(n[0]??"").toLowerCase()+n.slice(1)}function $_(e){let n="";for(let t of e.slice(0,40)){let s=t.charCodeAt(0);n+=s>=32&&s<127&&t!=='"'?t:"?"}return n}function Au(e,n,t){let s=e.length,r=l=>_u(e,l,s),o=!1,i=(l,d)=>{let c=e.slice(l+1,d);c.includes("<")&&(o=!0);let f=c.trimStart();if(f.startsWith("...")){let p=l+1+(c.length-f.length)+3;t.value(p,d)}else t.value(l+1,d)},a=n;for(;a<s;){let l=e.indexOf("<",a),d=e.indexOf("{",a);if(l===-1&&d===-1)break;if(d!==-1&&(l===-1||d<l)){let u=r(d);if(u===-1)return t.cannot("a { in the template does not close as an expression"),o;i(d,u),a=u+1;continue}if(e.startsWith("<!--",l)){let u=e.indexOf("-->",l+4);a=u===-1?s:u+3;continue}if(e[l+1]==="/"||!L_(e[l+1]??"")){let u=e.indexOf(">",l);a=e[l+1]==="/"&&u!==-1?u+1:l+1;continue}let c=Lt(e,l,s,!0,r);if(c===null)return t.cannot("a tag in the template is not closed"),o;let f=c.name.toLowerCase(),p=c.attributes.some(u=>u.name==="is:raw");if((f==="script"||f==="style"||p)&&!c.selfClosing){let u=D_(e,c.end,f);if(u===-1)return t.cannot(`a <${F_(f)}> is not closed`),o;let m=e.indexOf(">",u);a=m===-1?s:m+1;continue}for(let u of c.braces)i(u.open,u.close);for(let u of c.attributes)u.value?.kind==="brace"&&i(u.value.start-1,u.value.end);a=c.end}return o}function L_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function D_(e,n,t){let s=`</${t}`,r=n;for(;r<e.length;){let o=e.indexOf("</",r);if(o===-1)return-1;if(e.slice(o,o+s.length).toLowerCase()===s){let i=e[o+s.length]??"";if(i===">"||Qe(i))return o}r=o+2}return-1}function F_(e){let n="";for(let t of e.slice(0,40)){let s=t.charCodeAt(0);n+=s>=32&&s<127?t:"?"}return n}var j_=["use:","transition:","in:","out:","animate:"];function Iu(e,n){let t=e.length,s=0;for(;s<t;){let r=e.indexOf("<",s),o=e.indexOf("{",s);if(r===-1&&o===-1)break;if(o!==-1&&(r===-1||o<r)){let d=Fo(e,o,t);if(d===-1){n.cannot("a { in the template is not closed");return}K_(e,o,d,n),s=d+1;continue}if(e.startsWith("<!--",r)){let d=e.indexOf("-->",r+4);s=d===-1?t:d+3;continue}if(e[r+1]==="/"){let d=e.indexOf(">",r);s=d===-1?t:d+1;continue}let i=e[r+1]??"";if(!B_(i)){s=r+1;continue}let a=Lt(e,r,t,!0,d=>Fo(e,d,t));if(a===null){n.cannot("a tag in the template is not closed");return}let l=a.name.toLowerCase();if((l==="script"||l==="style")&&!a.selfClosing){let d=G_(e,a.end,l);if(d===-1){n.cannot(`a <${l}> is not closed`);return}let c=e.indexOf(">",d);s=c===-1?t:c+1;continue}for(let d of a.braces){let c=e.slice(d.open+1,d.close),f=c.length-c.trimStart().length;if(c.trimStart().startsWith("...")){let p=d.open+1+f+3;n.value(p,d.close)}else n.value(d.open+1,d.close)}for(let d of a.attributes)W_(e,d,n);s=a.end}}function B_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function G_(e,n,t){let s=`</${t}`,r=n;for(;r<e.length;){let o=e.indexOf("</",r);if(o===-1)return-1;if(e.slice(o,o+s.length).toLowerCase()===s)return o;r=o+2}return-1}function K_(e,n,t,s){let r=n+1;for(;r<t&&Qe(e[r]??"");)r+=1;let o=e[r]??"";if(o!=="#"&&o!==":"&&o!=="/"&&o!=="@"){s.value(n+1,t);return}if(o==="/")return;let i=r+1;for(;i<t&&z_(e[i]??"");)i+=1;let a=`${o}${e.slice(r+1,i)}`;switch(a){case"#if":case"#key":case"@html":case"@const":case"@render":case"@debug":{s.value(i,t);return}case":else":{let l=i;for(;l<t&&Qe(e[l]??"");)l+=1;e.startsWith("if",l)&&Qe(e[l+2]??"")?s.value(l+2,t):e.slice(i,t).trim()!==""&&s.cannot("an {:else \u2026} form this reader does not know");return}case"#each":{let l=Ma(e,i,t,"as"),d=l===-1?t:l;s.value(i,d);return}case"#await":{let l=Ma(e,i,t,"then"),d=Ma(e,i,t,"catch"),c=[l,d].filter(p=>p!==-1),f=c.length===0?t:Math.min(...c);s.value(i,f);return}case"#snippet":case":then":case":catch":return;default:s.cannot(`a {${a}} block this reader does not know`)}}function z_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function Ma(e,n,t,s){let r=0,o=n;for(;o<t;){let i=e[o]??"";if(i==="'"||i==='"'||i==="`"){let a=e.indexOf(i,o+1);o=a===-1||a>t?t:a+1;continue}if(i==="("||i==="["||i==="{")r+=1;else if(i===")"||i==="]"||i==="}")r-=1;else if(r===0&&Qe(e[o-1]??"")&&e.startsWith(s,o)&&Qe(e[o+s.length]??""))return o;o+=1}return-1}function W_(e,n,t){let s=n.name,r=n.value,o=j_.find(a=>s.startsWith(a));if(o!==void 0){let a=n.nameStart+o.length,l=s.indexOf("|",o.length),d=l===-1?n.nameEnd:n.nameStart+l,c={start:a,end:d};r===null?t.namedCall(c,null):r.kind==="brace"?t.namedCall(c,{start:r.start,end:r.end}):t.cannot(`a ${o} directive with a quoted value`);return}let i=s.startsWith("on:")||U_(s);if(r===null){for(let a of["bind:","class:","style:"]){if(!s.startsWith(a))continue;let l=n.nameStart+a.length,d=s.indexOf("|",a.length),c=d===-1?n.nameEnd:n.nameStart+d;t.value(l,c)}return}if(r.kind==="brace"){i?t.call(r.start,r.end):s.startsWith("let:")||t.value(r.start,r.end);return}r.kind==="quoted"&&H_(e,r.start,r.end,t)}function U_(e){if(!e.startsWith("on")||e.length<3)return!1;let n=e[2]??"";return n>="a"&&n<="z"}function H_(e,n,t,s){let r=n;for(;r<t;){let o=e.indexOf("{",r);if(o===-1||o>=t)return;let i=Fo(e,o,t);if(i===-1){s.cannot("a { in an attribute value is not closed");return}s.value(o+1,i),r=i+1}}import on from"typescript";function St(e){return e.endsWith(".vue")?"vue":e.endsWith(".svelte")?"svelte":e.endsWith(".astro")?"astro":null}var q_=new Set(["","js","javascript","ts","typescript","tsx","jsx"]),V_=new Set(["tsx","jsx"]),X_=new Set(["","module","text/javascript","application/javascript","text/typescript"]),Y_=new Set(["application/ld+json","application/json","importmap","speculationrules"]);function Or(e,n){let t=eS(n),s=new Set,r=!1,o=[],i=0,a=null,l=[];if(e==="astro"){let c=nS(n);c.kind==="unclosed"?(s.add("its frontmatter fence is not closed"),i=n.length):c.kind==="found"&&($a(n,t,c.start,c.end),o.push({start:c.start,end:c.end}),a={start:c.start,end:c.end},i=c.after)}for(let c of tS(n,i)){if(c.kind==="unclosed"){s.add("a <script> tag is not closed");break}let f=(c.attrs.get("type")??"").toLowerCase();if(Y_.has(f))continue;if(!X_.has(f)){s.add(`a script tag of type "${Nu(f)}" is not read`);continue}if(c.attrs.has("src")){s.add("a <script src> is not read");continue}if(e==="astro"){l.push({start:c.start,end:c.end});continue}let p=(c.attrs.get("lang")??"").toLowerCase();if(!q_.has(p)){s.add(`a script tag in lang "${Nu(p)}" is not read`);continue}V_.has(p)&&(r=!0),$a(n,t,c.start,c.end),o.push({start:c.start,end:c.end})}if(l.length>0)for(let c of J_(n,t,a,l,o))s.add(c);let d=new Do(n,t,o);e==="svelte"?Iu(n,d):e==="vue"?xu(n,d,Q_(n,o)):Au(n,i,d)&&(r=!0),d.write();for(let c of d.reasons)s.add(c);return{code:t.join(""),scriptKind:r?"tsx":"ts",partial:[...s]}}function J_(e,n,t,s,r){let o=[],i=[];t!==null&&i.push(Ta(e.slice(t.start,t.end)));for(let a of s){let l=Ta(e.slice(a.start,a.end));if(!l.parses){o.push("an Astro <script> tag does not parse on its own");continue}if(i.some(d=>Z_(l,d))){o.push("an Astro <script> tag shares a name with the frontmatter or another script");continue}$a(e,n,a.start,a.end),r.push({start:a.start,end:a.end}),i.push(l)}return o}function Q_(e,n){let t=new Set;for(let s of n)for(let r of Ta(e.slice(s.start,s.end)).declared)t.add(r);return t}function Z_(e,n){for(let t of e.declared)if(n.declared.has(t)||n.used.has(t))return!0;for(let t of n.declared)if(e.used.has(t))return!0;return!1}function Ta(e){let n=on.createSourceFile("block.ts",e,on.ScriptTarget.Latest,!0,on.ScriptKind.TS),t=n.parseDiagnostics,s=new Set,r=new Set;for(let i of n.statements)if(on.isImportDeclaration(i)){let a=i.importClause;a?.name!==void 0&&s.add(a.name.text);let l=a?.namedBindings;if(l!==void 0&&on.isNamespaceImport(l)&&s.add(l.name.text),l!==void 0&&on.isNamedImports(l))for(let d of l.elements)s.add(d.name.text)}else if(on.isVariableStatement(i))for(let a of i.declarationList.declarations)Ru(a.name,s);else(on.isFunctionDeclaration(i)||on.isClassDeclaration(i)||on.isEnumDeclaration(i)||on.isInterfaceDeclaration(i)||on.isTypeAliasDeclaration(i)||on.isModuleDeclaration(i))&&i.name!==void 0&&on.isIdentifier(i.name)&&s.add(i.name.text);let o=i=>{if(on.isIdentifier(i)){let a=i.parent;on.isPropertyAccessExpression(a)&&a.name===i||r.add(i.text)}on.forEachChild(i,o)};return o(n),{parses:t===void 0||t.length===0,declared:s,used:r}}function Ru(e,n){if(on.isIdentifier(e)){n.add(e.text);return}for(let t of e.elements)on.isBindingElement(t)&&Ru(t.name,n)}function eS(e){let n=new Array(e.length);for(let t=0;t<e.length;t+=1){let s=e[t]??" ";n[t]=s===`
+`||s==="\r"?s:" "}return n}function $a(e,n,t,s){for(let r=t;r<s;r+=1)n[r]=e[r]??" "}function Nu(e){let n="";for(let t of e.slice(0,40)){let s=t.charCodeAt(0);n+=s>=32&&s<127&&t!=='"'?t:"?"}return n}function nS(e){let n=0;for(e.charCodeAt(0)===65279&&(n=1);n<e.length&&_s(e[n]??"");)n+=1;if(!e.startsWith("---",n))return{kind:"none"};let t=e.indexOf(`
+`,n);if(t===-1)return{kind:"unclosed"};if(e.slice(n+3,t).trim()!=="")return{kind:"none"};let s=t+1;for(;s<=e.length;){let r=e.indexOf(`
+`,s),o=e.slice(s,r===-1?e.length:r);if(o.trimEnd()==="---"||o.trim()==="---")return{kind:"found",start:t+1,end:s,after:s+o.length};if(r===-1)break;s=r+1}return{kind:"unclosed"}}function _s(e){return e===" "||e==="	"||e===`
+`||e==="\r"||e==="\f"}function tS(e,n){let t=[],s=n;for(;s<e.length;){let r=e.indexOf("<",s);if(r===-1)break;if(e.startsWith("<!--",r)){let d=e.indexOf("-->",r+4);if(d===-1)break;s=d+3;continue}let o=sS(e,r);if(o!=="script"&&o!=="style"){s=r+1;continue}let i=rS(e,r+1+o.length);if(i===null){o==="script"&&t.push({kind:"unclosed"});break}if(i.selfClosing){o==="script"&&t.push({kind:"block",start:i.end,end:i.end,attrs:i.attrs}),s=i.end;continue}let a=oS(e,i.end,o);if(a===-1){o==="script"&&t.push({kind:"unclosed"});break}o==="script"&&t.push({kind:"block",start:i.end,end:a,attrs:i.attrs});let l=e.indexOf(">",a);s=l===-1?e.length:l+1}return t}function sS(e,n){for(let t of["script","style"]){if(e.slice(n+1,n+1+t.length).toLowerCase()!==t)continue;let s=e[n+1+t.length]??"";if(s===">"||s==="/"||_s(s))return t}return null}function rS(e,n){let t=new Map,s=n;for(;s<e.length;){for(;s<e.length&&_s(e[s]??"");)s+=1;let r=e[s];if(r===void 0)return null;if(r===">")return{end:s+1,selfClosing:!1,attrs:t};if(r==="/"&&e[s+1]===">")return{end:s+2,selfClosing:!0,attrs:t};let o=s;for(;s<e.length;){let l=e[s]??"";if(_s(l)||l==="="||l===">"||l==="/"&&e[s+1]===">")break;s+=1}let i=e.slice(o,s).toLowerCase();if(i.length===0){s+=1;continue}for(;s<e.length&&_s(e[s]??"");)s+=1;if(e[s]!=="="){t.set(i,"");continue}for(s+=1;s<e.length&&_s(e[s]??"");)s+=1;let a=e[s];if(a==='"'||a==="'"){let l=e.indexOf(a,s+1);if(l===-1)return null;t.set(i,e.slice(s+1,l)),s=l+1}else{let l=s;for(;s<e.length&&!_s(e[s]??"")&&e[s]!==">";)s+=1;t.set(i,e.slice(l,s))}}return null}function oS(e,n,t){let s=`</${t}`,r=n;for(;r<e.length;){let o=e.indexOf("</",r);if(o===-1)return-1;if(e.slice(o,o+s.length).toLowerCase()===s)return o;r=o+2}return-1}import{realpathSync as is}from"node:fs";import{isBuiltin as Ja}from"node:module";import cn from"node:path";import C from"typescript";function La(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function Ze(e){let n=La(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Bn(e){let n=La(e);if(n.startsWith("@")){let s=n.indexOf("/");if(s===-1)return n;let r=n.indexOf("/",s+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Ou(e){let n=La(e),t=Bn(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as iS,statSync as Da}from"node:fs";var ss=16*1024*1024;function Hs(e,n){try{let t=Da(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:iS(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function _n(e){let n=Hs(e,ss);return n.kind==="ok"?n.text:null}function st(e){try{return Da(e).isFile()}catch{return!1}}function Pu(e){try{let n=Da(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as aS,realpathSync as Ba}from"node:fs";import Ne from"node:path";import jo from"typescript";var Fu=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Cn(e){return Fu.some(([n])=>e.endsWith(n))}function lS(e){for(let[n,t]of Fu)if(e.endsWith(n)){let s=e.slice(0,-n.length);return t.map(r=>s+r)}return[]}var dS=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function ju(e){if(Cn(e))return e;for(let[n,t]of dS)if(e.endsWith(n)){let s=e.slice(0,-n.length);for(let r of t){let o=s+r;if(st(o))return o}return e}return e}var Ga=[jo.ModuleKind.CommonJS,jo.ModuleKind.ESNext],Ka=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function Pr(e,n,t,s,r,o){let i=jo.resolveModuleName(e,n,t,s,void 0,void 0,r).resolvedModule;if(i===void 0)return null;let a=i.resolvedFileName;if(o){for(let l of lS(a))if(st(l))return l}return a}var Bu=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],cS=[".js",".json",".node"],uS=["index.js","index.json","index.node"];function Bo(e){return Cn(e)?!1:Bu.some(n=>e.endsWith(n))||St(e)!==null}function Gu(e){if(st(e))return e;for(let n of cS)if(st(e+n))return e+n;return null}function Cu(e){for(let n of uS){let t=Ne.join(e,n);if(st(t))return t}return null}var Ku=[".ts",".tsx",".cts",".mts",".jsx"];function fS(e){for(let n of Ku)if(st(e+n))return e+n;return null}function pS(e){for(let n of Ku){let t=Ne.join(e,"index"+n);if(st(t))return t}return null}function za(e){let n=_n(Ne.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let s=Ne.join(e,t),r=Gu(s)??Cu(s);if(r!==null)return r}}catch{}return Cu(e)}function zu(e){return Gu(e)??za(e)??fS(e)??pS(e)}function Wu(e){return zu(e)!==null}function mS(e,n){let t=e.split(Ne.sep),s=n.split("/"),r=null;for(let i=t.length-s.length-1;i>=0;i-=1)if(t[i]==="node_modules"&&s.every((a,l)=>t[i+1+l]===a)){r=t.slice(0,i+1+s.length).join(Ne.sep);break}if(r===null||r==="")return null;let o=_n(Ne.join(r,"package.json"));if(o===null)return null;try{let i=JSON.parse(o),a=i.exports,l=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(i.name!==n||l)return null}catch{return null}try{return Ba(r)}catch{return null}}function gS(e,n){let t=zu(Ne.join(e,n));if(t===null)return null;let s;try{s=Ba(t)}catch{return null}let r=e.endsWith(Ne.sep)?e:e+Ne.sep;return s!==e&&!s.startsWith(r)||Cn(s)||!Bu.some(o=>s.endsWith(o))?null:s}function hS(e,n){let t=Ou(e);return t===""||t.includes("\0")||t.split("/").some(s=>s===""||s==="."||s===".."||s==="node_modules")?null:gS(n,t)}var Ss={kind:"nothing-loads"},Uu={kind:"absent"},Fa=8192;function ja(e,n){let t=n.get(e);if(t!==void 0)return t;let s,r=null;try{r=aS(e);let o=new Set,i=!1;for(;;){let a=r.readSync();if(a===null)break;if(o.size>=Fa){i=!0;break}o.add(a.name)}s={names:o,truncated:i}}catch{s=null}finally{try{r?.closeSync()}catch{}}return n.set(e,s),s}var yS=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function Wa(e){return yS.some(n=>e.length>n.length&&e.endsWith(n))}function rs(e,n){let t=e.endsWith(Ne.sep)?e:e+Ne.sep;return n===e||n.startsWith(t)}function Mu(e,n){let t;try{t=Ba(n)}catch{return{kind:"missing"}}return rs(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Tu(e,n){let t=(n+".").toLowerCase(),s=[];for(let r of e){let o=r.toLowerCase();o.length>t.length&&o.startsWith(t)&&s.push(r)}return s}function bS(e,n,t){let s=Ne.dirname(n);if(!rs(e,s))return null;let r=ja(s,t);if(r===null)return null;let o=Ne.basename(n);return r.names.has(o)?o:null}function $u(e){return Wa(e.split("/").pop()??"")?Ss:Uu}function Lu(e,n){let t=e.filter(r=>!Wa(r));if(t.length===0)return Ss;let s=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${s}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Hu(e,n,t,s){let r=e,o=r.indexOf("?");o!==-1&&(r=r.slice(0,o));let i=r.indexOf("#");if(i!==-1&&(r=r.slice(0,i)),r===""||r.includes("\0"))return Ss;let a=Ne.resolve(Ne.dirname(n),r);if(!rs(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let l=Mu(t,a);if(l.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(l.kind==="ok"){let m=Pu(l.real);if(m==="file"){let _=bS(t,l.real,s);return _!==null&&Wa(_)?Ss:{kind:"unanalyzable",reason:_===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${_}") the analyzer cannot parse`,why:_===null?"probe-refused":"sibling-unparsable"}}if(m!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let g=ja(l.real,s);if(g===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let y=Tu(g.names,"index"),b=Lu(y,"a directory index");return b.kind==="unanalyzable"?b:g.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:g.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Fa)} entries and was not fully probed`,why:"probe-refused"}:y.length===0?Uu:Ss}let d=Ne.basename(a);if(d===""||d==="."||d==="..")return Ss;let c=Mu(t,Ne.dirname(a));if(c.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(c.kind==="missing")return $u(r);let f=ja(c.real,s);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let p=Tu(f.names,d),u=Lu(p,"a sibling file exists");return u.kind==="unanalyzable"?u:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Fa)} entries and was not fully probed`,why:"probe-refused"}:p.length===0?$u(r):Ss}function Ua(e,n){let t=Bn(e),s=Ne.dirname(n);for(let r=0;r<64;r+=1){let o=Ne.join(s,"node_modules",...t.split("/"));if(_n(Ne.join(o,"package.json"))!==null)return o;let i=Ne.dirname(s);if(i===s)return null;s=i}return null}function Du(e,n,t,s,r){let o;for(let i of Ga)for(let a of Ka){let l={...t,noDtsResolution:!0,customConditions:[...a]},d=Pr(e,n,l,s,i,r);if(o===void 0)o=d;else if(o!==d)return null}return o??null}function Gn(e,n,t,s){let r=Ze(e);if(r==="relative"&&St(e)!==null){let a=Ne.resolve(Ne.dirname(n),e);return st(a)?a:null}if(r==="relative")return Pr(e,n,t,s,void 0,!0);if(r==="package-root"){let a=Du(e,n,t,s,!0);if(a!==null)return a;let l=Ua(e,n);if(l===null||_n(Ne.join(l,"package.json"))?.includes('"exports"')===!0)return null;let d=za(l);return d===null||Cn(d)?null:rs(l,d)?d:null}let o=Du(e,n,t,s,!1);if(o===null)return null;let i=mS(o,Bn(e));return i!==null?hS(e,i):Cn(o)?o:ju(o)}function qu(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function Cr(e,n,t,s){let r=Ze(e);if(r==="relative")return"no-candidate";if(qu(e))return"alias-unmapped";let o=new Set;for(let m of Ga)for(let g of Ka){let y={...t,noDtsResolution:!0,customConditions:[...g]};o.add(Pr(e,n,y,s,m,r==="package-root"))}if(o.size>1)return"divergent-exports";let i=Ua(e,n);if(i===null)return"not-installed";let a=_n(Ne.join(i,"package.json"));if(a===null)return"unreadable-manifest";let l;try{l=JSON.parse(a)}catch{return"unreadable-manifest"}if(typeof l!="object"||l===null)return"unreadable-manifest";let d=l,c=d.exports!==void 0&&d.exports!==null,f=typeof d.typesVersions=="object"&&d.typesVersions!==null,[p]=o;if(p!=null)return rs(i,p)?!c&&f?"types-versions-remap":Cn(p)?"declaration-only":"no-candidate":"out-of-root";let u=Pr(e,n,t,s,void 0,!1);if(u!==null&&Cn(u))return!c&&f?"types-versions-remap":"declaration-only";if(r==="package-root"&&!c){let m=za(i);if(m!==null&&!rs(i,m))return"out-of-root"}return"no-candidate"}function qs(e,n,t,s){let r=Gn(e,n,t,s);if(r!==null)return[r];let o=Ze(e);if(o==="relative")return[];let i=new Set;for(let d of Ga)for(let c of Ka){let f={...t,noDtsResolution:!0,customConditions:[...c]};i.add(Pr(e,n,f,s,d,o==="package-root"))}if(i.size<2||i.has(null))return[];let a=Ua(e,n);if(a===null)return[];let l=[];for(let d of i){if(d===null)return[];let c=ju(d);if(Cn(c)||!rs(a,c))return[];l.push(c)}return[...new Set(l)].sort()}function Vu(e,n){let t=Ne.dirname(e);for(let s=0;s<64;s+=1){let r=_n(Ne.join(t,"package.json"));if(r!==null){try{let i=JSON.parse(r);if(typeof i!="object"||i===null)return!1;let a=i.optionalDependencies;if(typeof a=="object"&&a!==null&&n in a)return!0;let l=i.peerDependenciesMeta;if(typeof l=="object"&&l!==null){let d=l[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let o=Ne.dirname(t);if(o===t)return!1;t=o}return!1}function Xu(e,n,t){let s=_n(Ne.join(e,"tsconfig.json"));if(s===null)return()=>null;let r=jo.parseConfigFileTextToJson(Ne.join(e,"tsconfig.json"),s);if(r.error!==void 0)return()=>null;let o=r.config?.compilerOptions;if(typeof o!="object"||o===null)return()=>null;let i=o.paths;if(typeof i!="object"||i===null)return()=>null;let a=o.baseUrl,l=typeof a=="string"?Ne.resolve(e,a):e,d=new Map,c=[];for(let[p,u]of Object.entries(i)){if(!Array.isArray(u))continue;let m=u.filter(y=>typeof y=="string");if(m.length===0)continue;let g=p.indexOf("*");g===-1?d.set(p,m):p.indexOf("*",g+1)===-1&&c.push({prefix:p.slice(0,g),suffix:p.slice(g+1),targets:m})}if(c.sort((p,u)=>u.prefix.length-p.prefix.length),d.size===0&&c.length===0)return()=>null;let f=p=>{let u=d.get(p);if(u!==void 0)return u;for(let m of c){if(p.length<m.prefix.length+m.suffix.length||!p.startsWith(m.prefix)||!p.endsWith(m.suffix))continue;let g=p.slice(m.prefix.length,p.length-m.suffix.length);return m.targets.map(y=>{let b=y.indexOf("*");return b===-1?y:y.slice(0,b)+g+y.slice(b+1)})}return[]};return(p,u)=>{let m=f(p);if(m.length===0||Gn(p,u,n,t)!==null)return null;for(let g of m){let y=Ne.resolve(l,g),b=Ne.relative(Ne.dirname(u),y).split(Ne.sep).join("/");if(b==="")continue;b.startsWith(".")||(b=`./${b}`);let _=Gn(b,u,n,t);if(_!==null&&rs(e,_))return _}return null}}import{readdirSync as _S,realpathSync as SS}from"node:fs";import Dt from"node:path";import ce from"typescript";function Mr(e,n){if(ce.isIdentifier(e))n.add(e.text);else for(let t of e.elements)ce.isBindingElement(t)&&Mr(t.name,n)}function Vs(e){let n=new Map,t=new Set,s=l=>{n.set(l,(n.get(l)??0)+1)},r=l=>{let d=an(l);if(ce.isIdentifier(d))t.add(d.text);else if(ce.isArrayLiteralExpression(d))for(let c of d.elements)r(c);else if(ce.isObjectLiteralExpression(d))for(let c of d.properties)ce.isShorthandPropertyAssignment(c)?t.add(c.name.text):ce.isPropertyAssignment(c)?r(c.initializer):ce.isSpreadAssignment(c)&&r(c.expression);else ce.isSpreadElement(d)?r(d.expression):ce.isBinaryExpression(d)&&d.operatorToken.kind===ce.SyntaxKind.EqualsToken&&r(d.left)},o=l=>{let d=new Set;Mr(l,d);for(let c of d)s(c)},i=l=>{ce.isVariableDeclaration(l)?o(l.name):ce.isFunctionDeclaration(l)&&l.name!==void 0||ce.isClassDeclaration(l)&&l.name!==void 0?s(l.name.text):ce.isParameter(l)?o(l.name):((ce.isFunctionExpression(l)||ce.isClassExpression(l))&&l.name!==void 0&&ce.isIdentifier(l.name)&&!(l.parent!==void 0&&ce.isVariableDeclaration(l.parent)&&l.parent.initializer===l&&ce.isIdentifier(l.parent.name)&&l.parent.name.text===l.name.text)||ce.isImportClause(l)&&l.name!==void 0||ce.isNamespaceImport(l)||ce.isImportSpecifier(l)||ce.isImportEqualsDeclaration(l))&&s(l.name.text),ce.isBinaryExpression(l)&&l.operatorToken.kind>=ce.SyntaxKind.FirstAssignment&&l.operatorToken.kind<=ce.SyntaxKind.LastAssignment?r(l.left):(ce.isPrefixUnaryExpression(l)||ce.isPostfixUnaryExpression(l))&&(l.operator===ce.SyntaxKind.PlusPlusToken||l.operator===ce.SyntaxKind.MinusMinusToken)?r(l.operand):(ce.isForOfStatement(l)||ce.isForInStatement(l))&&!ce.isVariableDeclarationList(l.initializer)&&r(l.initializer),ce.forEachChild(l,i)};i(e);let a=new Set(t);for(let[l,d]of n)d>1&&a.add(l);return a}function xs(e,n,t){let s=Vs(e),r=new Map,o=i=>{ce.isVariableDeclaration(i)&&ce.isIdentifier(i.name)&&i.initializer!==void 0&&!s.has(i.name.text)&&!r.has(i.name.text)&&r.set(i.name.text,i.initializer),ce.forEachChild(i,o)};return o(e),{containingFile:n,taintedNames:s,constBindings:r,resolveParamDirs:t}}var xS=1024,kS=32,wS=new Set(["filter","sort","slice","reverse"]),vS=new Set(["forEach","map","filter","flatMap","find","some","every"]);function an(e){let n=e;for(;ce.isParenthesizedExpression(n);)n=n.expression;return n}function Yu(e,n){return ce.isPropertyAccessExpression(e)&&ce.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function os(e,n,t,s){if(t>kS)return null;let r=an(e);if(ce.isStringLiteralLike(r))return r.text;if(ce.isTemplateExpression(r)){let o=r.head.text;for(let i of r.templateSpans){let a=os(i.expression,n,t+1,s);if(a===null)return null;o+=a+i.literal.text}return o}if(ce.isBinaryExpression(r)&&r.operatorToken.kind===ce.SyntaxKind.PlusToken){let o=os(r.left,n,t+1,s);if(o===null)return null;let i=os(r.right,n,t+1,s);return i===null?null:o+i}if(ce.isIdentifier(r)){if(r.text==="__dirname")return Dt.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||s.has(r.text))return null;let o=n.constBindings.get(r.text);if(o===void 0)return null;s.add(r.text);let i=os(o,n,t+1,s);return s.delete(r.text),i}if(ce.isCallExpression(r)){let o=Yu(r.expression,"join"),i=Yu(r.expression,"resolve");if(!o&&!i)return null;let a=[];for(let d of r.arguments){let c=os(d,n,t+1,s);if(c===null)return null;a.push(c)}let l=a[0];return l===void 0||i&&!Dt.isAbsolute(l)?null:i?Dt.resolve(...a):Dt.join(...a)}return null}function Go(e){let n=an(e);if(ce.isBinaryExpression(n)&&n.operatorToken.kind===ce.SyntaxKind.PlusToken)return[...Go(n.left),...Go(n.right)];if(ce.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let s of n.templateSpans)t.push({expr:s.expression}),s.literal.text.length>0&&t.push({lit:s.literal.text});return t}return ce.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Zu(e){let n=e,t=0;for(;t++<4096;){let s=n.parent;if(s===void 0)return null;if(ce.isForOfStatement(s)&&s.statement===n){let r=s.initializer;if(ce.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&ce.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let o=Ju(s.expression);if(o!==null)return o}}if((ce.isArrowFunction(n)||ce.isFunctionExpression(n))&&ce.isCallExpression(s)&&s.arguments.length>0&&s.arguments[0]===n&&ce.isPropertyAccessExpression(s.expression)&&vS.has(s.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&ce.isIdentifier(r.name)&&r.name.text===e.text){let o=Ju(s.expression.expression);if(o!==null)return o}}n=s}return null}function Ju(e){let n=an(e),t=0;for(;ce.isCallExpression(n)&&t++<16;){let s=n.expression;if(ce.isPropertyAccessExpression(s)){let r=s.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(wS.has(r)){n=an(s.expression);continue}return null}return ce.isIdentifier(s)&&s.text==="readdirSync"?n.arguments[0]??null:null}return null}function ES(e,n){let t=Go(e);if(t.length<2)return null;let s=t[t.length-1];if(s===void 0||!("expr"in s)||!ce.isIdentifier(s.expr))return null;let r=s.expr;if(n.taintedNames.has(r.text))return null;let o="";for(let d=0;d<t.length-1;d+=1){let c=t[d];if(c===void 0)return null;if("lit"in c)o+=c.lit;else{let f=os(c.expr,n,0,new Set);if(f===null)return null;o+=f}}let i=Zu(r),a=i===null?null:os(i,n,0,new Set);if(a===null)return null;let l=Dt.resolve(o);return l!==Dt.resolve(a)?null:l}function AS(e){if((ce.isFunctionDeclaration(e)||ce.isFunctionExpression(e))&&e.name!==void 0&&ce.isIdentifier(e.name)||ce.isMethodDeclaration(e)&&ce.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&ce.isVariableDeclaration(n)&&ce.isIdentifier(n.name)?n.name.text:null}function IS(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!ce.isFunctionLike(t))continue;let s=-1;for(let o=0;o<t.parameters.length;o+=1){let i=t.parameters[o];if(i!==void 0&&ce.isIdentifier(i.name)&&i.name.text===n){s=o;break}}if(s<0)continue;let r=AS(t);return r===null?null:{fnName:r,paramIndex:s}}return null}function Tr(e,n){let t=Go(e);if(t.length!==2)return null;let[s,r]=t;if(s===void 0||!("expr"in s)||!ce.isIdentifier(s.expr)||r===void 0||!("expr"in r)||!ce.isIdentifier(r.expr))return null;let o=s.expr,i=r.expr;if(n.taintedNames.has(o.text)||n.taintedNames.has(i.text))return null;let a=Zu(i);return a===null||!ce.isIdentifier(a)||a.text!==o.text?null:IS(o,o.text)}function NS(e,n){if(n.resolveParamDirs===void 0)return null;let t=Tr(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function Ko(e){for(let n=e.parent;n!==void 0;n=n.parent){if(ce.isSourceFile(n))return!0;if(!ce.isArrowFunction(n)&&ce.isFunctionLike(n))return!1}return!0}function Ha(e,n){let t=os(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let s=ES(e,n);if(s!==null)return{kind:"dir",dir:s};let r=NS(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function ef(e,n){let t;try{t=SS(e)}catch{return null}let s=n.endsWith(Dt.sep)?n:n+Dt.sep;return t===n||t.startsWith(s)?t:null}function nf(e,n,t,s,r){let o=Gn(e,n,s,r);return o===null||Cn(o)||!Bo(o)?null:ef(o,t)}function Qu(e,n,t,s,r){let o=ef(e,t);if(o===null)return[];let i;try{i=_S(o)}catch{return[]}if(i.length===0||i.length>xS)return[];i.sort();let a=new Set,l=[];for(let d of i){let c=nf(Dt.join(o,d),n,t,s,r);c!==null&&!a.has(c)&&(a.add(c),l.push(c))}return l}function zo(e,n,t,s,r){let o=Ha(e,n);if(o.kind==="const"){if(Ze(o.value)==="package-root")return[];let i=nf(o.value,n.containingFile,t,s,r);return i===null?[]:[i]}if(o.kind==="dir")return Qu(o.dir,n.containingFile,t,s,r);if(o.kind==="dirs"){let i=new Set,a=[];for(let l of o.dirs)for(let d of Qu(l,n.containingFile,t,s,r))i.has(d)||(i.add(d),a.push(d));return a}return[]}import RS from"node:path";import Fe from"typescript";var OS=32,Wo="\0",tf=(e,n)=>`${e}${Wo}${n}`,sf=(e,n,t)=>`${e}${Wo}${n}${Wo}${String(t)}`;function PS(e){let n=new Map,t=new Set,s=(r,o)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,o)};for(let r of e.statements)if(Fe.isImportDeclaration(r)&&Fe.isStringLiteralLike(r.moduleSpecifier)){let o=r.moduleSpecifier.text,i=r.importClause;if(i===void 0)continue;i.name!==void 0&&s(i.name.text,{kind:"module",specifier:o});let a=i.namedBindings;if(a!==void 0&&Fe.isNamespaceImport(a))s(a.name.text,{kind:"module",specifier:o});else if(a!==void 0&&Fe.isNamedImports(a))for(let l of a.elements)s(l.name.text,{kind:"named",specifier:o,imported:(l.propertyName??l.name).text})}else if(Fe.isImportEqualsDeclaration(r)&&Fe.isExternalModuleReference(r.moduleReference)&&Fe.isStringLiteralLike(r.moduleReference.expression))s(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(Fe.isFunctionDeclaration(r)&&r.name!==void 0)s(r.name.text,{kind:"local"});else if(Fe.isVariableStatement(r))for(let o of r.declarationList.declarations){if(o.initializer===void 0)continue;let i=o.initializer;if(Fe.isIdentifier(o.name))Fe.isArrowFunction(i)||Fe.isFunctionExpression(i)?s(o.name.text,{kind:"local"}):rf(i)&&s(o.name.text,{kind:"module",specifier:of(i)});else if(Fe.isObjectBindingPattern(o.name)&&rf(i)){let a=of(i);for(let l of o.name.elements){if(l.dotDotDotToken!==void 0||!Fe.isIdentifier(l.name))continue;let d=l.propertyName??l.name;!Fe.isIdentifier(d)&&!Fe.isStringLiteralLike(d)||s(l.name.text,{kind:"named",specifier:a,imported:d.text})}}}return n}function rf(e){return Fe.isCallExpression(e)&&Fe.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&Fe.isStringLiteralLike(e.arguments[0])}function of(e){let n=e.arguments[0];return n!==void 0&&Fe.isStringLiteralLike(n)?n.text:"\0"}function CS(e){let n=e.expression;if(Fe.isPropertyAccessExpression(n))return n.name.text;if(Fe.isIdentifier(n))return n.text}function MS(e,n,t,s,r,o){let i=e.expression,a=l=>{let d=`${l}${Wo}${n}`,c=o.get(d);if(c!==void 0||o.has(d))return c??null;let f=Gn(l,n,s,r),p=f===null?null:RS.resolve(f);return o.set(d,p),p};if(Fe.isPropertyAccessExpression(i)&&Fe.isIdentifier(i.expression)){let l=t.get(i.expression.text);if(l?.kind==="module"){let d=a(l.specifier);return d===null?null:{moduleReal:d,fnName:i.name.text}}return null}if(Fe.isIdentifier(i)){let l=t.get(i.text);if(l?.kind==="named"){let d=a(l.specifier);return d===null?null:{moduleReal:d,fnName:l.imported}}return l?.kind==="local"?{moduleReal:n,fnName:i.text}:null}return null}function af(e,n,t,s,r=new Map){if(n.length===0)return()=>null;let o=new Map,i=new Set;for(let l of n){let d=tf(l.definingModuleReal,l.fnName),c=o.get(d);c===void 0&&(c=new Set,o.set(d,c)),c.add(l.paramIndex),i.add(l.fnName)}let a=new Map;for(let l of e){let d=xs(l.sf,l.real),c=PS(l.sf),f=p=>{if(Fe.isCallExpression(p)){let u=CS(p);if(u!==void 0&&i.has(u)&&Ko(p)){let m=MS(p,l.real,c,t,s,r);if(m!==null){let g=o.get(tf(m.moduleReal,m.fnName));if(g!==void 0)for(let y of g){let b=p.arguments[y];if(b===void 0)continue;let _=Ha(b,d);if(_.kind==="const"){let S=sf(m.moduleReal,m.fnName,y),k=a.get(S);k===void 0&&(k=new Set,a.set(S,k)),k.add(_.value)}}}}}Fe.forEachChild(p,f)};f(l.sf)}return(l,d,c)=>{let f=a.get(sf(l,d,c));return f===void 0||f.size===0||f.size>OS?null:[...f].sort()}}var gn={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:C.ScriptTarget.ES2020,module:C.ModuleKind.CommonJS,moduleResolution:C.ModuleResolutionKind.Node10,types:[]},Uo=5e3;function hn(e,n){let t;try{t=is(n)}catch{t=cn.resolve(n)}let s=e.endsWith(cn.sep)?e:e+cn.sep;return t!==e&&!t.startsWith(s)?null:t===e?"":t.slice(s.length).split(cn.sep).join("/")}function TS(e,n){let t=hn(e,n);return t!==null&&!t.split("/").includes("node_modules")}function $S(e,n){if(C.isFunctionLike(e))return n!==e.name&&!C.isDecorator(n)&&!LS(e);if(C.isPropertyDeclaration(e))return n===e.initializer&&(C.getCombinedModifierFlags(e)&C.ModifierFlags.Static)===0;if(C.isTryStatement(e))return n===e.catchClause||n===e.tryBlock&&e.catchClause!==void 0;if(C.isIfStatement(e))return n!==e.expression;if(C.isConditionalExpression(e))return n!==e.condition;if(C.isCaseClause(e))return n!==e.expression;if(C.isDefaultClause(e))return!0;if(C.isBinaryExpression(e)){let t=e.operatorToken.kind;return n===e.right&&(t===C.SyntaxKind.AmpersandAmpersandToken||t===C.SyntaxKind.BarBarToken||t===C.SyntaxKind.QuestionQuestionToken||t===C.SyntaxKind.AmpersandAmpersandEqualsToken||t===C.SyntaxKind.BarBarEqualsToken||t===C.SyntaxKind.QuestionQuestionEqualsToken)}return C.isForStatement(e)?n===e.statement||n===e.incrementor:C.isForInStatement(e)||C.isForOfStatement(e)||C.isWhileStatement(e)?n===e.statement:C.isBindingElement(e)?n===e.initializer:C.isShorthandPropertyAssignment(e)?n===e.objectAssignmentInitializer:C.isCallExpression(e)&&C.isOptionalChain(e)?e.arguments.some(t=>t===n):C.isElementAccessExpression(e)&&C.isOptionalChain(e)?n===e.argumentExpression:!1}function LS(e){if(!C.isFunctionExpression(e)&&!C.isArrowFunction(e)||C.isFunctionExpression(e)&&e.asteriskToken!==void 0)return!1;let n=e;for(;C.isParenthesizedExpression(n.parent);)n=n.parent;let t=n.parent;return(C.isCallExpression(t)||C.isNewExpression(t))&&t.expression===n?!0:C.isPropertyAccessExpression(t)&&t.expression===n&&(t.name.text==="call"||t.name.text==="apply")&&C.isCallExpression(t.parent)&&t.parent.expression===t}function Ve(e){let n=e;for(;;)if(C.isParenthesizedExpression(n))n=n.expression;else if(C.isBinaryExpression(n)&&n.operatorToken.kind===C.SyntaxKind.CommaToken)n=n.right;else return n}function Ft(e){return C.isPropertyAccessExpression(e)?{receiver:Ve(e.expression),name:e.name.text}:C.isElementAccessExpression(e)&&C.isStringLiteralLike(e.argumentExpression)?{receiver:Ve(e.expression),name:e.argumentExpression.text}:null}function Dr(e){let n=Ve(e.expression);if(C.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===C.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=Ft(n);if(t!==null){if(t.name==="require"&&C.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(C.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let s=e.arguments[1];return{specifierArg:s!==void 0&&C.isArrayLiteralExpression(s)?s.elements[0]:void 0}}}}return null}function lf(e){let n=[],t=(s,r)=>{if(C.isImportDeclaration(s)&&C.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.importClause?.isTypeOnly!==!0,unguarded:!r&&C.isSourceFile(s.parent)});else if(C.isImportEqualsDeclaration(s)&&C.isExternalModuleReference(s.moduleReference)&&C.isStringLiteralLike(s.moduleReference.expression))n.push({text:s.moduleReference.expression.text,runtime:!0,unguarded:!r&&C.isSourceFile(s.parent)});else if(C.isExportDeclaration(s)&&s.moduleSpecifier!==void 0&&C.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.isTypeOnly!==!0,unguarded:!r&&C.isSourceFile(s.parent)});else if(C.isCallExpression(s)){let o=Dr(s),i=o?.specifierArg;if(o!==null&&i!==void 0&&C.isStringLiteralLike(i)){let a=Ve(s.expression).kind===C.SyntaxKind.ImportKeyword;n.push({text:i.text,runtime:!0,unguarded:!r&&(!a||DS(s))})}}C.forEachChild(s,o=>{t(o,r||$S(s,o))})};return t(e,!1),n}function DS(e){let n=e;for(;C.isParenthesizedExpression(n.parent);)n=n.parent;return C.isAwaitExpression(n.parent)}function FS(e,n){let t=n===C.ScriptKind.TSX?"__scriptkind_probe.tsx":n===C.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",s=C.createSourceFile(t,e,C.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},o={getSourceFile:i=>i===t?s:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:i=>i,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:i=>i===t,readFile:i=>i===t?e:void 0};return C.createProgram({rootNames:[t],options:r,host:o}).getSyntacticDiagnostics(s).length}function Qa(e){return e.endsWith(".js")||e.endsWith(".jsx")}function jS(e){return cn.extname(e)===""}function BS(e){if(!e.startsWith("#!"))return"none";let n=e.indexOf(`
+`),t=(n===-1?e:e.slice(0,n)).slice(0,512);return/(?:^|[\s/])node(?:\s|$)/u.test(t)?"node":"other"}function df(e){let n=0,t=s=>{(C.isCallExpression(s)||C.isNewExpression(s)||C.isTaggedTemplateExpression(s))&&(n+=1),C.forEachChild(s,t)};return t(e),n}function ff(e,n){let t=lf(C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0));if(!Qa(e)||!n.includes("<")||!n.includes("require"))return t;let s=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX),r=i=>`${i.runtime?"R":"T"}${i.unguarded?"U":"G"}:${i.text}`,o=new Set(t.map(r));for(let i of lf(s)){let a=r(i);o.has(a)||(o.add(a),t.push(i))}return t}function cf(e,n,t,s,r){if(!n.includes("require")&&!n.includes("import("))return[];let o=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0),i=xs(o,e,r),a=[],l=new Set;return pf(o,d=>{for(let c of zo(d,i,t,gn,s))l.has(c)||(l.add(c),a.push(c))}),a}function pf(e,n){let t=s=>{if(C.isCallExpression(s)){let r=Dr(s),o=r?.specifierArg;r!==null&&o!==void 0&&!C.isStringLiteralLike(o)&&n(o)}C.forEachChild(s,t)};t(e)}function GS(e){let n=[];for(let t of e){let s=xs(t.sf,t.real);pf(t.sf,r=>{let o=Tr(r,s);o!==null&&n.push({definingModuleReal:t.real,fnName:o.fnName,paramIndex:o.paramIndex})})}return n}var KS=4,qa=Uo,Va=new Set(["eval","Function","createRequire"]),zS=new Set(["require","eval","Function","createRequire"]),Vo=new Set(["module","Module","require","process","global","globalThis"]),Xo=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function WS(e){return e===C.SyntaxKind.LessThanToken||e===C.SyntaxKind.GreaterThanToken||e===C.SyntaxKind.LessThanEqualsToken||e===C.SyntaxKind.GreaterThanEqualsToken||e===C.SyntaxKind.EqualsEqualsToken||e===C.SyntaxKind.EqualsEqualsEqualsToken||e===C.SyntaxKind.ExclamationEqualsToken||e===C.SyntaxKind.ExclamationEqualsEqualsToken||e===C.SyntaxKind.InstanceOfKeyword||e===C.SyntaxKind.InKeyword}function US(e){let n=e.parent;return(C.isParameter(n)||C.isVariableDeclaration(n)||C.isBindingElement(n)||C.isFunctionDeclaration(n)||C.isFunctionExpression(n)||C.isClassDeclaration(n)||C.isClassExpression(n)||C.isPropertyAssignment(n)||C.isPropertyDeclaration(n)||C.isMethodDeclaration(n))&&n.name===e?!0:C.isPropertyAccessExpression(n)&&n.name===e}function HS(e,n){return C.isCallExpression(n)&&n.expression===e||(C.isPropertyAccessExpression(n)||C.isElementAccessExpression(n))&&n.expression===e||C.isTypeOfExpression(n)||C.isVoidExpression(n)||C.isDeleteExpression(n)||C.isPrefixUnaryExpression(n)||C.isPostfixUnaryExpression(n)?!0:C.isBinaryExpression(n)&&WS(n.operatorToken.kind)}function mf(e){let n=e,t=e.parent;for(;;)if(C.isParenthesizedExpression(t))n=t,t=t.parent;else if(C.isBinaryExpression(t)&&t.operatorToken.kind===C.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!HS(n,t)}function qS(e){return US(e)?!1:mf(e)}function gf(e){let n=Ft(e);if(n!==null&&Xo.has(n.name))return!0;if(C.isElementAccessExpression(e)&&!C.isStringLiteralLike(e.argumentExpression)){let t=Ve(e.expression);if(C.isIdentifier(t)&&Vo.has(t.text))return!0}return!1}function $r(e){let n=Ft(e);if(n===null||n.name!=="constructor")return!1;let t=Ft(n.receiver);return t!==null&&t.name==="constructor"}function hf(e){if(!C.isCallExpression(e))return!1;let n=Ve(e.expression);if(!C.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&C.isStringLiteralLike(t)&&t.text==="module"}var VS={roots:new Map,nodes:new Set,saturated:!1};function yf(e){return C.isSourceFile(e)||C.isFunctionDeclaration(e)||C.isFunctionExpression(e)||C.isArrowFunction(e)||C.isMethodDeclaration(e)||C.isConstructorDeclaration(e)||C.isGetAccessorDeclaration(e)||C.isSetAccessorDeclaration(e)||C.isClassStaticBlockDeclaration(e)||C.isModuleDeclaration(e)}function bf(e,n){let t=e.parent;for(;t!==void 0;){if(yf(t))return t;t=t.parent}return n}function XS(e){let n=new Set;if(C.isFunctionLike(e))for(let s of e.parameters)for(let r of Lr(s.name))n.add(r);let t=[e];for(;t.length>0;){let s=t.pop();if(s===void 0)break;if(!(s!==e&&yf(s))){if(C.isVariableDeclaration(s)&&C.isVariableDeclarationList(s.parent)&&!((s.parent.flags&C.NodeFlags.BlockScoped)!==0))for(let o of Lr(s.name))n.add(o);C.forEachChild(s,r=>{t.push(r)})}}return n}function YS(e,n,t){let s=bf(e,n);if(C.isSourceFile(s))return n;let r=t.get(s);return r===void 0&&(r=XS(s),t.set(s,r)),r.has(e.text)?s:n}function Ho(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let s=n;for(;;){if(t.has(s))return!0;let r=s.parent;if(r===void 0)return!C.isSourceFile(s);s=r}}var JS=12,QS=8;function qo(e,n){let t=Ve(e);for(;;){if(n.nodes.has(t))return!0;if(C.isIdentifier(t))return Vo.has(t.text)||Ho(n,t);if(C.isCallExpression(t))return hf(t);let s=Ft(t);if(s!==null){if(s.name==="constructor")return!0;t=s.receiver;continue}if(C.isElementAccessExpression(t)){t=Ve(t.expression);continue}return!1}}function _f(e){let n=Ft(Ve(e.expression));if(n===null||n.name!=="get"||!C.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function ZS(e,n){let t=_f(e);if(t===null||!qo(t.target,n))return!1;let s=t.key;return s===void 0||!C.isStringLiteralLike(s)?!0:Xo.has(s.text)}function Xa(e){if(!C.isFunctionExpression(e)&&!C.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,s=r=>{if(!(t||C.isFunctionExpression(r)||C.isFunctionDeclaration(r)||C.isClassLike(r))){if(C.isReturnStatement(r)&&r.expression!==void 0&&Ve(r.expression).kind===C.SyntaxKind.ThisKeyword){t=!0;return}C.forEachChild(r,s)}};return s(n),t}function Lr(e){if(C.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)C.isOmittedExpression(t)||n.push(...Lr(t.name));return n}function Sf(e){return e.parameters.map(n=>Lr(n.name))}function ex(e){let n=new Map,t=new Set,s=(o,i)=>{let a={fn:i,slots:Sf(i)},l=n.get(o);l===void 0?n.set(o,[a]):l.push(a),Xa(i)&&t.add(o)},r=o=>{if(C.isFunctionDeclaration(o)&&o.name!==void 0)s(o.name.text,o);else if(C.isVariableDeclaration(o)&&C.isIdentifier(o.name)&&o.initializer!==void 0){let i=Ve(o.initializer);(C.isFunctionExpression(i)||C.isArrowFunction(i))&&s(o.name.text,i)}C.forEachChild(o,r)};return r(e),{params:n,thisReturning:t}}function nx(e){let n=new Map,t=new Set,s={roots:n,nodes:t},r=ex(e),o=new Map,i=new Set(r.thisReturning),a=!0;for(let l=0;a;l+=1){if(l>=JS)return{roots:n,nodes:t,saturated:!0};a=!1;let d=(g,y)=>{y!==""&&!g.has(y)&&(g.add(y),a=!0)},c=(g,y)=>{if(g==="")return;let b=n.get(g);b===void 0&&(b=new Set,n.set(g,b)),b.has(y)||(b.add(y),a=!0)},f=g=>{t.has(g)||(t.add(g),a=!0)},p=(g,y)=>{let b=Ve(g.expression);if(C.isIdentifier(b)&&Va.has(b.text)||$r(b)||C.isCallExpression(g)&&hf(g)||Xa(b))return!0;let _=Ft(b);if(_!==null&&(_.name==="call"||_.name==="apply"||_.name==="bind")){let S=_.receiver;if(Xa(S)||t.has(S)||C.isIdentifier(S)&&(Ho(s,S)||i.has(S.text)))return!0}if(t.has(b)||(C.isCallExpression(b)||C.isNewExpression(b))&&p(b,y+1)||C.isIdentifier(b)&&(Ho(s,b)||i.has(b.text)))return!0;if(C.isCallExpression(g)){let S=_f(g);if(S!==null&&qo(S.target,s))return!0}return!1},u=(g,y)=>{if(y>=QS)return!0;let b=Ve(g);if(t.has(b))return!0;if(C.isIdentifier(b))return Vo.has(b.text)||Ho(s,b);if(C.isBinaryExpression(b)){let _=b.operatorToken.kind;return _===C.SyntaxKind.BarBarToken||_===C.SyntaxKind.AmpersandAmpersandToken||_===C.SyntaxKind.QuestionQuestionToken?u(b.left,y+1)||u(b.right,y+1):!1}return C.isConditionalExpression(b)?u(b.whenTrue,y+1)||u(b.whenFalse,y+1):C.isPropertyAccessExpression(b)||C.isElementAccessExpression(b)?qo(b,s):C.isCallExpression(b)||C.isNewExpression(b)?p(b,y+1):!1},m=(g,y)=>{if((C.isVariableDeclaration(g)||C.isParameter(g)||C.isBindingElement(g))&&g.initializer!==void 0){if(u(g.initializer,0)){let _=bf(g,e);for(let S of Lr(g.name))c(S,_)}}else if(C.isBinaryExpression(g)&&g.operatorToken.kind===C.SyntaxKind.EqualsToken&&C.isIdentifier(g.left)&&u(g.right,0))c(g.left.text,YS(g.left,e,o));else if(C.isReturnStatement(g)&&g.expression!==void 0&&y!==void 0&&u(g.expression,0))d(i,y);else if(C.isCallExpression(g)||C.isNewExpression(g)){p(g,0)&&f(g);let _=Ve(g.expression),S=Ft(_),k=S!==null&&S.name==="call",v=S!==null&&S.name==="apply",I=k||v?S.receiver:_,O=k?1:0,E=[];C.isFunctionExpression(I)||C.isArrowFunction(I)?E.push({fn:I,slots:Sf(I)}):C.isIdentifier(I)&&E.push(...r.params.get(I.text)??[]);let N=g.arguments??[];if(v){let A=N[1]===void 0?void 0:Ve(N[1]);for(let{fn:U,slots:$}of E)if(A!==void 0&&C.isArrayLiteralExpression(A))for(let W=0;W<A.elements.length;W+=1){let w=A.elements[W],P=$[W];if(!(w===void 0||P===void 0)&&u(w,0))for(let j of P)c(j,U)}else if(A!==void 0)for(let W of $)for(let w of W)c(w,U)}else for(let{fn:A,slots:U}of E)for(let $=O;$<N.length;$+=1){let W=N[$],w=U[$-O];if(!(W===void 0||w===void 0)&&u(W,0))for(let P of w)c(P,A)}}let b=y;if(C.isFunctionDeclaration(g))b=g.name?.text;else if(C.isFunctionExpression(g)||C.isArrowFunction(g)){let _=g.parent;b=C.isVariableDeclaration(_)&&C.isIdentifier(_.name)?_.name.text:void 0}C.forEachChild(g,_=>m(_,b))};m(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function tx(e){if(C.isIdentifier(e)&&Va.has(e.text)||$r(e))return!0;let n=Ft(e);if(n!==null&&(Xo.has(n.name)||(n.name==="call"||n.name==="apply")&&(C.isIdentifier(n.receiver)&&Va.has(n.receiver.text)||$r(n.receiver)||(C.isPropertyAccessExpression(n.receiver)||C.isElementAccessExpression(n.receiver))&&gf(n.receiver))))return!0;if(C.isElementAccessExpression(e)&&!C.isStringLiteralLike(e.argumentExpression)){let t=Ve(e.expression);if(C.isIdentifier(t)&&Vo.has(t.text))return!0}return!1}var sx=4;function uf(e,n){for(let t of e){if(!C.isStringLiteralLike(t)||n>=sx)return!0;let s=C.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,M.ScriptTarget.Latest,!0),r=s.parseDiagnostics;if(r!==void 0&&r.length>0||Gg(s,n+1,!0))return!0}return!1}function Gg(e,n=0,t=!1){return Ii(e,n,t).size>0}function Ii(e,n=0,t=!1){let s=new Set,r=t?Dg:qg(e);if(r.saturated)return s.add("saturated"),s;let i=a=>M.isElementAccessExpression(a)&&!M.isStringLiteralLike(a.argumentExpression)&&Xr(Xe(a.expression),r),o=a=>{if(t&&(M.isCallExpression(a)||M.isNewExpression(a)||M.isTaggedTemplateExpression(a))){s.add("eval-invocation");return}if(M.isCallExpression(a)){let d=Qs(a);if(d!==null){let l=d.specifierArg;if(l===void 0||!M.isStringLiteralLike(l)||t){s.add("non-literal-load");return}}else{let l=Xe(a.expression);if(M.isIdentifier(l)&&(l.text==="eval"||l.text==="Function")){if(dc(a.arguments,n)){s.add("eval-code");return}}else if(Hg(l)){s.add("loader-callee");return}else if(i(l)){s.add("computed-loader");return}else if(zg(a,r)){s.add("reflect-get");return}}}else if(M.isNewExpression(a)){let d=Xe(a.expression);if(M.isIdentifier(d)&&d.text==="Function"){if(dc(a.arguments??[],n)){s.add("function-ctor");return}}else if(Js(d)){s.add("ctor-chain");return}}else if(M.isIdentifier(a)&&Cg.has(a.text)&&Lg(a)){s.add("captured-loader");return}else if((M.isPropertyAccessExpression(a)||M.isElementAccessExpression(a))&&(pc(a)||Js(a)||i(a))&&fc(a)){s.add("captured-member");return}else if(M.isBindingElement(a)){let d=a.propertyName??a.name,l=M.isIdentifier(d)||M.isStringLiteralLike(d)?d.text:M.isComputedPropertyName(d)&&M.isStringLiteralLike(d.expression)?d.expression.text:void 0;if(l!==void 0&&Jr.has(l)){s.add("destructured-member");return}}M.forEachChild(a,o)};return o(e),s}function xc(e,n,t){let s=new Set(Ii(t));if(Oi(e)&&n.includes("<")&&n.includes("require")){let r=M.createSourceFile(e,n,M.ScriptTarget.ES2020,!0,M.ScriptKind.TSX);for(let i of Ii(r))s.add(i)}return s}function Vg(e,n,t){if(Ri(e))return!0;let s=t.endsWith(ln.sep)?t:t+ln.sep,r=e.split("/"),i=n;for(;;){let o=ln.join(i,"node_modules",...r),a;try{a=Wt(ln.join(o,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(s))return!1;let l=on(a);if(l===null)return!1;let c;try{c=JSON.parse(l).exports}catch{return!1}if(typeof c=="string"||Array.isArray(c)||typeof c=="object"&&c!==null)return!1}if(Ud(o))return!1;if(i===t)break;let d=ln.dirname(i);if(d===i||d!==t&&!d.startsWith(s))break;i=d}return!0}function Xg(e,n){let t=n.endsWith(ln.sep)?n:n+ln.sep,s=ln.dirname(e);for(;;){let r=ln.join(s,"package.json"),i;try{i=Wt(r)}catch{i=null}if(i!==null&&(i===n||i.startsWith(t))){let a=on(i);if(a!==null)try{let d=JSON.parse(a).name;if(typeof d=="string"&&d.length>0)return d}catch{return null}}if(s===n)break;let o=ln.dirname(s);if(o===s||o!==n&&!o.startsWith(t))break;s=o}return null}function Yg(e,n,t,s,r){let i=[],o=[],a=new Set,d={},l=[],c=[],p=new Set,u=new Set,f=[],h=!1,g=(_,b)=>{let x;try{x=Wt(b)}catch{return!1}let k=mn(e,x);if(k===null)return r.push({code:"out-of-root",path:x,detail:"dependency module resolved outside the app root; not followed"}),!1;let w=!t.has(x)&&!u.has(x);return w&&u.size>=Ei?(h=!0,!1):(o.push({from:_,to:{module:k}}),w?(u.add(x),i.push(k),!0):!1)},y=(_,b)=>{if(a.add(b),p.has(b))return;p.add(b);let x=Cn(b,_,an,n),k=x!==null?[x]:hs(b,_,an,n);k.length>=2&&l.push({path:mn(e,_)??_,specifier:b,candidates:k.map(I=>mn(e,I)??I)});let w=!1;for(let I of k)if(!Sn(I)&&(w=!0,g({surface:b},I))){f.push(I);try{let N=mn(e,Wt(I)),v=Xg(I,e);N!==null&&v!==null&&(d[N]=v)}catch{}}w||Vg(b,ln.dirname(_),e)||r.push({code:"unresolved-specifier",path:b,reason:Vs(b,_,an,n),detail:`dependency "${b}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let _ of s)y(_.containingFile,_.packageName);for(;f.length>0&&u.size<Ei;){let _=f.pop();if(_===void 0)break;let b=mn(e,_);if(b===null)continue;let x=ms(_,Pt);if(x.kind==="too-large"){r.push({code:"limit-exceeded",path:b,detail:`dependency module over the ${String(Pt/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(x.kind==="not-regular"){r.push({code:"parse-error",path:b,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let k=M.createSourceFile(_,x.text,M.ScriptTarget.ES2020,!0),w=k.parseDiagnostics;if(w!==void 0&&w.length>0){r.push({code:"dependency-body",path:b,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let I=xc(_,x.text,k);if(I.size>0){r.push({code:"dependency-body",path:b,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...I].sort()});continue}r.push({code:"dependency-body",path:b,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:b});for(let N of cc(_,x.text))if(N.runtime)if(We(N.text)==="package-root"){let v=Pn(N.text);o.push({from:{module:b},to:{surface:v}}),y(_,v)}else{if(Ri(Pn(N.text)))continue;let v=Cn(N.text,_,an,n),C=v!==null?[v]:hs(N.text,_,an,n);if(C.length===0){if(We(N.text)==="package-subpath"){let R=Vs(N.text,_,an,n);if(R==="no-candidate"||R==="not-installed"&&Gd(_,Pn(N.text))){c.push({path:b,specifier:N.text,why:R});continue}r.push({code:"unresolved-specifier",path:b,reason:R,detail:`runtime package-subpath import "${N.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}C.length>=2&&l.push({path:b,specifier:N.text,candidates:C.map(R=>mn(e,R)??R)});for(let R of C){if(Sn(R)){let F=mn(e,R);r.push({code:F===null?"out-of-root":"declaration-shadow",path:b,detail:F===null?`runtime import "${N.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${N.text}" resolved to the declaration file "${F}" with no co-located runtime module; its code was not analyzed`});continue}g({module:b},R)&&f.push(R)}}}return(h||f.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(Ei)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:i,edges:o,surfacePackages:[...a],entryRealNames:d,conditionUnions:l,provenAbsent:c}}function bc(e,n,t=!1){let s=Wt(e),r=[],i=[],o=M.createCompilerHost(an,!0),a=t?Vd(s,an,o):()=>null,d=new Set,l=new Set,c=n.map(P=>ln.join(s,P)),p=[],u=new Map,f=new Map,h=new Map,g=new Map,y=new Set,_=(P,U,E)=>{let T=`${String(P.length)}:${P}${U}`;y.has(T)||(y.add(T),r.push({code:"unresolved-specifier",path:P,detail:U,reason:E}))},b=()=>null,x=0,k=(P,U)=>{let E=f.get(P);return E===void 0&&(E=M.createSourceFile(P,U,M.ScriptTarget.ES2020,!0),f.set(P,E)),{real:P,sf:E}};for(;l.size<Gr;){let P=c.pop();if(P===void 0){if(x>=Pg)break;x+=1;let K=[];for(let[Y,V]of u)V.includes("readdir")&&(V.includes("require")||V.includes("import("))&&K.push(k(Y,V));let J=Og(K);if(J.length===0)break;let W=[];for(let[Y,V]of u)W.push(k(Y,V));b=oc(W,J,an,o,h);let se=!1;for(let Y of K){let V=u.get(Y.real);if(V!==void 0)for(let fe of lc(Y.real,V,s,o,b))l.has(fe)||(c.push(fe),se=!0)}if(!se)break;continue}let U;try{U=Wt(P)}catch{continue}if(l.has(U))continue;if(l.add(U),mn(s,U)===null){r.push({code:"out-of-root",path:P,detail:"resolved outside app root"});continue}let E=ms(U,Pt);if(E.kind==="too-large"){r.push({code:"limit-exceeded",path:U,detail:`file is ${String(Math.round(E.bytes/1048576))}MiB, over the ${String(Pt/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(E.kind==="not-regular"){r.push({code:"parse-error",path:U,detail:"unreadable or not a regular file"});continue}let T=E.text;d.add(U),u.set(U,T);for(let K of cc(U,T)){let J=K.runtime?a(K.text,U):null;if(J===null&&We(K.text)==="package-root"){K.runtime&&p.push({containingFile:U,packageName:Pn(K.text)});continue}let W=J??Cn(K.text,U,an,o),se=W!==null?[W]:K.runtime&&J===null?hs(K.text,U,an,o):[];if(se.length===0){if(K.runtime){let Y=We(K.text);if(!(Y==="package-subpath"&&Ri(Pn(K.text)))){if(Y==="package-subpath")_(U,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,Vs(K.text,U,an,o));else if(Y==="relative"){let V=Hd(K.text,U,s,g);V.kind==="unanalyzable"&&_(U,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${V.reason}; a bundler/loader may load a module the analyzer never saw`,V.why)}}}continue}se.length>=2&&i.push({path:mn(s,U)??U,specifier:K.text,candidates:se.map(Y=>mn(s,Y)??Y)});for(let Y of se){if(mn(s,Y)===null){r.push({code:"out-of-root",path:Y,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&Sn(Y)){r.push({code:"declaration-shadow",path:Y,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!zr(Y)){r.push({code:"unanalyzable-module",path:Y,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(Y)}}for(let K of lc(U,T,s,o,b))l.has(K)||c.push(K)}l.size>=Gr&&c.length>0&&r.push({code:"limit-exceeded",path:s,detail:`reachable file set exceeds ${String(Gr)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let w=Yg(s,o,d,p,r),I=M.createProgram({rootNames:[...d],options:an,host:o}),N=new Set,v=new Map;for(let P of I.getSourceFiles()){if(P.isDeclarationFile||I.isSourceFileDefaultLibrary(P)||mn(s,P.fileName)===null||!Oi(P.fileName))continue;let U=I.getSyntacticDiagnostics(P).length>0;if(!U&&!P.text.includes("<")||Rg(P.text,M.ScriptKind.TSX)!==0)continue;let E=M.createSourceFile(P.fileName,P.text,M.ScriptTarget.ES2020,!0,M.ScriptKind.TSX);(U||ac(E)>ac(P))&&(N.add(P.fileName),v.set(P.fileName,P.text))}let C=I;if(N.size>0){let P=o.getSourceFile.bind(o);o.getSourceFile=(U,E,T,K)=>{let J=v.get(U);return J!==void 0?M.createSourceFile(U,J,M.ScriptTarget.ES2020,!0,M.ScriptKind.TSX):P(U,E,T,K)},C=M.createProgram({rootNames:[...d],options:an,host:o,oldProgram:I})}let R=C.getTypeChecker(),F=[];for(let P of C.getSourceFiles()){if(P.isDeclarationFile||C.isSourceFileDefaultLibrary(P)||mn(s,P.fileName)===null)continue;F.push(P);let U=C.getSyntacticDiagnostics(P);if(U.length>0){let K=U[0],J=K!==void 0?M.flattenDiagnosticMessageText(K.messageText," "):"syntax error";r.push({code:"parse-error",path:P.fileName,detail:`${String(U.length)} syntax error(s): ${J}`})}let E=mn(s,P.fileName),T=E===null?null:xc(P.fileName,P.text,P);E!==null&&T!==null&&T.size>0&&r.push({code:"loader-escape",path:E,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...T].sort()})}return{program:C,checker:R,host:o,options:an,appRoot:s,sourceFiles:F,diagnostics:r,depReach:w,conditionUnions:[...i,...w.conditionUnions],provenAbsent:w.provenAbsent,resolveParamDirs:b,toRel:P=>mn(s,P)}}import{opendirSync as Jg,statSync as Zg}from"node:fs";import Pi from"node:path";var Qg=8192,ey=2e4,ny=new Set(["node_modules"]),Sc=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),ty=16;function Zr(e,n,t,s,r={}){let i=r.maxEntries??ey,o=r.prune,a=[],d=!1,l=0,c=[{dir:Pi.join(e,n),rel:n,depth:0}];for(;c.length>0;){let p=c.pop();if(p===void 0)break;if(p.depth>ty){d=!0;continue}let u;try{u=Jg(p.dir)}catch{d=!0;continue}try{let f=0;for(;;){let h=u.readSync();if(h===null)break;if(f+=1,l+=1,f>Qg||l>i){d=!0;break}let g=p.rel+h.name;if(h.isSymbolicLink()){let y;try{y=Zg(Pi.join(p.dir,h.name)).isDirectory()}catch{d=!0;continue}if(y){d=!0;continue}}else if(h.isDirectory()){if(ny.has(h.name)||h.name.startsWith(".")||o?.has(h.name)===!0){d=!0;continue}c.push({dir:Pi.join(p.dir,h.name),rel:`${g}/`,depth:p.depth+1});continue}else if(!h.isFile())continue;if(t(g)){if(a.length>=s){d=!0;break}a.push(g)}}}finally{try{u.closeSync()}catch{}}}return{matches:a,truncated:d}}var sy=64;function kc(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let s=n.slice(0,t),r=n.slice(t+1);if(s.startsWith("./")&&(s=s.slice(2)),s.startsWith("/")||r.includes("/")||s.split("/").includes("..")||s.includes("\\")||n.includes("\0"))return null;let i=s.slice(0,s.lastIndexOf("/")+1);return Zr(e,i,o=>o.length>=s.length+r.length&&o.startsWith(s)&&o.endsWith(r),sy)}import{existsSync as ry}from"node:fs";import oy from"node:path";var iy=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],ay=["dependencies","devDependencies"];function ly(e,n){for(let t of ay){let s=e[t];if(!(typeof s!="object"||s===null||Array.isArray(s))&&Object.hasOwn(s,n))return!0}return!1}function Ci(e,n){if(n===null)return null;for(let t of iy)if(ly(n,t.dependency)){for(let s of t.configFiles)if(ry(oy.join(e,s)))return{name:t.name,configFile:s,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function Mi(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var dy=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],cy=256,uy=12e4;function Ti(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let s=Zr(e,"",r=>{let i=r.split("/");for(let o=0;o<i.length-1;o+=1){let a=i[o];if(a!==void 0&&t.has(a))return dy.some(d=>r.endsWith(d))}return!1},cy,{maxEntries:uy,prune:Sc});return{roots:s.matches,truncated:s.truncated}}function Mn(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let s of n){let r=s.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:s}return t}function fy(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function py(e){let n=!1;for(let t=0;t<e.length;t+=1){let s=e.charAt(t),r=s.codePointAt(0)??0;if(r<32||r===127||r>=128&&r<=159)return null;if(s==="\\"){n=!0;let i=e.charAt(t+1);if(!(i>="a"&&i<="z"||i>="A"&&i<="Z"||i>="0"&&i<="9"||i==="."||i==="_"||i==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(s))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function my(e){let n=[],t="";for(let s of e){if(s===" "||s==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=s}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var hy=/^[A-Za-z_][A-Za-z0-9_]*=/u;function gy(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var wc=new Set(["flask","granian","gunicorn","hypercorn","php","php-fpm","puma","python","python2","python3","rails","ruby","streamlit","unicorn","uvicorn","uwsgi","waitress-serve"]);function yy(e){let n=e.slice(e.lastIndexOf("/")+1);return wc.has(n)||wc.has(n.replace(/[0-9.]+$/u,""))}var _y=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),xy=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),by=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function Ec(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function vc(e){if(Ec(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return by.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:_y.has(t)||n!==-1&&xy.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var Sy=[".js",".cjs",".mjs",".ts",".mts",".cts"];function ky(e){return Sy.some(n=>e.endsWith(n))}var wy=new Set(["npm","yarn","pnpm"]);function vy(e){let n=e[0];return n===void 0||!wy.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Li(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!fy(n))return $i(n);let t=py(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let s=$i(t.windows),r=$i(t.posixShell);if(s.kind==="file"){let i=r.kind==="file"?r.specifier:void 0;return i===void 0||i===s.specifier?{kind:"file",specifier:s.specifier}:{kind:"file",specifier:s.specifier,alt:i}}return r.kind==="file"?{kind:"file",specifier:r.specifier}:s}function $i(e){let n=my(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let i=n[t];if(i===void 0||!hy.test(i))break;if(Ec(i))return{kind:"unparsed",reason:`environment \`${Mn(i)}\` preloads another module; the launch surface is more than one file`};let o=i.indexOf("=");if(i.slice(0,o)==="NODE_OPTIONS")for(let a of i.slice(o+1).split(/\s+/u)){if(a===""||!a.startsWith("-"))continue;let d=vc(a);if(d!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Mn(d.token)}\` ${d.why}`}}}let s=n[t];if(s===void 0)return{kind:"unparsed",reason:"no program in the command"};if(vy(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!gy(s))return yy(s)?{kind:"foreign",binary:s}:{kind:"unparsed",reason:`runs \`${Mn(s)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let i=n[t];if(i===void 0||!i.startsWith("-"))break;let o=vc(i);if(o!==null)return{kind:"unparsed",reason:`node flag \`${Mn(o.token)}\` ${o.why}`}}let r=n[t];return r===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:ky(r)?{kind:"file",specifier:r}:{kind:"unparsed",reason:`\`${Mn(r)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Ey(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Ny=64,Di=64*1024,Ay=64;function Fi(e){let n=[],t=!1;for(let s of e.split(/\r?\n/u)){if(n.length>=Ay){t=!0;break}let r=/^\s*(CMD|ENTRYPOINT)\s+(.*\S)\s*$/iu.exec(s),i=/^\s*(command|entrypoint):\s*(.*\S)\s*$/u.exec(s),o=r??i;if(o?.[1]===void 0||o[2]===void 0)continue;let a=Iy(o[2]);a!==null&&n.push({label:o[1].toUpperCase(),command:a})}return{commands:n,truncated:t}}function Iy(e){let n=e.trim();if(!n.startsWith("["))return n===""?null:n;let t;try{t=JSON.parse(n)}catch{return null}if(!Array.isArray(t))return null;let s=t.filter(r=>typeof r=="string");return s.length===0||s.length!==t.length?null:s.join(" ")}function ji(e){let n=e.split(`
-`),t=n.length>64,s=[],r=0;for(let i of n.slice(0,64)){let o=i.trim();if(o.length===0||o.startsWith("#"))continue;let a=o.indexOf(":");if(a<=0)continue;let d=o.slice(a+1).trim();if(d.length===0)continue;let l=o.slice(0,a);if(l.length>Ny||!Ey(l)){r+=1;continue}s.push({name:l,command:d})}return s.sort((i,o)=>i.name===o.name?0:i.name==="web"?-1:o.name==="web"?1:0),{entries:s,truncated:t,unnamedLines:r}}import{realpathSync as Wc}from"node:fs";import kn from"node:path";import m from"typescript";import O from"typescript";import Nc from"node:path";import de from"typescript";var Ry=/^lib\.(?:es5|es20\d\d(?:\.[a-z0-9]+)*|esnext(?:\.[a-z0-9]+)*|decorators(?:\.legacy)?)\.d\.ts$/u,Oy=/^lib\.(?:dom|webworker|scripthost)(?:\.[a-z0-9]+)*\.d\.ts$/u;function Py(e,n){if(e.isSourceFileDefaultLibrary(n)){let t=Nc.basename(n.fileName);return Ry.test(t)?"ecmascript":Oy.test(t)?"host-lib":"unknown"}return n.fileName.split(Nc.sep).join("/").includes("/node_modules/")?"dependency":"app"}function Cy(e,n,t){if(t===void 0)return"unknown";let s=t;if(s.flags&de.SymbolFlags.Alias)try{s=n.getAliasedSymbol(s)}catch{return"unknown"}let r=s.declarations??[];if(r.length===0)return"unknown";let i=new Set(r.map(o=>Py(e,o.getSourceFile())));return i.size===1?[...i][0]:"unknown"}function Bi(e,n,t){let s=t;for(;de.isParenthesizedExpression(s);)s=s.expression;let r;if(de.isIdentifier(s)?r=s:de.isPropertyAccessExpression(s)?r=s.name:de.isElementAccessExpression(s)&&de.isStringLiteralLike(s.argumentExpression)&&(r=s.argumentExpression),r===void 0)return"unknown";let i;try{i=n.getSymbolAtLocation(r)}catch{return"unknown"}return Cy(e,n,i)}function My(e){if(de.isVariableDeclaration(e)){let n=e.parent;return de.isVariableDeclarationList(n)&&de.isVariableStatement(n.parent)&&de.isSourceFile(n.parent.parent)}return de.isFunctionDeclaration(e)||de.isClassDeclaration(e)?de.isSourceFile(e.parent):de.isImportClause(e)||de.isImportSpecifier(e)||de.isNamespaceImport(e)}function Ac(e,n,t){let s;try{s=n.getSymbolAtLocation(t)}catch{return"unknown"}let r=s?.declarations??[];if(r.length===0)return"unknown";let i=t.getSourceFile();return r.every(o=>o.getSourceFile()===i&&My(o))?"module":r.every(o=>e.isSourceFileDefaultLibrary(o.getSourceFile()))?"global":"unknown"}var Ty=de.TypeFlags.StringLike|de.TypeFlags.NumberLike|de.TypeFlags.BooleanLike|de.TypeFlags.BigIntLike|de.TypeFlags.ESSymbolLike|de.TypeFlags.Null|de.TypeFlags.Undefined|de.TypeFlags.Void;function Ic(e){return e.flags&(de.TypeFlags.Any|de.TypeFlags.Unknown|de.TypeFlags.Never)?!1:e.isUnion()?e.types.every(Ic):(e.flags&Ty)!==0&&(e.flags&de.TypeFlags.Object)===0}var $y=new Set([de.SyntaxKind.EqualsEqualsToken,de.SyntaxKind.EqualsEqualsEqualsToken,de.SyntaxKind.ExclamationEqualsToken,de.SyntaxKind.ExclamationEqualsEqualsToken,de.SyntaxKind.LessThanToken,de.SyntaxKind.LessThanEqualsToken,de.SyntaxKind.GreaterThanToken,de.SyntaxKind.GreaterThanEqualsToken,de.SyntaxKind.InstanceOfKeyword,de.SyntaxKind.InKeyword,de.SyntaxKind.PlusToken,de.SyntaxKind.MinusToken,de.SyntaxKind.AsteriskToken,de.SyntaxKind.AsteriskAsteriskToken,de.SyntaxKind.SlashToken,de.SyntaxKind.PercentToken,de.SyntaxKind.AmpersandToken,de.SyntaxKind.BarToken,de.SyntaxKind.CaretToken,de.SyntaxKind.LessThanLessThanToken,de.SyntaxKind.GreaterThanGreaterThanToken,de.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]),Ly=new Set([de.SyntaxKind.AmpersandAmpersandToken,de.SyntaxKind.BarBarToken,de.SyntaxKind.QuestionQuestionToken]);function er(e,n,t,s=0){if(s>8)return!1;let r=t;for(;de.isParenthesizedExpression(r);)r=r.expression;let i=o=>er(e,n,o,s+1);if(de.isStringLiteral(r)||de.isNoSubstitutionTemplateLiteral(r)||de.isTemplateExpression(r)||de.isNumericLiteral(r)||de.isBigIntLiteral(r)||r.kind===de.SyntaxKind.TrueKeyword||r.kind===de.SyntaxKind.FalseKeyword||r.kind===de.SyntaxKind.NullKeyword||de.isTypeOfExpression(r)||de.isVoidExpression(r)||de.isPrefixUnaryExpression(r)||de.isPostfixUnaryExpression(r)||de.isIdentifier(r)&&r.text==="undefined")return!0;if(de.isBinaryExpression(r)){let o=r.operatorToken.kind;return $y.has(o)?!0:Ly.has(o)?i(r.left)&&i(r.right):o===de.SyntaxKind.CommaToken?i(r.right):!1}if(de.isConditionalExpression(r))return i(r.whenTrue)&&i(r.whenFalse);if(de.isCallExpression(r)){if(Bi(e,n,r.expression)!=="ecmascript")return!1;try{let o=n.getResolvedSignature(r);return o!==void 0&&Ic(n.getReturnTypeOfSignature(o))}catch{return!1}}if(de.isIdentifier(r)){let o;try{o=n.getSymbolAtLocation(r)}catch{return!1}let a=o?.declarations??[],d=a.length===1?a[0]:void 0;return d===void 0||!de.isVariableDeclaration(d)||d.initializer===void 0||!de.isIdentifier(d.name)||!de.isVariableDeclarationList(d.parent)||(d.parent.flags&de.NodeFlags.Const)===0?!1:i(d.initializer)}return!1}import Fn from"typescript";var cn={kind:"receiver"},dn=e=>({kind:"arg",index:e}),Ki=e=>({kind:"args-from",index:e}),Ye=Ki(0),_t=(e=[Ye])=>({result:[Ye],mutates:[],callsProgram:e}),Wn=(e=[cn,Ye])=>({result:[cn,Ye],mutates:[],callsProgram:e}),Hn=(e=[])=>({result:[cn],mutates:[],callsProgram:e}),Dy={result:[],mutates:[]},zi=new Map,ge=(e,n)=>{for(let t of e)zi.set(t,n)};ge(["String","Number","BigInt"],{result:[dn(0)],mutates:[],callsProgram:[dn(0)]});ge(["Boolean"],{result:[dn(0)],mutates:[]});ge(["parseInt","parseFloat","isNaN","isFinite","encodeURIComponent","encodeURI","decodeURIComponent","decodeURI","escape","unescape"],_t());ge(["Array","Object"],{result:[Ye],mutates:[]});ge(["String.fromCharCode","String.fromCodePoint","String.raw"],_t());ge(["at","charAt","charCodeAt","codePointAt","concat","endsWith","includes","indexOf","isWellFormed","lastIndexOf","localeCompare","match","matchAll","normalize","padEnd","padStart","repeat","replace","replaceAll","search","slice","split","startsWith","substr","substring","toLocaleLowerCase","toLocaleUpperCase","toLowerCase","toString","toUpperCase","toWellFormed","trim","trimEnd","trimLeft","trimRight","trimStart","valueOf"].map(e=>`String.prototype.${e}`),Wn());ge(["Object.keys","Object.values","Object.entries","Object.getOwnPropertyNames","Object.getOwnPropertySymbols","Object.getPrototypeOf","Object.fromEntries","Object.freeze","Object.seal","Object.preventExtensions","Object.isFrozen","Object.isSealed","Object.isExtensible"],{result:[dn(0)],mutates:[],callsProgram:[dn(0)]});ge(["Object.is","Object.hasOwn","Object.create"],_t());ge(["Object.assign"],{result:[Ye],mutates:[{into:dn(0),from:[Ki(1)]}],callsProgram:[Ye]});ge(["Object.defineProperty"],{result:[dn(0)],mutates:[{into:dn(0),from:[dn(2)]}],callsProgram:[Ye]});ge(["Object.prototype.hasOwnProperty","Object.prototype.isPrototypeOf","Object.prototype.propertyIsEnumerable","Object.prototype.toString","Object.prototype.toLocaleString","Object.prototype.valueOf"],Wn());ge(["Array.isArray"],{result:[dn(0)],mutates:[]});ge(["Array.of"],{result:[Ye],mutates:[]});ge(["Array.from"],_t());var Fy=["at","concat","entries","flat","includes","indexOf","join","keys","lastIndexOf","slice","toLocaleString","toReversed","toSpliced","toString","values","with"];ge(Fy.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),Wn([cn,Ye]));var jy=["every","filter","find","findIndex","findLast","findLastIndex","flatMap","forEach","map","reduce","reduceRight","some","toSorted"];ge(jy.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),Wn([cn,Ye]));ge(["Array.prototype.push","Array.prototype.unshift"],{result:[cn,Ye],mutates:[{into:cn,from:[Ye]}]});ge(["Array.prototype.splice"],{result:[cn],mutates:[{into:cn,from:[Ki(2)]}],callsProgram:[Ye]});ge(["Array.prototype.fill"],{result:[cn,dn(0)],mutates:[{into:cn,from:[dn(0)]}],callsProgram:[Ye]});ge(["Array.prototype.pop","Array.prototype.shift"],Hn());ge(["Array.prototype.reverse","Array.prototype.copyWithin"],Hn([Ye]));ge(["Array.prototype.sort"],Hn([cn,Ye]));for(let e of["Map","WeakMap","ReadonlyMap"])ge([`${e}.prototype.get`],Hn()),ge([`${e}.prototype.has`],Wn([])),ge([`${e}.prototype.delete`],Wn([])),ge([`${e}.prototype.set`],{result:[cn],mutates:[{into:cn,from:[dn(0),dn(1)]}]}),ge([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],Hn()),ge([`${e}.prototype.forEach`],Hn([Ye]));for(let e of["Set","WeakSet","ReadonlySet"])ge([`${e}.prototype.has`],Wn([])),ge([`${e}.prototype.delete`],Wn([])),ge([`${e}.prototype.add`],{result:[cn],mutates:[{into:cn,from:[dn(0)]}]}),ge([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],Hn()),ge([`${e}.prototype.forEach`],Hn([Ye]));ge(["Map.prototype.clear","Set.prototype.clear"],Hn());ge(["JSON.parse","JSON.stringify"],_t());ge(["Number.isInteger","Number.isFinite","Number.isNaN","Number.isSafeInteger"],{result:[dn(0)],mutates:[]});ge(["Number.parseInt","Number.parseFloat"],_t());ge(["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"].map(e=>`Number.prototype.${e}`),Wn([Ye]));ge(["abs","acos","acosh","asin","asinh","atan","atan2","atanh","cbrt","ceil","clz32","cos","cosh","exp","expm1","floor","fround","hypot","imul","log","log10","log1p","log2","max","min","pow","round","sign","sin","sinh","sqrt","tan","tanh","trunc"].map(e=>`Math.${e}`),_t());ge(["Math.random","Date.now"],Dy);ge(["RegExp.prototype.test","RegExp.prototype.exec"],Wn());ge(["RegExp.prototype.toString"],Hn());ge(["Date.parse","Date.UTC"],_t());ge(["getDate","getDay","getFullYear","getHours","getMilliseconds","getMinutes","getMonth","getSeconds","getTime","getTimezoneOffset","toDateString","toISOString","toJSON","toLocaleDateString","toLocaleString","toLocaleTimeString","toString","toTimeString","toUTCString","valueOf"].map(e=>`Date.prototype.${e}`),Hn());ge(["Promise.resolve","Promise.all","Promise.allSettled","Promise.any","Promise.race"],_t());ge(["Promise.prototype.then","Promise.prototype.catch","Promise.prototype.finally"],Wn());var By=new Set(["JSON","Math","Reflect","Atomics"]);function Rc(e,n){let t=n;for(;Fn.isParenthesizedExpression(t);)t=t.expression;let s=Fn.isIdentifier(t)?t:Fn.isPropertyAccessExpression(t)?t.name:void 0;if(s===void 0)return null;let r;try{r=e.getSymbolAtLocation(s),r!==void 0&&r.flags&Fn.SymbolFlags.Alias&&(r=e.getAliasedSymbol(r))}catch{return null}let i=r?.valueDeclaration??r?.declarations?.[0];if(i===void 0)return null;if(Fn.isIdentifier(t))return(Fn.isVariableDeclaration(i)||Fn.isFunctionDeclaration(i))&&i.name!==void 0&&Fn.isIdentifier(i.name)?i.name.text:null;let o=i.parent;if(Fn.isModuleBlock(o)&&Fn.isModuleDeclaration(o.parent)&&Fn.isIdentifier(o.parent.name))return`${o.parent.name.text}.${s.text}`;if(!Fn.isInterfaceDeclaration(o))return null;let a=o.name.text,d=s.text;return By.has(a)?`${a}.${d}`:a.endsWith("Constructor")?`${a.slice(0,-11)}.${d}`:`${a}.prototype.${d}`}function Oc(e){let n=zi.get(e);return n===void 0?void 0:{id:`ecmascript:${e}`,...n}}var _0=zi.size;import Gt from"typescript";var Ui=["get","post","put","patch","delete","options","head","all"],Ky=[{id:"express@4-source-v1",packages:["express"],members:new Set([...Ui,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://expressjs.com/en/4x/api.html#app.METHOD \u2014 callbacks receive (req, res, next); error-handling middleware receives (err, req, res, next)"},{id:"koa@2-source-v1",packages:["koa","@koa/router","koa-router"],members:new Set([...Ui,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://koajs.com/#context \u2014 middleware receives (ctx, next); ctx.request carries the request"},{id:"fastify@4-source-v1",packages:["fastify"],members:new Set(Ui),sourceClass:"remote-unauthenticated",evidence:"https://fastify.dev/docs/latest/Reference/Routes/ \u2014 handler receives (request, reply)"}];function Pc(e){let n=new Set(e.map(t=>t.startsWith("@")?t.split("/").slice(0,2).join("/"):t.split("/")[0]));return Ky.filter(t=>t.packages.some(s=>n.has(s)))}function Qr(e,n){if(n.length===0)return null;let t=e.expression;for(;Gt.isParenthesizedExpression(t);)t=t.expression;if(!Gt.isPropertyAccessExpression(t))return null;let s=t.name.text,r=n.find(a=>a.members.has(s));if(r===void 0)return null;let i=e.arguments.filter(a=>Gt.isArrowFunction(a)||Gt.isFunctionExpression(a)||Gt.isIdentifier(a)||Gt.isPropertyAccessExpression(a)),o=e.arguments.filter(Gt.isCallExpression);return i.length>0||o.length>0?{model:r,handlers:i,forwarded:o}:null}function nr(e,n){return e.id.startsWith("express@")&&n===4?1:0}function Vt(e){return O.isFunctionDeclaration(e)||O.isFunctionExpression(e)||O.isArrowFunction(e)||O.isMethodDeclaration(e)||O.isConstructorDeclaration(e)||O.isGetAccessorDeclaration(e)||O.isSetAccessorDeclaration(e)}var eo=(e,n,t)=>({path:e,start:n.getStart(t,!1),end:n.getEnd()});function zy(e,n,t){let s=[];for(let r of e.parameters){if(O.isIdentifier(r.name)&&r.name.text==="this")continue;let i=O.isIdentifier(r.name)?r.name.text:void 0;s.push({index:s.length,kind:r.dotDotDotToken!==void 0?"rest":"positional",...i!==void 0?{name:i}:{},destructured:i===void 0,hasDefault:r.initializer!==void 0,range:eo(n,r,t)})}return s}function Uy(e){return O.isArrowFunction(e)?"lexical":"call"}function qy(e){let n=!1,t=s=>{if(!n&&!(s!==e&&Vt(s)&&!O.isArrowFunction(s))){if(O.isIdentifier(s)&&s.text==="arguments"){let r=s.parent;O.isPropertyAccessExpression(r)&&r.name===s||O.isPropertyAssignment(r)&&r.name===s||(n=!0)}O.isCallExpression(s)&&O.isIdentifier(s.expression)&&s.expression.text==="eval"&&(n=!0),O.forEachChild(s,t)}};e.body!==void 0&&O.forEachChild(e.body,t);for(let s of e.parameters)s.initializer!==void 0&&t(s.initializer);return n}function Hi(e,n,t,s=[],r,i=new Map){let o=new Map;if(s.length>0){let u=f=>{if(O.isCallExpression(f)){let h=Qr(f,s);for(let g of h?.handlers??[])h!==null&&(O.isArrowFunction(g)||O.isFunctionExpression(g))&&o.set(g,{model:h.model,index:nr(h.model,g.parameters.length),registeredAt:eo(t,f,n)})}O.forEachChild(f,u)};u(n)}for(let[u,f]of i)o.has(u)||o.set(u,f);let a=[],d=u=>{Vt(u)&&a.push({start:u.getStart(n,!1),end:u.getEnd(),node:u}),O.forEachChild(u,d)};d(n),a.sort((u,f)=>u.start-f.start||f.end-u.end);let l=u=>{let f=0,h=a.length;for(;f<h;){let g=f+h>>>1;(a[g]?.start??1/0)<u?f=g+1:h=g}return f},c=e.map(u=>{if(u.declRange.path!==t||u.name==="<toplevel>")return;let{start:f,end:h}=u.declRange,g=l(f);for(;g<a.length&&(a[g]?.start??1/0)<h&&(a[g]?.end??0)>h;)g+=1;let y=a[g];if(y===void 0||y.start>=h||y.end>h)return;let _=a[l(y.end)];if(!(_!==void 0&&_.start<h&&_.end<=h))return y.node}),p=new Set(c.filter(u=>u!==void 0));return e.map((u,f)=>{if(u.name==="<toplevel>"&&u.declRange.path===t){let _=Mc(n,p,n,o,r);return _!==void 0?{...u,valueFlows:_}:u}let h=c[f];if(h===void 0)return u;let g=Mc(h,p,n,o,r),y=o.get(h);return{...u,...y!==void 0?{sourceParams:[{index:y.index,sourceClass:y.model.sourceClass,model:y.model.id,registeredAt:y.registeredAt}]}:{},params:zy(h,t,n),receiver:Uy(h),reflectiveArguments:qy(h),...g!==void 0?{valueFlows:g}:{}}})}var Hy=new Set(["call","apply","bind"]),Cc=new WeakMap;function Lc(e,n){let t=Cc.get(n.checker);t===void 0&&(t=new WeakMap,Cc.set(n.checker,t));let s=t.get(e);if(s!==void 0)return s;let r=Bi(n.program,n.checker,e),i=r==="ecmascript"?Rc(n.checker,e):null,o=i!==null?Oc(i):void 0,a={calleeDecl:r,identity:i,...o!==void 0?{summary:o}:{}};return t.set(e,a),a}function Wi(e,n,t,s,r){let i=n;for(;O.isParenthesizedExpression(i);)i=i.expression;let o=O.isPropertyAccessExpression(i)||O.isElementAccessExpression(i)?i.expression:void 0,a=o!==void 0?{receiverRange:eo(t,o,s)}:{},d={repeats:Wy(e)},l=r!==void 0?Lc(n,r):void 0,c=l?.calleeDecl,p=l?.identity??null,u=l?.summary,f={...c!==void 0?{calleeDecl:c}:{},...u!==void 0?{summary:u}:{},...p!==null?{runtimeId:`ecmascript:${p}`}:{},...r!==void 0&&o!==void 0&&er(r.program,r.checker,o)?{receiverPrimitive:!0}:{}};if(O.isTaggedTemplateExpression(e))return{convention:"unknown",...a,...d,...f};let h=O.isPropertyAccessExpression(i)&&Hy.has(i.name.text);return{args:e.arguments.map((y,_)=>({index:_,spread:O.isSpreadElement(y)?"positional":!1,range:eo(t,y,s),...r!==void 0&&!O.isSpreadElement(y)&&er(r.program,r.checker,y)?{primitive:!0}:{}})),convention:h?"unknown":"direct",...a,...d,...f}}function Wy(e){for(let n=e.parent;n!==void 0;n=n.parent){if(O.isForStatement(n)||O.isForInStatement(n)||O.isForOfStatement(n)||O.isWhileStatement(n)||O.isDoStatement(n))return!0;if(O.isFunctionDeclaration(n)||O.isMethodDeclaration(n)||O.isConstructorDeclaration(n)||O.isGetAccessorDeclaration(n)||O.isSetAccessorDeclaration(n))return!1;if(O.isFunctionExpression(n)||O.isArrowFunction(n))return!(O.isVariableDeclaration(n.parent)&&n.parent.initializer===n)}return!0}var Dc=2e4,ys={kind:"constant"},rn=e=>({kind:"opaque",reason:e}),no=class extends Error{},Gy=new Set([O.SyntaxKind.BarBarToken,O.SyntaxKind.AmpersandAmpersandToken,O.SyntaxKind.QuestionQuestionToken,O.SyntaxKind.BarBarEqualsToken,O.SyntaxKind.AmpersandAmpersandEqualsToken,O.SyntaxKind.QuestionQuestionEqualsToken]),Vy=new Set([O.SyntaxKind.EqualsToken,O.SyntaxKind.BarBarEqualsToken,O.SyntaxKind.AmpersandAmpersandEqualsToken,O.SyntaxKind.QuestionQuestionEqualsToken]);function xt(e){switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${String(e.at)}-${String(e.end)}`;case"argument":return`a${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"call-receiver":return`r${String(e.at)}-${String(e.end)}`;case"mutated-by-call":return`m${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"source":return`s${e.model}`;case"shared":return`h${String(e.id)}`;default:return e.kind}}var tr=e=>e.kind==="local"||e.kind==="param"||e.kind==="receiver"||e.kind==="free";function qi(e){if(O.isIdentifier(e))return[];let n=[];for(let t of e.elements)O.isOmittedExpression(t)||(t.initializer!==void 0&&n.push(t),n.push(...qi(t.name)));return n}function Xy(e){return O.isWithStatement(e)||O.isCallExpression(e)&&O.isIdentifier(e.expression)&&e.expression.text==="eval"}function Mc(e,n,t,s,r){let i=[],o=(S,A,j)=>{for(let ne of S)for(let X of A)if(i.push({from:ne,to:X,kind:j}),i.length>Dc)throw new no},a=S=>S.getStart(t,!1),d=S=>({at:S.getStart(t,!1),end:S.getEnd()}),l=S=>r!==void 0&&er(r.program,r.checker,S),c=new Map,p=new Map,u=(S,A)=>{p.set(S,A);let j=c.get(S.text);j===void 0?c.set(S.text,[A]):j.push(A)},f=S=>{if(O.isIdentifier(S))return[S];let A=[];for(let j of S.elements)O.isOmittedExpression(j)||A.push(...f(j.name));return A},h=S=>({kind:"local",name:S.text,declStart:a(S)}),g=O.isSourceFile(e)?[]:e.parameters.filter(S=>!(O.isIdentifier(S.name)&&S.name.text==="this"));g.forEach((S,A)=>{if(O.isIdentifier(S.name))u(S.name,{kind:"param",index:A});else for(let j of f(S.name))u(j,h(j))});let y=S=>{for(let A=S.parent;A!==void 0&&A!==e;A=A.parent)if(Vt(A)&&!O.isArrowFunction(A))return!0;return!1},_=S=>{if(S!==e&&Vt(S)){if(n.has(S))return;for(let A of S.parameters)for(let j of f(A.name))u(j,h(j))}else if(O.isVariableDeclaration(S))for(let A of f(S.name))u(A,h(A));else if((O.isFunctionDeclaration(S)||O.isClassDeclaration(S))&&S.name!==void 0&&S!==e)u(S.name,h(S.name));else if(O.isCatchClause(S)&&S.variableDeclaration!==void 0)for(let A of f(S.variableDeclaration.name))u(A,h(A));O.forEachChild(S,_)},b=[];O.isSourceFile(e)?b.push(e):e.body!==void 0&&b.push(e.body);for(let S of g){S.initializer!==void 0&&b.push(S.initializer);for(let A of qi(S.name))A.initializer!==void 0&&b.push(A.initializer)}for(let S of b)_(S);let x=S=>r===void 0?{kind:"free",name:S.text}:{kind:"free",name:S.text,binding:Ac(r.program,r.checker,S)},k=S=>{if(r===void 0)return;let A;try{let D=S.parent;A=D!==void 0&&O.isShorthandPropertyAssignment(D)&&D.name===S?r.checker.getShorthandAssignmentValueSymbol(D):r.checker.getSymbolAtLocation(S)}catch{return}let j=A?.declarations??[];if(j.length===0)return;let ne=[],X=!1;for(let D of j){let $=O.getNameOfDeclaration(D),L=$===void 0?void 0:p.get($);L===void 0?X=!0:ne.push(L)}return X&&ne.push(x(S)),ne},w=S=>{if(S.text==="undefined")return[ys];if(S.text==="arguments")return[rn("reflective")];let A=k(S);return A!==void 0?A:c.get(S.text)??[x(S)]},I=S=>{if(n.has(S))return[];if(O.isArrowFunction(S)&&!O.isBlock(S.body))return[S.body];let A=[],j=ne=>{Vt(ne)||((O.isReturnStatement(ne)||O.isYieldExpression(ne))&&ne.expression!==void 0&&A.push(ne.expression),O.forEachChild(ne,j))};return S.body!==void 0&&O.forEachChild(S.body,j),A},N=S=>{if(O.isStringLiteral(S)||O.isNumericLiteral(S)||O.isBigIntLiteral(S)||O.isNoSubstitutionTemplateLiteral(S)||O.isRegularExpressionLiteral(S)||S.kind===O.SyntaxKind.TrueKeyword||S.kind===O.SyntaxKind.FalseKeyword||S.kind===O.SyntaxKind.NullKeyword||O.isVoidExpression(S)||O.isDeleteExpression(S))return[ys];if(O.isFunctionExpression(S)||O.isArrowFunction(S)||O.isClassExpression(S))return[rn("unmodeled")];if(O.isIdentifier(S))return w(S);if(S.kind===O.SyntaxKind.ThisKeyword)return y(S)||O.isSourceFile(e)?[rn("unmodeled")]:[{kind:"receiver"}];if(O.isParenthesizedExpression(S)||O.isAsExpression(S)||O.isNonNullExpression(S)||O.isTypeAssertionExpression(S)||O.isSatisfiesExpression(S)||O.isSpreadElement(S)||O.isTypeOfExpression(S)||O.isAwaitExpression(S))return N(S.expression);if(O.isYieldExpression(S))return[rn("unmodeled")];if(O.isPropertyAccessExpression(S)||O.isElementAccessExpression(S))return N(S.expression);if(O.isCallExpression(S)){if(O.isIdentifier(S.expression)&&S.expression.text==="require"){let A=S.arguments[0];return A!==void 0&&O.isStringLiteralLike(A)?[ys]:[rn("unmodeled")]}return S.expression.kind===O.SyntaxKind.ImportKeyword?[rn("unmodeled")]:[{kind:"call-result",...d(S)}]}if(O.isTaggedTemplateExpression(S))return[{kind:"call-result",...d(S)}];if(O.isNewExpression(S))return[rn("construct")];if(O.isConditionalExpression(S))return[...N(S.whenTrue),...N(S.whenFalse)];if(O.isBinaryExpression(S)){let A=S.operatorToken.kind;return A===O.SyntaxKind.CommaToken||A===O.SyntaxKind.EqualsToken?N(S.right):[...N(S.left),...N(S.right)]}return O.isPrefixUnaryExpression(S)||O.isPostfixUnaryExpression(S)?N(S.operand):O.isTemplateExpression(S)?S.templateSpans.flatMap(A=>N(A.expression)):O.isArrayLiteralExpression(S)?S.elements.length===0?[ys]:S.elements.flatMap(A=>N(A)):O.isObjectLiteralExpression(S)?S.properties.length===0?[ys]:S.properties.flatMap(A=>O.isPropertyAssignment(A)?N(A.initializer):O.isShorthandPropertyAssignment(A)?w(A.name):O.isSpreadAssignment(A)?N(A.expression):O.isSetAccessorDeclaration(A)?[ys]:[rn("unmodeled")]):[rn("unmodeled")]},v=S=>{if(O.isIdentifier(S))return w(S).filter(tr);if(S.kind===O.SyntaxKind.ThisKeyword)return N(S).filter(tr);if(O.isParenthesizedExpression(S)||O.isAsExpression(S)||O.isNonNullExpression(S)||O.isTypeAssertionExpression(S)||O.isSatisfiesExpression(S)||O.isSpreadElement(S)||O.isAwaitExpression(S)||O.isPropertyAccessExpression(S)||O.isElementAccessExpression(S))return v(S.expression);if(O.isConditionalExpression(S))return[...v(S.whenTrue),...v(S.whenFalse)];if(O.isBinaryExpression(S)){let A=S.operatorToken.kind;return A===O.SyntaxKind.CommaToken||A===O.SyntaxKind.EqualsToken?v(S.right):Gy.has(A)?[...v(S.left),...v(S.right)]:[]}if(O.isArrayLiteralExpression(S))return S.elements.flatMap(A=>v(A));if(O.isObjectLiteralExpression(S))return S.properties.flatMap(A=>O.isPropertyAssignment(A)?v(A.initializer):O.isShorthandPropertyAssignment(A)?w(A.name).filter(tr):O.isSpreadAssignment(A)?v(A.expression):O.isMethodDeclaration(A)||O.isGetAccessorDeclaration(A)?I(A).flatMap(j=>v(j)):[]);if(O.isCallExpression(S)||O.isNewExpression(S)||O.isTaggedTemplateExpression(S)){if(O.isCallExpression(S)&&Tc(S))return[];if(l(S))return[];let A=O.isTaggedTemplateExpression(S)?O.isTemplateExpression(S.template)?S.template.templateSpans.map(X=>X.expression):[]:[...S.arguments??[]],j=O.isTaggedTemplateExpression(S)?S.tag:S.expression;for(;O.isParenthesizedExpression(j);)j=j.expression;let ne=O.isPropertyAccessExpression(j)||O.isElementAccessExpression(j)?v(j.expression):v(j).filter(X=>X.kind!=="free");return[...A.flatMap(X=>l(X)?[]:v(X)),...ne]}return O.isFunctionExpression(S)||O.isArrowFunction(S)?I(S).flatMap(A=>v(A)):[]},C=S=>O.isIdentifier(S)?w(S):O.isParenthesizedExpression(S)||O.isNonNullExpression(S)||O.isAsExpression(S)||O.isSatisfiesExpression(S)||O.isTypeAssertionExpression(S)?C(S.expression):O.isPropertyAccessExpression(S)||O.isElementAccessExpression(S)?v(S.expression):O.isArrayLiteralExpression(S)?S.elements.flatMap(A=>C(A)):O.isObjectLiteralExpression(S)?S.properties.flatMap(A=>O.isShorthandPropertyAssignment(A)?w(A.name):O.isPropertyAssignment(A)?C(A.initializer):O.isSpreadAssignment(A)?C(A.expression):[]):O.isSpreadElement(S)?C(S.expression):O.isBinaryExpression(S)&&S.operatorToken.kind===O.SyntaxKind.EqualsToken?C(S.left):[],R=S=>O.isParenthesizedExpression(S)||O.isNonNullExpression(S)||O.isAsExpression(S)||O.isSatisfiesExpression(S)||O.isTypeAssertionExpression(S)||O.isSpreadElement(S)?R(S.expression):O.isPropertyAccessExpression(S)||O.isElementAccessExpression(S)?v(S.expression):O.isArrayLiteralExpression(S)?S.elements.flatMap(A=>R(A)):O.isObjectLiteralExpression(S)?S.properties.flatMap(A=>O.isPropertyAssignment(A)?R(A.initializer):O.isSpreadAssignment(A)?R(A.expression):[]):O.isBinaryExpression(S)&&S.operatorToken.kind===O.SyntaxKind.EqualsToken?R(S.left):[],F=S=>v(S).filter(A=>A.kind==="local"||A.kind==="param"||A.kind==="receiver"),P=new Map,U=new Map,E=S=>{let A=S;for(let j=P.get(A);j!==void 0&&j!==A;j=P.get(A))A=j;for(let j=S;j!==A;){let ne=P.get(j)??A;P.set(j,A),j=ne}return A},T=(S,A)=>{let j=xt(S),ne=xt(A);U.has(j)||(U.set(j,S),P.set(j,j)),U.has(ne)||(U.set(ne,A),P.set(ne,ne));let X=E(j),D=E(ne);X!==D&&P.set(X,D)},K=(S,A)=>{let j=S.filter(tr);if(j.length===0)return;let ne=v(A),X=ne[0];if(X!==void 0){for(let D of ne)T(X,D);for(let D of j)T(X,D)}},J=new Map,W=(S,A)=>{for(let j of S){if(!tr(j))continue;let ne=xt(j),X=J.get(ne);X===void 0&&(X=new Map,J.set(ne,X));for(let D of A)X.set(xt(D),D)}};g.forEach((S,A)=>{let j={kind:"param",index:A};if(S.initializer!==void 0&&(o(N(S.initializer),[j],"copy"),K([j],S.initializer)),!O.isIdentifier(S.name)){let ne=f(S.name).map(h);o([j],ne,"field");for(let X of ne)T(j,X);for(let X of qi(S.name)){if(X.initializer===void 0)continue;let D=f(X.name).map(h);o(N(X.initializer),D,"copy"),K(D,X.initializer)}}});let se=S=>{if(S!==e&&Vt(S)){if(n.has(S))return;let A=s.get(S);S.parameters.forEach((j,ne)=>{let X=A!==void 0&&ne===A.index?{kind:"source",sourceClass:A.model.sourceClass,model:A.model.id}:rn("inner-function-param");o([X],f(j.name).map(h),"copy")})}else if(O.isVariableDeclaration(S)&&S.initializer!==void 0){let A=f(S.name).map(h);o(N(S.initializer),A,O.isIdentifier(S.name)?"copy":"field"),K(A,S.initializer)}else if(O.isBindingElement(S)&&S.initializer!==void 0){let A=f(S.name).map(h);o(N(S.initializer),A,"copy"),K(A,S.initializer)}else if(O.isCatchClause(S)&&S.variableDeclaration!==void 0)o([rn("caught")],f(S.variableDeclaration.name).map(h),"copy");else if(O.isTryStatement(S)&&S.catchClause?.variableDeclaration!==void 0){let A=f(S.catchClause.variableDeclaration.name).map(h),j=[],ne=X=>{if(!n.has(X)){if(O.isThrowStatement(X))j.push(X.expression);else if(O.isCallExpression(X)||O.isNewExpression(X)){j.push(...X.arguments??[]);let D=X.expression;for(;O.isParenthesizedExpression(D);)D=D.expression;(O.isPropertyAccessExpression(D)||O.isElementAccessExpression(D))&&j.push(D.expression)}O.forEachChild(X,ne)}};ne(S.tryBlock);for(let X of j)l(X)||K(A,X)}else if((O.isFunctionDeclaration(S)||O.isClassDeclaration(S))&&S.name!==void 0&&S!==e)o([rn("unmodeled")],[h(S.name)],"copy");else if(O.isForOfStatement(S)||O.isForInStatement(S)){let A=S.initializer,j=O.isVariableDeclarationList(A)?A.declarations.flatMap(X=>f(X.name).map(h)):C(A),ne=N(S.expression);o(ne,j,"derive"),O.isVariableDeclarationList(A)||W(R(A),ne),O.isForOfStatement(S)&&K(j,S.expression)}else if(O.isBinaryExpression(S)&&Yy(S.operatorToken.kind)){let A=S.operatorToken.kind===O.SyntaxKind.EqualsToken?N(S.right):[...N(S.left),...N(S.right)],j=C(S.left);o(A,j,O.isIdentifier(S.left)?"copy":"field"),W(R(S.left),A),Vy.has(S.operatorToken.kind)&&K(j,S.right)}else if(O.isShorthandPropertyAssignment(S)&&S.objectAssignmentInitializer!==void 0){let A=w(S.name);o(N(S.objectAssignmentInitializer),A,"copy"),K(A,S.objectAssignmentInitializer)}else if(O.isReturnStatement(S)&&S.expression!==void 0&&$c(S)===e)o(N(S.expression),[{kind:"return"}],"return");else if(O.isYieldExpression(S)&&S.expression!==void 0&&$c(S)===e)o(N(S.expression),[{kind:"return"}],"return");else if(O.isCallExpression(S)&&!Tc(S)){let A=d(S);S.arguments.forEach(($,L)=>{if(o(N($),[{kind:"argument",...A,index:L}],"argument"),!l($)){let H={kind:"mutated-by-call",...A,index:L},z=F($);o([H],z,"mutation"),W(z,[H])}});let j=S.expression;for(;O.isParenthesizedExpression(j);)j=j.expression;let ne=O.isPropertyAccessExpression(j)||O.isElementAccessExpression(j)?j.expression:void 0,X=$=>$.kind==="receiver"?ne!==void 0?[ne]:[]:$.kind==="arg"?S.arguments.slice($.index,$.index+1):S.arguments.slice($.index),D=r!==void 0?Lc(S.expression,r):void 0;for(let $ of D?.summary?.mutates??[]){let L=[...X($.into),...$.from.flatMap(X)].filter(z=>!l(z)).flatMap(z=>v(z)),H=L[0];if(H!==void 0)for(let z of L)T(H,z)}if((O.isPropertyAccessExpression(j)||O.isElementAccessExpression(j))&&(o(N(j.expression),[{kind:"call-receiver",...A}],"argument"),!l(j.expression))){let $={kind:"mutated-by-call",...A,index:-1},L=F(j.expression);o([$],L,"mutation"),W(L,[$])}}else if(O.isNewExpression(S))for(let A of S.arguments??[]){if(l(A))continue;let j=F(A);o([rn("construct")],j,"mutation"),W(j,[rn("construct")])}O.forEachChild(S,se)},Y=()=>{let S=new Map,A=X=>{for(let D of X)D.kind==="local"&&S.set(xt(D),D)},j=X=>{let D=X.parent;D!==void 0&&D.name===X&&!O.isShorthandPropertyAssignment(D)||D!==void 0&&(O.isCallExpression(D)||O.isNewExpression(D)||O.isTaggedTemplateExpression(D))&&(O.isTaggedTemplateExpression(D)?D.tag:D.expression)===X||l(X)||A(k(X)??c.get(X.text)??[])},ne=(X,D)=>{let $=D||n.has(X);$&&O.isIdentifier(X)&&j(X),O.forEachChild(X,L=>{ne(L,$)})};ne(t,!1);for(let X of t.statements){let D=O.canHaveModifiers(X)&&(O.getModifiers(X)??[]).some($=>$.kind===O.SyntaxKind.ExportKeyword);if(D&&O.isVariableStatement(X))for(let $ of X.declarationList.declarations)A(f($.name).map(h));else if(D&&(O.isFunctionDeclaration(X)||O.isClassDeclaration(X))&&X.name!==void 0)A([h(X.name)]);else if(O.isExportDeclaration(X)&&X.moduleSpecifier===void 0&&X.exportClause!==void 0&&O.isNamedExports(X.exportClause))for(let $ of X.exportClause.elements)A(c.get(($.propertyName??$.name).text)??[]);else O.isExportAssignment(X)&&A(v(X.expression))}return[...S.values()]},V=()=>{let S=!1,A=j=>{if(!S&&!(j!==e&&n.has(j)&&!O.isSourceFile(e))){if(Xy(j)){S=!0;return}O.forEachChild(j,A)}};for(let j of b)A(j);return S},fe=()=>{let S=new Map;for(let[j,ne]of U){let X=E(j),D=S.get(X);D===void 0?S.set(X,[ne]):D.push(ne)}let A=0;for(let j of S.values()){if(j.length<2)continue;let ne=new Map;for(let D of j)for(let[$,L]of J.get(xt(D))??[])ne.set($,L);for(let D of j)D.kind==="free"&&ne.set(xt(D),D);if(ne.size>0){let D={kind:"shared",id:A};A+=1,o([...ne.values()],[D],"mutation"),o([D],j.filter($=>$.kind!=="free"),"mutation")}let X=j.filter(D=>D.kind==="param"||D.kind==="receiver");if(X.length>=2)for(let D of X)o(X.filter($=>xt($)!==xt(D)),[D],"mutation")}};try{for(let S of b)se(S);if(!O.isSourceFile(e)&&O.isArrowFunction(e)&&!O.isBlock(e.body)&&o(N(e.body),[{kind:"return"}],"return"),O.isSourceFile(e)){let S=Y();o([rn("unmodeled")],S,"mutation"),W(S,[rn("unmodeled")])}if(V()){let S=[...c.values()].flat(),A=g.map((ne,X)=>({kind:"param",index:X})),j=O.isSourceFile(e)?[]:[{kind:"receiver"}];o([rn("reflective")],[...S,...A,...j],"mutation")}fe()}catch(S){if(S instanceof no)return;throw S}return i}function Yy(e){return e>=O.SyntaxKind.FirstAssignment&&e<=O.SyntaxKind.LastAssignment}function Tc(e){return O.isIdentifier(e.expression)&&e.expression.text==="require"||e.expression.kind===O.SyntaxKind.ImportKeyword}function $c(e){for(let n=e.parent;n!==void 0;n=n.parent)if(Vt(n))return n}import ce from"typescript";var Bc=4,Jy=[{id:"express-async-handler@1-forwarder-v1",package:"express-async-handler",versions:"0.0.1 - 1.2.0: all 13 published versions, read 2026-09-24",shape:{param:0,arity:[3,0],passes:3},evidence:"index.js, 1.1.4 and 1.2.0 (npm dist.shasum 225a84908df63b35ae9df94b6f0f1af061266426, ffc9896061d90f8d2e71a2d2b8668db5b0934391): `const asyncUtil = fn => function asyncUtilWrap(...args) { const fnReturn = fn(...args) ...`, `module.exports = asyncUtil`. 0.0.1-1.0.2: `(req, res, next) => ... fn(req, res, next)`; 1.0.3-1.1.3: `(req, res, next, ...args)` calling `fn(req, res, next, ...args)` (1.1.0 on both branches of `fn instanceof Promise`). https://github.com/Abazhenov/express-async-handler"}];function Kc(e){return Jy.find(n=>n.package===e)}var Zy=8;function zc(e){if(!(ce.isFunctionDeclaration(e)||ce.isFunctionExpression(e)||ce.isArrowFunction(e)||ce.isMethodDeclaration(e))||e.body===void 0||Qy(e)||!ce.isArrowFunction(e)&&e.asteriskToken!==void 0||ce.canHaveDecorators(e)&&(ce.getDecorators(e)??[]).length>0||n_(e))return null;let n=t_(e);if(n===null||ce.isFunctionExpression(n)&&n.asteriskToken!==void 0)return null;let t=e_(n);if(t===null||t.length===0)return null;let s=t.map(f=>f.text),r=new Set(s),i=new Map,o=Uc(e);for(let f=0;f<o.length;f+=1){let h=o[f];if(h===void 0)continue;let g=h.name;if(ce.isIdentifier(g)){if(i.has(g.text))return null;h.dotDotDotToken!==void 0||h.initializer!==void 0||r.has(g.text)||i.set(g.text,{index:f,decl:g})}}let a=[...s_(n,i,s)],d=a[0];if(a.length!==1||d===void 0||d[1].length>Zy)return null;let[l,c]=d,p=i.get(l);if(p===void 0)return null;let u=0;for(let f of c)r_(f,n)&&(u=Math.max(u,f.arguments.length));return u===0||!jc(e,new Map([[l,p.decl]]))||!jc(n,new Map(t.slice(0,u).map(f=>[f.text,f])))?null:{param:p.index,arity:[t.length],passes:u}}function Uc(e){return e.parameters.filter(n=>!(ce.isIdentifier(n.name)&&n.name.text==="this"))}function Qy(e){return ce.canHaveModifiers(e)&&(ce.getModifiers(e)??[]).some(n=>n.kind===ce.SyntaxKind.AsyncKeyword)}function e_(e){let n=[],t=new Set;for(let s of Uc(e)){let r=s.name;if(!ce.isIdentifier(r)||s.dotDotDotToken!==void 0||s.initializer!==void 0||t.has(r.text))return null;t.add(r.text),n.push(r)}return n}function n_(e){let n=!1,t=s=>{n||((ce.isWithStatement(s)||ce.isIdentifier(s)&&(s.text==="arguments"||s.text==="eval")&&!qc(s))&&(n=!0),ce.forEachChild(s,t))};return ce.forEachChild(e,t),n}function t_(e){let n=e.body;if(n===void 0)return null;let t=o=>{if(o===void 0)return null;let a=Ze(o);return ce.isArrowFunction(a)||ce.isFunctionExpression(a)?a:null};if(!ce.isBlock(n))return t(n);let s=[],r=o=>{ce.isFunctionLike(o)||ce.isClassLike(o)||(ce.isReturnStatement(o)&&s.push(o),ce.forEachChild(o,r))};ce.forEachChild(n,r);let i=s[0];return s.length!==1||i===void 0||i.parent!==n?null:t(i.expression)}function s_(e,n,t){let s=new Map,r=o=>{if(ce.isCallExpression(o)&&ce.isIdentifier(o.expression)&&n.has(o.expression.text)&&o.questionDotToken===void 0&&o.arguments.length>0&&o.arguments.length<=t.length&&o.arguments.every((a,d)=>ce.isIdentifier(a)&&a.text===t[d])){let a=s.get(o.expression.text);a===void 0?s.set(o.expression.text,[o]):a.push(o)}ce.forEachChild(o,r)},i=e.body;return ce.isBlock(i)?ce.forEachChild(i,r):r(i),s}function r_(e,n){let t=e;for(;;){let s=t.parent;if(s===n)return ce.isArrowFunction(n)&&n.body===t;if(ce.isParenthesizedExpression(s)||ce.isAwaitExpression(s)||ce.isAsExpression(s)||ce.isNonNullExpression(s)||ce.isSatisfiesExpression(s)||ce.isTypeAssertionExpression(s)){t=s;continue}if((ce.isPropertyAccessExpression(s)||ce.isElementAccessExpression(s))&&s.expression===t){t=s;continue}if(ce.isCallExpression(s)){if(s.expression===t){t=s;continue}if(!ce.isOptionalChain(s)&&s.arguments.some(r=>r===t)){t=s;continue}return!1}if(ce.isVariableDeclaration(s)&&s.initializer===t){let i=s.parent.parent;return ce.isVariableStatement(i)&&Fc(i,n)}return(ce.isExpressionStatement(s)||ce.isReturnStatement(s))&&s.expression===t?Fc(s,n):!1}}function Fc(e,n){let t=e;for(;;){let s=t.parent;if(!ce.isBlock(s))return!1;for(let i of s.statements){if(i===t)break;if(!(ce.isExpressionStatement(i)||ce.isVariableStatement(i)||ce.isEmptyStatement(i)))return!1}if(s===n.body)return!0;let r=s.parent;if(!ce.isTryStatement(r)||r.tryBlock!==s)return!1;t=r}}function jc(e,n){let t=!0,s=r=>{if(t){if(ce.isIdentifier(r)){let i=n.get(r.text);i!==void 0&&r!==i&&!qc(r)&&!o_(r)&&(t=!1)}ce.forEachChild(r,s)}};return ce.forEachChild(e,s),t}function o_(e){let n=e.parent;return ce.isCallExpression(n)&&(n.expression===e||n.arguments.some(t=>t===e))||ce.isNewExpression(n)&&(n.arguments??[]).some(t=>t===e)||ce.isTypeOfExpression(n)||(ce.isPropertyAccessExpression(n)||ce.isElementAccessExpression(n))&&n.expression===e}function qc(e){let n=e.parent;return(ce.isPropertyAccessExpression(n)||ce.isPropertyAssignment(n)||ce.isMethodDeclaration(n)||ce.isPropertyDeclaration(n)||ce.isGetAccessorDeclaration(n)||ce.isSetAccessorDeclaration(n))&&n.name===e||ce.isBindingElement(n)&&n.propertyName===e}function Hc(e,n,t){let s=null,r=i=>{if(s!==null)return;let o=i.getStart(e,!1),a=i.getEnd();if(o===n&&a===t){if(ce.isVariableDeclaration(i)&&i.initializer!==void 0){let d=Ze(i.initializer);s=ce.isArrowFunction(d)||ce.isFunctionExpression(d)?d:null}else(ce.isFunctionDeclaration(i)||ce.isFunctionExpression(i)||ce.isArrowFunction(i)||ce.isMethodDeclaration(i))&&(s=i);if(s!==null)return}i.pos<=n&&a>=t&&ce.forEachChild(i,r)};return r(e),s}var Gc=3;function $e(e,n,t){if(e===void 0)return;let s=e[n]??={fired:0,refused:{}};t===null?s.fired+=1:s.refused[t]=(s.refused[t]??0)+1}function ot(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var so=16,Yi=256,Gi=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let s=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(s)||(this.moduleFor(n),this.fns.set(s,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let s=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(s)||(this.moduleFor(n),this.classNodes.set(s,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(s,[])),r}methodFor(n,t,s,r){let i=`${n}#${t}.${s}`,o=`pkg:${n}#${t}.${s}`;if(!this.fns.has(i)){let a=this.classFor(n,t);this.fns.set(i,{id:o,moduleId:`pkg:${n}`,name:s,kind:r,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(o)}return o}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function tu(e,n){let t="node_modules/",s=e.lastIndexOf(t);if(s===-1)return n;let i=e.slice(s+t.length).split("/");return i[0]?.startsWith("@")&&i.length>=2?`${i[0]}/${i[1]}`:i[0]??n}function Vc(e,n,t){let s=kn.dirname(e),r=kn.dirname(n),i=[];for(;;){let a=t.get(s);if(a!==void 0){for(let l of i)t.set(l,a);return a}i.push(s);let d=on(kn.join(s,"package.json"));if(d!==null)try{let l=JSON.parse(d),c={name:l.name??"app",version:l.version??"0.0.0",dir:s};for(let p of i)t.set(p,c);return c}catch{}if(s===r||s===kn.dirname(s))break;s=kn.dirname(s)}let o={name:"app",version:"0.0.0",dir:null};for(let a of i)t.set(a,o);return o}function Vi(e){return m.isParenthesizedExpression(e)?Vi(e.expression):m.isStringLiteralLike(e)?e.text:m.isTemplateExpression(e)?e.head.text:m.isBinaryExpression(e)&&e.operatorToken.kind===m.SyntaxKind.PlusToken?Vi(e.left):null}function i_(e){if(!m.isCallExpression(e))return!1;let n=e.expression,t=m.isPropertyAccessExpression(n)?n.name.text:m.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let s=e.arguments[0];return s!==void 0&&m.isIdentifier(s)&&(s.text==="__dirname"||s.text==="__filename")}function su(e){let n=Vi(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":i_(e)?"relative-bounded":"unknown"}function a_(e){let n=[],t=s=>{if(m.isImportDeclaration(s)&&m.isStringLiteralLike(s.moduleSpecifier))n.push({specifier:s.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(m.isImportEqualsDeclaration(s)&&m.isExternalModuleReference(s.moduleReference)&&m.isStringLiteralLike(s.moduleReference.expression))n.push({specifier:s.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(m.isExportDeclaration(s)&&s.moduleSpecifier!==void 0&&m.isStringLiteralLike(s.moduleSpecifier))n.push({specifier:s.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(m.isCallExpression(s)){let r=Qs(s);if(r!==null){let i=r.specifierArg,o=i!==void 0&&m.isStringLiteralLike(i);n.push({specifier:o?i.text:void 0,specifierIsLiteral:o,dynamic:!0,...i!==void 0&&!o?{computedArg:i,loadPos:s.getStart(e)}:{}})}}m.forEachChild(s,t)};return t(e),n}function l_(e,n,t){let s=new Map,r=Vc(kn.join(e.appRoot,"package.json"),e.appRoot,s),i=[],o=[],a=[],d=new Map,l=new Set,c=[],p=new Set;for(let u of e.sourceFiles){let f=e.toRel(u.fileName);f!==null&&p.add(f)}for(let u of e.sourceFiles){let f=e.toRel(u.fileName);if(f===null)continue;let h=Vc(u.fileName,e.appRoot,s),g=tu(f,r.name),y=f.includes("node_modules/");i.push({id:f,packageName:y&&h.name!==r.name?h.name:g,versionRange:h.version,path:f,moduleSystem:"cjs",isEntrypoint:n.has(f)}),h.dir===r.dir&&l.add(f);let _=0,b=null;for(let x of a_(u)){let k=`${f}#import${String(_)}`;_+=1;let w=null,I=[];if(x.specifier!==void 0)if(We(x.specifier)==="package-root")w=t.moduleFor(Pn(x.specifier));else{let N=Cn(x.specifier,u.fileName,e.options,e.host),v=N!==null?e.toRel(N):null;if(v!==null)w=v;else if(x.specifier!==void 0){let[C,...R]=hs(x.specifier,u.fileName,e.options,e.host).map(F=>e.toRel(F)).filter(F=>F!==null&&p.has(F));C!==void 0&&R.length>=1&&(w=C,I=R.map(F=>F))}}o.push({id:k,moduleId:f,specifier:x.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:x.dynamic,specifierIsLiteral:x.specifierIsLiteral,...w!==null?{resolvedModuleId:w}:{}}),w!==null&&a.push({importId:k,resolvedModuleId:w});for(let N of I)a.push({importId:k,resolvedModuleId:N});if(x.computedArg!==void 0&&x.loadPos!==void 0&&c.push({importId:String(k),path:f,pos:x.loadPos,shape:su(x.computedArg),text:x.computedArg.getText(u).slice(0,160)}),x.computedArg!==void 0&&x.loadPos!==void 0){b??=Ht(u,u.fileName,e.resolveParamDirs);let N=[];for(let v of Hr(x.computedArg,b,e.appRoot,e.options,e.host)){let C=e.toRel(v);if(C===null||!p.has(C))continue;let R=C,F=`${f}#import${String(_)}`;_+=1,o.push({id:F,moduleId:f,specifier:C,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:R}),a.push({importId:F,resolvedModuleId:R}),N.push(C)}if(N.length>0){let v=Ys(x.computedArg,b)!==null||qr(x.computedArg),C=d.get(f)??[];C.push({pos:x.loadPos,candidateRels:N,seedable:v}),d.set(f,C)}}}}return{modules:i,imports:o,importEdges:a,computedLoads:d,appOwnedPaths:l,loadSites:c}}function d_(e){let n=on(e);if(n===null)return null;let t=m.createSourceFile(e,n,m.ScriptTarget.Latest,!0),s=r=>t.statements.some(i=>m.isFunctionDeclaration(i)?i.name?.text===r:m.isVariableStatement(i)?i.declarationList.declarations.some(o=>m.isIdentifier(o.name)&&o.name.text===r&&o.initializer!==void 0&&(m.isFunctionExpression(o.initializer)||m.isArrowFunction(o.initializer))):!1);for(let r of t.statements){if(m.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(o=>o.kind===m.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!m.isExpressionStatement(r)||!m.isBinaryExpression(r.expression))continue;let i=r.expression;if(i.operatorToken.kind===m.SyntaxKind.EqualsToken&&c_(i.left)){if(m.isFunctionExpression(i.right)&&i.right.name!==void 0)return i.right.name.text;if(m.isIdentifier(i.right)&&s(i.right.text))return i.right.text}}return null}function c_(e){return m.isPropertyAccessExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:m.isElementAccessExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="module"&&m.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function u_(e,n,t){for(let l of e.surfacePackages)n.moduleFor(l);let s=l=>"surface"in l?n.moduleFor(l.surface):l.module,r=[],i=new Set;for(let l of e.modules)t.has(l)||i.has(l)||(i.add(l),r.push({id:l,packageName:e.entryRealNames[l]??tu(l,"app"),versionRange:"",path:l,moduleSystem:"cjs",isEntrypoint:!1}));let o=[],a=[],d=0;for(let l of e.edges){let c=s(l.from),p=s(l.to),u=`${String(c)}#depreach${String(d)}`;d+=1,o.push({id:u,moduleId:c,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),a.push({importId:u,resolvedModuleId:p})}return{modules:r,imports:o,importEdges:a}}function Xc(e,n,t){let s=e.expression;if(m.isIdentifier(s)&&!t.has(s.text)){let r=n.get(s.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(m.isPropertyAccessExpression(s)&&m.isIdentifier(s.expression)&&!t.has(s.expression.text)){let r=n.get(s.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:s.name.text}}return null}function Xt(e){return m.canHaveModifiers(e)&&(m.getModifiers(e)?.some(n=>n.kind===m.SyntaxKind.ExportKeyword)??!1)}function f_(e){let n=new Set,t;for(let s of e.statements){if(m.isExpressionStatement(s)&&m.isBinaryExpression(s.expression)){let r=s.expression;if(r.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isPropertyAccessExpression(r.left)&&m.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(m.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(m.isObjectLiteralExpression(r.right))for(let i of r.right.properties)m.isShorthandPropertyAssignment(i)?n.add(i.name.text):m.isPropertyAssignment(i)&&m.isIdentifier(i.initializer)&&n.add(i.initializer.text)}continue}if(m.isFunctionDeclaration(s)&&s.name!==void 0&&Xt(s))n.add(s.name.text);else if(m.isVariableStatement(s)&&Xt(s))for(let r of s.declarationList.declarations)m.isIdentifier(r.name)&&n.add(r.name.text);else if(m.isExportDeclaration(s)&&s.exportClause&&m.isNamedExports(s.exportClause))for(let r of s.exportClause.elements)n.add((r.propertyName??r.name).text);else m.isExportAssignment(s)&&m.isIdentifier(s.expression)&&(n.add(s.expression.text),t=s.expression.text)}return{reachableLocals:n,defaultTarget:t}}function p_(e){for(let n of e.statements){if(m.isFunctionDeclaration(n)&&n.name!==void 0&&Xt(n)&&m.getModifiers(n)?.some(t=>t.kind===m.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(m.isExportAssignment(n)&&!n.isExportEquals&&m.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(m.isExpressionStatement(n)&&m.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===m.SyntaxKind.EqualsToken&&gn(t.left)&&m.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function it(e){if(m.isCallExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&m.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function gn(e){return m.isPropertyAccessExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:m.isElementAccessExpression(e)&&m.isIdentifier(e.expression)&&e.expression.text==="module"&&m.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Gn(e){if(gn(e))return!0;if(!m.isPropertyAccessExpression(e)&&!m.isElementAccessExpression(e))return!1;let n=e.expression;return m.isIdentifier(n)&&n.text==="exports"?!0:gn(n)}function xs(e){return m.isPropertyAccessExpression(e.expression)&&m.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ru(e){let n=!1,t=s=>{if(!n){if(m.isCallExpression(s)){let r=it(s);if(r!==void 0&&We(r)!=="package-root"){n=!0;return}}m.forEachChild(s,t)}};return t(e),n}function ou(e){let n=new Set,t=r=>r!==void 0&&ru(r),s=r=>{m.isVariableDeclaration(r)&&t(r.initializer)&&Xs(r.name,n),m.isBinaryExpression(r)&&r.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),m.forEachChild(r,s)};return s(e),n}function iu(e,n){for(let t of e.properties)m.isShorthandPropertyAssignment(t)?n.add(t.name.text):m.isPropertyAssignment(t)&&m.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function m_(e){let n=new Set;for(let a of e.statements)if(m.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(m.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(m.isVariableStatement(a))for(let d of a.declarationList.declarations)m.isIdentifier(d.name)&&d.initializer!==void 0&&(m.isFunctionExpression(d.initializer)||m.isArrowFunction(d.initializer)||m.isObjectLiteralExpression(d.initializer))&&n.add(d.name.text);let t=a=>m.isFunctionExpression(a)||m.isArrowFunction(a)||m.isObjectLiteralExpression(a)||m.isIdentifier(a)&&n.has(a.text),s=new Set,r=a=>{m.isIdentifier(a)?s.add(a.text):m.isObjectLiteralExpression(a)&&iu(a,s)},i=!1,o=a=>{if(!i){if(m.isBinaryExpression(a)&&a.operatorToken.kind===m.SyntaxKind.EqualsToken)if(gn(a.left)){r(a.right);let d=a.right;(m.isObjectLiteralExpression(d)?d.properties.every(c=>m.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||m.isPropertyAssignment(c)&&t(c.initializer)):t(d))||(i=!0)}else Gn(a.left)&&(t(a.right)||(i=!0));else(m.isCallExpression(a)&&xs(a)&&a.arguments[0]!==void 0&&Yt(a.arguments[0])||m.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(i=!0);i||m.forEachChild(a,o)}};if(o(e),!i&&s.size>0){for(let a of cu(e))if(s.has(a)){i=!0;break}}return i}function Yt(e){return Gn(e)||m.isIdentifier(e)&&e.text==="exports"}function au(e){if(!m.isPropertyAccessExpression(e.expression)||!m.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Ji(e){return au(e)&&e.arguments[0]!==void 0&&Yt(e.arguments[0])}function h_(e){return au(e)&&e.arguments[0]!==void 0&&m.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function g_(e){for(let n of e.declarations??[])if(m.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(m.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(m.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(m.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function y_(e,n,t,s,r){let i=(e.declarations??[]).filter(a=>!m.isSourceFile(a)&&!m.isModuleDeclaration(a));for(let a of i){let d=a.getSourceFile(),l=n.toRel(d.fileName);if(l===null||r.has(l))continue;let c=t.get(`${l}::${String(a.getStart(d,!1))}`);if(c!==void 0)return c}let o=e.getName();for(let a of i){let d=n.toRel(a.getSourceFile().fileName);if(d===null||r.has(d))continue;let l=s.get(`${d}::${o}`);if(l!==void 0)return l}}function ro(e){return m.isPropertyAccessExpression(e)?e.name.text:m.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Zi=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Qi(e){let n=m.isPropertyAccessExpression(e)||m.isElementAccessExpression(e)?ro(e):void 0;return n!==void 0&&n!=="__proto__"&&Zi.test(n)?n:void 0}function __(e){return e!=="__proto__"&&Zi.test(e)}function Yc(e){let n=Xe(e);return m.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||gn(n)}function x_(e){if(!m.isArrayLiteralExpression(e)&&!m.isObjectLiteralExpression(e))return!1;let n=!1,t=s=>{n||(Gn(s)?n=!0:m.forEachChild(s,t))};return t(e),n}function ea(e){let n=!1,t=new Map,s=r=>{if(!n){if(m.isBinaryExpression(r)&&r.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=m.SyntaxKind.LastAssignment){if(gn(r.left)||m.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===m.SyntaxKind.EqualsToken&&Yc(r.right))n=!0;else if(x_(r.left))n=!0;else if(Gn(r.left)){let i=Qi(r.left);i===void 0?n=!0:t.set(i,(t.get(i)??0)+1)}}else(m.isCallExpression(r)&&xs(r)&&r.arguments[0]!==void 0&&Yt(r.arguments[0])||m.isCallExpression(r)&&Ji(r)||m.isCallExpression(r)&&h_(r)||m.isVariableDeclaration(r)&&r.initializer!==void 0&&Yc(r.initializer))&&(n=!0);n||m.forEachChild(r,s)}};return s(e),{surfaceEscapes:n,assignCount:t}}function na(e){let n=[];for(let t of e.statements){if(!m.isExpressionStatement(t)||!m.isBinaryExpression(t.expression))continue;let s=t.expression;s.operatorToken.kind===m.SyntaxKind.EqualsToken&&(!Gn(s.left)||gn(s.left)||n.push({bin:s,name:Qi(s.left)}))}return n}function b_(e){let{surfaceEscapes:n,assignCount:t}=ea(e);if(n)return[];let s=[];for(let{bin:r,name:i}of na(e))i===void 0||(t.get(i)??0)!==1||(m.isFunctionExpression(r.right)||m.isArrowFunction(r.right))&&s.push({name:i,value:r.right});return s}function S_(e,n){let{surfaceEscapes:t,assignCount:s}=ea(e);if(t)return[];let r=[];for(let{bin:i,name:o}of na(e))o===void 0||(s.get(o)??0)!==1||m.isIdentifier(i.right)&&!n.has(i.right.text)&&r.push(i.right.text);return r}function k_(e,n){let{surfaceEscapes:t,assignCount:s}=ea(e);for(let{bin:r,name:i}of na(e)){let o=r.right;if(!(m.isFunctionExpression(o)||m.isArrowFunction(o)||m.isIdentifier(o)))continue;let d=m.isFunctionExpression(o)||m.isArrowFunction(o)||m.isIdentifier(o)&&!n.has(o.text);if(!(!t&&i!==void 0&&(s.get(i)??0)===1&&d))return!0}return!1}function w_(e){let n=m.isPropertyAccessExpression(e)||m.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&m.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Jc(e){let n=e.parent;return n===void 0?!1:m.isPropertyAccessExpression(n)?n.name===e:m.isQualifiedName(n)?n.right===e:m.isBindingElement(n)||m.isImportSpecifier(n)?n.propertyName===e:m.isExportSpecifier(n)?!0:m.isPropertyAssignment(n)||m.isPropertyDeclaration(n)||m.isPropertySignature(n)||m.isMethodDeclaration(n)||m.isMethodSignature(n)||m.isGetAccessorDeclaration(n)||m.isSetAccessorDeclaration(n)||m.isEnumMember(n)?n.name===e:!1}function Zc(e){for(let n=e.parent;n!==void 0;n=n.parent){if(m.isSourceFile(n))return!0;if(!m.isArrowFunction(n)&&(m.isFunctionLike(n)||m.isClassLike(n)))return!1}return!0}function v_(e,n){let t=s=>{m.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&n.add(s),m.forEachChild(s,t)};t(e)}function E_(e){let n=[],t=new Set;for(let i of e.statements){if(m.isExportDeclaration(i)||m.isExportAssignment(i)||m.isImportDeclaration(i)||m.isImportEqualsDeclaration(i)||Xt(i))return null;if(!m.isExpressionStatement(i)||!m.isBinaryExpression(i.expression))continue;let o=i.expression;if(o.operatorToken.kind===m.SyntaxKind.EqualsToken){if(gn(o.left))n.push({kind:"whole",value:o.right});else if(Gn(o.left)){let a=Qi(o.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:o.right,root:w_(o.left)})}else continue;v_(o.left,t)}}let s=!1,r=i=>{if(!s){if(m.isIdentifier(i)&&(i.text==="exports"||i.text==="module")&&!t.has(i)&&!Jc(i)){s=!0;return}if(i.kind===m.SyntaxKind.ThisKeyword&&Zc(i)){s=!0;return}if(m.isIdentifier(i)&&i.text==="arguments"&&!Jc(i)&&Zc(i)){s=!0;return}m.forEachChild(i,r)}};return r(e),s?null:n}function Xi(e){return m.isIdentifier(e)||m.isStringLiteralLike(e)?e.text:void 0}function Qc(e,n,t){return m.isIdentifier(e)?n(e.text):t?.(e)}function N_(e,n,t,s){let r=new Map,i=E_(e);if(i===null||i.filter(f=>f.kind==="whole").length>1)return r;let o=i.findIndex(f=>f.kind==="whole"),a=(f,h)=>o>=0&&h>o&&f.kind==="member"&&f.root==="exports",d=i.some(a);if(d){let f=i[o];if(f===void 0||f.kind!=="whole"||!m.isObjectLiteralExpression(f.value))return r}let l=d?i.filter((f,h)=>!a(f,h)):i,c=new Map;for(let f of l)f.kind==="member"&&c.set(f.name,(c.get(f.name)??0)+1);let p=f=>n.has(f)?void 0:t(f),u=(f,h)=>{h===void 0?r.delete(f):r.set(f,h)};for(let f of l){if(f.kind==="member"){u(f.name,(c.get(f.name)??0)>1?void 0:Qc(f.value,p,s));continue}r.clear();let h=f.value;if(m.isObjectLiteralExpression(h))for(let g of h.properties){if(m.isSpreadAssignment(g))return new Map;if(m.isShorthandPropertyAssignment(g)){u(g.name.text,p(g.name.text));continue}let y=Xi(g.name);if(y===void 0)return new Map;u(y,m.isPropertyAssignment(g)?Qc(g.initializer,p,s):void 0)}}return r}function lu(e,n,t,s){let r=new Map,i=a=>a!==void 0&&We(a)==="relative"?t.get(`${n}::${a}`):void 0,o=a=>{if(m.isVariableDeclaration(a)&&a.initializer!==void 0){let d=a.initializer;if(m.isIdentifier(a.name)&&!s.has(a.name.text)){let l=i(it(d));if(l!==void 0)r.set(a.name.text,{kind:"whole",target:l});else if((m.isPropertyAccessExpression(d)||m.isElementAccessExpression(d))&&m.isCallExpression(d.expression)){let c=i(it(d.expression)),p=ro(d);c!==void 0&&p!==void 0&&r.set(a.name.text,{kind:"member",target:c,member:p})}}else if(m.isObjectBindingPattern(a.name)){let l=i(it(d));if(l!==void 0){for(let c of a.name.elements)if(m.isIdentifier(c.name)&&!s.has(c.name.text)){let p=c.propertyName!==void 0&&m.isIdentifier(c.propertyName)?c.propertyName.text:c.name.text;r.set(c.name.text,{kind:"member",target:l,member:p})}}}}m.forEachChild(a,o)};return o(e),r}function A_(e,n,t,s){let r=o=>o!==void 0&&We(o)==="relative"?t.get(`${n}::${o}`):void 0,i=r(it(e));if(i!==void 0)return{kind:"whole",target:i};if(m.isPropertyAccessExpression(e)||m.isElementAccessExpression(e)){let o=ro(e);if(o===void 0)return;let a=r(it(e.expression));if(a!==void 0)return{kind:"member",target:a,member:o};if(m.isIdentifier(e.expression)){let d=s.get(e.expression.text);if(d?.kind==="whole")return{kind:"member",target:d.target,member:o}}return}if(m.isIdentifier(e))return s.get(e.text)}function du(e,n,t,s,r){let i=[],o=!1,a=p=>{if(ru(p))return!0;let u=!1,f=h=>{u||(m.isIdentifier(h)&&r.has(h.text)?u=!0:m.forEachChild(h,f))};return f(p),u},d=(p,u)=>{let f=A_(p,n,t,s);f!==void 0?i.push({source:f,exportedName:u}):a(p)&&(o=!0)},l=p=>{if(m.isObjectLiteralExpression(p)){for(let u of p.properties)if(m.isSpreadAssignment(u))d(u.expression,"default");else if(m.isPropertyAssignment(u)){let f=m.isIdentifier(u.name)||m.isStringLiteralLike(u.name)?u.name.text:"default";d(u.initializer,f)}else if(m.isShorthandPropertyAssignment(u)){let f=s.get(u.name.text);f!==void 0&&i.push({source:f,exportedName:u.name.text})}return}d(p,"default")},c=p=>{if(m.isBinaryExpression(p)&&p.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=m.SyntaxKind.LastAssignment){if(gn(p.left)){l(p.right);return}if(Gn(p.left)){let u=m.isPropertyAccessExpression(p.left)?p.left.name.text:m.isElementAccessExpression(p.left)&&m.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";d(p.right,u);return}}else if(m.isExportAssignment(p)&&p.isExportEquals){d(p.expression,"default");return}else if(m.isCallExpression(p)&&xs(p)&&p.arguments[0]!==void 0&&Yt(p.arguments[0])){for(let u of p.arguments.slice(1))l(u);return}m.forEachChild(p,c)};return c(e),{sources:i,residual:o}}function cu(e){let n=new Set,t=r=>{let i=r;for(;m.isPropertyAccessExpression(i)||m.isElementAccessExpression(i);)i=i.expression;return m.isIdentifier(i)?i.text:void 0},s=r=>{let i=uu(r);if(i!==void 0){let o=t(i);o!==void 0&&n.add(o)}m.forEachChild(r,s)};return s(e),n}function uu(e){return m.isBinaryExpression(e)&&e.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=m.SyntaxKind.LastAssignment&&(m.isPropertyAccessExpression(e.left)||m.isElementAccessExpression(e.left))?e.left:void 0}function to(e){if(m.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)m.isBindingElement(t)&&n.push(...to(t.name));return n}function hn(e){if(m.isIdentifier(e))return[e.text];if(m.isParenthesizedExpression(e)||m.isAsExpression(e)||m.isNonNullExpression(e)||m.isSatisfiesExpression(e)||m.isTypeAssertionExpression(e)||m.isAwaitExpression(e))return hn(e.expression);if(m.isYieldExpression(e))return e.expression!==void 0?hn(e.expression):[];if(m.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===m.SyntaxKind.BarBarToken||n===m.SyntaxKind.AmpersandAmpersandToken||n===m.SyntaxKind.QuestionQuestionToken?[...hn(e.left),...hn(e.right)]:n===m.SyntaxKind.CommaToken?hn(e.right):[]}return m.isConditionalExpression(e)?[...hn(e.whenTrue),...hn(e.whenFalse)]:m.isArrayLiteralExpression(e)?e.elements.flatMap(n=>m.isSpreadElement(n)?hn(n.expression):m.isOmittedExpression(n)?[]:hn(n)):m.isObjectLiteralExpression(e)?e.properties.flatMap(n=>m.isShorthandPropertyAssignment(n)?[n.name.text]:m.isPropertyAssignment(n)?hn(n.initializer):m.isSpreadAssignment(n)?hn(n.expression):[]):[]}function fu(e,n){let t=[],s=(a,d)=>{for(let l of a)for(let c of d)l!==c&&t.push({a:l,b:c})},r=a=>m.isIdentifier(a)?[a.text]:m.isArrayLiteralExpression(a)?a.elements.flatMap(r):m.isObjectLiteralExpression(a)?a.properties.flatMap(d=>m.isShorthandPropertyAssignment(d)?[d.name.text]:m.isPropertyAssignment(d)?r(d.initializer):[]):[],i=a=>{m.isBinaryExpression(a)&&a.operatorToken.kind===m.SyntaxKind.EqualsToken?s(r(a.left),hn(a.right)):m.isVariableDeclaration(a)&&a.initializer!==void 0?s(to(a.name),hn(a.initializer)):(m.isForOfStatement(a)||m.isForInStatement(a))&&m.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&s(to(a.initializer.declarations[0].name),hn(a.expression)),m.forEachChild(a,i)};i(e);let o=new Set(n);for(let a=!0;a;){a=!1;for(let{a:d,b:l}of t)o.has(d)&&!o.has(l)&&(o.add(l),a=!0),o.has(l)&&!o.has(d)&&(o.add(d),a=!0)}return o}function pu(e,n){let t=a=>{if(!m.isPropertyAccessExpression(a)&&!m.isElementAccessExpression(a))return;let d=a;for(;m.isPropertyAccessExpression(d)||m.isElementAccessExpression(d);)d=d.expression;return m.isIdentifier(d)?d.text:void 0},s=[],r=(a,d)=>{for(let c of hn(d))s.push({name:a,root:c});let l=t(d);l!==void 0&&s.push({name:a,root:l})},i=a=>{m.isVariableDeclaration(a)&&m.isIdentifier(a.name)&&a.initializer!==void 0?r(a.name.text,a.initializer):m.isBinaryExpression(a)&&a.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isIdentifier(a.left)&&r(a.left.text,a.right),m.forEachChild(a,i)};i(e);let o=new Map(n);for(let a=!0;a;){a=!1;for(let{name:d,root:l}of s){let c=o.get(l);c!==void 0&&!o.has(d)&&(o.set(d,c),a=!0)}}return o}function mu(e){return fu(e,cu(e))}function I_(e,n){let t=d=>d>=m.SyntaxKind.FirstAssignment&&d<=m.SyntaxKind.LastAssignment,s=d=>{let l=d.parent;if(l===void 0||!m.isObjectLiteralExpression(l))return!1;let c=l.parent;return c!==void 0&&m.isBinaryExpression(c)&&c.operatorToken.kind===m.SyntaxKind.EqualsToken&&c.right===l&&Gn(c.left)?!0:c!==void 0&&m.isCallExpression(c)&&xs(c)&&c.arguments[0]!==void 0&&Yt(c.arguments[0])&&c.arguments.indexOf(l)>0},r=(d,l)=>{if((m.isFunctionDeclaration(l)||m.isFunctionExpression(l))&&l.name===d||m.isVariableDeclaration(l)&&l.name===d||m.isParameter(l)&&l.name===d||m.isBindingElement(l)&&l.name===d||(m.isCallExpression(l)||m.isNewExpression(l))&&l.expression===d)return!0;if((m.isPropertyAccessExpression(l)||m.isElementAccessExpression(l))&&l.expression===d){let c=l;for(;c.parent!==void 0&&(m.isPropertyAccessExpression(c.parent)||m.isElementAccessExpression(c.parent))&&c.parent.expression===c;)c=c.parent;let p=c.parent;return!(p!==void 0&&m.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===c)}return m.isBinaryExpression(l)&&l.operatorToken.kind===m.SyntaxKind.EqualsToken&&l.right===d&&Gn(l.left)?!0:m.isShorthandPropertyAssignment(l)&&l.name===d||m.isPropertyAssignment(l)&&l.initializer===d?s(l):!!(m.isExportAssignment(l)&&l.expression===d||m.isExportSpecifier(l))},i=(d,l)=>m.isPropertyAccessExpression(l)&&l.name===d||m.isPropertyAssignment(l)&&l.name===d||(m.isMethodDeclaration(l)||m.isGetAccessorDeclaration(l)||m.isSetAccessorDeclaration(l))&&l.name===d,o=!1,a=(d,l)=>{if(!o){if(m.isIdentifier(d)&&l!==void 0&&n.has(d.text)&&!i(d,l)&&!r(d,l)){o=!0;return}m.forEachChild(d,c=>a(c,d))}};return a(e,void 0),o}function R_(e){let n=new Set;for(let d of e.statements)if(m.isFunctionDeclaration(d)&&d.name!==void 0)n.add(d.name.text);else if(m.isVariableStatement(d))for(let l of d.declarationList.declarations)m.isIdentifier(l.name)&&l.initializer!==void 0&&(m.isFunctionExpression(l.initializer)||m.isArrowFunction(l.initializer))&&n.add(l.name.text);let t=new Set,s=d=>{m.isBinaryExpression(d)&&d.operatorToken.kind===m.SyntaxKind.EqualsToken?(gn(d.left)&&(m.isIdentifier(d.right)?t.add(d.right.text):m.isObjectLiteralExpression(d.right)&&iu(d.right,t)),gn(d.right)&&m.isIdentifier(d.left)&&t.add(d.left.text)):m.isVariableDeclaration(d)&&m.isIdentifier(d.name)&&d.initializer!==void 0&&gn(d.initializer)&&t.add(d.name.text),m.forEachChild(d,s)};if(s(e),t.size>0){if(I_(e,t))return!0;let d=pu(e,new Map([...t].map(c=>[c,c]))),l=mu(e);for(let c of d.keys())if(l.has(c))return!0}let r=d=>m.isIdentifier(d)&&n.has(d.text),i=d=>d.properties.every(l=>m.isShorthandPropertyAssignment(l)&&n.has(l.name.text)||m.isPropertyAssignment(l)&&r(l.initializer)),o=!1,a=d=>{if(!o){if(m.isBinaryExpression(d)){let l=d.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&d.operatorToken.kind<=m.SyntaxKind.LastAssignment;l&&gn(d.left)?d.operatorToken.kind===m.SyntaxKind.EqualsToken&&(r(d.right)||m.isObjectLiteralExpression(d.right)&&i(d.right))||(o=!0):l&&Gn(d.left)&&(o=!0)}else m.isCallExpression(d)?(xs(d)&&d.arguments[0]!==void 0&&Yt(d.arguments[0])||Ji(d))&&(o=!0):(m.isExportAssignment(d)&&d.isExportEquals&&!m.isIdentifier(d.expression)||m.isExportDeclaration(d)&&d.moduleSpecifier!==void 0)&&(o=!0);o||m.forEachChild(d,a)}};return a(e),o}var O_=8;function eu(e,n,t){let s=new Set,r=lu(e,n,t,gs(e)),i=du(e,n,t,r,ou(e));for(let{source:o}of i.sources)s.add(o.target);for(let o of e.statements)if(m.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&m.isStringLiteralLike(o.moduleSpecifier)&&We(o.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${o.moduleSpecifier.text}`);a!==void 0&&s.add(a)}return s}function P_(e,n,t,s=new Map){let r=new Set(n.modules.filter(w=>w.isEntrypoint).map(w=>String(w.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let i=new Set(n.modules.filter(w=>w.externalSurface===!0).map(w=>String(w.id))),o=new Map,a=new Map,d=new Map,l=new Map;for(let w of t){if(w.name==="<toplevel>"){l.set(String(w.moduleId),w);continue}if(o.set(`${String(w.moduleId)}::${String(w.declRange.start)}`,w),w.name!==void 0&&a.set(`${String(w.moduleId)}::${w.name}`,w),w.isExported&&w.name!==void 0){let I=d.get(String(w.moduleId))??[];I.push(w),d.set(String(w.moduleId),I)}}if(s.size>0){let w=new Map(t.map(I=>[String(I.id),I]));for(let[I,N]of s){let v=w.get(String(N));v!==void 0&&!o.has(I)&&o.set(I,v)}}let c=new Map;for(let w of n.imports)w.resolvedModuleId!==void 0&&c.set(`${w.moduleId}::${w.specifier}`,String(w.resolvedModuleId));let p=new Map;for(let w of e.sourceFiles){let I=e.toRel(w.fileName);I!==null&&p.set(I,w)}let u=new Map,f=w=>{let I=u.get(w);if(I!==void 0)return I;let N=p.get(w),v=N===void 0?!0:R_(N);return u.set(w,v),v},h=new Set,g=(w,I)=>I!==void 0&&We(I)==="relative"?c.get(`${w}::${I}`):void 0,y=w=>{if(m.isIdentifier(w))return w.text;if(m.isPropertyAccessExpression(w)){let I=y(w.expression);return I===void 0?void 0:`${I}.${w.name.text}`}if(m.isElementAccessExpression(w)&&m.isStringLiteralLike(w.argumentExpression)){let I=y(w.expression);return I===void 0?void 0:`${I}.${w.argumentExpression.text}`}},_=w=>{let I=w;for(;m.isPropertyAccessExpression(I)||m.isElementAccessExpression(I);)I=I.expression;return it(I)};for(let w of e.sourceFiles){let I=e.toRel(w.fileName);if(I===null)continue;let N=new Map,v=new Map,C=(P,U)=>{let E=g(I,it(U));if(E!==void 0){if(m.isIdentifier(P))v.set(P.text,E),N.set(P.text,E);else if(m.isObjectBindingPattern(P)||m.isArrayBindingPattern(P))for(let T of to(P))v.set(T,E);else if(m.isPropertyAccessExpression(P)||m.isElementAccessExpression(P)){let T=y(P);T!==void 0&&N.set(T,E)}}},R=P=>{m.isVariableDeclaration(P)&&P.initializer!==void 0?C(P.name,P.initializer):m.isBinaryExpression(P)&&P.operatorToken.kind===m.SyntaxKind.EqualsToken&&C(P.left,P.right),m.forEachChild(P,R)};R(w);let F=P=>{let U=uu(P);if(U!==void 0){let E=U.expression,T=g(I,_(E));T!==void 0&&h.add(T);let K=y(E),J=K!==void 0?N.get(K):void 0;J!==void 0&&h.add(J)}m.forEachChild(P,F)};if(F(w),v.size>0){let P=pu(w,v),U=mu(w);for(let[E,T]of P)U.has(E)&&h.add(T)}}let b=[],x=[],k=[];for(let w of e.sourceFiles){let I=e.toRel(w.fileName);if(I===null||!r.has(I))continue;let N=e.checker.getSymbolAtLocation(w),v=new Set,C=new Set,R=0,F=(Y,V)=>{if(i.has(String(Y.moduleId))||v.has(String(Y.id)))return;v.add(String(Y.id));let fe=`${I}#reexport:${String(R)}:${V}`;R+=1,b.push({id:fe,moduleId:I,exportedName:V,kind:"value",reexportOf:{moduleId:String(Y.moduleId),name:Y.name??V}}),x.push({exportId:fe,target:{kind:"function",functionId:Y.id}})},P=Y=>{if(g_(Y))return;let V=Y;if((Y.flags&m.SymbolFlags.Alias)!==0)try{V=e.checker.getAliasedSymbol(Y)}catch{return}let fe=y_(V,e,o,a,i);if(fe!==void 0){F(fe,Y.getName());return}if((V.flags&m.SymbolFlags.Module)!==0&&!C.has(V)){C.add(V);try{for(let S of e.checker.getExportsOfModule(V))P(S)}catch{}}};if(N!==void 0)for(let Y of e.checker.getExportsOfModule(N))P(Y);let U=lu(w,I,c,gs(w)),E=du(w,I,c,U,ou(w)),T=new Set,K=E.residual,J=Y=>{let V=p.get(Y);Y.includes("node_modules/")||V===void 0||m_(V)?K=!0:T.add(Y)};for(let{source:Y,exportedName:V}of E.sources){let fe=d.get(Y.target)??[],S=h.has(Y.target);if(Y.kind==="whole"){for(let A of fe)F(A,A.name??V);S?K=!0:(fe.length===0||f(Y.target))&&J(Y.target)}else{let A=fe.filter(j=>j.name===Y.member);for(let j of A)F(j,V);S?K=!0:(A.length===0||f(Y.target))&&J(Y.target)}}let W=new Set,se=[];for(let Y of eu(w,I,c))se.push({target:Y,depth:1});for(;se.length>0;){let Y=se.shift();if(Y===void 0)break;let{target:V,depth:fe}=Y;if(W.has(V)||fe>O_||(W.add(V),V.split("/").includes("node_modules")))continue;let S=p.get(V);if(S===void 0)continue;let A=l.get(V);A!==void 0&&!f(V)&&F(A,"<load>");for(let j of eu(S,V,c))W.has(j)||se.push({target:j,depth:fe+1})}k_(w,gs(w))&&(K=!0);for(let Y of T)k.push({code:"unresolved-reexport",path:I,detail:`entrypoint whole/member re-exports app-owned relative module ${Y} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:Y});K&&k.push({code:"unresolved-reexport",path:I,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:b,exportBindings:x,diagnostics:k}}var _s=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),C_=new Set(["defineProperty","defineProperties","create"]);function M_(e){let n=!0,t=r=>m.isIdentifier(r)||m.isStringLiteral(r)||m.isNumericLiteral(r)?_s.has(r.text):m.isComputedPropertyName(r)&&m.isStringLiteralLike(r.expression)?_s.has(r.expression.text):!1,s=r=>{if(n){if(m.isNewExpression(r)||m.isForOfStatement(r)||m.isSpreadElement(r)||m.isSpreadAssignment(r)||m.isArrayBindingPattern(r)||m.isGetAccessorDeclaration(r)||m.isSetAccessorDeclaration(r)||m.isYieldExpression(r)&&r.asteriskToken!==void 0||m.canHaveDecorators(r)&&(m.getDecorators(r)?.length??0)>0){n=!1;return}if((m.isPropertyAccessExpression(r)||m.isMethodDeclaration(r)||m.isPropertyAssignment(r))&&t(r.name)||m.isPropertyDeclaration(r)&&t(r.name)||m.isShorthandPropertyAssignment(r)&&t(r.name)||m.isBindingElement(r)&&t(r.propertyName??r.name)||m.isElementAccessExpression(r)&&m.isStringLiteralLike(r.argumentExpression)&&_s.has(r.argumentExpression.text)){n=!1;return}if(m.isCallExpression(r)&&m.isPropertyAccessExpression(r.expression)&&m.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&C_.has(r.expression.name.text)){n=!1;return}m.forEachChild(r,s)}};return s(e),n}function oo(e){if(m.isIdentifier(e)||m.isStringLiteral(e)||m.isNumericLiteral(e))return e.text}function hu(e){let n=t=>m.canHaveDecorators(t)&&(m.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function T_(e){let n=!1,t=new Set,s=[],r=new Map,i=(u,f)=>{let h=r.get(u);h===void 0?r.set(u,[f]):h.push(f)},o=u=>{m.isIdentifier(u)?t.add(u.text):s.push(u)},a=u=>{for(let f of u.properties)m.isShorthandPropertyAssignment(f)?t.add(f.name.text):m.isPropertyAssignment(f)?s.push(f.initializer):n=!0},d=u=>{if(m.isBinaryExpression(u)&&u.operatorToken.kind===m.SyntaxKind.EqualsToken){let f=u.left,h=u.right;gn(f)?m.isObjectLiteralExpression(h)?a(h):m.isIdentifier(h)||m.isFunctionExpression(h)||m.isArrowFunction(h)||m.isClassExpression(h)?o(h):n=!0:Gn(f)?(m.isElementAccessExpression(f)&&!m.isStringLiteralLike(f.argumentExpression)&&(n=!0),o(h)):m.isIdentifier(f)?i(f.text,h):(m.isPropertyAccessExpression(f)||m.isElementAccessExpression(f))&&m.isIdentifier(f.expression)&&i(f.expression.text,h)}else if(m.isCallExpression(u))(xs(u)&&u.arguments[0]!==void 0&&Yt(u.arguments[0])||Ji(u))&&(n=!0);else if(m.isVariableDeclaration(u)&&m.isIdentifier(u.name)&&u.initializer!==void 0)i(u.name.text,u.initializer);else if((m.isFunctionDeclaration(u)||m.isClassDeclaration(u))&&u.name!==void 0)i(u.name.text,u),Xt(u)&&t.add(u.name.text);else if(m.isExportDeclaration(u)){if(u.exportClause===void 0)n=!0;else if(u.moduleSpecifier===void 0&&m.isNamedExports(u.exportClause))for(let f of u.exportClause.elements)t.add((f.propertyName??f.name).text)}else if(m.isExportAssignment(u))u.isExportEquals&&!m.isIdentifier(u.expression)?n=!0:o(u.expression);else if(m.isVariableStatement(u)&&Xt(u))for(let f of u.declarationList.declarations)m.isIdentifier(f.name)&&t.add(f.name.text);m.forEachChild(u,d)};d(e);let l=new Set,c=[...t],p=u=>{let f=h=>{m.isIdentifier(h)&&c.push(h.text),m.forEachChild(h,f)};f(u)};for(let u of s)p(u);for(;c.length>0;){let u=c.pop();if(!(u===void 0||l.has(u))){l.add(u);for(let f of r.get(u)??[])p(f)}}return{names:l,opaque:n}}var $_=512,L_=new Set(["get","post","put","patch","delete","options","head"]);function D_(e){for(let n of e.statements){if(m.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(m.isExpressionStatement(n)&&m.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isPropertyAccessExpression(n.expression.left)&&m.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,s=n.expression.left.name.text;if(t==="module"&&s==="exports"||t==="exports"&&s==="default")return n.expression.right}}return null}function F_(e){let n=new Map,t=D_(e);if(t===null)return n;let s=i=>{for(let o of i.properties)if(m.isPropertyAssignment(o)&&m.isObjectLiteralExpression(o.initializer)){let a=oo(o.name);a!==void 0&&n.set(a,o.initializer)}};if(m.isObjectLiteralExpression(t))return s(t),n;if(!m.isIdentifier(t))return n;let r=t.text;for(let i of e.statements)if(m.isVariableStatement(i))for(let o of i.declarationList.declarations)m.isIdentifier(o.name)&&o.name.text===r&&o.initializer!==void 0&&m.isObjectLiteralExpression(o.initializer)&&s(o.initializer);else if(m.isExpressionStatement(i)&&m.isBinaryExpression(i.expression)&&i.expression.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isPropertyAccessExpression(i.expression.left)&&m.isIdentifier(i.expression.left.expression)&&i.expression.left.expression.text===r&&m.isObjectLiteralExpression(i.expression.right)){let o=i.expression.left.name.text;n.set(o,i.expression.right)}return n}function j_(e){for(let n of e.properties){if(m.isMethodDeclaration(n)&&m.isIdentifier(n.name)&&n.name.text==="handler")return n;if(m.isPropertyAssignment(n)&&m.isIdentifier(n.name)&&n.name.text==="handler"&&(m.isArrowFunction(n.initializer)||m.isFunctionExpression(n.initializer)))return n.initializer}return null}function B_(e,n){for(let s of e.properties){let r;if(m.isPropertyAssignment(s)||m.isMethodDeclaration(s)?r=oo(s.name):m.isShorthandPropertyAssignment(s)&&(r=s.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function K_(e,n){let t=[],s=new Set,r=(a,d,l)=>{if(t.length>=$_||a==="__proto__"||!Zi.test(a))return;let c=`${e}#handler:${a}`;s.has(c)||(s.add(c),t.push({id:c,node:d,memberPath:a,idiom:l}))};for(let[a,d]of F_(n)){let l=j_(d);l!==null&&B_(d,l)&&r(a,l,"descriptor-object")}let i=0,o=a=>{if(m.isCallExpression(a)&&m.isPropertyAccessExpression(a.expression)&&m.isIdentifier(a.expression.expression)&&L_.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&m.isStringLiteralLike(a.arguments[0])){let d=a.expression.name.text;for(let l=1;l<a.arguments.length;l+=1){let c=a.arguments[l];c!==void 0&&(m.isArrowFunction(c)||m.isFunctionExpression(c))&&r(`${d}_${String(i)}_${String(l)}`,c,"router-verb")}i+=1}m.forEachChild(a,o)};return o(n),t}function z_(e,n,t,s,r,i){let o=`${e}#class:${t}`,a=[],d=new Set;for(let l of s.members){let c,p,u;if(m.isConstructorDeclaration(l))c="constructor",p="ctor",u=!1;else if(m.isMethodDeclaration(l))c=oo(l.name),p="method",u=c!==void 0&&!_s.has(c);else continue;if(c===void 0||d.has(c))continue;d.add(c);let f=`${e}#${t}.${c}`;r.push({id:f,moduleId:e,name:c,kind:p,enclosingClassId:o,declRange:ot(e,l,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),u&&i.push({start:l.getStart(n,!1),end:l.getEnd(),id:f})}return{id:o,moduleId:e,name:t,implementsRefs:[],members:a}}function U_(e,n,t=[],s=!1,r){let i=[],o=new Map,a=[],{reachableLocals:d,defaultTarget:l}=f_(n),c=gs(n),p=`${e}#<toplevel>`;i.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let u=(I,N)=>{let v=`${e}#${I}`;return i.push({id:v,moduleId:e,name:I,kind:"function",declRange:ot(e,N,n),isExported:d.has(I),publicSurfaceReachable:d.has(I)}),o.set(I,{kind:"function",functionId:v}),a.push({start:N.getStart(n,!1),end:N.getEnd(),id:v}),v},f=[],h=!e.split("/").includes("node_modules");if(h)for(let I of S_(n,c))d.add(I);let g=h?T_(n):void 0,y=(I,N,v)=>{g===void 0||g.opaque||g.names.has(I)||Xt(v)||hu(N)||f.push(z_(e,n,I,N,i,a))};for(let I of n.statements)if(m.isFunctionDeclaration(I)&&I.name!==void 0)u(I.name.text,I);else if(m.isClassDeclaration(I)&&I.name!==void 0)y(I.name.text,I,I);else if(m.isVariableStatement(I))for(let N of I.declarationList.declarations){if(m.isObjectBindingPattern(N.name)&&N.initializer!==void 0&&m.isCallExpression(N.initializer)&&m.isIdentifier(N.initializer.expression)&&N.initializer.expression.text==="require"&&N.initializer.arguments.length===1&&N.initializer.arguments[0]!==void 0&&m.isStringLiteralLike(N.initializer.arguments[0])){let C=N.initializer.arguments[0].text;for(let R of N.name.elements){if(R.dotDotDotToken!==void 0||R.initializer!==void 0||!m.isIdentifier(R.name))continue;let F=R.propertyName??R.name;!m.isIdentifier(F)&&!m.isStringLiteralLike(F)||o.set(R.name.text,{kind:"import",specifier:C,form:{named:F.text}})}continue}if(!m.isIdentifier(N.name)||N.initializer===void 0)continue;let v=N.initializer;if(m.isFunctionExpression(v)||m.isArrowFunction(v))u(N.name.text,N);else if(m.isClassExpression(v))y(N.name.text,v,I);else if(m.isCallExpression(v)&&m.isIdentifier(v.expression)&&v.expression.text==="require"&&v.arguments.length===1&&v.arguments[0]!==void 0&&m.isStringLiteralLike(v.arguments[0]))o.set(N.name.text,{kind:"import",specifier:v.arguments[0].text,form:"whole"});else if((m.isPropertyAccessExpression(v)||m.isElementAccessExpression(v))&&ro(v)==="default"&&m.isCallExpression(v.expression)){let C=it(v.expression);C!==void 0&&o.set(N.name.text,{kind:"import",specifier:C,form:"require-default"})}}else if(m.isImportDeclaration(I)&&m.isStringLiteralLike(I.moduleSpecifier)){let N=I.moduleSpecifier.text,v=I.importClause;if(v!==void 0){v.name!==void 0&&o.set(v.name.text,{kind:"import",specifier:N,form:"default"});let C=v.namedBindings;if(C!==void 0&&m.isNamespaceImport(C))o.set(C.name.text,{kind:"import",specifier:N,form:"namespace"});else if(C!==void 0&&m.isNamedImports(C))for(let R of C.elements){let F=(R.propertyName??R.name).text;o.set(R.name.text,{kind:"import",specifier:N,form:{named:F}})}}}else m.isImportEqualsDeclaration(I)&&m.isExternalModuleReference(I.moduleReference)&&m.isStringLiteralLike(I.moduleReference.expression)&&o.set(I.name.text,{kind:"import",specifier:I.moduleReference.expression.text,form:"whole"});let _=new Map,b,x=new Map,k=new Map;if(h)for(let{name:I,value:N}of b_(n)){let v=`${e}#member-export:${I}`;i.push({id:v,moduleId:e,name:I,kind:m.isArrowFunction(N)?"arrow":"function",declRange:ot(e,N,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:N.getStart(n,!1),end:N.getEnd(),id:v}),_.set(N.getStart(n,!1),v)}if(s&&h){let I=F=>{let P=Ze(F);return m.isFunctionExpression(P)||m.isArrowFunction(P)?P:void 0},N=(F,P)=>{let U=F;return i.push({id:U,moduleId:e,kind:m.isArrowFunction(P)?"arrow":"function",declRange:ot(e,P,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:P.getStart(n,!1),end:P.getEnd(),id:U}),_.set(P.getStart(n,!1),U),U},v=[],C=[],R=[];for(let F of n.statements)m.isExportAssignment(F)&&!F.isExportEquals?v.push(F):m.isFunctionDeclaration(F)&&m.getModifiers(F)?.some(P=>P.kind===m.SyntaxKind.DefaultKeyword)===!0?C.push(F):m.isExpressionStatement(F)&&m.isBinaryExpression(F.expression)&&F.expression.operatorToken.kind===m.SyntaxKind.EqualsToken&&gn(F.expression.left)&&R.push(F.expression);if(v.length+C.length+R.length===1){let F=v[0],P=C[0],U=R[0];if(F!==void 0){let E=I(F.expression);if(E!==void 0){let T=N(`${e}#<default>`,E);b={id:T,esm:!0},k.set(F.getStart(n,!1),T),$e(r,"2a-default",null)}}else if(P!==void 0&&P.name===void 0&&P.body!==void 0){let E=N(`${e}#<default>`,P);b={id:E,esm:!0},k.set(P.getStart(n,!1),E),$e(r,"2a-default",null)}else if(U!==void 0){let E=I(U.right);if(E!==void 0){let T=N(`${e}#<default>`,E);b={id:T,esm:!1},k.set(U.getStart(n,!1),T),$e(r,"2a-default",null)}else if(m.isObjectLiteralExpression(U.right)){let T=U.right,K=[],J=!0;for(let W of T.properties){if(m.isSpreadAssignment(W)){J=!1;break}let se=W.name,Y=se===void 0?void 0:Xi(se);if(Y===void 0){J=!1;break}K.push(Y)}if(J){let W=new Map;for(let se of K)W.set(se,(W.get(se)??0)+1);for(let se of T.properties){if(!m.isPropertyAssignment(se))continue;let Y=Xi(se.name),V=I(se.initializer);if(Y!==void 0){if(!__(Y)){V!==void 0&&$e(r,"2a-member","charset-refused");continue}if((W.get(Y)??0)!==1){V!==void 0&&$e(r,"2a-member","duplicate-key");continue}if(V!==void 0){let fe=N(`${e}#<cjs>.${Y}`,V);x.set(Y,fe),k.set(se.getStart(n,!1),fe),$e(r,"2a-member",null)}}}}else for(let W of T.properties)m.isPropertyAssignment(W)&&I(W.initializer)!==void 0&&$e(r,"2a-member","spread-or-computed-literal")}}}else{for(let F of v)I(F.expression)!==void 0&&$e(r,"2a-default","duplicate-default-sources");for(let F of C)F.name===void 0&&$e(r,"2a-default","duplicate-default-sources");for(let F of R)if(I(F.right)!==void 0)$e(r,"2a-default","duplicate-default-sources");else if(m.isObjectLiteralExpression(F.right))for(let P of F.right.properties)m.isPropertyAssignment(P)&&I(P.initializer)!==void 0&&$e(r,"2a-member","duplicate-default-sources")}}for(let I of t)i.push({id:I.id,moduleId:e,name:`handler:${I.memberPath}`,kind:m.isArrowFunction(I.node)?"arrow":"function",declRange:ot(e,I.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:I.node.getStart(n,!1),end:I.node.getEnd(),id:I.id});a.sort((I,N)=>I.end-I.start-(N.end-N.start));let w=l!==void 0?`${e}#${l}`:void 0;return{rel:e,sf:n,functions:i,bindings:o,exportedFunctionId:w,exportedNames:d,tainted:c,fnRanges:a,toplevelId:p,classes:f,mintedByPos:_,mintedDefault:b,mintedMembers:x,mintSeedAliases:k}}function q_(e){return m.isIdentifier(e)?"identifier":m.isPropertyAccessExpression(e)?"member":m.isElementAccessExpression(e)?"computed-member":e.kind===m.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function nu(e,n){let t=s=>{if(m.isBinaryExpression(s)&&s.operatorToken.kind>=m.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=m.SyntaxKind.LastAssignment){let r=s.left;m.isPropertyAccessExpression(r)&&m.isIdentifier(r.expression)?n(r.expression.text,r.name.text):m.isElementAccessExpression(r)&&m.isIdentifier(r.expression)&&n(r.expression.text,m.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(m.isCallExpression(s)&&m.isPropertyAccessExpression(s.expression)){let r=s.expression,i=s.arguments[0];m.isIdentifier(r.expression)&&i!==void 0&&m.isIdentifier(i)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(i.text,null)}m.forEachChild(s,t)};t(e)}function H_(e){let n=!1,t=s=>{if(!n){if(m.isVariableDeclaration(s)||m.isParameter(s)){let r=new Set;if(Xs(s.name,r),r.has("require")){n=!0;return}}else if((m.isFunctionDeclaration(s)||m.isClassDeclaration(s))&&s.name!==void 0&&s.name.text==="require"){n=!0;return}m.forEachChild(s,t)}};return t(e),n}function W_(e,n,t,s=new Map,r={}){let i=r.additiveForms===!0,o=r.namelessExports===!0,a=i||o?{}:void 0,d=new Map,l=new Map;for(let E of n.imports)E.resolvedModuleId!==void 0&&l.set(`${E.moduleId}::${E.specifier}`,E.resolvedModuleId);for(let E of e.sourceFiles){let T=e.toRel(E.fileName);T!==null&&d.set(T,U_(T,E,s.get(T)??[],o,a))}let c=new Map;if(i)for(let E of d.values()){let T=new Map;for(let[K,J]of E.bindings)if(J.kind==="import"&&J.form==="whole"&&We(J.specifier)!=="package-root"){let W=l.get(`${E.rel}::${J.specifier}`);W!==void 0&&T.set(K,String(W))}T.size!==0&&nu(E.sf,(K,J)=>{let W=T.get(K);if(W===void 0)return;let se=c.get(W);if(se!=="*"){if(J===null){c.set(W,"*");return}se===void 0?c.set(W,new Set([J])):se.add(J)}})}let p=new Map;for(let E of d.values())E.exportedFunctionId!==void 0&&p.set(E.rel,E.exportedFunctionId);let u=new Map;for(let E of d.values()){if(E.rel.split("/").includes("node_modules"))continue;let T=p_(E.sf);if(T===void 0){o&&E.mintedDefault!==void 0&&u.set(E.rel,E.mintedDefault);continue}let K=E.bindings.get(T.name);K?.kind==="function"&&u.set(E.rel,{id:K.functionId,esm:T.esm})}let f=new Map;for(let E of d.values()){let T;for(let K of E.exportedNames){let J=E.bindings.get(K);J?.kind==="function"&&(T??=new Map,T.set(K,J.functionId))}T!==void 0&&f.set(E.rel,T)}let h=new Map;for(let E of d.values()){if(E.rel.split("/").includes("node_modules"))continue;let T=N_(E.sf,E.tainted,K=>{let J=E.bindings.get(K);return J?.kind==="function"?J.functionId:void 0},o?K=>{let J=Ze(K);return m.isFunctionExpression(J)||m.isArrowFunction(J)?E.mintedByPos.get(J.getStart(E.sf,!1)):void 0}:void 0);T.size>0&&h.set(E.rel,T)}let g=[],y=[],_=[],b=[],x=[],k=[],w=new Map;for(let E of n.imports){let T=w.get(E.moduleId)??[];T.push(E.specifier),w.set(E.moduleId,T)}let I=E=>Pc(w.get(E)??[]),N=new Map,v=new Map,C=new Map,R=new Map;for(let E of d.values())if(!E.rel.split("/").includes("node_modules"))for(let T of E.functions)T.id!==E.toplevelId&&R.set(T.id,{fn:T,sf:E.sf});let F=new Map,P=E=>{let T=F.get(E);if(T===void 0){let K=R.get(E),J=K===void 0?null:Hc(K.sf,K.fn.declRange.start,K.fn.declRange.end);T=J===null?null:zc(J),F.set(E,T)}return T};for(let E of d.values()){k.push(...E.classes);for(let B of E.exportedNames){let q=E.bindings.get(B);if(q?.kind==="function"){let Q=`${E.rel}#export:${B}`;b.push({id:Q,moduleId:E.rel,exportedName:B,kind:"value"}),x.push({exportId:Q,target:{kind:"function",functionId:q.functionId}})}}if(o){if(E.mintedDefault!==void 0){let B=`${E.rel}#export:<default>`;b.push({id:B,moduleId:E.rel,exportedName:"default",kind:"value"}),x.push({exportId:B,target:{kind:"function",functionId:E.mintedDefault.id}})}for(let[B,q]of E.mintedMembers){let Q=`${E.rel}#export:<cjs>.${B}`;b.push({id:Q,moduleId:E.rel,exportedName:B,kind:"value"}),x.push({exportId:Q,target:{kind:"function",functionId:q}})}}let T=new Map;for(let[B,q]of E.bindings){if(q.kind==="function"){T.set(B,q);continue}if(We(q.specifier)==="package-root"){let oe=Pn(q.specifier);typeof q.form=="object"?T.set(B,{kind:"package-export",packageName:oe,exportName:q.form.named}):q.form==="require-default"?T.set(B,{kind:"package-default",packageName:oe}):T.set(B,{kind:"package-surface",packageName:oe})}else{let oe=l.get(`${E.rel}::${q.specifier}`);if(oe!==void 0&&typeof q.form=="object"){let ke=f.get(String(oe))?.get(q.form.named);ke!==void 0&&T.set(B,{kind:"app-named-fn",functionId:ke})}else if(oe!==void 0&&q.form==="require-default"){let ke=u.get(String(oe));ke!==void 0&&ke.esm&&T.set(B,{kind:"app-default-fn",functionId:ke.id})}else oe!==void 0&&typeof q.form!="object"&&q.form!=="require-default"&&T.set(B,{kind:"module",resolvedModuleId:oe})}}let K=new Map;for(let B of E.functions){if(B.enclosingClassId===void 0||B.name===void 0)continue;let q=K.get(B.enclosingClassId);q===void 0&&(q=new Map,K.set(B.enclosingClassId,q)),q.set(B.name,B.id)}for(let B of E.classes)B.name===void 0||E.tainted.has(B.name)||T.has(B.name)||T.set(B.name,{kind:"app-class",cls:{classId:B.id,className:B.name,memberIds:K.get(B.id)??new Map}});let J=B=>{if(m.isVariableDeclaration(B)&&m.isIdentifier(B.name)&&B.initializer!==void 0&&m.isNewExpression(B.initializer)&&!E.tainted.has(B.name.text)&&!T.has(B.name.text)){let q=Xc(B.initializer,T,E.tainted);q!==null&&T.set(B.name.text,q)}m.forEachChild(B,J)};J(E.sf);let W=B=>{for(let q of E.fnRanges)if(B>=q.start&&B<q.end)return q.id;return E.toplevelId},se=new Map,Y=new Map,V=new Map,fe=(B,q,Q)=>{if(Q===null){B.set(q,"*");return}let oe=B.get(q);oe!=="*"&&(oe===void 0?B.set(q,new Set([Q])):oe.add(Q))},S=(B,q)=>{fe(se,B,q);let Q=T.get(B);Q?.kind==="package-surface"?fe(Y,Q.packageName,q):Q?.kind==="module"&&fe(V,String(Q.resolvedModuleId),q)};nu(E.sf,S);let A=new Map,j=256,ne=B=>{let q=A.get(B);return q===void 0&&(q=A.size>=j?new Set([B]):fu(E.sf,new Set([B])),A.set(B,q)),q},X=(B,q)=>B==="*"||B!==void 0&&B.has(q),D=(B,q)=>{let Q=T.get(B);if(Q?.kind==="package-surface"&&X(Y.get(Q.packageName),q)||Q?.kind==="module"&&X(V.get(String(Q.resolvedModuleId)),q))return!0;for(let oe of ne(B))if(X(se.get(oe),q))return!0;return!1},$=B=>{if(m.isIdentifier(B)){let q=E.tainted.has(B.text)?void 0:T.get(B.text);return q?.kind==="function"?q.functionId:q?.kind==="module"?p.get(String(q.resolvedModuleId))??null:q?.kind==="package-export"?t.exportFor(q.packageName,q.exportName):null}if(m.isPropertyAccessExpression(B)&&m.isIdentifier(B.expression)){let q=B.expression.text;if(D(q,B.name.text))return null;let Q=E.tainted.has(q)?void 0:T.get(q);return Q?.kind==="package-surface"?t.exportFor(Q.packageName,B.name.text):Q?.kind==="package-export"?t.methodFor(Q.packageName,Q.exportName,B.name.text,"method"):Q?.kind==="package-instance"?t.methodFor(Q.packageName,Q.className,B.name.text,"method"):null}return null},L=B=>{for(let q=B.parent;q!==void 0;q=q.parent)if(!m.isArrowFunction(q)){if(m.isFunctionExpression(q)||m.isFunctionDeclaration(q))return null;if(m.isMethodDeclaration(q)||m.isConstructorDeclaration(q)||m.isGetAccessorDeclaration(q)||m.isSetAccessorDeclaration(q)){let Q=q.parent;if(!m.isClassLike(Q)||Q.name===void 0)return null;let oe=E.tainted.has(Q.name.text)?void 0:T.get(Q.name.text);return oe?.kind==="app-class"?oe.cls:null}}return null},H=i&&!E.tainted.has("require")&&!H_(E.sf),z=B=>{if(m.isIdentifier(B)){let oe=E.tainted.has(B.text)?void 0:T.get(B.text);return oe?.kind==="package-surface"||oe?.kind==="package-default"?t.exportFor(oe.packageName,"default"):oe?.kind==="app-named-fn"||oe?.kind==="app-default-fn"?oe.functionId:oe?.kind==="module"?u.get(String(oe.resolvedModuleId))?.id??null:oe?.kind==="member-value"?oe.functionId:null}if(!m.isPropertyAccessExpression(B))return null;let q=B.expression;if(i&&m.isCallExpression(Ze(q))){let oe=it(Ze(q));if(oe!==void 0)if(!H)$e(a,"2b","require-shadow");else if(We(oe)==="package-root")$e(a,"2b","package-root");else{let ke=l.get(`${E.rel}::${oe}`);if(ke===void 0)$e(a,"2b","unresolved-module");else{let Re=B.name.text,En=c.get(String(ke));if(En==="*"||En!==void 0&&En.has(Re))$e(a,"2b","module-mutation-gate");else{let Nn=h.get(String(ke))?.get(Re);if(Nn!==void 0)return $e(a,"2b",null),Nn;if(Re==="default"){let An=u.get(String(ke));if(An!==void 0&&An.esm)return $e(a,"2b",null),An.id;$e(a,"2b","non-esm-default")}else $e(a,"2b","unknown-member")}}}return null}let Q;if(m.isIdentifier(q)){let oe=E.tainted.has(q.text)?void 0:T.get(q.text);if(oe?.kind==="app-class"||oe?.kind==="app-instance")Q=oe.cls.memberIds;else if(oe?.kind==="object-literal")Q=oe.obj.members;else if(oe?.kind==="module"){let ke=h.get(String(oe.resolvedModuleId));ke?.has(B.name.text)===!0&&!D(q.text,B.name.text)&&(Q=ke)}}else if(m.isNewExpression(q)){let oe=Xc(q,T,E.tainted);oe?.kind==="app-instance"&&(Q=oe.cls.memberIds)}else q.kind===m.SyntaxKind.ThisKeyword&&(Q=L(B)?.memberIds);return Q?.get(B.name.text)??null},Z=new Map,ie=B=>{if(m.isVariableDeclaration(B)&&m.isIdentifier(B.name)&&B.initializer!==void 0&&m.isObjectLiteralExpression(B.initializer)&&!E.tainted.has(B.name.text)&&!T.has(B.name.text)&&!Z.has(B.name.text)){let q=new Map;for(let Q of B.initializer.properties)if(m.isPropertyAssignment(Q)&&m.isIdentifier(Q.name)){let oe=$(Q.initializer);oe!==null&&q.set(Q.name.text,oe)}Z.set(B.name.text,q)}m.forEachChild(B,ie)};ie(E.sf);let ae=B=>{if(m.isBinaryExpression(B)&&B.operatorToken.kind===m.SyntaxKind.EqualsToken&&m.isPropertyAccessExpression(B.left)&&m.isIdentifier(B.left.expression)&&!E.tainted.has(B.left.expression.text)){let q=Z.get(B.left.expression.text);if(q!==void 0){let Q=$(B.right);Q!==null&&q.set(B.left.name.text,Q)}}m.forEachChild(B,ae)};ae(E.sf);for(let[B,q]of Z)T.set(B,{kind:"object-literal",obj:{members:q}});let pe=(B,q=0)=>{if(q>Gc)return null;let Q=Ze(B);if(m.isCallExpression(Q)&&m.isPropertyAccessExpression(Q.expression)&&Q.expression.name.text==="bind")return pe(Q.expression.expression,q+1);if(m.isIdentifier(Q)){let oe=$(Q);if(oe!==null)return oe;let ke=E.tainted.has(Q.text)?void 0:T.get(Q.text);return ke?.kind==="member-value"?ke.functionId:null}return m.isPropertyAccessExpression(Q)?$(Q)??z(Q):null},he=(B,q=0)=>{if(q>Gc)return"depth-cap";let Q=Ze(B);if(m.isCallExpression(Q)&&m.isPropertyAccessExpression(Q.expression)&&Q.expression.name.text==="bind")return he(Q.expression.expression,q+1);if(m.isIdentifier(Q))return E.tainted.has(Q.text)?"tainted-receiver":"unresolved-receiver";if(m.isPropertyAccessExpression(Q)&&m.isIdentifier(Q.expression)){if(E.tainted.has(Q.expression.text))return"tainted-receiver";if(D(Q.expression.text,Q.name.text))return"mutated-member"}return"unresolved-receiver"},we=B=>{if(m.isVariableDeclaration(B)&&m.isIdentifier(B.name)&&B.initializer!==void 0){let q=Ze(B.initializer),Q=m.isPropertyAccessExpression(q),oe=m.isCallExpression(q)&&m.isPropertyAccessExpression(q.expression)&&q.expression.name.text==="bind";if(Q||oe){let ke=Q?"D1":"A2";if(E.tainted.has(B.name.text))$e(a,ke,"tainted-alias");else if(T.has(B.name.text))$e(a,ke,"already-bound");else{let Re=pe(q);Re!==null?(T.set(B.name.text,{kind:"member-value",functionId:Re}),$e(a,ke,null)):$e(a,ke,he(q))}}}m.forEachChild(B,we)};i&&we(E.sf);let Ne=I(E.rel),Ie=new Map,Fe=new Map,Le=B=>{let q=Ze(B);if(!m.isIdentifier(q))return null;let Q=E.tainted.has(q.text)?void 0:T.get(q.text),oe=Q?.kind==="package-surface"||Q?.kind==="package-export"&&Q.exportName==="default"?Q.packageName:null;return oe===null?null:Kc(oe)?.shape??null},Je=(B,q)=>{let Q=new Set((q.arity??[]).map(Re=>nr(q.model,Re))),[oe]=[...Q];if(Q.size!==1||oe===void 0||oe>=q.passes)return;let ke={model:q.model,index:oe,registeredAt:q.registeredAt};if(m.isArrowFunction(B)||m.isFunctionExpression(B))Fe.has(B)||Fe.set(B,ke);else if(m.isIdentifier(B)||m.isPropertyAccessExpression(B)){let Re=$(B)??z(B);Re!==null&&!N.has(Re)&&(N.set(Re,q.model),v.set(Re,q.registeredAt),C.set(Re,oe))}},Ae=(B,q,Q)=>{let oe=Ie.get(B);if(oe===void 0)return;let ke=Le(q)??(Q===null?null:P(Q));if(ke===null||B.questionDotToken!==void 0||B.arguments.some(m.isSpreadElement))return;let Re=B.arguments[ke.param];if(Re===void 0)return;let En={...oe,depth:oe.depth+1,arity:oe.arity??ke.arity,passes:Math.min(oe.passes,ke.passes)},Nn=Ze(Re);m.isCallExpression(Nn)?En.depth<Bc&&Ie.set(Nn,En):Je(Nn,En)},tn=0,Ms=B=>{let q,Q;if(m.isCallExpression(B)){let oe=B.expression,ke=m.isIdentifier(oe)&&oe.text==="require",Re=oe.kind===m.SyntaxKind.ImportKeyword;!ke&&!Re&&(q=oe,Q=B.arguments)}else m.isTaggedTemplateExpression(B)&&(q=B.tag);if(q!==void 0){let oe=q_(q),ke=B.getStart(E.sf,!1),Re=`${E.rel}#call${String(tn)}`;tn+=1;let En="unresolved",Nn=[],An=$(q);if(An!==null&&(En="resolved",Nn.push(An)),y.push({id:Re,enclosingFunctionId:W(ke),calleeExprShape:oe,resolvedTargetIds:Nn,resolution:En,range:ot(E.rel,B,E.sf),...Wi(B,q,E.rel,E.sf,{program:e.program,checker:e.checker})}),m.isCallExpression(B)){let ue=Qr(B,Ne);for(let ye of ue?.handlers??[]){if(ue===null||!(m.isIdentifier(ye)||m.isPropertyAccessExpression(ye)))continue;let be=$(ye)??z(ye);be!==null&&!N.has(be)&&(N.set(be,ue.model),v.set(be,ot(E.rel,B,E.sf)))}for(let ye of ue?.forwarded??[])ue!==null&&Ie.set(ye,{model:ue.model,registeredAt:ot(E.rel,B,E.sf),depth:0,arity:null,passes:Number.POSITIVE_INFINITY})}for(let ue of Nn)_.push({callSiteId:Re,calleeFunctionId:ue,resolution:En,invocation:"direct"});let G=An===null?z(q):null;if(An===null){if(G!==null)_.push({callSiteId:Re,calleeFunctionId:G,resolution:"field-based",invocation:"direct"});else if(i&&m.isPropertyAccessExpression(q)&&(q.name.text==="call"||q.name.text==="apply")){let ue=pe(q.expression);ue!==null?(_.push({callSiteId:Re,calleeFunctionId:ue,resolution:"field-based"}),$e(a,"A3",null)):$e(a,"A3",he(q.expression))}}m.isCallExpression(B)&&Ae(B,q,An??G);for(let ue of Q??[]){let ye=$(ue);if(ye!==null)_.push({callSiteId:Re,calleeFunctionId:ye,resolution:"field-based",invocation:"callback"});else{let be=z(ue);if(be!==null)_.push({callSiteId:Re,calleeFunctionId:be,resolution:"field-based",invocation:"callback"});else if(i){let Ke=pe(ue),Pe=Ze(ue),Dn=Pe!==ue||m.isCallExpression(Pe)&&m.isPropertyAccessExpression(Pe.expression)&&Pe.expression.name.text==="bind";Ke!==null?(_.push({callSiteId:Re,calleeFunctionId:Ke,resolution:"field-based"}),Dn&&$e(a,"A2p",null)):Dn&&$e(a,"A2p",he(ue))}}}}m.forEachChild(B,Ms)};Ms(E.sf),g.push(...Hi(E.functions,E.sf,E.rel,Ne,{program:e.program,checker:e.checker},Fe));for(let B of n.computedLoads.get(E.rel)??[]){let q=B.candidateRels.filter(oe=>d.has(oe)).map(oe=>`${oe}#<toplevel>`);if(q.length===0)continue;let Q=`${E.rel}#dirload${String(tn)}`;tn+=1,y.push({id:Q,enclosingFunctionId:W(B.pos),calleeExprShape:"require",resolvedTargetIds:q,resolution:"field-based",range:{path:E.rel,start:B.pos,end:B.pos}});for(let oe of q)_.push({callSiteId:Q,calleeFunctionId:oe,resolution:"field-based"})}let Ts=0;for(let B of s.get(E.rel)??[]){let q=`${E.rel}#handlerseed${String(Ts)}`;Ts+=1;let Q=B.node.getStart(E.sf,!1);y.push({id:q,enclosingFunctionId:E.toplevelId,calleeExprShape:"member",resolvedTargetIds:[B.id],resolution:"field-based",range:{path:E.rel,start:Q,end:Q}}),_.push({callSiteId:q,calleeFunctionId:B.id,resolution:"field-based"})}}let U=new Map;if(o)for(let E of d.values())for(let[T,K]of E.mintSeedAliases)U.set(`${E.rel}::${String(T)}`,K);return{functions:g.map(E=>{let T=N.get(E.id);if(T===void 0||E.sourceParams!==void 0)return E;let K=v.get(E.id);return{...E,sourceParams:[{index:C.get(E.id)??nr(T,E.params?.length??0),sourceClass:T.sourceClass,model:T.id,...K!==void 0?{registeredAt:K}:{}}]}}),callSites:y,callEdges:_,exports:b,exportBindings:x,classes:k,mintSeedAliases:U,bindingApplicability:a}}function G_(e,n,t){let s=d=>d.length===0||kn.isAbsolute(d)||d.includes("\\")||/^[a-zA-Z]:/u.test(d)||d.split("/").some(l=>l===".."||l==="");if(s(n)||s(t))return null;let r=e.endsWith(kn.sep)?e:e+kn.sep,i;try{i=Wc(kn.resolve(e,n))}catch{return null}if(!i.startsWith(r))return null;let o=i.endsWith(kn.sep)?i:i+kn.sep,a;try{a=Wc(kn.resolve(i,t))}catch{return null}return a.startsWith(o)?a:null}function gu(e,n,t){let s=`${e}#class:${t}`,r=[],i=[],o=[],a=new Set;return{pushMember(d,l,c,p){if(d==="__proto__"||a.has(d))return;a.add(d);let u=`${e}#${t}.${d}`;r.push({id:u,moduleId:e,name:d,kind:c,enclosingClassId:s,declRange:ot(e,l,n),isExported:!1,publicSurfaceReachable:!1}),o.push(u),i.push({name:d,id:u,kind:c,body:p})},finish(){return i.length===0?null:{functions:r,classNode:{id:s,moduleId:e,name:t,implementsRefs:[],members:o},members:i}}}}function V_(e,n,t,s){if(hu(s)||s.members.length>Yi)return null;let r=gu(e,n,t);for(let i of s.members){let o,a,d;if(m.isConstructorDeclaration(i))o="constructor",a="ctor",d=void 0;else if(m.isMethodDeclaration(i))o=oo(i.name),a="method",d=o!==void 0&&!_s.has(o)?i.body??void 0:void 0;else continue;o!==void 0&&r.pushMember(o,i,a,d)}return r.finish()}function X_(e,n,t){let s;for(let o of n.statements)if(m.isFunctionDeclaration(o)&&o.name?.text===t){s=o;break}if(s===void 0)return null;let r=[];for(let o of n.statements){if(!m.isExpressionStatement(o))continue;let a=o.expression;if(!m.isBinaryExpression(a)||a.operatorToken.kind!==m.SyntaxKind.EqualsToken)continue;let d=a.left;if(m.isPropertyAccessExpression(d)&&m.isPropertyAccessExpression(d.expression)&&m.isIdentifier(d.expression.expression)&&d.expression.expression.text===t&&d.expression.name.text==="prototype"){let l=d.name.text;m.isFunctionExpression(a.right)?r.push({name:l,fn:a.right,walk:!0}):m.isArrowFunction(a.right)&&r.push({name:l,fn:a.right,walk:!1})}}if(r.length===0||r.length+1>Yi)return null;let i=gu(e,n,t);i.pushMember("constructor",s,"ctor",void 0);for(let o of r){let a=o.walk&&!_s.has(o.name)&&m.isFunctionExpression(o.fn)?o.fn.body:void 0;i.pushMember(o.name,o.fn,"method",a)}return i.finish()}function Y_(e,n,t){for(let s of n.statements)if(m.isClassDeclaration(s)&&s.name?.text===t)return V_(e,n,t,s);return X_(e,n,t)}function J_(e,n,t,s,r){let i={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return i;let o=new Set(t.map(p=>p.packageName)),a=new Set(t.map(p=>p.path)),d=new Set,l=new Set,c=0;for(let p of n){if(!o.has(p.packageName))continue;let u=G_(e.appRoot,p.packageRootRel,p.sourcePath);if(u===null)continue;let f=e.toRel(u);if(f===null)continue;let h=`${f}#${p.container}`;if(l.has(h)||!d.has(f)&&d.size>=so)continue;let g=on(u);if(g===null)continue;let y;try{y=m.createSourceFile(f,g,m.ScriptTarget.Latest,!0,m.ScriptKind.JS)}catch{continue}let _=Y_(f,y,p.container);if(_===null)continue;d.add(f),l.add(h);let b=new Map,x=new Map;for(let w of _.members){let I=r.methodFor(p.packageName,p.container,w.name,w.kind);b.set(w.name,I),x.set(I,w.id)}let k=0;for(let w of _.members){if(w.body===void 0)continue;let I=(N,v)=>{if(v&&m.isCallExpression(N)&&m.isPropertyAccessExpression(N.expression)&&N.expression.expression.kind===m.SyntaxKind.ThisKeyword){let F=b.get(N.expression.name.text);if(F!==void 0){let P=`${f}#depclass:${p.container}.${w.name}#c${String(k)}`;k+=1,i.callSites.push({id:P,enclosingFunctionId:w.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:ot(f,N,y)}),i.callEdges.push({callSiteId:P,calleeFunctionId:F,resolution:"field-based"})}}let C=m.isFunctionExpression(N)||m.isFunctionDeclaration(N)||m.isMethodDeclaration(N)||m.isConstructorDeclaration(N)||m.isGetAccessorDeclaration(N)||m.isSetAccessorDeclaration(N)||m.isClassLike(N),R=m.isArrowFunction(N)?v:C?!1:v;m.forEachChild(N,F=>{I(F,R)})};I(w.body,!0)}for(let w of s){let I=x.get(w.calleeFunctionId);I!==void 0&&i.callEdges.push({callSiteId:w.callSiteId,calleeFunctionId:I,resolution:"field-based"})}if(i.functions.push(..._.functions),i.classes.push(_.classNode),!a.has(f)){a.add(f),i.modules.push({id:f,packageName:p.packageName,versionRange:"",path:f,moduleSystem:"cjs",isEntrypoint:!1});let w=r.moduleFor(p.packageName),I=`${String(w)}#depclass${String(c)}`;c+=1,i.imports.push({id:I,moduleId:w,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),i.importEdges.push({importId:I,resolvedModuleId:f})}i.diagnostics.push({code:"dep-class-corridor",path:f,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(_.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return i}function Z_(e,n,t,s){let r=new Set(e.modules.filter(d=>d.isEntrypoint).map(d=>d.packageName)),i=new Map(e.functions.map(d=>[d.id,d.moduleId])),o=new Map;for(let d of e.callSites){if(d.resolution!=="unresolved")continue;let l=i.get(d.enclosingFunctionId);l!==void 0&&o.set(l,(o.get(l)??0)+1)}let a=[];for(let d of e.modules){if(d.externalSurface===!0)continue;let l=n.get(d.path);if(l===void 0||t.has(d.path)||r.has(d.packageName)&&s.has(d.path)&&!d.path.split("/").includes("node_modules"))continue;let c=o.get(d.id)??0;if(c===0&&M_(l))continue;let p=c>0?`${String(c)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:d.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:d.id})}return a}function yu(e,n,t=[],s={},r=!1){let i=new Gi,o=l_(e,n,i),a=new Set;for(let k of o.computedLoads.values())for(let w of k)if(w.seedable)for(let I of w.candidateRels)a.add(I);let d=new Map;for(let k of e.sourceFiles){let w=e.toRel(k.fileName);if(w===null||!a.has(w)||w.split("/").includes("node_modules"))continue;let I=K_(w,k);I.length>0&&d.set(w,I)}let l=d.size===0?o.modules:o.modules.map(k=>d.has(k.path)&&!k.isEntrypoint?{...k,isEntrypoint:!0}:k),c={...o,modules:l},p=W_(e,c,i,d,s),u=P_(e,o,p.functions,p.mintSeedAliases),f=new Set(o.modules.map(k=>k.path)),h=u_(e.depReach,i,f),g=[...c.modules,...h.modules,...i.modules()],y=J_(e,t,g,p.callEdges,i),_=[];if(r){let k="#default",w=new Set;for(let N of p.callEdges){let v=String(N.calleeFunctionId);!v.startsWith("pkg:")||!v.endsWith(k)||w.add(v.slice(4,v.length-k.length))}let I=new Map;for(let N of e.depReach.edges){if(!("surface"in N.from)||"surface"in N.to)continue;let v=N.from.surface;I.set(v,I.has(v)?null:N.to.module)}for(let N of w){let v=I.get(N);if(v==null)continue;let C=d_(kn.join(e.appRoot,v));if(C===null||C==="default")continue;let R=i.exportFor(N,C),F=`pkg:${N}${k}`;for(let P of p.callEdges)String(P.calleeFunctionId)===F&&_.push({callSiteId:P.callSiteId,calleeFunctionId:R,resolution:"field-based"})}}let b={modules:[...c.modules,...h.modules,...y.modules,...i.modules()],exports:[...p.exports,...u.exports],imports:[...o.imports,...h.imports,...y.imports],functions:[...p.functions,...i.functions(),...y.functions],callSites:[...p.callSites,...y.callSites],classes:[...p.classes,...i.classes(),...y.classes],callEdges:[...p.callEdges,...y.callEdges,..._],importEdges:[...o.importEdges,...h.importEdges,...y.importEdges],exportBindings:[...p.exportBindings,...u.exportBindings],inheritEdges:[]},x=new Map;for(let k of e.sourceFiles){let w=e.toRel(k.fileName);w!==null&&x.set(w,k)}return{graph:b,diagnostics:[...u.diagnostics,...y.diagnostics,...Z_(b,x,new Set(e.diagnostics.filter(k=>k.code==="dependency-body").map(k=>k.path)),o.appOwnedPaths)],loadSites:o.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var Q_=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,io=/^[A-Za-z0-9_$.-]{1,128}$/u;function ex(e){return Q_.test(e.calleePackage)?io.test(e.anchorExport)?io.test(e.calleeExport)?e.anchorContainer!==null&&!io.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!io.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function sr(e,n){let t=[],s=[],r=new Map(e.modules.map(l=>[l.id,l])),i=new Map(e.classes.map(l=>[l.id,l.name])),o=(l,c,p)=>e.functions.some(u=>{if(u.name!==c)return!1;let f=r.get(u.moduleId);return f===void 0||f.packageName!==l?!1:(u.enclosingClassId!==void 0?i.get(u.enclosingClassId)??null:null)===p}),a=(l,c,p)=>{for(let u of e.functions){if(u.name!==c)continue;let f=r.get(u.moduleId);if(!(f===void 0||f.packageName!==l||(u.enclosingClassId!==void 0?i.get(u.enclosingClassId)??null:null)!==p))return u.id}return null},d=[...n].sort((l,c)=>l.modelId<c.modelId?-1:l.modelId>c.modelId?1:0);for(let l of d){if(l.edges.length>64){t.push(`model ${l.modelId}: ${String(l.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let c=l.edges.map(ex).find(f=>f!==null);if(c!==void 0){t.push(`model ${l.modelId}: hostile/invalid edge field ${c} \u2014 model refused WHOLE`);continue}let p=0,u=0;for(let f of l.edges){if(!o(l.packageName,f.anchorExport,f.anchorContainer)){u+=1;continue}s.push({modelId:l.modelId,kind:f.kind,anchor:{packageName:l.packageName,exportName:f.anchorExport,container:f.anchorContainer},callee:{packageName:f.calleePackage,exportName:f.calleeExport,container:f.calleeContainer,realFunctionId:a(f.calleePackage,f.calleeExport,f.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${l.modelId}: ${String(p)} edge(s) lowered, ${String(u)} reference-gated`):t.push(`model ${l.modelId}: refused \u2014 no anchor surface in the graph (${String(u)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:s,notes:t}}}var nx={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function ra(e){try{let n=bc(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(a=>a.split(Tn.sep).join("/"))),{graph:s,diagnostics:r,loadSites:i,bindingApplicability:o}=yu(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:s,diagnostics:[...n.diagnostics,...r],loadSites:i,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...o!==void 0?{bindingApplicability:o}:{}}}catch(n){return{graph:nx,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function _u(e,n){let t=512,s=(r,i,o)=>{if(!(t<=0||i>12)){if(t-=1,typeof r=="string"){n(r,o);return}if(Array.isArray(r)){for(let a of r)s(a,i+1,o);return}if(r!==null&&typeof r=="object")for(let[a,d]of Object.entries(r))a==="types"||a==="typings"||s(d,i+1,o||a.includes("*"))}};s(e,0,!1)}function Su(e,n,t,s=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=bt(Tn.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||s&&!rt(r)?null:r===e?"":r.slice(n.length).split(Tn.sep).join("/")}var tx=1024*1024,sx=4096;function xu(e,n){let t=e.toLowerCase(),s=0;for(;;){let r=t.indexOf(n,s);if(r===-1)return null;let i=r===0?" ":t[r-1],o=r+n.length;for(;o<e.length&&(e[o]===" "||e[o]==="	"||e[o]===`
-`||e[o]==="\r");)o+=1;if(/[a-z0-9_:-]/i.test(i??" ")||e[o]!=="="){s=r+n.length;continue}for(o+=1;o<e.length&&(e[o]===" "||e[o]==="	"||e[o]===`
-`||e[o]==="\r");)o+=1;let a=e[o];if(a==='"'||a==="'"){let l=e.indexOf(a,o+1);return l===-1?null:e.slice(o+1,l)}let d=o;for(;d<e.length&&!/[\s>]/.test(e[d]??"");)d+=1;return e.slice(o,d)}}function rx(e){let n=[],t=e.toLowerCase(),s=0;for(;;){let r=t.indexOf("<script",s);if(r===-1)break;let i=t[r+7];if(i!==void 0&&/[a-z0-9-]/.test(i)){s=r+7;continue}let o=e.indexOf(">",r);if(o===-1)break;s=o+1;let a=e.slice(r+7,o);if(a.length>sx)continue;let d=xu(a,"type");n.push({module:(d??"").trim().toLowerCase()==="module",src:xu(a,"src")})}return n}function ox(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function ix(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function ax(e){let n=bt(e),t=n.endsWith(Tn.sep)?n:n+Tn.sep,s=new Set,r=[],i=[],o=[],a=[],d=[],l=!1,c=(E,T,K=!1,J)=>{let W=Su(n,t,E);return W===null||W.length===0?"unresolved":s.has(W)?"duplicate":(s.add(W),r.push(W),i.push({source:T,specifier:Mn(J??(typeof E=="string"?E:"")),entrypoint:W,launch:K}),"added")},p=new Set,u=(E,T,K=!1)=>{let J=c(E,T),W=typeof E=="string"&&E.includes("\\")?c(E.split("\\").join("/"),T,!1,E):"unresolved";if(J!=="unresolved"||W!=="unresolved"||typeof E!="string"||E.trim().length===0||E.endsWith(".d.ts")||E.endsWith(".d.mts")||E.endsWith(".d.cts"))return;if(K&&E.includes("*")){let Y=kc(n,E),V=!1;if(Y!==null){for(let fe of Y.matches)c(fe,T,!1,E)!=="unresolved"&&(V=!0);if(!Y.truncated&&V)return}a.push({source:T,file:"package.json",detail:`\`${Mn(E)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let se=`${T}\0${E}`;p.has(se)||(p.add(se),a.push({source:T,file:"package.json",detail:`\`${Mn(E)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},f=[],h=(E,T)=>{o.push({source:E,file:E,detail:T.detail}),f.push({code:T.code,path:E,detail:`${E} ${T.detail}`})},g,y,_,b=null,x=ao(n,t,"package.json",Pt);x.kind==="refused"&&h("package.json",x);try{let E=x.kind==="ok"?JSON.parse(x.text):{};if(b=x.kind==="ok"?E:null,u(E.main,"main"),typeof E.bin=="string")u(E.bin,"bin");else if(E.bin!==null&&typeof E.bin=="object")for(let K of Object.values(E.bin))u(K,"bin");_u(E.exports,(K,J)=>{u(K,"exports",J)}),typeof E.browser=="string"?u(E.browser,"browser"):_u(E.browser,K=>{c(K,"browser")});let T=E.scripts;if(T!==null&&typeof T=="object"){let K=T;g=K.start,y=K.prestart,_=K.poststart}}catch{}if(r.length===0)try{bt(Tn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let k=(E,T)=>{if(typeof E=="string"&&E.trim().length>0){let K=ta(E,T,"package.json",c,o,!1)==="used";return K&&(l=!0),K?"resolved":"gapped"}return E===void 0||typeof E=="string"?"absent":(o.push({source:T,file:"package.json",detail:`${T} is not a string; no entry file could be read from it`}),"gapped")},w=k(g,"scripts.start"),I=k(y,"scripts.prestart"),N=k(_,"scripts.poststart"),v=w==="resolved"&&I!=="gapped"&&N!=="gapped",C=ao(n,t,"Procfile",65536);if(C.kind==="refused")h("Procfile",C);else if(C.kind==="ok"){let{entries:E,truncated:T,unnamedLines:K}=ji(C.text);T&&o.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),K>0&&o.push({source:"Procfile",file:"Procfile",detail:`${String(K)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let J of E)ta(J.command,`Procfile:${J.name}`,"Procfile",c,o,v)==="used"&&(l=!0)}for(let E of["Dockerfile","docker-compose.yml","docker-compose.yaml","compose.yml"]){let T=ao(n,t,E,Di);if(T.kind==="refused"){h(E,T);continue}if(T.kind!=="ok")continue;let{commands:K,truncated:J}=Fi(T.text);J&&o.push({source:E,file:E,detail:`${E} declares more launch commands than cupel parses; the remainder was not read`});for(let W of K)ta(W.command,`${E}:${W.label}`,E,c,o,v)==="used"&&(l=!0)}let R=r.length===0,F=ao(n,t,"index.html",tx);if(F.kind==="ok")for(let E of rx(F.text)){if(E.src===null)continue;let T=Mn(E.src);if(!E.module){d.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${T}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(ox(E.src)){d.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${T}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}c(ix(E.src),"index.html",!1,E.src)==="unresolved"&&o.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${T}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else F.kind==="refused"&&d.push({kind:F.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${F.detail}`,root:""});let P=R?Ci(n,b):null;if(P!==null){let E=0;for(let T of Ti(n,P).roots)c(T,`framework:${P.name}`)==="added"&&(E+=1);E>0&&f.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${P.name}'s directory conventions (recognised via ${P.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let U=E=>E.map(T=>({...T,root:""}));return{entrypoints:r,sources:U(i),gaps:U(o),surfaceGaps:U(a),launchResolved:l,diagnostics:f,framework:P,observations:d}}function ao(e,n,t,s){let r;try{r=bt(Tn.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let i=ms(r,s);return i.kind==="ok"?i:i.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(i.bytes)} bytes, over the ${String(s)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function ta(e,n,t,s,r,i){let o=Li(e);if(o.kind==="delegates")return i?"used":(r.push({source:n,file:t,detail:`\`${Mn(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(o.kind==="foreign")return"foreign";if(o.kind==="unparsed")return r.push({source:n,file:t,detail:`\`${Mn(e)}\`: ${o.reason}`}),"gapped";let a=s(o.specifier,n,!0),d=o.alt===void 0?"unresolved":s(o.alt,n,!0);return a==="unresolved"&&d==="unresolved"?(r.push({source:n,file:t,detail:`\`${Mn(o.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function bs(e,n){return e===""?n:`${e}/${n}`}function ku(e,n){let t=bt(e),s=t.endsWith(Tn.sep)?t:t+Tn.sep,r=new Set,i=[],o=[],a=[],d=[],l=[],c=[],p=!1,u=null,f=[...n].sort((h,g)=>h.rel===""?-1:g.rel===""?1:h.rel<g.rel?-1:h.rel>g.rel?1:0);for(let h of f){let g=bs(h.rel,"package.json"),y=h.rel===""?".":h.rel,_;try{_=bt(h.abs)}catch{a.push({source:"root",file:g,detail:`root \`${y}\` could not be resolved; not seeded`,root:h.rel});continue}if(_!==t&&!_.startsWith(s)){a.push({source:"root",file:g,detail:`root \`${y}\` resolves outside the scan root; refused, not seeded`,root:h.rel});continue}let b;try{b=ax(_)}catch{a.push({source:"root",file:g,detail:`root \`${y}\` could not be read; not seeded`,root:h.rel});continue}for(let x of b.sources){let k=bs(h.rel,x.entrypoint),w,I;try{w=bt(Tn.resolve(t,k)),I=bt(Tn.resolve(_,x.entrypoint))}catch{a.push({source:x.source,file:g,detail:`\`${x.specifier}\` re-based to \`${k}\` did not resolve; not seeded`,root:h.rel});continue}if(!w.startsWith(s)||w!==I){a.push({source:x.source,file:g,detail:`\`${x.specifier}\` re-based to \`${k}\` escapes the scan root or names another file; refused, not seeded`,root:h.rel});continue}r.has(k)||(r.add(k),i.push(k),o.push({...x,entrypoint:k,root:h.rel}))}b.launchResolved&&(p=!0);for(let x of b.gaps)a.push({...x,file:bs(h.rel,x.file),root:h.rel});for(let x of b.surfaceGaps)d.push({...x,file:bs(h.rel,x.file),root:h.rel});for(let x of b.diagnostics)l.push({...x,path:bs(h.rel,x.path)});for(let x of b.observations)c.push({...x,file:bs(h.rel,x.file),root:h.rel});h.rel===""&&(u=b.framework)}return{entrypoints:i,sources:o,gaps:a,surfaceGaps:d,launchResolved:p,diagnostics:l,framework:u,observations:c}}function oa(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let s=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${s}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function ia(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let s=[...new Set(t.slice(0,3).map(r=>r.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${s}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function wu(e,n){let t=bt(e),s=t.endsWith(Tn.sep)?t:t+Tn.sep,r=new Set,i=[],o=[];for(let a of n){let d=Su(t,s,a,!0);if(d===null||d.length===0){o.push(a);continue}r.has(d)||(r.add(d),i.push(d))}return{entrypoints:i,rejected:o}}import{readdirSync as af,readFileSync as Na,realpathSync as Aa,statSync as pr}from"node:fs";import Jn from"node:path";function lx(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let s=t+2;for(;s<e.length&&e.charCodeAt(s)===32;)s+=1;let r=e.charCodeAt(s);return r===38||r===42}function Vn(e,n,t){let s=n.maxLines??2e6,r=n.maxLineBytes??16384,i=!1,o=!1,a=0,d=0,l=e.charCodeAt(0)===65279?1:0;for(;l<=e.length;){let c=e.indexOf(`
-`,l),p=c===-1;p&&(c=e.length);let u=c>l&&e.charCodeAt(c-1)===13?c-1:c;if(d+=1,d>s){i=!0;break}if(u-l>r)a+=1;else{let f=l;for(;f<u&&e.charCodeAt(f)===32;)f+=1;let h=f-l,g=u;for(;g>f&&(e.charCodeAt(g-1)===32||e.charCodeAt(g-1)===9);)g-=1;if(f<g&&e.charCodeAt(f)!==35){let y=e.slice(f,g);if(lx(y)){o=!0;break}t(h,y)}}if(p)break;l=c+1}return{truncated:i||a>0,refusedAnchors:o,oversizeLines:a}}function at(e){let n=e.charCodeAt(0);if(n===34||n===39){let s=e.indexOf(String.fromCharCode(n),1);if(s===-1)return null;let r=s+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,s+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function jn(e){return e.endsWith(":")}function Me(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function lo(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,s=t.indexOf("/");if(n){if(s<=0||t.indexOf("/",s+1)!==-1)return!1}else if(s!==-1)return!1;let r=n?[t.slice(0,s),t.slice(s+1)]:[t];for(let i of r){if(i.length===0||i.charCodeAt(0)===46||i.charCodeAt(0)===95)return!1;for(let o=0;o<i.length;o+=1){let a=i.charCodeAt(o);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function rr(e){return lo(e)?`node_modules/${e}`:""}function or(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var co=2e5,vu=64,uo=1024,dx=5,cx=[1,2,3];function ux(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let s=e.slice(t+n.length);if(s==="")return null;let r=s.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function Eu(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let s=t.indexOf("@",1);if(s>0){let r=t.slice(0,s),i=t.slice(s+1);if(r.length>0&&i.length>0)return[{name:r,version:i}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function Xn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Nu(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Au(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Iu(e,n,t,s,r=!1){let i=JSON.stringify([n,t,s]);if(!e.seen.has(i)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(i),e.deps.push({name:n,version:t,lockKey:s,dev:r})}}function fx(e,n){for(let[t,s]of Object.entries(e)){if(t==="")continue;if(!Au(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),i=Xn(s);if(i===null){n.unread+=1;continue}if(i.link===!0)continue;let o=i.name,a=typeof o=="string"&&o!==""?o:ux(t),d=i.version;if(a===null||typeof d!="string"){r&&(n.unread+=1);continue}let l=i.dev===!0||i.devOptional===!0;for(let c of Eu(a,d))Iu(n,c.name,c.version,t,l)}}function Ru(e,n,t){let s=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let i=0;i<s.length;i+=1){let o=s[i];if(o===void 0)break;for(let[a,d]of Object.entries(o.deps)){if(!Au(n))return{depthCapped:r};if(a===""){n.unread+=1;continue}let l=Xn(d);if(l===null){n.unread+=1;continue}let c=o.pathSafe&&lo(a),p=c?`${o.prefix}node_modules/${a}`:"",u=c&&p.length<=uo,f=u?p:"",h=l.version,g=l.dev===!0||o.dev;if(l.link!==!0&&typeof h=="string"&&h!=="")for(let _ of Eu(a,h))Iu(n,_.name,_.version,f,g);else n.unread+=1;let y=Xn(l.dependencies);if(y!==null){if(o.depth+1>t){r=!0;continue}s.push({deps:y,prefix:u?`${f}/`:o.prefix,depth:o.depth+1,pathSafe:u,dev:g})}}}return{depthCapped:r}}function px(e,n,t){let s=Nu(n.maxEntries),{depthCapped:r}=Ru(e,s,t),i=[],o=new Set(n.deps.map(l=>JSON.stringify([l.name,l.version]))),a=new Set,d=[];for(let l of s.deps){if(l.version.includes(":"))continue;let c=JSON.stringify([l.name,l.version]);o.has(c)||a.has(c)||(a.add(c),d.length<dx&&d.push(or(l.name,l.version)))}if(a.size>0){let l=a.size-d.length;i.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${d.join(", ")}${l>0?`, and ${String(l)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(s.capped||r)&&i.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),i}function fo(e,n={}){let t=[],s;try{s=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=Xn(s);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let i=r.lockfileVersion,o=typeof i=="number"&&Number.isInteger(i)?i:null,a=typeof i=="number"?String(i):"?",d=Xn(r.packages),l=Xn(r.dependencies);if(d===null&&l===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(o===null||!cx.includes(o))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let c=n.maxDepth??vu,p=Nu(n.maxEntries??co),u=!1;return d!==null?(fx(d,p),l!==null&&t.push(...px(l,p,c))):l!==null&&(u=Ru(l,p,c).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),u&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(c)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||u}}var mx=["workspace:","link:","portal:","file:","exec:"];function hx(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function aa(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let s=n.slice(0,t),r=n.slice(t+1);if(s.length===0)return[];for(let a of mx)if(r.startsWith(a))return[];if(!r.startsWith("npm:"))return[s];let i=r.slice(4),o=i.indexOf("@",1);if(o>0){let a=i.slice(0,o);return a.length>0?[a]:[s]}return i.length===0||hx(i)?[s]:[s,i]}function gx(e){if(jn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let s=e.charCodeAt(t);if(s===34||s===39){n===0?n=s:n===s&&(n=0);continue}if(n===0&&s===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function yx(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let s of n.split(",")){let r=s.trim();r.length>0&&t.push(r)}return t}function _x(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let s=t.length;for(;s<n.length&&s<t.length+3;){let i=n.charCodeAt(s);if(i<48||i>57)break;s+=1}let r=n.slice(t.length,s);return r.length>0?r:null}function Ou(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Me(e.slice(8).trim());return t.length>0?t:null}function la(e,n={}){let t=[],s=[],r=new Set,i=n.maxEntries??2e5,o=!1,a=null,d=!1,l=[],c=!1,p=-1,u=!1,f=0,h=()=>{l.length>0&&!c&&(f+=1)},g=Vn(e,n,(x,k)=>{if(x===0){h(),l=[],c=!1,p=-1,d=!1;let I=gx(k);if(I===null)return;let N=Me(I.trim());if(N==="__metadata"){o=!0,d=jn(k);return}for(let v of yx(N))l.push(...aa(v));return}if(d){if(x===2&&a===null){let I=Ou(k);I!==null&&(a=I)}return}if(l.length===0||(p===-1&&(p=x),x!==p||c))return;let w=Ou(k);if(w!==null){c=!0;for(let I of l){let N=JSON.stringify([I,w]);if(!r.has(N)){if(s.length>=i){u=!0;return}r.add(N),s.push({name:I,version:w,lockKey:rr(I),dev:!1})}}}});h();let y=o?"yarn.lock (Berry)":"yarn.lock (v1)";if(g.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};g.oversizeLines>0&&t.push(`${y} has ${String(g.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),u&&t.push(`${y} exceeds ${String(i)} entries; truncated`);let _=a??_x(e),b=_===null?null:Number(_.split(".")[0]);return _!==null&&(b===null||!Number.isInteger(b)||b<1||b>8)&&t.push(`${y} declares unsupported lockfileVersion ${_} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),f>0&&t.push(`${y} has ${String(f)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:s,diagnostics:t,truncated:g.truncated||u}}function da(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.indexOf("_");return s!==-1&&(n=n.slice(0,s)),n.trim()}function ca(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function mo(e){let n=Me(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.charCodeAt(0)===47;if(s&&(n=n.slice(1)),n.length===0)return null;if(!s&&n.charCodeAt(0)!==64){let c=n.indexOf("/"),p=n.indexOf("@",1);c>0&&(p===-1||c<p)&&n.slice(0,c).includes(".")&&n.indexOf("/",c+1)!==-1&&(n=n.slice(c+1))}let r=n.charCodeAt(0)===64,i=r?n.indexOf("/"):-1;if(r&&i<=0)return null;let o=r?i+1:0,a=-1;for(let c=o;c<n.length;c+=1){let p=n.charCodeAt(c);if(p===47||p===64){a=c;break}}if(a<=o)return null;let d=n.slice(0,a),l=da(n.slice(a+1));return ca(l)?{name:d,version:l}:null}var xx=new Set(["packages","snapshots","importers"]),bx=new Set([5,6,7,8,9]);function Sx(e){let n=Me(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function po(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Me(e.slice(0,n).trim()),value:Me(t)}}function ua(e,n={}){let t=[],s=[],r=new Set,i=n.maxEntries??2e5,o="",a=null,d=!1,l=0,c=[],p=(f,h)=>{let g=JSON.stringify([f,h]);if(!r.has(g)){if(s.length>=i){d=!0;return}r.add(g),s.push({name:f,version:h,lockKey:rr(f),dev:!1})}},u=Vn(e,n,(f,h)=>{if(f===0){let g=at(h);if(o=g===null?"":Me(g.trim()),a=null,o==="lockfileVersion"){let y=po(h),_=y===null?null:Sx(y.value);y!==null&&(_===null||!bx.has(_))&&c.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),o="";return}if(xx.has(o)&&!jn(h)){let y=po(h)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(l+=1),o=""}return}if(o==="packages"||o==="snapshots"){if(f!==2)return;let g=at(h),y=g===null?null:mo(g);if(y===null){l+=1;return}p(y.name,y.version);return}if(o==="importers"){if(f===6){let g=po(h);if(g===null){a=h.endsWith(":")?Me(h.slice(0,-1).trim()):null;return}a=null;let y=da(g.value);ca(y)&&p(g.key,y);return}if(f===8&&a!==null){let g=po(h);if(g===null||g.key!=="version")return;let y=da(g.value);ca(y)&&p(a,y)}}});return u.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...c),u.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(u.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),d&&t.push(`pnpm-lock.yaml exceeds ${String(i)} entries; truncated`),l>0&&t.push(`pnpm-lock.yaml has ${String(l)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:s,diagnostics:t,truncated:u.truncated||d})}function lt(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var Mu=1e6,Pu=2e5,kx=4096,wx=65536,vx=262144,ir=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Tu(e){let n=[];for(let t of e.split(/\r?\n/u)){if(t==="")break;let s=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(t);s!==null&&n.push([(s[1]??"").toLowerCase(),s[2]??""])}return n}function $u(e){if(e.length>Mu)return null;let n,t;for(let[s,r]of Tu(e))s==="name"&&n===void 0?n=r.trim():s==="version"&&t===void 0&&(t=r.trim());return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}var Ex=/^([A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)/u;function Lu(e){if(e.length>Mu)return[];let n=new Set;for(let[t,s]of Tu(e)){if(t!=="requires-dist")continue;let r=Ex.exec(s.trim())?.[1];r!==void 0&&n.add(lt(r))}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function Du(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&ir.test(n))}function Fu(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let s=e[t];if(s==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=s}return n}function ju(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Bu(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function Ku(e){let n=e.split(/\r?\n/u);return n.length>Pu?n.slice(0,Pu):n}function zu(e){let n=new Set;for(let t of Ku(e)){if(t==="")continue;let s=Fu(t).split("/"),r=s[0]??"";if(ju(r))continue;if(s.length>1){ir.test(r)&&n.add(r);continue}let i=Bu(r);i!==null&&ir.test(i)&&n.add(i)}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function Nx(e){let n=e.split("/"),t=n[0]??"";if(ju(t))return null;let s=n[n.length-1]??"",r=Bu(s);if(r===null)return null;let i=n.slice(0,-1);if(i.some(a=>!ir.test(a)||a==="__pycache__"))return null;let o=r==="__init__"?i:[...i,r];return o.length===0||!ir.test(r==="__init__"?i[i.length-1]??"":r)?null:o}function Uu(e,n=kx){let t=new Set,s=0,r=0,i=!1;for(let o of Ku(e)){if(o==="")continue;let a=Fu(o),d=Nx(a);if(d!==null){s+=1,(a.endsWith(".so")||a.endsWith(".pyd"))&&(r+=1);for(let l=1;l<=Math.min(2,d.length);l+=1){let c=d.slice(0,l).join(".");if(!t.has(c)){if(t.size>=n){i=!0;break}t.add(c)}}}}return{prefixes:[...t].sort((o,a)=>o<a?-1:o>a?1:0),moduleFiles:s,extensionModules:r,capped:i}}function Ax(e){if(e.length>vx)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let s=t.trim();if(!(s===""||s.startsWith("#")||s.startsWith(";"))){if(s.startsWith("[")){let r=s.slice(1,s.endsWith("]")?-1:void 0).trim();n=r==="console_scripts"||r==="gui_scripts";continue}if(n&&s.includes("="))return!0}}return!1}function qu(e){if(e.length>wx)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,s=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:s?.editable===!0}}function ar(e,n){let t=$u(e);if(t===null)return null;let s=n.topLevelText!==void 0?Du(n.topLevelText):[],r=s.length>0?s:n.recordText!==void 0?zu(n.recordText):[],i=n.recordText!==void 0?Uu(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},o=n.entryPointsText!==void 0?Ax(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",a=n.directUrlText!==void 0?qu(n.directUrlText)?.editable??!1:!1;return{name:lt(t.name),version:t.version,importNames:r,modulePrefixes:i.prefixes,moduleFiles:i.moduleFiles,editable:a,consoleScripts:o,extensionModules:i.extensionModules,recordKnown:n.recordText!==void 0,requiresDist:Lu(e)}}function Cu(e,n,t){let s=e.get(n);s===void 0?e.set(n,[t]):s.includes(t)||s.push(t)}function ho(e){let n=new Map,t=new Map,s=[];for(let r of e){if(r.importNames.length===0){s.push(r);continue}for(let i of r.importNames)Cu(n,i,r);for(let i of r.modulePrefixes)Cu(t,i,r)}return{byImportName:n,byModulePrefix:t,unmapped:s}}function lr(e,n){let t=n.split(".").filter(r=>r.length>0),s=t[0];if(s===void 0)return[];for(let r=Math.min(2,t.length);r>=1;r-=1){let i=e.byModulePrefix.get(t.slice(0,r).join("."));if(i!==void 0&&i.length>0)return i}return e.byImportName.get(s)??[]}var dr=class{nodes=new Map;children=new Map;importers=new Map;over=!1;node(n,t,s){if(!this.nodes.has(n)){if(this.nodes.size>=2e5){this.over=!0;return}this.nodes.set(n,{name:t,version:s})}}edge(n,t){let s=this.children.get(n);s===void 0?this.children.set(n,[t]):s.includes(t)||s.push(t)}done(){return this.over||this.importers.size===0?null:{nodes:this.nodes,children:this.children,importers:this.importers}}},Tt="importer:",Jt="node_modules/";function pa(e){let n;try{n=JSON.parse(e)}catch{return null}let t=Xn(Xn(n)?.packages);if(t===null)return null;let s=new dr,r=new Map;for(let[l,c]of Object.entries(t)){let p=Xn(c);p!==null&&r.set(l,p)}let i=l=>l.startsWith(Jt)||l.includes(`/${Jt}`),o=l=>{let c=l;for(let p=0;p<8;p+=1){let u=r.get(c);if(u===void 0)return null;if(u.link!==!0)return c;let f=u.resolved;if(typeof f!="string")return null;c=f}return null},a=l=>i(l)?l:`${Tt}${l}`,d=(l,c)=>{let p=l;for(;;){let u=p===""?`${Jt}${c}`:`${p}/${Jt}${c}`;if(r.has(u))return o(u);if(p==="")return null;let f=p.lastIndexOf(`/${Jt}`);p=f===-1?"":p.slice(0,f)}};for(let[l,c]of r){if(c.link===!0)continue;let p=i(l);if(p){let f=typeof c.name=="string"&&c.name!==""?c.name:l.slice(l.lastIndexOf(Jt)+Jt.length),h=c.version;if(typeof h!="string")continue;s.node(l,f,h)}else s.importers.set(`${Tt}${l}`,l===""?"package.json":`${l}/package.json`);let u=p?["dependencies","optionalDependencies","peerDependencies"]:["dependencies","devDependencies","optionalDependencies","peerDependencies"];for(let f of u){let h=Xn(c[f]);if(h!==null)for(let g of Object.keys(h)){let y=d(l,g);y!==null&&y!==l&&s.edge(a(l),a(y))}}}return s.done()}function go(e){let n=at(e);if(n===null)return null;let t=e.slice(n.length+1).trim();return t.length===0?null:{key:Me(n.trim()),value:Me(t)}}var fa=new Set(["dependencies","optionalDependencies","devDependencies"]);function ma(e,n={}){let t=new dr,s=[],r="",i=!1,o=null,a="",d=null,l=u=>u==="."||u===""?"package.json":`${u}/package.json`,c=(u,f,h,g)=>{if(h===f){let y=go(g);d=y===null&&jn(g)?Me(g.slice(0,-1).trim()):null,y!==null&&s.push({from:u,name:y.key,token:y.value});return}if(h===f+2&&d!==null){let y=go(g);y?.key==="version"&&s.push({from:u,name:d,token:y.value})}},p=Vn(e,n,(u,f)=>{if(u===0){let h=at(f);r=h===null?"":Me(h.trim()),r==="lockfileVersion"&&(i=(go(f)?.value??"").startsWith("5")),o=null,fa.has(r)&&jn(f)&&(o=`${Tt}.`,t.importers.set(o,"package.json"),a=r,d=null);return}if(fa.has(r)){o!==null&&c(o,2,u,f);return}if(r==="importers"){if(u===2){let h=at(f),g=h===null?".":Me(h.trim());o=`${Tt}${g}`,t.importers.set(o,l(g)),a="";return}if(o===null)return;if(u===4){a=jn(f)?Me(f.slice(0,-1).trim()):"",d=null;return}fa.has(a)&&c(o,6,u,f);return}if(!(r!=="packages"&&r!=="snapshots")){if(u===2){let h=at(f);if(h===null){o=null;return}let g=Me(h.trim()),y=g.startsWith("/")?g.slice(1):g,_=mo(g);o=_===null?null:y,_!==null&&t.node(y,_.name,_.version),a="";return}if(o!==null){if(u===4){a=jn(f)?Me(f.slice(0,-1).trim()):"";return}if(u===6&&(a==="dependencies"||a==="optionalDependencies")){let h=go(f);h!==null&&s.push({from:o,name:h.key,token:h.value})}}}});if(p.refusedAnchors||p.truncated)return null;for(let u of s){if(u.token.startsWith("link:"))continue;let h=(u.token.startsWith("/")?u.token.slice(1):null)??(i?`${u.name}/${u.token}`:`${u.name}@${u.token}`);t.nodes.has(h)&&t.edge(u.from,h)}return t.done()}function Ix(e,n){let t=e.indexOf("@npm:",1);return t<=0?null:e.slice(t+5)===n?e.slice(0,t):null}function ha(e,n,t={}){let s=new dr,r=new Map,i=[],o=null,a=-1,d=!1,l=-1,c=[],p=null,u=null,f=0,h=Vn(e,t,(g,y)=>{if(g===0){d=!1,a=-1,p=null,u=null;let k=jn(y)?y.slice(0,-1):null;if(o=null,c=[],k===null)return;let w=Me(k.trim());if(w==="__metadata"||(c=w.split(",").map(N=>Me(N.trim())).filter(N=>N.length>0),c.length===0))return;f+=1,o=`y${String(f)}`;for(let N of c)r.set(N,o);let I=c.find(N=>N.includes("@workspace:"));if(I!==void 0){let N=I.slice(I.indexOf("@workspace:")+11),v=`${Tt}${N}`;s.importers.set(v,N==="."||N===""?"package.json":`${N}/package.json`),o=v;for(let C of c)r.set(C,v)}return}if(o===null)return;if(a===-1&&(a=g),g===a){if(d=!1,y==="dependencies:"||y==="optionalDependencies:"){d=!0,l=-1;return}if(y.startsWith("version ")||y.startsWith("version:"))p=Me(y.slice(8).trim());else if(y.startsWith("resolution:"))u=Me(y.slice(11).trim());else return;let k=c[0];if(p!==null&&k!==void 0&&!o.startsWith(Tt)){let w=aa(k);if(w.length===1&&w[0]!==void 0)s.node(o,w[0],p);else if(u!==null){let I=Ix(u,p);I!==null&&s.node(o,I,p)}}return}if(!d||g<=a||(l===-1&&(l=g),g!==l))return;let _=at(y),b,x;if(_!==null&&y.charCodeAt(_.length)===58)b=Me(_.trim()),x=Me(y.slice(_.length+1).trim());else{let k=y.indexOf(" ");if(k<=0)return;b=Me(y.slice(0,k)),x=Me(y.slice(k+1).trim())}b.length>0&&x.length>0&&i.push({from:o,descriptor:`${b}@${x}`})});if(h.refusedAnchors||h.truncated)return null;if(s.importers.size===0){s.importers.set(`${Tt}.`,"package.json");for(let[g,y]of n)i.push({from:`${Tt}.`,descriptor:`${g}@${y}`})}for(let g of i){let y=g.descriptor.indexOf("@",1),_=g.descriptor.slice(y+1),b=_.includes(":")?g.descriptor:`${g.descriptor.slice(0,y)}@npm:${_}`,x=r.get(g.descriptor)??r.get(b);x!==void 0&&x!==g.from&&s.edge(g.from,x)}return s.done()}function ga(e,n,t,s){let r=new Map;for(let[k,w]of e.children)for(let I of w){let N=r.get(I);N===void 0?r.set(I,[k]):N.push(k)}let i=new Set,o=[...e.importers.keys()];for(let k=0;k<o.length;k+=1)for(let w of e.children.get(o[k])??[])i.has(w)||e.importers.has(w)||(i.add(w),o.push(w));let a=[...e.nodes].filter(([k,w])=>w.name===n&&w.version===t&&i.has(k)).map(([k])=>k).sort();if(a.length===0)return null;let d=new Map(a.map(k=>[k,0])),l=[...a];for(let k=0;k<l.length;k+=1){let w=l[k];for(let I of r.get(w)??[])d.has(I)||!i.has(I)||(d.set(I,(d.get(w)??0)+1),l.push(I))}let c=[...d.keys()].sort((k,w)=>(d.get(k)??0)-(d.get(w)??0)||(k<w?-1:k>w?1:0)),p=c.filter(k=>e.nodes.has(k)),u=c.length-p.length,f=new Map(p.map((k,w)=>[k,w])),h=[];for(let k of p)for(let w of e.children.get(k)??[])f.has(w)&&h.push([k,w]);let g=new Array(p.length).fill(0);for(let[k,w]of h){let I=Math.max(f.get(k)??0,f.get(w)??0);g[I]=(g[I]??0)+1}let y=0,_=0;for(;y<p.length&&y<s.maxNodes;){let k=g[y]??0;if(_+k>s.maxEdges)break;_+=k,y+=1}let b=new Map(p.slice(0,y).map((k,w)=>[k,`p${String(w)}`])),x=k=>{let I=(r.get(k)??[]).filter(N=>e.importers.has(N)).sort()[0];return I===void 0?null:e.importers.get(I)??null};return{nodes:p.slice(0,y).map(k=>{let w=e.nodes.get(k);return{id:b.get(k),name:w.name,version:w.version,directFrom:x(k)}}),edges:h.flatMap(([k,w])=>{let I=b.get(k),N=b.get(w);return I===void 0||N===void 0?[]:[{from:I,to:N}]}),truncated:p.length-y+u}}function ya(e){let n=new Map,t=new Set(["dependencies","devDependencies","optionalDependencies","peerDependencies"]),s=[],r=1,i=!1,o=e.charCodeAt(0)===65279?1:0;for(;o<e.length;){let a=e.charCodeAt(o);if(a===10)r+=1;else if(a===123||a===91){if(s.length>=64)return null;s.push({kind:a===123?"{":"[",key:null}),i=a===123}else if(a===125||a===93)s.pop(),i=!1;else if(a===44)i=s.at(-1)?.kind==="{";else if(a===58)i=!1;else if(a===34){let d=r,l=o+1;for(;l<e.length&&e.charCodeAt(l)!==34;){if(e.charCodeAt(l)===92)l+=1;else if(e.charCodeAt(l)===10)return null;l+=1}if(l>=e.length)return null;let c=s.at(-1);if(i&&c?.kind==="{"){let p;try{p=JSON.parse(e.slice(o,l+1))}catch{return null}c.key=p;let u=s.length===2?s[0]?.key:null;u!=null&&t.has(u)&&!n.has(p)&&n.set(p,d)}i=!1,o=l}o+=1}return s.length===0?n:null}var _a="importer:";function yo(e){let n=e.indexOf(" = ");if(n<=0)return null;let t=e.slice(n+3).trim();if(t.length<2||!t.startsWith('"')||!t.endsWith('"'))return null;let s=t.slice(1,-1);return s.includes('"')?null:{key:e.slice(0,n).trim(),value:s}}function Rx(e){let n=[],t=0;for(;;){let s=e.indexOf('"',t);if(s===-1)return n;let r=e.indexOf('"',s+1);if(r===-1)return n;n.push(e.slice(s+1,r)),t=r+1}}function Ox(e){let n=[],t=0;for(;;){let s=e.indexOf("{",t);if(s===-1)return n;let r=e.indexOf("}",s);if(r===-1)return n;let i=e.slice(s+1,r),o=[],a=i.indexOf("extra = [");if(a!==-1){let c=i.indexOf("]",a);c!==-1&&(o=Rx(i.slice(a,c)),i=i.slice(0,a)+i.slice(c+1))}let d=null,l=null;for(let c of i.split(",")){let p=yo(c.trim());p?.key==="name"?d=p.value:p?.key==="version"&&(l=p.value)}d!==null&&n.push({name:d,version:l,extras:o}),t=r+1}}function Hu(e,n,t,s,r=new Map){if(s||n.size===0)return null;let i=new Map;for(let[l,c]of e){let p=i.get(c.name);p===void 0?i.set(c.name,[l]):p.push(l)}let o=new Map,a=[...t],d=new Set;for(let l=0;l<a.length;l+=1){let c=a[l],p=lt(c.name),u=i.get(p)??[],f=c.version!==null?`${p}@${c.version}`:u.length===1?u[0]??null:null;if(f===null||!e.has(f)||f===c.from)continue;let h=o.get(c.from);h===void 0?o.set(c.from,[f]):h.includes(f)||h.push(f);for(let g of c.extras){let y=JSON.stringify([f,g]);if(!d.has(y)){d.add(y);for(let _ of r.get(f)?.get(g)??[])a.push({from:f,..._})}}}return{nodes:e,children:o,importers:n}}function ba(e,n={}){let t=new Map,s=new Map,r=[],i=!1,o=null,a=null,d=null,l=[],c=new Map,p=new Map,u="",f=!1,h="",g=null,y=x=>{let k=Ox(x);g===null?l.push(...k):c.set(g,[...c.get(g)??[],...k])},_=()=>{if(o===null)return;let x=lt(o),k=null;if(d!==null?(k=`${_a}${d}`,s.set(k,d==="."?"pyproject.toml":`${d}/pyproject.toml`)):a!==null&&(k=`${x}@${a}`,t.size>=2e5?i=!0:t.set(k,{name:x,version:a})),k!==null){for(let w of l)r.push({from:k,...w});c.size>0&&p.set(k,c)}o=null,a=null,d=null,l=[],c=new Map},b=Vn(e,n,(x,k)=>{if(f){h+=k,k.startsWith("]")&&(y(h),f=!1);return}if(k==="[[package]]"){_(),u="package";return}if(k.startsWith("[")){u=k==="[package.dev-dependencies]"?"dev":k==="[package.optional-dependencies]"?"optional":"other";return}if(u==="other")return;let w=k.indexOf(" = ");if(w<=0)return;let I=k.slice(0,w).trim(),N=k.slice(w+3).trim();if((u==="optional"||(u==="dev"?d!==null:I==="dependencies"))&&N.startsWith("[")){g=u==="optional"?I.replaceAll('"',""):null,N.endsWith("]")?y(N):(f=!0,h=N);return}if(u!=="package")return;if(I==="source"){let R=N.startsWith("{")&&N.endsWith("}")?N.slice(1,-1):"";for(let F of R.split(",")){let P=yo(F.trim());(P?.key==="editable"||P?.key==="virtual")&&(d=P.value)}return}let C=yo(k);C?.key==="name"?o=C.value:C?.key==="version"&&(a=C.value)});return _(),b.refusedAnchors||b.truncated?null:Hu(t,s,r,i,p)}function Sa(e,n,t={}){let s=new Map,r=new Map([[`${_a}.`,"pyproject.toml"]]),i=n.map(f=>({from:`${_a}.`,name:f,version:null,extras:[]})),o=!1,a=null,d=null,l=[],c="",p=()=>{if(a!==null&&d!==null){let f=lt(a),h=`${f}@${d}`;s.size>=2e5?o=!0:s.set(h,{name:f,version:d});for(let g of l)i.push({from:h,name:g,version:null,extras:[]})}a=null,d=null,l=[]},u=Vn(e,t,(f,h)=>{if(h==="[[package]]"){p(),c="package";return}if(h.startsWith("[")){c=h==="[package.dependencies]"?"deps":"other";return}if(c==="package"){let _=yo(h);_?.key==="name"?a=_.value:_?.key==="version"&&(d=_.value);return}if(c!=="deps")return;let g=h.indexOf(" = ");g<=0||h.slice(g+3).includes("optional = true")||l.push(h.slice(0,g).trim().replaceAll('"',""))});return p(),u.refusedAnchors||u.truncated?null:Hu(s,r,i,o)}function xa(e){let n=0;for(;n<e.length;){let t=e.charCodeAt(n);if(!(t>=97&&t<=122||t>=65&&t<=90||t>=48&&t<=57||t===45||t===46||t===95))break;n+=1}return n===0?null:lt(e.slice(0,n))}function Px(e){return e==="tool.poetry.dependencies"||e==="tool.poetry.dev-dependencies"||e.startsWith("tool.poetry.group.")&&e.endsWith(".dependencies")}function _o(e){let n=new Map,t="",s=!1,r=0,i=l=>{l!==null&&l!=="python"&&!n.has(l)&&n.set(l,r)},o=l=>{let c=0;for(;;){let p=l.indexOf('"',c);if(p===-1)return;let u=l.indexOf('"',p+1);if(u===-1)return;i(xa(l.slice(p+1,u))),c=u+1}},a=(l,c)=>l==="project"&&c==="dependencies"||l==="project.optional-dependencies"||l==="dependency-groups"||l==="tool.uv"&&c==="dev-dependencies",d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length&&r<2e5;){let l=e.indexOf(`
-`,d);l===-1&&(l=e.length),r+=1;let c=e.slice(d,l);d=l+1;let p=c.indexOf("#"),u=(p===-1?c:c.slice(0,p)).trim();if(u.length>4096)continue;if(s){o(u),u.includes("]")&&(s=!1);continue}if(u.startsWith("[")&&!u.startsWith("[[")){t=u.slice(1,u.indexOf("]")===-1?u.length:u.indexOf("]")).trim();continue}let f=u.indexOf("=");if(f<=0)continue;let h=u.slice(0,f).trim().replaceAll('"',""),g=u.slice(f+1).trim();if(Px(t)){i(xa(h));continue}if(a(t,h)&&g.startsWith("[")&&(o(g),s=!g.includes("]")),l===e.length)break}return n}function ka(e){let n=new Map,t=0,s=0;for(;s<=e.length&&t<2e5;){let r=e.indexOf(`
-`,s);r===-1&&(r=e.length),t+=1;let i=e.slice(s,r);s=r+1;let o=i.trim();if(o.length>0&&o.length<=4096&&!o.startsWith("#")&&!o.startsWith("-")){let a=xa(o);a!==null&&!n.has(a)&&n.set(a,t)}if(r===e.length)break}return n}import{statSync as Zx}from"node:fs";import Qx from"node:path";import{lstatSync as Cx,readFileSync as Mx,readdirSync as Tx,realpathSync as wa,statSync as cr}from"node:fs";import ze from"node:path";function ur(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}var Xu=2e4,Yu=32,Ju=256,$x=2*1024*1024,Lx=256*1024,Zu=256,Dx=16,Fx=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],jx=["pyproject.toml","setup.py","setup.cfg"],Bx=["requirements.txt","Pipfile"],Kx=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],Qu={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function Wu(e,n){try{let t=cr(e);return!t.isFile()||t.size>n?null:Mx(e,"utf8")}catch{return null}}function $t(e){let n;try{n=cr(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function zx(e){try{return cr(e).isDirectory()}catch{return!1}}function Ux(e,n){let t=0,s=0,r=-1,i=0;for(;s<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(s)))t+=1,s+=1;else if(t<e.length&&e.charAt(t)==="*")r=t,i=s,t+=1;else if(r>=0)t=r+1,i+=1,s=i;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function qx(e,n){let t=(s,r)=>{if(s===e.length)return r===n.length;let i=e[s]??"";if(i==="**"){for(let a=r;a<=n.length;a+=1)if(t(s+1,a))return!0;return!1}if(r>=n.length)return!1;let o=n[r]??"";return(i.includes("*")||i.includes("?")?Ux(i,o):i===o)?t(s+1,r+1):!1};return t(0,0)}function Hx(e){let n=[],t=Wu(ze.join(e,"package.json"),$x);if(t!==null)try{let o=JSON.parse(t)?.workspaces;if(Array.isArray(o))for(let a of o)typeof a=="string"&&n.push(a);else if(typeof o=="object"&&o!==null){let a=o.packages;if(Array.isArray(a))for(let d of a)typeof d=="string"&&n.push(d)}}catch{}let s=Wu(ze.join(e,"pnpm-workspace.yaml"),Lx);s!==null&&n.push(...Wx(s));let r=[];for(let i of n){if(r.length>=Zu)break;let o=i.trim();if(o.length===0)continue;for(;o.startsWith("./");)o=o.slice(2);if(o.startsWith("/")||ze.isAbsolute(o))continue;let a=o.split("/").filter(d=>d.length>0);a.length===0||a.length>Dx||a.includes("..")||r.push(a.join("/"))}return r}function Wx(e){let n=[],t=!1;for(let s of e.split(`
-`)){if(n.length>=Zu)break;if(/^packages:\s*(#.*)?$/.test(s)){t=!0;continue}if(!t)continue;let r=/^\s+-\s*(.*?)\s*$/.exec(s);if(r===null){s.trim().length>0&&(t=!1);continue}let i=(r[1]??"").trim(),o=i.indexOf(" #");o>=0&&(i=i.slice(0,o).trim()),(i.startsWith('"')&&i.endsWith('"')&&i.length>=2||i.startsWith("'")&&i.endsWith("'")&&i.length>=2)&&(i=i.slice(1,-1)),i.length>0&&n.push(i)}return n}function Gu(e,n){let t=ze.relative(n,e);return t.length===0?!1:t.split(ze.sep).includes("node_modules")}function Vu(e,n){return ze.relative(e,n).split(ze.sep).join("/")}function va(e,n){let t=n?.maxDirs??Xu,s=n?.maxDepth??Yu,r=n?.maxRoots??Ju,i=n?.discoverPythonRoots??!0,o;try{o=wa(e)}catch{return{...Qu,observations:[{kind:"refused-unreadable",rel:""}]}}let a=[],d=[],l=new Set([o]),c=0,p=0,u=0,f="complete",h=Hx(o).map(x=>x.split("/")),g=x=>{let k="absent";for(let I of jx){let N=$t(ze.join(x,I));if(N==="regular"){k="declared";break}N==="refused"&&(k="refused")}if(k==="absent"&&Bx.some(I=>$t(ze.join(x,I))==="regular")&&(k="listed"),k==="absent")return{candidate:k,witnesses:[]};let w=[];return Kx.some(I=>$t(ze.join(x,I))==="regular")&&w.push("own-lockfile"),zx(ze.join(x,".venv"))&&w.push("installed-env"),{candidate:k,witnesses:w}},y=(x,k)=>{let w=g(x);return w.candidate==="absent"?"not-root":(w.candidate!=="listed"&&(p+=1),w.witnesses.length===0&&w.candidate!=="refused"?(w.candidate==="declared"&&d.push({kind:"undeclared-manifest",rel:k}),"not-root"):a.length>=r?"exhausted":(a.push({rel:k,abs:x,witnesses:w.witnesses,manifestRefused:w.candidate==="refused",ecosystem:"PyPI"}),"root"))},_=(x,k)=>{if(k.length===0){let C=$t(ze.join(x,"package.json"))!=="absent",R=i?g(x):{candidate:"absent",witnesses:[]};return!C&&R.candidate!=="absent"?(a.push({rel:"",abs:x,witnesses:["scan-root",...R.witnesses],manifestRefused:!1,ecosystem:"PyPI"}),"root"):(a.push({rel:"",abs:x,witnesses:["scan-root",...R.witnesses],manifestRefused:!1,...R.witnesses.length>0?{alsoPython:!0}:{}}),"root")}let w=$t(ze.join(x,"package.json"));if(w==="absent")return i?y(x,k):"not-root";p+=1;let I=[],N=k.split("/");h.some(C=>qx(C,N))&&I.push("workspace-declared"),Fx.some(C=>$t(ze.join(x,C))==="regular")&&I.push("own-lockfile");let v=i?g(x):{candidate:"absent",witnesses:[]};for(let C of v.witnesses)I.includes(C)||I.push(C);return I.length===0&&w!=="refused"?(d.push({kind:"undeclared-manifest",rel:k}),"not-root"):a.length>=r?"exhausted":(a.push({rel:k,abs:x,witnesses:I,manifestRefused:w==="refused",...v.witnesses.length>0?{alsoPython:!0}:{}}),"root")},b=[{abs:o,rel:"",depth:0}];for(;b.length>0;){let x=b.pop();if(x===void 0)break;if(c>=t){f="dirs-exhausted";break}c+=1;let k=_(x.abs,x.rel);if(k==="exhausted"){f="roots-exhausted";break}let w=k==="root";if(x.depth>=s){f=f==="complete"?"depth-clamped":f;continue}let I;try{I=Tx(x.abs)}catch{d.push({kind:"refused-unreadable",rel:x.rel});continue}I.sort().reverse();for(let N of I){let v=ze.join(x.abs,N),C=x.rel.length===0?N:`${x.rel}/${N}`,R;try{let U=Cx(v);R=U.isDirectory()||U.isSymbolicLink()&&cr(v).isDirectory()}catch{continue}if(!R)continue;if(N==="node_modules"){w||d.push({kind:"unenumerated-install",rel:C});continue}if(N.startsWith(".")){u+=1,d.push({kind:"skipped-dot-directory",rel:C}),$t(ze.join(v,"package.json"))!=="absent"&&d.push({kind:"undeclared-manifest",rel:C});continue}let F;try{F=wa(v)}catch{d.push({kind:"refused-unreadable",rel:C});continue}let P=o.endsWith(ze.sep)?o:o+ze.sep;if(F!==o&&!F.startsWith(P)){d.push({kind:"refused-out-of-root",rel:C});continue}Gu(F,o)||l.has(F)||(l.add(F),b.push({abs:F,rel:Vu(o,F),depth:x.depth+1}))}}for(let x of n?.operatorRoots??[]){let k=typeof x=="string"?x.slice(0,512):"",w=()=>{d.push({kind:"refused-operator-root",rel:k})};if(k.length===0||k.includes("\0")){w();continue}let I;try{I=wa(ze.resolve(o,k))}catch{w();continue}let N=o.endsWith(ze.sep)?o:o+ze.sep;if(I!==o&&(!I.startsWith(N)||Gu(I,o))){w();continue}let v;try{v=cr(I).isDirectory()}catch{v=!1}if(!v||$t(ze.join(I,"package.json"))!=="regular"){w();continue}let C=a.findIndex(P=>P.abs===I);if(C>=0){let P=a[C];P!==void 0&&!P.witnesses.includes("operator")&&(a[C]={...P,witnesses:[...P.witnesses,"operator"]});continue}let R=Vu(o,I);a.push({rel:R,abs:I,witnesses:["operator"],manifestRefused:!1});let F=d.findIndex(P=>P.kind==="undeclared-manifest"&&P.rel===R);F>=0&&d.splice(F,1)}return a.sort((x,k)=>x.rel<k.rel?-1:x.rel>k.rel?1:0),d.sort((x,k)=>x.kind!==k.kind?x.kind<k.kind?-1:1:x.rel<k.rel?-1:x.rel>k.rel?1:0),{roots:a,observations:d,budget:f,counts:{dirsWalked:c,manifestsSeen:p,rootsAdmitted:a.length,dotDirectoriesSkipped:u}}}import{lstatSync as ef,readdirSync as Gx,readFileSync as Vx,realpathSync as sf,statSync as rf}from"node:fs";import wn from"node:path";var Yn={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},Xx=/^python\d+\.\d+$/u;function Lt(e,n){let t;try{t=rf(e)}catch(s){return{why:s?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:Vx(e,"utf8")}}catch{return{why:"unreadable"}}}function Ea(e,n){let t;try{if(t=sf(n),!rf(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+wn.sep)?t:null}function nf(e,n){return wn.relative(e,n).split(wn.sep).join("/")}function tf(e){try{return Gx(e).sort()}catch{return null}}function Yx(e){let n=[],t=[],s=0;for(let r of e.split(/\r?\n/u)){let i=r.trim();if(!(i===""||i.startsWith("#"))){if(/^import[ \t]/u.test(i)){s+=1;let o=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(i);o?.[1]!==void 0&&t.length<Yn.maxPthPaths&&t.push(o[1]);continue}n.length<Yn.maxPthPaths&&n.push(i)}}return{paths:n,importLines:s,importModules:t}}function Jx(e){let n=null;for(let t of e.split(/\r?\n/u)){let s=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(s!==null){if(s[1]==="version_info")return s[2]??null;n??=s[2]??null}}return n}function fr(e,n){let t=n?.envDir??Yn.envDir,s=n?.maxDistributions??Yn.maxDistributions,r=n?.maxMetadataBytes??Yn.maxMetadataBytes,i=n?.maxRecordBytes??Yn.maxRecordBytes,o=n?.maxTopLevelBytes??Yn.maxTopLevelBytes,a=n?.maxDirectUrlBytes??Yn.maxDirectUrlBytes,d=Yn.maxEntryPointsBytes,l=t,c=[],p=(C,R,F=null)=>({envRel:l,refused:C,sitePackages:[],interpreter:F,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...c,R],truncated:!1}),u;try{u=sf(e)}catch{return p("absent","the root itself could not be resolved")}let f=wn.join(u,t),h;try{h=ef(f)}catch(C){return C?.code==="ENOENT"?p("absent",`${l}: absent`):p("not-a-directory",`${l}: could not be inspected`)}if(!h.isDirectory()&&!h.isSymbolicLink())return p("not-a-directory",`${l}: not a directory`);let g=Ea(u,f);if(g===null)return p("escapes-root",`${l}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let y=Lt(wn.join(g,"pyvenv.cfg"),Yn.maxPyvenvCfgBytes),_="text"in y?Jx(y.text):null;"text"in y||c.push(`${l}/pyvenv.cfg: ${y.why} \u2014 interpreter version unknown`);let b=[];for(let C of["lib","lib64"]){let R=tf(wn.join(g,C));if(R!==null)for(let F of R)Xx.test(F)&&b.push(wn.join(g,C,F,"site-packages"))}b.push(wn.join(g,"Lib","site-packages"));let x=[],k=new Set;for(let C of b){let R=Ea(g,C);R===null||k.has(R)||(k.add(R),x.push(R))}if(x.length===0)return p("no-site-packages",`${l}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,_);x.length>1&&c.push(`${l}: ${String(x.length)} site-packages directories; all enumerated`);let w=[],I=[],N=0,v=!1;e:for(let C of x){let R=nf(u,C),F=tf(C);if(F===null){c.push(`${R}: unreadable; nothing enumerated there`);continue}for(let P of F){let U=wn.join(C,P),E=P.endsWith(".dist-info"),T=P.endsWith(".egg-info");if(P.endsWith(".pth")){let A=Lt(U,Yn.maxPthBytes);if(!("text"in A)){c.push(`${R}/${P}: ${A.why}; the paths it adds were NOT enumerated`);continue}I.push({name:P,sitePackages:R,...Yx(A.text)});continue}if(!E&&!T)continue;if(w.length>=s){v=!0,c.push(`${R}: the distribution cap (${String(s)}) was hit at ${P}; the enumeration is INCOMPLETE`);break e}let K;try{K=ef(U)}catch{N+=1,c.push(`${R}/${P}: could not be inspected; not enumerated`);continue}let J=E?"dist-info":"egg-info";if(K.isFile()&&T){let A=Lt(U,r);"text"in A?w.push({dir:P,kind:J,metadata:A.text,entryPointsUnknown:!0}):(N+=1,c.push(`${R}/${P}: ${A.why}; not enumerated`));continue}let W=Ea(g,U);if(W===null){N+=1,c.push(`${R}/${P}: not a directory inside the environment; not enumerated`);continue}let se=E?"METADATA":"PKG-INFO",Y=Lt(wn.join(W,se),r);if(!("text"in Y)){N+=1,c.push(`${R}/${P}: ${se} ${Y.why}; not enumerated`);continue}let V={dir:P,kind:J,metadata:Y.text},fe=Lt(wn.join(W,"entry_points.txt"),d);"text"in fe?V.entryPoints=fe.text:fe.why!=="absent"&&(V.entryPointsUnknown=!0,c.push(`${R}/${P}/entry_points.txt: ${fe.why}; the commands it declares are UNKNOWN`));let S=Lt(wn.join(W,"top_level.txt"),o);if("text"in S?V.topLevel=S.text:S.why!=="absent"&&c.push(`${R}/${P}/top_level.txt: ${S.why}; ignored`),E){let A=Lt(wn.join(W,"RECORD"),i);"text"in A?V.record=A.text:c.push(`${R}/${P}/RECORD: ${A.why}; import names from top_level.txt only`);let j=Lt(wn.join(W,"direct_url.json"),a);"text"in j&&(V.directUrl=j.text)}w.push(V)}}return{envRel:l,refused:null,sitePackages:x.map(C=>nf(u,C)),interpreter:_,distInfos:w,pthFiles:I,unreadable:N,diagnostics:c,truncated:v}}var eb=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function nb(e,n){for(let t of n)try{if(Zx(Qx.join(e,t)).isFile())return t}catch{}return null}function of(e){let n=[],t=[],s=(p,u)=>{t.push({kind:p,detail:u,blindsAnalysis:!1,rootRel:""}),n.push(u)},r=nb(e,eb),i=fr(e);if(i.refused!==null){let p=i.refused==="absent"?`no \`${i.envRel}\` is installed`:`\`${i.envRel}\` could not be read (${i.refused})`;return s("no-installed-env",`${r??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:r,diagnostics:[...n,...i.diagnostics],truncated:!1,gaps:t}}let o=[],a=new Set,d=[],l=0;for(let p of i.distInfos){let u=ar(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(u===null){l+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let f=JSON.stringify([u.name,u.version]);a.has(f)||(a.add(f),u.importNames.length===0&&d.push(u.name),o.push({name:u.name,version:u.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...i.diagnostics);let c=i.unreadable+l;return c>0&&s("installed-env-partial",`${String(c)} entr${c===1?"y":"ies"} under ${i.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(o.length)} enumerated were assessed normally.`),i.truncated&&s("installed-env-partial",`the environment walk under ${i.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),d.length>0&&n.push(`${String(d.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${d.slice(0,5).join(", ")}${d.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:o,source:o.length>0?"installed-env":"none",lockfilePath:r,diagnostics:n,truncated:i.truncated,gaps:t}}var Ia=128*1024*1024,tb=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>fo(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>fo(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>la(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>ua(e,n===void 0?{}:{maxEntries:n})}],sb=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Ra(e,n){let t;try{t=Aa(Jn.join(e,n))}catch{return null}let s=e.endsWith(Jn.sep)?e:e+Jn.sep;return t.startsWith(s)?t:null}function lf(e,n){let t=Jn.join(e,"package.json"),s;try{s=Aa(t)}catch{return null}if(!s.startsWith(n+Jn.sep))return null;try{if(!pr(s).isFile())return null;let r=JSON.parse(Na(s,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function df(e,n){try{return pr(Jn.join(e,n)),!0}catch{return!1}}function rb(e,n){if(df(e,"pnpm-workspace.yaml"))return!0;let t=Ra(e,"package.json");if(t===null)return df(e,"package.json");let s;try{let o=pr(t);if(!o.isFile()||o.size>n)return!0;s=Na(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(s)}catch{return!0}for(let o of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=r[o];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let i=r.workspaces;return Array.isArray(i)?i.length>0:typeof i=="object"&&i!==null}function cf(e,n){let t=Jn.join(e,"node_modules"),s=[],r;try{r=af(t,{withFileTypes:!0})}catch{return s}for(let i of r){let o=i.name;if(o.startsWith("."))continue;if(o.startsWith("@")){let d;try{d=af(Jn.join(t,o),{withFileTypes:!0})}catch{continue}for(let l of d){let c=lf(Jn.join(t,o,l.name),n);c!==null&&s.push({dev:!1,name:c.name,version:c.version,lockKey:`node_modules/${o}/${l.name}`,linked:l.isSymbolicLink()||i.isSymbolicLink()})}continue}let a=lf(Jn.join(t,o),n);a!==null&&s.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${o}`,linked:i.isSymbolicLink()})}return s}var ob=5;function ib(e,n,t){let s=Ra(e,n);if(s===null){try{pr(Jn.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=pr(s)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:Na(s,"utf8")}}catch{return{gap:`${n} could not be read`}}}function ab(e,n){let t=Aa(e),s=[],r=[],i=n?.maxLockfileBytes??Ia,o=[],a=new Set,d=[],l=rb(t,i),c=null,p=!1,u=(h,g,y)=>{r.push({kind:h,detail:g,blindsAnalysis:y,rootRel:""}),s.push(g)};for(let h of tb){let g=ib(t,h.file,i);if(g===null)continue;if("gap"in g){u("lockfile-unreadable",g.gap,!1);continue}let y=h.parse(g.text,n?.maxLockfileEntries);if(y.truncated&&(p=!0),y.deps.length===0){if(y.diagnostics.length>0||l){let _=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";u("lockfile-unparsed",`${h.file} yielded NO dependencies (${_}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&u("lockfile-partial",`${h.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),c===null&&(c=h.file),d.includes(h.source)||d.push(h.source);for(let _ of y.deps){let b=JSON.stringify([_.name,_.version,_.lockKey]);a.has(b)||(a.add(b),o.push({..._,declaredIn:h.file}))}}for(let h of sb)if(Ra(t,h)!==null){u("yarn-pnp",`${h} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(o.length>0){let h=d.length===1?d[0]??"none":"multi-lockfile";d.length>1&&s.push(`multiple lockfiles present (${d.join(", ")}); enumerated the UNION of all of them`);let g=new Set(o.map(b=>JSON.stringify([b.name,b.version]))),y=new Set,_=[];for(let b of cf(t,t)){let x=JSON.stringify([b.name,b.version,b.lockKey]);a.has(x)||(a.add(x),o.push({name:b.name,version:b.version,lockKey:b.lockKey,dev:b.dev,declaredIn:""}));let k=JSON.stringify([b.name,b.version]);b.linked||g.has(k)||y.has(k)||(y.add(k),_.length<ob&&_.push(or(b.name,b.version)))}if(y.size>0){let b=y.size-_.length;u("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${_.join(", ")}${b>0?`, and ${String(b)} more`:""}): ${c??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:o,source:h,lockfilePath:c,diagnostics:s,truncated:p,gaps:r}}let f=cf(t,t);return f.length>0?(u("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(f.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:f.map(h=>({name:h.name,version:h.version,lockKey:h.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:s,truncated:p,gaps:r}):(l&&u("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:s,truncated:p,gaps:r})}function lb(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function db(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function ff(e){return e===""||e.split("/").every(db)}function cb(e,n){if(e===""||n==="")return n;if(!ff(e))return"";let t=`${e}/${n}`;return t.length<=uo?t:""}function uf(e,n){return e===""?n:`${e}: ${n}`}function ub(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function pf(e,n,t){let s=t?.maxUnionEntries??co,r=n.roots.filter(lb),i=r.some(h=>h.rel==="")?r:[ub(e),...r],o=[],a=[],d=new Set,l=[],c=[],p=!1,u=!1;for(let h of i){let g=h.rel===""?e:h.abs,y=ab(g,t),_=ur(h)?of(g):null,b=_===null?y:mb(y,_),x=b.diagnostics.map(w=>uf(h.rel,w));!ff(h.rel)&&b.packages.length>0&&x.push(`${h.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(b.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let k={...b,rootRel:h.rel,...h.ecosystem!==void 0?{ecosystem:h.ecosystem}:{},..._!==null?{pythonLockfilePath:_.lockfilePath===null||h.rel===""?_.lockfilePath:`${h.rel}/${_.lockfilePath}`}:{},packages:b.packages.map(w=>({...w,lockKey:cb(h.rel,w.lockKey),declaredIn:w.declaredIn===""||h.rel===""?w.declaredIn:`${h.rel}/${w.declaredIn}`})),lockfilePath:b.lockfilePath===null||h.rel===""?b.lockfilePath:`${h.rel}/${b.lockfilePath}`,gaps:b.gaps.map(w=>({...w,rootRel:h.rel,detail:uf(h.rel,w.detail)})),diagnostics:x};o.push(k),b.truncated&&(p=!0);for(let w of k.packages){let I=JSON.stringify([w.name,w.version,w.lockKey]);if(!d.has(I)){if(a.length>=s){u=!0;break}d.add(I),a.push(w)}}l.push(...k.gaps),c.push(...k.diagnostics)}u&&(p=!0,c.push(`the union of installed sets across ${String(i.length)} roots exceeds its ceiling of ${String(s)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let f=o[0];if(f===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:a,source:f.source,lockfilePath:f.lockfilePath,diagnostics:c,truncated:p,gaps:l,perRoot:o}}function fb(e,n){let t;for(let s of e.perRoot){if(s.rootRel===""){t??=s;continue}n.startsWith(`${s.rootRel}/`)&&(t===void 0||s.rootRel.length>t.rootRel.length)&&(t=s)}return t}function xo(e,n){return n.declaredIn!==""?n.declaredIn:fb(e,n.lockKey)?.lockfilePath??null}function mf(e,n){let t=e.perRoot.find(s=>s.rootRel===n.rootRel);return pb.has(n.kind)?t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`:t?.lockfilePath!==void 0&&t.lockfilePath!==null?t.lockfilePath:n.rootRel===""?null:`${n.rootRel}/${t?.ecosystem==="PyPI"?"pyproject.toml":"package.json"}`}var pb=new Set(["no-installed-env","installed-env-partial"]);function mb(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function hf(e){let n=new Map;for(let t of e){let s=n.get(t.name)??new Set;s.add(t.version),n.set(t.name,s)}return t=>{let s=n.get(t);if(s===void 0)return;let r=[...s].sort();return r.length===1?r[0]:r}}function mr(e){return new Set(e.map(n=>n.root))}function Ss(e,n){let t=mr(n);return e.roots.filter(s=>!t.has(s.rel)&&(s.rel===""||s.ecosystem!=="PyPI"))}function Oa(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function Pa(e,n){return Ss(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function gf(e){let n=[],t=e.observations.filter(s=>s.kind==="unenumerated-install").map(s=>s.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${Oa(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let s=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(s.dirsWalked)} dirs walked, ${String(s.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function yf(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as Sk}from"node:fs";import rs from"node:path";import{spawnSync as jS}from"node:child_process";function hr(e){{let n=ee[e];if(n===void 0)throw new Error(`the bundle does not embed ${e}; this is a cupel build defect`);return["-c",n]}}var _f=["get","post","put","patch","delete","options","head","trace"],vn=(e,n)=>e.map(t=>`${t}.${n}()`),un=(e,...n)=>e.flatMap(t=>n.map(s=>`${t}.${s}`)),$n={id:"fastapi@0-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://fastapi.tiangolo.com/reference/apirouter/ \u2014 APIRouter.api_route's decorator calls add_api_route(path, func) and returns func (fastapi/routing.py, 0.141.1); FastAPI.get/\u2026 delegate to self.router","https://fastapi.tiangolo.com/tutorial/dependencies/ \u2014 a Depends parameter receives the dependency's return","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/dependencies/utils.py \u2014 add_non_field_param_to_dependency: Request, WebSocket, HTTPConnection, Response, BackgroundTasks, SecurityScopes are injected","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/security/http.py \u2014 HTTPBearer.__call__ returns HTTPAuthorizationCredentials read from the request's Authorization header"],apps:[...vn(["fastapi","fastapi.applications"],"FastAPI"),...vn(["fastapi","fastapi.routing"],"APIRouter")],decorators:[..._f,"api_route"],addRoute:"add_api_route",depends:un(["fastapi","fastapi.params","fastapi.param_functions"],"Depends","Security"),injected:[...un(["fastapi","fastapi.responses","starlette.responses"],"Response","JSONResponse","HTMLResponse","PlainTextResponse","RedirectResponse","StreamingResponse","FileResponse","ORJSONResponse","UJSONResponse","EventSourceResponse"),...un(["fastapi","fastapi.background","starlette.background"],"BackgroundTasks"),...un(["fastapi.security","fastapi.security.oauth2"],"SecurityScopes")],schemes:[...vn(["fastapi.security","fastapi.security.http"],"HTTPBearer"),...vn(["fastapi.security","fastapi.security.http"],"HTTPBasic"),...vn(["fastapi.security","fastapi.security.http"],"HTTPDigest"),...vn(["fastapi.security","fastapi.security.oauth2"],"OAuth2"),...vn(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordBearer"),...vn(["fastapi.security","fastapi.security.oauth2"],"OAuth2AuthorizationCodeBearer"),...vn(["fastapi.security","fastapi.security.open_id_connect_url"],"OpenIdConnect"),...vn(["fastapi.security","fastapi.security.api_key"],"APIKeyHeader"),...vn(["fastapi.security","fastapi.security.api_key"],"APIKeyQuery"),...vn(["fastapi.security","fastapi.security.api_key"],"APIKeyCookie")],forms:un(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordRequestForm","OAuth2PasswordRequestFormStrict")},Bn={id:"flask@3-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://flask.palletsprojects.com/en/stable/api/#flask.Flask.route \u2014 Scaffold.route's decorator calls add_url_rule(rule, endpoint, f) and returns f (flask/sansio/scaffold.py, 3.1.3); get/post/put/delete/patch are route(methods=[\u2026])","https://flask.palletsprojects.com/en/stable/quickstart/#variable-rules \u2014 <converter:variable> sections are passed to the view as keyword arguments (werkzeug/routing/rules.py _part_re)","https://flask.palletsprojects.com/en/stable/api/#flask.request \u2014 the request object for the active context (flask/globals.py: a LocalProxy)"],apps:[...vn(["flask","flask.app"],"Flask"),...vn(["flask","flask.blueprints"],"Blueprint")],decorators:["route","get","post","put","delete","patch"],addRule:"add_url_rule",proxies:["flask.request","flask.globals.request"]},yn={id:"django@6-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://docs.djangoproject.com/en/6.1/topics/http/urls/#how-django-processes-a-request \u2014 the view is called with the HttpRequest, then the captured values (django/urls/resolvers.py, 6.1.1)","https://docs.djangoproject.com/en/6.1/ref/class-based-views/base/#django.views.generic.base.View.dispatch \u2014 as_view()'s view calls dispatch(request, *args, **kwargs), which calls the method named for the verb","https://docs.djangoproject.com/en/3.2/ref/urls/#url \u2014 url() (removed in 4.0) is re_path()","https://www.django-rest-framework.org/api-guide/views/#api_view \u2014 the decorated function is called by a generated APIView's handler with (request, *args, **kwargs) (rest_framework/decorators.py, 3.18.1)","https://docs.djangoproject.com/en/6.1/topics/http/decorators/ \u2014 Django's view decorators; each wrapper calls the view with (request, *args, **kwargs) (django/views/decorators/*.py, django/contrib/auth/decorators.py user_passes_test, django/utils/decorators.py make_middleware_decorator, 6.1.1)"],paths:["django.urls.path","django.urls.conf.path"],regexes:["django.urls.re_path","django.urls.conf.re_path","django.conf.urls.url"],methods:_f,passThrough:[...un(["django.contrib.auth.decorators"],"login_required","login_required()","login_not_required","permission_required()","user_passes_test()"),...un(["django.contrib.admin.views.decorators"],"staff_member_required","staff_member_required()"),...un(["django.views.decorators.http"],"require_http_methods()","require_GET","require_POST","require_safe","condition()","etag()","last_modified()","conditional_page"),...un(["django.views.decorators.csrf"],"csrf_exempt","csrf_protect","requires_csrf_token","ensure_csrf_cookie"),...un(["django.views.decorators.cache"],"cache_page()","cache_control()","never_cache"),...un(["django.views.decorators.vary"],"vary_on_headers()","vary_on_cookie"),...un(["django.views.decorators.clickjacking"],"xframe_options_deny","xframe_options_sameorigin","xframe_options_exempt"),...un(["django.views.decorators.gzip"],"gzip_page"),...un(["django.views.decorators.debug"],"sensitive_post_parameters()","sensitive_variables()"),...un(["django.views.decorators.common"],"no_append_slash")],apiView:"rest_framework.decorators.api_view()",apiViewSetters:un(["rest_framework.decorators"],"renderer_classes()","parser_classes()","authentication_classes()","throttle_classes()","permission_classes()","schema()")};function xf(e){return Bn.proxies.includes(e)?{kind:"source",sourceClass:Bn.sourceClass,model:Bn.id}:null}var hb=[$n.addRoute,Bn.addRule,...new Set([...yn.paths,...yn.regexes].map(e=>e.slice(e.lastIndexOf(".")+1)))],gb=[...new Set([...yn.passThrough,yn.apiView,...yn.apiViewSetters].map(e=>e.split(".")[0]??e))];function bf(e){return{proxies:Bn.proxies.filter(n=>!e(n.split(".")[0]??n)),calls:hb,roots:gb.filter(n=>!e(n))}}import{readdirSync as wf,realpathSync as Sf,statSync as vf}from"node:fs";import kt from"node:path";var Ef=32,yb=512,_b=/^[A-Za-z_][A-Za-z0-9_]*$/u,xb=[".so",".pyd",".dylib"],bo=e=>({resolved:e,failure:null}),ks=e=>({resolved:null,failure:e});function bb(e){if(e.length===0||e.length>yb)return null;let n=e.split(".");return n.length>Ef?null:n.every(t=>_b.test(t))?n:null}function Ca(e){try{return vf(e).isDirectory()}catch{return!1}}function vs(e){try{return vf(e).isFile()}catch{return!1}}var kf=new WeakMap;function ws(e,n,t){let s=kf.get(e);s===void 0&&(s=new Map,kf.set(e,s));let r=s.get(n);if(r===void 0){try{r=new Set(wf(n))}catch{r=null}s.set(n,r)}return r?.has(t)===!0}function gr(e,n){let t,s;try{t=Sf(n),s=Sf(e)}catch{return null}return t===s||t.startsWith(s+kt.sep)?t:null}function Sb(e,n){let t;try{t=wf(e)}catch{return null}for(let s of t)if(s.startsWith(`${n}.`)&&xb.some(r=>s.endsWith(r))&&vs(kt.join(e,s)))return kt.join(e,s);return null}function wt(e,n){let t=bb(n);if(t===null)return ks("refused");let s=null,r=!1;for(let[i,o]of e.roots.entries()){let a=o,d=!1;for(let g of t.slice(0,-1)){let y=kt.join(a,g);if(ws(e,a,g)&&(vs(kt.join(y,"__init__.py"))||Ca(y))){if(!Ca(y)){d=!0;break}a=y;continue}d=!0,ws(e,a,`${g}.py`)&&vs(`${y}.py`)&&(r=!0);break}if(d)continue;let l=t[t.length-1];if(l===void 0)return ks("refused");let c=kt.join(a,l,"__init__.py");if(ws(e,a,l)&&vs(c)){let g=gr(o,c);return g===null?ks("escapes-root"):bo({module:n,kind:"package",path:g,rootIndex:i})}let p=kt.join(a,`${l}.py`);if(ws(e,a,`${l}.py`)&&vs(p)){let g=gr(o,p);return g===null?ks("escapes-root"):bo({module:n,kind:"module",path:g,rootIndex:i})}let u=Sb(a,l);if(u!==null){let g=gr(o,u);return g===null?ks("escapes-root"):bo({module:n,kind:"extension",path:g,rootIndex:i})}let f=kt.join(a,l);if(s===null&&ws(e,a,l)&&Ca(f)){let g=gr(o,f);g!==null&&(s={module:n,kind:"namespace",path:g,rootIndex:i});continue}let h=kt.join(a,`${l}.pyi`);if(s===null&&ws(e,a,`${l}.pyi`)&&vs(h)){let g=gr(o,h);g!==null&&(s={module:n,kind:"stub-only",path:g,rootIndex:i})}}return s!==null?bo(s):ks(r?"not-a-package":"not-found")}function So(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function Es(e,n,t,s){if(t<1||t>Ef)return{failure:"refused"};let r=So(e,n),i=r===""?[]:r.split("."),o=t-1;if(o>i.length)return{failure:"beyond-top-level"};let a=i.slice(0,i.length-o),d=s===null||s===""?[]:s.split("."),l=[...a,...d].join(".");return l===""?{failure:"beyond-top-level"}:{dotted:l}}function yr(e,n,t){if(e===null)return null;let s=i=>i.kind!=="declared-param"?i:i.index>=t?null:n==="none"?{kind:"param",index:i.index}:i.index===0?{kind:"receiver"}:{kind:"param",index:i.index-1},r=[];for(let i of e){let o=s(i.from),a=s(i.to);if(o===null||a===null)return null;r.push({from:o,to:a,kind:i.kind})}return r}var Ta="https://docs.python.org/3.13/",kb=`${Ta}builtins/functions.html#`,Zt=`${Ta}builtins/stdtypes.html#`,dt=e=>`${Ta}library/${e}.html#`;function ko(e){return e===""?[]:e.split(",").map(n=>{if(n==="r")return{kind:"receiver"};let t=n.endsWith("+"),s=Number(t?n.slice(0,-1):n);if(!Number.isSafeInteger(s)||s<0)throw new Error(`runtime table: input ${n}`);return t?{kind:"args-from",index:s}:{kind:"arg",index:s}})}var Af=new Map;function _e(e,n,t){let s=(t.mutates??"").split(";").filter(o=>o!=="").map(o=>{let[a,d]=o.split("<"),l=ko(a??"");if(l.length!==1||l[0]===void 0||d===void 0)throw new Error(`runtime table: mutation ${o}`);return{into:l[0],from:ko(d)}}),r=ko(t.program??""),i=t.returns;Af.set(e,{summary:{id:`python:${e}`,result:ko(t.result),mutates:s,...r.length>0?{callsProgram:r}:{}},...i!==void 0?{returns:i.endsWith("?")?{type:i.slice(0,-1),exact:"inputs"}:{type:i,exact:"always"}}:{},doc:n})}function $a(e,n,t){for(let s of e)_e(s,n(s),t)}var wb=(e,n=e)=>`${kb}${n}`,De=(e,n,t=e)=>_e(`builtins.${e}`,wb(e,t),n);De("len",{result:"0",program:"0",returns:"int"});De("isinstance",{result:"0+",program:"0+",returns:"bool"});De("issubclass",{result:"0+",program:"0+",returns:"bool"});De("callable",{result:"0",returns:"bool"});De("str",{result:"0+",program:"0+",returns:"str?"},"func-str");De("repr",{result:"0",program:"0",returns:"str?"});De("ascii",{result:"0",program:"0",returns:"str?"});De("format",{result:"0+",program:"0+",returns:"str?"});De("bytes",{result:"0+",program:"0+",returns:"bytes?"},"func-bytes");De("int",{result:"0+",program:"0+",returns:"int"});De("float",{result:"0",program:"0",returns:"float"});De("bool",{result:"0",program:"0",returns:"bool"});De("ord",{result:"0",returns:"int"});De("chr",{result:"0",program:"0",returns:"str"});for(let e of["hex","oct","bin"])De(e,{result:"0",program:"0",returns:"str"});De("hash",{result:"0",program:"0",returns:"int"});for(let e of["any","all"])De(e,{result:"0",program:"0",returns:"bool"});for(let e of["abs","reversed","frozenset"])De(e,{result:"0",program:"0"},e==="frozenset"?"func-frozenset":e);for(let e of["round","min","max","sum","enumerate","zip","map","iter","next"])De(e,{result:"0+",program:"0+"});De("range",{result:"0+",program:"0+"},"func-range");De("filter",{result:"1",program:"0+"});De("sorted",{result:"0",program:"0+",returns:"list"});De("list",{result:"0",program:"0",returns:"list"},"func-list");De("tuple",{result:"0",program:"0",returns:"tuple"},"func-tuple");De("dict",{result:"0+",program:"0+",returns:"dict"},"func-dict");De("set",{result:"0",program:"0",returns:"set"},"func-set");var vt=e=>n=>`${e}.${n}`,Ns=e=>n=>`${Zt}${e}.${n}`,vb=["capitalize","center","expandtabs","join","ljust","lower","lstrip","removeprefix","removesuffix","replace","rjust","rstrip","strip","swapcase","title","translate","upper","zfill"],Eb=["endswith","isalnum","isalpha","isascii","isdigit","islower","isspace","istitle","isupper","startswith"],Nb=["count","find","index","rfind","rindex"];for(let e of["str","bytes"]){let n=(t,s)=>{for(let r of t)_e(vt(e)(r),Ns(e)(r),s)};n(vb,{result:"r,0+",program:"0+",returns:e}),n(Eb,{result:"r,0+",program:"0+",returns:"bool"}),n(Nb,{result:"r,0+",program:"0+",returns:"int"}),n(["split","rsplit","splitlines"],{result:"r,0+",program:"0+",returns:"list"}),n(["partition","rpartition"],{result:"r,0+",program:"0+",returns:"tuple"})}$a(["casefold","format","format_map"].map(vt("str")),e=>`${Zt}${e}`,{result:"r,0+",program:"0+",returns:"str"});$a(["isdecimal","isidentifier","isnumeric","isprintable"].map(vt("str")),e=>`${Zt}${e}`,{result:"r",returns:"bool"});_e("str.encode",`${Zt}str.encode`,{result:"r,0+",program:"0+",returns:"bytes?"});_e("bytes.decode",`${Zt}bytes.decode`,{result:"r,0+",program:"0+",returns:"str?"});_e("bytes.hex",`${Zt}bytes.hex`,{result:"r,0+",program:"0+",returns:"str"});var As=Ns("dict");_e("dict.get",As("get"),{result:"r,1",program:"r,0"});_e("dict.pop",As("pop"),{result:"r,1",program:"r,0"});_e("dict.setdefault",As("setdefault"),{result:"r,1",mutates:"r<0,1",program:"r,0"});_e("dict.update",As("update"),{result:"",mutates:"r<0+",program:"r,0+"});$a(["keys","values","items","popitem"].map(vt("dict")),e=>`${Zt}${e}`,{result:"r"});_e("dict.copy",As("copy"),{result:"r",returns:"dict"});_e("dict.clear",As("clear"),{result:""});var Et=Ns("list");_e("list.append",Et("append"),{result:"",mutates:"r<0"});_e("list.extend",Et("extend"),{result:"",mutates:"r<0",program:"0"});_e("list.insert",Et("insert"),{result:"",mutates:"r<1",program:"0"});_e("list.pop",Et("pop"),{result:"r",program:"0"});_e("list.remove",Et("remove"),{result:"",program:"r,0"});_e("list.sort",Et("sort"),{result:"",program:"r,0+"});_e("list.reverse",Et("reverse"),{result:""});_e("list.clear",Et("clear"),{result:""});_e("list.copy",Et("copy"),{result:"r",returns:"list"});for(let e of["list","tuple"])for(let n of["index","count"])_e(vt(e)(n),Ns(e)(n),{result:"r,0+",program:"r,0+",returns:"int"});var Is=Ns("set"),La=Ns("frozenset");_e("set.add",Is("add"),{result:"",mutates:"r<0",program:"0"});_e("set.update",Is("update"),{result:"",mutates:"r<0+",program:"0+"});for(let e of["intersection_update","difference_update","symmetric_difference_update"])_e(vt("set")(e),Is(e),{result:"",mutates:"r<0+",program:"r,0+"});for(let e of["discard","remove"])_e(vt("set")(e),Is(e),{result:"",program:"r,0"});_e("set.pop",Is("pop"),{result:"r"});_e("set.clear",Is("clear"),{result:""});_e("set.copy",La("copy"),{result:"r",returns:"set"});for(let e of["union","intersection","difference","symmetric_difference"])_e(vt("set")(e),La(e),{result:"r,0+",program:"r,0+",returns:"set"});for(let e of["issubset","issuperset","isdisjoint"])_e(vt("set")(e),La(e),{result:"r,0+",program:"r,0+",returns:"bool"});_e("json.loads",`${dt("json")}json.loads`,{result:"0+",program:"0+"});_e("json.dumps",`${dt("json")}json.dumps`,{result:"0+",program:"0+"});_e("copy.copy",`${dt("copy")}copy.copy`,{result:"0",program:"0"});_e("copy.deepcopy",`${dt("copy")}copy.deepcopy`,{result:"0+",mutates:"1<0",program:"0+"});for(let e of["b64encode","b64decode","standard_b64encode","standard_b64decode","urlsafe_b64encode","urlsafe_b64decode"])_e(`base64.${e}`,`${dt("base64")}base64.${e}`,{result:"0+",program:"0+",returns:"bytes"});_e("unicodedata.normalize",`${dt("unicodedata")}unicodedata.normalize`,{result:"0+",returns:"str?"});for(let e of["category","bidirectional"])_e(`unicodedata.${e}`,`${dt("unicodedata")}unicodedata.${e}`,{result:"0",returns:"str"});for(let e of["bisect_left","bisect_right","bisect"])_e(`bisect.${e}`,`${dt("bisect")}bisect.${e}`,{result:"0+",program:"0+",returns:"int"});for(let e of["insort_left","insort_right","insort"])_e(`bisect.${e}`,`${dt("bisect")}bisect.${e}`,{result:"",mutates:"0<1",program:"0+"});for(let e of["join","basename","dirname","normpath","splitext","split"])_e(`os.path.${e}`,`${dt("os.path")}os.path.${e}`,{result:"0+",program:"0+"});var Nf=new Set(["str","bytes","int","float","complex","bool","none","scalar"]),Ab=new Set(["str","bytes","int","float","complex","bool","tuple","list","dict","set"]),Zn={decl:"unknown"},Ib=8;function If(e,n){let t=new Map,s=c=>c==null||c.unlessWritten!==void 0&&n.written(c.unlessWritten)?null:{type:c.type,exact:!0},r=(c,p)=>c.get(Ma(p))?.value??null,i=(c,p,u)=>{if(u>Ib)return Zn;let f=n.decls.get(c),h=f?.moduleBindings?.get(p),g=e.packageOf(c);if(h==="def"||h==="class")return g===void 0?Zn:{decl:g===""?"app":"dependency"};if(h!=="import"||f?.aliases.get(p)?.rows!==1)return Zn;let y=n.envs.get(c),_=y?.names.get(p);if(_!==void 0)return i(_.moduleId,_.name,u+1);let b=y?.externalOrigins?.get(p);return b!==void 0?o(b,u+1):Zn},o=(c,p)=>{let u=c.split(".");for(let h=u.length;h>=1;h-=1){let g=e.placed(u.slice(0,h).join("."));if(g===null)continue;if(g.kind==="surface")return{decl:"dependency"};let y=u.slice(h);return y.length===1&&y[0]!==void 0?i(g.id,y[0],p):Zn}let f=u[0];return f!==void 0&&e.stdlib.has(f)?{decl:"runtime",identity:c}:Zn},a=(c,p)=>{if(p.startsWith("~")){let y=e.packageOf(c);return y===void 0?Zn:{decl:y===""?"app":"dependency"}}let u=p,f=/^\.+/u.exec(p)?.[0].length??0;if(f>0){let y=e.dottedOf(c);if(y===void 0)return Zn;let _=p.slice(f),b=Es(y.dotted,y.isPackage,f,_===""?null:_);if("failure"in b)return Zn;u=b.dotted}let[h,g]=u.split(".");return h==="builtins"?g!==void 0&&e.builtins.has(g)?{decl:"runtime",identity:u}:Zn:o(u,0)},d=(c,p,u)=>{let g=(p.args??[]).map((N,v)=>{let C=p.argProofs?.[v],R=C?.unlessWritten===void 0?s(C):null;return R!==null||N.kind!=="positional"?R:r(u,N)}).map(N=>N!==null&&N.exact&&Nf.has(N.type)),y=p.attr===null||p.receiverRange===null?null:s(p.receiverProof)??r(u,p.receiverRange),_=y!==null&&y.exact&&Nf.has(y.type),b=Zn;y!==null&&p.attr!==null?Ab.has(y.type)&&e.typeAttrs.get(y.type)?.has(p.attr)===!0&&(b={decl:"runtime",identity:`${y.type}.${p.attr}`,method:!0}):p.calleeOrigin!==null&&(b=a(c,p.calleeOrigin));let x=b.identity===void 0?void 0:Af.get(b.identity),k=x?.summary;k!==void 0&&b.method===!0&&y?.exact!==!0&&(k={...k,callsProgram:[{kind:"receiver"},...k.callsProgram??[]]});let w=x?.returns,I=w===void 0?void 0:{type:w.type,exact:w.exact==="always"||g.every(Boolean)&&(b.method!==!0||_)};return{calleeDecl:b.decl,...b.identity!==void 0?{runtimeId:`python:${b.identity}`}:{},...k!==void 0?{summary:k}:{},..._?{receiverPrimitive:!0}:{},argPrimitive:g,...I!==void 0?{value:I}:{}}},l=c=>{let p=t.get(c);if(p!==void 0)return p;let u=new Map,f=g=>g.range.end-g.range.start,h=[...n.calls.get(c)??[]].sort((g,y)=>f(g)-f(y)||g.range.start-y.range.start);for(let g of h)f(g)>0&&u.set(Ma(g.range),d(c,g,u));return t.set(c,u),u};return(c,p)=>{let u=l(c),f=u.get(Ma(p.range))??d(c,p,u),{value:h,...g}=f;return g}}function Ma(e){return`${String(e.start)}-${String(e.end)}`}var Ba="<toplevel>",Tf=64,Rb=new Set(["self","cls"]),Ao=8,Ob=new Set(["__new__","__init_subclass__","__class_getitem__"]),Io=new Set(["__del__","__repr__","__str__","__bytes__","__format__","__lt__","__le__","__eq__","__ne__","__gt__","__ge__","__hash__","__bool__","__getattr__","__getattribute__","__setattr__","__delattr__","__dir__","__get__","__set__","__delete__","__init_subclass__","__set_name__","__mro_entries__","__prepare__","__instancecheck__","__subclasscheck__","__class_getitem__","__call__","__len__","__length_hint__","__getitem__","__setitem__","__delitem__","__missing__","__iter__","__reversed__","__contains__","__add__","__sub__","__mul__","__matmul__","__truediv__","__floordiv__","__mod__","__divmod__","__pow__","__lshift__","__rshift__","__and__","__xor__","__or__","__radd__","__rsub__","__rmul__","__rmatmul__","__rtruediv__","__rfloordiv__","__rmod__","__rdivmod__","__rpow__","__rlshift__","__rrshift__","__rand__","__rxor__","__ror__","__iadd__","__isub__","__imul__","__imatmul__","__itruediv__","__ifloordiv__","__imod__","__ipow__","__ilshift__","__irshift__","__iand__","__ixor__","__ior__","__neg__","__pos__","__abs__","__invert__","__complex__","__int__","__float__","__index__","__round__","__trunc__","__floor__","__ceil__","__enter__","__exit__","__buffer__","__release_buffer__","__await__","__aiter__","__anext__","__aenter__","__aexit__","__next__","__fspath__","__post_init__","__copy__","__deepcopy__","__reduce__","__reduce_ex__","__getstate__","__setstate__","__getnewargs__","__getnewargs_ex__","__subclasshook__","__sizeof__","_missing_","_generate_next_value_"]),$f=new Set(["__getattr__","__dir__"]),Pb=new Set(["property","cached_property","abstractproperty","getter","setter","deleter"]),Cb=e=>e.some(n=>n!==null&&Pb.has(n.split(".").pop()??n)),Rf=["__new__","__init__"],Lf=new Set(["object","BaseException","Exception","ArithmeticError","AssertionError","AttributeError","BufferError","EOFError","FloatingPointError","ImportError","IndexError","KeyError","LookupError","MemoryError","ModuleNotFoundError","NameError","NotImplementedError","OSError","OverflowError","RecursionError","ReferenceError","RuntimeError","StopAsyncIteration","StopIteration","SystemError","TimeoutError","TypeError","UnboundLocalError","UnicodeError","ValueError","ZeroDivisionError","Warning","UserWarning","DeprecationWarning","RuntimeWarning"]),Eo=new Set([...Lf,"type","dict","list","set","frozenset","tuple","str","bytes","bytearray","int","float","complex"]),Mb=new Map([["keys","any"],["get","mapping"],["close","iterator"]]),Df=new Set(["excepthook","unraisablehook","displayhook","breakpointhook","__import__"]),Tb=new Map([["dataclass",{module:"dataclasses",name:"dataclass"}],["dataclasses.dataclass",{module:"dataclasses",name:null}],["total_ordering",{module:"functools",name:"total_ordering"}],["functools.total_ordering",{module:"functools",name:null}],["unique",{module:"enum",name:"unique"}],["enum.unique",{module:"enum",name:null}],["final",{module:"typing",name:"final"}],["typing.final",{module:"typing",name:null}]]),Of=new Map([["ABCMeta",{module:"abc",name:"ABCMeta"}],["abc.ABCMeta",{module:"abc",name:null}],["type",null]]);function _r(e,n){return{path:e,start:n.start,end:n.end}}function Pf(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function za(e,n,t,s){let r=[],i=[],o=[],a=[],d=new Map,l=new Map,c=new Map,p=new Map,u=new Map,f=new Map,h=new Map,g=new Map,y=new Map,_=new Map,b=new Set,x=new Set,k=new Set,w=new Map,I=new Set,N=new Map,v=A=>{let j=new Map;for(let ne of A)j.set(ne,(j.get(ne)??0)+1);return j},C=v(e.functions.map(A=>A.qualname)),R=v(e.classes.map(A=>A.qualname)),F=new Map(e.classes.map(A=>[A.qualname,A])),P=jb(e),U=(A,j)=>j!==void 0&&Fb(A,j,e.moduleBindings,P),E=A=>!A.rebound&&A.decorators.every(j=>j!==null&&U(j,Tb.get(j)))&&(A.metaclass===null||U(A.metaclass,Of.get(A.metaclass))),T=`${n}#${Ba}`,K=yr(e.toplevelFlows,"none",0);r.push({id:T,moduleId:n,name:Ba,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1,...K!==null?{valueFlows:K}:{}});let J=new Set,W=new Set,se=new Set,Y=new Map,V=new Map,fe=new Map;for(let A of e.classes){let j=`${n}#class:${A.qualname}`;A.decorators.length>0&&se.add(j),fe.has(j)||fe.set(j,A.range.start),c.set(A.qualname,j),_.set(j,A.qualname),A.bases.length>1&&b.add(j),A.interceptsLookup&&x.add(j),w.set(j,A.nonDefBinds),N.set(j,A.valueBases),(!E(A)||R.get(A.qualname)!==1)&&I.add(j),A.metaclass!==null&&!U(A.metaclass,Of.get(A.metaclass))&&k.add(j);let ne=u.get(j),X=A.valueBases??A.bases;u.set(j,ne===void 0?[...X]:[...ne,...X]);let D=A.qualname.includes(".")?A.qualname:A.name;i.push({id:j,moduleId:n,name:D,implementsRefs:[],members:[]})}for(let A of e.functions){let j=`${n}#${A.qualname}`;d.set(A.qualname,j),g.set(A.qualname,A.params===null?null:new Set(A.params.map(ae=>ae.name)));let ne=A.enclosingClass,X=ne!==null&&A.qualname===`${ne}.${A.name}`,D=X?c.get(ne):void 0,$=ne===null&&A.enclosingFunction===null,L=!$&&!X&&A.qualname===`${A.enclosingFunction??""}.${A.name}`?A.enclosingFunction:null,H=$?Pf(A.name,e.all):X&&!ne.includes(".")?Pf(ne,e.all):!1,z=X?F.get(ne):void 0,Z=C.get(A.qualname)===1&&(z===void 0||R.get(z.qualname)===1)?Db(A,z===void 0?void 0:E(z),t):null;if(Z!==null&&y.set(j,Z.kind),Y.set(j,A.name),A.decorators.length>0&&W.add(j),V.get(j)!=="other"&&V.set(j,A.decorated),(X?Io.has(A.name)||Cb(A.decorators):$&&$f.has(A.name))&&J.add(j),r.push({id:j,moduleId:n,name:$||X?A.name:A.qualname,kind:D!==void 0?A.name==="__init__"?"ctor":"method":"function",...D!==void 0?{enclosingClassId:D}:{},declRange:_r(t,A.range),isExported:H,publicSurfaceReachable:H,...Z!==null?Z.fields:{}}),$&&(l.set(A.name,j),H)){let ae=s();o.push({id:ae,moduleId:n,exportedName:A.name,kind:"value"}),a.push({exportId:ae,target:{kind:"function",functionId:j}})}if(X){let ae=p.get(ne)??new Map;ae.set(A.name,j),p.set(ne,ae)}if(L!==null){let ae=f.get(L)??new Map;ae.set(A.name,j),f.set(L,ae)}!$&&!X&&h.set(A.name,[...h.get(A.name)??[],j])}let S=i.map(A=>{let j=[...c.entries()].find(([,X])=>X===A.id)?.[0],ne=j===void 0?void 0:p.get(j);return ne===void 0?A:{...A,members:[...ne.values()]}});return{moduleId:n,functions:r,classes:S,exports:o,exportBindings:a,byQualname:d,topLevel:l,classByName:c,methods:p,baseSlots:u,nested:f,closures:h,paramNames:g,all:e.all,allComputed:e.allComputed,toplevelId:T,callable:y,moduleBindings:e.moduleBindings,aliases:P,classQualname:_,multiBase:b,intercepts:x,customMeta:k,nonDefBinds:w,rewrites:I,valueBases:N,starImport:e.starImport,attrWrites:e.attrWrites,implicitRoots:J,decoratedDefs:W,decoration:V,classStarts:fe,decoratedClasses:se,defNames:Y,valueNames:e.valueNames,valueAttrs:e.valueAttrs,computedAccess:e.computedAccess,classBinds:e.classBinds,moduleBinds:e.moduleBinds,dunderWrites:e.dunderWrites,importRenames:e.imports.flatMap(A=>A.form==="from"?A.names.flatMap(j=>j.asname!==null?[[j.asname,j.name]]:[]):[])}}function $b(e,n){let t=new Set,s=!1;for(let o of e.values())if(o.attrWrites===null)s=!0;else for(let a of o.attrWrites)t.add(a);let r=t.has("__class__")||t.has("__getattribute__"),i=new Map;for(let[o,a]of e){let d=new Map;for(let c of a.functions){let p=a.callable.get(c.id);if(p===void 0||s||c.name!==void 0&&t.has(c.name))continue;let u=p!=="function";u&&r||u&&c.enclosingClassId!==void 0&&n.has(c.enclosingClassId)||d.set(c.id,p)}if(d.size===a.callable.size){i.set(o,a);continue}let l=a.functions.map(c=>{if(!a.callable.has(c.id)||d.has(c.id))return c;let{params:p,receiver:u,reflectiveArguments:f,valueFlows:h,...g}=c;return g});i.set(o,{...a,functions:l,callable:d})}return i}var _n={kind:"unknown"},No={kind:"external"};function Ka(e,n,t,s,r=0,i=new Set){let[o,...a]=e;if(o===void 0||r>Ao)return _n;let d=`${n}${e.join(".")}`;if(i.has(d))return _n;i.add(d);let l=t.get(n),c=l?.moduleBindings;if(l===void 0||c===void 0||c===null)return _n;let p=c.get(o);if(p===void 0)return r===0&&!l.starImport?No:_n;if(p==="class"){let y=a.length===0?l.classByName.get(o):void 0;return y===void 0?_n:{kind:"class",id:y}}let u=l.aliases.get(o);if(p!=="import"||u?.rows!==1)return _n;let f=s.get(n),h=f?.names.get(o);if(h!==void 0)return Ka([h.name,...a],h.moduleId,t,s,r+1,i);let g=f?.modules.get(o);return g!==void 0?u.exactModule&&a.length>0?Ka(a,g,t,s,r+1,i):_n:f?.external?.has(o)===!0?No:_n}function Lb(e,n){let t=new Map,s=new Map,r=[],i=(o,a,d)=>{let l=o.get(a);l===void 0?o.set(a,[d]):l.push(d)};for(let[o,a]of e)for(let[d,l]of a.classByName){let c=a.valueBases.get(l);if(c==null){r.push(l);continue}if(d.includes(".")){c.length>0&&r.push(l);continue}let p=!0;for(let u of c){let f=u===null?_n:Ka(u.split("."),o,e,n);f.kind==="unknown"&&(p=!1),f.kind==="class"&&(i(t,f.id,l),i(s,l,f.id))}p||r.push(l)}return{sub:t,sup:s,unknown:es(r,t)}}function es(e,n){let t=new Set,s=[...e];for(let r=s.pop();r!==void 0;r=s.pop())if(!t.has(r)){t.add(r);for(let i of n.get(r)??[])s.push(i)}return t}function Db(e,n,t){if(e.params===null||e.rebound)return null;let s;if(e.method){if(n!==!0)return null;if(e.decorated==="staticmethod")s="static-method";else if(e.decorated==="classmethod")s="class-method";else if(e.decorated==="none"&&!Ob.has(e.name))s="instance-method";else return null}else{if(e.decorated!=="none")return null;s="function"}let r=e.params;if(s==="instance-method"||s==="class-method"){let o=r[0];if(o===void 0||o.kind!=="positional"&&o.kind!=="positional-only")return null;r=r.slice(1)}let i=yr(e.valueFlows,r.length<e.params.length?"first":"none",e.params.length);return{kind:s,fields:{params:r.map((o,a)=>({index:a,kind:o.kind==="positional-only"?"positional":o.kind,...o.kind==="positional-only"?{}:{name:o.name},destructured:!1,hasDefault:o.hasDefault,range:{path:t,start:o.start,end:o.end}})),receiver:s==="instance-method"||s==="class-method"?"call":"none",reflectiveArguments:e.reflective,...i!==null?{valueFlows:i}:{}}}}function Fb(e,n,t,s){if(t===null)return!1;if(n===null)return!t.has(e);let r=e.split(".")[0]??e,i=s.get(r)?.source;return t.get(r)!=="import"||i===void 0||i.level!==0?!1:n.name===null?i.form==="import"&&i.name===n.module&&r===n.module:i.form==="from"&&i.module===n.module&&i.name===n.name&&r===n.name}function jb(e){let n=new Map,t=(s,r,i)=>{let o=n.get(s);n.set(s,o===void 0?{rows:1,exactModule:r,...i!==void 0?{source:i}:{}}:{rows:o.rows+1,exactModule:!1})};for(let s of e.imports)for(let r of s.names){let i={form:s.form,module:s.module,level:s.level,name:r.name};s.form==="import"?t(r.asname??r.name.split(".")[0]??r.name,r.asname!==null||!r.name.includes("."),r.asname===null?i:void 0):t(r.asname??r.name,!0,r.asname===null?i:void 0)}return n}function Ua(e){let{envs:n}=e,t=e.children??new Map,s=Bb(e.decls,{decls:e.decls,envs:n,children:t}),{inheritEdges:r}=s,i=Lb(e.decls,n),o=[];for(let $ of e.decls.values())o.push(...$.customMeta);let a=es(o,i.sub),d=new Set(a);if(o.length>0)for(let $ of i.unknown)d.add($);let l=$b(e.decls,d),c=new Map,p=($,L)=>{let H=c.get($)??[];H.includes(L)||H.push(L),c.set($,H)};for(let $ of l.values()){for(let L of $.methods.values())for(let[H,z]of L)p(H,z);for(let[L,H]of $.closures)for(let z of H)p(L,z)}for(let $ of e.rebinds??[]){let L=l.get($.moduleId)?.topLevel.get($.target);L!==void 0&&p($.attr,L)}let u=new Map;for(let $ of l.values())for(let L of $.classByName.values())u.set(L,$);let f=new Map,h=new Set,g=new Set,y=new Set(a),_=new Map;for(let $ of l.values()){for(let[L,H]of $.callable)f.set(L,H);for(let L of $.multiBase)h.add(L);for(let L of $.intercepts)g.add(L);for(let L of $.rewrites)y.add(L);for(let[L,H]of $.nonDefBinds)_.set(L,H)}let b=$=>{let L=_.get($),H=u.get($),z=H?.classQualname.get($);return L==null||H===void 0||z===void 0?null:new Set([...L,...H.methods.get(z)?.keys()??[]])},x=[],k=new Map;for(let $ of i.unknown){let L=new Set,H=!1;for(let z of es([$],i.sup)){let Z=b(z);if(Z===null||y.has(z)||g.has(z)){H=!0;break}for(let ie of Z)L.add(ie)}if(H){x.push($);continue}for(let z of L){let Z=k.get(z);Z===void 0?k.set(z,[$]):Z.push($)}}let w=$=>{let L=new Map;return H=>{let z=L.get(H);return z===void 0&&(z=es([H],$),L.set(H,z)),z}},I={decls:l,envs:n,kindOf:f,classOwner:u,multiBase:h,intercepts:g,rewrites:y,nonDefBinds:_,below:w(i.sub),above:w(i.sup),unplaced:i.unknown,unplacedAnyName:x,unplacedByName:k},N=[],v=[],C=0,R=0,F=new Set,P=!1,U=new Map;for(let $ of l.values()){if($.attrWrites===null)P=!0;else for(let L of $.attrWrites)F.add(L);for(let[L,H]of $.closures)U.set(L,[...U.get(L)??[],...H])}let E=new Set;for(let $ of l.values())for(let L of $.decoratedClasses)E.add(L);let T=new Map;for(let $ of l.values())for(let[L,H]of $.decoration)T.set(L,H);let K={hier:s,rewrites:y,decorated:E},J={byMethodName:c,children:t,selfTargets:Kb(s,c,{installable:$=>P||F.has($),closures:U,intercepts:g}),construct:Wb(K,$=>P||F.has($)),written:$=>P||F.has($),decoration:$=>T.get($)??"other"},W=new Map;for(let{moduleId:$,call:L}of e.pending){let H=W.get($);H===void 0?W.set($,[L]):H.push(L)}let se=e.runtime===void 0?void 0:If(e.runtime,{decls:l,envs:n,written:J.written,calls:W}),Y=new Set,V=new Map,fe=[];for(let $ of e.pending){let{moduleId:L,path:H,call:z}=$,Z=l.get(L);if(Z===void 0)continue;if(z.raisedCall!==null){fe.push($);continue}let ie=z.enclosingFunction===null?Z.toplevelId:Z.byQualname.get(z.enclosingFunction)??Z.toplevelId,ae=Qb(z,L,Z,n.get(L),l,n,J),pe=nS(z,L,Z,ae,I);ae.how==="name-match"&&ae.resolution!=="unresolved"&&pe.direct.size===0&&(ae=Qt(ae)),V.set(`${L}${String(z.range.start)}${String(z.range.end)}`,ae);let he=`py-call:${L}:${String(C)}`;C+=1;let we=ae.resolution==="unresolved";we&&(R+=1,z.attr!==null&&Y.add(z.attr),pe=fn);let Ne=se?.(L,z);N.push({id:he,enclosingFunctionId:ie,calleeExprShape:z.receiver===null?"identifier":"member",resolvedTargetIds:we?[]:ae.ids,resolution:ae.resolution,range:_r(H,z.range),...sS(H,z,pe.convention,Ne?.argPrimitive),...oS(Ne)});for(let Ie of ae.ids)v.push({callSiteId:he,calleeFunctionId:Ie,resolution:we?"field-based":ae.resolution,...pe.direct.has(Ie)?{invocation:"direct"}:{}})}for(let{moduleId:$,path:L,call:H}of fe){let z=l.get($),Z=H.raisedCall;if(z===void 0||Z===null)continue;let ie=V.get(`${$}${String(Z.start)}${String(Z.end)}`);if(ie===void 0||ie.how==="construct"||ie.ids.length===0)continue;let ae=`py-raise:${$}:${String(C)}`;C+=1,R+=1,N.push({id:ae,enclosingFunctionId:H.enclosingFunction===null?z.toplevelId:z.byQualname.get(H.enclosingFunction)??z.toplevelId,calleeExprShape:"unknown",resolvedTargetIds:[],resolution:"unresolved",range:_r(L,H.range)})}let S=new Map;for(let $ of e.loads??[]){let L=[$.moduleId,$.enclosingFunction??"",String($.at),$.shape].join(""),H=S.get(L);if(H===void 0)S.set(L,{load:$,targets:new Set($.targets)});else for(let z of $.targets)H.targets.add(z)}let A=0;for(let{load:$,targets:L}of S.values()){let H=l.get($.moduleId);if(H===void 0)continue;let z=new Set;for(let ie of L){let ae=l.get(ie)?.toplevelId;ae!==void 0&&z.add(ae)}if(z.size===0)continue;let Z=`py-load:${$.moduleId}:${String(A)}`;A+=1,N.push({id:Z,enclosingFunctionId:$.enclosingFunction===null?H.toplevelId:H.byQualname.get($.enclosingFunction)??H.toplevelId,calleeExprShape:$.shape,resolvedTargetIds:[...z],resolution:"resolved",range:{path:$.path,start:$.at,end:$.at}});for(let ie of z)v.push({callSiteId:Z,calleeFunctionId:ie,resolution:"resolved"})}let j=[...l.values()].flatMap($=>$.functions),ne=new Map(j.map($=>[$.id,$.declRange])),X=new Set;for(let $ of N)for(let L of $.resolvedTargetIds)X.add(`${$.enclosingFunctionId}${L}`);for(let[$,L]of l)for(let[H,z]of L.nested){let Z=L.byQualname.get(H);if(Z!==void 0)for(let ie of z.values()){let ae=ne.get(ie);if(ae===void 0||X.has(`${Z}${ie}`))continue;let pe=`py-closure:${$}:${String(C)}`;C+=1,N.push({id:pe,enclosingFunctionId:Z,calleeExprShape:"identifier",resolvedTargetIds:[ie],resolution:"field-based",range:{path:ae.path,start:ae.start,end:ae.start}}),v.push({callSiteId:pe,calleeFunctionId:ie,resolution:"field-based"})}}let D=($,L,H,z,Z=$.toplevelId)=>{let ie=[...new Set(H)];if(ie.length===0&&!z)return;let ae=`py-implicit:${$.moduleId}:${String(C)}`;C+=1,z&&(R+=1),N.push({id:ae,enclosingFunctionId:Z,calleeExprShape:"unknown",resolvedTargetIds:z?[]:ie,resolution:z?"unresolved":"field-based",range:{path:L.path,start:L.start,end:L.start}});for(let pe of ie)v.push({callSiteId:ae,calleeFunctionId:pe,resolution:"field-based"})};for(let $ of l.values()){for(let z of $.implicitRoots){let Z=ne.get(z);Z!==void 0&&D($,Z,[z],!1)}let L=ne.get($.toplevelId)?.path??String($.moduleId),H=(z,Z)=>{let ie=n.get($.moduleId),ae=Xb(z,{d:$,env:ie,classQual:Z,decls:l,envs:n,facts:K});ae!==null&&D($,{path:L,start:z.at},ae.ids,ae.unnamed)};for(let[z,Z]of $.classBinds??[])for(let ie of Z)H(ie,z);for(let z of $.moduleBinds??[])$f.has(z.name)&&H(z,null);for(let z of $.dunderWrites??[])(Io.has(z.name)||Df.has(z.name))&&H(z,null);for(let[z,Z]of $.classByName){let ie=$.methods.get(z);for(let[ae,pe]of Mb){let he=ie?.get(ae),we=he===void 0?void 0:ne.get(he);if(he===void 0||we===void 0)continue;(pe==="any"||pe==="mapping"&&Da(s,Z,zb).leaves||pe==="iterator"&&Da(s,Z,Eo,"__next__").reaches)&&D($,we,[he],!1)}if(Da(s,Z,Eo).leaves){let ae=$.classStarts.get(Z);ae!==void 0&&D($,{path:L,start:ae},[],!0,Ub($,z))}}}return{functions:Yb(l,Y),callSites:N,callEdges:v,inheritEdges:r,unresolved:R}}function Ff(e,n){return e===void 0?!1:e.allComputed?!0:e.all!==null?e.all.includes(n):!n.startsWith("_")}function vo(e,n,t,s=0,r=new Set){let[i,...o]=e;if(i===void 0||s>Ao)return _n;let a=`${n}${e.join(".")}`;if(r.has(a))return _n;r.add(a);let d=t.decls.get(n);if(d===void 0)return _n;let l=d.classByName.get(e.join("."));if(l!==void 0)return{kind:"class",id:l};let c=t.envs.get(n),p=c?.names.get(i);if(p!==void 0){let u=vo([p.name,...o],p.moduleId,t,s+1,r);if(u.kind!=="unknown")return u}if(o.length>0){let u=c?.modules.get(i)??t.children.get(n)?.get(i);if(u!==void 0){let f=vo(o,u,t,s+1,r);if(f.kind!=="unknown")return f}}if(c?.external?.has(i)===!0)return No;for(let u of c?.stars??[]){if(!Ff(t.decls.get(u),i))continue;let f=vo(e,u,t,s+1,r);if(f.kind!=="unknown")return f}return s===0&&d.moduleBindings!==null&&!d.moduleBindings.has(i)&&!d.starImport?No:_n}var jf=256;function Bb(e,n){let t=[],s=new Map,r=new Map,i=new Map,o=new Map,a=[],d=(h,g,y)=>{let _=h.get(g);_===void 0?h.set(g,[y]):_.push(y)};for(let[h,g]of e)for(let[y,_]of g.classByName){o.set(_,g);let b=g.baseSlots.get(_)??[],x=b.map(w=>w===null?_n:vo(w.split("."),h,n));y.includes(".")&&b.length>0&&x.push(_n),s.set(_,x),x.some(w=>w.kind==="unknown")&&a.push(_);let k=new Set;for(let w of x)w.kind==="class"&&k.add(w.id);for(let w of k)t.push({subclassId:_,superclassId:w,relation:"extends"}),d(r,w,_),d(i,_,w)}let l=es(a,r),c=new Map;for(let h of es(l,i)){let g=o.get(h),y=g?.classQualname.get(h),_=y===void 0?void 0:g?.methods.get(y);for(let[b,x]of _??[]){let k=c.get(b);k===void 0?c.set(b,[x]):k.push(x)}}let p=new Map,u=(h,g)=>{let y=p.get(h);if(y!==void 0)return y;if(g>jf)return 2;p.set(h,0);let _=0;for(let x of s.get(h)??[])if(_+=x.kind==="unknown"?1:x.kind==="class"?u(x.id,g+1):0,_>=2)break;let b=Math.min(_,2);return p.set(h,b),b},f=!1;for(let h of l)if(u(h,0)>=2){f=!0;break}return{inheritEdges:t,basesOf:s,subclassesOf:r,classOwner:o,unplacedDefs:c,unplacedMixin:f}}function qa(e,n,t){let s=e.classOwner.get(n),r=s?.classQualname.get(n);return r===void 0?void 0:s?.methods.get(r)?.get(t)}function Ha(e,n,t){let s=new Set,r=!1,i=!1,o=!1,a=new Set,d=[...n];for(let l=d.pop();l!==void 0;l=d.pop()){if(a.has(l))continue;a.add(l);let c=qa(e,l,t);c!==void 0&&s.add(c);let p=e.classOwner.get(l),u=p?.nonDefBinds.get(l);if(u===null||u?.has(t)===!0)i=!0;else if(c===void 0){let f=p?.baseSlots.get(l)??[];for(let[h,g]of(e.basesOf.get(l)??[]).entries())g.kind==="class"?d.push(g.id):g.kind==="unknown"?r=!0:(p===void 0||!Wa(Lf,f[h],p))&&(o=!0)}}return{ids:s,open:r,alias:i,outside:o}}function Kb(e,n,t){let s=new Map,r=new Map;return(i,o)=>{let a=`${i}${o}`,d=r.get(a);if(d!==void 0)return d;let l=s.get(i);l===void 0&&(l=es([i],e.subclassesOf),s.set(i,l));let{ids:c,open:p,alias:u,outside:f}=Ha(e,l,o),h=u,g=k=>{c.has(k)||(c.add(k),h=!0)};for(let k of e.unplacedDefs.get(o)??[])g(k);let y=t.installable(o)?t.closures.get(o)??[]:[];for(let k of y)g(k);let _="self",b;if(p||e.unplacedMixin){let k=new Set([...c,...n.get(o)??[]]);if(k.size<=Tf){if(k.size>c.size||p){for(let w of k)c.add(w);h=!0,_="name-match"}}else p&&(y.length>0||[...l].some(I=>qa(e,I,o)!==void 0)||(b=ns),h=!0)}let x=!h&&!p&&!f&&!e.unplacedMixin&&!qb(e,l,t.intercepts);return b??=c.size===0?ns:{ids:[...c],resolution:x?c.size===1?"resolved":"field-based":"unresolved",how:_},r.set(a,b),b}}var zb=new Set([...Eo].filter(e=>e!=="dict"));function Da(e,n,t,s){let r=!1,i=!1,o=new Set,a=[n];for(let d=a.pop();d!==void 0;d=a.pop()){if(o.has(d))continue;o.add(d);let l=e.classOwner.get(d);if(s!==void 0){let p=l?.nonDefBinds.get(d);(qa(e,d,s)!==void 0||p===null||p?.has(s)===!0)&&(i=!0)}let c=l?.baseSlots.get(d)??[];for(let[p,u]of(e.basesOf.get(d)??[]).entries())u.kind==="class"?a.push(u.id):(u.kind==="unknown"||l===void 0||!Wa(t,c[p],l))&&(r=!0)}return{leaves:r,reaches:r||i}}function Ub(e,n){for(let t=n;t.includes(".");){t=t.slice(0,t.lastIndexOf("."));let s=e.byQualname.get(t);if(s!==void 0)return s}return e.toplevelId}function qb(e,n,t){if(t.size===0)return!1;let s=new Set,r=[...n];for(let i=r.pop();i!==void 0;i=r.pop())if(!s.has(i)){if(s.add(i),t.has(i))return!0;for(let o of e.basesOf.get(i)??[])o.kind==="class"&&r.push(o.id)}return!1}var Wa=(e,n,t)=>typeof n=="string"&&e.has(n)&&t.moduleBindings!==null&&!t.moduleBindings.has(n)&&!t.starImport,Hb=(e,n)=>Wa(Eo,e,n);function Bf(e,n){let t=new Set,s=[e];for(let r=s.pop();r!==void 0;r=s.pop()){if(t.has(r))continue;if(t.add(r),t.size>jf||n.rewrites.has(r)||n.decorated.has(r))return!1;let i=n.hier.classOwner.get(r);if(i===void 0)return!1;let o=i.baseSlots.get(r)??[];for(let[a,d]of(n.hier.basesOf.get(r)??[]).entries())if(d.kind==="class")s.push(d.id);else if(d.kind==="unknown"||!Hb(o[a],i))return!1}return!0}function Wb(e,n){let t=new Map;return s=>{let r=t.get(s);if(r!==void 0)return r;let i=e.hier.classOwner.get(s)?.classQualname.get(s)??"",o=Rf.map(l=>Ha(e.hier,[s],l)),a=i!==""&&!Rf.some(n)&&!n(i.split(".").pop()??i)&&o.every(l=>!l.open&&!l.alias)&&Bf(s,e),d={ids:o.flatMap(l=>[...l.ids]),resolution:a?o.every(l=>l.ids.size<=1)?"resolved":"field-based":"unresolved",how:"construct"};return t.set(s,d),d}}function xr(e,n,t,s,r=0,i=new Set){if(r>Ao||i.has(`${e}${n}`))return;i.add(`${e}${n}`);let o=t.get(e),a=o?.moduleBindings?.get(n);if(a==="class")return o?.classByName.get(n);if(a!=="import"||o?.aliases.get(n)?.rows!==1)return;let d=s.get(e)?.names.get(n);return d===void 0?void 0:xr(d.moduleId,d.name,t,s,r+1,i)}function Kf(e,n,t){let s=n.aliases.get(e);return!e.includes(".")&&n.moduleBindings?.get(e)==="import"&&s?.rows===1&&s.exactModule?t?.modules.get(e):void 0}function Gb(e,n){let t=e.split(".");for(let s=t.length-1;s>0;s-=1)if(n.byQualname.has(t.slice(0,s).join(".")))return!0;return!1}function Fa(e,n,t){let[s,...r]=n;if(s===void 0||r.length>0||!Bf(e,t))return null;let i=Ha(t.hier,[e],s);return i.open||i.alias?null:[...i.ids]}function Vb(e,n){let[t,...s]=e.split("."),{d:r,env:i,classQual:o}=n;if(t===void 0||t==="")return null;if(o!==null){if(Gb(o,r))return null;let h=r.classByName.get(o),g=h===void 0?null:r.nonDefBinds.get(h)??null;if(g===null||g.has(t))return null;let y=r.methods.get(o)?.get(t);if(y!==void 0)return s.length===0?[y]:null}let a=r.moduleBindings?.get(t);if(r.moduleBindings===null)return null;if(a===void 0)return r.starImport||r.topLevel.has("__getattr__")?null:[];if(a==="def"){let h=r.topLevel.get(t);return h!==void 0&&s.length===0?[h]:null}if(a==="class"){let h=r.classByName.get(t);return h===void 0?null:Fa(h,s,n.facts)}if(a!=="import"||r.aliases.get(t)?.rows!==1)return null;let d=i?.names.get(t);if(d!==void 0){let h=s.length===0?Qn(d.moduleId,d.name,n.decls,n.envs,!0):void 0;if(h!==void 0)return[h];let g=xr(d.moduleId,d.name,n.decls,n.envs);return g===void 0?null:Fa(g,s,n.facts)}let l=Kf(t,r,i),[c,...p]=s;if(l===void 0||c===void 0)return null;let u=p.length===0?Qn(l,c,n.decls,n.envs,!0):void 0;if(u!==void 0)return[u];let f=xr(l,c,n.decls,n.envs);return f===void 0?null:Fa(f,p,n.facts)}function Xb(e,n){let t=e.value;if(t.kind==="const"||t.kind==="lambda"||t.kind!=="property"&&!Io.has(e.name)&&!Df.has(e.name))return null;if(t.kind==="other")return{ids:[],unnamed:!0};let s=t.kind==="name"?[t.dotted]:t.accessors.flatMap(o=>o.kind==="name"?[o.dotted]:o.kind==="other"?[null]:[]),r=[],i=!1;for(let o of s){let a=o===null?null:Vb(o,n);a===null?i=!0:r.push(...a)}return{ids:r,unnamed:i}}function Yb(e,n){let t=!1,s=new Set(n),r=new Map;for(let o of e.values()){(o.computedAccess||o.valueNames===null||o.valueAttrs===null)&&(t=!0);for(let a of o.valueNames??[])s.add(a);for(let a of o.valueAttrs??[])s.add(a);for(let[a,d]of o.importRenames){let l=r.get(a);l===void 0?r.set(a,[d]):l.push(d)}}let i=[...s];for(let o=i.pop();o!==void 0;o=i.pop())for(let a of r.get(o)??[])s.has(a)||(s.add(a),i.push(a));return[...e.values()].flatMap(o=>o.functions.map(a=>{let d=o.defNames.get(a.id)??"",l=a.id!==o.toplevelId&&(t||a.enclosingClassId!==void 0||s.has(d)||o.decoratedDefs.has(a.id));return{...a,addressTaken:l}}))}function Qn(e,n,t,s,r=!1,i=new Set,o=0){if(o>Ao)return;let a=`${e}${n}`;if(i.has(a))return;i.add(a);let d=t.get(e),l=d?.moduleBindings?.get(n),c=d?.topLevel.get(n);if(c!==void 0)return!r||l==="def"?c:void 0;let p=s.get(e),u=p?.names.get(n);if(u!==void 0)return r&&(l!=="import"||d?.aliases.get(n)?.rows!==1)?void 0:Qn(u.moduleId,u.name,t,s,r,i,o+1);if(!r)for(let f of p?.stars??[]){if(!Ff(t.get(f),n))continue;let h=Qn(f,n,t,s,!1,i,o+1);if(h!==void 0)return h}}var ns={ids:[],resolution:"unresolved",how:"none"};function ja(e,n){let t=n.byMethodName.get(e)??[];return t.length===0||t.length>Tf?ns:{ids:t,resolution:"field-based",how:"name-match"}}function Jb(e,n,t){for(let s=n;s!==null&&s!=="";){if(t.byQualname.has(s)){let i=t.nested.get(s)?.get(e);if(i!==void 0)return{kind:"def",id:i};if(t.paramNames.get(s)?.has(e)===!0)return{kind:"param"}}let r=s.lastIndexOf(".");s=r<0?null:s.slice(0,r)}return{kind:"none"}}function Zb(e,n,t,s){let[r,...i]=e.split(".");if(r===void 0||r==="")return;let o=n?.modules.get(r);for(let a of i){if(o===void 0)return;o=t.get(o)?.modules.get(a)??s.get(o)?.get(a)}return o}function Qb(e,n,t,s,r,i,o){let a=e.attr,d=e.nameScope;if(a===null){if(e.callee===null||e.receiver!==null)return ns;let p=e.callee,u=Jb(p,e.enclosingFunction,t);if(d==="local-def"&&u.kind==="def")return wo({ids:[u.id],resolution:"resolved",how:"local"},o,null);let f=eS(p,u,n,t,s,r,i);if(d!=="module")return Qt(f);let h=Qn(n,p,r,i,!0);if(h!==void 0&&f.ids[0]===h)return wo({ids:[h],resolution:"resolved",how:"bare"},o,p);if(f.ids.length>0)return Qt(f);let g=xr(n,p,r,i);return g===void 0?ns:o.construct(g)}if(e.receiver===null)return ja(a,o);let l=e.receiver;if(Rb.has(l)&&e.enclosingFunction!==null){let p=e.enclosingFunction.split(".").slice(0,-1).join("."),u=t.classByName.get(p);if(u!==void 0){let f=o.selfTargets(u,a),h=t.byQualname.get(e.enclosingFunction),g=h===void 0?"other":o.decoration(h),y=e.root==="param0"&&(g==="none"||g==="classmethod");return f.resolution==="unresolved"||!y?Qt(f):wo(f,o,a)}}let c=Zb(l,s,i,o.children);if(c!==void 0){let p=l.split("."),u=p[0]??l,f=d==="module"&&t.moduleBindings?.get(u)==="import"&&t.aliases.get(u)?.rows===1&&p.slice(1).every(b=>!o.written(b)),h=Qn(c,a,r,i);if(h!==void 0){let b={ids:[h],resolution:"resolved",how:"module"};return f&&Qn(c,a,r,i,!0)===h?wo(b,o,a):Qt(b)}let g=ja(a,o),y=f&&Kf(l,t,s)===c?xr(c,a,r,i):void 0;if(y===void 0)return Qt(g);let _=o.construct(y);return g.ids.length===0?_:{ids:[...new Set([..._.ids,...g.ids])],resolution:_.resolution==="unresolved"?"unresolved":"field-based",how:"construct"}}return ja(a,o)}function eS(e,n,t,s,r,i,o){if(n.kind==="def")return{ids:[n.id],resolution:"resolved",how:"local"};let a=s.topLevel.get(e);if(a!==void 0)return{ids:[a],resolution:"resolved",how:"bare"};let d=r?.names.get(e),l=d!==void 0?Qn(d.moduleId,d.name,i,o):Qn(t,e,i,o);return l!==void 0?{ids:[l],resolution:"resolved",how:"bare"}:ns}function Qt(e){return e.ids.length===0?ns:{...e,resolution:"unresolved"}}function wo(e,n,t){return e.ids.some(r=>{let i=n.decoration(r);return i!=="none"&&i!=="staticmethod"&&i!=="classmethod"})||t!==null&&n.written(t)?Qt(e):e}var fn={direct:new Set,convention:"unknown"};function Cf(e,n,t){return e!==void 0&&n.ids.length===1&&n.ids[0]===e&&t.get(e)==="function"?{direct:new Set([e]),convention:"direct"}:fn}function Mf(e){return e.length>0&&e.every(n=>n==="instance-method")?"shifted":e.length>0&&e.every(n=>n==="class-method"||n==="static-method")?"direct":"unknown"}function nS(e,n,t,s,r){if(e.root!==(s.how==="self"?"param0":"global"))return fn;let i=r.envs.get(n);switch(s.how){case"bare":return e.callee===null?fn:Cf(Qn(n,e.callee,r.decls,r.envs,!0),s,r.kindOf);case"module":{let o=e.receiver===null?void 0:t.aliases.get(e.receiver),a=e.receiver===null?void 0:i?.modules.get(e.receiver);return e.receiver===null||e.attr===null||a===void 0||t.moduleBindings?.get(e.receiver)!=="import"||o?.rows!==1||!o.exactModule?fn:Cf(Qn(a,e.attr,r.decls,r.envs,!0),s,r.kindOf)}case"self":{let o=e.attr,a=e.enclosingFunction===null?void 0:t.byQualname.get(e.enclosingFunction),d=a===void 0?void 0:r.kindOf.get(a);if(o===null||d!=="instance-method"&&d!=="class-method")return fn;let l=(e.enclosingFunction??"").split(".").slice(0,-1).join("."),c=t.classByName.get(l),p=t.methods.get(l)?.get(o);if(c===void 0||p===void 0||!s.ids.includes(p))return fn;let u=[];for(let y of s.ids){let _=r.kindOf.get(y);if(_===void 0||_==="function")return fn;u.push(_)}let f=r.below(c),h=r.above(c);for(let y of f){if(y===c)continue;let _=r.nonDefBinds.get(y);if(r.multiBase.has(y)||r.rewrites.has(y)||r.intercepts.has(y)||_===void 0||_===null||_.has(o))return fn;let b=r.classOwner.get(y),x=b?.classQualname.get(y),k=x===void 0?void 0:b?.methods.get(x)?.get(o);if(k!==void 0&&!s.ids.includes(k))return fn}for(let y of h)if(r.intercepts.has(y))return fn;if(r.unplaced.has(c)&&r.intercepts.size>0)return fn;let g=y=>f.has(y)||h.has(y);return r.unplacedAnyName.some(y=>!g(y))||(r.unplacedByName.get(o)??[]).some(y=>!g(y))?fn:{direct:new Set(s.ids),convention:d==="instance-method"?"direct":Mf(u)}}case"name-match":{let o=e.receiver===null||e.receiver.includes(".")?void 0:tS(e.receiver,t,i,r.decls),a=o===void 0?void 0:r.classOwner.get(o),d=o===void 0?void 0:a?.classQualname.get(o),l=d===void 0||e.attr===null?void 0:a?.methods.get(d)?.get(e.attr),c=l===void 0?void 0:r.kindOf.get(l);return l===void 0||c===void 0||c==="function"||!s.ids.includes(l)?fn:{direct:new Set([l]),convention:Mf([c])}}default:return fn}}function tS(e,n,t,s){let r=n.moduleBindings?.get(e);if(r==="class")return n.classByName.get(e);let i=t?.names.get(e);if(r!=="import"||i===void 0||n.aliases.get(e)?.rows!==1)return;let o=s.get(i.moduleId);return o?.moduleBindings?.get(i.name)==="class"?o.classByName.get(i.name):void 0}function sS(e,n,t,s=[]){let r=n.args,i=t==="shifted"&&r?.[0]?.kind!=="positional"?"unknown":t;return{...r!==null?{args:r.map((o,a)=>rS(e,o,a,s[a]===!0)),convention:i}:{},...n.receiverRange!==null?{receiverRange:_r(e,n.receiverRange)}:{},repeats:n.repeats}}function rS(e,n,t,s){return{index:t,...n.kind==="keyword"&&n.keyword!==void 0?{keyword:n.keyword}:{},spread:n.kind==="star"?"positional":n.kind==="double-star"?"keyword":!1,range:_r(e,n),...s?{primitive:!0}:{}}}function oS(e){return e===void 0?{}:{calleeDecl:e.calleeDecl,...e.runtimeId!==void 0?{runtimeId:e.runtimeId}:{},...e.summary!==void 0?{summary:e.summary}:{},...e.receiverPrimitive===!0?{receiverPrimitive:!0}:{}}}var iS=8,aS=new Set(["__new__","__init_subclass__","__class_getitem__"]),Ro=e=>e.map(n=>n.name+"()".repeat(n.calls)).join(".");function lS(e){let n=/^(~|\.*)(.*)$/u.exec(e);if(n===null)return null;let t=[];for(let s of(n[2]??"").split(".")){let r=s.replace(/(?:\(\))+$/u,"");if(r==="")return null;t.push({name:r,calls:(s.length-r.length)/2})}return{lead:n[1]??"",segs:t}}function dS(e){let n=new Map,t=e.moduleBindings;if(t===null)return n;for(let s of e.imports)if(!(s.enclosingFunction!==null||s.guards.includes("type-checking")))for(let r of s.names){let i=r.name.split(".")[0]??r.name,o=r.asname??(s.form==="import"?i:r.name);if(t.get(o)!=="import")continue;let a=s.form==="import"?r.asname!==null?r.name:i:`${".".repeat(s.level)}${s.module!==null&&s.module!==""?`${s.module}.`:""}${r.name}`;n.set(o,a)}return n}function Hf(e,n){let t=new Map;for(let[p,u]of n.modules){let f=new Map;for(let g of u.file.functions)f.set(g.qualname,(f.get(g.qualname)??0)+1);let h=new Map(u.file.functions.filter(g=>f.get(g.qualname)===1).map(g=>[g.qualname,g]));t.set(p,{...u,id:p,imports:dS(u.file),rows:h})}let s=(p,u,f=0)=>{if(f>iS)return null;let h=lS(p);if(h===null)return null;if(h.lead==="~"){let[y,..._]=h.segs;return y===void 0?null:r(u,y,_,f)}let g=h.segs;if(h.lead.length>0){let y=So(u.dotted,u.isPackage),_=y===""?[]:y.split("."),b=h.lead.length-1;if(b>=_.length)return null;g=[..._.slice(0,_.length-b).map(x=>({name:x,calls:0})),...g]}for(let y=g.length;y>=1;y-=1){if(g.slice(0,y).some(k=>k.calls>0))continue;let _=n.byDotted.get(Ro(g.slice(0,y)));if(_===void 0)continue;let b=t.get(_);if(b===void 0||!b.app)return{kind:"name",text:Ro(g)};let x=g[y];return x===void 0?null:r(b,x,g.slice(y+1),f)}return{kind:"name",text:Ro(g)}},r=(p,u,f,h)=>{let g="()".repeat(u.calls)+f.map(k=>`.${Ro([k])}`).join(""),y=p.file.moduleOrigins?.get(u.name);if(y!==void 0)return s(y+g,p,h+1);let _=p.imports.get(u.name);if(_!==void 0)return s(_+g,p,h+1);let b=p.file.moduleBindings?.get(u.name);if(b==="def"&&u.calls===0){let k=p.decls.topLevel.get(u.name),w=p.rows.get(u.name);return k===void 0||w===void 0?null:{kind:"function",module:p,id:k,row:w,rest:f}}if(b==="class"&&p.decls.classByName.has(u.name))return{kind:"class",module:p,qualname:u.name,calls:u.calls,rest:f};let x=p.file.annotatedAliases?.get(u.name);return x!==void 0&&u.calls===0&&f.length===0?{kind:"annotated",module:p,value:x}:null},i=(p,u)=>{if(p===null)return null;let f=s(p,u);return f?.kind==="name"?f.text:null},o=(p,u)=>p!==null&&u.includes(p),a=(p,u,f)=>p!==null&&u.some(h=>f.some(g=>p===`${h}.${g}()`)),d=new Map,l=new Set,c=(p,u,f)=>{let h=d.get(p);h===void 0?d.set(p,{row:u,regs:[f]}):h.regs.push(f)};for(let p of t.values()){for(let u of p.file.functions){let f=u.decoratorFacts;if(f===null||f.length===0||u.method||u.params===null)continue;let h=p.decls.byQualname.get(u.qualname);if(h===void 0||p.rows.get(u.qualname)!==u)continue;let g=f.map(_=>i(_.origin,p)),y=_=>{let b=g[_]??null;return a(b,$n.apps,$n.decorators)?$n:a(b,Bn.apps,Bn.decorators)?Bn:null};f.forEach((_,b)=>{let x=y(b);if(x===null)return;l.add(h);for(let I=b+1;I<f.length;I+=1)if(y(I)===null)return;let k={path:p.path,start:_.start,end:_.end},w=x===$n?zf(u,p,s):Uf(u,_.rule);c(h,u,{model:x,at:k,params:w})})}for(let u of p.file.calls){let f=u.registration;if(f===null||u.args===null||u.args.length!==f.args.length)continue;let h=i(f.callee,p);if(h===null)continue;let g={path:p.path,start:u.range.start,end:u.range.end},y=(b,x)=>cS(u,b,x),_=b=>{let x=b===null?null:f.args[b]?.origin??null,k=x===null?null:s(x,p);return k?.kind!=="function"||k.rest.length!==0?null:(k.row.decoratorFacts??[null]).length===0?{id:k.id,row:k.row,ctx:k.module}:null};if($n.apps.some(b=>h===`${b}.${$n.addRoute}`)){let b=_(y("endpoint",1));b!==null&&c(b.id,b.row,{model:$n,at:g,params:zf(b.row,b.ctx,s)})}else if(Bn.apps.some(b=>h===`${b}.${Bn.addRule}`)){let b=_(y("view_func",2)),x=y("rule",0);b!==null&&c(b.id,b.row,{model:Bn,at:g,params:Uf(b.row,x===null?null:f.args[x]?.literal??null)})}else if(o(h,yn.paths)||o(h,yn.regexes)){let b=o(h,yn.regexes),x=y("route",0),k=x===null?null:f.args[x]?.literal??null,w=y("view",1),I=w===null?null:f.args[w]?.origin??null,N=I===null?null:s(I,p);if(N?.kind==="function"&&N.rest.length===0&&gS(N.row,N.module,i))c(N.id,N.row,{model:yn,at:g,params:qf(N.row,0,k,b)});else if(N?.kind==="class"&&N.calls===0&&N.rest.length===1&&N.rest[0]?.name==="as_view"&&N.rest[0].calls===1){let v=N.module.decls.methods.get(N.qualname);for(let C of yn.methods){let R=v?.get(C),F=N.module.rows.get(`${N.qualname}.${C}`);R===void 0||F===void 0||F.decorated!=="none"||c(R,F,{model:yn,at:g,params:qf(F,1,k,b)})}}}}}return e.map(p=>{let u=d.get(p.id),f=u?.row??uS(p,t),h=p;if(u!==void 0){let g=pS(u.row,u.regs);g.length>0&&(h={...h,sourceParams:g})}if(h.valueFlows===void 0&&f!==void 0&&f.valueFlows!==null){let y=u!==void 0||l.has(p.id)||f.valueFlows.some(_=>_.from.kind==="source")?fS(f):null;y!==null&&(h={...h,valueFlows:y})}return h})}function cS(e,n,t){let s=e.args??[],r=s.findIndex(o=>o.kind==="keyword"&&o.keyword===n);if(r>=0)return r;let i=0;for(let o=0;o<s.length;o+=1){let a=s[o];if(a===void 0)break;if(a.kind==="star"||a.kind==="double-star")return null;if(a.kind==="positional"){if(i===t)return o;i+=1}}return null}function uS(e,n){let t=n.get(e.moduleId);if(t===void 0)return;let s=e.id.slice(`${e.moduleId}#`.length);return t.decls.byQualname.get(s)===e.id?t.rows.get(s):void 0}function fS(e){if(e.params===null)return null;let n;if(!e.method)n="none";else if(e.decorated==="staticmethod")n="none";else if(e.decorated==="none"&&!aS.has(e.name)||e.decorated==="classmethod")n="first";else return null;if(n==="first"){let t=e.params[0];if(t===void 0||t.kind!=="positional"&&t.kind!=="positional-only")return null}return yr(e.valueFlows,n,e.params.length)}function pS(e,n){let t=e.method&&e.decorated!=="staticmethod"?1:0,s=new Map,r=[...n].sort((i,o)=>i.at.path.localeCompare(o.at.path)||i.at.start-o.at.start);for(let i of r)for(let o of[...i.params].sort((a,d)=>a-d)){let a=o-t;a<0||s.has(a)||s.set(a,{index:a,sourceClass:i.model.sourceClass,model:i.model.id,registeredAt:i.at})}return[...s.values()].sort((i,o)=>i.index-o.index)}function zf(e,n,t){let s=new Set,r=(a,d)=>{if(a===null)return null;let l=t(a,d);return l?.kind==="name"?l.text:null},i=(a,d)=>a!==null&&$n.depends.includes(r(a.callee,d)??""),o=(a,d)=>$n.schemes.includes(r(a.arg0,d)??"");return(e.params??[]).forEach((a,d)=>{let l=e.paramFacts?.[d]??null;if(l===null){s.add(d);return}let c=l.annotated!==null?{value:l.annotated,from:n}:null;if(c===null&&l.annotation!==null){let f=t(l.annotation,n);f?.kind==="annotated"&&(c={value:f.value,from:f.module})}let p=c!==null?r(c.value.type,c.from):r(l.annotation,n),u=[];i(l.default,n)&&l.default!==null&&u.push({call:l.default,from:n});for(let f of c?.value.meta??[])f!==null&&c!==null&&i(f,c.from)&&u.push({call:f,from:c.from});if(u.length>0){u.some(h=>o(h.call,h.from)||h.call.arg0===null&&$n.forms.includes(p??""))&&s.add(d);return}$n.injected.includes(p??"")||s.add(d)}),s}var mS=/<(?:[a-zA-Z_][a-zA-Z0-9_]*(?:\([^)]*\))?:)?([a-zA-Z_][a-zA-Z0-9_]*)>/gu;function Uf(e,n){let t=n===null?null:new Set([...n.matchAll(mS)].map(s=>s[1]));return Wf(e,0,t)}function qf(e,n,t,s){let r=e.params??[],i=r[n];if(i===void 0||i.kind!=="positional"&&i.kind!=="positional-only")return new Set;let o=new Set([n]);if(t===null)return r.forEach((c,p)=>{p>n&&o.add(p)}),o;let a=s?[...t.matchAll(/\(\?P<([^>]+)>/gu)].map(c=>c[1]):[...t.matchAll(/<(?:[^>:]+:)?([^>]+)>/gu)].map(c=>c[1]);if(a.length>0){for(let c of Wf(e,n+1,new Set(a)))o.add(c);return o}let d=s?[...t.matchAll(/(?<!\\)\((?!\?)/gu)].length:0,l=0;return r.forEach((c,p)=>{p<=n||l>=d||(c.kind==="positional"||c.kind==="positional-only"?(o.add(p),l+=1):c.kind==="rest"&&(o.add(p),l=d))}),o}function Wf(e,n,t){let s=new Set,r=t===null||t.size>0;return(e.params??[]).forEach((i,o)=>{o<n||(i.kind==="keyword-rest"?r&&s.add(o):(i.kind==="positional"||i.kind==="keyword-only")&&(t===null||t.has(i.name))&&s.add(o))}),s}var hS=new Set([...yn.passThrough,yn.apiView,...yn.apiViewSetters]);function gS(e,n,t){let s=e.decoratorFacts;return s===null?!1:s.every(r=>hS.has(t(r.origin,n)??""))}var yS=5e3,Gf=200,Vf=100,_S=new Set(["args","params","flows"]),Xf={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Yf(e){return`pkg:${e}`}function ct(e){return e.split(/[\\/]+/u).join("/")}function Ga(e,n){let t=e.endsWith("/")?e:`${e}/`,s=ct(n),r=ct(t);return s.startsWith(r)?s.slice(r.length):null}function Jf(e){let n=ct(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let s=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),s].filter(r=>r!=="").join("."),isPackage:!1}}function Va(e){return e.split(".")[0]??e}var xS="site-packages:";function Xa(e){let n=e.extract??Oo,t=e.maxModules??yS,s=(e.externalRoots??[]).map(L=>ct(L).endsWith("/")?ct(L):`${ct(L)}/`),r=L=>{let H=ct(L);return s.find(z=>H.startsWith(z))??null},i=L=>r(L)!==null,o=[],a=new Map,d=[],l=[],c=new Set,p=new Set,u=new Map,f=new Map,h=[],g=[],y=new Map,_=new Set,b=new Set,x=[],k=0,w=()=>{let L=`py-export:${String(k)}`;return k+=1,L},I=null,N=!1,v=new Set,C=new Set,R=new Map,F=new Map,P=bf(L=>{let H=wt(e.paths,L).resolved;return H!==null&&Ga(e.projectRoot,H.path)!==null&&!i(H.path)}),U=new Map,E=[];for(let L of e.entryFiles){let H=Ga(e.projectRoot,L);if(H===null){o.push({code:"unresolved-import",where:ct(L),detail:"entrypoint lies outside the project root; not analyzed"});continue}c.has(L)||(c.add(L),E.push({file:L,rel:H,isEntry:!0,packageName:"",modulePath:H}))}let T=L=>{let H=Yf(L);return a.has(H)||(p.add(L),a.set(H,{id:H,packageName:L,versionRange:"",path:L,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),H},K=0,J=(L,H,z,Z)=>{let ie=`py-import:${String(K)}`;K+=1,d.push({id:ie,moduleId:L,specifier:H,...z!==null?{resolvedModuleId:z}:{},isNamespace:!1,isDefault:!1,dynamic:Z,specifierIsLiteral:!0}),z!==null&&l.push({importId:ie,resolvedModuleId:z})};for(let L=0;L<Vf&&E.length>0;L+=1){let H=E.slice(0,Gf);E=E.slice(Gf);let z=n(H.map(ie=>ie.file),e.python!==void 0?{python:e.python,hints:P}:{hints:P});if(I??=z.interpreter,v.size===0&&z.stdlib.length>0&&(v=new Set(z.stdlib)),C.size===0&&z.builtins.length>0&&(C=new Set(z.builtins)),R.size===0&&z.typeAttrs.size>0&&(R=z.typeAttrs),z.refused!==null)return o.push({code:"extract-refused",where:"",detail:`${z.refused}: ${z.diagnostics.join("; ")}`}),{graph:Xf,diagnostics:o,interpreter:z.interpreter,counts:{modules:0,surfaces:0},opaqueCode:[]};let Z=new Map(z.files.map(ie=>[ie.path,ie]));for(let ie of H){let ae=Z.get(ie.file),pe=ie.rel,he=Jf(ie.modulePath);if(F.set(pe,he),a.set(pe,{id:pe,packageName:ie.packageName,versionRange:"",path:ie.modulePath,moduleSystem:"dual",isEntrypoint:ie.isEntry}),ae===void 0||ae.refused!==null){o.push({code:"file-refused",where:ie.rel,detail:ae?.refused??"no row was returned for this file"});continue}W(ae,pe,he),S(ae,ie.rel);let we=ae.truncated.filter(Ne=>!_S.has(Ne));we.length>0&&o.push({code:"extract-truncated",where:ie.rel,detail:`the extract stopped at its per-file bound for ${we.join(", ")}; what lies past it is not in this graph`}),u.set(pe,za(ae,pe,ie.rel,w)),f.set(pe,fe(ae,pe,he)),U.set(pe,{file:ae,decls:u.get(pe),dotted:he.dotted,isPackage:he.isPackage,app:ie.packageName==="",path:ie.rel});for(let Ne of ae.calls)h.push({moduleId:pe,path:ie.rel,call:Ne});for(let Ne of ae.escapes){if(Ne.kind!=="attr-rebind")continue;let Ie=Ne.attr??null;Ie===null||Ne.target===null||x.push({moduleId:pe,attr:Ie,target:Ne.target})}}}function W(L,H,z){for(let Z of L.imports){if(Z.guards.includes("type-checking"))continue;let ie=[];if(Z.level>0){let he=Es(z.dotted,z.isPackage,Z.level,Z.module);if("failure"in he){o.push({code:"unresolved-import",where:L.path,detail:`relative import (level ${String(Z.level)}) ${he.failure}`});continue}ie.push(he.dotted);for(let we of Z.names)ie.push(`${he.dotted}.${we.name}`)}else if(Z.module!==null){ie.push(Z.module);for(let he of Z.names)ie.push(`${Z.module}.${he.name}`)}else continue;let ae=!1,pe=new Set;for(let he of ie)se(he,H,Z.deferred,pe)&&(ae=!0);if(pe.size>0&&g.push({moduleId:H,path:H,enclosingFunction:Z.enclosingFunction,at:Z.range.start,shape:"require",targets:[...pe]}),!ae){let he=ie[0]??"";J(H,he,null,Z.deferred);let we=Va(he);if(v.has(we)||Z.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf(we)===null)continue;o.push({code:"unresolved-import",where:L.path,detail:`\`${he}\` did not resolve on the search path`})}}}function se(L,H,z,Z){let ie=L.split("."),ae=!1;for(let pe=1;pe<=ie.length;pe+=1){let he=ie.slice(0,pe).join("."),we=wt(e.paths,he);if(we.resolved===null)continue;let Ne=V(we.resolved,H,he,z);Ne!==null&&Z.add(Ne),pe===ie.length&&(ae=!0)}return ae}function Y(L){return c.has(L.file)||a.has(L.rel)?!0:c.size>=t?(N||(N=!0,o.push({code:"module-cap",where:L.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(c.add(L.file),E.push(L),!0)}function V(L,H,z,Z){if(L.kind==="stub-only")return null;let ie=L.kind==="module"||L.kind==="package",ae=Ga(e.projectRoot,L.path);if(ae!==null&&!i(L.path)&&ie){let Ne=ae;return J(H,z,Ne,Z),y.set(z,Ne),Y({file:L.path,rel:ae,isEntry:!1,packageName:"",modulePath:ae}),Ne}let pe=e.distributionOf(Va(z));if(pe===null)return J(H,z,null,Z),o.push({code:"unresolved-import",where:z,detail:`resolved to ${L.kind} outside the project, but no installed distribution provides \`${Va(z)}\``}),null;let he=r(L.path);if(!ie||he===null)return J(H,z,T(pe),Z),_.add(z),(L.kind==="extension"||ie&&he===null)&&b.add(z),null;let we=`${xS}${ct(L.path).slice(he.length)}`;return J(H,z,we,Z),y.set(z,we),Y({file:L.path,rel:we,isEntry:!1,packageName:pe,modulePath:ct(L.path).slice(he.length)}),we}function fe(L,H,z){let Z=new Map,ie=new Map,ae=new Set,pe=new Map,he=(Ie,Fe)=>{ae.add(Ie),pe.set(Ie,Fe)},we=[],Ne=Ie=>v.has(Ie.split(".")[0]??Ie)||_.has(Ie);for(let Ie of L.imports){if(Ie.guards.includes("type-checking"))continue;let Fe=Ie.module;if(Ie.level>0){let Le=Es(z.dotted,z.isPackage,Ie.level,Ie.module);if("failure"in Le)continue;Fe=Le.dotted}if(Fe!==null){if(Ie.star){let Le=y.get(Fe);Le!==void 0&&!we.includes(Le)&&we.push(Le)}if(Ie.form==="import"){let Le=Ie.names[0]?.asname??null;if(Le!==null){let tn=y.get(Fe);tn!==void 0?Z.set(Le,tn):Ne(Fe)&&he(Le,Fe);continue}let Je=Fe.split(".")[0]??Fe,Ae=y.get(Je)??y.get(Fe);Ae!==void 0?Z.set(Je,Ae):Ne(Je)&&he(Je,Je);continue}for(let Le of Ie.names){let Je=Le.asname??Le.name,Ae=y.get(`${Fe}.${Le.name}`);if(Ae!==void 0){Z.set(Je,Ae);continue}let tn=y.get(Fe);tn!==void 0?ie.set(Je,{moduleId:tn,name:Le.name}):(Ne(Fe)||Ne(`${Fe}.${Le.name}`))&&he(Je,`${Fe}.${Le.name}`)}}}return Z.set("",H),{modules:Z,names:ie,external:ae,externalOrigins:pe,stars:we}}function S(L,H){for(let z of L.escapes)switch(z.kind){case"loader-escape":o.push({code:"loader-escape",where:H,detail:`${z.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":o.push({code:"dynamic-load-set",where:H,detail:`${z.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":o.push({code:"module-registry-write",where:H,detail:`${z.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let Z=z.target;if(Z===null)break;let ie=new Set;se(Z,H,!0,ie),ie.size>0&&g.push({moduleId:H,path:H,enclosingFunction:z.enclosingFunction,at:z.range.start,shape:"dynamic-import",targets:[...ie]});break}case"dispatch-escape":break}}E.length>0&&o.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(Vf)} waves; the graph is INCOMPLETE`});let A=new Map;for(let[L,H]of y){let z=L.lastIndexOf(".");if(z<0)continue;let Z=y.get(L.slice(0,z));if(Z===void 0||Z===H)continue;let ie=A.get(Z)??new Map;ie.set(L.slice(z+1),H),A.set(Z,ie)}let j=Ua({decls:u,envs:f,pending:h,rebinds:x,loads:g,children:A,runtime:{builtins:C,typeAttrs:R,stdlib:v,placed:L=>{let H=y.get(L);return H!==void 0?{kind:"module",id:H}:_.has(L)?{kind:"surface"}:null},packageOf:L=>a.get(L)?.packageName,dottedOf:L=>F.get(L)}}),ne=Hf(j.functions,{modules:U,byDotted:y}),X=[...u.values()].flatMap(L=>L.classes),D=[...u.values()].flatMap(L=>L.exports),$=[...u.values()].flatMap(L=>L.exportBindings);return{graph:{...Xf,modules:[...a.values()],imports:d,importEdges:l,functions:ne,classes:X,exports:D,exportBindings:$,callSites:j.callSites,callEdges:j.callEdges,inheritEdges:j.inheritEdges},diagnostics:o,interpreter:I,counts:{modules:a.size-p.size,surfaces:p.size},opaqueCode:[...b].sort()}}import{readdirSync as bS,readFileSync as Qf,statSync as Po}from"node:fs";import xn from"node:path";import{spawnSync as SS}from"node:child_process";var kS="python3",wS=256*1024,vS=8*1024*1024,ep=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,ES=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function Dt(e){try{return Po(e).isFile()}catch{return!1}}function Zf(e){try{return Po(e).isDirectory()}catch{return!1}}function NS(e,n){return xn.relative(e,n).split(xn.sep).join("/")}function AS(e){let n=e.python??process.env.CUPEL_PYTHON??kS,t=SS(n,["-I","-S",...hr("metadata.py"),e.projectRoot],{encoding:"utf8",maxBuffer:vS,timeout:6e4}),s=d=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:d}]});if(t.error!==void 0||t.status!==0)return s("the declared entry surface could not be read; it is unknown, not empty");let r;try{r=JSON.parse(t.stdout)}catch{return s("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof r!="object"||r===null)return{entries:[],projectName:null,gaps:[]};let i=r,o=(Array.isArray(i.entryPoints)?i.entryPoints:[]).filter(d=>typeof d=="object"&&d!==null&&typeof d.name=="string"&&typeof d.target=="string"&&typeof d.kind=="string"),a=(Array.isArray(i.gaps)?i.gaps:[]).flatMap(d=>{if(typeof d!="object"||d===null)return[];let l=d,c=typeof l.file=="string"?l.file:"",p=typeof l.why=="string"?l.why:"";return[{source:"metadata",declaration:c,detail:p==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":p}]});return{entries:o,gaps:a,projectName:typeof i.projectName=="string"?i.projectName:null}}function Ya(e,n){let t=ep.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let s=t[1]??"",r=wt(e.paths,s);if(r.resolved===null)return{detail:`\`${s}\` ${r.failure??"did not resolve"}`};if(r.resolved.kind==="namespace"||r.resolved.kind==="stub-only")return{detail:`\`${s}\` resolved to a ${r.resolved.kind}, which runs no code`};let i=NS(e.projectRoot,r.resolved.path);return i.startsWith("..")?{detail:`\`${s}\` resolves outside the project root; not seeded`}:{file:i}}function IS(e){let n=[];Dt(xn.join(e,"__main__.py"))&&n.push("__main__.py");let t=(s,r)=>{let i;try{i=bS(s).sort()}catch{return}for(let o of i){if(o.startsWith("."))continue;let a=xn.join(s,o);Zf(a)&&Dt(xn.join(a,"__init__.py"))&&Dt(xn.join(a,"__main__.py"))&&n.push(`${r}${o}/__main__.py`)}};return t(e,""),Zf(xn.join(e,"src"))&&t(xn.join(e,"src"),"src/"),n}function RS(e,n){let t=xn.join(e,"Procfile");if(!Dt(t))return[];let s;try{if(Po(t).size>n)return[];s=Qf(t,"utf8")}catch{return[]}let r=[];for(let i of s.split(/\r?\n/u)){let o=ES.exec(i);o?.[1]!==void 0&&r.push(o[1])}return r}var OS=256*1024,PS=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,CS=/^\s*WORKDIR\s+(\S+)\s*$/imu,MS=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,TS=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,$S=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function LS(e){let n=CS.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let s=MS.exec(t),r=s?.[1],i=s?.[2]?.replace(/\/+$/u,"");if(r===void 0||i===void 0||i!==n)continue;let o=r.replace(/\/+$/u,"");return o==="."?null:o}return null}function DS(e,n){let t=[],s=i=>{let o=xn.join(e,i);if(!Dt(o))return null;try{return Po(o).size>n?null:Qf(o,"utf8")}catch{return null}},r=s("Dockerfile");if(r!==null){let i=LS(r);for(let o of r.split(/\r?\n/u)){let a=PS.exec(o);a?.[1]!==void 0&&t.push({command:a[1],from:"Dockerfile",srcRoot:i})}}for(let i of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let o=s(i);if(o!==null)for(let a of o.split(/\r?\n/u)){let d=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(a);d?.[1]!==void 0&&t.push({command:d[1],from:i,srcRoot:null})}}return t}function FS(e,n,t){let s=e.projectRoot,r=$S.exec(n)?.[1];if(r!==void 0){for(let a of t===null?[r]:[xn.join(t,r),r])if(Dt(xn.join(s,a)))return{file:a}}let i=TS.exec(n)?.[1];if(i===void 0)return r===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${r}\` is not a file in this repository`};let o=ep.exec(i)?.[1]??"";for(let a of t===null?[""]:[t,""])for(let d of[`${o.replace(/\./gu,"/")}.py`,`${o.replace(/\./gu,"/")}/__init__.py`]){let l=a===""?d:xn.join(a,d);if(Dt(xn.join(s,l)))return{file:l}}return Ya(e,i)}function Ja(e){let n=[],t=[],s=new Set,r=(a,d,l)=>{let c=`${a} ${d}`;s.has(c)||(s.add(c),n.push({file:a,source:d,declaration:l}))},i=AS(e);t.push(...i.gaps);for(let a of i.entries){let d=a.kind==="entry-point-group"?"entry-point-group":"console-script",l=Ya(e,a.target);"file"in l?r(l.file,d,`${a.name} = ${a.target}`):t.push({source:d,declaration:`${a.name} = ${a.target}`,detail:l.detail})}for(let a of IS(e.projectRoot))r(a,"dunder-main",a);Dt(xn.join(e.projectRoot,"manage.py"))&&r("manage.py","manage-py","manage.py");let o=e.maxProcfileBytes??wS;for(let a of RS(e.projectRoot,o)){let d=Ya(e,a);"file"in d?r(d.file,"launch-declaration",a):t.push({source:"launch-declaration",declaration:a,detail:d.detail})}for(let a of DS(e.projectRoot,OS)){let d=FS(e,a.command,a.srcRoot),l=`${a.from}: ${a.command.trim()}`;"file"in d?r(d.file,"launch-declaration",l):t.push({source:"launch-declaration",declaration:l,detail:d.detail})}return{entrypoints:n,gaps:t,projectName:i.projectName}}var aO=256*1024*1024;var np="CUPEL_PYTHON",BS=["-I","-S"],KS="python3",zS=256*1024*1024,US=12e4,qS=512,tp=2e4,ip=new Set(["str","bytes","int","float","complex","bool","none","scalar","tuple","list","dict","set"]),HS=new Set(["module","local-def","local","class"]);function xe(e,n=qS){return typeof e=="string"&&e.length<=n?e:null}function ts(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function br(e){let n=bn(e)?e:{};return{line:ts(n.line),endLine:ts(n.endLine),col:ts(n.col),start:ts(n.start),end:ts(n.end)}}function bn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ft(e){return Array.isArray(e)?e:[]}function Rs(e){return Ft(e).map(n=>xe(n))}function ss(e,n){return Number.isSafeInteger(e)&&Number.isSafeInteger(n)&&e>=0&&n>=e?{start:e,end:n}:null}var WS={o:"positional-only",p:"positional",r:"rest",k:"keyword-only",K:"keyword-rest"},GS={p:"positional",s:"star",k:"keyword",d:"double-star"};function Os(e,n){if(!Array.isArray(e))return null;let t=[];for(let s of e){let r=Array.isArray(s)?n(s):null;if(r===null)return null;t.push(r)}return t}function VS(e){return Os(e,([n,t,s,r,i])=>{let o=typeof n=="string"?WS[n]:void 0,a=xe(t),d=ss(r,i);return o===void 0||a===null||a===""||typeof s!="boolean"||d===null?null:{kind:o,name:a,hasDefault:s,...d}})}function XS(e){return Os(e,([n,t,s,r])=>{let i=typeof n=="string"?GS[n]:void 0,o=ss(t,s);if(i===void 0||o===null)return null;if(i!=="keyword")return r===void 0?{kind:i,...o}:null;let a=xe(r);return a!==null&&a!==""?{kind:i,keyword:a,...o}:null})}var YS=new Set(["def","class","import","other","multi"]);function JS(e){if(!bn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e))xe(t)!==null&&typeof s=="string"&&YS.has(s)&&n.set(t,s);return n}var ZS=new Map([["c","copy"],["d","derive"],["f","field"],["w","await"],["r","return"],["a","argument"],["m","mutation"]]),QS=new Map([["m","module"],["g","global"],["u","unknown"]]),ek=new Set(["unmodeled","reflective","inner-function-param","caught","construct"]),nk=256;function sp(e,n){return Number.isSafeInteger(e)&&e>=n&&e<nk?e:null}function tk(e,n){let[t,s,r,i]=e;switch(t){case"p":{let o=e.length===2&&n?sp(s,0):null;return o===null?null:{kind:"declared-param",index:o}}case"l":{let o=xe(s);return e.length===3&&o!==null&&o!==""&&Number.isSafeInteger(r)&&r>=0?{kind:"local",name:o,declStart:r}:null}case"f":{let o=xe(s),a=QS.get(r);return e.length===3&&o!==null&&o!==""&&a!==void 0?{kind:"free",name:o,binding:a}:null}case"c":case"r":{let o=e.length===3?ss(s,r):null;return o===null?null:{kind:t==="c"?"call-result":"call-receiver",at:o.start,end:o.end}}case"a":case"m":{let o=e.length===4?ss(s,r):null,a=sp(i,t==="m"?-1:0);return o===null||a===null?null:{kind:t==="a"?"argument":"mutated-by-call",at:o.start,end:o.end,index:a}}case"R":return e.length===1?{kind:"return"}:null;case"k":return e.length===1?{kind:"constant"}:null;case"s":{let o=e.length===2?xe(s):null;return o===null?null:xf(o)}case"o":return e.length===2&&ek.has(s)?{kind:"opaque",reason:s}:null;default:return null}}function rp(e,n){if(!bn(e))return null;let t=e.refs,s=e.edges;if(!Array.isArray(t)||!Array.isArray(s)||s.length>tp||t.length>2*tp)return null;let r=Os(t,i=>tk(i,n));return r===null?null:Os(s,([i,o,a])=>{let d=Number.isSafeInteger(i)?r[i]:void 0,l=Number.isSafeInteger(o)?r[o]:void 0,c=ZS.get(a);return d===void 0||l===void 0||c===void 0?null:{from:d,to:l,kind:c}})}var sk=/^(?:~|\.*)[^\s.()~]+(?:\(\))*(?:\.[^\s.()~]+(?:\(\))*)*$/u,rk=2048;function jt(e){let n=xe(e);return n!==null&&sk.test(n)?n:null}function ap(e){return xe(e,rk)}function lp(e){return Array.isArray(e)&&e.length===2?{callee:jt(e[0]),arg0:jt(e[1])}:null}function dp(e){return!bn(e)||!Array.isArray(e.m)?null:{type:jt(e.t),meta:e.m.map(lp)}}function ok(e){return Os(e,([n,t,s,r])=>{let i=ss(t,s);return i===null?null:{origin:jt(n),rule:ap(r),...i}})}function ik(e){return Array.isArray(e)?e.map(n=>{if(!Array.isArray(n)||n.length!==2)return null;let t=n[1];return{default:lp(n[0]),annotated:dp(t),annotation:bn(t)?jt(t.o):null}}):null}function ak(e){if(!Array.isArray(e)||e.length!==2||!Array.isArray(e[1]))return null;let n=e[1].map(t=>Array.isArray(t)?{origin:jt(t[0]),literal:ap(t[1])}:{origin:null,literal:null});return{callee:jt(e[0]),args:n}}function op(e,n){if(!bn(e))return null;let t=new Map;for(let[s,r]of Object.entries(e)){let i=n(r);xe(s)!==null&&i!==null&&t.set(s,i)}return t}var lk=/^(?:~|\.*)[^\s.()~]+(?:\.[^\s.()~]+)*$/u;function dk(e){let n=xe(e);return n!==null&&lk.test(n)?n:null}function cp(e){if(!Array.isArray(e)||e.length<1||e.length>2||!ip.has(e[0]))return null;let n=e[0];if(e.length===1)return{type:n};let t=xe(e[1]);return t!==null&&t!==""?{type:n,unlessWritten:t}:null}function ck(e,n){return!Array.isArray(e)||n===null||e.length!==n.length?null:e.map(t=>t===null?null:cp(t))}var uk=new Set(["none","staticmethod","classmethod","other"]);function Co(e){if(!Array.isArray(e))return null;let n=new Set;for(let t of e){let s=xe(t);if(s===null)return null;n.add(s)}return n}function fk(e){if(e===!0)return{kind:"lambda"};if(e===!1)return{kind:"const"};if(e===null)return{kind:"other"};let n=xe(e);return n!==null&&n!==""?{kind:"name",dotted:n}:null}function pk(e){if(!Array.isArray(e))return null;let n=e,[t,s]=n;if(t==="k"&&n.length===1)return{kind:"const"};if(t==="l"&&n.length===1)return{kind:"lambda"};if(t==="o"&&n.length===1)return{kind:"other"};if(t==="n"&&n.length===2){let r=xe(s);return r!==null&&r!==""?{kind:"name",dotted:r}:null}if(t==="p"&&n.length===2&&Array.isArray(s)){let r=[];for(let i of s){let o=fk(i);if(o===null)return null;r.push(o)}return{kind:"property",accessors:r}}return null}function Za(e){return Os(e,([n,t,s])=>{let r=xe(n),i=pk(t);return r===null||r===""||i===null||!Number.isSafeInteger(s)||s<0?null:{name:r,value:i,at:s}})}function mk(e){if(!bn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e)){let r=xe(t)===null?null:Za(s);if(r===null)return null;n.set(t,r)}return n}var hk=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),gk=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function yk(e,n){if(n!==null)return[];let t=e.truncated;return Array.isArray(t)?t.map(s=>xe(s,64)??"unreadable"):["unreported"]}function _k(e){let n=XS(e.args);return{args:n,calleeOrigin:dk(e.calleeOrigin),receiverProof:cp(e.receiverProof),argProofs:ck(e.argProofs,n)}}function xk(e){let n=xe(e.path,4096);if(n===null)return null;let t=e.refused,s=typeof t=="string"&&gk.has(t)?t:null,r=xe(e.detail,200),i=Ft(e.imports).filter(bn).map(x=>({form:x.form==="import"?"import":"from",module:xe(x.module),level:ts(x.level),names:Ft(x.names).filter(bn).map(k=>({name:xe(k.name)??"",asname:xe(k.asname)})).filter(k=>k.name!==""),star:x.star===!0,deferred:x.deferred===!0,enclosingFunction:xe(x.enclosingFunction),guards:Rs(x.guards).filter(k=>k!==null),range:br(x.range)})),o=Ft(e.functions).filter(bn).flatMap(x=>{let k=xe(x.name),w=xe(x.qualname);return k===null||w===null?[]:[{name:k,qualname:w,kind:x.kind==="async-function"?"async-function":"function",enclosingClass:xe(x.enclosingClass),enclosingFunction:xe(x.enclosingFunction),decorators:Rs(x.decorators),range:br(x.range),params:VS(x.params),method:x.method===!0,decorated:typeof x.decorated=="string"&&uk.has(x.decorated)?x.decorated:"other",rebound:x.rebound!==!1,reflective:x.reflective!==!1,valueFlows:rp(x.flows,!0),decoratorFacts:ok(x.decoratorFacts),paramFacts:ik(x.paramFacts)}]}),a=Ft(e.classes).filter(bn).flatMap(x=>{let k=xe(x.name),w=xe(x.qualname);return k===null||w===null?[]:[{name:k,qualname:w,bases:Rs(x.bases),decorators:Rs(x.decorators),range:br(x.range),metaclass:x.metaclass===null?null:xe(x.metaclass)??"?",rebound:x.rebound!==!1,interceptsLookup:x.interceptsLookup!==!1,nonDefBinds:Co(x.nonDefBinds),valueBases:Array.isArray(x.valueBases)?Rs(x.valueBases):null}]}),d=Ft(e.calls).filter(bn).map(x=>({..._k(x),callee:xe(x.callee),attr:xe(x.attr),receiver:xe(x.receiver),enclosingFunction:xe(x.enclosingFunction),argCount:ts(x.argCount),range:br(x.range),receiverRange:Array.isArray(x.receiverRange)?ss(x.receiverRange[0],x.receiverRange[1]):null,root:x.root===null?null:x.root==="param0"||x.root==="global"?x.root:"other",nameScope:x.nameScope===null&&x.callee===null?null:HS.has(x.nameScope)?x.nameScope:"local",raisedCall:Array.isArray(x.raisedCall)?ss(x.raisedCall[0],x.raisedCall[1]):null,repeats:x.repeats!==!1,registration:ak(x.registration)})),l=Ft(e.escapes).filter(bn).flatMap(x=>{let k=x.kind,w=xe(x.callee);return typeof k!="string"||!hk.has(k)||w===null?[]:[{kind:k,callee:w,target:xe(x.target),attr:xe(x.attr),enclosingFunction:xe(x.enclosingFunction),range:br(x.range)}]}),c=e.all,p=Array.isArray(c)?Rs(c).filter(x=>x!==null):null,u=Co(e.attrWrites),f=mk(e.classBinds),h=Za(e.moduleBinds),g=Za(e.dunderWrites),y=JS(e.moduleBindings),_=yk(e,s),b=f===null&&a.length>0||h===null&&(y===null||y.has("__getattr__")||y.has("__dir__"))||g===null&&(u===null||[...u].some(x=>/^__.+__$/u.test(x))||d.length>0||o.length>0);return s===null&&b&&!_.includes("bindings")&&_.push("bindings"),{path:n,refused:s,...r!==null?{detail:r}:{},imports:i,functions:o,classes:a,calls:d,toplevelFlows:rp(e.toplevelFlows,!1),flowsRefused:e.flowsRefused===null?null:xe(e.flowsRefused,64)??"unreadable",escapes:l,all:p,allComputed:e.allComputed===!0,truncated:_,moduleBindings:y,attrWrites:u,starImport:e.starImport!==!1,moduleOrigins:op(e.moduleOrigins,jt),annotatedAliases:op(e.annotatedAliases,dp),valueNames:Co(e.valueNames),valueAttrs:Co(e.valueAttrs),computedAccess:e.computedAccess!==!1,classBinds:f,moduleBinds:h,dunderWrites:g}}function Oo(e,n={}){let t=n.env??process.env,s=n.python??t[np]??KS,r=[],i=e.filter(g=>!g.includes(`
-`));i.length!==e.length&&r.push(`${String(e.length-i.length)} path(s) carried a newline and were not extracted`);let o=[...BS,...hr("extract.py")];n.maxBytesPerFile!==void 0&&o.push("--max-bytes",String(n.maxBytesPerFile)),n.hints!==void 0&&o.push("--hints",JSON.stringify(n.hints));let a=jS(s,o,{input:i.length>0?`${i.join(`
+}`,C.ScriptTarget.Latest,!0),r=s.parseDiagnostics;if(r!==void 0&&r.length>0||rx(s,n+1,!0))return!0}return!1}function rx(e,n=0,t=!1){return Ya(e,n,t).size>0}function Ya(e,n=0,t=!1){let s=new Set,r=t?VS:nx(e);if(r.saturated)return s.add("saturated"),s;let o=a=>C.isElementAccessExpression(a)&&!C.isStringLiteralLike(a.argumentExpression)&&qo(Ve(a.expression),r),i=a=>{if(t&&(C.isCallExpression(a)||C.isNewExpression(a)||C.isTaggedTemplateExpression(a))){s.add("eval-invocation");return}if(C.isCallExpression(a)){let l=Dr(a);if(l!==null){let d=l.specifierArg;if(d===void 0||!C.isStringLiteralLike(d)||t){s.add("non-literal-load");return}}else{let d=Ve(a.expression);if(C.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if(uf(a.arguments,n)){s.add("eval-code");return}}else if(tx(d)){s.add("loader-callee");return}else if(o(d)){s.add("computed-loader");return}else if(ZS(a,r)){s.add("reflect-get");return}}}else if(C.isNewExpression(a)){let l=Ve(a.expression);if(C.isIdentifier(l)&&l.text==="Function"){if(uf(a.arguments??[],n)){s.add("function-ctor");return}}else if($r(l)){s.add("ctor-chain");return}}else if(C.isIdentifier(a)&&zS.has(a.text)&&qS(a)){s.add("captured-loader");return}else if((C.isPropertyAccessExpression(a)||C.isElementAccessExpression(a))&&(gf(a)||$r(a)||o(a))&&mf(a)){s.add("captured-member");return}else if(C.isBindingElement(a)){let l=a.propertyName??a.name,d=C.isIdentifier(l)||C.isStringLiteralLike(l)?l.text:C.isComputedPropertyName(l)&&C.isStringLiteralLike(l.expression)?l.expression.text:void 0;if(d!==void 0&&Xo.has(d)){s.add("destructured-member");return}}C.forEachChild(a,i)};return i(e),s}function xf(e,n,t){let s=new Set(Ya(t));if(Qa(e)&&n.includes("<")&&n.includes("require")){let r=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);for(let o of Ya(r))s.add(o)}return s}function ox(e,n,t){if(Ja(e))return!0;let s=t.endsWith(cn.sep)?t:t+cn.sep,r=e.split("/"),o=n;for(;;){let i=cn.join(o,"node_modules",...r),a;try{a=is(cn.join(i,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(s))return!1;let d=_n(a);if(d===null)return!1;let c;try{c=JSON.parse(d).exports}catch{return!1}if(typeof c=="string"||Array.isArray(c)||typeof c=="object"&&c!==null)return!1}if(Wu(i))return!1;if(o===t)break;let l=cn.dirname(o);if(l===o||l!==t&&!l.startsWith(s))break;o=l}return!0}function ix(e,n){let t=n.endsWith(cn.sep)?n:n+cn.sep,s=cn.dirname(e);for(;;){let r=cn.join(s,"package.json"),o;try{o=is(r)}catch{o=null}if(o!==null&&(o===n||o.startsWith(t))){let a=_n(o);if(a!==null)try{let l=JSON.parse(a).name;if(typeof l=="string"&&l.length>0)return l}catch{return null}}if(s===n)break;let i=cn.dirname(s);if(i===s||i!==n&&!i.startsWith(t))break;s=i}return null}function ax(e,n,t,s,r){let o=[],i=[],a=new Set,l={},d=[],c=[],f=new Set,p=new Set,u=[],m=!1,g=(b,_)=>{let S;try{S=is(_)}catch{return!1}let k=hn(e,S);if(k===null)return r.push({code:"out-of-root",path:S,detail:"dependency module resolved outside the app root; not followed"}),!1;let v=!t.has(S)&&!p.has(S);return v&&p.size>=qa?(m=!0,!1):(i.push({from:b,to:{module:k}}),v?(p.add(S),o.push(k),!0):!1)},y=(b,_)=>{if(a.add(_),f.has(_))return;f.add(_);let S=Gn(_,b,gn,n),k=S!==null?[S]:qs(_,b,gn,n);k.length>=2&&d.push({path:hn(e,b)??b,specifier:_,candidates:k.map(I=>hn(e,I)??I)});let v=!1;for(let I of k)if(!Cn(I)&&(v=!0,g({surface:_},I))){u.push(I);try{let O=hn(e,is(I)),E=ix(I,e);O!==null&&E!==null&&(l[O]=E)}catch{}}v||ox(_,cn.dirname(b),e)||r.push({code:"unresolved-specifier",path:_,reason:Cr(_,b,gn,n),detail:`dependency "${_}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let b of s)y(b.containingFile,b.packageName);for(;u.length>0&&p.size<qa;){let b=u.pop();if(b===void 0)break;let _=hn(e,b);if(_===null)continue;let S=Hs(b,ss);if(S.kind==="too-large"){r.push({code:"limit-exceeded",path:_,detail:`dependency module over the ${String(ss/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(S.kind==="not-regular"){r.push({code:"parse-error",path:_,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let k=C.createSourceFile(b,S.text,C.ScriptTarget.ES2020,!0),v=k.parseDiagnostics;if(v!==void 0&&v.length>0){r.push({code:"dependency-body",path:_,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let I=xf(b,S.text,k);if(I.size>0){r.push({code:"dependency-body",path:_,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...I].sort()});continue}r.push({code:"dependency-body",path:_,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:_});for(let O of ff(b,S.text))if(O.runtime)if(Ze(O.text)==="package-root"){let E=Bn(O.text);i.push({from:{module:_},to:{surface:E}}),y(b,E)}else{if(Ja(Bn(O.text)))continue;let E=Gn(O.text,b,gn,n),N=E!==null?[E]:qs(O.text,b,gn,n);if(N.length===0){if(Ze(O.text)==="package-subpath"){let A=Cr(O.text,b,gn,n);if(A==="no-candidate"||A==="not-installed"&&Vu(b,Bn(O.text))){c.push({path:_,specifier:O.text,why:A});continue}r.push({code:"unresolved-specifier",path:_,reason:A,detail:`runtime package-subpath import "${O.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}N.length>=2&&d.push({path:_,specifier:O.text,candidates:N.map(A=>hn(e,A)??A)});for(let A of N){if(Cn(A)){let U=hn(e,A);r.push({code:U===null?"out-of-root":"declaration-shadow",path:_,detail:U===null?`runtime import "${O.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${O.text}" resolved to the declaration file "${U}" with no co-located runtime module; its code was not analyzed`});continue}g({module:_},A)&&u.push(A)}}}return(m||u.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(qa)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:o,edges:i,surfacePackages:[...a],entryRealNames:l,conditionUnions:d,provenAbsent:c}}function kf(e,n,t=!1,s=new Set){let r=is(e),o=[],i=[],a=C.createCompilerHost(gn,!0),l=t?Xu(r,gn,a):()=>null,d=new Set,c=new Set,f=n.map(F=>cn.join(r,F)),p=[],u=new Map,m=new Map,g=new Map,y=new Map,b=new Map,_=new Set,S=(F,B,ne)=>{let X=`${String(F.length)}:${F}${B}`;_.has(X)||(_.add(X),o.push({code:"unresolved-specifier",path:F,detail:B,reason:ne}))},k=()=>null,v=0,I=(F,B)=>{let ne=g.get(F);return ne===void 0&&(ne=C.createSourceFile(F,B,C.ScriptTarget.ES2020,!0),g.set(F,ne)),{real:F,sf:ne}};for(;c.size<Uo;){let F=f.pop();if(F===void 0){if(v>=KS)break;v+=1;let Z=[];for(let[G,z]of u)z.includes("readdir")&&(z.includes("require")||z.includes("import("))&&Z.push(I(G,z));let x=GS(Z);if(x.length===0)break;let T=[];for(let[G,z]of u)T.push(I(G,z));k=af(T,x,gn,a,y);let q=!1;for(let G of Z){let z=u.get(G.real);if(z!==void 0)for(let L of cf(G.real,z,r,a,k))c.has(L)||(f.push(L),q=!0)}if(!q)break;continue}let B;try{B=is(F)}catch{continue}if(c.has(B))continue;if(c.add(B),hn(r,B)===null){o.push({code:"out-of-root",path:F,detail:"resolved outside app root"});continue}let ne=Hs(B,ss);if(ne.kind==="too-large"){o.push({code:"limit-exceeded",path:B,detail:`file is ${String(Math.round(ne.bytes/1048576))}MiB, over the ${String(ss/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(ne.kind==="not-regular"){o.push({code:"parse-error",path:B,detail:"unreadable or not a regular file"});continue}let X=St(B),Q=ne.text;if(X!==null){let Z=Or(X,ne.text);Q=Z.code,m.set(B,Z.scriptKind),Z.partial.length>0&&o.push({code:"component-partially-read",path:B,detail:`the component was not read in full: ${Z.partial.join("; ")}`})}d.add(B),u.set(B,Q);for(let Z of ff(B,Q)){let x=Z.runtime?l(Z.text,B):null;if(x===null&&Ze(Z.text)==="package-root"){Z.runtime&&p.push({containingFile:B,packageName:Bn(Z.text)});continue}let T=x??Gn(Z.text,B,gn,a),q=T!==null?[T]:Z.runtime&&x===null?qs(Z.text,B,gn,a):[];if(q.length===0){if(Z.runtime){let G=Ze(Z.text);if(!(G==="package-subpath"&&Ja(Bn(Z.text)))){if(G==="package-subpath")S(B,`runtime package-subpath import "${Z.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,Cr(Z.text,B,gn,a));else if(G==="relative"){let z=Hu(Z.text,B,r,b);z.kind==="unanalyzable"?S(B,`runtime relative import "${Z.text}" did not resolve and its absence could not be proven \u2014 ${z.reason}; a bundler/loader may load a module the analyzer never saw`,z.why):z.kind==="absent"&&Z.unguarded&&TS(r,B)&&S(B,`runtime relative import "${Z.text}" runs whenever its module runs, but nothing is on disk at its target \u2014 the module the running app loads there (a build output, a generated file) was never analyzed`,"absent-unguarded")}}}continue}q.length>=2&&i.push({path:hn(r,B)??B,specifier:Z.text,candidates:q.map(G=>hn(r,G)??G)});for(let G of q){if(hn(r,G)===null){o.push({code:"out-of-root",path:G,detail:`specifier "${Z.text}" resolved outside app root`});continue}if(Z.runtime&&Cn(G)){o.push({code:"declaration-shadow",path:G,detail:`runtime import "${Z.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(Z.runtime&&!Bo(G)){o.push({code:"unanalyzable-module",path:G,detail:`runtime import "${Z.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}f.push(G)}}for(let Z of cf(B,Q,r,a,k))c.has(Z)||f.push(Z)}c.size>=Uo&&f.length>0&&o.push({code:"limit-exceeded",path:r,detail:`reachable file set exceeds ${String(Uo)}; analysis truncated (${String(f.length)}+ files not analyzed)`});let O=ax(r,a,d,p,o),E=new Set,N=new Set,A=F=>{let B=hn(r,F);return B!==null&&s.has(B)};for(let F of d){if(!jS(F))continue;let B=u.get(F);if(B===void 0)continue;let ne=BS(B);if(ne==="other"){if(!A(F))continue;N.add(F),o.push({code:"parse-error",path:F,detail:"extensionless entrypoint declares a non-node interpreter in its shebang; it is not a JavaScript module, and the code it runs was NOT analyzed (degraded to unknown)"});continue}ne==="none"&&!A(F)||E.add(F)}let U=C.createProgram({rootNames:[...d],options:gn,host:a}),$=new Set,W=new Map;for(let F of U.getSourceFiles()){if(F.isDeclarationFile||U.isSourceFileDefaultLibrary(F)||hn(r,F.fileName)===null||!Qa(F.fileName))continue;let B=U.getSyntacticDiagnostics(F).length>0;if(!B&&!F.text.includes("<")||FS(F.text,C.ScriptKind.TSX)!==0)continue;let ne=C.createSourceFile(F.fileName,F.text,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);(B||df(ne)>df(F))&&($.add(F.fileName),W.set(F.fileName,F.text))}let w=U;if($.size>0||E.size>0||m.size>0){let F=a.getSourceFile.bind(a);a.getSourceFile=(ne,X,Q,Z)=>{let x=W.get(ne);if(x!==void 0)return C.createSourceFile(ne,x,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);let T=m.get(ne),q=T===void 0?void 0:u.get(ne);if(q!==void 0)return C.createSourceFile(ne,q,C.ScriptTarget.ES2020,!0,T==="tsx"?C.ScriptKind.TSX:C.ScriptKind.TS);let G=E.has(ne)?u.get(ne):void 0;return G!==void 0?C.createSourceFile(ne,G,C.ScriptTarget.ES2020,!0,C.ScriptKind.JS):F(ne,X,Q,Z)};let B=ne=>U.getSourceFile(ne)!==void 0;w=C.createProgram({rootNames:[...d].filter(ne=>E.has(ne)||m.has(ne)||B(ne)),options:E.size>0||m.size>0?{...gn,allowNonTsExtensions:!0}:gn,host:a,...E.size>0||m.size>0?{}:{oldProgram:U}})}let P=w.getTypeChecker();for(let F of n){if(!s.has(F))continue;let B;try{B=is(cn.join(r,F))}catch{continue}!d.has(B)||N.has(B)||w.getSourceFile(B)===void 0&&(N.add(B),o.push({code:"parse-error",path:B,detail:"entrypoint is not a module cupel can parse (an unrecognised file type); the code it runs was NOT analyzed (degraded to unknown)"}))}let j=[];for(let F of w.getSourceFiles()){if(F.isDeclarationFile||w.isSourceFileDefaultLibrary(F)||hn(r,F.fileName)===null)continue;j.push(F);let B=w.getSyntacticDiagnostics(F);if(B.length>0){let Q=B[0],Z=Q!==void 0?C.flattenDiagnosticMessageText(Q.messageText," "):"syntax error";o.push({code:"parse-error",path:F.fileName,detail:`${String(B.length)} syntax error(s): ${Z}`})}let ne=hn(r,F.fileName),X=ne===null?null:xf(F.fileName,F.text,F);ne!==null&&X!==null&&X.size>0&&o.push({code:"loader-escape",path:ne,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...X].sort()})}return{program:w,checker:P,host:a,options:gn,appRoot:r,sourceFiles:j,diagnostics:o,depReach:O,conditionUnions:[...i,...O.conditionUnions],provenAbsent:O.provenAbsent,resolveParamDirs:k,toRel:F=>hn(r,F)}}import{opendirSync as lx,statSync as dx}from"node:fs";import Za from"node:path";var cx=8192,ux=2e4,fx=new Set(["node_modules"]),wf=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),px=16;function Yo(e,n,t,s,r={}){let o=r.maxEntries??ux,i=r.prune,a=[],l=!1,d=0,c=[{dir:Za.join(e,n),rel:n,depth:0}];for(;c.length>0;){let f=c.pop();if(f===void 0)break;if(f.depth>px){l=!0;continue}let p;try{p=lx(f.dir)}catch{l=!0;continue}try{let u=0;for(;;){let m=p.readSync();if(m===null)break;if(u+=1,d+=1,u>cx||d>o){l=!0;break}let g=f.rel+m.name;if(m.isSymbolicLink()){let y;try{y=dx(Za.join(f.dir,m.name)).isDirectory()}catch{l=!0;continue}if(y){l=!0;continue}}else if(m.isDirectory()){if(fx.has(m.name)||m.name.startsWith(".")||i?.has(m.name)===!0){l=!0;continue}c.push({dir:Za.join(f.dir,m.name),rel:`${g}/`,depth:f.depth+1});continue}else if(!m.isFile())continue;if(t(g)){if(a.length>=s){l=!0;break}a.push(g)}}}finally{try{p.closeSync()}catch{}}}return{matches:a,truncated:l}}var mx=64;function vf(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let s=n.slice(0,t),r=n.slice(t+1);if(s.startsWith("./")&&(s=s.slice(2)),s.startsWith("/")||r.includes("/")||s.split("/").includes("..")||s.includes("\\")||n.includes("\0"))return null;let o=s.slice(0,s.lastIndexOf("/")+1);return Yo(e,o,i=>i.length>=s.length+r.length&&i.startsWith(s)&&i.endsWith(r),mx)}import{existsSync as gx}from"node:fs";import hx from"node:path";var yx=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"],components:{route:e=>e.endsWith(".astro")}},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"],components:{route:e=>e==="+page.svelte"||e==="+layout.svelte"||e==="+error.svelte"}},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"],components:{route:e=>e.endsWith(".vue"),dirs:["layouts"],files:["app.vue","error.vue"]}},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],bx=["dependencies","devDependencies"];function _x(e,n){for(let t of bx){let s=e[t];if(!(typeof s!="object"||s===null||Array.isArray(s))&&Object.hasOwn(s,n))return!0}return!1}function el(e,n){if(n===null)return null;for(let t of yx)if(_x(n,t.dependency)){for(let s of t.configFiles)if(gx(hx.join(e,s)))return{name:t.name,configFile:s,entryHint:t.entryHint,rootDirs:t.rootDirs,...t.components!==void 0?{components:t.components}:{}}}return null}function nl(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var Sx=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],xx=256,kx=12e4;function tl(e,n){let t=new Set(n.rootDirs),s=n.components,r=new Set([...n.rootDirs,...s?.dirs??[]]),o=new Set(s?.files??[]);if(t.size===0&&s===void 0)return{roots:[],truncated:!1};let i=Yo(e,"",a=>{let l=a.split("/"),d=l[l.length-1]??"";if(s!==void 0&&St(d)!==null)return o.has(d)?!0:s.route(d)?l.slice(0,-1).some(c=>r.has(c)):!1;for(let c=0;c<l.length-1;c+=1){let f=l[c];if(f!==void 0&&t.has(f))return Sx.some(p=>a.endsWith(p))}return!1},xx,{maxEntries:kx,prune:wf});return{roots:i.matches,truncated:i.truncated}}function Kn(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let s of n){let r=s.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:s}return t}function wx(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function vx(e){let n=!1;for(let t=0;t<e.length;t+=1){let s=e.charAt(t),r=s.codePointAt(0)??0;if(r<32||r===127||r>=128&&r<=159)return null;if(s==="\\"){n=!0;let o=e.charAt(t+1);if(!(o>="a"&&o<="z"||o>="A"&&o<="Z"||o>="0"&&o<="9"||o==="."||o==="_"||o==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(s))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function Ex(e){let n=[],t="";for(let s of e){if(s===" "||s==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=s}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var Ax=/^[A-Za-z_][A-Za-z0-9_]*=/u;function Ix(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var Ef=new Set(["flask","granian","gunicorn","hypercorn","php","php-fpm","puma","python","python2","python3","rails","ruby","streamlit","unicorn","uvicorn","uwsgi","waitress-serve"]);function Nx(e){let n=e.slice(e.lastIndexOf("/")+1);return Ef.has(n)||Ef.has(n.replace(/[0-9.]+$/u,""))}var Rx=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),Ox=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),Px=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function If(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Af(e){if(If(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return Px.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:Rx.has(t)||n!==-1&&Ox.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var Cx=[".js",".cjs",".mjs",".ts",".mts",".cts"];function Mx(e){return Cx.some(n=>e.endsWith(n))}var Tx=new Set(["npm","yarn","pnpm"]);function $x(e){let n=e[0];return n===void 0||!Tx.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function rl(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!wx(n))return sl(n);let t=vx(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let s=sl(t.windows),r=sl(t.posixShell);if(s.kind==="file"){let o=r.kind==="file"?r.specifier:void 0;return o===void 0||o===s.specifier?{kind:"file",specifier:s.specifier}:{kind:"file",specifier:s.specifier,alt:o}}return r.kind==="file"?{kind:"file",specifier:r.specifier}:s}function sl(e){let n=Ex(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let o=n[t];if(o===void 0||!Ax.test(o))break;if(If(o))return{kind:"unparsed",reason:`environment \`${Kn(o)}\` preloads another module; the launch surface is more than one file`};let i=o.indexOf("=");if(o.slice(0,i)==="NODE_OPTIONS")for(let a of o.slice(i+1).split(/\s+/u)){if(a===""||!a.startsWith("-"))continue;let l=Af(a);if(l!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Kn(l.token)}\` ${l.why}`}}}let s=n[t];if(s===void 0)return{kind:"unparsed",reason:"no program in the command"};if($x(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!Ix(s))return Nx(s)?{kind:"foreign",binary:s}:{kind:"unparsed",reason:`runs \`${Kn(s)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let o=n[t];if(o===void 0||!o.startsWith("-"))break;let i=Af(o);if(i!==null)return{kind:"unparsed",reason:`node flag \`${Kn(i.token)}\` ${i.why}`}}let r=n[t];return r===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:Mx(r)?{kind:"file",specifier:r}:{kind:"unparsed",reason:`\`${Kn(r)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Lx(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Dx=64,ol=64*1024,Fx=64;function il(e){let n=[],t=!1;for(let s of e.split(/\r?\n/u)){if(n.length>=Fx){t=!0;break}let r=/^\s*(CMD|ENTRYPOINT)\s+(.*\S)\s*$/iu.exec(s),o=/^\s*(command|entrypoint):\s*(.*\S)\s*$/u.exec(s),i=r??o;if(i?.[1]===void 0||i[2]===void 0)continue;let a=jx(i[2]);a!==null&&n.push({label:i[1].toUpperCase(),command:a})}return{commands:n,truncated:t}}function jx(e){let n=e.trim();if(!n.startsWith("["))return n===""?null:n;let t;try{t=JSON.parse(n)}catch{return null}if(!Array.isArray(t))return null;let s=t.filter(r=>typeof r=="string");return s.length===0||s.length!==t.length?null:s.join(" ")}function al(e){let n=e.split(`
+`),t=n.length>64,s=[],r=0;for(let o of n.slice(0,64)){let i=o.trim();if(i.length===0||i.startsWith("#"))continue;let a=i.indexOf(":");if(a<=0)continue;let l=i.slice(a+1).trim();if(l.length===0)continue;let d=i.slice(0,a);if(d.length>Dx||!Lx(d)){r+=1;continue}s.push({name:d,command:l})}return s.sort((o,i)=>o.name===i.name?0:o.name==="web"?-1:i.name==="web"?1:0),{entries:s,truncated:t,unnamedLines:r}}import{realpathSync as Vf}from"node:fs";import Mn from"node:path";import h from"typescript";import M from"typescript";import Nf from"node:path";import ue from"typescript";var Bx=/^lib\.(?:es5|es20\d\d(?:\.[a-z0-9]+)*|esnext(?:\.[a-z0-9]+)*|decorators(?:\.legacy)?)\.d\.ts$/u,Gx=/^lib\.(?:dom|webworker|scripthost)(?:\.[a-z0-9]+)*\.d\.ts$/u;function Kx(e,n){if(e.isSourceFileDefaultLibrary(n)){let t=Nf.basename(n.fileName);return Bx.test(t)?"ecmascript":Gx.test(t)?"host-lib":"unknown"}return n.fileName.split(Nf.sep).join("/").includes("/node_modules/")?"dependency":"app"}function zx(e,n,t){if(t===void 0)return"unknown";let s=t;if(s.flags&ue.SymbolFlags.Alias)try{s=n.getAliasedSymbol(s)}catch{return"unknown"}let r=s.declarations??[];if(r.length===0)return"unknown";let o=new Set(r.map(i=>Kx(e,i.getSourceFile())));return o.size===1?[...o][0]:"unknown"}function ll(e,n,t){let s=t;for(;ue.isParenthesizedExpression(s);)s=s.expression;let r;if(ue.isIdentifier(s)?r=s:ue.isPropertyAccessExpression(s)?r=s.name:ue.isElementAccessExpression(s)&&ue.isStringLiteralLike(s.argumentExpression)&&(r=s.argumentExpression),r===void 0)return"unknown";let o;try{o=n.getSymbolAtLocation(r)}catch{return"unknown"}return zx(e,n,o)}function Wx(e){if(ue.isVariableDeclaration(e)){let n=e.parent;return ue.isVariableDeclarationList(n)&&ue.isVariableStatement(n.parent)&&ue.isSourceFile(n.parent.parent)}return ue.isFunctionDeclaration(e)||ue.isClassDeclaration(e)?ue.isSourceFile(e.parent):ue.isImportClause(e)||ue.isImportSpecifier(e)||ue.isNamespaceImport(e)}function Rf(e,n,t){let s;try{s=n.getSymbolAtLocation(t)}catch{return"unknown"}let r=s?.declarations??[];if(r.length===0)return"unknown";let o=t.getSourceFile();return r.every(i=>i.getSourceFile()===o&&Wx(i))?"module":r.every(i=>e.isSourceFileDefaultLibrary(i.getSourceFile()))?"global":"unknown"}var Ux=ue.TypeFlags.StringLike|ue.TypeFlags.NumberLike|ue.TypeFlags.BooleanLike|ue.TypeFlags.BigIntLike|ue.TypeFlags.ESSymbolLike|ue.TypeFlags.Null|ue.TypeFlags.Undefined|ue.TypeFlags.Void;function Of(e){return e.flags&(ue.TypeFlags.Any|ue.TypeFlags.Unknown|ue.TypeFlags.Never)?!1:e.isUnion()?e.types.every(Of):(e.flags&Ux)!==0&&(e.flags&ue.TypeFlags.Object)===0}var Hx=new Set([ue.SyntaxKind.EqualsEqualsToken,ue.SyntaxKind.EqualsEqualsEqualsToken,ue.SyntaxKind.ExclamationEqualsToken,ue.SyntaxKind.ExclamationEqualsEqualsToken,ue.SyntaxKind.LessThanToken,ue.SyntaxKind.LessThanEqualsToken,ue.SyntaxKind.GreaterThanToken,ue.SyntaxKind.GreaterThanEqualsToken,ue.SyntaxKind.InstanceOfKeyword,ue.SyntaxKind.InKeyword,ue.SyntaxKind.PlusToken,ue.SyntaxKind.MinusToken,ue.SyntaxKind.AsteriskToken,ue.SyntaxKind.AsteriskAsteriskToken,ue.SyntaxKind.SlashToken,ue.SyntaxKind.PercentToken,ue.SyntaxKind.AmpersandToken,ue.SyntaxKind.BarToken,ue.SyntaxKind.CaretToken,ue.SyntaxKind.LessThanLessThanToken,ue.SyntaxKind.GreaterThanGreaterThanToken,ue.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]),qx=new Set([ue.SyntaxKind.AmpersandAmpersandToken,ue.SyntaxKind.BarBarToken,ue.SyntaxKind.QuestionQuestionToken]);function Fr(e,n,t,s=0){if(s>8)return!1;let r=t;for(;ue.isParenthesizedExpression(r);)r=r.expression;let o=i=>Fr(e,n,i,s+1);if(ue.isStringLiteral(r)||ue.isNoSubstitutionTemplateLiteral(r)||ue.isTemplateExpression(r)||ue.isNumericLiteral(r)||ue.isBigIntLiteral(r)||r.kind===ue.SyntaxKind.TrueKeyword||r.kind===ue.SyntaxKind.FalseKeyword||r.kind===ue.SyntaxKind.NullKeyword||ue.isTypeOfExpression(r)||ue.isVoidExpression(r)||ue.isPrefixUnaryExpression(r)||ue.isPostfixUnaryExpression(r)||ue.isIdentifier(r)&&r.text==="undefined")return!0;if(ue.isBinaryExpression(r)){let i=r.operatorToken.kind;return Hx.has(i)?!0:qx.has(i)?o(r.left)&&o(r.right):i===ue.SyntaxKind.CommaToken?o(r.right):!1}if(ue.isConditionalExpression(r))return o(r.whenTrue)&&o(r.whenFalse);if(ue.isCallExpression(r)){if(ll(e,n,r.expression)!=="ecmascript")return!1;try{let i=n.getResolvedSignature(r);return i!==void 0&&Of(n.getReturnTypeOfSignature(i))}catch{return!1}}if(ue.isIdentifier(r)){let i;try{i=n.getSymbolAtLocation(r)}catch{return!1}let a=i?.declarations??[],l=a.length===1?a[0]:void 0;return l===void 0||!ue.isVariableDeclaration(l)||l.initializer===void 0||!ue.isIdentifier(l.name)||!ue.isVariableDeclarationList(l.parent)||(l.parent.flags&ue.NodeFlags.Const)===0?!1:o(l.initializer)}return!1}import Xn from"typescript";var xn={kind:"receiver"},Sn=e=>({kind:"arg",index:e}),dl=e=>({kind:"args-from",index:e}),sn=dl(0),jt=(e=[sn])=>({result:[sn],mutates:[],callsProgram:e}),ot=(e=[xn,sn])=>({result:[xn,sn],mutates:[],callsProgram:e}),rt=(e=[])=>({result:[xn],mutates:[],callsProgram:e}),Vx={result:[],mutates:[]},cl=new Map,xe=(e,n)=>{for(let t of e)cl.set(t,n)};xe(["String","Number","BigInt"],{result:[Sn(0)],mutates:[],callsProgram:[Sn(0)]});xe(["Boolean"],{result:[Sn(0)],mutates:[]});xe(["parseInt","parseFloat","isNaN","isFinite","encodeURIComponent","encodeURI","decodeURIComponent","decodeURI","escape","unescape"],jt());xe(["Array","Object"],{result:[sn],mutates:[]});xe(["String.fromCharCode","String.fromCodePoint","String.raw"],jt());xe(["at","charAt","charCodeAt","codePointAt","concat","endsWith","includes","indexOf","isWellFormed","lastIndexOf","localeCompare","match","matchAll","normalize","padEnd","padStart","repeat","replace","replaceAll","search","slice","split","startsWith","substr","substring","toLocaleLowerCase","toLocaleUpperCase","toLowerCase","toString","toUpperCase","toWellFormed","trim","trimEnd","trimLeft","trimRight","trimStart","valueOf"].map(e=>`String.prototype.${e}`),ot());xe(["Object.keys","Object.values","Object.entries","Object.getOwnPropertyNames","Object.getOwnPropertySymbols","Object.getPrototypeOf","Object.fromEntries","Object.freeze","Object.seal","Object.preventExtensions","Object.isFrozen","Object.isSealed","Object.isExtensible"],{result:[Sn(0)],mutates:[],callsProgram:[Sn(0)]});xe(["Object.is","Object.hasOwn","Object.create"],jt());xe(["Object.assign"],{result:[sn],mutates:[{into:Sn(0),from:[dl(1)]}],callsProgram:[sn]});xe(["Object.defineProperty"],{result:[Sn(0)],mutates:[{into:Sn(0),from:[Sn(2)]}],callsProgram:[sn]});xe(["Object.prototype.hasOwnProperty","Object.prototype.isPrototypeOf","Object.prototype.propertyIsEnumerable","Object.prototype.toString","Object.prototype.toLocaleString","Object.prototype.valueOf"],ot());xe(["Array.isArray"],{result:[Sn(0)],mutates:[]});xe(["Array.of"],{result:[sn],mutates:[]});xe(["Array.from"],jt());var Xx=["at","concat","entries","flat","includes","indexOf","join","keys","lastIndexOf","slice","toLocaleString","toReversed","toSpliced","toString","values","with"];xe(Xx.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),ot([xn,sn]));var Yx=["every","filter","find","findIndex","findLast","findLastIndex","flatMap","forEach","map","reduce","reduceRight","some","toSorted"];xe(Yx.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),ot([xn,sn]));xe(["Array.prototype.push","Array.prototype.unshift"],{result:[xn,sn],mutates:[{into:xn,from:[sn]}]});xe(["Array.prototype.splice"],{result:[xn],mutates:[{into:xn,from:[dl(2)]}],callsProgram:[sn]});xe(["Array.prototype.fill"],{result:[xn,Sn(0)],mutates:[{into:xn,from:[Sn(0)]}],callsProgram:[sn]});xe(["Array.prototype.pop","Array.prototype.shift"],rt());xe(["Array.prototype.reverse","Array.prototype.copyWithin"],rt([sn]));xe(["Array.prototype.sort"],rt([xn,sn]));for(let e of["Map","WeakMap","ReadonlyMap"])xe([`${e}.prototype.get`],rt()),xe([`${e}.prototype.has`],ot([])),xe([`${e}.prototype.delete`],ot([])),xe([`${e}.prototype.set`],{result:[xn],mutates:[{into:xn,from:[Sn(0),Sn(1)]}]}),xe([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],rt()),xe([`${e}.prototype.forEach`],rt([sn]));for(let e of["Set","WeakSet","ReadonlySet"])xe([`${e}.prototype.has`],ot([])),xe([`${e}.prototype.delete`],ot([])),xe([`${e}.prototype.add`],{result:[xn],mutates:[{into:xn,from:[Sn(0)]}]}),xe([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],rt()),xe([`${e}.prototype.forEach`],rt([sn]));xe(["Map.prototype.clear","Set.prototype.clear"],rt());xe(["JSON.parse","JSON.stringify"],jt());xe(["Number.isInteger","Number.isFinite","Number.isNaN","Number.isSafeInteger"],{result:[Sn(0)],mutates:[]});xe(["Number.parseInt","Number.parseFloat"],jt());xe(["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"].map(e=>`Number.prototype.${e}`),ot([sn]));xe(["abs","acos","acosh","asin","asinh","atan","atan2","atanh","cbrt","ceil","clz32","cos","cosh","exp","expm1","floor","fround","hypot","imul","log","log10","log1p","log2","max","min","pow","round","sign","sin","sinh","sqrt","tan","tanh","trunc"].map(e=>`Math.${e}`),jt());xe(["Math.random","Date.now"],Vx);xe(["RegExp.prototype.test","RegExp.prototype.exec"],ot());xe(["RegExp.prototype.toString"],rt());xe(["Date.parse","Date.UTC"],jt());xe(["getDate","getDay","getFullYear","getHours","getMilliseconds","getMinutes","getMonth","getSeconds","getTime","getTimezoneOffset","toDateString","toISOString","toJSON","toLocaleDateString","toLocaleString","toLocaleTimeString","toString","toTimeString","toUTCString","valueOf"].map(e=>`Date.prototype.${e}`),rt());xe(["Promise.resolve","Promise.all","Promise.allSettled","Promise.any","Promise.race"],jt());xe(["Promise.prototype.then","Promise.prototype.catch","Promise.prototype.finally"],ot());var Jx=new Set(["JSON","Math","Reflect","Atomics"]);function Pf(e,n){let t=n;for(;Xn.isParenthesizedExpression(t);)t=t.expression;let s=Xn.isIdentifier(t)?t:Xn.isPropertyAccessExpression(t)?t.name:void 0;if(s===void 0)return null;let r;try{r=e.getSymbolAtLocation(s),r!==void 0&&r.flags&Xn.SymbolFlags.Alias&&(r=e.getAliasedSymbol(r))}catch{return null}let o=r?.valueDeclaration??r?.declarations?.[0];if(o===void 0)return null;if(Xn.isIdentifier(t))return(Xn.isVariableDeclaration(o)||Xn.isFunctionDeclaration(o))&&o.name!==void 0&&Xn.isIdentifier(o.name)?o.name.text:null;let i=o.parent;if(Xn.isModuleBlock(i)&&Xn.isModuleDeclaration(i.parent)&&Xn.isIdentifier(i.parent.name))return`${i.parent.name.text}.${s.text}`;if(!Xn.isInterfaceDeclaration(i))return null;let a=i.name.text,l=s.text;return Jx.has(a)?`${a}.${l}`:a.endsWith("Constructor")?`${a.slice(0,-11)}.${l}`:`${a}.prototype.${l}`}function Cf(e){let n=cl.get(e);return n===void 0?void 0:{id:`ecmascript:${e}`,...n}}var YC=cl.size;import ks from"typescript";var ul=["get","post","put","patch","delete","options","head","all"],Qx=[{id:"express@4-source-v1",packages:["express"],members:new Set([...ul,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://expressjs.com/en/4x/api.html#app.METHOD \u2014 callbacks receive (req, res, next); error-handling middleware receives (err, req, res, next)"},{id:"koa@2-source-v1",packages:["koa","@koa/router","koa-router"],members:new Set([...ul,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://koajs.com/#context \u2014 middleware receives (ctx, next); ctx.request carries the request"},{id:"fastify@4-source-v1",packages:["fastify"],members:new Set(ul),sourceClass:"remote-unauthenticated",evidence:"https://fastify.dev/docs/latest/Reference/Routes/ \u2014 handler receives (request, reply)"}];function Mf(e){let n=new Set(e.map(t=>t.startsWith("@")?t.split("/").slice(0,2).join("/"):t.split("/")[0]));return Qx.filter(t=>t.packages.some(s=>n.has(s)))}function Jo(e,n){if(n.length===0)return null;let t=e.expression;for(;ks.isParenthesizedExpression(t);)t=t.expression;if(!ks.isPropertyAccessExpression(t))return null;let s=t.name.text,r=n.find(a=>a.members.has(s));if(r===void 0)return null;let o=e.arguments.filter(a=>ks.isArrowFunction(a)||ks.isFunctionExpression(a)||ks.isIdentifier(a)||ks.isPropertyAccessExpression(a)),i=e.arguments.filter(ks.isCallExpression);return o.length>0||i.length>0?{model:r,handlers:o,forwarded:i}:null}function jr(e,n){return e.id.startsWith("express@")&&n===4?1:0}function ws(e){return M.isFunctionDeclaration(e)||M.isFunctionExpression(e)||M.isArrowFunction(e)||M.isMethodDeclaration(e)||M.isConstructorDeclaration(e)||M.isGetAccessorDeclaration(e)||M.isSetAccessorDeclaration(e)}var Qo=(e,n,t)=>({path:e,start:n.getStart(t,!1),end:n.getEnd()});function Zx(e,n,t){let s=[];for(let r of e.parameters){if(M.isIdentifier(r.name)&&r.name.text==="this")continue;let o=M.isIdentifier(r.name)?r.name.text:void 0;s.push({index:s.length,kind:r.dotDotDotToken!==void 0?"rest":"positional",...o!==void 0?{name:o}:{},destructured:o===void 0,hasDefault:r.initializer!==void 0,range:Qo(n,r,t)})}return s}function ek(e){return M.isArrowFunction(e)?"lexical":"call"}function nk(e){let n=!1,t=s=>{if(!n&&!(s!==e&&ws(s)&&!M.isArrowFunction(s))){if(M.isIdentifier(s)&&s.text==="arguments"){let r=s.parent;M.isPropertyAccessExpression(r)&&r.name===s||M.isPropertyAssignment(r)&&r.name===s||(n=!0)}M.isCallExpression(s)&&M.isIdentifier(s.expression)&&s.expression.text==="eval"&&(n=!0),M.forEachChild(s,t)}};e.body!==void 0&&M.forEachChild(e.body,t);for(let s of e.parameters)s.initializer!==void 0&&t(s.initializer);return n}function pl(e,n,t,s=[],r,o=new Map){let i=new Map;if(s.length>0){let p=u=>{if(M.isCallExpression(u)){let m=Jo(u,s);for(let g of m?.handlers??[])m!==null&&(M.isArrowFunction(g)||M.isFunctionExpression(g))&&i.set(g,{model:m.model,index:jr(m.model,g.parameters.length),registeredAt:Qo(t,u,n)})}M.forEachChild(u,p)};p(n)}for(let[p,u]of o)i.has(p)||i.set(p,u);let a=[],l=p=>{ws(p)&&a.push({start:p.getStart(n,!1),end:p.getEnd(),node:p}),M.forEachChild(p,l)};l(n),a.sort((p,u)=>p.start-u.start||u.end-p.end);let d=p=>{let u=0,m=a.length;for(;u<m;){let g=u+m>>>1;(a[g]?.start??1/0)<p?u=g+1:m=g}return u},c=e.map(p=>{if(p.declRange.path!==t||p.name==="<toplevel>")return;let{start:u,end:m}=p.declRange,g=d(u);for(;g<a.length&&(a[g]?.start??1/0)<m&&(a[g]?.end??0)>m;)g+=1;let y=a[g];if(y===void 0||y.start>=m||y.end>m)return;let b=a[d(y.end)];if(!(b!==void 0&&b.start<m&&b.end<=m))return y.node}),f=new Set(c.filter(p=>p!==void 0));return e.map((p,u)=>{if(p.name==="<toplevel>"&&p.declRange.path===t){let b=$f(n,f,n,i,r);return b!==void 0?{...p,valueFlows:b}:p}let m=c[u];if(m===void 0)return p;let g=$f(m,f,n,i,r),y=i.get(m);return{...p,...y!==void 0?{sourceParams:[{index:y.index,sourceClass:y.model.sourceClass,model:y.model.id,registeredAt:y.registeredAt}]}:{},params:Zx(m,t,n),receiver:ek(m),reflectiveArguments:nk(m),...g!==void 0?{valueFlows:g}:{}}})}var tk=new Set(["call","apply","bind"]),Tf=new WeakMap;function Ff(e,n){let t=Tf.get(n.checker);t===void 0&&(t=new WeakMap,Tf.set(n.checker,t));let s=t.get(e);if(s!==void 0)return s;let r=ll(n.program,n.checker,e),o=r==="ecmascript"?Pf(n.checker,e):null,i=o!==null?Cf(o):void 0,a={calleeDecl:r,identity:o,...i!==void 0?{summary:i}:{}};return t.set(e,a),a}function ml(e,n,t,s,r){let o=n;for(;M.isParenthesizedExpression(o);)o=o.expression;let i=M.isPropertyAccessExpression(o)||M.isElementAccessExpression(o)?o.expression:void 0,a=i!==void 0?{receiverRange:Qo(t,i,s)}:{},l={repeats:sk(e)},d=r!==void 0?Ff(n,r):void 0,c=d?.calleeDecl,f=d?.identity??null,p=d?.summary,u={...c!==void 0?{calleeDecl:c}:{},...p!==void 0?{summary:p}:{},...f!==null?{runtimeId:`ecmascript:${f}`}:{},...r!==void 0&&i!==void 0&&Fr(r.program,r.checker,i)?{receiverPrimitive:!0}:{}};if(M.isTaggedTemplateExpression(e))return{convention:"unknown",...a,...l,...u};let m=M.isPropertyAccessExpression(o)&&tk.has(o.name.text);return{args:e.arguments.map((y,b)=>({index:b,spread:M.isSpreadElement(y)?"positional":!1,range:Qo(t,y,s),...r!==void 0&&!M.isSpreadElement(y)&&Fr(r.program,r.checker,y)?{primitive:!0}:{}})),convention:m?"unknown":"direct",...a,...l,...u}}function sk(e){for(let n=e.parent;n!==void 0;n=n.parent){if(M.isForStatement(n)||M.isForInStatement(n)||M.isForOfStatement(n)||M.isWhileStatement(n)||M.isDoStatement(n))return!0;if(M.isFunctionDeclaration(n)||M.isMethodDeclaration(n)||M.isConstructorDeclaration(n)||M.isGetAccessorDeclaration(n)||M.isSetAccessorDeclaration(n))return!1;if(M.isFunctionExpression(n)||M.isArrowFunction(n))return!(M.isVariableDeclaration(n.parent)&&n.parent.initializer===n)}return!0}var jf=2e4,Xs={kind:"constant"},yn=e=>({kind:"opaque",reason:e}),Zo=class extends Error{},rk=new Set([M.SyntaxKind.BarBarToken,M.SyntaxKind.AmpersandAmpersandToken,M.SyntaxKind.QuestionQuestionToken,M.SyntaxKind.BarBarEqualsToken,M.SyntaxKind.AmpersandAmpersandEqualsToken,M.SyntaxKind.QuestionQuestionEqualsToken]),ok=new Set([M.SyntaxKind.EqualsToken,M.SyntaxKind.BarBarEqualsToken,M.SyntaxKind.AmpersandAmpersandEqualsToken,M.SyntaxKind.QuestionQuestionEqualsToken]);function Bt(e){switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${String(e.at)}-${String(e.end)}`;case"argument":return`a${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"call-receiver":return`r${String(e.at)}-${String(e.end)}`;case"mutated-by-call":return`m${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"source":return`s${e.model}`;case"shared":return`h${String(e.id)}`;default:return e.kind}}var Br=e=>e.kind==="local"||e.kind==="param"||e.kind==="receiver"||e.kind==="free";function fl(e){if(M.isIdentifier(e))return[];let n=[];for(let t of e.elements)M.isOmittedExpression(t)||(t.initializer!==void 0&&n.push(t),n.push(...fl(t.name)));return n}function ik(e){return M.isWithStatement(e)||M.isCallExpression(e)&&M.isIdentifier(e.expression)&&e.expression.text==="eval"}function $f(e,n,t,s,r){let o=[],i=(x,T,q)=>{for(let G of x)for(let z of T)if(o.push({from:G,to:z,kind:q}),o.length>jf)throw new Zo},a=x=>x.getStart(t,!1),l=x=>({at:x.getStart(t,!1),end:x.getEnd()}),d=x=>r!==void 0&&Fr(r.program,r.checker,x),c=new Map,f=new Map,p=(x,T)=>{f.set(x,T);let q=c.get(x.text);q===void 0?c.set(x.text,[T]):q.push(T)},u=x=>{if(M.isIdentifier(x))return[x];let T=[];for(let q of x.elements)M.isOmittedExpression(q)||T.push(...u(q.name));return T},m=x=>({kind:"local",name:x.text,declStart:a(x)}),g=M.isSourceFile(e)?[]:e.parameters.filter(x=>!(M.isIdentifier(x.name)&&x.name.text==="this"));g.forEach((x,T)=>{if(M.isIdentifier(x.name))p(x.name,{kind:"param",index:T});else for(let q of u(x.name))p(q,m(q))});let y=x=>{for(let T=x.parent;T!==void 0&&T!==e;T=T.parent)if(ws(T)&&!M.isArrowFunction(T))return!0;return!1},b=x=>{if(x!==e&&ws(x)){if(n.has(x))return;for(let T of x.parameters)for(let q of u(T.name))p(q,m(q))}else if(M.isVariableDeclaration(x))for(let T of u(x.name))p(T,m(T));else if((M.isFunctionDeclaration(x)||M.isClassDeclaration(x))&&x.name!==void 0&&x!==e)p(x.name,m(x.name));else if(M.isCatchClause(x)&&x.variableDeclaration!==void 0)for(let T of u(x.variableDeclaration.name))p(T,m(T));M.forEachChild(x,b)},_=[];M.isSourceFile(e)?_.push(e):e.body!==void 0&&_.push(e.body);for(let x of g){x.initializer!==void 0&&_.push(x.initializer);for(let T of fl(x.name))T.initializer!==void 0&&_.push(T.initializer)}for(let x of _)b(x);let S=x=>r===void 0?{kind:"free",name:x.text}:{kind:"free",name:x.text,binding:Rf(r.program,r.checker,x)},k=x=>{if(r===void 0)return;let T;try{let L=x.parent;T=L!==void 0&&M.isShorthandPropertyAssignment(L)&&L.name===x?r.checker.getShorthandAssignmentValueSymbol(L):r.checker.getSymbolAtLocation(x)}catch{return}let q=T?.declarations??[];if(q.length===0)return;let G=[],z=!1;for(let L of q){let ie=M.getNameOfDeclaration(L),me=ie===void 0?void 0:f.get(ie);me===void 0?z=!0:G.push(me)}return z&&G.push(S(x)),G},v=x=>{if(x.text==="undefined")return[Xs];if(x.text==="arguments")return[yn("reflective")];let T=k(x);return T!==void 0?T:c.get(x.text)??[S(x)]},I=x=>{if(n.has(x))return[];if(M.isArrowFunction(x)&&!M.isBlock(x.body))return[x.body];let T=[],q=G=>{ws(G)||((M.isReturnStatement(G)||M.isYieldExpression(G))&&G.expression!==void 0&&T.push(G.expression),M.forEachChild(G,q))};return x.body!==void 0&&M.forEachChild(x.body,q),T},O=x=>{if(M.isStringLiteral(x)||M.isNumericLiteral(x)||M.isBigIntLiteral(x)||M.isNoSubstitutionTemplateLiteral(x)||M.isRegularExpressionLiteral(x)||x.kind===M.SyntaxKind.TrueKeyword||x.kind===M.SyntaxKind.FalseKeyword||x.kind===M.SyntaxKind.NullKeyword||M.isVoidExpression(x)||M.isDeleteExpression(x))return[Xs];if(M.isFunctionExpression(x)||M.isArrowFunction(x)||M.isClassExpression(x))return[yn("unmodeled")];if(M.isIdentifier(x))return v(x);if(x.kind===M.SyntaxKind.ThisKeyword)return y(x)||M.isSourceFile(e)?[yn("unmodeled")]:[{kind:"receiver"}];if(M.isParenthesizedExpression(x)||M.isAsExpression(x)||M.isNonNullExpression(x)||M.isTypeAssertionExpression(x)||M.isSatisfiesExpression(x)||M.isSpreadElement(x)||M.isTypeOfExpression(x)||M.isAwaitExpression(x))return O(x.expression);if(M.isYieldExpression(x))return[yn("unmodeled")];if(M.isPropertyAccessExpression(x)||M.isElementAccessExpression(x))return O(x.expression);if(M.isCallExpression(x)){if(M.isIdentifier(x.expression)&&x.expression.text==="require"){let T=x.arguments[0];return T!==void 0&&M.isStringLiteralLike(T)?[Xs]:[yn("unmodeled")]}return x.expression.kind===M.SyntaxKind.ImportKeyword?[yn("unmodeled")]:[{kind:"call-result",...l(x)}]}if(M.isTaggedTemplateExpression(x))return[{kind:"call-result",...l(x)}];if(M.isNewExpression(x))return[yn("construct")];if(M.isConditionalExpression(x))return[...O(x.whenTrue),...O(x.whenFalse)];if(M.isBinaryExpression(x)){let T=x.operatorToken.kind;return T===M.SyntaxKind.CommaToken||T===M.SyntaxKind.EqualsToken?O(x.right):[...O(x.left),...O(x.right)]}return M.isPrefixUnaryExpression(x)||M.isPostfixUnaryExpression(x)?O(x.operand):M.isTemplateExpression(x)?x.templateSpans.flatMap(T=>O(T.expression)):M.isArrayLiteralExpression(x)?x.elements.length===0?[Xs]:x.elements.flatMap(T=>O(T)):M.isObjectLiteralExpression(x)?x.properties.length===0?[Xs]:x.properties.flatMap(T=>M.isPropertyAssignment(T)?O(T.initializer):M.isShorthandPropertyAssignment(T)?v(T.name):M.isSpreadAssignment(T)?O(T.expression):M.isSetAccessorDeclaration(T)?[Xs]:[yn("unmodeled")]):[yn("unmodeled")]},E=x=>{if(M.isIdentifier(x))return v(x).filter(Br);if(x.kind===M.SyntaxKind.ThisKeyword)return O(x).filter(Br);if(M.isParenthesizedExpression(x)||M.isAsExpression(x)||M.isNonNullExpression(x)||M.isTypeAssertionExpression(x)||M.isSatisfiesExpression(x)||M.isSpreadElement(x)||M.isAwaitExpression(x)||M.isPropertyAccessExpression(x)||M.isElementAccessExpression(x))return E(x.expression);if(M.isConditionalExpression(x))return[...E(x.whenTrue),...E(x.whenFalse)];if(M.isBinaryExpression(x)){let T=x.operatorToken.kind;return T===M.SyntaxKind.CommaToken||T===M.SyntaxKind.EqualsToken?E(x.right):rk.has(T)?[...E(x.left),...E(x.right)]:[]}if(M.isArrayLiteralExpression(x))return x.elements.flatMap(T=>E(T));if(M.isObjectLiteralExpression(x))return x.properties.flatMap(T=>M.isPropertyAssignment(T)?E(T.initializer):M.isShorthandPropertyAssignment(T)?v(T.name).filter(Br):M.isSpreadAssignment(T)?E(T.expression):M.isMethodDeclaration(T)||M.isGetAccessorDeclaration(T)?I(T).flatMap(q=>E(q)):[]);if(M.isCallExpression(x)||M.isNewExpression(x)||M.isTaggedTemplateExpression(x)){if(M.isCallExpression(x)&&Lf(x))return[];if(d(x))return[];let T=M.isTaggedTemplateExpression(x)?M.isTemplateExpression(x.template)?x.template.templateSpans.map(z=>z.expression):[]:[...x.arguments??[]],q=M.isTaggedTemplateExpression(x)?x.tag:x.expression;for(;M.isParenthesizedExpression(q);)q=q.expression;let G=M.isPropertyAccessExpression(q)||M.isElementAccessExpression(q)?E(q.expression):E(q).filter(z=>z.kind!=="free");return[...T.flatMap(z=>d(z)?[]:E(z)),...G]}return M.isFunctionExpression(x)||M.isArrowFunction(x)?I(x).flatMap(T=>E(T)):[]},N=x=>M.isIdentifier(x)?v(x):M.isParenthesizedExpression(x)||M.isNonNullExpression(x)||M.isAsExpression(x)||M.isSatisfiesExpression(x)||M.isTypeAssertionExpression(x)?N(x.expression):M.isPropertyAccessExpression(x)||M.isElementAccessExpression(x)?E(x.expression):M.isArrayLiteralExpression(x)?x.elements.flatMap(T=>N(T)):M.isObjectLiteralExpression(x)?x.properties.flatMap(T=>M.isShorthandPropertyAssignment(T)?v(T.name):M.isPropertyAssignment(T)?N(T.initializer):M.isSpreadAssignment(T)?N(T.expression):[]):M.isSpreadElement(x)?N(x.expression):M.isBinaryExpression(x)&&x.operatorToken.kind===M.SyntaxKind.EqualsToken?N(x.left):[],A=x=>M.isParenthesizedExpression(x)||M.isNonNullExpression(x)||M.isAsExpression(x)||M.isSatisfiesExpression(x)||M.isTypeAssertionExpression(x)||M.isSpreadElement(x)?A(x.expression):M.isPropertyAccessExpression(x)||M.isElementAccessExpression(x)?E(x.expression):M.isArrayLiteralExpression(x)?x.elements.flatMap(T=>A(T)):M.isObjectLiteralExpression(x)?x.properties.flatMap(T=>M.isPropertyAssignment(T)?A(T.initializer):M.isSpreadAssignment(T)?A(T.expression):[]):M.isBinaryExpression(x)&&x.operatorToken.kind===M.SyntaxKind.EqualsToken?A(x.left):[],U=x=>E(x).filter(T=>T.kind==="local"||T.kind==="param"||T.kind==="receiver"),$=new Map,W=new Map,w=x=>{let T=x;for(let q=$.get(T);q!==void 0&&q!==T;q=$.get(T))T=q;for(let q=x;q!==T;){let G=$.get(q)??T;$.set(q,T),q=G}return T},P=(x,T)=>{let q=Bt(x),G=Bt(T);W.has(q)||(W.set(q,x),$.set(q,q)),W.has(G)||(W.set(G,T),$.set(G,G));let z=w(q),L=w(G);z!==L&&$.set(z,L)},j=(x,T)=>{let q=x.filter(Br);if(q.length===0)return;let G=E(T),z=G[0];if(z!==void 0){for(let L of G)P(z,L);for(let L of q)P(z,L)}},F=new Map,B=(x,T)=>{for(let q of x){if(!Br(q))continue;let G=Bt(q),z=F.get(G);z===void 0&&(z=new Map,F.set(G,z));for(let L of T)z.set(Bt(L),L)}};g.forEach((x,T)=>{let q={kind:"param",index:T};if(x.initializer!==void 0&&(i(O(x.initializer),[q],"copy"),j([q],x.initializer)),!M.isIdentifier(x.name)){let G=u(x.name).map(m);i([q],G,"field");for(let z of G)P(q,z);for(let z of fl(x.name)){if(z.initializer===void 0)continue;let L=u(z.name).map(m);i(O(z.initializer),L,"copy"),j(L,z.initializer)}}});let ne=x=>{if(x!==e&&ws(x)){if(n.has(x))return;let T=s.get(x);x.parameters.forEach((q,G)=>{let z=T!==void 0&&G===T.index?{kind:"source",sourceClass:T.model.sourceClass,model:T.model.id}:yn("inner-function-param");i([z],u(q.name).map(m),"copy")})}else if(M.isVariableDeclaration(x)&&x.initializer!==void 0){let T=u(x.name).map(m);i(O(x.initializer),T,M.isIdentifier(x.name)?"copy":"field"),j(T,x.initializer)}else if(M.isBindingElement(x)&&x.initializer!==void 0){let T=u(x.name).map(m);i(O(x.initializer),T,"copy"),j(T,x.initializer)}else if(M.isCatchClause(x)&&x.variableDeclaration!==void 0)i([yn("caught")],u(x.variableDeclaration.name).map(m),"copy");else if(M.isTryStatement(x)&&x.catchClause?.variableDeclaration!==void 0){let T=u(x.catchClause.variableDeclaration.name).map(m),q=[],G=z=>{if(!n.has(z)){if(M.isThrowStatement(z))q.push(z.expression);else if(M.isCallExpression(z)||M.isNewExpression(z)){q.push(...z.arguments??[]);let L=z.expression;for(;M.isParenthesizedExpression(L);)L=L.expression;(M.isPropertyAccessExpression(L)||M.isElementAccessExpression(L))&&q.push(L.expression)}M.forEachChild(z,G)}};G(x.tryBlock);for(let z of q)d(z)||j(T,z)}else if((M.isFunctionDeclaration(x)||M.isClassDeclaration(x))&&x.name!==void 0&&x!==e)i([yn("unmodeled")],[m(x.name)],"copy");else if(M.isForOfStatement(x)||M.isForInStatement(x)){let T=x.initializer,q=M.isVariableDeclarationList(T)?T.declarations.flatMap(z=>u(z.name).map(m)):N(T),G=O(x.expression);i(G,q,"derive"),M.isVariableDeclarationList(T)||B(A(T),G),M.isForOfStatement(x)&&j(q,x.expression)}else if(M.isBinaryExpression(x)&&ak(x.operatorToken.kind)){let T=x.operatorToken.kind===M.SyntaxKind.EqualsToken?O(x.right):[...O(x.left),...O(x.right)],q=N(x.left);i(T,q,M.isIdentifier(x.left)?"copy":"field"),B(A(x.left),T),ok.has(x.operatorToken.kind)&&j(q,x.right)}else if(M.isShorthandPropertyAssignment(x)&&x.objectAssignmentInitializer!==void 0){let T=v(x.name);i(O(x.objectAssignmentInitializer),T,"copy"),j(T,x.objectAssignmentInitializer)}else if(M.isReturnStatement(x)&&x.expression!==void 0&&Df(x)===e)i(O(x.expression),[{kind:"return"}],"return");else if(M.isYieldExpression(x)&&x.expression!==void 0&&Df(x)===e)i(O(x.expression),[{kind:"return"}],"return");else if(M.isCallExpression(x)&&!Lf(x)){let T=l(x);x.arguments.forEach((ie,me)=>{if(i(O(ie),[{kind:"argument",...T,index:me}],"argument"),!d(ie)){let be={kind:"mutated-by-call",...T,index:me},Me=U(ie);i([be],Me,"mutation"),B(Me,[be])}});let q=x.expression;for(;M.isParenthesizedExpression(q);)q=q.expression;let G=M.isPropertyAccessExpression(q)||M.isElementAccessExpression(q)?q.expression:void 0,z=ie=>ie.kind==="receiver"?G!==void 0?[G]:[]:ie.kind==="arg"?x.arguments.slice(ie.index,ie.index+1):x.arguments.slice(ie.index),L=r!==void 0?Ff(x.expression,r):void 0;for(let ie of L?.summary?.mutates??[]){let me=[...z(ie.into),...ie.from.flatMap(z)].filter(Me=>!d(Me)).flatMap(Me=>E(Me)),be=me[0];if(be!==void 0)for(let Me of me)P(be,Me)}if((M.isPropertyAccessExpression(q)||M.isElementAccessExpression(q))&&(i(O(q.expression),[{kind:"call-receiver",...T}],"argument"),!d(q.expression))){let ie={kind:"mutated-by-call",...T,index:-1},me=U(q.expression);i([ie],me,"mutation"),B(me,[ie])}}else if(M.isNewExpression(x))for(let T of x.arguments??[]){if(d(T))continue;let q=U(T);i([yn("construct")],q,"mutation"),B(q,[yn("construct")])}M.forEachChild(x,ne)},X=()=>{let x=new Map,T=z=>{for(let L of z)L.kind==="local"&&x.set(Bt(L),L)},q=z=>{let L=z.parent;L!==void 0&&L.name===z&&!M.isShorthandPropertyAssignment(L)||L!==void 0&&(M.isCallExpression(L)||M.isNewExpression(L)||M.isTaggedTemplateExpression(L))&&(M.isTaggedTemplateExpression(L)?L.tag:L.expression)===z||d(z)||T(k(z)??c.get(z.text)??[])},G=(z,L)=>{let ie=L||n.has(z);ie&&M.isIdentifier(z)&&q(z),M.forEachChild(z,me=>{G(me,ie)})};G(t,!1);for(let z of t.statements){let L=M.canHaveModifiers(z)&&(M.getModifiers(z)??[]).some(ie=>ie.kind===M.SyntaxKind.ExportKeyword);if(L&&M.isVariableStatement(z))for(let ie of z.declarationList.declarations)T(u(ie.name).map(m));else if(L&&(M.isFunctionDeclaration(z)||M.isClassDeclaration(z))&&z.name!==void 0)T([m(z.name)]);else if(M.isExportDeclaration(z)&&z.moduleSpecifier===void 0&&z.exportClause!==void 0&&M.isNamedExports(z.exportClause))for(let ie of z.exportClause.elements)T(c.get((ie.propertyName??ie.name).text)??[]);else M.isExportAssignment(z)&&T(E(z.expression))}return[...x.values()]},Q=()=>{let x=!1,T=q=>{if(!x&&!(q!==e&&n.has(q)&&!M.isSourceFile(e))){if(ik(q)){x=!0;return}M.forEachChild(q,T)}};for(let q of _)T(q);return x},Z=()=>{let x=new Map;for(let[q,G]of W){let z=w(q),L=x.get(z);L===void 0?x.set(z,[G]):L.push(G)}let T=0;for(let q of x.values()){if(q.length<2)continue;let G=new Map;for(let L of q)for(let[ie,me]of F.get(Bt(L))??[])G.set(ie,me);for(let L of q)L.kind==="free"&&G.set(Bt(L),L);if(G.size>0){let L={kind:"shared",id:T};T+=1,i([...G.values()],[L],"mutation"),i([L],q.filter(ie=>ie.kind!=="free"),"mutation")}let z=q.filter(L=>L.kind==="param"||L.kind==="receiver");if(z.length>=2)for(let L of z)i(z.filter(ie=>Bt(ie)!==Bt(L)),[L],"mutation")}};try{for(let x of _)ne(x);if(!M.isSourceFile(e)&&M.isArrowFunction(e)&&!M.isBlock(e.body)&&i(O(e.body),[{kind:"return"}],"return"),M.isSourceFile(e)){let x=X();i([yn("unmodeled")],x,"mutation"),B(x,[yn("unmodeled")])}if(Q()){let x=[...c.values()].flat(),T=g.map((G,z)=>({kind:"param",index:z})),q=M.isSourceFile(e)?[]:[{kind:"receiver"}];i([yn("reflective")],[...x,...T,...q],"mutation")}Z()}catch(x){if(x instanceof Zo)return;throw x}return o}function ak(e){return e>=M.SyntaxKind.FirstAssignment&&e<=M.SyntaxKind.LastAssignment}function Lf(e){return M.isIdentifier(e.expression)&&e.expression.text==="require"||e.expression.kind===M.SyntaxKind.ImportKeyword}function Df(e){for(let n=e.parent;n!==void 0;n=n.parent)if(ws(n))return n}import fe from"typescript";var Kf=4,lk=[{id:"express-async-handler@1-forwarder-v1",package:"express-async-handler",versions:"0.0.1 - 1.2.0: all 13 published versions, read 2026-09-24",shape:{param:0,arity:[3,0],passes:3},evidence:"index.js, 1.1.4 and 1.2.0 (npm dist.shasum 225a84908df63b35ae9df94b6f0f1af061266426, ffc9896061d90f8d2e71a2d2b8668db5b0934391): `const asyncUtil = fn => function asyncUtilWrap(...args) { const fnReturn = fn(...args) ...`, `module.exports = asyncUtil`. 0.0.1-1.0.2: `(req, res, next) => ... fn(req, res, next)`; 1.0.3-1.1.3: `(req, res, next, ...args)` calling `fn(req, res, next, ...args)` (1.1.0 on both branches of `fn instanceof Promise`). https://github.com/Abazhenov/express-async-handler"}];function zf(e){return lk.find(n=>n.package===e)}var dk=8;function Wf(e){if(!(fe.isFunctionDeclaration(e)||fe.isFunctionExpression(e)||fe.isArrowFunction(e)||fe.isMethodDeclaration(e))||e.body===void 0||ck(e)||!fe.isArrowFunction(e)&&e.asteriskToken!==void 0||fe.canHaveDecorators(e)&&(fe.getDecorators(e)??[]).length>0||fk(e))return null;let n=pk(e);if(n===null||fe.isFunctionExpression(n)&&n.asteriskToken!==void 0)return null;let t=uk(n);if(t===null||t.length===0)return null;let s=t.map(u=>u.text),r=new Set(s),o=new Map,i=Uf(e);for(let u=0;u<i.length;u+=1){let m=i[u];if(m===void 0)continue;let g=m.name;if(fe.isIdentifier(g)){if(o.has(g.text))return null;m.dotDotDotToken!==void 0||m.initializer!==void 0||r.has(g.text)||o.set(g.text,{index:u,decl:g})}}let a=[...mk(n,o,s)],l=a[0];if(a.length!==1||l===void 0||l[1].length>dk)return null;let[d,c]=l,f=o.get(d);if(f===void 0)return null;let p=0;for(let u of c)gk(u,n)&&(p=Math.max(p,u.arguments.length));return p===0||!Gf(e,new Map([[d,f.decl]]))||!Gf(n,new Map(t.slice(0,p).map(u=>[u.text,u])))?null:{param:f.index,arity:[t.length],passes:p}}function Uf(e){return e.parameters.filter(n=>!(fe.isIdentifier(n.name)&&n.name.text==="this"))}function ck(e){return fe.canHaveModifiers(e)&&(fe.getModifiers(e)??[]).some(n=>n.kind===fe.SyntaxKind.AsyncKeyword)}function uk(e){let n=[],t=new Set;for(let s of Uf(e)){let r=s.name;if(!fe.isIdentifier(r)||s.dotDotDotToken!==void 0||s.initializer!==void 0||t.has(r.text))return null;t.add(r.text),n.push(r)}return n}function fk(e){let n=!1,t=s=>{n||((fe.isWithStatement(s)||fe.isIdentifier(s)&&(s.text==="arguments"||s.text==="eval")&&!Hf(s))&&(n=!0),fe.forEachChild(s,t))};return fe.forEachChild(e,t),n}function pk(e){let n=e.body;if(n===void 0)return null;let t=i=>{if(i===void 0)return null;let a=an(i);return fe.isArrowFunction(a)||fe.isFunctionExpression(a)?a:null};if(!fe.isBlock(n))return t(n);let s=[],r=i=>{fe.isFunctionLike(i)||fe.isClassLike(i)||(fe.isReturnStatement(i)&&s.push(i),fe.forEachChild(i,r))};fe.forEachChild(n,r);let o=s[0];return s.length!==1||o===void 0||o.parent!==n?null:t(o.expression)}function mk(e,n,t){let s=new Map,r=i=>{if(fe.isCallExpression(i)&&fe.isIdentifier(i.expression)&&n.has(i.expression.text)&&i.questionDotToken===void 0&&i.arguments.length>0&&i.arguments.length<=t.length&&i.arguments.every((a,l)=>fe.isIdentifier(a)&&a.text===t[l])){let a=s.get(i.expression.text);a===void 0?s.set(i.expression.text,[i]):a.push(i)}fe.forEachChild(i,r)},o=e.body;return fe.isBlock(o)?fe.forEachChild(o,r):r(o),s}function gk(e,n){let t=e;for(;;){let s=t.parent;if(s===n)return fe.isArrowFunction(n)&&n.body===t;if(fe.isParenthesizedExpression(s)||fe.isAwaitExpression(s)||fe.isAsExpression(s)||fe.isNonNullExpression(s)||fe.isSatisfiesExpression(s)||fe.isTypeAssertionExpression(s)){t=s;continue}if((fe.isPropertyAccessExpression(s)||fe.isElementAccessExpression(s))&&s.expression===t){t=s;continue}if(fe.isCallExpression(s)){if(s.expression===t){t=s;continue}if(!fe.isOptionalChain(s)&&s.arguments.some(r=>r===t)){t=s;continue}return!1}if(fe.isVariableDeclaration(s)&&s.initializer===t){let o=s.parent.parent;return fe.isVariableStatement(o)&&Bf(o,n)}return(fe.isExpressionStatement(s)||fe.isReturnStatement(s))&&s.expression===t?Bf(s,n):!1}}function Bf(e,n){let t=e;for(;;){let s=t.parent;if(!fe.isBlock(s))return!1;for(let o of s.statements){if(o===t)break;if(!(fe.isExpressionStatement(o)||fe.isVariableStatement(o)||fe.isEmptyStatement(o)))return!1}if(s===n.body)return!0;let r=s.parent;if(!fe.isTryStatement(r)||r.tryBlock!==s)return!1;t=r}}function Gf(e,n){let t=!0,s=r=>{if(t){if(fe.isIdentifier(r)){let o=n.get(r.text);o!==void 0&&r!==o&&!Hf(r)&&!hk(r)&&(t=!1)}fe.forEachChild(r,s)}};return fe.forEachChild(e,s),t}function hk(e){let n=e.parent;return fe.isCallExpression(n)&&(n.expression===e||n.arguments.some(t=>t===e))||fe.isNewExpression(n)&&(n.arguments??[]).some(t=>t===e)||fe.isTypeOfExpression(n)||(fe.isPropertyAccessExpression(n)||fe.isElementAccessExpression(n))&&n.expression===e}function Hf(e){let n=e.parent;return(fe.isPropertyAccessExpression(n)||fe.isPropertyAssignment(n)||fe.isMethodDeclaration(n)||fe.isPropertyDeclaration(n)||fe.isGetAccessorDeclaration(n)||fe.isSetAccessorDeclaration(n))&&n.name===e||fe.isBindingElement(n)&&n.propertyName===e}function qf(e,n,t){let s=null,r=o=>{if(s!==null)return;let i=o.getStart(e,!1),a=o.getEnd();if(i===n&&a===t){if(fe.isVariableDeclaration(o)&&o.initializer!==void 0){let l=an(o.initializer);s=fe.isArrowFunction(l)||fe.isFunctionExpression(l)?l:null}else(fe.isFunctionDeclaration(o)||fe.isFunctionExpression(o)||fe.isArrowFunction(o)||fe.isMethodDeclaration(o))&&(s=o);if(s!==null)return}o.pos<=n&&a>=t&&fe.forEachChild(o,r)};return r(e),s}var Xf=3;function je(e,n,t){if(e===void 0)return;let s=e[n]??={fired:0,refused:{}};t===null?s.fired+=1:s.refused[t]=(s.refused[t]??0)+1}function xt(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var ni=16,bl=256,gl=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let s=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(s)||(this.moduleFor(n),this.fns.set(s,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let s=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(s)||(this.moduleFor(n),this.classNodes.set(s,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(s,[])),r}methodFor(n,t,s,r){let o=`${n}#${t}.${s}`,i=`pkg:${n}#${t}.${s}`;if(!this.fns.has(o)){let a=this.classFor(n,t);this.fns.set(o,{id:i,moduleId:`pkg:${n}`,name:s,kind:r,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(i)}return i}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function rp(e,n){let t="node_modules/",s=e.lastIndexOf(t);if(s===-1)return n;let o=e.slice(s+t.length).split("/");return o[0]?.startsWith("@")&&o.length>=2?`${o[0]}/${o[1]}`:o[0]??n}function Yf(e,n,t){let s=Mn.dirname(e),r=Mn.dirname(n),o=[];for(;;){let a=t.get(s);if(a!==void 0){for(let d of o)t.set(d,a);return a}o.push(s);let l=_n(Mn.join(s,"package.json"));if(l!==null)try{let d=JSON.parse(l),c={name:d.name??"app",version:d.version??"0.0.0",dir:s};for(let f of o)t.set(f,c);return c}catch{}if(s===r||s===Mn.dirname(s))break;s=Mn.dirname(s)}let i={name:"app",version:"0.0.0",dir:null};for(let a of o)t.set(a,i);return i}function hl(e){return h.isParenthesizedExpression(e)?hl(e.expression):h.isStringLiteralLike(e)?e.text:h.isTemplateExpression(e)?e.head.text:h.isBinaryExpression(e)&&e.operatorToken.kind===h.SyntaxKind.PlusToken?hl(e.left):null}function yk(e){if(!h.isCallExpression(e))return!1;let n=e.expression,t=h.isPropertyAccessExpression(n)?n.name.text:h.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let s=e.arguments[0];return s!==void 0&&h.isIdentifier(s)&&(s.text==="__dirname"||s.text==="__filename")}function op(e){let n=hl(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":yk(e)?"relative-bounded":"unknown"}function bk(e){let n=[],t=r=>{if(e.isDeclarationFile)return!0;for(let o=r.parent;o!==void 0;o=o.parent)if(h.isModuleDeclaration(o)&&(h.getCombinedModifierFlags(o)&h.ModifierFlags.Ambient)!==0)return!0;return!1},s=r=>{if(h.isImportDeclaration(r)&&h.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1,at:r.getStart(e),runsBody:r.importClause?.isTypeOnly!==!0&&!t(r),loadShape:"require"});else if(h.isImportEqualsDeclaration(r)&&h.isExternalModuleReference(r.moduleReference)&&h.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1,at:r.getStart(e),runsBody:!r.isTypeOnly&&!t(r),loadShape:"require"});else if(h.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&h.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1,at:r.getStart(e),runsBody:!r.isTypeOnly&&!t(r),loadShape:"require"});else if(h.isCallExpression(r)){let o=Dr(r);if(o!==null){let i=o.specifierArg,a=i!==void 0&&h.isStringLiteralLike(i);n.push({specifier:a?i.text:void 0,specifierIsLiteral:a,dynamic:!0,...i!==void 0&&!a?{computedArg:i,loadPos:r.getStart(e)}:{},at:r.getStart(e),runsBody:!t(r),loadShape:Ve(r.expression).kind===h.SyntaxKind.ImportKeyword?"dynamic-import":"require"})}}h.forEachChild(r,s)};return s(e),n}function _k(e,n,t){let s=new Map,r=Yf(Mn.join(e.appRoot,"package.json"),e.appRoot,s),o=[],i=[],a=[],l=new Map,d=new Map,c=new Set,f=[],p=new Set;for(let u of e.sourceFiles){let m=e.toRel(u.fileName);m!==null&&p.add(m)}for(let u of e.sourceFiles){let m=e.toRel(u.fileName);if(m===null)continue;let g=Yf(u.fileName,e.appRoot,s),y=rp(m,r.name),b=m.includes("node_modules/");o.push({id:m,packageName:b&&g.name!==r.name?g.name:y,versionRange:g.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),g.dir===r.dir&&c.add(m);let _=0,S=null;for(let k of bk(u)){let v=`${m}#import${String(_)}`;_+=1;let I=null,O=[];if(k.specifier!==void 0)if(Ze(k.specifier)==="package-root")I=t.moduleFor(Bn(k.specifier));else{let E=Gn(k.specifier,u.fileName,e.options,e.host),N=E!==null?e.toRel(E):null;if(N!==null)I=N;else if(k.specifier!==void 0){let[A,...U]=qs(k.specifier,u.fileName,e.options,e.host).map($=>e.toRel($)).filter($=>$!==null&&p.has($));A!==void 0&&U.length>=1&&(I=A,O=U.map($=>$))}}i.push({id:v,moduleId:m,specifier:k.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:k.dynamic,specifierIsLiteral:k.specifierIsLiteral,...I!==null?{resolvedModuleId:I}:{}}),I!==null&&a.push({importId:v,resolvedModuleId:I});for(let E of O)a.push({importId:v,resolvedModuleId:E});if(k.specifierIsLiteral&&k.runsBody&&I!==null){let E=[I,...O].map(N=>String(N)).filter(N=>p.has(N));if(E.length>0){let N=d.get(m)??[];N.push({pos:k.at,shape:k.loadShape,targetRels:E}),d.set(m,N)}}if(k.computedArg!==void 0&&k.loadPos!==void 0&&f.push({importId:String(v),path:m,pos:k.loadPos,shape:op(k.computedArg),text:k.computedArg.getText(u).slice(0,160)}),k.computedArg!==void 0&&k.loadPos!==void 0){S??=xs(u,u.fileName,e.resolveParamDirs);let E=[];for(let N of zo(k.computedArg,S,e.appRoot,e.options,e.host)){let A=e.toRel(N);if(A===null||!p.has(A))continue;let U=A,$=`${m}#import${String(_)}`;_+=1,i.push({id:$,moduleId:m,specifier:A,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:U}),a.push({importId:$,resolvedModuleId:U}),E.push(A)}if(E.length>0){let N=Tr(k.computedArg,S)!==null||Ko(k.computedArg),A=l.get(m)??[];A.push({pos:k.loadPos,candidateRels:E,seedable:N}),l.set(m,A)}}}}return{modules:o,imports:i,importEdges:a,computedLoads:l,literalLoads:d,appOwnedPaths:c,loadSites:f}}function Sk(e){let n=_n(e);if(n===null)return null;let t=h.createSourceFile(e,n,h.ScriptTarget.Latest,!0),s=r=>t.statements.some(o=>h.isFunctionDeclaration(o)?o.name?.text===r:h.isVariableStatement(o)?o.declarationList.declarations.some(i=>h.isIdentifier(i.name)&&i.name.text===r&&i.initializer!==void 0&&(h.isFunctionExpression(i.initializer)||h.isArrowFunction(i.initializer))):!1);for(let r of t.statements){if(h.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(i=>i.kind===h.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!h.isExpressionStatement(r)||!h.isBinaryExpression(r.expression))continue;let o=r.expression;if(o.operatorToken.kind===h.SyntaxKind.EqualsToken&&xk(o.left)){if(h.isFunctionExpression(o.right)&&o.right.name!==void 0)return o.right.name.text;if(h.isIdentifier(o.right)&&s(o.right.text))return o.right.text}}return null}function xk(e){return h.isPropertyAccessExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:h.isElementAccessExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="module"&&h.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function kk(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let s=d=>"surface"in d?n.moduleFor(d.surface):d.module,r=[],o=new Set;for(let d of e.modules)t.has(d)||o.has(d)||(o.add(d),r.push({id:d,packageName:e.entryRealNames[d]??rp(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let i=[],a=[],l=0;for(let d of e.edges){let c=s(d.from),f=s(d.to),p=`${String(c)}#depreach${String(l)}`;l+=1,i.push({id:p,moduleId:c,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),a.push({importId:p,resolvedModuleId:f})}return{modules:r,imports:i,importEdges:a}}function Jf(e,n,t){let s=e.expression;if(h.isIdentifier(s)&&!t.has(s.text)){let r=n.get(s.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(h.isPropertyAccessExpression(s)&&h.isIdentifier(s.expression)&&!t.has(s.expression.text)){let r=n.get(s.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:s.name.text}}return null}function vs(e){return h.canHaveModifiers(e)&&(h.getModifiers(e)?.some(n=>n.kind===h.SyntaxKind.ExportKeyword)??!1)}function wk(e){let n=new Set,t;for(let s of e.statements){if(h.isExpressionStatement(s)&&h.isBinaryExpression(s.expression)){let r=s.expression;if(r.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isPropertyAccessExpression(r.left)&&h.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(h.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(h.isObjectLiteralExpression(r.right))for(let o of r.right.properties)h.isShorthandPropertyAssignment(o)?n.add(o.name.text):h.isPropertyAssignment(o)&&h.isIdentifier(o.initializer)&&n.add(o.initializer.text)}continue}if(h.isFunctionDeclaration(s)&&s.name!==void 0&&vs(s))n.add(s.name.text);else if(h.isVariableStatement(s)&&vs(s))for(let r of s.declarationList.declarations)h.isIdentifier(r.name)&&n.add(r.name.text);else if(h.isExportDeclaration(s)&&s.exportClause&&h.isNamedExports(s.exportClause))for(let r of s.exportClause.elements)n.add((r.propertyName??r.name).text);else h.isExportAssignment(s)&&h.isIdentifier(s.expression)&&(n.add(s.expression.text),t=s.expression.text)}return{reachableLocals:n,defaultTarget:t}}function vk(e){for(let n of e.statements){if(h.isFunctionDeclaration(n)&&n.name!==void 0&&vs(n)&&h.getModifiers(n)?.some(t=>t.kind===h.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(h.isExportAssignment(n)&&!n.isExportEquals&&h.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(h.isExpressionStatement(n)&&h.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===h.SyntaxKind.EqualsToken&&In(t.left)&&h.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function kt(e){if(h.isCallExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&h.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function In(e){return h.isPropertyAccessExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:h.isElementAccessExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="module"&&h.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function it(e){if(In(e))return!0;if(!h.isPropertyAccessExpression(e)&&!h.isElementAccessExpression(e))return!1;let n=e.expression;return h.isIdentifier(n)&&n.text==="exports"?!0:In(n)}function Js(e){return h.isPropertyAccessExpression(e.expression)&&h.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ip(e){let n=!1,t=s=>{if(!n){if(h.isCallExpression(s)){let r=kt(s);if(r!==void 0&&Ze(r)!=="package-root"){n=!0;return}}h.forEachChild(s,t)}};return t(e),n}function ap(e){let n=new Set,t=r=>r!==void 0&&ip(r),s=r=>{h.isVariableDeclaration(r)&&t(r.initializer)&&Mr(r.name,n),h.isBinaryExpression(r)&&r.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),h.forEachChild(r,s)};return s(e),n}function lp(e,n){for(let t of e.properties)h.isShorthandPropertyAssignment(t)?n.add(t.name.text):h.isPropertyAssignment(t)&&h.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function Ek(e){let n=new Set;for(let a of e.statements)if(h.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(h.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(h.isVariableStatement(a))for(let l of a.declarationList.declarations)h.isIdentifier(l.name)&&l.initializer!==void 0&&(h.isFunctionExpression(l.initializer)||h.isArrowFunction(l.initializer)||h.isObjectLiteralExpression(l.initializer))&&n.add(l.name.text);let t=a=>h.isFunctionExpression(a)||h.isArrowFunction(a)||h.isObjectLiteralExpression(a)||h.isIdentifier(a)&&n.has(a.text),s=new Set,r=a=>{h.isIdentifier(a)?s.add(a.text):h.isObjectLiteralExpression(a)&&lp(a,s)},o=!1,i=a=>{if(!o){if(h.isBinaryExpression(a)&&a.operatorToken.kind===h.SyntaxKind.EqualsToken)if(In(a.left)){r(a.right);let l=a.right;(h.isObjectLiteralExpression(l)?l.properties.every(c=>h.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||h.isPropertyAssignment(c)&&t(c.initializer)):t(l))||(o=!0)}else it(a.left)&&(t(a.right)||(o=!0));else(h.isCallExpression(a)&&Js(a)&&a.arguments[0]!==void 0&&Es(a.arguments[0])||h.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(o=!0);o||h.forEachChild(a,i)}};if(i(e),!o&&s.size>0){for(let a of fp(e))if(s.has(a)){o=!0;break}}return o}function Es(e){return it(e)||h.isIdentifier(e)&&e.text==="exports"}function dp(e){if(!h.isPropertyAccessExpression(e.expression)||!h.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function _l(e){return dp(e)&&e.arguments[0]!==void 0&&Es(e.arguments[0])}function Ak(e){return dp(e)&&e.arguments[0]!==void 0&&h.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Ik(e){for(let n of e.declarations??[])if(h.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(h.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(h.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(h.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Nk(e,n,t,s,r){let o=(e.declarations??[]).filter(a=>!h.isSourceFile(a)&&!h.isModuleDeclaration(a));for(let a of o){let l=a.getSourceFile(),d=n.toRel(l.fileName);if(d===null||r.has(d))continue;let c=t.get(`${d}::${String(a.getStart(l,!1))}`);if(c!==void 0)return c}let i=e.getName();for(let a of o){let l=n.toRel(a.getSourceFile().fileName);if(l===null||r.has(l))continue;let d=s.get(`${l}::${i}`);if(d!==void 0)return d}}function ti(e){return h.isPropertyAccessExpression(e)?e.name.text:h.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Sl=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function xl(e){let n=h.isPropertyAccessExpression(e)||h.isElementAccessExpression(e)?ti(e):void 0;return n!==void 0&&n!=="__proto__"&&Sl.test(n)?n:void 0}function Rk(e){return e!=="__proto__"&&Sl.test(e)}function Qf(e){let n=Ve(e);return h.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||In(n)}function Ok(e){if(!h.isArrayLiteralExpression(e)&&!h.isObjectLiteralExpression(e))return!1;let n=!1,t=s=>{n||(it(s)?n=!0:h.forEachChild(s,t))};return t(e),n}function kl(e){let n=!1,t=new Map,s=r=>{if(!n){if(h.isBinaryExpression(r)&&r.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=h.SyntaxKind.LastAssignment){if(In(r.left)||h.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===h.SyntaxKind.EqualsToken&&Qf(r.right))n=!0;else if(Ok(r.left))n=!0;else if(it(r.left)){let o=xl(r.left);o===void 0?n=!0:t.set(o,(t.get(o)??0)+1)}}else(h.isCallExpression(r)&&Js(r)&&r.arguments[0]!==void 0&&Es(r.arguments[0])||h.isCallExpression(r)&&_l(r)||h.isCallExpression(r)&&Ak(r)||h.isVariableDeclaration(r)&&r.initializer!==void 0&&Qf(r.initializer))&&(n=!0);n||h.forEachChild(r,s)}};return s(e),{surfaceEscapes:n,assignCount:t}}function wl(e){let n=[];for(let t of e.statements){if(!h.isExpressionStatement(t)||!h.isBinaryExpression(t.expression))continue;let s=t.expression;s.operatorToken.kind===h.SyntaxKind.EqualsToken&&(!it(s.left)||In(s.left)||n.push({bin:s,name:xl(s.left)}))}return n}function Pk(e){let{surfaceEscapes:n,assignCount:t}=kl(e);if(n)return[];let s=[];for(let{bin:r,name:o}of wl(e))o===void 0||(t.get(o)??0)!==1||(h.isFunctionExpression(r.right)||h.isArrowFunction(r.right))&&s.push({name:o,value:r.right});return s}function Ck(e,n){let{surfaceEscapes:t,assignCount:s}=kl(e);if(t)return[];let r=[];for(let{bin:o,name:i}of wl(e))i===void 0||(s.get(i)??0)!==1||h.isIdentifier(o.right)&&!n.has(o.right.text)&&r.push(o.right.text);return r}function Mk(e,n){let{surfaceEscapes:t,assignCount:s}=kl(e);for(let{bin:r,name:o}of wl(e)){let i=r.right;if(!(h.isFunctionExpression(i)||h.isArrowFunction(i)||h.isIdentifier(i)))continue;let l=h.isFunctionExpression(i)||h.isArrowFunction(i)||h.isIdentifier(i)&&!n.has(i.text);if(!(!t&&o!==void 0&&(s.get(o)??0)===1&&l))return!0}return!1}function Tk(e){let n=h.isPropertyAccessExpression(e)||h.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&h.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Zf(e){let n=e.parent;return n===void 0?!1:h.isPropertyAccessExpression(n)?n.name===e:h.isQualifiedName(n)?n.right===e:h.isBindingElement(n)||h.isImportSpecifier(n)?n.propertyName===e:h.isExportSpecifier(n)?!0:h.isPropertyAssignment(n)||h.isPropertyDeclaration(n)||h.isPropertySignature(n)||h.isMethodDeclaration(n)||h.isMethodSignature(n)||h.isGetAccessorDeclaration(n)||h.isSetAccessorDeclaration(n)||h.isEnumMember(n)?n.name===e:!1}function ep(e){for(let n=e.parent;n!==void 0;n=n.parent){if(h.isSourceFile(n))return!0;if(!h.isArrowFunction(n)&&(h.isFunctionLike(n)||h.isClassLike(n)))return!1}return!0}function $k(e,n){let t=s=>{h.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&n.add(s),h.forEachChild(s,t)};t(e)}function Lk(e){let n=[],t=new Set;for(let o of e.statements){if(h.isExportDeclaration(o)||h.isExportAssignment(o)||h.isImportDeclaration(o)||h.isImportEqualsDeclaration(o)||vs(o))return null;if(!h.isExpressionStatement(o)||!h.isBinaryExpression(o.expression))continue;let i=o.expression;if(i.operatorToken.kind===h.SyntaxKind.EqualsToken){if(In(i.left))n.push({kind:"whole",value:i.right});else if(it(i.left)){let a=xl(i.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:i.right,root:Tk(i.left)})}else continue;$k(i.left,t)}}let s=!1,r=o=>{if(!s){if(h.isIdentifier(o)&&(o.text==="exports"||o.text==="module")&&!t.has(o)&&!Zf(o)){s=!0;return}if(o.kind===h.SyntaxKind.ThisKeyword&&ep(o)){s=!0;return}if(h.isIdentifier(o)&&o.text==="arguments"&&!Zf(o)&&ep(o)){s=!0;return}h.forEachChild(o,r)}};return r(e),s?null:n}function yl(e){return h.isIdentifier(e)||h.isStringLiteralLike(e)?e.text:void 0}function np(e,n,t){return h.isIdentifier(e)?n(e.text):t?.(e)}function Dk(e,n,t,s){let r=new Map,o=Lk(e);if(o===null||o.filter(u=>u.kind==="whole").length>1)return r;let i=o.findIndex(u=>u.kind==="whole"),a=(u,m)=>i>=0&&m>i&&u.kind==="member"&&u.root==="exports",l=o.some(a);if(l){let u=o[i];if(u===void 0||u.kind!=="whole"||!h.isObjectLiteralExpression(u.value))return r}let d=l?o.filter((u,m)=>!a(u,m)):o,c=new Map;for(let u of d)u.kind==="member"&&c.set(u.name,(c.get(u.name)??0)+1);let f=u=>n.has(u)?void 0:t(u),p=(u,m)=>{m===void 0?r.delete(u):r.set(u,m)};for(let u of d){if(u.kind==="member"){p(u.name,(c.get(u.name)??0)>1?void 0:np(u.value,f,s));continue}r.clear();let m=u.value;if(h.isObjectLiteralExpression(m))for(let g of m.properties){if(h.isSpreadAssignment(g))return new Map;if(h.isShorthandPropertyAssignment(g)){p(g.name.text,f(g.name.text));continue}let y=yl(g.name);if(y===void 0)return new Map;p(y,h.isPropertyAssignment(g)?np(g.initializer,f,s):void 0)}}return r}function cp(e,n,t,s){let r=new Map,o=a=>a!==void 0&&Ze(a)==="relative"?t.get(`${n}::${a}`):void 0,i=a=>{if(h.isVariableDeclaration(a)&&a.initializer!==void 0){let l=a.initializer;if(h.isIdentifier(a.name)&&!s.has(a.name.text)){let d=o(kt(l));if(d!==void 0)r.set(a.name.text,{kind:"whole",target:d});else if((h.isPropertyAccessExpression(l)||h.isElementAccessExpression(l))&&h.isCallExpression(l.expression)){let c=o(kt(l.expression)),f=ti(l);c!==void 0&&f!==void 0&&r.set(a.name.text,{kind:"member",target:c,member:f})}}else if(h.isObjectBindingPattern(a.name)){let d=o(kt(l));if(d!==void 0){for(let c of a.name.elements)if(h.isIdentifier(c.name)&&!s.has(c.name.text)){let f=c.propertyName!==void 0&&h.isIdentifier(c.propertyName)?c.propertyName.text:c.name.text;r.set(c.name.text,{kind:"member",target:d,member:f})}}}}h.forEachChild(a,i)};return i(e),r}function Fk(e,n,t,s){let r=i=>i!==void 0&&Ze(i)==="relative"?t.get(`${n}::${i}`):void 0,o=r(kt(e));if(o!==void 0)return{kind:"whole",target:o};if(h.isPropertyAccessExpression(e)||h.isElementAccessExpression(e)){let i=ti(e);if(i===void 0)return;let a=r(kt(e.expression));if(a!==void 0)return{kind:"member",target:a,member:i};if(h.isIdentifier(e.expression)){let l=s.get(e.expression.text);if(l?.kind==="whole")return{kind:"member",target:l.target,member:i}}return}if(h.isIdentifier(e))return s.get(e.text)}function up(e,n,t,s,r){let o=[],i=!1,a=f=>{if(ip(f))return!0;let p=!1,u=m=>{p||(h.isIdentifier(m)&&r.has(m.text)?p=!0:h.forEachChild(m,u))};return u(f),p},l=(f,p)=>{let u=Fk(f,n,t,s);u!==void 0?o.push({source:u,exportedName:p}):a(f)&&(i=!0)},d=f=>{if(h.isObjectLiteralExpression(f)){for(let p of f.properties)if(h.isSpreadAssignment(p))l(p.expression,"default");else if(h.isPropertyAssignment(p)){let u=h.isIdentifier(p.name)||h.isStringLiteralLike(p.name)?p.name.text:"default";l(p.initializer,u)}else if(h.isShorthandPropertyAssignment(p)){let u=s.get(p.name.text);u!==void 0&&o.push({source:u,exportedName:p.name.text})}return}l(f,"default")},c=f=>{if(h.isBinaryExpression(f)&&f.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=h.SyntaxKind.LastAssignment){if(In(f.left)){d(f.right);return}if(it(f.left)){let p=h.isPropertyAccessExpression(f.left)?f.left.name.text:h.isElementAccessExpression(f.left)&&h.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";l(f.right,p);return}}else if(h.isExportAssignment(f)&&f.isExportEquals){l(f.expression,"default");return}else if(h.isCallExpression(f)&&Js(f)&&f.arguments[0]!==void 0&&Es(f.arguments[0])){for(let p of f.arguments.slice(1))d(p);return}h.forEachChild(f,c)};return c(e),{sources:o,residual:i}}function fp(e){let n=new Set,t=r=>{let o=r;for(;h.isPropertyAccessExpression(o)||h.isElementAccessExpression(o);)o=o.expression;return h.isIdentifier(o)?o.text:void 0},s=r=>{let o=pp(r);if(o!==void 0){let i=t(o);i!==void 0&&n.add(i)}h.forEachChild(r,s)};return s(e),n}function pp(e){return h.isBinaryExpression(e)&&e.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=h.SyntaxKind.LastAssignment&&(h.isPropertyAccessExpression(e.left)||h.isElementAccessExpression(e.left))?e.left:void 0}function ei(e){if(h.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)h.isBindingElement(t)&&n.push(...ei(t.name));return n}function An(e){if(h.isIdentifier(e))return[e.text];if(h.isParenthesizedExpression(e)||h.isAsExpression(e)||h.isNonNullExpression(e)||h.isSatisfiesExpression(e)||h.isTypeAssertionExpression(e)||h.isAwaitExpression(e))return An(e.expression);if(h.isYieldExpression(e))return e.expression!==void 0?An(e.expression):[];if(h.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===h.SyntaxKind.BarBarToken||n===h.SyntaxKind.AmpersandAmpersandToken||n===h.SyntaxKind.QuestionQuestionToken?[...An(e.left),...An(e.right)]:n===h.SyntaxKind.CommaToken?An(e.right):[]}return h.isConditionalExpression(e)?[...An(e.whenTrue),...An(e.whenFalse)]:h.isArrayLiteralExpression(e)?e.elements.flatMap(n=>h.isSpreadElement(n)?An(n.expression):h.isOmittedExpression(n)?[]:An(n)):h.isObjectLiteralExpression(e)?e.properties.flatMap(n=>h.isShorthandPropertyAssignment(n)?[n.name.text]:h.isPropertyAssignment(n)?An(n.initializer):h.isSpreadAssignment(n)?An(n.expression):[]):[]}function mp(e,n){let t=[],s=(a,l)=>{for(let d of a)for(let c of l)d!==c&&t.push({a:d,b:c})},r=a=>h.isIdentifier(a)?[a.text]:h.isArrayLiteralExpression(a)?a.elements.flatMap(r):h.isObjectLiteralExpression(a)?a.properties.flatMap(l=>h.isShorthandPropertyAssignment(l)?[l.name.text]:h.isPropertyAssignment(l)?r(l.initializer):[]):[],o=a=>{h.isBinaryExpression(a)&&a.operatorToken.kind===h.SyntaxKind.EqualsToken?s(r(a.left),An(a.right)):h.isVariableDeclaration(a)&&a.initializer!==void 0?s(ei(a.name),An(a.initializer)):(h.isForOfStatement(a)||h.isForInStatement(a))&&h.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&s(ei(a.initializer.declarations[0].name),An(a.expression)),h.forEachChild(a,o)};o(e);let i=new Set(n);for(let a=!0;a;){a=!1;for(let{a:l,b:d}of t)i.has(l)&&!i.has(d)&&(i.add(d),a=!0),i.has(d)&&!i.has(l)&&(i.add(l),a=!0)}return i}function gp(e,n){let t=a=>{if(!h.isPropertyAccessExpression(a)&&!h.isElementAccessExpression(a))return;let l=a;for(;h.isPropertyAccessExpression(l)||h.isElementAccessExpression(l);)l=l.expression;return h.isIdentifier(l)?l.text:void 0},s=[],r=(a,l)=>{for(let c of An(l))s.push({name:a,root:c});let d=t(l);d!==void 0&&s.push({name:a,root:d})},o=a=>{h.isVariableDeclaration(a)&&h.isIdentifier(a.name)&&a.initializer!==void 0?r(a.name.text,a.initializer):h.isBinaryExpression(a)&&a.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isIdentifier(a.left)&&r(a.left.text,a.right),h.forEachChild(a,o)};o(e);let i=new Map(n);for(let a=!0;a;){a=!1;for(let{name:l,root:d}of s){let c=i.get(d);c!==void 0&&!i.has(l)&&(i.set(l,c),a=!0)}}return i}function hp(e){return mp(e,fp(e))}function jk(e,n){let t=l=>l>=h.SyntaxKind.FirstAssignment&&l<=h.SyntaxKind.LastAssignment,s=l=>{let d=l.parent;if(d===void 0||!h.isObjectLiteralExpression(d))return!1;let c=d.parent;return c!==void 0&&h.isBinaryExpression(c)&&c.operatorToken.kind===h.SyntaxKind.EqualsToken&&c.right===d&&it(c.left)?!0:c!==void 0&&h.isCallExpression(c)&&Js(c)&&c.arguments[0]!==void 0&&Es(c.arguments[0])&&c.arguments.indexOf(d)>0},r=(l,d)=>{if((h.isFunctionDeclaration(d)||h.isFunctionExpression(d))&&d.name===l||h.isVariableDeclaration(d)&&d.name===l||h.isParameter(d)&&d.name===l||h.isBindingElement(d)&&d.name===l||(h.isCallExpression(d)||h.isNewExpression(d))&&d.expression===l)return!0;if((h.isPropertyAccessExpression(d)||h.isElementAccessExpression(d))&&d.expression===l){let c=d;for(;c.parent!==void 0&&(h.isPropertyAccessExpression(c.parent)||h.isElementAccessExpression(c.parent))&&c.parent.expression===c;)c=c.parent;let f=c.parent;return!(f!==void 0&&h.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===c)}return h.isBinaryExpression(d)&&d.operatorToken.kind===h.SyntaxKind.EqualsToken&&d.right===l&&it(d.left)?!0:h.isShorthandPropertyAssignment(d)&&d.name===l||h.isPropertyAssignment(d)&&d.initializer===l?s(d):!!(h.isExportAssignment(d)&&d.expression===l||h.isExportSpecifier(d))},o=(l,d)=>h.isPropertyAccessExpression(d)&&d.name===l||h.isPropertyAssignment(d)&&d.name===l||(h.isMethodDeclaration(d)||h.isGetAccessorDeclaration(d)||h.isSetAccessorDeclaration(d))&&d.name===l,i=!1,a=(l,d)=>{if(!i){if(h.isIdentifier(l)&&d!==void 0&&n.has(l.text)&&!o(l,d)&&!r(l,d)){i=!0;return}h.forEachChild(l,c=>a(c,l))}};return a(e,void 0),i}function Bk(e){let n=new Set;for(let l of e.statements)if(h.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(h.isVariableStatement(l))for(let d of l.declarationList.declarations)h.isIdentifier(d.name)&&d.initializer!==void 0&&(h.isFunctionExpression(d.initializer)||h.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,s=l=>{h.isBinaryExpression(l)&&l.operatorToken.kind===h.SyntaxKind.EqualsToken?(In(l.left)&&(h.isIdentifier(l.right)?t.add(l.right.text):h.isObjectLiteralExpression(l.right)&&lp(l.right,t)),In(l.right)&&h.isIdentifier(l.left)&&t.add(l.left.text)):h.isVariableDeclaration(l)&&h.isIdentifier(l.name)&&l.initializer!==void 0&&In(l.initializer)&&t.add(l.name.text),h.forEachChild(l,s)};if(s(e),t.size>0){if(jk(e,t))return!0;let l=gp(e,new Map([...t].map(c=>[c,c]))),d=hp(e);for(let c of l.keys())if(d.has(c))return!0}let r=l=>h.isIdentifier(l)&&n.has(l.text),o=l=>l.properties.every(d=>h.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||h.isPropertyAssignment(d)&&r(d.initializer)),i=!1,a=l=>{if(!i){if(h.isBinaryExpression(l)){let d=l.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&l.operatorToken.kind<=h.SyntaxKind.LastAssignment;d&&In(l.left)?l.operatorToken.kind===h.SyntaxKind.EqualsToken&&(r(l.right)||h.isObjectLiteralExpression(l.right)&&o(l.right))||(i=!0):d&&it(l.left)&&(i=!0)}else h.isCallExpression(l)?(Js(l)&&l.arguments[0]!==void 0&&Es(l.arguments[0])||_l(l))&&(i=!0):(h.isExportAssignment(l)&&l.isExportEquals&&!h.isIdentifier(l.expression)||h.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(i=!0);i||h.forEachChild(l,a)}};return a(e),i}var Gk=8;function tp(e,n,t){let s=new Set,r=cp(e,n,t,Vs(e)),o=up(e,n,t,r,ap(e));for(let{source:i}of o.sources)s.add(i.target);for(let i of e.statements)if(h.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&h.isStringLiteralLike(i.moduleSpecifier)&&Ze(i.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${i.moduleSpecifier.text}`);a!==void 0&&s.add(a)}return s}function Kk(e,n,t,s=new Map){let r=new Set(n.modules.filter(v=>v.isEntrypoint).map(v=>String(v.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let o=new Set(n.modules.filter(v=>v.externalSurface===!0).map(v=>String(v.id))),i=new Map,a=new Map,l=new Map,d=new Map;for(let v of t){if(v.name==="<toplevel>"){d.set(String(v.moduleId),v);continue}if(i.set(`${String(v.moduleId)}::${String(v.declRange.start)}`,v),v.name!==void 0&&a.set(`${String(v.moduleId)}::${v.name}`,v),v.isExported&&v.name!==void 0){let I=l.get(String(v.moduleId))??[];I.push(v),l.set(String(v.moduleId),I)}}if(s.size>0){let v=new Map(t.map(I=>[String(I.id),I]));for(let[I,O]of s){let E=v.get(String(O));E!==void 0&&!i.has(I)&&i.set(I,E)}}let c=new Map;for(let v of n.imports)v.resolvedModuleId!==void 0&&c.set(`${v.moduleId}::${v.specifier}`,String(v.resolvedModuleId));let f=new Map;for(let v of e.sourceFiles){let I=e.toRel(v.fileName);I!==null&&f.set(I,v)}let p=new Map,u=v=>{let I=p.get(v);if(I!==void 0)return I;let O=f.get(v),E=O===void 0?!0:Bk(O);return p.set(v,E),E},m=new Set,g=(v,I)=>I!==void 0&&Ze(I)==="relative"?c.get(`${v}::${I}`):void 0,y=v=>{if(h.isIdentifier(v))return v.text;if(h.isPropertyAccessExpression(v)){let I=y(v.expression);return I===void 0?void 0:`${I}.${v.name.text}`}if(h.isElementAccessExpression(v)&&h.isStringLiteralLike(v.argumentExpression)){let I=y(v.expression);return I===void 0?void 0:`${I}.${v.argumentExpression.text}`}},b=v=>{let I=v;for(;h.isPropertyAccessExpression(I)||h.isElementAccessExpression(I);)I=I.expression;return kt(I)};for(let v of e.sourceFiles){let I=e.toRel(v.fileName);if(I===null)continue;let O=new Map,E=new Map,N=($,W)=>{let w=g(I,kt(W));if(w!==void 0){if(h.isIdentifier($))E.set($.text,w),O.set($.text,w);else if(h.isObjectBindingPattern($)||h.isArrayBindingPattern($))for(let P of ei($))E.set(P,w);else if(h.isPropertyAccessExpression($)||h.isElementAccessExpression($)){let P=y($);P!==void 0&&O.set(P,w)}}},A=$=>{h.isVariableDeclaration($)&&$.initializer!==void 0?N($.name,$.initializer):h.isBinaryExpression($)&&$.operatorToken.kind===h.SyntaxKind.EqualsToken&&N($.left,$.right),h.forEachChild($,A)};A(v);let U=$=>{let W=pp($);if(W!==void 0){let w=W.expression,P=g(I,b(w));P!==void 0&&m.add(P);let j=y(w),F=j!==void 0?O.get(j):void 0;F!==void 0&&m.add(F)}h.forEachChild($,U)};if(U(v),E.size>0){let $=gp(v,E),W=hp(v);for(let[w,P]of $)W.has(w)&&m.add(P)}}let _=[],S=[],k=[];for(let v of e.sourceFiles){let I=e.toRel(v.fileName);if(I===null||!r.has(I))continue;let O=e.checker.getSymbolAtLocation(v),E=new Set,N=new Set,A=0,U=(X,Q)=>{if(o.has(String(X.moduleId))||E.has(String(X.id)))return;E.add(String(X.id));let Z=`${I}#reexport:${String(A)}:${Q}`;A+=1,_.push({id:Z,moduleId:I,exportedName:Q,kind:"value",reexportOf:{moduleId:String(X.moduleId),name:X.name??Q}}),S.push({exportId:Z,target:{kind:"function",functionId:X.id}})},$=X=>{if(Ik(X))return;let Q=X;if((X.flags&h.SymbolFlags.Alias)!==0)try{Q=e.checker.getAliasedSymbol(X)}catch{return}let Z=Nk(Q,e,i,a,o);if(Z!==void 0){U(Z,X.getName());return}if((Q.flags&h.SymbolFlags.Module)!==0&&!N.has(Q)){N.add(Q);try{for(let x of e.checker.getExportsOfModule(Q))$(x)}catch{}}};if(O!==void 0)for(let X of e.checker.getExportsOfModule(O))$(X);let W=cp(v,I,c,Vs(v)),w=up(v,I,c,W,ap(v)),P=new Set,j=w.residual,F=X=>{let Q=f.get(X);X.includes("node_modules/")||Q===void 0||Ek(Q)?j=!0:P.add(X)};for(let{source:X,exportedName:Q}of w.sources){let Z=l.get(X.target)??[],x=m.has(X.target);if(X.kind==="whole"){for(let T of Z)U(T,T.name??Q);x?j=!0:(Z.length===0||u(X.target))&&F(X.target)}else{let T=Z.filter(q=>q.name===X.member);for(let q of T)U(q,Q);x?j=!0:(T.length===0||u(X.target))&&F(X.target)}}let B=new Set,ne=[];for(let X of tp(v,I,c))ne.push({target:X,depth:1});for(;ne.length>0;){let X=ne.shift();if(X===void 0)break;let{target:Q,depth:Z}=X;if(B.has(Q)||Z>Gk||(B.add(Q),Q.split("/").includes("node_modules")))continue;let x=f.get(Q);if(x===void 0)continue;let T=d.get(Q);T!==void 0&&!u(Q)&&U(T,"<load>");for(let q of tp(x,Q,c))B.has(q)||ne.push({target:q,depth:Z+1})}Mk(v,Vs(v))&&(j=!0);for(let X of P)k.push({code:"unresolved-reexport",path:I,detail:`entrypoint whole/member re-exports app-owned relative module ${X} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:X});j&&k.push({code:"unresolved-reexport",path:I,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:_,exportBindings:S,diagnostics:k}}var Ys=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),zk=new Set(["defineProperty","defineProperties","create"]);function Wk(e){let n=!0,t=r=>h.isIdentifier(r)||h.isStringLiteral(r)||h.isNumericLiteral(r)?Ys.has(r.text):h.isComputedPropertyName(r)&&h.isStringLiteralLike(r.expression)?Ys.has(r.expression.text):!1,s=r=>{if(n){if(h.isNewExpression(r)||h.isForOfStatement(r)||h.isSpreadElement(r)||h.isSpreadAssignment(r)||h.isArrayBindingPattern(r)||h.isGetAccessorDeclaration(r)||h.isSetAccessorDeclaration(r)||h.isYieldExpression(r)&&r.asteriskToken!==void 0||h.canHaveDecorators(r)&&(h.getDecorators(r)?.length??0)>0){n=!1;return}if((h.isPropertyAccessExpression(r)||h.isMethodDeclaration(r)||h.isPropertyAssignment(r))&&t(r.name)||h.isPropertyDeclaration(r)&&t(r.name)||h.isShorthandPropertyAssignment(r)&&t(r.name)||h.isBindingElement(r)&&t(r.propertyName??r.name)||h.isElementAccessExpression(r)&&h.isStringLiteralLike(r.argumentExpression)&&Ys.has(r.argumentExpression.text)){n=!1;return}if(h.isCallExpression(r)&&h.isPropertyAccessExpression(r.expression)&&h.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&zk.has(r.expression.name.text)){n=!1;return}h.forEachChild(r,s)}};return s(e),n}function si(e){if(h.isIdentifier(e)||h.isStringLiteral(e)||h.isNumericLiteral(e))return e.text}function yp(e){let n=t=>h.canHaveDecorators(t)&&(h.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Uk(e){let n=!1,t=new Set,s=[],r=new Map,o=(p,u)=>{let m=r.get(p);m===void 0?r.set(p,[u]):m.push(u)},i=p=>{h.isIdentifier(p)?t.add(p.text):s.push(p)},a=p=>{for(let u of p.properties)h.isShorthandPropertyAssignment(u)?t.add(u.name.text):h.isPropertyAssignment(u)?s.push(u.initializer):n=!0},l=p=>{if(h.isBinaryExpression(p)&&p.operatorToken.kind===h.SyntaxKind.EqualsToken){let u=p.left,m=p.right;In(u)?h.isObjectLiteralExpression(m)?a(m):h.isIdentifier(m)||h.isFunctionExpression(m)||h.isArrowFunction(m)||h.isClassExpression(m)?i(m):n=!0:it(u)?(h.isElementAccessExpression(u)&&!h.isStringLiteralLike(u.argumentExpression)&&(n=!0),i(m)):h.isIdentifier(u)?o(u.text,m):(h.isPropertyAccessExpression(u)||h.isElementAccessExpression(u))&&h.isIdentifier(u.expression)&&o(u.expression.text,m)}else if(h.isCallExpression(p))(Js(p)&&p.arguments[0]!==void 0&&Es(p.arguments[0])||_l(p))&&(n=!0);else if(h.isVariableDeclaration(p)&&h.isIdentifier(p.name)&&p.initializer!==void 0)o(p.name.text,p.initializer);else if((h.isFunctionDeclaration(p)||h.isClassDeclaration(p))&&p.name!==void 0)o(p.name.text,p),vs(p)&&t.add(p.name.text);else if(h.isExportDeclaration(p)){if(p.exportClause===void 0)n=!0;else if(p.moduleSpecifier===void 0&&h.isNamedExports(p.exportClause))for(let u of p.exportClause.elements)t.add((u.propertyName??u.name).text)}else if(h.isExportAssignment(p))p.isExportEquals&&!h.isIdentifier(p.expression)?n=!0:i(p.expression);else if(h.isVariableStatement(p)&&vs(p))for(let u of p.declarationList.declarations)h.isIdentifier(u.name)&&t.add(u.name.text);h.forEachChild(p,l)};l(e);let d=new Set,c=[...t],f=p=>{let u=m=>{h.isIdentifier(m)&&c.push(m.text),h.forEachChild(m,u)};u(p)};for(let p of s)f(p);for(;c.length>0;){let p=c.pop();if(!(p===void 0||d.has(p))){d.add(p);for(let u of r.get(p)??[])f(u)}}return{names:d,opaque:n}}var Hk=512,qk=new Set(["get","post","put","patch","delete","options","head"]);function Vk(e){for(let n of e.statements){if(h.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(h.isExpressionStatement(n)&&h.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isPropertyAccessExpression(n.expression.left)&&h.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,s=n.expression.left.name.text;if(t==="module"&&s==="exports"||t==="exports"&&s==="default")return n.expression.right}}return null}function Xk(e){let n=new Map,t=Vk(e);if(t===null)return n;let s=o=>{for(let i of o.properties)if(h.isPropertyAssignment(i)&&h.isObjectLiteralExpression(i.initializer)){let a=si(i.name);a!==void 0&&n.set(a,i.initializer)}};if(h.isObjectLiteralExpression(t))return s(t),n;if(!h.isIdentifier(t))return n;let r=t.text;for(let o of e.statements)if(h.isVariableStatement(o))for(let i of o.declarationList.declarations)h.isIdentifier(i.name)&&i.name.text===r&&i.initializer!==void 0&&h.isObjectLiteralExpression(i.initializer)&&s(i.initializer);else if(h.isExpressionStatement(o)&&h.isBinaryExpression(o.expression)&&o.expression.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isPropertyAccessExpression(o.expression.left)&&h.isIdentifier(o.expression.left.expression)&&o.expression.left.expression.text===r&&h.isObjectLiteralExpression(o.expression.right)){let i=o.expression.left.name.text;n.set(i,o.expression.right)}return n}function Yk(e){for(let n of e.properties){if(h.isMethodDeclaration(n)&&h.isIdentifier(n.name)&&n.name.text==="handler")return n;if(h.isPropertyAssignment(n)&&h.isIdentifier(n.name)&&n.name.text==="handler"&&(h.isArrowFunction(n.initializer)||h.isFunctionExpression(n.initializer)))return n.initializer}return null}function Jk(e,n){for(let s of e.properties){let r;if(h.isPropertyAssignment(s)||h.isMethodDeclaration(s)?r=si(s.name):h.isShorthandPropertyAssignment(s)&&(r=s.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Qk(e,n){let t=[],s=new Set,r=(a,l,d)=>{if(t.length>=Hk||a==="__proto__"||!Sl.test(a))return;let c=`${e}#handler:${a}`;s.has(c)||(s.add(c),t.push({id:c,node:l,memberPath:a,idiom:d}))};for(let[a,l]of Xk(n)){let d=Yk(l);d!==null&&Jk(l,d)&&r(a,d,"descriptor-object")}let o=0,i=a=>{if(h.isCallExpression(a)&&h.isPropertyAccessExpression(a.expression)&&h.isIdentifier(a.expression.expression)&&qk.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&h.isStringLiteralLike(a.arguments[0])){let l=a.expression.name.text;for(let d=1;d<a.arguments.length;d+=1){let c=a.arguments[d];c!==void 0&&(h.isArrowFunction(c)||h.isFunctionExpression(c))&&r(`${l}_${String(o)}_${String(d)}`,c,"router-verb")}o+=1}h.forEachChild(a,i)};return i(n),t}function Zk(e,n,t,s,r,o){let i=`${e}#class:${t}`,a=[],l=new Set;for(let d of s.members){let c,f,p;if(h.isConstructorDeclaration(d))c="constructor",f="ctor",p=!1;else if(h.isMethodDeclaration(d))c=si(d.name),f="method",p=c!==void 0&&!Ys.has(c);else continue;if(c===void 0||l.has(c))continue;l.add(c);let u=`${e}#${t}.${c}`;r.push({id:u,moduleId:e,name:c,kind:f,enclosingClassId:i,declRange:xt(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(u),p&&o.push({start:d.getStart(n,!1),end:d.getEnd(),id:u})}return{id:i,moduleId:e,name:t,implementsRefs:[],members:a}}function ew(e,n,t=[],s=!1,r){let o=[],i=new Map,a=[],{reachableLocals:l,defaultTarget:d}=wk(n),c=Vs(n),f=`${e}#<toplevel>`;o.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let p=(I,O)=>{let E=`${e}#${I}`;return o.push({id:E,moduleId:e,name:I,kind:"function",declRange:xt(e,O,n),isExported:l.has(I),publicSurfaceReachable:l.has(I)}),i.set(I,{kind:"function",functionId:E}),a.push({start:O.getStart(n,!1),end:O.getEnd(),id:E}),E},u=[],m=!e.split("/").includes("node_modules");if(m)for(let I of Ck(n,c))l.add(I);let g=m?Uk(n):void 0,y=(I,O,E)=>{g===void 0||g.opaque||g.names.has(I)||vs(E)||yp(O)||u.push(Zk(e,n,I,O,o,a))};for(let I of n.statements)if(h.isFunctionDeclaration(I)&&I.name!==void 0)p(I.name.text,I);else if(h.isClassDeclaration(I)&&I.name!==void 0)y(I.name.text,I,I);else if(h.isVariableStatement(I))for(let O of I.declarationList.declarations){if(h.isObjectBindingPattern(O.name)&&O.initializer!==void 0&&h.isCallExpression(O.initializer)&&h.isIdentifier(O.initializer.expression)&&O.initializer.expression.text==="require"&&O.initializer.arguments.length===1&&O.initializer.arguments[0]!==void 0&&h.isStringLiteralLike(O.initializer.arguments[0])){let N=O.initializer.arguments[0].text;for(let A of O.name.elements){if(A.dotDotDotToken!==void 0||A.initializer!==void 0||!h.isIdentifier(A.name))continue;let U=A.propertyName??A.name;!h.isIdentifier(U)&&!h.isStringLiteralLike(U)||i.set(A.name.text,{kind:"import",specifier:N,form:{named:U.text}})}continue}if(!h.isIdentifier(O.name)||O.initializer===void 0)continue;let E=O.initializer;if(h.isFunctionExpression(E)||h.isArrowFunction(E))p(O.name.text,O);else if(h.isClassExpression(E))y(O.name.text,E,I);else if(h.isCallExpression(E)&&h.isIdentifier(E.expression)&&E.expression.text==="require"&&E.arguments.length===1&&E.arguments[0]!==void 0&&h.isStringLiteralLike(E.arguments[0]))i.set(O.name.text,{kind:"import",specifier:E.arguments[0].text,form:"whole"});else if((h.isPropertyAccessExpression(E)||h.isElementAccessExpression(E))&&ti(E)==="default"&&h.isCallExpression(E.expression)){let N=kt(E.expression);N!==void 0&&i.set(O.name.text,{kind:"import",specifier:N,form:"require-default"})}}else if(h.isImportDeclaration(I)&&h.isStringLiteralLike(I.moduleSpecifier)){let O=I.moduleSpecifier.text,E=I.importClause;if(E!==void 0){E.name!==void 0&&i.set(E.name.text,{kind:"import",specifier:O,form:"default"});let N=E.namedBindings;if(N!==void 0&&h.isNamespaceImport(N))i.set(N.name.text,{kind:"import",specifier:O,form:"namespace"});else if(N!==void 0&&h.isNamedImports(N))for(let A of N.elements){let U=(A.propertyName??A.name).text;i.set(A.name.text,{kind:"import",specifier:O,form:{named:U}})}}}else h.isImportEqualsDeclaration(I)&&h.isExternalModuleReference(I.moduleReference)&&h.isStringLiteralLike(I.moduleReference.expression)&&i.set(I.name.text,{kind:"import",specifier:I.moduleReference.expression.text,form:"whole"});let b=new Map,_,S=new Map,k=new Map;if(m)for(let{name:I,value:O}of Pk(n)){let E=`${e}#member-export:${I}`;o.push({id:E,moduleId:e,name:I,kind:h.isArrowFunction(O)?"arrow":"function",declRange:xt(e,O,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:O.getStart(n,!1),end:O.getEnd(),id:E}),b.set(O.getStart(n,!1),E)}if(s&&m){let I=U=>{let $=an(U);return h.isFunctionExpression($)||h.isArrowFunction($)?$:void 0},O=(U,$)=>{let W=U;return o.push({id:W,moduleId:e,kind:h.isArrowFunction($)?"arrow":"function",declRange:xt(e,$,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:$.getStart(n,!1),end:$.getEnd(),id:W}),b.set($.getStart(n,!1),W),W},E=[],N=[],A=[];for(let U of n.statements)h.isExportAssignment(U)&&!U.isExportEquals?E.push(U):h.isFunctionDeclaration(U)&&h.getModifiers(U)?.some($=>$.kind===h.SyntaxKind.DefaultKeyword)===!0?N.push(U):h.isExpressionStatement(U)&&h.isBinaryExpression(U.expression)&&U.expression.operatorToken.kind===h.SyntaxKind.EqualsToken&&In(U.expression.left)&&A.push(U.expression);if(E.length+N.length+A.length===1){let U=E[0],$=N[0],W=A[0];if(U!==void 0){let w=I(U.expression);if(w!==void 0){let P=O(`${e}#<default>`,w);_={id:P,esm:!0},k.set(U.getStart(n,!1),P),je(r,"2a-default",null)}}else if($!==void 0&&$.name===void 0&&$.body!==void 0){let w=O(`${e}#<default>`,$);_={id:w,esm:!0},k.set($.getStart(n,!1),w),je(r,"2a-default",null)}else if(W!==void 0){let w=I(W.right);if(w!==void 0){let P=O(`${e}#<default>`,w);_={id:P,esm:!1},k.set(W.getStart(n,!1),P),je(r,"2a-default",null)}else if(h.isObjectLiteralExpression(W.right)){let P=W.right,j=[],F=!0;for(let B of P.properties){if(h.isSpreadAssignment(B)){F=!1;break}let ne=B.name,X=ne===void 0?void 0:yl(ne);if(X===void 0){F=!1;break}j.push(X)}if(F){let B=new Map;for(let ne of j)B.set(ne,(B.get(ne)??0)+1);for(let ne of P.properties){if(!h.isPropertyAssignment(ne))continue;let X=yl(ne.name),Q=I(ne.initializer);if(X!==void 0){if(!Rk(X)){Q!==void 0&&je(r,"2a-member","charset-refused");continue}if((B.get(X)??0)!==1){Q!==void 0&&je(r,"2a-member","duplicate-key");continue}if(Q!==void 0){let Z=O(`${e}#<cjs>.${X}`,Q);S.set(X,Z),k.set(ne.getStart(n,!1),Z),je(r,"2a-member",null)}}}}else for(let B of P.properties)h.isPropertyAssignment(B)&&I(B.initializer)!==void 0&&je(r,"2a-member","spread-or-computed-literal")}}}else{for(let U of E)I(U.expression)!==void 0&&je(r,"2a-default","duplicate-default-sources");for(let U of N)U.name===void 0&&je(r,"2a-default","duplicate-default-sources");for(let U of A)if(I(U.right)!==void 0)je(r,"2a-default","duplicate-default-sources");else if(h.isObjectLiteralExpression(U.right))for(let $ of U.right.properties)h.isPropertyAssignment($)&&I($.initializer)!==void 0&&je(r,"2a-member","duplicate-default-sources")}}for(let I of t)o.push({id:I.id,moduleId:e,name:`handler:${I.memberPath}`,kind:h.isArrowFunction(I.node)?"arrow":"function",declRange:xt(e,I.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:I.node.getStart(n,!1),end:I.node.getEnd(),id:I.id});a.sort((I,O)=>I.end-I.start-(O.end-O.start));let v=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:o,bindings:i,exportedFunctionId:v,exportedNames:l,tainted:c,fnRanges:a,toplevelId:f,classes:u,mintedByPos:b,mintedDefault:_,mintedMembers:S,mintSeedAliases:k}}function nw(e){return h.isIdentifier(e)?"identifier":h.isPropertyAccessExpression(e)?"member":h.isElementAccessExpression(e)?"computed-member":e.kind===h.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function sp(e,n){let t=s=>{if(h.isBinaryExpression(s)&&s.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=h.SyntaxKind.LastAssignment){let r=s.left;h.isPropertyAccessExpression(r)&&h.isIdentifier(r.expression)?n(r.expression.text,r.name.text):h.isElementAccessExpression(r)&&h.isIdentifier(r.expression)&&n(r.expression.text,h.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(h.isCallExpression(s)&&h.isPropertyAccessExpression(s.expression)){let r=s.expression,o=s.arguments[0];h.isIdentifier(r.expression)&&o!==void 0&&h.isIdentifier(o)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(o.text,null)}h.forEachChild(s,t)};t(e)}function tw(e){let n=!1,t=s=>{if(!n){if(h.isVariableDeclaration(s)||h.isParameter(s)){let r=new Set;if(Mr(s.name,r),r.has("require")){n=!0;return}}else if((h.isFunctionDeclaration(s)||h.isClassDeclaration(s))&&s.name!==void 0&&s.name.text==="require"){n=!0;return}h.forEachChild(s,t)}};return t(e),n}function sw(e,n,t,s=new Map,r={}){let o=r.additiveForms===!0,i=r.namelessExports===!0,a=o||i?{}:void 0,l=new Map,d=new Map;for(let w of n.imports)w.resolvedModuleId!==void 0&&d.set(`${w.moduleId}::${w.specifier}`,w.resolvedModuleId);for(let w of e.sourceFiles){let P=e.toRel(w.fileName);P!==null&&l.set(P,ew(P,w,s.get(P)??[],i,a))}let c=new Map;if(o)for(let w of l.values()){let P=new Map;for(let[j,F]of w.bindings)if(F.kind==="import"&&F.form==="whole"&&Ze(F.specifier)!=="package-root"){let B=d.get(`${w.rel}::${F.specifier}`);B!==void 0&&P.set(j,String(B))}P.size!==0&&sp(w.sf,(j,F)=>{let B=P.get(j);if(B===void 0)return;let ne=c.get(B);if(ne!=="*"){if(F===null){c.set(B,"*");return}ne===void 0?c.set(B,new Set([F])):ne.add(F)}})}let f=new Map;for(let w of l.values())w.exportedFunctionId!==void 0&&f.set(w.rel,w.exportedFunctionId);let p=new Map;for(let w of l.values()){if(w.rel.split("/").includes("node_modules"))continue;let P=vk(w.sf);if(P===void 0){i&&w.mintedDefault!==void 0&&p.set(w.rel,w.mintedDefault);continue}let j=w.bindings.get(P.name);j?.kind==="function"&&p.set(w.rel,{id:j.functionId,esm:P.esm})}let u=new Map;for(let w of l.values()){let P;for(let j of w.exportedNames){let F=w.bindings.get(j);F?.kind==="function"&&(P??=new Map,P.set(j,F.functionId))}P!==void 0&&u.set(w.rel,P)}let m=new Map;for(let w of l.values()){if(w.rel.split("/").includes("node_modules"))continue;let P=Dk(w.sf,w.tainted,j=>{let F=w.bindings.get(j);return F?.kind==="function"?F.functionId:void 0},i?j=>{let F=an(j);return h.isFunctionExpression(F)||h.isArrowFunction(F)?w.mintedByPos.get(F.getStart(w.sf,!1)):void 0}:void 0);P.size>0&&m.set(w.rel,P)}let g=[],y=[],b=[],_=[],S=[],k=[],v=new Map;for(let w of n.imports){let P=v.get(w.moduleId)??[];P.push(w.specifier),v.set(w.moduleId,P)}let I=w=>Mf(v.get(w)??[]),O=new Map,E=new Map,N=new Map,A=new Map;for(let w of l.values())if(!w.rel.split("/").includes("node_modules"))for(let P of w.functions)P.id!==w.toplevelId&&A.set(P.id,{fn:P,sf:w.sf});let U=new Map,$=w=>{let P=U.get(w);if(P===void 0){let j=A.get(w),F=j===void 0?null:qf(j.sf,j.fn.declRange.start,j.fn.declRange.end);P=F===null?null:Wf(F),U.set(w,P)}return P};for(let w of l.values()){k.push(...w.classes);for(let K of w.exportedNames){let J=w.bindings.get(K);if(J?.kind==="function"){let oe=`${w.rel}#export:${K}`;_.push({id:oe,moduleId:w.rel,exportedName:K,kind:"value"}),S.push({exportId:oe,target:{kind:"function",functionId:J.functionId}})}}if(i){if(w.mintedDefault!==void 0){let K=`${w.rel}#export:<default>`;_.push({id:K,moduleId:w.rel,exportedName:"default",kind:"value"}),S.push({exportId:K,target:{kind:"function",functionId:w.mintedDefault.id}})}for(let[K,J]of w.mintedMembers){let oe=`${w.rel}#export:<cjs>.${K}`;_.push({id:oe,moduleId:w.rel,exportedName:K,kind:"value"}),S.push({exportId:oe,target:{kind:"function",functionId:J}})}}let P=new Map;for(let[K,J]of w.bindings){if(J.kind==="function"){P.set(K,J);continue}if(Ze(J.specifier)==="package-root"){let ae=Bn(J.specifier);typeof J.form=="object"?P.set(K,{kind:"package-export",packageName:ae,exportName:J.form.named}):J.form==="require-default"?P.set(K,{kind:"package-default",packageName:ae}):P.set(K,{kind:"package-surface",packageName:ae})}else{let ae=d.get(`${w.rel}::${J.specifier}`);if(ae!==void 0&&typeof J.form=="object"){let Ee=u.get(String(ae))?.get(J.form.named);Ee!==void 0&&P.set(K,{kind:"app-named-fn",functionId:Ee})}else if(ae!==void 0&&J.form==="require-default"){let Ee=p.get(String(ae));Ee!==void 0&&Ee.esm&&P.set(K,{kind:"app-default-fn",functionId:Ee.id})}else ae!==void 0&&typeof J.form!="object"&&J.form!=="require-default"&&P.set(K,{kind:"module",resolvedModuleId:ae})}}let j=new Map;for(let K of w.functions){if(K.enclosingClassId===void 0||K.name===void 0)continue;let J=j.get(K.enclosingClassId);J===void 0&&(J=new Map,j.set(K.enclosingClassId,J)),J.set(K.name,K.id)}for(let K of w.classes)K.name===void 0||w.tainted.has(K.name)||P.has(K.name)||P.set(K.name,{kind:"app-class",cls:{classId:K.id,className:K.name,memberIds:j.get(K.id)??new Map}});let F=K=>{if(h.isVariableDeclaration(K)&&h.isIdentifier(K.name)&&K.initializer!==void 0&&h.isNewExpression(K.initializer)&&!w.tainted.has(K.name.text)&&!P.has(K.name.text)){let J=Jf(K.initializer,P,w.tainted);J!==null&&P.set(K.name.text,J)}h.forEachChild(K,F)};F(w.sf);let B=K=>{for(let J of w.fnRanges)if(K>=J.start&&K<J.end)return J.id;return w.toplevelId},ne=new Map,X=new Map,Q=new Map,Z=(K,J,oe)=>{if(oe===null){K.set(J,"*");return}let ae=K.get(J);ae!=="*"&&(ae===void 0?K.set(J,new Set([oe])):ae.add(oe))},x=(K,J)=>{Z(ne,K,J);let oe=P.get(K);oe?.kind==="package-surface"?Z(X,oe.packageName,J):oe?.kind==="module"&&Z(Q,String(oe.resolvedModuleId),J)};sp(w.sf,x);let T=new Map,q=256,G=K=>{let J=T.get(K);return J===void 0&&(J=T.size>=q?new Set([K]):mp(w.sf,new Set([K])),T.set(K,J)),J},z=(K,J)=>K==="*"||K!==void 0&&K.has(J),L=(K,J)=>{let oe=P.get(K);if(oe?.kind==="package-surface"&&z(X.get(oe.packageName),J)||oe?.kind==="module"&&z(Q.get(String(oe.resolvedModuleId)),J))return!0;for(let ae of G(K))if(z(ne.get(ae),J))return!0;return!1},ie=K=>{if(h.isIdentifier(K)){let J=w.tainted.has(K.text)?void 0:P.get(K.text);return J?.kind==="function"?J.functionId:J?.kind==="module"?f.get(String(J.resolvedModuleId))??null:J?.kind==="package-export"?t.exportFor(J.packageName,J.exportName):null}if(h.isPropertyAccessExpression(K)&&h.isIdentifier(K.expression)){let J=K.expression.text;if(L(J,K.name.text))return null;let oe=w.tainted.has(J)?void 0:P.get(J);return oe?.kind==="package-surface"?t.exportFor(oe.packageName,K.name.text):oe?.kind==="package-export"?t.methodFor(oe.packageName,oe.exportName,K.name.text,"method"):oe?.kind==="package-instance"?t.methodFor(oe.packageName,oe.className,K.name.text,"method"):null}return null},me=K=>{for(let J=K.parent;J!==void 0;J=J.parent)if(!h.isArrowFunction(J)){if(h.isFunctionExpression(J)||h.isFunctionDeclaration(J))return null;if(h.isMethodDeclaration(J)||h.isConstructorDeclaration(J)||h.isGetAccessorDeclaration(J)||h.isSetAccessorDeclaration(J)){let oe=J.parent;if(!h.isClassLike(oe)||oe.name===void 0)return null;let ae=w.tainted.has(oe.name.text)?void 0:P.get(oe.name.text);return ae?.kind==="app-class"?ae.cls:null}}return null},be=o&&!w.tainted.has("require")&&!tw(w.sf),Me=K=>{if(h.isIdentifier(K)){let ae=w.tainted.has(K.text)?void 0:P.get(K.text);return ae?.kind==="package-surface"||ae?.kind==="package-default"?t.exportFor(ae.packageName,"default"):ae?.kind==="app-named-fn"||ae?.kind==="app-default-fn"?ae.functionId:ae?.kind==="module"?p.get(String(ae.resolvedModuleId))?.id??null:ae?.kind==="member-value"?ae.functionId:null}if(!h.isPropertyAccessExpression(K))return null;let J=K.expression;if(o&&h.isCallExpression(an(J))){let ae=kt(an(J));if(ae!==void 0)if(!be)je(a,"2b","require-shadow");else if(Ze(ae)==="package-root")je(a,"2b","package-root");else{let Ee=d.get(`${w.rel}::${ae}`);if(Ee===void 0)je(a,"2b","unresolved-module");else{let Te=K.name.text,En=c.get(String(Ee));if(En==="*"||En!==void 0&&En.has(Te))je(a,"2b","module-mutation-gate");else{let Un=m.get(String(Ee))?.get(Te);if(Un!==void 0)return je(a,"2b",null),Un;if(Te==="default"){let Hn=p.get(String(Ee));if(Hn!==void 0&&Hn.esm)return je(a,"2b",null),Hn.id;je(a,"2b","non-esm-default")}else je(a,"2b","unknown-member")}}}return null}let oe;if(h.isIdentifier(J)){let ae=w.tainted.has(J.text)?void 0:P.get(J.text);if(ae?.kind==="app-class"||ae?.kind==="app-instance")oe=ae.cls.memberIds;else if(ae?.kind==="object-literal")oe=ae.obj.members;else if(ae?.kind==="module"){let Ee=m.get(String(ae.resolvedModuleId));Ee?.has(K.name.text)===!0&&!L(J.text,K.name.text)&&(oe=Ee)}}else if(h.isNewExpression(J)){let ae=Jf(J,P,w.tainted);ae?.kind==="app-instance"&&(oe=ae.cls.memberIds)}else J.kind===h.SyntaxKind.ThisKeyword&&(oe=me(K)?.memberIds);return oe?.get(K.name.text)??null},re=new Map,R=K=>{if(h.isVariableDeclaration(K)&&h.isIdentifier(K.name)&&K.initializer!==void 0&&h.isObjectLiteralExpression(K.initializer)&&!w.tainted.has(K.name.text)&&!P.has(K.name.text)&&!re.has(K.name.text)){let J=new Map;for(let oe of K.initializer.properties)if(h.isPropertyAssignment(oe)&&h.isIdentifier(oe.name)){let ae=ie(oe.initializer);ae!==null&&J.set(oe.name.text,ae)}re.set(K.name.text,J)}h.forEachChild(K,R)};R(w.sf);let D=K=>{if(h.isBinaryExpression(K)&&K.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isPropertyAccessExpression(K.left)&&h.isIdentifier(K.left.expression)&&!w.tainted.has(K.left.expression.text)){let J=re.get(K.left.expression.text);if(J!==void 0){let oe=ie(K.right);oe!==null&&J.set(K.left.name.text,oe)}}h.forEachChild(K,D)};D(w.sf);for(let[K,J]of re)P.set(K,{kind:"object-literal",obj:{members:J}});let Y=(K,J=0)=>{if(J>Xf)return null;let oe=an(K);if(h.isCallExpression(oe)&&h.isPropertyAccessExpression(oe.expression)&&oe.expression.name.text==="bind")return Y(oe.expression.expression,J+1);if(h.isIdentifier(oe)){let ae=ie(oe);if(ae!==null)return ae;let Ee=w.tainted.has(oe.text)?void 0:P.get(oe.text);return Ee?.kind==="member-value"?Ee.functionId:null}return h.isPropertyAccessExpression(oe)?ie(oe)??Me(oe):null},H=(K,J=0)=>{if(J>Xf)return"depth-cap";let oe=an(K);if(h.isCallExpression(oe)&&h.isPropertyAccessExpression(oe.expression)&&oe.expression.name.text==="bind")return H(oe.expression.expression,J+1);if(h.isIdentifier(oe))return w.tainted.has(oe.text)?"tainted-receiver":"unresolved-receiver";if(h.isPropertyAccessExpression(oe)&&h.isIdentifier(oe.expression)){if(w.tainted.has(oe.expression.text))return"tainted-receiver";if(L(oe.expression.text,oe.name.text))return"mutated-member"}return"unresolved-receiver"},ee=K=>{if(h.isVariableDeclaration(K)&&h.isIdentifier(K.name)&&K.initializer!==void 0){let J=an(K.initializer),oe=h.isPropertyAccessExpression(J),ae=h.isCallExpression(J)&&h.isPropertyAccessExpression(J.expression)&&J.expression.name.text==="bind";if(oe||ae){let Ee=oe?"D1":"A2";if(w.tainted.has(K.name.text))je(a,Ee,"tainted-alias");else if(P.has(K.name.text))je(a,Ee,"already-bound");else{let Te=Y(J);Te!==null?(P.set(K.name.text,{kind:"member-value",functionId:Te}),je(a,Ee,null)):je(a,Ee,H(J))}}}h.forEachChild(K,ee)};o&&ee(w.sf);let le=I(w.rel),de=new Map,ge=new Map,ve=K=>{let J=an(K);if(!h.isIdentifier(J))return null;let oe=w.tainted.has(J.text)?void 0:P.get(J.text),ae=oe?.kind==="package-surface"||oe?.kind==="package-export"&&oe.exportName==="default"?oe.packageName:null;return ae===null?null:zf(ae)?.shape??null},Re=(K,J)=>{let oe=new Set((J.arity??[]).map(Te=>jr(J.model,Te))),[ae]=[...oe];if(oe.size!==1||ae===void 0||ae>=J.passes)return;let Ee={model:J.model,index:ae,registeredAt:J.registeredAt};if(h.isArrowFunction(K)||h.isFunctionExpression(K))ge.has(K)||ge.set(K,Ee);else if(h.isIdentifier(K)||h.isPropertyAccessExpression(K)){let Te=ie(K)??Me(K);Te!==null&&!O.has(Te)&&(O.set(Te,J.model),E.set(Te,J.registeredAt),N.set(Te,ae))}},_e=(K,J,oe)=>{let ae=de.get(K);if(ae===void 0)return;let Ee=ve(J)??(oe===null?null:$(oe));if(Ee===null||K.questionDotToken!==void 0||K.arguments.some(h.isSpreadElement))return;let Te=K.arguments[Ee.param];if(Te===void 0)return;let En={...ae,depth:ae.depth+1,arity:ae.arity??Ee.arity,passes:Math.min(ae.passes,Ee.passes)},Un=an(Te);h.isCallExpression(Un)?En.depth<Kf&&de.set(Un,En):Re(Un,En)},Ke=0,ze=K=>{let J,oe;if(h.isCallExpression(K)){let ae=K.expression,Ee=h.isIdentifier(ae)&&ae.text==="require",Te=ae.kind===h.SyntaxKind.ImportKeyword;!Ee&&!Te&&(J=ae,oe=K.arguments)}else h.isTaggedTemplateExpression(K)&&(J=K.tag);if(J!==void 0){let ae=nw(J),Ee=K.getStart(w.sf,!1),Te=`${w.rel}#call${String(Ke)}`;Ke+=1;let En="unresolved",Un=[],Hn=ie(J);if(Hn!==null&&(En="resolved",Un.push(Hn)),y.push({id:Te,enclosingFunctionId:B(Ee),calleeExprShape:ae,resolvedTargetIds:Un,resolution:En,range:xt(w.rel,K,w.sf),...ml(K,J,w.rel,w.sf,{program:e.program,checker:e.checker})}),h.isCallExpression(K)){let Ye=Jo(K,le);for(let et of Ye?.handlers??[]){if(Ye===null||!(h.isIdentifier(et)||h.isPropertyAccessExpression(et)))continue;let gt=ie(et)??Me(et);gt!==null&&!O.has(gt)&&(O.set(gt,Ye.model),E.set(gt,xt(w.rel,K,w.sf)))}for(let et of Ye?.forwarded??[])Ye!==null&&de.set(et,{model:Ye.model,registeredAt:xt(w.rel,K,w.sf),depth:0,arity:null,passes:Number.POSITIVE_INFINITY})}for(let Ye of Un)b.push({callSiteId:Te,calleeFunctionId:Ye,resolution:En,invocation:"direct"});let br=Hn===null?Me(J):null;if(Hn===null){if(br!==null)b.push({callSiteId:Te,calleeFunctionId:br,resolution:"field-based",invocation:"direct"});else if(o&&h.isPropertyAccessExpression(J)&&(J.name.text==="call"||J.name.text==="apply")){let Ye=Y(J.expression);Ye!==null?(b.push({callSiteId:Te,calleeFunctionId:Ye,resolution:"field-based"}),je(a,"A3",null)):je(a,"A3",H(J.expression))}}h.isCallExpression(K)&&_e(K,J,Hn??br);for(let Ye of oe??[]){let et=ie(Ye);if(et!==null)b.push({callSiteId:Te,calleeFunctionId:et,resolution:"field-based",invocation:"callback"});else{let gt=Me(Ye);if(gt!==null)b.push({callSiteId:Te,calleeFunctionId:gt,resolution:"field-based",invocation:"callback"});else if(o){let Ds=Y(Ye),V=an(Ye),ye=V!==Ye||h.isCallExpression(V)&&h.isPropertyAccessExpression(V.expression)&&V.expression.name.text==="bind";Ds!==null?(b.push({callSiteId:Te,calleeFunctionId:Ds,resolution:"field-based"}),ye&&je(a,"A2p",null)):ye&&je(a,"A2p",H(Ye))}}}}h.forEachChild(K,ze)};ze(w.sf),g.push(...pl(w.functions,w.sf,w.rel,le,{program:e.program,checker:e.checker},ge));for(let K of n.computedLoads.get(w.rel)??[]){let J=K.candidateRels.filter(ae=>l.has(ae)).map(ae=>`${ae}#<toplevel>`);if(J.length===0)continue;let oe=`${w.rel}#dirload${String(Ke)}`;Ke+=1,y.push({id:oe,enclosingFunctionId:B(K.pos),calleeExprShape:"require",resolvedTargetIds:J,resolution:"field-based",range:{path:w.rel,start:K.pos,end:K.pos}});for(let ae of J)b.push({callSiteId:oe,calleeFunctionId:ae,resolution:"field-based"})}let pn=0;for(let K of n.literalLoads.get(w.rel)??[]){let J=[];for(let ae of K.targetRels){let Ee=l.get(ae);Ee!==void 0&&J.push(Ee.toplevelId)}if(J.length===0)continue;let oe=`${w.rel}#load${String(pn)}`;pn+=1,y.push({id:oe,enclosingFunctionId:B(K.pos),calleeExprShape:K.shape,resolvedTargetIds:J,resolution:"resolved",range:{path:w.rel,start:K.pos,end:K.pos}});for(let ae of J)b.push({callSiteId:oe,calleeFunctionId:ae,resolution:"resolved"})}let vn=0;for(let K of s.get(w.rel)??[]){let J=`${w.rel}#handlerseed${String(vn)}`;vn+=1;let oe=K.node.getStart(w.sf,!1);y.push({id:J,enclosingFunctionId:w.toplevelId,calleeExprShape:"member",resolvedTargetIds:[K.id],resolution:"field-based",range:{path:w.rel,start:oe,end:oe}}),b.push({callSiteId:J,calleeFunctionId:K.id,resolution:"field-based"})}}let W=new Map;if(i)for(let w of l.values())for(let[P,j]of w.mintSeedAliases)W.set(`${w.rel}::${String(P)}`,j);return{functions:g.map(w=>{let P=O.get(w.id);if(P===void 0||w.sourceParams!==void 0)return w;let j=E.get(w.id);return{...w,sourceParams:[{index:N.get(w.id)??jr(P,w.params?.length??0),sourceClass:P.sourceClass,model:P.id,...j!==void 0?{registeredAt:j}:{}}]}}),callSites:y,callEdges:b,exports:_,exportBindings:S,classes:k,mintSeedAliases:W,bindingApplicability:a}}function rw(e,n,t){let s=l=>l.length===0||Mn.isAbsolute(l)||l.includes("\\")||/^[a-zA-Z]:/u.test(l)||l.split("/").some(d=>d===".."||d==="");if(s(n)||s(t))return null;let r=e.endsWith(Mn.sep)?e:e+Mn.sep,o;try{o=Vf(Mn.resolve(e,n))}catch{return null}if(!o.startsWith(r))return null;let i=o.endsWith(Mn.sep)?o:o+Mn.sep,a;try{a=Vf(Mn.resolve(o,t))}catch{return null}return a.startsWith(i)?a:null}function bp(e,n,t){let s=`${e}#class:${t}`,r=[],o=[],i=[],a=new Set;return{pushMember(l,d,c,f){if(l==="__proto__"||a.has(l))return;a.add(l);let p=`${e}#${t}.${l}`;r.push({id:p,moduleId:e,name:l,kind:c,enclosingClassId:s,declRange:xt(e,d,n),isExported:!1,publicSurfaceReachable:!1}),i.push(p),o.push({name:l,id:p,kind:c,body:f})},finish(){return o.length===0?null:{functions:r,classNode:{id:s,moduleId:e,name:t,implementsRefs:[],members:i},members:o}}}}function ow(e,n,t,s){if(yp(s)||s.members.length>bl)return null;let r=bp(e,n,t);for(let o of s.members){let i,a,l;if(h.isConstructorDeclaration(o))i="constructor",a="ctor",l=void 0;else if(h.isMethodDeclaration(o))i=si(o.name),a="method",l=i!==void 0&&!Ys.has(i)?o.body??void 0:void 0;else continue;i!==void 0&&r.pushMember(i,o,a,l)}return r.finish()}function iw(e,n,t){let s;for(let i of n.statements)if(h.isFunctionDeclaration(i)&&i.name?.text===t){s=i;break}if(s===void 0)return null;let r=[];for(let i of n.statements){if(!h.isExpressionStatement(i))continue;let a=i.expression;if(!h.isBinaryExpression(a)||a.operatorToken.kind!==h.SyntaxKind.EqualsToken)continue;let l=a.left;if(h.isPropertyAccessExpression(l)&&h.isPropertyAccessExpression(l.expression)&&h.isIdentifier(l.expression.expression)&&l.expression.expression.text===t&&l.expression.name.text==="prototype"){let d=l.name.text;h.isFunctionExpression(a.right)?r.push({name:d,fn:a.right,walk:!0}):h.isArrowFunction(a.right)&&r.push({name:d,fn:a.right,walk:!1})}}if(r.length===0||r.length+1>bl)return null;let o=bp(e,n,t);o.pushMember("constructor",s,"ctor",void 0);for(let i of r){let a=i.walk&&!Ys.has(i.name)&&h.isFunctionExpression(i.fn)?i.fn.body:void 0;o.pushMember(i.name,i.fn,"method",a)}return o.finish()}function aw(e,n,t){for(let s of n.statements)if(h.isClassDeclaration(s)&&s.name?.text===t)return ow(e,n,t,s);return iw(e,n,t)}function lw(e,n,t,s,r){let o={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return o;let i=new Set(t.map(f=>f.packageName)),a=new Set(t.map(f=>f.path)),l=new Set,d=new Set,c=0;for(let f of n){if(!i.has(f.packageName))continue;let p=rw(e.appRoot,f.packageRootRel,f.sourcePath);if(p===null)continue;let u=e.toRel(p);if(u===null)continue;let m=`${u}#${f.container}`;if(d.has(m)||!l.has(u)&&l.size>=ni)continue;let g=_n(p);if(g===null)continue;let y;try{y=h.createSourceFile(u,g,h.ScriptTarget.Latest,!0,h.ScriptKind.JS)}catch{continue}let b=aw(u,y,f.container);if(b===null)continue;l.add(u),d.add(m);let _=new Map,S=new Map;for(let v of b.members){let I=r.methodFor(f.packageName,f.container,v.name,v.kind);_.set(v.name,I),S.set(I,v.id)}let k=0;for(let v of b.members){if(v.body===void 0)continue;let I=(O,E)=>{if(E&&h.isCallExpression(O)&&h.isPropertyAccessExpression(O.expression)&&O.expression.expression.kind===h.SyntaxKind.ThisKeyword){let U=_.get(O.expression.name.text);if(U!==void 0){let $=`${u}#depclass:${f.container}.${v.name}#c${String(k)}`;k+=1,o.callSites.push({id:$,enclosingFunctionId:v.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:xt(u,O,y)}),o.callEdges.push({callSiteId:$,calleeFunctionId:U,resolution:"field-based"})}}let N=h.isFunctionExpression(O)||h.isFunctionDeclaration(O)||h.isMethodDeclaration(O)||h.isConstructorDeclaration(O)||h.isGetAccessorDeclaration(O)||h.isSetAccessorDeclaration(O)||h.isClassLike(O),A=h.isArrowFunction(O)?E:N?!1:E;h.forEachChild(O,U=>{I(U,A)})};I(v.body,!0)}for(let v of s){let I=S.get(v.calleeFunctionId);I!==void 0&&o.callEdges.push({callSiteId:v.callSiteId,calleeFunctionId:I,resolution:"field-based"})}if(o.functions.push(...b.functions),o.classes.push(b.classNode),!a.has(u)){a.add(u),o.modules.push({id:u,packageName:f.packageName,versionRange:"",path:u,moduleSystem:"cjs",isEntrypoint:!1});let v=r.moduleFor(f.packageName),I=`${String(v)}#depclass${String(c)}`;c+=1,o.imports.push({id:I,moduleId:v,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:u}),o.importEdges.push({importId:I,resolvedModuleId:u})}o.diagnostics.push({code:"dep-class-corridor",path:u,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(b.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return o}function dw(e,n,t,s){let r=new Set(e.modules.filter(l=>l.isEntrypoint).map(l=>l.packageName)),o=new Map(e.functions.map(l=>[l.id,l.moduleId])),i=new Map;for(let l of e.callSites){if(l.resolution!=="unresolved")continue;let d=o.get(l.enclosingFunctionId);d!==void 0&&i.set(d,(i.get(d)??0)+1)}let a=[];for(let l of e.modules){if(l.externalSurface===!0)continue;let d=n.get(l.path);if(d===void 0||t.has(l.path)||r.has(l.packageName)&&s.has(l.path)&&!l.path.split("/").includes("node_modules"))continue;let c=i.get(l.id)??0;if(c===0&&Wk(d))continue;let f=c>0?`${String(c)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:l.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:l.id})}return a}function _p(e,n,t=[],s={},r=!1){let o=new gl,i=_k(e,n,o),a=new Set;for(let k of i.computedLoads.values())for(let v of k)if(v.seedable)for(let I of v.candidateRels)a.add(I);let l=new Map;for(let k of e.sourceFiles){let v=e.toRel(k.fileName);if(v===null||!a.has(v)||v.split("/").includes("node_modules"))continue;let I=Qk(v,k);I.length>0&&l.set(v,I)}let d=l.size===0?i.modules:i.modules.map(k=>l.has(k.path)&&!k.isEntrypoint?{...k,isEntrypoint:!0}:k),c={...i,modules:d},f=sw(e,c,o,l,s),p=Kk(e,i,f.functions,f.mintSeedAliases),u=new Set(i.modules.map(k=>k.path)),m=kk(e.depReach,o,u),g=[...c.modules,...m.modules,...o.modules()],y=lw(e,t,g,f.callEdges,o),b=[];if(r){let k="#default",v=new Set;for(let O of f.callEdges){let E=String(O.calleeFunctionId);!E.startsWith("pkg:")||!E.endsWith(k)||v.add(E.slice(4,E.length-k.length))}let I=new Map;for(let O of e.depReach.edges){if(!("surface"in O.from)||"surface"in O.to)continue;let E=O.from.surface;I.set(E,I.has(E)?null:O.to.module)}for(let O of v){let E=I.get(O);if(E==null)continue;let N=Sk(Mn.join(e.appRoot,E));if(N===null||N==="default")continue;let A=o.exportFor(O,N),U=`pkg:${O}${k}`;for(let $ of f.callEdges)String($.calleeFunctionId)===U&&b.push({callSiteId:$.callSiteId,calleeFunctionId:A,resolution:"field-based"})}}let _={modules:[...c.modules,...m.modules,...y.modules,...o.modules()],exports:[...f.exports,...p.exports],imports:[...i.imports,...m.imports,...y.imports],functions:[...f.functions,...o.functions(),...y.functions],callSites:[...f.callSites,...y.callSites],classes:[...f.classes,...o.classes(),...y.classes],callEdges:[...f.callEdges,...y.callEdges,...b],importEdges:[...i.importEdges,...m.importEdges,...y.importEdges],exportBindings:[...f.exportBindings,...p.exportBindings],inheritEdges:[]},S=new Map;for(let k of e.sourceFiles){let v=e.toRel(k.fileName);v!==null&&S.set(v,k)}return{graph:_,diagnostics:[...p.diagnostics,...y.diagnostics,...dw(_,S,new Set(e.diagnostics.filter(k=>k.code==="dependency-body").map(k=>k.path)),i.appOwnedPaths)],loadSites:i.loadSites,...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var cw=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,ri=/^[A-Za-z0-9_$.-]{1,128}$/u;function uw(e){return cw.test(e.calleePackage)?ri.test(e.anchorExport)?ri.test(e.calleeExport)?e.anchorContainer!==null&&!ri.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!ri.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Gr(e,n){let t=[],s=[],r=new Map(e.modules.map(d=>[d.id,d])),o=new Map(e.classes.map(d=>[d.id,d.name])),i=(d,c,f)=>e.functions.some(p=>{if(p.name!==c)return!1;let u=r.get(p.moduleId);return u===void 0||u.packageName!==d?!1:(p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null)===f}),a=(d,c,f)=>{for(let p of e.functions){if(p.name!==c)continue;let u=r.get(p.moduleId);if(!(u===void 0||u.packageName!==d||(p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null)!==f))return p.id}return null},l=[...n].sort((d,c)=>d.modelId<c.modelId?-1:d.modelId>c.modelId?1:0);for(let d of l){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let c=d.edges.map(uw).find(u=>u!==null);if(c!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${c} \u2014 model refused WHOLE`);continue}let f=0,p=0;for(let u of d.edges){if(!i(d.packageName,u.anchorExport,u.anchorContainer)){p+=1;continue}s.push({modelId:d.modelId,kind:u.kind,anchor:{packageName:d.packageName,exportName:u.anchorExport,container:u.anchorContainer},callee:{packageName:u.calleePackage,exportName:u.calleeExport,container:u.calleeContainer,realFunctionId:a(u.calleePackage,u.calleeExport,u.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${d.modelId}: ${String(f)} edge(s) lowered, ${String(p)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(p)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:s,notes:t}}}var fw={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Al(e){try{let n=kf(e.appRoot,e.entrypoints,e.tsconfigPaths===!0,new Set((e.executedEntrypoints??[]).map(a=>a.split(Tn.sep).join("/")))),t=new Set(e.entrypoints.map(a=>a.split(Tn.sep).join("/"))),{graph:s,diagnostics:r,loadSites:o,bindingApplicability:i}=_p(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:s,diagnostics:[...n.diagnostics,...r],loadSites:o,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...i!==void 0?{bindingApplicability:i}:{}}}catch(n){return{graph:fw,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Sp(e,n){let t=512,s=(r,o,i)=>{if(!(t<=0||o>12)){if(t-=1,typeof r=="string"){n(r,i);return}if(Array.isArray(r)){for(let a of r)s(a,o+1,i);return}if(r!==null&&typeof r=="object")for(let[a,l]of Object.entries(r))a==="types"||a==="typings"||s(l,o+1,i||a.includes("*"))}};s(e,0,!1)}function wp(e,n,t,s=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=Gt(Tn.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||s&&!st(r)?null:r===e?"":r.slice(n.length).split(Tn.sep).join("/")}var pw=1024*1024,mw=4096;function xp(e,n){let t=e.toLowerCase(),s=0;for(;;){let r=t.indexOf(n,s);if(r===-1)return null;let o=r===0?" ":t[r-1],i=r+n.length;for(;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
+`||e[i]==="\r");)i+=1;if(/[a-z0-9_:-]/i.test(o??" ")||e[i]!=="="){s=r+n.length;continue}for(i+=1;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
+`||e[i]==="\r");)i+=1;let a=e[i];if(a==='"'||a==="'"){let d=e.indexOf(a,i+1);return d===-1?null:e.slice(i+1,d)}let l=i;for(;l<e.length&&!/[\s>]/.test(e[l]??"");)l+=1;return e.slice(i,l)}}function gw(e){let n=[],t=e.toLowerCase(),s=0;for(;;){let r=t.indexOf("<script",s);if(r===-1)break;let o=t[r+7];if(o!==void 0&&/[a-z0-9-]/.test(o)){s=r+7;continue}let i=e.indexOf(">",r);if(i===-1)break;s=i+1;let a=e.slice(r+7,i);if(a.length>mw)continue;let l=xp(a,"type");n.push({module:(l??"").trim().toLowerCase()==="module",src:xp(a,"src")})}return n}function hw(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function yw(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function bw(e){let n=Gt(e),t=n.endsWith(Tn.sep)?n:n+Tn.sep,s=new Set,r=[],o=[],i=[],a=[],l=[],d=!1,c=(w,P,j=!1,F)=>{let B=wp(n,t,w);return B===null||B.length===0?"unresolved":s.has(B)?"duplicate":(s.add(B),r.push(B),o.push({source:P,specifier:Kn(F??(typeof w=="string"?w:"")),entrypoint:B,launch:j}),"added")},f=new Set,p=(w,P,j=!1)=>{let F=c(w,P),B=typeof w=="string"&&w.includes("\\")?c(w.split("\\").join("/"),P,!1,w):"unresolved";if(F!=="unresolved"||B!=="unresolved"||typeof w!="string"||w.trim().length===0||w.endsWith(".d.ts")||w.endsWith(".d.mts")||w.endsWith(".d.cts"))return;if(j&&w.includes("*")){let X=vf(n,w),Q=!1;if(X!==null){for(let Z of X.matches)c(Z,P,!1,w)!=="unresolved"&&(Q=!0);if(!X.truncated&&Q)return}a.push({source:P,file:"package.json",detail:`\`${Kn(w)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let ne=`${P}\0${w}`;f.has(ne)||(f.add(ne),a.push({source:P,file:"package.json",detail:`\`${Kn(w)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},u=[],m=(w,P)=>{i.push({source:w,file:w,detail:P.detail}),u.push({code:P.code,path:w,detail:`${w} ${P.detail}`})},g,y,b,_=null,S=oi(n,t,"package.json",ss);S.kind==="refused"&&m("package.json",S);try{let w=S.kind==="ok"?JSON.parse(S.text):{};if(_=S.kind==="ok"?w:null,p(w.main,"main"),typeof w.bin=="string")p(w.bin,"bin");else if(w.bin!==null&&typeof w.bin=="object")for(let j of Object.values(w.bin))p(j,"bin");Sp(w.exports,(j,F)=>{p(j,"exports",F)}),typeof w.browser=="string"?p(w.browser,"browser"):Sp(w.browser,j=>{c(j,"browser")});let P=w.scripts;if(P!==null&&typeof P=="object"){let j=P;g=j.start,y=j.prestart,b=j.poststart}}catch{}if(r.length===0)try{Gt(Tn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let k=(w,P)=>{if(typeof w=="string"&&w.trim().length>0){let j=vl(w,P,"package.json",c,i,!1)==="used";return j&&(d=!0),j?"resolved":"gapped"}return w===void 0||typeof w=="string"?"absent":(i.push({source:P,file:"package.json",detail:`${P} is not a string; no entry file could be read from it`}),"gapped")},v=k(g,"scripts.start"),I=k(y,"scripts.prestart"),O=k(b,"scripts.poststart"),E=v==="resolved"&&I!=="gapped"&&O!=="gapped",N=oi(n,t,"Procfile",65536);if(N.kind==="refused")m("Procfile",N);else if(N.kind==="ok"){let{entries:w,truncated:P,unnamedLines:j}=al(N.text);P&&i.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),j>0&&i.push({source:"Procfile",file:"Procfile",detail:`${String(j)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let F of w)vl(F.command,`Procfile:${F.name}`,"Procfile",c,i,E)==="used"&&(d=!0)}for(let w of["Dockerfile","docker-compose.yml","docker-compose.yaml","compose.yml"]){let P=oi(n,t,w,ol);if(P.kind==="refused"){m(w,P);continue}if(P.kind!=="ok")continue;let{commands:j,truncated:F}=il(P.text);F&&i.push({source:w,file:w,detail:`${w} declares more launch commands than cupel parses; the remainder was not read`});for(let B of j)vl(B.command,`${w}:${B.label}`,w,c,i,E)==="used"&&(d=!0)}let A=r.length===0,U=oi(n,t,"index.html",pw);if(U.kind==="ok")for(let w of gw(U.text)){if(w.src===null)continue;let P=Kn(w.src);if(!w.module){l.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${P}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(hw(w.src)){l.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${P}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}c(yw(w.src),"index.html",!1,w.src)==="unresolved"&&i.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${P}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else U.kind==="refused"&&l.push({kind:U.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${U.detail}`,root:""});let $=A?el(n,_):null;if($!==null){let w=0;for(let P of tl(n,$).roots)c(P,`framework:${$.name}`)==="added"&&(w+=1);w>0&&u.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${$.name}'s directory conventions (recognised via ${$.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let W=w=>w.map(P=>({...P,root:""}));return{entrypoints:r,sources:W(o),gaps:W(i),surfaceGaps:W(a),launchResolved:d,diagnostics:u,framework:$,observations:l}}function oi(e,n,t,s){let r;try{r=Gt(Tn.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let o=Hs(r,s);return o.kind==="ok"?o:o.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(o.bytes)} bytes, over the ${String(s)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function vl(e,n,t,s,r,o){let i=rl(e);if(i.kind==="delegates")return o?"used":(r.push({source:n,file:t,detail:`\`${Kn(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(i.kind==="foreign")return"foreign";if(i.kind==="unparsed")return r.push({source:n,file:t,detail:`\`${Kn(e)}\`: ${i.reason}`}),"gapped";let a=s(i.specifier,n,!0),l=i.alt===void 0?"unresolved":s(i.alt,n,!0);return a==="unresolved"&&l==="unresolved"?(r.push({source:n,file:t,detail:`\`${Kn(i.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function Qs(e,n){return e===""?n:`${e}/${n}`}function vp(e,n){let t=Gt(e),s=t.endsWith(Tn.sep)?t:t+Tn.sep,r=new Set,o=[],i=[],a=[],l=[],d=[],c=[],f=!1,p=null,u=[...n].sort((m,g)=>m.rel===""?-1:g.rel===""?1:m.rel<g.rel?-1:m.rel>g.rel?1:0);for(let m of u){let g=Qs(m.rel,"package.json"),y=m.rel===""?".":m.rel,b;try{b=Gt(m.abs)}catch{a.push({source:"root",file:g,detail:`root \`${y}\` could not be resolved; not seeded`,root:m.rel});continue}if(b!==t&&!b.startsWith(s)){a.push({source:"root",file:g,detail:`root \`${y}\` resolves outside the scan root; refused, not seeded`,root:m.rel});continue}let _;try{_=bw(b)}catch{a.push({source:"root",file:g,detail:`root \`${y}\` could not be read; not seeded`,root:m.rel});continue}for(let S of _.sources){let k=Qs(m.rel,S.entrypoint),v,I;try{v=Gt(Tn.resolve(t,k)),I=Gt(Tn.resolve(b,S.entrypoint))}catch{a.push({source:S.source,file:g,detail:`\`${S.specifier}\` re-based to \`${k}\` did not resolve; not seeded`,root:m.rel});continue}if(!v.startsWith(s)||v!==I){a.push({source:S.source,file:g,detail:`\`${S.specifier}\` re-based to \`${k}\` escapes the scan root or names another file; refused, not seeded`,root:m.rel});continue}r.has(k)||(r.add(k),o.push(k),i.push({...S,entrypoint:k,root:m.rel}))}_.launchResolved&&(f=!0);for(let S of _.gaps)a.push({...S,file:Qs(m.rel,S.file),root:m.rel});for(let S of _.surfaceGaps)l.push({...S,file:Qs(m.rel,S.file),root:m.rel});for(let S of _.diagnostics)d.push({...S,path:Qs(m.rel,S.path)});for(let S of _.observations)c.push({...S,file:Qs(m.rel,S.file),root:m.rel});m.rel===""&&(p=_.framework)}return{entrypoints:o,sources:i,gaps:a,surfaceGaps:l,launchResolved:f,diagnostics:d,framework:p,observations:c}}function Il(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let s=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${s}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Nl(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let s=[...new Set(t.slice(0,3).map(r=>r.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${s}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Ep(e,n){let t=Gt(e),s=t.endsWith(Tn.sep)?t:t+Tn.sep,r=new Set,o=[],i=[];for(let a of n){let l=wp(t,s,a,!0);if(l===null||l.length===0){i.push(a);continue}r.has(l)||(r.add(l),o.push(l))}return{entrypoints:o,rejected:i}}import{readdirSync as cm,readFileSync as Vl,realpathSync as Xl,statSync as no}from"node:fs";import ut from"node:path";function _w(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let s=t+2;for(;s<e.length&&e.charCodeAt(s)===32;)s+=1;let r=e.charCodeAt(s);return r===38||r===42}function at(e,n,t){let s=n.maxLines??2e6,r=n.maxLineBytes??16384,o=!1,i=!1,a=0,l=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let c=e.indexOf(`
+`,d),f=c===-1;f&&(c=e.length);let p=c>d&&e.charCodeAt(c-1)===13?c-1:c;if(l+=1,l>s){o=!0;break}if(p-d>r)a+=1;else{let u=d;for(;u<p&&e.charCodeAt(u)===32;)u+=1;let m=u-d,g=p;for(;g>u&&(e.charCodeAt(g-1)===32||e.charCodeAt(g-1)===9);)g-=1;if(u<g&&e.charCodeAt(u)!==35){let y=e.slice(u,g);if(_w(y)){i=!0;break}t(m,y)}}if(f)break;d=c+1}return{truncated:o||a>0,refusedAnchors:i,oversizeLines:a}}function wt(e){let n=e.charCodeAt(0);if(n===34||n===39){let s=e.indexOf(String.fromCharCode(n),1);if(s===-1)return null;let r=s+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,s+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function Yn(e){return e.endsWith(":")}function Le(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function ii(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,s=t.indexOf("/");if(n){if(s<=0||t.indexOf("/",s+1)!==-1)return!1}else if(s!==-1)return!1;let r=n?[t.slice(0,s),t.slice(s+1)]:[t];for(let o of r){if(o.length===0||o.charCodeAt(0)===46||o.charCodeAt(0)===95)return!1;for(let i=0;i<o.length;i+=1){let a=o.charCodeAt(i);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function Kr(e){return ii(e)?`node_modules/${e}`:""}function zr(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var ai=2e5,Ap=64,li=1024,Sw=5,xw=[1,2,3];function kw(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let s=e.slice(t+n.length);if(s==="")return null;let r=s.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function Ip(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let s=t.indexOf("@",1);if(s>0){let r=t.slice(0,s),o=t.slice(s+1);if(r.length>0&&o.length>0)return[{name:r,version:o}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function lt(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Np(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Rp(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Op(e,n,t,s,r=!1){let o=JSON.stringify([n,t,s]);if(!e.seen.has(o)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(o),e.deps.push({name:n,version:t,lockKey:s,dev:r})}}function ww(e,n){for(let[t,s]of Object.entries(e)){if(t==="")continue;if(!Rp(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),o=lt(s);if(o===null){n.unread+=1;continue}if(o.link===!0)continue;let i=o.name,a=typeof i=="string"&&i!==""?i:kw(t),l=o.version;if(a===null||typeof l!="string"){r&&(n.unread+=1);continue}let d=o.dev===!0||o.devOptional===!0;for(let c of Ip(a,l))Op(n,c.name,c.version,t,d)}}function Pp(e,n,t){let s=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let o=0;o<s.length;o+=1){let i=s[o];if(i===void 0)break;for(let[a,l]of Object.entries(i.deps)){if(!Rp(n))return{depthCapped:r};if(a===""){n.unread+=1;continue}let d=lt(l);if(d===null){n.unread+=1;continue}let c=i.pathSafe&&ii(a),f=c?`${i.prefix}node_modules/${a}`:"",p=c&&f.length<=li,u=p?f:"",m=d.version,g=d.dev===!0||i.dev;if(d.link!==!0&&typeof m=="string"&&m!=="")for(let b of Ip(a,m))Op(n,b.name,b.version,u,g);else n.unread+=1;let y=lt(d.dependencies);if(y!==null){if(i.depth+1>t){r=!0;continue}s.push({deps:y,prefix:p?`${u}/`:i.prefix,depth:i.depth+1,pathSafe:p,dev:g})}}}return{depthCapped:r}}function vw(e,n,t){let s=Np(n.maxEntries),{depthCapped:r}=Pp(e,s,t),o=[],i=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),a=new Set,l=[];for(let d of s.deps){if(d.version.includes(":"))continue;let c=JSON.stringify([d.name,d.version]);i.has(c)||a.has(c)||(a.add(c),l.length<Sw&&l.push(zr(d.name,d.version)))}if(a.size>0){let d=a.size-l.length;o.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${l.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(s.capped||r)&&o.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),o}function di(e,n={}){let t=[],s;try{s=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=lt(s);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let o=r.lockfileVersion,i=typeof o=="number"&&Number.isInteger(o)?o:null,a=typeof o=="number"?String(o):"?",l=lt(r.packages),d=lt(r.dependencies);if(l===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(i===null||!xw.includes(i))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let c=n.maxDepth??Ap,f=Np(n.maxEntries??ai),p=!1;return l!==null?(ww(l,f),d!==null&&t.push(...vw(d,f,c))):d!==null&&(p=Pp(d,f,c).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),p&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(c)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||p}}var Ew=["workspace:","link:","portal:","file:","exec:"];function Aw(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Rl(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let s=n.slice(0,t),r=n.slice(t+1);if(s.length===0)return[];for(let a of Ew)if(r.startsWith(a))return[];if(!r.startsWith("npm:"))return[s];let o=r.slice(4),i=o.indexOf("@",1);if(i>0){let a=o.slice(0,i);return a.length>0?[a]:[s]}return o.length===0||Aw(o)?[s]:[s,o]}function Iw(e){if(Yn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let s=e.charCodeAt(t);if(s===34||s===39){n===0?n=s:n===s&&(n=0);continue}if(n===0&&s===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Nw(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let s of n.split(",")){let r=s.trim();r.length>0&&t.push(r)}return t}function Rw(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let s=t.length;for(;s<n.length&&s<t.length+3;){let o=n.charCodeAt(s);if(o<48||o>57)break;s+=1}let r=n.slice(t.length,s);return r.length>0?r:null}function Cp(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Le(e.slice(8).trim());return t.length>0?t:null}function Ol(e,n={}){let t=[],s=[],r=new Set,o=n.maxEntries??2e5,i=!1,a=null,l=!1,d=[],c=!1,f=-1,p=!1,u=0,m=()=>{d.length>0&&!c&&(u+=1)},g=at(e,n,(S,k)=>{if(S===0){m(),d=[],c=!1,f=-1,l=!1;let I=Iw(k);if(I===null)return;let O=Le(I.trim());if(O==="__metadata"){i=!0,l=Yn(k);return}for(let E of Nw(O))d.push(...Rl(E));return}if(l){if(S===2&&a===null){let I=Cp(k);I!==null&&(a=I)}return}if(d.length===0||(f===-1&&(f=S),S!==f||c))return;let v=Cp(k);if(v!==null){c=!0;for(let I of d){let O=JSON.stringify([I,v]);if(!r.has(O)){if(s.length>=o){p=!0;return}r.add(O),s.push({name:I,version:v,lockKey:Kr(I),dev:!1})}}}});m();let y=i?"yarn.lock (Berry)":"yarn.lock (v1)";if(g.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};g.oversizeLines>0&&t.push(`${y} has ${String(g.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),p&&t.push(`${y} exceeds ${String(o)} entries; truncated`);let b=a??Rw(e),_=b===null?null:Number(b.split(".")[0]);return b!==null&&(_===null||!Number.isInteger(_)||_<1||_>8)&&t.push(`${y} declares unsupported lockfileVersion ${b} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),u>0&&t.push(`${y} has ${String(u)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:s,diagnostics:t,truncated:g.truncated||p}}function Pl(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.indexOf("_");return s!==-1&&(n=n.slice(0,s)),n.trim()}function Cl(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function ui(e){let n=Le(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.charCodeAt(0)===47;if(s&&(n=n.slice(1)),n.length===0)return null;if(!s&&n.charCodeAt(0)!==64){let c=n.indexOf("/"),f=n.indexOf("@",1);c>0&&(f===-1||c<f)&&n.slice(0,c).includes(".")&&n.indexOf("/",c+1)!==-1&&(n=n.slice(c+1))}let r=n.charCodeAt(0)===64,o=r?n.indexOf("/"):-1;if(r&&o<=0)return null;let i=r?o+1:0,a=-1;for(let c=i;c<n.length;c+=1){let f=n.charCodeAt(c);if(f===47||f===64){a=c;break}}if(a<=i)return null;let l=n.slice(0,a),d=Pl(n.slice(a+1));return Cl(d)?{name:l,version:d}:null}var Ow=new Set(["packages","snapshots","importers"]),Pw=new Set([5,6,7,8,9]);function Cw(e){let n=Le(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function ci(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Le(e.slice(0,n).trim()),value:Le(t)}}function Ml(e,n={}){let t=[],s=[],r=new Set,o=n.maxEntries??2e5,i="",a=null,l=!1,d=0,c=[],f=(u,m)=>{let g=JSON.stringify([u,m]);if(!r.has(g)){if(s.length>=o){l=!0;return}r.add(g),s.push({name:u,version:m,lockKey:Kr(u),dev:!1})}},p=at(e,n,(u,m)=>{if(u===0){let g=wt(m);if(i=g===null?"":Le(g.trim()),a=null,i==="lockfileVersion"){let y=ci(m),b=y===null?null:Cw(y.value);y!==null&&(b===null||!Pw.has(b))&&c.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),i="";return}if(Ow.has(i)&&!Yn(m)){let y=ci(m)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(d+=1),i=""}return}if(i==="packages"||i==="snapshots"){if(u!==2)return;let g=wt(m),y=g===null?null:ui(g);if(y===null){d+=1;return}f(y.name,y.version);return}if(i==="importers"){if(u===6){let g=ci(m);if(g===null){a=m.endsWith(":")?Le(m.slice(0,-1).trim()):null;return}a=null;let y=Pl(g.value);Cl(y)&&f(g.key,y);return}if(u===8&&a!==null){let g=ci(m);if(g===null||g.key!=="version")return;let y=Pl(g.value);Cl(y)&&f(a,y)}}});return p.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...c),p.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(p.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),l&&t.push(`pnpm-lock.yaml exceeds ${String(o)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:s,diagnostics:t,truncated:p.truncated||l})}function vt(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var $p=1e6,Mp=2e5,Mw=4096,Tw=65536,$w=262144,Wr=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Lp(e){let n=[];for(let t of e.split(/\r?\n/u)){if(t==="")break;let s=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(t);s!==null&&n.push([(s[1]??"").toLowerCase(),s[2]??""])}return n}function Dp(e){if(e.length>$p)return null;let n,t;for(let[s,r]of Lp(e))s==="name"&&n===void 0?n=r.trim():s==="version"&&t===void 0&&(t=r.trim());return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}var Lw=/^([A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)/u;function Fp(e){if(e.length>$p)return[];let n=new Set;for(let[t,s]of Lp(e)){if(t!=="requires-dist")continue;let r=Lw.exec(s.trim())?.[1];r!==void 0&&n.add(vt(r))}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function jp(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&Wr.test(n))}function Bp(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let s=e[t];if(s==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=s}return n}function Gp(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Kp(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function zp(e){let n=e.split(/\r?\n/u);return n.length>Mp?n.slice(0,Mp):n}function Wp(e){let n=new Set;for(let t of zp(e)){if(t==="")continue;let s=Bp(t).split("/"),r=s[0]??"";if(Gp(r))continue;if(s.length>1){Wr.test(r)&&n.add(r);continue}let o=Kp(r);o!==null&&Wr.test(o)&&n.add(o)}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function Dw(e){let n=e.split("/"),t=n[0]??"";if(Gp(t))return null;let s=n[n.length-1]??"",r=Kp(s);if(r===null)return null;let o=n.slice(0,-1);if(o.some(a=>!Wr.test(a)||a==="__pycache__"))return null;let i=r==="__init__"?o:[...o,r];return i.length===0||!Wr.test(r==="__init__"?o[o.length-1]??"":r)?null:i}function Up(e,n=Mw){let t=new Set,s=0,r=0,o=!1;for(let i of zp(e)){if(i==="")continue;let a=Bp(i),l=Dw(a);if(l!==null){s+=1,(a.endsWith(".so")||a.endsWith(".pyd"))&&(r+=1);for(let d=1;d<=Math.min(2,l.length);d+=1){let c=l.slice(0,d).join(".");if(!t.has(c)){if(t.size>=n){o=!0;break}t.add(c)}}}}return{prefixes:[...t].sort((i,a)=>i<a?-1:i>a?1:0),moduleFiles:s,extensionModules:r,capped:o}}function Fw(e){if(e.length>$w)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let s=t.trim();if(!(s===""||s.startsWith("#")||s.startsWith(";"))){if(s.startsWith("[")){let r=s.slice(1,s.endsWith("]")?-1:void 0).trim();n=r==="console_scripts"||r==="gui_scripts";continue}if(n&&s.includes("="))return!0}}return!1}function Hp(e){if(e.length>Tw)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,s=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:s?.editable===!0}}function Ur(e,n){let t=Dp(e);if(t===null)return null;let s=n.topLevelText!==void 0?jp(n.topLevelText):[],r=s.length>0?s:n.recordText!==void 0?Wp(n.recordText):[],o=n.recordText!==void 0?Up(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},i=n.entryPointsText!==void 0?Fw(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",a=n.directUrlText!==void 0?Hp(n.directUrlText)?.editable??!1:!1;return{name:vt(t.name),version:t.version,importNames:r,modulePrefixes:o.prefixes,moduleFiles:o.moduleFiles,editable:a,consoleScripts:i,extensionModules:o.extensionModules,recordKnown:n.recordText!==void 0,requiresDist:Fp(e)}}function Tp(e,n,t){let s=e.get(n);s===void 0?e.set(n,[t]):s.includes(t)||s.push(t)}function fi(e){let n=new Map,t=new Map,s=[];for(let r of e){if(r.importNames.length===0){s.push(r);continue}for(let o of r.importNames)Tp(n,o,r);for(let o of r.modulePrefixes)Tp(t,o,r)}return{byImportName:n,byModulePrefix:t,unmapped:s}}function Hr(e,n){let t=n.split(".").filter(r=>r.length>0),s=t[0];if(s===void 0)return[];for(let r=Math.min(2,t.length);r>=1;r-=1){let o=e.byModulePrefix.get(t.slice(0,r).join("."));if(o!==void 0&&o.length>0)return o}return e.byImportName.get(s)??[]}var qr=class{nodes=new Map;children=new Map;importers=new Map;over=!1;node(n,t,s){if(!this.nodes.has(n)){if(this.nodes.size>=2e5){this.over=!0;return}this.nodes.set(n,{name:t,version:s})}}edge(n,t){let s=this.children.get(n);s===void 0?this.children.set(n,[t]):s.includes(t)||s.push(t)}done(){return this.over||this.importers.size===0?null:{nodes:this.nodes,children:this.children,importers:this.importers}}},as="importer:",As="node_modules/";function $l(e){let n;try{n=JSON.parse(e)}catch{return null}let t=lt(lt(n)?.packages);if(t===null)return null;let s=new qr,r=new Map;for(let[d,c]of Object.entries(t)){let f=lt(c);f!==null&&r.set(d,f)}let o=d=>d.startsWith(As)||d.includes(`/${As}`),i=d=>{let c=d;for(let f=0;f<8;f+=1){let p=r.get(c);if(p===void 0)return null;if(p.link!==!0)return c;let u=p.resolved;if(typeof u!="string")return null;c=u}return null},a=d=>o(d)?d:`${as}${d}`,l=(d,c)=>{let f=d;for(;;){let p=f===""?`${As}${c}`:`${f}/${As}${c}`;if(r.has(p))return i(p);if(f==="")return null;let u=f.lastIndexOf(`/${As}`);f=u===-1?"":f.slice(0,u)}};for(let[d,c]of r){if(c.link===!0)continue;let f=o(d);if(f){let u=typeof c.name=="string"&&c.name!==""?c.name:d.slice(d.lastIndexOf(As)+As.length),m=c.version;if(typeof m!="string")continue;s.node(d,u,m)}else s.importers.set(`${as}${d}`,d===""?"package.json":`${d}/package.json`);let p=f?["dependencies","optionalDependencies","peerDependencies"]:["dependencies","devDependencies","optionalDependencies","peerDependencies"];for(let u of p){let m=lt(c[u]);if(m!==null)for(let g of Object.keys(m)){let y=l(d,g);y!==null&&y!==d&&s.edge(a(d),a(y))}}}return s.done()}function pi(e){let n=wt(e);if(n===null)return null;let t=e.slice(n.length+1).trim();return t.length===0?null:{key:Le(n.trim()),value:Le(t)}}var Tl=new Set(["dependencies","optionalDependencies","devDependencies"]);function Ll(e,n={}){let t=new qr,s=[],r="",o=!1,i=null,a="",l=null,d=p=>p==="."||p===""?"package.json":`${p}/package.json`,c=(p,u,m,g)=>{if(m===u){let y=pi(g);l=y===null&&Yn(g)?Le(g.slice(0,-1).trim()):null,y!==null&&s.push({from:p,name:y.key,token:y.value});return}if(m===u+2&&l!==null){let y=pi(g);y?.key==="version"&&s.push({from:p,name:l,token:y.value})}},f=at(e,n,(p,u)=>{if(p===0){let m=wt(u);r=m===null?"":Le(m.trim()),r==="lockfileVersion"&&(o=(pi(u)?.value??"").startsWith("5")),i=null,Tl.has(r)&&Yn(u)&&(i=`${as}.`,t.importers.set(i,"package.json"),a=r,l=null);return}if(Tl.has(r)){i!==null&&c(i,2,p,u);return}if(r==="importers"){if(p===2){let m=wt(u),g=m===null?".":Le(m.trim());i=`${as}${g}`,t.importers.set(i,d(g)),a="";return}if(i===null)return;if(p===4){a=Yn(u)?Le(u.slice(0,-1).trim()):"",l=null;return}Tl.has(a)&&c(i,6,p,u);return}if(!(r!=="packages"&&r!=="snapshots")){if(p===2){let m=wt(u);if(m===null){i=null;return}let g=Le(m.trim()),y=g.startsWith("/")?g.slice(1):g,b=ui(g);i=b===null?null:y,b!==null&&t.node(y,b.name,b.version),a="";return}if(i!==null){if(p===4){a=Yn(u)?Le(u.slice(0,-1).trim()):"";return}if(p===6&&(a==="dependencies"||a==="optionalDependencies")){let m=pi(u);m!==null&&s.push({from:i,name:m.key,token:m.value})}}}});if(f.refusedAnchors||f.truncated)return null;for(let p of s){if(p.token.startsWith("link:"))continue;let m=(p.token.startsWith("/")?p.token.slice(1):null)??(o?`${p.name}/${p.token}`:`${p.name}@${p.token}`);t.nodes.has(m)&&t.edge(p.from,m)}return t.done()}function jw(e,n){let t=e.indexOf("@npm:",1);return t<=0?null:e.slice(t+5)===n?e.slice(0,t):null}function Dl(e,n,t={}){let s=new qr,r=new Map,o=[],i=null,a=-1,l=!1,d=-1,c=[],f=null,p=null,u=0,m=at(e,t,(g,y)=>{if(g===0){l=!1,a=-1,f=null,p=null;let k=Yn(y)?y.slice(0,-1):null;if(i=null,c=[],k===null)return;let v=Le(k.trim());if(v==="__metadata"||(c=v.split(",").map(O=>Le(O.trim())).filter(O=>O.length>0),c.length===0))return;u+=1,i=`y${String(u)}`;for(let O of c)r.set(O,i);let I=c.find(O=>O.includes("@workspace:"));if(I!==void 0){let O=I.slice(I.indexOf("@workspace:")+11),E=`${as}${O}`;s.importers.set(E,O==="."||O===""?"package.json":`${O}/package.json`),i=E;for(let N of c)r.set(N,E)}return}if(i===null)return;if(a===-1&&(a=g),g===a){if(l=!1,y==="dependencies:"||y==="optionalDependencies:"){l=!0,d=-1;return}if(y.startsWith("version ")||y.startsWith("version:"))f=Le(y.slice(8).trim());else if(y.startsWith("resolution:"))p=Le(y.slice(11).trim());else return;let k=c[0];if(f!==null&&k!==void 0&&!i.startsWith(as)){let v=Rl(k);if(v.length===1&&v[0]!==void 0)s.node(i,v[0],f);else if(p!==null){let I=jw(p,f);I!==null&&s.node(i,I,f)}}return}if(!l||g<=a||(d===-1&&(d=g),g!==d))return;let b=wt(y),_,S;if(b!==null&&y.charCodeAt(b.length)===58)_=Le(b.trim()),S=Le(y.slice(b.length+1).trim());else{let k=y.indexOf(" ");if(k<=0)return;_=Le(y.slice(0,k)),S=Le(y.slice(k+1).trim())}_.length>0&&S.length>0&&o.push({from:i,descriptor:`${_}@${S}`})});if(m.refusedAnchors||m.truncated)return null;if(s.importers.size===0){s.importers.set(`${as}.`,"package.json");for(let[g,y]of n)o.push({from:`${as}.`,descriptor:`${g}@${y}`})}for(let g of o){let y=g.descriptor.indexOf("@",1),b=g.descriptor.slice(y+1),_=b.includes(":")?g.descriptor:`${g.descriptor.slice(0,y)}@npm:${b}`,S=r.get(g.descriptor)??r.get(_);S!==void 0&&S!==g.from&&s.edge(g.from,S)}return s.done()}function Fl(e,n,t,s){let r=new Map;for(let[k,v]of e.children)for(let I of v){let O=r.get(I);O===void 0?r.set(I,[k]):O.push(k)}let o=new Set,i=[...e.importers.keys()];for(let k=0;k<i.length;k+=1)for(let v of e.children.get(i[k])??[])o.has(v)||e.importers.has(v)||(o.add(v),i.push(v));let a=[...e.nodes].filter(([k,v])=>v.name===n&&v.version===t&&o.has(k)).map(([k])=>k).sort();if(a.length===0)return null;let l=new Map(a.map(k=>[k,0])),d=[...a];for(let k=0;k<d.length;k+=1){let v=d[k];for(let I of r.get(v)??[])l.has(I)||!o.has(I)||(l.set(I,(l.get(v)??0)+1),d.push(I))}let c=[...l.keys()].sort((k,v)=>(l.get(k)??0)-(l.get(v)??0)||(k<v?-1:k>v?1:0)),f=c.filter(k=>e.nodes.has(k)),p=c.length-f.length,u=new Map(f.map((k,v)=>[k,v])),m=[];for(let k of f)for(let v of e.children.get(k)??[])u.has(v)&&m.push([k,v]);let g=new Array(f.length).fill(0);for(let[k,v]of m){let I=Math.max(u.get(k)??0,u.get(v)??0);g[I]=(g[I]??0)+1}let y=0,b=0;for(;y<f.length&&y<s.maxNodes;){let k=g[y]??0;if(b+k>s.maxEdges)break;b+=k,y+=1}let _=new Map(f.slice(0,y).map((k,v)=>[k,`p${String(v)}`])),S=k=>{let I=(r.get(k)??[]).filter(O=>e.importers.has(O)).sort()[0];return I===void 0?null:e.importers.get(I)??null};return{nodes:f.slice(0,y).map(k=>{let v=e.nodes.get(k);return{id:_.get(k),name:v.name,version:v.version,directFrom:S(k)}}),edges:m.flatMap(([k,v])=>{let I=_.get(k),O=_.get(v);return I===void 0||O===void 0?[]:[{from:I,to:O}]}),truncated:f.length-y+p}}function jl(e){let n=new Map,t=new Set(["dependencies","devDependencies","optionalDependencies","peerDependencies"]),s=[],r=1,o=!1,i=e.charCodeAt(0)===65279?1:0;for(;i<e.length;){let a=e.charCodeAt(i);if(a===10)r+=1;else if(a===123||a===91){if(s.length>=64)return null;s.push({kind:a===123?"{":"[",key:null}),o=a===123}else if(a===125||a===93)s.pop(),o=!1;else if(a===44)o=s.at(-1)?.kind==="{";else if(a===58)o=!1;else if(a===34){let l=r,d=i+1;for(;d<e.length&&e.charCodeAt(d)!==34;){if(e.charCodeAt(d)===92)d+=1;else if(e.charCodeAt(d)===10)return null;d+=1}if(d>=e.length)return null;let c=s.at(-1);if(o&&c?.kind==="{"){let f;try{f=JSON.parse(e.slice(i,d+1))}catch{return null}c.key=f;let p=s.length===2?s[0]?.key:null;p!=null&&t.has(p)&&!n.has(f)&&n.set(f,l)}o=!1,i=d}i+=1}return s.length===0?n:null}var Bl="importer:";function mi(e){let n=e.indexOf(" = ");if(n<=0)return null;let t=e.slice(n+3).trim();if(t.length<2||!t.startsWith('"')||!t.endsWith('"'))return null;let s=t.slice(1,-1);return s.includes('"')?null:{key:e.slice(0,n).trim(),value:s}}function Bw(e){let n=[],t=0;for(;;){let s=e.indexOf('"',t);if(s===-1)return n;let r=e.indexOf('"',s+1);if(r===-1)return n;n.push(e.slice(s+1,r)),t=r+1}}function Gw(e){let n=[],t=0;for(;;){let s=e.indexOf("{",t);if(s===-1)return n;let r=e.indexOf("}",s);if(r===-1)return n;let o=e.slice(s+1,r),i=[],a=o.indexOf("extra = [");if(a!==-1){let c=o.indexOf("]",a);c!==-1&&(i=Bw(o.slice(a,c)),o=o.slice(0,a)+o.slice(c+1))}let l=null,d=null;for(let c of o.split(",")){let f=mi(c.trim());f?.key==="name"?l=f.value:f?.key==="version"&&(d=f.value)}l!==null&&n.push({name:l,version:d,extras:i}),t=r+1}}function qp(e,n,t,s,r=new Map){if(s||n.size===0)return null;let o=new Map;for(let[d,c]of e){let f=o.get(c.name);f===void 0?o.set(c.name,[d]):f.push(d)}let i=new Map,a=[...t],l=new Set;for(let d=0;d<a.length;d+=1){let c=a[d],f=vt(c.name),p=o.get(f)??[],u=c.version!==null?`${f}@${c.version}`:p.length===1?p[0]??null:null;if(u===null||!e.has(u)||u===c.from)continue;let m=i.get(c.from);m===void 0?i.set(c.from,[u]):m.includes(u)||m.push(u);for(let g of c.extras){let y=JSON.stringify([u,g]);if(!l.has(y)){l.add(y);for(let b of r.get(u)?.get(g)??[])a.push({from:u,...b})}}}return{nodes:e,children:i,importers:n}}function Kl(e,n={}){let t=new Map,s=new Map,r=[],o=!1,i=null,a=null,l=null,d=[],c=new Map,f=new Map,p="",u=!1,m="",g=null,y=S=>{let k=Gw(S);g===null?d.push(...k):c.set(g,[...c.get(g)??[],...k])},b=()=>{if(i===null)return;let S=vt(i),k=null;if(l!==null?(k=`${Bl}${l}`,s.set(k,l==="."?"pyproject.toml":`${l}/pyproject.toml`)):a!==null&&(k=`${S}@${a}`,t.size>=2e5?o=!0:t.set(k,{name:S,version:a})),k!==null){for(let v of d)r.push({from:k,...v});c.size>0&&f.set(k,c)}i=null,a=null,l=null,d=[],c=new Map},_=at(e,n,(S,k)=>{if(u){m+=k,k.startsWith("]")&&(y(m),u=!1);return}if(k==="[[package]]"){b(),p="package";return}if(k.startsWith("[")){p=k==="[package.dev-dependencies]"?"dev":k==="[package.optional-dependencies]"?"optional":"other";return}if(p==="other")return;let v=k.indexOf(" = ");if(v<=0)return;let I=k.slice(0,v).trim(),O=k.slice(v+3).trim();if((p==="optional"||(p==="dev"?l!==null:I==="dependencies"))&&O.startsWith("[")){g=p==="optional"?I.replaceAll('"',""):null,O.endsWith("]")?y(O):(u=!0,m=O);return}if(p!=="package")return;if(I==="source"){let A=O.startsWith("{")&&O.endsWith("}")?O.slice(1,-1):"";for(let U of A.split(",")){let $=mi(U.trim());($?.key==="editable"||$?.key==="virtual")&&(l=$.value)}return}let N=mi(k);N?.key==="name"?i=N.value:N?.key==="version"&&(a=N.value)});return b(),_.refusedAnchors||_.truncated?null:qp(t,s,r,o,f)}function zl(e,n,t={}){let s=new Map,r=new Map([[`${Bl}.`,"pyproject.toml"]]),o=n.map(u=>({from:`${Bl}.`,name:u,version:null,extras:[]})),i=!1,a=null,l=null,d=[],c="",f=()=>{if(a!==null&&l!==null){let u=vt(a),m=`${u}@${l}`;s.size>=2e5?i=!0:s.set(m,{name:u,version:l});for(let g of d)o.push({from:m,name:g,version:null,extras:[]})}a=null,l=null,d=[]},p=at(e,t,(u,m)=>{if(m==="[[package]]"){f(),c="package";return}if(m.startsWith("[")){c=m==="[package.dependencies]"?"deps":"other";return}if(c==="package"){let b=mi(m);b?.key==="name"?a=b.value:b?.key==="version"&&(l=b.value);return}if(c!=="deps")return;let g=m.indexOf(" = ");g<=0||m.slice(g+3).includes("optional = true")||d.push(m.slice(0,g).trim().replaceAll('"',""))});return f(),p.refusedAnchors||p.truncated?null:qp(s,r,o,i)}function Gl(e){let n=0;for(;n<e.length;){let t=e.charCodeAt(n);if(!(t>=97&&t<=122||t>=65&&t<=90||t>=48&&t<=57||t===45||t===46||t===95))break;n+=1}return n===0?null:vt(e.slice(0,n))}function Kw(e){return e==="tool.poetry.dependencies"||e==="tool.poetry.dev-dependencies"||e.startsWith("tool.poetry.group.")&&e.endsWith(".dependencies")}function gi(e){let n=new Map,t="",s=!1,r=0,o=d=>{d!==null&&d!=="python"&&!n.has(d)&&n.set(d,r)},i=d=>{let c=0;for(;;){let f=d.indexOf('"',c);if(f===-1)return;let p=d.indexOf('"',f+1);if(p===-1)return;o(Gl(d.slice(f+1,p))),c=p+1}},a=(d,c)=>d==="project"&&c==="dependencies"||d==="project.optional-dependencies"||d==="dependency-groups"||d==="tool.uv"&&c==="dev-dependencies",l=e.charCodeAt(0)===65279?1:0;for(;l<=e.length&&r<2e5;){let d=e.indexOf(`
+`,l);d===-1&&(d=e.length),r+=1;let c=e.slice(l,d);l=d+1;let f=c.indexOf("#"),p=(f===-1?c:c.slice(0,f)).trim();if(p.length>4096)continue;if(s){i(p),p.includes("]")&&(s=!1);continue}if(p.startsWith("[")&&!p.startsWith("[[")){t=p.slice(1,p.indexOf("]")===-1?p.length:p.indexOf("]")).trim();continue}let u=p.indexOf("=");if(u<=0)continue;let m=p.slice(0,u).trim().replaceAll('"',""),g=p.slice(u+1).trim();if(Kw(t)){o(Gl(m));continue}if(a(t,m)&&g.startsWith("[")&&(i(g),s=!g.includes("]")),d===e.length)break}return n}function Wl(e){let n=new Map,t=0,s=0;for(;s<=e.length&&t<2e5;){let r=e.indexOf(`
+`,s);r===-1&&(r=e.length),t+=1;let o=e.slice(s,r);s=r+1;let i=o.trim();if(i.length>0&&i.length<=4096&&!i.startsWith("#")&&!i.startsWith("-")){let a=Gl(i);a!==null&&!n.has(a)&&n.set(a,t)}if(r===e.length)break}return n}import{statSync as mv}from"node:fs";import gv from"node:path";import{lstatSync as Uw,readFileSync as Hw,readdirSync as qw,realpathSync as Ul,statSync as Yr}from"node:fs";import Be from"node:path";function zw(e,n){let t=e.charAt(n),s="",r=n+1;for(;r<e.length;){let o=e.charAt(r);if(o===t)return{value:s,end:r+1};if(t==='"'&&o==="\\"){let i=e.charAt(r+1);if(i!=="\\"&&i!=='"')return null;s+=i,r+=2;continue}s+=o,r+=1}return null}function Ww(e){let n=[],t=0;for(;t<e.length;){let s=e.charAt(t);if(s===" "||s==="	"||s==="\r"||s==="\f"||s==="\v"){t+=1;continue}if(s==="/"&&e.charAt(t+1)==="/")break;if(s==="("||s===")"){n.push({kind:s}),t+=1;continue}if(s==='"'||s==="`"){let i=zw(e,t);if(i===null||i.value.length>4096)return null;n.push({kind:"quoted",text:i.value}),t=i.end;continue}let r=t;for(;r<e.length;){let i=e.charAt(r);if(i===" "||i==="	"||i==="\r"||i==="("||i===")"||i==='"'||i==="`"||i==="/"&&e.charAt(r+1)==="/")break;r+=1}let o=e.slice(t,r);if(o.length>4096)return null;n.push({kind:"word",text:o}),t=r}return n}function Vp(e){return e.kind==="word"||e.kind==="quoted"?e.text:null}function Zs(e){let n=[],t=null;for(let s of e.split(`
+`)){if(n.length>=1e5)break;let r=Ww(s);if(r===null||r.length===0)continue;if(t!==null){if(r[0]?.kind===")"){t=null;continue}let l=r.map(Vp);if(l.some(d=>d===null)||l.length>16)continue;n.push({verb:t,args:l});continue}let o=r[0];if(o?.kind!=="word")continue;let i=o.text;if(r.length===2&&r[1]?.kind==="("){t=i;continue}let a=r.slice(1).map(Vp);a.some(l=>l===null)||a.length>16||n.push({verb:i,args:a})}return n}function Vr(e,n){for(let t of e)if(t.verb===n&&t.args.length>0)return t.args[0]??null;return null}function Xr(e){let n=[],t=[];for(let s of e){if(s.verb!=="use")continue;let r=s.args[0];if(r===void 0||r.length===0||r.includes("\0"))continue;let o=r.replace(/\\/gu,"/");if(o.startsWith("/")||/^[A-Za-z]:\//u.test(o)){t.push(r);continue}let i=[],a=!1;for(let l of o.split("/"))if(!(l===""||l===".")){if(l===".."){if(i.length===0){a=!0;break}i.pop();continue}i.push(l)}a?t.push(r):n.push(i.join("/"))}return{inside:n,outside:t}}function Jr(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}function Qr(e){return e.ecosystem==="Go"||e.alsoGo===!0}var Qp=2e4,Zp=32,em=256,Vw=2*1024*1024,Xw=256*1024,nm=256,Yw=16,Jw=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],Qw=["pyproject.toml","setup.py","setup.cfg"],Zw=["requirements.txt","Pipfile"],ev=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],tm=["go.sum","vendor/modules.txt"],nv=256*1024;function tv(e){return e===""?!1:e.split("/").some(n=>n==="vendor"||n==="testdata"||n.startsWith("_"))}var Xp={candidate:"absent",witnesses:[],admitted:!1};function sv(e){let n=Hl(Be.join(e,"go.work"),nv);return n===null?new Set:new Set(Xr(Zs(n)).inside)}var sm={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function Hl(e,n){try{let t=Yr(e);return!t.isFile()||t.size>n?null:Hw(e,"utf8")}catch{return null}}function dt(e){let n;try{n=Yr(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function rv(e){try{return Yr(e).isDirectory()}catch{return!1}}function ov(e,n){let t=0,s=0,r=-1,o=0;for(;s<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(s)))t+=1,s+=1;else if(t<e.length&&e.charAt(t)==="*")r=t,o=s,t+=1;else if(r>=0)t=r+1,o+=1,s=o;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function iv(e,n){let t=(s,r)=>{if(s===e.length)return r===n.length;let o=e[s]??"";if(o==="**"){for(let a=r;a<=n.length;a+=1)if(t(s+1,a))return!0;return!1}if(r>=n.length)return!1;let i=n[r]??"";return(o.includes("*")||o.includes("?")?ov(o,i):o===i)?t(s+1,r+1):!1};return t(0,0)}function av(e){let n=[],t=Hl(Be.join(e,"package.json"),Vw);if(t!==null)try{let i=JSON.parse(t)?.workspaces;if(Array.isArray(i))for(let a of i)typeof a=="string"&&n.push(a);else if(typeof i=="object"&&i!==null){let a=i.packages;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l)}}catch{}let s=Hl(Be.join(e,"pnpm-workspace.yaml"),Xw);s!==null&&n.push(...lv(s));let r=[];for(let o of n){if(r.length>=nm)break;let i=o.trim();if(i.length===0)continue;for(;i.startsWith("./");)i=i.slice(2);if(i.startsWith("/")||Be.isAbsolute(i))continue;let a=i.split("/").filter(l=>l.length>0);a.length===0||a.length>Yw||a.includes("..")||r.push(a.join("/"))}return r}function lv(e){let n=[],t=!1;for(let s of e.split(`
+`)){if(n.length>=nm)break;if(/^packages:\s*(#.*)?$/.test(s)){t=!0;continue}if(!t)continue;let r=/^\s+-\s*(.*?)\s*$/.exec(s);if(r===null){s.trim().length>0&&(t=!1);continue}let o=(r[1]??"").trim(),i=o.indexOf(" #");i>=0&&(o=o.slice(0,i).trim()),(o.startsWith('"')&&o.endsWith('"')&&o.length>=2||o.startsWith("'")&&o.endsWith("'")&&o.length>=2)&&(o=o.slice(1,-1)),o.length>0&&n.push(o)}return n}function Yp(e,n){let t=Be.relative(n,e);return t.length===0?!1:t.split(Be.sep).includes("node_modules")}function Jp(e,n){return Be.relative(e,n).split(Be.sep).join("/")}function Zr(e,n){let t=n?.maxDirs??Qp,s=n?.maxDepth??Zp,r=n?.maxRoots??em,o=n?.discoverPythonRoots??!0,i=n?.discoverGoRoots??!1,a;try{a=Ul(e)}catch{return{...sm,observations:[{kind:"refused-unreadable",rel:""}]}}let l=[],d=[],c=new Set([a]),f=0,p=0,u=0,m="complete",g=av(a).map(N=>N.split("/")),y=i?sv(a):new Set,b=new Set,_=new Set,S=N=>{let A="absent";for(let $ of Qw){let W=dt(Be.join(N,$));if(W==="regular"){A="declared";break}W==="refused"&&(A="refused")}if(A==="absent"&&Zw.some($=>dt(Be.join(N,$))==="regular")&&(A="listed"),A==="absent")return{candidate:A,witnesses:[]};let U=[];return ev.some($=>dt(Be.join(N,$))==="regular")&&U.push("own-lockfile"),rv(Be.join(N,".venv"))&&U.push("installed-env"),{candidate:A,witnesses:U}},k=(N,A)=>{if(!i||tv(A))return Xp;let U=dt(Be.join(N,"go.mod"));if(U==="absent")return Xp;let $=U==="regular"?"declared":"refused",W=[];tm.some(P=>dt(Be.join(N,P))==="regular")&&W.push("own-lockfile"),y.has(A)&&W.push("workspace-declared");let w=A===""||$==="refused"||W.length>0;return{candidate:$,witnesses:W,admitted:w}},v=(N,A,U)=>U.admitted?l.length>=r?"exhausted":(l.push({rel:A,abs:N,witnesses:U.witnesses,manifestRefused:U.candidate==="refused",ecosystem:"Go"}),b.add(N),_.add(N),"root"):"not-root",I=(N,A,U)=>{let $=S(N);return $.candidate==="absent"?"not-root":($.candidate!=="listed"&&(p+=1),$.witnesses.length===0&&$.candidate!=="refused"?$.candidate==="declared"?(d.push({kind:"undeclared-manifest",rel:A}),"observed"):"not-root":l.length>=r?"exhausted":(l.push({rel:A,abs:N,witnesses:$.witnesses,manifestRefused:$.candidate==="refused",ecosystem:"PyPI",...U.admitted?{alsoGo:!0}:{}}),U.admitted&&b.add(N),"root"))},O=(N,A)=>{if(A.length===0){let j=dt(Be.join(N,"package.json"))!=="absent",F=o?S(N):{candidate:"absent",witnesses:[]},B=k(N,A);return B.admitted&&b.add(N),!j&&F.candidate!=="absent"?(l.push({rel:"",abs:N,witnesses:["scan-root",...F.witnesses],manifestRefused:!1,ecosystem:"PyPI",...B.admitted?{alsoGo:!0}:{}}),"root"):!j&&B.admitted?(l.push({rel:"",abs:N,witnesses:["scan-root",...B.witnesses],manifestRefused:!1,ecosystem:"Go"}),"root"):(l.push({rel:"",abs:N,witnesses:["scan-root",...F.witnesses],manifestRefused:!1,...F.witnesses.length>0?{alsoPython:!0}:{},...B.admitted?{alsoGo:!0}:{}}),"root")}let U=dt(Be.join(N,"package.json")),$=k(N,A);if($.candidate!=="absent"&&(p+=1),U==="absent"){let j=o?I(N,A,$):"not-root";if(j==="root"||j==="exhausted")return j;let F=v(N,A,$);return F==="not-root"&&$.candidate==="declared"&&j!=="observed"&&d.push({kind:"undeclared-manifest",rel:A}),F}p+=1;let W=[],w=A.split("/");g.some(j=>iv(j,w))&&W.push("workspace-declared"),Jw.some(j=>dt(Be.join(N,j))==="regular")&&W.push("own-lockfile");let P=o?S(N):{candidate:"absent",witnesses:[]};for(let j of P.witnesses)W.includes(j)||W.push(j);return W.length===0&&U!=="refused"?(d.push({kind:"undeclared-manifest",rel:A}),v(N,A,$)):l.length>=r?"exhausted":(l.push({rel:A,abs:N,witnesses:W,manifestRefused:U==="refused",...P.witnesses.length>0?{alsoPython:!0}:{},...$.admitted?{alsoGo:!0}:{}}),$.admitted&&b.add(N),"root")},E=[{abs:a,rel:"",depth:0}];for(;E.length>0;){let N=E.pop();if(N===void 0)break;if(f>=t){m="dirs-exhausted";break}f+=1;let A=O(N.abs,N.rel);if(A==="exhausted"){m="roots-exhausted";break}let U=A==="root";if(N.depth>=s){m=m==="complete"?"depth-clamped":m;continue}let $;try{$=qw(N.abs)}catch{d.push({kind:"refused-unreadable",rel:N.rel});continue}$.sort().reverse();for(let W of $){let w=Be.join(N.abs,W),P=N.rel.length===0?W:`${N.rel}/${W}`,j;try{let ne=Uw(w);j=ne.isDirectory()||ne.isSymbolicLink()&&Yr(w).isDirectory()}catch{continue}if(!j)continue;if(W==="node_modules"){(!U||_.has(N.abs))&&d.push({kind:"unenumerated-install",rel:P});continue}if(W==="vendor"&&b.has(N.abs)&&dt(Be.join(w,"modules.txt"))==="regular")continue;if(W.startsWith(".")){u+=1,d.push({kind:"skipped-dot-directory",rel:P}),dt(Be.join(w,"package.json"))!=="absent"&&d.push({kind:"undeclared-manifest",rel:P});continue}let F;try{F=Ul(w)}catch{d.push({kind:"refused-unreadable",rel:P});continue}let B=a.endsWith(Be.sep)?a:a+Be.sep;if(F!==a&&!F.startsWith(B)){d.push({kind:"refused-out-of-root",rel:P});continue}Yp(F,a)||c.has(F)||(c.add(F),E.push({abs:F,rel:Jp(a,F),depth:N.depth+1}))}}for(let N of n?.operatorRoots??[]){let A=typeof N=="string"?N.slice(0,512):"",U=()=>{d.push({kind:"refused-operator-root",rel:A})};if(A.length===0||A.includes("\0")){U();continue}let $;try{$=Ul(Be.resolve(a,A))}catch{U();continue}let W=a.endsWith(Be.sep)?a:a+Be.sep;if($!==a&&(!$.startsWith(W)||Yp($,a))){U();continue}let w;try{w=Yr($).isDirectory()}catch{w=!1}if(!w||dt(Be.join($,"package.json"))!=="regular"){U();continue}let P=l.findIndex(B=>B.abs===$);if(P>=0){let B=l[P];B!==void 0&&!B.witnesses.includes("operator")&&(l[P]={...B,witnesses:[...B.witnesses,"operator"]});continue}let j=Jp(a,$);l.push({rel:j,abs:$,witnesses:["operator"],manifestRefused:!1});let F=d.findIndex(B=>B.kind==="undeclared-manifest"&&B.rel===j);F>=0&&d.splice(F,1)}return l.sort((N,A)=>N.rel<A.rel?-1:N.rel>A.rel?1:0),d.sort((N,A)=>N.kind!==A.kind?N.kind<A.kind?-1:1:N.rel<A.rel?-1:N.rel>A.rel?1:0),{roots:l,observations:d,budget:m,counts:{dirsWalked:f,manifestsSeen:p,rootsAdmitted:l.length,dotDirectoriesSkipped:u}}}import{lstatSync as rm,readdirSync as dv,readFileSync as cv,realpathSync as am,statSync as lm}from"node:fs";import $n from"node:path";var ct={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},uv=/^python\d+\.\d+$/u;function ls(e,n){let t;try{t=lm(e)}catch(s){return{why:s?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:cv(e,"utf8")}}catch{return{why:"unreadable"}}}function ql(e,n){let t;try{if(t=am(n),!lm(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+$n.sep)?t:null}function om(e,n){return $n.relative(e,n).split($n.sep).join("/")}function im(e){try{return dv(e).sort()}catch{return null}}function fv(e){let n=[],t=[],s=0;for(let r of e.split(/\r?\n/u)){let o=r.trim();if(!(o===""||o.startsWith("#"))){if(/^import[ \t]/u.test(o)){s+=1;let i=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(o);i?.[1]!==void 0&&t.length<ct.maxPthPaths&&t.push(i[1]);continue}n.length<ct.maxPthPaths&&n.push(o)}}return{paths:n,importLines:s,importModules:t}}function pv(e){let n=null;for(let t of e.split(/\r?\n/u)){let s=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(s!==null){if(s[1]==="version_info")return s[2]??null;n??=s[2]??null}}return n}function eo(e,n){let t=n?.envDir??ct.envDir,s=n?.maxDistributions??ct.maxDistributions,r=n?.maxMetadataBytes??ct.maxMetadataBytes,o=n?.maxRecordBytes??ct.maxRecordBytes,i=n?.maxTopLevelBytes??ct.maxTopLevelBytes,a=n?.maxDirectUrlBytes??ct.maxDirectUrlBytes,l=ct.maxEntryPointsBytes,d=t,c=[],f=(N,A,U=null)=>({envRel:d,refused:N,sitePackages:[],interpreter:U,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...c,A],truncated:!1}),p;try{p=am(e)}catch{return f("absent","the root itself could not be resolved")}let u=$n.join(p,t),m;try{m=rm(u)}catch(N){return N?.code==="ENOENT"?f("absent",`${d}: absent`):f("not-a-directory",`${d}: could not be inspected`)}if(!m.isDirectory()&&!m.isSymbolicLink())return f("not-a-directory",`${d}: not a directory`);let g=ql(p,u);if(g===null)return f("escapes-root",`${d}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let y=ls($n.join(g,"pyvenv.cfg"),ct.maxPyvenvCfgBytes),b="text"in y?pv(y.text):null;"text"in y||c.push(`${d}/pyvenv.cfg: ${y.why} \u2014 interpreter version unknown`);let _=[];for(let N of["lib","lib64"]){let A=im($n.join(g,N));if(A!==null)for(let U of A)uv.test(U)&&_.push($n.join(g,N,U,"site-packages"))}_.push($n.join(g,"Lib","site-packages"));let S=[],k=new Set;for(let N of _){let A=ql(g,N);A===null||k.has(A)||(k.add(A),S.push(A))}if(S.length===0)return f("no-site-packages",`${d}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,b);S.length>1&&c.push(`${d}: ${String(S.length)} site-packages directories; all enumerated`);let v=[],I=[],O=0,E=!1;e:for(let N of S){let A=om(p,N),U=im(N);if(U===null){c.push(`${A}: unreadable; nothing enumerated there`);continue}for(let $ of U){let W=$n.join(N,$),w=$.endsWith(".dist-info"),P=$.endsWith(".egg-info");if($.endsWith(".pth")){let T=ls(W,ct.maxPthBytes);if(!("text"in T)){c.push(`${A}/${$}: ${T.why}; the paths it adds were NOT enumerated`);continue}I.push({name:$,sitePackages:A,...fv(T.text)});continue}if(!w&&!P)continue;if(v.length>=s){E=!0,c.push(`${A}: the distribution cap (${String(s)}) was hit at ${$}; the enumeration is INCOMPLETE`);break e}let j;try{j=rm(W)}catch{O+=1,c.push(`${A}/${$}: could not be inspected; not enumerated`);continue}let F=w?"dist-info":"egg-info";if(j.isFile()&&P){let T=ls(W,r);"text"in T?v.push({dir:$,kind:F,metadata:T.text,entryPointsUnknown:!0}):(O+=1,c.push(`${A}/${$}: ${T.why}; not enumerated`));continue}let B=ql(g,W);if(B===null){O+=1,c.push(`${A}/${$}: not a directory inside the environment; not enumerated`);continue}let ne=w?"METADATA":"PKG-INFO",X=ls($n.join(B,ne),r);if(!("text"in X)){O+=1,c.push(`${A}/${$}: ${ne} ${X.why}; not enumerated`);continue}let Q={dir:$,kind:F,metadata:X.text},Z=ls($n.join(B,"entry_points.txt"),l);"text"in Z?Q.entryPoints=Z.text:Z.why!=="absent"&&(Q.entryPointsUnknown=!0,c.push(`${A}/${$}/entry_points.txt: ${Z.why}; the commands it declares are UNKNOWN`));let x=ls($n.join(B,"top_level.txt"),i);if("text"in x?Q.topLevel=x.text:x.why!=="absent"&&c.push(`${A}/${$}/top_level.txt: ${x.why}; ignored`),w){let T=ls($n.join(B,"RECORD"),o);"text"in T?Q.record=T.text:c.push(`${A}/${$}/RECORD: ${T.why}; import names from top_level.txt only`);let q=ls($n.join(B,"direct_url.json"),a);"text"in q&&(Q.directUrl=q.text)}v.push(Q)}}return{envRel:d,refused:null,sitePackages:S.map(N=>om(p,N)),interpreter:b,distInfos:v,pthFiles:I,unreadable:O,diagnostics:c,truncated:E}}var hv=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function yv(e,n){for(let t of n)try{if(mv(gv.join(e,t)).isFile())return t}catch{}return null}function dm(e){let n=[],t=[],s=(f,p)=>{t.push({kind:f,detail:p,blindsAnalysis:!1,rootRel:""}),n.push(p)},r=yv(e,hv),o=eo(e);if(o.refused!==null){let f=o.refused==="absent"?`no \`${o.envRel}\` is installed`:`\`${o.envRel}\` could not be read (${o.refused})`;return s("no-installed-env",`${r??"the Python manifest"} declares a dependency set but ${f}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:r,diagnostics:[...n,...o.diagnostics],truncated:!1,gaps:t}}let i=[],a=new Set,l=[],d=0;for(let f of o.distInfos){let p=Ur(f.metadata,{...f.topLevel!==void 0?{topLevelText:f.topLevel}:{},...f.record!==void 0?{recordText:f.record}:{},...f.directUrl!==void 0?{directUrlText:f.directUrl}:{}});if(p===null){d+=1,n.push(`${f.dir}: METADATA carries no Name/Version; not enumerated`);continue}let u=JSON.stringify([p.name,p.version]);a.has(u)||(a.add(u),p.importNames.length===0&&l.push(p.name),i.push({name:p.name,version:p.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...o.diagnostics);let c=o.unreadable+d;return c>0&&s("installed-env-partial",`${String(c)} entr${c===1?"y":"ies"} under ${o.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(i.length)} enumerated were assessed normally.`),o.truncated&&s("installed-env-partial",`the environment walk under ${o.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),l.length>0&&n.push(`${String(l.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${l.slice(0,5).join(", ")}${l.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:i,source:i.length>0?"installed-env":"none",lockfilePath:r,diagnostics:n,truncated:o.truncated,gaps:t}}var Yl=128*1024*1024,bv=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>di(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>di(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Ol(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Ml(e,n===void 0?{}:{maxEntries:n})}],_v=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Jl(e,n){let t;try{t=Xl(ut.join(e,n))}catch{return null}let s=e.endsWith(ut.sep)?e:e+ut.sep;return t.startsWith(s)?t:null}function um(e,n){let t=ut.join(e,"package.json"),s;try{s=Xl(t)}catch{return null}if(!s.startsWith(n+ut.sep))return null;try{if(!no(s).isFile())return null;let r=JSON.parse(Vl(s,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function fm(e,n){try{return no(ut.join(e,n)),!0}catch{return!1}}function Sv(e,n){if(fm(e,"pnpm-workspace.yaml"))return!0;let t=Jl(e,"package.json");if(t===null)return fm(e,"package.json");let s;try{let i=no(t);if(!i.isFile()||i.size>n)return!0;s=Vl(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(s)}catch{return!0}for(let i of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=r[i];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let o=r.workspaces;return Array.isArray(o)?o.length>0:typeof o=="object"&&o!==null}function pm(e,n){let t=ut.join(e,"node_modules"),s=[],r;try{r=cm(t,{withFileTypes:!0})}catch{return s}for(let o of r){let i=o.name;if(i.startsWith("."))continue;if(i.startsWith("@")){let l;try{l=cm(ut.join(t,i),{withFileTypes:!0})}catch{continue}for(let d of l){let c=um(ut.join(t,i,d.name),n);c!==null&&s.push({dev:!1,name:c.name,version:c.version,lockKey:`node_modules/${i}/${d.name}`,linked:d.isSymbolicLink()||o.isSymbolicLink()})}continue}let a=um(ut.join(t,i),n);a!==null&&s.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${i}`,linked:o.isSymbolicLink()})}return s}var xv=5;function kv(e,n,t){let s=Jl(e,n);if(s===null){try{no(ut.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=no(s)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:Vl(s,"utf8")}}catch{return{gap:`${n} could not be read`}}}function wv(e,n){let t=Xl(e),s=[],r=[],o=n?.maxLockfileBytes??Yl,i=[],a=new Set,l=[],d=Sv(t,o),c=null,f=!1,p=(m,g,y)=>{r.push({kind:m,detail:g,blindsAnalysis:y,rootRel:""}),s.push(g)};for(let m of bv){let g=kv(t,m.file,o);if(g===null)continue;if("gap"in g){p("lockfile-unreadable",g.gap,!1);continue}let y=m.parse(g.text,n?.maxLockfileEntries);if(y.truncated&&(f=!0),y.deps.length===0){if(y.diagnostics.length>0||d){let b=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";p("lockfile-unparsed",`${m.file} yielded NO dependencies (${b}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&p("lockfile-partial",`${m.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),c===null&&(c=m.file),l.includes(m.source)||l.push(m.source);for(let b of y.deps){let _=JSON.stringify([b.name,b.version,b.lockKey]);a.has(_)||(a.add(_),i.push({...b,declaredIn:m.file}))}}for(let m of _v)if(Jl(t,m)!==null){p("yarn-pnp",`${m} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(i.length>0){let m=l.length===1?l[0]??"none":"multi-lockfile";l.length>1&&s.push(`multiple lockfiles present (${l.join(", ")}); enumerated the UNION of all of them`);let g=new Set(i.map(_=>JSON.stringify([_.name,_.version]))),y=new Set,b=[];for(let _ of pm(t,t)){let S=JSON.stringify([_.name,_.version,_.lockKey]);a.has(S)||(a.add(S),i.push({name:_.name,version:_.version,lockKey:_.lockKey,dev:_.dev,declaredIn:""}));let k=JSON.stringify([_.name,_.version]);_.linked||g.has(k)||y.has(k)||(y.add(k),b.length<xv&&b.push(zr(_.name,_.version)))}if(y.size>0){let _=y.size-b.length;p("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${b.join(", ")}${_>0?`, and ${String(_)} more`:""}): ${c??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:i,source:m,lockfilePath:c,diagnostics:s,truncated:f,gaps:r}}let u=pm(t,t);return u.length>0?(p("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(u.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:u.map(m=>({name:m.name,version:m.version,lockKey:m.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:s,truncated:f,gaps:r}):(d&&p("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:s,truncated:f,gaps:r})}function mm(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function vv(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function ym(e){return e===""||e.split("/").every(vv)}function Ev(e,n){if(e===""||n==="")return n;if(!ym(e))return"";let t=`${e}/${n}`;return t.length<=li?t:""}function gm(e,n){return e===""?n:`${e}: ${n}`}function Av(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function bm(e,n,t,s){let r=t?.maxUnionEntries??ai,o=n.roots.filter(g=>mm(g)||s?.has(g.rel)===!0),i=o.some(g=>g.rel==="")?o:[Av(e),...o],a=[],l=[],d=new Set,c=[],f=[],p=!1,u=!1;for(let g of i){let y=g.rel===""?e:g.abs,_=g.rel===""||g.ecosystem!=="Go"&&mm(g)?wv(y,t):Ov,S=Jr(g)?dm(y):null,k=s?.get(g.rel)??null,v=S===null?_:hm(_,S),I=k===null?v:hm(v,k),O=I.diagnostics.map(N=>gm(g.rel,N));!ym(g.rel)&&I.packages.length>0&&O.push(`${g.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(I.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let E={...I,rootRel:g.rel,...g.ecosystem!==void 0?{ecosystem:g.ecosystem}:{},...S!==null?{pythonLockfilePath:S.lockfilePath===null||g.rel===""?S.lockfilePath:`${g.rel}/${S.lockfilePath}`}:{},...k!==null?{goModPath:g.rel===""?"go.mod":`${g.rel}/go.mod`}:{},packages:I.packages.map(N=>({...N,lockKey:Ev(g.rel,N.lockKey),declaredIn:N.declaredIn===""||g.rel===""?N.declaredIn:`${g.rel}/${N.declaredIn}`})),lockfilePath:I.lockfilePath===null||g.rel===""?I.lockfilePath:`${g.rel}/${I.lockfilePath}`,gaps:I.gaps.map(N=>({...N,rootRel:g.rel,detail:gm(g.rel,N.detail)})),diagnostics:O};a.push(E),I.truncated&&(p=!0);for(let N of E.packages){let A=JSON.stringify(N.ecosystem==="Go"?[N.name,N.version,N.lockKey,"Go"]:[N.name,N.version,N.lockKey]);if(!d.has(A)){if(l.length>=r){u=!0;break}d.add(A),l.push(N)}}c.push(...E.gaps),f.push(...E.diagnostics)}u&&(p=!0,f.push(`the union of installed sets across ${String(i.length)} roots exceeds its ceiling of ${String(r)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let m=a[0];if(m===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:m.source,lockfilePath:m.lockfilePath,diagnostics:f,truncated:p,gaps:c,perRoot:a}}function Iv(e,n){let t;for(let s of e.perRoot){if(s.rootRel===""){t??=s;continue}n.startsWith(`${s.rootRel}/`)&&(t===void 0||s.rootRel.length>t.rootRel.length)&&(t=s)}return t}function hi(e,n){return n.declaredIn!==""?n.declaredIn:Iv(e,n.lockKey)?.lockfilePath??null}function _m(e,n){let t=e.perRoot.find(r=>r.rootRel===n.rootRel);if(Rv.has(n.kind))return t?.goModPath??(n.rootRel===""?"go.mod":`${n.rootRel}/go.mod`);if(Nv.has(n.kind))return t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`;if(t?.lockfilePath!==void 0&&t.lockfilePath!==null)return t.lockfilePath;if(n.rootRel==="")return null;let s=t?.ecosystem==="PyPI"?"pyproject.toml":t?.ecosystem==="Go"?"go.mod":"package.json";return`${n.rootRel}/${s}`}var Nv=new Set(["no-installed-env","installed-env-partial"]),Rv=new Set(["go-toolchain-missing","go-list-failed","go-module-missing"]),Ov={packages:[],source:"none",lockfilePath:null,diagnostics:[],truncated:!1,gaps:[]};function hm(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function Sm(e){let n=new Map;for(let t of e){let s=n.get(t.name)??new Set;s.add(t.version),n.set(t.name,s)}return t=>{let s=n.get(t);if(s===void 0)return;let r=[...s].sort();return r.length===1?r[0]:r}}function to(e){return new Set(e.map(n=>n.root))}function er(e,n){let t=to(n);return e.roots.filter(s=>!t.has(s.rel)&&(s.rel===""||s.ecosystem!=="PyPI"&&s.ecosystem!=="Go"))}function Ql(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function Zl(e,n){return er(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function xm(e){let n=[],t=e.observations.filter(s=>s.kind==="unenumerated-install").map(s=>s.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${Ql(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let s=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(s.dirsWalked)} dirs walked, ${String(s.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function km(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as L0}from"node:fs";import Ps from"node:path";import{spawnSync as n0}from"node:child_process";function so(e){{let n=se[e];if(n===void 0)throw new Error(`the bundle does not embed ${e}; this is a cupel build defect`);return["-c",n]}}var wm=["get","post","put","patch","delete","options","head","trace"],Ln=(e,n)=>e.map(t=>`${t}.${n}()`),kn=(e,...n)=>e.flatMap(t=>n.map(s=>`${t}.${s}`)),zn={id:"fastapi@0-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://fastapi.tiangolo.com/reference/apirouter/ \u2014 APIRouter.api_route's decorator calls add_api_route(path, func) and returns func (fastapi/routing.py, 0.141.1); FastAPI.get/\u2026 delegate to self.router","https://fastapi.tiangolo.com/tutorial/dependencies/ \u2014 a Depends parameter receives the dependency's return","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/dependencies/utils.py \u2014 add_non_field_param_to_dependency: Request, WebSocket, HTTPConnection, Response, BackgroundTasks, SecurityScopes are injected","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/security/http.py \u2014 HTTPBearer.__call__ returns HTTPAuthorizationCredentials read from the request's Authorization header"],apps:[...Ln(["fastapi","fastapi.applications"],"FastAPI"),...Ln(["fastapi","fastapi.routing"],"APIRouter")],decorators:[...wm,"api_route"],addRoute:"add_api_route",depends:kn(["fastapi","fastapi.params","fastapi.param_functions"],"Depends","Security"),injected:[...kn(["fastapi","fastapi.responses","starlette.responses"],"Response","JSONResponse","HTMLResponse","PlainTextResponse","RedirectResponse","StreamingResponse","FileResponse","ORJSONResponse","UJSONResponse","EventSourceResponse"),...kn(["fastapi","fastapi.background","starlette.background"],"BackgroundTasks"),...kn(["fastapi.security","fastapi.security.oauth2"],"SecurityScopes")],schemes:[...Ln(["fastapi.security","fastapi.security.http"],"HTTPBearer"),...Ln(["fastapi.security","fastapi.security.http"],"HTTPBasic"),...Ln(["fastapi.security","fastapi.security.http"],"HTTPDigest"),...Ln(["fastapi.security","fastapi.security.oauth2"],"OAuth2"),...Ln(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordBearer"),...Ln(["fastapi.security","fastapi.security.oauth2"],"OAuth2AuthorizationCodeBearer"),...Ln(["fastapi.security","fastapi.security.open_id_connect_url"],"OpenIdConnect"),...Ln(["fastapi.security","fastapi.security.api_key"],"APIKeyHeader"),...Ln(["fastapi.security","fastapi.security.api_key"],"APIKeyQuery"),...Ln(["fastapi.security","fastapi.security.api_key"],"APIKeyCookie")],forms:kn(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordRequestForm","OAuth2PasswordRequestFormStrict")},Jn={id:"flask@3-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://flask.palletsprojects.com/en/stable/api/#flask.Flask.route \u2014 Scaffold.route's decorator calls add_url_rule(rule, endpoint, f) and returns f (flask/sansio/scaffold.py, 3.1.3); get/post/put/delete/patch are route(methods=[\u2026])","https://flask.palletsprojects.com/en/stable/quickstart/#variable-rules \u2014 <converter:variable> sections are passed to the view as keyword arguments (werkzeug/routing/rules.py _part_re)","https://flask.palletsprojects.com/en/stable/api/#flask.request \u2014 the request object for the active context (flask/globals.py: a LocalProxy)"],apps:[...Ln(["flask","flask.app"],"Flask"),...Ln(["flask","flask.blueprints"],"Blueprint")],decorators:["route","get","post","put","delete","patch"],addRule:"add_url_rule",proxies:["flask.request","flask.globals.request"]},Nn={id:"django@6-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://docs.djangoproject.com/en/6.1/topics/http/urls/#how-django-processes-a-request \u2014 the view is called with the HttpRequest, then the captured values (django/urls/resolvers.py, 6.1.1)","https://docs.djangoproject.com/en/6.1/ref/class-based-views/base/#django.views.generic.base.View.dispatch \u2014 as_view()'s view calls dispatch(request, *args, **kwargs), which calls the method named for the verb","https://docs.djangoproject.com/en/3.2/ref/urls/#url \u2014 url() (removed in 4.0) is re_path()","https://www.django-rest-framework.org/api-guide/views/#api_view \u2014 the decorated function is called by a generated APIView's handler with (request, *args, **kwargs) (rest_framework/decorators.py, 3.18.1)","https://docs.djangoproject.com/en/6.1/topics/http/decorators/ \u2014 Django's view decorators; each wrapper calls the view with (request, *args, **kwargs) (django/views/decorators/*.py, django/contrib/auth/decorators.py user_passes_test, django/utils/decorators.py make_middleware_decorator, 6.1.1)"],paths:["django.urls.path","django.urls.conf.path"],regexes:["django.urls.re_path","django.urls.conf.re_path","django.conf.urls.url"],methods:wm,passThrough:[...kn(["django.contrib.auth.decorators"],"login_required","login_required()","login_not_required","permission_required()","user_passes_test()"),...kn(["django.contrib.admin.views.decorators"],"staff_member_required","staff_member_required()"),...kn(["django.views.decorators.http"],"require_http_methods()","require_GET","require_POST","require_safe","condition()","etag()","last_modified()","conditional_page"),...kn(["django.views.decorators.csrf"],"csrf_exempt","csrf_protect","requires_csrf_token","ensure_csrf_cookie"),...kn(["django.views.decorators.cache"],"cache_page()","cache_control()","never_cache"),...kn(["django.views.decorators.vary"],"vary_on_headers()","vary_on_cookie"),...kn(["django.views.decorators.clickjacking"],"xframe_options_deny","xframe_options_sameorigin","xframe_options_exempt"),...kn(["django.views.decorators.gzip"],"gzip_page"),...kn(["django.views.decorators.debug"],"sensitive_post_parameters()","sensitive_variables()"),...kn(["django.views.decorators.common"],"no_append_slash")],apiView:"rest_framework.decorators.api_view()",apiViewSetters:kn(["rest_framework.decorators"],"renderer_classes()","parser_classes()","authentication_classes()","throttle_classes()","permission_classes()","schema()")};function vm(e){return Jn.proxies.includes(e)?{kind:"source",sourceClass:Jn.sourceClass,model:Jn.id}:null}var Pv=[zn.addRoute,Jn.addRule,...new Set([...Nn.paths,...Nn.regexes].map(e=>e.slice(e.lastIndexOf(".")+1)))],Cv=[...new Set([...Nn.passThrough,Nn.apiView,...Nn.apiViewSetters].map(e=>e.split(".")[0]??e))];function Em(e){return{proxies:Jn.proxies.filter(n=>!e(n.split(".")[0]??n)),calls:Pv,roots:Cv.filter(n=>!e(n))}}import{readdirSync as Nm,realpathSync as Am,statSync as Rm}from"node:fs";import zt from"node:path";var Om=32,Mv=512,Tv=/^[A-Za-z_][A-Za-z0-9_]*$/u,$v=[".so",".pyd",".dylib"],yi=e=>({resolved:e,failure:null}),nr=e=>({resolved:null,failure:e});function Lv(e){if(e.length===0||e.length>Mv)return null;let n=e.split(".");return n.length>Om?null:n.every(t=>Tv.test(t))?n:null}function ed(e){try{return Rm(e).isDirectory()}catch{return!1}}function sr(e){try{return Rm(e).isFile()}catch{return!1}}var Im=new WeakMap;function tr(e,n,t){let s=Im.get(e);s===void 0&&(s=new Map,Im.set(e,s));let r=s.get(n);if(r===void 0){try{r=new Set(Nm(n))}catch{r=null}s.set(n,r)}return r?.has(t)===!0}function ro(e,n){let t,s;try{t=Am(n),s=Am(e)}catch{return null}return t===s||t.startsWith(s+zt.sep)?t:null}function Dv(e,n){let t;try{t=Nm(e)}catch{return null}for(let s of t)if(s.startsWith(`${n}.`)&&$v.some(r=>s.endsWith(r))&&sr(zt.join(e,s)))return zt.join(e,s);return null}function Wt(e,n){let t=Lv(n);if(t===null)return nr("refused");let s=null,r=!1;for(let[o,i]of e.roots.entries()){let a=i,l=!1;for(let g of t.slice(0,-1)){let y=zt.join(a,g);if(tr(e,a,g)&&(sr(zt.join(y,"__init__.py"))||ed(y))){if(!ed(y)){l=!0;break}a=y;continue}l=!0,tr(e,a,`${g}.py`)&&sr(`${y}.py`)&&(r=!0);break}if(l)continue;let d=t[t.length-1];if(d===void 0)return nr("refused");let c=zt.join(a,d,"__init__.py");if(tr(e,a,d)&&sr(c)){let g=ro(i,c);return g===null?nr("escapes-root"):yi({module:n,kind:"package",path:g,rootIndex:o})}let f=zt.join(a,`${d}.py`);if(tr(e,a,`${d}.py`)&&sr(f)){let g=ro(i,f);return g===null?nr("escapes-root"):yi({module:n,kind:"module",path:g,rootIndex:o})}let p=Dv(a,d);if(p!==null){let g=ro(i,p);return g===null?nr("escapes-root"):yi({module:n,kind:"extension",path:g,rootIndex:o})}let u=zt.join(a,d);if(s===null&&tr(e,a,d)&&ed(u)){let g=ro(i,u);g!==null&&(s={module:n,kind:"namespace",path:g,rootIndex:o});continue}let m=zt.join(a,`${d}.pyi`);if(s===null&&tr(e,a,`${d}.pyi`)&&sr(m)){let g=ro(i,m);g!==null&&(s={module:n,kind:"stub-only",path:g,rootIndex:o})}}return s!==null?yi(s):nr(r?"not-a-package":"not-found")}function bi(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function rr(e,n,t,s){if(t<1||t>Om)return{failure:"refused"};let r=bi(e,n),o=r===""?[]:r.split("."),i=t-1;if(i>o.length)return{failure:"beyond-top-level"};let a=o.slice(0,o.length-i),l=s===null||s===""?[]:s.split("."),d=[...a,...l].join(".");return d===""?{failure:"beyond-top-level"}:{dotted:d}}function oo(e,n,t){if(e===null)return null;let s=o=>o.kind!=="declared-param"?o:o.index>=t?null:n==="none"?{kind:"param",index:o.index}:o.index===0?{kind:"receiver"}:{kind:"param",index:o.index-1},r=[];for(let o of e){let i=s(o.from),a=s(o.to);if(i===null||a===null)return null;r.push({from:i,to:a,kind:o.kind})}return r}var td="https://docs.python.org/3.13/",Fv=`${td}builtins/functions.html#`,Is=`${td}builtins/stdtypes.html#`,Et=e=>`${td}library/${e}.html#`;function _i(e){return e===""?[]:e.split(",").map(n=>{if(n==="r")return{kind:"receiver"};let t=n.endsWith("+"),s=Number(t?n.slice(0,-1):n);if(!Number.isSafeInteger(s)||s<0)throw new Error(`runtime table: input ${n}`);return t?{kind:"args-from",index:s}:{kind:"arg",index:s}})}var Cm=new Map;function ke(e,n,t){let s=(t.mutates??"").split(";").filter(i=>i!=="").map(i=>{let[a,l]=i.split("<"),d=_i(a??"");if(d.length!==1||d[0]===void 0||l===void 0)throw new Error(`runtime table: mutation ${i}`);return{into:d[0],from:_i(l)}}),r=_i(t.program??""),o=t.returns;Cm.set(e,{summary:{id:`python:${e}`,result:_i(t.result),mutates:s,...r.length>0?{callsProgram:r}:{}},...o!==void 0?{returns:o.endsWith("?")?{type:o.slice(0,-1),exact:"inputs"}:{type:o,exact:"always"}}:{},doc:n})}function sd(e,n,t){for(let s of e)ke(s,n(s),t)}var jv=(e,n=e)=>`${Fv}${n}`,Ge=(e,n,t=e)=>ke(`builtins.${e}`,jv(e,t),n);Ge("len",{result:"0",program:"0",returns:"int"});Ge("isinstance",{result:"0+",program:"0+",returns:"bool"});Ge("issubclass",{result:"0+",program:"0+",returns:"bool"});Ge("callable",{result:"0",returns:"bool"});Ge("str",{result:"0+",program:"0+",returns:"str?"},"func-str");Ge("repr",{result:"0",program:"0",returns:"str?"});Ge("ascii",{result:"0",program:"0",returns:"str?"});Ge("format",{result:"0+",program:"0+",returns:"str?"});Ge("bytes",{result:"0+",program:"0+",returns:"bytes?"},"func-bytes");Ge("int",{result:"0+",program:"0+",returns:"int"});Ge("float",{result:"0",program:"0",returns:"float"});Ge("bool",{result:"0",program:"0",returns:"bool"});Ge("ord",{result:"0",returns:"int"});Ge("chr",{result:"0",program:"0",returns:"str"});for(let e of["hex","oct","bin"])Ge(e,{result:"0",program:"0",returns:"str"});Ge("hash",{result:"0",program:"0",returns:"int"});for(let e of["any","all"])Ge(e,{result:"0",program:"0",returns:"bool"});for(let e of["abs","reversed","frozenset"])Ge(e,{result:"0",program:"0"},e==="frozenset"?"func-frozenset":e);for(let e of["round","min","max","sum","enumerate","zip","map","iter","next"])Ge(e,{result:"0+",program:"0+"});Ge("range",{result:"0+",program:"0+"},"func-range");Ge("filter",{result:"1",program:"0+"});Ge("sorted",{result:"0",program:"0+",returns:"list"});Ge("list",{result:"0",program:"0",returns:"list"},"func-list");Ge("tuple",{result:"0",program:"0",returns:"tuple"},"func-tuple");Ge("dict",{result:"0+",program:"0+",returns:"dict"},"func-dict");Ge("set",{result:"0",program:"0",returns:"set"},"func-set");var Ut=e=>n=>`${e}.${n}`,or=e=>n=>`${Is}${e}.${n}`,Bv=["capitalize","center","expandtabs","join","ljust","lower","lstrip","removeprefix","removesuffix","replace","rjust","rstrip","strip","swapcase","title","translate","upper","zfill"],Gv=["endswith","isalnum","isalpha","isascii","isdigit","islower","isspace","istitle","isupper","startswith"],Kv=["count","find","index","rfind","rindex"];for(let e of["str","bytes"]){let n=(t,s)=>{for(let r of t)ke(Ut(e)(r),or(e)(r),s)};n(Bv,{result:"r,0+",program:"0+",returns:e}),n(Gv,{result:"r,0+",program:"0+",returns:"bool"}),n(Kv,{result:"r,0+",program:"0+",returns:"int"}),n(["split","rsplit","splitlines"],{result:"r,0+",program:"0+",returns:"list"}),n(["partition","rpartition"],{result:"r,0+",program:"0+",returns:"tuple"})}sd(["casefold","format","format_map"].map(Ut("str")),e=>`${Is}${e}`,{result:"r,0+",program:"0+",returns:"str"});sd(["isdecimal","isidentifier","isnumeric","isprintable"].map(Ut("str")),e=>`${Is}${e}`,{result:"r",returns:"bool"});ke("str.encode",`${Is}str.encode`,{result:"r,0+",program:"0+",returns:"bytes?"});ke("bytes.decode",`${Is}bytes.decode`,{result:"r,0+",program:"0+",returns:"str?"});ke("bytes.hex",`${Is}bytes.hex`,{result:"r,0+",program:"0+",returns:"str"});var ir=or("dict");ke("dict.get",ir("get"),{result:"r,1",program:"r,0"});ke("dict.pop",ir("pop"),{result:"r,1",program:"r,0"});ke("dict.setdefault",ir("setdefault"),{result:"r,1",mutates:"r<0,1",program:"r,0"});ke("dict.update",ir("update"),{result:"",mutates:"r<0+",program:"r,0+"});sd(["keys","values","items","popitem"].map(Ut("dict")),e=>`${Is}${e}`,{result:"r"});ke("dict.copy",ir("copy"),{result:"r",returns:"dict"});ke("dict.clear",ir("clear"),{result:""});var Ht=or("list");ke("list.append",Ht("append"),{result:"",mutates:"r<0"});ke("list.extend",Ht("extend"),{result:"",mutates:"r<0",program:"0"});ke("list.insert",Ht("insert"),{result:"",mutates:"r<1",program:"0"});ke("list.pop",Ht("pop"),{result:"r",program:"0"});ke("list.remove",Ht("remove"),{result:"",program:"r,0"});ke("list.sort",Ht("sort"),{result:"",program:"r,0+"});ke("list.reverse",Ht("reverse"),{result:""});ke("list.clear",Ht("clear"),{result:""});ke("list.copy",Ht("copy"),{result:"r",returns:"list"});for(let e of["list","tuple"])for(let n of["index","count"])ke(Ut(e)(n),or(e)(n),{result:"r,0+",program:"r,0+",returns:"int"});var ar=or("set"),rd=or("frozenset");ke("set.add",ar("add"),{result:"",mutates:"r<0",program:"0"});ke("set.update",ar("update"),{result:"",mutates:"r<0+",program:"0+"});for(let e of["intersection_update","difference_update","symmetric_difference_update"])ke(Ut("set")(e),ar(e),{result:"",mutates:"r<0+",program:"r,0+"});for(let e of["discard","remove"])ke(Ut("set")(e),ar(e),{result:"",program:"r,0"});ke("set.pop",ar("pop"),{result:"r"});ke("set.clear",ar("clear"),{result:""});ke("set.copy",rd("copy"),{result:"r",returns:"set"});for(let e of["union","intersection","difference","symmetric_difference"])ke(Ut("set")(e),rd(e),{result:"r,0+",program:"r,0+",returns:"set"});for(let e of["issubset","issuperset","isdisjoint"])ke(Ut("set")(e),rd(e),{result:"r,0+",program:"r,0+",returns:"bool"});ke("json.loads",`${Et("json")}json.loads`,{result:"0+",program:"0+"});ke("json.dumps",`${Et("json")}json.dumps`,{result:"0+",program:"0+"});ke("copy.copy",`${Et("copy")}copy.copy`,{result:"0",program:"0"});ke("copy.deepcopy",`${Et("copy")}copy.deepcopy`,{result:"0+",mutates:"1<0",program:"0+"});for(let e of["b64encode","b64decode","standard_b64encode","standard_b64decode","urlsafe_b64encode","urlsafe_b64decode"])ke(`base64.${e}`,`${Et("base64")}base64.${e}`,{result:"0+",program:"0+",returns:"bytes"});ke("unicodedata.normalize",`${Et("unicodedata")}unicodedata.normalize`,{result:"0+",returns:"str?"});for(let e of["category","bidirectional"])ke(`unicodedata.${e}`,`${Et("unicodedata")}unicodedata.${e}`,{result:"0",returns:"str"});for(let e of["bisect_left","bisect_right","bisect"])ke(`bisect.${e}`,`${Et("bisect")}bisect.${e}`,{result:"0+",program:"0+",returns:"int"});for(let e of["insort_left","insort_right","insort"])ke(`bisect.${e}`,`${Et("bisect")}bisect.${e}`,{result:"",mutates:"0<1",program:"0+"});for(let e of["join","basename","dirname","normpath","splitext","split"])ke(`os.path.${e}`,`${Et("os.path")}os.path.${e}`,{result:"0+",program:"0+"});var Pm=new Set(["str","bytes","int","float","complex","bool","none","scalar"]),zv=new Set(["str","bytes","int","float","complex","bool","tuple","list","dict","set"]),ft={decl:"unknown"},Wv=8;function Mm(e,n){let t=new Map,s=c=>c==null||c.unlessWritten!==void 0&&n.written(c.unlessWritten)?null:{type:c.type,exact:!0},r=(c,f)=>c.get(nd(f))?.value??null,o=(c,f,p)=>{if(p>Wv)return ft;let u=n.decls.get(c),m=u?.moduleBindings?.get(f),g=e.packageOf(c);if(m==="def"||m==="class")return g===void 0?ft:{decl:g===""?"app":"dependency"};if(m!=="import"||u?.aliases.get(f)?.rows!==1)return ft;let y=n.envs.get(c),b=y?.names.get(f);if(b!==void 0)return o(b.moduleId,b.name,p+1);let _=y?.externalOrigins?.get(f);return _!==void 0?i(_,p+1):ft},i=(c,f)=>{let p=c.split(".");for(let m=p.length;m>=1;m-=1){let g=e.placed(p.slice(0,m).join("."));if(g===null)continue;if(g.kind==="surface")return{decl:"dependency"};let y=p.slice(m);return y.length===1&&y[0]!==void 0?o(g.id,y[0],f):ft}let u=p[0];return u!==void 0&&e.stdlib.has(u)?{decl:"runtime",identity:c}:ft},a=(c,f)=>{if(f.startsWith("~")){let y=e.packageOf(c);return y===void 0?ft:{decl:y===""?"app":"dependency"}}let p=f,u=/^\.+/u.exec(f)?.[0].length??0;if(u>0){let y=e.dottedOf(c);if(y===void 0)return ft;let b=f.slice(u),_=rr(y.dotted,y.isPackage,u,b===""?null:b);if("failure"in _)return ft;p=_.dotted}let[m,g]=p.split(".");return m==="builtins"?g!==void 0&&e.builtins.has(g)?{decl:"runtime",identity:p}:ft:i(p,0)},l=(c,f,p)=>{let g=(f.args??[]).map((O,E)=>{let N=f.argProofs?.[E],A=N?.unlessWritten===void 0?s(N):null;return A!==null||O.kind!=="positional"?A:r(p,O)}).map(O=>O!==null&&O.exact&&Pm.has(O.type)),y=f.attr===null||f.receiverRange===null?null:s(f.receiverProof)??r(p,f.receiverRange),b=y!==null&&y.exact&&Pm.has(y.type),_=ft;y!==null&&f.attr!==null?zv.has(y.type)&&e.typeAttrs.get(y.type)?.has(f.attr)===!0&&(_={decl:"runtime",identity:`${y.type}.${f.attr}`,method:!0}):f.calleeOrigin!==null&&(_=a(c,f.calleeOrigin));let S=_.identity===void 0?void 0:Cm.get(_.identity),k=S?.summary;k!==void 0&&_.method===!0&&y?.exact!==!0&&(k={...k,callsProgram:[{kind:"receiver"},...k.callsProgram??[]]});let v=S?.returns,I=v===void 0?void 0:{type:v.type,exact:v.exact==="always"||g.every(Boolean)&&(_.method!==!0||b)};return{calleeDecl:_.decl,..._.identity!==void 0?{runtimeId:`python:${_.identity}`}:{},...k!==void 0?{summary:k}:{},...b?{receiverPrimitive:!0}:{},..._.method===!0&&y?.exact===!0?{receiverMethod:y.type}:{},argPrimitive:g,...I!==void 0?{value:I}:{}}},d=c=>{let f=t.get(c);if(f!==void 0)return f;let p=new Map,u=g=>g.range.end-g.range.start,m=[...n.calls.get(c)??[]].sort((g,y)=>u(g)-u(y)||g.range.start-y.range.start);for(let g of m)u(g)>0&&p.set(nd(g.range),l(c,g,p));return t.set(c,p),p};return(c,f)=>{let p=d(c),u=p.get(nd(f.range))??l(c,f,p),{value:m,...g}=u;return g}}function nd(e){return`${String(e.start)}-${String(e.end)}`}var ld="<toplevel>",Gm=64,Uv=new Set(["self","cls"]),ao=8,Hv=new Set(["__new__","__init_subclass__","__class_getitem__"]),vi=new Set(["__del__","__repr__","__str__","__bytes__","__format__","__lt__","__le__","__eq__","__ne__","__gt__","__ge__","__hash__","__bool__","__getattr__","__getattribute__","__setattr__","__delattr__","__dir__","__get__","__set__","__delete__","__init_subclass__","__set_name__","__mro_entries__","__prepare__","__instancecheck__","__subclasscheck__","__class_getitem__","__call__","__len__","__length_hint__","__getitem__","__setitem__","__delitem__","__missing__","__iter__","__reversed__","__contains__","__add__","__sub__","__mul__","__matmul__","__truediv__","__floordiv__","__mod__","__divmod__","__pow__","__lshift__","__rshift__","__and__","__xor__","__or__","__radd__","__rsub__","__rmul__","__rmatmul__","__rtruediv__","__rfloordiv__","__rmod__","__rdivmod__","__rpow__","__rlshift__","__rrshift__","__rand__","__rxor__","__ror__","__iadd__","__isub__","__imul__","__imatmul__","__itruediv__","__ifloordiv__","__imod__","__ipow__","__ilshift__","__irshift__","__iand__","__ixor__","__ior__","__neg__","__pos__","__abs__","__invert__","__complex__","__int__","__float__","__index__","__round__","__trunc__","__floor__","__ceil__","__enter__","__exit__","__buffer__","__release_buffer__","__await__","__aiter__","__anext__","__aenter__","__aexit__","__next__","__fspath__","__post_init__","__copy__","__deepcopy__","__reduce__","__reduce_ex__","__getstate__","__setstate__","__getnewargs__","__getnewargs_ex__","__subclasshook__","__sizeof__","_missing_","_generate_next_value_"]),Km=new Set(["__getattr__","__dir__"]),qv=new Set(["property","cached_property","abstractproperty","getter","setter","deleter"]),Vv=e=>e.some(n=>n!==null&&qv.has(n.split(".").pop()??n)),Tm=["__new__","__init__"],zm=new Set(["object","BaseException","Exception","ArithmeticError","AssertionError","AttributeError","BufferError","EOFError","FloatingPointError","ImportError","IndexError","KeyError","LookupError","MemoryError","ModuleNotFoundError","NameError","NotImplementedError","OSError","OverflowError","RecursionError","ReferenceError","RuntimeError","StopAsyncIteration","StopIteration","SystemError","TimeoutError","TypeError","UnboundLocalError","UnicodeError","ValueError","ZeroDivisionError","Warning","UserWarning","DeprecationWarning","RuntimeWarning"]),ki=new Set([...zm,"type","dict","list","set","frozenset","tuple","str","bytes","bytearray","int","float","complex"]),Xv=new Map([["keys","any"],["get","mapping"],["close","iterator"]]),Wm=new Set(["excepthook","unraisablehook","displayhook","breakpointhook","__import__"]),Yv=new Map([["dataclass",{module:"dataclasses",name:"dataclass"}],["dataclasses.dataclass",{module:"dataclasses",name:null}],["total_ordering",{module:"functools",name:"total_ordering"}],["functools.total_ordering",{module:"functools",name:null}],["unique",{module:"enum",name:"unique"}],["enum.unique",{module:"enum",name:null}],["final",{module:"typing",name:"final"}],["typing.final",{module:"typing",name:null}]]),$m=new Map([["ABCMeta",{module:"abc",name:"ABCMeta"}],["abc.ABCMeta",{module:"abc",name:null}],["type",null]]);function lr(e,n){return{path:e,start:n.start,end:n.end}}function Lm(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function cd(e,n,t,s){let r=[],o=[],i=[],a=[],l=new Map,d=new Map,c=new Map,f=new Map,p=new Map,u=new Map,m=new Map,g=new Map,y=new Map,b=new Map,_=new Set,S=new Set,k=new Set,v=new Map,I=new Set,O=new Map,E=G=>{let z=new Map;for(let L of G)z.set(L,(z.get(L)??0)+1);return z},N=E(e.functions.map(G=>G.qualname)),A=E(e.classes.map(G=>G.qualname)),U=new Map(e.classes.map(G=>[G.qualname,G])),$=nE(e),W=(G,z)=>z!==void 0&&eE(G,z,e.moduleBindings,$),w=G=>!G.rebound&&G.decorators.every(z=>z!==null&&W(z,Yv.get(z)))&&(G.metaclass===null||W(G.metaclass,$m.get(G.metaclass))),P=`${n}#${ld}`,j=oo(e.toplevelFlows,"none",0);r.push({id:P,moduleId:n,name:ld,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1,...j!==null?{valueFlows:j}:{}});let F=new Set,B=new Set,ne=new Set,X=new Map,Q=new Map,Z=new Map,x=new Map,T=[];for(let G of e.classes){let z=`${n}#class:${G.qualname}`;G.decorators.length>0&&ne.add(z),Z.has(z)||Z.set(z,G.range.start),c.set(G.qualname,z),b.set(z,G.qualname),G.bases.length>1&&_.add(z),G.interceptsLookup&&S.add(z),v.set(z,G.nonDefBinds),O.set(z,G.valueBases),(!w(G)||A.get(G.qualname)!==1)&&I.add(z),G.metaclass!==null&&!W(G.metaclass,$m.get(G.metaclass))&&k.add(z);let L=p.get(z),ie=G.valueBases??G.bases;p.set(z,L===void 0?[...ie]:[...L,...ie]);let me=G.qualname.includes(".")?G.qualname:G.name;if(o.push({id:z,moduleId:n,name:me,implementsRefs:[],members:[]}),!x.has(z)){let be=`${n}#<class:${G.qualname}>`;x.set(z,be),T.push({id:be,moduleId:n,name:me,kind:"class",declRange:lr(t,G.range),isExported:!1,publicSurfaceReachable:!1})}}for(let G of e.functions){let z=`${n}#${G.qualname}`;l.set(G.qualname,z),g.set(G.qualname,G.params===null?null:new Set(G.params.map(H=>H.name)));let L=G.enclosingClass,ie=L!==null&&G.qualname===`${L}.${G.name}`,me=ie?c.get(L):void 0,be=L===null&&G.enclosingFunction===null,Me=!be&&!ie&&G.qualname===`${G.enclosingFunction??""}.${G.name}`?G.enclosingFunction:null,re=be?Lm(G.name,e.all):ie&&!L.includes(".")?Lm(L,e.all):!1,R=ie?U.get(L):void 0,D=N.get(G.qualname)===1&&(R===void 0||A.get(R.qualname)===1)?Zv(G,R===void 0?void 0:w(R),t):null;if(D!==null&&y.set(z,D.kind),X.set(z,G.name),G.decorators.length>0&&B.add(z),Q.get(z)!=="other"&&Q.set(z,G.decorated),(ie?vi.has(G.name)||Vv(G.decorators):be&&Km.has(G.name))&&F.add(z),r.push({id:z,moduleId:n,name:be||ie?G.name:G.qualname,kind:me!==void 0?G.name==="__init__"?"ctor":"method":"function",...me!==void 0?{enclosingClassId:me}:{},declRange:lr(t,G.range),isExported:re,publicSurfaceReachable:re,...D!==null?D.fields:{}}),be&&(d.set(G.name,z),re)){let H=s();i.push({id:H,moduleId:n,exportedName:G.name,kind:"value"}),a.push({exportId:H,target:{kind:"function",functionId:z}})}if(ie){let H=f.get(L)??new Map;H.set(G.name,z),f.set(L,H)}if(Me!==null){let H=u.get(Me)??new Map;H.set(G.name,z),u.set(Me,H)}!be&&!ie&&m.set(G.name,[...m.get(G.name)??[],z])}r.push(...T);let q=o.map(G=>{let z=[...c.entries()].find(([,ie])=>ie===G.id)?.[0],L=z===void 0?void 0:f.get(z);return L===void 0?G:{...G,members:[...L.values()]}});return{moduleId:n,functions:r,classes:q,exports:i,exportBindings:a,byQualname:l,topLevel:d,classByName:c,methods:f,baseSlots:p,nested:u,closures:m,paramNames:g,all:e.all,allComputed:e.allComputed,toplevelId:P,callable:y,moduleBindings:e.moduleBindings,staticBindings:e.staticBindings,aliases:$,classQualname:b,multiBase:_,intercepts:S,customMeta:k,nonDefBinds:v,rewrites:I,valueBases:O,starImport:e.starImport,attrWrites:e.attrWrites,implicitRoots:F,decoratedDefs:B,decoration:Q,classStarts:Z,decoratedClasses:ne,defNames:X,classObjects:x,valueNames:e.valueNames,valueAttrs:e.valueAttrs,computedAccess:e.computedAccess,classBinds:e.classBinds,moduleBinds:e.moduleBinds,dunderWrites:e.dunderWrites,moduleCalls:e.moduleCalls,importRenames:e.imports.flatMap(G=>G.form==="from"?G.names.flatMap(z=>z.asname!==null?[[z.asname,z.name]]:[]):[])}}function Jv(e,n){let t=new Set,s=!1;for(let i of e.values())if(i.attrWrites===null)s=!0;else for(let a of i.attrWrites)t.add(a);let r=t.has("__class__")||t.has("__getattribute__"),o=new Map;for(let[i,a]of e){let l=new Map;for(let c of a.functions){let f=a.callable.get(c.id);if(f===void 0||s||c.name!==void 0&&t.has(c.name))continue;let p=f!=="function";p&&r||p&&c.enclosingClassId!==void 0&&n.has(c.enclosingClassId)||l.set(c.id,f)}if(l.size===a.callable.size){o.set(i,a);continue}let d=a.functions.map(c=>{if(!a.callable.has(c.id)||l.has(c.id))return c;let{params:f,receiver:p,reflectiveArguments:u,valueFlows:m,...g}=c;return g});o.set(i,{...a,functions:d,callable:l})}return o}var Rn={kind:"unknown"},wi={kind:"external"};function dd(e,n,t,s,r=0,o=new Set){let[i,...a]=e;if(i===void 0||r>ao)return Rn;let l=`${n}${e.join(".")}`;if(o.has(l))return Rn;o.add(l);let d=t.get(n),c=d?.moduleBindings;if(d===void 0||c===void 0||c===null)return Rn;let f=c.get(i);if(f===void 0)return r===0&&!d.starImport?wi:Rn;if(f==="class"){let y=a.length===0?d.classByName.get(i):void 0;return y===void 0?Rn:{kind:"class",id:y}}let p=d.aliases.get(i);if(f!=="import"||p?.rows!==1)return Rn;let u=s.get(n),m=u?.names.get(i);if(m!==void 0)return dd([m.name,...a],m.moduleId,t,s,r+1,o);let g=u?.modules.get(i);return g!==void 0?p.exactModule&&a.length>0?dd(a,g,t,s,r+1,o):Rn:u?.external?.has(i)===!0?wi:Rn}function Qv(e,n){let t=new Map,s=new Map,r=[],o=(i,a,l)=>{let d=i.get(a);d===void 0?i.set(a,[l]):d.push(l)};for(let[i,a]of e)for(let[l,d]of a.classByName){let c=a.valueBases.get(d);if(c==null){r.push(d);continue}if(l.includes(".")){c.length>0&&r.push(d);continue}let f=!0;for(let p of c){let u=p===null?Rn:dd(p.split("."),i,e,n);u.kind==="unknown"&&(f=!1),u.kind==="class"&&(o(t,u.id,d),o(s,d,u.id))}f||r.push(d)}return{sub:t,sup:s,unknown:Ns(r,t)}}function Ns(e,n){let t=new Set,s=[...e];for(let r=s.pop();r!==void 0;r=s.pop())if(!t.has(r)){t.add(r);for(let o of n.get(r)??[])s.push(o)}return t}function Zv(e,n,t){if(e.params===null||e.rebound)return null;let s;if(e.method){if(n!==!0)return null;if(e.decorated==="staticmethod")s="static-method";else if(e.decorated==="classmethod")s="class-method";else if(e.decorated==="none"&&!Hv.has(e.name))s="instance-method";else return null}else{if(e.decorated!=="none")return null;s="function"}let r=e.params;if(s==="instance-method"||s==="class-method"){let i=r[0];if(i===void 0||i.kind!=="positional"&&i.kind!=="positional-only")return null;r=r.slice(1)}let o=oo(e.valueFlows,r.length<e.params.length?"first":"none",e.params.length);return{kind:s,fields:{params:r.map((i,a)=>({index:a,kind:i.kind==="positional-only"?"positional":i.kind,...i.kind==="positional-only"?{}:{name:i.name},destructured:!1,hasDefault:i.hasDefault,range:{path:t,start:i.start,end:i.end}})),receiver:s==="instance-method"||s==="class-method"?"call":"none",reflectiveArguments:e.reflective,...o!==null?{valueFlows:o}:{}}}}function eE(e,n,t,s){if(t===null)return!1;if(n===null)return!t.has(e);let r=e.split(".")[0]??e,o=s.get(r)?.source;return t.get(r)!=="import"||o===void 0||o.level!==0?!1:n.name===null?o.form==="import"&&o.name===n.module&&r===n.module:o.form==="from"&&o.module===n.module&&o.name===n.name&&r===n.name}function nE(e){let n=new Map,t=(s,r,o)=>{let i=n.get(s);n.set(s,i===void 0?{rows:1,exactModule:r,...o!==void 0?{source:o}:{}}:{rows:i.rows+1,exactModule:!1})};for(let s of e.imports)for(let r of s.names){let o={form:s.form,module:s.module,level:s.level,name:r.name};s.form==="import"?t(r.asname??r.name.split(".")[0]??r.name,r.asname!==null||!r.name.includes("."),r.asname===null?o:void 0):t(r.asname??r.name,!0,r.asname===null?o:void 0)}return n}function ud(e){let{envs:n}=e,t=e.children??new Map,s=tE(e.decls,{decls:e.decls,envs:n,children:t}),{inheritEdges:r}=s,o=Qv(e.decls,n),i=[];for(let R of e.decls.values())i.push(...R.customMeta);let a=Ns(i,o.sub),l=new Set(a);if(i.length>0)for(let R of o.unknown)l.add(R);let d=Jv(e.decls,l),c=new Map,f=(R,D)=>{let Y=c.get(R)??[];Y.includes(D)||Y.push(D),c.set(R,Y)};for(let R of d.values()){for(let D of R.methods.values())for(let[Y,H]of D)f(Y,H);for(let[D,Y]of R.closures)for(let H of Y)f(D,H)}for(let R of e.rebinds??[]){let D=d.get(R.moduleId)?.topLevel.get(R.target);D!==void 0&&f(R.attr,D)}let p=new Map;for(let R of d.values())for(let D of R.classByName.values())p.set(D,R);let u=new Map,m=new Set,g=new Set,y=new Set(a),b=new Map;for(let R of d.values()){for(let[D,Y]of R.callable)u.set(D,Y);for(let D of R.multiBase)m.add(D);for(let D of R.intercepts)g.add(D);for(let D of R.rewrites)y.add(D);for(let[D,Y]of R.nonDefBinds)b.set(D,Y)}let _=R=>{let D=b.get(R),Y=p.get(R),H=Y?.classQualname.get(R);return D==null||Y===void 0||H===void 0?null:new Set([...D,...Y.methods.get(H)?.keys()??[]])},S=[],k=new Map;for(let R of o.unknown){let D=new Set,Y=!1;for(let H of Ns([R],o.sup)){let ee=_(H);if(ee===null||y.has(H)||g.has(H)){Y=!0;break}for(let le of ee)D.add(le)}if(Y){S.push(R);continue}for(let H of D){let ee=k.get(H);ee===void 0?k.set(H,[R]):ee.push(R)}}let v=R=>{let D=new Map;return Y=>{let H=D.get(Y);return H===void 0&&(H=Ns([Y],R),D.set(Y,H)),H}},I={decls:d,envs:n,kindOf:u,classOwner:p,multiBase:m,intercepts:g,rewrites:y,nonDefBinds:b,below:v(o.sub),above:v(o.sup),unplaced:o.unknown,unplacedAnyName:S,unplacedByName:k},O=[],E=[],N=new Set,A=0,U=0,$=new Set,W=!1,w=new Map;for(let R of d.values()){if(R.attrWrites===null)W=!0;else for(let D of R.attrWrites)$.add(D);for(let[D,Y]of R.closures)w.set(D,[...w.get(D)??[],...Y])}let P=new Set;for(let R of d.values())for(let D of R.decoratedClasses)P.add(D);let j=new Map;for(let R of d.values())for(let[D,Y]of R.decoration)j.set(D,Y);let F={hier:s,rewrites:y,decorated:P},B={byMethodName:c,children:t,selfTargets:sE(s,c,{installable:R=>W||$.has(R),closures:w,intercepts:g}),construct:aE(F,R=>W||$.has(R)),written:R=>W||$.has(R),decoration:R=>j.get(R)??"other"},ne=new Map;for(let{moduleId:R,call:D}of e.pending){let Y=ne.get(R);Y===void 0?ne.set(R,[D]):Y.push(D)}let X=e.runtime===void 0?void 0:Mm(e.runtime,{decls:d,envs:n,written:B.written,calls:ne}),Q=new Set,Z=new Map,x=[],T=new Map;for(let R of e.pending){let{moduleId:D,path:Y,call:H}=R,ee=d.get(D);if(ee===void 0)continue;if(H.raisedCall!==null){x.push(R);continue}let le=H.enclosingFunction===null?ee.toplevelId:ee.byQualname.get(H.enclosingFunction)??ee.toplevelId,de=gE(H,D,ee,n.get(D),d,n,B),ge=yE(H,D,ee,de,I),ve=X?.(D,H);de.how==="name-match"&&de.resolution!=="unresolved"&&ge.direct.size===0&&(de=ds(de)),Z.set(`${D}${String(H.range.start)}${String(H.range.end)}`,de),e.preciseNames!==!1&&de.how==="name-match"&&de.resolution==="unresolved"&&ve?.receiverMethod!==void 0&&(de={ids:[],resolution:"unresolved",how:"name-match"});let Re=`py-call:${D}:${String(A)}`;A+=1,T.set(R,Re);let _e=de.resolution==="unresolved";_e&&(U+=1,H.attr!==null&&Q.add(H.attr),ge=wn),O.push({id:Re,enclosingFunctionId:le,calleeExprShape:H.receiver===null?"identifier":"member",resolvedTargetIds:_e?[]:de.ids,resolution:de.resolution,range:lr(Y,H.range),..._E(Y,H,ge.convention,ve?.argPrimitive),...xE(ve)});let Ke=e.nameMatchLabel===!0&&de.how==="name-match";for(let ze of de.ids){let pn=ge.direct.has(ze),vn=_e?"field-based":de.resolution,K=Ke&&vn==="field-based"&&!pn;K&&N.add(E.length),E.push({callSiteId:Re,calleeFunctionId:ze,resolution:K?"name-match":vn,...pn?{invocation:"direct"}:{}})}}let q=R=>{let D=B.decoration(R);return D==="none"||D==="staticmethod"||D==="classmethod"},G=lE({decls:d,envs:n,hier:s,facts:F,intercepts:g,written:B.written,constructs:(R,D)=>Z.get(`${R}${String(D.start)}${String(D.end)}`),certainTarget:q}),z=[];for(let[R,D]of T){let Y=G(R.moduleId,R.call);Y!==void 0&&z.push({site:D,target:Y})}if(z.length>0){let R=new Set(z.map(H=>H.site)),D=new Set,Y=new Map;for(let[H,ee]of E.entries())R.has(ee.callSiteId)&&(D.add(`${ee.callSiteId}${ee.calleeFunctionId}`),N.has(H)&&Y.set(`${ee.callSiteId}${ee.calleeFunctionId}`,H));for(let H of z){let ee=Y.get(`${H.site}${H.target}`);if(ee!==void 0){let le=E[ee];le!==void 0&&(E[ee]={...le,resolution:"field-based"}),N.delete(ee)}D.has(`${H.site}${H.target}`)||(D.add(`${H.site}${H.target}`),E.push({callSiteId:H.site,calleeFunctionId:H.target,resolution:"field-based"}))}}for(let{moduleId:R,path:D,call:Y}of x){let H=d.get(R),ee=Y.raisedCall;if(H===void 0||ee===null)continue;let le=Z.get(`${R}${String(ee.start)}${String(ee.end)}`);if(le===void 0||le.how==="construct"||le.ids.length===0)continue;let de=`py-raise:${R}:${String(A)}`;A+=1,U+=1,O.push({id:de,enclosingFunctionId:Y.enclosingFunction===null?H.toplevelId:H.byQualname.get(Y.enclosingFunction)??H.toplevelId,calleeExprShape:"unknown",resolvedTargetIds:[],resolution:"unresolved",range:lr(D,Y.range)})}let L=new Map;for(let R of e.loads??[]){let D=[R.moduleId,R.enclosingFunction??"",String(R.at),R.shape].join(""),Y=L.get(D);if(Y===void 0)L.set(D,{load:R,targets:new Set(R.targets)});else for(let H of R.targets)Y.targets.add(H)}let ie=0;for(let{load:R,targets:D}of L.values()){let Y=d.get(R.moduleId);if(Y===void 0)continue;let H=new Set;for(let le of D){let de=d.get(le)?.toplevelId;de!==void 0&&H.add(de)}if(H.size===0)continue;let ee=`py-load:${R.moduleId}:${String(ie)}`;ie+=1,O.push({id:ee,enclosingFunctionId:R.enclosingFunction===null?Y.toplevelId:Y.byQualname.get(R.enclosingFunction)??Y.toplevelId,calleeExprShape:R.shape,resolvedTargetIds:[...H],resolution:"resolved",range:{path:R.path,start:R.at,end:R.at}});for(let le of H)E.push({callSiteId:ee,calleeFunctionId:le,resolution:"resolved"})}let me=[...d.values()].flatMap(R=>R.functions),be=new Map(me.map(R=>[R.id,R.declRange])),Me=new Set;for(let R of O)for(let D of R.resolvedTargetIds)Me.add(`${R.enclosingFunctionId}${D}`);for(let[R,D]of d)for(let[Y,H]of D.nested){let ee=D.byQualname.get(Y);if(ee!==void 0)for(let le of H.values()){let de=be.get(le);if(de===void 0||Me.has(`${ee}${le}`))continue;let ge=`py-closure:${R}:${String(A)}`;A+=1,O.push({id:ge,enclosingFunctionId:ee,calleeExprShape:"identifier",resolvedTargetIds:[le],resolution:"field-based",range:{path:de.path,start:de.start,end:de.start}}),E.push({callSiteId:ge,calleeFunctionId:le,resolution:"field-based"})}}let re=(R,D,Y,H,ee=R.toplevelId)=>{let le=[...new Set(Y)];if(le.length===0&&!H)return;let de=`py-implicit:${R.moduleId}:${String(A)}`;A+=1,H&&(U+=1),O.push({id:de,enclosingFunctionId:ee,calleeExprShape:"unknown",resolvedTargetIds:H?[]:le,resolution:H?"unresolved":"field-based",range:{path:D.path,start:D.start,end:D.start}});for(let ge of le)E.push({callSiteId:de,calleeFunctionId:ge,resolution:"field-based"})};for(let R of d.values()){for(let H of R.implicitRoots){let ee=be.get(H);ee!==void 0&&re(R,ee,[H],!1)}let D=be.get(R.toplevelId)?.path??String(R.moduleId),Y=(H,ee)=>{let le=n.get(R.moduleId),de=uE(H,{d:R,env:le,classQual:ee,decls:d,envs:n,facts:F});de!==null&&re(R,{path:D,start:H.at},de.ids,de.unnamed)};for(let[H,ee]of R.classBinds??[])for(let le of ee)Y(le,H);for(let H of R.moduleBinds??[])Km.has(H.name)&&Y(H,null);for(let H of R.dunderWrites??[])(vi.has(H.name)||Wm.has(H.name))&&Y(H,null);for(let[H,ee]of R.classByName){let le=R.methods.get(H);for(let[de,ge]of Xv){let ve=le?.get(de),Re=ve===void 0?void 0:be.get(ve);if(ve===void 0||Re===void 0)continue;(ge==="any"||ge==="mapping"&&od(s,ee,rE).leaves||ge==="iterator"&&od(s,ee,ki,"__next__").reaches)&&re(R,Re,[ve],!1)}if(od(s,ee,ki).leaves){let de=R.classStarts.get(ee);de!==void 0&&re(R,{path:D,start:de},[],!0,oE(R,H))}}}for(let R of d.values()){let D=be.get(R.toplevelId)?.path??String(R.moduleId);for(let[Y,H]of R.classObjects){let ee=new Set;for(let ge of s.basesOf.get(Y)??[]){if(ge.kind!=="class")continue;let ve=s.classOwner.get(ge.id)?.classObjects.get(ge.id);ve!==void 0&&ve!==H&&ee.add(ve)}if(ee.size===0)continue;let le=`py-isa:${R.moduleId}:${String(A)}`;A+=1;let de=R.classStarts.get(Y)??0;O.push({id:le,enclosingFunctionId:H,calleeExprShape:"unknown",resolvedTargetIds:[...ee],resolution:"field-based",range:{path:D,start:de,end:de}});for(let ge of ee)E.push({callSiteId:le,calleeFunctionId:ge,resolution:"field-based"})}}return{functions:fE(d,Q),callSites:O,callEdges:E,inheritEdges:r,unresolved:U}}function Um(e,n){return e===void 0?!1:e.allComputed?!0:e.all!==null?e.all.includes(n):!n.startsWith("_")}function xi(e,n,t,s=0,r=new Set){let[o,...i]=e;if(o===void 0||s>ao)return Rn;let a=`${n}${e.join(".")}`;if(r.has(a))return Rn;r.add(a);let l=t.decls.get(n);if(l===void 0)return Rn;let d=l.classByName.get(e.join("."));if(d!==void 0)return{kind:"class",id:d};let c=t.envs.get(n),f=c?.names.get(o);if(f!==void 0){let p=xi([f.name,...i],f.moduleId,t,s+1,r);if(p.kind!=="unknown")return p}if(i.length>0){let p=c?.modules.get(o)??t.children.get(n)?.get(o);if(p!==void 0){let u=xi(i,p,t,s+1,r);if(u.kind!=="unknown")return u}}if(c?.external?.has(o)===!0)return wi;for(let p of c?.stars??[]){if(!Um(t.decls.get(p),o))continue;let u=xi(e,p,t,s+1,r);if(u.kind!=="unknown")return u}return s===0&&l.moduleBindings!==null&&!l.moduleBindings.has(o)&&!l.starImport?wi:Rn}var Hm=256;function tE(e,n){let t=[],s=new Map,r=new Map,o=new Map,i=new Map,a=[],l=(m,g,y)=>{let b=m.get(g);b===void 0?m.set(g,[y]):b.push(y)};for(let[m,g]of e)for(let[y,b]of g.classByName){i.set(b,g);let _=g.baseSlots.get(b)??[],S=_.map(v=>v===null?Rn:xi(v.split("."),m,n));y.includes(".")&&_.length>0&&S.push(Rn),s.set(b,S),S.some(v=>v.kind==="unknown")&&a.push(b);let k=new Set;for(let v of S)v.kind==="class"&&k.add(v.id);for(let v of k)t.push({subclassId:b,superclassId:v,relation:"extends"}),l(r,v,b),l(o,b,v)}let d=Ns(a,r),c=new Map;for(let m of Ns(d,o)){let g=i.get(m),y=g?.classQualname.get(m),b=y===void 0?void 0:g?.methods.get(y);for(let[_,S]of b??[]){let k=c.get(_);k===void 0?c.set(_,[S]):k.push(S)}}let f=new Map,p=(m,g)=>{let y=f.get(m);if(y!==void 0)return y;if(g>Hm)return 2;f.set(m,0);let b=0;for(let S of s.get(m)??[])if(b+=S.kind==="unknown"?1:S.kind==="class"?p(S.id,g+1):0,b>=2)break;let _=Math.min(b,2);return f.set(m,_),_},u=!1;for(let m of d)if(p(m,0)>=2){u=!0;break}return{inheritEdges:t,basesOf:s,subclassesOf:r,classOwner:i,unplacedDefs:c,unplacedMixin:u}}function fd(e,n,t){let s=e.classOwner.get(n),r=s?.classQualname.get(n);return r===void 0?void 0:s?.methods.get(r)?.get(t)}function io(e,n,t){let s=new Set,r=!1,o=!1,i=!1,a=new Set,l=[...n];for(let d=l.pop();d!==void 0;d=l.pop()){if(a.has(d))continue;a.add(d);let c=fd(e,d,t);c!==void 0&&s.add(c);let f=e.classOwner.get(d),p=f?.nonDefBinds.get(d);if(p===null||p?.has(t)===!0)o=!0;else if(c===void 0){let u=f?.baseSlots.get(d)??[];for(let[m,g]of(e.basesOf.get(d)??[]).entries())g.kind==="class"?l.push(g.id):g.kind==="unknown"?r=!0:(f===void 0||!pd(zm,u[m],f))&&(i=!0)}}return{ids:s,open:r,alias:o,outside:i}}function sE(e,n,t){let s=new Map,r=new Map;return(o,i)=>{let a=`${o}${i}`,l=r.get(a);if(l!==void 0)return l;let d=s.get(o);d===void 0&&(d=Ns([o],e.subclassesOf),s.set(o,d));let{ids:c,open:f,alias:p,outside:u}=io(e,d,i),m=p,g=k=>{c.has(k)||(c.add(k),m=!0)};for(let k of e.unplacedDefs.get(i)??[])g(k);let y=t.installable(i)?t.closures.get(i)??[]:[];for(let k of y)g(k);let b="self",_;if(f||e.unplacedMixin){let k=new Set([...c,...n.get(i)??[]]);if(k.size<=Gm){if(k.size>c.size||f){for(let v of k)c.add(v);m=!0,b="name-match"}}else f&&(y.length>0||[...d].some(I=>fd(e,I,i)!==void 0)||(_=Rs),m=!0)}let S=!m&&!f&&!u&&!e.unplacedMixin&&!qm(e,d,t.intercepts);return _??=c.size===0?Rs:{ids:[...c],resolution:S?c.size===1?"resolved":"field-based":"unresolved",how:b},r.set(a,_),_}}var rE=new Set([...ki].filter(e=>e!=="dict"));function od(e,n,t,s){let r=!1,o=!1,i=new Set,a=[n];for(let l=a.pop();l!==void 0;l=a.pop()){if(i.has(l))continue;i.add(l);let d=e.classOwner.get(l);if(s!==void 0){let f=d?.nonDefBinds.get(l);(fd(e,l,s)!==void 0||f===null||f?.has(s)===!0)&&(o=!0)}let c=d?.baseSlots.get(l)??[];for(let[f,p]of(e.basesOf.get(l)??[]).entries())p.kind==="class"?a.push(p.id):(p.kind==="unknown"||d===void 0||!pd(t,c[f],d))&&(r=!0)}return{leaves:r,reaches:r||o}}function oE(e,n){for(let t=n;t.includes(".");){t=t.slice(0,t.lastIndexOf("."));let s=e.byQualname.get(t);if(s!==void 0)return s}return e.toplevelId}function qm(e,n,t){if(t.size===0)return!1;let s=new Set,r=[...n];for(let o=r.pop();o!==void 0;o=r.pop())if(!s.has(o)){if(s.add(o),t.has(o))return!0;for(let i of e.basesOf.get(o)??[])i.kind==="class"&&r.push(i.id)}return!1}var pd=(e,n,t)=>typeof n=="string"&&e.has(n)&&t.moduleBindings!==null&&!t.moduleBindings.has(n)&&!t.starImport,iE=(e,n)=>pd(ki,e,n);function md(e,n){let t=new Set,s=[e];for(let r=s.pop();r!==void 0;r=s.pop()){if(t.has(r))continue;if(t.add(r),t.size>Hm||n.rewrites.has(r)||n.decorated.has(r))return!1;let o=n.hier.classOwner.get(r);if(o===void 0)return!1;let i=o.baseSlots.get(r)??[];for(let[a,l]of(n.hier.basesOf.get(r)??[]).entries())if(l.kind==="class")s.push(l.id);else if(l.kind==="unknown"||!iE(i[a],o))return!1}return!0}function aE(e,n){let t=new Map;return s=>{let r=t.get(s);if(r!==void 0)return r;let o=e.hier.classOwner.get(s),i=o?.classQualname.get(s)??"",a=Tm.map(f=>io(e.hier,[s],f)),l=i!==""&&!Tm.some(n)&&!n(i.split(".").pop()??i)&&a.every(f=>!f.open&&!f.alias)&&md(s,e),d=o?.classObjects.get(s),c={ids:[...d!==void 0?[d]:[],...a.flatMap(f=>[...f.ids])],resolution:l?a.every(f=>f.ids.size<=1)?"resolved":"field-based":"unresolved",how:"construct",classId:s};return t.set(s,c),c}}function dr(e,n,t,s,r=0,o=new Set,i=!1){if(r>ao||o.has(`${e}${n}`))return;o.add(`${e}${n}`);let a=t.get(e),d=(a?.moduleBindings??(i?a?.staticBindings:null))?.get(n);if(d==="class")return a?.classByName.get(n);if(d!=="import"||a?.aliases.get(n)?.rows!==1)return;let c=s.get(e)?.names.get(n);return c===void 0?void 0:dr(c.moduleId,c.name,t,s,r+1,o,i)}function Dm(e,n,t,s){return dr(e,n,t,s,0,new Set,!0)}function lE(e){let n=(r,o,i)=>{if(i>ao)return;let a=e.decls.get(r),l=a?.moduleBindings?.get(o);if(a===void 0||l===void 0)return;if(l==="import"){let f=a.aliases.get(o)?.rows===1?e.envs.get(r)?.names.get(o):void 0;return f===void 0?void 0:n(f.moduleId,f.name,i+1)}let d=l==="other"?a.moduleCalls?.get(o):void 0,c=d===void 0?void 0:e.constructs(r,d);return c?.how==="construct"?c.classId:void 0},t=new Map,s=r=>{let o=t.get(r);if(o===void 0){let i=e.hier.classOwner.get(r)?.classQualname.get(r),a=io(e.hier,[r],"__new__");o=i!==void 0&&!i.includes(".")&&!e.written(i)&&!e.written("__new__")&&a.ids.size===0&&!a.open&&!a.alias&&!a.outside&&md(r,e.facts),t.set(r,o)}return o};return(r,o)=>{let i=o.receiver;if(o.attr===null||i===null||i.includes(".")||o.nameScope!=="module"||o.root!=="global"||e.written(i))return;let a=n(r,i,0);if(a===void 0||!s(a)||e.written(o.attr)||e.written("__class__")||e.written("__getattribute__")||qm(e.hier,[a],e.intercepts))return;let l=io(e.hier,[a],o.attr);if(l.open||l.alias||l.outside||l.ids.size!==1)return;let[d]=l.ids;return d!==void 0&&e.certainTarget(d)?d:void 0}}function Vm(e,n,t){let s=n.aliases.get(e);return!e.includes(".")&&n.moduleBindings?.get(e)==="import"&&s?.rows===1&&s.exactModule?t?.modules.get(e):void 0}function dE(e,n){let t=e.split(".");for(let s=t.length-1;s>0;s-=1)if(n.byQualname.has(t.slice(0,s).join(".")))return!0;return!1}function id(e,n,t){let[s,...r]=n;if(s===void 0||r.length>0||!md(e,t))return null;let o=io(t.hier,[e],s);return o.open||o.alias?null:[...o.ids]}function cE(e,n){let[t,...s]=e.split("."),{d:r,env:o,classQual:i}=n;if(t===void 0||t==="")return null;if(i!==null){if(dE(i,r))return null;let m=r.classByName.get(i),g=m===void 0?null:r.nonDefBinds.get(m)??null;if(g===null||g.has(t))return null;let y=r.methods.get(i)?.get(t);if(y!==void 0)return s.length===0?[y]:null}let a=r.moduleBindings?.get(t);if(r.moduleBindings===null)return null;if(a===void 0)return r.starImport||r.topLevel.has("__getattr__")?null:[];if(a==="def"){let m=r.topLevel.get(t);return m!==void 0&&s.length===0?[m]:null}if(a==="class"){let m=r.classByName.get(t);return m===void 0?null:id(m,s,n.facts)}if(a!=="import"||r.aliases.get(t)?.rows!==1)return null;let l=o?.names.get(t);if(l!==void 0){let m=s.length===0?pt(l.moduleId,l.name,n.decls,n.envs,!0):void 0;if(m!==void 0)return[m];let g=dr(l.moduleId,l.name,n.decls,n.envs);return g===void 0?null:id(g,s,n.facts)}let d=Vm(t,r,o),[c,...f]=s;if(d===void 0||c===void 0)return null;let p=f.length===0?pt(d,c,n.decls,n.envs,!0):void 0;if(p!==void 0)return[p];let u=dr(d,c,n.decls,n.envs);return u===void 0?null:id(u,f,n.facts)}function uE(e,n){let t=e.value;if(t.kind==="const"||t.kind==="lambda"||t.kind!=="property"&&!vi.has(e.name)&&!Wm.has(e.name))return null;if(t.kind==="other")return{ids:[],unnamed:!0};let s=t.kind==="name"?[t.dotted]:t.accessors.flatMap(i=>i.kind==="name"?[i.dotted]:i.kind==="other"?[null]:[]),r=[],o=!1;for(let i of s){let a=i===null?null:cE(i,n);a===null?o=!0:r.push(...a)}return{ids:r,unnamed:o}}function fE(e,n){let t=!1,s=new Set(n),r=new Map;for(let i of e.values()){(i.computedAccess||i.valueNames===null||i.valueAttrs===null)&&(t=!0);for(let a of i.valueNames??[])s.add(a);for(let a of i.valueAttrs??[])s.add(a);for(let[a,l]of i.importRenames){let d=r.get(a);d===void 0?r.set(a,[l]):d.push(l)}}let o=[...s];for(let i=o.pop();i!==void 0;i=o.pop())for(let a of r.get(i)??[])s.has(a)||(s.add(a),o.push(a));return[...e.values()].flatMap(i=>i.functions.map(a=>{let l=i.defNames.get(a.id)??"",d=a.id!==i.toplevelId&&(t||a.kind==="class"||a.enclosingClassId!==void 0||s.has(l)||i.decoratedDefs.has(a.id));return{...a,addressTaken:d}}))}function pt(e,n,t,s,r=!1,o=new Set,i=0){if(i>ao)return;let a=`${e}${n}`;if(o.has(a))return;o.add(a);let l=t.get(e),d=l?.moduleBindings?.get(n),c=l?.topLevel.get(n);if(c!==void 0)return!r||d==="def"?c:void 0;let f=s.get(e),p=f?.names.get(n);if(p!==void 0)return r&&(d!=="import"||l?.aliases.get(n)?.rows!==1)?void 0:pt(p.moduleId,p.name,t,s,r,o,i+1);if(!r)for(let u of f?.stars??[]){if(!Um(t.get(u),n))continue;let m=pt(u,n,t,s,!1,o,i+1);if(m!==void 0)return m}}var Rs={ids:[],resolution:"unresolved",how:"none"};function ad(e,n){let t=n.byMethodName.get(e)??[];return t.length===0||t.length>Gm?Rs:{ids:t,resolution:"field-based",how:"name-match"}}function pE(e,n,t){for(let s=n;s!==null&&s!=="";){if(t.byQualname.has(s)){let o=t.nested.get(s)?.get(e);if(o!==void 0)return{kind:"def",id:o};if(t.paramNames.get(s)?.has(e)===!0)return{kind:"param"}}let r=s.lastIndexOf(".");s=r<0?null:s.slice(0,r)}return{kind:"none"}}function mE(e,n,t,s){let[r,...o]=e.split(".");if(r===void 0||r==="")return;let i=n?.modules.get(r);for(let a of o){if(i===void 0)return;i=t.get(i)?.modules.get(a)??s.get(i)?.get(a)}return i}function gE(e,n,t,s,r,o,i){let a=e.attr,l=e.nameScope;if(a===null){if(e.callee===null||e.receiver!==null)return Rs;let f=e.callee,p=pE(f,e.enclosingFunction,t);if(l==="local-def"&&p.kind==="def")return Si({ids:[p.id],resolution:"resolved",how:"local"},i,null);let u=hE(f,p,n,t,s,r,o);if(l!=="module")return ds(u);let m=pt(n,f,r,o,!0);if(m!==void 0&&u.ids[0]===m)return Si({ids:[m],resolution:"resolved",how:"bare"},i,f);if(u.ids.length>0)return ds(u);let g=dr(n,f,r,o);if(g!==void 0)return i.construct(g);let y=Dm(n,f,r,o);return y===void 0?Rs:Fm(i.construct(y))}if(e.receiver===null)return ad(a,i);let d=e.receiver;if(Uv.has(d)&&e.enclosingFunction!==null){let f=e.enclosingFunction.split(".").slice(0,-1).join("."),p=t.classByName.get(f);if(p!==void 0){let u=i.selfTargets(p,a),m=t.byQualname.get(e.enclosingFunction),g=m===void 0?"other":i.decoration(m),y=e.root==="param0"&&(g==="none"||g==="classmethod");return u.resolution==="unresolved"||!y?ds(u):Si(u,i,a)}}let c=mE(d,s,o,i.children);if(c!==void 0){let f=d.split("."),p=f[0]??d,u=l==="module"&&t.moduleBindings?.get(p)==="import"&&t.aliases.get(p)?.rows===1&&f.slice(1).every(S=>!i.written(S)),m=pt(c,a,r,o);if(m!==void 0){let S={ids:[m],resolution:"resolved",how:"module"};return u&&pt(c,a,r,o,!0)===m?Si(S,i,a):ds(S)}let g=ad(a,i),y=u&&Vm(d,t,s)===c,b=y?dr(c,a,r,o):void 0;if(b===void 0){let S=y?Dm(c,a,r,o):void 0;if(S===void 0)return ds(g);let k=Fm(i.construct(S));return g.ids.length===0?k:{ids:[...new Set([...k.ids,...g.ids])],resolution:"unresolved",how:"construct"}}let _=i.construct(b);return g.ids.length===0?_:{ids:[...new Set([..._.ids,...g.ids])],resolution:_.resolution==="unresolved"?"unresolved":"field-based",how:"construct",classId:b}}return ad(a,i)}function hE(e,n,t,s,r,o,i){if(n.kind==="def")return{ids:[n.id],resolution:"resolved",how:"local"};let a=s.topLevel.get(e);if(a!==void 0)return{ids:[a],resolution:"resolved",how:"bare"};let l=r?.names.get(e),d=l!==void 0?pt(l.moduleId,l.name,o,i):pt(t,e,o,i);return d!==void 0?{ids:[d],resolution:"resolved",how:"bare"}:Rs}function ds(e){return e.ids.length===0?Rs:{...e,resolution:"unresolved"}}function Fm(e){let{classId:n,...t}=e;return ds(t)}function Si(e,n,t){return e.ids.some(r=>{let o=n.decoration(r);return o!=="none"&&o!=="staticmethod"&&o!=="classmethod"})||t!==null&&n.written(t)?ds(e):e}var wn={direct:new Set,convention:"unknown"};function jm(e,n,t){return e!==void 0&&n.ids.length===1&&n.ids[0]===e&&t.get(e)==="function"?{direct:new Set([e]),convention:"direct"}:wn}function Bm(e){return e.length>0&&e.every(n=>n==="instance-method")?"shifted":e.length>0&&e.every(n=>n==="class-method"||n==="static-method")?"direct":"unknown"}function yE(e,n,t,s,r){if(e.root!==(s.how==="self"?"param0":"global"))return wn;let o=r.envs.get(n);switch(s.how){case"bare":return e.callee===null?wn:jm(pt(n,e.callee,r.decls,r.envs,!0),s,r.kindOf);case"module":{let i=e.receiver===null?void 0:t.aliases.get(e.receiver),a=e.receiver===null?void 0:o?.modules.get(e.receiver);return e.receiver===null||e.attr===null||a===void 0||t.moduleBindings?.get(e.receiver)!=="import"||i?.rows!==1||!i.exactModule?wn:jm(pt(a,e.attr,r.decls,r.envs,!0),s,r.kindOf)}case"self":{let i=e.attr,a=e.enclosingFunction===null?void 0:t.byQualname.get(e.enclosingFunction),l=a===void 0?void 0:r.kindOf.get(a);if(i===null||l!=="instance-method"&&l!=="class-method")return wn;let d=(e.enclosingFunction??"").split(".").slice(0,-1).join("."),c=t.classByName.get(d),f=t.methods.get(d)?.get(i);if(c===void 0||f===void 0||!s.ids.includes(f))return wn;let p=[];for(let y of s.ids){let b=r.kindOf.get(y);if(b===void 0||b==="function")return wn;p.push(b)}let u=r.below(c),m=r.above(c);for(let y of u){if(y===c)continue;let b=r.nonDefBinds.get(y);if(r.multiBase.has(y)||r.rewrites.has(y)||r.intercepts.has(y)||b===void 0||b===null||b.has(i))return wn;let _=r.classOwner.get(y),S=_?.classQualname.get(y),k=S===void 0?void 0:_?.methods.get(S)?.get(i);if(k!==void 0&&!s.ids.includes(k))return wn}for(let y of m)if(r.intercepts.has(y))return wn;if(r.unplaced.has(c)&&r.intercepts.size>0)return wn;let g=y=>u.has(y)||m.has(y);return r.unplacedAnyName.some(y=>!g(y))||(r.unplacedByName.get(i)??[]).some(y=>!g(y))?wn:{direct:new Set(s.ids),convention:l==="instance-method"?"direct":Bm(p)}}case"name-match":{let i=e.receiver===null||e.receiver.includes(".")?void 0:bE(e.receiver,t,o,r.decls),a=i===void 0?void 0:r.classOwner.get(i),l=i===void 0?void 0:a?.classQualname.get(i),d=l===void 0||e.attr===null?void 0:a?.methods.get(l)?.get(e.attr),c=d===void 0?void 0:r.kindOf.get(d);return d===void 0||c===void 0||c==="function"||!s.ids.includes(d)?wn:{direct:new Set([d]),convention:Bm([c])}}default:return wn}}function bE(e,n,t,s){let r=n.moduleBindings?.get(e);if(r==="class")return n.classByName.get(e);let o=t?.names.get(e);if(r!=="import"||o===void 0||n.aliases.get(e)?.rows!==1)return;let i=s.get(o.moduleId);return i?.moduleBindings?.get(o.name)==="class"?i.classByName.get(o.name):void 0}function _E(e,n,t,s=[]){let r=n.args,o=t==="shifted"&&r?.[0]?.kind!=="positional"?"unknown":t;return{...r!==null?{args:r.map((i,a)=>SE(e,i,a,s[a]===!0)),convention:o}:{},...n.receiverRange!==null?{receiverRange:lr(e,n.receiverRange)}:{},repeats:n.repeats}}function SE(e,n,t,s){return{index:t,...n.kind==="keyword"&&n.keyword!==void 0?{keyword:n.keyword}:{},spread:n.kind==="star"?"positional":n.kind==="double-star"?"keyword":!1,range:lr(e,n),...s?{primitive:!0}:{}}}function xE(e){return e===void 0?{}:{calleeDecl:e.calleeDecl,...e.runtimeId!==void 0?{runtimeId:e.runtimeId}:{},...e.summary!==void 0?{summary:e.summary}:{},...e.receiverPrimitive===!0?{receiverPrimitive:!0}:{}}}var kE=8,wE=new Set(["__new__","__init_subclass__","__class_getitem__"]),Ei=e=>e.map(n=>n.name+"()".repeat(n.calls)).join(".");function vE(e){let n=/^(~|\.*)(.*)$/u.exec(e);if(n===null)return null;let t=[];for(let s of(n[2]??"").split(".")){let r=s.replace(/(?:\(\))+$/u,"");if(r==="")return null;t.push({name:r,calls:(s.length-r.length)/2})}return{lead:n[1]??"",segs:t}}function EE(e){let n=new Map,t=e.moduleBindings;if(t===null)return n;for(let s of e.imports)if(!(s.enclosingFunction!==null||s.guards.includes("type-checking")))for(let r of s.names){let o=r.name.split(".")[0]??r.name,i=r.asname??(s.form==="import"?o:r.name);if(t.get(i)!=="import")continue;let a=s.form==="import"?r.asname!==null?r.name:o:`${".".repeat(s.level)}${s.module!==null&&s.module!==""?`${s.module}.`:""}${r.name}`;n.set(i,a)}return n}function Qm(e,n){let t=new Map;for(let[u,m]of n.modules){let g=new Map;for(let b of m.file.functions)g.set(b.qualname,(g.get(b.qualname)??0)+1);let y=new Map(m.file.functions.filter(b=>g.get(b.qualname)===1).map(b=>[b.qualname,b]));t.set(u,{...m,id:u,imports:EE(m.file),rows:y})}let s=(u,m,g=0)=>{if(g>kE)return null;let y=vE(u);if(y===null)return null;if(y.lead==="~"){let[_,...S]=y.segs;return _===void 0?null:r(m,_,S,g)}let b=y.segs;if(y.lead.length>0){let _=bi(m.dotted,m.isPackage),S=_===""?[]:_.split("."),k=y.lead.length-1;if(k>=S.length)return null;b=[...S.slice(0,S.length-k).map(v=>({name:v,calls:0})),...b]}for(let _=b.length;_>=1;_-=1){if(b.slice(0,_).some(I=>I.calls>0))continue;let S=n.byDotted.get(Ei(b.slice(0,_)));if(S===void 0)continue;let k=t.get(S);if(k===void 0||!k.app)return{kind:"name",text:Ei(b)};let v=b[_];return v===void 0?null:r(k,v,b.slice(_+1),g)}return{kind:"name",text:Ei(b)}},r=(u,m,g,y)=>{let b="()".repeat(m.calls)+g.map(I=>`.${Ei([I])}`).join(""),_=u.file.moduleOrigins?.get(m.name);if(_!==void 0)return s(_+b,u,y+1);let S=u.imports.get(m.name);if(S!==void 0)return s(S+b,u,y+1);let k=u.file.moduleBindings?.get(m.name);if(k==="def"&&m.calls===0){let I=u.decls.topLevel.get(m.name),O=u.rows.get(m.name);return I===void 0||O===void 0?null:{kind:"function",module:u,id:I,row:O,rest:g}}if(k==="class"&&u.decls.classByName.has(m.name))return{kind:"class",module:u,qualname:m.name,calls:m.calls,rest:g};let v=u.file.annotatedAliases?.get(m.name);return v!==void 0&&m.calls===0&&g.length===0?{kind:"annotated",module:u,value:v}:null},o=(u,m)=>{if(u===null)return null;let g=s(u,m);return g?.kind==="name"?g.text:null},i=(u,m)=>u!==null&&m.includes(u),a=(u,m,g)=>u!==null&&m.some(y=>g.some(b=>u===`${y}.${b}()`)),l=new Map,d=new Set,c=(u,m,g)=>{let y=l.get(u);y===void 0?l.set(u,{row:m,regs:[g]}):y.regs.push(g)};for(let u of t.values()){for(let m of u.file.functions){let g=m.decoratorFacts;if(g===null||g.length===0||m.method||m.params===null)continue;let y=u.decls.byQualname.get(m.qualname);if(y===void 0||u.rows.get(m.qualname)!==m)continue;let b=g.map(S=>o(S.origin,u)),_=S=>{let k=b[S]??null;return a(k,zn.apps,zn.decorators)?zn:a(k,Jn.apps,Jn.decorators)?Jn:null};g.forEach((S,k)=>{let v=_(k);if(v===null)return;d.add(y);for(let E=k+1;E<g.length;E+=1)if(_(E)===null)return;let I={path:u.path,start:S.start,end:S.end},O=v===zn?Xm(m,u,s):Ym(m,S.rule);c(y,m,{model:v,at:I,params:O,form:"decorator"})})}for(let m of u.file.calls){let g=m.registration;if(g===null||m.args===null||m.args.length!==g.args.length)continue;let y=o(g.callee,u);if(y===null)continue;let b={path:u.path,start:m.range.start,end:m.range.end},_=(k,v)=>AE(m,k,v),S=k=>{let v=k===null?null:g.args[k]?.origin??null,I=v===null?null:s(v,u);return I?.kind!=="function"||I.rest.length!==0?null:(I.row.decoratorFacts??[null]).length===0?{id:I.id,row:I.row,ctx:I.module}:null};if(zn.apps.some(k=>y===`${k}.${zn.addRoute}`)){let k=S(_("endpoint",1));k!==null&&c(k.id,k.row,{model:zn,at:b,params:Xm(k.row,k.ctx,s),form:"call"})}else if(Jn.apps.some(k=>y===`${k}.${Jn.addRule}`)){let k=S(_("view_func",2)),v=_("rule",0);k!==null&&c(k.id,k.row,{model:Jn,at:b,params:Ym(k.row,v===null?null:g.args[v]?.literal??null),form:"call"})}else if(i(y,Nn.paths)||i(y,Nn.regexes)){let k=i(y,Nn.regexes),v=_("route",0),I=v===null?null:g.args[v]?.literal??null,O=_("view",1),E=O===null?null:g.args[O]?.origin??null,N=E===null?null:s(E,u);if(N?.kind==="function"&&N.rest.length===0&&CE(N.row,N.module,o))c(N.id,N.row,{model:Nn,at:b,params:Jm(N.row,0,I,k),form:"call"});else if(N?.kind==="class"&&N.calls===0&&N.rest.length===1&&N.rest[0]?.name==="as_view"&&N.rest[0].calls===1){let A=N.module.decls.methods.get(N.qualname);for(let U of Nn.methods){let $=A?.get(U),W=N.module.rows.get(`${N.qualname}.${U}`);$===void 0||W===void 0||W.decorated!=="none"||c($,W,{model:Nn,at:b,params:Jm(W,1,I,k),form:"call"})}}}}}let f=[];for(let[u,{regs:m}]of l)for(let g of m)f.push({handler:u,at:g.at,form:g.form});return{functions:e.map(u=>{let m=l.get(u.id),g=m?.row??IE(u,t),y=u;if(m!==void 0){let b=RE(m.row,m.regs);b.length>0&&(y={...y,sourceParams:b})}if(y.valueFlows===void 0&&g!==void 0&&g.valueFlows!==null){let _=m!==void 0||d.has(u.id)||g.valueFlows.some(S=>S.from.kind==="source")?NE(g):null;_!==null&&(y={...y,valueFlows:_})}return y}),registrations:f}}function AE(e,n,t){let s=e.args??[],r=s.findIndex(i=>i.kind==="keyword"&&i.keyword===n);if(r>=0)return r;let o=0;for(let i=0;i<s.length;i+=1){let a=s[i];if(a===void 0)break;if(a.kind==="star"||a.kind==="double-star")return null;if(a.kind==="positional"){if(o===t)return i;o+=1}}return null}function IE(e,n){let t=n.get(e.moduleId);if(t===void 0)return;let s=e.id.slice(`${e.moduleId}#`.length);return t.decls.byQualname.get(s)===e.id?t.rows.get(s):void 0}function NE(e){if(e.params===null)return null;let n;if(!e.method)n="none";else if(e.decorated==="staticmethod")n="none";else if(e.decorated==="none"&&!wE.has(e.name)||e.decorated==="classmethod")n="first";else return null;if(n==="first"){let t=e.params[0];if(t===void 0||t.kind!=="positional"&&t.kind!=="positional-only")return null}return oo(e.valueFlows,n,e.params.length)}function RE(e,n){let t=e.method&&e.decorated!=="staticmethod"?1:0,s=new Map,r=[...n].sort((o,i)=>o.at.path.localeCompare(i.at.path)||o.at.start-i.at.start);for(let o of r)for(let i of[...o.params].sort((a,l)=>a-l)){let a=i-t;a<0||s.has(a)||s.set(a,{index:a,sourceClass:o.model.sourceClass,model:o.model.id,registeredAt:o.at})}return[...s.values()].sort((o,i)=>o.index-i.index)}function Xm(e,n,t){let s=new Set,r=(a,l)=>{if(a===null)return null;let d=t(a,l);return d?.kind==="name"?d.text:null},o=(a,l)=>a!==null&&zn.depends.includes(r(a.callee,l)??""),i=(a,l)=>zn.schemes.includes(r(a.arg0,l)??"");return(e.params??[]).forEach((a,l)=>{let d=e.paramFacts?.[l]??null;if(d===null){s.add(l);return}let c=d.annotated!==null?{value:d.annotated,from:n}:null;if(c===null&&d.annotation!==null){let u=t(d.annotation,n);u?.kind==="annotated"&&(c={value:u.value,from:u.module})}let f=c!==null?r(c.value.type,c.from):r(d.annotation,n),p=[];o(d.default,n)&&d.default!==null&&p.push({call:d.default,from:n});for(let u of c?.value.meta??[])u!==null&&c!==null&&o(u,c.from)&&p.push({call:u,from:c.from});if(p.length>0){p.some(m=>i(m.call,m.from)||m.call.arg0===null&&zn.forms.includes(f??""))&&s.add(l);return}zn.injected.includes(f??"")||s.add(l)}),s}var OE=/<(?:[a-zA-Z_][a-zA-Z0-9_]*(?:\([^)]*\))?:)?([a-zA-Z_][a-zA-Z0-9_]*)>/gu;function Ym(e,n){let t=n===null?null:new Set([...n.matchAll(OE)].map(s=>s[1]));return Zm(e,0,t)}function Jm(e,n,t,s){let r=e.params??[],o=r[n];if(o===void 0||o.kind!=="positional"&&o.kind!=="positional-only")return new Set;let i=new Set([n]);if(t===null)return r.forEach((c,f)=>{f>n&&i.add(f)}),i;let a=s?[...t.matchAll(/\(\?P<([^>]+)>/gu)].map(c=>c[1]):[...t.matchAll(/<(?:[^>:]+:)?([^>]+)>/gu)].map(c=>c[1]);if(a.length>0){for(let c of Zm(e,n+1,new Set(a)))i.add(c);return i}let l=s?[...t.matchAll(/(?<!\\)\((?!\?)/gu)].length:0,d=0;return r.forEach((c,f)=>{f<=n||d>=l||(c.kind==="positional"||c.kind==="positional-only"?(i.add(f),d+=1):c.kind==="rest"&&(i.add(f),d=l))}),i}function Zm(e,n,t){let s=new Set,r=t===null||t.size>0;return(e.params??[]).forEach((o,i)=>{i<n||(o.kind==="keyword-rest"?r&&s.add(i):(o.kind==="positional"||o.kind==="keyword-only")&&(t===null||t.has(o.name))&&s.add(i))}),s}var PE=new Set([...Nn.passThrough,Nn.apiView,...Nn.apiViewSetters]);function CE(e,n,t){let s=e.decoratorFacts;return s===null?!1:s.every(r=>PE.has(t(r.origin,n)??""))}var ME=5e3,eg=200,ng=100,TE=new Set(["args","params","flows"]),tg={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function sg(e){return`pkg:${e}`}function At(e){return e.split(/[\\/]+/u).join("/")}function gd(e,n){let t=e.endsWith("/")?e:`${e}/`,s=At(n),r=At(t);return s.startsWith(r)?s.slice(r.length):null}function rg(e){let n=At(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let s=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),s].filter(r=>r!=="").join("."),isPackage:!1}}function hd(e){return e.split(".")[0]??e}var $E="site-packages:";function yd(e){let n=e.extract??cr,t=e.maxModules??ME,s=(e.externalRoots??[]).map(R=>At(R).endsWith("/")?At(R):`${At(R)}/`),r=R=>{let D=At(R);return s.find(Y=>D.startsWith(Y))??null},o=R=>r(R)!==null,i=[],a=new Map,l=[],d=[],c=new Set,f=new Set,p=new Map,u=new Map,m=[],g=[],y=new Map,b=new Set,_=new Set,S=[],k=0,v=()=>{let R=`py-export:${String(k)}`;return k+=1,R},I=null,O=!1,E=new Set,N=new Set,A=new Map,U=new Map,$=Em(R=>{let D=Wt(e.paths,R).resolved;return D!==null&&gd(e.projectRoot,D.path)!==null&&!o(D.path)}),W=new Map,w=[];for(let R of e.entryFiles){let D=gd(e.projectRoot,R);if(D===null){i.push({code:"unresolved-import",where:At(R),detail:"entrypoint lies outside the project root; not analyzed"});continue}c.has(R)||(c.add(R),w.push({file:R,rel:D,isEntry:!0,packageName:"",modulePath:D}))}let P=R=>{let D=sg(R);return a.has(D)||(f.add(R),a.set(D,{id:D,packageName:R,versionRange:"",path:R,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),D},j=0,F=(R,D,Y,H)=>{let ee=`py-import:${String(j)}`;j+=1,l.push({id:ee,moduleId:R,specifier:D,...Y!==null?{resolvedModuleId:Y}:{},isNamespace:!1,isDefault:!1,dynamic:H,specifierIsLiteral:!0}),Y!==null&&d.push({importId:ee,resolvedModuleId:Y})};for(let R=0;R<ng&&w.length>0;R+=1){let D=w.slice(0,eg);w=w.slice(eg);let Y=n(D.map(ee=>ee.file),e.python!==void 0?{python:e.python,hints:$}:{hints:$});if(I??=Y.interpreter,E.size===0&&Y.stdlib.length>0&&(E=new Set(Y.stdlib)),N.size===0&&Y.builtins.length>0&&(N=new Set(Y.builtins)),A.size===0&&Y.typeAttrs.size>0&&(A=Y.typeAttrs),Y.refused!==null)return i.push({code:"extract-refused",where:"",detail:`${Y.refused}: ${Y.diagnostics.join("; ")}`}),{graph:tg,diagnostics:i,interpreter:Y.interpreter,counts:{modules:0,surfaces:0},opaqueCode:[]};let H=new Map(Y.files.map(ee=>[ee.path,ee]));for(let ee of D){let le=H.get(ee.file),de=ee.rel,ge=rg(ee.modulePath);if(U.set(de,ge),a.set(de,{id:de,packageName:ee.packageName,versionRange:"",path:ee.modulePath,moduleSystem:"dual",isEntrypoint:ee.isEntry}),le===void 0||le.refused!==null){i.push({code:"file-refused",where:ee.rel,detail:le?.refused??"no row was returned for this file"});continue}B(le,de,ge),x(le,ee.rel);let ve=le.truncated.filter(Re=>!TE.has(Re));ve.length>0&&i.push({code:"extract-truncated",where:ee.rel,detail:`the extract stopped at its per-file bound for ${ve.join(", ")}; what lies past it is not in this graph`}),p.set(de,cd(le,de,ee.rel,v)),u.set(de,Z(le,de,ge)),W.set(de,{file:le,decls:p.get(de),dotted:ge.dotted,isPackage:ge.isPackage,app:ee.packageName==="",path:ee.rel});for(let Re of le.calls)m.push({moduleId:de,path:ee.rel,call:Re});for(let Re of le.escapes){if(Re.kind!=="attr-rebind")continue;let _e=Re.attr??null;_e===null||Re.target===null||S.push({moduleId:de,attr:_e,target:Re.target})}}}function B(R,D,Y){for(let H of R.imports){if(H.guards.includes("type-checking"))continue;let ee=[];if(H.level>0){let ge=rr(Y.dotted,Y.isPackage,H.level,H.module);if("failure"in ge){i.push({code:"unresolved-import",where:R.path,detail:`relative import (level ${String(H.level)}) ${ge.failure}`});continue}ee.push(ge.dotted);for(let ve of H.names)ee.push(`${ge.dotted}.${ve.name}`)}else if(H.module!==null){ee.push(H.module);for(let ge of H.names)ee.push(`${H.module}.${ge.name}`)}else continue;let le=!1,de=new Set;for(let ge of ee)ne(ge,D,H.deferred,de)&&(le=!0);if(de.size>0&&g.push({moduleId:D,path:D,enclosingFunction:H.enclosingFunction,at:H.range.start,shape:"require",targets:[...de]}),!le){let ge=ee[0]??"";F(D,ge,null,H.deferred);let ve=hd(ge);if(E.has(ve)||H.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf(ve)===null)continue;i.push({code:"unresolved-import",where:R.path,detail:`\`${ge}\` did not resolve on the search path`})}}}function ne(R,D,Y,H){let ee=R.split("."),le=!1;for(let de=1;de<=ee.length;de+=1){let ge=ee.slice(0,de).join("."),ve=Wt(e.paths,ge);if(ve.resolved===null)continue;let Re=Q(ve.resolved,D,ge,Y);Re!==null&&H.add(Re),de===ee.length&&(le=!0)}return le}function X(R){return c.has(R.file)||a.has(R.rel)?!0:c.size>=t?(O||(O=!0,i.push({code:"module-cap",where:R.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(c.add(R.file),w.push(R),!0)}function Q(R,D,Y,H){if(R.kind==="stub-only")return null;let ee=R.kind==="module"||R.kind==="package",le=gd(e.projectRoot,R.path);if(le!==null&&!o(R.path)&&ee){let Re=le;return F(D,Y,Re,H),y.set(Y,Re),X({file:R.path,rel:le,isEntry:!1,packageName:"",modulePath:le}),Re}let de=e.distributionOf(hd(Y));if(de===null)return F(D,Y,null,H),i.push({code:"unresolved-import",where:Y,detail:`resolved to ${R.kind} outside the project, but no installed distribution provides \`${hd(Y)}\``}),null;let ge=r(R.path);if(!ee||ge===null)return F(D,Y,P(de),H),b.add(Y),(R.kind==="extension"||ee&&ge===null)&&_.add(Y),null;let ve=`${$E}${At(R.path).slice(ge.length)}`;return F(D,Y,ve,H),y.set(Y,ve),X({file:R.path,rel:ve,isEntry:!1,packageName:de,modulePath:At(R.path).slice(ge.length)}),ve}function Z(R,D,Y){let H=new Map,ee=new Map,le=new Set,de=new Map,ge=(_e,Ke)=>{le.add(_e),de.set(_e,Ke)},ve=[],Re=_e=>E.has(_e.split(".")[0]??_e)||b.has(_e);for(let _e of R.imports){if(_e.guards.includes("type-checking"))continue;let Ke=_e.module;if(_e.level>0){let ze=rr(Y.dotted,Y.isPackage,_e.level,_e.module);if("failure"in ze)continue;Ke=ze.dotted}if(Ke!==null){if(_e.star){let ze=y.get(Ke);ze!==void 0&&!ve.includes(ze)&&ve.push(ze)}if(_e.form==="import"){let ze=_e.names[0]?.asname??null;if(ze!==null){let K=y.get(Ke);K!==void 0?H.set(ze,K):Re(Ke)&&ge(ze,Ke);continue}let pn=Ke.split(".")[0]??Ke,vn=y.get(pn)??y.get(Ke);vn!==void 0?H.set(pn,vn):Re(pn)&&ge(pn,pn);continue}for(let ze of _e.names){let pn=ze.asname??ze.name,vn=y.get(`${Ke}.${ze.name}`);if(vn!==void 0){H.set(pn,vn);continue}let K=y.get(Ke);K!==void 0?ee.set(pn,{moduleId:K,name:ze.name}):(Re(Ke)||Re(`${Ke}.${ze.name}`))&&ge(pn,`${Ke}.${ze.name}`)}}}return H.set("",D),{modules:H,names:ee,external:le,externalOrigins:de,stars:ve}}function x(R,D){for(let Y of R.escapes)switch(Y.kind){case"loader-escape":i.push({code:"loader-escape",where:D,detail:`${Y.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":i.push({code:"dynamic-load-set",where:D,detail:`${Y.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":i.push({code:"module-registry-write",where:D,detail:`${Y.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let H=Y.target;if(H===null)break;let ee=new Set;ne(H,D,!0,ee),ee.size>0&&g.push({moduleId:D,path:D,enclosingFunction:Y.enclosingFunction,at:Y.range.start,shape:"dynamic-import",targets:[...ee]});break}case"dispatch-escape":break}}w.length>0&&i.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(ng)} waves; the graph is INCOMPLETE`});let T=new Map;for(let[R,D]of y){let Y=R.lastIndexOf(".");if(Y<0)continue;let H=y.get(R.slice(0,Y));if(H===void 0||H===D)continue;let ee=T.get(H)??new Map;ee.set(R.slice(Y+1),D),T.set(H,ee)}let q=ud({decls:p,envs:u,pending:m,rebinds:S,loads:g,children:T,preciseNames:e.preciseNames!==!1,...e.nameMatchLabel===!0?{nameMatchLabel:!0}:{},runtime:{builtins:N,typeAttrs:A,stdlib:E,placed:R=>{let D=y.get(R);return D!==void 0?{kind:"module",id:D}:b.has(R)?{kind:"surface"}:null},packageOf:R=>a.get(R)?.packageName,dottedOf:R=>U.get(R)}}),{functions:G,registrations:z}=Qm(q.functions,{modules:W,byDotted:y}),L=new Map;for(let R of q.callSites)R.id.startsWith("py-call:")&&L.set(`${R.range.path}${String(R.range.start)}${String(R.range.end)}`,R.id);let ie=[],me=new Set;for(let R of z){let D=R.form==="decorator"?R.at.end:R.at.start,Y=L.get(`${R.at.path}${String(D)}${String(R.at.end)}`);Y===void 0||me.has(`${Y}${R.handler}`)||(me.add(`${Y}${R.handler}`),ie.push({callSiteId:Y,calleeFunctionId:R.handler,resolution:"field-based",invocation:"callback"}))}let be=[...p.values()].flatMap(R=>R.classes),Me=[...p.values()].flatMap(R=>R.exports),re=[...p.values()].flatMap(R=>R.exportBindings);return{graph:{...tg,modules:[...a.values()],imports:l,importEdges:d,functions:G,classes:be,exports:Me,exportBindings:re,callSites:q.callSites,callEdges:[...q.callEdges,...ie],inheritEdges:q.inheritEdges},diagnostics:i,interpreter:I,counts:{modules:a.size-f.size,surfaces:f.size},opaqueCode:[..._].sort()}}import{readdirSync as LE,readFileSync as ig,statSync as Ai}from"node:fs";import On from"node:path";import{spawnSync as DE}from"node:child_process";var FE="python3",jE=256*1024,BE=8*1024*1024,ag=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,GE=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function cs(e){try{return Ai(e).isFile()}catch{return!1}}function og(e){try{return Ai(e).isDirectory()}catch{return!1}}function KE(e,n){return On.relative(e,n).split(On.sep).join("/")}function zE(e){let n=e.python??process.env.CUPEL_PYTHON??FE,t=DE(n,["-I","-S",...so("metadata.py"),e.projectRoot],{encoding:"utf8",maxBuffer:BE,timeout:6e4}),s=l=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:l}]});if(t.error!==void 0||t.status!==0)return s("the declared entry surface could not be read; it is unknown, not empty");let r;try{r=JSON.parse(t.stdout)}catch{return s("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof r!="object"||r===null)return{entries:[],projectName:null,gaps:[]};let o=r,i=(Array.isArray(o.entryPoints)?o.entryPoints:[]).filter(l=>typeof l=="object"&&l!==null&&typeof l.name=="string"&&typeof l.target=="string"&&typeof l.kind=="string"),a=(Array.isArray(o.gaps)?o.gaps:[]).flatMap(l=>{if(typeof l!="object"||l===null)return[];let d=l,c=typeof d.file=="string"?d.file:"",f=typeof d.why=="string"?d.why:"";return[{source:"metadata",declaration:c,detail:f==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":f}]});return{entries:i,gaps:a,projectName:typeof o.projectName=="string"?o.projectName:null}}function bd(e,n){let t=ag.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let s=t[1]??"",r=Wt(e.paths,s);if(r.resolved===null)return{detail:`\`${s}\` ${r.failure??"did not resolve"}`};if(r.resolved.kind==="namespace"||r.resolved.kind==="stub-only")return{detail:`\`${s}\` resolved to a ${r.resolved.kind}, which runs no code`};let o=KE(e.projectRoot,r.resolved.path);return o.startsWith("..")?{detail:`\`${s}\` resolves outside the project root; not seeded`}:{file:o}}function WE(e){let n=[];cs(On.join(e,"__main__.py"))&&n.push("__main__.py");let t=(s,r)=>{let o;try{o=LE(s).sort()}catch{return}for(let i of o){if(i.startsWith("."))continue;let a=On.join(s,i);og(a)&&cs(On.join(a,"__init__.py"))&&cs(On.join(a,"__main__.py"))&&n.push(`${r}${i}/__main__.py`)}};return t(e,""),og(On.join(e,"src"))&&t(On.join(e,"src"),"src/"),n}function UE(e,n){let t=On.join(e,"Procfile");if(!cs(t))return[];let s;try{if(Ai(t).size>n)return[];s=ig(t,"utf8")}catch{return[]}let r=[];for(let o of s.split(/\r?\n/u)){let i=GE.exec(o);i?.[1]!==void 0&&r.push(i[1])}return r}var HE=256*1024,qE=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,VE=/^\s*WORKDIR\s+(\S+)\s*$/imu,XE=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,YE=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,JE=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function QE(e){let n=VE.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let s=XE.exec(t),r=s?.[1],o=s?.[2]?.replace(/\/+$/u,"");if(r===void 0||o===void 0||o!==n)continue;let i=r.replace(/\/+$/u,"");return i==="."?null:i}return null}function ZE(e,n){let t=[],s=o=>{let i=On.join(e,o);if(!cs(i))return null;try{return Ai(i).size>n?null:ig(i,"utf8")}catch{return null}},r=s("Dockerfile");if(r!==null){let o=QE(r);for(let i of r.split(/\r?\n/u)){let a=qE.exec(i);a?.[1]!==void 0&&t.push({command:a[1],from:"Dockerfile",srcRoot:o})}}for(let o of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let i=s(o);if(i!==null)for(let a of i.split(/\r?\n/u)){let l=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(a);l?.[1]!==void 0&&t.push({command:l[1],from:o,srcRoot:null})}}return t}function e0(e,n,t){let s=e.projectRoot,r=JE.exec(n)?.[1];if(r!==void 0){for(let a of t===null?[r]:[On.join(t,r),r])if(cs(On.join(s,a)))return{file:a}}let o=YE.exec(n)?.[1];if(o===void 0)return r===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${r}\` is not a file in this repository`};let i=ag.exec(o)?.[1]??"";for(let a of t===null?[""]:[t,""])for(let l of[`${i.replace(/\./gu,"/")}.py`,`${i.replace(/\./gu,"/")}/__init__.py`]){let d=a===""?l:On.join(a,l);if(cs(On.join(s,d)))return{file:d}}return bd(e,o)}function _d(e){let n=[],t=[],s=new Set,r=(a,l,d)=>{let c=`${a} ${l}`;s.has(c)||(s.add(c),n.push({file:a,source:l,declaration:d}))},o=zE(e);t.push(...o.gaps);for(let a of o.entries){let l=a.kind==="entry-point-group"?"entry-point-group":"console-script",d=bd(e,a.target);"file"in d?r(d.file,l,`${a.name} = ${a.target}`):t.push({source:l,declaration:`${a.name} = ${a.target}`,detail:d.detail})}for(let a of WE(e.projectRoot))r(a,"dunder-main",a);cs(On.join(e.projectRoot,"manage.py"))&&r("manage.py","manage-py","manage.py");let i=e.maxProcfileBytes??jE;for(let a of UE(e.projectRoot,i)){let l=bd(e,a);"file"in l?r(l.file,"launch-declaration",a):t.push({source:"launch-declaration",declaration:a,detail:l.detail})}for(let a of ZE(e.projectRoot,HE)){let l=e0(e,a.command,a.srcRoot),d=`${a.from}: ${a.command.trim()}`;"file"in l?r(l.file,"launch-declaration",d):t.push({source:"launch-declaration",declaration:d,detail:l.detail})}return{entrypoints:n,gaps:t,projectName:o.projectName}}var H$=256*1024*1024;var lg="CUPEL_PYTHON",t0=["-I","-S"],s0="python3",r0=256*1024*1024,o0=12e4,i0=512,dg=2e4,pg=new Set(["str","bytes","int","float","complex","bool","none","scalar","tuple","list","dict","set"]),a0=new Set(["module","local-def","local","class"]);function we(e,n=i0){return typeof e=="string"&&e.length<=n?e:null}function Os(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function lo(e){let n=Pn(e)?e:{};return{line:Os(n.line),endLine:Os(n.endLine),col:Os(n.col),start:Os(n.start),end:Os(n.end)}}function Pn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function us(e){return Array.isArray(e)?e:[]}function ur(e){return us(e).map(n=>we(n))}function fs(e,n){return Number.isSafeInteger(e)&&Number.isSafeInteger(n)&&e>=0&&n>=e?{start:e,end:n}:null}var l0={o:"positional-only",p:"positional",r:"rest",k:"keyword-only",K:"keyword-rest"},d0={p:"positional",s:"star",k:"keyword",d:"double-star"};function fr(e,n){if(!Array.isArray(e))return null;let t=[];for(let s of e){let r=Array.isArray(s)?n(s):null;if(r===null)return null;t.push(r)}return t}function c0(e){return fr(e,([n,t,s,r,o])=>{let i=typeof n=="string"?l0[n]:void 0,a=we(t),l=fs(r,o);return i===void 0||a===null||a===""||typeof s!="boolean"||l===null?null:{kind:i,name:a,hasDefault:s,...l}})}function u0(e){return fr(e,([n,t,s,r])=>{let o=typeof n=="string"?d0[n]:void 0,i=fs(t,s);if(o===void 0||i===null)return null;if(o!=="keyword")return r===void 0?{kind:o,...i}:null;let a=we(r);return a!==null&&a!==""?{kind:o,keyword:a,...i}:null})}var f0=new Set(["def","class","import","other","multi"]);function cg(e){if(!Pn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e))we(t)!==null&&typeof s=="string"&&f0.has(s)&&n.set(t,s);return n}var p0=new Map([["c","copy"],["d","derive"],["f","field"],["w","await"],["r","return"],["a","argument"],["m","mutation"]]),m0=new Map([["m","module"],["g","global"],["u","unknown"]]),g0=new Set(["unmodeled","reflective","inner-function-param","caught","construct"]),h0=256;function ug(e,n){return Number.isSafeInteger(e)&&e>=n&&e<h0?e:null}function y0(e,n){let[t,s,r,o]=e;switch(t){case"p":{let i=e.length===2&&n?ug(s,0):null;return i===null?null:{kind:"declared-param",index:i}}case"l":{let i=we(s);return e.length===3&&i!==null&&i!==""&&Number.isSafeInteger(r)&&r>=0?{kind:"local",name:i,declStart:r}:null}case"f":{let i=we(s),a=m0.get(r);return e.length===3&&i!==null&&i!==""&&a!==void 0?{kind:"free",name:i,binding:a}:null}case"c":case"r":{let i=e.length===3?fs(s,r):null;return i===null?null:{kind:t==="c"?"call-result":"call-receiver",at:i.start,end:i.end}}case"a":case"m":{let i=e.length===4?fs(s,r):null,a=ug(o,t==="m"?-1:0);return i===null||a===null?null:{kind:t==="a"?"argument":"mutated-by-call",at:i.start,end:i.end,index:a}}case"R":return e.length===1?{kind:"return"}:null;case"k":return e.length===1?{kind:"constant"}:null;case"s":{let i=e.length===2?we(s):null;return i===null?null:vm(i)}case"o":return e.length===2&&g0.has(s)?{kind:"opaque",reason:s}:null;default:return null}}function fg(e,n){if(!Pn(e))return null;let t=e.refs,s=e.edges;if(!Array.isArray(t)||!Array.isArray(s)||s.length>dg||t.length>2*dg)return null;let r=fr(t,o=>y0(o,n));return r===null?null:fr(s,([o,i,a])=>{let l=Number.isSafeInteger(o)?r[o]:void 0,d=Number.isSafeInteger(i)?r[i]:void 0,c=p0.get(a);return l===void 0||d===void 0||c===void 0?null:{from:l,to:d,kind:c}})}var b0=/^(?:~|\.*)[^\s.()~]+(?:\(\))*(?:\.[^\s.()~]+(?:\(\))*)*$/u,_0=2048;function ps(e){let n=we(e);return n!==null&&b0.test(n)?n:null}function mg(e){return we(e,_0)}function gg(e){return Array.isArray(e)&&e.length===2?{callee:ps(e[0]),arg0:ps(e[1])}:null}function hg(e){return!Pn(e)||!Array.isArray(e.m)?null:{type:ps(e.t),meta:e.m.map(gg)}}function S0(e){return fr(e,([n,t,s,r])=>{let o=fs(t,s);return o===null?null:{origin:ps(n),rule:mg(r),...o}})}function x0(e){return Array.isArray(e)?e.map(n=>{if(!Array.isArray(n)||n.length!==2)return null;let t=n[1];return{default:gg(n[0]),annotated:hg(t),annotation:Pn(t)?ps(t.o):null}}):null}function k0(e){if(!Array.isArray(e)||e.length!==2||!Array.isArray(e[1]))return null;let n=e[1].map(t=>Array.isArray(t)?{origin:ps(t[0]),literal:mg(t[1])}:{origin:null,literal:null});return{callee:ps(e[0]),args:n}}function Sd(e,n){if(!Pn(e))return null;let t=new Map;for(let[s,r]of Object.entries(e)){let o=n(r);we(s)!==null&&o!==null&&t.set(s,o)}return t}var w0=/^(?:~|\.*)[^\s.()~]+(?:\.[^\s.()~]+)*$/u;function v0(e){let n=we(e);return n!==null&&w0.test(n)?n:null}function yg(e){if(!Array.isArray(e)||e.length<1||e.length>2||!pg.has(e[0]))return null;let n=e[0];if(e.length===1)return{type:n};let t=we(e[1]);return t!==null&&t!==""?{type:n,unlessWritten:t}:null}function E0(e,n){return!Array.isArray(e)||n===null||e.length!==n.length?null:e.map(t=>t===null?null:yg(t))}var A0=new Set(["none","staticmethod","classmethod","other"]);function Ii(e){if(!Array.isArray(e))return null;let n=new Set;for(let t of e){let s=we(t);if(s===null)return null;n.add(s)}return n}function I0(e){if(e===!0)return{kind:"lambda"};if(e===!1)return{kind:"const"};if(e===null)return{kind:"other"};let n=we(e);return n!==null&&n!==""?{kind:"name",dotted:n}:null}function N0(e){if(!Array.isArray(e))return null;let n=e,[t,s]=n;if(t==="k"&&n.length===1)return{kind:"const"};if(t==="l"&&n.length===1)return{kind:"lambda"};if(t==="o"&&n.length===1)return{kind:"other"};if(t==="n"&&n.length===2){let r=we(s);return r!==null&&r!==""?{kind:"name",dotted:r}:null}if(t==="p"&&n.length===2&&Array.isArray(s)){let r=[];for(let o of s){let i=I0(o);if(i===null)return null;r.push(i)}return{kind:"property",accessors:r}}return null}function xd(e){return fr(e,([n,t,s])=>{let r=we(n),o=N0(t);return r===null||r===""||o===null||!Number.isSafeInteger(s)||s<0?null:{name:r,value:o,at:s}})}function R0(e){if(!Pn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e)){let r=we(t)===null?null:xd(s);if(r===null)return null;n.set(t,r)}return n}var O0=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),P0=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function C0(e,n){if(n!==null)return[];let t=e.truncated;return Array.isArray(t)?t.map(s=>we(s,64)??"unreadable"):["unreported"]}function M0(e){let n=u0(e.args);return{args:n,calleeOrigin:v0(e.calleeOrigin),receiverProof:yg(e.receiverProof),argProofs:E0(e.argProofs,n)}}function T0(e){let n=we(e.path,4096);if(n===null)return null;let t=e.refused,s=typeof t=="string"&&P0.has(t)?t:null,r=we(e.detail,200),o=us(e.imports).filter(Pn).map(S=>({form:S.form==="import"?"import":"from",module:we(S.module),level:Os(S.level),names:us(S.names).filter(Pn).map(k=>({name:we(k.name)??"",asname:we(k.asname)})).filter(k=>k.name!==""),star:S.star===!0,deferred:S.deferred===!0,enclosingFunction:we(S.enclosingFunction),guards:ur(S.guards).filter(k=>k!==null),range:lo(S.range)})),i=us(e.functions).filter(Pn).flatMap(S=>{let k=we(S.name),v=we(S.qualname);return k===null||v===null?[]:[{name:k,qualname:v,kind:S.kind==="async-function"?"async-function":"function",enclosingClass:we(S.enclosingClass),enclosingFunction:we(S.enclosingFunction),decorators:ur(S.decorators),range:lo(S.range),params:c0(S.params),method:S.method===!0,decorated:typeof S.decorated=="string"&&A0.has(S.decorated)?S.decorated:"other",rebound:S.rebound!==!1,reflective:S.reflective!==!1,valueFlows:fg(S.flows,!0),decoratorFacts:S0(S.decoratorFacts),paramFacts:x0(S.paramFacts)}]}),a=us(e.classes).filter(Pn).flatMap(S=>{let k=we(S.name),v=we(S.qualname);return k===null||v===null?[]:[{name:k,qualname:v,bases:ur(S.bases),decorators:ur(S.decorators),range:lo(S.range),metaclass:S.metaclass===null?null:we(S.metaclass)??"?",rebound:S.rebound!==!1,interceptsLookup:S.interceptsLookup!==!1,nonDefBinds:Ii(S.nonDefBinds),valueBases:Array.isArray(S.valueBases)?ur(S.valueBases):null}]}),l=us(e.calls).filter(Pn).map(S=>({...M0(S),callee:we(S.callee),attr:we(S.attr),receiver:we(S.receiver),enclosingFunction:we(S.enclosingFunction),argCount:Os(S.argCount),range:lo(S.range),receiverRange:Array.isArray(S.receiverRange)?fs(S.receiverRange[0],S.receiverRange[1]):null,root:S.root===null?null:S.root==="param0"||S.root==="global"?S.root:"other",nameScope:S.nameScope===null&&S.callee===null?null:a0.has(S.nameScope)?S.nameScope:"local",raisedCall:Array.isArray(S.raisedCall)?fs(S.raisedCall[0],S.raisedCall[1]):null,repeats:S.repeats!==!1,registration:k0(S.registration)})),d=us(e.escapes).filter(Pn).flatMap(S=>{let k=S.kind,v=we(S.callee);return typeof k!="string"||!O0.has(k)||v===null?[]:[{kind:k,callee:v,target:we(S.target),attr:we(S.attr),enclosingFunction:we(S.enclosingFunction),range:lo(S.range)}]}),c=e.all,f=Array.isArray(c)?ur(c).filter(S=>S!==null):null,p=Ii(e.attrWrites),u=R0(e.classBinds),m=xd(e.moduleBinds),g=xd(e.dunderWrites),y=cg(e.moduleBindings),b=C0(e,s),_=u===null&&a.length>0||m===null&&(y===null||y.has("__getattr__")||y.has("__dir__"))||g===null&&(p===null||[...p].some(S=>/^__.+__$/u.test(S))||l.length>0||i.length>0);return s===null&&_&&!b.includes("bindings")&&b.push("bindings"),{path:n,refused:s,...r!==null?{detail:r}:{},imports:o,functions:i,classes:a,calls:l,toplevelFlows:fg(e.toplevelFlows,!1),flowsRefused:e.flowsRefused===null?null:we(e.flowsRefused,64)??"unreadable",escapes:d,all:f,allComputed:e.allComputed===!0,truncated:b,moduleBindings:y,staticBindings:y===null?cg(e.staticBindings):null,attrWrites:p,starImport:e.starImport!==!1,moduleOrigins:Sd(e.moduleOrigins,ps),annotatedAliases:Sd(e.annotatedAliases,hg),moduleCalls:Sd(e.moduleCalls,S=>Array.isArray(S)&&S.length===2?fs(S[0],S[1]):null),valueNames:Ii(e.valueNames),valueAttrs:Ii(e.valueAttrs),computedAccess:e.computedAccess!==!1,classBinds:u,moduleBinds:m,dunderWrites:g}}function cr(e,n={}){let t=n.env??process.env,s=n.python??t[lg]??s0,r=[],o=e.filter(g=>!g.includes(`
+`));o.length!==e.length&&r.push(`${String(e.length-o.length)} path(s) carried a newline and were not extracted`);let i=[...t0,...so("extract.py")];n.maxBytesPerFile!==void 0&&i.push("--max-bytes",String(n.maxBytesPerFile)),n.hints!==void 0&&i.push("--hints",JSON.stringify(n.hints));let a=n0(s,i,{input:o.length>0?`${o.join(`
 `)}
-`:"",encoding:"utf8",maxBuffer:zS,timeout:n.timeoutMs??US,env:t});if(a.error!==void 0){let g=a.error.code,y=g==="ENOENT";return{refused:y?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,y?`no Python interpreter: \`${s}\` is not on PATH (set ${np} to the interpreter this project runs under)`:`the Python extract could not run (${g??a.error.message})`]}}if(a.status!==0){let g=(a.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,`the Python extract exited ${String(a.status??"on a signal")}${g!==""?`: ${g}`:""}`]}}let d=(a.stdout??"").split(`
-`).filter(g=>g.trim()!==""),l=null,c=[],p=[],u=new Map,f=[];for(let g of d){let y;try{y=JSON.parse(g)}catch{r.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!bn(y))continue;if(y.kind==="header"){l=xe(y.interpreter,64);let b=y.stdlib;Array.isArray(b)&&(c=b.filter(x=>typeof x=="string"&&x.length<=128)),p=Ft(y.builtins).filter(x=>typeof x=="string"&&x.length<=128),u=bk(y.typeAttrs);continue}let _=xk(y);if(_===null){r.push("the Python extract emitted a file row without a path; it was skipped");continue}f.push(_)}if(l===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,"the Python extract did not report an interpreter version"]};let h=i.length-f.length;return h>0&&r.push(`${String(h)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:l,files:f,stdlib:c,diagnostics:r,builtins:p,typeAttrs:u}}function bk(e){let n=new Map;if(!bn(e))return n;for(let[t,s]of Object.entries(e))!ip.has(t)||!Array.isArray(s)||n.set(t,new Set(s.filter(r=>typeof r=="string"&&r.length<=128)));return n}var kk="python3",wk={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","extract-truncated":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function vk(e,n,t=s=>Oo([],{python:s}).refused===null){let s=rs.resolve(e,n.envRel);for(let r of["bin/python3","bin/python","Scripts/python.exe"]){let i=rs.join(s,r);try{if(!Sk(i).isFile())continue}catch{continue}if(t(i))return i}return kk}function Ek(e,n){let t=[e];for(let s of n.sitePackages)t.push(rs.resolve(e,s));for(let s of n.pthFiles)for(let r of s.paths)t.push(rs.isAbsolute(r)?r:rs.resolve(e,s.sitePackages,r));return{roots:[...new Set(t)]}}function Nk(e){let n=[];for(let t of e.distInfos){let s=ar(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});s!==null&&n.push(s)}return n}function fp(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function Ak(e,n,t={}){let r=(t.readEnvironment??fr)(n),i=Nk(r),o=ho(i),a=r.diagnostics.map(_=>_),d=t.python??vk(n,r),l=Ek(n,r),c=Mk(r,o,l),p=new Map;for(let _ of i)p.set(_.name,Pk(_,c.distributions));for(let _ of c.seen)a.push(`startup hook: ${_}`);for(let _ of c.unattributed)a.push(`startup escape: ${_} \u2014 a module runs at interpreter start that no installed distribution claims`);let u=Ja({projectRoot:n,paths:l,python:d});for(let _ of u.gaps)a.push(`entrypoint \`${_.declaration}\` (${_.source}): ${_.detail}`);if(u.entrypoints.length===0)return a.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,graph:Ps,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:u.gaps,interpreter:null,diagnostics:a,execution:p};let f=Xa({projectRoot:n,paths:l,entryFiles:u.entrypoints.map(_=>rs.join(n,_.file)),environmentComplete:!r.truncated&&r.refused===null,externalRoots:r.sitePackages.map(_=>rs.resolve(n,_)),distributionOf:fp(o),python:d,...t.maxModules!==void 0?{maxModules:t.maxModules}:{}});for(let _ of f.diagnostics)a.push(`${_.code} at ${_.where}: ${_.detail}`);if(f.graph.modules.length===0)return{rootRel:e,graph:Ps,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:f.interpreter,diagnostics:a,execution:p};let h=new Map;for(let _ of f.graph.modules)h.set(_.id,_.id),h.set(_.path,_.id);let g=f.graph.modules[0]?.id,y=f.diagnostics.map(_=>({source:h.get(_.where)??g,cause:wk[_.code],reach:{kind:"unbounded"}}));if(c.unattributed.length>0&&y.push({source:g,cause:"dynamic-load",reach:{kind:"unbounded"}}),y.push(...Rk(f.graph)),f.opaqueCode.length>0){let _=f.graph.modules.find(x=>x.isEntrypoint)?.id??g,b=Ik(f.graph,f.opaqueCode,i);y.push({source:_,cause:"dep-opaque",reach:{kind:"loaded-package",ecosystem:"PyPI",alsoLoaded:b}}),a.push(`code no analysis reads is loaded (${up(f.opaqueCode)}): a loaded package is not reported unreachable, and neither is any of the ${String(b.length)} package(s) in the declared-dependency closure of the distributions that ship it (${up(b)})`)}return{rootRel:e,graph:f.graph,incompleteness:y,analysisAborted:null,entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:f.interpreter,diagnostics:a,execution:p}}var up=e=>`${e.slice(0,5).join(", ")}${e.length>5?", \u2026":""}`;function Ik(e,n,t){let s=new Set(e.modules.map(c=>c.packageName).filter(c=>c!=="")),r=new Map;for(let c of t){let p=r.get(c.name);if(p===void 0)r.set(c.name,new Set(c.requiresDist));else for(let u of c.requiresDist)p.add(u)}let i=new Set,o=ho(t),a=fp(o);for(let c of n){let p=a(c.split(".")[0]??c);p!==null&&i.add(p);for(let u of lr(o,c))i.add(u.name)}for(let c of t)s.has(c.name)&&(c.extensionModules>0||!c.recordKnown)&&i.add(c.name);let d=new Set,l=[...i];for(let c=l.pop();c!==void 0;c=l.pop())if(!d.has(c)){d.add(c);for(let p of r.get(c)??[])r.has(p)&&!d.has(p)&&l.push(p)}return[...d].sort((c,p)=>c<p?-1:c>p?1:0)}function Rk(e){let n=new Map(e.functions.map(r=>[r.id,r.moduleId])),t=new Set(e.modules.filter(r=>r.packageName!==""&&r.externalSurface!==!0).map(r=>r.id)),s=new Set;for(let r of e.callSites){if(r.resolution!=="unresolved")continue;let i=n.get(r.enclosingFunctionId);i!==void 0&&t.has(i)&&s.add(i)}return[...s].map(r=>({source:r,cause:"dep-opaque",reach:{kind:"dependency-dispatch"}}))}var Ps={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Ok(e){if(e.length===0)return null;let n=[],t=new Map;for(let _ of e){let b=_.rootRel===""?".":_.rootRel;for(let x of _.diagnostics)n.push(`${b}: ${x}`);for(let[x,k]of _.execution){let w=t.get(x);t.set(x,w===void 0?k:[...new Set([...w,...k])])}}let s=e.filter(_=>_.analysisAborted===null);if(s.length===0)return{graph:Ps,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let r=[],i=[],o=[],a=[],d=[],l=[],c=[],p=[],u=[],f=[],h=[],g=new Set;for(let _ of s){let b=_.rootRel===""?"":`${_.rootRel}::`,x=new Set(_.graph.modules.filter(R=>R.externalSurface===!0).map(R=>R.id)),k=R=>x.has(R)?R:`${b}${R}`,w=R=>`${b}${R}`,I=R=>`${b}${R}`,N=R=>`${b}${R}`,v=R=>`${b}${R}`,C=R=>`${b}${R}`;for(let R of _.graph.modules){if(R.externalSurface===!0){if(g.has(R.id))continue;g.add(R.id),r.push(R);continue}r.push({...R,id:k(R.id)})}for(let R of _.graph.imports)i.push({...R,id:w(R.id),moduleId:k(R.moduleId),...R.resolvedModuleId!==void 0?{resolvedModuleId:k(R.resolvedModuleId)}:{}});for(let R of _.graph.importEdges)o.push({importId:w(R.importId),resolvedModuleId:k(R.resolvedModuleId)});for(let R of _.incompleteness)h.push({...R,source:k(R.source)});for(let R of _.graph.functions)a.push({...R,id:I(R.id),moduleId:k(R.moduleId),...R.enclosingClassId!==void 0?{enclosingClassId:N(R.enclosingClassId)}:{}});for(let R of _.graph.classes)d.push({...R,id:N(R.id),moduleId:k(R.moduleId),members:R.members.map(I)});for(let R of _.graph.exports)l.push({...R,id:C(R.id),moduleId:k(R.moduleId)});for(let R of _.graph.exportBindings)c.push({exportId:C(R.exportId),target:R.target.kind==="function"?{kind:"function",functionId:I(R.target.functionId)}:{kind:"module",moduleId:k(R.target.moduleId)}});for(let R of _.graph.callSites)p.push({...R,id:v(R.id),enclosingFunctionId:I(R.enclosingFunctionId),resolvedTargetIds:R.resolvedTargetIds.map(I)});for(let R of _.graph.callEdges)u.push({...R,callSiteId:v(R.callSiteId),calleeFunctionId:I(R.calleeFunctionId)});for(let R of _.graph.inheritEdges)f.push({...R,subclassId:N(R.subclassId),superclassId:N(R.superclassId)})}let y=r[0]?.id;for(let _ of e)_.analysisAborted===null||y===void 0||h.push({source:y,cause:_.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:r,imports:i,importEdges:o,functions:a,classes:d,exports:l,exportBindings:c,callSites:p,callEdges:u,inheritEdges:f},incompleteness:h,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function pp(e,n={}){let t=e.filter(s=>ur(s));return t.length===0?null:Ok(t.map(s=>Ak(s.rel,s.abs,n)))}function Pk(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var Ck=["sitecustomize","usercustomize"];function Mk(e,n,t){let s=new Set,r=[],i=[];for(let o of e.pthFiles){for(let d of o.importModules){let l=lr(n,d);for(let p of l)s.add(p.name);let c=wt(t,d);if(c.resolved!==null){i.push(`${o.sitePackages}/${o.name}: \`import ${d}\` runs ${c.resolved.path}`);continue}l.length===0&&r.push(`${o.sitePackages}/${o.name}: \`import ${d}\``)}let a=o.importModules.length;o.importLines>a&&r.push(`${o.sitePackages}/${o.name}: ${String(o.importLines-a)} import line(s) whose module could not be read`)}for(let o of Ck){let a=wt(t,o);if(a.resolved===null)continue;let d=lr(n,o);for(let l of d)s.add(l.name);d.length===0?r.push(`${a.resolved.path}: \`import ${o}\` runs at every interpreter start`):i.push(`${o}: \`import ${o}\` runs ${a.resolved.path}`)}return{distributions:s,unattributed:r,seen:i}}import{readdirSync as Tk,readFileSync as $k}from"node:fs";import Lk from"node:path";var Dk=new Set(["summarized","crashed","over-cap"]),Fk=new Set(["function","method","ctor"]);function Ue(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function Qa(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function jk(e,n){Qa(e)||Ue(n,"edge is not an object");let{entryPath:t,entryExport:s,entryContainer:r,hops:i}=e;(typeof t!="string"||typeof s!="string")&&Ue(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&Ue(n,"entryContainer must be string or null"),(typeof i!="number"||!Number.isInteger(i)||i<0)&&Ue(n,"hops must be a non-negative integer");let o=e.target;if(Qa(o)||Ue(n,"edge target missing"),o.kind==="symbol"){let{exportName:a,container:d,symbolKind:l}=o;return typeof a!="string"&&Ue(n,"symbol target exportName"),d!==null&&typeof d!="string"&&Ue(n,"symbol target container"),(typeof l!="string"||!Fk.has(l))&&Ue(n,`symbol target kind ${JSON.stringify(l)}`),{entryPath:t,entryExport:s,entryContainer:r,target:{kind:"symbol",exportName:a,container:d,symbolKind:l},hops:i}}if(o.kind==="dep"){let{calleePackage:a,calleeSubpath:d,calleeExport:l}=o;return(typeof a!="string"||a.length===0)&&Ue(n,"dep target calleePackage"),d!==null&&typeof d!="string"&&Ue(n,"dep target calleeSubpath"),(typeof l!="string"||l.length===0)&&Ue(n,"dep target calleeExport"),{entryPath:t,entryExport:s,entryContainer:r,target:{kind:"dep",calleePackage:a,calleeSubpath:d,calleeExport:l},hops:i}}Ue(n,`unknown target kind ${JSON.stringify(o.kind)}`)}function Bk(e,n){Qa(e)||Ue(n,"root is not an object");let{packageName:t,analyzedVersion:s,tool:r,toolVersion:i,maxIndirections:o,status:a}=e;(typeof t!="string"||t.length===0)&&Ue(n,"packageName"),typeof s!="string"&&Ue(n,"analyzedVersion"),r!=="jelly"&&Ue(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof i!="string"&&Ue(n,"toolVersion"),typeof o!="number"&&Ue(n,"maxIndirections"),(typeof a!="string"||!Dk.has(a))&&Ue(n,`status ${JSON.stringify(a)} not in the enum`);let d=e.edges;return Array.isArray(d)||Ue(n,"edges is not an array"),a!=="summarized"&&d.length>0&&Ue(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:s,tool:r,toolVersion:i,maxIndirections:o,status:a,edges:d.map(l=>jk(l,n))}}function mp(e){let n=new Map,t=Tk(e).filter(s=>s.endsWith(".summary.json"));for(let s of t){let r=Lk.join(e,s),i;try{i=JSON.parse($k(r,"utf8"))}catch(d){Ue(s,`unparseable JSON: ${d instanceof Error?d.message:String(d)}`)}let o=Bk(i,s),a=n.get(o.packageName);a===void 0?n.set(o.packageName,[o]):a.push(o)}return n}import ut from"node:path";function Kk(e,n){let t=e.read(n);if(t===null)return null;let s=t.toString("utf8"),r=ut.posix.basename(n);if(r==="package-lock.json"||r==="npm-shrinkwrap.json")return pa(s);if(r==="pnpm-lock.yaml")return ma(s);if(r==="yarn.lock")return ha(s,zk(e,n));if(r==="uv.lock")return ba(s);if(r==="poetry.lock"){let i=e.read(ut.posix.join(ut.posix.dirname(n),"pyproject.toml")),o=i===null?[]:[..._o(i.toString("utf8")).keys()];return Sa(s,o)}return null}function zk(e,n){let t=new Map,s=e.read(ut.posix.join(ut.posix.dirname(n),"package.json"));if(s===null)return t;let r;try{r=JSON.parse(s.toString("utf8"))}catch{return t}if(typeof r!="object"||r===null)return t;for(let i of["dependencies","devDependencies","optionalDependencies"]){let o=r[i];if(!(typeof o!="object"||o===null||Array.isArray(o)))for(let[a,d]of Object.entries(o))typeof d=="string"&&!t.has(a)&&t.set(a,d)}return t}function hp(e,n,t=[]){let s=new Nt(e,Ia),r=new Map,i=new Map,o=new Map,a=[],d=u=>{if(!i.has(u)){let h=s.read(u)?.toString("utf8")??null,g=ut.posix.basename(u);i.set(u,h===null?null:g==="pyproject.toml"?_o(h):g.endsWith(".txt")?ka(h):ya(h))}return i.get(u)??null},l=(u,f)=>{let h=u.endsWith("pyproject.toml"),g=h?lt(f):f,y=h?[u,ut.posix.join(ut.posix.dirname(u),"requirements.txt")]:[u];for(let _ of y){let b=d(_)?.get(g);if(b!==void 0)return{path:_,line:b}}return null},c=(u,f,h)=>{let g=JSON.stringify([u,f,h]),y=o.get(g);if(y!==void 0)return y;r.has(u)||r.set(u,Kk(s,u));let _=r.get(u)??null,b=_===null?null:ga(_,f,h,{maxNodes:Ot.maxPackageGraphNodes,maxEdges:Ot.maxPackageGraphEdges}),x=null;if(b!==null&&a.length<Ot.maxPackageGraphs){x=`g${String(a.length)}`;let k=ut.posix.dirname(u);a.push({id:x,nodes:b.nodes.map(w=>{let I=w.directFrom===null?null:ut.posix.join(k,w.directFrom);return{id:w.id,name:w.name,version:w.version,direct:w.directFrom!==null,declaredIn:I===null?null:l(I,w.name)}}),edges:b.edges.map(w=>({from:w.from,to:w.to})),truncated:b.truncated})}return o.set(g,x),x},p=n.map(u=>{if(u.tier==="not-affected")return null;if(u.ecosystem==="PyPI"){for(let f of t){let h=c(f,u.packageName,u.version);if(h!==null)return h}return null}return u.packageLocation===null?null:c(u.packageLocation,u.packageName,u.version)});return{graphs:a,idOf:p}}import{isBuiltin as gp}from"node:module";function te(e){let n="";for(let t of e){let s=t.charCodeAt(0),r=s<32||s>=127&&s<=159;n+=r?"\\x"+s.toString(16).padStart(2,"0"):t}return n}var yp=1024,_p=4096,Mo=8,xp=512,bp=512,el=8,Uk=160,qk=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),nl=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),Hk=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,Wk=/\.[cm]?[jt]sx?$/u;function Sp(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let s=e.lastIndexOf("node_modules/");if(s!==-1){let r=e.slice(s+13).split("/"),i=r[0]??"";return i.startsWith("@")?r[1]===void 0?null:`${i}/${r[1]}`:i===""?null:i}return Hk.test(e)&&!Wk.test(e)?e:null}function Gk(e){return te(`${e.code} ${e.path}: ${e.detail}`.slice(0,Uk))}function kp(e){let{graph:n,facts:t,diagnostics:s}=e,r=new Map(n.modules.map(D=>[D.id,D])),i=new Map(n.modules.map(D=>[D.path,D])),o=qn(n),a=new Set;for(let D of o){let $=r.get(D);$!==void 0&&a.add($.packageName)}let d=new Map,l=0,c=!1,p=!1,u=D=>D.startsWith(`${e.appRootReal}/`)?D.slice(e.appRootReal.length+1):D;for(let D of s){if(D.code==="limit-exceeded"&&D.path===e.appRootReal){c=!0;continue}let $=Sp(u(D.path),i);if($===null){D.code==="out-of-root"&&l++,nl.has(D.code)&&(p=!0);continue}let L=i.get(u(D.path));L!==void 0&&nl.has(D.code)&&!L.path.includes("node_modules/")&&(p=!0);let H=d.get($);H===void 0?d.set($,[D]):H.push(D)}let f=new Map(n.imports.map(D=>[D.id,D])),h=new Set;for(let D of n.importEdges){let $=f.get(D.importId);$!==void 0&&r.get($.moduleId)?.externalSurface===!0&&h.add($.moduleId)}let g=[],y=new Set,_=n.modules.filter(D=>D.externalSurface===!0);for(let D of _){let $=d.get(D.packageName)??[],L=h.has(D.id),H=[],z=Ae=>Ae.code==="dependency-body"&&Ae.anchor===void 0&&/syntax/u.test(Ae.detail),Z=Ae=>Ae.code==="loader-escape"||Ae.code==="dependency-body"&&Ae.anchor===void 0&&!/syntax/u.test(Ae.detail),ie=$.filter(Ae=>qk.has(Ae.code)),ae=$.filter(Z),pe=$.filter(Ae=>nl.has(Ae.code)||z(Ae)),he=$.filter(Ae=>Ae.code==="out-of-root"),we=L&&ie.length===0,Ne=ae.length===0,Ie=!c&&pe.length===0,Fe=l===0&&he.length===0;L||H.push("(a) the package's entry was never followed to a module");for(let Ae of[...ie,...ae,...pe,...he]){if(H.length>=el)break;H.push(Gk(Ae))}c&&H.length<el&&H.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),l>0&&H.length<el&&H.push(`(d) ${String(l)} out-of-root diagnostic(s) no package can be read from`);let Le=["a","b","c","d"].filter(Ae=>!{a:we,b:Ne,c:Ie,d:Fe}[Ae]),Je=Le.length===0;Je&&y.add(D.id),g.push({packageName:te(D.packageName),module:te(String(D.id)),inReach:o.has(D.id),builtin:gp(D.packageName),followed:L,d1:{a:we,b:Ne,c:Ie,d:Fe},failing:Le,transparent:Je,evidence:H})}let b=new Set;for(let D of t)D.reach.kind==="unbounded"&&b.add(D.source);let x=D=>({module:te(String(D.module)),kind:D.kind,packageName:r.get(D.module)?.packageName??null}),k=new Set(_.filter(D=>gp(D.packageName)).map(D=>D.id)),w=new Set([...y,...k]),I=[],N=new Map,v=0,C=0,R=0,F=0,P=[],U=new Set;for(let D of t)D.reach.kind==="unbounded"&&U.add(D.cause);for(let D of t){if(D.reach.kind==="class-scope"){P.push({packageName:D.reach.packageName,container:D.reach.container});continue}if(D.reach.kind==="unbounded"||D.reach.kind==="dependency-dispatch"||D.reach.kind==="loaded-package")continue;F++;let $=D.reach.anchor,L=N.get(String($));L===void 0&&(L={today:Bs(n,$,b),d1:Bs(n,$,b,y),d1Builtins:Bs(n,$,b,w)},N.set(String($),L)),L.d1Builtins.length>0&&R++,L.today.length>0&&(v++,U.add(D.cause)),L.d1.length>0&&C++,I.length<_p&&I.push({anchor:te(String($)),packageName:te(r.get($)?.packageName??""),cause:D.cause,reachKind:D.reach.kind,blockersToday:L.today.slice(0,Mo).map(x),blockersUnderD1:L.d1.slice(0,Mo).map(x),blockedUnderD1Builtins:L.d1Builtins.length>0,moreToday:Math.max(0,L.today.length-Mo),moreUnderD1:Math.max(0,L.d1.length-Mo)})}let E=s.filter(D=>D.anchor===void 0&&D.classScope===void 0),T=new Map(e.loadSites.map(D=>[D.importId,D])),K=new Map;for(let D of e.loadSites){let $=K.get(D.path);$===void 0?K.set(D.path,[D.shape]):$.push(D.shape)}let J=D=>{if(D.code!=="loader-escape")return!1;let $=D.escapes??[];if($.length===0||$.some(H=>H!=="non-literal-load"))return!1;let L=K.get(D.path)??[];return L.length>0&&L.every(H=>H==="relative-bounded")},W=E.slice(0,bp).map(D=>({cause:e.causeOf(D.code),code:D.code,path:te(u(D.path)),attributedPackage:Sp(u(D.path),i),...D.escapes!==void 0?{escapes:[...D.escapes]}:{},...D.reason!==void 0?{reason:D.reason}:{},d2Dischargeable:J(D)})),se={};for(let D of E){if(D.code!=="unresolved-specifier")continue;let $=D.reason??"(none)";se[$]=(se[$]??0)+1}let Y=b.size===0?0:t.filter(D=>D.reach.kind==="unbounded").length,V=Math.max(0,Y-E.length),fe=Y-E.filter(J).length,S=[],A=0,j=0,ne=0;for(let D of n.imports){if(D.specifierIsLiteral)continue;ne++;let $=o.has(D.moduleId),L=T.get(String(D.id)),H=L?.shape??"unrecorded";$&&(A++,H==="relative-bounded"&&j++),S.length<xp&&S.push({importId:te(String(D.id)),path:te(r.get(D.moduleId)?.path??""),shape:H,text:te(L?.text??""),inReach:$})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:c,appCapHit:p,unattributedOutOfRoot:l,blindUnbounded:V,unbounded:W,anchors:I,surfaces:g.slice(0,yp),loads:S,counts:{modules:n.modules.length,reachMods:o.size,surfaces:_.length,surfacesInReach:g.filter(D=>D.inReach).length,transparentSurfaces:y.size,builtinSurfaces:k.size,anchors:F,anchorsBlockedToday:v,anchorsBlockedUnderD1:C,anchorsBlockedUnderD1Builtins:R,unbounded:Y,loadsInReach:A,loadsRelativeBounded:j,unresolvedByReason:se,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,g.length-yp),anchors:Math.max(0,F-_p),loads:Math.max(0,ne-xp),unbounded:Math.max(0,E.length-bp)}},reachedPackages:a,aborted:e.analysisAborted,unboundedFacts:Y,unboundedHard:fe,anchorsBlockedToday:v,anchorsBlockedUnderD1:C,anchorsBlockedUnderD1Builtins:R,loadsInReach:A,loadsAllBounded:A>0&&j===A,d2Eligible:e.rootBudget==="complete"&&!p&&!c,classScope:P,taintCausesToday:U}}var Vk=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),Xk=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function wp(e,n,t,s,r){if(t===null||e.reachedPackages.has(t.packageName))return;let i=e.classScope.some(v=>v.packageName===t.packageName&&v.container===t.container),o=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||i,a=t.symbolKind==="method"||t.symbolKind==="ctor",l=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||a||n.unknownKind!==void 0&&Vk.has(n.unknownKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":o?"taint":s>0?"oog":"unexpected",c=new Set(e.taintCausesToday);i&&c.add("dep-opaque");let p=e.aborted!==null?e.aborted:Xk.find(v=>c.has(v)),u=l==="pre-2b"?n.tier==="unknown"&&(a?n.unknownKind==="dep-opaque":!0):l==="denial"?n.tier==="not-reachable":l==="load"?n.tier==="unknown"&&n.unknownKind==="dynamic-load":l==="taint"?n.tier==="unknown"&&n.unknownKind===p:l==="oog"?n.tier==="unknown"&&n.unknownKind==="analysis-cap":!1,f=t.verified&&r===!0,h=e.aborted===null&&e.unboundedFacts===0&&!i&&s===0,g=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,y=f&&l==="taint"&&h&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,_=f&&l==="load"&&h&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,b=f&&(l==="load"||l==="taint")&&h&&g&&e.anchorsBlockedUnderD1===0,x=e.aborted===null&&e.unboundedHard===0&&!i&&s===0,k=f&&l==="load"&&x&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,w=f&&(l==="load"||l==="taint")&&x&&g&&e.anchorsBlockedUnderD1===0,I=f&&l==="taint"&&h&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,N=f&&(l==="load"||l==="taint")&&x&&g&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:l,agrees:u,verified:t.verified,surfaceComplete:r,oog:s,classScoped:i,predicted:{d1:y,d2:_,d1d2:b,d2Amended:k,d1d2Amended:w,d1Builtins:I,d1d2AmendedBuiltins:N}}}import{readFileSync as Yk,statSync as Jk}from"node:fs";var sl=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,To=/^[A-Za-z0-9_$.-]{1,128}$/u,vp=64,Ep=1024*1024,Np=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Ap=/^[A-Za-z0-9@_.-]{1,128}$/u;function Ge(e){throw new Error(`model claims rejected: ${e}`)}function tl(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Zk(e,n){tl(e)||Ge(`${n}: edge is not an object`);let{kind:t,anchorExport:s,anchorContainer:r,calleePackage:i,calleeContainer:o,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&Ge(`${n}: edge kind`),(typeof s!="string"||!To.test(s))&&Ge(`${n}: anchorExport ${JSON.stringify(s)}`),r!==null&&(typeof r!="string"||!To.test(r))&&Ge(`${n}: anchorContainer`),(typeof i!="string"||!sl.test(i))&&Ge(`${n}: calleePackage ${JSON.stringify(i)}`),o!==null&&(typeof o!="string"||!To.test(o))&&Ge(`${n}: calleeContainer`),(typeof a!="string"||!To.test(a))&&Ge(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:s,anchorContainer:r,calleePackage:i,calleeContainer:o,calleeExport:a}}function Ip(e){let n=Jk(e).size;n>Ep&&Ge(`file is ${String(n)} bytes, over the ${String(Ep)} cap`);let t;try{t=JSON.parse(Yk(e,"utf8"))}catch(r){Ge(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||Ge("root is not an array"),t.length>vp&&Ge(`${String(t.length)} claims over cap ${String(vp)}`);let s=[];for(let r of t){tl(r)||Ge("claim is not an object");let{packageName:i,modelId:o,range:a,edges:d}=r;(typeof i!="string"||!sl.test(i))&&Ge("packageName"),(typeof o!="string"||!Ap.test(o))&&Ge("modelId (identifier charset, 1-128 chars)"),s.some(c=>c.model.modelId===o)&&Ge(`duplicate modelId ${o} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!tl(a)||typeof a.introduced!="string")&&Ge(`${o}: range`),Np.test(a.introduced)||Ge(`${o}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let l=a.fixedBefore;l!==null&&typeof l!="string"&&Ge(`${o}: fixedBefore`),typeof l=="string"&&!Np.test(l)&&Ge(`${o}: range.fixedBefore ${JSON.stringify(l)} is not an exact x.y.z triple`),Array.isArray(d)||Ge(`${o}: edges`),d.length>64&&Ge(`${o}: ${String(d.length)} edges over cap ${String(64)}`),s.push({model:{packageName:i,modelId:o,edges:d.map(c=>Zk(c,o))},introduced:a.introduced,fixedBefore:l})}return s}var Qk=["in-app-purchase@1-v1"];function rl(e,n,t){let s=[],r=[],i=[],o=(a,d,l,c)=>{r.push(l),i.push({modelId:c??a.model.modelId,status:d,reason:l,edgeCount:a.model.edges.length})};for(let a of e){if(!sl.test(a.model.packageName)||!Ap.test(a.model.modelId)){o(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Qk.includes(a.model.modelId)){o(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(c=>c.kind!=="alias"&&c.kind!=="dispatch")){o(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let d=n(a.model.packageName);if(typeof d!="string"&&d!==void 0){o(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} installed at more than one version (${d.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(d===void 0){o(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let l;try{l=zt(d,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{o(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${d} not an exact triple \u2014 inert (never guessed)`);continue}if(!l){o(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${d} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}s.push(a.model),i.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:s,notes:r,dispositions:i}}var nw=4,tw={additiveForms:!0,namelessExports:!0},sw=new Set(["dep-opaque","dynamic-load","dispatch"]),rw={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function fl(e,n,t){return e.tier==="unknown"&&rw[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&sw.has(e.unknownKind)&&n!==null&&n.verified}var ow=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),et=class extends Error{},pl="cupel/coverage-gap",Cp={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function kr(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Rp(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Op(e,n,t){let s=new Map(e.modules.map(o=>[o.path,o.id])),r=e.modules[0]?.id;if(r===void 0)return[];let i=n.map(o=>({source:s.get(o.path)??r,cause:Cp[o.code],reach:o.classScope!==void 0?{kind:"class-scope",packageName:o.classScope.packageName,container:o.classScope.container}:o.anchor!==void 0?{kind:"via-module",anchor:o.anchor}:{kind:"unbounded"}}));for(let o of t)i.push({source:r,reach:{kind:"unbounded"},cause:o});return i}function dl(e,n,t,s,r){let i=t.filter(o=>o.exportName!==null&&(s===1||r||o.verified!==1));return i.length>0?i.map(o=>({advisoryId:e,packageName:n,exportName:o.exportName??"",container:o.container,symbolKind:o.symbolKind,sourcePath:o.sourcePath??"",derivation:o.derivation,confidence:o.confidence,verified:o.verified===1})):t.length===0||t.every(o=>o.exportName!==null&&o.verified===1)?[null]:[]}function iw(e,n){let t;try{t=wr(e)}catch{return!0}let s=3,r=(i,o)=>{if(o>s)return!1;let a;try{a=Pp(i)}catch{return!1}for(let d of a){if(d==="node_modules"||d.startsWith("."))continue;let l=nt.join(i,d),c;try{c=ul(l)}catch{continue}if(!c.isDirectory())continue;let p=nt.relative(t,l).split(nt.sep).join("/");try{if(ul(nt.join(l,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(r(l,o+1))return!0}return!1};return r(t,1)}function aw(e,n){let t="";for(let s of e)s.rel!==""&&n.startsWith(`${s.rel}/`)&&s.rel.length>t.length&&(t=s.rel);return t}function lw(e,n,t){let s=[];if(t&&s.push("nested-app-root"),n==="")return[...s,"manifest-unreadable"];let r;try{if(r=wr(nt.resolve(e,n)),!r.startsWith(wr(e)+nt.sep))return[...s,"manifest-unreadable"]}catch{return[...s,"manifest-unreadable"]}let i;try{let c=nt.join(r,"package.json");if(!ul(c).isFile())return[...s,"manifest-unreadable"];i=ew(c,"utf8")}catch{return[...s,"manifest-unreadable"]}let o;try{o=JSON.parse(i)}catch{return[...s,"manifest-unreadable"]}if(typeof o!="object"||o===null)return[...s,"manifest-unreadable"];let a=o;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&s.push("bin");let d=["preinstall","install","postinstall","prepare","prepublish"],l=a.scripts;if(typeof l=="object"&&l!==null){let c=l;d.some(p=>typeof c[p]=="string")&&s.push("install-script")}return(a.gypfile===!0||dw(r))&&s.push("native-artifact"),s}function dw(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=nt.join(e,n),s;try{s=Pp(t)}catch{continue}if(s.some(r=>r.endsWith(".node")))return!0}return!1}function cw(e){return new Set(["npm",...e.ecosystems?.()??[]])}function ml(e){return e.ecosystem??"npm"}function uw(e,n){let t=[];for(let s of e.perRoot){let r=new Map;for(let i of s.packages){let o=ml(i);n.has(o)||r.set(o,(r.get(o)??0)+1)}for(let[i,o]of[...r.entries()].sort())t.push({kind:"ecosystem-uncovered",detail:`${s.rootRel===""?"":`${s.rootRel}: `}${String(o)} ${i} distribution(s) were enumerated but the loaded shard carries no ${i} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${i} shard to assess them (ADR-109 D5).`,blindsAnalysis:!1,rootRel:s.rootRel})}return t}function fw(e,n,t){let s=new Set(e.perRoot.flatMap(o=>o.packages.map(ml))),r=new Map([...s].filter(o=>t.has(o)).map(o=>[o,pw(n,o)])),i=[];for(let o of e.perRoot)for(let a of[...new Set(o.packages.map(ml))].sort()){let d=r.get(a);if(d===void 0||d==="census")continue;let l=d==="project"?"one project's installed set":d==="corpus"?"a vetted corpus slice":"an undeclared population";i.push({kind:"shard-population-narrow",detail:`${o.rootRel===""?"":`${o.rootRel}: `}the loaded ${a} shard's population is ${l}, not the whole ${a} ecosystem: a package outside it carries no advisory row here, so it reports no findings \u2014 which is NOT a clean bill of health for it. Scan with a census shard to assess every package (ADR-114 D5).`,blindsAnalysis:!1,rootRel:o.rootRel})}return i}function pw(e,n){return e.populationModeFor!==void 0?e.populationModeFor(n):e.populationMode?.()}function Mp(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function mw(e,n,t){return new Map(n.map(s=>[Mp(s),lw(e,s.lockKey,t)]))}function hw(e){let n=new Map;for(let t of e){let s=n.get(t.advisory.id);s===void 0?n.set(t.advisory.id,[t]):s.push(t)}return n}function gw(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(r=>r.packageName===t.name)?e:{...e,tier:"unknown",reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,unknownKind:"symbol-unsupported",basis:void 0,path:void 0}}function yw(e,n,t,s,r,i,o){let{finding:a}=Sr(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:o(t)},kr(s.advisory.id,t.name,s.affected),null,r,i);return a.decidedAtStage!=="presence"&&a.decidedAtStage!=="version-match"}function Sr(e,n,t,s,r,i,o){let a=Qo({graph:e,installed:t,range:s,symbol:r,coverage:null,incompleteness:i,analysisAborted:o});if(n!==null&&r!==null&&fl(a,r,"base")){let d=Ks(e,n.modulesById,n.reachMods,r,n.records);if(d!==null)return{finding:a,hit:d}}return{finding:a,hit:null}}function _w(e,n){let t=new Set,s=[];for(let r of e.packages)if((r.ecosystem??"npm")==="npm")for(let{advisory:i,affected:o}of n.advisoriesForPackage(r.ecosystem??"npm",r.name)){let a=kr(i.id,r.name,o),d;try{d=zt(r.version,a)}catch{continue}if(d)for(let l of n.symbolsForAffected(o.id)){if(l.verified!==1||l.symbolKind!=="method"&&l.symbolKind!=="ctor"||l.container===null||l.sourcePath===null)continue;let c=`${r.lockKey}\0${l.container}\0${l.sourcePath}`;t.has(c)||(t.add(c),s.push({packageName:r.name,packageRootRel:r.lockKey,container:l.container,sourcePath:l.sourcePath}))}}return s.sort((r,i)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`)),s.slice(0,so)}function xw(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),r=new Map(e.classes.map(a=>[a.id,a.name])),i=new Map(e.callSites.map(a=>[a.id,a])),o=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let d=i.get(a.callSiteId);if(d===void 0)continue;let l=s.get(d.enclosingFunctionId);if(l===void 0||!t.has(l.moduleId))continue;let c=n.get(l.moduleId);if(c===void 0)continue;let p=s.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&o.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:l.id})}return o}function bw(e){let n=new Set(e.modules.filter(c=>c.isEntrypoint).map(c=>c.id)),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.functions.map(c=>[c.id,c])),r=new Set;for(let c of e.functions)n.has(c.moduleId)&&(c.publicSurfaceReachable||c.name==="<toplevel>")&&r.add(c.id);let i=new Map(e.exports.map(c=>[c.id,c]));for(let c of e.exportBindings){if(c.target.kind!=="function")continue;let p=i.get(c.exportId);if(p===void 0||!n.has(p.moduleId))continue;let u=s.get(c.target.functionId);u===void 0||t.get(u.moduleId)?.externalSurface===!0||r.add(u.id)}let o=new Map(e.callSites.map(c=>[c.id,c.enclosingFunctionId])),a=new Map;for(let c of e.callEdges){if(c.resolution!=="resolved"&&c.resolution!=="field-based")continue;let p=o.get(c.callSiteId);if(p===void 0)continue;let u=a.get(p);u===void 0?a.set(p,[c.calleeFunctionId]):u.push(c.calleeFunctionId)}let d=new Set(r),l=[...r];for(;l.length>0;){let c=l.pop();if(c!==void 0)for(let p of a.get(c)??[])d.has(p)||(d.add(p),l.push(p))}return d}function Sw(e,n,t,s){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let i=t.filter(a=>a.packageName===r.anchor.packageName&&a.exportName===r.anchor.exportName&&a.container===r.anchor.container),o=i.find(a=>a.resolution==="resolved")??i[0];if(o!==void 0)return s.has(o.callerFunctionId)}return null}function kw(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(i=>i.modelId!==void 0);let s=new Set(t),r=i=>s.has(i)||s.has(Rn[i]??"");return e.some(i=>i.tier==="unknown"&&i.unknownKind!==void 0&&r(i.unknownKind)||i.modelPromotedFromKind!==void 0&&r(i.modelPromotedFromKind))}function hl(e){let n=Cs.now(),t=wr(e.dir),s=e.reader??(e.shardPathPypi!==void 0?mi([Ws(e.shardPath),Ws(e.shardPathPypi)]):Ws(e.shardPath)),r=e.partialRows===!0;try{if(!/^\d+$/u.test(s.schemaVersion)||Number(s.schemaVersion)>Number(ps))throw new et(`shard schema ${JSON.stringify(s.schemaVersion)} is unreadable or newer than this cupel understands (v${ps})`);let i=null;if(e.summaryShadow!==void 0)try{i=mp(e.summaryShadow)}catch(G){throw new et(`--summary-shadow facts dir rejected: ${G instanceof Error?G.message:String(G)}`)}let o=null;if(e.modelShadow!==void 0)try{o=Ip(e.modelShadow.claimsPath)}catch(G){throw new et(`--model-shadow claims rejected: ${G instanceof Error?G.message:String(G)}`)}let a=va(t,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{}}),d=pf(t,a,e.installedSet);if(d.truncated){let G=d.perRoot.filter(ue=>ue.truncated).map(ue=>ue.rootRel===""?"the scan root":`\`${ue.rootRel}\``);throw new et(`the dependency enumeration hit a hard cap and is incomplete at ${G.length>0?G.join(", "):"the union across roots"} (${d.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let l=pp(a.roots),c=l?.execution??null,p=hf(d.packages.filter(G=>(G.ecosystem??"npm")==="npm")),u=e.entry??[],f=u.length>0?wu(t,u):{entrypoints:[],rejected:[]},h=f.rejected,g=ku(t,a.roots),y=[...new Set([...g.entrypoints,...f.entrypoints])],_=[...g.sources];for(let G of f.entrypoints)g.entrypoints.includes(G)||_.push({source:"--entry",specifier:G,entrypoint:G,launch:!1,root:aw(a.roots,G)});let b=[..._];for(let G of l?.roots??[])for(let ue of G.entrypoints)_.push({source:`python:${ue.source}`,specifier:ue.declaration,entrypoint:G.rootRel===""?ue.file:`${G.rootRel}/${ue.file}`,launch:ue.source==="console-script"||ue.source==="launch-declaration",root:G.rootRel});let x=_w(d,s),k=e.bindingForms??tw,w=e.callablePackageResolver===!0,I=e.tsconfigPaths!==!1,N=iw(t,mr(_)),v=mw(t,d.packages,N),C=G=>(G.ecosystem??"npm")!=="npm"?c?.get(G.name)??["manifest-unreadable"]:v.get(Mp(G))??["manifest-unreadable"],R=ra({appRoot:t,entrypoints:y,depClassAnchors:x,bindingForms:k,callablePackageResolver:w,tsconfigPaths:I}),F=R.graph,P=Zo(F),U=[...g.diagnostics,...oa(g),...ia(g,y.length),...Pa(a,b),...R.diagnostics],E=Rp(y.length,F),T=G=>d.packages.some(ue=>(ue.ecosystem??"npm")===G),K=l===null?"no-entrypoint":l.analysisAborted,J=(T("npm")?E:null)??(T("PyPI")?K:null)??(T("npm")||T("PyPI")?null:E),W=cw(s),se=[...d.gaps,...gf(a),...uw(d,W),...fw(d,s,W)],Y=yf(se),V=Op(F,U,Y),fe={graph:Ps,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},S=G=>(G.ecosystem??"npm")==="npm"?{graph:F,incompleteness:V,analysisAborted:E,symbolsDecidable:!0}:l===null?fe:{...l,symbolsDecidable:!0},A=t;try{A=wr(t)}catch{}let j=kp({graph:F,facts:V,diagnostics:U,analysisAborted:E,loadSites:R.loadSites,conditionUnions:R.conditionUnions,provenAbsent:R.provenAbsent,appRootReal:A,rootBudget:a.budget,causeOf:G=>Cp[G]}),ne=s.allModels?.()??[],X=rl(ne.map(G=>({model:{packageName:G.packageName,modelId:G.modelId,edges:G.edges},introduced:G.introduced,fixedBefore:G.fixedBefore})),p),D=X.models.length>0?sr(F,X.models).delta:null,$=D!==null?{records:D.records,reachMods:qn(F),modulesById:new Map(F.modules.map(G=>[G.id,G]))}:null,L=Cs.now(),H=[],z=new Map,Z=ow(),ie=[],ae=[];for(let G of d.packages){let ue=S(G),ye=(G.ecosystem??"npm")==="npm"?$:null;for(let[,be]of hw(s.advisoriesForPackage(G.ecosystem??"npm",G.name))){let Ke=be[0];if(Ke!==void 0){let Be=z.get(Ke.advisory.id),Kn=be.map(Qe=>Qe.affected);if(Be===void 0)z.set(Ke.advisory.id,{advisory:Ke.advisory,ranges:Kn});else{let Qe=new Set(Be.ranges.map(pn=>pn.id));for(let pn of Kn)Qe.has(pn.id)||(Qe.add(pn.id),Be.ranges.push(pn))}}let Pe=be.filter(Be=>yw(ue.graph,ye,G,Be,ue.incompleteness,ue.analysisAborted,C)),Dn=Pe.length>0?Pe:be.slice(0,1),pt=Pe.length===0;for(let{advisory:Be,affected:Kn}of Dn){let Qe=kr(Be.id,G.name,Kn),pn=Be.cveId??Be.id,Bt=pt?[]:s.symbolsForAffected(Kn.id),$s=Bt.filter(je=>je.exportName===null),mt=dl(Be.id,G.name,Bt,Kn.surfaceComplete,r),ht=Sr(ue.graph,ye,{name:G.name,version:G.version,...G.ecosystem!==void 0?{ecosystem:G.ecosystem}:{},devOnly:G.dev,outOfGraphExecution:C(G)},Qe,null,ue.incompleteness,ue.analysisAborted).finding;if(ht.decidedAtStage==="presence"||ht.decidedAtStage==="version-match"){Z[ht.tier]+=1,H.push({...ht,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:Qe.surfaceComplete,advisoryId:Be.id,displayId:pn,packageName:G.name,version:G.version,ecosystem:G.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:Be.severity,packageLocation:xo(d,G)});continue}for(let je of mt){let{finding:zn,hit:In}=Sr(ue.graph,ye,{name:G.name,version:G.version,...G.ecosystem!==void 0?{ecosystem:G.ecosystem}:{},devOnly:G.dev,outOfGraphExecution:C(G)},Qe,je,ue.incompleteness,ue.analysisAborted),re=gw(zn,ue,G),me,Ee;In!==null&&je!==null&&(me=In.modelId,Ee=zn.unknownKind,re={basis:void 0,tier:In.tier,decidedAtStage:zn.decidedAtStage,reason:`boundary model ${In.modelId}: ${In.anchorPackage}.${In.entryExport} reaches ${je.exportName} [${In.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Lr(je),path:void 0,unresolvedSites:zn.unresolvedSites,unresolvedEvidence:zn.unresolvedEvidence}),Z[re.tier]+=1;let en=wp(j,re,je,C(G).length,Qe.surfaceComplete),Ce={...re,...en!==void 0?{adr105:en}:{},modelId:me,modelPromotedFromKind:Ee,surfaceComplete:Qe.surfaceComplete,advisoryId:Be.id,displayId:pn,packageName:G.name,version:G.version,ecosystem:G.ecosystem??"npm",symbolName:je?.exportName??null,symbolPath:je?.sourcePath||null,symbolContainer:je?.container??null,severity:Be.severity,packageLocation:xo(d,G)};H.push(Ce);let Oe=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&Ce.tier==="unknown"&&Ce.decidedAtStage==="symbol-reachable"&&Ce.unknownKind!==void 0&&Oe.has(Ce.unknownKind)&&je!==null&&ie.push({finding:Ce,symbol:je}),o!==null&&Ce.tier==="unknown"&&je!==null&&ae.push({finding:Ce,symbol:je})}for(let je of $s)Z.unknown+=1,H.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:Qe.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${pn} carries a ${je.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Be.id,displayId:pn,packageName:G.name,version:G.version,ecosystem:G.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:Be.severity,packageLocation:xo(d,G)})}}}for(let G of se)Z.unknown+=1,H.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:G.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:pl,displayId:pl,packageName:G.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:null,unknownKind:"coverage-gap",packageLocation:mf(d,G)});let pe=Cs.now()-L,he=Z["reachable-high"]+Z["reachable-medium"],we=e.failOnReachable===!0&&he>0,Ne=kw(H,Z.unknown,e.failOnUnknown),Ie=e.requireCompleteDenial===!0&&H.some(G=>G.tier==="not-reachable"&&G.basis==="loader-assumption"),Fe=we||Ne||Ie?2:0,Le;if(i!==null){let G=qn(F),ue=new Map(F.modules.map(be=>[be.id,be])),ye=[];for(let{finding:be,symbol:Ke}of ie){let Pe=Vo(F,ue,G,Ke,i,nw);ye.push({advisoryId:be.advisoryId,packageName:be.packageName,symbolName:be.symbolName,unknownKind:be.unknownKind??null,wouldPromote:Pe!==null,...Pe!==null?{anchorPackage:Pe.anchorPackage,entryExport:Pe.entryExport,viaPackages:Pe.viaPackages,totalHops:Pe.totalHops}:{}})}Le={records:ye}}let Je;if(o!==null&&e.modelShadow!==void 0){let G=e.modelShadow.widened===!0?"widened":"base",{models:ue,notes:ye,dispositions:be}=rl(o,p,{shadowConsultDenylisted:!0}),{delta:Ke}=sr(F,ue),Pe=qn(F),Dn=new Map(F.modules.map(re=>[re.id,re])),pt=xw(F,Dn,Pe),Be=bw(F),Kn=Ke.records.some(re=>pt.some(me=>me.packageName===re.anchor.packageName&&me.exportName===re.anchor.exportName&&me.container===re.anchor.container)),Qe=[],pn=Date.now();for(let{finding:re,symbol:me}of ae){let Ee=Ke.records,en=fl(re,me,G),Ce=en?Ks(F,Dn,Pe,me,Ee):null,Oe=Ke.records.filter(sn=>sn.callee.packageName===me.packageName&&sn.callee.exportName===me.exportName&&sn.callee.container===me.container||sn.callee.packageName===me.packageName&&sn.callee.realFunctionId!==null);Qe.push({advisoryId:re.advisoryId,packageName:re.packageName,symbolName:re.symbolName,unknownKind:re.unknownKind??null,decidedAtStage:re.decidedAtStage,consultSurface:G,noHitReason:Ce!==null?null:en?Kn?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Ce!==null?Sw(Ce,Ee,pt,Be):null,verdictBefore:re.tier,verdictAfter:Ce!==null?"reachable-low":re.tier,wouldPromote:Ce!==null,...Ce!==null?{modelId:Ce.modelId,anchorPackage:Ce.anchorPackage,entryExport:Ce.entryExport,pathLabels:Ce.pathLabels,calleeBinding:Oe.find(sn=>sn.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:en?Oe.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Oe[0]?.anchor.packageName??"?"}#${Oe[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Bt=Date.now()-pn,$s=be.map(re=>{if(re.status!=="active")return{modelId:re.modelId,state:re.status,reason:re.reason,edgesLowered:0,edgesReferenceGated:0};let me=Ke.records.filter(en=>en.modelId===re.modelId).length;if(me>0)return{modelId:re.modelId,state:"lowered",reason:null,edgesLowered:me,edgesReferenceGated:re.edgeCount-me};let Ee=Ke.notes.find(en=>en.startsWith(`model ${re.modelId}:`)||en.startsWith(`model-edge ${re.modelId}:`));return{modelId:re.modelId,state:"refused",reason:Ee??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:re.edgeCount}}),mt=Qe.filter(re=>re.wouldPromote).length,ht=Z.unknown-mt,je=Z["reachable-high"]+Z["reachable-medium"],zn=re=>({none:0,"fail-on-reachable":je>0?2:0,"fail-on-unknown":re>0?2:0,both:je>0||re>0?2:0});Je={records:Qe,notes:[...ye,...Ke.notes],laneStates:$s,exitCodes:{baseline:zn(Z.unknown),withModels:zn(ht)},overlayWallMs:Bt},il(nt.dirname(e.modelShadow.outPath),{recursive:!0});let In=`${e.modelShadow.outPath}.tmp-${ol(8).toString("hex")}`;ll(In,`${JSON.stringify(Je,null,2)}
-`,{encoding:"utf8",flag:"wx"}),al(In,e.modelShadow.outPath)}let Ae;if(e.bindingShadow!==void 0){let G=Date.now(),ue=re=>X.models.length>0?{records:sr(re,X.models).delta.records,reachMods:qn(re),modulesById:new Map(re.modules.map(me=>[me.id,me]))}:null,ye=(re,me,Ee,en)=>{let Ce=[];for(let Oe of d.packages)for(let{advisory:sn,affected:Kt}of s.advisoriesForPackage(Oe.ecosystem??"npm",Oe.name)){let ls=kr(sn.id,Oe.name,Kt),km=dl(sn.id,Oe.name,s.symbolsForAffected(Kt.id),Kt.surfaceComplete,r);for(let Dl of km){let{finding:Fl,hit:Wo}=Sr(re,en,{name:Oe.name,version:Oe.version,...Oe.ecosystem!==void 0?{ecosystem:Oe.ecosystem}:{},devOnly:Oe.dev,outOfGraphExecution:C(Oe)},ls,Dl,me,Ee);Ce.push({advisoryId:sn.id,packageName:Oe.name,symbolName:Dl?.exportName??null,tier:Wo!==null?Wo.tier:Fl.tier,unknownKind:Wo!==null?null:Fl.unknownKind??null})}}return Ce},be=re=>{let me=ra({appRoot:t,entrypoints:y,depClassAnchors:x,bindingForms:re,callablePackageResolver:w,tsconfigPaths:I}),Ee=[...g.diagnostics,...oa(g),...ia(g,y.length),...Pa(a,b),...me.diagnostics];return{graph:me.graph,inc:Op(me.graph,Ee,Y),aborted:Rp(y.length,me.graph),live:ue(me.graph),applicability:me.bindingApplicability}},Ke=re=>{let me=be(re);return ye(me.graph,me.inc,me.aborted,me.live)},Pe=be({}),Dn=ye(Pe.graph,Pe.inc,Pe.aborted,Pe.live),pt=ye(F,V,E,$);if(pt.length!==Dn.length)throw new et("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let Be=(re,me)=>me.tier!==re.tier||me.unknownKind!==re.unknownKind,Kn=Dn.some((re,me)=>{let Ee=pt[me];return Ee!==void 0&&Be(re,Ee)}),Qe=Kn?Ke({additiveForms:!0}):null,pn=Kn?Ke({namelessExports:!0}):null,Bt=0,$s=Dn.map((re,me)=>{let Ee=pt[me];if(Ee===void 0||Ee.advisoryId!==re.advisoryId||Ee.packageName!==re.packageName||Ee.symbolName!==re.symbolName)throw new et("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let en={advisoryId:re.advisoryId,packageName:re.packageName,symbolName:re.symbolName,unknownKind:re.unknownKind,verdictBefore:re.tier,verdictAfter:Ee.tier,wouldPromote:Ee.tier!==re.tier&&(Ee.tier==="reachable-high"||Ee.tier==="reachable-medium"||Ee.tier==="reachable-low")};if(!Be(re,Ee)||Qe===null||pn===null)return en;Bt+=1;let Ce=Qe[me],Oe=pn[me],sn=Ce!==void 0&&Be(re,Ce),Kt=Oe!==void 0&&Be(re,Oe);return{...en,attributedArm:sn&&!Kt?"additiveForms":Kt&&!sn?"namelessExports":"both",...Ce!==void 0?{verdictArmA:Ce.tier}:{},...Oe!==void 0?{verdictArmB:Oe.tier}:{}}}),mt={...Z};Dn.forEach((re,me)=>{let Ee=pt[me];Ee!==void 0&&Ee.tier!==re.tier&&(mt[Ee.tier]-=1,mt[re.tier]+=1)});let ht=(re,me)=>({none:0,"fail-on-reachable":re>0?2:0,"fail-on-unknown":me>0?2:0,both:re>0||me>0?2:0}),je;if(X.models.length>0&&$!==null){je=[];for(let re of d.packages)for(let{advisory:me,affected:Ee}of s.advisoriesForPackage(re.ecosystem??"npm",re.name)){let en=kr(me.id,re.name,Ee),Ce=dl(me.id,re.name,s.symbolsForAffected(Ee.id),Ee.surfaceComplete,r);for(let Oe of Ce){if(Oe===null||!Oe.verified)continue;let sn=Sr(Pe.graph,Pe.live,{name:re.name,version:re.version,...re.ecosystem!==void 0?{ecosystem:re.ecosystem}:{},devOnly:re.dev,outOfGraphExecution:C(re)},en,Oe,Pe.inc,Pe.aborted);if(!(sn.hit===null&&fl(sn.finding,Oe,"base")))continue;let ls=Ks(F,$.modulesById,$.reachMods,Oe,$.records);je.push({advisoryId:me.id,packageName:re.name,symbolName:Oe.exportName,modelWouldPromote:ls!==null,...ls!==null?{modelId:ls.modelId}:{},anchorCleared:ls!==null})}}}let zn=H.some(re=>re.modelId!==void 0);Ae={records:$s,deltas:Bt,exitCodes:{baseline:ht(mt["reachable-high"]+mt["reachable-medium"],mt.unknown+(zn?1:0)),withBindingForms:ht(Z["reachable-high"]+Z["reachable-medium"],Z.unknown+(zn?1:0))},dualRunWallMs:Date.now()-G,...R.bindingApplicability!==void 0?{applicability:R.bindingApplicability}:{},...je!==void 0?{modelProbe:je}:{}},il(nt.dirname(e.bindingShadow.outPath),{recursive:!0});let In=`${e.bindingShadow.outPath}.tmp-${ol(8).toString("hex")}`;ll(In,`${JSON.stringify(Ae,null,2)}
-`,{encoding:"utf8",flag:"wx"}),al(In,e.bindingShadow.outPath)}let tn=new Nt(t),Ms=new Map,Ts=G=>{let ue=Ms.get(G);if(ue!==void 0)return ue;let ye=G==="npm"?new Hs(F,tn,zs("npm"),()=>""):new Hs(l?.graph??Ps,tn,zs("PyPI"),ci((l?.roots??[]).map(be=>be.rootRel)));return Ms.set(G,ye),ye},B=ne.length>0||X.notes.length>0?{active:X.models.length,stored:ne.length,promoted:H.filter(G=>G.modelId!==void 0).length,notes:[...X.notes,...D!==null?D.notes:[]]}:void 0,q=ww(H,n,pe),Q=q.findings.map(G=>G.path===void 0?G:{...G,located:Ts(G.ecosystem).locate(G)}),oe=new Map,ke=G=>{let ue=oe.get(G);if(ue!==void 0)return ue;let ye=G==="npm"?bd(F,tn):l===null?null:Sd(l.graph,Ts("PyPI"),tn);return oe.set(G,ye),ye},Re=Q.map(G=>{let ue=G.located?.nodeOf,ye=G.path?.[G.path.length-1]?.functionId;if(G.influence===void 0||ue===void 0||ue===null||ye===void 0)return G;let be=ke(G.ecosystem);return be===null?G:{...G,influenceOverlay:kd(be.index,ye,ue,be.lineOf,be.pathOf)}}),En=()=>{if(l===null)return null;let G=new Map(l.graph.modules.map(ye=>[ye.id,ye])),ue=ci(l.roots.map(ye=>ye.rootRel));return{graph:Dr(l.graph),lineOf:ye=>{let be=G.get(ye.path);if(be===void 0||be.id.includes("site-packages:"))return null;let Ke=ue(be.id),Pe=Ke===""?be.path:`${Ke}/${be.path}`;return At(tn,{...ye,path:Pe},"utf8-bytes")?.startLine??null}}},Nn=hp(t,Re,d.perRoot.flatMap(G=>G.pythonLockfilePath?[G.pythonLockfilePath]:[])),An;if(e.influenceShadow!==void 0){let G=ad(F,q.findings,()=>Cs.now(),ye=>At(tn,ye,"utf16-units")?.startLine??null,En());il(nt.dirname(e.influenceShadow.outPath),{recursive:!0});let ue=`${e.influenceShadow.outPath}.tmp-${ol(8).toString("hex")}`;ll(ue,`${JSON.stringify(G,null,2)}
-`,{encoding:"utf8",flag:"wx"}),al(ue,e.influenceShadow.outPath),An={ports:G.totals.ports,byOutcome:G.totals.byOutcome,wallMs:G.wallMs}}return{...An!==void 0?{influenceShadow:An}:{},...Le!==void 0?{summaryShadow:Le}:{},...Je!==void 0?{modelShadow:Je}:{},...Ae!==void 0?{bindingShadow:Ae}:{},...B!==void 0?{modelLane:B}:{},dir:t,shardSchemaVersion:s.schemaVersion,installed:d,findings:Re.map((G,ue)=>{let ye=Nn.idOf[ue]??null;return ye===null?G:{...G,introducedBy:ye}}),packageGraphs:Nn.graphs,timings:q.timings,counts:Z,analyzerDiagnostics:U,pythonDiagnostics:l?.diagnostics??[],analysisAborted:J,rejectedEntries:h,entrypointSources:_,entrypointGaps:[...g.gaps,...g.surfaceGaps],entrypointObservations:g.observations,framework:g.framework,unresolved:P,advisories:[...z.values()],rootSet:a,exitCode:Fe,adr105:j.report}}finally{e.reader===void 0&&s.close()}}var cl=e=>Math.round(e*10)/10;function ww(e,n,t){let s=Cs.now(),r=e.map(o=>{let a=Yo(o.tier);return a===void 0?o:{...o,influence:a}}),i=Cs.now()-s;return{findings:r,timings:{scanMs:cl(s-n),cascadeMs:cl(t),stage6Ms:cl(i)}}}var vw="cupel",Ew="reachability-first SCA \u2014 verdict + call path + confidence";function gl(e){return[`${vw} v${e} \u2014 ${Ew}`,`cascade: ${Ql.join(" \u2192 ")}`,`verdicts: ${ed.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
-`)}var Nw=new Set([...ei,...ni]);function ft(e,n,t){let s=e[n+1];if(s===void 0||s.startsWith("--"))throw new Error(`${t} requires a value`);return s}function Aw(e){let n=e.split(",").map(r=>r.trim()),t=[...ei,...ni].join(", ");if(n.length===0||n.some(r=>r===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let s=[];for(let r of n){if(!Nw.has(r))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(r)}; valid: ${t}`);s.push(r)}return s}function Tp(e){let n=".",t,s,r,i=!1,o=!1,a=!1,d=!1,l=!1,c,p,u,f=!1,h=!1,g,y,_=!1,b=!0,x=!1,k,w=[],I=[];for(let N=0;N<e.length;N+=1){let v=e[N];if(v==="--require-complete-denial"){o=!0;continue}if(v==="--fail-on-reachable")i=!0;else if(v==="--fail-on-unknown")a="all";else if(v!==void 0&&v.startsWith("--fail-on-unknown="))a=Aw(v.slice(18));else if(v==="--offline")d=!0;else if(v==="--sarif")t=ft(e,N,"--sarif"),N+=1;else if(v==="--shard")s=ft(e,N,"--shard"),N+=1;else if(v==="--shard-pypi")r=ft(e,N,"--shard-pypi"),N+=1;else if(v==="--entry")w.push(ft(e,N,"--entry")),N+=1;else if(v==="--root")I.push(ft(e,N,"--root")),N+=1;else if(v==="--summary-shadow")c=ft(e,N,"--summary-shadow"),N+=1;else if(v==="--model-shadow")p=ft(e,N,"--model-shadow"),N+=1;else if(v==="--model-shadow-out")u=ft(e,N,"--model-shadow-out"),N+=1;else if(v==="--model-shadow-widened")f=!0;else if(v==="--binding-shadow")h=!0;else if(v==="--x-influence-shadow")y=ft(e,N,"--x-influence-shadow"),N+=1;else if(v==="--binding-shadow-out")g=ft(e,N,"--binding-shadow-out"),N+=1;else if(v==="--x-partial-rows")_=!0;else if(v==="--no-tsconfig-paths")b=!1;else if(v==="--x-tsconfig-paths")b=!0;else if(v==="--push")x=!0;else if(v!==void 0&&v.startsWith("--auth=")){let C=v.slice(7);if(C!=="oidc"&&C!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(C)}`);k=C}else{if(v!==void 0&&v.startsWith("--"))throw new Error(`unknown flag ${v}`);v!==void 0&&!l&&(n=v,l=!0)}}if(p===void 0!=(u===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(f&&p===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(g!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(k!==void 0&&!x)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:s,shardPypi:r,failOnReachable:i,requireCompleteDenial:o,failOnUnknown:a,offline:d,entry:w,root:I,summaryShadow:c,modelShadow:p,modelShadowOut:u,modelShadowWidened:f,push:x,auth:k,bindingShadow:h,bindingShadowOut:g,influenceShadowOut:y,partialRows:_,tsconfigPaths:b}}import{chmodSync as Tw,mkdirSync as $w,readFileSync as Lw,renameSync as Dw,statSync as Fw,unlinkSync as jw,writeFileSync as Bw}from"node:fs";import{randomBytes as Kw}from"node:crypto";import{homedir as zw}from"node:os";import is from"node:path";import{createPublicKey as Iw,verify as Rw}from"node:crypto";var Se=class extends Error{constructor(n){super(n),this.name="DistError"}},os=class extends Se{constructor(n){super(n),this.name="NoCachedShardError"}},Ow=Buffer.from("302a300506032b6570032100","hex"),Pw=32;function Fp(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Pw)try{return Iw({key:Buffer.concat([Ow,n]),format:"der",type:"spki"})}catch{return}}function yl(e,n,t){for(let s of t){let r=Fp(s);if(r!==void 0)try{if(Rw(null,e,r,n))return!0}catch{}}return!1}function jp(e){return e.some(n=>Fp(n)!==void 0)}var Cw=/^[0-9a-f]{64}$/u,Mw=/^[a-z0-9-]+$/u;function $p(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new Se(`${n} must be an object`);return e}function Lp(e,n){if(!Array.isArray(e))throw new Se(`${n} must be an array`);return e}function $o(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new Se(`${n} must be an integer`);return e}function Lo(e,n){if(typeof e!="string")throw new Se(`${n} must be a string`);return e}function Dp(e,n){let t=Lo(e,n);if(Number.isNaN(Date.parse(t)))throw new Se(`${n} is not a valid timestamp: ${t}`);return t}function _l(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new Se("distribution index is not valid JSON")}let s=$p(t,"index"),r=$o(s.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new Se(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let i=$o(s.sequence,"sequence");if(i<0)throw new Se("sequence must be non-negative");let o=Dp(s.generated,"generated"),a=Lp(s.shards,"shards"),d;for(let h of a){let g=$p(h,"shard entry"),y=Lo(g.ecosystem,"ecosystem");if(!Mw.test(y))throw new Se(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){d=g;break}}if(d===void 0)throw new Se(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);Dp(d.built,"built");let l=$o(d.db_schema_version,"db_schema_version");if(l<1)throw new Se("db_schema_version must be >= 1");if(l>n.supportedDbSchemaVersion)throw new Se(`this shard needs a newer cupel (db_schema_version ${String(l)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let c=Lo(d.sha256,"sha256");if(!Cw.test(c))throw new Se(`sha256 must be 64 lowercase hex, got ${JSON.stringify(c)}`);let p=$o(d.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new Se(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let u=Lp(d.urls,"urls");if(u.length===0)throw new Se("urls must be a non-empty array");let f=[];for(let h of u){let g=Lo(h,"url");try{f.push(On(g,n.shardHosts))}catch(y){throw new Se(`refusing shard url ${JSON.stringify(g)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:c,sizeBytes:p,dbSchemaVersion:l,urls:f,sequence:i,generated:o}}var Bp="CUPEL_CONFIG_DIR",Kp="credentials.json",xl="cpd_",Uw="cpl_",qw=xl.length+6+32,Hw=200,Ww=/^[A-Za-z0-9_-]+$/u,vr=class extends Se{constructor(n){super(n),this.name="StoredCredentialError"}};function zp(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=zw();if(process.platform==="darwin")return is.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let i=e.APPDATA,o=i!==void 0&&i!==""?i:is.join(t,"AppData","Roaming");return is.join(o,"cupel")}let s=e.XDG_CONFIG_HOME,r=s!==void 0&&s!==""?s:is.join(t,".config");return is.join(r,"cupel")}function Do(e){return is.join(zp(e),Kp)}function bl(e){let n=e.trim();return n.startsWith(Uw)?{ok:!1,reason:"push-token"}:n.startsWith(xl)?n.length<qw||n.length>Hw?{ok:!1,reason:"malformed"}:Ww.test(n.slice(xl.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function Up(e,n){let t=zp(e),s=is.join(t,Kp);$w(t,{recursive:!0,mode:448}),process.platform!=="win32"&&Tw(t,448);let r=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),i=`${s}.tmp-${Kw(8).toString("hex")}`;return Bw(i,`${r}
-`,{flag:"wx",mode:384}),Dw(i,s),s}function qp(e){let n=Do(e),t;try{t=Fw(n)}catch(o){if(o instanceof Error&&o.code==="ENOENT")return;throw o}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new vr(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let s;try{s=JSON.parse(Lw(n,"utf8"))}catch{throw new vr(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let r=typeof s=="object"&&s!==null&&"delivery_token"in s?s.delivery_token:void 0,i=bl(typeof r=="string"?r:"");if(!i.ok)throw new vr(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return i.token}function Hp(e){try{return jw(Do(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var Er="CUPEL_DELIVERY_TOKEN",Sl=class extends Se{constructor(n){super(n),this.name="NoDeliveryTokenError"}},kl=class extends Se{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Gw(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function Wp(e,n,t=()=>{}){let s=Gw(e)??t();return s!==void 0?()=>Promise.resolve(s):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function Gp(e){if(e===void 0)throw new Sl(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${Er} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new kl(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Vw="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function Xw(){return new Promise(e=>{let n=process.stdin;process.stderr.write(Vw),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",s=i=>{n.setRawMode(!1),n.pause(),n.removeListener("data",r),process.stderr.write(`
-`),i===null&&process.exit(130),e(i)},r=i=>{for(let o of i){if(o==="")return s(null);if(o==="\r"||o===`
-`)return s(t);if(o==="\x7F"||o==="\b"){t=t.slice(0,-1);continue}t+=o}};n.on("data",r)})}async function Yw(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function Vp(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${te(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
-`),!0)}async function Xp(e){if(Vp(e,"login"))return 1;let n=process.stdin.isTTY?await Xw():await Yw(),t=bl(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
+`:"",encoding:"utf8",maxBuffer:r0,timeout:n.timeoutMs??o0,env:t});if(a.error!==void 0){let g=a.error.code,y=g==="ENOENT";return{refused:y?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,y?`no Python interpreter: \`${s}\` is not on PATH (set ${lg} to the interpreter this project runs under)`:`the Python extract could not run (${g??a.error.message})`]}}if(a.status!==0){let g=(a.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,`the Python extract exited ${String(a.status??"on a signal")}${g!==""?`: ${g}`:""}`]}}let l=(a.stdout??"").split(`
+`).filter(g=>g.trim()!==""),d=null,c=[],f=[],p=new Map,u=[];for(let g of l){let y;try{y=JSON.parse(g)}catch{r.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!Pn(y))continue;if(y.kind==="header"){d=we(y.interpreter,64);let _=y.stdlib;Array.isArray(_)&&(c=_.filter(S=>typeof S=="string"&&S.length<=128)),f=us(y.builtins).filter(S=>typeof S=="string"&&S.length<=128),p=$0(y.typeAttrs);continue}let b=T0(y);if(b===null){r.push("the Python extract emitted a file row without a path; it was skipped");continue}u.push(b)}if(d===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,"the Python extract did not report an interpreter version"]};let m=o.length-u.length;return m>0&&r.push(`${String(m)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:d,files:u,stdlib:c,diagnostics:r,builtins:f,typeAttrs:p}}function $0(e){let n=new Map;if(!Pn(e))return n;for(let[t,s]of Object.entries(e))!pg.has(t)||!Array.isArray(s)||n.set(t,new Set(s.filter(r=>typeof r=="string"&&r.length<=128)));return n}var D0="python3",F0={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","extract-truncated":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function j0(e,n){let t=F0[e.code];return t!=="dynamic-load"?t:n!==void 0&&n.packageName!==""?"dep-opaque":t}function B0(e,n,t=s=>cr([],{python:s}).refused===null){let s=Ps.resolve(e,n.envRel);for(let r of["bin/python3","bin/python","Scripts/python.exe"]){let o=Ps.join(s,r);try{if(!L0(o).isFile())continue}catch{continue}if(t(o))return o}return D0}function G0(e,n){let t=[e];for(let s of n.sitePackages)t.push(Ps.resolve(e,s));for(let s of n.pthFiles)for(let r of s.paths)t.push(Ps.isAbsolute(r)?r:Ps.resolve(e,s.sitePackages,r));return{roots:[...new Set(t)]}}function K0(e){let n=[];for(let t of e.distInfos){let s=Ur(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});s!==null&&n.push(s)}return n}function _g(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function z0(e,n,t={}){let r=(t.readEnvironment??eo)(n),o=K0(r),i=fi(o),a=r.diagnostics.map(S=>S),l=t.python??B0(n,r),d=G0(n,r),c=X0(r,i,d),f=new Map;for(let S of o)f.set(S.name,q0(S,c.distributions));for(let S of c.seen)a.push(`startup hook: ${S}`);for(let S of c.unattributed)a.push(`startup escape: ${S} \u2014 a module runs at interpreter start that no installed distribution claims`);let p=_d({projectRoot:n,paths:d,python:l});for(let S of p.gaps)a.push(`entrypoint \`${S.declaration}\` (${S.source}): ${S.detail}`);if(p.entrypoints.length===0)return a.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,pythonPath:l,graph:pr,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:p.gaps,interpreter:null,diagnostics:a,execution:f};let u=yd({projectRoot:n,paths:d,entryFiles:p.entrypoints.map(S=>Ps.join(n,S.file)),environmentComplete:!r.truncated&&r.refused===null,externalRoots:r.sitePackages.map(S=>Ps.resolve(n,S)),distributionOf:_g(i),python:l,...t.maxModules!==void 0?{maxModules:t.maxModules}:{},preciseNames:t.preciseNames!==!1,...t.nameMatchLabel===!0?{nameMatchLabel:!0}:{}});for(let S of u.diagnostics)a.push(`${S.code} at ${S.where}: ${S.detail}`);if(u.graph.modules.length===0)return{rootRel:e,pythonPath:l,graph:pr,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:p.entrypoints,entrypointGaps:p.gaps,interpreter:u.interpreter,diagnostics:a,execution:f};let m=new Map;for(let S of u.graph.modules)m.set(S.id,S.id),m.set(S.path,S.id);let g=new Map(u.graph.modules.map(S=>[S.id,S])),y=S=>g.get(S)??g.get(m.get(S)??""),b=u.graph.modules[0]?.id,_=u.diagnostics.map(S=>{let k=y(S.where);return{source:k?.id??b,cause:j0(S,k),reach:{kind:"unbounded"}}});if(c.unattributed.length>0&&_.push({source:b,cause:"dynamic-load",reach:{kind:"unbounded"}}),_.push(...U0(u.graph)),u.opaqueCode.length>0){let S=u.graph.modules.find(v=>v.isEntrypoint)?.id??b,k=W0(u.graph,u.opaqueCode,o);_.push({source:S,cause:"dep-opaque",reach:{kind:"loaded-package",ecosystem:"PyPI",alsoLoaded:k}}),a.push(`code no analysis reads is loaded (${bg(u.opaqueCode)}): a loaded package is not reported unreachable, and neither is any of the ${String(k.length)} package(s) in the declared-dependency closure of the distributions that ship it (${bg(k)})`)}return{rootRel:e,pythonPath:l,graph:u.graph,incompleteness:_,analysisAborted:null,entrypoints:p.entrypoints,entrypointGaps:p.gaps,interpreter:u.interpreter,diagnostics:a,execution:f}}var bg=e=>`${e.slice(0,5).join(", ")}${e.length>5?", \u2026":""}`;function W0(e,n,t){let s=new Set(e.modules.map(c=>c.packageName).filter(c=>c!=="")),r=new Map;for(let c of t){let f=r.get(c.name);if(f===void 0)r.set(c.name,new Set(c.requiresDist));else for(let p of c.requiresDist)f.add(p)}let o=new Set,i=fi(t),a=_g(i);for(let c of n){let f=a(c.split(".")[0]??c);f!==null&&o.add(f);for(let p of Hr(i,c))o.add(p.name)}for(let c of t)s.has(c.name)&&(c.extensionModules>0||!c.recordKnown)&&o.add(c.name);let l=new Set,d=[...o];for(let c=d.pop();c!==void 0;c=d.pop())if(!l.has(c)){l.add(c);for(let f of r.get(c)??[])r.has(f)&&!l.has(f)&&d.push(f)}return[...l].sort((c,f)=>c<f?-1:c>f?1:0)}function U0(e){let n=new Map(e.functions.map(r=>[r.id,r.moduleId])),t=new Set(e.modules.filter(r=>r.packageName!==""&&r.externalSurface!==!0).map(r=>r.id)),s=new Set;for(let r of e.callSites){if(r.resolution!=="unresolved")continue;let o=n.get(r.enclosingFunctionId);o!==void 0&&t.has(o)&&s.add(o)}return[...s].map(r=>({source:r,cause:"dep-opaque",reach:{kind:"dependency-dispatch"}}))}var pr={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function H0(e){if(e.length===0)return null;let n=[],t=new Map;for(let b of e){let _=b.rootRel===""?".":b.rootRel;for(let S of b.diagnostics)n.push(`${_}: ${S}`);for(let[S,k]of b.execution){let v=t.get(S);t.set(S,v===void 0?k:[...new Set([...v,...k])])}}let s=e.filter(b=>b.analysisAborted===null);if(s.length===0)return{graph:pr,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let r=[],o=[],i=[],a=[],l=[],d=[],c=[],f=[],p=[],u=[],m=[],g=new Set;for(let b of s){let _=b.rootRel===""?"":`${b.rootRel}::`,S=new Set(b.graph.modules.filter(A=>A.externalSurface===!0).map(A=>A.id)),k=A=>S.has(A)?A:`${_}${A}`,v=A=>`${_}${A}`,I=A=>`${_}${A}`,O=A=>`${_}${A}`,E=A=>`${_}${A}`,N=A=>`${_}${A}`;for(let A of b.graph.modules){if(A.externalSurface===!0){if(g.has(A.id))continue;g.add(A.id),r.push(A);continue}r.push({...A,id:k(A.id)})}for(let A of b.graph.imports)o.push({...A,id:v(A.id),moduleId:k(A.moduleId),...A.resolvedModuleId!==void 0?{resolvedModuleId:k(A.resolvedModuleId)}:{}});for(let A of b.graph.importEdges)i.push({importId:v(A.importId),resolvedModuleId:k(A.resolvedModuleId)});for(let A of b.incompleteness)m.push({...A,source:k(A.source)});for(let A of b.graph.functions)a.push({...A,id:I(A.id),moduleId:k(A.moduleId),...A.enclosingClassId!==void 0?{enclosingClassId:O(A.enclosingClassId)}:{}});for(let A of b.graph.classes)l.push({...A,id:O(A.id),moduleId:k(A.moduleId),members:A.members.map(I)});for(let A of b.graph.exports)d.push({...A,id:N(A.id),moduleId:k(A.moduleId)});for(let A of b.graph.exportBindings)c.push({exportId:N(A.exportId),target:A.target.kind==="function"?{kind:"function",functionId:I(A.target.functionId)}:{kind:"module",moduleId:k(A.target.moduleId)}});for(let A of b.graph.callSites)f.push({...A,id:E(A.id),enclosingFunctionId:I(A.enclosingFunctionId),resolvedTargetIds:A.resolvedTargetIds.map(I)});for(let A of b.graph.callEdges)p.push({...A,callSiteId:E(A.callSiteId),calleeFunctionId:I(A.calleeFunctionId)});for(let A of b.graph.inheritEdges)u.push({...A,subclassId:O(A.subclassId),superclassId:O(A.superclassId)})}let y=r[0]?.id;for(let b of e)b.analysisAborted===null||y===void 0||m.push({source:y,cause:b.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:r,imports:o,importEdges:i,functions:a,classes:l,exports:d,exportBindings:c,callSites:f,callEdges:p,inheritEdges:u},incompleteness:m,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function Sg(e,n={}){let t=e.filter(s=>Jr(s));return t.length===0?null:H0(t.map(s=>z0(s.rel,s.abs,n)))}function q0(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var V0=["sitecustomize","usercustomize"];function X0(e,n,t){let s=new Set,r=[],o=[];for(let i of e.pthFiles){for(let l of i.importModules){let d=Hr(n,l);for(let f of d)s.add(f.name);let c=Wt(t,l);if(c.resolved!==null){o.push(`${i.sitePackages}/${i.name}: \`import ${l}\` runs ${c.resolved.path}`);continue}d.length===0&&r.push(`${i.sitePackages}/${i.name}: \`import ${l}\``)}let a=i.importModules.length;i.importLines>a&&r.push(`${i.sitePackages}/${i.name}: ${String(i.importLines-a)} import line(s) whose module could not be read`)}for(let i of V0){let a=Wt(t,i);if(a.resolved===null)continue;let l=Hr(n,i);for(let d of l)s.add(d.name);l.length===0?r.push(`${a.resolved.path}: \`import ${i}\` runs at every interpreter start`):o.push(`${i}: \`import ${i}\` runs ${a.resolved.path}`)}return{distributions:s,unattributed:r,seen:o}}import{spawnSync as Y0}from"node:child_process";import{closeSync as J0,lstatSync as Q0,openSync as Z0,readdirSync as Og,readFileSync as eA,readSync as nA,realpathSync as wd,statSync as gr}from"node:fs";import{homedir as xg,tmpdir as tA}from"node:os";import De from"node:path";var sA="ImportPath,Dir,Standard,Module,IgnoredGoFiles,Error,DepsErrors",kg=21,Pg="CUPEL_GO",rA=3e5,oA=256*1024*1024,iA=1e5,aA=8,lA=1e5,dA=5e4,wg=1024*1024,vg=4*1024*1024,Eg=16*1024*1024,Ag=8,Ig=200,qt=8;function vd(e,n,t){let s={...e};return s.GOTOOLCHAIN="local",s.GOPROXY="off",s.GOFLAGS=`-mod=${n}`,s.GO111MODULE="on",s.GOCACHE="off",t!==null&&(s.GOWORK=t),s}function Ed(e,n,t,s){let r=Y0(e.go,n,{cwd:t,env:s,encoding:"utf8",timeout:e.timeoutMs,killSignal:"SIGKILL",maxBuffer:e.maxOutputBytes,stdio:["ignore","pipe","pipe"],windowsHide:!0,shell:!1});if(r.error!==void 0){let o=r.error.code;return o==="ENOENT"?{kind:"missing"}:o==="ETIMEDOUT"?{kind:"failed",detail:`timed out after ${String(e.timeoutMs/1e3)} s`}:o==="ENOBUFS"?{kind:"failed",detail:`printed more than ${String(e.maxOutputBytes)} bytes`}:{kind:"failed",detail:`could not run (${o??"spawn error"})`}}return r.signal!==null?{kind:"failed",detail:`was killed (${r.signal})`}:{kind:"ran",status:r.status??1,stdout:r.stdout,stderr:r.stderr}}function mr(e){let n="";for(let t of e.slice(-600)){let s=t.charCodeAt(0);n+=s<32||s===127||s>=128&&s<=159?" ":t}return n.replace(/ {2,}/gu," ").trim()}function Cg(e){let n=e.split(" ")[0]??"",t=/^go(\d{1,4})\.(\d{1,4})(?:\.(\d{1,4}))?(?:(alpha|beta|rc)(\d{1,4}))?$/u.exec(n);if(t===null)return null;let[,s,r,o,i,a]=t,l=`${s??"0"}.${r??"0"}.${o??"0"}`;return i===void 0?l:`${l}-${i}.${a??"0"}`}function cA(e){let n=Ed(e,["env","-json","GOVERSION","GOOS","GOARCH","CGO_ENABLED","GOEXPERIMENT","GOROOT","GOMODCACHE"],tA(),vd(e.env,"readonly","off"));if(n.kind==="missing")return{refused:"missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH (set ${Pg} to point at one)`};if(n.kind==="failed")return{refused:"unusable",detail:`\`${e.go} env\` ${n.detail}`};if(n.status!==0)return{refused:"unusable",detail:`\`${e.go} env\` exited ${String(n.status)}: ${mr(n.stderr)}`};let t;try{t=JSON.parse(n.stdout)}catch{t=null}let s=typeof t=="object"&&t!==null?t:{},r=s.GOVERSION,o=s.GOOS,i=s.GOARCH,a=s.CGO_ENABLED,l=s.GOEXPERIMENT,d=u=>typeof u=="string"&&u.length>1&&u.length<=4096&&De.isAbsolute(u)?u:null,c=u=>typeof u=="string"&&u.length>0&&u.length<=64&&/^[A-Za-z0-9_]+$/u.test(u);if(typeof r!="string"||r.length===0||r.length>256||!c(o)||!c(i))return{refused:"unusable",detail:`\`${e.go} env -json\` did not report GOVERSION, GOOS and GOARCH`};let f=Cg(r),p=/^go1\.(\d+)/u.exec(r)?.[1];return f!==null&&p!==void 0&&Number(p)<kg?{refused:"unusable",detail:`the Go toolchain on PATH is ${mr(r)}; the Go scan needs go1.${String(kg)} or later`}:{toolchain:{goversion:mr(r),release:f,goos:o,goarch:i,cgo:a==="1",experiment:typeof l=="string"?mr(l).slice(0,200):"",goroot:d(s.GOROOT),gomodcache:d(s.GOMODCACHE)}}}function Ng(e){let n=e.filter(t=>t[0]!==null&&t[0].length>1).sort((t,s)=>s[0].length-t[0].length);return t=>{let s=t;for(let[r,o]of n)s=s.split(r).join(o);return s.replace(/(^|[\s(["'`=])\/[^\s:"'`()\]]+/gu,"$1<path>")}}function Mg(e,n){for(let t=0;t<e.length;t+=1){let s=e.charCodeAt(t);if(!(n&&(s===10||s===9))&&(s<32||s===127||s>=128&&s<=159))return!0}return!1}function Ni(e,n){if(typeof e!="string"||e.length===0||e.length>n)return!1;for(let t=0;t<e.length;t+=1){let s=e.charCodeAt(t);if(s<=32||s>=127||s===34||s===39||s===92||s===96)return!1}return!0}function Tg(e){return typeof e=="string"&&e.length>3&&e.length<=255&&e.endsWith(".go")&&!e.includes("/")&&!e.includes("\\")&&!Mg(e,!1)}var un=class extends Error{};function $g(e,n){if(e===void 0)return!1;if(typeof e!="boolean")throw new un(`${n} is not a boolean`);return e}function co(e,n,t,s=!1){if(e==null)return null;if(typeof e!="string"||e.length>t||Mg(e,s))throw new un(`${n} is not a bounded string`);return e}function uA(e,n){if(e==null)return null;if(typeof e!="object"||Array.isArray(e))throw new un(`${n}.Module is not an object`);let t=e;if(!Ni(t.Path,1024))throw new un(`${n}.Module.Path is not a module path`);let s=t.Version===void 0?"":t.Version;if(s!==""&&!Ni(s,256))throw new un(`${n}.Module.Version is not a version`);let r=null,o=t.Replace;if(o!=null){if(typeof o!="object"||Array.isArray(o))throw new un(`${n}.Module.Replace is not an object`);let a=o,l=co(a.Path,`${n}.Module.Replace.Path`,4096),d=a.Version===void 0?"":a.Version;if(l===null||l.length===0)throw new un(`${n}.Module.Replace.Path is missing`);if(d!==""&&!Ni(d,256))throw new un(`${n}.Module.Replace.Version is not a version`);r={path:l,version:d}}let i=co(t.Dir,`${n}.Module.Dir`,4096);if(i!==null&&!De.isAbsolute(i))throw new un(`${n}.Module.Dir is not absolute`);return{path:t.Path,version:s,main:$g(t.Main,`${n}.Module.Main`),replace:r,dir:i}}function fA(e,n){let t=`package ${String(n)}`;if(typeof e!="object"||e===null||Array.isArray(e))throw new un(`${t} is not an object`);let s=e,r=co(s.ImportPath,`${t}.ImportPath`,1024);if(r===null||r.length===0)throw new un(`${t} has no ImportPath`);let o=co(s.Dir,`${t}.Dir`,4096);if(o!==null&&!De.isAbsolute(o))throw new un(`${t}.Dir is not absolute`);let i=s.IgnoredGoFiles,a=[];if(i!=null){if(!Array.isArray(i)||i.length>1e5)throw new un(`${t}.IgnoredGoFiles is not a bounded list`);a=i.map(f=>{if(!Tg(f))throw new un(`${t}.IgnoredGoFiles holds a name that is not a file`);return f})}let l=null,d=s.Error;if(d!=null){if(typeof d!="object"||Array.isArray(d))throw new un(`${t}.Error is not an object`);l=co(d.Err,`${t}.Error.Err`,65536,!0),l??="error without a message"}let c=s.DepsErrors;if(c!=null&&!Array.isArray(c))throw new un(`${t}.DepsErrors is not a list`);return{importPath:r,dir:o,standard:$g(s.Standard,`${t}.Standard`),module:uA(s.Module,t),ignoredGoFiles:a,error:l}}function pA(e,n){let t=[],s=0,r=-1,o=!1,i=!1;try{for(let a=0;a<e.length;a+=1){let l=e.charCodeAt(a);if(o){i?i=!1:l===92?i=!0:l===34&&(o=!1);continue}if(s===0){if(l===123){s=1,r=a;continue}if(l===32||l===10||l===13||l===9)continue;return{refused:`a byte outside any object at offset ${String(a)}`}}if(l===34)o=!0;else if(l===123||l===91){if(s+=1,s>Ag)return{refused:`an object nested deeper than ${String(Ag)}`}}else if((l===125||l===93)&&(s-=1,s===0)){if(a+1-r>Eg)return{refused:"an object over the size bound"};if(t.length>=n)return{refused:`more than ${String(n)} packages`};t.push(fA(JSON.parse(e.slice(r,a+1)),t.length))}if(s>0&&a+1-r>Eg)return{refused:"an object over the size bound"}}}catch(a){return{refused:a instanceof Error?a.message:"an object that is not JSON"}}return s!==0||o?{refused:"the stream ends inside an object"}:{packages:t}}function mA(e){let n=0,t=!1,s=!1,r=null,o=e.charCodeAt(0)===65279?1:0;e:for(;o<e.length;){let i=e.indexOf(`
+`,o),a=(i<0?e.slice(o):e.slice(o,i)).trim();if(o=i<0?e.length:i+1,a.length===0&&!t){n=o;continue}if(a.startsWith("//")||(t=!0),!s&&a.startsWith("//go:build")){let l=a.slice(10);if(l.length===0||l.trim().length<l.length){if(r!==null)return!1;r=l.trim()}}for(;a.length>0;){if(s){let l=a.indexOf("*/");if(l<0)continue e;s=!1,a=a.slice(l+2).trim();continue}if(a.startsWith("//"))continue e;if(a.startsWith("/*")){s=!0,a=a.slice(2).trim();continue}break e}}if(r!==null)return r==="ignore";for(let i of e.slice(0,n).split(`
+`)){let a=i.trim();if(!a.startsWith("//"))continue;let l=a.slice(2).trim();if(!l.startsWith("+build"))continue;let d=l.slice(6);if(!(d.length>0&&d.charAt(0)!==" ")&&d.trim()==="ignore")return!0}return!1}function gA(e){if(e.length===0||e.length>1024||e.startsWith("-")||e.startsWith(".")||e.startsWith("/")||e.endsWith("/"))return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<=32||t===127||t>=128&&t<=159||t===34||t===39||t===92||t===96||t===58)return!1}return!e.split("/").some(n=>n===""||n==="."||n==="..")}function hA(e){let n=e.charCodeAt(0)===65279?1:0,t=e.length,s=()=>{for(;;){for(;n<t;){let d=e.charCodeAt(n);if(d===32||d===9||d===10||d===13)n+=1;else break}if(n>=t)return{kind:"eof",text:""};if(e.startsWith("//",n)){let d=e.indexOf(`
+`,n);n=d<0?t:d+1;continue}if(e.startsWith("/*",n)){let d=e.indexOf("*/",n+2);if(d<0)return{bad:"an unterminated comment"};n=d+2;continue}break}let a=e.charAt(n);if(a==='"'){let d="";for(n+=1;n<t;){let c=e.charAt(n);if(c==='"')return n+=1,{kind:"string",text:d};if(c===`
+`)return{bad:"a string broken by a newline"};if(c==="\\"){let f=e.charAt(n+1);if(f!=="\\"&&f!=='"')return{bad:"an escape in an import path"};d+=f,n+=2;continue}d+=c,n+=1}return{bad:"an unterminated string"}}if(a==="`"){let d=e.indexOf("`",n+1);if(d<0)return{bad:"an unterminated raw string"};let c=e.slice(n+1,d);return n=d+1,{kind:"string",text:c}}if(a==="("||a===")"||a===";"||a===".")return n+=1,{kind:"punct",text:a};let l=n;for(;n<t;){let d=e.charCodeAt(n);if(!(d>=48&&d<=57||d>=65&&d<=90||d>=97&&d<=122||d===95||d>127))break;n+=1}return n===l?(n+=1,{kind:"punct",text:a}):{kind:"ident",text:e.slice(l,n)}},r=[],o=s();if("bad"in o)return{refused:o.bad};if(o.kind!=="ident"||o.text!=="package")return{refused:"no package clause"};if(o=s(),"bad"in o)return{refused:o.bad};if(o.kind!=="ident")return{refused:"no package name"};let i=a=>{let l=a;return(l.kind==="ident"||l.kind==="punct"&&l.text===".")&&(l=s()),"bad"in l?l:l.kind!=="string"?{bad:"an import without a path"}:l.text};for(;;){if(o=s(),"bad"in o)return{refused:o.bad};if(!(o.kind==="punct"&&o.text===";")){if(o.kind!=="ident"||o.text!=="import")break;if(o=s(),"bad"in o)return{refused:o.bad};if(o.kind==="punct"&&o.text==="(")for(;;){if(o=s(),"bad"in o)return{refused:o.bad};if(o.kind==="punct"&&o.text===";")continue;if(o.kind==="punct"&&o.text===")")break;if(o.kind==="eof")return{refused:"an unterminated import block"};let a=i(o);if(typeof a!="string")return{refused:a.bad};r.push(a)}else{if(o.kind==="eof")return{refused:"an import declaration without a path"};let a=i(o);if(typeof a!="string")return{refused:a.bad};r.push(a)}}}return{imports:r}}function Lg(e){let n;try{let t=gr(e);if(!t.isFile())return null;n=Z0(e,"r");let s=Buffer.alloc(Math.min(t.size,wg)),r=0;for(;r<s.length;){let o=nA(n,s,r,s.length-r,r);if(o===0)break;r+=o}return{text:s.subarray(0,r).toString("utf8"),whole:t.size<=wg}}catch{return null}finally{n!==void 0&&J0(n)}}function Rg(e,n){try{let t=gr(e);return!t.isFile()||t.size>n?null:eA(e,"utf8")}catch{return null}}function yA(e){try{return gr(e).isDirectory()}catch{return!1}}function bA(e,n){if(e===n)return!0;let t=n.endsWith(De.sep)?n:n+De.sep;return e.startsWith(t)}function _A(e,n,t){let s=/^(\d{1,4})\.(\d{1,4})/u.exec(e);if(s===null)return!1;let r=Number(s[1]),o=Number(s[2]);return r>n||r===n&&o>=t}function SA(e,n){let t=Cg(e.split("+")[0]??"");if(t===null||n===null)return!0;try{return $t(n,{advisoryId:"",packageName:"",ecosystem:"Go",introduced:"0",fixed:t,surfaceComplete:!1})}catch{return!0}}function kd(e){return/module lookup disabled by GOPROXY=off/u.test(e)?"go-module-missing":"go-list-failed"}function Dg(e,n){if(!bA(e,n))return"a go.work outside the scan root";let t=De.relative(n,e).split(De.sep).join("/");return t.length===0?"go.work":t}function xA(e,n,t){let s=Ed(e,["env","-json","GOWORK","GOMOD"],t,vd(e.env,"readonly",null));if(s.kind==="missing")return{failed:{kind:"go-toolchain-missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH`}};if(s.kind==="failed"||s.status!==0)return{failed:{kind:"go-list-failed",detail:`\`go env\` in the module ${s.kind==="failed"?s.detail:`exited ${String(s.status)}: ${mr(s.stderr)}`}`}};let r={};try{let S=JSON.parse(s.stdout);typeof S=="object"&&S!==null&&(r=S)}catch{}let o=typeof r.GOMOD=="string"?r.GOMOD:"",i;try{i=o.length>0&&De.isAbsolute(o)?De.join(wd(De.dirname(o)),De.basename(o)):""}catch{i=""}if(i!==De.join(t,"go.mod"))return{failed:{kind:"go-list-failed",detail:"the go command does not read this directory's go.mod as its module (GOMOD is another file, or none)"}};let a=Rg(De.join(t,"go.mod"),vg),l=a===null?[]:Zs(a),d=[],c=typeof r.GOWORK=="string"?r.GOWORK:"",f=null,p=[];if(c.length>0&&c!=="off"&&De.isAbsolute(c)){let S=Rg(c,vg);if(S===null)f=c;else{p=Zs(S);let k=De.dirname(c),v=Xr(p);[...v.inside,...v.outside].some(O=>{try{return wd(De.resolve(k,O))===t}catch{return!1}})?f=c:d.push(`${Dg(c,n)} governs this directory but does not \`use\` this module, so the go command builds it only on its own (GOWORK=off) \u2014 that is how it was listed`)}}let u=f!==null?p:l,m=Vr(u,"go"),g=Vr(u,"toolchain"),y=De.join(f!==null?De.dirname(f):t,"vendor"),b="readonly";if(yA(y))if(m===null||!_A(m,1,14))d.push("a vendor directory is present, but the governing go line is older than 1.14 (or absent), so the go command does not use it: listed -mod=readonly");else{let k=(Lg(De.join(y,"modules.txt"))?.text.slice(0,512)??"").split(`
+`)[0]??"";(k.startsWith("## ")&&k.slice(3).split(";").some(I=>I.trim()==="workspace"))===(f!==null)?b="vendor":d.push("a vendor directory is present for the other mode (workspace vs module), so the go command does not use it: listed -mod=readonly")}let _=l.filter(S=>S.verb==="tool").map(S=>S.args[0]??"").filter(S=>S.length>0);return{mode:b,gowork:f??"off",workspaceFile:f,facts:d,goLine:m,toolchainLine:g,modulePath:Vr(l,"module"),tools:_}}function kA(e,n){for(let s of n)if(e===s||e.startsWith(`${s}/`))return!1;return!(e.split("/")[0]??"").includes(".")}function wA(e,n,t){let s=[],r=[e],o=0;for(;r.length>0;){let i=r.pop();if(i===void 0)break;if(o+=1,o>t)return{dirs:s,truncated:!0};let a;try{a=Og(i).sort()}catch{continue}let l=[];for(let d of a){let c=De.join(i,d),f;try{f=Q0(c)}catch{continue}if(f.isDirectory()){if(d.startsWith(".")||d.startsWith("_")||d==="testdata"||d==="vendor")continue;try{if(gr(De.join(c,"go.mod")).isFile())continue}catch{}r.push(c)}else f.isFile()&&d.endsWith(".go")&&!d.endsWith("_test.go")&&Tg(d)&&l.push(d)}l.length>0&&!n.has(i)&&s.push({dir:i,files:l})}return{dirs:s,truncated:!1}}function Fg(e,n,t,s,r){return{rootRel:e,status:"failed",mode:n,workspace:null,packages:0,otherConfiguration:0,rows:[],gaps:t,diagnostics:s,facts:r,loadedPackages:new Set,otherConfigPackages:new Set,modules:new Map,loadedNames:new Set,importsPlugin:!1,packageModules:new Map,moduleDirs:new Map}}function vA(e,n,t,s,r){let o=t.abs,i=[],a=[],l=[],d=(re,R)=>{let D=r(R);i.push({kind:re,detail:D,blindsAnalysis:!1,rootRel:""}),a.push(D)},c=(re,R=null)=>(d(re.kind,`${re.detail} \u2014 NO Go module of this root was enumerated, so this scan says nothing about them; it is not a clean bill of health (ADR-108 D6)`),Fg(t.rel,R,i,a,l.map(r))),f=xA(e,n,o);if("failed"in f)return c(f.failed);l.push(...f.facts);let p=vd(e.env,f.mode,f.gowork),u=re=>{let R=Ed(e,["list",`-mod=${f.mode}`,"-e","-deps",`-json=${sA}`,"--",...re],o,p);if(R.kind==="missing")return{failed:{kind:"go-toolchain-missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH`}};if(R.kind==="failed")return{failed:{kind:"go-list-failed",detail:`\`go list\` ${R.detail}`}};if(R.status!==0){let Y=mr(R.stderr);return{failed:{kind:kd(Y),detail:`\`go list\` exited ${String(R.status)}: ${Y}`}}}let D=pA(R.stdout,e.maxPackages);return"refused"in D?{failed:{kind:"go-list-failed",detail:`\`go list\` printed output that was refused as malformed (${D.refused})`}}:D},m=u(["./..."]);if("failed"in m)return c(m.failed,f.mode);let g=new Map,y=new Set;f.modulePath!==null&&y.add(f.modulePath);let b=[],_=[],S=(re,R)=>{R.length>=1e3||R.push(`${re.importPath} (${(re.error??"").split(`
+`)[0]?.slice(0,200)??""})`)};for(let re of m.packages)re.module!==null&&y.add(re.module.path);for(let re of m.packages){if(re.importPath.startsWith(".")||re.importPath.includes("...")){re.error!==null&&S(re,_);continue}re.error!==null?S(re,kd(re.error)==="go-module-missing"?b:_):!re.standard&&re.module===null&&_.length<1e3&&_.push(`${re.importPath} (a package outside any module)`),g.set(re.importPath,re)}let k=new Map,v=!0,I=[],O=re=>{v=!1,I.length<qt&&I.push(re)},E=g.has("plugin"),N=new Set;for(let re of g.values())re.dir!==null&&N.add(re.dir);let A=wA(o,N,e.maxWalkDirs);A.truncated&&O(`the module has more than ${String(e.maxWalkDirs)} directories`);let U=new Set([...N,...A.dirs.map(re=>re.dir)]),$=f.modulePath,W=0,w=new Set,P=re=>g.has(re)||k.has(re),j=(re,R,D)=>{if(R.endsWith("_test.go"))return;if(W+=1,W>e.maxFiles){W===e.maxFiles+1&&O(`more than ${String(e.maxFiles)} excluded files`);return}let Y=Lg(De.join(re,R));if(Y===null){O(`${D}/${R} could not be read`);return}if(mA(Y.text))return;let H=hA(Y.text);if("refused"in H){O(`${D}/${R}: ${Y.whole?H.refused:"its import clause runs past the byte bound"}`);return}for(let ee of H.imports)if(ee==="plugin"&&(E=!0),!(ee==="C"||!gA(ee)||kA(ee,y)||P(ee))){if($!==null&&(ee===$||ee.startsWith(`${$}/`))){let le=De.join(o,...ee.slice($.length).split("/").filter(de=>de!==""));if(U.has(le))continue}w.add(ee)}};for(let re of g.values())if(!(re.standard||re.dir===null))for(let R of re.ignoredGoFiles)j(re.dir,R,re.importPath);for(let re of A.dirs){let R=De.relative(o,re.dir).split(De.sep).join("/");for(let D of re.files)j(re.dir,D,R)}let F=0,B=!1;for(;w.size>0&&!B;){if(F+=1,F>e.maxRounds){O(`the closure did not finish in ${String(e.maxRounds)} rounds`);break}let re=[...w].sort();w.clear();let R=[];for(let D=0;D<re.length;D+=Ig){let Y=u(re.slice(D,D+Ig));if("failed"in Y){O(`listing what another configuration imports: ${Y.failed.detail.slice(0,300)}`),Y.failed.kind==="go-module-missing"&&b.length<1e3&&b.push(`(another configuration) ${Y.failed.detail.slice(0,200)}`);continue}R.push(...Y.packages)}for(let D of R)if(!(P(D.importPath)||D.importPath.startsWith("."))){if(D.importPath==="plugin"&&(E=!0),D.error!==null&&!D.error.startsWith("build constraints exclude all Go files")&&(O(`${D.importPath}: ${D.error.split(`
+`)[0]?.slice(0,200)??""}`),kd(D.error)==="go-module-missing"&&S(D,b)),!D.standard&&D.module===null){O(`${D.importPath} lies in no module the build list names`);continue}if(k.size+g.size>=e.maxPackages){O(`more than ${String(e.maxPackages)} packages`),B=!0;break}if(k.set(D.importPath,D),!D.standard&&D.dir!==null)for(let Y of D.ignoredGoFiles)j(D.dir,Y,D.importPath)}}let ne=[],X=new Map,Q=new Set,Z=new Set,x=new Set,T=new Map,q=new Map,G=new Map,z=(re,R)=>{if(re.standard||re.module===null||(T.set(re.importPath,re.module.path),q.has(re.module.path)||q.set(re.module.path,re.module.dir),re.module.main))return;let D=G.get(re.module.path);D===void 0?G.set(re.module.path,{module:re.module,inGraph:R}):R&&(D.inGraph=!0)};for(let re of g.values())re.standard||Q.add(re.importPath),z(re,!0);for(let re of k.values())re.standard||Z.add(re.importPath),z(re,!1);let L=f.toolchainLine!==null&&SA(f.toolchainLine,s.release)?f.toolchainLine:null,ie=re=>f.tools.some(R=>R===re||R.startsWith(`${re}/`)),me=[];for(let[re,R]of[...G.entries()].sort((D,Y)=>D[0]<Y[0]?-1:1)){let D=R.module.replace,Y=D!==null&&D.path===re&&D.version!=="",H=Y?D.version:R.module.version;X.set(re,H),R.inGraph&&x.add(re);let ee={};if(D!==null){let le=D.version===""?D.path:`${D.path}@${D.version}`;me.push(`${re}@${R.module.version===""?"?":R.module.version} => ${le}`),Y||(ee.replacedBy=r(le))}R.inGraph||(ee.otherConfiguration=!0),ie(re)&&(ee.tool=!0),ne.push({name:re,version:H,flags:ee}),D!==null&&!Y&&D.version!==""&&Ni(D.path,1024)&&/^[A-Za-z0-9]/u.test(D.path)&&(R.inGraph&&x.add(D.path),ne.push({name:D.path,version:D.version,flags:{replacementOf:re,...R.inGraph?{}:{otherConfiguration:!0}}}))}if(me.length>0&&l.push(`resolution divergence: ${String(me.length)} module(s) replaced (${me.slice(0,qt).join(", ")}${me.length>qt?", \u2026":""}); a replacement by other code or a local directory withholds the version verdict, never the import graph`),g.size>0||A.dirs.length>0){let re=s.release??s.goversion,R=L!==null?{toolchainAhead:L}:{};ne.push({name:"stdlib",version:re,flags:R}),ne.push({name:"toolchain",version:re,flags:R}),x.add("stdlib"),x.add("toolchain")}else l.push("the module holds no Go package, so it contributes no row");L!==null&&l.push(`the governing toolchain line is \`${L}\`, newer than ${s.goversion} on PATH: a build under GOTOOLCHAIN=auto uses that one, so the stdlib and toolchain version verdicts are withheld`),b.length>0&&d("go-module-missing",`the module cache lacks what ${String(b.length)} package(s) of this build need (${b.slice(0,qt).join("; ")}${b.length>qt?"; \u2026":""}) \u2014 nothing is fetched (GOPROXY=off), so their modules are MISSING from this scan. Run \`go mod download\` and re-scan`),_.length>0&&d("go-list-failed",`\`go list\` could not load ${String(_.length)} package(s) of this build (${_.slice(0,qt).join("; ")}${_.length>qt?"; \u2026":""}) \u2014 what they import is missing from this scan`),v||d("go-list-failed",`the packages another build configuration imports could not all be read (${I.join("; ")}) \u2014 a module imported only there may be missing from this scan`);let Me=b.length>0||_.length>0||!v?"partial":"ok";return{rootRel:t.rel,status:Me,mode:f.mode,workspace:f.workspaceFile===null?null:Dg(f.workspaceFile,n),packages:g.size,otherConfiguration:k.size,rows:ne,gaps:i,diagnostics:a,facts:l.map(r),loadedPackages:Q,otherConfigPackages:Z,modules:X,loadedNames:x,importsPlugin:E,packageModules:T,moduleDirs:q}}function jg(e,n,t={}){let s=n.filter(Qr);if(s.length===0)return null;let r=t.env??process.env,o=r[Pg],i={go:t.go??(o!==void 0&&o!==""?o:"go"),env:r,timeoutMs:t.timeoutMs??rA,maxOutputBytes:t.maxOutputBytes??oA,maxPackages:t.maxPackages??iA,maxRounds:t.maxRounds??aA,maxFiles:t.maxFiles??lA,maxWalkDirs:t.maxWalkDirs??dA},a=e;try{a=wd(e)}catch{}let l=cA(i);if("refused"in l){let g=Ng([[a,"."],[xg(),"~"]])(`${l.detail} \u2014 the Go scan needs one (ADR-108 F-108-B); NO Go module of this root was enumerated, so this scan says nothing about them; it is not a clean bill of health`);return{toolchain:null,roots:s.map(y=>Fg(y.rel,null,[{kind:"go-toolchain-missing",detail:g,blindsAnalysis:!1,rootRel:""}],[g],[])),blockers:["no Go toolchain read the build"],facts:[]}}let d=l.toolchain,c=Ng([[a,"."],[d.gomodcache,"$GOMODCACHE"],[d.goroot,"$GOROOT"],[xg(),"~"]]),f=s.map(g=>vA(i,a,g,d,c)),p=[],u=f.filter(g=>g.status!=="ok").map(g=>g.rootRel===""?".":g.rootRel);u.length>0&&p.push(`the Go build of ${u.slice(0,qt).join(", ")}${u.length>qt?", \u2026":""} was not read completely, and what it imports may be what this finding is about`),f.some(g=>g.importsPlugin)&&p.push("the build imports `plugin`: a plugin brings in packages no import graph here holds");let m=[`read with ${d.goversion} ${d.goos}/${d.goarch}, CGO_ENABLED=${d.cgo?"1":"0"}${d.experiment.length>0?`, GOEXPERIMENT=${d.experiment}`:""}, default build tags, GOFLAGS cleared, GOTOOLCHAIN=local, GOPROXY=off \u2014 the import graph is this configuration's; a package only another configuration imports is enumerated and never denied; tests, tools and plugins' own builds are outside it`];return{toolchain:d,roots:f,blockers:p,facts:m}}function Ri(e,n){return JSON.stringify([e,n])}function EA(e,n){let t=n.split("/");if(t.some(r=>r===""||r==="."||r===".."||r.includes("\\")))return!1;let s=e;for(let r of t){s=De.join(s,r);try{if(gr(De.join(s,"go.mod")).isFile())return!1}catch{}}try{return Og(s).some(r=>r.endsWith(".go")&&!r.endsWith("_test.go")&&gr(De.join(s,r)).isFile())}catch{return!1}}function Bg(e,n,t){let s=[],r=new Map(e.rows.map(i=>[i.name,i])),o=i=>{let a=e.packageModules.get(i);if(a!==void 0)return a;let l=null;for(let f of n)i.startsWith(`${f}/`)&&(l===null||f.length>l.length)&&(l=f);if(l===null)return null;let d=i.slice(l.length+1);if(/^v[0-9]+(\/|$)/u.test(d))return null;let c=e.moduleDirs.get(l)??null;return c!==null&&EA(c,d)?l:null};for(let[i,a]of[...e.modules.entries()].sort())for(let l of t(`${i}/`)){if(n.has(l)||o(l)!==i)continue;let d=r.get(i)?.flags??{},c={packageOf:i,...d.replacedBy!==void 0?{replacedBy:d.replacedBy}:{},...d.tool===!0?{tool:!0}:{},...!e.loadedPackages.has(l)&&e.otherConfigPackages.has(l)?{otherConfiguration:!0}:{}};s.push({name:l,version:a,flags:c})}return s}import{readdirSync as AA,readFileSync as IA}from"node:fs";import NA from"node:path";var RA=new Set(["summarized","crashed","over-cap"]),OA=new Set(["function","method","ctor"]);function Xe(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function Ad(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function PA(e,n){Ad(e)||Xe(n,"edge is not an object");let{entryPath:t,entryExport:s,entryContainer:r,hops:o}=e;(typeof t!="string"||typeof s!="string")&&Xe(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&Xe(n,"entryContainer must be string or null"),(typeof o!="number"||!Number.isInteger(o)||o<0)&&Xe(n,"hops must be a non-negative integer");let i=e.target;if(Ad(i)||Xe(n,"edge target missing"),i.kind==="symbol"){let{exportName:a,container:l,symbolKind:d}=i;return typeof a!="string"&&Xe(n,"symbol target exportName"),l!==null&&typeof l!="string"&&Xe(n,"symbol target container"),(typeof d!="string"||!OA.has(d))&&Xe(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:s,entryContainer:r,target:{kind:"symbol",exportName:a,container:l,symbolKind:d},hops:o}}if(i.kind==="dep"){let{calleePackage:a,calleeSubpath:l,calleeExport:d}=i;return(typeof a!="string"||a.length===0)&&Xe(n,"dep target calleePackage"),l!==null&&typeof l!="string"&&Xe(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&Xe(n,"dep target calleeExport"),{entryPath:t,entryExport:s,entryContainer:r,target:{kind:"dep",calleePackage:a,calleeSubpath:l,calleeExport:d},hops:o}}Xe(n,`unknown target kind ${JSON.stringify(i.kind)}`)}function CA(e,n){Ad(e)||Xe(n,"root is not an object");let{packageName:t,analyzedVersion:s,tool:r,toolVersion:o,maxIndirections:i,status:a}=e;(typeof t!="string"||t.length===0)&&Xe(n,"packageName"),typeof s!="string"&&Xe(n,"analyzedVersion"),r!=="jelly"&&Xe(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof o!="string"&&Xe(n,"toolVersion"),typeof i!="number"&&Xe(n,"maxIndirections"),(typeof a!="string"||!RA.has(a))&&Xe(n,`status ${JSON.stringify(a)} not in the enum`);let l=e.edges;return Array.isArray(l)||Xe(n,"edges is not an array"),a!=="summarized"&&l.length>0&&Xe(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:s,tool:r,toolVersion:o,maxIndirections:i,status:a,edges:l.map(d=>PA(d,n))}}function Gg(e){let n=new Map,t=AA(e).filter(s=>s.endsWith(".summary.json"));for(let s of t){let r=NA.join(e,s),o;try{o=JSON.parse(IA(r,"utf8"))}catch(l){Xe(s,`unparseable JSON: ${l instanceof Error?l.message:String(l)}`)}let i=CA(o,s),a=n.get(i.packageName);a===void 0?n.set(i.packageName,[i]):a.push(i)}return n}import It from"node:path";function MA(e,n){let t=e.read(n);if(t===null)return null;let s=t.toString("utf8"),r=It.posix.basename(n);if(r==="package-lock.json"||r==="npm-shrinkwrap.json")return $l(s);if(r==="pnpm-lock.yaml")return Ll(s);if(r==="yarn.lock")return Dl(s,TA(e,n));if(r==="uv.lock")return Kl(s);if(r==="poetry.lock"){let o=e.read(It.posix.join(It.posix.dirname(n),"pyproject.toml")),i=o===null?[]:[...gi(o.toString("utf8")).keys()];return zl(s,i)}return null}function TA(e,n){let t=new Map,s=e.read(It.posix.join(It.posix.dirname(n),"package.json"));if(s===null)return t;let r;try{r=JSON.parse(s.toString("utf8"))}catch{return t}if(typeof r!="object"||r===null)return t;for(let o of["dependencies","devDependencies","optionalDependencies"]){let i=r[o];if(!(typeof i!="object"||i===null||Array.isArray(i)))for(let[a,l]of Object.entries(i))typeof l=="string"&&!t.has(a)&&t.set(a,l)}return t}function Kg(e,n,t=[]){let s=new Jt(e,Yl),r=new Map,o=new Map,i=new Map,a=[],l=p=>{if(!o.has(p)){let m=s.read(p)?.toString("utf8")??null,g=It.posix.basename(p);o.set(p,m===null?null:g==="pyproject.toml"?gi(m):g.endsWith(".txt")?Wl(m):jl(m))}return o.get(p)??null},d=(p,u)=>{let m=p.endsWith("pyproject.toml"),g=m?vt(u):u,y=m?[p,It.posix.join(It.posix.dirname(p),"requirements.txt")]:[p];for(let b of y){let _=l(b)?.get(g);if(_!==void 0)return{path:b,line:_}}return null},c=(p,u,m)=>{let g=JSON.stringify([p,u,m]),y=i.get(g);if(y!==void 0)return y;r.has(p)||r.set(p,MA(s,p));let b=r.get(p)??null,_=b===null?null:Fl(b,u,m,{maxNodes:ns.maxPackageGraphNodes,maxEdges:ns.maxPackageGraphEdges}),S=null;if(_!==null&&a.length<ns.maxPackageGraphs){S=`g${String(a.length)}`;let k=It.posix.dirname(p);a.push({id:S,nodes:_.nodes.map(v=>{let I=v.directFrom===null?null:It.posix.join(k,v.directFrom);return{id:v.id,name:v.name,version:v.version,direct:v.directFrom!==null,declaredIn:I===null?null:d(I,v.name)}}),edges:_.edges.map(v=>({from:v.from,to:v.to})),truncated:_.truncated})}return i.set(g,S),S},f=n.map(p=>{if(p.tier==="not-affected"||p.ecosystem==="Go")return null;if(p.ecosystem==="PyPI"){for(let u of t){let m=c(u,p.packageName,p.version);if(m!==null)return m}return null}return p.packageLocation===null?null:c(p.packageLocation,p.packageName,p.version)});return{graphs:a,idOf:f}}import{isBuiltin as zg}from"node:module";function te(e){let n="";for(let t of e){let s=t.charCodeAt(0),r=s<32||s>=127&&s<=159;n+=r?"\\x"+s.toString(16).padStart(2,"0"):t}return n}var Wg=1024,Ug=4096,Oi=8,Hg=512,qg=512,Id=8,$A=160,LA=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),Nd=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),DA=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,FA=/\.[cm]?[jt]sx?$/u;function Vg(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let s=e.lastIndexOf("node_modules/");if(s!==-1){let r=e.slice(s+13).split("/"),o=r[0]??"";return o.startsWith("@")?r[1]===void 0?null:`${o}/${r[1]}`:o===""?null:o}return DA.test(e)&&!FA.test(e)?e:null}function jA(e){return te(`${e.code} ${e.path}: ${e.detail}`.slice(0,$A))}function Xg(e){let{graph:n,facts:t,diagnostics:s}=e,r=new Map(n.modules.map(L=>[L.id,L])),o=new Map(n.modules.map(L=>[L.path,L])),i=tt(n),a=new Set;for(let L of i){let ie=r.get(L);ie!==void 0&&a.add(ie.packageName)}let l=new Map,d=0,c=!1,f=!1,p=L=>L.startsWith(`${e.appRootReal}/`)?L.slice(e.appRootReal.length+1):L;for(let L of s){if(L.code==="limit-exceeded"&&L.path===e.appRootReal){c=!0;continue}let ie=Vg(p(L.path),o);if(ie===null){L.code==="out-of-root"&&d++,Nd.has(L.code)&&(f=!0);continue}let me=o.get(p(L.path));me!==void 0&&Nd.has(L.code)&&!me.path.includes("node_modules/")&&(f=!0);let be=l.get(ie);be===void 0?l.set(ie,[L]):be.push(L)}let u=new Map(n.imports.map(L=>[L.id,L])),m=new Set;for(let L of n.importEdges){let ie=u.get(L.importId);ie!==void 0&&r.get(ie.moduleId)?.externalSurface===!0&&m.add(ie.moduleId)}let g=[],y=new Set,b=n.modules.filter(L=>L.externalSurface===!0);for(let L of b){let ie=l.get(L.packageName)??[],me=m.has(L.id),be=[],Me=_e=>_e.code==="dependency-body"&&_e.anchor===void 0&&/syntax/u.test(_e.detail),re=_e=>_e.code==="loader-escape"||_e.code==="dependency-body"&&_e.anchor===void 0&&!/syntax/u.test(_e.detail),R=ie.filter(_e=>LA.has(_e.code)),D=ie.filter(re),Y=ie.filter(_e=>Nd.has(_e.code)||Me(_e)),H=ie.filter(_e=>_e.code==="out-of-root"),ee=me&&R.length===0,le=D.length===0,de=!c&&Y.length===0,ge=d===0&&H.length===0;me||be.push("(a) the package's entry was never followed to a module");for(let _e of[...R,...D,...Y,...H]){if(be.length>=Id)break;be.push(jA(_e))}c&&be.length<Id&&be.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&be.length<Id&&be.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let ve=["a","b","c","d"].filter(_e=>!{a:ee,b:le,c:de,d:ge}[_e]),Re=ve.length===0;Re&&y.add(L.id),g.push({packageName:te(L.packageName),module:te(String(L.id)),inReach:i.has(L.id),builtin:zg(L.packageName),followed:me,d1:{a:ee,b:le,c:de,d:ge},failing:ve,transparent:Re,evidence:be})}let _=new Set;for(let L of t)L.reach.kind==="unbounded"&&_.add(L.source);let S=L=>({module:te(String(L.module)),kind:L.kind,packageName:r.get(L.module)?.packageName??null}),k=new Set(b.filter(L=>zg(L.packageName)).map(L=>L.id)),v=new Set([...y,...k]),I=[],O=new Map,E=0,N=0,A=0,U=0,$=[],W=new Set;for(let L of t)L.reach.kind==="unbounded"&&W.add(L.cause);for(let L of t){if(L.reach.kind==="class-scope"){$.push({packageName:L.reach.packageName,container:L.reach.container});continue}if(L.reach.kind==="unbounded"||L.reach.kind==="dependency-dispatch"||L.reach.kind==="loaded-package")continue;U++;let ie=L.reach.anchor,me=O.get(String(ie));me===void 0&&(me={today:wr(n,ie,_),d1:wr(n,ie,_,y),d1Builtins:wr(n,ie,_,v)},O.set(String(ie),me)),me.d1Builtins.length>0&&A++,me.today.length>0&&(E++,W.add(L.cause)),me.d1.length>0&&N++,I.length<Ug&&I.push({anchor:te(String(ie)),packageName:te(r.get(ie)?.packageName??""),cause:L.cause,reachKind:L.reach.kind,blockersToday:me.today.slice(0,Oi).map(S),blockersUnderD1:me.d1.slice(0,Oi).map(S),blockedUnderD1Builtins:me.d1Builtins.length>0,moreToday:Math.max(0,me.today.length-Oi),moreUnderD1:Math.max(0,me.d1.length-Oi)})}let w=s.filter(L=>L.anchor===void 0&&L.classScope===void 0),P=new Map(e.loadSites.map(L=>[L.importId,L])),j=new Map;for(let L of e.loadSites){let ie=j.get(L.path);ie===void 0?j.set(L.path,[L.shape]):ie.push(L.shape)}let F=L=>{if(L.code!=="loader-escape")return!1;let ie=L.escapes??[];if(ie.length===0||ie.some(be=>be!=="non-literal-load"))return!1;let me=j.get(L.path)??[];return me.length>0&&me.every(be=>be==="relative-bounded")},B=w.slice(0,qg).map(L=>({cause:e.causeOf(L.code),code:L.code,path:te(p(L.path)),attributedPackage:Vg(p(L.path),o),...L.escapes!==void 0?{escapes:[...L.escapes]}:{},...L.reason!==void 0?{reason:L.reason}:{},d2Dischargeable:F(L)})),ne={};for(let L of w){if(L.code!=="unresolved-specifier")continue;let ie=L.reason??"(none)";ne[ie]=(ne[ie]??0)+1}let X=_.size===0?0:t.filter(L=>L.reach.kind==="unbounded").length,Q=Math.max(0,X-w.length),Z=X-w.filter(F).length,x=[],T=0,q=0,G=0;for(let L of n.imports){if(L.specifierIsLiteral)continue;G++;let ie=i.has(L.moduleId),me=P.get(String(L.id)),be=me?.shape??"unrecorded";ie&&(T++,be==="relative-bounded"&&q++),x.length<Hg&&x.push({importId:te(String(L.id)),path:te(r.get(L.moduleId)?.path??""),shape:be,text:te(me?.text??""),inReach:ie})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:c,appCapHit:f,unattributedOutOfRoot:d,blindUnbounded:Q,unbounded:B,anchors:I,surfaces:g.slice(0,Wg),loads:x,counts:{modules:n.modules.length,reachMods:i.size,surfaces:b.length,surfacesInReach:g.filter(L=>L.inReach).length,transparentSurfaces:y.size,builtinSurfaces:k.size,anchors:U,anchorsBlockedToday:E,anchorsBlockedUnderD1:N,anchorsBlockedUnderD1Builtins:A,unbounded:X,loadsInReach:T,loadsRelativeBounded:q,unresolvedByReason:ne,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,g.length-Wg),anchors:Math.max(0,U-Ug),loads:Math.max(0,G-Hg),unbounded:Math.max(0,w.length-qg)}},reachedPackages:a,aborted:e.analysisAborted,unboundedFacts:X,unboundedHard:Z,anchorsBlockedToday:E,anchorsBlockedUnderD1:N,anchorsBlockedUnderD1Builtins:A,loadsInReach:T,loadsAllBounded:T>0&&q===T,d2Eligible:e.rootBudget==="complete"&&!f&&!c,classScope:$,taintCausesToday:W}}var BA=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),GA=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Yg(e,n,t,s,r){if(t===null||e.reachedPackages.has(t.packageName))return;let o=e.classScope.some(E=>E.packageName===t.packageName&&E.container===t.container),i=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||o,a=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||a||n.reasonKind!==void 0&&BA.has(n.reasonKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":i?"taint":s>0?"oog":"unexpected",c=new Set(e.taintCausesToday);o&&c.add("dep-opaque");let f=e.aborted!==null?e.aborted:GA.find(E=>c.has(E)),p=d==="pre-2b"?He(n.tier)&&(a?n.reasonKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?He(n.tier)&&n.reasonKind==="dynamic-load":d==="taint"?He(n.tier)&&n.reasonKind===f:d==="oog"?He(n.tier)&&n.reasonKind==="analysis-cap":!1,u=t.verified&&r===!0,m=e.aborted===null&&e.unboundedFacts===0&&!o&&s===0,g=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,y=u&&d==="taint"&&m&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,b=u&&d==="load"&&m&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,_=u&&(d==="load"||d==="taint")&&m&&g&&e.anchorsBlockedUnderD1===0,S=e.aborted===null&&e.unboundedHard===0&&!o&&s===0,k=u&&d==="load"&&S&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,v=u&&(d==="load"||d==="taint")&&S&&g&&e.anchorsBlockedUnderD1===0,I=u&&d==="taint"&&m&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,O=u&&(d==="load"||d==="taint")&&S&&g&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:p,verified:t.verified,surfaceComplete:r,oog:s,classScoped:o,predicted:{d1:y,d2:b,d1d2:_,d2Amended:k,d1d2Amended:v,d1Builtins:I,d1d2AmendedBuiltins:O}}}import{readFileSync as KA,statSync as zA}from"node:fs";var Od=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,Pi=/^[A-Za-z0-9_$.-]{1,128}$/u,Jg=64,Qg=1024*1024,Zg=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,eh=/^[A-Za-z0-9@_.-]{1,128}$/u;function en(e){throw new Error(`model claims rejected: ${e}`)}function Rd(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function WA(e,n){Rd(e)||en(`${n}: edge is not an object`);let{kind:t,anchorExport:s,anchorContainer:r,calleePackage:o,calleeContainer:i,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&en(`${n}: edge kind`),(typeof s!="string"||!Pi.test(s))&&en(`${n}: anchorExport ${JSON.stringify(s)}`),r!==null&&(typeof r!="string"||!Pi.test(r))&&en(`${n}: anchorContainer`),(typeof o!="string"||!Od.test(o))&&en(`${n}: calleePackage ${JSON.stringify(o)}`),i!==null&&(typeof i!="string"||!Pi.test(i))&&en(`${n}: calleeContainer`),(typeof a!="string"||!Pi.test(a))&&en(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:s,anchorContainer:r,calleePackage:o,calleeContainer:i,calleeExport:a}}function nh(e){let n=zA(e).size;n>Qg&&en(`file is ${String(n)} bytes, over the ${String(Qg)} cap`);let t;try{t=JSON.parse(KA(e,"utf8"))}catch(r){en(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||en("root is not an array"),t.length>Jg&&en(`${String(t.length)} claims over cap ${String(Jg)}`);let s=[];for(let r of t){Rd(r)||en("claim is not an object");let{packageName:o,modelId:i,range:a,edges:l}=r;(typeof o!="string"||!Od.test(o))&&en("packageName"),(typeof i!="string"||!eh.test(i))&&en("modelId (identifier charset, 1-128 chars)"),s.some(c=>c.model.modelId===i)&&en(`duplicate modelId ${i} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Rd(a)||typeof a.introduced!="string")&&en(`${i}: range`),Zg.test(a.introduced)||en(`${i}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let d=a.fixedBefore;d!==null&&typeof d!="string"&&en(`${i}: fixedBefore`),typeof d=="string"&&!Zg.test(d)&&en(`${i}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(l)||en(`${i}: edges`),l.length>64&&en(`${i}: ${String(l.length)} edges over cap ${String(64)}`),s.push({model:{packageName:o,modelId:i,edges:l.map(c=>WA(c,i))},introduced:a.introduced,fixedBefore:d})}return s}var UA=["in-app-purchase@1-v1"];function Pd(e,n,t){let s=[],r=[],o=[],i=(a,l,d,c)=>{r.push(d),o.push({modelId:c??a.model.modelId,status:l,reason:d,edgeCount:a.model.edges.length})};for(let a of e){if(!Od.test(a.model.packageName)||!eh.test(a.model.modelId)){i(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&UA.includes(a.model.modelId)){i(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(c=>c.kind!=="alias"&&c.kind!=="dispatch")){i(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let l=n(a.model.packageName);if(typeof l!="string"&&l!==void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} installed at more than one version (${l.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(l===void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let d;try{d=$t(l,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${l} is not a version cupel can order \u2014 inert (never guessed)`);continue}if(!d){i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${l} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}s.push(a.model),o.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:s,notes:r,dispositions:o}}var th=["javascript-typescript","python","go","rust","components"],Cd=[{language:"javascript-typescript",label:"JavaScript and TypeScript",extensions:[".js",".mjs",".cjs",".jsx",".ts",".mts",".cts",".tsx"],frontEnd:"in-process"},{language:"python",label:"Python",extensions:[".py",".pyi"],frontEnd:"interpreter"},{language:"go",label:"Go",extensions:[".go"],frontEnd:"not-on-scan-side"},{language:"rust",label:"Rust",extensions:[".rs"],frontEnd:"none"},{language:"components",label:"Component files (.vue, .svelte, .astro)",extensions:[".vue",".svelte",".astro"],frontEnd:"in-process"}],HA=new Map(Cd.flatMap(e=>e.extensions.map(n=>[n,e])));function uo(e){let n=e.lastIndexOf(".");return n<=0?null:HA.get(e.slice(n))??null}function Ci(e){let n=Cd.find(t=>t.language===e);if(n===void 0)throw new Error(`unknown inventory language ${e}`);return n}import{lstatSync as Fd,readdirSync as bI,readFileSync as _I,realpathSync as SI,statSync as jd}from"node:fs";import{join as po,relative as xI,resolve as kI}from"node:path";import{existsSync as qA,lstatSync as VA,readFileSync as sh,statSync as rh}from"node:fs";import{dirname as oh,isAbsolute as ih,join as Nt,relative as XA,resolve as Ti,sep as YA}from"node:path";var JA=64,fo=1024*1024,QA=256*1024*1024,ZA=5e6,eI=4096,nI=e=>e.split(YA).join("/");function ah(e,n){let t=tI(e);if(t===null)return null;let{root:s,dotGit:r}=t,o=sI(r);if(o===null)return null;let i=rI(o),a=Cs(Nt(i,"config"),fo),l=a===null?new Map:Mi(a,"core"),c=((a===null?new Map:Mi(a,"extensions")).get("objectformat")??"sha1").toLowerCase()==="sha256"?32:20;return{root:s,scanPrefix:nI(XA(s,Ti(e))),gitDir:o,commonDir:i,ignoreCase:(l.get("ignorecase")??"false").toLowerCase()==="true",infoExclude:Cs(Nt(i,"info","exclude"),fo),globalExcludes:oI(l.get("excludesfile"),n),index:iI(Nt(o,"index"),c)}}function tI(e){let n=Ti(e);for(let t=0;t<JA;t+=1){let s=Nt(n,".git");if(qA(s))return{root:n,dotGit:s};let r=oh(n);if(r===n)return null;n=r}return null}function sI(e){try{let r=VA(e);if(r.isDirectory())return e;if(!r.isFile())return null}catch{return null}let n=Cs(e,4096);if(n===null)return null;let t=n.split(`
+`).find(r=>r.startsWith("gitdir:"));if(t===void 0)return null;let s=t.slice(7).trim();return s.length===0?null:ih(s)?s:Ti(oh(e),s)}function rI(e){let n=Cs(Nt(e,"commondir"),4096);if(n===null)return e;let t=n.trim();return t.length===0?e:ih(t)?t:Ti(e,t)}function oI(e,n){let t=n.home,s=n.xdgConfigHome??(t===void 0?void 0:Nt(t,".config")),r=e;if(r===void 0&&t!==void 0){let a=Cs(Nt(t,".gitconfig"),fo);a!==null&&(r=Mi(a,"core").get("excludesfile"))}if(r===void 0&&s!==void 0){let a=Cs(Nt(s,"git","config"),fo);a!==null&&(r=Mi(a,"core").get("excludesfile"))}let o;if(r!==void 0?o=r.startsWith("~/")&&t!==void 0?Nt(t,r.slice(2)):r:s!==void 0&&(o=Nt(s,"git","ignore")),o===void 0)return null;let i=Cs(o,fo);return i===null?null:{path:o,text:i}}function Mi(e,n){let t=new Map,s="";for(let r of e.split(`
+`)){let o=r.trim();if(o.length===0||o.startsWith("#")||o.startsWith(";"))continue;if(o.startsWith("[")){let c=o.indexOf("]");s=c===-1?"":o.slice(1,c).trim().toLowerCase();continue}if(s!==n)continue;let i=o.indexOf("="),a=(i===-1?o:o.slice(0,i)).trim().toLowerCase(),l=i===-1?"true":o.slice(i+1).trim(),d=l.search(/\s[#;]/u);d!==-1&&!l.startsWith('"')&&(l=l.slice(0,d).trim()),l.startsWith('"')&&l.endsWith('"')&&l.length>=2&&(l=l.slice(1,-1)),t.set(a,l)}return t}function Cs(e,n){try{let t=rh(e);return!t.isFile()||t.size>n?null:sh(e,"utf8")}catch{return null}}function iI(e,n){let t;try{let s=rh(e);if(!s.isFile())return{kind:"absent"};if(s.size>QA)return{kind:"refused",reason:"index larger than 256 MiB"};t=sh(e)}catch{return{kind:"absent"}}return aI(t,n)}function aI(e,n){if(e.length<12||e.toString("latin1",0,4)!=="DIRC")return{kind:"refused",reason:"not a git index"};let t=e.readUInt32BE(4);if(t<2||t>4)return{kind:"refused",reason:`index version ${String(t)}`};let s=e.readUInt32BE(8);if(s>ZA)return{kind:"refused",reason:"too many index entries"};let r=new Set,o=[],i=40+n+2,a=12,l=Buffer.alloc(0);for(let f=0;f<s;f+=1){let p=a;if(a+i>e.length)return{kind:"refused",reason:"index truncated"};let u=e.readUInt32BE(a+24),m=e.readUInt16BE(a+40+n);if(a+=i,(m&16384)!==0){if(t<3)return{kind:"refused",reason:"extended flag in a version 2 index"};a+=2}let g;if(t===4){let b=lI(e,a);if(b===null)return{kind:"refused",reason:"index truncated"};a=b.next;let _=e.indexOf(0,a);if(_===-1||b.value>l.length)return{kind:"refused",reason:"index truncated"};g=Buffer.concat([l.subarray(0,l.length-b.value),e.subarray(a,_)]),a=_+1}else{let b=e.indexOf(0,a);if(b===-1)return{kind:"refused",reason:"index truncated"};g=e.subarray(a,b);let _=b-p+1;a=p+Math.ceil(_/8)*8}if(g.length>eI)return{kind:"refused",reason:"index path too long"};l=g;let y=g.toString("utf8");(u&61440)===16384?o.push(y.endsWith("/")?y.slice(0,-1):y):r.add(y)}let d=e.length-n;for(;a+8<=d;){if(e.toString("latin1",a,a+4)==="link")return{kind:"refused",reason:"split index"};let p=e.readUInt32BE(a+4);if(a+8+p>d)break;a+=8+p}let c=[...r].sort(dI);return{kind:"read",tracked:{files:r,sorted:c,sparseDirs:o}}}function lI(e,n){let t=n;if(t>=e.length)return null;let s=e[t]??0;t+=1;let r=s&127;for(;(s&128)!==0;){if(t>=e.length||r>16777215)return null;s=e[t]??0,t+=1,r=r+1<<7|s&127}return{value:r,next:t}}function dI(e,n){return Buffer.compare(Buffer.from(e),Buffer.from(n))}function lh(e,n){let t=`${n}/`,s=Buffer.from(t),r=0,o=e.sorted.length;for(;r<o;){let a=r+o>>1;Buffer.compare(Buffer.from(e.sorted[a]??""),s)<0?r=a+1:o=a}let i=[];for(let a=r;a<e.sorted.length;a+=1){let l=e.sorted[a]??"";if(!l.startsWith(t))break;i.push(l)}return i}function $d(e){return e==="git-global"||e==="git-info"||e==="gitignore"}var cI=4096;function Di(e,n,t,s){let r=[],o=e.split(`
+`);for(let i=0;i<o.length;i+=1){let a=Fi(o[i]??"",n,t,i+1,s);a!==null&&r.push(a)}return r}function Fi(e,n,t,s,r){let o=e.endsWith("\r")?e.slice(0,-1):e;if(o.length===0||o.length>cI||o.startsWith("#")||(o=uI(o),o.length===0))return null;let i=!1;o.startsWith("!")&&(i=!0,o=o.slice(1));let a=!1;if(o.endsWith("/")&&!dh(o,o.length-1)&&(a=!0,o=o.slice(0,-1)),o.length===0)return null;let l=o.includes("/");if(o.startsWith("/")&&(o=o.slice(1)),o.length===0)return null;let d=o.split("/").filter(c=>c.length>0);return d.length===0?null:{origin:n,source:t,line:s,pattern:e.endsWith("\r")?e.slice(0,-1):e,base:r,negate:i,dirOnly:a,anchored:l,segments:d}}function uI(e){let n=e.length;for(;n>0&&e[n-1]===" "&&!dh(e,n-1);)n-=1;return e.slice(0,n)}function dh(e,n){let t=0;for(let s=n-1;s>=0&&e[s]==="\\";s-=1)t+=1;return t%2===1}function fI(e,n,t,s=!1){if(e.dirOnly&&!t)return!1;let r=n;if(e.base!==""){if(!n.startsWith(`${e.base}/`))return!1;r=n.slice(e.base.length+1)}if(r.length===0)return!1;let o=r.split("/");if(!e.anchored){let i=o[o.length-1]??"";return ch(e.segments[0]??"",i,s)}return Td(e.segments,0,o,0,s,{steps:0})}var pI=1e5;function Td(e,n,t,s,r,o){if(o.steps+=1,o.steps>pI)return!1;if(n===e.length)return s===t.length;let i=e[n]??"";if(i==="**"){if(n===e.length-1)return s<t.length;for(let a=s;a<=t.length;a+=1)if(Td(e,n+1,t,a,r,o))return!0;return!1}return s>=t.length||!ch(i,t[s]??"",r)?!1:Td(e,n+1,t,s+1,r,o)}function ch(e,n,t=!1){let s=[...e],r=[...n],o=0,i=0,a=-1,l=0;for(;i<r.length;){let d=s[o];if(d==="*"){for(;s[o]==="*";)o+=1;a=o,l=i;continue}if(d!==void 0){let c=mI(s,o,r[i]??"",t);if(c>0){o+=c,i+=1;continue}}if(a>=0){l+=1,i=l,o=a;continue}return!1}for(;s[o]==="*";)o+=1;return o===s.length}function mI(e,n,t,s){let r=e[n];if(r===void 0)return 0;if(r==="?")return t==="/"?0:1;if(r==="\\"){let o=e[n+1];return o===void 0?$i("\\",t,s)?1:0:$i(o,t,s)?2:0}if(r==="["){let o=hI(e,n);return o===null?$i("[",t,s)?1:0:t==="/"?0:(o.test(t)||s&&(o.test(t.toLowerCase())||o.test(t.toUpperCase())))!==o.negated?o.span:0}return $i(r,t,s)?1:0}function $i(e,n,t){return t?e.toLowerCase()===n.toLowerCase():e===n}var gI={alnum:e=>Md(e)||Li(e),alpha:e=>Md(e),blank:e=>e===" "||e==="	",cntrl:e=>{let n=e.codePointAt(0)??0;return n<32||n===127},digit:e=>Li(e),graph:e=>{let n=e.codePointAt(0)??0;return n>32&&n<127},lower:e=>e>="a"&&e<="z",print:e=>{let n=e.codePointAt(0)??0;return n>=32&&n<127},punct:e=>{let n=e.codePointAt(0)??0;return n>32&&n<127&&!Md(e)&&!Li(e)},space:e=>e===" "||e>="	"&&e<="\r",upper:e=>e>="A"&&e<="Z",xdigit:e=>Li(e)||e>="a"&&e<="f"||e>="A"&&e<="F"};function Md(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function Li(e){return e>="0"&&e<="9"}function hI(e,n){let t=n+1,s=!1;(e[t]==="!"||e[t]==="^")&&(s=!0,t+=1);let r=[],o=!0;for(;t<e.length;){let i=e[t];if(i==="]"&&!o)return{negated:s,span:t-n+1,test:d=>r.some(c=>c(d))};if(o=!1,i==="["&&e[t+1]===":"){let d=yI(e,t+2);if(d!==-1){let c=e.slice(t+2,d).join(""),f=gI[c];f!==void 0&&r.push(f),t=d+2;continue}}let a=i??"";if(a==="\\"&&t+1<e.length&&(t+=1,a=e[t]??""),e[t+1]==="-"&&e[t+2]!==void 0&&e[t+2]!=="]"){let d=e[t+2]??"",c=t+3;d==="\\"&&e[t+3]!==void 0&&(d=e[t+3]??"",c=t+4);let f=a.codePointAt(0)??0,p=d.codePointAt(0)??0;r.push(u=>{let m=u.codePointAt(0)??-1;return m>=f&&m<=p}),t=c;continue}let l=a;r.push(d=>d===l),t+=1}return null}function yI(e,n){for(let t=n;t+1<e.length;t+=1){if(e[t]===":"&&e[t+1]==="]")return t;if(e[t]==="]")return-1}return-1}function Ld(e,n,t,s=!1){for(let r=e.length-1;r>=0;r-=1){let o=e[r];if(o!==void 0&&fI(o,n,t,s))return o}return null}var wI=16*1024*1024,vI=2e5,EI=1e5,AI=128,II=1024*1024,uh="git's global excludes file",Gi=["not-utf8","over-size-cap","unreadable","symlink-loop","parse-error","name-unrepresentable","front-end-unavailable","cap-reached"],ph=["node_modules/",".venv/","venv/","vendor/","target/","dist/","build/",".next/",".nuxt/",".svelte-kit/",".output/","coverage/","__pycache__/","**/pkg/mod/"],NI=new TextDecoder("utf-8",{fatal:!0}),RI=new TextDecoder("utf-8");function mh(e,n={}){let t=kI(e),s=n.maxFiles??vI,r=n.maxDirs??EI,o=ah(t,n.gitEnv??{}),i=o?.scanPrefix??"",a=P=>i===""?P:P===""?i:`${i}/${P}`,l=o?.index.kind==="read"?o.index.tracked:null,d=o?.ignoreCase??!1,c=[],f=[];o!==null&&(o.globalExcludes!==null&&(f.push(...Di(o.globalExcludes.text,"git-global",uh,"")),c.push(uh)),o.infoExclude!==null&&(f.push(...Di(o.infoExclude,"git-info",".git/info/exclude","")),c.push(".git/info/exclude")));let p=ph.map(P=>Fi(P,"default","cupel default",0,"")),u=(n.exclude??[]).map(P=>Fi(P,"exclude-flag","--exclude",0,i)).filter(P=>P!==null),m=[],g=[];if(o!==null&&i!==""){let P=i.split("/");for(let j=0;j<P.length;j+=1){let F=P.slice(0,j).join("/"),B=po(o.root,...P.slice(0,j));m.push(ji(B,".gitignore","gitignore",F,c)),g.push(ji(B,".cupelignore","cupelignore",F,c))}}let y=[],b=[],_=[],S=null,k=0,v=new Set,I=()=>[...f,...m.flat(),...p,...g.flat(),...u],O=(P,j,F)=>{let B=a(P),ne=Ld(F,B,j,d);return ne===null||ne.negate||!j&&$d(ne.origin)&&l?.files.has(B)===!0?null:ne},E=(P,j,F,B)=>{v.has(P)||(v.add(P),y.push({rel:P,abs:j,language:F,outcome:B}))},N=P=>{try{let j=Fd(P);return j.isFile()?j.size>wI?{kind:"failed",reason:"over-size-cap",detail:`${String(j.size)} bytes`}:{kind:"candidate",bytes:j.size}:{kind:"failed",reason:"unreadable",detail:"not a regular file"}}catch(j){return{kind:"failed",reason:"unreadable",detail:Bi(j)}}},A=P=>{try{let j=SI(P);return jd(j),{kind:"excluded",rule:{origin:"symlink",source:"cupel",line:0,pattern:!xI(t,j).startsWith("..")?"a symlink: its target is counted where it lives":"a symlink out of the scanned directory"}}}catch(j){let F=Bi(j);return F==="ELOOP"?{kind:"failed",reason:"symlink-loop"}:{kind:"failed",reason:"unreadable",detail:`broken symlink (${F})`}}},U=P=>{if(l!==null)for(let j of lh(l,a(P))){let F=i===""?j:j.slice(i.length+1),B=F.slice(F.lastIndexOf("/")+1),ne=uo(B);if(ne===null)continue;let X=po(t,...F.split("/")),Q=[...p,...g.flat(),...u],Z=F.split("/"),x=null;for(let T=P.split("/").length+1;T<=Z.length&&x===null;T+=1){let q=Z.slice(0,T).join("/"),G=Ld(Q,a(q),T<Z.length,d);G!==null&&!G.negate&&(x=G)}E(F,X,ne.language,x!==null?{kind:"excluded",rule:Dd(x)}:N(X))}},$=(P,j,F)=>{if(S!==null)return;if(k>=r){S={cap:"directories",limit:r},_.push({rel:P,reason:"cap-reached"});return}if(F>AI){_.push({rel:P,reason:"cap-reached"});return}k+=1;let B;try{B=bI(j,{withFileTypes:!0,encoding:"buffer"})}catch{_.push({rel:P,reason:"unreadable"});return}B.sort((Q,Z)=>Buffer.compare(Q.name,Z.name));let ne=a(P);m.push(ji(j,".gitignore","gitignore",ne,c)),g.push(ji(j,".cupelignore","cupelignore",ne,c));let X=I();try{for(let Q of B){if(S!==null)return;let Z,x=!0;try{Z=NI.decode(Q.name)}catch{Z=RI.decode(Q.name),x=!1}let T=P===""?Z:`${P}/${Z}`,q=po(j,Z);if(Q.isDirectory()){if(!x){_.push({rel:T,reason:"name-unrepresentable"});continue}if(Z===".git"){b.push({rel:T,rule:{origin:"git-dir",source:"cupel",line:0,pattern:"git's own directory"}});continue}let L=O(T,!0,X);if(L!==null){b.push({rel:T,rule:Dd(L)}),$d(L.origin)&&U(T);continue}if(OI(q)){b.push({rel:T,rule:{origin:"virtualenv",source:"cupel default",line:0,pattern:"a virtualenv (holds pyvenv.cfg)"}});continue}$(T,q,F+1);continue}if(Q.isSymbolicLink()){let L=uo(Z);if(L!==null){if(!W())return;E(T,q,L.language,x?A(q):fh());continue}PI(q)&&_.push({rel:T,reason:CI(q)?"symlink-loop":"symlink"});continue}let G=uo(Z);if(G===null)continue;if(!W())return;if(!x){E(T,q,G.language,fh());continue}let z=O(T,!1,X);E(T,q,G.language,z!==null?{kind:"excluded",rule:Dd(z)}:N(q))}}finally{m.pop(),g.pop()}},W=()=>y.length<s?!0:(S={cap:"files",limit:s},!1);$("",t,0);let w=o===null?{kind:"none"}:o.index.kind==="read"?{kind:"index",root:o.root}:{kind:"ignore-files",root:o.root,indexNote:o.index.kind==="absent"?"no index":o.index.reason};return{files:y,excludedDirectories:b,unwalked:_,truncated:S,git:w,ignoreFiles:c}}function ji(e,n,t,s,r){let o=po(e,n);try{let i=Fd(o);if(!i.isFile()||i.size>II)return[];let a=s===""?n:`${s}/${n}`;return r.push(a),Di(_I(o,"utf8"),t,a,s)}catch{return[]}}function OI(e){try{return Fd(po(e,"pyvenv.cfg")).isFile()}catch{return!1}}function PI(e){try{return jd(e).isDirectory()}catch(n){return Bi(n)==="ELOOP"}}function CI(e){try{return jd(e),!1}catch(n){return Bi(n)==="ELOOP"}}function fh(){return{kind:"failed",reason:"name-unrepresentable"}}function Dd(e){return{origin:e.origin,source:e.source,line:e.line,pattern:e.pattern}}function Bi(e){return typeof e=="object"&&e!==null&&"code"in e?String(e.code):"error"}var Rt=class extends Error{},gh=()=>Object.fromEntries(Gi.map(e=>[e,0]));function hh(e,n){let t=new Set,s=[],r=[],o=[],i=[],a=new Map,l=new Map,d=u=>{let m=l.get(u);return m===void 0&&(m={files:0,scanned:0,unsupported:0,failed:0,excluded:0,reasons:gh()},l.set(u,m)),m};for(let u of e.files){if(t.has(u.rel))throw new Rt(`the walk counted ${u.rel} twice`);t.add(u.rel);let m=d(u.language);m.files+=1;let g=u.outcome;if(g.kind==="excluded"){m.excluded+=1,o.push({rel:u.rel,language:u.language,rule:g.rule});continue}if(g.kind==="failed"){m.failed+=1,m.reasons[g.reason]+=1,r.push({rel:u.rel,language:u.language,reason:g.reason,...g.detail===void 0?{}:{detail:g.detail}});continue}let y=n.get(u.rel);if(y===void 0){s.push(u.rel);continue}if(y.kind==="scanned"){m.scanned+=1;let b=a.get(u.language);b===void 0&&(b=new Set,a.set(u.language,b)),b.add(u.rel)}else y.kind==="unsupported"?(m.unsupported+=1,i.push({rel:u.rel,language:u.language})):(m.failed+=1,m.reasons[y.reason]+=1,r.push({rel:u.rel,language:u.language,reason:y.reason,...y.detail===void 0?{}:{detail:y.detail}}))}if(s.length>0)throw new Rt(`${String(s.length)} file(s) were walked and never given an outcome, first ${s[0]??""}`);let c=[...n.keys()].filter(u=>!t.has(u));if(c.length>0)throw new Rt(`a parse result names a file the walk never counted: ${c[0]??""}`);let f=[];for(let u of th){let m=l.get(u);if(m!==void 0){if(m.files!==m.scanned+m.unsupported+m.failed+m.excluded)throw new Rt(`${u}: the buckets do not add up to the files walked`);f.push({language:u,label:Ci(u).label,files:m.files,scanned:m.scanned,unsupported:m.unsupported,failed:m.failed,excluded:m.excluded,failedByReason:m.reasons,reached:null,coverage:yh(m.scanned,m.unsupported,m.failed)})}}let p=bh(f,null);if(p.files!==e.files.length)throw new Rt("the languages do not add up to the files walked");return{languages:f,total:p,failedFiles:r,excludedFiles:o,unsupportedFiles:i,excludedDirectories:e.excludedDirectories,unwalked:e.unwalked,truncated:e.truncated,git:e.git,ignoreFiles:e.ignoreFiles,scannedPaths:a}}function Bd(e,n){let t=e.languages.map(s=>{let r=e.scannedPaths.get(s.language)??new Set,o=0;for(let i of r)n.has(i)&&(o+=1);return{...s,reached:o}});return{...e,languages:t,total:bh(t,t.reduce((s,r)=>s+(r.reached??0),0))}}function yh(e,n,t){let s=e+n+t;return s===0?null:e/s}function bh(e,n){let t=gh(),s=0,r=0,o=0,i=0,a=0;for(let l of e){s+=l.files,r+=l.scanned,o+=l.unsupported,i+=l.failed,a+=l.excluded;for(let d of Gi)t[d]+=l.failedByReason[d]}return{files:s,scanned:r,unsupported:o,failed:i,excluded:a,failedByReason:t,reached:n,coverage:yh(r,o,i)}}function Ki(e){if(e===null)return"nothing to scan";if(e>=1)return"100%";let n=Math.floor(e*1e3)/10;return`${n.toFixed(n%1===0?0:1)}%`}import{readFileSync as MI}from"node:fs";import Vt from"typescript";var _h=100,TI=new TextDecoder("utf-8",{fatal:!0});function Sh(e,n={}){let t=new Map,s=[];for(let r of e){if(r.outcome.kind!=="candidate")continue;let o=Ci(r.language).frontEnd;o==="none"?t.set(r.rel,{kind:"unsupported"}):o==="not-on-scan-side"?t.set(r.rel,{kind:"failed",reason:"front-end-unavailable",detail:"its front end is not on the scan side yet"}):o==="in-process"?t.set(r.rel,$I(r)):s.push(r)}return DI(s,n,t),t}function $I(e){let n;try{n=TI.decode(MI(e.abs))}catch(r){return r instanceof TypeError?{kind:"failed",reason:"not-utf8"}:{kind:"failed",reason:"unreadable"}}n.startsWith("\uFEFF")&&(n=n.slice(1));let t=LI(e.rel),s=St(e.rel);if(s!==null){let r=Or(s,n);n=r.code,t=r.scriptKind==="tsx"?Vt.ScriptKind.TSX:Vt.ScriptKind.TS}try{let o=Vt.createSourceFile(e.rel,n,Vt.ScriptTarget.Latest,!1,t).parseDiagnostics;if(o!==void 0&&o.length>0){let i=o[0];return{kind:"failed",reason:"parse-error",detail:(i===void 0?"":Vt.flattenDiagnosticMessageText(i.messageText," ")).slice(0,200)}}return{kind:"scanned"}}catch(r){return{kind:"failed",reason:"parse-error",detail:r instanceof RangeError?"nested too deeply to parse":"the parser failed"}}}function LI(e){return e.endsWith(".tsx")?Vt.ScriptKind.TSX:e.endsWith(".jsx")?Vt.ScriptKind.JSX:e.endsWith(".ts")||e.endsWith(".mts")||e.endsWith(".cts")?Vt.ScriptKind.TS:Vt.ScriptKind.JS}function DI(e,n,t){let s=n.extractPython??((i,a)=>cr(i,a===void 0?{}:{python:a})),r=[];for(let i of e)i.abs.includes(`
+`)?t.set(i.rel,{kind:"failed",reason:"name-unrepresentable"}):r.push(i);let o=new Map;for(let i of r){let a=n.pythonFor?.(i.rel),l=a??"",d=o.get(l)??{python:a,files:[]};d.files.push(i),o.set(l,d)}for(let{python:i,files:a}of o.values())for(let l=0;l<a.length;l+=_h){let d=a.slice(l,l+_h),c=s(d.map(p=>p.abs),i);if(c.refused==="no-interpreter"){for(let p of d)t.set(p.rel,{kind:"failed",reason:"front-end-unavailable",detail:"no Python interpreter"});continue}if(c.refused!==null){let p=s([],i);if(p.refused!==null){for(let u of d)t.set(u.rel,{kind:"failed",reason:"front-end-unavailable",detail:`the Python interpreter did not run (${p.refused})`});continue}for(let u of d)t.set(u.rel,FI(u,i,s));continue}let f=new Map(c.files.map(p=>[p.path,p]));for(let p of d){let u=f.get(p.abs);u!==void 0&&t.set(p.rel,u.refused===null?{kind:"scanned"}:xh(u.refused))}}}function FI(e,n,t){let s=t([e.abs],n);if(s.refused==="no-interpreter")return{kind:"failed",reason:"front-end-unavailable",detail:"no Python interpreter"};if(s.refused!==null)return{kind:"failed",reason:"parse-error",detail:`the Python front end stopped on this file (${s.refused})`};let r=s.files[0];return r===void 0?{kind:"failed",reason:"parse-error",detail:"the Python front end gave no answer"}:r.refused===null?{kind:"scanned"}:xh(r.refused)}function xh(e){switch(e){case"unreadable":return{kind:"failed",reason:"unreadable"};case"oversize":return{kind:"failed",reason:"over-size-cap"};case"undecodable":return{kind:"failed",reason:"not-utf8"};case"nul-byte":return{kind:"failed",reason:"parse-error",detail:"a NUL byte in the source"};case"parse-error":return{kind:"failed",reason:"parse-error"};case"recursion":case"too-many-nodes":return{kind:"failed",reason:"cap-reached",detail:e}}}function kh(e,n={}){let t=mh(e,n);return hh(t,Sh(t.files,n))}var BI=4,GI={additiveForms:!0,namelessExports:!0},KI=new Set(["dep-opaque","dynamic-load","dispatch"]),zI={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Xd(e,n,t){return He(e.tier)&&zI[t].has(e.decidedAtStage)&&e.reasonKind!==void 0&&KI.has(e.reasonKind)&&n!==null&&n.verified}var WI=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,"potentially-reachable-not-ruled-out":0,"potentially-reachable-not-analysed":0}),Qn=class extends Error{},Yd="cupel/coverage-gap",Ih={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","component-partially-read":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function go(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:t.ecosystem==="Go"?{ecosystem:"Go"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function wh(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function vh(e,n,t){let s=new Map(e.modules.map(i=>[i.path,i.id])),r=e.modules[0]?.id;if(r===void 0)return[];let o=n.map(i=>({source:s.get(i.path)??r,cause:Ih[i.code],reach:i.classScope!==void 0?{kind:"class-scope",packageName:i.classScope.packageName,container:i.classScope.container}:i.anchor!==void 0?{kind:"via-module",anchor:i.anchor}:{kind:"unbounded"}}));for(let i of t)o.push({source:r,reach:{kind:"unbounded"},cause:i});return o}function Ud(e,n,t,s,r){let o=t.filter(i=>i.exportName!==null&&(s===1||r||i.verified!==1));return o.length>0?o.map(i=>({advisoryId:e,packageName:n,exportName:i.exportName??"",container:i.container,symbolKind:i.symbolKind,sourcePath:i.sourcePath??"",derivation:i.derivation,confidence:i.confidence,verified:i.verified===1})):t.length===0||t.every(i=>i.exportName!==null&&i.verified===1)?[null]:[]}function UI(e,n){let t;try{t=ho(e)}catch{return!0}let s=3,r=(o,i)=>{if(i>s)return!1;let a;try{a=Ah(o)}catch{return!1}for(let l of a){if(l==="node_modules"||l.startsWith("."))continue;let d=mt.join(o,l),c;try{c=Vd(d)}catch{continue}if(!c.isDirectory())continue;let f=mt.relative(t,d).split(mt.sep).join("/");try{if(Vd(mt.join(d,"package.json")).isFile()&&!n.has(f))return!0}catch{}if(r(d,i+1))return!0}return!1};return r(t,1)}function HI(e,n){let t="";for(let s of e)s.rel!==""&&n.startsWith(`${s.rel}/`)&&s.rel.length>t.length&&(t=s.rel);return t}function qI(e,n,t){let s=[];if(t&&s.push("nested-app-root"),n==="")return[...s,"manifest-unreadable"];let r;try{if(r=ho(mt.resolve(e,n)),!r.startsWith(ho(e)+mt.sep))return[...s,"manifest-unreadable"]}catch{return[...s,"manifest-unreadable"]}let o;try{let c=mt.join(r,"package.json");if(!Vd(c).isFile())return[...s,"manifest-unreadable"];o=jI(c,"utf8")}catch{return[...s,"manifest-unreadable"]}let i;try{i=JSON.parse(o)}catch{return[...s,"manifest-unreadable"]}if(typeof i!="object"||i===null)return[...s,"manifest-unreadable"];let a=i;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&s.push("bin");let l=["preinstall","install","postinstall","prepare","prepublish"],d=a.scripts;if(typeof d=="object"&&d!==null){let c=d;l.some(f=>typeof c[f]=="string")&&s.push("install-script")}return(a.gypfile===!0||VI(r))&&s.push("native-artifact"),s}function VI(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=mt.join(e,n),s;try{s=Ah(t)}catch{continue}if(s.some(r=>r.endsWith(".node")))return!0}return!1}function XI(e){return new Set(["npm",...e.ecosystems?.()??[]])}function Jd(e){return e.ecosystem??"npm"}function YI(e,n){let t=[];for(let s of e.perRoot){let r=new Map;for(let o of s.packages){let i=Jd(o);n.has(i)||r.set(i,(r.get(i)??0)+1)}for(let[o,i]of[...r.entries()].sort()){let a=o==="Go"?"module(s)":"distribution(s)",l=o==="Go"?"ADR-108 D6":"ADR-109 D5";t.push({kind:"ecosystem-uncovered",detail:`${s.rootRel===""?"":`${s.rootRel}: `}${String(i)} ${o} ${a} were enumerated but the loaded shard carries no ${o} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${o} shard to assess them (${l}).`,blindsAnalysis:!1,rootRel:s.rootRel})}}return t}function JI(e,n,t){let s=new Set(e.perRoot.flatMap(i=>i.packages.map(Jd))),r=new Map([...s].filter(i=>t.has(i)).map(i=>[i,QI(n,i)])),o=[];for(let i of e.perRoot)for(let a of[...new Set(i.packages.map(Jd))].sort()){let l=r.get(a);if(l===void 0||l==="census")continue;let d=l==="project"?"one project's installed set":l==="corpus"?"a vetted corpus slice":"an undeclared population";o.push({kind:"shard-population-narrow",detail:`${i.rootRel===""?"":`${i.rootRel}: `}the loaded ${a} shard's population is ${d}, not the whole ${a} ecosystem: a package outside it carries no advisory row here, so it reports no findings \u2014 which is NOT a clean bill of health for it. Scan with a census shard to assess every package (ADR-114 D5).`,blindsAnalysis:!1,rootRel:i.rootRel})}return o}function QI(e,n){return e.populationModeFor!==void 0?e.populationModeFor(n):e.populationMode?.()}function Nh(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function ZI(e,n,t){return new Map(n.map(s=>[Nh(s),qI(e,s.lockKey,t)]))}function eN(e){let n=new Map;for(let t of e){let s=n.get(t.advisory.id);s===void 0?n.set(t.advisory.id,[t]):s.push(t)}return n}function nN(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(r=>r.packageName===t.name)?e:{...e,tier:$e("symbol-unsupported"),reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,reasonKind:"symbol-unsupported",basis:void 0,path:void 0}}function Eh(e,n,t){if(n.ecosystem!=="Go")return e;let s=t?.flags(n.name,n.version)??{};if(e.tier==="not-affected"&&e.decidedAtStage==="version-match")return s.replacedBy!==void 0?{...e,tier:$e("resolution-divergence"),reason:`${n.name} is replaced by ${s.replacedBy} (a go.mod replace): the code that is built is not ${n.name}@${n.version}, so its version cannot place it outside the advisory's range`,reasonKind:"resolution-divergence",basis:void 0}:s.toolchainAhead!==void 0?{...e,tier:$e("version-undecidable"),reason:`the Go on PATH is ${n.version}, but the governing toolchain line names ${s.toolchainAhead}, which a build under GOTOOLCHAIN=auto uses instead \u2014 which release builds the program is not known here`,reasonKind:"version-undecidable",basis:void 0}:e;if(e.tier!=="not-reachable")return e;let r=s.otherConfiguration===!0?"another build configuration imports it (a file this configuration excludes by a build constraint)":t===null?"no Go lane read the build":t.blockers[0];return r===void 0&&t!==null?{...e,reason:`${n.name} is imported by no package of this build \u2014 not in the import graph \`go list -deps\` reports for ${t.configuration}, and by no file another build configuration compiles (tests excepted): a package-level denial, saying nothing about symbols`}:r===void 0?e:{...e,tier:$e("analysis-cap"),reason:`${n.name} is not imported by this build's graph, but ${r} \u2014 cannot confirm it is unreachable`,reasonKind:"analysis-cap",basis:void 0,path:void 0}}function tN(e,n){return e===void 0?n:{...e.replacedBy!==void 0||n.replacedBy!==void 0?{replacedBy:e.replacedBy??n.replacedBy}:{},...e.replacementOf!==void 0||n.replacementOf!==void 0?{replacementOf:e.replacementOf??n.replacementOf}:{},...e.otherConfiguration===!0||n.otherConfiguration===!0?{otherConfiguration:!0}:{},...e.toolchainAhead!==void 0||n.toolchainAhead!==void 0?{toolchainAhead:e.toolchainAhead??n.toolchainAhead}:{},...e.tool===!0||n.tool===!0?{tool:!0}:{},...e.packageOf!==void 0||n.packageOf!==void 0?{packageOf:e.packageOf??n.packageOf}:{}}}function sN(e,n){let t=new Set;for(let l of e.roots)for(let d of l.modules.keys())t.add(d);let s=l=>n.packageNamesUnder?.("Go",l)??[],r=new Map,o=new Set,i=new Map;for(let l of e.roots){let d=Bg(l,t,s),c=[...l.rows,...d];for(let f of c){let p=Ri(f.name,f.version);r.set(p,tN(r.get(p),f.flags))}for(let f of l.loadedNames)o.add(f);for(let f of d)l.loadedPackages.has(f.name)&&o.add(f.name);i.set(l.rootRel,{packages:c.map(f=>({name:f.name,version:f.version,lockKey:"",dev:!1,declaredIn:"go.mod",ecosystem:"Go"})),source:c.length>0?"go-list":"none",lockfilePath:null,diagnostics:l.diagnostics,truncated:!1,gaps:l.gaps})}let a=[...o].sort().map(l=>({id:`go:${l}`,packageName:l,versionRange:"",path:l,moduleSystem:"esm",isEntrypoint:!0}));return{sets:i,flags:r,graph:{...Qd,modules:a},analyzed:e.roots.some(l=>l.status!=="failed")}}var Qd={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function rN(e,n,t,s,r,o,i){let{finding:a}=mo(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:i(t)},go(s.advisory.id,t.name,s.affected),null,r,o);return a.decidedAtStage!=="presence"&&a.decidedAtStage!=="version-match"?"inside":a.tier==="not-affected"?"outside":"undecidable"}function mo(e,n,t,s,r,o,i){let a=ya({graph:e,installed:t,range:s,symbol:r,coverage:null,incompleteness:o,analysisAborted:i});if(n!==null&&r!==null&&Xd(a,r,"base")){let l=vr(e,n.modulesById,n.reachMods,r,n.records);if(l!==null)return{finding:a,hit:l}}return{finding:a,hit:null}}function oN(e,n){let t=new Set,s=[];for(let r of e.packages)if((r.ecosystem??"npm")==="npm")for(let{advisory:o,affected:i}of n.advisoriesForPackage(r.ecosystem??"npm",r.name)){let a=go(o.id,r.name,i),l;try{l=$t(r.version,a)}catch{continue}if(l)for(let d of n.symbolsForAffected(i.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let c=`${r.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(c)||(t.add(c),s.push({packageName:r.name,packageRootRel:r.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return s.sort((r,o)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${o.packageRootRel}\0${o.container}\0${o.sourcePath}`)),s.slice(0,ni)}function iN(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),r=new Map(e.classes.map(a=>[a.id,a.name])),o=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution==="unresolved")continue;let l=o.get(a.callSiteId);if(l===void 0)continue;let d=s.get(l.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let c=n.get(d.moduleId);if(c===void 0)continue;let f=s.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==c.packageName&&i.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:d.id})}return i}function aN(e){let n=new Set(e.modules.filter(c=>c.isEntrypoint).map(c=>c.id)),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.functions.map(c=>[c.id,c])),r=new Set;for(let c of e.functions)n.has(c.moduleId)&&(c.publicSurfaceReachable||c.name==="<toplevel>")&&r.add(c.id);let o=new Map(e.exports.map(c=>[c.id,c]));for(let c of e.exportBindings){if(c.target.kind!=="function")continue;let f=o.get(c.exportId);if(f===void 0||!n.has(f.moduleId))continue;let p=s.get(c.target.functionId);p===void 0||t.get(p.moduleId)?.externalSurface===!0||r.add(p.id)}let i=new Map(e.callSites.map(c=>[c.id,c.enclosingFunctionId])),a=new Map;for(let c of e.callEdges){if(c.resolution==="unresolved")continue;let f=i.get(c.callSiteId);if(f===void 0)continue;let p=a.get(f);p===void 0?a.set(f,[c.calleeFunctionId]):p.push(c.calleeFunctionId)}let l=new Set(r),d=[...r];for(;d.length>0;){let c=d.pop();if(c!==void 0)for(let f of a.get(c)??[])l.has(f)||(l.add(f),d.push(f))}return l}function lN(e,n,t,s){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let o=t.filter(a=>a.packageName===r.anchor.packageName&&a.exportName===r.anchor.exportName&&a.container===r.anchor.container),i=o.find(a=>a.resolution==="resolved")??o[0];if(i!==void 0)return s.has(i.callerFunctionId)}return null}function Hd(e){return e.some(n=>n.pathQuality==="name-match")}function dN(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(o=>o.modelId!==void 0);let s=new Set(t),r=o=>s.has(o)||s.has(Fn[o]??"")||s.has(yt[o]??"");return e.some(o=>He(o.tier)&&o.reasonKind!==void 0&&r(o.reasonKind)||o.modelPromotedFromKind!==void 0&&r(o.modelPromotedFromKind))}function Zd(e){let n=hr.now(),t=ho(e.dir),s=e.xGo===!0,r=e.reader??(s&&e.shardPathGo!==void 0?$o([ts(e.shardPath),...e.shardPathPypi!==void 0?[ts(e.shardPathPypi)]:[],ts(e.shardPathGo)]):e.shardPathPypi!==void 0?$o([ts(e.shardPath),ts(e.shardPathPypi)]):ts(e.shardPath)),o=e.partialRows===!0;try{if(!/^\d+$/u.test(r.schemaVersion)||Number(r.schemaVersion)>Number(bt))throw new Qn(`shard schema ${JSON.stringify(r.schemaVersion)} is unreadable or newer than this cupel understands (v${bt})`);let i=null;if(e.summaryShadow!==void 0)try{i=Gg(e.summaryShadow)}catch(V){throw new Qn(`--summary-shadow facts dir rejected: ${V instanceof Error?V.message:String(V)}`)}let a=null;if(e.modelShadow!==void 0)try{a=nh(e.modelShadow.claimsPath)}catch(V){throw new Qn(`--model-shadow claims rejected: ${V instanceof Error?V.message:String(V)}`)}let l=Zr(t,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{},discoverGoRoots:s}),d=s?jg(t,l.roots,e.goScan):null,c=d===null?null:sN(d,r),f=bm(t,l,e.installedSet,c?.sets);if(f.truncated){let V=f.perRoot.filter(ye=>ye.truncated).map(ye=>ye.rootRel===""?"the scan root":`\`${ye.rootRel}\``);throw new Qn(`the dependency enumeration hit a hard cap and is incomplete at ${V.length>0?V.join(", "):"the union across roots"} (${f.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let p=Sg(l.roots,{preciseNames:e.pyPreciseNames!==!1,...e.xPyNameMatchLabel===!0?{nameMatchLabel:!0}:{}}),u=p?.execution??null,m=Sm(f.packages.filter(V=>(V.ecosystem??"npm")==="npm")),g=e.entry??[],y=g.length>0?Ep(t,g):{entrypoints:[],rejected:[]},b=y.rejected,_=vp(t,l.roots.filter(V=>V.rel===""||V.ecosystem!=="Go")),S=[...new Set([..._.entrypoints,...y.entrypoints])],k=[...new Set([..._.sources.filter(V=>V.source!=="exports"&&V.source!=="browser").map(V=>V.entrypoint),...y.entrypoints])],v=[..._.sources];for(let V of y.entrypoints)_.entrypoints.includes(V)||v.push({source:"--entry",specifier:V,entrypoint:V,launch:!1,root:HI(l.roots,V)});let I=[...v];for(let V of p?.roots??[])for(let ye of V.entrypoints)v.push({source:`python:${ye.source}`,specifier:ye.declaration,entrypoint:V.rootRel===""?ye.file:`${V.rootRel}/${ye.file}`,launch:ye.source==="console-script"||ye.source==="launch-declaration",root:V.rootRel});let O=oN(f,r),E=e.bindingForms??GI,N=e.callablePackageResolver===!0,A=e.tsconfigPaths!==!1,U=UI(t,to(v)),$=ZI(t,f.packages,U),W=V=>V.ecosystem==="Go"?c?.flags.get(Ri(V.name,V.version))?.tool===!0?["bin"]:[]:(V.ecosystem??"npm")!=="npm"?u?.get(V.name)??["manifest-unreadable"]:$.get(Nh(V))??["manifest-unreadable"],w=Al({appRoot:t,entrypoints:S,executedEntrypoints:k,depClassAnchors:O,bindingForms:E,callablePackageResolver:N,tsconfigPaths:A}),P=w.graph,j=ha(P),F=[..._.diagnostics,...Il(_),...Nl(_,S.length),...Zl(l,I),...w.diagnostics],B=wh(S.length,P),ne=V=>f.packages.some(ye=>(ye.ecosystem??"npm")===V),X=p===null?"no-entrypoint":p.analysisAborted,Q=(ne("npm")?B:null)??(ne("PyPI")?X:null)??(ne("npm")||ne("PyPI")||ne("Go")||d!==null?null:B),Z=XI(r),x=[...f.gaps,...xm(l),...YI(f,Z),...JI(f,r,Z)],T=km(x),q=vh(P,F,T),G={graph:pr,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},z=c===null?{...G,graph:Qd}:{graph:c.graph,incompleteness:[],analysisAborted:c.analyzed?null:"no-entrypoint",symbolsDecidable:!1},L=d===null||c===null?null:{flags:(V,ye)=>c.flags.get(Ri(V,ye)),blockers:d.blockers,configuration:d.toolchain===null?"no toolchain":`${d.toolchain.goos}/${d.toolchain.goarch}, CGO_ENABLED=${d.toolchain.cgo?"1":"0"}, default tags`},ie=V=>(V.ecosystem??"npm")==="npm"?{graph:P,incompleteness:q,analysisAborted:B,symbolsDecidable:!0}:V.ecosystem==="Go"?z:p===null?G:{...p,symbolsDecidable:!0},me=t;try{me=ho(t)}catch{}let be=Xg({graph:P,facts:q,diagnostics:F,analysisAborted:B,loadSites:w.loadSites,conditionUnions:w.conditionUnions,provenAbsent:w.provenAbsent,appRootReal:me,rootBudget:l.budget,causeOf:V=>Ih[V]}),Me=r.allModels?.()??[],re=Pd(Me.map(V=>({model:{packageName:V.packageName,modelId:V.modelId,edges:V.edges},introduced:V.introduced,fixedBefore:V.fixedBefore})),m),R=re.models.length>0?Gr(P,re.models).delta:null,D=R!==null?{records:R.records,reachMods:tt(P),modulesById:new Map(P.modules.map(V=>[V.id,V]))}:null,Y=hr.now(),H=[],ee=new Map,le=WI(),de=[],ge=[];for(let V of f.packages){let ye=ie(V),Oe=(V.ecosystem??"npm")==="npm"?D:null;for(let[,Ce]of eN(r.advisoriesForPackage(V.ecosystem??"npm",V.name))){let rn=Ce[0];if(rn!==void 0){let ln=ee.get(rn.advisory.id),Ue=Ce.map(Dn=>Dn.affected);if(ln===void 0)ee.set(rn.advisory.id,{advisory:rn.advisory,ranges:Ue});else{let Dn=new Set(ln.ranges.map(bn=>bn.id));for(let bn of Ue)Dn.has(bn.id)||(Dn.add(bn.id),ln.ranges.push(bn))}}let We=Ce.map(ln=>rN(ye.graph,Oe,V,ln,ye.incompleteness,ye.analysisAborted,W)),ht=new Set(Ce.filter((ln,Ue)=>We[Ue]==="inside")),Ot=We.indexOf("undecidable"),Pt=Ce.filter((ln,Ue)=>ht.has(ln)||Ue===Ot),Fs=Pt.length>0?Pt:Ce.slice(0,1);for(let ln of Fs){let{advisory:Ue,affected:Dn}=ln,bn=go(Ue.id,V.name,Dn),qn=Ue.cveId??Ue.id,gs=ht.has(ln)?r.symbolsForAffected(Dn.id):[],Ct=gs.filter(he=>he.exportName===null),hs=Ud(Ue.id,V.name,gs,Dn.surfaceComplete,o),Mt=mo(ye.graph,Oe,{name:V.name,version:V.version,...V.ecosystem!==void 0?{ecosystem:V.ecosystem}:{},devOnly:V.dev,outOfGraphExecution:W(V)},bn,null,ye.incompleteness,ye.analysisAborted).finding;if(Mt.decidedAtStage==="presence"||Mt.decidedAtStage==="version-match"){let he=Eh(Mt,V,L);le[he.tier]+=1,H.push({...he,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:bn.surfaceComplete,advisoryId:Ue.id,displayId:qn,packageName:V.name,version:V.version,ecosystem:V.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:Ue.severity,packageLocation:hi(f,V)});continue}for(let he of hs){let{finding:pe,hit:Se}=mo(ye.graph,Oe,{name:V.name,version:V.version,...V.ecosystem!==void 0?{ecosystem:V.ecosystem}:{},devOnly:V.dev,outOfGraphExecution:W(V)},bn,he,ye.incompleteness,ye.analysisAborted),Ae=Eh(nN(pe,ye,V),V,L),nn,mn;Se!==null&&he!==null&&(nn=Se.modelId,mn=pe.reasonKind,Ae={basis:void 0,tier:Se.tier,decidedAtStage:pe.decidedAtStage,reason:`boundary model ${Se.modelId}: ${Se.anchorPackage}.${Se.entryExport} reaches ${he.exportName} [${Se.pathLabels.join(" \u2192 ")}]`,reasonKind:void 0,attribution:Ro(he),pathQuality:Se.pathQuality,path:void 0,unresolvedSites:pe.unresolvedSites,unresolvedEvidence:pe.unresolvedEvidence}),le[Ae.tier]+=1;let Pe=Yg(be,Ae,he,W(V).length,bn.surfaceComplete),dn={...Ae,...Pe!==void 0?{adr105:Pe}:{},modelId:nn,modelPromotedFromKind:mn,surfaceComplete:bn.surfaceComplete,advisoryId:Ue.id,displayId:qn,packageName:V.name,version:V.version,ecosystem:V.ecosystem??"npm",symbolName:he?.exportName??null,symbolPath:he?.sourcePath||null,symbolContainer:he?.container??null,severity:Ue.severity,packageLocation:hi(f,V)};H.push(dn);let Tt=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&He(dn.tier)&&dn.decidedAtStage==="symbol-reachable"&&dn.reasonKind!==void 0&&Tt.has(dn.reasonKind)&&he!==null&&de.push({finding:dn,symbol:he}),a!==null&&He(dn.tier)&&he!==null&&ge.push({finding:dn,symbol:he})}for(let he of Ct)le[$e("symbol-unsupported")]+=1,H.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:bn.surfaceComplete,tier:$e("symbol-unsupported"),decidedAtStage:"symbol-reachable",reason:`advisory ${qn} carries a ${he.symbolKind} pattern symbol; pattern matching is not evaluated yet`,reasonKind:"symbol-unsupported",attribution:void 0,pathQuality:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Ue.id,displayId:qn,packageName:V.name,version:V.version,ecosystem:V.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:Ue.severity,packageLocation:hi(f,V)})}}}for(let V of x)le[$e("coverage-gap")]+=1,H.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:$e("coverage-gap"),decidedAtStage:"presence",reason:V.detail,attribution:void 0,pathQuality:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Yd,displayId:Yd,packageName:V.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:null,reasonKind:"coverage-gap",packageLocation:_m(f,V)});let ve=hr.now()-Y,Re=le["reachable-high"]+le["reachable-medium"],_e=e.failOnReachable===!0&&(Re>0||Hd(H)),Ke=dN(H,Yt(le),e.failOnPotentiallyReachable),ze=e.requireCompleteDenial===!0&&H.some(V=>V.tier==="not-reachable"&&V.basis==="loader-assumption"),pn=_e||Ke||ze?2:0,vn;if(i!==null){let V=tt(P),ye=new Map(P.modules.map(Ce=>[Ce.id,Ce])),Oe=[];for(let{finding:Ce,symbol:rn}of de){let We=ca(P,ye,V,rn,i,BI);Oe.push({advisoryId:Ce.advisoryId,packageName:Ce.packageName,symbolName:Ce.symbolName,reasonKind:Ce.reasonKind??null,wouldPromote:We!==null,...We!==null?{anchorPackage:We.anchorPackage,entryExport:We.entryExport,viaPackages:We.viaPackages,totalHops:We.totalHops}:{}})}vn={records:Oe}}let K;if(a!==null&&e.modelShadow!==void 0){let V=e.modelShadow.widened===!0?"widened":"base",{models:ye,notes:Oe,dispositions:Ce}=Pd(a,m,{shadowConsultDenylisted:!0}),{delta:rn}=Gr(P,ye),We=tt(P),ht=new Map(P.modules.map(he=>[he.id,he])),Ot=iN(P,ht,We),Pt=aN(P),Fs=rn.records.some(he=>Ot.some(pe=>pe.packageName===he.anchor.packageName&&pe.exportName===he.anchor.exportName&&pe.container===he.anchor.container)),ln=[],Ue=Date.now();for(let{finding:he,symbol:pe}of ge){let Se=rn.records,Ae=Xd(he,pe,V),nn=Ae?vr(P,ht,We,pe,Se):null,mn=rn.records.filter(Pe=>Pe.callee.packageName===pe.packageName&&Pe.callee.exportName===pe.exportName&&Pe.callee.container===pe.container||Pe.callee.packageName===pe.packageName&&Pe.callee.realFunctionId!==null);ln.push({advisoryId:he.advisoryId,packageName:he.packageName,symbolName:he.symbolName,reasonKind:he.reasonKind??null,decidedAtStage:he.decidedAtStage,consultSurface:V,noHitReason:nn!==null?null:Ae?Fs?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:nn!==null?lN(nn,Se,Ot,Pt):null,verdictBefore:he.tier,verdictAfter:nn!==null?"reachable-low":he.tier,wouldPromote:nn!==null,...nn!==null?{modelId:nn.modelId,anchorPackage:nn.anchorPackage,entryExport:nn.entryExport,pathLabels:nn.pathLabels,calleeBinding:mn.find(Pe=>Pe.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:Ae?mn.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${mn[0]?.anchor.packageName??"?"}#${mn[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Dn=Date.now()-Ue,bn=Ce.map(he=>{if(he.status!=="active")return{modelId:he.modelId,state:he.status,reason:he.reason,edgesLowered:0,edgesReferenceGated:0};let pe=rn.records.filter(Ae=>Ae.modelId===he.modelId).length;if(pe>0)return{modelId:he.modelId,state:"lowered",reason:null,edgesLowered:pe,edgesReferenceGated:he.edgeCount-pe};let Se=rn.notes.find(Ae=>Ae.startsWith(`model ${he.modelId}:`)||Ae.startsWith(`model-edge ${he.modelId}:`));return{modelId:he.modelId,state:"refused",reason:Se??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:he.edgeCount}}),qn=ln.filter(he=>he.wouldPromote).length,gs=Yt(le)-qn,Ct=le["reachable-high"]+le["reachable-medium"]+(Hd(H)?1:0),hs=he=>({none:0,"fail-on-reachable":Ct>0?2:0,"fail-on-potentially-reachable":he>0?2:0,both:Ct>0||he>0?2:0});K={records:ln,notes:[...Oe,...rn.notes],laneStates:bn,exitCodes:{baseline:hs(Yt(le)),withModels:hs(gs)},overlayWallMs:Dn},Kd(mt.dirname(e.modelShadow.outPath),{recursive:!0});let Mt=`${e.modelShadow.outPath}.tmp-${Gd(8).toString("hex")}`;Wd(Mt,`${JSON.stringify(K,null,2)}
+`,{encoding:"utf8",flag:"wx"}),zd(Mt,e.modelShadow.outPath)}let J;if(e.bindingShadow!==void 0){let V=Date.now(),ye=pe=>re.models.length>0?{records:Gr(pe,re.models).delta.records,reachMods:tt(pe),modulesById:new Map(pe.modules.map(Se=>[Se.id,Se]))}:null,Oe=(pe,Se,Ae,nn)=>{let mn=[];for(let Pe of f.packages)for(let{advisory:dn,affected:Tt}of r.advisoriesForPackage(Pe.ecosystem??"npm",Pe.name)){let js=go(dn.id,Pe.name,Tt),Iy=Ud(dn.id,Pe.name,r.symbolsForAffected(Tt.id),Tt.surfaceComplete,o);for(let kc of Iy){let{finding:wc,hit:na}=mo(pe,nn,{name:Pe.name,version:Pe.version,...Pe.ecosystem!==void 0?{ecosystem:Pe.ecosystem}:{},devOnly:Pe.dev,outOfGraphExecution:W(Pe)},js,kc,Se,Ae);mn.push({advisoryId:dn.id,packageName:Pe.name,symbolName:kc?.exportName??null,tier:na!==null?na.tier:wc.tier,reasonKind:na!==null?null:wc.reasonKind??null})}}return mn},Ce=pe=>{let Se=Al({appRoot:t,entrypoints:S,executedEntrypoints:k,depClassAnchors:O,bindingForms:pe,callablePackageResolver:N,tsconfigPaths:A}),Ae=[..._.diagnostics,...Il(_),...Nl(_,S.length),...Zl(l,I),...Se.diagnostics];return{graph:Se.graph,inc:vh(Se.graph,Ae,T),aborted:wh(S.length,Se.graph),live:ye(Se.graph),applicability:Se.bindingApplicability}},rn=pe=>{let Se=Ce(pe);return Oe(Se.graph,Se.inc,Se.aborted,Se.live)},We=Ce({}),ht=Oe(We.graph,We.inc,We.aborted,We.live),Ot=Oe(P,q,B,D);if(Ot.length!==ht.length)throw new Qn("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let Pt=(pe,Se)=>Se.tier!==pe.tier||Se.reasonKind!==pe.reasonKind,Fs=ht.some((pe,Se)=>{let Ae=Ot[Se];return Ae!==void 0&&Pt(pe,Ae)}),ln=Fs?rn({additiveForms:!0}):null,Ue=Fs?rn({namelessExports:!0}):null,Dn=0,bn=ht.map((pe,Se)=>{let Ae=Ot[Se];if(Ae===void 0||Ae.advisoryId!==pe.advisoryId||Ae.packageName!==pe.packageName||Ae.symbolName!==pe.symbolName)throw new Qn("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let nn={advisoryId:pe.advisoryId,packageName:pe.packageName,symbolName:pe.symbolName,reasonKind:pe.reasonKind,verdictBefore:pe.tier,verdictAfter:Ae.tier,wouldPromote:Ae.tier!==pe.tier&&(Ae.tier==="reachable-high"||Ae.tier==="reachable-medium"||Ae.tier==="reachable-low")};if(!Pt(pe,Ae)||ln===null||Ue===null)return nn;Dn+=1;let mn=ln[Se],Pe=Ue[Se],dn=mn!==void 0&&Pt(pe,mn),Tt=Pe!==void 0&&Pt(pe,Pe);return{...nn,attributedArm:dn&&!Tt?"additiveForms":Tt&&!dn?"namelessExports":"both",...mn!==void 0?{verdictArmA:mn.tier}:{},...Pe!==void 0?{verdictArmB:Pe.tier}:{}}}),qn={...le};ht.forEach((pe,Se)=>{let Ae=Ot[Se];Ae!==void 0&&Ae.tier!==pe.tier&&(qn[Ae.tier]-=1,qn[pe.tier]+=1)});let gs=(pe,Se)=>({none:0,"fail-on-reachable":pe>0?2:0,"fail-on-potentially-reachable":Se>0?2:0,both:pe>0||Se>0?2:0}),Ct;if(re.models.length>0&&D!==null){Ct=[];for(let pe of f.packages)for(let{advisory:Se,affected:Ae}of r.advisoriesForPackage(pe.ecosystem??"npm",pe.name)){let nn=go(Se.id,pe.name,Ae),mn=Ud(Se.id,pe.name,r.symbolsForAffected(Ae.id),Ae.surfaceComplete,o);for(let Pe of mn){if(Pe===null||!Pe.verified)continue;let dn=mo(We.graph,We.live,{name:pe.name,version:pe.version,...pe.ecosystem!==void 0?{ecosystem:pe.ecosystem}:{},devOnly:pe.dev,outOfGraphExecution:W(pe)},nn,Pe,We.inc,We.aborted);if(!(dn.hit===null&&Xd(dn.finding,Pe,"base")))continue;let js=vr(P,D.modulesById,D.reachMods,Pe,D.records);Ct.push({advisoryId:Se.id,packageName:pe.name,symbolName:Pe.exportName,modelWouldPromote:js!==null,...js!==null?{modelId:js.modelId}:{},anchorCleared:js!==null})}}}let hs=H.some(pe=>pe.modelId!==void 0),Mt=Hd(H)?1:0;J={records:bn,deltas:Dn,exitCodes:{baseline:gs(qn["reachable-high"]+qn["reachable-medium"]+Mt,Yt(qn)+(hs?1:0)),withBindingForms:gs(le["reachable-high"]+le["reachable-medium"]+Mt,Yt(le)+(hs?1:0))},dualRunWallMs:Date.now()-V,...w.bindingApplicability!==void 0?{applicability:w.bindingApplicability}:{},...Ct!==void 0?{modelProbe:Ct}:{}},Kd(mt.dirname(e.bindingShadow.outPath),{recursive:!0});let he=`${e.bindingShadow.outPath}.tmp-${Gd(8).toString("hex")}`;Wd(he,`${JSON.stringify(J,null,2)}
+`,{encoding:"utf8",flag:"wx"}),zd(he,e.bindingShadow.outPath)}let oe=new Jt(t),ae=new Map,Ee=V=>{let ye=ae.get(V);if(ye!==void 0)return ye;let Oe=V==="npm"?new Us(P,oe,Ws("npm"),()=>""):V==="Go"?new Us(Qd,oe,Ws("Go"),()=>""):new Us(p?.graph??pr,oe,Ws("PyPI"),Ia((p?.roots??[]).map(Ce=>Ce.rootRel)));return ae.set(V,Oe),Oe},Te=Me.length>0||re.notes.length>0?{active:re.models.length,stored:Me.length,promoted:H.filter(V=>V.modelId!==void 0).length,notes:[...re.notes,...R!==null?R.notes:[]]}:void 0,En=uN(H,n,ve),Un=En.findings.map(V=>V.path===void 0?V:{...V,located:Ee(V.ecosystem).locate(V)}),Hn=new Map,br=V=>{let ye=Hn.get(V);if(ye!==void 0)return ye;let Oe=V==="npm"?lu(P,oe):V==="Go"||p===null?null:du(p.graph,Ee("PyPI"),oe);return Hn.set(V,Oe),Oe},Ye=Un.map(V=>{let ye=V.located?.nodeOf,Oe=V.path?.[V.path.length-1]?.functionId;if(V.influence===void 0||ye===void 0||ye===null||Oe===void 0)return V;let Ce=br(V.ecosystem);return Ce===null?V:{...V,influenceOverlay:cu(Ce.index,Oe,ye,Ce.lineOf,Ce.pathOf)}}),et=()=>{if(p===null)return null;let V=new Map(p.graph.modules.map(Oe=>[Oe.id,Oe])),ye=Ia(p.roots.map(Oe=>Oe.rootRel));return{graph:Oo(p.graph),lineOf:Oe=>{let Ce=V.get(Oe.path);if(Ce===void 0||Ce.id.includes("site-packages:"))return null;let rn=ye(Ce.id),We=rn===""?Ce.path:`${rn}/${Ce.path}`;return Qt(oe,{...Oe,path:We},"utf8-bytes")?.startLine??null}}},gt=Kg(t,Ye,f.perRoot.flatMap(V=>V.pythonLockfilePath?[V.pythonLockfilePath]:[])),Ds;if(e.influenceShadow!==void 0){let V=Xc(P,En.findings,()=>hr.now(),Oe=>Qt(oe,Oe,"utf16-units")?.startLine??null,et());Kd(mt.dirname(e.influenceShadow.outPath),{recursive:!0});let ye=`${e.influenceShadow.outPath}.tmp-${Gd(8).toString("hex")}`;Wd(ye,`${JSON.stringify(V,null,2)}
+`,{encoding:"utf8",flag:"wx"}),zd(ye,e.influenceShadow.outPath),Ds={ports:V.totals.ports,byOutcome:V.totals.byOutcome,wallMs:V.wallMs}}return{...Ds!==void 0?{influenceShadow:Ds}:{},...vn!==void 0?{summaryShadow:vn}:{},...K!==void 0?{modelShadow:K}:{},...J!==void 0?{bindingShadow:J}:{},...Te!==void 0?{modelLane:Te}:{},...e.xPyNameMatchLabel===!0?{nameMatchLabel:!0}:{},dir:t,shardSchemaVersion:r.schemaVersion,installed:f,findings:Ye.map((V,ye)=>{let Oe=gt.idOf[ye]??null;return Oe===null?V:{...V,introducedBy:Oe}}),packageGraphs:gt.graphs,timings:En.timings,counts:le,analyzerDiagnostics:F,pythonDiagnostics:p?.diagnostics??[],...d!==null?{go:{toolchain:d.toolchain===null?null:`${d.toolchain.goversion} ${d.toolchain.goos}/${d.toolchain.goarch}`,facts:d.facts,blockers:d.blockers,roots:d.roots.map(V=>({rootRel:V.rootRel,status:V.status,mode:V.mode,workspace:V.workspace,packages:V.packages,otherConfiguration:V.otherConfiguration,modules:V.modules.size,facts:V.facts}))}}:{},analysisAborted:Q,rejectedEntries:b,entrypointSources:v,entrypointGaps:[..._.gaps,..._.surfaceGaps],entrypointObservations:_.observations,framework:_.framework,unresolved:j,advisories:[...ee.values()],rootSet:l,exitCode:pn,adr105:be.report,inventory:cN(t,e.exclude??[],p,P)}}finally{e.reader===void 0&&r.close()}}function cN(e,n,t,s){let r=t?.roots??[],o=d=>{let c;for(let f of r)(f.rootRel===""||d===f.rootRel||d.startsWith(`${f.rootRel}/`))&&(c===void 0||f.rootRel.length>c.rootRel.length)&&(c=f);return c?.pythonPath},i={...process.env.HOME!==void 0?{home:process.env.HOME}:{},...process.env.XDG_CONFIG_HOME!==void 0?{xdgConfigHome:process.env.XDG_CONFIG_HOME}:{}},a;try{a=kh(e,{exclude:n,gitEnv:i,pythonFor:o})}catch(d){throw d instanceof Rt?new Qn(`the file inventory does not add up (${d.message}); refusing to report coverage it cannot back (ADR-129)`):d}let l=new Set;for(let d of s.modules)d.externalSurface===!0||d.path.includes("node_modules/")||l.add(d.path);for(let d of r)for(let c of d.graph.modules)c.externalSurface===!0||c.packageName!==""||l.add(d.rootRel===""?c.id:`${d.rootRel}/${c.id}`);return Bd(a,l)}var qd=e=>Math.round(e*10)/10;function uN(e,n,t){let s=hr.now(),r=e.map(i=>{let a=fa(i.tier);return a===void 0?i:{...i,influence:a}}),o=hr.now()-s;return{findings:r,timings:{scanMs:qd(s-n),cascadeMs:qd(t),stage6Ms:qd(o)}}}var fN="cupel",pN="reachability-first SCA \u2014 verdict + call path + confidence";function ec(e){return[`${fN} v${e} \u2014 ${pN}`,`cascade: ${Bc.join(" \u2192 ")}`,`verdicts: ${Gc.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-potentially-reachable]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-potentially-reachable","                        exit 2 when any potentially reachable finding is present (strict CI;","                        --fail-on-unknown is the old name, still accepted, with a warning)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
+`)}var mN=new Set([...Er,...ba,...ys]),yo="--fail-on-potentially-reachable",yr="--fail-on-unknown",Rh=`${yr} is deprecated: use ${yo} (the same gate, renamed by ADR-128). The old spelling keeps working, with this warning, until the next major version.`;function Zn(e,n,t){let s=e[n+1];if(s===void 0||s.startsWith("--"))throw new Error(`${t} requires a value`);return s}function gN(e,n){let t=n.split(",").map(o=>o.trim()),s=[...Er,...ba,...ys].join(", ");if(t.length===0||t.some(o=>o===""))throw new Error(`${e}= requires a non-empty comma-separated list of: ${s} (or pass the bare ${e} to fail on every kind)`);let r=[];for(let o of t){if(!mN.has(o))throw new Error(`unrecognised ${e} selector ${JSON.stringify(o)}; valid: ${s}`);r.push(o)}return r}function Oh(e){let n=".",t,s,r,o,i=!1,a=!1,l=!1,d=!1,c=!1,f=!1,p,u,m,g=!1,y=!1,b,_,S=!1,k=!1,v=!0,I=!1,O=!0,E=!1,N,A=[],U=[],$=[];for(let W=0;W<e.length;W+=1){let w=e[W];if(w==="--require-complete-denial"){a=!0;continue}if(w==="--fail-on-reachable")i=!0;else if(w===yo||w===yr)l="all",w===yr&&(d=!0);else if(w!==void 0&&(w.startsWith(`${yo}=`)||w.startsWith(`${yr}=`))){let P=w.startsWith(`${yo}=`)?yo:yr;l=gN(P,w.slice(P.length+1)),P===yr&&(d=!0)}else if(w==="--offline")c=!0;else if(w==="--sarif")t=Zn(e,W,"--sarif"),W+=1;else if(w==="--shard")s=Zn(e,W,"--shard"),W+=1;else if(w==="--shard-pypi")r=Zn(e,W,"--shard-pypi"),W+=1;else if(w==="--shard-go")o=Zn(e,W,"--shard-go"),W+=1;else if(w==="--entry")A.push(Zn(e,W,"--entry")),W+=1;else if(w==="--exclude")U.push(Zn(e,W,"--exclude")),W+=1;else if(w==="--root")$.push(Zn(e,W,"--root")),W+=1;else if(w==="--summary-shadow")p=Zn(e,W,"--summary-shadow"),W+=1;else if(w==="--model-shadow")u=Zn(e,W,"--model-shadow"),W+=1;else if(w==="--model-shadow-out")m=Zn(e,W,"--model-shadow-out"),W+=1;else if(w==="--model-shadow-widened")g=!0;else if(w==="--binding-shadow")y=!0;else if(w==="--x-influence-shadow")_=Zn(e,W,"--x-influence-shadow"),W+=1;else if(w==="--binding-shadow-out")b=Zn(e,W,"--binding-shadow-out"),W+=1;else if(w==="--x-partial-rows")S=!0;else if(w==="--x-go")k=!0;else if(w==="--no-py-precise-names")v=!1;else if(w==="--x-py-precise-names")v=!0;else if(w==="--x-py-name-match-label")I=!0;else if(w==="--no-tsconfig-paths")O=!1;else if(w==="--x-tsconfig-paths")O=!0;else if(w==="--push")E=!0;else if(w!==void 0&&w.startsWith("--auth=")){let P=w.slice(7);if(P!=="oidc"&&P!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(P)}`);N=P}else{if(w!==void 0&&w.startsWith("--"))throw new Error(`unknown flag ${w}`);w!==void 0&&!f&&(n=w,f=!0)}}if(u===void 0!=(m===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(g&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(y!==(b!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(N!==void 0&&!E)throw new Error("--auth only means something with --push");if(o!==void 0&&!k)throw new Error("--shard-go only means something with --x-go");return{dir:n,sarif:t,shard:s,shardPypi:r,shardGo:o,failOnReachable:i,requireCompleteDenial:a,failOnPotentiallyReachable:l,legacyGateFlag:d,offline:c,entry:A,exclude:U,root:$,summaryShadow:p,modelShadow:u,modelShadowOut:m,modelShadowWidened:g,push:E,auth:N,bindingShadow:y,bindingShadowOut:b,influenceShadowOut:_,partialRows:S,xGo:k,pyPreciseNames:v,xPyNameMatchLabel:I,tsconfigPaths:O}}import{chmodSync as kN,mkdirSync as wN,readFileSync as vN,renameSync as EN,statSync as AN,unlinkSync as IN,writeFileSync as NN}from"node:fs";import{randomBytes as RN}from"node:crypto";import{homedir as ON}from"node:os";import Ms from"node:path";import{createPublicKey as hN,verify as yN}from"node:crypto";var Ie=class extends Error{constructor(n){super(n),this.name="DistError"}},Xt=class extends Ie{constructor(n){super(n),this.name="NoCachedShardError"}},bN=Buffer.from("302a300506032b6570032100","hex"),_N=32;function Th(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===_N)try{return hN({key:Buffer.concat([bN,n]),format:"der",type:"spki"})}catch{return}}function nc(e,n,t){for(let s of t){let r=Th(s);if(r!==void 0)try{if(yN(null,e,r,n))return!0}catch{}}return!1}function $h(e){return e.some(n=>Th(n)!==void 0)}var SN=/^[0-9a-f]{64}$/u,xN=/^[a-z0-9-]+$/u;function Ph(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new Ie(`${n} must be an object`);return e}function Ch(e,n){if(!Array.isArray(e))throw new Ie(`${n} must be an array`);return e}function zi(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new Ie(`${n} must be an integer`);return e}function Wi(e,n){if(typeof e!="string")throw new Ie(`${n} must be a string`);return e}function Mh(e,n){let t=Wi(e,n);if(Number.isNaN(Date.parse(t)))throw new Ie(`${n} is not a valid timestamp: ${t}`);return t}function tc(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new Ie("distribution index is not valid JSON")}let s=Ph(t,"index"),r=zi(s.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new Ie(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let o=zi(s.sequence,"sequence");if(o<0)throw new Ie("sequence must be non-negative");let i=Mh(s.generated,"generated"),a=Ch(s.shards,"shards"),l;for(let m of a){let g=Ph(m,"shard entry"),y=Wi(g.ecosystem,"ecosystem");if(!xN.test(y))throw new Ie(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){l=g;break}}if(l===void 0)throw new Ie(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);Mh(l.built,"built");let d=zi(l.db_schema_version,"db_schema_version");if(d<1)throw new Ie("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new Ie(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let c=Wi(l.sha256,"sha256");if(!SN.test(c))throw new Ie(`sha256 must be 64 lowercase hex, got ${JSON.stringify(c)}`);let f=zi(l.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new Ie(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let p=Ch(l.urls,"urls");if(p.length===0)throw new Ie("urls must be a non-empty array");let u=[];for(let m of p){let g=Wi(m,"url");try{u.push(jn(g,n.shardHosts))}catch(y){throw new Ie(`refusing shard url ${JSON.stringify(g)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:c,sizeBytes:f,dbSchemaVersion:d,urls:u,sequence:o,generated:i}}var Lh="CUPEL_CONFIG_DIR",Dh="credentials.json",sc="cpd_",PN="cpl_",CN=sc.length+6+32,MN=200,TN=/^[A-Za-z0-9_-]+$/u,bo=class extends Ie{constructor(n){super(n),this.name="StoredCredentialError"}};function Fh(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=ON();if(process.platform==="darwin")return Ms.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let o=e.APPDATA,i=o!==void 0&&o!==""?o:Ms.join(t,"AppData","Roaming");return Ms.join(i,"cupel")}let s=e.XDG_CONFIG_HOME,r=s!==void 0&&s!==""?s:Ms.join(t,".config");return Ms.join(r,"cupel")}function Ui(e){return Ms.join(Fh(e),Dh)}function rc(e){let n=e.trim();return n.startsWith(PN)?{ok:!1,reason:"push-token"}:n.startsWith(sc)?n.length<CN||n.length>MN?{ok:!1,reason:"malformed"}:TN.test(n.slice(sc.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function jh(e,n){let t=Fh(e),s=Ms.join(t,Dh);wN(t,{recursive:!0,mode:448}),process.platform!=="win32"&&kN(t,448);let r=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),o=`${s}.tmp-${RN(8).toString("hex")}`;return NN(o,`${r}
+`,{flag:"wx",mode:384}),EN(o,s),s}function Bh(e){let n=Ui(e),t;try{t=AN(n)}catch(i){if(i instanceof Error&&i.code==="ENOENT")return;throw i}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new bo(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let s;try{s=JSON.parse(vN(n,"utf8"))}catch{throw new bo(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let r=typeof s=="object"&&s!==null&&"delivery_token"in s?s.delivery_token:void 0,o=rc(typeof r=="string"?r:"");if(!o.ok)throw new bo(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return o.token}function Gh(e){try{return IN(Ui(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var _o="CUPEL_DELIVERY_TOKEN",oc=class extends Ie{constructor(n){super(n),this.name="NoDeliveryTokenError"}},ic=class extends Ie{constructor(n){super(n),this.name="DeliveryCredentialError"}};function $N(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function Kh(e,n,t=()=>{}){let s=$N(e)??t();return s!==void 0?()=>Promise.resolve(s):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function zh(e){if(e===void 0)throw new oc(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${_o} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new ic(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var LN="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function DN(){return new Promise(e=>{let n=process.stdin;process.stderr.write(LN),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",s=o=>{n.setRawMode(!1),n.pause(),n.removeListener("data",r),process.stderr.write(`
+`),o===null&&process.exit(130),e(o)},r=o=>{for(let i of o){if(i==="")return s(null);if(i==="\r"||i===`
+`)return s(t);if(i==="\x7F"||i==="\b"){t=t.slice(0,-1);continue}t+=i}};n.on("data",r)})}async function FN(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function Wh(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${te(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
+`),!0)}async function Uh(e){if(Wh(e,"login"))return 1;let n=process.stdin.isTTY?await DN():await FN(),t=rc(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
 `:`cupel login: that is not a delivery token. Paste the whole token as shown once on app.cupel.sh (Settings \u2192 Tokens); it starts with cpd_.
-`),1;let s=Up(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${s} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${Er} in the environment still wins, and \`cupel logout\` forgets it.
-`),0}function Yp(e){if(Vp(e,"logout"))return 1;let n=Do(process.env);return Hp(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
-`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${Bp} would point elsewhere).
-`),0}import Iv from"node:path";import{randomBytes as Jw,createHash as Zw}from"node:crypto";import{mkdirSync as Qw,readFileSync as ev,renameSync as nv,writeFileSync as tv}from"node:fs";import{homedir as sv}from"node:os";import as from"node:path";var wl="latest.json",vl="latest.json.sig";function Fo(e){return Zw("sha256").update(e).digest("hex")}function El(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=sv();if(process.platform==="darwin")return as.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,i=r!==void 0&&r!==""?r:as.join(n,"AppData","Local");return as.join(i,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,s=t!==void 0&&t!==""?t:as.join(n,".cache");return as.join(s,"cupel","shards")}function Nl(e,n,t){return as.join(e,`${n}-${t}.sqlite`)}function jo(e,n){Qw(as.dirname(e),{recursive:!0});let t=`${e}.tmp-${Jw(8).toString("hex")}`;tv(t,n,{flag:"wx"}),nv(t,e)}function Nr(e){try{return ev(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function Jp(e,n,t,s){let r=Nl(e,n,t),i=Nr(r);if(i===void 0)return;let o=Fo(i);if(o!==t)throw s(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${o})`);return{path:r,bytes:i}}var Zp="api.cupel.sh",Bo=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Qp=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Ko from"node:path";var rv="/v1/resolve",Al=1024*1024,Il=4096,em=Al+Il+64*1024,ov=8,iv=2048,av=/^[A-Za-z0-9+/]+={0,2}$/u,lv=3e4,nn=class extends Se{constructor(n){super(n),this.name="DeliveryRefusedError"}},Ar=class extends nn{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},Ir=class extends Se{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Rr=class extends Se{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function dv(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function cv(e){if(typeof e!="string"||e.length===0)throw new nn("the delivery response carried no index signature");if(e.length>Il||!av.test(e))throw new nn("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new nn("the delivery response's index signature is not canonical base64");return n}function uv(e){if(typeof e!="string"||e.length===0)throw new nn("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Al)throw new nn("the delivery response's index is larger than one can be");return n}function fv(e){if(!Array.isArray(e)||e.length===0)throw new nn("the delivery response named no shard urls");if(e.length>ov)throw new nn("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>iv)throw new nn("the delivery response carried a malformed shard url");n.push(t)}return n}function pv(e,n){throw e===401||e===403?new nn(`${n} rejected the delivery credential \u2014 check ${Er} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new Ar(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Rr(`${n} holds nothing newer than the shard index already cached`):e===429?new Ir(`${n} rate-limited the delivery request`):e>=500?new Ir(`${n} answered ${String(e)}`):new nn(`${n} refused the delivery request with status ${String(e)}`)}async function nm(e,n,t,s,r=lv){let i=On(`https://${e}${rv}`,new Set([e])),o=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await s(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},o,r)}catch{throw new Ir(`${e} could not be reached`)}if(a.status!==200&&pv(a.status,e),Buffer.byteLength(a.body,"utf8")>em)throw new nn(`${e} returned a delivery response larger than one can be`);let d;try{d=JSON.parse(a.body)}catch{throw new nn(`${e} returned a delivery response that is not JSON`)}if(!dv(d))throw new nn(`${e} returned a delivery response that is not an object`);return{index:uv(d.index),sig:cv(d.signature),shardUrls:fv(d.shardUrls)}}var tm=async(e,n,t,s)=>await Us("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,em,s);var mv=8,Ol=class extends Se{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Rl(e){return`${e.origin}${e.pathname}`}function sm(e,n,t){let s=new Map;for(let o of n)s.set(Rl(o),o);let r=[],i=[];for(let o of e.slice(0,mv)){let a;try{a=On(o,t)}catch(c){i.push(c.message);continue}if(a.hash!==""){i.push("a candidate carried a fragment");continue}let d=s.get(Rl(a));if(d===void 0){i.push("a candidate named an object the signed index does not list");continue}let l=new URL(`${Rl(d)}${a.search}`);r.push(On(l.href,t))}if(r.length===0)throw new Ol(`no pre-signed shard url matched the signed index (${i.length===0?"none offered":i.join("; ")})`);return r}var gv=1,yv=1024*1024*1024;function _v(e=Bo){return{async resolve(n){return await nm(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},tm)},async fetchShard(n,t){return On(n.href,e),await fd(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Pl(e){return e instanceof Error?e.message:String(e)}function rm(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:gv,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:yv}}function xv(e){let n=Nr(Ko.join(e.cacheDir,wl)),t=Nr(Ko.join(e.cacheDir,vl));if(!(n===void 0||t===void 0)&&yl(n,t,e.pubkeys))try{return _l(n,rm(e))}catch{return}}function om(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let s=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(s)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function zo(e,n,t){let s=Jp(n.cacheDir,e.ecosystem,e.sha256,r=>new Se(r));if(s===void 0)throw new Se(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:s.path,fromCache:!0,warnings:[...t,...om(e,n)],sequence:e.sequence}}async function bv(e,n,t,s){let r=Nl(t.cacheDir,e.ecosystem,e.sha256),i=Nr(r);if(i!==void 0&&Fo(i)===e.sha256)return{path:r,downloaded:!1};let o="no shard urls";for(let a of n){let d;try{d=await s.fetchShard(a,e.sizeBytes)}catch(c){o=Pl(c);continue}let l=Fo(d);if(l!==e.sha256){o=`sha256 mismatch (expected ${e.sha256}, got ${l})`;continue}return jo(r,d),{path:r,downloaded:!0}}throw new Se(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${o}`)}function Sv(e,n,t){if(e instanceof nn)throw e;if(e instanceof Rr){if(n===void 0)throw new Se(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return zo(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new os(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Pl(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return zo(n,t,[`could not refresh the shard index (${Pl(e)}); using the cached shard`])}async function im(e,n){if(!e.activated)throw new Se("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??_v(e.shardHosts);if(!jp(e.pubkeys))throw new Se("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let s=xv(e);if(e.offline){if(s===void 0)throw new os(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return zo(s,e,[])}let r=await Gp(e.credential),i;try{i=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:s?.sequence??0})}catch(l){return Sv(l,s,e)}if(!yl(i.index,i.sig,e.pubkeys))throw new Se("shard index signature did not verify against any pinned key");let o=_l(i.index,rm(e));if(s!==void 0&&o.sequence<s.sequence)return zo(s,e,[`refusing a rolled-back shard index (served sequence ${String(o.sequence)} < cached ${String(s.sequence)}); keeping the newer cached shard`]);let a=sm(i.shardUrls,o.urls,e.shardHosts),d=await bv(o,a,e,t);return jo(Ko.join(e.cacheDir,wl),i.index),jo(Ko.join(e.cacheDir,vl),i.sig),{path:d.path,fromCache:!d.downloaded,warnings:om(o,e),sequence:o.sequence}}var kv="https://api.cupel.sh",am=".actions.githubusercontent.com",wv=8192;function lm(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Ln=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function vv(e){let n;try{n=new URL(e).hostname}catch{throw new Ln("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=am.slice(1);if(n!==t&&!n.endsWith(am))throw new Ln(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return On(e,new Set([n]))}catch{throw new Ln(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Uo(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,s=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Ln("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(s===void 0||s==="")throw new Ln("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=vv(t);r.searchParams.set("audience",kv);let i;try{i=await n(r.href,{authorization:`Bearer ${s}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Ln("the ID-token request failed")}if(i.length>wv)throw new Ln("the ID-token response was larger than a token can be");let o;try{o=JSON.parse(i)}catch{throw new Ln("the ID-token response was not JSON")}let a=typeof o=="object"&&o!==null?o.value:void 0;if(typeof a!="string"||a.length===0)throw new Ln("the ID-token response carried no token");return a}async function dm(e,n,t={}){let s=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!s)throw new Ln("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Uo(e,n)};if(s)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await Uo(e,n)};throw new Ln("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Ev=64*1024,Nv=64*1024,qo=async(e,n,t,s)=>{if(Buffer.byteLength(t,"utf8")>Ut)throw new Error("findings payload is over the size limit");return await Us("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Nv,s)};async function Ho(e,n){let t=await Us("GET",e,n,void 0,Ev,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var Rv=720*60*60*1e3,Ov=Number(ps);function cm(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function um(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new et("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Cl(e){let n=e.ecosystem??"npm",t=await im({ecosystem:n,activated:!0,pubkeys:Qp,indexHost:Zp,shardHosts:Bo,credential:Wp(process.env,()=>Uo(process.env,Ho),()=>qp(process.env)),cacheDir:n==="npm"?El():Iv.join(El(),n),offline:e.offline,now:Date.now(),maxAgeMs:Rv,supportedDbSchemaVersion:Ov});for(let s of t.warnings)process.stderr.write(`cupel: ${s}
-`);return{path:t.path,sequence:t.sequence}}var Pv=`https://${qs}/v1/scan-failed`,Cv=400;async function Ml(e,n,t,s,r=1e4){try{let i=JSON.stringify({kind:e,detail:n.slice(0,Cv)});await s(Pv,{authorization:`Bearer ${t}`,"content-type":"application/json","content-length":String(Buffer.byteLength(i,"utf8"))},i,r)}catch{}}function Mv(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var Tv={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},fm=4,Tl=3,$l=10,pm={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},$v="(symbol set known incomplete)";function Lv(e){let n=(e.path??[]).map(t=>te(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function mm(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function Dv(e){let n=e.findings.filter(l=>l.tier==="unknown"&&l.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let l of n){let c=t.get(l.unknownKind)??[];c.push(l),t.set(l.unknownKind,c)}let s={cupel:0,project:0};for(let[l,c]of t)s[Rn[l]]+=c.length;let r=[];r.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let i=(l,c)=>{if(s[l]===0)return;r.push(""),r.push(`   ${c} (${String(s[l])}):`);let p=[...t.entries()].filter(([f])=>Rn[f]===l).sort((f,h)=>h[1].length-f[1].length||f[0].localeCompare(h[0])),u=p.slice(0,fm);for(let[f,h]of u){let g=l==="project"?[...new Set(h.flatMap(mm))]:[],y=g.slice(0,Tl).map(te).join(", "),_=g.length>Tl?` (+${String(g.length-Tl)} more files)`:"";r.push(`     ${f.padEnd(21)} ${String(h.length).padStart(4)}  ${pm[f]}`+(y!==""?`
-       ${y}${_}`:""))}for(let[f,h]of p.slice(fm))r.push(`     ${f.padEnd(21)} ${String(h.length).padStart(4)}  ${pm[f]}`)};i("project","Your code \u2014 a change on your side would produce a real verdict"),i("cupel","cupel's gap \u2014 nothing you can do today");let o=new Map;for(let l of n)if(Rn[l.unknownKind]==="project")for(let c of mm(l))o.set(c,(o.get(c)??0)+1);let a=[...o.entries()].sort((l,c)=>c[1]-l[1]||l[0].localeCompare(c[0]))[0];a!==void 0&&s.project>0&&(r.push(""),r.push(`   \u279C Start here: ${te(a[0])} appears in ${String(a[1])} of your ${String(s.project)} finding(s), across ${String(o.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let d=n.filter(l=>Rn[l.unknownKind]==="project");if(d.length>0){r.push("");for(let l of d.slice(0,$l))r.push(`     ${te(l.displayId)}  ${te(l.packageName)}@${te(l.version)}  [${l.unknownKind}] ${te(l.reason)}`);d.length>$l&&r.push(`     \u2026 and ${String(d.length-$l)} more`)}return r.push(""),r}function hm(e){let n=[],t=e.counts,s=e.findings.filter(l=>l.tier==="reachable-high"||l.tier==="reachable-medium"||l.tier==="reachable-low");if(n.push(`cupel scan: ${te(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let l=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+l.map(c=>`${te(c.entrypoint)} [${te(c.source)}]`).join(", ")+(e.entrypointSources.length>l.length?`, \u2026 and ${String(e.entrypointSources.length-l.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let l=new Map;for(let c of e.entrypointObservations)l.set(c.kind,(l.get(c.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...l.entries()].map(([c,p])=>`${String(p)} ${c}`).join(", ")+` (${te(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let l=e.rootSet,c=l.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(l.counts.rootsAdmitted)}): `+c.map(f=>`${te(f.rel===""?".":f.rel)} [${f.witnesses.join("+")}${f.ecosystem==="PyPI"?"; PyPI":f.alsoPython===!0?"; npm+PyPI":""}]`).join(", ")+(l.roots.length>c.length?`, \u2026 and ${String(l.roots.length-c.length)} more`:"")),l.observations.length>0){let f=new Map;for(let h of l.observations)f.set(h.kind,(f.get(h.kind)??0)+1);n.push("    not admitted: "+[...f.entries()].map(([h,g])=>`${String(g)} ${h}`).join(", "))}n.push(`    walk: ${String(l.counts.dirsWalked)} dirs, ${String(l.counts.manifestsSeen)} manifests seen, ${String(l.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${l.budget}`);let p=e.installed.perRoot.filter(f=>f.rootRel!=="");p.length>0&&n.push(`    enumerated (${String(p.length)} nested root${p.length===1?"":"s"}): `+p.slice(0,8).map(f=>`${te(f.rootRel)} (${String(f.packages.length)} packages, ${f.source})`).join(", ")+(p.length>8?`, \u2026 and ${String(p.length-8)} more`:""));let u=Ss(l,e.entrypointSources);u.length>0&&n.push(`    NOT analyzed (${String(u.length)}): ${te(Oa(u.map(f=>f.rel===""?".":f.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at unknown until they are analyzed`),l.budget!=="complete"&&l.budget!=="not-attempted"&&n.push(`    the walk did not finish (${l.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at unknown`),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let l of e.entrypointGaps.slice(0,5))n.push(`  - ${te(l.source)} (${te(l.file)}): ${te(l.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(te).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${Mi(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,i=r.find(l=>l.kind==="no-enumeration")??null;i!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${te(i.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let o=r.filter(l=>l!==i);if(o.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(o.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let l of o.slice(0,10))n.push(`  - [${te(l.kind)}] ${te(l.detail)}`);o.length>10&&n.push(`  \u2026 and ${String(o.length-10)} more`),n.push("")}let a=new Set(r.map(l=>l.detail)),d=[...e.analyzerDiagnostics.map(l=>`${te(l.code)}: ${te(l.detail)}`),...e.pythonDiagnostics.map(l=>`python: ${te(l)}`),...e.installed.diagnostics.filter(l=>!a.has(l)).map(te)];if(d.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(d.length)}) \u2014 verdicts are conservative:`);for(let l of d.slice(0,10))n.push(`  - ${l}`);d.length>10&&n.push(`  \u2026 and ${String(d.length-10)} more`),n.push("")}if(s.length>0){n.push(`\u{1F3AF} Reachable (${String(s.length)}) \u2014 fix these:`);for(let l of s)n.push(`  ${Tv[l.tier]} ${te(l.displayId)}  ${te(l.packageName)}@${te(l.version)}  ${te(l.symbolName??"")}`+(l.surfaceComplete===!1?`  ${$v}`:"")),n.push(`        path: ${Lv(l)}`);n.push("")}return n.push(...Dv(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${Mv(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as Fv}from"node:crypto";var jv="https://json.schemastore.org/sarif-2.1.0.json",gm="cupel-reachability",Ll=new Set(["dispatch","dynamic-load","coverage-gap"]);function Bv(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var Kv=500,zv=10;function Uv(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function qv(e,n){return`${e}::${n}`}function Hv(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Wv(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Fv("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Gv(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Ll.has(e.unknownKind)}var ym={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function _m(e){let n=[],t=new Map,s=[],r=new Nt(e.dir);for(let l of e.findings){if(!Gv(l))continue;let c=qv(l.displayId,l.packageName);if(!t.has(c)){t.set(c,n.length);let v=Hv(l.severity);n.push({id:te(c),properties:{tags:l.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${te(l.packageName)}`]:["security","reachability",`package/${te(l.packageName)}`],...v!==void 0?{"security-severity":v}:{}}})}let p=l.tier==="reachable-high"||l.tier==="reachable-medium"||l.tier==="reachable-low",u=l.path??[],f=u.findIndex(v=>v.modulePath!==""),h=f===-1?void 0:u[f],g=zs(l.ecosystem),y=l.located?.path??null,_=v=>y?.[v]?.modulePath??u[v]?.modulePath??"",b=(v,C)=>{if(C===null)return;let R=_(v);return At(r,R===""?C:{...C,path:R},g)??void 0},x=u[f+1]?.calledAt??null,k=h!==void 0&&x!==null&&x.path===h.modulePath?b(f,x):void 0,w=[...new Set(l.unresolvedSites.map(v=>v.path).filter(v=>v!==""))],I=p?h!==void 0?{physicalLocation:{artifactLocation:{uri:te(_(f))},...k!==void 0?{region:k}:{}},message:{text:`calls ${te(l.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:te(l.packageLocation??"package-lock.json")}}}:w[0]!==void 0?{physicalLocation:{artifactLocation:{uri:te(w[0])}},message:{text:`unresolved ${te(l.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:te(l.packageLocation??(l.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},N=p?u.map((v,C)=>({physicalLocation:{artifactLocation:{uri:te(_(C)||"package-lock.json")}},message:{text:te(v.functionName??"<step>")}})):w.slice(1,zv+1).map(v=>({physicalLocation:{artifactLocation:{uri:te(v)}},message:{text:"also blocked here"}}));s.push({ruleId:te(c),ruleIndex:t.get(c),level:p?"error":"warning",message:{text:te(`[${l.tier}] ${l.displayId} in ${l.packageName}@${l.version}`+(l.symbolName!==null?` \u2014 reaches ${l.symbolName}`:"")+(l.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${l.reason}`)},locations:[I],...N.length>0?{relatedLocations:N}:{},...p&&u.length>0?{codeFlows:[{threadFlows:[{locations:u.map((v,C)=>{let R=v.calledAt===null?void 0:b(C-1,v.calledAt),F=v.calledAt===null?_(C):_(C-1)||v.calledAt.path;return{location:{physicalLocation:{artifactLocation:{uri:te(F||"package-lock.json")},...R!==void 0?{region:R}:{}},message:{text:te(C===0?`entry ${v.functionName??"<step>"}`:`calls ${v.functionName??"<step>"}`)}}}})}]}]}:{},partialFingerprints:{"cupelReachability/v1":Wv(l)},properties:{tier:l.tier,advisoryId:te(l.advisoryId),...l.surfaceComplete===!1?{surfaceComplete:!1}:{},...l.modelId!==void 0?{modelId:te(l.modelId),modelPromotedFromKind:l.modelPromotedFromKind}:{},...l.unknownKind!==void 0?{unknownKind:l.unknownKind,unknownOwner:Rn[l.unknownKind],unresolvedSiteCount:l.unresolvedSites.length}:{},...l.adr105!==void 0?{adr105:l.adr105}:{},...l.influence!==void 0?{influence:{value:l.influence.value,kind:l.influence.kind,owner:Fs[l.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null}}:{}}})}let i=new Map,o=new Map;for(let l of e.findings){if(l.tier!=="unknown"||l.unknownKind===void 0||(i.set(l.unknownKind,(i.get(l.unknownKind)??0)+1),Ll.has(l.unknownKind)))continue;let c=o.get(l.unknownKind)??[];c.length<Kv&&c.push({advisory:te(l.displayId),package:te(l.packageName),version:te(l.version)}),o.set(l.unknownKind,c)}let a={cupel:0,project:0};for(let[l,c]of i)a[Rn[l]]+=c;let d={};for(let[l,c]of o){let p=i.get(l)??c.length;d[l]={count:p,owner:Rn[l],note:ym[l],truncated:p>c.length,advisories:c}}return{$schema:jv,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:gm},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:te(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(l=>`${l.entrypoint} (${l.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...i.keys()].filter(l=>!Ll.has(l)&&!Bv(l,e.analysisAborted)).sort().map(l=>({descriptor:{id:`unknown-${l}`},level:"warning",message:{text:`${String(i.get(l)??0)} finding(s) are unknown because ${ym[l]} (owner: ${Rn[l]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${l}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(l=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:te(`${l.source} (${l.file}): ${l.detail}`)}})),...e.rejectedEntries.map(l=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:te(`--entry did not resolve to a file inside the app root: ${l}`)}})),...e.entrypointObservations.map(l=>({descriptor:{id:`entrypoint-observation:${l.kind}`},level:"note",message:{text:te(`${l.detail} (${l.file})`)}})),...e.analyzerDiagnostics.map(l=>({descriptor:{id:l.code},level:"warning",message:{text:te(`${l.detail}${l.reason===void 0?"":` [reason: ${l.reason}]`} (${l.path})`)}})),...e.pythonDiagnostics.map(l=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:te(l)}})),...e.installed.diagnostics.map(l=>({descriptor:{id:"resolve"},level:"warning",message:{text:te(l)}}))]}],results:s,properties:{category:gm,summary:e.counts,...e.timings!==void 0?{timings:e.timings}:{},installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(l=>({path:te(l.rootRel),count:l.packages.length,source:l.source}))},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:Ss(e.rootSet,e.entrypointSources).length,named:Ss(e.rootSet,e.entrypointSources).slice(0,8).map(l=>te(l.rel===""?".":l.rel))},analyzed:[...mr(e.entrypointSources)].sort().slice(0,64).map(l=>te(l===""?".":l)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(l=>({path:te(l.rel),witnesses:l.witnesses,...l.manifestRefused?{manifestRefused:!0}:{},...l.ecosystem!==void 0?{ecosystem:l.ecosystem}:{},...l.alsoPython===!0?{alsoPython:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(l=>({kind:l.kind,path:te(l.rel)}))}}:{},...Uv(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...i].sort((l,c)=>c[1]-l[1])),byOwner:a,grouped:d},dbCoverageGaps:e.findings.filter(l=>l.tier==="unknown"&&l.unknownKind==="db-gap").map(l=>({advisory:te(l.displayId),package:te(l.packageName),version:te(l.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(l=>l.adr105!==void 0).map(l=>({advisory:te(l.displayId),package:te(l.packageName),version:te(l.version),symbol:te(l.symbolName??""),tier:l.tier,...l.unknownKind!==void 0?{unknownKind:l.unknownKind}:{},...l.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function xm(){try{let e=Vv(Jv(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Zv(e,n){let t=`${JSON.stringify(n,null,2)}
-`,s=`${e}.tmp-${bm(8).toString("hex")}`;Sm(s,t,{encoding:"utf8",flag:"wx"}),Xv(s,e)}async function Qv(e){let n=Tp(e),t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",s=t?{path:um(n.shard),sequence:null}:await Cl({offline:n.offline}),r=s.path,o=cm(n.shardPypi);if(o===void 0&&!t)try{o=(await Cl({offline:n.offline,ecosystem:"pypi"})).path}catch(d){if(d instanceof Ar||d instanceof os)process.stderr.write(`cupel: no PyPI shard available (${d.message}); Python distributions, if any, will be reported as not assessed
-`);else throw d}let a=hl({dir:n.dir,shardPath:r,...o!==void 0?{shardPathPypi:o}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.influenceShadowOut!==void 0?{influenceShadow:{outPath:n.influenceShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${hm(a)}
-`),a.modelLane!==void 0){let d=a.modelLane.notes.length>0?` (${a.modelLane.notes.map(l=>te(l)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(a.modelLane.active)}/${String(a.modelLane.stored)} active, ${String(a.modelLane.promoted)} promoted to reachable-low${d}
-`)}if(n.summaryShadow!==void 0&&a.summaryShadow!==void 0){let d=Yv.join(n.summaryShadow,"shadow-report.json");Sm(d,`${JSON.stringify(a.summaryShadow,null,2)}
-`),process.stdout.write(`summary-shadow: ${String(a.summaryShadow.records.length)} counterfactual record(s) -> ${d}
-`)}if(a.modelShadow!==void 0&&n.modelShadowOut!==void 0){let d=a.modelShadow.records.filter(l=>l.wouldPromote).length;process.stdout.write(`model-shadow: ${String(d)}/${String(a.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
-`)}if(a.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(a.bindingShadow.deltas)}/${String(a.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),a.influenceShadow!==void 0&&n.influenceShadowOut!==void 0){let d=a.influenceShadow.byOutcome;process.stderr.write(`influence-shadow: ${String(a.influenceShadow.ports)} port(s) \u2014 ${String(d.influenced)} influenced, ${String(d["no-source-reached"])} no-source-reached, ${String(d["reaches-entry-parameter"])} reaches-entry-parameter, ${String(d.unknown)} unknown (${String(a.influenceShadow.wallMs)} ms) -> ${n.influenceShadowOut}
-`)}if(n.sarif!==void 0&&Zv(n.sarif,_m(a)),n.push){let d=await dm(process.env,Ho,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
-`)}),l;try{l=gd(a,{scanId:bm(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:yd(a),shardSequence:s.sequence},{onCut:p=>process.stderr.write(`cupel: ${ud(p)}
+`),1;let s=jh(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${s} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${_o} in the environment still wins, and \`cupel logout\` forgets it.
+`),0}function Hh(e){if(Wh(e,"logout"))return 1;let n=Ui(process.env);return Gh(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
+`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${Lh} would point elsewhere).
+`),0}import hR from"node:path";import{randomBytes as jN,createHash as BN}from"node:crypto";import{mkdirSync as GN,readFileSync as KN,renameSync as zN,writeFileSync as WN}from"node:fs";import{homedir as UN}from"node:os";import Ts from"node:path";var ac="latest.json",lc="latest.json.sig";function Hi(e){return BN("sha256").update(e).digest("hex")}function dc(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=UN();if(process.platform==="darwin")return Ts.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,o=r!==void 0&&r!==""?r:Ts.join(n,"AppData","Local");return Ts.join(o,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,s=t!==void 0&&t!==""?t:Ts.join(n,".cache");return Ts.join(s,"cupel","shards")}function cc(e,n,t){return Ts.join(e,`${n}-${t}.sqlite`)}function qi(e,n){GN(Ts.dirname(e),{recursive:!0});let t=`${e}.tmp-${jN(8).toString("hex")}`;WN(t,n,{flag:"wx"}),zN(t,e)}function So(e){try{return KN(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function qh(e,n,t,s){let r=cc(e,n,t),o=So(r);if(o===void 0)return;let i=Hi(o);if(i!==t)throw s(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${i})`);return{path:r,bytes:o}}var Vh="api.cupel.sh",Vi=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Xh=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];var HN="/v1/resolve",uc=1024*1024,fc=4096,Yh=uc+fc+64*1024,qN=8,VN=2048,XN=/^[A-Za-z0-9+/]+={0,2}$/u,YN=3e4,fn=class extends Ie{constructor(n){super(n),this.name="DeliveryRefusedError"}},$s=class extends fn{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},xo=class extends Ie{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},ko=class extends Ie{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function JN(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function QN(e){if(typeof e!="string"||e.length===0)throw new fn("the delivery response carried no index signature");if(e.length>fc||!XN.test(e))throw new fn("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new fn("the delivery response's index signature is not canonical base64");return n}function ZN(e){if(typeof e!="string"||e.length===0)throw new fn("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>uc)throw new fn("the delivery response's index is larger than one can be");return n}function eR(e){if(!Array.isArray(e)||e.length===0)throw new fn("the delivery response named no shard urls");if(e.length>qN)throw new fn("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>VN)throw new fn("the delivery response carried a malformed shard url");n.push(t)}return n}function nR(e,n){throw e===401||e===403?new fn(`${n} rejected the delivery credential \u2014 check ${_o} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new $s(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new ko(`${n} holds nothing newer than the shard index already cached`):e===429?new xo(`${n} rate-limited the delivery request`):e>=500?new xo(`${n} answered ${String(e)}`):new fn(`${n} refused the delivery request with status ${String(e)}`)}async function Jh(e,n,t,s,r=YN){let o=jn(`https://${e}${HN}`,new Set([e])),i=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await s(o.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},i,r)}catch{throw new xo(`${e} could not be reached`)}if(a.status!==200&&nR(a.status,e),Buffer.byteLength(a.body,"utf8")>Yh)throw new fn(`${e} returned a delivery response larger than one can be`);let l;try{l=JSON.parse(a.body)}catch{throw new fn(`${e} returned a delivery response that is not JSON`)}if(!JN(l))throw new fn(`${e} returned a delivery response that is not an object`);return{index:ZN(l.index),sig:QN(l.signature),shardUrls:eR(l.shardUrls)}}var Qh=async(e,n,t,s)=>await Ar("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Yh,s);import Xi from"node:path";var tR=8,mc=class extends Ie{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function pc(e){return`${e.origin}${e.pathname}`}function Zh(e,n,t){let s=new Map;for(let i of n)s.set(pc(i),i);let r=[],o=[];for(let i of e.slice(0,tR)){let a;try{a=jn(i,t)}catch(c){o.push(c.message);continue}if(a.hash!==""){o.push("a candidate carried a fragment");continue}let l=s.get(pc(a));if(l===void 0){o.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${pc(l)}${a.search}`);r.push(jn(d.href,t))}if(r.length===0)throw new mc(`no pre-signed shard url matched the signed index (${o.length===0?"none offered":o.join("; ")})`);return r}var rR=1,oR=1024*1024*1024;function iR(e=Vi){return{async resolve(n){return await Jh(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Qh)},async fetchShard(n,t){return jn(n.href,e),await eu(n.href,{maxBytes:t,timeoutMs:3e4})}}}function gc(e){return e instanceof Error?e.message:String(e)}function ey(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:rR,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:oR}}function aR(e){let n=So(Xi.join(e.cacheDir,ac)),t=So(Xi.join(e.cacheDir,lc));if(!(n===void 0||t===void 0)&&nc(n,t,e.pubkeys))try{return tc(n,ey(e))}catch{return}}function ny(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let s=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(s)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Yi(e,n,t){let s=qh(n.cacheDir,e.ecosystem,e.sha256,r=>new Ie(r));if(s===void 0)throw new Ie(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:s.path,fromCache:!0,warnings:[...t,...ny(e,n)],sequence:e.sequence}}async function lR(e,n,t,s){let r=cc(t.cacheDir,e.ecosystem,e.sha256),o=So(r);if(o!==void 0&&Hi(o)===e.sha256)return{path:r,downloaded:!1};let i="no shard urls";for(let a of n){let l;try{l=await s.fetchShard(a,e.sizeBytes)}catch(c){i=gc(c);continue}let d=Hi(l);if(d!==e.sha256){i=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return qi(r,l),{path:r,downloaded:!0}}throw new Ie(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${i}`)}function dR(e,n,t){if(e instanceof fn)throw e;if(e instanceof ko){if(n===void 0)throw new Ie(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Yi(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new Xt(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${gc(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Yi(n,t,[`could not refresh the shard index (${gc(e)}); using the cached shard`])}async function ty(e,n){if(!e.activated)throw new Ie("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??iR(e.shardHosts);if(!$h(e.pubkeys))throw new Ie("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let s=aR(e);if(e.offline){if(s===void 0)throw new Xt(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Yi(s,e,[])}let r=await zh(e.credential),o;try{o=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:s?.sequence??0})}catch(d){return dR(d,s,e)}if(!nc(o.index,o.sig,e.pubkeys))throw new Ie("shard index signature did not verify against any pinned key");let i=tc(o.index,ey(e));if(s!==void 0&&i.sequence<s.sequence)return Yi(s,e,[`refusing a rolled-back shard index (served sequence ${String(i.sequence)} < cached ${String(s.sequence)}); keeping the newer cached shard`]);let a=Zh(o.shardUrls,i.urls,e.shardHosts),l=await lR(i,a,e,t);return qi(Xi.join(e.cacheDir,ac),o.index),qi(Xi.join(e.cacheDir,lc),o.sig),{path:l.path,fromCache:!l.downloaded,warnings:ny(i,e),sequence:i.sequence}}var cR="https://api.cupel.sh",sy=".actions.githubusercontent.com",uR=8192;function ry(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Wn=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function fR(e){let n;try{n=new URL(e).hostname}catch{throw new Wn("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=sy.slice(1);if(n!==t&&!n.endsWith(sy))throw new Wn(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return jn(e,new Set([n]))}catch{throw new Wn(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Ji(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,s=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Wn("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(s===void 0||s==="")throw new Wn("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=fR(t);r.searchParams.set("audience",cR);let o;try{o=await n(r.href,{authorization:`Bearer ${s}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Wn("the ID-token request failed")}if(o.length>uR)throw new Wn("the ID-token response was larger than a token can be");let i;try{i=JSON.parse(o)}catch{throw new Wn("the ID-token response was not JSON")}let a=typeof i=="object"&&i!==null?i.value:void 0;if(typeof a!="string"||a.length===0)throw new Wn("the ID-token response carried no token");return a}async function oy(e,n,t={}){let s=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!s)throw new Wn("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Ji(e,n)};if(s)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await Ji(e,n)};throw new Wn("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var pR=64*1024,mR=64*1024,Qi=async(e,n,t,s)=>{if(Buffer.byteLength(t,"utf8")>bs)throw new Error("findings payload is over the size limit");return await Ar("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,mR,s)};async function Zi(e,n){let t=await Ar("GET",e,n,void 0,pR,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var yR=720*60*60*1e3,bR=Number(bt);function iy(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function _R(e){let n=process.env.CUPEL_SHARD_GO;return e??(n!==void 0&&n!==""?n:void 0)}function SR(e,n){return Zr(e,{discoverGoRoots:!0,...n.length>0?{operatorRoots:n}:{}}).roots.some(Qr)}async function ay(e,n={}){if(!e.xGo)return;let t=_R(e.shardGo);if(t!==void 0||e.explicitNpm)return t;if((n.holdsGoRoot??SR)(e.dir,e.root))try{return(await(n.zeroConfig??ea)({offline:e.offline,ecosystem:"go"})).path}catch(s){if(s instanceof $s||s instanceof Xt){(n.warn??(r=>process.stderr.write(r)))(`cupel: no Go shard available (${s.message}); Go modules will be reported as not assessed
+`);return}throw s}}function ly(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Qn("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function ea(e){let n=e.ecosystem??"npm",t=await ty({ecosystem:n,activated:!0,pubkeys:Xh,indexHost:Vh,shardHosts:Vi,credential:Kh(process.env,()=>Ji(process.env,Zi),()=>Bh(process.env)),cacheDir:n==="npm"?dc():hR.join(dc(),n),offline:e.offline,now:Date.now(),maxAgeMs:yR,supportedDbSchemaVersion:bR});for(let s of t.warnings)process.stderr.write(`cupel: ${s}
+`);return{path:t.path,sequence:t.sequence}}var xR=`https://${Ir}/v1/scan-failed`,kR=400;async function hc(e,n,t,s,r=1e4){try{let o=JSON.stringify({kind:e,detail:n.slice(0,kR)});await s(xR,{authorization:`Bearer ${t}`,"content-type":"application/json","content-length":String(Buffer.byteLength(o,"utf8"))},o,r)}catch{}}var yc=8,wR=3,Ls=500;function vR(e){let n=[`${String(e.files)} ${e.files===1?"file":"files"}`];return n.push(`${Ki(e.coverage)} scanned`),e.reached!==null&&n.push(`${String(e.reached)} reached`),e.failed>0&&n.push(`${String(e.failed)} failed`),e.unsupported>0&&n.push(`${String(e.unsupported)} not supported yet`),e.excluded>0&&n.push(`${String(e.excluded)} excluded`),`   ${e.label}: ${n.join(" \xB7 ")}`}function dy(e){let n=[],t=e.total;n.push(`\u{1F4C2} Source files: ${String(t.files)} \xB7 ${Ki(t.coverage)} scanned`+(t.reached===null?"":` \xB7 ${String(t.reached)} reached from an entrypoint`));for(let s of e.languages)n.push(vR(s));if(e.failedFiles.length>0){n.push(`   \u26A0\uFE0F  ${String(e.failedFiles.length)} ${e.failedFiles.length===1?"file":"files"} could not be scanned:`);let s=new Map;for(let o of e.failedFiles){let i=`${o.reason}\0${o.detail??""}`,a=s.get(i)??[];a.push(o),s.set(i,a)}let r=0;for(let o of s.values()){if(r===yc)break;r+=1;let i=o[0];if(i===void 0)continue;let a=`${i.reason}${i.detail===void 0?"":` (${te(i.detail)})`}`,l=o.slice(0,wR).map(d=>te(d.rel));n.push(`      ${String(o.length)} \xD7 ${a}: ${l.join(", ")}${o.length>l.length?", \u2026":""}`)}s.size>yc&&n.push(`      \u2026 and ${String(s.size-yc)} more reasons (every file is in the SARIF output)`)}if(e.unsupportedFiles.length>0&&n.push(`   \u2139\uFE0F  ${String(e.unsupportedFiles.length)} ${e.unsupportedFiles.length===1?"file is":"files are"} in a language cupel does not read yet, counted as not scanned`),e.excludedFiles.length>0||e.excludedDirectories.length>0){let s=[];if(e.excludedFiles.length>0&&s.push(`${String(e.excludedFiles.length)} ${e.excludedFiles.length===1?"file":"files"}`),e.excludedDirectories.length>0){let r=e.excludedDirectories.slice(0,6).map(o=>`${te(o.rel)} [${AR(o.rule.origin,o.rule.source)}]`);s.push(`${String(e.excludedDirectories.length)} ${e.excludedDirectories.length===1?"directory":"directories"} (${r.join(", ")}${e.excludedDirectories.length>r.length?", \u2026":""})`)}n.push(`   \u2139\uFE0F  Excluded: ${s.join(", ")}`)}return e.unwalked.length>0&&n.push(`   \u26A0\uFE0F  Not walked: ${e.unwalked.slice(0,6).map(s=>`${te(s.rel)} [${s.reason}]`).join(", ")}${e.unwalked.length>6?", \u2026":""}`),e.truncated!==null&&n.push(`   \u26A0\uFE0F  The inventory stopped at ${String(e.truncated.limit)} ${e.truncated.cap}: files past it are not counted`),n.push(`   ${ER(e)}`),n}function ER(e){switch(e.git.kind){case"index":return"Ignore rules: git's, with its index (a tracked file is counted even under an ignore pattern)";case"ignore-files":return`Ignore rules: git's ignore files (index not read: ${te(e.git.indexNote)})`;case"none":return"Ignore rules: not a git checkout; .gitignore and .cupelignore files still apply"}}function AR(e,n){return e==="default"||e==="virtualenv"?"default":e==="git-dir"?"git":e==="symlink"?"symlink":e==="exclude-flag"?"--exclude":te(n)}function cy(e){return{total:e.total,languages:e.languages.map(n=>({language:n.language,files:n.files,scanned:n.scanned,unsupported:n.unsupported,failed:n.failed,failedByReason:n.failedByReason,excluded:n.excluded,reached:n.reached,coverage:n.coverage})),failed:e.failedFiles.slice(0,Ls).map(n=>({path:te(n.rel),language:n.language,reason:n.reason,...n.detail===void 0?{}:{detail:te(n.detail)}})),excluded:e.excludedFiles.slice(0,Ls).map(n=>({path:te(n.rel),language:n.language,rule:{origin:n.rule.origin,source:te(n.rule.source),line:n.rule.line,pattern:te(n.rule.pattern)}})),excludedDirectories:e.excludedDirectories.slice(0,Ls).map(n=>({path:te(n.rel),rule:{origin:n.rule.origin,source:te(n.rule.source),line:n.rule.line,pattern:te(n.rule.pattern)}})),unwalked:e.unwalked.slice(0,Ls).map(n=>({path:te(n.rel),reason:n.reason})),truncated:e.truncated,git:e.git.kind==="ignore-files"?{kind:e.git.kind,indexNote:te(e.git.indexNote)}:{kind:e.git.kind},omitted:{failed:Math.max(0,e.failedFiles.length-Ls),excluded:Math.max(0,e.excludedFiles.length-Ls),excludedDirectories:Math.max(0,e.excludedDirectories.length-Ls)}}}var IR={"reachable-high":"reachable","reachable-medium":"reachable","reachable-low":"reachable","potentially-reachable-not-ruled-out":"potentially-reachable","potentially-reachable-not-analysed":"potentially-reachable","not-reachable":"not-reachable","not-affected":"not-affected"};function py(e){let n=e.map(t=>IR[t.tier]);return n.includes("reachable")?"reachable":n.includes("potentially-reachable")?"potentially-reachable":n.length>0&&n.every(t=>t==="not-reachable")?"not-reachable":"not-affected"}function NR(e){return e.some(n=>n.tier==="potentially-reachable-not-ruled-out")?"potentially-reachable-not-ruled-out":"potentially-reachable-not-analysed"}function uy(e,n){let t=new Map;for(let s of e){let r=n(s),o=t.get(r);o===void 0?t.set(r,[s]):o.push(s)}return[...t.values()]}function fy(e){let n={"potentially-reachable-not-ruled-out":0,"potentially-reachable-not-analysed":0},t=0,s=0,r=0,o=0,i=!1;for(let a of e){let l=py(a);l==="reachable"?t+=1:l==="potentially-reachable"?(s+=1,n[NR(a)]+=1):l==="not-reachable"?(r+=1,a.some(d=>d.basis==="loader-assumption")&&(i=!0)):o+=1}return{total:e.length,reachable:t,potentiallyReachable:s,byTier:n,notReachable:r,notAffected:o,notReachableAssumed:i}}function my(e){let n=(r,o)=>JSON.stringify([r.ecosystem,r.packageName,r.version,o]),t=uy(e,r=>n(r,r.advisoryId)),s=0;for(let r of t)py(r)==="reachable"&&(s+=r.filter(o=>He(o.tier)).length);return{advisories:fy(t),vulnerabilities:fy(uy(e,r=>n(r,r.displayId))),middleRowsInReachable:s}}function RR(e){if(e.counts["not-reachable"]===0)return"";let n=e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption");return _y(n)}var _y=e=>e?" (assumed: no dependency loader loads them)":" (nothing assumed)",Sc=e=>e===1?"advisory":"advisories",OR=e=>e===1?"finding":"findings",PR=Er.filter(e=>yt[e]==="potentially-reachable-not-ruled-out").join(", ");function gy(e,n){return`${e} \u2014 ${String(n.reachable)} reachable, ${String(n.potentiallyReachable)} potentially reachable (${String(n.byTier["potentially-reachable-not-ruled-out"])} path not ruled out, ${String(n.byTier["potentially-reachable-not-analysed"])} not analysed), ${String(n.notReachable)} not-reachable${n.notReachable===0?"":_y(n.notReachableAssumed)}, ${String(n.notAffected)} not-affected.`}function CR(e){let n=e.ecosystem==="PyPI"?"; PyPI":e.alsoPython===!0?"; npm+PyPI":"";return e.ecosystem==="Go"?"; Go":e.alsoGo!==!0?n:n===""?"; npm+Go":`${n}+Go`}function MR(e){let n=e.findings.filter(r=>r.tier==="reachable-low"),t=n.filter(r=>r.pathQuality==="name-match").length;if(e.nameMatchLabel!==!0&&t===0)return"(modeled)";let s=n.filter(r=>r.pathQuality!=="name-match").length;return`(${String(s)} modeled, ${String(t)} name-match)`}var TR={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},hy=4,bc=3,_c=10,$R={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version or advisory bound is not SemVer 2.0.0 / PEP 440 \u2014 cupel cannot order them","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},LR={"resolution-divergence":"a go.mod replace builds other code than the module@version the advisory names","version-undecidable":"the Go release that builds the program is not the one on PATH, or is not a release","analysis-cap":"another build configuration, a plugin, or an unread part of the build keeps the Go denial open","symbol-unsupported":"the package is imported; the Go scan reads packages, not calls, before S2"};function yy(e,n){let t=LR[e];return t!==void 0&&n.length>0&&n.every(s=>s.ecosystem==="Go")?t:$R[e]}var DR="(symbol set known incomplete)";function FR(e){let n=e.path??[];return n.length===0?"(no path)":n.map((t,s)=>{let r=te(t.functionName??"<anon>");return s===0?r:`${t.via==="name-match"?" \u21E2 ":" \u2192 "}${r}`}).join("")}function jR(e){let n=e.path??[],t=n.flatMap((d,c)=>d.via==="name-match"?[c]:[]),s=t[0];if(s===void 0||s===0)return null;let r=e.located?.path?.[s-1],o=r?.modulePath??n[s]?.calledAt?.path??n[s-1]?.modulePath,i=r?.callSite?.line??null,a=`${te(o??"")}${i!==null?`:${String(i)}`:""}`,l=t.length-1;return`via name match at ${a}`+(l>0?` \u2026 and ${String(l)} more name-match hop${l===1?"":"s"}`:"")}function by(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function BR(e,n){let t=e.findings.filter(u=>He(u.tier)&&u.reasonKind!==void 0);if(t.length===0)return[];let s=new Map;for(let u of t){let m=s.get(u.reasonKind)??[];m.push(u),s.set(u.reasonKind,m)}let r={cupel:0,project:0};for(let[u,m]of s)r[Fn[u]]+=m.length;let o=[],i=n.advisories.potentiallyReachable;o.push(i>0?`\u2753 Potentially reachable (${String(i)}) \u2014 cupel could NOT rule out a path for ${String(i)} ${Sc(i)}. This is not a clean result.`:"\u2753 Potentially reachable (0) \u2014 every undecided finding sits in an advisory counted reachable above.");let a=n.advisories.byTier;o.push(`   Path not ruled out (${String(a["potentially-reachable-not-ruled-out"])}) \u2014 cupel analysed it and a path could not be ruled out (${PR}).`),o.push(`   Not analysed (${String(a["potentially-reachable-not-analysed"])}) \u2014 the function-level question could not be run (every other kind).`);let l=n.middleRowsInReachable;o.push(`   By kind, in findings (${String(t.length)}`+(l>0?`; ${String(l)} of them in advisories counted reachable above`:"")+"):");let d=(u,m)=>{if(r[u]===0)return;o.push(""),o.push(`   ${m} (${String(r[u])}):`);let g=[...s.entries()].filter(([b])=>Fn[b]===u).sort((b,_)=>_[1].length-b[1].length||b[0].localeCompare(_[0])),y=g.slice(0,hy);for(let[b,_]of y){let S=u==="project"?[...new Set(_.flatMap(by))]:[],k=S.slice(0,bc).map(te).join(", "),v=S.length>bc?` (+${String(S.length-bc)} more files)`:"";o.push(`     ${b.padEnd(21)} ${String(_.length).padStart(4)}  ${yy(b,_)}`+(k!==""?`
+       ${k}${v}`:""))}for(let[b,_]of g.slice(hy))o.push(`     ${b.padEnd(21)} ${String(_.length).padStart(4)}  ${yy(b,_)}`)};d("project","Your code \u2014 a change on your side would produce a real verdict"),d("cupel","cupel's gap \u2014 nothing you can do today");let c=new Map;for(let u of t)if(Fn[u.reasonKind]==="project")for(let m of by(u))c.set(m,(c.get(m)??0)+1);let f=[...c.entries()].sort((u,m)=>m[1]-u[1]||u[0].localeCompare(m[0]))[0];f!==void 0&&r.project>0&&(o.push(""),o.push(`   \u279C Start here: ${te(f[0])} appears in ${String(f[1])} of your ${String(r.project)} finding(s), across ${String(c.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let p=t.filter(u=>Fn[u.reasonKind]==="project");if(p.length>0){o.push("");for(let u of p.slice(0,_c))o.push(`     ${te(u.displayId)}  ${te(u.packageName)}@${te(u.version)}  [${u.reasonKind}] ${te(u.reason)}`);p.length>_c&&o.push(`     \u2026 and ${String(p.length-_c)} more`)}return o.push(""),o}function GR(e){let n=e.go;if(n===void 0)return[];let t=[];t.push(`\u2139\uFE0F  Go, package level (${String(n.roots.length)} root${n.roots.length===1?"":"s"}): ${te(n.toolchain??"no usable Go toolchain")}`);for(let s of n.facts)t.push(`    ${te(s)}`);for(let s of n.roots.slice(0,8)){let r=s.rootRel===""?".":s.rootRel;t.push(`    ${te(r)}: ${s.status}`+(s.mode===null?"":`, -mod=${s.mode}`)+(s.workspace===null?"":`, workspace ${te(s.workspace)}`)+`, ${String(s.packages)} package(s) in the graph, ${String(s.modules)} module(s)`+(s.otherConfiguration>0?`, ${String(s.otherConfiguration)} package(s) only another build configuration imports`:""));for(let o of s.facts.slice(0,5))t.push(`      - ${te(o)}`)}return n.roots.length>8&&t.push(`    \u2026 and ${String(n.roots.length-8)} more`),n.blockers.length>0&&t.push(`    no Go not-reachable stands in this scan: ${te(n.blockers.join("; "))}`),t.push(""),t}function Sy(e){let n=[],t=e.counts,s=e.findings.filter(p=>p.tier==="reachable-high"||p.tier==="reachable-medium"||p.tier==="reachable-low");if(n.push(`cupel scan: ${te(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let p=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+p.map(u=>`${te(u.entrypoint)} [${te(u.source)}]`).join(", ")+(e.entrypointSources.length>p.length?`, \u2026 and ${String(e.entrypointSources.length-p.length)} more`:"")),n.push("")}if(e.inventory!==void 0&&(n.push(...dy(e.inventory)),n.push("")),e.entrypointObservations.length>0){let p=new Map;for(let u of e.entrypointObservations)p.set(u.kind,(p.get(u.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...p.entries()].map(([u,m])=>`${String(m)} ${u}`).join(", ")+` (${te(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let p=e.rootSet,u=p.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(p.counts.rootsAdmitted)}): `+u.map(y=>`${te(y.rel===""?".":y.rel)} [${y.witnesses.join("+")}${CR(y)}]`).join(", ")+(p.roots.length>u.length?`, \u2026 and ${String(p.roots.length-u.length)} more`:"")),p.observations.length>0){let y=new Map;for(let b of p.observations)y.set(b.kind,(y.get(b.kind)??0)+1);n.push("    not admitted: "+[...y.entries()].map(([b,_])=>`${String(_)} ${b}`).join(", "))}n.push(`    walk: ${String(p.counts.dirsWalked)} dirs, ${String(p.counts.manifestsSeen)} manifests seen, ${String(p.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${p.budget}`);let m=e.installed.perRoot.filter(y=>y.rootRel!=="");m.length>0&&n.push(`    enumerated (${String(m.length)} nested root${m.length===1?"":"s"}): `+m.slice(0,8).map(y=>`${te(y.rootRel)} (${String(y.packages.length)} packages, ${y.source})`).join(", ")+(m.length>8?`, \u2026 and ${String(m.length-8)} more`:""));let g=er(p,e.entrypointSources);g.length>0&&n.push(`    NOT analyzed (${String(g.length)}): ${te(Ql(g.map(y=>y.rel===""?".":y.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at potentially reachable until they are analyzed`),p.budget!=="complete"&&p.budget!=="not-attempted"&&n.push(`    the walk did not finish (${p.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at potentially reachable`),n.push("")}if(n.push(...GR(e)),e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let p of e.entrypointGaps.slice(0,5))n.push(`  - ${te(p.source)} (${te(p.file)}): ${te(p.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(te).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at potentially reachable, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${nl(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at potentially reachable, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,o=r.find(p=>p.kind==="no-enumeration")??null;o!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${te(o.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let i=r.filter(p=>p!==o);if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let p of i.slice(0,10))n.push(`  - [${te(p.kind)}] ${te(p.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let a=new Set(r.map(p=>p.detail)),l=[...e.analyzerDiagnostics.map(p=>`${te(p.code)}: ${te(p.detail)}`),...e.pythonDiagnostics.map(p=>`python: ${te(p)}`),...e.installed.diagnostics.filter(p=>!a.has(p)).map(te)];if(l.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(l.length)}) \u2014 verdicts are conservative:`);for(let p of l.slice(0,10))n.push(`  - ${p}`);l.length>10&&n.push(`  \u2026 and ${String(l.length-10)} more`),n.push("")}let d=my(e.findings);if(s.length>0){let p=d.advisories.reachable;n.push(`\u{1F3AF} Reachable (${String(p)}) \u2014 fix these: ${String(p)} ${Sc(p)}, ${String(s.length)} ${OR(s.length)}, each with its call path.`);for(let u of s){n.push(`  ${TR[u.tier]} ${te(u.displayId)}  ${te(u.packageName)}@${te(u.version)}  ${te(u.symbolName??"")}`+(u.surfaceComplete===!1?`  ${DR}`:""));let m=jR(u);m!==null&&n.push(`        ${m}`),n.push(`        path: ${FR(u)}`)}n.push("")}n.push(...BR(e,d));let c=d.advisories,f=d.vulnerabilities;return n.push(`Summary: ${gy(`${String(c.total)} ${Sc(c.total)}`,c)}`),n.push(`         ${gy(`${String(f.total)} ${f.total===1?"vulnerability":"vulnerabilities"} (deduplicated by CVE)`,f)}`),n.push(`Findings: ${String(e.findings.length)} \u2014 ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low ${MR(e)}, ${String(t["potentially-reachable-not-ruled-out"]+t["potentially-reachable-not-analysed"])} potentially reachable (${String(t["potentially-reachable-not-ruled-out"])} path not ruled out, ${String(t["potentially-reachable-not-analysed"])} not analysed), ${String(t["not-reachable"])} not-reachable${RR(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as KR}from"node:crypto";var zR="https://json.schemastore.org/sarif-2.1.0.json",xy="cupel-reachability",xc=new Set(["dispatch","dynamic-load","coverage-gap"]);function WR(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var UR=500,HR=10;function qR(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function VR(e,n){return`${e}::${n}`}function XR(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function YR(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return KR("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function JR(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:!He(e.tier)||e.reasonKind===void 0?!1:xc.has(e.reasonKind)}var ky={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range: one of them is not a valid version for its ecosystem (npm: SemVer 2.0.0; PyPI: PEP 440)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function wy(e){let n=[],t=new Map,s=[],r=new Jt(e.dir);for(let d of e.findings){if(!JR(d))continue;let c=VR(d.displayId,d.packageName);if(!t.has(c)){t.set(c,n.length);let E=XR(d.severity);n.push({id:te(c),properties:{tags:d.reasonKind==="coverage-gap"?["security","coverage-gap",`gap/${te(d.packageName)}`]:["security","reachability",`package/${te(d.packageName)}`],...E!==void 0?{"security-severity":E}:{}}})}let f=d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low",p=d.path??[],u=p.findIndex(E=>E.modulePath!==""),m=u===-1?void 0:p[u],g=Ws(d.ecosystem),y=d.located?.path??null,b=E=>y?.[E]?.modulePath??p[E]?.modulePath??"",_=(E,N)=>{if(N===null)return;let A=b(E);return Qt(r,A===""?N:{...N,path:A},g)??void 0},S=p[u+1]?.calledAt??null,k=m!==void 0&&S!==null&&S.path===m.modulePath?_(u,S):void 0,v=[...new Set(d.unresolvedSites.map(E=>E.path).filter(E=>E!==""))],I=f?m!==void 0?{physicalLocation:{artifactLocation:{uri:te(b(u))},...k!==void 0?{region:k}:{}},message:{text:`calls ${te(d.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:te(d.packageLocation??"package-lock.json")}}}:v[0]!==void 0?{physicalLocation:{artifactLocation:{uri:te(v[0])}},message:{text:`unresolved ${te(d.reasonKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:te(d.packageLocation??(d.reasonKind==="coverage-gap"?"package.json":"package-lock.json"))}}},O=f?p.map((E,N)=>({physicalLocation:{artifactLocation:{uri:te(b(N)||"package-lock.json")}},message:{text:te(E.functionName??"<step>")}})):v.slice(1,HR+1).map(E=>({physicalLocation:{artifactLocation:{uri:te(E)}},message:{text:"also blocked here"}}));s.push({ruleId:te(c),ruleIndex:t.get(c),level:f?"error":"warning",message:{text:te(`[${d.tier}] ${d.displayId} in ${d.packageName}@${d.version}`+(d.symbolName!==null?` \u2014 reaches ${d.symbolName}`:"")+(d.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${d.reason}`)},locations:[I],...O.length>0?{relatedLocations:O}:{},...f&&p.length>0?{codeFlows:[{threadFlows:[{locations:p.map((E,N)=>{let A=E.calledAt===null?void 0:_(N-1,E.calledAt),U=E.calledAt===null?b(N):b(N-1)||E.calledAt.path;return{location:{physicalLocation:{artifactLocation:{uri:te(U||"package-lock.json")},...A!==void 0?{region:A}:{}},message:{text:te(N===0?`entry ${E.functionName??"<step>"}`:`calls ${E.functionName??"<step>"}`+(E.via==="name-match"?" via name match":""))}}}})}]}]}:{},partialFingerprints:{"cupelReachability/v1":YR(d)},properties:{tier:d.tier,...f&&(e.nameMatchLabel===!0||d.pathQuality==="name-match")?{pathQuality:d.pathQuality,nameMatchHops:p.flatMap((E,N)=>E.via==="name-match"?[N+1]:[])}:{},advisoryId:te(d.advisoryId),...d.surfaceComplete===!1?{surfaceComplete:!1}:{},...d.modelId!==void 0?{modelId:te(d.modelId),modelPromotedFromKind:d.modelPromotedFromKind}:{},...d.reasonKind!==void 0?{reasonKind:d.reasonKind,reasonOwner:Fn[d.reasonKind],unresolvedSiteCount:d.unresolvedSites.length}:{},...d.adr105!==void 0?{adr105:d.adr105}:{},...d.influence!==void 0?{influence:{value:d.influence.value,kind:d.influence.kind,owner:xr[d.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null}}:{}}})}let o=new Map,i=new Map;for(let d of e.findings){if(!He(d.tier)||d.reasonKind===void 0||(o.set(d.reasonKind,(o.get(d.reasonKind)??0)+1),xc.has(d.reasonKind)))continue;let c=i.get(d.reasonKind)??[];c.length<UR&&c.push({advisory:te(d.displayId),package:te(d.packageName),version:te(d.version)}),i.set(d.reasonKind,c)}let a={cupel:0,project:0};for(let[d,c]of o)a[Fn[d]]+=c;let l={};for(let[d,c]of i){let f=o.get(d)??c.length;l[d]={count:f,owner:Fn[d],note:ky[d],truncated:f>c.length,advisories:c}}return{$schema:zR,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:xy},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:te(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(d=>`${d.entrypoint} (${d.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...o.keys()].filter(d=>!xc.has(d)&&!WR(d,e.analysisAborted)).sort().map(d=>({descriptor:{id:`potentially-reachable-${d}`},level:"warning",message:{text:`${String(o.get(d)??0)} finding(s) are Potentially reachable because ${ky[d]} (owner: ${Fn[d]}). These are counted in counts["${yt[d]}"] and itemised in run.properties.potentiallyReachable.grouped["${d}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(d=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:te(`${d.source} (${d.file}): ${d.detail}`)}})),...e.rejectedEntries.map(d=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:te(`--entry did not resolve to a file inside the app root: ${d}`)}})),...e.entrypointObservations.map(d=>({descriptor:{id:`entrypoint-observation:${d.kind}`},level:"note",message:{text:te(`${d.detail} (${d.file})`)}})),...e.analyzerDiagnostics.map(d=>({descriptor:{id:d.code},level:"warning",message:{text:te(`${d.detail}${d.reason===void 0?"":` [reason: ${d.reason}]`} (${d.path})`)}})),...e.pythonDiagnostics.map(d=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:te(d)}})),...(e.go?.facts??[]).map(d=>({descriptor:{id:"go-build-context"},level:"note",message:{text:te(d)}})),...(e.go?.blockers??[]).map(d=>({descriptor:{id:"go-denial-withheld"},level:"warning",message:{text:te(`no Go not-reachable stands in this scan: ${d}`)}})),...e.installed.diagnostics.map(d=>({descriptor:{id:"resolve"},level:"warning",message:{text:te(d)}}))]}],results:s,properties:{category:xy,summary:e.counts,...e.inventory!==void 0?{inventory:cy(e.inventory)}:{},...e.timings!==void 0?{timings:e.timings}:{},installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(d=>({path:te(d.rootRel),count:d.packages.length,source:d.source}))},...e.go!==void 0?{go:{toolchain:e.go.toolchain===null?null:te(e.go.toolchain),deniesWithheld:e.go.blockers.map(te),roots:e.go.roots.slice(0,64).map(d=>({path:te(d.rootRel),status:d.status,mode:d.mode,workspace:d.workspace===null?null:te(d.workspace),packages:d.packages,otherConfiguration:d.otherConfiguration,modules:d.modules}))}}:{},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:er(e.rootSet,e.entrypointSources).length,named:er(e.rootSet,e.entrypointSources).slice(0,8).map(d=>te(d.rel===""?".":d.rel))},analyzed:[...to(e.entrypointSources)].sort().slice(0,64).map(d=>te(d===""?".":d)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(d=>({path:te(d.rel),witnesses:d.witnesses,...d.manifestRefused?{manifestRefused:!0}:{},...d.ecosystem!==void 0?{ecosystem:d.ecosystem}:{},...d.alsoPython===!0?{alsoPython:!0}:{},...d.alsoGo===!0?{alsoGo:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(d=>({kind:d.kind,path:te(d.rel)}))}}:{},...qR(e),potentiallyReachable:{total:Yt(e.counts),byTier:Object.fromEntries(ys.map(d=>[d,e.counts[d]])),byKind:Object.fromEntries([...o].sort((d,c)=>c[1]-d[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(d=>He(d.tier)&&d.reasonKind==="db-gap").map(d=>({advisory:te(d.displayId),package:te(d.packageName),version:te(d.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(d=>d.adr105!==void 0).map(d=>({advisory:te(d.displayId),package:te(d.packageName),version:te(d.version),symbol:te(d.symbolName??""),tier:d.tier,...d.reasonKind!==void 0?{reasonKind:d.reasonKind}:{},...d.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function vy(){try{let e=QR(nO(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function tO(e,n){let t=`${JSON.stringify(n,null,2)}
+`,s=`${e}.tmp-${Ey(8).toString("hex")}`;Ay(s,t,{encoding:"utf8",flag:"wx"}),ZR(s,e)}async function sO(e){let n=Oh(e);n.legacyGateFlag&&process.stderr.write(`cupel: ${Rh}
+`);let t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",s=t?{path:ly(n.shard),sequence:null}:await ea({offline:n.offline}),r=s.path,i=iy(n.shardPypi);if(i===void 0&&!t)try{i=(await ea({offline:n.offline,ecosystem:"pypi"})).path}catch(d){if(d instanceof $s||d instanceof Xt)process.stderr.write(`cupel: no PyPI shard available (${d.message}); Python distributions, if any, will be reported as not assessed
+`);else throw d}let a=await ay({xGo:n.xGo,shardGo:n.shardGo,dir:n.dir,root:n.root,offline:n.offline,explicitNpm:t}),l=Zd({dir:n.dir,shardPath:r,...i!==void 0?{shardPathPypi:i}:{},...n.xGo?{xGo:!0}:{},...a!==void 0?{shardPathGo:a}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnPotentiallyReachable:n.failOnPotentiallyReachable,entry:n.entry,exclude:n.exclude,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.influenceShadowOut!==void 0?{influenceShadow:{outPath:n.influenceShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},pyPreciseNames:n.pyPreciseNames,...n.xPyNameMatchLabel?{xPyNameMatchLabel:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${Sy(l)}
+`),l.modelLane!==void 0){let d=l.modelLane.notes.length>0?` (${l.modelLane.notes.map(c=>te(c)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(l.modelLane.active)}/${String(l.modelLane.stored)} active, ${String(l.modelLane.promoted)} promoted to reachable-low${d}
+`)}if(n.summaryShadow!==void 0&&l.summaryShadow!==void 0){let d=eO.join(n.summaryShadow,"shadow-report.json");Ay(d,`${JSON.stringify(l.summaryShadow,null,2)}
+`),process.stdout.write(`summary-shadow: ${String(l.summaryShadow.records.length)} counterfactual record(s) -> ${d}
+`)}if(l.modelShadow!==void 0&&n.modelShadowOut!==void 0){let d=l.modelShadow.records.filter(c=>c.wouldPromote).length;process.stdout.write(`model-shadow: ${String(d)}/${String(l.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
+`)}if(l.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(l.bindingShadow.deltas)}/${String(l.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
+`),l.influenceShadow!==void 0&&n.influenceShadowOut!==void 0){let d=l.influenceShadow.byOutcome;process.stderr.write(`influence-shadow: ${String(l.influenceShadow.ports)} port(s) \u2014 ${String(d.influenced)} influenced, ${String(d["no-source-reached"])} no-source-reached, ${String(d["reaches-entry-parameter"])} reaches-entry-parameter, ${String(d.unknown)} unknown (${String(l.influenceShadow.wallMs)} ms) -> ${n.influenceShadowOut}
+`)}if(n.sarif!==void 0&&tO(n.sarif,wy(l)),n.push){let d=await oy(process.env,Zi,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
+`)}),c;try{c=ru(l,{scanId:Ey(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:ou(l),shardSequence:s.sequence},{onCut:p=>process.stderr.write(`cupel: ${Zc(p)}
 `)})}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
-`),await Ml("push-refused",u,d.value,qo),a.exitCode===0?1:a.exitCode}try{await pd(JSON.stringify(l),d.value,qo)}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
-`),await Ml("scan-error",u,d.value,qo),a.exitCode===0?1:a.exitCode}let c=s.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(l.findings.length)} finding(s) to api.cupel.sh (${lm(d)})${c}
-`)}return a.exitCode}async function eE(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Qv(e.slice(1))}catch(t){let s=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${s}
-`),1}if(e[0]==="login")return await Xp(e.slice(1));if(e[0]==="logout")return Yp(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${gl(xm())}
+`),await hc("push-refused",u,d.value,Qi),l.exitCode===0?1:l.exitCode}try{await nu(JSON.stringify(c),d.value,Qi)}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
+`),await hc("scan-error",u,d.value,Qi),l.exitCode===0?1:l.exitCode}let f=s.sequence===null?" \u2014 shard version unverified, shown as unverifiable on the dashboard":"";process.stdout.write(`pushed ${String(c.findings.length)} finding(s) to api.cupel.sh (${ry(d)})${f}
+`)}return l.exitCode}async function rO(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await sO(e.slice(1))}catch(t){let s=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${s}
+`),1}if(e[0]==="login")return await Uh(e.slice(1));if(e[0]==="logout")return Hh(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${ec(vy())}
 `),0):(process.stderr.write(`cupel: unknown command '${te(n)}'
-`),process.stderr.write(`${gl(xm())}
-`),1)}eE().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`),process.stderr.write(`${ec(vy())}
+`),1)}rO().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});