@cupel-sh/cli 0.11.0 → 0.12.0

package/bundle/cli.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-var oe={"extract.py":`None
+var se={"extract.py":`None
 
 import ast
 import builtins
@@ -3092,76 +3092,91 @@ def main(argv):
 
 if __name__ == "__main__":
     sys.exit(main(sys.argv))
-`};import{randomBytes as Zh}from"node:crypto";import{readFileSync as $A,renameSync as LA,writeFileSync as Qh}from"node:fs";import DA from"node:path";import{fileURLToPath as FA}from"node:url";var tg=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Ni(e){let n=0;for(;n<e.length-1&&e.charCodeAt(n)===48;)n+=1;return e.slice(n)}function sg(e){let n=Mi(e,!1);if(n!==null)return{kind:"npm",...n};let t=tg.exec(e);return t===null?null:{kind:"npm",major:Ni(t[1]??""),minor:Ni(t[2]??""),patch:Ni(t[3]??""),prerelease:"",build:""}}var og=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,rg={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function Rs(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function ig(e){let n=og.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,s=(t.release??"").split(".");if(s.length===0||s.length>32)return null;let o=[];for(let c of s){let p=Rs(c);if(p===null)return null;o.push(p)}let r=0;if(t.epoch!==void 0){let c=Rs(t.epoch);if(c===null)return null;r=c}let i=null;if(t.preL!==void 0){let c=t.preN===void 0?0:Rs(t.preN);if(c===null)return null;i=[rg[t.preL]??t.preL,c]}let a=null;if(t.postImplicit!==void 0){let c=Rs(t.postImplicit);if(c===null)return null;a=c}else if(t.postL!==void 0){let c=t.postN===void 0?0:Rs(t.postN);if(c===null)return null;a=c}let l=null;if(t.devL!==void 0){let c=t.devN===void 0?0:Rs(t.devN);if(c===null)return null;l=c}let d=t.local===void 0?null:t.local.split(/[-_.]/u).map(c=>/^[0-9]+$/u.test(c)?Number(c):c);return{kind:"PyPI",epoch:r,release:o,pre:i,post:a,dev:l,local:d}}function Os(e,n){return e===n?0:e<n?-1:1}function Md(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function ag(e,n){let t=Md(e),s=Md(n),o=Math.max(t.length,s.length);for(let r=0;r<o;r+=1){let i=Os(t[r]??0,s[r]??0);if(i!==0)return i}return 0}function Td(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function lg(e,n){let t=Td(e),s=Td(n);return t!==s?t<s?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:Os(e.pre[1],n.pre[1])}function dg(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:Os(e,n)}function cg(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:Os(e,n)}function ug(e,n){let t=typeof e=="number",s=typeof n=="number";return t&&s?Os(e,n):!t&&!s?e===n?0:e<n?-1:1:t?1:-1}function fg(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let s=0;s<t;s+=1){let o=e[s],r=n[s];if(o===void 0)return-1;if(r===void 0)return 1;let i=ug(o,r);if(i!==0)return i}return 0}function pg(e,n){let t=Os(e.epoch,n.epoch);if(t!==0)return t;let s=ag(e.release,n.release);if(s!==0)return s;let o=lg(e,n);if(o!==0)return o;let r=dg(e.post,n.post);if(r!==0)return r;let i=cg(e.dev,n.dev);return i!==0?i:fg(e.local,n.local)}var lr=46;function Pi(e,n){let t=e.charCodeAt(n);return t>=48&&t<=57}function Dd(e,n){let t=e.charCodeAt(n);return t>=48&&t<=57||t>=65&&t<=90||t>=97&&t<=122||t===45}function Ci(e){for(let n=0;n<e.length;n+=1)if(!Pi(e,n))return!1;return!0}function $d(e){return e.length>1&&e.startsWith("0")&&Ci(e)}function Ii(e){if(e.length===0||!Pi(e,0))return null;let n=1;for(;n<e.length&&Pi(e,n);)n+=1;return e.startsWith("0")&&n!==1?null:[e.slice(0,n),e.slice(n)]}function mg(e){if(!e.startsWith("-"))return null;let n=1,t=1;for(;n<e.length&&e[n]!=="+";){if(!Dd(e,n)&&e.charCodeAt(n)!==lr)return null;if(e.charCodeAt(n)===lr){if(t===n||$d(e.slice(t,n)))return null;t=n+1}n+=1}return t===n||$d(e.slice(t,n))?null:[e.slice(0,n),e.slice(n)]}function hg(e){if(!e.startsWith("+"))return null;let n=1,t=1;for(;n<e.length;){if(!Dd(e,n)&&e.charCodeAt(n)!==lr)return null;if(e.charCodeAt(n)===lr){if(t===n)return null;t=n+1}n+=1}return t===n?null:[e.slice(0,n),e.slice(n)]}function Mi(e,n){let t=Ii(e);if(t===null)return null;let[s,o]=t;if(o==="")return n?{major:s,minor:"0",patch:"0",prerelease:"",build:""}:null;if(!o.startsWith("."))return null;let r=Ii(o.slice(1));if(r===null)return null;let[i,a]=r;if(a==="")return n?{major:s,minor:i,patch:"0",prerelease:"",build:""}:null;if(!a.startsWith("."))return null;let l=Ii(a.slice(1));if(l===null)return null;let[d,c]=l,p=c,u="",f="";if(p.startsWith("-")){let m=mg(p);if(m===null)return null;[u,p]=m}if(p.startsWith("+")){let m=hg(p);if(m===null)return null;[f,p]=m}return p!==""?null:{major:s,minor:i,patch:d,prerelease:u,build:f}}function gg(e){let n=Mi(e.startsWith("v")?e.slice(1):e,!0);return n===null?null:{kind:"Go",...n}}function yg(e){let n=Mi(e,!1);return n===null?null:{kind:"crates.io",...n}}function Ri(e,n){return e===n?0:e.length!==n.length?e.length<n.length?-1:1:e<n?-1:1}function Ld(e){let n=e.indexOf(".");return n<0?[e,""]:[e.slice(0,n),e.slice(n)]}function _g(e,n){if(e===n)return 0;if(e==="")return 1;if(n==="")return-1;let t=e,s=n;for(;t!==""&&s!=="";){let[o,r]=Ld(t.slice(1)),[i,a]=Ld(s.slice(1));if(t=r,s=a,o!==i){let l=Ci(o),d=Ci(i);return l!==d?l?-1:1:l&&o.length!==i.length?o.length<i.length?-1:1:o<i?-1:1}}return t===""?-1:1}function Oi(e,n){return Ri(e.major,n.major)||Ri(e.minor,n.minor)||Ri(e.patch,n.patch)||_g(e.prerelease,n.prerelease)}function bg(e,n){return e==="npm"?sg(n):e==="PyPI"?ig(n):e==="crates.io"?yg(n):gg(n)}function Sg(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=bg(e,n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function ao(e,n){let t=Sg(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function ar(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return Oi(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return pg(e.parsed,n.parsed);if(e.parsed.kind==="Go"&&n.parsed.kind==="Go"||e.parsed.kind==="crates.io"&&n.parsed.kind==="crates.io")return Oi(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function Fd(e,n,t){let s=ao(e,n);return!(t.introduced!=="0"&&ar(s,ao(e,t.introduced))<0||t.fixed!==void 0&&ar(s,ao(e,t.fixed))>=0||t.lastAffected!==void 0&&ar(s,ao(e,t.lastAffected))>0)}var Ti=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Rt(e,n){return Fd(n.ecosystem??"npm",e,n)}function dr(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),o=new Map(e.classes.map(a=>[a.id,a.name])),r=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let l=r.get(a.callSiteId);if(l===void 0)continue;let d=s.get(l.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let c=n.get(d.moduleId);if(c===void 0)continue;let p=s.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&i.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:a.resolution})}return i}function xg(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,s)=>t.analyzedVersion<s.analyzedVersion?1:t.analyzedVersion>s.analyzedVersion?-1:0)}function kg(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function jd(e,n,t,s,o,r){if(r<=0)return null;let i=null,a=l=>{(i===null||l.hops<i.hops)&&(i=l)};for(let l of xg(e,n))for(let d of l.edges){if(d.entryExport!==t||d.entryContainer!==s)continue;if(kg(d,o,l.packageName)){a({viaPackages:[],hops:d.hops,provenance:{tool:l.tool,toolVersion:l.toolVersion,analyzedVersion:l.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let c=jd(e,d.target.calleePackage,d.target.calleeExport,null,o,r-1);c!==null&&a({viaPackages:[d.target.calleePackage,...c.viaPackages],hops:d.hops+c.hops,provenance:c.provenance})}return i}function $i(e,n,t,s,o,r){let i=null;for(let a of dr(e,n,t)){let l=jd(o,a.packageName,a.exportName,a.container,s,r);l!==null&&(i===null||l.hops<i.totalHops)&&(i={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:l.viaPackages,totalHops:l.hops,provenance:l.provenance})}return i}function cr(e,n){let{args:t,convention:s}=e,o=n.params;if(t===void 0||s===void 0||o===void 0)return{known:!1,reason:"not-emitted"};if(s==="unknown")return{known:!1,reason:"convention"};if(n.reflectiveArguments===!0)return{known:!1,reason:"reflective-arguments"};if(s==="shifted"&&t[0]?.spread!==void 0&&t[0].spread!==!1)return{known:!1,reason:"convention"};let r=s==="shifted"?t.slice(1):t,i=[...o].sort((S,b)=>S.index-b.index),a=i.filter(S=>S.kind==="positional"),l=i.find(S=>S.kind==="rest"),d=i.find(S=>S.kind==="keyword-rest"),c=new Map,p=(S,b)=>{let k=c.get(S);k!=="unknown"&&c.set(S,[...k??[],b])},u=S=>{S!==void 0&&c.set(S,"unknown")},f=[],m=0,h=!1,y=!1;for(let S of r){if(S.spread==="positional"){h=!0;for(let k of a.slice(m))u(k);u(l);continue}if(S.spread==="keyword"){y=!0;for(let k of i)(k.kind==="positional"||k.kind==="keyword-only")&&!c.has(k)&&u(k);u(d);continue}if(S.keyword!==void 0){let k=i.find(w=>w.name===S.keyword&&(w.kind==="positional"||w.kind==="keyword-only"));k!==void 0?c.has(k)?u(k):p(k,S.index):d!==void 0?p(d,S.index):f.push(S.index);continue}if(h){for(let k of a.slice(m))u(k);u(l);continue}let b=a[m];b!==void 0?p(b,S.index):l!==void 0?p(l,S.index):f.push(S.index),m+=1}return{known:!0,params:i.map(S=>{let b=c.get(S);return b==="unknown"?{kind:"unknown"}:b!==void 0?{kind:"args",argIndexes:b}:y&&(S.kind==="positional"||S.kind==="keyword-only")?{kind:"unknown"}:S.kind==="rest"||S.kind==="keyword-rest"?{kind:"args",argIndexes:[]}:{kind:"absent"}}),receiver:wg(e,n),unbound:f}}function wg(e,n){if(n.receiver===void 0)return"unknown";if(n.receiver!=="call")return"none";switch(e.convention){case"construct":return"fresh";case"shifted":return(e.args?.length??0)>0?"first-argument":"none";case"direct":return e.receiverRange!==void 0?"receiver-expression":"none";default:return"unknown"}}var Li=["builtin-call","host-lib-call","primitive-mutation","dependency-boundary","app-unresolved","untyped-call","dependency-callee","app-callee","module-binding","global","free-name","construct","opaque","unregistered-entry","binding","not-emitted","analysis-cap"],Bd=2e4,vg=4,Jn=(e,n)=>`${String(e)}-${String(n)}`,ur=e=>{switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${Jn(e.at,e.end)}`;case"argument":return`a${Jn(e.at,e.end)}:${String(e.index)}`;case"call-receiver":return`r${Jn(e.at,e.end)}`;case"mutated-by-call":return`m${Jn(e.at,e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"shared":return`h${String(e.id)}`;default:return e.kind}};function Eg(e){if(e.kind==="entry-parameter")return"unregistered-entry";if(e.kind==="unknown")switch(e.reason){case"binding":return"binding";case"not-emitted":return"not-emitted";case"analysis-cap":return"analysis-cap";case"opaque":return e.detail==="construct"?"construct":"opaque";default:return}}function Ps(e){let n=new Map(e.functions.map(c=>[c.id,c])),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map;for(let c of e.functions){if(c.valueFlows===void 0)continue;let p=new Map;for(let u of c.valueFlows){let f=ur(u.to),m=p.get(f);m===void 0?p.set(f,[u]):m.push(u)}s.set(c.id,p)}let o=new Map,r=new Map,i=0;for(let c of e.callSites){let p=`${c.range.path}\0${Jn(c.range.start,c.range.end)}`;o.has(p)&&(i+=1),o.set(p,c),r.set(c.id,c)}let a=new Map,l=new Map,d=(c,p,u)=>{let f=c.get(p)??[];f.includes(u)||f.push(u),c.set(p,f)};for(let c of e.callEdges){let p=r.get(c.callSiteId);if(p===void 0)continue;let u=c.invocation==="direct";u&&d(a,p.id,c.calleeFunctionId);let f=l.get(c.calleeFunctionId)??[],m=f.find(h=>h.site===p);m===void 0?f.push({site:p,direct:u}):u&&(m.direct=!0),l.set(c.calleeFunctionId,f)}return{functions:n,modules:t,into:s,siteAt:o,identityCollisions:i,callees:a,callers:l}}function Ag(e,n){let{args:t,convention:s}=e;if(t===void 0||s===void 0||s!=="direct"&&s!=="construct")return"unknown";for(let o=0;o<=n&&o<t.length;o+=1){let r=t[o];if(r===void 0||r.spread!==!1||r.keyword!==void 0)return"unknown"}return n<t.length?n:"absent"}var Gd=e=>[...e.params??[]].sort((n,t)=>n.index-t.index);function Ng(e,n,t){if(n===-1)return e.receiver==="receiver-expression"?{kind:"receiver"}:e.receiver==="unknown"?"unknown":null;if(e.receiver==="first-argument"&&n===0)return{kind:"receiver"};let s=e.params.findIndex(o=>o.kind==="args"&&o.argIndexes.includes(n));if(s>=0){let o=Gd(t)[s];return o!==void 0?{kind:"param",index:o.index}:"unknown"}return e.unbound.includes(n)?null:"unknown"}function lo(e,n){let t=new Map,s=v=>{let I=v.class??Eg(v),A=v.site===void 0?"":`${v.site.path}:${String(v.site.start)}-${String(v.site.end)}`;t.set(`${v.kind}|${v.functionId}|${v.reason??""}|${v.detail??""}|${A}|${v.via??""}`,I===void 0?v:{...v,class:I})},o=new Map,r=v=>{o.set(`${v.site.path}:${String(v.site.start)}-${String(v.site.end)}|${v.reason}`,v)},i=(v,I)=>{if(I.kind==="receiver")return v.receiverPrimitive===!0;let A=v.args??[];return I.kind==="arg"?A[I.index]?.primitive===!0:A.slice(I.index).every(B=>B.primitive===!0)},a=(v,I,A,B)=>{let O=I.range.start,V=I.range.end,E=Jn(O,V),D=I.args,L=D!==void 0&&D.every(Z=>Z.spread===!1&&Z.keyword===void 0),K=D!==void 0&&!L&&D.every(Z=>Z.spread===!1)&&D.some(Z=>Z.keyword!==void 0),Y=K?D.findIndex(Z=>Z.keyword!==void 0):Number.POSITIVE_INFINITY,le=(Z,de)=>de===-1?Z.kind==="receiver":de<Y?Z.kind==="arg"&&Z.index===de||Z.kind==="args-from"&&de>=Z.index:Z.kind==="args-from"||Z.kind==="arg"&&Z.index>=Y,z=B.kind==="call-result"?A.result:A.mutates.filter(Z=>le(Z.into,B.index)).flatMap(Z=>Z.from);for(let Z of z){if(Z.kind==="receiver"){I.receiverRange!==void 0&&y({fn:v.fn,ref:{kind:"call-receiver",at:O,end:V},stack:v.stack,tracing:E});continue}if(D===void 0||!L&&!K){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:"summary input",site:I.range});continue}let[de,x]=Z.kind==="arg"&&Z.index<Y?[Z.index,Math.min(Z.index+1,D.length)]:[Math.min(Z.index,Y),D.length];for(let M=de;M<x;M+=1)y({fn:v.fn,ref:{kind:"argument",at:O,end:V,index:M},stack:v.stack,tracing:E})}A.reviewed!==!0&&r({site:I.range,id:A.id,reason:"unreviewed-summary"}),(A.callsProgram??[]).some(Z=>!i(I,Z))&&r({site:I.range,id:A.id,reason:"calls-program"})},l=(v,I,A,B)=>{if(I.kind==="mutated-by-call"&&I.index>=0&&v.args?.[I.index]?.primitive===!0)return"primitive-mutation";if(A!==null){let O=e.modules.get(A.moduleId),V=e.modules.get(B.moduleId);return O===void 0?"not-emitted":O.externalSurface===!0||O.packageName!==V?.packageName?"dependency-callee":"app-callee"}switch(v.calleeDecl){case"ecmascript":case"runtime":return"builtin-call";case"host-lib":return"host-lib-call";case"dependency":return"dependency-boundary";case"app":return"app-unresolved";default:return"untyped-call"}},d=new Set,c=[],p=new Map,u=null,f,m=v=>`${v.fn}\0${ur(v.ref)}\0${v.stack.map(I=>I.id).join(",")}\0${String(v.tracing??"")}`,h=v=>{if(f!==void 0)return;let I=[{functionId:v.fn,ref:v.ref}];for(let A=u;A!==null;){let B=p.get(A);if(B===void 0)break;I.push({functionId:B.state.fn,ref:B.state.ref}),A=B.key}f=I},y=v=>{let I=m(v);d.has(I)||(d.add(I),p.set(I,{key:u,state:v}),c.push(v))},_=n.site.enclosingFunctionId,S=n.site.range.start,b=n.site.range.end;if(n.port.kind==="receiver")y({fn:_,ref:{kind:"call-receiver",at:S,end:b},stack:[],tracing:Jn(S,b)});else{let v=Ag(n.site,n.port.index);v==="unknown"?s({kind:"unknown",functionId:_,reason:"binding"}):v==="absent"?s({kind:"constant",functionId:_,detail:"no argument"}):y({fn:_,ref:{kind:"argument",at:S,end:b,index:v},stack:[],tracing:Jn(S,b)})}let k=0;for(;c.length>0;){if(k+=1,k>Bd){s({kind:"unknown",functionId:_,reason:"analysis-cap"});break}let v=c.pop();u=m(v);let I=e.into.get(v.fn),A=e.functions.get(v.fn);if(I===void 0||A===void 0){s({kind:"unknown",functionId:v.fn,reason:"not-emitted"});continue}let B=I.get(ur(v.ref));if(B!==void 0&&B.length>0){for(let V of B)v.tracing!==void 0&&V.from.kind==="mutated-by-call"&&Jn(V.from.at,V.from.end)===v.tracing&&e.siteAt.get(`${A.declRange.path}\0${v.tracing}`)?.repeats===!1||y({...v,ref:V.from});if(v.ref.kind!=="param"&&v.ref.kind!=="receiver"&&v.ref.kind!=="call-result"&&v.ref.kind!=="mutated-by-call"&&v.ref.kind!=="free")continue}let O=v.ref;switch(O.kind){case"constant":s({kind:"constant",functionId:v.fn});break;case"opaque":s({kind:"unknown",functionId:v.fn,reason:"opaque",detail:O.reason});break;case"source":s({kind:"source",functionId:v.fn,sourceClass:O.sourceClass,model:O.model}),h(v);break;case"free":s({kind:"unknown",functionId:v.fn,reason:"free",detail:O.name,class:O.binding==="module"?"module-binding":O.binding==="global"?"global":"free-name"});break;case"local":case"return":(B===void 0||B.length===0)&&s({kind:"constant",functionId:v.fn,detail:"undefined"});break;case"param":case"receiver":{let V=O.kind==="param"?A.sourceParams?.find(Y=>Y.index===O.index):void 0;V!==void 0&&(s({kind:"source",functionId:v.fn,sourceClass:V.sourceClass,model:V.model}),h(v));let E=v.stack[v.stack.length-1],D=E!==void 0?[{site:E,direct:!0}]:e.callers.get(v.fn)??[],L=V!==void 0?D.filter(Y=>Y.direct&&Y.site.args!==void 0):D;if(V!==void 0&&L.length===0)break;let K=E!==void 0?v.stack.slice(0,-1):[];if(L.length===0){s({kind:"entry-parameter",functionId:v.fn,detail:O.kind==="param"?`param ${String(O.index)}`:"receiver"});break}for(let{site:Y,direct:le}of L){if(!le){s({kind:"unknown",functionId:Y.enclosingFunctionId,reason:"binding",detail:"callback"});continue}let z=cr(Y,A);if(!z.known){s({kind:"unknown",functionId:Y.enclosingFunctionId,reason:"binding",detail:z.reason});continue}let Z=Y.range.start,de=Y.range.end,x=Jn(Z,de),M=Y.enclosingFunctionId;if(O.kind==="receiver"){z.receiver==="receiver-expression"?y({fn:M,ref:{kind:"call-receiver",at:Z,end:de},stack:K,tracing:x}):z.receiver==="first-argument"?y({fn:M,ref:{kind:"argument",at:Z,end:de,index:0},stack:K,tracing:x}):z.receiver==="none"?s({kind:"constant",functionId:M,detail:"no receiver"}):s({kind:"unknown",functionId:M,reason:"binding",detail:`receiver ${z.receiver}`});continue}let X=Gd(A).findIndex(q=>q.index===O.index),W=z.params[X];if(W===void 0||W.kind==="unknown")s({kind:"unknown",functionId:M,reason:"binding"});else if(W.kind==="absent")(B===void 0||B.length===0)&&s({kind:"constant",functionId:v.fn,detail:"no argument"});else for(let q of W.argIndexes)y({fn:M,ref:{kind:"argument",at:Z,end:de,index:q},stack:K,tracing:x})}break}case"call-result":case"mutated-by-call":{let V=e.siteAt.get(`${A.declRange.path}\0${Jn(O.at,O.end)}`);if(V===void 0){s({kind:"unknown",functionId:v.fn,reason:"unresolved-call",detail:"no call site at offset",class:"not-emitted"});break}let E=e.callees.get(V.id)??[];if(E.length===0&&V.summary!==void 0){a(v,V,V.summary,O);break}if(E.length===0){s({kind:"unknown",functionId:v.fn,reason:"unresolved-call",...V.runtimeId!==void 0?{detail:V.runtimeId}:{},site:V.range,via:O.kind==="call-result"?"result":"mutation",class:l(V,O,null,A)});break}let D=v.stack.length>=vg?[]:[...v.stack,V];for(let L of E){let K=e.functions.get(L);if(K===void 0||!e.into.has(L)){s({kind:"unknown",functionId:v.fn,reason:"opaque-callee",detail:L,site:V.range,via:O.kind==="call-result"?"result":"mutation",class:K===void 0?"not-emitted":l(V,O,K,A)});continue}if(O.kind==="call-result"){y({fn:L,ref:{kind:"return"},stack:D});continue}let Y=cr(V,K);if(!Y.known){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:Y.reason});continue}let le=Ng(Y,O.index,K);if(le==="unknown"){s({kind:"unknown",functionId:v.fn,reason:"binding",detail:"mutation target",site:V.range});continue}if(le===null)continue;let z=(e.into.get(L)?.get(ur(le))??[]).filter(Z=>Z.kind==="field"||Z.kind==="mutation");for(let Z of z)y({fn:L,ref:Z.from,stack:D})}break}case"argument":case"call-receiver":(B===void 0||B.length===0)&&s({kind:"unknown",functionId:v.fn,reason:"not-emitted",detail:"no flow into the argument"});break}}let w=[...t.values()],N=[...o.values()];return{outcome:w.some(v=>v.kind==="source")?"influenced":w.some(v=>v.kind==="unknown")||N.length>0?"unknown":w.some(v=>v.kind==="entry-parameter")?"reaches-entry-parameter":"no-source-reached",leaves:w,caveats:N,visited:d.size,...f!==void 0?{witness:f}:{}}}var co={"no-contract":"cupel","no-source-model":"cupel","control-influence-unsupported":"cupel","analysis-cap":"cupel"};function Di(e){if(Fi.includes(e))return{value:"unknown",kind:"no-contract"}}function uo(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Cs(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function fr(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let o=t.get(s.importId);if(o===void 0)continue;let r=n.get(o.moduleId)??[];r.push(s.resolvedModuleId),n.set(o.moduleId,r)}return n}function Ig(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let o=t.get(s.importId);if(o===void 0)continue;let r=n.get(s.resolvedModuleId)??[];r.push(o.moduleId),n.set(s.resolvedModuleId,r)}return n}function Zn(e){let n=fr(e),t=new Set,s=e.modules.filter(o=>o.isEntrypoint).map(o=>o.id);for(;s.length>0;){let o=s.pop();if(!(o===void 0||t.has(o))){t.add(o);for(let r of n.get(o)??[])t.has(r)||s.push(r)}}return t}function Rg(e,n){let t=Ig(e),s=new Set,o=[n];for(;o.length>0;){let r=o.pop();if(!(r===void 0||s.has(r))){s.add(r);for(let i of t.get(r)??[])s.has(i)||o.push(i)}}return s}function Og(e,n,t){let s=fr(e),o=Cs(e),r=new Set,i=[n];for(;i.length>0;){let a=i.pop();if(a===void 0||r.has(a))continue;r.add(a);let l=o.get(a);if(l===void 0||l.externalSurface===!0||t.has(a))return!0;for(let d of s.get(a)??[])r.has(d)||i.push(d)}return!1}function fo(e,n,t,s=new Set){let o=fr(e),r=Cs(e),i=new Set,a=[],l=[n];for(;l.length>0;){let d=l.pop();if(d===void 0||i.has(d))continue;i.add(d);let c=r.get(d);if(c===void 0){a.push({module:d,kind:"absent"});continue}if(t.has(d)){a.push({module:d,kind:"unbounded"});continue}if(c.externalSurface===!0&&!s.has(d)){a.push({module:d,kind:"surface"});continue}for(let p of o.get(d)??[])i.has(p)||l.push(p)}return a}function Wd(e){let n=new Set(e.modules.filter(i=>i.isEntrypoint).map(i=>i.id)),t=new Map(e.functions.map(i=>[i.id,i])),s=Cs(e),o=new Map;for(let i of e.functions)n.has(i.moduleId)&&(i.publicSurfaceReachable||i.name==="<toplevel>")&&o.set(i.id,i);let r=new Map(e.exports.map(i=>[i.id,i]));for(let i of e.exportBindings){if(i.target.kind!=="function")continue;let a=r.get(i.exportId);if(a===void 0||!n.has(a.moduleId))continue;let l=t.get(i.target.functionId);l===void 0||s.get(l.moduleId)?.externalSurface===!0||o.set(l.id,l)}return[...o.values()]}function ji(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let o=e.slice(t+n.length).split("/"),r=o[0]?.startsWith("@")===!0?2:1;return o.slice(r).join("/")}function Pg(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let s=t.symbolKind==="method"||t.symbolKind==="ctor",o=new Map(e.classes.map(r=>[r.id,r]));return e.functions.find(r=>{if(r.name!==t.exportName)return!1;let i=n.get(r.moduleId);if(i===void 0||i.packageName!==t.packageName)return!1;if(s){if(r.kind!==t.symbolKind||r.enclosingClassId===void 0||o.get(r.enclosingClassId)?.name!==t.container)return!1}else if(r.kind!=="function"&&r.kind!=="class")return!1;return i.externalSurface===!0?!0:ji(i.path)===t.sourcePath})}function Kd(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&ji(t.path)===n.sourcePath)}function Cg(e,n,t){if(!(t.symbolKind!=="function"||t.container!==null))for(let s of e.classes){if(s.name!==t.exportName)continue;let o=n.get(s.moduleId);if(o!==void 0&&o.externalSurface!==!0&&o.packageName===t.packageName&&ji(o.path)===t.sourcePath)return o}}function Mg(e,n,t,s){let o=new Map(e.functions.map(r=>[r.id,r]));return e.callSites.some(r=>r.calleeExprShape!=="member"||r.resolution!=="resolved"?!1:r.resolvedTargetIds.some(i=>{let a=o.get(i);if(a?.name!==s.exportName)return!1;let l=n.get(a.moduleId);return l?.externalSurface===!0&&l.packageName===s.packageName&&t.has(a.moduleId)}))}function Tg(e,n,t){return t.container===null?!0:e.classes.some(s=>{if(s.name!==t.container)return!1;let o=n.get(s.moduleId);return o!==void 0&&o.packageName===t.packageName&&o.externalSurface!==!0})}function $g(e,n,t){let s=new Map(e.callSites.map(l=>[l.id,l.enclosingFunctionId])),o=new Map;for(let l of e.callEdges){let d=s.get(l.callSiteId);if(d===void 0)continue;let c=o.get(d)??[];c.push({to:l.calleeFunctionId,res:l.resolution,site:l.callSiteId}),o.set(d,c)}let r=l=>{let d=new Set,c=n.map(p=>({id:p.id,prev:null,via:null}));for(let p of c)d.add(p.id);for(;c.length>0;){let p=c.shift();if(p===void 0)break;if(p.id===t){let u=[],f=[];for(let m=p;m!==null;m=m.prev)u.unshift(m.id),f.unshift(m.via);return{path:u,via:f}}for(let u of o.get(p.id)??[])u.res!=="unresolved"&&(u.res==="field-based"&&!l||d.has(u.to)||(d.add(u.to),c.push({id:u.to,prev:p,via:u.site})))}return null},i=r(!1);if(i!==null)return{...i,usedFieldBased:!1};let a=r(!0);return a!==null?{...a,usedFieldBased:!0}:null}function Bi(e,n,t){let s=new Map(e.callSites.map(y=>[y.id,y.enclosingFunctionId])),o=new Map,r=new Map,i=[],a=(y,_,S)=>{let b=y.get(_);b===void 0?y.set(_,[S]):b.push(S)};for(let y of e.callEdges){if(y.resolution==="unresolved"||y.resolution==="field-based"&&!t)continue;let _=s.get(y.callSiteId);if(_===void 0)continue;let S=y.calleeFunctionId;a(o,_,S),a(r,S,_),i.push({from:_,to:S,site:y.callSiteId})}let l=new Set,d=Wd(e).map(y=>y.id);for(let y of d)l.add(y);for(let y=0;y<d.length;y+=1)for(let _ of o.get(d[y])??[])l.has(_)||(l.add(_),d.push(_));if(!l.has(n))return null;let c=new Map([[n,0]]),p=[n];for(let y=0;y<p.length;y+=1){let _=p[y],S=(c.get(_)??0)+1;for(let b of r.get(_)??[])c.has(b)||!l.has(b)||(c.set(b,S),p.push(b))}let u=(y,_)=>y<_?-1:y>_?1:0,f=[...c].map(([y,_])=>({functionId:y,distance:_})).sort((y,_)=>y.distance-_.distance||u(y.functionId,_.functionId)),m=new Set,h=i.filter(y=>c.has(y.from)&&c.has(y.to)).filter(y=>{let _=JSON.stringify([y.from,y.to,y.site]);return m.has(_)?!1:(m.add(_),!0)}).sort((y,_)=>u(y.from,_.from)||u(y.to,_.to)||u(y.site,_.site));return{functions:f,edges:h}}function zd(e,n){let t=new Set,s=[...e];for(let o=s.pop();o!==void 0;o=s.pop())if(!t.has(o)){t.add(o);for(let r of n(o)??[])t.has(r)||s.push(r)}return t}var Ud=new WeakMap;function Lg(e,n){let t=Ud.get(n);if(t!==void 0&&t.graph===e)return t.reach;let s=Zn(e),o=n.filter(i=>i.reach.kind==="dependency-dispatch"&&s.has(i.source)).map(i=>i.source),r=new Set;if(o.length>0){let i=fr(e),a=zd(o,p=>i.get(p)),l=e.functions.filter(p=>s.has(p.moduleId)&&(a.has(p.moduleId)||p.addressTaken!==!1)).map(p=>p.id),d=new Map(e.callSites.map(p=>[p.id,p.enclosingFunctionId])),c=new Map;for(let p of e.callEdges){if(p.resolution==="unresolved")continue;let u=d.get(p.callSiteId);if(u===void 0)continue;let f=c.get(u);f===void 0?c.set(u,[p.calleeFunctionId]):f.push(p.calleeFunctionId)}r=zd(l,p=>c.get(p))}return Ud.set(n,{graph:e,reach:r}),r}function Gi(e){return Hd(e,Cs(e),Zn(e),qd(e))}function Hd(e,n,t,s){let o=[],r=[],i=new Map(e.functions.map(l=>[l.id,l.moduleId])),a=l=>l!==void 0&&t.has(l)&&s.has(n.get(l)?.packageName??"");for(let l of e.callSites)l.resolution==="unresolved"&&a(i.get(l.enclosingFunctionId))&&o.push(l.range);for(let l of e.imports)!l.specifierIsLiteral&&t.has(l.moduleId)&&r.push({path:n.get(l.moduleId)?.path??"",start:0,end:0});return{dispatch:o,load:r}}function qd(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function Dg(e,n,t){let s=new Map(e.functions.map(i=>[i.id,i])),o=Cs(e),r=new Map(e.callSites.map(i=>[i.id,i]));return n.map((i,a)=>{let l=s.get(i),d=l!==void 0?o.get(l.moduleId):void 0,c=t[a];return{functionId:i,functionName:l?.name,modulePath:d?.path??"",calledAt:c==null?null:r.get(c)?.range??null}})}function Ki(e){return Fg(jg(e))}function Fg(e){if(He(e.tier)!==(e.reasonKind!==void 0))throw new Error(`engine invariant: tier ${e.tier} with reasonKind ${String(e.reasonKind)} (a reason kind is set iff the tier is Potentially reachable)`);if(e.reasonKind!==void 0&&mt[e.reasonKind]!==e.tier)throw new Error(`engine invariant: reasonKind ${e.reasonKind} belongs in ${mt[e.reasonKind]}, not ${e.tier}`);return e}function jg(e){let{graph:n,installed:t,range:s,symbol:o,coverage:r}=e,i=[],a={unresolvedSites:i,unresolvedEvidence:{own:i,sets:[]}},l=z=>({unresolvedSites:z,unresolvedEvidence:{own:z,sets:[]}}),d=qd(n),c=new Set;for(let z of e.incompleteness)z.reach.kind==="unbounded"&&c.add(z.source);let p=e.incompleteness.some(z=>z.reach.kind==="assumed-bounded")?"loader-assumption":"complete",u=z=>z==="not-reachable"?p:void 0,f=void 0,m=new Map,h=z=>{let Z=m.get(z);return Z===void 0&&(Z=Og(n,z,c),m.set(z,Z)),Z},y=z=>z.reach.kind==="class-scope"&&o!==null&&o.packageName===z.reach.packageName&&o.container===z.reach.container,_=z=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let Z of Ti)for(let de of e.incompleteness)if(de.cause===Z&&z(de))return{cause:de.cause,source:de.source};return null},S=(z,Z)=>{let de;return _(x=>x.reach.kind==="unbounded"?!0:x.reach.kind==="class-scope"?y(x):x.reach.kind==="dependency-dispatch"?Z===void 0||Lg(n,e.incompleteness).has(Z):x.reach.kind==="loaded-package"?(s.ecosystem??"npm")===x.reach.ecosystem:z===void 0||h(x.reach.anchor)?!0:(de??=Rg(n,z),de.has(x.reach.anchor)))},b=()=>_(z=>z.reach.kind==="unbounded"?!0:z.reach.kind==="class-scope"?y(z):z.reach.kind==="dependency-dispatch"?!1:z.reach.kind==="loaded-package"?(s.ecosystem??"npm")===z.reach.ecosystem&&(z.reach.alsoLoaded?.includes(s.packageName)??!1):h(z.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${s.packageName} is not installed`,reasonKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let k;try{if((t.ecosystem??"npm")!==(s.ecosystem??"npm"))throw new Error("ecosystem mismatch");k=Rt(t.version,s)}catch{return{tier:Te("version-undecidable"),decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,reasonKind:"version-undecidable",attribution:void 0,basis:f,path:void 0,...a}}if(!k)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${s.packageName}@${t.version} is outside the affected range`,reasonKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,...a};let w=Cs(n),N=Zn(n),R=z=>{if(z.cause!=="dynamic-load"||z.source===null)return i;let Z=w.get(z.source);return Z===void 0?i:[{path:Z.path,start:0,end:0}]},{dispatch:v,load:I}=Hd(n,w,N,d),A=[...v,...I],B={unresolvedSites:I,unresolvedEvidence:{own:i,sets:["load"]}},O={unresolvedSites:A,unresolvedEvidence:{own:i,sets:["dispatch","load"]}},V=z=>{for(let Z of N)if(w.get(Z)?.packageName===z)return!0;return!1},E=z=>({tier:Te("incomplete-surface"),decidedAtStage:z,reason:`${o?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,reasonKind:"incomplete-surface",attribution:void 0,basis:f,path:void 0,...a}),D=()=>{if(!V(s.packageName)){if(I.length>0)return{tier:Te("dynamic-load"),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,reasonKind:"dynamic-load",attribution:void 0,basis:f,path:void 0,...B};let z=b();return z!==null?{tier:Te(z.cause),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,reasonKind:z.cause,attribution:void 0,basis:f,path:void 0,...l(R(z))}:t!==null&&t.outOfGraphExecution.length>0?{tier:Te("analysis-cap"),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,reasonKind:"analysis-cap",attribution:void 0,basis:f,path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${s.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${s.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,reasonKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}}return null};if(o===null||!o.verified)return{tier:Te(o===null?"db-gap":"unverified-symbol"),decidedAtStage:"symbol-reachable",reason:o===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",reasonKind:o===null?"db-gap":"unverified-symbol",attribution:void 0,basis:f,path:void 0,...O};if(r!==null&&!r.comparedPaths.has(o.sourcePath))return{tier:Te("db-gap"),decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${o.sourcePath}; symbol reachability undetermined`,reasonKind:"db-gap",attribution:void 0,basis:f,path:void 0,...O};if(o.symbolKind==="accessor"||o.symbolKind==="pattern")return{tier:Te("symbol-unsupported"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a ${o.symbolKind} symbol; call-graph reachability is not evaluated`,reasonKind:"symbol-unsupported",attribution:void 0,basis:f,path:void 0,...O};let L=Pg(n,w,o);if(L===void 0||!N.has(L.moduleId)){if(L===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&Mg(n,w,N,o))return{tier:Te("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} may be a static method reached via an ambiguous package-surface member call`,reasonKind:"dep-opaque",attribution:void 0,basis:f,path:void 0,...O};if(L===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&!Tg(n,w,o))return{tier:Te("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a method of the dependency class ${o.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,reasonKind:"dep-opaque",attribution:void 0,basis:f,path:void 0,...O};if(L===void 0){let x=Cg(n,w,o);if(x!==void 0&&N.has(x.id))return{tier:Te(I.length>0?"dynamic-load":"dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a class a loaded module declares, and the graph holds no node for constructing it \u2014 a class cannot be shown unused without one`,reasonKind:I.length>0?"dynamic-load":"dep-opaque",attribution:void 0,basis:f,path:void 0,...O}}let z=D();if(z!==null)return z;if(A.length>0){let x=L!==void 0?w.get(L.moduleId):Kd(n,o),M=L===void 0&&x!==void 0&&x.externalSurface!==!0&&N.has(x.id)&&!d.has(x.packageName);return{tier:Te(I.length>0?"dynamic-load":M?"dep-opaque":"dispatch"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} not statically reached, but unresolved dynamic access exists`,reasonKind:I.length>0?"dynamic-load":M?"dep-opaque":"dispatch",attribution:void 0,basis:f,path:void 0,...O}}let Z=L!==void 0?w.get(L.moduleId):Kd(n,o);if(L===void 0&&Z!==void 0&&Z.externalSurface!==!0&&N.has(Z.id)&&!d.has(Z.packageName))return{tier:Te("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${o.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,reasonKind:"dep-opaque",attribution:void 0,basis:f,path:void 0,...a};let de=Z!==void 0?S(Z.id,L?.id):b();return de!==null?{tier:Te(de.cause),decidedAtStage:L===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,reasonKind:de.cause,attribution:void 0,basis:f,path:void 0,...l(R(de))}:s.surfaceComplete?{tier:"not-reachable",decidedAtStage:L===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} is never reached from the application's entrypoints`,reasonKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:E(L===void 0?"symbol-reachable":"module-reachable")}let K=L.kind==="class",Y=$g(n,Wd(n),L.id);if(Y!==null)return{tier:uo(Y.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:K?`${o.exportName} is a class, and a path from an application entrypoint constructs it or a class below it`:`${o.exportName} is called from an application entrypoint`,reasonKind:void 0,attribution:pr(o),basis:u("reachable-high"),path:Dg(n,Y.path,Y.via),...a};if(A.length>0)return{tier:Te(I.length>0?"dynamic-load":K?"dep-opaque":"dispatch"),decidedAtStage:"call-path-confirmed",reason:K?`no path constructs the class ${o.exportName}, but unresolved edges exist \u2014 and a class is used by more than its construction`:`no resolved call path to ${o.exportName}, but unresolved edges exist`,reasonKind:I.length>0?"dynamic-load":K?"dep-opaque":"dispatch",attribution:void 0,basis:f,path:void 0,...O};let le=S(L.moduleId,L.id);return le!==null?{tier:Te(le.cause),decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${o.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,reasonKind:le.cause,attribution:void 0,basis:f,path:void 0,...l(R(le))}:s.surfaceComplete?K?{tier:Te("dep-opaque"),decidedAtStage:"call-path-confirmed",reason:`no path constructs the class ${o.exportName}, but a class is also used through subclasses, class attributes and class methods, which the call graph does not enumerate \u2014 cannot confirm it is unused`,reasonKind:"dep-opaque",attribution:void 0,basis:f,path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${o.exportName} is imported but never called from an entrypoint`,reasonKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,...a}:E("call-path-confirmed")}function Bg(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Gg(e,n,t){let s=new Map(e.classes.map(o=>[o.id,o.name]));for(let o of e.functions){if(o.name!==t.exportName)continue;let r=n.get(o.moduleId);if(!(r===void 0||r.packageName!==t.packageName||(o.enclosingClassId!==void 0?s.get(o.enclosingClassId)??null:null)!==t.container))return o.id}return null}function Kg(e,n,t){if(n===t)return[];let s=new Map(e.functions.map(l=>[l.id,l])),o=new Map(e.callSites.map(l=>[l.id,l])),r=new Map;for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let d=o.get(l.callSiteId);if(d===void 0)continue;let c=d.enclosingFunctionId;if(!s.has(c)||!s.has(l.calleeFunctionId))continue;let p=r.get(c),u={to:l.calleeFunctionId,label:l.resolution};p===void 0?r.set(c,[u]):p.push(u)}let i=new Set([n]),a=[{at:n,labels:[]}];for(let l=0;l<a.length;l++){let d=a[l];for(let c of r.get(d.at)??[]){if(i.has(c.to))continue;let p=[...d.labels,c.label];if(c.to===t)return p;i.add(c.to),a.push({at:c.to,labels:p})}}return null}function po(e,n,t,s,o){if(o.length===0)return null;let r=dr(e,n,t);if(r.length===0)return null;let i=Gg(e,n,s);for(let a of o){let l=r.filter(c=>c.packageName===a.anchor.packageName&&c.exportName===a.anchor.exportName&&c.container===a.anchor.container),d=l.find(c=>c.resolution==="resolved")??l[0];if(d!==void 0){if(Bg(a.callee,s))return{tier:uo("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&i!==null){let c=Kg(e,a.callee.realFunctionId,i);if(c!==null)return{tier:uo("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[d.resolution,"modeled",...c]}}}}return null}var Vd=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Xd=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","potentially-reachable-not-ruled-out","potentially-reachable-not-analysed"],Fi=["reachable-high","reachable-medium","reachable-low"],Yd=new Set(Fi),cs=["potentially-reachable-not-ruled-out","potentially-reachable-not-analysed"],zg=new Set(cs);function He(e){return zg.has(e)}function zt(e){return cs.reduce((n,t)=>n+e[t],0)}function pr(e){return e.verified?"gated":"candidate"}var mo=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],zi=["cupel","project"],$n={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Jd(e){return $n[e]}var mt={dispatch:"potentially-reachable-not-ruled-out","dynamic-load":"potentially-reachable-not-ruled-out","dep-opaque":"potentially-reachable-not-ruled-out","no-entrypoint":"potentially-reachable-not-analysed","analyzer-crash":"potentially-reachable-not-analysed","version-undecidable":"potentially-reachable-not-analysed","db-gap":"potentially-reachable-not-analysed","unverified-symbol":"potentially-reachable-not-analysed","symbol-unsupported":"potentially-reachable-not-analysed","resolution-divergence":"potentially-reachable-not-analysed","analysis-cap":"potentially-reachable-not-analysed","coverage-gap":"potentially-reachable-not-analysed","incomplete-surface":"potentially-reachable-not-analysed"};function Te(e){return mt[e]}import{randomBytes as Zl}from"node:crypto";import{performance as oo}from"node:perf_hooks";import hc from"node:path";import{closeSync as Ug,constants as Zd,fstatSync as Wg,openSync as Hg,readSync as qg,realpathSync as Qd}from"node:fs";import Ui from"node:path";var Vg=8*1024*1024;function Ms(e){return e==="PyPI"?"utf8-bytes":"utf16-units"}var Ut=class{#e;#t;#n=new Map;constructor(n,t=Vg){this.#t=t;let s;try{s=Qd(n)}catch{s=null}this.#e=s}read(n){let t=this.#n.get(n);if(t!==void 0)return t;let s=this.#s(n);return this.#n.set(n,s),s}#s(n){let t=this.#e;if(t===null||n===""||Ui.isAbsolute(n))return null;let s;try{s=Qd(Ui.join(t,n))}catch{return null}if(s!==t&&!s.startsWith(`${t}${Ui.sep}`))return null;let o;try{o=Hg(s,Zd.O_RDONLY|Zd.O_NONBLOCK)}catch{return null}try{let r=Wg(o);if(!r.isFile()||r.size>this.#t)return null;let i=Buffer.alloc(r.size),a=0;for(;a<r.size;){let l=qg(o,i,a,r.size-a,a);if(l===0)break;a+=l}return a===r.size?i:null}catch{return null}finally{Ug(o)}}};function ec(e,n,t){if(!Number.isInteger(n)||n<0)return null;if(t==="utf8-bytes"){if(n>e.length)return null;let i=e.subarray(0,n),a=1;for(let d of i)d===10&&(a+=1);let l=i.lastIndexOf(10)+1;return[a,e.subarray(l,n).toString("utf8").length+1]}let s=e.toString("utf8");if(n>s.length)return null;let o=s.slice(0,n),r=1;for(let i=0;i<o.length;i+=1)o.charCodeAt(i)===10&&(r+=1);return[r,n-(o.lastIndexOf(`
-`)+1)+1]}function Wt(e,n,t){if(n.end<n.start)return null;let s=e.read(n.path);if(s===null)return null;let o=ec(s,n.start,t),r=ec(s,n.end,t);return o===null||r===null?null:{startLine:o[0],startColumn:o[1],endLine:r[0],endColumn:r[1]}}var Xg="cupel/influence-shadow/2",nc=64,tc=16,Yg=e=>Yd.has(e);function mr(e){let n=new Map(e.functions.map(t=>[t.id,t.moduleId]));return{...e,functions:e.functions.map(t=>({...t,declRange:{...t.declRange,path:t.moduleId}})),callSites:e.callSites.map(t=>{let s=n.get(t.enclosingFunctionId);return s===void 0?t:{...t,range:{...t.range,path:s}}})}}function sc(e,n,t,s=()=>null,o=null){let r=t(),i={graph:e,lineOf:s},a={npm:i,PyPI:o},l=new Map,d=S=>{let b=l.get(S);return b===void 0&&(b=Ps(S.graph),l.set(S,b)),b};d(i);let c=Object.fromEntries(Li.map(S=>[S,0])),p=0,u=0,f=S=>b=>{let{site:k,...w}=b;return k===void 0?w:{...w,site:{...k,line:S.lineOf?.(k)??null}}},m={influenced:0,"no-source-reached":0,"reaches-entry-parameter":0,unknown:0},h={},y=0,_=[];for(let S of n){if(!Yg(S.tier))continue;let b={advisoryId:S.advisoryId,packageName:S.packageName,version:S.version,ecosystem:S.ecosystem,symbol:S.symbolName,tier:S.tier},k=S.ecosystem==="npm"||S.ecosystem==="PyPI"?a[S.ecosystem]:null;if(k===null){_.push({...b,skipped:S.ecosystem==="PyPI"?"this scan holds no Python graph to ask":`no front-end emits value flows for ${S.ecosystem}`,sites:[],truncatedSites:!1});continue}let w=d(k),N=f(k),R=S.path?.[S.path.length-1]?.functionId,v=R!==void 0?(w.callers.get(R)??[]).filter(A=>A.direct).map(A=>A.site):[],I=[];for(let A of v.slice(0,nc)){let B=[],O=A.args?.length??1,V=(E,D)=>{let L=lo(w,{site:A,port:D});y+=1,m[L.outcome]+=1,L.caveats.length>0&&(u+=1);for(let K of L.leaves)K.kind==="unknown"&&K.reason!==void 0&&(h[K.reason]=(h[K.reason]??0)+1),(K.kind==="unknown"||K.kind==="entry-parameter")&&(K.class===void 0?p+=1:c[K.class]+=1);B.push({port:E,outcome:L.outcome,leaves:L.leaves.map(N),caveats:L.caveats,visited:L.visited,...L.witness!==void 0?{witness:L.witness}:{}})};for(let E=0;E<Math.min(O,tc);E+=1)V(`arg[${String(E)}]`,{kind:"arg",index:E});A.receiverRange!==void 0&&V("receiver",{kind:"receiver"}),I.push({path:A.range.path,start:A.range.start,enclosing:A.enclosingFunctionId,ports:B,truncatedArgs:O>tc})}_.push({...b,sites:I,truncatedSites:v.length>nc})}return{format:Xg,findings:_,totals:{findings:_.length,ports:y,byOutcome:m,unknownReasons:h,identityCollisions:[...l.values()].reduce((S,b)=>S+b.identityCollisions,0),byClass:c,unclassified:p,portsWithCaveats:u},wallMs:Math.round((t()-r)*10)/10}}function tn(e){return Buffer.byteLength(JSON.stringify(e),"utf8")}function hr(e,n){return 2+e+Math.max(n-1,0)}function oc(e){return String(e).length}var Ht=class{#e;constructor(n,t){let s=new Float64Array(n+2);for(let[o,r]of t)s[o+1]=(s[o+1]??0)+r;for(let o=1;o<s.length;o+=1)s[o]=(s[o]??0)+(s[o-1]??0);this.#e=s}below(n){return this.#e[n]??0}},Hi=class{index;finding;key;size;kept;#e;#t;#n;#s;#r;#i;#a;#o;#l;#d;#c;#u;#f;constructor(n,t,s,o){this.index=n,this.finding=t,this.key=o,this.size=s.nodes.length,this.kept=s.nodes.length,this.#e=s,this.#t=t.influence?.overlay??null;let r=this.size,i=new Map;s.nodes.forEach((f,m)=>{i.has(f.id)||i.set(f.id,m)}),this.#n=i;let a=f=>i.get(f)??r,l=f=>Math.max(a(f.from),a(f.to));this.#s=new Ht(r,s.nodes.map((f,m)=>[m,tn(f)])),this.#r=new Ht(r,s.edges.map(f=>[l(f),tn(f)])),this.#i=new Ht(r,s.edges.map(f=>[l(f),1])),this.#c=tn({...s,nodes:[],edges:[],truncated:0})-5;let d=this.#t,c=d?.inputs??[];this.#a=new Ht(r,c.map(f=>[a(f.node),tn(f)])),this.#o=new Ht(r,c.map(f=>[a(f.node),1]));let p=0,u=[];for(let f of d?.blockers??[]){let m=tn(f.node===null?f:{...f,node:null});p+=m,f.node!==null&&u.push([a(f.node),tn(f)-m])}this.#l=new Ht(r,u),this.#d=p,this.#u=d===null?0:tn({...d,inputs:[],blockers:[],truncated:0})-5,this.#f=tn(s)+(d===null?0:tn(d))}bytesAt(n){if(n===this.size)return this.#f;let t=this.#c+hr(this.#s.below(n),n)+hr(this.#r.below(n),this.#i.below(n))+oc(this.#e.truncated+(this.size-n)),s=this.#t;if(s===null)return t;let o=this.#o.below(n);return t+this.#u+hr(this.#a.below(n),o)+hr(this.#d+this.#l.below(n),s.blockers.length)+oc(s.truncated+(s.inputs.length-o))}cut(){let n=this.kept,t=u=>(this.#n.get(u)??this.size)<n,s=this.#e,o=s.edges.filter(u=>t(u.from)&&t(u.to)),r={...s,nodes:s.nodes.slice(0,n),edges:o,truncated:s.truncated+(this.size-n)},i=this.#t,a=this.finding;if(i===null||a.influence===null)return{finding:{...a,reach:r},calls:s.edges.length-o.length,inputs:0,offGraph:0};let l=i.inputs.filter(u=>t(u.node)),d=0,c=i.blockers.map(u=>u.node===null||t(u.node)?u:(d+=1,{...u,node:null})),p={...i,inputs:l,blockers:c,truncated:i.truncated+(i.inputs.length-l.length)};return{finding:{...a,reach:r,influence:{...a.influence,overlay:p}},calls:s.edges.length-o.length,inputs:i.inputs.length-l.length,offGraph:d}}};function Wi(e,n){return e<n?-1:e>n?1:0}function Jg(e,n){return Wi(e.finding.advisoryId,n.finding.advisoryId)||Wi(e.finding.packageName,n.finding.packageName)||Wi(e.key,n.key)}function rc(e,n,t){let s=tn(e);if(s<=n)return{payload:e,bytes:s,cut:null};let o=e.findings.flatMap((h,y)=>h.reach!==null&&h.reach.nodes.length>1?[new Hi(y,h,h.reach,t(h))]:[]);if(o.length===0)return{payload:e,bytes:s,cut:null};o.sort(Jg);let r=o.reduce((h,y)=>Math.max(h,y.size),0),i=s;for(let h=r;h>1&&i>n;h-=1)for(let y of o){if(i<=n)break;y.size<h||(i+=y.bytesAt(y.kept-1)-y.bytesAt(y.kept),y.kept-=1)}let a=new Map(o.filter(h=>h.kept<h.size).map(h=>[h.index,h]));if(a.size===0)return{payload:e,bytes:s,cut:null};let l=0,d=0,c=0,p=0,u=e.findings.map((h,y)=>{let _=a.get(y);if(_===void 0)return h;let S=_.cut();return l+=_.size-_.kept,d+=S.calls,c+=S.inputs,p+=S.offGraph,S.finding}),f={...e,findings:u},m=tn(f);return{payload:f,bytes:m,cut:{budget:n,bytesBefore:s,bytesAfter:m,graphsCut:a.size,functionsCut:l,callsCut:d,inputsCut:c,blockersOffGraph:p,exhausted:m>n}}}function ic(e){let n=0,t=0,s=0,o=0;for(let l of e.findings){l.reach!==null&&(n+=tn(l.reach));let d=l.influence?.overlay??null;d!==null&&(t+=tn(d)),l.path!==null&&(s+=tn(l.path)),o+=tn(l.unresolvedSites)}let r=0;for(let l of e.advisories)l.details!==null&&(r+=tn(l.details));let i=tn(e.findings),a=tn(e.advisories);return[{name:"the reach graphs",bytes:n},{name:"the influence overlays",bytes:t},{name:"the call paths",bytes:s},{name:"the findings' own unresolved sites",bytes:o},{name:"the rest of the findings",bytes:i-n-t-s-o},{name:"the app-global unresolved sets",bytes:tn(e.unresolved)},{name:"the advisory descriptions",bytes:r},{name:"the rest of the advisory records",bytes:a-r},{name:"the package graphs",bytes:tn(e.packageGraphs)}].sort((l,d)=>d.bytes-l.bytes)}function ac(e){let n=e.exhausted?`; every graph is down to its vulnerable function and the payload is still ${String(e.bytesAfter)} bytes`:"";return`the findings payload was ${String(e.bytesBefore)} bytes, over its ${String(e.budget)}-byte budget, so ${String(e.graphsCut)} reach graph(s) were cut nearest the vulnerable function first (ADR-120): ${String(e.functionsCut)} function(s) dropped and counted in each graph's \`truncated\`, with the ${String(e.callsCut)} call(s) that touched them and the ${String(e.inputsCut)} overlay input(s) on them${n}`}function Ln(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function lc(e,n={}){let t=n.maxBytes??1073741824,s=n.timeoutMs??3e4,{get:o}=await import("node:https");return await new Promise((r,i)=>{let a=o(e,n.headers!==void 0?{headers:n.headers}:{},l=>{let d=l.statusCode??0;if(d<200||d>=300){l.resume(),i(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let c=[],p=0;l.on("data",u=>{if(p+=u.length,p>t){l.destroy(),i(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}c.push(u)}),l.on("end",()=>{r(Buffer.concat(c))}),l.on("error",i)});a.on("error",i),a.setTimeout(s,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(s)}ms`))})})}async function ho(e,n,t,s,o,r=3e4){let{request:i}=await import("node:https"),a=new URL(n).hostname;return await new Promise((l,d)=>{let c=i(n,{method:e,headers:t},p=>{let u=[],f=0;p.on("data",m=>{if(f+=m.length,f>o){p.destroy(),d(new Error(`${e} to ${a} returned more than ${String(o)} bytes`));return}u.push(m)}),p.on("end",()=>{l({status:p.statusCode??0,body:Buffer.concat(u).toString("utf8")})}),p.on("error",()=>{d(new Error(`${e} to ${a} failed`))})});c.on("error",()=>{d(new Error(`${e} to ${a} failed`))}),c.setTimeout(r,()=>{c.destroy(new Error(`${e} to ${a} timed out after ${String(r)}ms`))}),s!==void 0&&c.write(s),c.end()})}var go="api.cupel.sh",Zg=`https://${go}/v1/findings`,Qg=64*1024,us=8*1024*1024,ey=3e4,qt=class extends Error{constructor(n){super(n),this.name="PushError"}};async function dc(e,n,t,s={}){if(e.length>us)throw new qt(`findings payload is ${String(e.length)} bytes, over the ${String(us)}-byte limit`);let o=Ln(Zg,new Set([go])),r;try{r=await t(o.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,s.timeoutMs??ey)}catch{throw new qt(`the findings push to ${go} failed`)}if(r.body.length>Qg)throw new qt("the control plane returned a response larger than it should");if(!(r.status===202||r.status===200))throw r.status===401||r.status===403?new qt("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):r.status===400?new qt("the control plane rejected the findings payload as malformed"):new qt(`the findings push was refused with status ${String(r.status)}`)}var ny=14,Vt={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:1024,maxAdvisoryDetails:8e3,maxReachNodes:512,maxReachEdges:2048,maxPackageGraphNodes:256,maxPackageGraphEdges:1024,maxPackageGraphs:2e4,maxSourcePosition:1e7},ty=7.5*1024*1024,Hn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Vi(e){return{path:e.path,start:e.start,end:e.end}}function sy(e){let n=He(e.tier);if(n&&e.reasonKind===void 0)throw new Hn(`finding ${e.advisoryId} is ${e.tier} with no reason kind \u2014 a Potentially reachable finding without its kind is a hedge`);if(!n&&e.reasonKind!==void 0)throw new Hn(`finding ${e.advisoryId} is ${e.tier} but carries reason kind ${e.reasonKind} \u2014 only a Potentially reachable finding has one`);if(e.reasonKind!==void 0&&Te(e.reasonKind)!==e.tier)throw new Hn(`finding ${e.advisoryId} is ${e.tier} but its reason kind ${e.reasonKind} puts it in ${Te(e.reasonKind)}`);let t=n?e.reasonKind:null,s=e.modelId??null,o=e.modelPromotedFromKind??null;if(s===null!=(o===null))throw new Hn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(s!==null&&e.tier!=="reachable-low")throw new Hn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,symbolContainer:e.symbolContainer,symbolPath:e.symbolPath,severity:e.severity,tier:e.tier,reason:e.reason,reasonKind:t,reasonOwner:t===null?null:Jd(t),basis:e.basis??null,path:oy(e),unresolvedSites:e.unresolvedEvidence.own.map(Vi),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:s,modelPromotedFromKind:o,surfaceComplete:e.surfaceComplete??null,reach:ry(e),introducedBy:e.introducedBy??null,influence:e.influence===void 0?null:{value:e.influence.value,kind:e.influence.kind,owner:co[e.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null,overlay:e.influenceOverlay??null}}}function cc(e){return e===null?null:{line:e.line,column:e.column}}function oy(e){if(e.path===void 0)return null;let n=e.located?.path??null;return n!==null&&n.length===e.path.length?n.map((t,s)=>({functionName:e.path?.[s]?.functionName??null,modulePath:t.modulePath,line:t.line,column:t.column,callSite:cc(t.callSite)})):e.path.map(t=>({functionName:t.functionName??null,modulePath:t.modulePath,line:null,column:null,callSite:null}))}function ry(e){let n=e.located?.reach??null;return n===null?null:{nodes:n.nodes.map(t=>({id:t.id,functionName:t.functionName,modulePath:t.modulePath,line:t.line,column:t.column})),edges:n.edges.map(t=>({from:t.from,to:t.to,callSite:cc(t.callSite)})),truncated:n.truncated}}var qi="";function uc(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];if(e.ecosystem==="npm")return n.join(qi);let{symbolContainer:t,symbolPath:s}=e;return t===null&&s===null?[...n,e.ecosystem].join(qi):[...n,e.ecosystem,t??"",s??""].join(qi)}function iy(e){let n=new Map;for(let t of e){let s=uc(t),o=n.get(s);if(o===void 0){n.set(s,t);continue}if(o.tier!==t.tier||o.reasonKind!==t.reasonKind)throw new Hn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${o.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function ay(e){let n=Vt,t=(s,o,r)=>{throw new Hn(`${s} has ${String(o)} entries, over the ${String(r)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let s of["dispatch","load"]){let o=e.unresolved[s].length;o>n.maxUnresolvedSites&&t(`the app-global ${s} set`,o,n.maxUnresolvedSites)}for(let s of e.findings)s.path!==null&&s.path.length>n.maxPathSteps&&t(`the call path of finding ${s.advisoryId}`,s.path.length,n.maxPathSteps),s.reach!==null&&s.reach.nodes.length>n.maxReachNodes&&t(`the reach graph of finding ${s.advisoryId}`,s.reach.nodes.length,n.maxReachNodes),s.reach!==null&&s.reach.edges.length>n.maxReachEdges&&t(`the reach graph's calls of finding ${s.advisoryId}`,s.reach.edges.length,n.maxReachEdges),s.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${s.advisoryId}`,s.unresolvedSites.length,n.maxUnresolvedSites);e.packageGraphs.length>n.maxPackageGraphs&&t("the package graphs list",e.packageGraphs.length,n.maxPackageGraphs);for(let s of e.packageGraphs)s.nodes.length>n.maxPackageGraphNodes&&t(`package graph ${s.id}`,s.nodes.length,n.maxPackageGraphNodes),s.edges.length>n.maxPackageGraphEdges&&t(`the links of package graph ${s.id}`,s.edges.length,n.maxPackageGraphEdges);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let s of e.advisories){if(s.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${s.id}`,s.ranges.length,n.maxAdvisoryRanges),s.summary!==null&&s.summary.length>n.maxStringLength)throw new Hn(`the summary of advisory ${s.id} is ${String(s.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(s.details!==null&&s.details.length>n.maxAdvisoryDetails)throw new Hn(`the description of advisory ${s.id} is ${String(s.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function ly(e,n){let t=new Set(n.map(s=>s.advisoryId));return e.advisories.filter(s=>t.has(s.advisory.id)).map(s=>({id:s.advisory.id,cveId:s.advisory.cveId,osvId:s.advisory.osvId,summary:s.advisory.summary,details:s.advisory.details??null,severity:s.advisory.severity,published:s.advisory.published,source:s.advisory.source,ranges:s.ranges.map(o=>({packageName:o.packageName,introduced:o.introduced,fixed:o.fixed,lastAffected:o.lastAffected}))}))}function dy(e,n){let t=new Set(n.flatMap(s=>s.introducedBy===null?[]:[s.introducedBy]));return(e.packageGraphs??[]).filter(s=>t.has(s.id)).map(s=>({id:s.id,nodes:s.nodes.map(o=>({id:o.id,name:o.name,version:o.version,direct:o.direct,declaredIn:o.declaredIn===null?null:{path:o.declaredIn.path,line:o.declaredIn.line}})),edges:s.edges.map(o=>({from:o.from,to:o.to})),truncated:s.truncated}))}function cy(e){if(e.bytes<=us)return;let n=i=>`${i.name} (${String(i.bytes)} bytes, ${String(Math.round(100*i.bytes/e.bytes))}%)`,[t,s]=ic(e.payload),o=e.payload.findings.flatMap(i=>i.reach===null?[]:[i.reach]),r=o.length===0?"with no reach graph to cut":o.every(i=>i.nodes.length<=1)?"with every reach graph cut to its vulnerable function":"with its reach graphs as built";throw new Hn(`the findings payload is ${String(e.bytes)} bytes, over the ${String(us)}-byte limit, ${r} (ADR-120); its largest part is ${t===void 0?"unknown":n(t)}${s===void 0?"":`, then ${n(s)}`}`)}function fc(e,n,t={}){let s=iy(e.findings.map(sy)),o={version:ny,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:s,unresolved:{dispatch:e.unresolved.dispatch.map(Vi),load:e.unresolved.load.map(Vi)},advisories:ly(e,s),packageGraphs:dy(e,s)};ay(o);let r=rc(o,t.byteBudget??ty,uc);return r.cut!==null&&t.onCut?.(r.cut),cy(r),r.payload}function pc(e){let n=new Set(e.installed.packages.map(s=>s.ecosystem??"npm")),t=["npm","PyPI","Go"].filter(s=>n.has(s));return t.length===0?"npm":t.join("+")}var Ji="site-packages:",Yi=class{#e;#t;#n=new Map;constructor(n,t){this.#e=n,this.#t=t}point(n,t){if(!Number.isInteger(t)||t<0)return null;let s=this.#s(n);if(s===null)return null;let o=(typeof s.text=="string",s.text.length);if(t>o)return null;let r=0,i=s.starts.length-1;for(;r<i;){let p=r+i+1>>1;(s.starts[p]??0)<=t?r=p:i=p-1}let a=s.starts[r]??0,l=typeof s.text=="string"?t-a+1:s.text.subarray(a,t).toString("utf8").length+1,d=r+1,c=Vt.maxSourcePosition;return d>c||l>c?null:{line:d,column:l}}#s(n){let t=this.#n.get(n);if(t!==void 0)return t;let s=this.#e.read(n),o=null;if(s!==null){let r=[0];if(this.#t==="utf8-bytes"){for(let i=0;i<s.length;i+=1)s[i]===10&&r.push(i+1);o={text:s,starts:r}}else{let i=s.toString("utf8");for(let a=0;a<i.length;a+=1)i.charCodeAt(a)===10&&r.push(a+1);o={text:i,starts:r}}}return this.#n.set(n,o),o}},Ts=class{#e;#t;#n;#s;#r;#i;constructor(n,t,s,o){this.#e=n,this.#t=new Yi(t,s),this.#n=o,this.#s=new Map(n.functions.map(r=>[r.id,r])),this.#r=new Map(n.modules.map(r=>[r.id,r])),this.#i=new Map(n.callSites.map(r=>[r.id,r]))}locate(n){let t=n.path;if(t===void 0||t.length===0)return{path:null,reach:null};let s=t.map((l,d)=>{let c=this.#s.get(l.functionId),p=c===void 0?"":this.#n(c.moduleId),u=c===void 0?null:this.#o(p,c.declRange),f=t[d+1]?.calledAt??null;return{modulePath:Xi(p,l.modulePath),line:u?.line??null,column:u?.column??null,callSite:f===null?null:this.#o(p,f)}}),o=t[t.length-1]?.functionId,r=o===void 0?null:Bi(this.#e,o,n.tier==="reachable-medium");if(r===null)return{path:s,reach:null};let i=mc(r),a=new Map(r.functions.slice(0,i).map((l,d)=>[l.functionId,`n${String(d)}`]));return{path:s,reach:this.#a(r),nodeOf:a}}modulePathOf(n){let t=this.#r.get(n);return t===void 0?null:Xi(this.#n(n),t.path)}#a(n){let t=mc(n),s=new Map(n.functions.slice(0,t).map((i,a)=>[i.functionId,a])),o=n.functions.slice(0,t).map((i,a)=>{let l=this.#s.get(i.functionId),d=l===void 0?"":this.#n(l.moduleId),c=l===void 0?null:this.#o(d,l.declRange);return{id:`n${String(a)}`,functionName:l?.name??null,modulePath:(l===void 0?null:this.modulePathOf(l.moduleId))??"",line:c?.line??null,column:c?.column??null}}),r=n.edges.flatMap(i=>{let a=s.get(i.from),l=s.get(i.to);if(a===void 0||l===void 0)return[];let d=this.#i.get(i.site),c=this.#s.get(i.from),p=c===void 0?"":this.#n(c.moduleId);return[{from:`n${String(a)}`,to:`n${String(l)}`,callSite:d===void 0?null:this.#o(p,d.range)}]});return{nodes:o,edges:r,truncated:n.functions.length-t}}#o(n,t){return t.path===""||t.path.startsWith(Ji)?null:this.#t.point(Xi(n,t.path),t.start)}};function mc(e){let n=Vt,t=new Map(e.functions.map((i,a)=>[i.functionId,a])),s=new Array(e.functions.length).fill(0);for(let i of e.edges){let a=Math.max(t.get(i.from)??0,t.get(i.to)??0);s[a]=(s[a]??0)+1}let o=0,r=0;for(;r<e.functions.length&&r<n.maxReachNodes;){let i=s[r]??0;if(o+i>n.maxReachEdges)break;o+=i,r+=1}return r}function Xi(e,n){return e===""||n===""?n:`${e}/${n}`}function Zi(e){let n=e.filter(t=>t!=="").sort((t,s)=>s.length-t.length);return t=>n.find(s=>t.startsWith(`${s}::`))??""}var uy=512,fy=2048,py=64*1024,my=255,hy=1024,gy=64,yy=16,_y=/^(?:pkg:[^\s\p{Cc}]{1,200}|ecmascript:[A-Za-z0-9_.$]{1,200})$/u;function Qi(e){return e.length>0&&e.length<=hy&&!new RegExp("\\p{Cc}","u").test(e)&&!hc.posix.isAbsolute(e)&&!hc.win32.isAbsolute(e)}function gc(e,n){return{index:Ps(e),lineOf:t=>Wt(n,t,"utf16-units")?.startLine??null,pathOf:t=>t.path}}function yc(e,n,t){let s=new Map(e.modules.map(a=>[a.id,a])),o=(a,l)=>{let d=l.registeredAt;if(d===void 0)return l;let c=a.declRange.path,p=c!==""&&a.moduleId.endsWith(c)?a.moduleId.slice(0,a.moduleId.length-c.length):null,u=p===null?null:`${p}${d.path}`;return u!==null&&s.has(u)?{...l,registeredAt:{...d,path:u}}:{index:l.index,sourceClass:l.sourceClass,model:l.model}},r={...e,functions:e.functions.map(a=>a.sourceParams===void 0?a:{...a,sourceParams:a.sourceParams.map(l=>o(a,l))})},i=a=>a.packageName===""&&!a.id.includes(Ji);return{index:Ps(mr(r)),lineOf:a=>{let l=s.get(a.path);if(l===void 0||!i(l))return null;let d=n.modulePathOf(l.id);return d===null?null:Wt(t,{...a,path:d},"utf8-bytes")?.startLine??null},pathOf:a=>s.has(a.path)?n.modulePathOf(a.path):null}}function _c(e,n,t,s,o=r=>r.path){let r=0,i=64,a=u=>{let f=Buffer.byteLength(JSON.stringify(u),"utf8")+1;return i+f>py?!1:(i+=f,!0)},l=[];for(let[u,f]of t)for(let m of e.functions.get(u)?.sourceParams??[]){if(l.length>=uy||m.index<0||m.index>my){r+=1;continue}let h=m.registeredAt,y=h===void 0?null:o(h),_=h===void 0||y===null||!Qi(y)?null:s(h),S={node:f,param:m.index,sourceClass:m.sourceClass,model:m.model,registeredAt:y!==null&&_!==null?{path:y,line:_}:null};if(!a(S)){r+=1;continue}l.push(S)}let d=[],c=new Set,p=(e.callers.get(n)??[]).filter(u=>u.direct).map(u=>u.site);for(let u of p.slice(0,gy)){let f=[],m=Math.min(u.args?.length??1,yy);for(let h=0;h<m;h+=1)f.push({label:`arg[${String(h)}]`,port:{kind:"arg",index:h}});u.receiverRange!==void 0&&f.push({label:"receiver",port:{kind:"receiver"}});for(let{label:h,port:y}of f)for(let _ of lo(e,{site:u,port:y}).leaves){if(_.kind!=="unknown"&&_.kind!=="entry-parameter"||_.class===void 0)continue;let S=_.site??e.functions.get(_.functionId)?.declRange;if(S===void 0||S.path==="")continue;let b=o(S);if(b===null)continue;let k={port:h,node:t.get(_.functionId)??null,path:b,line:Qi(b)?s(S):null,class:_.class,owner:"cupel",callee:(_.reason==="opaque-callee"||_.reason==="unresolved-call")&&_.detail!==void 0&&_y.test(_.detail)?_.detail:null},w=JSON.stringify(k);if(!c.has(w)){if(c.add(w),!Qi(b)||d.length>=fy||!a(k)){r+=1;continue}d.push(k)}}}return{inputs:l,blockers:d,truncated:r}}import{mkdirSync as Ql,readdirSync as nh,readFileSync as RE,realpathSync as er,renameSync as ed,statSync as od,writeFileSync as nd}from"node:fs";import ct from"node:path";import{createRequire as by}from"node:module";var Sy=by(import.meta.url);function xy(){try{return Sy("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function ky(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var gr={open(e,n){let{DatabaseSync:t}=xy(),s=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?s.exec("PRAGMA query_only = ON;"):s.exec("PRAGMA journal_mode = DELETE;"),{exec:o=>s.exec(o),prepare:o=>ky(s.prepare(o)),close:()=>s.close()}}};var kc=["data","control","state","call-only","config-only"],wc=["patch-derived","pov-derived","drafted","reviewed"],vc=["remote-unauthenticated","remote-authenticated","rpc","message","upload","stored","upstream-response","cli","env","file"];var bc="[A-Za-z_$][A-Za-z0-9_$]{0,127}",wy=new RegExp(`^(?:(?:arg\\[(?:0|[1-9][0-9]{0,2})\\]|receiver)(?:\\.${bc}){0,${String(4)}}|kwarg\\[${bc}\\])$`,"u");function Ec(e){return wy.test(e)}var ea=(e,n)=>typeof e=="string"&&n.includes(e)?e:null,Sc=e=>{if(e==null)return null;if(typeof e!="string"||e.length>4096)return!1;try{return JSON.parse(e),e}catch{return!1}},xc=e=>e==null?null:typeof e=="string"&&e.length<=4096?e:!1,yr=e=>typeof e=="number"&&Number.isSafeInteger(e)?e:typeof e=="bigint"?Number(e):null;function na(e){let n=yr(e.id),t=yr(e.vulnerable_symbol_id),s=ea(e.mode,kc),o=ea(e.provenance,wc);if(n===null||t===null||s===null||o===null)return null;let r=s==="call-only"||s==="config-only",i=e.port;if(r?i!==null:typeof i!="string"||!Ec(i))return null;let a=e.at_path,l=e.at_start===null?null:yr(e.at_start),d=e.at_end===null?null:yr(e.at_end),c=null;if(a!==null||e.at_start!==null||e.at_end!==null){if(typeof a!="string"||a===""||a.length>4096||l===null||d===null||l<0||d<l)return null;c={path:a,start:l,end:d}}let p;try{p=typeof e.accepted_sources=="string"&&e.accepted_sources.length<=4096?JSON.parse(e.accepted_sources):void 0}catch{return null}if(!Array.isArray(p))return null;let u=[];for(let _ of p){let S=ea(_,vc);if(S===null||u.includes(S))return null;u.push(S)}let f=Sc(e.barriers),m=Sc(e.trigger_predicate),h=xc(e.evidence_ref),y=xc(e.reviewer);return f===!1||m===!1||h===!1||y===!1||o==="reviewed"&&y===null?null:{id:n,vulnerableSymbolId:t,mode:s,port:r?null:i,at:c,acceptedSources:u,barriers:f,triggerPredicate:m,provenance:o,evidenceRef:h,reviewer:y}}var yo="8",_r=new Set(["vulndb-listed","vulndb-derived"]),ht="8";function _o(e,n){return/^\d+$/u.test(e)&&Number(e)>=Number(n)}function qe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function Je(e){return typeof e=="string"?e:null}function gt(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var vy=`
+`};import{randomBytes as Ey}from"node:crypto";import{readFileSync as QR,renameSync as ZR,writeFileSync as Ay}from"node:fs";import eO from"node:path";import{fileURLToPath as nO}from"node:url";var Ry=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function ta(e){let n=0;for(;n<e.length-1&&e.charCodeAt(n)===48;)n+=1;return e.slice(n)}function Oy(e){let n=la(e,!1);if(n!==null)return{kind:"npm",...n};let t=Ry.exec(e);return t===null?null:{kind:"npm",major:ta(t[1]??""),minor:ta(t[2]??""),patch:ta(t[3]??""),prerelease:"",build:""}}var Py=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,Cy={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function Bs(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function My(e){let n=Py.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,s=(t.release??"").split(".");if(s.length===0||s.length>32)return null;let r=[];for(let c of s){let f=Bs(c);if(f===null)return null;r.push(f)}let o=0;if(t.epoch!==void 0){let c=Bs(t.epoch);if(c===null)return null;o=c}let i=null;if(t.preL!==void 0){let c=t.preN===void 0?0:Bs(t.preN);if(c===null)return null;i=[Cy[t.preL]??t.preL,c]}let a=null;if(t.postImplicit!==void 0){let c=Bs(t.postImplicit);if(c===null)return null;a=c}else if(t.postL!==void 0){let c=t.postN===void 0?0:Bs(t.postN);if(c===null)return null;a=c}let l=null;if(t.devL!==void 0){let c=t.devN===void 0?0:Bs(t.devN);if(c===null)return null;l=c}let d=t.local===void 0?null:t.local.split(/[-_.]/u).map(c=>/^[0-9]+$/u.test(c)?Number(c):c);return{kind:"PyPI",epoch:o,release:r,pre:i,post:a,dev:l,local:d}}function Gs(e,n){return e===n?0:e<n?-1:1}function vc(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function Ty(e,n){let t=vc(e),s=vc(n),r=Math.max(t.length,s.length);for(let o=0;o<r;o+=1){let i=Gs(t[o]??0,s[o]??0);if(i!==0)return i}return 0}function Ec(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function $y(e,n){let t=Ec(e),s=Ec(n);return t!==s?t<s?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:Gs(e.pre[1],n.pre[1])}function Ly(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:Gs(e,n)}function Dy(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:Gs(e,n)}function Fy(e,n){let t=typeof e=="number",s=typeof n=="number";return t&&s?Gs(e,n):!t&&!s?e===n?0:e<n?-1:1:t?1:-1}function jy(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let s=0;s<t;s+=1){let r=e[s],o=n[s];if(r===void 0)return-1;if(o===void 0)return 1;let i=Fy(r,o);if(i!==0)return i}return 0}function By(e,n){let t=Gs(e.epoch,n.epoch);if(t!==0)return t;let s=Ty(e.release,n.release);if(s!==0)return s;let r=$y(e,n);if(r!==0)return r;let o=Ly(e.post,n.post);if(o!==0)return o;let i=Dy(e.dev,n.dev);return i!==0?i:jy(e.local,n.local)}var vo=46;function ia(e,n){let t=e.charCodeAt(n);return t>=48&&t<=57}function Nc(e,n){let t=e.charCodeAt(n);return t>=48&&t<=57||t>=65&&t<=90||t>=97&&t<=122||t===45}function aa(e){for(let n=0;n<e.length;n+=1)if(!ia(e,n))return!1;return!0}function Ac(e){return e.length>1&&e.startsWith("0")&&aa(e)}function sa(e){if(e.length===0||!ia(e,0))return null;let n=1;for(;n<e.length&&ia(e,n);)n+=1;return e.startsWith("0")&&n!==1?null:[e.slice(0,n),e.slice(n)]}function Gy(e){if(!e.startsWith("-"))return null;let n=1,t=1;for(;n<e.length&&e[n]!=="+";){if(!Nc(e,n)&&e.charCodeAt(n)!==vo)return null;if(e.charCodeAt(n)===vo){if(t===n||Ac(e.slice(t,n)))return null;t=n+1}n+=1}return t===n||Ac(e.slice(t,n))?null:[e.slice(0,n),e.slice(n)]}function Ky(e){if(!e.startsWith("+"))return null;let n=1,t=1;for(;n<e.length;){if(!Nc(e,n)&&e.charCodeAt(n)!==vo)return null;if(e.charCodeAt(n)===vo){if(t===n)return null;t=n+1}n+=1}return t===n?null:[e.slice(0,n),e.slice(n)]}function la(e,n){let t=sa(e);if(t===null)return null;let[s,r]=t;if(r==="")return n?{major:s,minor:"0",patch:"0",prerelease:"",build:""}:null;if(!r.startsWith("."))return null;let o=sa(r.slice(1));if(o===null)return null;let[i,a]=o;if(a==="")return n?{major:s,minor:i,patch:"0",prerelease:"",build:""}:null;if(!a.startsWith("."))return null;let l=sa(a.slice(1));if(l===null)return null;let[d,c]=l,f=c,p="",u="";if(f.startsWith("-")){let m=Gy(f);if(m===null)return null;[p,f]=m}if(f.startsWith("+")){let m=Ky(f);if(m===null)return null;[u,f]=m}return f!==""?null:{major:s,minor:i,patch:d,prerelease:p,build:u}}function zy(e){let n=la(e.startsWith("v")?e.slice(1):e,!0);return n===null?null:{kind:"Go",...n}}function Wy(e){let n=la(e,!1);return n===null?null:{kind:"crates.io",...n}}function ra(e,n){return e===n?0:e.length!==n.length?e.length<n.length?-1:1:e<n?-1:1}function Ic(e){let n=e.indexOf(".");return n<0?[e,""]:[e.slice(0,n),e.slice(n)]}function Uy(e,n){if(e===n)return 0;if(e==="")return 1;if(n==="")return-1;let t=e,s=n;for(;t!==""&&s!=="";){let[r,o]=Ic(t.slice(1)),[i,a]=Ic(s.slice(1));if(t=o,s=a,r!==i){let l=aa(r),d=aa(i);return l!==d?l?-1:1:l&&r.length!==i.length?r.length<i.length?-1:1:r<i?-1:1}}return t===""?-1:1}function oa(e,n){return ra(e.major,n.major)||ra(e.minor,n.minor)||ra(e.patch,n.patch)||Uy(e.prerelease,n.prerelease)}function Hy(e,n){return e==="npm"?Oy(n):e==="PyPI"?My(n):e==="crates.io"?Wy(n):zy(n)}function qy(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=Hy(e,n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function _r(e,n){let t=qy(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function wo(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return oa(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return By(e.parsed,n.parsed);if(e.parsed.kind==="Go"&&n.parsed.kind==="Go"||e.parsed.kind==="crates.io"&&n.parsed.kind==="crates.io")return oa(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function Rc(e,n,t){let s=_r(e,n);return!(t.introduced!=="0"&&wo(s,_r(e,t.introduced))<0||t.fixed!==void 0&&wo(s,_r(e,t.fixed))>=0||t.lastAffected!==void 0&&wo(s,_r(e,t.lastAffected))>0)}var da=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function $t(e,n){return Rc(n.ecosystem??"npm",e,n)}function Eo(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),r=new Map(e.classes.map(a=>[a.id,a.name])),o=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution==="unresolved")continue;let l=o.get(a.callSiteId);if(l===void 0)continue;let d=s.get(l.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let c=n.get(d.moduleId);if(c===void 0)continue;let f=s.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==c.packageName&&i.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:a.resolution})}return i}function Vy(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,s)=>t.analyzedVersion<s.analyzedVersion?1:t.analyzedVersion>s.analyzedVersion?-1:0)}function Xy(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Oc(e,n,t,s,r,o){if(o<=0)return null;let i=null,a=l=>{(i===null||l.hops<i.hops)&&(i=l)};for(let l of Vy(e,n))for(let d of l.edges){if(d.entryExport!==t||d.entryContainer!==s)continue;if(Xy(d,r,l.packageName)){a({viaPackages:[],hops:d.hops,provenance:{tool:l.tool,toolVersion:l.toolVersion,analyzedVersion:l.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let c=Oc(e,d.target.calleePackage,d.target.calleeExport,null,r,o-1);c!==null&&a({viaPackages:[d.target.calleePackage,...c.viaPackages],hops:d.hops+c.hops,provenance:c.provenance})}return i}function ca(e,n,t,s,r,o){let i=null;for(let a of Eo(e,n,t)){let l=Oc(r,a.packageName,a.exportName,a.container,s,o);l!==null&&(i===null||l.hops<i.totalHops)&&(i={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:l.viaPackages,totalHops:l.hops,provenance:l.provenance})}return i}function Ao(e,n){let{args:t,convention:s}=e,r=n.params;if(t===void 0||s===void 0||r===void 0)return{known:!1,reason:"not-emitted"};if(s==="unknown")return{known:!1,reason:"convention"};if(n.reflectiveArguments===!0)return{known:!1,reason:"reflective-arguments"};if(s==="shifted"&&t[0]?.spread!==void 0&&t[0].spread!==!1)return{known:!1,reason:"convention"};let o=s==="shifted"?t.slice(1):t,i=[...r].sort((_,S)=>_.index-S.index),a=i.filter(_=>_.kind==="positional"),l=i.find(_=>_.kind==="rest"),d=i.find(_=>_.kind==="keyword-rest"),c=new Map,f=(_,S)=>{let k=c.get(_);k!=="unknown"&&c.set(_,[...k??[],S])},p=_=>{_!==void 0&&c.set(_,"unknown")},u=[],m=0,g=!1,y=!1;for(let _ of o){if(_.spread==="positional"){g=!0;for(let k of a.slice(m))p(k);p(l);continue}if(_.spread==="keyword"){y=!0;for(let k of i)(k.kind==="positional"||k.kind==="keyword-only")&&!c.has(k)&&p(k);p(d);continue}if(_.keyword!==void 0){let k=i.find(v=>v.name===_.keyword&&(v.kind==="positional"||v.kind==="keyword-only"));k!==void 0?c.has(k)?p(k):f(k,_.index):d!==void 0?f(d,_.index):u.push(_.index);continue}if(g){for(let k of a.slice(m))p(k);p(l);continue}let S=a[m];S!==void 0?f(S,_.index):l!==void 0?f(l,_.index):u.push(_.index),m+=1}return{known:!0,params:i.map(_=>{let S=c.get(_);return S==="unknown"?{kind:"unknown"}:S!==void 0?{kind:"args",argIndexes:S}:y&&(_.kind==="positional"||_.kind==="keyword-only")?{kind:"unknown"}:_.kind==="rest"||_.kind==="keyword-rest"?{kind:"args",argIndexes:[]}:{kind:"absent"}}),receiver:Yy(e,n),unbound:u}}function Yy(e,n){if(n.receiver===void 0)return"unknown";if(n.receiver!=="call")return"none";switch(e.convention){case"construct":return"fresh";case"shifted":return(e.args?.length??0)>0?"first-argument":"none";case"direct":return e.receiverRange!==void 0?"receiver-expression":"none";default:return"unknown"}}var ua=["builtin-call","host-lib-call","primitive-mutation","dependency-boundary","app-unresolved","untyped-call","dependency-callee","app-callee","module-binding","global","free-name","construct","opaque","unregistered-entry","binding","not-emitted","analysis-cap"],Pc=2e4,Jy=4,nt=(e,n)=>`${String(e)}-${String(n)}`,Io=e=>{switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${nt(e.at,e.end)}`;case"argument":return`a${nt(e.at,e.end)}:${String(e.index)}`;case"call-receiver":return`r${nt(e.at,e.end)}`;case"mutated-by-call":return`m${nt(e.at,e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"shared":return`h${String(e.id)}`;default:return e.kind}};function Qy(e){if(e.kind==="entry-parameter")return"unregistered-entry";if(e.kind==="unknown")switch(e.reason){case"binding":return"binding";case"not-emitted":return"not-emitted";case"analysis-cap":return"analysis-cap";case"opaque":return e.detail==="construct"?"construct":"opaque";default:return}}function Ks(e){let n=new Map(e.functions.map(c=>[c.id,c])),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map;for(let c of e.functions){if(c.valueFlows===void 0)continue;let f=new Map;for(let p of c.valueFlows){let u=Io(p.to),m=f.get(u);m===void 0?f.set(u,[p]):m.push(p)}s.set(c.id,f)}let r=new Map,o=new Map,i=0;for(let c of e.callSites){let f=`${c.range.path}\0${nt(c.range.start,c.range.end)}`;r.has(f)&&(i+=1),r.set(f,c),o.set(c.id,c)}let a=new Map,l=new Map,d=(c,f,p)=>{let u=c.get(f)??[];u.includes(p)||u.push(p),c.set(f,u)};for(let c of e.callEdges){let f=o.get(c.callSiteId);if(f===void 0)continue;let p=c.invocation==="direct";p&&d(a,f.id,c.calleeFunctionId);let u=l.get(c.calleeFunctionId)??[],m=u.find(g=>g.site===f);m===void 0?u.push({site:f,direct:p}):p&&(m.direct=!0),l.set(c.calleeFunctionId,u)}return{functions:n,modules:t,into:s,siteAt:r,identityCollisions:i,callees:a,callers:l}}function Zy(e,n){let{args:t,convention:s}=e;if(t===void 0||s===void 0||s!=="direct"&&s!=="construct")return"unknown";for(let r=0;r<=n&&r<t.length;r+=1){let o=t[r];if(o===void 0||o.spread!==!1||o.keyword!==void 0)return"unknown"}return n<t.length?n:"absent"}var Cc=e=>[...e.params??[]].sort((n,t)=>n.index-t.index);function eb(e,n,t){if(n===-1)return e.receiver==="receiver-expression"?{kind:"receiver"}:e.receiver==="unknown"?"unknown":null;if(e.receiver==="first-argument"&&n===0)return{kind:"receiver"};let s=e.params.findIndex(r=>r.kind==="args"&&r.argIndexes.includes(n));if(s>=0){let r=Cc(t)[s];return r!==void 0?{kind:"param",index:r.index}:"unknown"}return e.unbound.includes(n)?null:"unknown"}function Sr(e,n){let t=new Map,s=E=>{let N=E.class??Qy(E),A=E.site===void 0?"":`${E.site.path}:${String(E.site.start)}-${String(E.site.end)}`;t.set(`${E.kind}|${E.functionId}|${E.reason??""}|${E.detail??""}|${A}|${E.via??""}`,N===void 0?E:{...E,class:N})},r=new Map,o=E=>{r.set(`${E.site.path}:${String(E.site.start)}-${String(E.site.end)}|${E.reason}`,E)},i=(E,N)=>{if(N.kind==="receiver")return E.receiverPrimitive===!0;let A=E.args??[];return N.kind==="arg"?A[N.index]?.primitive===!0:A.slice(N.index).every(U=>U.primitive===!0)},a=(E,N,A,U)=>{let $=N.range.start,W=N.range.end,w=nt($,W),P=N.args,j=P!==void 0&&P.every(Q=>Q.spread===!1&&Q.keyword===void 0),F=P!==void 0&&!j&&P.every(Q=>Q.spread===!1)&&P.some(Q=>Q.keyword!==void 0),B=F?P.findIndex(Q=>Q.keyword!==void 0):Number.POSITIVE_INFINITY,ne=(Q,Z)=>Z===-1?Q.kind==="receiver":Z<B?Q.kind==="arg"&&Q.index===Z||Q.kind==="args-from"&&Z>=Q.index:Q.kind==="args-from"||Q.kind==="arg"&&Q.index>=B,X=U.kind==="call-result"?A.result:A.mutates.filter(Q=>ne(Q.into,U.index)).flatMap(Q=>Q.from);for(let Q of X){if(Q.kind==="receiver"){N.receiverRange!==void 0&&y({fn:E.fn,ref:{kind:"call-receiver",at:$,end:W},stack:E.stack,tracing:w});continue}if(P===void 0||!j&&!F){s({kind:"unknown",functionId:E.fn,reason:"binding",detail:"summary input",site:N.range});continue}let[Z,x]=Q.kind==="arg"&&Q.index<B?[Q.index,Math.min(Q.index+1,P.length)]:[Math.min(Q.index,B),P.length];for(let T=Z;T<x;T+=1)y({fn:E.fn,ref:{kind:"argument",at:$,end:W,index:T},stack:E.stack,tracing:w})}A.reviewed!==!0&&o({site:N.range,id:A.id,reason:"unreviewed-summary"}),(A.callsProgram??[]).some(Q=>!i(N,Q))&&o({site:N.range,id:A.id,reason:"calls-program"})},l=(E,N,A,U)=>{if(N.kind==="mutated-by-call"&&N.index>=0&&E.args?.[N.index]?.primitive===!0)return"primitive-mutation";if(A!==null){let $=e.modules.get(A.moduleId),W=e.modules.get(U.moduleId);return $===void 0?"not-emitted":$.externalSurface===!0||$.packageName!==W?.packageName?"dependency-callee":"app-callee"}switch(E.calleeDecl){case"ecmascript":case"runtime":return"builtin-call";case"host-lib":return"host-lib-call";case"dependency":return"dependency-boundary";case"app":return"app-unresolved";default:return"untyped-call"}},d=new Set,c=[],f=new Map,p=null,u,m=E=>`${E.fn}\0${Io(E.ref)}\0${E.stack.map(N=>N.id).join(",")}\0${String(E.tracing??"")}`,g=E=>{if(u!==void 0)return;let N=[{functionId:E.fn,ref:E.ref}];for(let A=p;A!==null;){let U=f.get(A);if(U===void 0)break;N.push({functionId:U.state.fn,ref:U.state.ref}),A=U.key}u=N},y=E=>{let N=m(E);d.has(N)||(d.add(N),f.set(N,{key:p,state:E}),c.push(E))},b=n.site.enclosingFunctionId,_=n.site.range.start,S=n.site.range.end;if(n.port.kind==="receiver")y({fn:b,ref:{kind:"call-receiver",at:_,end:S},stack:[],tracing:nt(_,S)});else{let E=Zy(n.site,n.port.index);E==="unknown"?s({kind:"unknown",functionId:b,reason:"binding"}):E==="absent"?s({kind:"constant",functionId:b,detail:"no argument"}):y({fn:b,ref:{kind:"argument",at:_,end:S,index:E},stack:[],tracing:nt(_,S)})}let k=0;for(;c.length>0;){if(k+=1,k>Pc){s({kind:"unknown",functionId:b,reason:"analysis-cap"});break}let E=c.pop();p=m(E);let N=e.into.get(E.fn),A=e.functions.get(E.fn);if(N===void 0||A===void 0){s({kind:"unknown",functionId:E.fn,reason:"not-emitted"});continue}let U=N.get(Io(E.ref));if(U!==void 0&&U.length>0){for(let W of U)E.tracing!==void 0&&W.from.kind==="mutated-by-call"&&nt(W.from.at,W.from.end)===E.tracing&&e.siteAt.get(`${A.declRange.path}\0${E.tracing}`)?.repeats===!1||y({...E,ref:W.from});if(E.ref.kind!=="param"&&E.ref.kind!=="receiver"&&E.ref.kind!=="call-result"&&E.ref.kind!=="mutated-by-call"&&E.ref.kind!=="free")continue}let $=E.ref;switch($.kind){case"constant":s({kind:"constant",functionId:E.fn});break;case"opaque":s({kind:"unknown",functionId:E.fn,reason:"opaque",detail:$.reason});break;case"source":s({kind:"source",functionId:E.fn,sourceClass:$.sourceClass,model:$.model}),g(E);break;case"free":s({kind:"unknown",functionId:E.fn,reason:"free",detail:$.name,class:$.binding==="module"?"module-binding":$.binding==="global"?"global":"free-name"});break;case"local":case"return":(U===void 0||U.length===0)&&s({kind:"constant",functionId:E.fn,detail:"undefined"});break;case"param":case"receiver":{let W=$.kind==="param"?A.sourceParams?.find(B=>B.index===$.index):void 0;W!==void 0&&(s({kind:"source",functionId:E.fn,sourceClass:W.sourceClass,model:W.model}),g(E));let w=E.stack[E.stack.length-1],P=w!==void 0?[{site:w,direct:!0}]:e.callers.get(E.fn)??[],j=W!==void 0?P.filter(B=>B.direct&&B.site.args!==void 0):P;if(W!==void 0&&j.length===0)break;let F=w!==void 0?E.stack.slice(0,-1):[];if(j.length===0){s({kind:"entry-parameter",functionId:E.fn,detail:$.kind==="param"?`param ${String($.index)}`:"receiver"});break}for(let{site:B,direct:ne}of j){if(!ne){s({kind:"unknown",functionId:B.enclosingFunctionId,reason:"binding",detail:"callback"});continue}let X=Ao(B,A);if(!X.known){s({kind:"unknown",functionId:B.enclosingFunctionId,reason:"binding",detail:X.reason});continue}let Q=B.range.start,Z=B.range.end,x=nt(Q,Z),T=B.enclosingFunctionId;if($.kind==="receiver"){X.receiver==="receiver-expression"?y({fn:T,ref:{kind:"call-receiver",at:Q,end:Z},stack:F,tracing:x}):X.receiver==="first-argument"?y({fn:T,ref:{kind:"argument",at:Q,end:Z,index:0},stack:F,tracing:x}):X.receiver==="none"?s({kind:"constant",functionId:T,detail:"no receiver"}):s({kind:"unknown",functionId:T,reason:"binding",detail:`receiver ${X.receiver}`});continue}let q=Cc(A).findIndex(z=>z.index===$.index),G=X.params[q];if(G===void 0||G.kind==="unknown")s({kind:"unknown",functionId:T,reason:"binding"});else if(G.kind==="absent")(U===void 0||U.length===0)&&s({kind:"constant",functionId:E.fn,detail:"no argument"});else for(let z of G.argIndexes)y({fn:T,ref:{kind:"argument",at:Q,end:Z,index:z},stack:F,tracing:x})}break}case"call-result":case"mutated-by-call":{let W=e.siteAt.get(`${A.declRange.path}\0${nt($.at,$.end)}`);if(W===void 0){s({kind:"unknown",functionId:E.fn,reason:"unresolved-call",detail:"no call site at offset",class:"not-emitted"});break}let w=e.callees.get(W.id)??[];if(w.length===0&&W.summary!==void 0){a(E,W,W.summary,$);break}if(w.length===0){s({kind:"unknown",functionId:E.fn,reason:"unresolved-call",...W.runtimeId!==void 0?{detail:W.runtimeId}:{},site:W.range,via:$.kind==="call-result"?"result":"mutation",class:l(W,$,null,A)});break}let P=E.stack.length>=Jy?[]:[...E.stack,W];for(let j of w){let F=e.functions.get(j);if(F===void 0||!e.into.has(j)){s({kind:"unknown",functionId:E.fn,reason:"opaque-callee",detail:j,site:W.range,via:$.kind==="call-result"?"result":"mutation",class:F===void 0?"not-emitted":l(W,$,F,A)});continue}if($.kind==="call-result"){y({fn:j,ref:{kind:"return"},stack:P});continue}let B=Ao(W,F);if(!B.known){s({kind:"unknown",functionId:E.fn,reason:"binding",detail:B.reason});continue}let ne=eb(B,$.index,F);if(ne==="unknown"){s({kind:"unknown",functionId:E.fn,reason:"binding",detail:"mutation target",site:W.range});continue}if(ne===null)continue;let X=(e.into.get(j)?.get(Io(ne))??[]).filter(Q=>Q.kind==="field"||Q.kind==="mutation");for(let Q of X)y({fn:j,ref:Q.from,stack:P})}break}case"argument":case"call-receiver":(U===void 0||U.length===0)&&s({kind:"unknown",functionId:E.fn,reason:"not-emitted",detail:"no flow into the argument"});break}}let v=[...t.values()],I=[...r.values()];return{outcome:v.some(E=>E.kind==="source")?"influenced":v.some(E=>E.kind==="unknown")||I.length>0?"unknown":v.some(E=>E.kind==="entry-parameter")?"reaches-entry-parameter":"no-source-reached",leaves:v,caveats:I,visited:d.size,...u!==void 0?{witness:u}:{}}}var xr={"no-contract":"cupel","no-source-model":"cupel","control-influence-unsupported":"cupel","analysis-cap":"cupel"};function fa(e){if(pa.includes(e))return{value:"unknown",kind:"no-contract"}}function kr(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"name-match":return"reachable-low";case"modeled":return"reachable-low"}}function zs(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function No(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let r=t.get(s.importId);if(r===void 0)continue;let o=n.get(r.moduleId)??[];o.push(s.resolvedModuleId),n.set(r.moduleId,o)}return n}function nb(e){let n=new Map,t=new Map(e.imports.map(s=>[s.id,s]));for(let s of e.importEdges){let r=t.get(s.importId);if(r===void 0)continue;let o=n.get(s.resolvedModuleId)??[];o.push(r.moduleId),n.set(s.resolvedModuleId,o)}return n}function tt(e){let n=No(e),t=new Set,s=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;s.length>0;){let r=s.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let o of n.get(r)??[])t.has(o)||s.push(o)}}return t}function tb(e,n){let t=nb(e),s=new Set,r=[n];for(;r.length>0;){let o=r.pop();if(!(o===void 0||s.has(o))){s.add(o);for(let i of t.get(o)??[])s.has(i)||r.push(i)}}return s}function sb(e,n,t){let s=No(e),r=zs(e),o=new Set,i=[n];for(;i.length>0;){let a=i.pop();if(a===void 0||o.has(a))continue;o.add(a);let l=r.get(a);if(l===void 0||l.externalSurface===!0||t.has(a))return!0;for(let d of s.get(a)??[])o.has(d)||i.push(d)}return!1}function wr(e,n,t,s=new Set){let r=No(e),o=zs(e),i=new Set,a=[],l=[n];for(;l.length>0;){let d=l.pop();if(d===void 0||i.has(d))continue;i.add(d);let c=o.get(d);if(c===void 0){a.push({module:d,kind:"absent"});continue}if(t.has(d)){a.push({module:d,kind:"unbounded"});continue}if(c.externalSurface===!0&&!s.has(d)){a.push({module:d,kind:"surface"});continue}for(let f of r.get(d)??[])i.has(f)||l.push(f)}return a}function Lc(e){let n=new Set(e.modules.filter(i=>i.isEntrypoint).map(i=>i.id)),t=new Map(e.functions.map(i=>[i.id,i])),s=zs(e),r=new Map;for(let i of e.functions)n.has(i.moduleId)&&(i.publicSurfaceReachable||i.name==="<toplevel>")&&r.set(i.id,i);let o=new Map(e.exports.map(i=>[i.id,i]));for(let i of e.exportBindings){if(i.target.kind!=="function")continue;let a=o.get(i.exportId);if(a===void 0||!n.has(a.moduleId))continue;let l=t.get(i.target.functionId);l===void 0||s.get(l.moduleId)?.externalSurface===!0||r.set(l.id,l)}return[...r.values()]}function ma(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),o=r[0]?.startsWith("@")===!0?2:1;return r.slice(o).join("/")}function rb(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let s=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(o=>[o.id,o]));return e.functions.find(o=>{if(o.name!==t.exportName)return!1;let i=n.get(o.moduleId);if(i===void 0||i.packageName!==t.packageName)return!1;if(s){if(o.kind!==t.symbolKind||o.enclosingClassId===void 0||r.get(o.enclosingClassId)?.name!==t.container)return!1}else if(o.kind!=="function"&&o.kind!=="class")return!1;return i.externalSurface===!0?!0:ma(i.path)===t.sourcePath})}function Mc(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&ma(t.path)===n.sourcePath)}function ob(e,n,t){if(!(t.symbolKind!=="function"||t.container!==null))for(let s of e.classes){if(s.name!==t.exportName)continue;let r=n.get(s.moduleId);if(r!==void 0&&r.externalSurface!==!0&&r.packageName===t.packageName&&ma(r.path)===t.sourcePath)return r}}function ib(e,n,t,s){let r=new Map(e.functions.map(o=>[o.id,o]));return e.callSites.some(o=>o.calleeExprShape!=="member"||o.resolution!=="resolved"?!1:o.resolvedTargetIds.some(i=>{let a=r.get(i);if(a?.name!==s.exportName)return!1;let l=n.get(a.moduleId);return l?.externalSurface===!0&&l.packageName===s.packageName&&t.has(a.moduleId)}))}function ab(e,n,t){return t.container===null?!0:e.classes.some(s=>{if(s.name!==t.container)return!1;let r=n.get(s.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function Dc(e,n){switch(n){case"resolved":return!0;case"field-based":return e!=="all-resolved";case"name-match":return e==="name-match";case"unresolved":return!1}}function lb(e,n,t){let s=new Map(e.callSites.map(f=>[f.id,f.enclosingFunctionId])),r=new Map,o=[],i=f=>{let p=s.get(f.callSiteId);if(p===void 0)return;let u=r.get(p)??[];u.push({to:f.calleeFunctionId,res:f.resolution,site:f.callSiteId}),r.set(p,u)};for(let f of e.callEdges)f.resolution==="name-match"?o.push(f):i(f);for(let f of o)i(f);let a=f=>{let p=new Set,u=n.map(m=>({id:m.id,prev:null,via:null,label:null}));for(let m of u)p.add(m.id);for(;u.length>0;){let m=u.shift();if(m===void 0)break;if(m.id===t){let g=[],y=[],b=[];for(let _=m;_!==null;_=_.prev)g.unshift(_.id),y.unshift(_.via),b.unshift(_.label);return{path:g,via:y,labels:b}}for(let g of r.get(m.id)??[])g.res==="unresolved"||!Dc(f,g.res)||p.has(g.to)||(p.add(g.to),u.push({id:g.to,prev:m,via:g.site,label:g.res}))}return null},l=a("all-resolved");if(l!==null)return{...l,quality:"all-resolved"};let d=a("field-based");if(d!==null)return{...d,quality:"field-based"};if(o.length===0)return null;let c=a("name-match");return c!==null?{...c,quality:"name-match"}:null}function ga(e,n,t){let s=new Map(e.callSites.map(y=>[y.id,y.enclosingFunctionId])),r=new Map,o=new Map,i=[],a=(y,b,_)=>{let S=y.get(b);S===void 0?y.set(b,[_]):S.push(_)};for(let y of e.callEdges){if(!Dc(t,y.resolution))continue;let b=s.get(y.callSiteId);if(b===void 0)continue;let _=y.calleeFunctionId;a(r,b,_),a(o,_,b),i.push({from:b,to:_,site:y.callSiteId})}let l=new Set,d=Lc(e).map(y=>y.id);for(let y of d)l.add(y);for(let y=0;y<d.length;y+=1)for(let b of r.get(d[y])??[])l.has(b)||(l.add(b),d.push(b));if(!l.has(n))return null;let c=new Map([[n,0]]),f=[n];for(let y=0;y<f.length;y+=1){let b=f[y],_=(c.get(b)??0)+1;for(let S of o.get(b)??[])c.has(S)||!l.has(S)||(c.set(S,_),f.push(S))}let p=(y,b)=>y<b?-1:y>b?1:0,u=[...c].map(([y,b])=>({functionId:y,distance:b})).sort((y,b)=>y.distance-b.distance||p(y.functionId,b.functionId)),m=new Set,g=i.filter(y=>c.has(y.from)&&c.has(y.to)).filter(y=>{let b=JSON.stringify([y.from,y.to,y.site]);return m.has(b)?!1:(m.add(b),!0)}).sort((y,b)=>p(y.from,b.from)||p(y.to,b.to)||p(y.site,b.site));return{functions:u,edges:g}}function Tc(e,n){let t=new Set,s=[...e];for(let r=s.pop();r!==void 0;r=s.pop())if(!t.has(r)){t.add(r);for(let o of n(r)??[])t.has(o)||s.push(o)}return t}var $c=new WeakMap;function db(e,n){let t=$c.get(n);if(t!==void 0&&t.graph===e)return t.reach;let s=tt(e),r=n.filter(i=>i.reach.kind==="dependency-dispatch"&&s.has(i.source)).map(i=>i.source),o=new Set;if(r.length>0){let i=No(e),a=Tc(r,f=>i.get(f)),l=e.functions.filter(f=>s.has(f.moduleId)&&(a.has(f.moduleId)||f.addressTaken!==!1)).map(f=>f.id),d=new Map(e.callSites.map(f=>[f.id,f.enclosingFunctionId])),c=new Map;for(let f of e.callEdges){if(f.resolution==="unresolved")continue;let p=d.get(f.callSiteId);if(p===void 0)continue;let u=c.get(p);u===void 0?c.set(p,[f.calleeFunctionId]):u.push(f.calleeFunctionId)}o=Tc(l,f=>c.get(f))}return $c.set(n,{graph:e,reach:o}),o}function ha(e){return Fc(e,zs(e),tt(e),jc(e))}function Fc(e,n,t,s){let r=[],o=[],i=new Map(e.functions.map(l=>[l.id,l.moduleId])),a=l=>l!==void 0&&t.has(l)&&s.has(n.get(l)?.packageName??"");for(let l of e.callSites)l.resolution==="unresolved"&&a(i.get(l.enclosingFunctionId))&&r.push(l.range);for(let l of e.imports)!l.specifierIsLiteral&&t.has(l.moduleId)&&o.push({path:n.get(l.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:o}}function jc(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function cb(e,n,t,s){let r=new Map(e.functions.map(a=>[a.id,a])),o=zs(e),i=new Map(e.callSites.map(a=>[a.id,a]));return n.map((a,l)=>{let d=r.get(a),c=d!==void 0?o.get(d.moduleId):void 0,f=t[l];return{functionId:a,functionName:d?.name,modulePath:c?.path??"",calledAt:f==null?null:i.get(f)?.range??null,via:s[l]??null}})}function ya(e){return ub(fb(e))}function ub(e){if(He(e.tier)!==(e.reasonKind!==void 0))throw new Error(`engine invariant: tier ${e.tier} with reasonKind ${String(e.reasonKind)} (a reason kind is set iff the tier is Potentially reachable)`);if(e.reasonKind!==void 0&&yt[e.reasonKind]!==e.tier)throw new Error(`engine invariant: reasonKind ${e.reasonKind} belongs in ${yt[e.reasonKind]}, not ${e.tier}`);return e}function fb(e){let{graph:n,installed:t,range:s,symbol:r,coverage:o}=e,i=[],a={unresolvedSites:i,unresolvedEvidence:{own:i,sets:[]}},l=X=>({unresolvedSites:X,unresolvedEvidence:{own:X,sets:[]}}),d=jc(n),c=new Set;for(let X of e.incompleteness)X.reach.kind==="unbounded"&&c.add(X.source);let f=e.incompleteness.some(X=>X.reach.kind==="assumed-bounded")?"loader-assumption":"complete",p=X=>X==="not-reachable"?f:void 0,u=void 0,m=new Map,g=X=>{let Q=m.get(X);return Q===void 0&&(Q=sb(n,X,c),m.set(X,Q)),Q},y=X=>X.reach.kind==="class-scope"&&r!==null&&r.packageName===X.reach.packageName&&r.container===X.reach.container,b=X=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let Q of da)for(let Z of e.incompleteness)if(Z.cause===Q&&X(Z))return{cause:Z.cause,source:Z.source};return null},_=(X,Q)=>{let Z;return b(x=>x.reach.kind==="unbounded"?!0:x.reach.kind==="class-scope"?y(x):x.reach.kind==="dependency-dispatch"?Q===void 0||db(n,e.incompleteness).has(Q):x.reach.kind==="loaded-package"?(s.ecosystem??"npm")===x.reach.ecosystem:X===void 0||g(x.reach.anchor)?!0:(Z??=tb(n,X),Z.has(x.reach.anchor)))},S=()=>b(X=>X.reach.kind==="unbounded"?!0:X.reach.kind==="class-scope"?y(X):X.reach.kind==="dependency-dispatch"?!1:X.reach.kind==="loaded-package"?(s.ecosystem??"npm")===X.reach.ecosystem&&(X.reach.alsoLoaded?.includes(s.packageName)??!1):g(X.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${s.packageName} is not installed`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-affected"),path:void 0,...a};let k;try{if((t.ecosystem??"npm")!==(s.ecosystem??"npm"))throw new Error("ecosystem mismatch");k=$t(t.version,s)}catch{return{tier:$e("version-undecidable"),decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,reasonKind:"version-undecidable",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a}}if(!k)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${s.packageName}@${t.version} is outside the affected range`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-affected"),path:void 0,...a};let v=zs(n),I=tt(n),O=X=>{if(X.cause!=="dynamic-load"||X.source===null)return i;let Q=v.get(X.source);return Q===void 0?i:[{path:Q.path,start:0,end:0}]},{dispatch:E,load:N}=Fc(n,v,I,d),A=[...E,...N],U={unresolvedSites:N,unresolvedEvidence:{own:i,sets:["load"]}},$={unresolvedSites:A,unresolvedEvidence:{own:i,sets:["dispatch","load"]}},W=X=>{for(let Q of I)if(v.get(Q)?.packageName===X)return!0;return!1},w=X=>({tier:$e("incomplete-surface"),decidedAtStage:X,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,reasonKind:"incomplete-surface",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a}),P=()=>{if(!W(s.packageName)){if(N.length>0)return{tier:$e("dynamic-load"),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,reasonKind:"dynamic-load",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...U};let X=S();return X!==null?{tier:$e(X.cause),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,reasonKind:X.cause,attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...l(O(X))}:t!==null&&t.outOfGraphExecution.length>0?{tier:$e("analysis-cap"),decidedAtStage:"symbol-reachable",reason:`${s.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,reasonKind:"analysis-cap",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${s.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${s.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-reachable"),path:void 0,...a}}return null};if(r===null||!r.verified)return{tier:$e(r===null?"db-gap":"unverified-symbol"),decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",reasonKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};if(o!==null&&!o.comparedPaths.has(r.sourcePath))return{tier:$e("db-gap"),decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,reasonKind:"db-gap",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:$e("symbol-unsupported"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,reasonKind:"symbol-unsupported",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};let j=rb(n,v,r);if(j===void 0||!I.has(j.moduleId)){if(j===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&ib(n,v,I,r))return{tier:$e("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,reasonKind:"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};if(j===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!ab(n,v,r))return{tier:$e("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,reasonKind:"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};if(j===void 0){let x=ob(n,v,r);if(x!==void 0&&I.has(x.id))return{tier:$e(N.length>0?"dynamic-load":"dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a class a loaded module declares, and the graph holds no node for constructing it \u2014 a class cannot be shown unused without one`,reasonKind:N.length>0?"dynamic-load":"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$}}let X=P();if(X!==null)return X;if(A.length>0){let x=j!==void 0?v.get(j.moduleId):Mc(n,r),T=j===void 0&&x!==void 0&&x.externalSurface!==!0&&I.has(x.id)&&!d.has(x.packageName);return{tier:$e(N.length>0?"dynamic-load":T?"dep-opaque":"dispatch"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,reasonKind:N.length>0?"dynamic-load":T?"dep-opaque":"dispatch",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$}}let Q=j!==void 0?v.get(j.moduleId):Mc(n,r);if(j===void 0&&Q!==void 0&&Q.externalSurface!==!0&&I.has(Q.id)&&!d.has(Q.packageName))return{tier:$e("dep-opaque"),decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,reasonKind:"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a};let Z=Q!==void 0?_(Q.id,j?.id):S();return Z!==null?{tier:$e(Z.cause),decidedAtStage:j===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,reasonKind:Z.cause,attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...l(O(Z))}:s.surfaceComplete?{tier:"not-reachable",decidedAtStage:j===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-reachable"),path:void 0,...a}:w(j===void 0?"symbol-reachable":"module-reachable")}let F=j.kind==="class",B=lb(n,Lc(n),j.id);if(B!==null)return{tier:kr(B.quality),decidedAtStage:"call-path-confirmed",reason:F?`${r.exportName} is a class, and a path from an application entrypoint constructs it or a class below it`:`${r.exportName} is called from an application entrypoint`,reasonKind:void 0,attribution:Ro(r),pathQuality:B.quality,basis:p("reachable-high"),path:cb(n,B.path,B.via,B.labels),...a};if(A.length>0)return{tier:$e(N.length>0?"dynamic-load":F?"dep-opaque":"dispatch"),decidedAtStage:"call-path-confirmed",reason:F?`no path constructs the class ${r.exportName}, but unresolved edges exist \u2014 and a class is used by more than its construction`:`no resolved call path to ${r.exportName}, but unresolved edges exist`,reasonKind:N.length>0?"dynamic-load":F?"dep-opaque":"dispatch",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...$};let ne=_(j.moduleId,j.id);return ne!==null?{tier:$e(ne.cause),decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,reasonKind:ne.cause,attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...l(O(ne))}:s.surfaceComplete?F?{tier:$e("dep-opaque"),decidedAtStage:"call-path-confirmed",reason:`no path constructs the class ${r.exportName}, but a class is also used through subclasses, class attributes and class methods, which the call graph does not enumerate \u2014 cannot confirm it is unused`,reasonKind:"dep-opaque",attribution:void 0,pathQuality:void 0,basis:u,path:void 0,...a}:{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,reasonKind:void 0,attribution:void 0,pathQuality:void 0,basis:p("not-reachable"),path:void 0,...a}:w("call-path-confirmed")}function pb(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function mb(e,n,t){let s=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let o=n.get(r.moduleId);if(!(o===void 0||o.packageName!==t.packageName||(r.enclosingClassId!==void 0?s.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function gb(e,n,t){if(n===t)return[];let s=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.callSites.map(l=>[l.id,l])),o=new Map;for(let l of e.callEdges){if(l.resolution==="unresolved")continue;let d=r.get(l.callSiteId);if(d===void 0)continue;let c=d.enclosingFunctionId;if(!s.has(c)||!s.has(l.calleeFunctionId))continue;let f=o.get(c),p={to:l.calleeFunctionId,label:l.resolution};f===void 0?o.set(c,[p]):f.push(p)}let i=new Set([n]),a=[{at:n,labels:[]}];for(let l=0;l<a.length;l++){let d=a[l];for(let c of o.get(d.at)??[]){if(i.has(c.to))continue;let f=[...d.labels,c.label];if(c.to===t)return f;i.add(c.to),a.push({at:c.to,labels:f})}}return null}function vr(e,n,t,s,r){if(r.length===0)return null;let o=Eo(e,n,t);if(o.length===0)return null;let i=mb(e,n,s);for(let a of r){let l=o.filter(c=>c.packageName===a.anchor.packageName&&c.exportName===a.anchor.exportName&&c.container===a.anchor.container),d=l.find(c=>c.resolution==="resolved")??l[0];if(d!==void 0){if(pb(a.callee,s))return{tier:kr("modeled"),pathQuality:"modeled",modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&i!==null){let c=gb(e,a.callee.realFunctionId,i);if(c!==null)return{tier:kr("modeled"),pathQuality:"modeled",modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[d.resolution,"modeled",...c]}}}}return null}var Bc=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Gc=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","potentially-reachable-not-ruled-out","potentially-reachable-not-analysed"],pa=["reachable-high","reachable-medium","reachable-low"],Kc=new Set(pa),ys=["potentially-reachable-not-ruled-out","potentially-reachable-not-analysed"],hb=new Set(ys);function He(e){return hb.has(e)}function Yt(e){return ys.reduce((n,t)=>n+e[t],0)}function Ro(e){return e.verified?"gated":"candidate"}var Er=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],ba=["cupel","project"],Fn={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function zc(e){return Fn[e]}var yt={dispatch:"potentially-reachable-not-ruled-out","dynamic-load":"potentially-reachable-not-ruled-out","dep-opaque":"potentially-reachable-not-ruled-out","no-entrypoint":"potentially-reachable-not-analysed","analyzer-crash":"potentially-reachable-not-analysed","version-undecidable":"potentially-reachable-not-analysed","db-gap":"potentially-reachable-not-analysed","unverified-symbol":"potentially-reachable-not-analysed","symbol-unsupported":"potentially-reachable-not-analysed","resolution-divergence":"potentially-reachable-not-analysed","analysis-cap":"potentially-reachable-not-analysed","coverage-gap":"potentially-reachable-not-analysed","incomplete-surface":"potentially-reachable-not-analysed"};function $e(e){return yt[e]}import{randomBytes as Gd}from"node:crypto";import{performance as hr}from"node:perf_hooks";import au from"node:path";import{closeSync as yb,constants as Wc,fstatSync as bb,openSync as _b,readSync as Sb,realpathSync as Uc}from"node:fs";import _a from"node:path";var xb=8*1024*1024;function Ws(e){return e==="PyPI"?"utf8-bytes":"utf16-units"}var Jt=class{#e;#n;#t=new Map;constructor(n,t=xb){this.#n=t;let s;try{s=Uc(n)}catch{s=null}this.#e=s}read(n){let t=this.#t.get(n);if(t!==void 0)return t;let s=this.#s(n);return this.#t.set(n,s),s}#s(n){let t=this.#e;if(t===null||n===""||_a.isAbsolute(n))return null;let s;try{s=Uc(_a.join(t,n))}catch{return null}if(s!==t&&!s.startsWith(`${t}${_a.sep}`))return null;let r;try{r=_b(s,Wc.O_RDONLY|Wc.O_NONBLOCK)}catch{return null}try{let o=bb(r);if(!o.isFile()||o.size>this.#n)return null;let i=Buffer.alloc(o.size),a=0;for(;a<o.size;){let l=Sb(r,i,a,o.size-a,a);if(l===0)break;a+=l}return a===o.size?i:null}catch{return null}finally{yb(r)}}};function Hc(e,n,t){if(!Number.isInteger(n)||n<0)return null;if(t==="utf8-bytes"){if(n>e.length)return null;let i=e.subarray(0,n),a=1;for(let d of i)d===10&&(a+=1);let l=i.lastIndexOf(10)+1;return[a,e.subarray(l,n).toString("utf8").length+1]}let s=e.toString("utf8");if(n>s.length)return null;let r=s.slice(0,n),o=1;for(let i=0;i<r.length;i+=1)r.charCodeAt(i)===10&&(o+=1);return[o,n-(r.lastIndexOf(`
+`)+1)+1]}function Qt(e,n,t){if(n.end<n.start)return null;let s=e.read(n.path);if(s===null)return null;let r=Hc(s,n.start,t),o=Hc(s,n.end,t);return r===null||o===null?null:{startLine:r[0],startColumn:r[1],endLine:o[0],endColumn:o[1]}}var kb="cupel/influence-shadow/2",qc=64,Vc=16,wb=e=>Kc.has(e);function Oo(e){let n=new Map(e.functions.map(t=>[t.id,t.moduleId]));return{...e,functions:e.functions.map(t=>({...t,declRange:{...t.declRange,path:t.moduleId}})),callSites:e.callSites.map(t=>{let s=n.get(t.enclosingFunctionId);return s===void 0?t:{...t,range:{...t.range,path:s}}})}}function Xc(e,n,t,s=()=>null,r=null){let o=t(),i={graph:e,lineOf:s},a={npm:i,PyPI:r},l=new Map,d=_=>{let S=l.get(_);return S===void 0&&(S=Ks(_.graph),l.set(_,S)),S};d(i);let c=Object.fromEntries(ua.map(_=>[_,0])),f=0,p=0,u=_=>S=>{let{site:k,...v}=S;return k===void 0?v:{...v,site:{...k,line:_.lineOf?.(k)??null}}},m={influenced:0,"no-source-reached":0,"reaches-entry-parameter":0,unknown:0},g={},y=0,b=[];for(let _ of n){if(!wb(_.tier))continue;let S={advisoryId:_.advisoryId,packageName:_.packageName,version:_.version,ecosystem:_.ecosystem,symbol:_.symbolName,tier:_.tier},k=_.ecosystem==="npm"||_.ecosystem==="PyPI"?a[_.ecosystem]:null;if(k===null){b.push({...S,skipped:_.ecosystem==="PyPI"?"this scan holds no Python graph to ask":`no front-end emits value flows for ${_.ecosystem}`,sites:[],truncatedSites:!1});continue}let v=d(k),I=u(k),O=_.path?.[_.path.length-1]?.functionId,E=O!==void 0?(v.callers.get(O)??[]).filter(A=>A.direct).map(A=>A.site):[],N=[];for(let A of E.slice(0,qc)){let U=[],$=A.args?.length??1,W=(w,P)=>{let j=Sr(v,{site:A,port:P});y+=1,m[j.outcome]+=1,j.caveats.length>0&&(p+=1);for(let F of j.leaves)F.kind==="unknown"&&F.reason!==void 0&&(g[F.reason]=(g[F.reason]??0)+1),(F.kind==="unknown"||F.kind==="entry-parameter")&&(F.class===void 0?f+=1:c[F.class]+=1);U.push({port:w,outcome:j.outcome,leaves:j.leaves.map(I),caveats:j.caveats,visited:j.visited,...j.witness!==void 0?{witness:j.witness}:{}})};for(let w=0;w<Math.min($,Vc);w+=1)W(`arg[${String(w)}]`,{kind:"arg",index:w});A.receiverRange!==void 0&&W("receiver",{kind:"receiver"}),N.push({path:A.range.path,start:A.range.start,enclosing:A.enclosingFunctionId,ports:U,truncatedArgs:$>Vc})}b.push({...S,sites:N,truncatedSites:E.length>qc})}return{format:kb,findings:b,totals:{findings:b.length,ports:y,byOutcome:m,unknownReasons:g,identityCollisions:[...l.values()].reduce((_,S)=>_+S.identityCollisions,0),byClass:c,unclassified:f,portsWithCaveats:p},wallMs:Math.round((t()-o)*10)/10}}function tn(e){return Buffer.byteLength(JSON.stringify(e),"utf8")}function Po(e,n){return 2+e+Math.max(n-1,0)}function Yc(e){return String(e).length}var Zt=class{#e;constructor(n,t){let s=new Float64Array(n+2);for(let[r,o]of t)s[r+1]=(s[r+1]??0)+o;for(let r=1;r<s.length;r+=1)s[r]=(s[r]??0)+(s[r-1]??0);this.#e=s}below(n){return this.#e[n]??0}},xa=class{index;finding;key;size;kept;#e;#n;#t;#s;#o;#r;#a;#i;#l;#d;#c;#u;#f;constructor(n,t,s,r){this.index=n,this.finding=t,this.key=r,this.size=s.nodes.length,this.kept=s.nodes.length,this.#e=s,this.#n=t.influence?.overlay??null;let o=this.size,i=new Map;s.nodes.forEach((u,m)=>{i.has(u.id)||i.set(u.id,m)}),this.#t=i;let a=u=>i.get(u)??o,l=u=>Math.max(a(u.from),a(u.to));this.#s=new Zt(o,s.nodes.map((u,m)=>[m,tn(u)])),this.#o=new Zt(o,s.edges.map(u=>[l(u),tn(u)])),this.#r=new Zt(o,s.edges.map(u=>[l(u),1])),this.#c=tn({...s,nodes:[],edges:[],truncated:0})-5;let d=this.#n,c=d?.inputs??[];this.#a=new Zt(o,c.map(u=>[a(u.node),tn(u)])),this.#i=new Zt(o,c.map(u=>[a(u.node),1]));let f=0,p=[];for(let u of d?.blockers??[]){let m=tn(u.node===null?u:{...u,node:null});f+=m,u.node!==null&&p.push([a(u.node),tn(u)-m])}this.#l=new Zt(o,p),this.#d=f,this.#u=d===null?0:tn({...d,inputs:[],blockers:[],truncated:0})-5,this.#f=tn(s)+(d===null?0:tn(d))}bytesAt(n){if(n===this.size)return this.#f;let t=this.#c+Po(this.#s.below(n),n)+Po(this.#o.below(n),this.#r.below(n))+Yc(this.#e.truncated+(this.size-n)),s=this.#n;if(s===null)return t;let r=this.#i.below(n);return t+this.#u+Po(this.#a.below(n),r)+Po(this.#d+this.#l.below(n),s.blockers.length)+Yc(s.truncated+(s.inputs.length-r))}cut(){let n=this.kept,t=p=>(this.#t.get(p)??this.size)<n,s=this.#e,r=s.edges.filter(p=>t(p.from)&&t(p.to)),o={...s,nodes:s.nodes.slice(0,n),edges:r,truncated:s.truncated+(this.size-n)},i=this.#n,a=this.finding;if(i===null||a.influence===null)return{finding:{...a,reach:o},calls:s.edges.length-r.length,inputs:0,offGraph:0};let l=i.inputs.filter(p=>t(p.node)),d=0,c=i.blockers.map(p=>p.node===null||t(p.node)?p:(d+=1,{...p,node:null})),f={...i,inputs:l,blockers:c,truncated:i.truncated+(i.inputs.length-l.length)};return{finding:{...a,reach:o,influence:{...a.influence,overlay:f}},calls:s.edges.length-r.length,inputs:i.inputs.length-l.length,offGraph:d}}};function Sa(e,n){return e<n?-1:e>n?1:0}function vb(e,n){return Sa(e.finding.advisoryId,n.finding.advisoryId)||Sa(e.finding.packageName,n.finding.packageName)||Sa(e.key,n.key)}function Jc(e,n,t){let s=tn(e);if(s<=n)return{payload:e,bytes:s,cut:null};let r=e.findings.flatMap((g,y)=>g.reach!==null&&g.reach.nodes.length>1?[new xa(y,g,g.reach,t(g))]:[]);if(r.length===0)return{payload:e,bytes:s,cut:null};r.sort(vb);let o=r.reduce((g,y)=>Math.max(g,y.size),0),i=s;for(let g=o;g>1&&i>n;g-=1)for(let y of r){if(i<=n)break;y.size<g||(i+=y.bytesAt(y.kept-1)-y.bytesAt(y.kept),y.kept-=1)}let a=new Map(r.filter(g=>g.kept<g.size).map(g=>[g.index,g]));if(a.size===0)return{payload:e,bytes:s,cut:null};let l=0,d=0,c=0,f=0,p=e.findings.map((g,y)=>{let b=a.get(y);if(b===void 0)return g;let _=b.cut();return l+=b.size-b.kept,d+=_.calls,c+=_.inputs,f+=_.offGraph,_.finding}),u={...e,findings:p},m=tn(u);return{payload:u,bytes:m,cut:{budget:n,bytesBefore:s,bytesAfter:m,graphsCut:a.size,functionsCut:l,callsCut:d,inputsCut:c,blockersOffGraph:f,exhausted:m>n}}}function Qc(e){let n=0,t=0,s=0,r=0;for(let l of e.findings){l.reach!==null&&(n+=tn(l.reach));let d=l.influence?.overlay??null;d!==null&&(t+=tn(d)),l.path!==null&&(s+=tn(l.path)),r+=tn(l.unresolvedSites)}let o=0;for(let l of e.advisories)l.details!==null&&(o+=tn(l.details));let i=tn(e.findings),a=tn(e.advisories);return[{name:"the reach graphs",bytes:n},{name:"the influence overlays",bytes:t},{name:"the call paths",bytes:s},{name:"the findings' own unresolved sites",bytes:r},{name:"the rest of the findings",bytes:i-n-t-s-r},{name:"the app-global unresolved sets",bytes:tn(e.unresolved)},{name:"the advisory descriptions",bytes:o},{name:"the rest of the advisory records",bytes:a-o},{name:"the package graphs",bytes:tn(e.packageGraphs)}].sort((l,d)=>d.bytes-l.bytes)}function Zc(e){let n=e.exhausted?`; every graph is down to its vulnerable function and the payload is still ${String(e.bytesAfter)} bytes`:"";return`the findings payload was ${String(e.bytesBefore)} bytes, over its ${String(e.budget)}-byte budget, so ${String(e.graphsCut)} reach graph(s) were cut nearest the vulnerable function first (ADR-120): ${String(e.functionsCut)} function(s) dropped and counted in each graph's \`truncated\`, with the ${String(e.callsCut)} call(s) that touched them and the ${String(e.inputsCut)} overlay input(s) on them${n}`}function jn(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function eu(e,n={}){let t=n.maxBytes??1073741824,s=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((o,i)=>{let a=r(e,n.headers!==void 0?{headers:n.headers}:{},l=>{let d=l.statusCode??0;if(d<200||d>=300){l.resume(),i(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let c=[],f=0;l.on("data",p=>{if(f+=p.length,f>t){l.destroy(),i(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}c.push(p)}),l.on("end",()=>{o(Buffer.concat(c))}),l.on("error",i)});a.on("error",i),a.setTimeout(s,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(s)}ms`))})})}async function Ar(e,n,t,s,r,o=3e4){let{request:i}=await import("node:https"),a=new URL(n).hostname;return await new Promise((l,d)=>{let c=i(n,{method:e,headers:t},f=>{let p=[],u=0;f.on("data",m=>{if(u+=m.length,u>r){f.destroy(),d(new Error(`${e} to ${a} returned more than ${String(r)} bytes`));return}p.push(m)}),f.on("end",()=>{l({status:f.statusCode??0,body:Buffer.concat(p).toString("utf8")})}),f.on("error",()=>{d(new Error(`${e} to ${a} failed`))})});c.on("error",()=>{d(new Error(`${e} to ${a} failed`))}),c.setTimeout(o,()=>{c.destroy(new Error(`${e} to ${a} timed out after ${String(o)}ms`))}),s!==void 0&&c.write(s),c.end()})}var Ir="api.cupel.sh",Eb=`https://${Ir}/v1/findings`,Ab=64*1024,bs=8*1024*1024,Ib=3e4,es=class extends Error{constructor(n){super(n),this.name="PushError"}};async function nu(e,n,t,s={}){if(e.length>bs)throw new es(`findings payload is ${String(e.length)} bytes, over the ${String(bs)}-byte limit`);let r=jn(Eb,new Set([Ir])),o;try{o=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,s.timeoutMs??Ib)}catch{throw new es(`the findings push to ${Ir} failed`)}if(o.body.length>Ab)throw new es("the control plane returned a response larger than it should");if(!(o.status===202||o.status===200))throw o.status===401||o.status===403?new es("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):o.status===400?new es("the control plane rejected the findings payload as malformed"):new es(`the findings push was refused with status ${String(o.status)}`)}var Nb=14,ns={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:1024,maxAdvisoryDetails:8e3,maxReachNodes:512,maxReachEdges:2048,maxPackageGraphNodes:256,maxPackageGraphEdges:1024,maxPackageGraphs:2e4,maxSourcePosition:1e7},Rb=7.5*1024*1024,Vn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function wa(e){return{path:e.path,start:e.start,end:e.end}}function Ob(e){let n=He(e.tier);if(n&&e.reasonKind===void 0)throw new Vn(`finding ${e.advisoryId} is ${e.tier} with no reason kind \u2014 a Potentially reachable finding without its kind is a hedge`);if(!n&&e.reasonKind!==void 0)throw new Vn(`finding ${e.advisoryId} is ${e.tier} but carries reason kind ${e.reasonKind} \u2014 only a Potentially reachable finding has one`);if(e.reasonKind!==void 0&&$e(e.reasonKind)!==e.tier)throw new Vn(`finding ${e.advisoryId} is ${e.tier} but its reason kind ${e.reasonKind} puts it in ${$e(e.reasonKind)}`);let t=n?e.reasonKind:null,s=e.modelId??null,r=e.modelPromotedFromKind??null;if(s===null!=(r===null))throw new Vn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(s!==null&&e.tier!=="reachable-low")throw new Vn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,symbolContainer:e.symbolContainer,symbolPath:e.symbolPath,severity:e.severity,tier:e.tier,reason:e.reason,reasonKind:t,reasonOwner:t===null?null:zc(t),basis:e.basis??null,path:Pb(e),unresolvedSites:e.unresolvedEvidence.own.map(wa),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:s,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null,reach:Cb(e),introducedBy:e.introducedBy??null,influence:e.influence===void 0?null:{value:e.influence.value,kind:e.influence.kind,owner:xr[e.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null,overlay:e.influenceOverlay??null}}}function tu(e){return e===null?null:{line:e.line,column:e.column}}function Pb(e){if(e.path===void 0)return null;let n=e.located?.path??null;return n!==null&&n.length===e.path.length?n.map((t,s)=>({functionName:e.path?.[s]?.functionName??null,modulePath:t.modulePath,line:t.line,column:t.column,callSite:tu(t.callSite)})):e.path.map(t=>({functionName:t.functionName??null,modulePath:t.modulePath,line:null,column:null,callSite:null}))}function Cb(e){let n=e.located?.reach??null;return n===null?null:{nodes:n.nodes.map(t=>({id:t.id,functionName:t.functionName,modulePath:t.modulePath,line:t.line,column:t.column})),edges:n.edges.map(t=>({from:t.from,to:t.to,callSite:tu(t.callSite)})),truncated:n.truncated}}var ka="";function su(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];if(e.ecosystem==="npm")return n.join(ka);let{symbolContainer:t,symbolPath:s}=e;return t===null&&s===null?[...n,e.ecosystem].join(ka):[...n,e.ecosystem,t??"",s??""].join(ka)}function Mb(e){let n=new Map;for(let t of e){let s=su(t),r=n.get(s);if(r===void 0){n.set(s,t);continue}if(r.tier!==t.tier||r.reasonKind!==t.reasonKind)throw new Vn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Tb(e){let n=ns,t=(s,r,o)=>{throw new Vn(`${s} has ${String(r)} entries, over the ${String(o)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let s of["dispatch","load"]){let r=e.unresolved[s].length;r>n.maxUnresolvedSites&&t(`the app-global ${s} set`,r,n.maxUnresolvedSites)}for(let s of e.findings)s.path!==null&&s.path.length>n.maxPathSteps&&t(`the call path of finding ${s.advisoryId}`,s.path.length,n.maxPathSteps),s.reach!==null&&s.reach.nodes.length>n.maxReachNodes&&t(`the reach graph of finding ${s.advisoryId}`,s.reach.nodes.length,n.maxReachNodes),s.reach!==null&&s.reach.edges.length>n.maxReachEdges&&t(`the reach graph's calls of finding ${s.advisoryId}`,s.reach.edges.length,n.maxReachEdges),s.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${s.advisoryId}`,s.unresolvedSites.length,n.maxUnresolvedSites);e.packageGraphs.length>n.maxPackageGraphs&&t("the package graphs list",e.packageGraphs.length,n.maxPackageGraphs);for(let s of e.packageGraphs)s.nodes.length>n.maxPackageGraphNodes&&t(`package graph ${s.id}`,s.nodes.length,n.maxPackageGraphNodes),s.edges.length>n.maxPackageGraphEdges&&t(`the links of package graph ${s.id}`,s.edges.length,n.maxPackageGraphEdges);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let s of e.advisories){if(s.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${s.id}`,s.ranges.length,n.maxAdvisoryRanges),s.summary!==null&&s.summary.length>n.maxStringLength)throw new Vn(`the summary of advisory ${s.id} is ${String(s.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(s.details!==null&&s.details.length>n.maxAdvisoryDetails)throw new Vn(`the description of advisory ${s.id} is ${String(s.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function $b(e,n){let t=new Set(n.map(s=>s.advisoryId));return e.advisories.filter(s=>t.has(s.advisory.id)).map(s=>({id:s.advisory.id,cveId:s.advisory.cveId,osvId:s.advisory.osvId,summary:s.advisory.summary,details:s.advisory.details??null,severity:s.advisory.severity,published:s.advisory.published,source:s.advisory.source,ranges:s.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function Lb(e,n){let t=new Set(n.flatMap(s=>s.introducedBy===null?[]:[s.introducedBy]));return(e.packageGraphs??[]).filter(s=>t.has(s.id)).map(s=>({id:s.id,nodes:s.nodes.map(r=>({id:r.id,name:r.name,version:r.version,direct:r.direct,declaredIn:r.declaredIn===null?null:{path:r.declaredIn.path,line:r.declaredIn.line}})),edges:s.edges.map(r=>({from:r.from,to:r.to})),truncated:s.truncated}))}function Db(e){if(e.bytes<=bs)return;let n=i=>`${i.name} (${String(i.bytes)} bytes, ${String(Math.round(100*i.bytes/e.bytes))}%)`,[t,s]=Qc(e.payload),r=e.payload.findings.flatMap(i=>i.reach===null?[]:[i.reach]),o=r.length===0?"with no reach graph to cut":r.every(i=>i.nodes.length<=1)?"with every reach graph cut to its vulnerable function":"with its reach graphs as built";throw new Vn(`the findings payload is ${String(e.bytes)} bytes, over the ${String(bs)}-byte limit, ${o} (ADR-120); its largest part is ${t===void 0?"unknown":n(t)}${s===void 0?"":`, then ${n(s)}`}`)}function ru(e,n,t={}){let s=Mb(e.findings.map(Ob)),r={version:Nb,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:s,unresolved:{dispatch:e.unresolved.dispatch.map(wa),load:e.unresolved.load.map(wa)},advisories:$b(e,s),packageGraphs:Lb(e,s)};Tb(r);let o=Jc(r,t.byteBudget??Rb,su);return o.cut!==null&&t.onCut?.(o.cut),Db(o),o.payload}function ou(e){let n=new Set(e.installed.packages.map(s=>s.ecosystem??"npm")),t=["npm","PyPI","Go"].filter(s=>n.has(s));return t.length===0?"npm":t.join("+")}var Aa="site-packages:",Ea=class{#e;#n;#t=new Map;constructor(n,t){this.#e=n,this.#n=t}point(n,t){if(!Number.isInteger(t)||t<0)return null;let s=this.#s(n);if(s===null)return null;let r=(typeof s.text=="string",s.text.length);if(t>r)return null;let o=0,i=s.starts.length-1;for(;o<i;){let f=o+i+1>>1;(s.starts[f]??0)<=t?o=f:i=f-1}let a=s.starts[o]??0,l=typeof s.text=="string"?t-a+1:s.text.subarray(a,t).toString("utf8").length+1,d=o+1,c=ns.maxSourcePosition;return d>c||l>c?null:{line:d,column:l}}#s(n){let t=this.#t.get(n);if(t!==void 0)return t;let s=this.#e.read(n),r=null;if(s!==null){let o=[0];if(this.#n==="utf8-bytes"){for(let i=0;i<s.length;i+=1)s[i]===10&&o.push(i+1);r={text:s,starts:o}}else{let i=s.toString("utf8");for(let a=0;a<i.length;a+=1)i.charCodeAt(a)===10&&o.push(a+1);r={text:i,starts:o}}}return this.#t.set(n,r),r}},Us=class{#e;#n;#t;#s;#o;#r;constructor(n,t,s,r){this.#e=n,this.#n=new Ea(t,s),this.#t=r,this.#s=new Map(n.functions.map(o=>[o.id,o])),this.#o=new Map(n.modules.map(o=>[o.id,o])),this.#r=new Map(n.callSites.map(o=>[o.id,o]))}locate(n){let t=n.path;if(t===void 0||t.length===0)return{path:null,reach:null};let s=t.map((d,c)=>{let f=this.#s.get(d.functionId),p=f===void 0?"":this.#t(f.moduleId),u=f===void 0?null:this.#i(p,f.declRange),m=t[c+1]?.calledAt??null;return{modulePath:va(p,d.modulePath),line:u?.line??null,column:u?.column??null,callSite:m===null?null:this.#i(p,m)}}),r=t[t.length-1]?.functionId,o=n.pathQuality==="modeled"?void 0:n.pathQuality,i=r===void 0||o===void 0?null:ga(this.#e,r,o);if(i===null)return{path:s,reach:null};let a=iu(i),l=new Map(i.functions.slice(0,a).map((d,c)=>[d.functionId,`n${String(c)}`]));return{path:s,reach:this.#a(i),nodeOf:l}}modulePathOf(n){let t=this.#o.get(n);return t===void 0?null:va(this.#t(n),t.path)}#a(n){let t=iu(n),s=new Map(n.functions.slice(0,t).map((i,a)=>[i.functionId,a])),r=n.functions.slice(0,t).map((i,a)=>{let l=this.#s.get(i.functionId),d=l===void 0?"":this.#t(l.moduleId),c=l===void 0?null:this.#i(d,l.declRange);return{id:`n${String(a)}`,functionName:l?.name??null,modulePath:(l===void 0?null:this.modulePathOf(l.moduleId))??"",line:c?.line??null,column:c?.column??null}}),o=n.edges.flatMap(i=>{let a=s.get(i.from),l=s.get(i.to);if(a===void 0||l===void 0)return[];let d=this.#r.get(i.site),c=this.#s.get(i.from),f=c===void 0?"":this.#t(c.moduleId);return[{from:`n${String(a)}`,to:`n${String(l)}`,callSite:d===void 0?null:this.#i(f,d.range)}]});return{nodes:r,edges:o,truncated:n.functions.length-t}}#i(n,t){return t.path===""||t.path.startsWith(Aa)?null:this.#n.point(va(n,t.path),t.start)}};function iu(e){let n=ns,t=new Map(e.functions.map((i,a)=>[i.functionId,a])),s=new Array(e.functions.length).fill(0);for(let i of e.edges){let a=Math.max(t.get(i.from)??0,t.get(i.to)??0);s[a]=(s[a]??0)+1}let r=0,o=0;for(;o<e.functions.length&&o<n.maxReachNodes;){let i=s[o]??0;if(r+i>n.maxReachEdges)break;r+=i,o+=1}return o}function va(e,n){return e===""||n===""?n:`${e}/${n}`}function Ia(e){let n=e.filter(t=>t!=="").sort((t,s)=>s.length-t.length);return t=>n.find(s=>t.startsWith(`${s}::`))??""}var Fb=512,jb=2048,Bb=64*1024,Gb=255,Kb=1024,zb=64,Wb=16,Ub=/^(?:pkg:[^\s\p{Cc}]{1,200}|ecmascript:[A-Za-z0-9_.$]{1,200})$/u;function Na(e){return e.length>0&&e.length<=Kb&&!new RegExp("\\p{Cc}","u").test(e)&&!au.posix.isAbsolute(e)&&!au.win32.isAbsolute(e)}function lu(e,n){return{index:Ks(e),lineOf:t=>Qt(n,t,"utf16-units")?.startLine??null,pathOf:t=>t.path}}function du(e,n,t){let s=new Map(e.modules.map(a=>[a.id,a])),r=(a,l)=>{let d=l.registeredAt;if(d===void 0)return l;let c=a.declRange.path,f=c!==""&&a.moduleId.endsWith(c)?a.moduleId.slice(0,a.moduleId.length-c.length):null,p=f===null?null:`${f}${d.path}`;return p!==null&&s.has(p)?{...l,registeredAt:{...d,path:p}}:{index:l.index,sourceClass:l.sourceClass,model:l.model}},o={...e,functions:e.functions.map(a=>a.sourceParams===void 0?a:{...a,sourceParams:a.sourceParams.map(l=>r(a,l))})},i=a=>a.packageName===""&&!a.id.includes(Aa);return{index:Ks(Oo(o)),lineOf:a=>{let l=s.get(a.path);if(l===void 0||!i(l))return null;let d=n.modulePathOf(l.id);return d===null?null:Qt(t,{...a,path:d},"utf8-bytes")?.startLine??null},pathOf:a=>s.has(a.path)?n.modulePathOf(a.path):null}}function cu(e,n,t,s,r=o=>o.path){let o=0,i=64,a=p=>{let u=Buffer.byteLength(JSON.stringify(p),"utf8")+1;return i+u>Bb?!1:(i+=u,!0)},l=[];for(let[p,u]of t)for(let m of e.functions.get(p)?.sourceParams??[]){if(l.length>=Fb||m.index<0||m.index>Gb){o+=1;continue}let g=m.registeredAt,y=g===void 0?null:r(g),b=g===void 0||y===null||!Na(y)?null:s(g),_={node:u,param:m.index,sourceClass:m.sourceClass,model:m.model,registeredAt:y!==null&&b!==null?{path:y,line:b}:null};if(!a(_)){o+=1;continue}l.push(_)}let d=[],c=new Set,f=(e.callers.get(n)??[]).filter(p=>p.direct).map(p=>p.site);for(let p of f.slice(0,zb)){let u=[],m=Math.min(p.args?.length??1,Wb);for(let g=0;g<m;g+=1)u.push({label:`arg[${String(g)}]`,port:{kind:"arg",index:g}});p.receiverRange!==void 0&&u.push({label:"receiver",port:{kind:"receiver"}});for(let{label:g,port:y}of u)for(let b of Sr(e,{site:p,port:y}).leaves){if(b.kind!=="unknown"&&b.kind!=="entry-parameter"||b.class===void 0)continue;let _=b.site??e.functions.get(b.functionId)?.declRange;if(_===void 0||_.path==="")continue;let S=r(_);if(S===null)continue;let k={port:g,node:t.get(b.functionId)??null,path:S,line:Na(S)?s(_):null,class:b.class,owner:"cupel",callee:(b.reason==="opaque-callee"||b.reason==="unresolved-call")&&b.detail!==void 0&&Ub.test(b.detail)?b.detail:null},v=JSON.stringify(k);if(!c.has(v)){if(c.add(v),!Na(S)||d.length>=jb||!a(k)){o+=1;continue}d.push(k)}}}return{inputs:l,blockers:d,truncated:o}}import{mkdirSync as Kd,readdirSync as Ah,readFileSync as jI,realpathSync as ho,renameSync as zd,statSync as Vd,writeFileSync as Wd}from"node:fs";import mt from"node:path";import{createRequire as Hb}from"node:module";var qb=Hb(import.meta.url);function Vb(){try{return qb("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function Xb(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Co={open(e,n){let{DatabaseSync:t}=Vb(),s=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?s.exec("PRAGMA query_only = ON;"):s.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>s.exec(r),prepare:r=>Xb(s.prepare(r)),close:()=>s.close()}}};var mu=["data","control","state","call-only","config-only"],gu=["patch-derived","pov-derived","drafted","reviewed"],hu=["remote-unauthenticated","remote-authenticated","rpc","message","upload","stored","upstream-response","cli","env","file"];var uu="[A-Za-z_$][A-Za-z0-9_$]{0,127}",Yb=new RegExp(`^(?:(?:arg\\[(?:0|[1-9][0-9]{0,2})\\]|receiver)(?:\\.${uu}){0,${String(4)}}|kwarg\\[${uu}\\])$`,"u");function yu(e){return Yb.test(e)}var Ra=(e,n)=>typeof e=="string"&&n.includes(e)?e:null,fu=e=>{if(e==null)return null;if(typeof e!="string"||e.length>4096)return!1;try{return JSON.parse(e),e}catch{return!1}},pu=e=>e==null?null:typeof e=="string"&&e.length<=4096?e:!1,Mo=e=>typeof e=="number"&&Number.isSafeInteger(e)?e:typeof e=="bigint"?Number(e):null;function Oa(e){let n=Mo(e.id),t=Mo(e.vulnerable_symbol_id),s=Ra(e.mode,mu),r=Ra(e.provenance,gu);if(n===null||t===null||s===null||r===null)return null;let o=s==="call-only"||s==="config-only",i=e.port;if(o?i!==null:typeof i!="string"||!yu(i))return null;let a=e.at_path,l=e.at_start===null?null:Mo(e.at_start),d=e.at_end===null?null:Mo(e.at_end),c=null;if(a!==null||e.at_start!==null||e.at_end!==null){if(typeof a!="string"||a===""||a.length>4096||l===null||d===null||l<0||d<l)return null;c={path:a,start:l,end:d}}let f;try{f=typeof e.accepted_sources=="string"&&e.accepted_sources.length<=4096?JSON.parse(e.accepted_sources):void 0}catch{return null}if(!Array.isArray(f))return null;let p=[];for(let b of f){let _=Ra(b,hu);if(_===null||p.includes(_))return null;p.push(_)}let u=fu(e.barriers),m=fu(e.trigger_predicate),g=pu(e.evidence_ref),y=pu(e.reviewer);return u===!1||m===!1||g===!1||y===!1||r==="reviewed"&&y===null?null:{id:n,vulnerableSymbolId:t,mode:s,port:o?null:i,at:c,acceptedSources:p,barriers:u,triggerPredicate:m,provenance:r,evidenceRef:g,reviewer:y}}var Nr="8",To=new Set(["vulndb-listed","vulndb-derived"]),bt="8";function Rr(e,n){return/^\d+$/u.test(e)&&Number(e)>=Number(n)}function qe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function Je(e){return typeof e=="string"?e:null}function _t(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Jb=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Ey=`
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Qb=`
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Ay=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
-                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Ny=5,Iy=6;function Ry(e){let n=e>=Iy?"a.details":"NULL AS details",t=e>=Ny?"ap.surface_complete":Ay;return`${vy}, ${n}, ${t}${Ey}`}var Oy="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",Py="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Cy="SELECT value FROM ingest_meta WHERE key = 'schema_version'",My=7,Ty="SELECT * FROM vulnerability_contract WHERE vulnerable_symbol_id = :id ORDER BY id",$y="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem",Ly=`SELECT DISTINCT package_name FROM affected_package
-  WHERE ecosystem = :eco AND package_name >= :lo AND package_name < :hi ORDER BY package_name`,Dy="SELECT value FROM ingest_meta WHERE key = 'population_mode'";function Xt(e,n=gr){let t=n.open(e,"readonly"),s=t.prepare(Cy).get(),o=s!==void 0?qe(s.value):"";if(_o(o,String(Number(ht)+1)))throw t.close(),new Error(`shard schema ${JSON.stringify(o)} is newer than this cupel understands (v${ht})`);let r=_o(o,yo),i=/^\d+$/u.test(o)?Number(o):0,a=t.prepare(Ry(i)),l=t.prepare(Oy),d=t.prepare(Py),c=t.prepare($y),p=t.prepare(Ly),u=t.prepare(Dy),f=i>=My?t.prepare(Ty):null;return{schemaVersion:o,ecosystems(){return c.all({}).map(m=>qe(m.ecosystem))},populationMode(){let m=u.get();return m===void 0?null:qe(m.value)},packageNamesUnder(m,h){if(h.length===0)return[];for(let S=0;S<h.length;S+=1){let b=h.charCodeAt(S);if(b<33||b>126)return[]}let y=h,_=h.slice(0,-1)+String.fromCharCode(h.charCodeAt(h.length-1)+1);return p.all({eco:m,lo:y,hi:_}).map(S=>qe(S.package_name))},advisoriesForPackage(m,h){return a.all({eco:m,name:h}).map(y=>({affected:{id:gt(y.ap_id)??0,advisoryId:qe(y.advisory_id),ecosystem:qe(y.ecosystem),packageName:qe(y.package_name),introduced:Je(y.introduced),fixed:Je(y.fixed),lastAffected:Je(y.last_affected),fixCommit:Je(y.fix_commit),repoUrl:Je(y.repo_url),surfaceComplete:gt(y.surface_complete)===1?1:0},advisory:{id:qe(y.a_id),osvId:Je(y.osv_id),cveId:Je(y.cve_id),summary:Je(y.summary),details:Je(y.details),severity:Je(y.severity),published:Je(y.published),source:qe(y.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(m){return l.all({id:m}).map(h=>{let y=qe(h.derivation);if(!r&&_r.has(y))throw new Error(`shard stamped schema ${o===""?"(none)":o} carries a ${y} row, which only a v${yo} shard may: its stamp is not the truth \u2014 refusing (ADR-108 D2)`);return{id:gt(h.id)??0,affectedPackageId:gt(h.affected_package_id)??0,exportName:Je(h.export_name),symbolKind:qe(h.symbol_kind),matchPattern:Je(h.match_pattern),matchGlobs:Je(h.match_globs),container:Je(h.container),sourcePath:Je(h.source_path),declStart:gt(h.decl_start),declEnd:gt(h.decl_end),astHashBefore:Je(h.ast_hash_before),astHashAfter:Je(h.ast_hash_after),derivation:y,confidence:qe(h.confidence),verified:gt(h.verified)===1?1:0}})},contractsForSymbol(m){if(f===null)return[];let h=[];for(let y of f.all({id:m})){let _=na(y);if(_===null||_.vulnerableSymbolId!==m)return"unreadable";h.push(_)}return h},aliasesForSymbol(m){return d.all({id:m}).map(h=>({id:gt(h.id)??0,vulnerableSymbolId:gt(h.vulnerable_symbol_id)??0,aliasPath:qe(h.alias_path),aliasName:qe(h.alias_name)}))},allModels(){let m;try{m=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
-               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let h=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return m.map(y=>{let _=gt(y.id)??0;return{packageName:qe(y.package_name),modelId:qe(y.evidence_ref),introduced:qe(y.introduced),fixedBefore:Je(y.fixed_before),evidenceRef:qe(y.evidence_ref),edges:h.all({id:_}).map(S=>({kind:qe(S.kind),anchorExport:qe(S.anchor_export),anchorContainer:Je(S.anchor_container),calleePackage:qe(S.callee_package),calleeContainer:Je(S.callee_container),calleeExport:qe(S.callee_export)}))}})},close(){t.close()}}}function br(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let f of e)if(f.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${f.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,s=new Map,o=new Map,r=new Map,i=1,a=(f,m,h,y)=>{let _=`${String(h)}:${String(y)}`,S=f.get(_);if(S!==void 0)return S;let b=i;i+=1,f.set(_,b);let k=e[h];if(k===void 0)throw new Error("unreachable: reader index out of range");return m.set(b,{reader:k,id:y}),b},l=e.map(f=>new Set(f.ecosystems?.()??[])),d=f=>{let m=e.map((h,y)=>y).filter(h=>l[h]?.has(f)===!0);return m.length>0?m:e.map((h,y)=>y).filter(h=>e[h]?.ecosystems===void 0)},c=(f,m)=>({...m,id:a(o,r,f,m.id),affectedPackageId:a(t,s,f,m.affectedPackageId)}),p=e.map((f,m)=>m),u=f=>{let m;for(let h of f){let y=e[h];if(y?.populationMode===void 0)continue;let _=y.populationMode();if(_!=="census")return _;m=_}return m};return{schemaVersion:n.schemaVersion,ecosystems(){let f=new Set;for(let m of l)for(let h of m)f.add(h);return[...f].sort()},populationMode(){return u(p)??null},populationModeFor(f){let m=d(f);return u(m.length>0?m:p)},packageNamesUnder(f,m){let h=new Set;for(let y of d(f))for(let _ of e[y]?.packageNamesUnder?.(f,m)??[])h.add(_);return[...h].sort()},advisoriesForPackage(f,m){let h=[];for(let y of d(f)){let _=e[y];if(_!==void 0)for(let S of _.advisoriesForPackage(f,m))h.push({...S,affected:{...S.affected,id:a(t,s,y,S.affected.id)}})}return h},symbolsForAffected(f){let m=s.get(f);if(m===void 0)return[];let h=e.indexOf(m.reader);return m.reader.symbolsForAffected(m.id).map(y=>c(h,y))},aliasesForSymbol(f){let m=r.get(f);if(m===void 0)return[];let h=e.indexOf(m.reader);return m.reader.aliasesForSymbol(m.id).map(y=>({...y,vulnerableSymbolId:a(o,r,h,y.vulnerableSymbolId)}))},contractsForSymbol(f){let m=r.get(f);if(m===void 0)return[];let h=m.reader.contractsForSymbol?.(m.id)??[];return h==="unreadable"?h:h.map(y=>({...y,vulnerableSymbolId:f}))},allModels(){return e.flatMap(f=>f.allModels?.()??[])},close(){for(let f of e)f.close()}}}import{realpathSync as Tt}from"node:fs";import Pn from"node:path";import{realpathSync as Qt}from"node:fs";import{isBuiltin as ya}from"node:module";import ln from"node:path";import C from"typescript";function ta(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function Ze(e){let n=ta(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Dn(e){let n=ta(e);if(n.startsWith("@")){let s=n.indexOf("/");if(s===-1)return n;let o=n.indexOf("/",s+1);return o===-1?n:n.slice(0,o)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Ac(e){let n=ta(e),t=Dn(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as zy,statSync as sa}from"node:fs";var Yt=16*1024*1024;function $s(e,n){try{let t=sa(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:zy(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function gn(e){let n=$s(e,Yt);return n.kind==="ok"?n.text:null}function yt(e){try{return sa(e).isFile()}catch{return!1}}function Nc(e){try{let n=sa(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Uy,realpathSync as ia}from"node:fs";import Ne from"node:path";import Sr from"typescript";var Tc=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Rn(e){return Tc.some(([n])=>e.endsWith(n))}function Wy(e){for(let[n,t]of Tc)if(e.endsWith(n)){let s=e.slice(0,-n.length);return t.map(o=>s+o)}return[]}var Hy=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function $c(e){if(Rn(e))return e;for(let[n,t]of Hy)if(e.endsWith(n)){let s=e.slice(0,-n.length);for(let o of t){let r=s+o;if(yt(r))return r}return e}return e}var aa=[Sr.ModuleKind.CommonJS,Sr.ModuleKind.ESNext],la=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function bo(e,n,t,s,o,r){let i=Sr.resolveModuleName(e,n,t,s,void 0,void 0,o).resolvedModule;if(i===void 0)return null;let a=i.resolvedFileName;if(r){for(let l of Wy(a))if(yt(l))return l}return a}var Lc=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],qy=[".js",".json",".node"],Vy=["index.js","index.json","index.node"];function xr(e){return!Rn(e)&&Lc.some(n=>e.endsWith(n))}function Dc(e){if(yt(e))return e;for(let n of qy)if(yt(e+n))return e+n;return null}function Ic(e){for(let n of Vy){let t=Ne.join(e,n);if(yt(t))return t}return null}var Fc=[".ts",".tsx",".cts",".mts",".jsx"];function Xy(e){for(let n of Fc)if(yt(e+n))return e+n;return null}function Yy(e){for(let n of Fc){let t=Ne.join(e,"index"+n);if(yt(t))return t}return null}function da(e){let n=gn(Ne.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let s=Ne.join(e,t),o=Dc(s)??Ic(s);if(o!==null)return o}}catch{}return Ic(e)}function jc(e){return Dc(e)??da(e)??Xy(e)??Yy(e)}function Bc(e){return jc(e)!==null}function Jy(e,n){let t=e.split(Ne.sep),s=n.split("/"),o=null;for(let i=t.length-s.length-1;i>=0;i-=1)if(t[i]==="node_modules"&&s.every((a,l)=>t[i+1+l]===a)){o=t.slice(0,i+1+s.length).join(Ne.sep);break}if(o===null||o==="")return null;let r=gn(Ne.join(o,"package.json"));if(r===null)return null;try{let i=JSON.parse(r),a=i.exports,l=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(i.name!==n||l)return null}catch{return null}try{return ia(o)}catch{return null}}function Zy(e,n){let t=jc(Ne.join(e,n));if(t===null)return null;let s;try{s=ia(t)}catch{return null}let o=e.endsWith(Ne.sep)?e:e+Ne.sep;return s!==e&&!s.startsWith(o)||Rn(s)||!Lc.some(r=>s.endsWith(r))?null:s}function Qy(e,n){let t=Ac(e);return t===""||t.includes("\0")||t.split("/").some(s=>s===""||s==="."||s===".."||s==="node_modules")?null:Zy(n,t)}var fs={kind:"nothing-loads"},Gc={kind:"absent"},oa=8192;function ra(e,n){let t=n.get(e);if(t!==void 0)return t;let s,o=null;try{o=Uy(e);let r=new Set,i=!1;for(;;){let a=o.readSync();if(a===null)break;if(r.size>=oa){i=!0;break}r.add(a.name)}s={names:r,truncated:i}}catch{s=null}finally{try{o?.closeSync()}catch{}}return n.set(e,s),s}var e_=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function ca(e){return e_.some(n=>e.length>n.length&&e.endsWith(n))}function Jt(e,n){let t=e.endsWith(Ne.sep)?e:e+Ne.sep;return n===e||n.startsWith(t)}function Rc(e,n){let t;try{t=ia(n)}catch{return{kind:"missing"}}return Jt(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Oc(e,n){let t=(n+".").toLowerCase(),s=[];for(let o of e){let r=o.toLowerCase();r.length>t.length&&r.startsWith(t)&&s.push(o)}return s}function n_(e,n,t){let s=Ne.dirname(n);if(!Jt(e,s))return null;let o=ra(s,t);if(o===null)return null;let r=Ne.basename(n);return o.names.has(r)?r:null}function Pc(e){return ca(e.split("/").pop()??"")?fs:Gc}function Cc(e,n){let t=e.filter(o=>!ca(o));if(t.length===0)return fs;let s=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${s}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Kc(e,n,t,s){let o=e,r=o.indexOf("?");r!==-1&&(o=o.slice(0,r));let i=o.indexOf("#");if(i!==-1&&(o=o.slice(0,i)),o===""||o.includes("\0"))return fs;let a=Ne.resolve(Ne.dirname(n),o);if(!Jt(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let l=Rc(t,a);if(l.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(l.kind==="ok"){let m=Nc(l.real);if(m==="file"){let S=n_(t,l.real,s);return S!==null&&ca(S)?fs:{kind:"unanalyzable",reason:S===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${S}") the analyzer cannot parse`,why:S===null?"probe-refused":"sibling-unparsable"}}if(m!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let h=ra(l.real,s);if(h===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let y=Oc(h.names,"index"),_=Cc(y,"a directory index");return _.kind==="unanalyzable"?_:h.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:h.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(oa)} entries and was not fully probed`,why:"probe-refused"}:y.length===0?Gc:fs}let d=Ne.basename(a);if(d===""||d==="."||d==="..")return fs;let c=Rc(t,Ne.dirname(a));if(c.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(c.kind==="missing")return Pc(o);let p=ra(c.real,s);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let u=Oc(p.names,d),f=Cc(u,"a sibling file exists");return f.kind==="unanalyzable"?f:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(oa)} entries and was not fully probed`,why:"probe-refused"}:u.length===0?Pc(o):fs}function ua(e,n){let t=Dn(e),s=Ne.dirname(n);for(let o=0;o<64;o+=1){let r=Ne.join(s,"node_modules",...t.split("/"));if(gn(Ne.join(r,"package.json"))!==null)return r;let i=Ne.dirname(s);if(i===s)return null;s=i}return null}function Mc(e,n,t,s,o){let r;for(let i of aa)for(let a of la){let l={...t,noDtsResolution:!0,customConditions:[...a]},d=bo(e,n,l,s,i,o);if(r===void 0)r=d;else if(r!==d)return null}return r??null}function Fn(e,n,t,s){let o=Ze(e);if(o==="relative")return bo(e,n,t,s,void 0,!0);if(o==="package-root"){let a=Mc(e,n,t,s,!0);if(a!==null)return a;let l=ua(e,n);if(l===null||gn(Ne.join(l,"package.json"))?.includes('"exports"')===!0)return null;let d=da(l);return d===null||Rn(d)?null:Jt(l,d)?d:null}let r=Mc(e,n,t,s,!1);if(r===null)return null;let i=Jy(r,Dn(e));return i!==null?Qy(e,i):Rn(r)?r:$c(r)}function zc(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function So(e,n,t,s){let o=Ze(e);if(o==="relative")return"no-candidate";if(zc(e))return"alias-unmapped";let r=new Set;for(let m of aa)for(let h of la){let y={...t,noDtsResolution:!0,customConditions:[...h]};r.add(bo(e,n,y,s,m,o==="package-root"))}if(r.size>1)return"divergent-exports";let i=ua(e,n);if(i===null)return"not-installed";let a=gn(Ne.join(i,"package.json"));if(a===null)return"unreadable-manifest";let l;try{l=JSON.parse(a)}catch{return"unreadable-manifest"}if(typeof l!="object"||l===null)return"unreadable-manifest";let d=l,c=d.exports!==void 0&&d.exports!==null,p=typeof d.typesVersions=="object"&&d.typesVersions!==null,[u]=r;if(u!=null)return Jt(i,u)?!c&&p?"types-versions-remap":Rn(u)?"declaration-only":"no-candidate":"out-of-root";let f=bo(e,n,t,s,void 0,!1);if(f!==null&&Rn(f))return!c&&p?"types-versions-remap":"declaration-only";if(o==="package-root"&&!c){let m=da(i);if(m!==null&&!Jt(i,m))return"out-of-root"}return"no-candidate"}function Ls(e,n,t,s){let o=Fn(e,n,t,s);if(o!==null)return[o];let r=Ze(e);if(r==="relative")return[];let i=new Set;for(let d of aa)for(let c of la){let p={...t,noDtsResolution:!0,customConditions:[...c]};i.add(bo(e,n,p,s,d,r==="package-root"))}if(i.size<2||i.has(null))return[];let a=ua(e,n);if(a===null)return[];let l=[];for(let d of i){if(d===null)return[];let c=$c(d);if(Rn(c)||!Jt(a,c))return[];l.push(c)}return[...new Set(l)].sort()}function Uc(e,n){let t=Ne.dirname(e);for(let s=0;s<64;s+=1){let o=gn(Ne.join(t,"package.json"));if(o!==null){try{let i=JSON.parse(o);if(typeof i!="object"||i===null)return!1;let a=i.optionalDependencies;if(typeof a=="object"&&a!==null&&n in a)return!0;let l=i.peerDependenciesMeta;if(typeof l=="object"&&l!==null){let d=l[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let r=Ne.dirname(t);if(r===t)return!1;t=r}return!1}function Wc(e,n,t){let s=gn(Ne.join(e,"tsconfig.json"));if(s===null)return()=>null;let o=Sr.parseConfigFileTextToJson(Ne.join(e,"tsconfig.json"),s);if(o.error!==void 0)return()=>null;let r=o.config?.compilerOptions;if(typeof r!="object"||r===null)return()=>null;let i=r.paths;if(typeof i!="object"||i===null)return()=>null;let a=r.baseUrl,l=typeof a=="string"?Ne.resolve(e,a):e,d=new Map,c=[];for(let[u,f]of Object.entries(i)){if(!Array.isArray(f))continue;let m=f.filter(y=>typeof y=="string");if(m.length===0)continue;let h=u.indexOf("*");h===-1?d.set(u,m):u.indexOf("*",h+1)===-1&&c.push({prefix:u.slice(0,h),suffix:u.slice(h+1),targets:m})}if(c.sort((u,f)=>f.prefix.length-u.prefix.length),d.size===0&&c.length===0)return()=>null;let p=u=>{let f=d.get(u);if(f!==void 0)return f;for(let m of c){if(u.length<m.prefix.length+m.suffix.length||!u.startsWith(m.prefix)||!u.endsWith(m.suffix))continue;let h=u.slice(m.prefix.length,u.length-m.suffix.length);return m.targets.map(y=>{let _=y.indexOf("*");return _===-1?y:y.slice(0,_)+h+y.slice(_+1)})}return[]};return(u,f)=>{let m=p(u);if(m.length===0||Fn(u,f,n,t)!==null)return null;for(let h of m){let y=Ne.resolve(l,h),_=Ne.relative(Ne.dirname(f),y).split(Ne.sep).join("/");if(_==="")continue;_.startsWith(".")||(_=`./${_}`);let S=Fn(_,f,n,t);if(S!==null&&Jt(e,S))return S}return null}}import{readdirSync as t_,realpathSync as s_}from"node:fs";import Ot from"node:path";import ce from"typescript";function xo(e,n){if(ce.isIdentifier(e))n.add(e.text);else for(let t of e.elements)ce.isBindingElement(t)&&xo(t.name,n)}function Ds(e){let n=new Map,t=new Set,s=l=>{n.set(l,(n.get(l)??0)+1)},o=l=>{let d=rn(l);if(ce.isIdentifier(d))t.add(d.text);else if(ce.isArrayLiteralExpression(d))for(let c of d.elements)o(c);else if(ce.isObjectLiteralExpression(d))for(let c of d.properties)ce.isShorthandPropertyAssignment(c)?t.add(c.name.text):ce.isPropertyAssignment(c)?o(c.initializer):ce.isSpreadAssignment(c)&&o(c.expression);else ce.isSpreadElement(d)?o(d.expression):ce.isBinaryExpression(d)&&d.operatorToken.kind===ce.SyntaxKind.EqualsToken&&o(d.left)},r=l=>{let d=new Set;xo(l,d);for(let c of d)s(c)},i=l=>{ce.isVariableDeclaration(l)?r(l.name):ce.isFunctionDeclaration(l)&&l.name!==void 0||ce.isClassDeclaration(l)&&l.name!==void 0?s(l.name.text):ce.isParameter(l)?r(l.name):((ce.isFunctionExpression(l)||ce.isClassExpression(l))&&l.name!==void 0&&ce.isIdentifier(l.name)&&!(l.parent!==void 0&&ce.isVariableDeclaration(l.parent)&&l.parent.initializer===l&&ce.isIdentifier(l.parent.name)&&l.parent.name.text===l.name.text)||ce.isImportClause(l)&&l.name!==void 0||ce.isNamespaceImport(l)||ce.isImportSpecifier(l)||ce.isImportEqualsDeclaration(l))&&s(l.name.text),ce.isBinaryExpression(l)&&l.operatorToken.kind>=ce.SyntaxKind.FirstAssignment&&l.operatorToken.kind<=ce.SyntaxKind.LastAssignment?o(l.left):(ce.isPrefixUnaryExpression(l)||ce.isPostfixUnaryExpression(l))&&(l.operator===ce.SyntaxKind.PlusPlusToken||l.operator===ce.SyntaxKind.MinusMinusToken)?o(l.operand):(ce.isForOfStatement(l)||ce.isForInStatement(l))&&!ce.isVariableDeclarationList(l.initializer)&&o(l.initializer),ce.forEachChild(l,i)};i(e);let a=new Set(t);for(let[l,d]of n)d>1&&a.add(l);return a}function ps(e,n,t){let s=Ds(e),o=new Map,r=i=>{ce.isVariableDeclaration(i)&&ce.isIdentifier(i.name)&&i.initializer!==void 0&&!s.has(i.name.text)&&!o.has(i.name.text)&&o.set(i.name.text,i.initializer),ce.forEachChild(i,r)};return r(e),{containingFile:n,taintedNames:s,constBindings:o,resolveParamDirs:t}}var o_=1024,r_=32,i_=new Set(["filter","sort","slice","reverse"]),a_=new Set(["forEach","map","filter","flatMap","find","some","every"]);function rn(e){let n=e;for(;ce.isParenthesizedExpression(n);)n=n.expression;return n}function Hc(e,n){return ce.isPropertyAccessExpression(e)&&ce.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function Zt(e,n,t,s){if(t>r_)return null;let o=rn(e);if(ce.isStringLiteralLike(o))return o.text;if(ce.isTemplateExpression(o)){let r=o.head.text;for(let i of o.templateSpans){let a=Zt(i.expression,n,t+1,s);if(a===null)return null;r+=a+i.literal.text}return r}if(ce.isBinaryExpression(o)&&o.operatorToken.kind===ce.SyntaxKind.PlusToken){let r=Zt(o.left,n,t+1,s);if(r===null)return null;let i=Zt(o.right,n,t+1,s);return i===null?null:r+i}if(ce.isIdentifier(o)){if(o.text==="__dirname")return Ot.dirname(n.containingFile);if(o.text==="__filename")return n.containingFile;if(n.taintedNames.has(o.text)||s.has(o.text))return null;let r=n.constBindings.get(o.text);if(r===void 0)return null;s.add(o.text);let i=Zt(r,n,t+1,s);return s.delete(o.text),i}if(ce.isCallExpression(o)){let r=Hc(o.expression,"join"),i=Hc(o.expression,"resolve");if(!r&&!i)return null;let a=[];for(let d of o.arguments){let c=Zt(d,n,t+1,s);if(c===null)return null;a.push(c)}let l=a[0];return l===void 0||i&&!Ot.isAbsolute(l)?null:i?Ot.resolve(...a):Ot.join(...a)}return null}function kr(e){let n=rn(e);if(ce.isBinaryExpression(n)&&n.operatorToken.kind===ce.SyntaxKind.PlusToken)return[...kr(n.left),...kr(n.right)];if(ce.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let s of n.templateSpans)t.push({expr:s.expression}),s.literal.text.length>0&&t.push({lit:s.literal.text});return t}return ce.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Xc(e){let n=e,t=0;for(;t++<4096;){let s=n.parent;if(s===void 0)return null;if(ce.isForOfStatement(s)&&s.statement===n){let o=s.initializer;if(ce.isVariableDeclarationList(o)&&o.declarations.length===1&&o.declarations[0]!==void 0&&ce.isIdentifier(o.declarations[0].name)&&o.declarations[0].name.text===e.text){let r=qc(s.expression);if(r!==null)return r}}if((ce.isArrowFunction(n)||ce.isFunctionExpression(n))&&ce.isCallExpression(s)&&s.arguments.length>0&&s.arguments[0]===n&&ce.isPropertyAccessExpression(s.expression)&&a_.has(s.expression.name.text)){let o=n.parameters[0];if(o!==void 0&&ce.isIdentifier(o.name)&&o.name.text===e.text){let r=qc(s.expression.expression);if(r!==null)return r}}n=s}return null}function qc(e){let n=rn(e),t=0;for(;ce.isCallExpression(n)&&t++<16;){let s=n.expression;if(ce.isPropertyAccessExpression(s)){let o=s.name.text;if(o==="readdirSync")return n.arguments[0]??null;if(i_.has(o)){n=rn(s.expression);continue}return null}return ce.isIdentifier(s)&&s.text==="readdirSync"?n.arguments[0]??null:null}return null}function l_(e,n){let t=kr(e);if(t.length<2)return null;let s=t[t.length-1];if(s===void 0||!("expr"in s)||!ce.isIdentifier(s.expr))return null;let o=s.expr;if(n.taintedNames.has(o.text))return null;let r="";for(let d=0;d<t.length-1;d+=1){let c=t[d];if(c===void 0)return null;if("lit"in c)r+=c.lit;else{let p=Zt(c.expr,n,0,new Set);if(p===null)return null;r+=p}}let i=Xc(o),a=i===null?null:Zt(i,n,0,new Set);if(a===null)return null;let l=Ot.resolve(r);return l!==Ot.resolve(a)?null:l}function d_(e){if((ce.isFunctionDeclaration(e)||ce.isFunctionExpression(e))&&e.name!==void 0&&ce.isIdentifier(e.name)||ce.isMethodDeclaration(e)&&ce.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&ce.isVariableDeclaration(n)&&ce.isIdentifier(n.name)?n.name.text:null}function c_(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!ce.isFunctionLike(t))continue;let s=-1;for(let r=0;r<t.parameters.length;r+=1){let i=t.parameters[r];if(i!==void 0&&ce.isIdentifier(i.name)&&i.name.text===n){s=r;break}}if(s<0)continue;let o=d_(t);return o===null?null:{fnName:o,paramIndex:s}}return null}function ko(e,n){let t=kr(e);if(t.length!==2)return null;let[s,o]=t;if(s===void 0||!("expr"in s)||!ce.isIdentifier(s.expr)||o===void 0||!("expr"in o)||!ce.isIdentifier(o.expr))return null;let r=s.expr,i=o.expr;if(n.taintedNames.has(r.text)||n.taintedNames.has(i.text))return null;let a=Xc(i);return a===null||!ce.isIdentifier(a)||a.text!==r.text?null:c_(r,r.text)}function u_(e,n){if(n.resolveParamDirs===void 0)return null;let t=ko(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function wr(e){for(let n=e.parent;n!==void 0;n=n.parent){if(ce.isSourceFile(n))return!0;if(!ce.isArrowFunction(n)&&ce.isFunctionLike(n))return!1}return!0}function fa(e,n){let t=Zt(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let s=l_(e,n);if(s!==null)return{kind:"dir",dir:s};let o=u_(e,n);return o!==null&&o.length>0?{kind:"dirs",dirs:[...o]}:{kind:"opaque"}}function Yc(e,n){let t;try{t=s_(e)}catch{return null}let s=n.endsWith(Ot.sep)?n:n+Ot.sep;return t===n||t.startsWith(s)?t:null}function Jc(e,n,t,s,o){let r=Fn(e,n,s,o);return r===null||Rn(r)||!xr(r)?null:Yc(r,t)}function Vc(e,n,t,s,o){let r=Yc(e,t);if(r===null)return[];let i;try{i=t_(r)}catch{return[]}if(i.length===0||i.length>o_)return[];i.sort();let a=new Set,l=[];for(let d of i){let c=Jc(Ot.join(r,d),n,t,s,o);c!==null&&!a.has(c)&&(a.add(c),l.push(c))}return l}function vr(e,n,t,s,o){let r=fa(e,n);if(r.kind==="const"){if(Ze(r.value)==="package-root")return[];let i=Jc(r.value,n.containingFile,t,s,o);return i===null?[]:[i]}if(r.kind==="dir")return Vc(r.dir,n.containingFile,t,s,o);if(r.kind==="dirs"){let i=new Set,a=[];for(let l of r.dirs)for(let d of Vc(l,n.containingFile,t,s,o))i.has(d)||(i.add(d),a.push(d));return a}return[]}import f_ from"node:path";import De from"typescript";var p_=32,Er="\0",Zc=(e,n)=>`${e}${Er}${n}`,Qc=(e,n,t)=>`${e}${Er}${n}${Er}${String(t)}`;function m_(e){let n=new Map,t=new Set,s=(o,r)=>{if(t.has(o)){n.delete(o);return}t.add(o),n.set(o,r)};for(let o of e.statements)if(De.isImportDeclaration(o)&&De.isStringLiteralLike(o.moduleSpecifier)){let r=o.moduleSpecifier.text,i=o.importClause;if(i===void 0)continue;i.name!==void 0&&s(i.name.text,{kind:"module",specifier:r});let a=i.namedBindings;if(a!==void 0&&De.isNamespaceImport(a))s(a.name.text,{kind:"module",specifier:r});else if(a!==void 0&&De.isNamedImports(a))for(let l of a.elements)s(l.name.text,{kind:"named",specifier:r,imported:(l.propertyName??l.name).text})}else if(De.isImportEqualsDeclaration(o)&&De.isExternalModuleReference(o.moduleReference)&&De.isStringLiteralLike(o.moduleReference.expression))s(o.name.text,{kind:"module",specifier:o.moduleReference.expression.text});else if(De.isFunctionDeclaration(o)&&o.name!==void 0)s(o.name.text,{kind:"local"});else if(De.isVariableStatement(o))for(let r of o.declarationList.declarations){if(r.initializer===void 0)continue;let i=r.initializer;if(De.isIdentifier(r.name))De.isArrowFunction(i)||De.isFunctionExpression(i)?s(r.name.text,{kind:"local"}):eu(i)&&s(r.name.text,{kind:"module",specifier:nu(i)});else if(De.isObjectBindingPattern(r.name)&&eu(i)){let a=nu(i);for(let l of r.name.elements){if(l.dotDotDotToken!==void 0||!De.isIdentifier(l.name))continue;let d=l.propertyName??l.name;!De.isIdentifier(d)&&!De.isStringLiteralLike(d)||s(l.name.text,{kind:"named",specifier:a,imported:d.text})}}}return n}function eu(e){return De.isCallExpression(e)&&De.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&De.isStringLiteralLike(e.arguments[0])}function nu(e){let n=e.arguments[0];return n!==void 0&&De.isStringLiteralLike(n)?n.text:"\0"}function h_(e){let n=e.expression;if(De.isPropertyAccessExpression(n))return n.name.text;if(De.isIdentifier(n))return n.text}function g_(e,n,t,s,o,r){let i=e.expression,a=l=>{let d=`${l}${Er}${n}`,c=r.get(d);if(c!==void 0||r.has(d))return c??null;let p=Fn(l,n,s,o),u=p===null?null:f_.resolve(p);return r.set(d,u),u};if(De.isPropertyAccessExpression(i)&&De.isIdentifier(i.expression)){let l=t.get(i.expression.text);if(l?.kind==="module"){let d=a(l.specifier);return d===null?null:{moduleReal:d,fnName:i.name.text}}return null}if(De.isIdentifier(i)){let l=t.get(i.text);if(l?.kind==="named"){let d=a(l.specifier);return d===null?null:{moduleReal:d,fnName:l.imported}}return l?.kind==="local"?{moduleReal:n,fnName:i.text}:null}return null}function tu(e,n,t,s,o=new Map){if(n.length===0)return()=>null;let r=new Map,i=new Set;for(let l of n){let d=Zc(l.definingModuleReal,l.fnName),c=r.get(d);c===void 0&&(c=new Set,r.set(d,c)),c.add(l.paramIndex),i.add(l.fnName)}let a=new Map;for(let l of e){let d=ps(l.sf,l.real),c=m_(l.sf),p=u=>{if(De.isCallExpression(u)){let f=h_(u);if(f!==void 0&&i.has(f)&&wr(u)){let m=g_(u,l.real,c,t,s,o);if(m!==null){let h=r.get(Zc(m.moduleReal,m.fnName));if(h!==void 0)for(let y of h){let _=u.arguments[y];if(_===void 0)continue;let S=fa(_,d);if(S.kind==="const"){let b=Qc(m.moduleReal,m.fnName,y),k=a.get(b);k===void 0&&(k=new Set,a.set(b,k)),k.add(S.value)}}}}}De.forEachChild(u,p)};p(l.sf)}return(l,d,c)=>{let p=a.get(Qc(l,d,c));return p===void 0||p.size===0||p.size>p_?null:[...p].sort()}}var un={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:C.ScriptTarget.ES2020,module:C.ModuleKind.CommonJS,moduleResolution:C.ModuleResolutionKind.Node10,types:[]},Ar=5e3;function fn(e,n){let t;try{t=Qt(n)}catch{t=ln.resolve(n)}let s=e.endsWith(ln.sep)?e:e+ln.sep;return t!==e&&!t.startsWith(s)?null:t===e?"":t.slice(s.length).split(ln.sep).join("/")}function y_(e,n){let t=fn(e,n);return t!==null&&!t.split("/").includes("node_modules")}function __(e,n){if(C.isFunctionLike(e))return n!==e.name&&!C.isDecorator(n)&&!b_(e);if(C.isPropertyDeclaration(e))return n===e.initializer&&(C.getCombinedModifierFlags(e)&C.ModifierFlags.Static)===0;if(C.isTryStatement(e))return n===e.catchClause||n===e.tryBlock&&e.catchClause!==void 0;if(C.isIfStatement(e))return n!==e.expression;if(C.isConditionalExpression(e))return n!==e.condition;if(C.isCaseClause(e))return n!==e.expression;if(C.isDefaultClause(e))return!0;if(C.isBinaryExpression(e)){let t=e.operatorToken.kind;return n===e.right&&(t===C.SyntaxKind.AmpersandAmpersandToken||t===C.SyntaxKind.BarBarToken||t===C.SyntaxKind.QuestionQuestionToken||t===C.SyntaxKind.AmpersandAmpersandEqualsToken||t===C.SyntaxKind.BarBarEqualsToken||t===C.SyntaxKind.QuestionQuestionEqualsToken)}return C.isForStatement(e)?n===e.statement||n===e.incrementor:C.isForInStatement(e)||C.isForOfStatement(e)||C.isWhileStatement(e)?n===e.statement:C.isBindingElement(e)?n===e.initializer:C.isShorthandPropertyAssignment(e)?n===e.objectAssignmentInitializer:C.isCallExpression(e)&&C.isOptionalChain(e)?e.arguments.some(t=>t===n):C.isElementAccessExpression(e)&&C.isOptionalChain(e)?n===e.argumentExpression:!1}function b_(e){if(!C.isFunctionExpression(e)&&!C.isArrowFunction(e)||C.isFunctionExpression(e)&&e.asteriskToken!==void 0)return!1;let n=e;for(;C.isParenthesizedExpression(n.parent);)n=n.parent;let t=n.parent;return(C.isCallExpression(t)||C.isNewExpression(t))&&t.expression===n?!0:C.isPropertyAccessExpression(t)&&t.expression===n&&(t.name.text==="call"||t.name.text==="apply")&&C.isCallExpression(t.parent)&&t.parent.expression===t}function Ve(e){let n=e;for(;;)if(C.isParenthesizedExpression(n))n=n.expression;else if(C.isBinaryExpression(n)&&n.operatorToken.kind===C.SyntaxKind.CommaToken)n=n.right;else return n}function Pt(e){return C.isPropertyAccessExpression(e)?{receiver:Ve(e.expression),name:e.name.text}:C.isElementAccessExpression(e)&&C.isStringLiteralLike(e.argumentExpression)?{receiver:Ve(e.expression),name:e.argumentExpression.text}:null}function Eo(e){let n=Ve(e.expression);if(C.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===C.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=Pt(n);if(t!==null){if(t.name==="require"&&C.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(C.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let s=e.arguments[1];return{specifierArg:s!==void 0&&C.isArrayLiteralExpression(s)?s.elements[0]:void 0}}}}return null}function su(e){let n=[],t=(s,o)=>{if(C.isImportDeclaration(s)&&C.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.importClause?.isTypeOnly!==!0,unguarded:!o&&C.isSourceFile(s.parent)});else if(C.isImportEqualsDeclaration(s)&&C.isExternalModuleReference(s.moduleReference)&&C.isStringLiteralLike(s.moduleReference.expression))n.push({text:s.moduleReference.expression.text,runtime:!0,unguarded:!o&&C.isSourceFile(s.parent)});else if(C.isExportDeclaration(s)&&s.moduleSpecifier!==void 0&&C.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.isTypeOnly!==!0,unguarded:!o&&C.isSourceFile(s.parent)});else if(C.isCallExpression(s)){let r=Eo(s),i=r?.specifierArg;if(r!==null&&i!==void 0&&C.isStringLiteralLike(i)){let a=Ve(s.expression).kind===C.SyntaxKind.ImportKeyword;n.push({text:i.text,runtime:!0,unguarded:!o&&(!a||S_(s))})}}C.forEachChild(s,r=>{t(r,o||__(s,r))})};return t(e,!1),n}function S_(e){let n=e;for(;C.isParenthesizedExpression(n.parent);)n=n.parent;return C.isAwaitExpression(n.parent)}function x_(e,n){let t=n===C.ScriptKind.TSX?"__scriptkind_probe.tsx":n===C.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",s=C.createSourceFile(t,e,C.ScriptTarget.ES2020,!0,n),o={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},r={getSourceFile:i=>i===t?s:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:i=>i,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:i=>i===t,readFile:i=>i===t?e:void 0};return C.createProgram({rootNames:[t],options:o,host:r}).getSyntacticDiagnostics(s).length}function _a(e){return e.endsWith(".js")||e.endsWith(".jsx")}function k_(e){return ln.extname(e)===""}function w_(e){if(!e.startsWith("#!"))return"none";let n=e.indexOf(`
-`),t=(n===-1?e:e.slice(0,n)).slice(0,512);return/(?:^|[\s/])node(?:\s|$)/u.test(t)?"node":"other"}function ou(e){let n=0,t=s=>{(C.isCallExpression(s)||C.isNewExpression(s)||C.isTaggedTemplateExpression(s))&&(n+=1),C.forEachChild(s,t)};return t(e),n}function au(e,n){let t=su(C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0));if(!_a(e)||!n.includes("<")||!n.includes("require"))return t;let s=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX),o=i=>`${i.runtime?"R":"T"}${i.unguarded?"U":"G"}:${i.text}`,r=new Set(t.map(o));for(let i of su(s)){let a=o(i);r.has(a)||(r.add(a),t.push(i))}return t}function ru(e,n,t,s,o){if(!n.includes("require")&&!n.includes("import("))return[];let r=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0),i=ps(r,e,o),a=[],l=new Set;return lu(r,d=>{for(let c of vr(d,i,t,un,s))l.has(c)||(l.add(c),a.push(c))}),a}function lu(e,n){let t=s=>{if(C.isCallExpression(s)){let o=Eo(s),r=o?.specifierArg;o!==null&&r!==void 0&&!C.isStringLiteralLike(r)&&n(r)}C.forEachChild(s,t)};t(e)}function v_(e){let n=[];for(let t of e){let s=ps(t.sf,t.real);lu(t.sf,o=>{let r=ko(o,s);r!==null&&n.push({definingModuleReal:t.real,fnName:r.fnName,paramIndex:r.paramIndex})})}return n}var E_=4,pa=Ar,ma=new Set(["eval","Function","createRequire"]),A_=new Set(["require","eval","Function","createRequire"]),Rr=new Set(["module","Module","require","process","global","globalThis"]),Or=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function N_(e){return e===C.SyntaxKind.LessThanToken||e===C.SyntaxKind.GreaterThanToken||e===C.SyntaxKind.LessThanEqualsToken||e===C.SyntaxKind.GreaterThanEqualsToken||e===C.SyntaxKind.EqualsEqualsToken||e===C.SyntaxKind.EqualsEqualsEqualsToken||e===C.SyntaxKind.ExclamationEqualsToken||e===C.SyntaxKind.ExclamationEqualsEqualsToken||e===C.SyntaxKind.InstanceOfKeyword||e===C.SyntaxKind.InKeyword}function I_(e){let n=e.parent;return(C.isParameter(n)||C.isVariableDeclaration(n)||C.isBindingElement(n)||C.isFunctionDeclaration(n)||C.isFunctionExpression(n)||C.isClassDeclaration(n)||C.isClassExpression(n)||C.isPropertyAssignment(n)||C.isPropertyDeclaration(n)||C.isMethodDeclaration(n))&&n.name===e?!0:C.isPropertyAccessExpression(n)&&n.name===e}function R_(e,n){return C.isCallExpression(n)&&n.expression===e||(C.isPropertyAccessExpression(n)||C.isElementAccessExpression(n))&&n.expression===e||C.isTypeOfExpression(n)||C.isVoidExpression(n)||C.isDeleteExpression(n)||C.isPrefixUnaryExpression(n)||C.isPostfixUnaryExpression(n)?!0:C.isBinaryExpression(n)&&N_(n.operatorToken.kind)}function du(e){let n=e,t=e.parent;for(;;)if(C.isParenthesizedExpression(t))n=t,t=t.parent;else if(C.isBinaryExpression(t)&&t.operatorToken.kind===C.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!R_(n,t)}function O_(e){return I_(e)?!1:du(e)}function cu(e){let n=Pt(e);if(n!==null&&Or.has(n.name))return!0;if(C.isElementAccessExpression(e)&&!C.isStringLiteralLike(e.argumentExpression)){let t=Ve(e.expression);if(C.isIdentifier(t)&&Rr.has(t.text))return!0}return!1}function wo(e){let n=Pt(e);if(n===null||n.name!=="constructor")return!1;let t=Pt(n.receiver);return t!==null&&t.name==="constructor"}function uu(e){if(!C.isCallExpression(e))return!1;let n=Ve(e.expression);if(!C.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&C.isStringLiteralLike(t)&&t.text==="module"}var P_={roots:new Map,nodes:new Set,saturated:!1};function fu(e){return C.isSourceFile(e)||C.isFunctionDeclaration(e)||C.isFunctionExpression(e)||C.isArrowFunction(e)||C.isMethodDeclaration(e)||C.isConstructorDeclaration(e)||C.isGetAccessorDeclaration(e)||C.isSetAccessorDeclaration(e)||C.isClassStaticBlockDeclaration(e)||C.isModuleDeclaration(e)}function pu(e,n){let t=e.parent;for(;t!==void 0;){if(fu(t))return t;t=t.parent}return n}function C_(e){let n=new Set;if(C.isFunctionLike(e))for(let s of e.parameters)for(let o of vo(s.name))n.add(o);let t=[e];for(;t.length>0;){let s=t.pop();if(s===void 0)break;if(!(s!==e&&fu(s))){if(C.isVariableDeclaration(s)&&C.isVariableDeclarationList(s.parent)&&!((s.parent.flags&C.NodeFlags.BlockScoped)!==0))for(let r of vo(s.name))n.add(r);C.forEachChild(s,o=>{t.push(o)})}}return n}function M_(e,n,t){let s=pu(e,n);if(C.isSourceFile(s))return n;let o=t.get(s);return o===void 0&&(o=C_(s),t.set(s,o)),o.has(e.text)?s:n}function Nr(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let s=n;for(;;){if(t.has(s))return!0;let o=s.parent;if(o===void 0)return!C.isSourceFile(s);s=o}}var T_=12,$_=8;function Ir(e,n){let t=Ve(e);for(;;){if(n.nodes.has(t))return!0;if(C.isIdentifier(t))return Rr.has(t.text)||Nr(n,t);if(C.isCallExpression(t))return uu(t);let s=Pt(t);if(s!==null){if(s.name==="constructor")return!0;t=s.receiver;continue}if(C.isElementAccessExpression(t)){t=Ve(t.expression);continue}return!1}}function mu(e){let n=Pt(Ve(e.expression));if(n===null||n.name!=="get"||!C.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function L_(e,n){let t=mu(e);if(t===null||!Ir(t.target,n))return!1;let s=t.key;return s===void 0||!C.isStringLiteralLike(s)?!0:Or.has(s.text)}function ha(e){if(!C.isFunctionExpression(e)&&!C.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,s=o=>{if(!(t||C.isFunctionExpression(o)||C.isFunctionDeclaration(o)||C.isClassLike(o))){if(C.isReturnStatement(o)&&o.expression!==void 0&&Ve(o.expression).kind===C.SyntaxKind.ThisKeyword){t=!0;return}C.forEachChild(o,s)}};return s(n),t}function vo(e){if(C.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)C.isOmittedExpression(t)||n.push(...vo(t.name));return n}function hu(e){return e.parameters.map(n=>vo(n.name))}function D_(e){let n=new Map,t=new Set,s=(r,i)=>{let a={fn:i,slots:hu(i)},l=n.get(r);l===void 0?n.set(r,[a]):l.push(a),ha(i)&&t.add(r)},o=r=>{if(C.isFunctionDeclaration(r)&&r.name!==void 0)s(r.name.text,r);else if(C.isVariableDeclaration(r)&&C.isIdentifier(r.name)&&r.initializer!==void 0){let i=Ve(r.initializer);(C.isFunctionExpression(i)||C.isArrowFunction(i))&&s(r.name.text,i)}C.forEachChild(r,o)};return o(e),{params:n,thisReturning:t}}function F_(e){let n=new Map,t=new Set,s={roots:n,nodes:t},o=D_(e),r=new Map,i=new Set(o.thisReturning),a=!0;for(let l=0;a;l+=1){if(l>=T_)return{roots:n,nodes:t,saturated:!0};a=!1;let d=(h,y)=>{y!==""&&!h.has(y)&&(h.add(y),a=!0)},c=(h,y)=>{if(h==="")return;let _=n.get(h);_===void 0&&(_=new Set,n.set(h,_)),_.has(y)||(_.add(y),a=!0)},p=h=>{t.has(h)||(t.add(h),a=!0)},u=(h,y)=>{let _=Ve(h.expression);if(C.isIdentifier(_)&&ma.has(_.text)||wo(_)||C.isCallExpression(h)&&uu(h)||ha(_))return!0;let S=Pt(_);if(S!==null&&(S.name==="call"||S.name==="apply"||S.name==="bind")){let b=S.receiver;if(ha(b)||t.has(b)||C.isIdentifier(b)&&(Nr(s,b)||i.has(b.text)))return!0}if(t.has(_)||(C.isCallExpression(_)||C.isNewExpression(_))&&u(_,y+1)||C.isIdentifier(_)&&(Nr(s,_)||i.has(_.text)))return!0;if(C.isCallExpression(h)){let b=mu(h);if(b!==null&&Ir(b.target,s))return!0}return!1},f=(h,y)=>{if(y>=$_)return!0;let _=Ve(h);if(t.has(_))return!0;if(C.isIdentifier(_))return Rr.has(_.text)||Nr(s,_);if(C.isBinaryExpression(_)){let S=_.operatorToken.kind;return S===C.SyntaxKind.BarBarToken||S===C.SyntaxKind.AmpersandAmpersandToken||S===C.SyntaxKind.QuestionQuestionToken?f(_.left,y+1)||f(_.right,y+1):!1}return C.isConditionalExpression(_)?f(_.whenTrue,y+1)||f(_.whenFalse,y+1):C.isPropertyAccessExpression(_)||C.isElementAccessExpression(_)?Ir(_,s):C.isCallExpression(_)||C.isNewExpression(_)?u(_,y+1):!1},m=(h,y)=>{if((C.isVariableDeclaration(h)||C.isParameter(h)||C.isBindingElement(h))&&h.initializer!==void 0){if(f(h.initializer,0)){let S=pu(h,e);for(let b of vo(h.name))c(b,S)}}else if(C.isBinaryExpression(h)&&h.operatorToken.kind===C.SyntaxKind.EqualsToken&&C.isIdentifier(h.left)&&f(h.right,0))c(h.left.text,M_(h.left,e,r));else if(C.isReturnStatement(h)&&h.expression!==void 0&&y!==void 0&&f(h.expression,0))d(i,y);else if(C.isCallExpression(h)||C.isNewExpression(h)){u(h,0)&&p(h);let S=Ve(h.expression),b=Pt(S),k=b!==null&&b.name==="call",w=b!==null&&b.name==="apply",N=k||w?b.receiver:S,R=k?1:0,v=[];C.isFunctionExpression(N)||C.isArrowFunction(N)?v.push({fn:N,slots:hu(N)}):C.isIdentifier(N)&&v.push(...o.params.get(N.text)??[]);let I=h.arguments??[];if(w){let A=I[1]===void 0?void 0:Ve(I[1]);for(let{fn:B,slots:O}of v)if(A!==void 0&&C.isArrayLiteralExpression(A))for(let V=0;V<A.elements.length;V+=1){let E=A.elements[V],D=O[V];if(!(E===void 0||D===void 0)&&f(E,0))for(let L of D)c(L,B)}else if(A!==void 0)for(let V of O)for(let E of V)c(E,B)}else for(let{fn:A,slots:B}of v)for(let O=R;O<I.length;O+=1){let V=I[O],E=B[O-R];if(!(V===void 0||E===void 0)&&f(V,0))for(let D of E)c(D,A)}}let _=y;if(C.isFunctionDeclaration(h))_=h.name?.text;else if(C.isFunctionExpression(h)||C.isArrowFunction(h)){let S=h.parent;_=C.isVariableDeclaration(S)&&C.isIdentifier(S.name)?S.name.text:void 0}C.forEachChild(h,S=>m(S,_))};m(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function j_(e){if(C.isIdentifier(e)&&ma.has(e.text)||wo(e))return!0;let n=Pt(e);if(n!==null&&(Or.has(n.name)||(n.name==="call"||n.name==="apply")&&(C.isIdentifier(n.receiver)&&ma.has(n.receiver.text)||wo(n.receiver)||(C.isPropertyAccessExpression(n.receiver)||C.isElementAccessExpression(n.receiver))&&cu(n.receiver))))return!0;if(C.isElementAccessExpression(e)&&!C.isStringLiteralLike(e.argumentExpression)){let t=Ve(e.expression);if(C.isIdentifier(t)&&Rr.has(t.text))return!0}return!1}var B_=4;function iu(e,n){for(let t of e){if(!C.isStringLiteralLike(t)||n>=B_)return!0;let s=C.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Zb=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
+                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,e_=5,n_=6;function t_(e){let n=e>=n_?"a.details":"NULL AS details",t=e>=e_?"ap.surface_complete":Zb;return`${Jb}, ${n}, ${t}${Qb}`}var s_="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",r_="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",o_="SELECT value FROM ingest_meta WHERE key = 'schema_version'",i_=7,a_="SELECT * FROM vulnerability_contract WHERE vulnerable_symbol_id = :id ORDER BY id",l_="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem",d_=`SELECT DISTINCT package_name FROM affected_package
+  WHERE ecosystem = :eco AND package_name >= :lo AND package_name < :hi ORDER BY package_name`,c_="SELECT value FROM ingest_meta WHERE key = 'population_mode'";function ts(e,n=Co){let t=n.open(e,"readonly"),s=t.prepare(o_).get(),r=s!==void 0?qe(s.value):"";if(Rr(r,String(Number(bt)+1)))throw t.close(),new Error(`shard schema ${JSON.stringify(r)} is newer than this cupel understands (v${bt})`);let o=Rr(r,Nr),i=/^\d+$/u.test(r)?Number(r):0,a=t.prepare(t_(i)),l=t.prepare(s_),d=t.prepare(r_),c=t.prepare(l_),f=t.prepare(d_),p=t.prepare(c_),u=i>=i_?t.prepare(a_):null;return{schemaVersion:r,ecosystems(){return c.all({}).map(m=>qe(m.ecosystem))},populationMode(){let m=p.get();return m===void 0?null:qe(m.value)},packageNamesUnder(m,g){if(g.length===0)return[];for(let _=0;_<g.length;_+=1){let S=g.charCodeAt(_);if(S<33||S>126)return[]}let y=g,b=g.slice(0,-1)+String.fromCharCode(g.charCodeAt(g.length-1)+1);return f.all({eco:m,lo:y,hi:b}).map(_=>qe(_.package_name))},advisoriesForPackage(m,g){return a.all({eco:m,name:g}).map(y=>({affected:{id:_t(y.ap_id)??0,advisoryId:qe(y.advisory_id),ecosystem:qe(y.ecosystem),packageName:qe(y.package_name),introduced:Je(y.introduced),fixed:Je(y.fixed),lastAffected:Je(y.last_affected),fixCommit:Je(y.fix_commit),repoUrl:Je(y.repo_url),surfaceComplete:_t(y.surface_complete)===1?1:0},advisory:{id:qe(y.a_id),osvId:Je(y.osv_id),cveId:Je(y.cve_id),summary:Je(y.summary),details:Je(y.details),severity:Je(y.severity),published:Je(y.published),source:qe(y.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(m){return l.all({id:m}).map(g=>{let y=qe(g.derivation);if(!o&&To.has(y))throw new Error(`shard stamped schema ${r===""?"(none)":r} carries a ${y} row, which only a v${Nr} shard may: its stamp is not the truth \u2014 refusing (ADR-108 D2)`);return{id:_t(g.id)??0,affectedPackageId:_t(g.affected_package_id)??0,exportName:Je(g.export_name),symbolKind:qe(g.symbol_kind),matchPattern:Je(g.match_pattern),matchGlobs:Je(g.match_globs),container:Je(g.container),sourcePath:Je(g.source_path),declStart:_t(g.decl_start),declEnd:_t(g.decl_end),astHashBefore:Je(g.ast_hash_before),astHashAfter:Je(g.ast_hash_after),derivation:y,confidence:qe(g.confidence),verified:_t(g.verified)===1?1:0}})},contractsForSymbol(m){if(u===null)return[];let g=[];for(let y of u.all({id:m})){let b=Oa(y);if(b===null||b.vulnerableSymbolId!==m)return"unreadable";g.push(b)}return g},aliasesForSymbol(m){return d.all({id:m}).map(g=>({id:_t(g.id)??0,vulnerableSymbolId:_t(g.vulnerable_symbol_id)??0,aliasPath:qe(g.alias_path),aliasName:qe(g.alias_name)}))},allModels(){let m;try{m=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let g=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return m.map(y=>{let b=_t(y.id)??0;return{packageName:qe(y.package_name),modelId:qe(y.evidence_ref),introduced:qe(y.introduced),fixedBefore:Je(y.fixed_before),evidenceRef:qe(y.evidence_ref),edges:g.all({id:b}).map(_=>({kind:qe(_.kind),anchorExport:qe(_.anchor_export),anchorContainer:Je(_.anchor_container),calleePackage:qe(_.callee_package),calleeContainer:Je(_.callee_container),calleeExport:qe(_.callee_export)}))}})},close(){t.close()}}}function $o(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let u of e)if(u.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${u.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,s=new Map,r=new Map,o=new Map,i=1,a=(u,m,g,y)=>{let b=`${String(g)}:${String(y)}`,_=u.get(b);if(_!==void 0)return _;let S=i;i+=1,u.set(b,S);let k=e[g];if(k===void 0)throw new Error("unreachable: reader index out of range");return m.set(S,{reader:k,id:y}),S},l=e.map(u=>new Set(u.ecosystems?.()??[])),d=u=>{let m=e.map((g,y)=>y).filter(g=>l[g]?.has(u)===!0);return m.length>0?m:e.map((g,y)=>y).filter(g=>e[g]?.ecosystems===void 0)},c=(u,m)=>({...m,id:a(r,o,u,m.id),affectedPackageId:a(t,s,u,m.affectedPackageId)}),f=e.map((u,m)=>m),p=u=>{let m;for(let g of u){let y=e[g];if(y?.populationMode===void 0)continue;let b=y.populationMode();if(b!=="census")return b;m=b}return m};return{schemaVersion:n.schemaVersion,ecosystems(){let u=new Set;for(let m of l)for(let g of m)u.add(g);return[...u].sort()},populationMode(){return p(f)??null},populationModeFor(u){let m=d(u);return p(m.length>0?m:f)},packageNamesUnder(u,m){let g=new Set;for(let y of d(u))for(let b of e[y]?.packageNamesUnder?.(u,m)??[])g.add(b);return[...g].sort()},advisoriesForPackage(u,m){let g=[];for(let y of d(u)){let b=e[y];if(b!==void 0)for(let _ of b.advisoriesForPackage(u,m))g.push({..._,affected:{..._.affected,id:a(t,s,y,_.affected.id)}})}return g},symbolsForAffected(u){let m=s.get(u);if(m===void 0)return[];let g=e.indexOf(m.reader);return m.reader.symbolsForAffected(m.id).map(y=>c(g,y))},aliasesForSymbol(u){let m=o.get(u);if(m===void 0)return[];let g=e.indexOf(m.reader);return m.reader.aliasesForSymbol(m.id).map(y=>({...y,vulnerableSymbolId:a(r,o,g,y.vulnerableSymbolId)}))},contractsForSymbol(u){let m=o.get(u);if(m===void 0)return[];let g=m.reader.contractsForSymbol?.(m.id)??[];return g==="unreadable"?g:g.map(y=>({...y,vulnerableSymbolId:u}))},allModels(){return e.flatMap(u=>u.allModels?.()??[])},close(){for(let u of e)u.close()}}}import{realpathSync as Gt}from"node:fs";import Tn from"node:path";import Pa from"typescript";var Do=class{#e;#n;#t;#s=[];reasons=new Set;constructor(n,t,s){this.#e=n,this.#n=t,this.#t=[...s].sort((r,o)=>r.start-o.start)}value(n,t){let[s,r]=Ca(this.#e,n,t);if(s>=r)return;let o=y_(this.#e.slice(s,Math.min(r,s+16)));this.#s.push({code:[{start:s,end:r}],lead:o?";(":";",between:[],tail:o?")":""})}call(n,t){let[s,r]=Ca(this.#e,n,t);if(s>=r)return;let o=h_(this.#e.slice(s,r));this.#s.push({code:[{start:s,end:r}],lead:o?";":";(",between:[],tail:o?"()":")()"})}namedCall(n,t){let[s,r]=t===null?[0,0]:Ca(this.#e,t.start,t.end);if(t===null||s>=r){this.#s.push({code:[n],lead:";",between:[],tail:"()"});return}this.#s.push({code:[n,{start:s,end:r}],lead:";",between:["("],tail:")"})}cannot(n){this.reasons.add(n)}write(){let n=[...this.#t.map(i=>({fixed:!0,seg:i})),...this.#s.map(i=>({fixed:!1,item:i}))],t=i=>i.fixed?i.seg.start:i.item.code[0]?.start??0,s=i=>i.fixed?i.seg.end:i.item.code[i.item.code.length-1]?.end??0;n.sort((i,a)=>t(i)-t(a));let r=0,o=null;for(let i=0;i<n.length;i+=1){let a=n[i];if(a===void 0)continue;let l=t(a);if(l<r){this.reasons.add("a template expression overlaps other code");return}if(a.fixed){r=a.seg.end,o=null;continue}let d=a.item,c=n[i+1],f=c===void 0?this.#e.length:t(c),p=c!==void 0&&!c.fixed?d.tail:`${d.tail};`,u=this.#o(r,l,d.lead.length);if(u===null){let _=o!==null&&d.code.length===1?o:null,S=_===null?null:this.#r(s(a),f,p.length-d.tail.length+1);if(_!==null&&S!==null){this.#n[_.close]=" ";for(let k of d.code)bu(this.#e,this.#n,k.start,k.end);Lo(this.#n,S,`)${p.slice(d.tail.length)}`),r=(S[S.length-1]??s(a))+1,o=null;continue}this.reasons.add("a template expression could not be placed in the module");continue}let m=[],g=!0;for(let _=0;_+1<d.code.length;_+=1){let S=d.code[_],k=d.code[_+1],v=d.between[_]??"";if(S===void 0||k===void 0)continue;let I=this.#r(S.end,k.start,v.length);I===null?g=!1:m.push(I)}let y=s(a),b=this.#r(y,f,p.length);if(!g||b===null){this.reasons.add("a template expression could not be placed in the module");continue}for(let _ of d.code)bu(this.#e,this.#n,_.start,_.end);Lo(this.#n,u,d.lead),m.forEach((_,S)=>{Lo(this.#n,_,d.between[S]??"")}),Lo(this.#n,b,p),r=b.length>0?(b[b.length-1]??y)+1:y,o=d.tail==="()"&&b.length>=2?{open:b[0]??y,close:b[1]??y}:null}}#o(n,t,s){let r=[];for(let o=t-1;o>=n&&r.length<s;o-=1){let i=this.#e[o];i!==`
+`&&i!=="\r"&&r.push(o)}return r.length===s?r.reverse():null}#r(n,t,s){let r=[];for(let o=n;o<t&&r.length<s;o+=1){let i=this.#e[o];i!==`
+`&&i!=="\r"&&r.push(o)}return r.length===s?r:null}};function bu(e,n,t,s){for(let r=t;r<s;r+=1)n[r]=e[r]??" "}function Lo(e,n,t){n.forEach((s,r)=>{e[s]=t[r]??" "})}function h_(e){if(e.length===0)return!1;let n=!0;for(let t of e){if(t==="."){if(n)return!1;n=!0;continue}let s=t>="a"&&t<="z"||t>="A"&&t<="Z"||t==="_"||t==="$",r=s||t>="0"&&t<="9";if(n?!s:!r)return!1;n=!1}return!n}function Ca(e,n,t){let s=n,r=t;for(;s<r&&Qe(e[s]??"");)s+=1;for(;r>s&&Qe(e[r-1]??"");)r-=1;return[s,r]}function Qe(e){return e===" "||e==="	"||e===`
+`||e==="\r"||e==="\f"}function y_(e){if(e.startsWith("{"))return!0;for(let n of["function","class","let","async"]){if(!e.startsWith(n))continue;let t=e[n.length]??"";if(!b_(t))return!0}return!1}function b_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"||e>="0"&&e<="9"||e==="_"||e==="$"}function Fo(e,n,t){let s=["b"],r=n+1;for(;r<t;){let o=s[s.length-1],i=e[r]??"";if(o==="t"){i==="\\"?r+=2:i==="`"?(s.pop(),r+=1):i==="$"&&e[r+1]==="{"?(s.push("s"),r+=2):r+=1;continue}if(i==="'"||i==='"'){for(r+=1;r<t&&e[r]!==i&&e[r]!==`
+`;)r+=e[r]==="\\"?2:1;r+=1;continue}if(i==="`"){s.push("t"),r+=1;continue}if(i==="/"&&e[r+1]==="/"){let a=e.indexOf(`
+`,r);r=a===-1?t:a+1;continue}if(i==="/"&&e[r+1]==="*"){let a=e.indexOf("*/",r+2);r=a===-1?t:a+2;continue}if(i==="{"){s.push("b"),r+=1;continue}if(i==="}"){let a=s.pop();if(s.length===0&&a==="b")return r;r+=1;continue}r+=1}return-1}var __=64,S_=32*1024;function _u(e,n,t){let s=0,r=n+1;for(;s<__;){let o=e.indexOf("}",r);if(o===-1||o>=t||o-n>S_)return-1;if(s+=1,x_(e.slice(n+1,o)))return o;r=o+1}return-1}function x_(e){if(e.trim().length===0)return!0;let n=e.trimStart().startsWith("...")?`[${e}
+];`:`(${e}
+);`,t=Pa.createSourceFile("probe.tsx",n,Pa.ScriptTarget.Latest,!1,Pa.ScriptKind.TSX),s=t.parseDiagnostics;return s!==void 0&&s.length>0?!1:t.statements.length===1}function Lt(e,n,t,s,r){let o=n+1,i=o;for(;o<t&&!Qe(e[o]??"")&&e[o]!==">"&&e[o]!=="/";)o+=1;let a=e.slice(i,o),l=[],d=[];for(;o<t;){for(;o<t&&Qe(e[o]??"");)o+=1;let c=e[o];if(c===void 0||o>=t)return null;if(c===">")return{name:a,start:n,end:o+1,selfClosing:!1,attributes:l,braces:d};if(c==="/"&&e[o+1]===">")return{name:a,start:n,end:o+2,selfClosing:!0,attributes:l,braces:d};if(c==="{"&&s){let y=r(o);if(y===-1)return null;d.push({open:o,close:y}),o=y+1;continue}let f=o;for(;o<t;){let y=e[o]??"";if(Qe(y)||y==="="||y===">"||y==="/"&&e[o+1]===">")break;o+=1}if(o===f){o+=1;continue}let p=o,u=o;for(;u<t&&Qe(e[u]??"");)u+=1;if(e[u]!=="="){l.push({name:e.slice(f,p),nameStart:f,nameEnd:p,value:null});continue}let m=u;for(u+=1;u<t&&Qe(e[u]??"");)u+=1;let g=e[u];if(g==='"'||g==="'"){let y=e.indexOf(g,u+1);if(y===-1||y>=t)return null;l.push({name:e.slice(f,p),nameStart:f,nameEnd:p,value:{kind:"quoted",start:u+1,end:y,delimiters:[m,u,y]}}),o=y+1}else if(g==="{"&&s){let y=r(u);if(y===-1)return null;l.push({name:e.slice(f,p),nameStart:f,nameEnd:p,value:{kind:"brace",start:u+1,end:y,delimiters:[m,u,y]}}),o=y+1}else{let y=u;for(;u<t&&!Qe(e[u]??"")&&e[u]!==">";)u+=1;l.push({name:e.slice(f,p),nameStart:f,nameEnd:p,value:{kind:"bare",start:y,end:u,delimiters:[m]}}),o=u}}return null}var k_=new Set(["component","slot","template","transition","transition-group","keep-alive","teleport","suspense","router-view","router-link"]),w_=new Set(["v-if","v-else-if","v-show","v-html","v-text","v-model","v-memo","v-bind","v-on"]),v_=new Set(["v-else","v-once","v-pre","v-cloak","v-slot"]);function xu(e,n,t){A_(e)&&n.cannot("text outside the component's blocks is not read");let s=E_(e);if(s===null)return;if(s.kind==="unclosed"){n.cannot("the <template> block is not closed");return}if(s.lang!==""&&s.lang!=="html"){n.cannot(`a template in lang "${$_(s.lang)}" is not read`);return}let{start:r,end:o}=s,i=r;for(;i<o;){let a=e.indexOf("<",i),l=e.indexOf("{{",i),d=a===-1||a>=o?o:a;if(l!==-1&&l<d){let f=e.indexOf("}}",l+2);if(f===-1||f>o){n.cannot("a {{ in the template is not closed");return}n.value(l+2,f),i=f+2;continue}if(d===o)break;if(e.startsWith("<!--",a)){let f=e.indexOf("-->",a+4);i=f===-1?o:f+3;continue}if(e[a+1]==="/"||!I_(e[a+1]??"")){let f=e.indexOf(">",a);i=e[a+1]==="/"&&f!==-1?f+1:a+1;continue}let c=Lt(e,a,o,!1,()=>-1);if(c===null){n.cannot("a tag in the template is not closed");return}N_(e,c.name,c.attributes,t,n);for(let f of c.attributes)R_(e,f,n);i=c.end}}function E_(e){let n=0;for(;n<e.length;){let t=e.indexOf("<",n);if(t===-1)return null;if(e.startsWith("<!--",t)){let a=e.indexOf("-->",t+4);if(a===-1)return null;n=a+3;continue}let s=Lt(e,t,e.length,!1,()=>-1);if(s===null)return null;let r=s.name.toLowerCase();if(r==="template"){let a=s.attributes.find(c=>c.name.toLowerCase()==="lang"),l=a?.value===null||a===void 0?"":e.slice(a.value.start,a.value.end);if(s.selfClosing)return{kind:"found",start:s.end,end:s.end,lang:l};let d=ku(e,s.end);return d===-1?{kind:"unclosed"}:{kind:"found",start:s.end,end:d,lang:l.toLowerCase()}}let o=s.selfClosing?s.end:wu(e,s.end,r);if(o===-1)return null;let i=e.indexOf(">",o);n=i===-1?e.length:i+1}return null}function A_(e){let n=0;for(;n<e.length;){let t=e[n]??"";if(Qe(t)||t==="\uFEFF"){n+=1;continue}if(t!=="<")return!0;if(e.startsWith("<!--",n)){let a=e.indexOf("-->",n+4);if(a===-1)return!0;n=a+3;continue}let s=Lt(e,n,e.length,!1,()=>-1);if(s===null)return!0;if(s.selfClosing){n=s.end;continue}let r=s.name.toLowerCase(),o=r==="template"?ku(e,s.end):wu(e,s.end,r);if(o===-1)return!0;let i=e.indexOf(">",o);n=i===-1?e.length:i+1}return!1}function ku(e,n){let t=1,s=n;for(;s<e.length;){let r=e.indexOf("<",s);if(r===-1)return-1;if(e.startsWith("<!--",r)){let a=e.indexOf("-->",r+4);if(a===-1)return-1;s=a+3;continue}let o=e[r+1]==="/",i=o?r+2:r+1;if(e.slice(i,i+8).toLowerCase()==="template"){let a=e[i+8]??"";if(a===">"||a==="/"||Qe(a))if(o){if(t-=1,t===0)return r}else{let l=Lt(e,r,e.length,!1,()=>-1);l!==null&&!l.selfClosing&&(t+=1)}}s=r+1}return-1}function wu(e,n,t){let s=`</${t}`,r=n;for(;r<e.length;){let o=e.indexOf("</",r);if(o===-1)return-1;if(e.slice(o,o+s.length).toLowerCase()===s)return o;r=o+2}return-1}function I_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function N_(e,n,t,s,r){if(!(n!==n.toLowerCase()||n.includes("-")||n.includes("."))&&n.toLowerCase()!=="component")return;let i=M_(n);if(k_.has(i)){if(i==="component"){let l=t.find(f=>f.name==="is"),d=t.find(f=>f.name===":is"||f.name==="v-bind:is");l!==void 0&&r.cannot("a <component is> names a component by string");let c=d?.value??null;if(c!==null){let f=e.slice(c.start,c.end).trimStart()[0]??"";(f==="'"||f==='"'||f==="`")&&r.cannot("a <component :is> names a component by string")}}return}let a=n.split(".")[0]??n;s.has(a)||s.has(Eu(a))||s.has(T_(a))||r.cannot("a component used without an import (it may be registered globally)")}function R_(e,n,t){let s=n.name,r=n.value;if(s.startsWith("#"))return;let o=s.startsWith(":")||s.startsWith("v-bind:")||s.startsWith("."),i=s.startsWith("@")||s.startsWith("v-on:");if(o||i){if((s.startsWith(":")||s.startsWith("@")||s.startsWith(".")?s.slice(1):s.slice(s.indexOf(":")+1)).startsWith("[")){t.cannot("a dynamic directive argument is not read");return}if(r===null)return;i?Su(e,r.start,r.end,t):t.value(r.start,r.end);return}if(!s.startsWith("v-"))return;let a=s.slice(0,O_(s));if(!v_.has(a)){if(a==="v-for"){if(r===null)return;let l=C_(e,r.start,r.end);l===-1?t.cannot("a v-for this reader cannot split"):t.value(l,r.end);return}if(w_.has(a)){r!==null&&(a==="v-on"?Su(e,r.start,r.end,t):t.value(r.start,r.end));return}t.cannot("a custom directive is not read")}}function O_(e){for(let n=0;n<e.length;n+=1){let t=e[n];if(t===":"||t===".")return n}return e.length}function Su(e,n,t,s){let r=e.slice(n,t).trim(),o=r.startsWith("function")||r.startsWith("async")||r.startsWith("(")&&r.includes("=>")||P_(r);vu(r)||o?s.call(n,t):s.value(n,t)}function P_(e){let n=e.indexOf("=>");return n>0&&vu(e.slice(0,n).trim())}function vu(e){if(e.length===0)return!1;let n=!0;for(let t of e){if(t==="."){if(n)return!1;n=!0;continue}let s=t>="a"&&t<="z"||t>="A"&&t<="Z"||t==="_"||t==="$",r=s||t>="0"&&t<="9";if(n?!s:!r)return!1;n=!1}return!n}function C_(e,n,t){let s=0;for(let r=n;r<t;r+=1){let o=e[r]??"";if(o==="("||o==="["||o==="{")s+=1;else if(o===")"||o==="]"||o==="}")s-=1;else if(s===0&&Qe(e[r-1]??"")){for(let i of["in","of"])if(e.startsWith(i,r)&&Qe(e[r+i.length]??""))return r+i.length}}return-1}function M_(e){let n="";for(let t=0;t<e.length;t+=1){let s=e[t]??"",r=s.toLowerCase();s!==r&&t>0&&(n+="-"),n+=r}return n}function Eu(e){return e.split("-").map(n=>n.length===0?"":(n[0]??"").toUpperCase()+n.slice(1)).join("")}function T_(e){let n=Eu(e);return n.length===0?n:(n[0]??"").toLowerCase()+n.slice(1)}function $_(e){let n="";for(let t of e.slice(0,40)){let s=t.charCodeAt(0);n+=s>=32&&s<127&&t!=='"'?t:"?"}return n}function Au(e,n,t){let s=e.length,r=l=>_u(e,l,s),o=!1,i=(l,d)=>{let c=e.slice(l+1,d);c.includes("<")&&(o=!0);let f=c.trimStart();if(f.startsWith("...")){let p=l+1+(c.length-f.length)+3;t.value(p,d)}else t.value(l+1,d)},a=n;for(;a<s;){let l=e.indexOf("<",a),d=e.indexOf("{",a);if(l===-1&&d===-1)break;if(d!==-1&&(l===-1||d<l)){let u=r(d);if(u===-1)return t.cannot("a { in the template does not close as an expression"),o;i(d,u),a=u+1;continue}if(e.startsWith("<!--",l)){let u=e.indexOf("-->",l+4);a=u===-1?s:u+3;continue}if(e[l+1]==="/"||!L_(e[l+1]??"")){let u=e.indexOf(">",l);a=e[l+1]==="/"&&u!==-1?u+1:l+1;continue}let c=Lt(e,l,s,!0,r);if(c===null)return t.cannot("a tag in the template is not closed"),o;let f=c.name.toLowerCase(),p=c.attributes.some(u=>u.name==="is:raw");if((f==="script"||f==="style"||p)&&!c.selfClosing){let u=D_(e,c.end,f);if(u===-1)return t.cannot(`a <${F_(f)}> is not closed`),o;let m=e.indexOf(">",u);a=m===-1?s:m+1;continue}for(let u of c.braces)i(u.open,u.close);for(let u of c.attributes)u.value?.kind==="brace"&&i(u.value.start-1,u.value.end);a=c.end}return o}function L_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function D_(e,n,t){let s=`</${t}`,r=n;for(;r<e.length;){let o=e.indexOf("</",r);if(o===-1)return-1;if(e.slice(o,o+s.length).toLowerCase()===s){let i=e[o+s.length]??"";if(i===">"||Qe(i))return o}r=o+2}return-1}function F_(e){let n="";for(let t of e.slice(0,40)){let s=t.charCodeAt(0);n+=s>=32&&s<127?t:"?"}return n}var j_=["use:","transition:","in:","out:","animate:"];function Iu(e,n){let t=e.length,s=0;for(;s<t;){let r=e.indexOf("<",s),o=e.indexOf("{",s);if(r===-1&&o===-1)break;if(o!==-1&&(r===-1||o<r)){let d=Fo(e,o,t);if(d===-1){n.cannot("a { in the template is not closed");return}K_(e,o,d,n),s=d+1;continue}if(e.startsWith("<!--",r)){let d=e.indexOf("-->",r+4);s=d===-1?t:d+3;continue}if(e[r+1]==="/"){let d=e.indexOf(">",r);s=d===-1?t:d+1;continue}let i=e[r+1]??"";if(!B_(i)){s=r+1;continue}let a=Lt(e,r,t,!0,d=>Fo(e,d,t));if(a===null){n.cannot("a tag in the template is not closed");return}let l=a.name.toLowerCase();if((l==="script"||l==="style")&&!a.selfClosing){let d=G_(e,a.end,l);if(d===-1){n.cannot(`a <${l}> is not closed`);return}let c=e.indexOf(">",d);s=c===-1?t:c+1;continue}for(let d of a.braces){let c=e.slice(d.open+1,d.close),f=c.length-c.trimStart().length;if(c.trimStart().startsWith("...")){let p=d.open+1+f+3;n.value(p,d.close)}else n.value(d.open+1,d.close)}for(let d of a.attributes)W_(e,d,n);s=a.end}}function B_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function G_(e,n,t){let s=`</${t}`,r=n;for(;r<e.length;){let o=e.indexOf("</",r);if(o===-1)return-1;if(e.slice(o,o+s.length).toLowerCase()===s)return o;r=o+2}return-1}function K_(e,n,t,s){let r=n+1;for(;r<t&&Qe(e[r]??"");)r+=1;let o=e[r]??"";if(o!=="#"&&o!==":"&&o!=="/"&&o!=="@"){s.value(n+1,t);return}if(o==="/")return;let i=r+1;for(;i<t&&z_(e[i]??"");)i+=1;let a=`${o}${e.slice(r+1,i)}`;switch(a){case"#if":case"#key":case"@html":case"@const":case"@render":case"@debug":{s.value(i,t);return}case":else":{let l=i;for(;l<t&&Qe(e[l]??"");)l+=1;e.startsWith("if",l)&&Qe(e[l+2]??"")?s.value(l+2,t):e.slice(i,t).trim()!==""&&s.cannot("an {:else \u2026} form this reader does not know");return}case"#each":{let l=Ma(e,i,t,"as"),d=l===-1?t:l;s.value(i,d);return}case"#await":{let l=Ma(e,i,t,"then"),d=Ma(e,i,t,"catch"),c=[l,d].filter(p=>p!==-1),f=c.length===0?t:Math.min(...c);s.value(i,f);return}case"#snippet":case":then":case":catch":return;default:s.cannot(`a {${a}} block this reader does not know`)}}function z_(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function Ma(e,n,t,s){let r=0,o=n;for(;o<t;){let i=e[o]??"";if(i==="'"||i==='"'||i==="`"){let a=e.indexOf(i,o+1);o=a===-1||a>t?t:a+1;continue}if(i==="("||i==="["||i==="{")r+=1;else if(i===")"||i==="]"||i==="}")r-=1;else if(r===0&&Qe(e[o-1]??"")&&e.startsWith(s,o)&&Qe(e[o+s.length]??""))return o;o+=1}return-1}function W_(e,n,t){let s=n.name,r=n.value,o=j_.find(a=>s.startsWith(a));if(o!==void 0){let a=n.nameStart+o.length,l=s.indexOf("|",o.length),d=l===-1?n.nameEnd:n.nameStart+l,c={start:a,end:d};r===null?t.namedCall(c,null):r.kind==="brace"?t.namedCall(c,{start:r.start,end:r.end}):t.cannot(`a ${o} directive with a quoted value`);return}let i=s.startsWith("on:")||U_(s);if(r===null){for(let a of["bind:","class:","style:"]){if(!s.startsWith(a))continue;let l=n.nameStart+a.length,d=s.indexOf("|",a.length),c=d===-1?n.nameEnd:n.nameStart+d;t.value(l,c)}return}if(r.kind==="brace"){i?t.call(r.start,r.end):s.startsWith("let:")||t.value(r.start,r.end);return}r.kind==="quoted"&&H_(e,r.start,r.end,t)}function U_(e){if(!e.startsWith("on")||e.length<3)return!1;let n=e[2]??"";return n>="a"&&n<="z"}function H_(e,n,t,s){let r=n;for(;r<t;){let o=e.indexOf("{",r);if(o===-1||o>=t)return;let i=Fo(e,o,t);if(i===-1){s.cannot("a { in an attribute value is not closed");return}s.value(o+1,i),r=i+1}}import on from"typescript";function St(e){return e.endsWith(".vue")?"vue":e.endsWith(".svelte")?"svelte":e.endsWith(".astro")?"astro":null}var q_=new Set(["","js","javascript","ts","typescript","tsx","jsx"]),V_=new Set(["tsx","jsx"]),X_=new Set(["","module","text/javascript","application/javascript","text/typescript"]),Y_=new Set(["application/ld+json","application/json","importmap","speculationrules"]);function Or(e,n){let t=eS(n),s=new Set,r=!1,o=[],i=0,a=null,l=[];if(e==="astro"){let c=nS(n);c.kind==="unclosed"?(s.add("its frontmatter fence is not closed"),i=n.length):c.kind==="found"&&($a(n,t,c.start,c.end),o.push({start:c.start,end:c.end}),a={start:c.start,end:c.end},i=c.after)}for(let c of tS(n,i)){if(c.kind==="unclosed"){s.add("a <script> tag is not closed");break}let f=(c.attrs.get("type")??"").toLowerCase();if(Y_.has(f))continue;if(!X_.has(f)){s.add(`a script tag of type "${Nu(f)}" is not read`);continue}if(c.attrs.has("src")){s.add("a <script src> is not read");continue}if(e==="astro"){l.push({start:c.start,end:c.end});continue}let p=(c.attrs.get("lang")??"").toLowerCase();if(!q_.has(p)){s.add(`a script tag in lang "${Nu(p)}" is not read`);continue}V_.has(p)&&(r=!0),$a(n,t,c.start,c.end),o.push({start:c.start,end:c.end})}if(l.length>0)for(let c of J_(n,t,a,l,o))s.add(c);let d=new Do(n,t,o);e==="svelte"?Iu(n,d):e==="vue"?xu(n,d,Q_(n,o)):Au(n,i,d)&&(r=!0),d.write();for(let c of d.reasons)s.add(c);return{code:t.join(""),scriptKind:r?"tsx":"ts",partial:[...s]}}function J_(e,n,t,s,r){let o=[],i=[];t!==null&&i.push(Ta(e.slice(t.start,t.end)));for(let a of s){let l=Ta(e.slice(a.start,a.end));if(!l.parses){o.push("an Astro <script> tag does not parse on its own");continue}if(i.some(d=>Z_(l,d))){o.push("an Astro <script> tag shares a name with the frontmatter or another script");continue}$a(e,n,a.start,a.end),r.push({start:a.start,end:a.end}),i.push(l)}return o}function Q_(e,n){let t=new Set;for(let s of n)for(let r of Ta(e.slice(s.start,s.end)).declared)t.add(r);return t}function Z_(e,n){for(let t of e.declared)if(n.declared.has(t)||n.used.has(t))return!0;for(let t of n.declared)if(e.used.has(t))return!0;return!1}function Ta(e){let n=on.createSourceFile("block.ts",e,on.ScriptTarget.Latest,!0,on.ScriptKind.TS),t=n.parseDiagnostics,s=new Set,r=new Set;for(let i of n.statements)if(on.isImportDeclaration(i)){let a=i.importClause;a?.name!==void 0&&s.add(a.name.text);let l=a?.namedBindings;if(l!==void 0&&on.isNamespaceImport(l)&&s.add(l.name.text),l!==void 0&&on.isNamedImports(l))for(let d of l.elements)s.add(d.name.text)}else if(on.isVariableStatement(i))for(let a of i.declarationList.declarations)Ru(a.name,s);else(on.isFunctionDeclaration(i)||on.isClassDeclaration(i)||on.isEnumDeclaration(i)||on.isInterfaceDeclaration(i)||on.isTypeAliasDeclaration(i)||on.isModuleDeclaration(i))&&i.name!==void 0&&on.isIdentifier(i.name)&&s.add(i.name.text);let o=i=>{if(on.isIdentifier(i)){let a=i.parent;on.isPropertyAccessExpression(a)&&a.name===i||r.add(i.text)}on.forEachChild(i,o)};return o(n),{parses:t===void 0||t.length===0,declared:s,used:r}}function Ru(e,n){if(on.isIdentifier(e)){n.add(e.text);return}for(let t of e.elements)on.isBindingElement(t)&&Ru(t.name,n)}function eS(e){let n=new Array(e.length);for(let t=0;t<e.length;t+=1){let s=e[t]??" ";n[t]=s===`
+`||s==="\r"?s:" "}return n}function $a(e,n,t,s){for(let r=t;r<s;r+=1)n[r]=e[r]??" "}function Nu(e){let n="";for(let t of e.slice(0,40)){let s=t.charCodeAt(0);n+=s>=32&&s<127&&t!=='"'?t:"?"}return n}function nS(e){let n=0;for(e.charCodeAt(0)===65279&&(n=1);n<e.length&&_s(e[n]??"");)n+=1;if(!e.startsWith("---",n))return{kind:"none"};let t=e.indexOf(`
+`,n);if(t===-1)return{kind:"unclosed"};if(e.slice(n+3,t).trim()!=="")return{kind:"none"};let s=t+1;for(;s<=e.length;){let r=e.indexOf(`
+`,s),o=e.slice(s,r===-1?e.length:r);if(o.trimEnd()==="---"||o.trim()==="---")return{kind:"found",start:t+1,end:s,after:s+o.length};if(r===-1)break;s=r+1}return{kind:"unclosed"}}function _s(e){return e===" "||e==="	"||e===`
+`||e==="\r"||e==="\f"}function tS(e,n){let t=[],s=n;for(;s<e.length;){let r=e.indexOf("<",s);if(r===-1)break;if(e.startsWith("<!--",r)){let d=e.indexOf("-->",r+4);if(d===-1)break;s=d+3;continue}let o=sS(e,r);if(o!=="script"&&o!=="style"){s=r+1;continue}let i=rS(e,r+1+o.length);if(i===null){o==="script"&&t.push({kind:"unclosed"});break}if(i.selfClosing){o==="script"&&t.push({kind:"block",start:i.end,end:i.end,attrs:i.attrs}),s=i.end;continue}let a=oS(e,i.end,o);if(a===-1){o==="script"&&t.push({kind:"unclosed"});break}o==="script"&&t.push({kind:"block",start:i.end,end:a,attrs:i.attrs});let l=e.indexOf(">",a);s=l===-1?e.length:l+1}return t}function sS(e,n){for(let t of["script","style"]){if(e.slice(n+1,n+1+t.length).toLowerCase()!==t)continue;let s=e[n+1+t.length]??"";if(s===">"||s==="/"||_s(s))return t}return null}function rS(e,n){let t=new Map,s=n;for(;s<e.length;){for(;s<e.length&&_s(e[s]??"");)s+=1;let r=e[s];if(r===void 0)return null;if(r===">")return{end:s+1,selfClosing:!1,attrs:t};if(r==="/"&&e[s+1]===">")return{end:s+2,selfClosing:!0,attrs:t};let o=s;for(;s<e.length;){let l=e[s]??"";if(_s(l)||l==="="||l===">"||l==="/"&&e[s+1]===">")break;s+=1}let i=e.slice(o,s).toLowerCase();if(i.length===0){s+=1;continue}for(;s<e.length&&_s(e[s]??"");)s+=1;if(e[s]!=="="){t.set(i,"");continue}for(s+=1;s<e.length&&_s(e[s]??"");)s+=1;let a=e[s];if(a==='"'||a==="'"){let l=e.indexOf(a,s+1);if(l===-1)return null;t.set(i,e.slice(s+1,l)),s=l+1}else{let l=s;for(;s<e.length&&!_s(e[s]??"")&&e[s]!==">";)s+=1;t.set(i,e.slice(l,s))}}return null}function oS(e,n,t){let s=`</${t}`,r=n;for(;r<e.length;){let o=e.indexOf("</",r);if(o===-1)return-1;if(e.slice(o,o+s.length).toLowerCase()===s)return o;r=o+2}return-1}import{realpathSync as is}from"node:fs";import{isBuiltin as Ja}from"node:module";import cn from"node:path";import C from"typescript";function La(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function Ze(e){let n=La(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function Bn(e){let n=La(e);if(n.startsWith("@")){let s=n.indexOf("/");if(s===-1)return n;let r=n.indexOf("/",s+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Ou(e){let n=La(e),t=Bn(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as iS,statSync as Da}from"node:fs";var ss=16*1024*1024;function Hs(e,n){try{let t=Da(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:iS(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function _n(e){let n=Hs(e,ss);return n.kind==="ok"?n.text:null}function st(e){try{return Da(e).isFile()}catch{return!1}}function Pu(e){try{let n=Da(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as aS,realpathSync as Ba}from"node:fs";import Ne from"node:path";import jo from"typescript";var Fu=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Cn(e){return Fu.some(([n])=>e.endsWith(n))}function lS(e){for(let[n,t]of Fu)if(e.endsWith(n)){let s=e.slice(0,-n.length);return t.map(r=>s+r)}return[]}var dS=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function ju(e){if(Cn(e))return e;for(let[n,t]of dS)if(e.endsWith(n)){let s=e.slice(0,-n.length);for(let r of t){let o=s+r;if(st(o))return o}return e}return e}var Ga=[jo.ModuleKind.CommonJS,jo.ModuleKind.ESNext],Ka=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function Pr(e,n,t,s,r,o){let i=jo.resolveModuleName(e,n,t,s,void 0,void 0,r).resolvedModule;if(i===void 0)return null;let a=i.resolvedFileName;if(o){for(let l of lS(a))if(st(l))return l}return a}var Bu=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],cS=[".js",".json",".node"],uS=["index.js","index.json","index.node"];function Bo(e){return Cn(e)?!1:Bu.some(n=>e.endsWith(n))||St(e)!==null}function Gu(e){if(st(e))return e;for(let n of cS)if(st(e+n))return e+n;return null}function Cu(e){for(let n of uS){let t=Ne.join(e,n);if(st(t))return t}return null}var Ku=[".ts",".tsx",".cts",".mts",".jsx"];function fS(e){for(let n of Ku)if(st(e+n))return e+n;return null}function pS(e){for(let n of Ku){let t=Ne.join(e,"index"+n);if(st(t))return t}return null}function za(e){let n=_n(Ne.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let s=Ne.join(e,t),r=Gu(s)??Cu(s);if(r!==null)return r}}catch{}return Cu(e)}function zu(e){return Gu(e)??za(e)??fS(e)??pS(e)}function Wu(e){return zu(e)!==null}function mS(e,n){let t=e.split(Ne.sep),s=n.split("/"),r=null;for(let i=t.length-s.length-1;i>=0;i-=1)if(t[i]==="node_modules"&&s.every((a,l)=>t[i+1+l]===a)){r=t.slice(0,i+1+s.length).join(Ne.sep);break}if(r===null||r==="")return null;let o=_n(Ne.join(r,"package.json"));if(o===null)return null;try{let i=JSON.parse(o),a=i.exports,l=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(i.name!==n||l)return null}catch{return null}try{return Ba(r)}catch{return null}}function gS(e,n){let t=zu(Ne.join(e,n));if(t===null)return null;let s;try{s=Ba(t)}catch{return null}let r=e.endsWith(Ne.sep)?e:e+Ne.sep;return s!==e&&!s.startsWith(r)||Cn(s)||!Bu.some(o=>s.endsWith(o))?null:s}function hS(e,n){let t=Ou(e);return t===""||t.includes("\0")||t.split("/").some(s=>s===""||s==="."||s===".."||s==="node_modules")?null:gS(n,t)}var Ss={kind:"nothing-loads"},Uu={kind:"absent"},Fa=8192;function ja(e,n){let t=n.get(e);if(t!==void 0)return t;let s,r=null;try{r=aS(e);let o=new Set,i=!1;for(;;){let a=r.readSync();if(a===null)break;if(o.size>=Fa){i=!0;break}o.add(a.name)}s={names:o,truncated:i}}catch{s=null}finally{try{r?.closeSync()}catch{}}return n.set(e,s),s}var yS=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function Wa(e){return yS.some(n=>e.length>n.length&&e.endsWith(n))}function rs(e,n){let t=e.endsWith(Ne.sep)?e:e+Ne.sep;return n===e||n.startsWith(t)}function Mu(e,n){let t;try{t=Ba(n)}catch{return{kind:"missing"}}return rs(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Tu(e,n){let t=(n+".").toLowerCase(),s=[];for(let r of e){let o=r.toLowerCase();o.length>t.length&&o.startsWith(t)&&s.push(r)}return s}function bS(e,n,t){let s=Ne.dirname(n);if(!rs(e,s))return null;let r=ja(s,t);if(r===null)return null;let o=Ne.basename(n);return r.names.has(o)?o:null}function $u(e){return Wa(e.split("/").pop()??"")?Ss:Uu}function Lu(e,n){let t=e.filter(r=>!Wa(r));if(t.length===0)return Ss;let s=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${s}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Hu(e,n,t,s){let r=e,o=r.indexOf("?");o!==-1&&(r=r.slice(0,o));let i=r.indexOf("#");if(i!==-1&&(r=r.slice(0,i)),r===""||r.includes("\0"))return Ss;let a=Ne.resolve(Ne.dirname(n),r);if(!rs(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let l=Mu(t,a);if(l.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(l.kind==="ok"){let m=Pu(l.real);if(m==="file"){let _=bS(t,l.real,s);return _!==null&&Wa(_)?Ss:{kind:"unanalyzable",reason:_===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${_}") the analyzer cannot parse`,why:_===null?"probe-refused":"sibling-unparsable"}}if(m!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let g=ja(l.real,s);if(g===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let y=Tu(g.names,"index"),b=Lu(y,"a directory index");return b.kind==="unanalyzable"?b:g.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:g.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Fa)} entries and was not fully probed`,why:"probe-refused"}:y.length===0?Uu:Ss}let d=Ne.basename(a);if(d===""||d==="."||d==="..")return Ss;let c=Mu(t,Ne.dirname(a));if(c.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(c.kind==="missing")return $u(r);let f=ja(c.real,s);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let p=Tu(f.names,d),u=Lu(p,"a sibling file exists");return u.kind==="unanalyzable"?u:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Fa)} entries and was not fully probed`,why:"probe-refused"}:p.length===0?$u(r):Ss}function Ua(e,n){let t=Bn(e),s=Ne.dirname(n);for(let r=0;r<64;r+=1){let o=Ne.join(s,"node_modules",...t.split("/"));if(_n(Ne.join(o,"package.json"))!==null)return o;let i=Ne.dirname(s);if(i===s)return null;s=i}return null}function Du(e,n,t,s,r){let o;for(let i of Ga)for(let a of Ka){let l={...t,noDtsResolution:!0,customConditions:[...a]},d=Pr(e,n,l,s,i,r);if(o===void 0)o=d;else if(o!==d)return null}return o??null}function Gn(e,n,t,s){let r=Ze(e);if(r==="relative"&&St(e)!==null){let a=Ne.resolve(Ne.dirname(n),e);return st(a)?a:null}if(r==="relative")return Pr(e,n,t,s,void 0,!0);if(r==="package-root"){let a=Du(e,n,t,s,!0);if(a!==null)return a;let l=Ua(e,n);if(l===null||_n(Ne.join(l,"package.json"))?.includes('"exports"')===!0)return null;let d=za(l);return d===null||Cn(d)?null:rs(l,d)?d:null}let o=Du(e,n,t,s,!1);if(o===null)return null;let i=mS(o,Bn(e));return i!==null?hS(e,i):Cn(o)?o:ju(o)}function qu(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function Cr(e,n,t,s){let r=Ze(e);if(r==="relative")return"no-candidate";if(qu(e))return"alias-unmapped";let o=new Set;for(let m of Ga)for(let g of Ka){let y={...t,noDtsResolution:!0,customConditions:[...g]};o.add(Pr(e,n,y,s,m,r==="package-root"))}if(o.size>1)return"divergent-exports";let i=Ua(e,n);if(i===null)return"not-installed";let a=_n(Ne.join(i,"package.json"));if(a===null)return"unreadable-manifest";let l;try{l=JSON.parse(a)}catch{return"unreadable-manifest"}if(typeof l!="object"||l===null)return"unreadable-manifest";let d=l,c=d.exports!==void 0&&d.exports!==null,f=typeof d.typesVersions=="object"&&d.typesVersions!==null,[p]=o;if(p!=null)return rs(i,p)?!c&&f?"types-versions-remap":Cn(p)?"declaration-only":"no-candidate":"out-of-root";let u=Pr(e,n,t,s,void 0,!1);if(u!==null&&Cn(u))return!c&&f?"types-versions-remap":"declaration-only";if(r==="package-root"&&!c){let m=za(i);if(m!==null&&!rs(i,m))return"out-of-root"}return"no-candidate"}function qs(e,n,t,s){let r=Gn(e,n,t,s);if(r!==null)return[r];let o=Ze(e);if(o==="relative")return[];let i=new Set;for(let d of Ga)for(let c of Ka){let f={...t,noDtsResolution:!0,customConditions:[...c]};i.add(Pr(e,n,f,s,d,o==="package-root"))}if(i.size<2||i.has(null))return[];let a=Ua(e,n);if(a===null)return[];let l=[];for(let d of i){if(d===null)return[];let c=ju(d);if(Cn(c)||!rs(a,c))return[];l.push(c)}return[...new Set(l)].sort()}function Vu(e,n){let t=Ne.dirname(e);for(let s=0;s<64;s+=1){let r=_n(Ne.join(t,"package.json"));if(r!==null){try{let i=JSON.parse(r);if(typeof i!="object"||i===null)return!1;let a=i.optionalDependencies;if(typeof a=="object"&&a!==null&&n in a)return!0;let l=i.peerDependenciesMeta;if(typeof l=="object"&&l!==null){let d=l[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let o=Ne.dirname(t);if(o===t)return!1;t=o}return!1}function Xu(e,n,t){let s=_n(Ne.join(e,"tsconfig.json"));if(s===null)return()=>null;let r=jo.parseConfigFileTextToJson(Ne.join(e,"tsconfig.json"),s);if(r.error!==void 0)return()=>null;let o=r.config?.compilerOptions;if(typeof o!="object"||o===null)return()=>null;let i=o.paths;if(typeof i!="object"||i===null)return()=>null;let a=o.baseUrl,l=typeof a=="string"?Ne.resolve(e,a):e,d=new Map,c=[];for(let[p,u]of Object.entries(i)){if(!Array.isArray(u))continue;let m=u.filter(y=>typeof y=="string");if(m.length===0)continue;let g=p.indexOf("*");g===-1?d.set(p,m):p.indexOf("*",g+1)===-1&&c.push({prefix:p.slice(0,g),suffix:p.slice(g+1),targets:m})}if(c.sort((p,u)=>u.prefix.length-p.prefix.length),d.size===0&&c.length===0)return()=>null;let f=p=>{let u=d.get(p);if(u!==void 0)return u;for(let m of c){if(p.length<m.prefix.length+m.suffix.length||!p.startsWith(m.prefix)||!p.endsWith(m.suffix))continue;let g=p.slice(m.prefix.length,p.length-m.suffix.length);return m.targets.map(y=>{let b=y.indexOf("*");return b===-1?y:y.slice(0,b)+g+y.slice(b+1)})}return[]};return(p,u)=>{let m=f(p);if(m.length===0||Gn(p,u,n,t)!==null)return null;for(let g of m){let y=Ne.resolve(l,g),b=Ne.relative(Ne.dirname(u),y).split(Ne.sep).join("/");if(b==="")continue;b.startsWith(".")||(b=`./${b}`);let _=Gn(b,u,n,t);if(_!==null&&rs(e,_))return _}return null}}import{readdirSync as _S,realpathSync as SS}from"node:fs";import Dt from"node:path";import ce from"typescript";function Mr(e,n){if(ce.isIdentifier(e))n.add(e.text);else for(let t of e.elements)ce.isBindingElement(t)&&Mr(t.name,n)}function Vs(e){let n=new Map,t=new Set,s=l=>{n.set(l,(n.get(l)??0)+1)},r=l=>{let d=an(l);if(ce.isIdentifier(d))t.add(d.text);else if(ce.isArrayLiteralExpression(d))for(let c of d.elements)r(c);else if(ce.isObjectLiteralExpression(d))for(let c of d.properties)ce.isShorthandPropertyAssignment(c)?t.add(c.name.text):ce.isPropertyAssignment(c)?r(c.initializer):ce.isSpreadAssignment(c)&&r(c.expression);else ce.isSpreadElement(d)?r(d.expression):ce.isBinaryExpression(d)&&d.operatorToken.kind===ce.SyntaxKind.EqualsToken&&r(d.left)},o=l=>{let d=new Set;Mr(l,d);for(let c of d)s(c)},i=l=>{ce.isVariableDeclaration(l)?o(l.name):ce.isFunctionDeclaration(l)&&l.name!==void 0||ce.isClassDeclaration(l)&&l.name!==void 0?s(l.name.text):ce.isParameter(l)?o(l.name):((ce.isFunctionExpression(l)||ce.isClassExpression(l))&&l.name!==void 0&&ce.isIdentifier(l.name)&&!(l.parent!==void 0&&ce.isVariableDeclaration(l.parent)&&l.parent.initializer===l&&ce.isIdentifier(l.parent.name)&&l.parent.name.text===l.name.text)||ce.isImportClause(l)&&l.name!==void 0||ce.isNamespaceImport(l)||ce.isImportSpecifier(l)||ce.isImportEqualsDeclaration(l))&&s(l.name.text),ce.isBinaryExpression(l)&&l.operatorToken.kind>=ce.SyntaxKind.FirstAssignment&&l.operatorToken.kind<=ce.SyntaxKind.LastAssignment?r(l.left):(ce.isPrefixUnaryExpression(l)||ce.isPostfixUnaryExpression(l))&&(l.operator===ce.SyntaxKind.PlusPlusToken||l.operator===ce.SyntaxKind.MinusMinusToken)?r(l.operand):(ce.isForOfStatement(l)||ce.isForInStatement(l))&&!ce.isVariableDeclarationList(l.initializer)&&r(l.initializer),ce.forEachChild(l,i)};i(e);let a=new Set(t);for(let[l,d]of n)d>1&&a.add(l);return a}function xs(e,n,t){let s=Vs(e),r=new Map,o=i=>{ce.isVariableDeclaration(i)&&ce.isIdentifier(i.name)&&i.initializer!==void 0&&!s.has(i.name.text)&&!r.has(i.name.text)&&r.set(i.name.text,i.initializer),ce.forEachChild(i,o)};return o(e),{containingFile:n,taintedNames:s,constBindings:r,resolveParamDirs:t}}var xS=1024,kS=32,wS=new Set(["filter","sort","slice","reverse"]),vS=new Set(["forEach","map","filter","flatMap","find","some","every"]);function an(e){let n=e;for(;ce.isParenthesizedExpression(n);)n=n.expression;return n}function Yu(e,n){return ce.isPropertyAccessExpression(e)&&ce.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function os(e,n,t,s){if(t>kS)return null;let r=an(e);if(ce.isStringLiteralLike(r))return r.text;if(ce.isTemplateExpression(r)){let o=r.head.text;for(let i of r.templateSpans){let a=os(i.expression,n,t+1,s);if(a===null)return null;o+=a+i.literal.text}return o}if(ce.isBinaryExpression(r)&&r.operatorToken.kind===ce.SyntaxKind.PlusToken){let o=os(r.left,n,t+1,s);if(o===null)return null;let i=os(r.right,n,t+1,s);return i===null?null:o+i}if(ce.isIdentifier(r)){if(r.text==="__dirname")return Dt.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||s.has(r.text))return null;let o=n.constBindings.get(r.text);if(o===void 0)return null;s.add(r.text);let i=os(o,n,t+1,s);return s.delete(r.text),i}if(ce.isCallExpression(r)){let o=Yu(r.expression,"join"),i=Yu(r.expression,"resolve");if(!o&&!i)return null;let a=[];for(let d of r.arguments){let c=os(d,n,t+1,s);if(c===null)return null;a.push(c)}let l=a[0];return l===void 0||i&&!Dt.isAbsolute(l)?null:i?Dt.resolve(...a):Dt.join(...a)}return null}function Go(e){let n=an(e);if(ce.isBinaryExpression(n)&&n.operatorToken.kind===ce.SyntaxKind.PlusToken)return[...Go(n.left),...Go(n.right)];if(ce.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let s of n.templateSpans)t.push({expr:s.expression}),s.literal.text.length>0&&t.push({lit:s.literal.text});return t}return ce.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Zu(e){let n=e,t=0;for(;t++<4096;){let s=n.parent;if(s===void 0)return null;if(ce.isForOfStatement(s)&&s.statement===n){let r=s.initializer;if(ce.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&ce.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let o=Ju(s.expression);if(o!==null)return o}}if((ce.isArrowFunction(n)||ce.isFunctionExpression(n))&&ce.isCallExpression(s)&&s.arguments.length>0&&s.arguments[0]===n&&ce.isPropertyAccessExpression(s.expression)&&vS.has(s.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&ce.isIdentifier(r.name)&&r.name.text===e.text){let o=Ju(s.expression.expression);if(o!==null)return o}}n=s}return null}function Ju(e){let n=an(e),t=0;for(;ce.isCallExpression(n)&&t++<16;){let s=n.expression;if(ce.isPropertyAccessExpression(s)){let r=s.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(wS.has(r)){n=an(s.expression);continue}return null}return ce.isIdentifier(s)&&s.text==="readdirSync"?n.arguments[0]??null:null}return null}function ES(e,n){let t=Go(e);if(t.length<2)return null;let s=t[t.length-1];if(s===void 0||!("expr"in s)||!ce.isIdentifier(s.expr))return null;let r=s.expr;if(n.taintedNames.has(r.text))return null;let o="";for(let d=0;d<t.length-1;d+=1){let c=t[d];if(c===void 0)return null;if("lit"in c)o+=c.lit;else{let f=os(c.expr,n,0,new Set);if(f===null)return null;o+=f}}let i=Zu(r),a=i===null?null:os(i,n,0,new Set);if(a===null)return null;let l=Dt.resolve(o);return l!==Dt.resolve(a)?null:l}function AS(e){if((ce.isFunctionDeclaration(e)||ce.isFunctionExpression(e))&&e.name!==void 0&&ce.isIdentifier(e.name)||ce.isMethodDeclaration(e)&&ce.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&ce.isVariableDeclaration(n)&&ce.isIdentifier(n.name)?n.name.text:null}function IS(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!ce.isFunctionLike(t))continue;let s=-1;for(let o=0;o<t.parameters.length;o+=1){let i=t.parameters[o];if(i!==void 0&&ce.isIdentifier(i.name)&&i.name.text===n){s=o;break}}if(s<0)continue;let r=AS(t);return r===null?null:{fnName:r,paramIndex:s}}return null}function Tr(e,n){let t=Go(e);if(t.length!==2)return null;let[s,r]=t;if(s===void 0||!("expr"in s)||!ce.isIdentifier(s.expr)||r===void 0||!("expr"in r)||!ce.isIdentifier(r.expr))return null;let o=s.expr,i=r.expr;if(n.taintedNames.has(o.text)||n.taintedNames.has(i.text))return null;let a=Zu(i);return a===null||!ce.isIdentifier(a)||a.text!==o.text?null:IS(o,o.text)}function NS(e,n){if(n.resolveParamDirs===void 0)return null;let t=Tr(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function Ko(e){for(let n=e.parent;n!==void 0;n=n.parent){if(ce.isSourceFile(n))return!0;if(!ce.isArrowFunction(n)&&ce.isFunctionLike(n))return!1}return!0}function Ha(e,n){let t=os(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let s=ES(e,n);if(s!==null)return{kind:"dir",dir:s};let r=NS(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function ef(e,n){let t;try{t=SS(e)}catch{return null}let s=n.endsWith(Dt.sep)?n:n+Dt.sep;return t===n||t.startsWith(s)?t:null}function nf(e,n,t,s,r){let o=Gn(e,n,s,r);return o===null||Cn(o)||!Bo(o)?null:ef(o,t)}function Qu(e,n,t,s,r){let o=ef(e,t);if(o===null)return[];let i;try{i=_S(o)}catch{return[]}if(i.length===0||i.length>xS)return[];i.sort();let a=new Set,l=[];for(let d of i){let c=nf(Dt.join(o,d),n,t,s,r);c!==null&&!a.has(c)&&(a.add(c),l.push(c))}return l}function zo(e,n,t,s,r){let o=Ha(e,n);if(o.kind==="const"){if(Ze(o.value)==="package-root")return[];let i=nf(o.value,n.containingFile,t,s,r);return i===null?[]:[i]}if(o.kind==="dir")return Qu(o.dir,n.containingFile,t,s,r);if(o.kind==="dirs"){let i=new Set,a=[];for(let l of o.dirs)for(let d of Qu(l,n.containingFile,t,s,r))i.has(d)||(i.add(d),a.push(d));return a}return[]}import RS from"node:path";import Fe from"typescript";var OS=32,Wo="\0",tf=(e,n)=>`${e}${Wo}${n}`,sf=(e,n,t)=>`${e}${Wo}${n}${Wo}${String(t)}`;function PS(e){let n=new Map,t=new Set,s=(r,o)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,o)};for(let r of e.statements)if(Fe.isImportDeclaration(r)&&Fe.isStringLiteralLike(r.moduleSpecifier)){let o=r.moduleSpecifier.text,i=r.importClause;if(i===void 0)continue;i.name!==void 0&&s(i.name.text,{kind:"module",specifier:o});let a=i.namedBindings;if(a!==void 0&&Fe.isNamespaceImport(a))s(a.name.text,{kind:"module",specifier:o});else if(a!==void 0&&Fe.isNamedImports(a))for(let l of a.elements)s(l.name.text,{kind:"named",specifier:o,imported:(l.propertyName??l.name).text})}else if(Fe.isImportEqualsDeclaration(r)&&Fe.isExternalModuleReference(r.moduleReference)&&Fe.isStringLiteralLike(r.moduleReference.expression))s(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(Fe.isFunctionDeclaration(r)&&r.name!==void 0)s(r.name.text,{kind:"local"});else if(Fe.isVariableStatement(r))for(let o of r.declarationList.declarations){if(o.initializer===void 0)continue;let i=o.initializer;if(Fe.isIdentifier(o.name))Fe.isArrowFunction(i)||Fe.isFunctionExpression(i)?s(o.name.text,{kind:"local"}):rf(i)&&s(o.name.text,{kind:"module",specifier:of(i)});else if(Fe.isObjectBindingPattern(o.name)&&rf(i)){let a=of(i);for(let l of o.name.elements){if(l.dotDotDotToken!==void 0||!Fe.isIdentifier(l.name))continue;let d=l.propertyName??l.name;!Fe.isIdentifier(d)&&!Fe.isStringLiteralLike(d)||s(l.name.text,{kind:"named",specifier:a,imported:d.text})}}}return n}function rf(e){return Fe.isCallExpression(e)&&Fe.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&Fe.isStringLiteralLike(e.arguments[0])}function of(e){let n=e.arguments[0];return n!==void 0&&Fe.isStringLiteralLike(n)?n.text:"\0"}function CS(e){let n=e.expression;if(Fe.isPropertyAccessExpression(n))return n.name.text;if(Fe.isIdentifier(n))return n.text}function MS(e,n,t,s,r,o){let i=e.expression,a=l=>{let d=`${l}${Wo}${n}`,c=o.get(d);if(c!==void 0||o.has(d))return c??null;let f=Gn(l,n,s,r),p=f===null?null:RS.resolve(f);return o.set(d,p),p};if(Fe.isPropertyAccessExpression(i)&&Fe.isIdentifier(i.expression)){let l=t.get(i.expression.text);if(l?.kind==="module"){let d=a(l.specifier);return d===null?null:{moduleReal:d,fnName:i.name.text}}return null}if(Fe.isIdentifier(i)){let l=t.get(i.text);if(l?.kind==="named"){let d=a(l.specifier);return d===null?null:{moduleReal:d,fnName:l.imported}}return l?.kind==="local"?{moduleReal:n,fnName:i.text}:null}return null}function af(e,n,t,s,r=new Map){if(n.length===0)return()=>null;let o=new Map,i=new Set;for(let l of n){let d=tf(l.definingModuleReal,l.fnName),c=o.get(d);c===void 0&&(c=new Set,o.set(d,c)),c.add(l.paramIndex),i.add(l.fnName)}let a=new Map;for(let l of e){let d=xs(l.sf,l.real),c=PS(l.sf),f=p=>{if(Fe.isCallExpression(p)){let u=CS(p);if(u!==void 0&&i.has(u)&&Ko(p)){let m=MS(p,l.real,c,t,s,r);if(m!==null){let g=o.get(tf(m.moduleReal,m.fnName));if(g!==void 0)for(let y of g){let b=p.arguments[y];if(b===void 0)continue;let _=Ha(b,d);if(_.kind==="const"){let S=sf(m.moduleReal,m.fnName,y),k=a.get(S);k===void 0&&(k=new Set,a.set(S,k)),k.add(_.value)}}}}}Fe.forEachChild(p,f)};f(l.sf)}return(l,d,c)=>{let f=a.get(sf(l,d,c));return f===void 0||f.size===0||f.size>OS?null:[...f].sort()}}var gn={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:C.ScriptTarget.ES2020,module:C.ModuleKind.CommonJS,moduleResolution:C.ModuleResolutionKind.Node10,types:[]},Uo=5e3;function hn(e,n){let t;try{t=is(n)}catch{t=cn.resolve(n)}let s=e.endsWith(cn.sep)?e:e+cn.sep;return t!==e&&!t.startsWith(s)?null:t===e?"":t.slice(s.length).split(cn.sep).join("/")}function TS(e,n){let t=hn(e,n);return t!==null&&!t.split("/").includes("node_modules")}function $S(e,n){if(C.isFunctionLike(e))return n!==e.name&&!C.isDecorator(n)&&!LS(e);if(C.isPropertyDeclaration(e))return n===e.initializer&&(C.getCombinedModifierFlags(e)&C.ModifierFlags.Static)===0;if(C.isTryStatement(e))return n===e.catchClause||n===e.tryBlock&&e.catchClause!==void 0;if(C.isIfStatement(e))return n!==e.expression;if(C.isConditionalExpression(e))return n!==e.condition;if(C.isCaseClause(e))return n!==e.expression;if(C.isDefaultClause(e))return!0;if(C.isBinaryExpression(e)){let t=e.operatorToken.kind;return n===e.right&&(t===C.SyntaxKind.AmpersandAmpersandToken||t===C.SyntaxKind.BarBarToken||t===C.SyntaxKind.QuestionQuestionToken||t===C.SyntaxKind.AmpersandAmpersandEqualsToken||t===C.SyntaxKind.BarBarEqualsToken||t===C.SyntaxKind.QuestionQuestionEqualsToken)}return C.isForStatement(e)?n===e.statement||n===e.incrementor:C.isForInStatement(e)||C.isForOfStatement(e)||C.isWhileStatement(e)?n===e.statement:C.isBindingElement(e)?n===e.initializer:C.isShorthandPropertyAssignment(e)?n===e.objectAssignmentInitializer:C.isCallExpression(e)&&C.isOptionalChain(e)?e.arguments.some(t=>t===n):C.isElementAccessExpression(e)&&C.isOptionalChain(e)?n===e.argumentExpression:!1}function LS(e){if(!C.isFunctionExpression(e)&&!C.isArrowFunction(e)||C.isFunctionExpression(e)&&e.asteriskToken!==void 0)return!1;let n=e;for(;C.isParenthesizedExpression(n.parent);)n=n.parent;let t=n.parent;return(C.isCallExpression(t)||C.isNewExpression(t))&&t.expression===n?!0:C.isPropertyAccessExpression(t)&&t.expression===n&&(t.name.text==="call"||t.name.text==="apply")&&C.isCallExpression(t.parent)&&t.parent.expression===t}function Ve(e){let n=e;for(;;)if(C.isParenthesizedExpression(n))n=n.expression;else if(C.isBinaryExpression(n)&&n.operatorToken.kind===C.SyntaxKind.CommaToken)n=n.right;else return n}function Ft(e){return C.isPropertyAccessExpression(e)?{receiver:Ve(e.expression),name:e.name.text}:C.isElementAccessExpression(e)&&C.isStringLiteralLike(e.argumentExpression)?{receiver:Ve(e.expression),name:e.argumentExpression.text}:null}function Dr(e){let n=Ve(e.expression);if(C.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===C.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=Ft(n);if(t!==null){if(t.name==="require"&&C.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(C.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let s=e.arguments[1];return{specifierArg:s!==void 0&&C.isArrayLiteralExpression(s)?s.elements[0]:void 0}}}}return null}function lf(e){let n=[],t=(s,r)=>{if(C.isImportDeclaration(s)&&C.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.importClause?.isTypeOnly!==!0,unguarded:!r&&C.isSourceFile(s.parent)});else if(C.isImportEqualsDeclaration(s)&&C.isExternalModuleReference(s.moduleReference)&&C.isStringLiteralLike(s.moduleReference.expression))n.push({text:s.moduleReference.expression.text,runtime:!0,unguarded:!r&&C.isSourceFile(s.parent)});else if(C.isExportDeclaration(s)&&s.moduleSpecifier!==void 0&&C.isStringLiteralLike(s.moduleSpecifier))n.push({text:s.moduleSpecifier.text,runtime:s.isTypeOnly!==!0,unguarded:!r&&C.isSourceFile(s.parent)});else if(C.isCallExpression(s)){let o=Dr(s),i=o?.specifierArg;if(o!==null&&i!==void 0&&C.isStringLiteralLike(i)){let a=Ve(s.expression).kind===C.SyntaxKind.ImportKeyword;n.push({text:i.text,runtime:!0,unguarded:!r&&(!a||DS(s))})}}C.forEachChild(s,o=>{t(o,r||$S(s,o))})};return t(e,!1),n}function DS(e){let n=e;for(;C.isParenthesizedExpression(n.parent);)n=n.parent;return C.isAwaitExpression(n.parent)}function FS(e,n){let t=n===C.ScriptKind.TSX?"__scriptkind_probe.tsx":n===C.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",s=C.createSourceFile(t,e,C.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},o={getSourceFile:i=>i===t?s:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:i=>i,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:i=>i===t,readFile:i=>i===t?e:void 0};return C.createProgram({rootNames:[t],options:r,host:o}).getSyntacticDiagnostics(s).length}function Qa(e){return e.endsWith(".js")||e.endsWith(".jsx")}function jS(e){return cn.extname(e)===""}function BS(e){if(!e.startsWith("#!"))return"none";let n=e.indexOf(`
+`),t=(n===-1?e:e.slice(0,n)).slice(0,512);return/(?:^|[\s/])node(?:\s|$)/u.test(t)?"node":"other"}function df(e){let n=0,t=s=>{(C.isCallExpression(s)||C.isNewExpression(s)||C.isTaggedTemplateExpression(s))&&(n+=1),C.forEachChild(s,t)};return t(e),n}function ff(e,n){let t=lf(C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0));if(!Qa(e)||!n.includes("<")||!n.includes("require"))return t;let s=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX),r=i=>`${i.runtime?"R":"T"}${i.unguarded?"U":"G"}:${i.text}`,o=new Set(t.map(r));for(let i of lf(s)){let a=r(i);o.has(a)||(o.add(a),t.push(i))}return t}function cf(e,n,t,s,r){if(!n.includes("require")&&!n.includes("import("))return[];let o=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0),i=xs(o,e,r),a=[],l=new Set;return pf(o,d=>{for(let c of zo(d,i,t,gn,s))l.has(c)||(l.add(c),a.push(c))}),a}function pf(e,n){let t=s=>{if(C.isCallExpression(s)){let r=Dr(s),o=r?.specifierArg;r!==null&&o!==void 0&&!C.isStringLiteralLike(o)&&n(o)}C.forEachChild(s,t)};t(e)}function GS(e){let n=[];for(let t of e){let s=xs(t.sf,t.real);pf(t.sf,r=>{let o=Tr(r,s);o!==null&&n.push({definingModuleReal:t.real,fnName:o.fnName,paramIndex:o.paramIndex})})}return n}var KS=4,qa=Uo,Va=new Set(["eval","Function","createRequire"]),zS=new Set(["require","eval","Function","createRequire"]),Vo=new Set(["module","Module","require","process","global","globalThis"]),Xo=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function WS(e){return e===C.SyntaxKind.LessThanToken||e===C.SyntaxKind.GreaterThanToken||e===C.SyntaxKind.LessThanEqualsToken||e===C.SyntaxKind.GreaterThanEqualsToken||e===C.SyntaxKind.EqualsEqualsToken||e===C.SyntaxKind.EqualsEqualsEqualsToken||e===C.SyntaxKind.ExclamationEqualsToken||e===C.SyntaxKind.ExclamationEqualsEqualsToken||e===C.SyntaxKind.InstanceOfKeyword||e===C.SyntaxKind.InKeyword}function US(e){let n=e.parent;return(C.isParameter(n)||C.isVariableDeclaration(n)||C.isBindingElement(n)||C.isFunctionDeclaration(n)||C.isFunctionExpression(n)||C.isClassDeclaration(n)||C.isClassExpression(n)||C.isPropertyAssignment(n)||C.isPropertyDeclaration(n)||C.isMethodDeclaration(n))&&n.name===e?!0:C.isPropertyAccessExpression(n)&&n.name===e}function HS(e,n){return C.isCallExpression(n)&&n.expression===e||(C.isPropertyAccessExpression(n)||C.isElementAccessExpression(n))&&n.expression===e||C.isTypeOfExpression(n)||C.isVoidExpression(n)||C.isDeleteExpression(n)||C.isPrefixUnaryExpression(n)||C.isPostfixUnaryExpression(n)?!0:C.isBinaryExpression(n)&&WS(n.operatorToken.kind)}function mf(e){let n=e,t=e.parent;for(;;)if(C.isParenthesizedExpression(t))n=t,t=t.parent;else if(C.isBinaryExpression(t)&&t.operatorToken.kind===C.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!HS(n,t)}function qS(e){return US(e)?!1:mf(e)}function gf(e){let n=Ft(e);if(n!==null&&Xo.has(n.name))return!0;if(C.isElementAccessExpression(e)&&!C.isStringLiteralLike(e.argumentExpression)){let t=Ve(e.expression);if(C.isIdentifier(t)&&Vo.has(t.text))return!0}return!1}function $r(e){let n=Ft(e);if(n===null||n.name!=="constructor")return!1;let t=Ft(n.receiver);return t!==null&&t.name==="constructor"}function hf(e){if(!C.isCallExpression(e))return!1;let n=Ve(e.expression);if(!C.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&C.isStringLiteralLike(t)&&t.text==="module"}var VS={roots:new Map,nodes:new Set,saturated:!1};function yf(e){return C.isSourceFile(e)||C.isFunctionDeclaration(e)||C.isFunctionExpression(e)||C.isArrowFunction(e)||C.isMethodDeclaration(e)||C.isConstructorDeclaration(e)||C.isGetAccessorDeclaration(e)||C.isSetAccessorDeclaration(e)||C.isClassStaticBlockDeclaration(e)||C.isModuleDeclaration(e)}function bf(e,n){let t=e.parent;for(;t!==void 0;){if(yf(t))return t;t=t.parent}return n}function XS(e){let n=new Set;if(C.isFunctionLike(e))for(let s of e.parameters)for(let r of Lr(s.name))n.add(r);let t=[e];for(;t.length>0;){let s=t.pop();if(s===void 0)break;if(!(s!==e&&yf(s))){if(C.isVariableDeclaration(s)&&C.isVariableDeclarationList(s.parent)&&!((s.parent.flags&C.NodeFlags.BlockScoped)!==0))for(let o of Lr(s.name))n.add(o);C.forEachChild(s,r=>{t.push(r)})}}return n}function YS(e,n,t){let s=bf(e,n);if(C.isSourceFile(s))return n;let r=t.get(s);return r===void 0&&(r=XS(s),t.set(s,r)),r.has(e.text)?s:n}function Ho(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let s=n;for(;;){if(t.has(s))return!0;let r=s.parent;if(r===void 0)return!C.isSourceFile(s);s=r}}var JS=12,QS=8;function qo(e,n){let t=Ve(e);for(;;){if(n.nodes.has(t))return!0;if(C.isIdentifier(t))return Vo.has(t.text)||Ho(n,t);if(C.isCallExpression(t))return hf(t);let s=Ft(t);if(s!==null){if(s.name==="constructor")return!0;t=s.receiver;continue}if(C.isElementAccessExpression(t)){t=Ve(t.expression);continue}return!1}}function _f(e){let n=Ft(Ve(e.expression));if(n===null||n.name!=="get"||!C.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function ZS(e,n){let t=_f(e);if(t===null||!qo(t.target,n))return!1;let s=t.key;return s===void 0||!C.isStringLiteralLike(s)?!0:Xo.has(s.text)}function Xa(e){if(!C.isFunctionExpression(e)&&!C.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,s=r=>{if(!(t||C.isFunctionExpression(r)||C.isFunctionDeclaration(r)||C.isClassLike(r))){if(C.isReturnStatement(r)&&r.expression!==void 0&&Ve(r.expression).kind===C.SyntaxKind.ThisKeyword){t=!0;return}C.forEachChild(r,s)}};return s(n),t}function Lr(e){if(C.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)C.isOmittedExpression(t)||n.push(...Lr(t.name));return n}function Sf(e){return e.parameters.map(n=>Lr(n.name))}function ex(e){let n=new Map,t=new Set,s=(o,i)=>{let a={fn:i,slots:Sf(i)},l=n.get(o);l===void 0?n.set(o,[a]):l.push(a),Xa(i)&&t.add(o)},r=o=>{if(C.isFunctionDeclaration(o)&&o.name!==void 0)s(o.name.text,o);else if(C.isVariableDeclaration(o)&&C.isIdentifier(o.name)&&o.initializer!==void 0){let i=Ve(o.initializer);(C.isFunctionExpression(i)||C.isArrowFunction(i))&&s(o.name.text,i)}C.forEachChild(o,r)};return r(e),{params:n,thisReturning:t}}function nx(e){let n=new Map,t=new Set,s={roots:n,nodes:t},r=ex(e),o=new Map,i=new Set(r.thisReturning),a=!0;for(let l=0;a;l+=1){if(l>=JS)return{roots:n,nodes:t,saturated:!0};a=!1;let d=(g,y)=>{y!==""&&!g.has(y)&&(g.add(y),a=!0)},c=(g,y)=>{if(g==="")return;let b=n.get(g);b===void 0&&(b=new Set,n.set(g,b)),b.has(y)||(b.add(y),a=!0)},f=g=>{t.has(g)||(t.add(g),a=!0)},p=(g,y)=>{let b=Ve(g.expression);if(C.isIdentifier(b)&&Va.has(b.text)||$r(b)||C.isCallExpression(g)&&hf(g)||Xa(b))return!0;let _=Ft(b);if(_!==null&&(_.name==="call"||_.name==="apply"||_.name==="bind")){let S=_.receiver;if(Xa(S)||t.has(S)||C.isIdentifier(S)&&(Ho(s,S)||i.has(S.text)))return!0}if(t.has(b)||(C.isCallExpression(b)||C.isNewExpression(b))&&p(b,y+1)||C.isIdentifier(b)&&(Ho(s,b)||i.has(b.text)))return!0;if(C.isCallExpression(g)){let S=_f(g);if(S!==null&&qo(S.target,s))return!0}return!1},u=(g,y)=>{if(y>=QS)return!0;let b=Ve(g);if(t.has(b))return!0;if(C.isIdentifier(b))return Vo.has(b.text)||Ho(s,b);if(C.isBinaryExpression(b)){let _=b.operatorToken.kind;return _===C.SyntaxKind.BarBarToken||_===C.SyntaxKind.AmpersandAmpersandToken||_===C.SyntaxKind.QuestionQuestionToken?u(b.left,y+1)||u(b.right,y+1):!1}return C.isConditionalExpression(b)?u(b.whenTrue,y+1)||u(b.whenFalse,y+1):C.isPropertyAccessExpression(b)||C.isElementAccessExpression(b)?qo(b,s):C.isCallExpression(b)||C.isNewExpression(b)?p(b,y+1):!1},m=(g,y)=>{if((C.isVariableDeclaration(g)||C.isParameter(g)||C.isBindingElement(g))&&g.initializer!==void 0){if(u(g.initializer,0)){let _=bf(g,e);for(let S of Lr(g.name))c(S,_)}}else if(C.isBinaryExpression(g)&&g.operatorToken.kind===C.SyntaxKind.EqualsToken&&C.isIdentifier(g.left)&&u(g.right,0))c(g.left.text,YS(g.left,e,o));else if(C.isReturnStatement(g)&&g.expression!==void 0&&y!==void 0&&u(g.expression,0))d(i,y);else if(C.isCallExpression(g)||C.isNewExpression(g)){p(g,0)&&f(g);let _=Ve(g.expression),S=Ft(_),k=S!==null&&S.name==="call",v=S!==null&&S.name==="apply",I=k||v?S.receiver:_,O=k?1:0,E=[];C.isFunctionExpression(I)||C.isArrowFunction(I)?E.push({fn:I,slots:Sf(I)}):C.isIdentifier(I)&&E.push(...r.params.get(I.text)??[]);let N=g.arguments??[];if(v){let A=N[1]===void 0?void 0:Ve(N[1]);for(let{fn:U,slots:$}of E)if(A!==void 0&&C.isArrayLiteralExpression(A))for(let W=0;W<A.elements.length;W+=1){let w=A.elements[W],P=$[W];if(!(w===void 0||P===void 0)&&u(w,0))for(let j of P)c(j,U)}else if(A!==void 0)for(let W of $)for(let w of W)c(w,U)}else for(let{fn:A,slots:U}of E)for(let $=O;$<N.length;$+=1){let W=N[$],w=U[$-O];if(!(W===void 0||w===void 0)&&u(W,0))for(let P of w)c(P,A)}}let b=y;if(C.isFunctionDeclaration(g))b=g.name?.text;else if(C.isFunctionExpression(g)||C.isArrowFunction(g)){let _=g.parent;b=C.isVariableDeclaration(_)&&C.isIdentifier(_.name)?_.name.text:void 0}C.forEachChild(g,_=>m(_,b))};m(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function tx(e){if(C.isIdentifier(e)&&Va.has(e.text)||$r(e))return!0;let n=Ft(e);if(n!==null&&(Xo.has(n.name)||(n.name==="call"||n.name==="apply")&&(C.isIdentifier(n.receiver)&&Va.has(n.receiver.text)||$r(n.receiver)||(C.isPropertyAccessExpression(n.receiver)||C.isElementAccessExpression(n.receiver))&&gf(n.receiver))))return!0;if(C.isElementAccessExpression(e)&&!C.isStringLiteralLike(e.argumentExpression)){let t=Ve(e.expression);if(C.isIdentifier(t)&&Vo.has(t.text))return!0}return!1}var sx=4;function uf(e,n){for(let t of e){if(!C.isStringLiteralLike(t)||n>=sx)return!0;let s=C.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,C.ScriptTarget.Latest,!0),o=s.parseDiagnostics;if(o!==void 0&&o.length>0||G_(s,n+1,!0))return!0}return!1}function G_(e,n=0,t=!1){return ga(e,n,t).size>0}function ga(e,n=0,t=!1){let s=new Set,o=t?P_:F_(e);if(o.saturated)return s.add("saturated"),s;let r=a=>C.isElementAccessExpression(a)&&!C.isStringLiteralLike(a.argumentExpression)&&Ir(Ve(a.expression),o),i=a=>{if(t&&(C.isCallExpression(a)||C.isNewExpression(a)||C.isTaggedTemplateExpression(a))){s.add("eval-invocation");return}if(C.isCallExpression(a)){let l=Eo(a);if(l!==null){let d=l.specifierArg;if(d===void 0||!C.isStringLiteralLike(d)||t){s.add("non-literal-load");return}}else{let d=Ve(a.expression);if(C.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if(iu(a.arguments,n)){s.add("eval-code");return}}else if(j_(d)){s.add("loader-callee");return}else if(r(d)){s.add("computed-loader");return}else if(L_(a,o)){s.add("reflect-get");return}}}else if(C.isNewExpression(a)){let l=Ve(a.expression);if(C.isIdentifier(l)&&l.text==="Function"){if(iu(a.arguments??[],n)){s.add("function-ctor");return}}else if(wo(l)){s.add("ctor-chain");return}}else if(C.isIdentifier(a)&&A_.has(a.text)&&O_(a)){s.add("captured-loader");return}else if((C.isPropertyAccessExpression(a)||C.isElementAccessExpression(a))&&(cu(a)||wo(a)||r(a))&&du(a)){s.add("captured-member");return}else if(C.isBindingElement(a)){let l=a.propertyName??a.name,d=C.isIdentifier(l)||C.isStringLiteralLike(l)?l.text:C.isComputedPropertyName(l)&&C.isStringLiteralLike(l.expression)?l.expression.text:void 0;if(d!==void 0&&Or.has(d)){s.add("destructured-member");return}}C.forEachChild(a,i)};return i(e),s}function gu(e,n,t){let s=new Set(ga(t));if(_a(e)&&n.includes("<")&&n.includes("require")){let o=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);for(let r of ga(o))s.add(r)}return s}function K_(e,n,t){if(ya(e))return!0;let s=t.endsWith(ln.sep)?t:t+ln.sep,o=e.split("/"),r=n;for(;;){let i=ln.join(r,"node_modules",...o),a;try{a=Qt(ln.join(i,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(s))return!1;let d=gn(a);if(d===null)return!1;let c;try{c=JSON.parse(d).exports}catch{return!1}if(typeof c=="string"||Array.isArray(c)||typeof c=="object"&&c!==null)return!1}if(Bc(i))return!1;if(r===t)break;let l=ln.dirname(r);if(l===r||l!==t&&!l.startsWith(s))break;r=l}return!0}function z_(e,n){let t=n.endsWith(ln.sep)?n:n+ln.sep,s=ln.dirname(e);for(;;){let o=ln.join(s,"package.json"),r;try{r=Qt(o)}catch{r=null}if(r!==null&&(r===n||r.startsWith(t))){let a=gn(r);if(a!==null)try{let l=JSON.parse(a).name;if(typeof l=="string"&&l.length>0)return l}catch{return null}}if(s===n)break;let i=ln.dirname(s);if(i===s||i!==n&&!i.startsWith(t))break;s=i}return null}function U_(e,n,t,s,o){let r=[],i=[],a=new Set,l={},d=[],c=[],p=new Set,u=new Set,f=[],m=!1,h=(_,S)=>{let b;try{b=Qt(S)}catch{return!1}let k=fn(e,b);if(k===null)return o.push({code:"out-of-root",path:b,detail:"dependency module resolved outside the app root; not followed"}),!1;let w=!t.has(b)&&!u.has(b);return w&&u.size>=pa?(m=!0,!1):(i.push({from:_,to:{module:k}}),w?(u.add(b),r.push(k),!0):!1)},y=(_,S)=>{if(a.add(S),p.has(S))return;p.add(S);let b=Fn(S,_,un,n),k=b!==null?[b]:Ls(S,_,un,n);k.length>=2&&d.push({path:fn(e,_)??_,specifier:S,candidates:k.map(N=>fn(e,N)??N)});let w=!1;for(let N of k)if(!Rn(N)&&(w=!0,h({surface:S},N))){f.push(N);try{let R=fn(e,Qt(N)),v=z_(N,e);R!==null&&v!==null&&(l[R]=v)}catch{}}w||K_(S,ln.dirname(_),e)||o.push({code:"unresolved-specifier",path:S,reason:So(S,_,un,n),detail:`dependency "${S}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let _ of s)y(_.containingFile,_.packageName);for(;f.length>0&&u.size<pa;){let _=f.pop();if(_===void 0)break;let S=fn(e,_);if(S===null)continue;let b=$s(_,Yt);if(b.kind==="too-large"){o.push({code:"limit-exceeded",path:S,detail:`dependency module over the ${String(Yt/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(b.kind==="not-regular"){o.push({code:"parse-error",path:S,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let k=C.createSourceFile(_,b.text,C.ScriptTarget.ES2020,!0),w=k.parseDiagnostics;if(w!==void 0&&w.length>0){o.push({code:"dependency-body",path:S,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let N=gu(_,b.text,k);if(N.size>0){o.push({code:"dependency-body",path:S,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...N].sort()});continue}o.push({code:"dependency-body",path:S,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:S});for(let R of au(_,b.text))if(R.runtime)if(Ze(R.text)==="package-root"){let v=Dn(R.text);i.push({from:{module:S},to:{surface:v}}),y(_,v)}else{if(ya(Dn(R.text)))continue;let v=Fn(R.text,_,un,n),I=v!==null?[v]:Ls(R.text,_,un,n);if(I.length===0){if(Ze(R.text)==="package-subpath"){let A=So(R.text,_,un,n);if(A==="no-candidate"||A==="not-installed"&&Uc(_,Dn(R.text))){c.push({path:S,specifier:R.text,why:A});continue}o.push({code:"unresolved-specifier",path:S,reason:A,detail:`runtime package-subpath import "${R.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}I.length>=2&&d.push({path:S,specifier:R.text,candidates:I.map(A=>fn(e,A)??A)});for(let A of I){if(Rn(A)){let B=fn(e,A);o.push({code:B===null?"out-of-root":"declaration-shadow",path:S,detail:B===null?`runtime import "${R.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${R.text}" resolved to the declaration file "${B}" with no co-located runtime module; its code was not analyzed`});continue}h({module:S},A)&&f.push(A)}}}return(m||f.length>0)&&o.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(pa)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:r,edges:i,surfacePackages:[...a],entryRealNames:l,conditionUnions:d,provenAbsent:c}}function yu(e,n,t=!1,s=new Set){let o=Qt(e),r=[],i=[],a=C.createCompilerHost(un,!0),l=t?Wc(o,un,a):()=>null,d=new Set,c=new Set,p=n.map(L=>ln.join(o,L)),u=[],f=new Map,m=new Map,h=new Map,y=new Map,_=new Set,S=(L,K,Y)=>{let le=`${String(L.length)}:${L}${K}`;_.has(le)||(_.add(le),r.push({code:"unresolved-specifier",path:L,detail:K,reason:Y}))},b=()=>null,k=0,w=(L,K)=>{let Y=m.get(L);return Y===void 0&&(Y=C.createSourceFile(L,K,C.ScriptTarget.ES2020,!0),m.set(L,Y)),{real:L,sf:Y}};for(;c.size<Ar;){let L=p.pop();if(L===void 0){if(k>=E_)break;k+=1;let z=[];for(let[M,X]of f)X.includes("readdir")&&(X.includes("require")||X.includes("import("))&&z.push(w(M,X));let Z=v_(z);if(Z.length===0)break;let de=[];for(let[M,X]of f)de.push(w(M,X));b=tu(de,Z,un,a,h);let x=!1;for(let M of z){let X=f.get(M.real);if(X!==void 0)for(let W of ru(M.real,X,o,a,b))c.has(W)||(p.push(W),x=!0)}if(!x)break;continue}let K;try{K=Qt(L)}catch{continue}if(c.has(K))continue;if(c.add(K),fn(o,K)===null){r.push({code:"out-of-root",path:L,detail:"resolved outside app root"});continue}let Y=$s(K,Yt);if(Y.kind==="too-large"){r.push({code:"limit-exceeded",path:K,detail:`file is ${String(Math.round(Y.bytes/1048576))}MiB, over the ${String(Yt/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(Y.kind==="not-regular"){r.push({code:"parse-error",path:K,detail:"unreadable or not a regular file"});continue}let le=Y.text;d.add(K),f.set(K,le);for(let z of au(K,le)){let Z=z.runtime?l(z.text,K):null;if(Z===null&&Ze(z.text)==="package-root"){z.runtime&&u.push({containingFile:K,packageName:Dn(z.text)});continue}let de=Z??Fn(z.text,K,un,a),x=de!==null?[de]:z.runtime&&Z===null?Ls(z.text,K,un,a):[];if(x.length===0){if(z.runtime){let M=Ze(z.text);if(!(M==="package-subpath"&&ya(Dn(z.text)))){if(M==="package-subpath")S(K,`runtime package-subpath import "${z.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,So(z.text,K,un,a));else if(M==="relative"){let X=Kc(z.text,K,o,y);X.kind==="unanalyzable"?S(K,`runtime relative import "${z.text}" did not resolve and its absence could not be proven \u2014 ${X.reason}; a bundler/loader may load a module the analyzer never saw`,X.why):X.kind==="absent"&&z.unguarded&&y_(o,K)&&S(K,`runtime relative import "${z.text}" runs whenever its module runs, but nothing is on disk at its target \u2014 the module the running app loads there (a build output, a generated file) was never analyzed`,"absent-unguarded")}}}continue}x.length>=2&&i.push({path:fn(o,K)??K,specifier:z.text,candidates:x.map(M=>fn(o,M)??M)});for(let M of x){if(fn(o,M)===null){r.push({code:"out-of-root",path:M,detail:`specifier "${z.text}" resolved outside app root`});continue}if(z.runtime&&Rn(M)){r.push({code:"declaration-shadow",path:M,detail:`runtime import "${z.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(z.runtime&&!xr(M)){r.push({code:"unanalyzable-module",path:M,detail:`runtime import "${z.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}p.push(M)}}for(let z of ru(K,le,o,a,b))c.has(z)||p.push(z)}c.size>=Ar&&p.length>0&&r.push({code:"limit-exceeded",path:o,detail:`reachable file set exceeds ${String(Ar)}; analysis truncated (${String(p.length)}+ files not analyzed)`});let N=U_(o,a,d,u,r),R=new Set,v=new Set,I=L=>{let K=fn(o,L);return K!==null&&s.has(K)};for(let L of d){if(!k_(L))continue;let K=f.get(L);if(K===void 0)continue;let Y=w_(K);if(Y==="other"){if(!I(L))continue;v.add(L),r.push({code:"parse-error",path:L,detail:"extensionless entrypoint declares a non-node interpreter in its shebang; it is not a JavaScript module, and the code it runs was NOT analyzed (degraded to unknown)"});continue}Y==="none"&&!I(L)||R.add(L)}let A=C.createProgram({rootNames:[...d],options:un,host:a}),B=new Set,O=new Map;for(let L of A.getSourceFiles()){if(L.isDeclarationFile||A.isSourceFileDefaultLibrary(L)||fn(o,L.fileName)===null||!_a(L.fileName))continue;let K=A.getSyntacticDiagnostics(L).length>0;if(!K&&!L.text.includes("<")||x_(L.text,C.ScriptKind.TSX)!==0)continue;let Y=C.createSourceFile(L.fileName,L.text,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);(K||ou(Y)>ou(L))&&(B.add(L.fileName),O.set(L.fileName,L.text))}let V=A;if(B.size>0||R.size>0){let L=a.getSourceFile.bind(a);a.getSourceFile=(Y,le,z,Z)=>{let de=O.get(Y);if(de!==void 0)return C.createSourceFile(Y,de,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);let x=R.has(Y)?f.get(Y):void 0;return x!==void 0?C.createSourceFile(Y,x,C.ScriptTarget.ES2020,!0,C.ScriptKind.JS):L(Y,le,z,Z)};let K=Y=>A.getSourceFile(Y)!==void 0;V=C.createProgram({rootNames:[...d].filter(Y=>R.has(Y)||K(Y)),options:R.size>0?{...un,allowNonTsExtensions:!0}:un,host:a,...R.size>0?{}:{oldProgram:A}})}let E=V.getTypeChecker();for(let L of n){if(!s.has(L))continue;let K;try{K=Qt(ln.join(o,L))}catch{continue}!d.has(K)||v.has(K)||V.getSourceFile(K)===void 0&&(v.add(K),r.push({code:"parse-error",path:K,detail:"entrypoint is not a module cupel can parse (an unrecognised file type); the code it runs was NOT analyzed (degraded to unknown)"}))}let D=[];for(let L of V.getSourceFiles()){if(L.isDeclarationFile||V.isSourceFileDefaultLibrary(L)||fn(o,L.fileName)===null)continue;D.push(L);let K=V.getSyntacticDiagnostics(L);if(K.length>0){let z=K[0],Z=z!==void 0?C.flattenDiagnosticMessageText(z.messageText," "):"syntax error";r.push({code:"parse-error",path:L.fileName,detail:`${String(K.length)} syntax error(s): ${Z}`})}let Y=fn(o,L.fileName),le=Y===null?null:gu(L.fileName,L.text,L);Y!==null&&le!==null&&le.size>0&&r.push({code:"loader-escape",path:Y,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...le].sort()})}return{program:V,checker:E,host:a,options:un,appRoot:o,sourceFiles:D,diagnostics:r,depReach:N,conditionUnions:[...i,...N.conditionUnions],provenAbsent:N.provenAbsent,resolveParamDirs:b,toRel:L=>fn(o,L)}}import{opendirSync as W_,statSync as H_}from"node:fs";import ba from"node:path";var q_=8192,V_=2e4,X_=new Set(["node_modules"]),_u=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),Y_=16;function Pr(e,n,t,s,o={}){let r=o.maxEntries??V_,i=o.prune,a=[],l=!1,d=0,c=[{dir:ba.join(e,n),rel:n,depth:0}];for(;c.length>0;){let p=c.pop();if(p===void 0)break;if(p.depth>Y_){l=!0;continue}let u;try{u=W_(p.dir)}catch{l=!0;continue}try{let f=0;for(;;){let m=u.readSync();if(m===null)break;if(f+=1,d+=1,f>q_||d>r){l=!0;break}let h=p.rel+m.name;if(m.isSymbolicLink()){let y;try{y=H_(ba.join(p.dir,m.name)).isDirectory()}catch{l=!0;continue}if(y){l=!0;continue}}else if(m.isDirectory()){if(X_.has(m.name)||m.name.startsWith(".")||i?.has(m.name)===!0){l=!0;continue}c.push({dir:ba.join(p.dir,m.name),rel:`${h}/`,depth:p.depth+1});continue}else if(!m.isFile())continue;if(t(h)){if(a.length>=s){l=!0;break}a.push(h)}}}finally{try{u.closeSync()}catch{}}}return{matches:a,truncated:l}}var J_=64;function bu(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let s=n.slice(0,t),o=n.slice(t+1);if(s.startsWith("./")&&(s=s.slice(2)),s.startsWith("/")||o.includes("/")||s.split("/").includes("..")||s.includes("\\")||n.includes("\0"))return null;let r=s.slice(0,s.lastIndexOf("/")+1);return Pr(e,r,i=>i.length>=s.length+o.length&&i.startsWith(s)&&i.endsWith(o),J_)}import{existsSync as Z_}from"node:fs";import Q_ from"node:path";var eb=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],nb=["dependencies","devDependencies"];function tb(e,n){for(let t of nb){let s=e[t];if(!(typeof s!="object"||s===null||Array.isArray(s))&&Object.hasOwn(s,n))return!0}return!1}function Sa(e,n){if(n===null)return null;for(let t of eb)if(tb(n,t.dependency)){for(let s of t.configFiles)if(Z_(Q_.join(e,s)))return{name:t.name,configFile:s,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function xa(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var sb=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],ob=256,rb=12e4;function ka(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let s=Pr(e,"",o=>{let r=o.split("/");for(let i=0;i<r.length-1;i+=1){let a=r[i];if(a!==void 0&&t.has(a))return sb.some(l=>o.endsWith(l))}return!1},ob,{maxEntries:rb,prune:_u});return{roots:s.matches,truncated:s.truncated}}function jn(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let s of n){let o=s.codePointAt(0)??0;t+=o<32||o>=127&&o<=159?`\\x${o.toString(16).padStart(2,"0")}`:s}return t}function ib(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function ab(e){let n=!1;for(let t=0;t<e.length;t+=1){let s=e.charAt(t),o=s.codePointAt(0)??0;if(o<32||o===127||o>=128&&o<=159)return null;if(s==="\\"){n=!0;let r=e.charAt(t+1);if(!(r>="a"&&r<="z"||r>="A"&&r<="Z"||r>="0"&&r<="9"||r==="."||r==="_"||r==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(s))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function lb(e){let n=[],t="";for(let s of e){if(s===" "||s==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=s}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var db=/^[A-Za-z_][A-Za-z0-9_]*=/u;function cb(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var Su=new Set(["flask","granian","gunicorn","hypercorn","php","php-fpm","puma","python","python2","python3","rails","ruby","streamlit","unicorn","uvicorn","uwsgi","waitress-serve"]);function ub(e){let n=e.slice(e.lastIndexOf("/")+1);return Su.has(n)||Su.has(n.replace(/[0-9.]+$/u,""))}var fb=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),pb=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),mb=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function ku(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function xu(e){if(ku(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return mb.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:fb.has(t)||n!==-1&&pb.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var hb=[".js",".cjs",".mjs",".ts",".mts",".cts"];function gb(e){return hb.some(n=>e.endsWith(n))}var yb=new Set(["npm","yarn","pnpm"]);function _b(e){let n=e[0];return n===void 0||!yb.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function va(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!ib(n))return wa(n);let t=ab(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let s=wa(t.windows),o=wa(t.posixShell);if(s.kind==="file"){let r=o.kind==="file"?o.specifier:void 0;return r===void 0||r===s.specifier?{kind:"file",specifier:s.specifier}:{kind:"file",specifier:s.specifier,alt:r}}return o.kind==="file"?{kind:"file",specifier:o.specifier}:s}function wa(e){let n=lb(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let r=n[t];if(r===void 0||!db.test(r))break;if(ku(r))return{kind:"unparsed",reason:`environment \`${jn(r)}\` preloads another module; the launch surface is more than one file`};let i=r.indexOf("=");if(r.slice(0,i)==="NODE_OPTIONS")for(let a of r.slice(i+1).split(/\s+/u)){if(a===""||!a.startsWith("-"))continue;let l=xu(a);if(l!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${jn(l.token)}\` ${l.why}`}}}let s=n[t];if(s===void 0)return{kind:"unparsed",reason:"no program in the command"};if(_b(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!cb(s))return ub(s)?{kind:"foreign",binary:s}:{kind:"unparsed",reason:`runs \`${jn(s)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let r=n[t];if(r===void 0||!r.startsWith("-"))break;let i=xu(r);if(i!==null)return{kind:"unparsed",reason:`node flag \`${jn(i.token)}\` ${i.why}`}}let o=n[t];return o===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:gb(o)?{kind:"file",specifier:o}:{kind:"unparsed",reason:`\`${jn(o)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function bb(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Sb=64,Ea=64*1024,xb=64;function Aa(e){let n=[],t=!1;for(let s of e.split(/\r?\n/u)){if(n.length>=xb){t=!0;break}let o=/^\s*(CMD|ENTRYPOINT)\s+(.*\S)\s*$/iu.exec(s),r=/^\s*(command|entrypoint):\s*(.*\S)\s*$/u.exec(s),i=o??r;if(i?.[1]===void 0||i[2]===void 0)continue;let a=kb(i[2]);a!==null&&n.push({label:i[1].toUpperCase(),command:a})}return{commands:n,truncated:t}}function kb(e){let n=e.trim();if(!n.startsWith("["))return n===""?null:n;let t;try{t=JSON.parse(n)}catch{return null}if(!Array.isArray(t))return null;let s=t.filter(o=>typeof o=="string");return s.length===0||s.length!==t.length?null:s.join(" ")}function Na(e){let n=e.split(`
-`),t=n.length>64,s=[],o=0;for(let r of n.slice(0,64)){let i=r.trim();if(i.length===0||i.startsWith("#"))continue;let a=i.indexOf(":");if(a<=0)continue;let l=i.slice(a+1).trim();if(l.length===0)continue;let d=i.slice(0,a);if(d.length>Sb||!bb(d)){o+=1;continue}s.push({name:d,command:l})}return s.sort((r,i)=>r.name===i.name?0:r.name==="web"?-1:i.name==="web"?1:0),{entries:s,truncated:t,unnamedLines:o}}import{realpathSync as zu}from"node:fs";import On from"node:path";import g from"typescript";import P from"typescript";import wu from"node:path";import ue from"typescript";var wb=/^lib\.(?:es5|es20\d\d(?:\.[a-z0-9]+)*|esnext(?:\.[a-z0-9]+)*|decorators(?:\.legacy)?)\.d\.ts$/u,vb=/^lib\.(?:dom|webworker|scripthost)(?:\.[a-z0-9]+)*\.d\.ts$/u;function Eb(e,n){if(e.isSourceFileDefaultLibrary(n)){let t=wu.basename(n.fileName);return wb.test(t)?"ecmascript":vb.test(t)?"host-lib":"unknown"}return n.fileName.split(wu.sep).join("/").includes("/node_modules/")?"dependency":"app"}function Ab(e,n,t){if(t===void 0)return"unknown";let s=t;if(s.flags&ue.SymbolFlags.Alias)try{s=n.getAliasedSymbol(s)}catch{return"unknown"}let o=s.declarations??[];if(o.length===0)return"unknown";let r=new Set(o.map(i=>Eb(e,i.getSourceFile())));return r.size===1?[...r][0]:"unknown"}function Ia(e,n,t){let s=t;for(;ue.isParenthesizedExpression(s);)s=s.expression;let o;if(ue.isIdentifier(s)?o=s:ue.isPropertyAccessExpression(s)?o=s.name:ue.isElementAccessExpression(s)&&ue.isStringLiteralLike(s.argumentExpression)&&(o=s.argumentExpression),o===void 0)return"unknown";let r;try{r=n.getSymbolAtLocation(o)}catch{return"unknown"}return Ab(e,n,r)}function Nb(e){if(ue.isVariableDeclaration(e)){let n=e.parent;return ue.isVariableDeclarationList(n)&&ue.isVariableStatement(n.parent)&&ue.isSourceFile(n.parent.parent)}return ue.isFunctionDeclaration(e)||ue.isClassDeclaration(e)?ue.isSourceFile(e.parent):ue.isImportClause(e)||ue.isImportSpecifier(e)||ue.isNamespaceImport(e)}function vu(e,n,t){let s;try{s=n.getSymbolAtLocation(t)}catch{return"unknown"}let o=s?.declarations??[];if(o.length===0)return"unknown";let r=t.getSourceFile();return o.every(i=>i.getSourceFile()===r&&Nb(i))?"module":o.every(i=>e.isSourceFileDefaultLibrary(i.getSourceFile()))?"global":"unknown"}var Ib=ue.TypeFlags.StringLike|ue.TypeFlags.NumberLike|ue.TypeFlags.BooleanLike|ue.TypeFlags.BigIntLike|ue.TypeFlags.ESSymbolLike|ue.TypeFlags.Null|ue.TypeFlags.Undefined|ue.TypeFlags.Void;function Eu(e){return e.flags&(ue.TypeFlags.Any|ue.TypeFlags.Unknown|ue.TypeFlags.Never)?!1:e.isUnion()?e.types.every(Eu):(e.flags&Ib)!==0&&(e.flags&ue.TypeFlags.Object)===0}var Rb=new Set([ue.SyntaxKind.EqualsEqualsToken,ue.SyntaxKind.EqualsEqualsEqualsToken,ue.SyntaxKind.ExclamationEqualsToken,ue.SyntaxKind.ExclamationEqualsEqualsToken,ue.SyntaxKind.LessThanToken,ue.SyntaxKind.LessThanEqualsToken,ue.SyntaxKind.GreaterThanToken,ue.SyntaxKind.GreaterThanEqualsToken,ue.SyntaxKind.InstanceOfKeyword,ue.SyntaxKind.InKeyword,ue.SyntaxKind.PlusToken,ue.SyntaxKind.MinusToken,ue.SyntaxKind.AsteriskToken,ue.SyntaxKind.AsteriskAsteriskToken,ue.SyntaxKind.SlashToken,ue.SyntaxKind.PercentToken,ue.SyntaxKind.AmpersandToken,ue.SyntaxKind.BarToken,ue.SyntaxKind.CaretToken,ue.SyntaxKind.LessThanLessThanToken,ue.SyntaxKind.GreaterThanGreaterThanToken,ue.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]),Ob=new Set([ue.SyntaxKind.AmpersandAmpersandToken,ue.SyntaxKind.BarBarToken,ue.SyntaxKind.QuestionQuestionToken]);function Ao(e,n,t,s=0){if(s>8)return!1;let o=t;for(;ue.isParenthesizedExpression(o);)o=o.expression;let r=i=>Ao(e,n,i,s+1);if(ue.isStringLiteral(o)||ue.isNoSubstitutionTemplateLiteral(o)||ue.isTemplateExpression(o)||ue.isNumericLiteral(o)||ue.isBigIntLiteral(o)||o.kind===ue.SyntaxKind.TrueKeyword||o.kind===ue.SyntaxKind.FalseKeyword||o.kind===ue.SyntaxKind.NullKeyword||ue.isTypeOfExpression(o)||ue.isVoidExpression(o)||ue.isPrefixUnaryExpression(o)||ue.isPostfixUnaryExpression(o)||ue.isIdentifier(o)&&o.text==="undefined")return!0;if(ue.isBinaryExpression(o)){let i=o.operatorToken.kind;return Rb.has(i)?!0:Ob.has(i)?r(o.left)&&r(o.right):i===ue.SyntaxKind.CommaToken?r(o.right):!1}if(ue.isConditionalExpression(o))return r(o.whenTrue)&&r(o.whenFalse);if(ue.isCallExpression(o)){if(Ia(e,n,o.expression)!=="ecmascript")return!1;try{let i=n.getResolvedSignature(o);return i!==void 0&&Eu(n.getReturnTypeOfSignature(i))}catch{return!1}}if(ue.isIdentifier(o)){let i;try{i=n.getSymbolAtLocation(o)}catch{return!1}let a=i?.declarations??[],l=a.length===1?a[0]:void 0;return l===void 0||!ue.isVariableDeclaration(l)||l.initializer===void 0||!ue.isIdentifier(l.name)||!ue.isVariableDeclarationList(l.parent)||(l.parent.flags&ue.NodeFlags.Const)===0?!1:r(l.initializer)}return!1}import qn from"typescript";var _n={kind:"receiver"},yn=e=>({kind:"arg",index:e}),Ra=e=>({kind:"args-from",index:e}),sn=Ra(0),Ct=(e=[sn])=>({result:[sn],mutates:[],callsProgram:e}),et=(e=[_n,sn])=>({result:[_n,sn],mutates:[],callsProgram:e}),Qn=(e=[])=>({result:[_n],mutates:[],callsProgram:e}),Pb={result:[],mutates:[]},Oa=new Map,be=(e,n)=>{for(let t of e)Oa.set(t,n)};be(["String","Number","BigInt"],{result:[yn(0)],mutates:[],callsProgram:[yn(0)]});be(["Boolean"],{result:[yn(0)],mutates:[]});be(["parseInt","parseFloat","isNaN","isFinite","encodeURIComponent","encodeURI","decodeURIComponent","decodeURI","escape","unescape"],Ct());be(["Array","Object"],{result:[sn],mutates:[]});be(["String.fromCharCode","String.fromCodePoint","String.raw"],Ct());be(["at","charAt","charCodeAt","codePointAt","concat","endsWith","includes","indexOf","isWellFormed","lastIndexOf","localeCompare","match","matchAll","normalize","padEnd","padStart","repeat","replace","replaceAll","search","slice","split","startsWith","substr","substring","toLocaleLowerCase","toLocaleUpperCase","toLowerCase","toString","toUpperCase","toWellFormed","trim","trimEnd","trimLeft","trimRight","trimStart","valueOf"].map(e=>`String.prototype.${e}`),et());be(["Object.keys","Object.values","Object.entries","Object.getOwnPropertyNames","Object.getOwnPropertySymbols","Object.getPrototypeOf","Object.fromEntries","Object.freeze","Object.seal","Object.preventExtensions","Object.isFrozen","Object.isSealed","Object.isExtensible"],{result:[yn(0)],mutates:[],callsProgram:[yn(0)]});be(["Object.is","Object.hasOwn","Object.create"],Ct());be(["Object.assign"],{result:[sn],mutates:[{into:yn(0),from:[Ra(1)]}],callsProgram:[sn]});be(["Object.defineProperty"],{result:[yn(0)],mutates:[{into:yn(0),from:[yn(2)]}],callsProgram:[sn]});be(["Object.prototype.hasOwnProperty","Object.prototype.isPrototypeOf","Object.prototype.propertyIsEnumerable","Object.prototype.toString","Object.prototype.toLocaleString","Object.prototype.valueOf"],et());be(["Array.isArray"],{result:[yn(0)],mutates:[]});be(["Array.of"],{result:[sn],mutates:[]});be(["Array.from"],Ct());var Cb=["at","concat","entries","flat","includes","indexOf","join","keys","lastIndexOf","slice","toLocaleString","toReversed","toSpliced","toString","values","with"];be(Cb.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),et([_n,sn]));var Mb=["every","filter","find","findIndex","findLast","findLastIndex","flatMap","forEach","map","reduce","reduceRight","some","toSorted"];be(Mb.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),et([_n,sn]));be(["Array.prototype.push","Array.prototype.unshift"],{result:[_n,sn],mutates:[{into:_n,from:[sn]}]});be(["Array.prototype.splice"],{result:[_n],mutates:[{into:_n,from:[Ra(2)]}],callsProgram:[sn]});be(["Array.prototype.fill"],{result:[_n,yn(0)],mutates:[{into:_n,from:[yn(0)]}],callsProgram:[sn]});be(["Array.prototype.pop","Array.prototype.shift"],Qn());be(["Array.prototype.reverse","Array.prototype.copyWithin"],Qn([sn]));be(["Array.prototype.sort"],Qn([_n,sn]));for(let e of["Map","WeakMap","ReadonlyMap"])be([`${e}.prototype.get`],Qn()),be([`${e}.prototype.has`],et([])),be([`${e}.prototype.delete`],et([])),be([`${e}.prototype.set`],{result:[_n],mutates:[{into:_n,from:[yn(0),yn(1)]}]}),be([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],Qn()),be([`${e}.prototype.forEach`],Qn([sn]));for(let e of["Set","WeakSet","ReadonlySet"])be([`${e}.prototype.has`],et([])),be([`${e}.prototype.delete`],et([])),be([`${e}.prototype.add`],{result:[_n],mutates:[{into:_n,from:[yn(0)]}]}),be([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],Qn()),be([`${e}.prototype.forEach`],Qn([sn]));be(["Map.prototype.clear","Set.prototype.clear"],Qn());be(["JSON.parse","JSON.stringify"],Ct());be(["Number.isInteger","Number.isFinite","Number.isNaN","Number.isSafeInteger"],{result:[yn(0)],mutates:[]});be(["Number.parseInt","Number.parseFloat"],Ct());be(["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"].map(e=>`Number.prototype.${e}`),et([sn]));be(["abs","acos","acosh","asin","asinh","atan","atan2","atanh","cbrt","ceil","clz32","cos","cosh","exp","expm1","floor","fround","hypot","imul","log","log10","log1p","log2","max","min","pow","round","sign","sin","sinh","sqrt","tan","tanh","trunc"].map(e=>`Math.${e}`),Ct());be(["Math.random","Date.now"],Pb);be(["RegExp.prototype.test","RegExp.prototype.exec"],et());be(["RegExp.prototype.toString"],Qn());be(["Date.parse","Date.UTC"],Ct());be(["getDate","getDay","getFullYear","getHours","getMilliseconds","getMinutes","getMonth","getSeconds","getTime","getTimezoneOffset","toDateString","toISOString","toJSON","toLocaleDateString","toLocaleString","toLocaleTimeString","toString","toTimeString","toUTCString","valueOf"].map(e=>`Date.prototype.${e}`),Qn());be(["Promise.resolve","Promise.all","Promise.allSettled","Promise.any","Promise.race"],Ct());be(["Promise.prototype.then","Promise.prototype.catch","Promise.prototype.finally"],et());var Tb=new Set(["JSON","Math","Reflect","Atomics"]);function Au(e,n){let t=n;for(;qn.isParenthesizedExpression(t);)t=t.expression;let s=qn.isIdentifier(t)?t:qn.isPropertyAccessExpression(t)?t.name:void 0;if(s===void 0)return null;let o;try{o=e.getSymbolAtLocation(s),o!==void 0&&o.flags&qn.SymbolFlags.Alias&&(o=e.getAliasedSymbol(o))}catch{return null}let r=o?.valueDeclaration??o?.declarations?.[0];if(r===void 0)return null;if(qn.isIdentifier(t))return(qn.isVariableDeclaration(r)||qn.isFunctionDeclaration(r))&&r.name!==void 0&&qn.isIdentifier(r.name)?r.name.text:null;let i=r.parent;if(qn.isModuleBlock(i)&&qn.isModuleDeclaration(i.parent)&&qn.isIdentifier(i.parent.name))return`${i.parent.name.text}.${s.text}`;if(!qn.isInterfaceDeclaration(i))return null;let a=i.name.text,l=s.text;return Tb.has(a)?`${a}.${l}`:a.endsWith("Constructor")?`${a.slice(0,-11)}.${l}`:`${a}.prototype.${l}`}function Nu(e){let n=Oa.get(e);return n===void 0?void 0:{id:`ecmascript:${e}`,...n}}var cO=Oa.size;import ms from"typescript";var Pa=["get","post","put","patch","delete","options","head","all"],$b=[{id:"express@4-source-v1",packages:["express"],members:new Set([...Pa,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://expressjs.com/en/4x/api.html#app.METHOD \u2014 callbacks receive (req, res, next); error-handling middleware receives (err, req, res, next)"},{id:"koa@2-source-v1",packages:["koa","@koa/router","koa-router"],members:new Set([...Pa,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://koajs.com/#context \u2014 middleware receives (ctx, next); ctx.request carries the request"},{id:"fastify@4-source-v1",packages:["fastify"],members:new Set(Pa),sourceClass:"remote-unauthenticated",evidence:"https://fastify.dev/docs/latest/Reference/Routes/ \u2014 handler receives (request, reply)"}];function Iu(e){let n=new Set(e.map(t=>t.startsWith("@")?t.split("/").slice(0,2).join("/"):t.split("/")[0]));return $b.filter(t=>t.packages.some(s=>n.has(s)))}function Cr(e,n){if(n.length===0)return null;let t=e.expression;for(;ms.isParenthesizedExpression(t);)t=t.expression;if(!ms.isPropertyAccessExpression(t))return null;let s=t.name.text,o=n.find(a=>a.members.has(s));if(o===void 0)return null;let r=e.arguments.filter(a=>ms.isArrowFunction(a)||ms.isFunctionExpression(a)||ms.isIdentifier(a)||ms.isPropertyAccessExpression(a)),i=e.arguments.filter(ms.isCallExpression);return r.length>0||i.length>0?{model:o,handlers:r,forwarded:i}:null}function No(e,n){return e.id.startsWith("express@")&&n===4?1:0}function hs(e){return P.isFunctionDeclaration(e)||P.isFunctionExpression(e)||P.isArrowFunction(e)||P.isMethodDeclaration(e)||P.isConstructorDeclaration(e)||P.isGetAccessorDeclaration(e)||P.isSetAccessorDeclaration(e)}var Mr=(e,n,t)=>({path:e,start:n.getStart(t,!1),end:n.getEnd()});function Lb(e,n,t){let s=[];for(let o of e.parameters){if(P.isIdentifier(o.name)&&o.name.text==="this")continue;let r=P.isIdentifier(o.name)?o.name.text:void 0;s.push({index:s.length,kind:o.dotDotDotToken!==void 0?"rest":"positional",...r!==void 0?{name:r}:{},destructured:r===void 0,hasDefault:o.initializer!==void 0,range:Mr(n,o,t)})}return s}function Db(e){return P.isArrowFunction(e)?"lexical":"call"}function Fb(e){let n=!1,t=s=>{if(!n&&!(s!==e&&hs(s)&&!P.isArrowFunction(s))){if(P.isIdentifier(s)&&s.text==="arguments"){let o=s.parent;P.isPropertyAccessExpression(o)&&o.name===s||P.isPropertyAssignment(o)&&o.name===s||(n=!0)}P.isCallExpression(s)&&P.isIdentifier(s.expression)&&s.expression.text==="eval"&&(n=!0),P.forEachChild(s,t)}};e.body!==void 0&&P.forEachChild(e.body,t);for(let s of e.parameters)s.initializer!==void 0&&t(s.initializer);return n}function Ma(e,n,t,s=[],o,r=new Map){let i=new Map;if(s.length>0){let u=f=>{if(P.isCallExpression(f)){let m=Cr(f,s);for(let h of m?.handlers??[])m!==null&&(P.isArrowFunction(h)||P.isFunctionExpression(h))&&i.set(h,{model:m.model,index:No(m.model,h.parameters.length),registeredAt:Mr(t,f,n)})}P.forEachChild(f,u)};u(n)}for(let[u,f]of r)i.has(u)||i.set(u,f);let a=[],l=u=>{hs(u)&&a.push({start:u.getStart(n,!1),end:u.getEnd(),node:u}),P.forEachChild(u,l)};l(n),a.sort((u,f)=>u.start-f.start||f.end-u.end);let d=u=>{let f=0,m=a.length;for(;f<m;){let h=f+m>>>1;(a[h]?.start??1/0)<u?f=h+1:m=h}return f},c=e.map(u=>{if(u.declRange.path!==t||u.name==="<toplevel>")return;let{start:f,end:m}=u.declRange,h=d(f);for(;h<a.length&&(a[h]?.start??1/0)<m&&(a[h]?.end??0)>m;)h+=1;let y=a[h];if(y===void 0||y.start>=m||y.end>m)return;let _=a[d(y.end)];if(!(_!==void 0&&_.start<m&&_.end<=m))return y.node}),p=new Set(c.filter(u=>u!==void 0));return e.map((u,f)=>{if(u.name==="<toplevel>"&&u.declRange.path===t){let _=Ou(n,p,n,i,o);return _!==void 0?{...u,valueFlows:_}:u}let m=c[f];if(m===void 0)return u;let h=Ou(m,p,n,i,o),y=i.get(m);return{...u,...y!==void 0?{sourceParams:[{index:y.index,sourceClass:y.model.sourceClass,model:y.model.id,registeredAt:y.registeredAt}]}:{},params:Lb(m,t,n),receiver:Db(m),reflectiveArguments:Fb(m),...h!==void 0?{valueFlows:h}:{}}})}var jb=new Set(["call","apply","bind"]),Ru=new WeakMap;function Mu(e,n){let t=Ru.get(n.checker);t===void 0&&(t=new WeakMap,Ru.set(n.checker,t));let s=t.get(e);if(s!==void 0)return s;let o=Ia(n.program,n.checker,e),r=o==="ecmascript"?Au(n.checker,e):null,i=r!==null?Nu(r):void 0,a={calleeDecl:o,identity:r,...i!==void 0?{summary:i}:{}};return t.set(e,a),a}function Ta(e,n,t,s,o){let r=n;for(;P.isParenthesizedExpression(r);)r=r.expression;let i=P.isPropertyAccessExpression(r)||P.isElementAccessExpression(r)?r.expression:void 0,a=i!==void 0?{receiverRange:Mr(t,i,s)}:{},l={repeats:Bb(e)},d=o!==void 0?Mu(n,o):void 0,c=d?.calleeDecl,p=d?.identity??null,u=d?.summary,f={...c!==void 0?{calleeDecl:c}:{},...u!==void 0?{summary:u}:{},...p!==null?{runtimeId:`ecmascript:${p}`}:{},...o!==void 0&&i!==void 0&&Ao(o.program,o.checker,i)?{receiverPrimitive:!0}:{}};if(P.isTaggedTemplateExpression(e))return{convention:"unknown",...a,...l,...f};let m=P.isPropertyAccessExpression(r)&&jb.has(r.name.text);return{args:e.arguments.map((y,_)=>({index:_,spread:P.isSpreadElement(y)?"positional":!1,range:Mr(t,y,s),...o!==void 0&&!P.isSpreadElement(y)&&Ao(o.program,o.checker,y)?{primitive:!0}:{}})),convention:m?"unknown":"direct",...a,...l,...f}}function Bb(e){for(let n=e.parent;n!==void 0;n=n.parent){if(P.isForStatement(n)||P.isForInStatement(n)||P.isForOfStatement(n)||P.isWhileStatement(n)||P.isDoStatement(n))return!0;if(P.isFunctionDeclaration(n)||P.isMethodDeclaration(n)||P.isConstructorDeclaration(n)||P.isGetAccessorDeclaration(n)||P.isSetAccessorDeclaration(n))return!1;if(P.isFunctionExpression(n)||P.isArrowFunction(n))return!(P.isVariableDeclaration(n.parent)&&n.parent.initializer===n)}return!0}var Tu=2e4,Fs={kind:"constant"},pn=e=>({kind:"opaque",reason:e}),Tr=class extends Error{},Gb=new Set([P.SyntaxKind.BarBarToken,P.SyntaxKind.AmpersandAmpersandToken,P.SyntaxKind.QuestionQuestionToken,P.SyntaxKind.BarBarEqualsToken,P.SyntaxKind.AmpersandAmpersandEqualsToken,P.SyntaxKind.QuestionQuestionEqualsToken]),Kb=new Set([P.SyntaxKind.EqualsToken,P.SyntaxKind.BarBarEqualsToken,P.SyntaxKind.AmpersandAmpersandEqualsToken,P.SyntaxKind.QuestionQuestionEqualsToken]);function Mt(e){switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${String(e.at)}-${String(e.end)}`;case"argument":return`a${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"call-receiver":return`r${String(e.at)}-${String(e.end)}`;case"mutated-by-call":return`m${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"source":return`s${e.model}`;case"shared":return`h${String(e.id)}`;default:return e.kind}}var Io=e=>e.kind==="local"||e.kind==="param"||e.kind==="receiver"||e.kind==="free";function Ca(e){if(P.isIdentifier(e))return[];let n=[];for(let t of e.elements)P.isOmittedExpression(t)||(t.initializer!==void 0&&n.push(t),n.push(...Ca(t.name)));return n}function zb(e){return P.isWithStatement(e)||P.isCallExpression(e)&&P.isIdentifier(e.expression)&&e.expression.text==="eval"}function Ou(e,n,t,s,o){let r=[],i=(x,M,X)=>{for(let W of x)for(let q of M)if(r.push({from:W,to:q,kind:X}),r.length>Tu)throw new Tr},a=x=>x.getStart(t,!1),l=x=>({at:x.getStart(t,!1),end:x.getEnd()}),d=x=>o!==void 0&&Ao(o.program,o.checker,x),c=new Map,p=new Map,u=(x,M)=>{p.set(x,M);let X=c.get(x.text);X===void 0?c.set(x.text,[M]):X.push(M)},f=x=>{if(P.isIdentifier(x))return[x];let M=[];for(let X of x.elements)P.isOmittedExpression(X)||M.push(...f(X.name));return M},m=x=>({kind:"local",name:x.text,declStart:a(x)}),h=P.isSourceFile(e)?[]:e.parameters.filter(x=>!(P.isIdentifier(x.name)&&x.name.text==="this"));h.forEach((x,M)=>{if(P.isIdentifier(x.name))u(x.name,{kind:"param",index:M});else for(let X of f(x.name))u(X,m(X))});let y=x=>{for(let M=x.parent;M!==void 0&&M!==e;M=M.parent)if(hs(M)&&!P.isArrowFunction(M))return!0;return!1},_=x=>{if(x!==e&&hs(x)){if(n.has(x))return;for(let M of x.parameters)for(let X of f(M.name))u(X,m(X))}else if(P.isVariableDeclaration(x))for(let M of f(x.name))u(M,m(M));else if((P.isFunctionDeclaration(x)||P.isClassDeclaration(x))&&x.name!==void 0&&x!==e)u(x.name,m(x.name));else if(P.isCatchClause(x)&&x.variableDeclaration!==void 0)for(let M of f(x.variableDeclaration.name))u(M,m(M));P.forEachChild(x,_)},S=[];P.isSourceFile(e)?S.push(e):e.body!==void 0&&S.push(e.body);for(let x of h){x.initializer!==void 0&&S.push(x.initializer);for(let M of Ca(x.name))M.initializer!==void 0&&S.push(M.initializer)}for(let x of S)_(x);let b=x=>o===void 0?{kind:"free",name:x.text}:{kind:"free",name:x.text,binding:vu(o.program,o.checker,x)},k=x=>{if(o===void 0)return;let M;try{let F=x.parent;M=F!==void 0&&P.isShorthandPropertyAssignment(F)&&F.name===x?o.checker.getShorthandAssignmentValueSymbol(F):o.checker.getSymbolAtLocation(x)}catch{return}let X=M?.declarations??[];if(X.length===0)return;let W=[],q=!1;for(let F of X){let ne=P.getNameOfDeclaration(F),pe=ne===void 0?void 0:p.get(ne);pe===void 0?q=!0:W.push(pe)}return q&&W.push(b(x)),W},w=x=>{if(x.text==="undefined")return[Fs];if(x.text==="arguments")return[pn("reflective")];let M=k(x);return M!==void 0?M:c.get(x.text)??[b(x)]},N=x=>{if(n.has(x))return[];if(P.isArrowFunction(x)&&!P.isBlock(x.body))return[x.body];let M=[],X=W=>{hs(W)||((P.isReturnStatement(W)||P.isYieldExpression(W))&&W.expression!==void 0&&M.push(W.expression),P.forEachChild(W,X))};return x.body!==void 0&&P.forEachChild(x.body,X),M},R=x=>{if(P.isStringLiteral(x)||P.isNumericLiteral(x)||P.isBigIntLiteral(x)||P.isNoSubstitutionTemplateLiteral(x)||P.isRegularExpressionLiteral(x)||x.kind===P.SyntaxKind.TrueKeyword||x.kind===P.SyntaxKind.FalseKeyword||x.kind===P.SyntaxKind.NullKeyword||P.isVoidExpression(x)||P.isDeleteExpression(x))return[Fs];if(P.isFunctionExpression(x)||P.isArrowFunction(x)||P.isClassExpression(x))return[pn("unmodeled")];if(P.isIdentifier(x))return w(x);if(x.kind===P.SyntaxKind.ThisKeyword)return y(x)||P.isSourceFile(e)?[pn("unmodeled")]:[{kind:"receiver"}];if(P.isParenthesizedExpression(x)||P.isAsExpression(x)||P.isNonNullExpression(x)||P.isTypeAssertionExpression(x)||P.isSatisfiesExpression(x)||P.isSpreadElement(x)||P.isTypeOfExpression(x)||P.isAwaitExpression(x))return R(x.expression);if(P.isYieldExpression(x))return[pn("unmodeled")];if(P.isPropertyAccessExpression(x)||P.isElementAccessExpression(x))return R(x.expression);if(P.isCallExpression(x)){if(P.isIdentifier(x.expression)&&x.expression.text==="require"){let M=x.arguments[0];return M!==void 0&&P.isStringLiteralLike(M)?[Fs]:[pn("unmodeled")]}return x.expression.kind===P.SyntaxKind.ImportKeyword?[pn("unmodeled")]:[{kind:"call-result",...l(x)}]}if(P.isTaggedTemplateExpression(x))return[{kind:"call-result",...l(x)}];if(P.isNewExpression(x))return[pn("construct")];if(P.isConditionalExpression(x))return[...R(x.whenTrue),...R(x.whenFalse)];if(P.isBinaryExpression(x)){let M=x.operatorToken.kind;return M===P.SyntaxKind.CommaToken||M===P.SyntaxKind.EqualsToken?R(x.right):[...R(x.left),...R(x.right)]}return P.isPrefixUnaryExpression(x)||P.isPostfixUnaryExpression(x)?R(x.operand):P.isTemplateExpression(x)?x.templateSpans.flatMap(M=>R(M.expression)):P.isArrayLiteralExpression(x)?x.elements.length===0?[Fs]:x.elements.flatMap(M=>R(M)):P.isObjectLiteralExpression(x)?x.properties.length===0?[Fs]:x.properties.flatMap(M=>P.isPropertyAssignment(M)?R(M.initializer):P.isShorthandPropertyAssignment(M)?w(M.name):P.isSpreadAssignment(M)?R(M.expression):P.isSetAccessorDeclaration(M)?[Fs]:[pn("unmodeled")]):[pn("unmodeled")]},v=x=>{if(P.isIdentifier(x))return w(x).filter(Io);if(x.kind===P.SyntaxKind.ThisKeyword)return R(x).filter(Io);if(P.isParenthesizedExpression(x)||P.isAsExpression(x)||P.isNonNullExpression(x)||P.isTypeAssertionExpression(x)||P.isSatisfiesExpression(x)||P.isSpreadElement(x)||P.isAwaitExpression(x)||P.isPropertyAccessExpression(x)||P.isElementAccessExpression(x))return v(x.expression);if(P.isConditionalExpression(x))return[...v(x.whenTrue),...v(x.whenFalse)];if(P.isBinaryExpression(x)){let M=x.operatorToken.kind;return M===P.SyntaxKind.CommaToken||M===P.SyntaxKind.EqualsToken?v(x.right):Gb.has(M)?[...v(x.left),...v(x.right)]:[]}if(P.isArrayLiteralExpression(x))return x.elements.flatMap(M=>v(M));if(P.isObjectLiteralExpression(x))return x.properties.flatMap(M=>P.isPropertyAssignment(M)?v(M.initializer):P.isShorthandPropertyAssignment(M)?w(M.name).filter(Io):P.isSpreadAssignment(M)?v(M.expression):P.isMethodDeclaration(M)||P.isGetAccessorDeclaration(M)?N(M).flatMap(X=>v(X)):[]);if(P.isCallExpression(x)||P.isNewExpression(x)||P.isTaggedTemplateExpression(x)){if(P.isCallExpression(x)&&Pu(x))return[];if(d(x))return[];let M=P.isTaggedTemplateExpression(x)?P.isTemplateExpression(x.template)?x.template.templateSpans.map(q=>q.expression):[]:[...x.arguments??[]],X=P.isTaggedTemplateExpression(x)?x.tag:x.expression;for(;P.isParenthesizedExpression(X);)X=X.expression;let W=P.isPropertyAccessExpression(X)||P.isElementAccessExpression(X)?v(X.expression):v(X).filter(q=>q.kind!=="free");return[...M.flatMap(q=>d(q)?[]:v(q)),...W]}return P.isFunctionExpression(x)||P.isArrowFunction(x)?N(x).flatMap(M=>v(M)):[]},I=x=>P.isIdentifier(x)?w(x):P.isParenthesizedExpression(x)||P.isNonNullExpression(x)||P.isAsExpression(x)||P.isSatisfiesExpression(x)||P.isTypeAssertionExpression(x)?I(x.expression):P.isPropertyAccessExpression(x)||P.isElementAccessExpression(x)?v(x.expression):P.isArrayLiteralExpression(x)?x.elements.flatMap(M=>I(M)):P.isObjectLiteralExpression(x)?x.properties.flatMap(M=>P.isShorthandPropertyAssignment(M)?w(M.name):P.isPropertyAssignment(M)?I(M.initializer):P.isSpreadAssignment(M)?I(M.expression):[]):P.isSpreadElement(x)?I(x.expression):P.isBinaryExpression(x)&&x.operatorToken.kind===P.SyntaxKind.EqualsToken?I(x.left):[],A=x=>P.isParenthesizedExpression(x)||P.isNonNullExpression(x)||P.isAsExpression(x)||P.isSatisfiesExpression(x)||P.isTypeAssertionExpression(x)||P.isSpreadElement(x)?A(x.expression):P.isPropertyAccessExpression(x)||P.isElementAccessExpression(x)?v(x.expression):P.isArrayLiteralExpression(x)?x.elements.flatMap(M=>A(M)):P.isObjectLiteralExpression(x)?x.properties.flatMap(M=>P.isPropertyAssignment(M)?A(M.initializer):P.isSpreadAssignment(M)?A(M.expression):[]):P.isBinaryExpression(x)&&x.operatorToken.kind===P.SyntaxKind.EqualsToken?A(x.left):[],B=x=>v(x).filter(M=>M.kind==="local"||M.kind==="param"||M.kind==="receiver"),O=new Map,V=new Map,E=x=>{let M=x;for(let X=O.get(M);X!==void 0&&X!==M;X=O.get(M))M=X;for(let X=x;X!==M;){let W=O.get(X)??M;O.set(X,M),X=W}return M},D=(x,M)=>{let X=Mt(x),W=Mt(M);V.has(X)||(V.set(X,x),O.set(X,X)),V.has(W)||(V.set(W,M),O.set(W,W));let q=E(X),F=E(W);q!==F&&O.set(q,F)},L=(x,M)=>{let X=x.filter(Io);if(X.length===0)return;let W=v(M),q=W[0];if(q!==void 0){for(let F of W)D(q,F);for(let F of X)D(q,F)}},K=new Map,Y=(x,M)=>{for(let X of x){if(!Io(X))continue;let W=Mt(X),q=K.get(W);q===void 0&&(q=new Map,K.set(W,q));for(let F of M)q.set(Mt(F),F)}};h.forEach((x,M)=>{let X={kind:"param",index:M};if(x.initializer!==void 0&&(i(R(x.initializer),[X],"copy"),L([X],x.initializer)),!P.isIdentifier(x.name)){let W=f(x.name).map(m);i([X],W,"field");for(let q of W)D(X,q);for(let q of Ca(x.name)){if(q.initializer===void 0)continue;let F=f(q.name).map(m);i(R(q.initializer),F,"copy"),L(F,q.initializer)}}});let le=x=>{if(x!==e&&hs(x)){if(n.has(x))return;let M=s.get(x);x.parameters.forEach((X,W)=>{let q=M!==void 0&&W===M.index?{kind:"source",sourceClass:M.model.sourceClass,model:M.model.id}:pn("inner-function-param");i([q],f(X.name).map(m),"copy")})}else if(P.isVariableDeclaration(x)&&x.initializer!==void 0){let M=f(x.name).map(m);i(R(x.initializer),M,P.isIdentifier(x.name)?"copy":"field"),L(M,x.initializer)}else if(P.isBindingElement(x)&&x.initializer!==void 0){let M=f(x.name).map(m);i(R(x.initializer),M,"copy"),L(M,x.initializer)}else if(P.isCatchClause(x)&&x.variableDeclaration!==void 0)i([pn("caught")],f(x.variableDeclaration.name).map(m),"copy");else if(P.isTryStatement(x)&&x.catchClause?.variableDeclaration!==void 0){let M=f(x.catchClause.variableDeclaration.name).map(m),X=[],W=q=>{if(!n.has(q)){if(P.isThrowStatement(q))X.push(q.expression);else if(P.isCallExpression(q)||P.isNewExpression(q)){X.push(...q.arguments??[]);let F=q.expression;for(;P.isParenthesizedExpression(F);)F=F.expression;(P.isPropertyAccessExpression(F)||P.isElementAccessExpression(F))&&X.push(F.expression)}P.forEachChild(q,W)}};W(x.tryBlock);for(let q of X)d(q)||L(M,q)}else if((P.isFunctionDeclaration(x)||P.isClassDeclaration(x))&&x.name!==void 0&&x!==e)i([pn("unmodeled")],[m(x.name)],"copy");else if(P.isForOfStatement(x)||P.isForInStatement(x)){let M=x.initializer,X=P.isVariableDeclarationList(M)?M.declarations.flatMap(q=>f(q.name).map(m)):I(M),W=R(x.expression);i(W,X,"derive"),P.isVariableDeclarationList(M)||Y(A(M),W),P.isForOfStatement(x)&&L(X,x.expression)}else if(P.isBinaryExpression(x)&&Ub(x.operatorToken.kind)){let M=x.operatorToken.kind===P.SyntaxKind.EqualsToken?R(x.right):[...R(x.left),...R(x.right)],X=I(x.left);i(M,X,P.isIdentifier(x.left)?"copy":"field"),Y(A(x.left),M),Kb.has(x.operatorToken.kind)&&L(X,x.right)}else if(P.isShorthandPropertyAssignment(x)&&x.objectAssignmentInitializer!==void 0){let M=w(x.name);i(R(x.objectAssignmentInitializer),M,"copy"),L(M,x.objectAssignmentInitializer)}else if(P.isReturnStatement(x)&&x.expression!==void 0&&Cu(x)===e)i(R(x.expression),[{kind:"return"}],"return");else if(P.isYieldExpression(x)&&x.expression!==void 0&&Cu(x)===e)i(R(x.expression),[{kind:"return"}],"return");else if(P.isCallExpression(x)&&!Pu(x)){let M=l(x);x.arguments.forEach((ne,pe)=>{if(i(R(ne),[{kind:"argument",...M,index:pe}],"argument"),!d(ne)){let Se={kind:"mutated-by-call",...M,index:pe},Ie=B(ne);i([Se],Ie,"mutation"),Y(Ie,[Se])}});let X=x.expression;for(;P.isParenthesizedExpression(X);)X=X.expression;let W=P.isPropertyAccessExpression(X)||P.isElementAccessExpression(X)?X.expression:void 0,q=ne=>ne.kind==="receiver"?W!==void 0?[W]:[]:ne.kind==="arg"?x.arguments.slice(ne.index,ne.index+1):x.arguments.slice(ne.index),F=o!==void 0?Mu(x.expression,o):void 0;for(let ne of F?.summary?.mutates??[]){let pe=[...q(ne.into),...ne.from.flatMap(q)].filter(Ie=>!d(Ie)).flatMap(Ie=>v(Ie)),Se=pe[0];if(Se!==void 0)for(let Ie of pe)D(Se,Ie)}if((P.isPropertyAccessExpression(X)||P.isElementAccessExpression(X))&&(i(R(X.expression),[{kind:"call-receiver",...M}],"argument"),!d(X.expression))){let ne={kind:"mutated-by-call",...M,index:-1},pe=B(X.expression);i([ne],pe,"mutation"),Y(pe,[ne])}}else if(P.isNewExpression(x))for(let M of x.arguments??[]){if(d(M))continue;let X=B(M);i([pn("construct")],X,"mutation"),Y(X,[pn("construct")])}P.forEachChild(x,le)},z=()=>{let x=new Map,M=q=>{for(let F of q)F.kind==="local"&&x.set(Mt(F),F)},X=q=>{let F=q.parent;F!==void 0&&F.name===q&&!P.isShorthandPropertyAssignment(F)||F!==void 0&&(P.isCallExpression(F)||P.isNewExpression(F)||P.isTaggedTemplateExpression(F))&&(P.isTaggedTemplateExpression(F)?F.tag:F.expression)===q||d(q)||M(k(q)??c.get(q.text)??[])},W=(q,F)=>{let ne=F||n.has(q);ne&&P.isIdentifier(q)&&X(q),P.forEachChild(q,pe=>{W(pe,ne)})};W(t,!1);for(let q of t.statements){let F=P.canHaveModifiers(q)&&(P.getModifiers(q)??[]).some(ne=>ne.kind===P.SyntaxKind.ExportKeyword);if(F&&P.isVariableStatement(q))for(let ne of q.declarationList.declarations)M(f(ne.name).map(m));else if(F&&(P.isFunctionDeclaration(q)||P.isClassDeclaration(q))&&q.name!==void 0)M([m(q.name)]);else if(P.isExportDeclaration(q)&&q.moduleSpecifier===void 0&&q.exportClause!==void 0&&P.isNamedExports(q.exportClause))for(let ne of q.exportClause.elements)M(c.get((ne.propertyName??ne.name).text)??[]);else P.isExportAssignment(q)&&M(v(q.expression))}return[...x.values()]},Z=()=>{let x=!1,M=X=>{if(!x&&!(X!==e&&n.has(X)&&!P.isSourceFile(e))){if(zb(X)){x=!0;return}P.forEachChild(X,M)}};for(let X of S)M(X);return x},de=()=>{let x=new Map;for(let[X,W]of V){let q=E(X),F=x.get(q);F===void 0?x.set(q,[W]):F.push(W)}let M=0;for(let X of x.values()){if(X.length<2)continue;let W=new Map;for(let F of X)for(let[ne,pe]of K.get(Mt(F))??[])W.set(ne,pe);for(let F of X)F.kind==="free"&&W.set(Mt(F),F);if(W.size>0){let F={kind:"shared",id:M};M+=1,i([...W.values()],[F],"mutation"),i([F],X.filter(ne=>ne.kind!=="free"),"mutation")}let q=X.filter(F=>F.kind==="param"||F.kind==="receiver");if(q.length>=2)for(let F of q)i(q.filter(ne=>Mt(ne)!==Mt(F)),[F],"mutation")}};try{for(let x of S)le(x);if(!P.isSourceFile(e)&&P.isArrowFunction(e)&&!P.isBlock(e.body)&&i(R(e.body),[{kind:"return"}],"return"),P.isSourceFile(e)){let x=z();i([pn("unmodeled")],x,"mutation"),Y(x,[pn("unmodeled")])}if(Z()){let x=[...c.values()].flat(),M=h.map((W,q)=>({kind:"param",index:q})),X=P.isSourceFile(e)?[]:[{kind:"receiver"}];i([pn("reflective")],[...x,...M,...X],"mutation")}de()}catch(x){if(x instanceof Tr)return;throw x}return r}function Ub(e){return e>=P.SyntaxKind.FirstAssignment&&e<=P.SyntaxKind.LastAssignment}function Pu(e){return P.isIdentifier(e.expression)&&e.expression.text==="require"||e.expression.kind===P.SyntaxKind.ImportKeyword}function Cu(e){for(let n=e.parent;n!==void 0;n=n.parent)if(hs(n))return n}import fe from"typescript";var Du=4,Wb=[{id:"express-async-handler@1-forwarder-v1",package:"express-async-handler",versions:"0.0.1 - 1.2.0: all 13 published versions, read 2026-09-24",shape:{param:0,arity:[3,0],passes:3},evidence:"index.js, 1.1.4 and 1.2.0 (npm dist.shasum 225a84908df63b35ae9df94b6f0f1af061266426, ffc9896061d90f8d2e71a2d2b8668db5b0934391): `const asyncUtil = fn => function asyncUtilWrap(...args) { const fnReturn = fn(...args) ...`, `module.exports = asyncUtil`. 0.0.1-1.0.2: `(req, res, next) => ... fn(req, res, next)`; 1.0.3-1.1.3: `(req, res, next, ...args)` calling `fn(req, res, next, ...args)` (1.1.0 on both branches of `fn instanceof Promise`). https://github.com/Abazhenov/express-async-handler"}];function Fu(e){return Wb.find(n=>n.package===e)}var Hb=8;function ju(e){if(!(fe.isFunctionDeclaration(e)||fe.isFunctionExpression(e)||fe.isArrowFunction(e)||fe.isMethodDeclaration(e))||e.body===void 0||qb(e)||!fe.isArrowFunction(e)&&e.asteriskToken!==void 0||fe.canHaveDecorators(e)&&(fe.getDecorators(e)??[]).length>0||Xb(e))return null;let n=Yb(e);if(n===null||fe.isFunctionExpression(n)&&n.asteriskToken!==void 0)return null;let t=Vb(n);if(t===null||t.length===0)return null;let s=t.map(f=>f.text),o=new Set(s),r=new Map,i=Bu(e);for(let f=0;f<i.length;f+=1){let m=i[f];if(m===void 0)continue;let h=m.name;if(fe.isIdentifier(h)){if(r.has(h.text))return null;m.dotDotDotToken!==void 0||m.initializer!==void 0||o.has(h.text)||r.set(h.text,{index:f,decl:h})}}let a=[...Jb(n,r,s)],l=a[0];if(a.length!==1||l===void 0||l[1].length>Hb)return null;let[d,c]=l,p=r.get(d);if(p===void 0)return null;let u=0;for(let f of c)Zb(f,n)&&(u=Math.max(u,f.arguments.length));return u===0||!Lu(e,new Map([[d,p.decl]]))||!Lu(n,new Map(t.slice(0,u).map(f=>[f.text,f])))?null:{param:p.index,arity:[t.length],passes:u}}function Bu(e){return e.parameters.filter(n=>!(fe.isIdentifier(n.name)&&n.name.text==="this"))}function qb(e){return fe.canHaveModifiers(e)&&(fe.getModifiers(e)??[]).some(n=>n.kind===fe.SyntaxKind.AsyncKeyword)}function Vb(e){let n=[],t=new Set;for(let s of Bu(e)){let o=s.name;if(!fe.isIdentifier(o)||s.dotDotDotToken!==void 0||s.initializer!==void 0||t.has(o.text))return null;t.add(o.text),n.push(o)}return n}function Xb(e){let n=!1,t=s=>{n||((fe.isWithStatement(s)||fe.isIdentifier(s)&&(s.text==="arguments"||s.text==="eval")&&!Gu(s))&&(n=!0),fe.forEachChild(s,t))};return fe.forEachChild(e,t),n}function Yb(e){let n=e.body;if(n===void 0)return null;let t=i=>{if(i===void 0)return null;let a=rn(i);return fe.isArrowFunction(a)||fe.isFunctionExpression(a)?a:null};if(!fe.isBlock(n))return t(n);let s=[],o=i=>{fe.isFunctionLike(i)||fe.isClassLike(i)||(fe.isReturnStatement(i)&&s.push(i),fe.forEachChild(i,o))};fe.forEachChild(n,o);let r=s[0];return s.length!==1||r===void 0||r.parent!==n?null:t(r.expression)}function Jb(e,n,t){let s=new Map,o=i=>{if(fe.isCallExpression(i)&&fe.isIdentifier(i.expression)&&n.has(i.expression.text)&&i.questionDotToken===void 0&&i.arguments.length>0&&i.arguments.length<=t.length&&i.arguments.every((a,l)=>fe.isIdentifier(a)&&a.text===t[l])){let a=s.get(i.expression.text);a===void 0?s.set(i.expression.text,[i]):a.push(i)}fe.forEachChild(i,o)},r=e.body;return fe.isBlock(r)?fe.forEachChild(r,o):o(r),s}function Zb(e,n){let t=e;for(;;){let s=t.parent;if(s===n)return fe.isArrowFunction(n)&&n.body===t;if(fe.isParenthesizedExpression(s)||fe.isAwaitExpression(s)||fe.isAsExpression(s)||fe.isNonNullExpression(s)||fe.isSatisfiesExpression(s)||fe.isTypeAssertionExpression(s)){t=s;continue}if((fe.isPropertyAccessExpression(s)||fe.isElementAccessExpression(s))&&s.expression===t){t=s;continue}if(fe.isCallExpression(s)){if(s.expression===t){t=s;continue}if(!fe.isOptionalChain(s)&&s.arguments.some(o=>o===t)){t=s;continue}return!1}if(fe.isVariableDeclaration(s)&&s.initializer===t){let r=s.parent.parent;return fe.isVariableStatement(r)&&$u(r,n)}return(fe.isExpressionStatement(s)||fe.isReturnStatement(s))&&s.expression===t?$u(s,n):!1}}function $u(e,n){let t=e;for(;;){let s=t.parent;if(!fe.isBlock(s))return!1;for(let r of s.statements){if(r===t)break;if(!(fe.isExpressionStatement(r)||fe.isVariableStatement(r)||fe.isEmptyStatement(r)))return!1}if(s===n.body)return!0;let o=s.parent;if(!fe.isTryStatement(o)||o.tryBlock!==s)return!1;t=o}}function Lu(e,n){let t=!0,s=o=>{if(t){if(fe.isIdentifier(o)){let r=n.get(o.text);r!==void 0&&o!==r&&!Gu(o)&&!Qb(o)&&(t=!1)}fe.forEachChild(o,s)}};return fe.forEachChild(e,s),t}function Qb(e){let n=e.parent;return fe.isCallExpression(n)&&(n.expression===e||n.arguments.some(t=>t===e))||fe.isNewExpression(n)&&(n.arguments??[]).some(t=>t===e)||fe.isTypeOfExpression(n)||(fe.isPropertyAccessExpression(n)||fe.isElementAccessExpression(n))&&n.expression===e}function Gu(e){let n=e.parent;return(fe.isPropertyAccessExpression(n)||fe.isPropertyAssignment(n)||fe.isMethodDeclaration(n)||fe.isPropertyDeclaration(n)||fe.isGetAccessorDeclaration(n)||fe.isSetAccessorDeclaration(n))&&n.name===e||fe.isBindingElement(n)&&n.propertyName===e}function Ku(e,n,t){let s=null,o=r=>{if(s!==null)return;let i=r.getStart(e,!1),a=r.getEnd();if(i===n&&a===t){if(fe.isVariableDeclaration(r)&&r.initializer!==void 0){let l=rn(r.initializer);s=fe.isArrowFunction(l)||fe.isFunctionExpression(l)?l:null}else(fe.isFunctionDeclaration(r)||fe.isFunctionExpression(r)||fe.isArrowFunction(r)||fe.isMethodDeclaration(r))&&(s=r);if(s!==null)return}r.pos<=n&&a>=t&&fe.forEachChild(r,o)};return o(e),s}var Uu=3;function Fe(e,n,t){if(e===void 0)return;let s=e[n]??={fired:0,refused:{}};t===null?s.fired+=1:s.refused[t]=(s.refused[t]??0)+1}function _t(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var Lr=16,Fa=256,$a=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let s=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.fns.has(s)||(this.moduleFor(n),this.fns.set(s,{id:o,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),o}classFor(n,t){let s=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.classNodes.has(s)||(this.moduleFor(n),this.classNodes.set(s,{id:o,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(s,[])),o}methodFor(n,t,s,o){let r=`${n}#${t}.${s}`,i=`pkg:${n}#${t}.${s}`;if(!this.fns.has(r)){let a=this.classFor(n,t);this.fns.set(r,{id:i,moduleId:`pkg:${n}`,name:s,kind:o,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(i)}return i}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function Qu(e,n){let t="node_modules/",s=e.lastIndexOf(t);if(s===-1)return n;let r=e.slice(s+t.length).split("/");return r[0]?.startsWith("@")&&r.length>=2?`${r[0]}/${r[1]}`:r[0]??n}function Wu(e,n,t){let s=On.dirname(e),o=On.dirname(n),r=[];for(;;){let a=t.get(s);if(a!==void 0){for(let d of r)t.set(d,a);return a}r.push(s);let l=gn(On.join(s,"package.json"));if(l!==null)try{let d=JSON.parse(l),c={name:d.name??"app",version:d.version??"0.0.0",dir:s};for(let p of r)t.set(p,c);return c}catch{}if(s===o||s===On.dirname(s))break;s=On.dirname(s)}let i={name:"app",version:"0.0.0",dir:null};for(let a of r)t.set(a,i);return i}function La(e){return g.isParenthesizedExpression(e)?La(e.expression):g.isStringLiteralLike(e)?e.text:g.isTemplateExpression(e)?e.head.text:g.isBinaryExpression(e)&&e.operatorToken.kind===g.SyntaxKind.PlusToken?La(e.left):null}function eS(e){if(!g.isCallExpression(e))return!1;let n=e.expression,t=g.isPropertyAccessExpression(n)?n.name.text:g.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let s=e.arguments[0];return s!==void 0&&g.isIdentifier(s)&&(s.text==="__dirname"||s.text==="__filename")}function ef(e){let n=La(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":eS(e)?"relative-bounded":"unknown"}function nS(e){let n=[],t=o=>{if(e.isDeclarationFile)return!0;for(let r=o.parent;r!==void 0;r=r.parent)if(g.isModuleDeclaration(r)&&(g.getCombinedModifierFlags(r)&g.ModifierFlags.Ambient)!==0)return!0;return!1},s=o=>{if(g.isImportDeclaration(o)&&g.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1,at:o.getStart(e),runsBody:o.importClause?.isTypeOnly!==!0&&!t(o),loadShape:"require"});else if(g.isImportEqualsDeclaration(o)&&g.isExternalModuleReference(o.moduleReference)&&g.isStringLiteralLike(o.moduleReference.expression))n.push({specifier:o.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1,at:o.getStart(e),runsBody:!o.isTypeOnly&&!t(o),loadShape:"require"});else if(g.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&g.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1,at:o.getStart(e),runsBody:!o.isTypeOnly&&!t(o),loadShape:"require"});else if(g.isCallExpression(o)){let r=Eo(o);if(r!==null){let i=r.specifierArg,a=i!==void 0&&g.isStringLiteralLike(i);n.push({specifier:a?i.text:void 0,specifierIsLiteral:a,dynamic:!0,...i!==void 0&&!a?{computedArg:i,loadPos:o.getStart(e)}:{},at:o.getStart(e),runsBody:!t(o),loadShape:Ve(o.expression).kind===g.SyntaxKind.ImportKeyword?"dynamic-import":"require"})}}g.forEachChild(o,s)};return s(e),n}function tS(e,n,t){let s=new Map,o=Wu(On.join(e.appRoot,"package.json"),e.appRoot,s),r=[],i=[],a=[],l=new Map,d=new Map,c=new Set,p=[],u=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&u.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let h=Wu(f.fileName,e.appRoot,s),y=Qu(m,o.name),_=m.includes("node_modules/");r.push({id:m,packageName:_&&h.name!==o.name?h.name:y,versionRange:h.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),h.dir===o.dir&&c.add(m);let S=0,b=null;for(let k of nS(f)){let w=`${m}#import${String(S)}`;S+=1;let N=null,R=[];if(k.specifier!==void 0)if(Ze(k.specifier)==="package-root")N=t.moduleFor(Dn(k.specifier));else{let v=Fn(k.specifier,f.fileName,e.options,e.host),I=v!==null?e.toRel(v):null;if(I!==null)N=I;else if(k.specifier!==void 0){let[A,...B]=Ls(k.specifier,f.fileName,e.options,e.host).map(O=>e.toRel(O)).filter(O=>O!==null&&u.has(O));A!==void 0&&B.length>=1&&(N=A,R=B.map(O=>O))}}i.push({id:w,moduleId:m,specifier:k.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:k.dynamic,specifierIsLiteral:k.specifierIsLiteral,...N!==null?{resolvedModuleId:N}:{}}),N!==null&&a.push({importId:w,resolvedModuleId:N});for(let v of R)a.push({importId:w,resolvedModuleId:v});if(k.specifierIsLiteral&&k.runsBody&&N!==null){let v=[N,...R].map(I=>String(I)).filter(I=>u.has(I));if(v.length>0){let I=d.get(m)??[];I.push({pos:k.at,shape:k.loadShape,targetRels:v}),d.set(m,I)}}if(k.computedArg!==void 0&&k.loadPos!==void 0&&p.push({importId:String(w),path:m,pos:k.loadPos,shape:ef(k.computedArg),text:k.computedArg.getText(f).slice(0,160)}),k.computedArg!==void 0&&k.loadPos!==void 0){b??=ps(f,f.fileName,e.resolveParamDirs);let v=[];for(let I of vr(k.computedArg,b,e.appRoot,e.options,e.host)){let A=e.toRel(I);if(A===null||!u.has(A))continue;let B=A,O=`${m}#import${String(S)}`;S+=1,i.push({id:O,moduleId:m,specifier:A,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:B}),a.push({importId:O,resolvedModuleId:B}),v.push(A)}if(v.length>0){let I=ko(k.computedArg,b)!==null||wr(k.computedArg),A=l.get(m)??[];A.push({pos:k.loadPos,candidateRels:v,seedable:I}),l.set(m,A)}}}}return{modules:r,imports:i,importEdges:a,computedLoads:l,literalLoads:d,appOwnedPaths:c,loadSites:p}}function sS(e){let n=gn(e);if(n===null)return null;let t=g.createSourceFile(e,n,g.ScriptTarget.Latest,!0),s=o=>t.statements.some(r=>g.isFunctionDeclaration(r)?r.name?.text===o:g.isVariableStatement(r)?r.declarationList.declarations.some(i=>g.isIdentifier(i.name)&&i.name.text===o&&i.initializer!==void 0&&(g.isFunctionExpression(i.initializer)||g.isArrowFunction(i.initializer))):!1);for(let o of t.statements){if(g.isFunctionDeclaration(o)&&o.name!==void 0&&o.modifiers?.some(i=>i.kind===g.SyntaxKind.DefaultKeyword)===!0)return o.name.text;if(!g.isExpressionStatement(o)||!g.isBinaryExpression(o.expression))continue;let r=o.expression;if(r.operatorToken.kind===g.SyntaxKind.EqualsToken&&oS(r.left)){if(g.isFunctionExpression(r.right)&&r.right.name!==void 0)return r.right.name.text;if(g.isIdentifier(r.right)&&s(r.right.text))return r.right.text}}return null}function oS(e){return g.isPropertyAccessExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:g.isElementAccessExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="module"&&g.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function rS(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let s=d=>"surface"in d?n.moduleFor(d.surface):d.module,o=[],r=new Set;for(let d of e.modules)t.has(d)||r.has(d)||(r.add(d),o.push({id:d,packageName:e.entryRealNames[d]??Qu(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let i=[],a=[],l=0;for(let d of e.edges){let c=s(d.from),p=s(d.to),u=`${String(c)}#depreach${String(l)}`;l+=1,i.push({id:u,moduleId:c,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),a.push({importId:u,resolvedModuleId:p})}return{modules:o,imports:i,importEdges:a}}function Hu(e,n,t){let s=e.expression;if(g.isIdentifier(s)&&!t.has(s.text)){let o=n.get(s.text);if(o?.kind==="package-export")return{kind:"package-instance",packageName:o.packageName,className:o.exportName};if(o?.kind==="app-class")return{kind:"app-instance",cls:o.cls}}else if(g.isPropertyAccessExpression(s)&&g.isIdentifier(s.expression)&&!t.has(s.expression.text)){let o=n.get(s.expression.text);if(o?.kind==="package-surface")return{kind:"package-instance",packageName:o.packageName,className:s.name.text}}return null}function gs(e){return g.canHaveModifiers(e)&&(g.getModifiers(e)?.some(n=>n.kind===g.SyntaxKind.ExportKeyword)??!1)}function iS(e){let n=new Set,t;for(let s of e.statements){if(g.isExpressionStatement(s)&&g.isBinaryExpression(s.expression)){let o=s.expression;if(o.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isPropertyAccessExpression(o.left)&&g.isIdentifier(o.left.expression)&&o.left.expression.text==="module"&&o.left.name.text==="exports"){if(g.isIdentifier(o.right))n.add(o.right.text),t=o.right.text;else if(g.isObjectLiteralExpression(o.right))for(let r of o.right.properties)g.isShorthandPropertyAssignment(r)?n.add(r.name.text):g.isPropertyAssignment(r)&&g.isIdentifier(r.initializer)&&n.add(r.initializer.text)}continue}if(g.isFunctionDeclaration(s)&&s.name!==void 0&&gs(s))n.add(s.name.text);else if(g.isVariableStatement(s)&&gs(s))for(let o of s.declarationList.declarations)g.isIdentifier(o.name)&&n.add(o.name.text);else if(g.isExportDeclaration(s)&&s.exportClause&&g.isNamedExports(s.exportClause))for(let o of s.exportClause.elements)n.add((o.propertyName??o.name).text);else g.isExportAssignment(s)&&g.isIdentifier(s.expression)&&(n.add(s.expression.text),t=s.expression.text)}return{reachableLocals:n,defaultTarget:t}}function aS(e){for(let n of e.statements){if(g.isFunctionDeclaration(n)&&n.name!==void 0&&gs(n)&&g.getModifiers(n)?.some(t=>t.kind===g.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(g.isExportAssignment(n)&&!n.isExportEquals&&g.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(g.isExpressionStatement(n)&&g.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===g.SyntaxKind.EqualsToken&&wn(t.left)&&g.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function bt(e){if(g.isCallExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&g.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function wn(e){return g.isPropertyAccessExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:g.isElementAccessExpression(e)&&g.isIdentifier(e.expression)&&e.expression.text==="module"&&g.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function nt(e){if(wn(e))return!0;if(!g.isPropertyAccessExpression(e)&&!g.isElementAccessExpression(e))return!1;let n=e.expression;return g.isIdentifier(n)&&n.text==="exports"?!0:wn(n)}function Bs(e){return g.isPropertyAccessExpression(e.expression)&&g.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function nf(e){let n=!1,t=s=>{if(!n){if(g.isCallExpression(s)){let o=bt(s);if(o!==void 0&&Ze(o)!=="package-root"){n=!0;return}}g.forEachChild(s,t)}};return t(e),n}function tf(e){let n=new Set,t=o=>o!==void 0&&nf(o),s=o=>{g.isVariableDeclaration(o)&&t(o.initializer)&&xo(o.name,n),g.isBinaryExpression(o)&&o.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(o.left)&&t(o.right)&&n.add(o.left.text),g.forEachChild(o,s)};return s(e),n}function sf(e,n){for(let t of e.properties)g.isShorthandPropertyAssignment(t)?n.add(t.name.text):g.isPropertyAssignment(t)&&g.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function lS(e){let n=new Set;for(let a of e.statements)if(g.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(g.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(g.isVariableStatement(a))for(let l of a.declarationList.declarations)g.isIdentifier(l.name)&&l.initializer!==void 0&&(g.isFunctionExpression(l.initializer)||g.isArrowFunction(l.initializer)||g.isObjectLiteralExpression(l.initializer))&&n.add(l.name.text);let t=a=>g.isFunctionExpression(a)||g.isArrowFunction(a)||g.isObjectLiteralExpression(a)||g.isIdentifier(a)&&n.has(a.text),s=new Set,o=a=>{g.isIdentifier(a)?s.add(a.text):g.isObjectLiteralExpression(a)&&sf(a,s)},r=!1,i=a=>{if(!r){if(g.isBinaryExpression(a)&&a.operatorToken.kind===g.SyntaxKind.EqualsToken)if(wn(a.left)){o(a.right);let l=a.right;(g.isObjectLiteralExpression(l)?l.properties.every(c=>g.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||g.isPropertyAssignment(c)&&t(c.initializer)):t(l))||(r=!0)}else nt(a.left)&&(t(a.right)||(r=!0));else(g.isCallExpression(a)&&Bs(a)&&a.arguments[0]!==void 0&&ys(a.arguments[0])||g.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(r=!0);r||g.forEachChild(a,i)}};if(i(e),!r&&s.size>0){for(let a of lf(e))if(s.has(a)){r=!0;break}}return r}function ys(e){return nt(e)||g.isIdentifier(e)&&e.text==="exports"}function of(e){if(!g.isPropertyAccessExpression(e.expression)||!g.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function ja(e){return of(e)&&e.arguments[0]!==void 0&&ys(e.arguments[0])}function dS(e){return of(e)&&e.arguments[0]!==void 0&&g.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function cS(e){for(let n of e.declarations??[])if(g.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(g.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(g.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(g.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function uS(e,n,t,s,o){let r=(e.declarations??[]).filter(a=>!g.isSourceFile(a)&&!g.isModuleDeclaration(a));for(let a of r){let l=a.getSourceFile(),d=n.toRel(l.fileName);if(d===null||o.has(d))continue;let c=t.get(`${d}::${String(a.getStart(l,!1))}`);if(c!==void 0)return c}let i=e.getName();for(let a of r){let l=n.toRel(a.getSourceFile().fileName);if(l===null||o.has(l))continue;let d=s.get(`${l}::${i}`);if(d!==void 0)return d}}function Dr(e){return g.isPropertyAccessExpression(e)?e.name.text:g.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Ba=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Ga(e){let n=g.isPropertyAccessExpression(e)||g.isElementAccessExpression(e)?Dr(e):void 0;return n!==void 0&&n!=="__proto__"&&Ba.test(n)?n:void 0}function fS(e){return e!=="__proto__"&&Ba.test(e)}function qu(e){let n=Ve(e);return g.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||wn(n)}function pS(e){if(!g.isArrayLiteralExpression(e)&&!g.isObjectLiteralExpression(e))return!1;let n=!1,t=s=>{n||(nt(s)?n=!0:g.forEachChild(s,t))};return t(e),n}function Ka(e){let n=!1,t=new Map,s=o=>{if(!n){if(g.isBinaryExpression(o)&&o.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=g.SyntaxKind.LastAssignment){if(wn(o.left)||g.isIdentifier(o.left)&&o.left.text==="exports")n=!0;else if(o.operatorToken.kind===g.SyntaxKind.EqualsToken&&qu(o.right))n=!0;else if(pS(o.left))n=!0;else if(nt(o.left)){let r=Ga(o.left);r===void 0?n=!0:t.set(r,(t.get(r)??0)+1)}}else(g.isCallExpression(o)&&Bs(o)&&o.arguments[0]!==void 0&&ys(o.arguments[0])||g.isCallExpression(o)&&ja(o)||g.isCallExpression(o)&&dS(o)||g.isVariableDeclaration(o)&&o.initializer!==void 0&&qu(o.initializer))&&(n=!0);n||g.forEachChild(o,s)}};return s(e),{surfaceEscapes:n,assignCount:t}}function za(e){let n=[];for(let t of e.statements){if(!g.isExpressionStatement(t)||!g.isBinaryExpression(t.expression))continue;let s=t.expression;s.operatorToken.kind===g.SyntaxKind.EqualsToken&&(!nt(s.left)||wn(s.left)||n.push({bin:s,name:Ga(s.left)}))}return n}function mS(e){let{surfaceEscapes:n,assignCount:t}=Ka(e);if(n)return[];let s=[];for(let{bin:o,name:r}of za(e))r===void 0||(t.get(r)??0)!==1||(g.isFunctionExpression(o.right)||g.isArrowFunction(o.right))&&s.push({name:r,value:o.right});return s}function hS(e,n){let{surfaceEscapes:t,assignCount:s}=Ka(e);if(t)return[];let o=[];for(let{bin:r,name:i}of za(e))i===void 0||(s.get(i)??0)!==1||g.isIdentifier(r.right)&&!n.has(r.right.text)&&o.push(r.right.text);return o}function gS(e,n){let{surfaceEscapes:t,assignCount:s}=Ka(e);for(let{bin:o,name:r}of za(e)){let i=o.right;if(!(g.isFunctionExpression(i)||g.isArrowFunction(i)||g.isIdentifier(i)))continue;let l=g.isFunctionExpression(i)||g.isArrowFunction(i)||g.isIdentifier(i)&&!n.has(i.text);if(!(!t&&r!==void 0&&(s.get(r)??0)===1&&l))return!0}return!1}function yS(e){let n=g.isPropertyAccessExpression(e)||g.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&g.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Vu(e){let n=e.parent;return n===void 0?!1:g.isPropertyAccessExpression(n)?n.name===e:g.isQualifiedName(n)?n.right===e:g.isBindingElement(n)||g.isImportSpecifier(n)?n.propertyName===e:g.isExportSpecifier(n)?!0:g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isPropertySignature(n)||g.isMethodDeclaration(n)||g.isMethodSignature(n)||g.isGetAccessorDeclaration(n)||g.isSetAccessorDeclaration(n)||g.isEnumMember(n)?n.name===e:!1}function Xu(e){for(let n=e.parent;n!==void 0;n=n.parent){if(g.isSourceFile(n))return!0;if(!g.isArrowFunction(n)&&(g.isFunctionLike(n)||g.isClassLike(n)))return!1}return!0}function _S(e,n){let t=s=>{g.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&n.add(s),g.forEachChild(s,t)};t(e)}function bS(e){let n=[],t=new Set;for(let r of e.statements){if(g.isExportDeclaration(r)||g.isExportAssignment(r)||g.isImportDeclaration(r)||g.isImportEqualsDeclaration(r)||gs(r))return null;if(!g.isExpressionStatement(r)||!g.isBinaryExpression(r.expression))continue;let i=r.expression;if(i.operatorToken.kind===g.SyntaxKind.EqualsToken){if(wn(i.left))n.push({kind:"whole",value:i.right});else if(nt(i.left)){let a=Ga(i.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:i.right,root:yS(i.left)})}else continue;_S(i.left,t)}}let s=!1,o=r=>{if(!s){if(g.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&!t.has(r)&&!Vu(r)){s=!0;return}if(r.kind===g.SyntaxKind.ThisKeyword&&Xu(r)){s=!0;return}if(g.isIdentifier(r)&&r.text==="arguments"&&!Vu(r)&&Xu(r)){s=!0;return}g.forEachChild(r,o)}};return o(e),s?null:n}function Da(e){return g.isIdentifier(e)||g.isStringLiteralLike(e)?e.text:void 0}function Yu(e,n,t){return g.isIdentifier(e)?n(e.text):t?.(e)}function SS(e,n,t,s){let o=new Map,r=bS(e);if(r===null||r.filter(f=>f.kind==="whole").length>1)return o;let i=r.findIndex(f=>f.kind==="whole"),a=(f,m)=>i>=0&&m>i&&f.kind==="member"&&f.root==="exports",l=r.some(a);if(l){let f=r[i];if(f===void 0||f.kind!=="whole"||!g.isObjectLiteralExpression(f.value))return o}let d=l?r.filter((f,m)=>!a(f,m)):r,c=new Map;for(let f of d)f.kind==="member"&&c.set(f.name,(c.get(f.name)??0)+1);let p=f=>n.has(f)?void 0:t(f),u=(f,m)=>{m===void 0?o.delete(f):o.set(f,m)};for(let f of d){if(f.kind==="member"){u(f.name,(c.get(f.name)??0)>1?void 0:Yu(f.value,p,s));continue}o.clear();let m=f.value;if(g.isObjectLiteralExpression(m))for(let h of m.properties){if(g.isSpreadAssignment(h))return new Map;if(g.isShorthandPropertyAssignment(h)){u(h.name.text,p(h.name.text));continue}let y=Da(h.name);if(y===void 0)return new Map;u(y,g.isPropertyAssignment(h)?Yu(h.initializer,p,s):void 0)}}return o}function rf(e,n,t,s){let o=new Map,r=a=>a!==void 0&&Ze(a)==="relative"?t.get(`${n}::${a}`):void 0,i=a=>{if(g.isVariableDeclaration(a)&&a.initializer!==void 0){let l=a.initializer;if(g.isIdentifier(a.name)&&!s.has(a.name.text)){let d=r(bt(l));if(d!==void 0)o.set(a.name.text,{kind:"whole",target:d});else if((g.isPropertyAccessExpression(l)||g.isElementAccessExpression(l))&&g.isCallExpression(l.expression)){let c=r(bt(l.expression)),p=Dr(l);c!==void 0&&p!==void 0&&o.set(a.name.text,{kind:"member",target:c,member:p})}}else if(g.isObjectBindingPattern(a.name)){let d=r(bt(l));if(d!==void 0){for(let c of a.name.elements)if(g.isIdentifier(c.name)&&!s.has(c.name.text)){let p=c.propertyName!==void 0&&g.isIdentifier(c.propertyName)?c.propertyName.text:c.name.text;o.set(c.name.text,{kind:"member",target:d,member:p})}}}}g.forEachChild(a,i)};return i(e),o}function xS(e,n,t,s){let o=i=>i!==void 0&&Ze(i)==="relative"?t.get(`${n}::${i}`):void 0,r=o(bt(e));if(r!==void 0)return{kind:"whole",target:r};if(g.isPropertyAccessExpression(e)||g.isElementAccessExpression(e)){let i=Dr(e);if(i===void 0)return;let a=o(bt(e.expression));if(a!==void 0)return{kind:"member",target:a,member:i};if(g.isIdentifier(e.expression)){let l=s.get(e.expression.text);if(l?.kind==="whole")return{kind:"member",target:l.target,member:i}}return}if(g.isIdentifier(e))return s.get(e.text)}function af(e,n,t,s,o){let r=[],i=!1,a=p=>{if(nf(p))return!0;let u=!1,f=m=>{u||(g.isIdentifier(m)&&o.has(m.text)?u=!0:g.forEachChild(m,f))};return f(p),u},l=(p,u)=>{let f=xS(p,n,t,s);f!==void 0?r.push({source:f,exportedName:u}):a(p)&&(i=!0)},d=p=>{if(g.isObjectLiteralExpression(p)){for(let u of p.properties)if(g.isSpreadAssignment(u))l(u.expression,"default");else if(g.isPropertyAssignment(u)){let f=g.isIdentifier(u.name)||g.isStringLiteralLike(u.name)?u.name.text:"default";l(u.initializer,f)}else if(g.isShorthandPropertyAssignment(u)){let f=s.get(u.name.text);f!==void 0&&r.push({source:f,exportedName:u.name.text})}return}l(p,"default")},c=p=>{if(g.isBinaryExpression(p)&&p.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=g.SyntaxKind.LastAssignment){if(wn(p.left)){d(p.right);return}if(nt(p.left)){let u=g.isPropertyAccessExpression(p.left)?p.left.name.text:g.isElementAccessExpression(p.left)&&g.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";l(p.right,u);return}}else if(g.isExportAssignment(p)&&p.isExportEquals){l(p.expression,"default");return}else if(g.isCallExpression(p)&&Bs(p)&&p.arguments[0]!==void 0&&ys(p.arguments[0])){for(let u of p.arguments.slice(1))d(u);return}g.forEachChild(p,c)};return c(e),{sources:r,residual:i}}function lf(e){let n=new Set,t=o=>{let r=o;for(;g.isPropertyAccessExpression(r)||g.isElementAccessExpression(r);)r=r.expression;return g.isIdentifier(r)?r.text:void 0},s=o=>{let r=df(o);if(r!==void 0){let i=t(r);i!==void 0&&n.add(i)}g.forEachChild(o,s)};return s(e),n}function df(e){return g.isBinaryExpression(e)&&e.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=g.SyntaxKind.LastAssignment&&(g.isPropertyAccessExpression(e.left)||g.isElementAccessExpression(e.left))?e.left:void 0}function $r(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isBindingElement(t)&&n.push(...$r(t.name));return n}function kn(e){if(g.isIdentifier(e))return[e.text];if(g.isParenthesizedExpression(e)||g.isAsExpression(e)||g.isNonNullExpression(e)||g.isSatisfiesExpression(e)||g.isTypeAssertionExpression(e)||g.isAwaitExpression(e))return kn(e.expression);if(g.isYieldExpression(e))return e.expression!==void 0?kn(e.expression):[];if(g.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===g.SyntaxKind.BarBarToken||n===g.SyntaxKind.AmpersandAmpersandToken||n===g.SyntaxKind.QuestionQuestionToken?[...kn(e.left),...kn(e.right)]:n===g.SyntaxKind.CommaToken?kn(e.right):[]}return g.isConditionalExpression(e)?[...kn(e.whenTrue),...kn(e.whenFalse)]:g.isArrayLiteralExpression(e)?e.elements.flatMap(n=>g.isSpreadElement(n)?kn(n.expression):g.isOmittedExpression(n)?[]:kn(n)):g.isObjectLiteralExpression(e)?e.properties.flatMap(n=>g.isShorthandPropertyAssignment(n)?[n.name.text]:g.isPropertyAssignment(n)?kn(n.initializer):g.isSpreadAssignment(n)?kn(n.expression):[]):[]}function cf(e,n){let t=[],s=(a,l)=>{for(let d of a)for(let c of l)d!==c&&t.push({a:d,b:c})},o=a=>g.isIdentifier(a)?[a.text]:g.isArrayLiteralExpression(a)?a.elements.flatMap(o):g.isObjectLiteralExpression(a)?a.properties.flatMap(l=>g.isShorthandPropertyAssignment(l)?[l.name.text]:g.isPropertyAssignment(l)?o(l.initializer):[]):[],r=a=>{g.isBinaryExpression(a)&&a.operatorToken.kind===g.SyntaxKind.EqualsToken?s(o(a.left),kn(a.right)):g.isVariableDeclaration(a)&&a.initializer!==void 0?s($r(a.name),kn(a.initializer)):(g.isForOfStatement(a)||g.isForInStatement(a))&&g.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&s($r(a.initializer.declarations[0].name),kn(a.expression)),g.forEachChild(a,r)};r(e);let i=new Set(n);for(let a=!0;a;){a=!1;for(let{a:l,b:d}of t)i.has(l)&&!i.has(d)&&(i.add(d),a=!0),i.has(d)&&!i.has(l)&&(i.add(l),a=!0)}return i}function uf(e,n){let t=a=>{if(!g.isPropertyAccessExpression(a)&&!g.isElementAccessExpression(a))return;let l=a;for(;g.isPropertyAccessExpression(l)||g.isElementAccessExpression(l);)l=l.expression;return g.isIdentifier(l)?l.text:void 0},s=[],o=(a,l)=>{for(let c of kn(l))s.push({name:a,root:c});let d=t(l);d!==void 0&&s.push({name:a,root:d})},r=a=>{g.isVariableDeclaration(a)&&g.isIdentifier(a.name)&&a.initializer!==void 0?o(a.name.text,a.initializer):g.isBinaryExpression(a)&&a.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(a.left)&&o(a.left.text,a.right),g.forEachChild(a,r)};r(e);let i=new Map(n);for(let a=!0;a;){a=!1;for(let{name:l,root:d}of s){let c=i.get(d);c!==void 0&&!i.has(l)&&(i.set(l,c),a=!0)}}return i}function ff(e){return cf(e,lf(e))}function kS(e,n){let t=l=>l>=g.SyntaxKind.FirstAssignment&&l<=g.SyntaxKind.LastAssignment,s=l=>{let d=l.parent;if(d===void 0||!g.isObjectLiteralExpression(d))return!1;let c=d.parent;return c!==void 0&&g.isBinaryExpression(c)&&c.operatorToken.kind===g.SyntaxKind.EqualsToken&&c.right===d&&nt(c.left)?!0:c!==void 0&&g.isCallExpression(c)&&Bs(c)&&c.arguments[0]!==void 0&&ys(c.arguments[0])&&c.arguments.indexOf(d)>0},o=(l,d)=>{if((g.isFunctionDeclaration(d)||g.isFunctionExpression(d))&&d.name===l||g.isVariableDeclaration(d)&&d.name===l||g.isParameter(d)&&d.name===l||g.isBindingElement(d)&&d.name===l||(g.isCallExpression(d)||g.isNewExpression(d))&&d.expression===l)return!0;if((g.isPropertyAccessExpression(d)||g.isElementAccessExpression(d))&&d.expression===l){let c=d;for(;c.parent!==void 0&&(g.isPropertyAccessExpression(c.parent)||g.isElementAccessExpression(c.parent))&&c.parent.expression===c;)c=c.parent;let p=c.parent;return!(p!==void 0&&g.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===c)}return g.isBinaryExpression(d)&&d.operatorToken.kind===g.SyntaxKind.EqualsToken&&d.right===l&&nt(d.left)?!0:g.isShorthandPropertyAssignment(d)&&d.name===l||g.isPropertyAssignment(d)&&d.initializer===l?s(d):!!(g.isExportAssignment(d)&&d.expression===l||g.isExportSpecifier(d))},r=(l,d)=>g.isPropertyAccessExpression(d)&&d.name===l||g.isPropertyAssignment(d)&&d.name===l||(g.isMethodDeclaration(d)||g.isGetAccessorDeclaration(d)||g.isSetAccessorDeclaration(d))&&d.name===l,i=!1,a=(l,d)=>{if(!i){if(g.isIdentifier(l)&&d!==void 0&&n.has(l.text)&&!r(l,d)&&!o(l,d)){i=!0;return}g.forEachChild(l,c=>a(c,l))}};return a(e,void 0),i}function wS(e){let n=new Set;for(let l of e.statements)if(g.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(g.isVariableStatement(l))for(let d of l.declarationList.declarations)g.isIdentifier(d.name)&&d.initializer!==void 0&&(g.isFunctionExpression(d.initializer)||g.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,s=l=>{g.isBinaryExpression(l)&&l.operatorToken.kind===g.SyntaxKind.EqualsToken?(wn(l.left)&&(g.isIdentifier(l.right)?t.add(l.right.text):g.isObjectLiteralExpression(l.right)&&sf(l.right,t)),wn(l.right)&&g.isIdentifier(l.left)&&t.add(l.left.text)):g.isVariableDeclaration(l)&&g.isIdentifier(l.name)&&l.initializer!==void 0&&wn(l.initializer)&&t.add(l.name.text),g.forEachChild(l,s)};if(s(e),t.size>0){if(kS(e,t))return!0;let l=uf(e,new Map([...t].map(c=>[c,c]))),d=ff(e);for(let c of l.keys())if(d.has(c))return!0}let o=l=>g.isIdentifier(l)&&n.has(l.text),r=l=>l.properties.every(d=>g.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||g.isPropertyAssignment(d)&&o(d.initializer)),i=!1,a=l=>{if(!i){if(g.isBinaryExpression(l)){let d=l.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&l.operatorToken.kind<=g.SyntaxKind.LastAssignment;d&&wn(l.left)?l.operatorToken.kind===g.SyntaxKind.EqualsToken&&(o(l.right)||g.isObjectLiteralExpression(l.right)&&r(l.right))||(i=!0):d&&nt(l.left)&&(i=!0)}else g.isCallExpression(l)?(Bs(l)&&l.arguments[0]!==void 0&&ys(l.arguments[0])||ja(l))&&(i=!0):(g.isExportAssignment(l)&&l.isExportEquals&&!g.isIdentifier(l.expression)||g.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(i=!0);i||g.forEachChild(l,a)}};return a(e),i}var vS=8;function Ju(e,n,t){let s=new Set,o=rf(e,n,t,Ds(e)),r=af(e,n,t,o,tf(e));for(let{source:i}of r.sources)s.add(i.target);for(let i of e.statements)if(g.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&g.isStringLiteralLike(i.moduleSpecifier)&&Ze(i.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${i.moduleSpecifier.text}`);a!==void 0&&s.add(a)}return s}function ES(e,n,t,s=new Map){let o=new Set(n.modules.filter(w=>w.isEntrypoint).map(w=>String(w.id)));if(o.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let r=new Set(n.modules.filter(w=>w.externalSurface===!0).map(w=>String(w.id))),i=new Map,a=new Map,l=new Map,d=new Map;for(let w of t){if(w.name==="<toplevel>"){d.set(String(w.moduleId),w);continue}if(i.set(`${String(w.moduleId)}::${String(w.declRange.start)}`,w),w.name!==void 0&&a.set(`${String(w.moduleId)}::${w.name}`,w),w.isExported&&w.name!==void 0){let N=l.get(String(w.moduleId))??[];N.push(w),l.set(String(w.moduleId),N)}}if(s.size>0){let w=new Map(t.map(N=>[String(N.id),N]));for(let[N,R]of s){let v=w.get(String(R));v!==void 0&&!i.has(N)&&i.set(N,v)}}let c=new Map;for(let w of n.imports)w.resolvedModuleId!==void 0&&c.set(`${w.moduleId}::${w.specifier}`,String(w.resolvedModuleId));let p=new Map;for(let w of e.sourceFiles){let N=e.toRel(w.fileName);N!==null&&p.set(N,w)}let u=new Map,f=w=>{let N=u.get(w);if(N!==void 0)return N;let R=p.get(w),v=R===void 0?!0:wS(R);return u.set(w,v),v},m=new Set,h=(w,N)=>N!==void 0&&Ze(N)==="relative"?c.get(`${w}::${N}`):void 0,y=w=>{if(g.isIdentifier(w))return w.text;if(g.isPropertyAccessExpression(w)){let N=y(w.expression);return N===void 0?void 0:`${N}.${w.name.text}`}if(g.isElementAccessExpression(w)&&g.isStringLiteralLike(w.argumentExpression)){let N=y(w.expression);return N===void 0?void 0:`${N}.${w.argumentExpression.text}`}},_=w=>{let N=w;for(;g.isPropertyAccessExpression(N)||g.isElementAccessExpression(N);)N=N.expression;return bt(N)};for(let w of e.sourceFiles){let N=e.toRel(w.fileName);if(N===null)continue;let R=new Map,v=new Map,I=(O,V)=>{let E=h(N,bt(V));if(E!==void 0){if(g.isIdentifier(O))v.set(O.text,E),R.set(O.text,E);else if(g.isObjectBindingPattern(O)||g.isArrayBindingPattern(O))for(let D of $r(O))v.set(D,E);else if(g.isPropertyAccessExpression(O)||g.isElementAccessExpression(O)){let D=y(O);D!==void 0&&R.set(D,E)}}},A=O=>{g.isVariableDeclaration(O)&&O.initializer!==void 0?I(O.name,O.initializer):g.isBinaryExpression(O)&&O.operatorToken.kind===g.SyntaxKind.EqualsToken&&I(O.left,O.right),g.forEachChild(O,A)};A(w);let B=O=>{let V=df(O);if(V!==void 0){let E=V.expression,D=h(N,_(E));D!==void 0&&m.add(D);let L=y(E),K=L!==void 0?R.get(L):void 0;K!==void 0&&m.add(K)}g.forEachChild(O,B)};if(B(w),v.size>0){let O=uf(w,v),V=ff(w);for(let[E,D]of O)V.has(E)&&m.add(D)}}let S=[],b=[],k=[];for(let w of e.sourceFiles){let N=e.toRel(w.fileName);if(N===null||!o.has(N))continue;let R=e.checker.getSymbolAtLocation(w),v=new Set,I=new Set,A=0,B=(z,Z)=>{if(r.has(String(z.moduleId))||v.has(String(z.id)))return;v.add(String(z.id));let de=`${N}#reexport:${String(A)}:${Z}`;A+=1,S.push({id:de,moduleId:N,exportedName:Z,kind:"value",reexportOf:{moduleId:String(z.moduleId),name:z.name??Z}}),b.push({exportId:de,target:{kind:"function",functionId:z.id}})},O=z=>{if(cS(z))return;let Z=z;if((z.flags&g.SymbolFlags.Alias)!==0)try{Z=e.checker.getAliasedSymbol(z)}catch{return}let de=uS(Z,e,i,a,r);if(de!==void 0){B(de,z.getName());return}if((Z.flags&g.SymbolFlags.Module)!==0&&!I.has(Z)){I.add(Z);try{for(let x of e.checker.getExportsOfModule(Z))O(x)}catch{}}};if(R!==void 0)for(let z of e.checker.getExportsOfModule(R))O(z);let V=rf(w,N,c,Ds(w)),E=af(w,N,c,V,tf(w)),D=new Set,L=E.residual,K=z=>{let Z=p.get(z);z.includes("node_modules/")||Z===void 0||lS(Z)?L=!0:D.add(z)};for(let{source:z,exportedName:Z}of E.sources){let de=l.get(z.target)??[],x=m.has(z.target);if(z.kind==="whole"){for(let M of de)B(M,M.name??Z);x?L=!0:(de.length===0||f(z.target))&&K(z.target)}else{let M=de.filter(X=>X.name===z.member);for(let X of M)B(X,Z);x?L=!0:(M.length===0||f(z.target))&&K(z.target)}}let Y=new Set,le=[];for(let z of Ju(w,N,c))le.push({target:z,depth:1});for(;le.length>0;){let z=le.shift();if(z===void 0)break;let{target:Z,depth:de}=z;if(Y.has(Z)||de>vS||(Y.add(Z),Z.split("/").includes("node_modules")))continue;let x=p.get(Z);if(x===void 0)continue;let M=d.get(Z);M!==void 0&&!f(Z)&&B(M,"<load>");for(let X of Ju(x,Z,c))Y.has(X)||le.push({target:X,depth:de+1})}gS(w,Ds(w))&&(L=!0);for(let z of D)k.push({code:"unresolved-reexport",path:N,detail:`entrypoint whole/member re-exports app-owned relative module ${z} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:z});L&&k.push({code:"unresolved-reexport",path:N,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:S,exportBindings:b,diagnostics:k}}var js=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),AS=new Set(["defineProperty","defineProperties","create"]);function NS(e){let n=!0,t=o=>g.isIdentifier(o)||g.isStringLiteral(o)||g.isNumericLiteral(o)?js.has(o.text):g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?js.has(o.expression.text):!1,s=o=>{if(n){if(g.isNewExpression(o)||g.isForOfStatement(o)||g.isSpreadElement(o)||g.isSpreadAssignment(o)||g.isArrayBindingPattern(o)||g.isGetAccessorDeclaration(o)||g.isSetAccessorDeclaration(o)||g.isYieldExpression(o)&&o.asteriskToken!==void 0||g.canHaveDecorators(o)&&(g.getDecorators(o)?.length??0)>0){n=!1;return}if((g.isPropertyAccessExpression(o)||g.isMethodDeclaration(o)||g.isPropertyAssignment(o))&&t(o.name)||g.isPropertyDeclaration(o)&&t(o.name)||g.isShorthandPropertyAssignment(o)&&t(o.name)||g.isBindingElement(o)&&t(o.propertyName??o.name)||g.isElementAccessExpression(o)&&g.isStringLiteralLike(o.argumentExpression)&&js.has(o.argumentExpression.text)){n=!1;return}if(g.isCallExpression(o)&&g.isPropertyAccessExpression(o.expression)&&g.isIdentifier(o.expression.expression)&&o.expression.expression.text==="Object"&&AS.has(o.expression.name.text)){n=!1;return}g.forEachChild(o,s)}};return s(e),n}function Fr(e){if(g.isIdentifier(e)||g.isStringLiteral(e)||g.isNumericLiteral(e))return e.text}function pf(e){let n=t=>g.canHaveDecorators(t)&&(g.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function IS(e){let n=!1,t=new Set,s=[],o=new Map,r=(u,f)=>{let m=o.get(u);m===void 0?o.set(u,[f]):m.push(f)},i=u=>{g.isIdentifier(u)?t.add(u.text):s.push(u)},a=u=>{for(let f of u.properties)g.isShorthandPropertyAssignment(f)?t.add(f.name.text):g.isPropertyAssignment(f)?s.push(f.initializer):n=!0},l=u=>{if(g.isBinaryExpression(u)&&u.operatorToken.kind===g.SyntaxKind.EqualsToken){let f=u.left,m=u.right;wn(f)?g.isObjectLiteralExpression(m)?a(m):g.isIdentifier(m)||g.isFunctionExpression(m)||g.isArrowFunction(m)||g.isClassExpression(m)?i(m):n=!0:nt(f)?(g.isElementAccessExpression(f)&&!g.isStringLiteralLike(f.argumentExpression)&&(n=!0),i(m)):g.isIdentifier(f)?r(f.text,m):(g.isPropertyAccessExpression(f)||g.isElementAccessExpression(f))&&g.isIdentifier(f.expression)&&r(f.expression.text,m)}else if(g.isCallExpression(u))(Bs(u)&&u.arguments[0]!==void 0&&ys(u.arguments[0])||ja(u))&&(n=!0);else if(g.isVariableDeclaration(u)&&g.isIdentifier(u.name)&&u.initializer!==void 0)r(u.name.text,u.initializer);else if((g.isFunctionDeclaration(u)||g.isClassDeclaration(u))&&u.name!==void 0)r(u.name.text,u),gs(u)&&t.add(u.name.text);else if(g.isExportDeclaration(u)){if(u.exportClause===void 0)n=!0;else if(u.moduleSpecifier===void 0&&g.isNamedExports(u.exportClause))for(let f of u.exportClause.elements)t.add((f.propertyName??f.name).text)}else if(g.isExportAssignment(u))u.isExportEquals&&!g.isIdentifier(u.expression)?n=!0:i(u.expression);else if(g.isVariableStatement(u)&&gs(u))for(let f of u.declarationList.declarations)g.isIdentifier(f.name)&&t.add(f.name.text);g.forEachChild(u,l)};l(e);let d=new Set,c=[...t],p=u=>{let f=m=>{g.isIdentifier(m)&&c.push(m.text),g.forEachChild(m,f)};f(u)};for(let u of s)p(u);for(;c.length>0;){let u=c.pop();if(!(u===void 0||d.has(u))){d.add(u);for(let f of o.get(u)??[])p(f)}}return{names:d,opaque:n}}var RS=512,OS=new Set(["get","post","put","patch","delete","options","head"]);function PS(e){for(let n of e.statements){if(g.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(g.isExpressionStatement(n)&&g.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isPropertyAccessExpression(n.expression.left)&&g.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,s=n.expression.left.name.text;if(t==="module"&&s==="exports"||t==="exports"&&s==="default")return n.expression.right}}return null}function CS(e){let n=new Map,t=PS(e);if(t===null)return n;let s=r=>{for(let i of r.properties)if(g.isPropertyAssignment(i)&&g.isObjectLiteralExpression(i.initializer)){let a=Fr(i.name);a!==void 0&&n.set(a,i.initializer)}};if(g.isObjectLiteralExpression(t))return s(t),n;if(!g.isIdentifier(t))return n;let o=t.text;for(let r of e.statements)if(g.isVariableStatement(r))for(let i of r.declarationList.declarations)g.isIdentifier(i.name)&&i.name.text===o&&i.initializer!==void 0&&g.isObjectLiteralExpression(i.initializer)&&s(i.initializer);else if(g.isExpressionStatement(r)&&g.isBinaryExpression(r.expression)&&r.expression.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isPropertyAccessExpression(r.expression.left)&&g.isIdentifier(r.expression.left.expression)&&r.expression.left.expression.text===o&&g.isObjectLiteralExpression(r.expression.right)){let i=r.expression.left.name.text;n.set(i,r.expression.right)}return n}function MS(e){for(let n of e.properties){if(g.isMethodDeclaration(n)&&g.isIdentifier(n.name)&&n.name.text==="handler")return n;if(g.isPropertyAssignment(n)&&g.isIdentifier(n.name)&&n.name.text==="handler"&&(g.isArrowFunction(n.initializer)||g.isFunctionExpression(n.initializer)))return n.initializer}return null}function TS(e,n){for(let s of e.properties){let o;if(g.isPropertyAssignment(s)||g.isMethodDeclaration(s)?o=Fr(s.name):g.isShorthandPropertyAssignment(s)&&(o=s.name.text),o==="method"||o==="url"||o==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function $S(e,n){let t=[],s=new Set,o=(a,l,d)=>{if(t.length>=RS||a==="__proto__"||!Ba.test(a))return;let c=`${e}#handler:${a}`;s.has(c)||(s.add(c),t.push({id:c,node:l,memberPath:a,idiom:d}))};for(let[a,l]of CS(n)){let d=MS(l);d!==null&&TS(l,d)&&o(a,d,"descriptor-object")}let r=0,i=a=>{if(g.isCallExpression(a)&&g.isPropertyAccessExpression(a.expression)&&g.isIdentifier(a.expression.expression)&&OS.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&g.isStringLiteralLike(a.arguments[0])){let l=a.expression.name.text;for(let d=1;d<a.arguments.length;d+=1){let c=a.arguments[d];c!==void 0&&(g.isArrowFunction(c)||g.isFunctionExpression(c))&&o(`${l}_${String(r)}_${String(d)}`,c,"router-verb")}r+=1}g.forEachChild(a,i)};return i(n),t}function LS(e,n,t,s,o,r){let i=`${e}#class:${t}`,a=[],l=new Set;for(let d of s.members){let c,p,u;if(g.isConstructorDeclaration(d))c="constructor",p="ctor",u=!1;else if(g.isMethodDeclaration(d))c=Fr(d.name),p="method",u=c!==void 0&&!js.has(c);else continue;if(c===void 0||l.has(c))continue;l.add(c);let f=`${e}#${t}.${c}`;o.push({id:f,moduleId:e,name:c,kind:p,enclosingClassId:i,declRange:_t(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),u&&r.push({start:d.getStart(n,!1),end:d.getEnd(),id:f})}return{id:i,moduleId:e,name:t,implementsRefs:[],members:a}}function DS(e,n,t=[],s=!1,o){let r=[],i=new Map,a=[],{reachableLocals:l,defaultTarget:d}=iS(n),c=Ds(n),p=`${e}#<toplevel>`;r.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let u=(N,R)=>{let v=`${e}#${N}`;return r.push({id:v,moduleId:e,name:N,kind:"function",declRange:_t(e,R,n),isExported:l.has(N),publicSurfaceReachable:l.has(N)}),i.set(N,{kind:"function",functionId:v}),a.push({start:R.getStart(n,!1),end:R.getEnd(),id:v}),v},f=[],m=!e.split("/").includes("node_modules");if(m)for(let N of hS(n,c))l.add(N);let h=m?IS(n):void 0,y=(N,R,v)=>{h===void 0||h.opaque||h.names.has(N)||gs(v)||pf(R)||f.push(LS(e,n,N,R,r,a))};for(let N of n.statements)if(g.isFunctionDeclaration(N)&&N.name!==void 0)u(N.name.text,N);else if(g.isClassDeclaration(N)&&N.name!==void 0)y(N.name.text,N,N);else if(g.isVariableStatement(N))for(let R of N.declarationList.declarations){if(g.isObjectBindingPattern(R.name)&&R.initializer!==void 0&&g.isCallExpression(R.initializer)&&g.isIdentifier(R.initializer.expression)&&R.initializer.expression.text==="require"&&R.initializer.arguments.length===1&&R.initializer.arguments[0]!==void 0&&g.isStringLiteralLike(R.initializer.arguments[0])){let I=R.initializer.arguments[0].text;for(let A of R.name.elements){if(A.dotDotDotToken!==void 0||A.initializer!==void 0||!g.isIdentifier(A.name))continue;let B=A.propertyName??A.name;!g.isIdentifier(B)&&!g.isStringLiteralLike(B)||i.set(A.name.text,{kind:"import",specifier:I,form:{named:B.text}})}continue}if(!g.isIdentifier(R.name)||R.initializer===void 0)continue;let v=R.initializer;if(g.isFunctionExpression(v)||g.isArrowFunction(v))u(R.name.text,R);else if(g.isClassExpression(v))y(R.name.text,v,N);else if(g.isCallExpression(v)&&g.isIdentifier(v.expression)&&v.expression.text==="require"&&v.arguments.length===1&&v.arguments[0]!==void 0&&g.isStringLiteralLike(v.arguments[0]))i.set(R.name.text,{kind:"import",specifier:v.arguments[0].text,form:"whole"});else if((g.isPropertyAccessExpression(v)||g.isElementAccessExpression(v))&&Dr(v)==="default"&&g.isCallExpression(v.expression)){let I=bt(v.expression);I!==void 0&&i.set(R.name.text,{kind:"import",specifier:I,form:"require-default"})}}else if(g.isImportDeclaration(N)&&g.isStringLiteralLike(N.moduleSpecifier)){let R=N.moduleSpecifier.text,v=N.importClause;if(v!==void 0){v.name!==void 0&&i.set(v.name.text,{kind:"import",specifier:R,form:"default"});let I=v.namedBindings;if(I!==void 0&&g.isNamespaceImport(I))i.set(I.name.text,{kind:"import",specifier:R,form:"namespace"});else if(I!==void 0&&g.isNamedImports(I))for(let A of I.elements){let B=(A.propertyName??A.name).text;i.set(A.name.text,{kind:"import",specifier:R,form:{named:B}})}}}else g.isImportEqualsDeclaration(N)&&g.isExternalModuleReference(N.moduleReference)&&g.isStringLiteralLike(N.moduleReference.expression)&&i.set(N.name.text,{kind:"import",specifier:N.moduleReference.expression.text,form:"whole"});let _=new Map,S,b=new Map,k=new Map;if(m)for(let{name:N,value:R}of mS(n)){let v=`${e}#member-export:${N}`;r.push({id:v,moduleId:e,name:N,kind:g.isArrowFunction(R)?"arrow":"function",declRange:_t(e,R,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:R.getStart(n,!1),end:R.getEnd(),id:v}),_.set(R.getStart(n,!1),v)}if(s&&m){let N=B=>{let O=rn(B);return g.isFunctionExpression(O)||g.isArrowFunction(O)?O:void 0},R=(B,O)=>{let V=B;return r.push({id:V,moduleId:e,kind:g.isArrowFunction(O)?"arrow":"function",declRange:_t(e,O,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:O.getStart(n,!1),end:O.getEnd(),id:V}),_.set(O.getStart(n,!1),V),V},v=[],I=[],A=[];for(let B of n.statements)g.isExportAssignment(B)&&!B.isExportEquals?v.push(B):g.isFunctionDeclaration(B)&&g.getModifiers(B)?.some(O=>O.kind===g.SyntaxKind.DefaultKeyword)===!0?I.push(B):g.isExpressionStatement(B)&&g.isBinaryExpression(B.expression)&&B.expression.operatorToken.kind===g.SyntaxKind.EqualsToken&&wn(B.expression.left)&&A.push(B.expression);if(v.length+I.length+A.length===1){let B=v[0],O=I[0],V=A[0];if(B!==void 0){let E=N(B.expression);if(E!==void 0){let D=R(`${e}#<default>`,E);S={id:D,esm:!0},k.set(B.getStart(n,!1),D),Fe(o,"2a-default",null)}}else if(O!==void 0&&O.name===void 0&&O.body!==void 0){let E=R(`${e}#<default>`,O);S={id:E,esm:!0},k.set(O.getStart(n,!1),E),Fe(o,"2a-default",null)}else if(V!==void 0){let E=N(V.right);if(E!==void 0){let D=R(`${e}#<default>`,E);S={id:D,esm:!1},k.set(V.getStart(n,!1),D),Fe(o,"2a-default",null)}else if(g.isObjectLiteralExpression(V.right)){let D=V.right,L=[],K=!0;for(let Y of D.properties){if(g.isSpreadAssignment(Y)){K=!1;break}let le=Y.name,z=le===void 0?void 0:Da(le);if(z===void 0){K=!1;break}L.push(z)}if(K){let Y=new Map;for(let le of L)Y.set(le,(Y.get(le)??0)+1);for(let le of D.properties){if(!g.isPropertyAssignment(le))continue;let z=Da(le.name),Z=N(le.initializer);if(z!==void 0){if(!fS(z)){Z!==void 0&&Fe(o,"2a-member","charset-refused");continue}if((Y.get(z)??0)!==1){Z!==void 0&&Fe(o,"2a-member","duplicate-key");continue}if(Z!==void 0){let de=R(`${e}#<cjs>.${z}`,Z);b.set(z,de),k.set(le.getStart(n,!1),de),Fe(o,"2a-member",null)}}}}else for(let Y of D.properties)g.isPropertyAssignment(Y)&&N(Y.initializer)!==void 0&&Fe(o,"2a-member","spread-or-computed-literal")}}}else{for(let B of v)N(B.expression)!==void 0&&Fe(o,"2a-default","duplicate-default-sources");for(let B of I)B.name===void 0&&Fe(o,"2a-default","duplicate-default-sources");for(let B of A)if(N(B.right)!==void 0)Fe(o,"2a-default","duplicate-default-sources");else if(g.isObjectLiteralExpression(B.right))for(let O of B.right.properties)g.isPropertyAssignment(O)&&N(O.initializer)!==void 0&&Fe(o,"2a-member","duplicate-default-sources")}}for(let N of t)r.push({id:N.id,moduleId:e,name:`handler:${N.memberPath}`,kind:g.isArrowFunction(N.node)?"arrow":"function",declRange:_t(e,N.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:N.node.getStart(n,!1),end:N.node.getEnd(),id:N.id});a.sort((N,R)=>N.end-N.start-(R.end-R.start));let w=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:r,bindings:i,exportedFunctionId:w,exportedNames:l,tainted:c,fnRanges:a,toplevelId:p,classes:f,mintedByPos:_,mintedDefault:S,mintedMembers:b,mintSeedAliases:k}}function FS(e){return g.isIdentifier(e)?"identifier":g.isPropertyAccessExpression(e)?"member":g.isElementAccessExpression(e)?"computed-member":e.kind===g.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function Zu(e,n){let t=s=>{if(g.isBinaryExpression(s)&&s.operatorToken.kind>=g.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=g.SyntaxKind.LastAssignment){let o=s.left;g.isPropertyAccessExpression(o)&&g.isIdentifier(o.expression)?n(o.expression.text,o.name.text):g.isElementAccessExpression(o)&&g.isIdentifier(o.expression)&&n(o.expression.text,g.isStringLiteralLike(o.argumentExpression)?o.argumentExpression.text:null)}else if(g.isCallExpression(s)&&g.isPropertyAccessExpression(s.expression)){let o=s.expression,r=s.arguments[0];g.isIdentifier(o.expression)&&r!==void 0&&g.isIdentifier(r)&&(o.expression.text==="Object"&&(o.name.text==="assign"||o.name.text==="defineProperty"||o.name.text==="defineProperties")||o.expression.text==="Reflect"&&o.name.text==="defineProperty")&&n(r.text,null)}g.forEachChild(s,t)};t(e)}function jS(e){let n=!1,t=s=>{if(!n){if(g.isVariableDeclaration(s)||g.isParameter(s)){let o=new Set;if(xo(s.name,o),o.has("require")){n=!0;return}}else if((g.isFunctionDeclaration(s)||g.isClassDeclaration(s))&&s.name!==void 0&&s.name.text==="require"){n=!0;return}g.forEachChild(s,t)}};return t(e),n}function BS(e,n,t,s=new Map,o={}){let r=o.additiveForms===!0,i=o.namelessExports===!0,a=r||i?{}:void 0,l=new Map,d=new Map;for(let E of n.imports)E.resolvedModuleId!==void 0&&d.set(`${E.moduleId}::${E.specifier}`,E.resolvedModuleId);for(let E of e.sourceFiles){let D=e.toRel(E.fileName);D!==null&&l.set(D,DS(D,E,s.get(D)??[],i,a))}let c=new Map;if(r)for(let E of l.values()){let D=new Map;for(let[L,K]of E.bindings)if(K.kind==="import"&&K.form==="whole"&&Ze(K.specifier)!=="package-root"){let Y=d.get(`${E.rel}::${K.specifier}`);Y!==void 0&&D.set(L,String(Y))}D.size!==0&&Zu(E.sf,(L,K)=>{let Y=D.get(L);if(Y===void 0)return;let le=c.get(Y);if(le!=="*"){if(K===null){c.set(Y,"*");return}le===void 0?c.set(Y,new Set([K])):le.add(K)}})}let p=new Map;for(let E of l.values())E.exportedFunctionId!==void 0&&p.set(E.rel,E.exportedFunctionId);let u=new Map;for(let E of l.values()){if(E.rel.split("/").includes("node_modules"))continue;let D=aS(E.sf);if(D===void 0){i&&E.mintedDefault!==void 0&&u.set(E.rel,E.mintedDefault);continue}let L=E.bindings.get(D.name);L?.kind==="function"&&u.set(E.rel,{id:L.functionId,esm:D.esm})}let f=new Map;for(let E of l.values()){let D;for(let L of E.exportedNames){let K=E.bindings.get(L);K?.kind==="function"&&(D??=new Map,D.set(L,K.functionId))}D!==void 0&&f.set(E.rel,D)}let m=new Map;for(let E of l.values()){if(E.rel.split("/").includes("node_modules"))continue;let D=SS(E.sf,E.tainted,L=>{let K=E.bindings.get(L);return K?.kind==="function"?K.functionId:void 0},i?L=>{let K=rn(L);return g.isFunctionExpression(K)||g.isArrowFunction(K)?E.mintedByPos.get(K.getStart(E.sf,!1)):void 0}:void 0);D.size>0&&m.set(E.rel,D)}let h=[],y=[],_=[],S=[],b=[],k=[],w=new Map;for(let E of n.imports){let D=w.get(E.moduleId)??[];D.push(E.specifier),w.set(E.moduleId,D)}let N=E=>Iu(w.get(E)??[]),R=new Map,v=new Map,I=new Map,A=new Map;for(let E of l.values())if(!E.rel.split("/").includes("node_modules"))for(let D of E.functions)D.id!==E.toplevelId&&A.set(D.id,{fn:D,sf:E.sf});let B=new Map,O=E=>{let D=B.get(E);if(D===void 0){let L=A.get(E),K=L===void 0?null:Ku(L.sf,L.fn.declRange.start,L.fn.declRange.end);D=K===null?null:ju(K),B.set(E,D)}return D};for(let E of l.values()){k.push(...E.classes);for(let G of E.exportedNames){let J=E.bindings.get(G);if(J?.kind==="function"){let ee=`${E.rel}#export:${G}`;S.push({id:ee,moduleId:E.rel,exportedName:G,kind:"value"}),b.push({exportId:ee,target:{kind:"function",functionId:J.functionId}})}}if(i){if(E.mintedDefault!==void 0){let G=`${E.rel}#export:<default>`;S.push({id:G,moduleId:E.rel,exportedName:"default",kind:"value"}),b.push({exportId:G,target:{kind:"function",functionId:E.mintedDefault.id}})}for(let[G,J]of E.mintedMembers){let ee=`${E.rel}#export:<cjs>.${G}`;S.push({id:ee,moduleId:E.rel,exportedName:G,kind:"value"}),b.push({exportId:ee,target:{kind:"function",functionId:J}})}}let D=new Map;for(let[G,J]of E.bindings){if(J.kind==="function"){D.set(G,J);continue}if(Ze(J.specifier)==="package-root"){let ae=Dn(J.specifier);typeof J.form=="object"?D.set(G,{kind:"package-export",packageName:ae,exportName:J.form.named}):J.form==="require-default"?D.set(G,{kind:"package-default",packageName:ae}):D.set(G,{kind:"package-surface",packageName:ae})}else{let ae=d.get(`${E.rel}::${J.specifier}`);if(ae!==void 0&&typeof J.form=="object"){let we=f.get(String(ae))?.get(J.form.named);we!==void 0&&D.set(G,{kind:"app-named-fn",functionId:we})}else if(ae!==void 0&&J.form==="require-default"){let we=u.get(String(ae));we!==void 0&&we.esm&&D.set(G,{kind:"app-default-fn",functionId:we.id})}else ae!==void 0&&typeof J.form!="object"&&J.form!=="require-default"&&D.set(G,{kind:"module",resolvedModuleId:ae})}}let L=new Map;for(let G of E.functions){if(G.enclosingClassId===void 0||G.name===void 0)continue;let J=L.get(G.enclosingClassId);J===void 0&&(J=new Map,L.set(G.enclosingClassId,J)),J.set(G.name,G.id)}for(let G of E.classes)G.name===void 0||E.tainted.has(G.name)||D.has(G.name)||D.set(G.name,{kind:"app-class",cls:{classId:G.id,className:G.name,memberIds:L.get(G.id)??new Map}});let K=G=>{if(g.isVariableDeclaration(G)&&g.isIdentifier(G.name)&&G.initializer!==void 0&&g.isNewExpression(G.initializer)&&!E.tainted.has(G.name.text)&&!D.has(G.name.text)){let J=Hu(G.initializer,D,E.tainted);J!==null&&D.set(G.name.text,J)}g.forEachChild(G,K)};K(E.sf);let Y=G=>{for(let J of E.fnRanges)if(G>=J.start&&G<J.end)return J.id;return E.toplevelId},le=new Map,z=new Map,Z=new Map,de=(G,J,ee)=>{if(ee===null){G.set(J,"*");return}let ae=G.get(J);ae!=="*"&&(ae===void 0?G.set(J,new Set([ee])):ae.add(ee))},x=(G,J)=>{de(le,G,J);let ee=D.get(G);ee?.kind==="package-surface"?de(z,ee.packageName,J):ee?.kind==="module"&&de(Z,String(ee.resolvedModuleId),J)};Zu(E.sf,x);let M=new Map,X=256,W=G=>{let J=M.get(G);return J===void 0&&(J=M.size>=X?new Set([G]):cf(E.sf,new Set([G])),M.set(G,J)),J},q=(G,J)=>G==="*"||G!==void 0&&G.has(J),F=(G,J)=>{let ee=D.get(G);if(ee?.kind==="package-surface"&&q(z.get(ee.packageName),J)||ee?.kind==="module"&&q(Z.get(String(ee.resolvedModuleId)),J))return!0;for(let ae of W(G))if(q(le.get(ae),J))return!0;return!1},ne=G=>{if(g.isIdentifier(G)){let J=E.tainted.has(G.text)?void 0:D.get(G.text);return J?.kind==="function"?J.functionId:J?.kind==="module"?p.get(String(J.resolvedModuleId))??null:J?.kind==="package-export"?t.exportFor(J.packageName,J.exportName):null}if(g.isPropertyAccessExpression(G)&&g.isIdentifier(G.expression)){let J=G.expression.text;if(F(J,G.name.text))return null;let ee=E.tainted.has(J)?void 0:D.get(J);return ee?.kind==="package-surface"?t.exportFor(ee.packageName,G.name.text):ee?.kind==="package-export"?t.methodFor(ee.packageName,ee.exportName,G.name.text,"method"):ee?.kind==="package-instance"?t.methodFor(ee.packageName,ee.className,G.name.text,"method"):null}return null},pe=G=>{for(let J=G.parent;J!==void 0;J=J.parent)if(!g.isArrowFunction(J)){if(g.isFunctionExpression(J)||g.isFunctionDeclaration(J))return null;if(g.isMethodDeclaration(J)||g.isConstructorDeclaration(J)||g.isGetAccessorDeclaration(J)||g.isSetAccessorDeclaration(J)){let ee=J.parent;if(!g.isClassLike(ee)||ee.name===void 0)return null;let ae=E.tainted.has(ee.name.text)?void 0:D.get(ee.name.text);return ae?.kind==="app-class"?ae.cls:null}}return null},Se=r&&!E.tainted.has("require")&&!jS(E.sf),Ie=G=>{if(g.isIdentifier(G)){let ae=E.tainted.has(G.text)?void 0:D.get(G.text);return ae?.kind==="package-surface"||ae?.kind==="package-default"?t.exportFor(ae.packageName,"default"):ae?.kind==="app-named-fn"||ae?.kind==="app-default-fn"?ae.functionId:ae?.kind==="module"?u.get(String(ae.resolvedModuleId))?.id??null:ae?.kind==="member-value"?ae.functionId:null}if(!g.isPropertyAccessExpression(G))return null;let J=G.expression;if(r&&g.isCallExpression(rn(J))){let ae=bt(rn(J));if(ae!==void 0)if(!Se)Fe(a,"2b","require-shadow");else if(Ze(ae)==="package-root")Fe(a,"2b","package-root");else{let we=d.get(`${E.rel}::${ae}`);if(we===void 0)Fe(a,"2b","unresolved-module");else{let Me=G.name.text,xn=c.get(String(we));if(xn==="*"||xn!==void 0&&xn.has(Me))Fe(a,"2b","module-mutation-gate");else{let zn=m.get(String(we))?.get(Me);if(zn!==void 0)return Fe(a,"2b",null),zn;if(Me==="default"){let Un=u.get(String(we));if(Un!==void 0&&Un.esm)return Fe(a,"2b",null),Un.id;Fe(a,"2b","non-esm-default")}else Fe(a,"2b","unknown-member")}}}return null}let ee;if(g.isIdentifier(J)){let ae=E.tainted.has(J.text)?void 0:D.get(J.text);if(ae?.kind==="app-class"||ae?.kind==="app-instance")ee=ae.cls.memberIds;else if(ae?.kind==="object-literal")ee=ae.obj.members;else if(ae?.kind==="module"){let we=m.get(String(ae.resolvedModuleId));we?.has(G.name.text)===!0&&!F(J.text,G.name.text)&&(ee=we)}}else if(g.isNewExpression(J)){let ae=Hu(J,D,E.tainted);ae?.kind==="app-instance"&&(ee=ae.cls.memberIds)}else J.kind===g.SyntaxKind.ThisKeyword&&(ee=pe(G)?.memberIds);return ee?.get(G.name.text)??null},$=new Map,T=G=>{if(g.isVariableDeclaration(G)&&g.isIdentifier(G.name)&&G.initializer!==void 0&&g.isObjectLiteralExpression(G.initializer)&&!E.tainted.has(G.name.text)&&!D.has(G.name.text)&&!$.has(G.name.text)){let J=new Map;for(let ee of G.initializer.properties)if(g.isPropertyAssignment(ee)&&g.isIdentifier(ee.name)){let ae=ne(ee.initializer);ae!==null&&J.set(ee.name.text,ae)}$.set(G.name.text,J)}g.forEachChild(G,T)};T(E.sf);let j=G=>{if(g.isBinaryExpression(G)&&G.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isPropertyAccessExpression(G.left)&&g.isIdentifier(G.left.expression)&&!E.tainted.has(G.left.expression.text)){let J=$.get(G.left.expression.text);if(J!==void 0){let ee=ne(G.right);ee!==null&&J.set(G.left.name.text,ee)}}g.forEachChild(G,j)};j(E.sf);for(let[G,J]of $)D.set(G,{kind:"object-literal",obj:{members:J}});let U=(G,J=0)=>{if(J>Uu)return null;let ee=rn(G);if(g.isCallExpression(ee)&&g.isPropertyAccessExpression(ee.expression)&&ee.expression.name.text==="bind")return U(ee.expression.expression,J+1);if(g.isIdentifier(ee)){let ae=ne(ee);if(ae!==null)return ae;let we=E.tainted.has(ee.text)?void 0:D.get(ee.text);return we?.kind==="member-value"?we.functionId:null}return g.isPropertyAccessExpression(ee)?ne(ee)??Ie(ee):null},Q=(G,J=0)=>{if(J>Uu)return"depth-cap";let ee=rn(G);if(g.isCallExpression(ee)&&g.isPropertyAccessExpression(ee.expression)&&ee.expression.name.text==="bind")return Q(ee.expression.expression,J+1);if(g.isIdentifier(ee))return E.tainted.has(ee.text)?"tainted-receiver":"unresolved-receiver";if(g.isPropertyAccessExpression(ee)&&g.isIdentifier(ee.expression)){if(E.tainted.has(ee.expression.text))return"tainted-receiver";if(F(ee.expression.text,ee.name.text))return"mutated-member"}return"unresolved-receiver"},te=G=>{if(g.isVariableDeclaration(G)&&g.isIdentifier(G.name)&&G.initializer!==void 0){let J=rn(G.initializer),ee=g.isPropertyAccessExpression(J),ae=g.isCallExpression(J)&&g.isPropertyAccessExpression(J.expression)&&J.expression.name.text==="bind";if(ee||ae){let we=ee?"D1":"A2";if(E.tainted.has(G.name.text))Fe(a,we,"tainted-alias");else if(D.has(G.name.text))Fe(a,we,"already-bound");else{let Me=U(J);Me!==null?(D.set(G.name.text,{kind:"member-value",functionId:Me}),Fe(a,we,null)):Fe(a,we,Q(J))}}}g.forEachChild(G,te)};r&&te(E.sf);let ie=N(E.rel),me=new Map,ge=new Map,Re=G=>{let J=rn(G);if(!g.isIdentifier(J))return null;let ee=E.tainted.has(J.text)?void 0:D.get(J.text),ae=ee?.kind==="package-surface"||ee?.kind==="package-export"&&ee.exportName==="default"?ee.packageName:null;return ae===null?null:Fu(ae)?.shape??null},Oe=(G,J)=>{let ee=new Set((J.arity??[]).map(Me=>No(J.model,Me))),[ae]=[...ee];if(ee.size!==1||ae===void 0||ae>=J.passes)return;let we={model:J.model,index:ae,registeredAt:J.registeredAt};if(g.isArrowFunction(G)||g.isFunctionExpression(G))ge.has(G)||ge.set(G,we);else if(g.isIdentifier(G)||g.isPropertyAccessExpression(G)){let Me=ne(G)??Ie(G);Me!==null&&!R.has(Me)&&(R.set(Me,J.model),v.set(Me,J.registeredAt),I.set(Me,ae))}},_e=(G,J,ee)=>{let ae=me.get(G);if(ae===void 0)return;let we=Re(J)??(ee===null?null:O(ee));if(we===null||G.questionDotToken!==void 0||G.arguments.some(g.isSpreadElement))return;let Me=G.arguments[we.param];if(Me===void 0)return;let xn={...ae,depth:ae.depth+1,arity:ae.arity??we.arity,passes:Math.min(ae.passes,we.passes)},zn=rn(Me);g.isCallExpression(zn)?xn.depth<Du&&me.set(zn,xn):Oe(zn,xn)},Ge=0,Ue=G=>{let J,ee;if(g.isCallExpression(G)){let ae=G.expression,we=g.isIdentifier(ae)&&ae.text==="require",Me=ae.kind===g.SyntaxKind.ImportKeyword;!we&&!Me&&(J=ae,ee=G.arguments)}else g.isTaggedTemplateExpression(G)&&(J=G.tag);if(J!==void 0){let ae=FS(J),we=G.getStart(E.sf,!1),Me=`${E.rel}#call${String(Ge)}`;Ge+=1;let xn="unresolved",zn=[],Un=ne(J);if(Un!==null&&(xn="resolved",zn.push(Un)),y.push({id:Me,enclosingFunctionId:Y(we),calleeExprShape:ae,resolvedTargetIds:zn,resolution:xn,range:_t(E.rel,G,E.sf),...Ta(G,J,E.rel,E.sf,{program:e.program,checker:e.checker})}),g.isCallExpression(G)){let Ye=Cr(G,ie);for(let Yn of Ye?.handlers??[]){if(Ye===null||!(g.isIdentifier(Yn)||g.isPropertyAccessExpression(Yn)))continue;let ft=ne(Yn)??Ie(Yn);ft!==null&&!R.has(ft)&&(R.set(ft,Ye.model),v.set(ft,_t(E.rel,G,E.sf)))}for(let Yn of Ye?.forwarded??[])Ye!==null&&me.set(Yn,{model:Ye.model,registeredAt:_t(E.rel,G,E.sf),depth:0,arity:null,passes:Number.POSITIVE_INFINITY})}for(let Ye of zn)_.push({callSiteId:Me,calleeFunctionId:Ye,resolution:xn,invocation:"direct"});let io=Un===null?Ie(J):null;if(Un===null){if(io!==null)_.push({callSiteId:Me,calleeFunctionId:io,resolution:"field-based",invocation:"direct"});else if(r&&g.isPropertyAccessExpression(J)&&(J.name.text==="call"||J.name.text==="apply")){let Ye=U(J.expression);Ye!==null?(_.push({callSiteId:Me,calleeFunctionId:Ye,resolution:"field-based"}),Fe(a,"A3",null)):Fe(a,"A3",Q(J.expression))}}g.isCallExpression(G)&&_e(G,J,Un??io);for(let Ye of ee??[]){let Yn=ne(Ye);if(Yn!==null)_.push({callSiteId:Me,calleeFunctionId:Yn,resolution:"field-based",invocation:"callback"});else{let ft=Ie(Ye);if(ft!==null)_.push({callSiteId:Me,calleeFunctionId:ft,resolution:"field-based",invocation:"callback"});else if(r){let Ns=U(Ye),H=rn(Ye),ye=H!==Ye||g.isCallExpression(H)&&g.isPropertyAccessExpression(H.expression)&&H.expression.name.text==="bind";Ns!==null?(_.push({callSiteId:Me,calleeFunctionId:Ns,resolution:"field-based"}),ye&&Fe(a,"A2p",null)):ye&&Fe(a,"A2p",Q(Ye))}}}}g.forEachChild(G,Ue)};Ue(E.sf),h.push(...Ma(E.functions,E.sf,E.rel,ie,{program:e.program,checker:e.checker},ge));for(let G of n.computedLoads.get(E.rel)??[]){let J=G.candidateRels.filter(ae=>l.has(ae)).map(ae=>`${ae}#<toplevel>`);if(J.length===0)continue;let ee=`${E.rel}#dirload${String(Ge)}`;Ge+=1,y.push({id:ee,enclosingFunctionId:Y(G.pos),calleeExprShape:"require",resolvedTargetIds:J,resolution:"field-based",range:{path:E.rel,start:G.pos,end:G.pos}});for(let ae of J)_.push({callSiteId:ee,calleeFunctionId:ae,resolution:"field-based"})}let In=0;for(let G of n.literalLoads.get(E.rel)??[]){let J=[];for(let ae of G.targetRels){let we=l.get(ae);we!==void 0&&J.push(we.toplevelId)}if(J.length===0)continue;let ee=`${E.rel}#load${String(In)}`;In+=1,y.push({id:ee,enclosingFunctionId:Y(G.pos),calleeExprShape:G.shape,resolvedTargetIds:J,resolution:"resolved",range:{path:E.rel,start:G.pos,end:G.pos}});for(let ae of J)_.push({callSiteId:ee,calleeFunctionId:ae,resolution:"resolved"})}let Kn=0;for(let G of s.get(E.rel)??[]){let J=`${E.rel}#handlerseed${String(Kn)}`;Kn+=1;let ee=G.node.getStart(E.sf,!1);y.push({id:J,enclosingFunctionId:E.toplevelId,calleeExprShape:"member",resolvedTargetIds:[G.id],resolution:"field-based",range:{path:E.rel,start:ee,end:ee}}),_.push({callSiteId:J,calleeFunctionId:G.id,resolution:"field-based"})}}let V=new Map;if(i)for(let E of l.values())for(let[D,L]of E.mintSeedAliases)V.set(`${E.rel}::${String(D)}`,L);return{functions:h.map(E=>{let D=R.get(E.id);if(D===void 0||E.sourceParams!==void 0)return E;let L=v.get(E.id);return{...E,sourceParams:[{index:I.get(E.id)??No(D,E.params?.length??0),sourceClass:D.sourceClass,model:D.id,...L!==void 0?{registeredAt:L}:{}}]}}),callSites:y,callEdges:_,exports:S,exportBindings:b,classes:k,mintSeedAliases:V,bindingApplicability:a}}function GS(e,n,t){let s=l=>l.length===0||On.isAbsolute(l)||l.includes("\\")||/^[a-zA-Z]:/u.test(l)||l.split("/").some(d=>d===".."||d==="");if(s(n)||s(t))return null;let o=e.endsWith(On.sep)?e:e+On.sep,r;try{r=zu(On.resolve(e,n))}catch{return null}if(!r.startsWith(o))return null;let i=r.endsWith(On.sep)?r:r+On.sep,a;try{a=zu(On.resolve(r,t))}catch{return null}return a.startsWith(i)?a:null}function mf(e,n,t){let s=`${e}#class:${t}`,o=[],r=[],i=[],a=new Set;return{pushMember(l,d,c,p){if(l==="__proto__"||a.has(l))return;a.add(l);let u=`${e}#${t}.${l}`;o.push({id:u,moduleId:e,name:l,kind:c,enclosingClassId:s,declRange:_t(e,d,n),isExported:!1,publicSurfaceReachable:!1}),i.push(u),r.push({name:l,id:u,kind:c,body:p})},finish(){return r.length===0?null:{functions:o,classNode:{id:s,moduleId:e,name:t,implementsRefs:[],members:i},members:r}}}}function KS(e,n,t,s){if(pf(s)||s.members.length>Fa)return null;let o=mf(e,n,t);for(let r of s.members){let i,a,l;if(g.isConstructorDeclaration(r))i="constructor",a="ctor",l=void 0;else if(g.isMethodDeclaration(r))i=Fr(r.name),a="method",l=i!==void 0&&!js.has(i)?r.body??void 0:void 0;else continue;i!==void 0&&o.pushMember(i,r,a,l)}return o.finish()}function zS(e,n,t){let s;for(let i of n.statements)if(g.isFunctionDeclaration(i)&&i.name?.text===t){s=i;break}if(s===void 0)return null;let o=[];for(let i of n.statements){if(!g.isExpressionStatement(i))continue;let a=i.expression;if(!g.isBinaryExpression(a)||a.operatorToken.kind!==g.SyntaxKind.EqualsToken)continue;let l=a.left;if(g.isPropertyAccessExpression(l)&&g.isPropertyAccessExpression(l.expression)&&g.isIdentifier(l.expression.expression)&&l.expression.expression.text===t&&l.expression.name.text==="prototype"){let d=l.name.text;g.isFunctionExpression(a.right)?o.push({name:d,fn:a.right,walk:!0}):g.isArrowFunction(a.right)&&o.push({name:d,fn:a.right,walk:!1})}}if(o.length===0||o.length+1>Fa)return null;let r=mf(e,n,t);r.pushMember("constructor",s,"ctor",void 0);for(let i of o){let a=i.walk&&!js.has(i.name)&&g.isFunctionExpression(i.fn)?i.fn.body:void 0;r.pushMember(i.name,i.fn,"method",a)}return r.finish()}function US(e,n,t){for(let s of n.statements)if(g.isClassDeclaration(s)&&s.name?.text===t)return KS(e,n,t,s);return zS(e,n,t)}function WS(e,n,t,s,o){let r={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return r;let i=new Set(t.map(p=>p.packageName)),a=new Set(t.map(p=>p.path)),l=new Set,d=new Set,c=0;for(let p of n){if(!i.has(p.packageName))continue;let u=GS(e.appRoot,p.packageRootRel,p.sourcePath);if(u===null)continue;let f=e.toRel(u);if(f===null)continue;let m=`${f}#${p.container}`;if(d.has(m)||!l.has(f)&&l.size>=Lr)continue;let h=gn(u);if(h===null)continue;let y;try{y=g.createSourceFile(f,h,g.ScriptTarget.Latest,!0,g.ScriptKind.JS)}catch{continue}let _=US(f,y,p.container);if(_===null)continue;l.add(f),d.add(m);let S=new Map,b=new Map;for(let w of _.members){let N=o.methodFor(p.packageName,p.container,w.name,w.kind);S.set(w.name,N),b.set(N,w.id)}let k=0;for(let w of _.members){if(w.body===void 0)continue;let N=(R,v)=>{if(v&&g.isCallExpression(R)&&g.isPropertyAccessExpression(R.expression)&&R.expression.expression.kind===g.SyntaxKind.ThisKeyword){let B=S.get(R.expression.name.text);if(B!==void 0){let O=`${f}#depclass:${p.container}.${w.name}#c${String(k)}`;k+=1,r.callSites.push({id:O,enclosingFunctionId:w.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:_t(f,R,y)}),r.callEdges.push({callSiteId:O,calleeFunctionId:B,resolution:"field-based"})}}let I=g.isFunctionExpression(R)||g.isFunctionDeclaration(R)||g.isMethodDeclaration(R)||g.isConstructorDeclaration(R)||g.isGetAccessorDeclaration(R)||g.isSetAccessorDeclaration(R)||g.isClassLike(R),A=g.isArrowFunction(R)?v:I?!1:v;g.forEachChild(R,B=>{N(B,A)})};N(w.body,!0)}for(let w of s){let N=b.get(w.calleeFunctionId);N!==void 0&&r.callEdges.push({callSiteId:w.callSiteId,calleeFunctionId:N,resolution:"field-based"})}if(r.functions.push(..._.functions),r.classes.push(_.classNode),!a.has(f)){a.add(f),r.modules.push({id:f,packageName:p.packageName,versionRange:"",path:f,moduleSystem:"cjs",isEntrypoint:!1});let w=o.moduleFor(p.packageName),N=`${String(w)}#depclass${String(c)}`;c+=1,r.imports.push({id:N,moduleId:w,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),r.importEdges.push({importId:N,resolvedModuleId:f})}r.diagnostics.push({code:"dep-class-corridor",path:f,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(_.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return r}function HS(e,n,t,s){let o=new Set(e.modules.filter(l=>l.isEntrypoint).map(l=>l.packageName)),r=new Map(e.functions.map(l=>[l.id,l.moduleId])),i=new Map;for(let l of e.callSites){if(l.resolution!=="unresolved")continue;let d=r.get(l.enclosingFunctionId);d!==void 0&&i.set(d,(i.get(d)??0)+1)}let a=[];for(let l of e.modules){if(l.externalSurface===!0)continue;let d=n.get(l.path);if(d===void 0||t.has(l.path)||o.has(l.packageName)&&s.has(l.path)&&!l.path.split("/").includes("node_modules"))continue;let c=i.get(l.id)??0;if(c===0&&NS(d))continue;let p=c>0?`${String(c)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:l.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:l.id})}return a}function hf(e,n,t=[],s={},o=!1){let r=new $a,i=tS(e,n,r),a=new Set;for(let k of i.computedLoads.values())for(let w of k)if(w.seedable)for(let N of w.candidateRels)a.add(N);let l=new Map;for(let k of e.sourceFiles){let w=e.toRel(k.fileName);if(w===null||!a.has(w)||w.split("/").includes("node_modules"))continue;let N=$S(w,k);N.length>0&&l.set(w,N)}let d=l.size===0?i.modules:i.modules.map(k=>l.has(k.path)&&!k.isEntrypoint?{...k,isEntrypoint:!0}:k),c={...i,modules:d},p=BS(e,c,r,l,s),u=ES(e,i,p.functions,p.mintSeedAliases),f=new Set(i.modules.map(k=>k.path)),m=rS(e.depReach,r,f),h=[...c.modules,...m.modules,...r.modules()],y=WS(e,t,h,p.callEdges,r),_=[];if(o){let k="#default",w=new Set;for(let R of p.callEdges){let v=String(R.calleeFunctionId);!v.startsWith("pkg:")||!v.endsWith(k)||w.add(v.slice(4,v.length-k.length))}let N=new Map;for(let R of e.depReach.edges){if(!("surface"in R.from)||"surface"in R.to)continue;let v=R.from.surface;N.set(v,N.has(v)?null:R.to.module)}for(let R of w){let v=N.get(R);if(v==null)continue;let I=sS(On.join(e.appRoot,v));if(I===null||I==="default")continue;let A=r.exportFor(R,I),B=`pkg:${R}${k}`;for(let O of p.callEdges)String(O.calleeFunctionId)===B&&_.push({callSiteId:O.callSiteId,calleeFunctionId:A,resolution:"field-based"})}}let S={modules:[...c.modules,...m.modules,...y.modules,...r.modules()],exports:[...p.exports,...u.exports],imports:[...i.imports,...m.imports,...y.imports],functions:[...p.functions,...r.functions(),...y.functions],callSites:[...p.callSites,...y.callSites],classes:[...p.classes,...r.classes(),...y.classes],callEdges:[...p.callEdges,...y.callEdges,..._],importEdges:[...i.importEdges,...m.importEdges,...y.importEdges],exportBindings:[...p.exportBindings,...u.exportBindings],inheritEdges:[]},b=new Map;for(let k of e.sourceFiles){let w=e.toRel(k.fileName);w!==null&&b.set(w,k)}return{graph:S,diagnostics:[...u.diagnostics,...y.diagnostics,...HS(S,b,new Set(e.diagnostics.filter(k=>k.code==="dependency-body").map(k=>k.path)),i.appOwnedPaths)],loadSites:i.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var qS=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,jr=/^[A-Za-z0-9_$.-]{1,128}$/u;function VS(e){return qS.test(e.calleePackage)?jr.test(e.anchorExport)?jr.test(e.calleeExport)?e.anchorContainer!==null&&!jr.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!jr.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Ro(e,n){let t=[],s=[],o=new Map(e.modules.map(d=>[d.id,d])),r=new Map(e.classes.map(d=>[d.id,d.name])),i=(d,c,p)=>e.functions.some(u=>{if(u.name!==c)return!1;let f=o.get(u.moduleId);return f===void 0||f.packageName!==d?!1:(u.enclosingClassId!==void 0?r.get(u.enclosingClassId)??null:null)===p}),a=(d,c,p)=>{for(let u of e.functions){if(u.name!==c)continue;let f=o.get(u.moduleId);if(!(f===void 0||f.packageName!==d||(u.enclosingClassId!==void 0?r.get(u.enclosingClassId)??null:null)!==p))return u.id}return null},l=[...n].sort((d,c)=>d.modelId<c.modelId?-1:d.modelId>c.modelId?1:0);for(let d of l){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let c=d.edges.map(VS).find(f=>f!==null);if(c!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${c} \u2014 model refused WHOLE`);continue}let p=0,u=0;for(let f of d.edges){if(!i(d.packageName,f.anchorExport,f.anchorContainer)){u+=1;continue}s.push({modelId:d.modelId,kind:f.kind,anchor:{packageName:d.packageName,exportName:f.anchorExport,container:f.anchorContainer},callee:{packageName:f.calleePackage,exportName:f.calleeExport,container:f.calleeContainer,realFunctionId:a(f.calleePackage,f.calleeExport,f.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${d.modelId}: ${String(p)} edge(s) lowered, ${String(u)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(u)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:s,notes:t}}}var XS={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Ha(e){try{let n=yu(e.appRoot,e.entrypoints,e.tsconfigPaths===!0,new Set((e.executedEntrypoints??[]).map(a=>a.split(Pn.sep).join("/")))),t=new Set(e.entrypoints.map(a=>a.split(Pn.sep).join("/"))),{graph:s,diagnostics:o,loadSites:r,bindingApplicability:i}=hf(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:s,diagnostics:[...n.diagnostics,...o],loadSites:r,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...i!==void 0?{bindingApplicability:i}:{}}}catch(n){return{graph:XS,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function gf(e,n){let t=512,s=(o,r,i)=>{if(!(t<=0||r>12)){if(t-=1,typeof o=="string"){n(o,i);return}if(Array.isArray(o)){for(let a of o)s(a,r+1,i);return}if(o!==null&&typeof o=="object")for(let[a,l]of Object.entries(o))a==="types"||a==="typings"||s(l,r+1,i||a.includes("*"))}};s(e,0,!1)}function bf(e,n,t,s=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let o;try{o=Tt(Pn.resolve(e,t))}catch{return null}return o!==e&&!o.startsWith(n)||s&&!yt(o)?null:o===e?"":o.slice(n.length).split(Pn.sep).join("/")}var YS=1024*1024,JS=4096;function yf(e,n){let t=e.toLowerCase(),s=0;for(;;){let o=t.indexOf(n,s);if(o===-1)return null;let r=o===0?" ":t[o-1],i=o+n.length;for(;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
-`||e[i]==="\r");)i+=1;if(/[a-z0-9_:-]/i.test(r??" ")||e[i]!=="="){s=o+n.length;continue}for(i+=1;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
-`||e[i]==="\r");)i+=1;let a=e[i];if(a==='"'||a==="'"){let d=e.indexOf(a,i+1);return d===-1?null:e.slice(i+1,d)}let l=i;for(;l<e.length&&!/[\s>]/.test(e[l]??"");)l+=1;return e.slice(i,l)}}function ZS(e){let n=[],t=e.toLowerCase(),s=0;for(;;){let o=t.indexOf("<script",s);if(o===-1)break;let r=t[o+7];if(r!==void 0&&/[a-z0-9-]/.test(r)){s=o+7;continue}let i=e.indexOf(">",o);if(i===-1)break;s=i+1;let a=e.slice(o+7,i);if(a.length>JS)continue;let l=yf(a,"type");n.push({module:(l??"").trim().toLowerCase()==="module",src:yf(a,"src")})}return n}function QS(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function ex(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function nx(e){let n=Tt(e),t=n.endsWith(Pn.sep)?n:n+Pn.sep,s=new Set,o=[],r=[],i=[],a=[],l=[],d=!1,c=(E,D,L=!1,K)=>{let Y=bf(n,t,E);return Y===null||Y.length===0?"unresolved":s.has(Y)?"duplicate":(s.add(Y),o.push(Y),r.push({source:D,specifier:jn(K??(typeof E=="string"?E:"")),entrypoint:Y,launch:L}),"added")},p=new Set,u=(E,D,L=!1)=>{let K=c(E,D),Y=typeof E=="string"&&E.includes("\\")?c(E.split("\\").join("/"),D,!1,E):"unresolved";if(K!=="unresolved"||Y!=="unresolved"||typeof E!="string"||E.trim().length===0||E.endsWith(".d.ts")||E.endsWith(".d.mts")||E.endsWith(".d.cts"))return;if(L&&E.includes("*")){let z=bu(n,E),Z=!1;if(z!==null){for(let de of z.matches)c(de,D,!1,E)!=="unresolved"&&(Z=!0);if(!z.truncated&&Z)return}a.push({source:D,file:"package.json",detail:`\`${jn(E)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let le=`${D}\0${E}`;p.has(le)||(p.add(le),a.push({source:D,file:"package.json",detail:`\`${jn(E)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},f=[],m=(E,D)=>{i.push({source:E,file:E,detail:D.detail}),f.push({code:D.code,path:E,detail:`${E} ${D.detail}`})},h,y,_,S=null,b=Br(n,t,"package.json",Yt);b.kind==="refused"&&m("package.json",b);try{let E=b.kind==="ok"?JSON.parse(b.text):{};if(S=b.kind==="ok"?E:null,u(E.main,"main"),typeof E.bin=="string")u(E.bin,"bin");else if(E.bin!==null&&typeof E.bin=="object")for(let L of Object.values(E.bin))u(L,"bin");gf(E.exports,(L,K)=>{u(L,"exports",K)}),typeof E.browser=="string"?u(E.browser,"browser"):gf(E.browser,L=>{c(L,"browser")});let D=E.scripts;if(D!==null&&typeof D=="object"){let L=D;h=L.start,y=L.prestart,_=L.poststart}}catch{}if(o.length===0)try{Tt(Pn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let k=(E,D)=>{if(typeof E=="string"&&E.trim().length>0){let L=Ua(E,D,"package.json",c,i,!1)==="used";return L&&(d=!0),L?"resolved":"gapped"}return E===void 0||typeof E=="string"?"absent":(i.push({source:D,file:"package.json",detail:`${D} is not a string; no entry file could be read from it`}),"gapped")},w=k(h,"scripts.start"),N=k(y,"scripts.prestart"),R=k(_,"scripts.poststart"),v=w==="resolved"&&N!=="gapped"&&R!=="gapped",I=Br(n,t,"Procfile",65536);if(I.kind==="refused")m("Procfile",I);else if(I.kind==="ok"){let{entries:E,truncated:D,unnamedLines:L}=Na(I.text);D&&i.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),L>0&&i.push({source:"Procfile",file:"Procfile",detail:`${String(L)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let K of E)Ua(K.command,`Procfile:${K.name}`,"Procfile",c,i,v)==="used"&&(d=!0)}for(let E of["Dockerfile","docker-compose.yml","docker-compose.yaml","compose.yml"]){let D=Br(n,t,E,Ea);if(D.kind==="refused"){m(E,D);continue}if(D.kind!=="ok")continue;let{commands:L,truncated:K}=Aa(D.text);K&&i.push({source:E,file:E,detail:`${E} declares more launch commands than cupel parses; the remainder was not read`});for(let Y of L)Ua(Y.command,`${E}:${Y.label}`,E,c,i,v)==="used"&&(d=!0)}let A=o.length===0,B=Br(n,t,"index.html",YS);if(B.kind==="ok")for(let E of ZS(B.text)){if(E.src===null)continue;let D=jn(E.src);if(!E.module){l.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${D}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(QS(E.src)){l.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${D}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}c(ex(E.src),"index.html",!1,E.src)==="unresolved"&&i.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${D}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else B.kind==="refused"&&l.push({kind:B.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${B.detail}`,root:""});let O=A?Sa(n,S):null;if(O!==null){let E=0;for(let D of ka(n,O).roots)c(D,`framework:${O.name}`)==="added"&&(E+=1);E>0&&f.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${O.name}'s directory conventions (recognised via ${O.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let V=E=>E.map(D=>({...D,root:""}));return{entrypoints:o,sources:V(r),gaps:V(i),surfaceGaps:V(a),launchResolved:d,diagnostics:f,framework:O,observations:l}}function Br(e,n,t,s){let o;try{o=Tt(Pn.join(e,t))}catch{return{kind:"absent"}}if(!o.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let r=$s(o,s);return r.kind==="ok"?r:r.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(r.bytes)} bytes, over the ${String(s)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Ua(e,n,t,s,o,r){let i=va(e);if(i.kind==="delegates")return r?"used":(o.push({source:n,file:t,detail:`\`${jn(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(i.kind==="foreign")return"foreign";if(i.kind==="unparsed")return o.push({source:n,file:t,detail:`\`${jn(e)}\`: ${i.reason}`}),"gapped";let a=s(i.specifier,n,!0),l=i.alt===void 0?"unresolved":s(i.alt,n,!0);return a==="unresolved"&&l==="unresolved"?(o.push({source:n,file:t,detail:`\`${jn(i.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function Gs(e,n){return e===""?n:`${e}/${n}`}function Sf(e,n){let t=Tt(e),s=t.endsWith(Pn.sep)?t:t+Pn.sep,o=new Set,r=[],i=[],a=[],l=[],d=[],c=[],p=!1,u=null,f=[...n].sort((m,h)=>m.rel===""?-1:h.rel===""?1:m.rel<h.rel?-1:m.rel>h.rel?1:0);for(let m of f){let h=Gs(m.rel,"package.json"),y=m.rel===""?".":m.rel,_;try{_=Tt(m.abs)}catch{a.push({source:"root",file:h,detail:`root \`${y}\` could not be resolved; not seeded`,root:m.rel});continue}if(_!==t&&!_.startsWith(s)){a.push({source:"root",file:h,detail:`root \`${y}\` resolves outside the scan root; refused, not seeded`,root:m.rel});continue}let S;try{S=nx(_)}catch{a.push({source:"root",file:h,detail:`root \`${y}\` could not be read; not seeded`,root:m.rel});continue}for(let b of S.sources){let k=Gs(m.rel,b.entrypoint),w,N;try{w=Tt(Pn.resolve(t,k)),N=Tt(Pn.resolve(_,b.entrypoint))}catch{a.push({source:b.source,file:h,detail:`\`${b.specifier}\` re-based to \`${k}\` did not resolve; not seeded`,root:m.rel});continue}if(!w.startsWith(s)||w!==N){a.push({source:b.source,file:h,detail:`\`${b.specifier}\` re-based to \`${k}\` escapes the scan root or names another file; refused, not seeded`,root:m.rel});continue}o.has(k)||(o.add(k),r.push(k),i.push({...b,entrypoint:k,root:m.rel}))}S.launchResolved&&(p=!0);for(let b of S.gaps)a.push({...b,file:Gs(m.rel,b.file),root:m.rel});for(let b of S.surfaceGaps)l.push({...b,file:Gs(m.rel,b.file),root:m.rel});for(let b of S.diagnostics)d.push({...b,path:Gs(m.rel,b.path)});for(let b of S.observations)c.push({...b,file:Gs(m.rel,b.file),root:m.rel});m.rel===""&&(u=S.framework)}return{entrypoints:r,sources:i,gaps:a,surfaceGaps:l,launchResolved:p,diagnostics:d,framework:u,observations:c}}function qa(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let s=n.slice(0,3).map(o=>o.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${s}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Va(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let s=[...new Set(t.slice(0,3).map(o=>o.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${s}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function xf(e,n){let t=Tt(e),s=t.endsWith(Pn.sep)?t:t+Pn.sep,o=new Set,r=[],i=[];for(let a of n){let l=bf(t,s,a,!0);if(l===null||l.length===0){i.push(a);continue}o.has(l)||(o.add(l),r.push(l))}return{entrypoints:r,rejected:i}}import{readdirSync as ip,readFileSync as ml,realpathSync as hl,statSync as zo}from"node:fs";import it from"node:path";function tx(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let s=t+2;for(;s<e.length&&e.charCodeAt(s)===32;)s+=1;let o=e.charCodeAt(s);return o===38||o===42}function tt(e,n,t){let s=n.maxLines??2e6,o=n.maxLineBytes??16384,r=!1,i=!1,a=0,l=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let c=e.indexOf(`
-`,d),p=c===-1;p&&(c=e.length);let u=c>d&&e.charCodeAt(c-1)===13?c-1:c;if(l+=1,l>s){r=!0;break}if(u-d>o)a+=1;else{let f=d;for(;f<u&&e.charCodeAt(f)===32;)f+=1;let m=f-d,h=u;for(;h>f&&(e.charCodeAt(h-1)===32||e.charCodeAt(h-1)===9);)h-=1;if(f<h&&e.charCodeAt(f)!==35){let y=e.slice(f,h);if(tx(y)){i=!0;break}t(m,y)}}if(p)break;d=c+1}return{truncated:r||a>0,refusedAnchors:i,oversizeLines:a}}function St(e){let n=e.charCodeAt(0);if(n===34||n===39){let s=e.indexOf(String.fromCharCode(n),1);if(s===-1)return null;let o=s+1;for(;o<e.length&&e.charCodeAt(o)===32;)o+=1;return e.charCodeAt(o)===58?e.slice(0,s+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function Vn(e){return e.endsWith(":")}function $e(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function Gr(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,s=t.indexOf("/");if(n){if(s<=0||t.indexOf("/",s+1)!==-1)return!1}else if(s!==-1)return!1;let o=n?[t.slice(0,s),t.slice(s+1)]:[t];for(let r of o){if(r.length===0||r.charCodeAt(0)===46||r.charCodeAt(0)===95)return!1;for(let i=0;i<r.length;i+=1){let a=r.charCodeAt(i);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function Oo(e){return Gr(e)?`node_modules/${e}`:""}function Po(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Kr=2e5,kf=64,zr=1024,sx=5,ox=[1,2,3];function rx(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let s=e.slice(t+n.length);if(s==="")return null;let o=s.split("/");return o[0]?.startsWith("@")?o.length>=2?`${o[0]}/${o[1]}`:null:o[0]??null}function wf(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let s=t.indexOf("@",1);if(s>0){let o=t.slice(0,s),r=t.slice(s+1);if(o.length>0&&r.length>0)return[{name:o,version:r}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function st(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function vf(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Ef(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Af(e,n,t,s,o=!1){let r=JSON.stringify([n,t,s]);if(!e.seen.has(r)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(r),e.deps.push({name:n,version:t,lockKey:s,dev:o})}}function ix(e,n){for(let[t,s]of Object.entries(e)){if(t==="")continue;if(!Ef(n))return;let o=t.startsWith("node_modules/")||t.includes("/node_modules/"),r=st(s);if(r===null){n.unread+=1;continue}if(r.link===!0)continue;let i=r.name,a=typeof i=="string"&&i!==""?i:rx(t),l=r.version;if(a===null||typeof l!="string"){o&&(n.unread+=1);continue}let d=r.dev===!0||r.devOptional===!0;for(let c of wf(a,l))Af(n,c.name,c.version,t,d)}}function Nf(e,n,t){let s=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],o=!1;for(let r=0;r<s.length;r+=1){let i=s[r];if(i===void 0)break;for(let[a,l]of Object.entries(i.deps)){if(!Ef(n))return{depthCapped:o};if(a===""){n.unread+=1;continue}let d=st(l);if(d===null){n.unread+=1;continue}let c=i.pathSafe&&Gr(a),p=c?`${i.prefix}node_modules/${a}`:"",u=c&&p.length<=zr,f=u?p:"",m=d.version,h=d.dev===!0||i.dev;if(d.link!==!0&&typeof m=="string"&&m!=="")for(let _ of wf(a,m))Af(n,_.name,_.version,f,h);else n.unread+=1;let y=st(d.dependencies);if(y!==null){if(i.depth+1>t){o=!0;continue}s.push({deps:y,prefix:u?`${f}/`:i.prefix,depth:i.depth+1,pathSafe:u,dev:h})}}}return{depthCapped:o}}function ax(e,n,t){let s=vf(n.maxEntries),{depthCapped:o}=Nf(e,s,t),r=[],i=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),a=new Set,l=[];for(let d of s.deps){if(d.version.includes(":"))continue;let c=JSON.stringify([d.name,d.version]);i.has(c)||a.has(c)||(a.add(c),l.length<sx&&l.push(Po(d.name,d.version)))}if(a.size>0){let d=a.size-l.length;r.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${l.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(s.capped||o)&&r.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),r}function Ur(e,n={}){let t=[],s;try{s=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let o=st(s);if(o===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let r=o.lockfileVersion,i=typeof r=="number"&&Number.isInteger(r)?r:null,a=typeof r=="number"?String(r):"?",l=st(o.packages),d=st(o.dependencies);if(l===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(i===null||!ox.includes(i))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let c=n.maxDepth??kf,p=vf(n.maxEntries??Kr),u=!1;return l!==null?(ix(l,p),d!==null&&t.push(...ax(d,p,c))):d!==null&&(u=Nf(d,p,c).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),u&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(c)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||u}}var lx=["workspace:","link:","portal:","file:","exec:"];function dx(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Xa(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let s=n.slice(0,t),o=n.slice(t+1);if(s.length===0)return[];for(let a of lx)if(o.startsWith(a))return[];if(!o.startsWith("npm:"))return[s];let r=o.slice(4),i=r.indexOf("@",1);if(i>0){let a=r.slice(0,i);return a.length>0?[a]:[s]}return r.length===0||dx(r)?[s]:[s,r]}function cx(e){if(Vn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let s=e.charCodeAt(t);if(s===34||s===39){n===0?n=s:n===s&&(n=0);continue}if(n===0&&s===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function ux(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let s of n.split(",")){let o=s.trim();o.length>0&&t.push(o)}return t}function fx(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let s=t.length;for(;s<n.length&&s<t.length+3;){let r=n.charCodeAt(s);if(r<48||r>57)break;s+=1}let o=n.slice(t.length,s);return o.length>0?o:null}function If(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=$e(e.slice(8).trim());return t.length>0?t:null}function Ya(e,n={}){let t=[],s=[],o=new Set,r=n.maxEntries??2e5,i=!1,a=null,l=!1,d=[],c=!1,p=-1,u=!1,f=0,m=()=>{d.length>0&&!c&&(f+=1)},h=tt(e,n,(b,k)=>{if(b===0){m(),d=[],c=!1,p=-1,l=!1;let N=cx(k);if(N===null)return;let R=$e(N.trim());if(R==="__metadata"){i=!0,l=Vn(k);return}for(let v of ux(R))d.push(...Xa(v));return}if(l){if(b===2&&a===null){let N=If(k);N!==null&&(a=N)}return}if(d.length===0||(p===-1&&(p=b),b!==p||c))return;let w=If(k);if(w!==null){c=!0;for(let N of d){let R=JSON.stringify([N,w]);if(!o.has(R)){if(s.length>=r){u=!0;return}o.add(R),s.push({name:N,version:w,lockKey:Oo(N),dev:!1})}}}});m();let y=i?"yarn.lock (Berry)":"yarn.lock (v1)";if(h.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};h.oversizeLines>0&&t.push(`${y} has ${String(h.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),u&&t.push(`${y} exceeds ${String(r)} entries; truncated`);let _=a??fx(e),S=_===null?null:Number(_.split(".")[0]);return _!==null&&(S===null||!Number.isInteger(S)||S<1||S>8)&&t.push(`${y} declares unsupported lockfileVersion ${_} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),f>0&&t.push(`${y} has ${String(f)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:s,diagnostics:t,truncated:h.truncated||u}}function Ja(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.indexOf("_");return s!==-1&&(n=n.slice(0,s)),n.trim()}function Za(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Hr(e){let n=$e(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.charCodeAt(0)===47;if(s&&(n=n.slice(1)),n.length===0)return null;if(!s&&n.charCodeAt(0)!==64){let c=n.indexOf("/"),p=n.indexOf("@",1);c>0&&(p===-1||c<p)&&n.slice(0,c).includes(".")&&n.indexOf("/",c+1)!==-1&&(n=n.slice(c+1))}let o=n.charCodeAt(0)===64,r=o?n.indexOf("/"):-1;if(o&&r<=0)return null;let i=o?r+1:0,a=-1;for(let c=i;c<n.length;c+=1){let p=n.charCodeAt(c);if(p===47||p===64){a=c;break}}if(a<=i)return null;let l=n.slice(0,a),d=Ja(n.slice(a+1));return Za(d)?{name:l,version:d}:null}var px=new Set(["packages","snapshots","importers"]),mx=new Set([5,6,7,8,9]);function hx(e){let n=$e(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function Wr(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:$e(e.slice(0,n).trim()),value:$e(t)}}function Qa(e,n={}){let t=[],s=[],o=new Set,r=n.maxEntries??2e5,i="",a=null,l=!1,d=0,c=[],p=(f,m)=>{let h=JSON.stringify([f,m]);if(!o.has(h)){if(s.length>=r){l=!0;return}o.add(h),s.push({name:f,version:m,lockKey:Oo(f),dev:!1})}},u=tt(e,n,(f,m)=>{if(f===0){let h=St(m);if(i=h===null?"":$e(h.trim()),a=null,i==="lockfileVersion"){let y=Wr(m),_=y===null?null:hx(y.value);y!==null&&(_===null||!mx.has(_))&&c.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),i="";return}if(px.has(i)&&!Vn(m)){let y=Wr(m)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(d+=1),i=""}return}if(i==="packages"||i==="snapshots"){if(f!==2)return;let h=St(m),y=h===null?null:Hr(h);if(y===null){d+=1;return}p(y.name,y.version);return}if(i==="importers"){if(f===6){let h=Wr(m);if(h===null){a=m.endsWith(":")?$e(m.slice(0,-1).trim()):null;return}a=null;let y=Ja(h.value);Za(y)&&p(h.key,y);return}if(f===8&&a!==null){let h=Wr(m);if(h===null||h.key!=="version")return;let y=Ja(h.value);Za(y)&&p(a,y)}}});return u.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...c),u.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(u.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),l&&t.push(`pnpm-lock.yaml exceeds ${String(r)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:s,diagnostics:t,truncated:u.truncated||l})}function xt(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var Pf=1e6,Rf=2e5,gx=4096,yx=65536,_x=262144,Co=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Cf(e){let n=[];for(let t of e.split(/\r?\n/u)){if(t==="")break;let s=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(t);s!==null&&n.push([(s[1]??"").toLowerCase(),s[2]??""])}return n}function Mf(e){if(e.length>Pf)return null;let n,t;for(let[s,o]of Cf(e))s==="name"&&n===void 0?n=o.trim():s==="version"&&t===void 0&&(t=o.trim());return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}var bx=/^([A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)/u;function Tf(e){if(e.length>Pf)return[];let n=new Set;for(let[t,s]of Cf(e)){if(t!=="requires-dist")continue;let o=bx.exec(s.trim())?.[1];o!==void 0&&n.add(xt(o))}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function $f(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&Co.test(n))}function Lf(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let s=e[t];if(s==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=s}return n}function Df(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Ff(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function jf(e){let n=e.split(/\r?\n/u);return n.length>Rf?n.slice(0,Rf):n}function Bf(e){let n=new Set;for(let t of jf(e)){if(t==="")continue;let s=Lf(t).split("/"),o=s[0]??"";if(Df(o))continue;if(s.length>1){Co.test(o)&&n.add(o);continue}let r=Ff(o);r!==null&&Co.test(r)&&n.add(r)}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function Sx(e){let n=e.split("/"),t=n[0]??"";if(Df(t))return null;let s=n[n.length-1]??"",o=Ff(s);if(o===null)return null;let r=n.slice(0,-1);if(r.some(a=>!Co.test(a)||a==="__pycache__"))return null;let i=o==="__init__"?r:[...r,o];return i.length===0||!Co.test(o==="__init__"?r[r.length-1]??"":o)?null:i}function Gf(e,n=gx){let t=new Set,s=0,o=0,r=!1;for(let i of jf(e)){if(i==="")continue;let a=Lf(i),l=Sx(a);if(l!==null){s+=1,(a.endsWith(".so")||a.endsWith(".pyd"))&&(o+=1);for(let d=1;d<=Math.min(2,l.length);d+=1){let c=l.slice(0,d).join(".");if(!t.has(c)){if(t.size>=n){r=!0;break}t.add(c)}}}}return{prefixes:[...t].sort((i,a)=>i<a?-1:i>a?1:0),moduleFiles:s,extensionModules:o,capped:r}}function xx(e){if(e.length>_x)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let s=t.trim();if(!(s===""||s.startsWith("#")||s.startsWith(";"))){if(s.startsWith("[")){let o=s.slice(1,s.endsWith("]")?-1:void 0).trim();n=o==="console_scripts"||o==="gui_scripts";continue}if(n&&s.includes("="))return!0}}return!1}function Kf(e){if(e.length>yx)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,s=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:s?.editable===!0}}function Mo(e,n){let t=Mf(e);if(t===null)return null;let s=n.topLevelText!==void 0?$f(n.topLevelText):[],o=s.length>0?s:n.recordText!==void 0?Bf(n.recordText):[],r=n.recordText!==void 0?Gf(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},i=n.entryPointsText!==void 0?xx(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",a=n.directUrlText!==void 0?Kf(n.directUrlText)?.editable??!1:!1;return{name:xt(t.name),version:t.version,importNames:o,modulePrefixes:r.prefixes,moduleFiles:r.moduleFiles,editable:a,consoleScripts:i,extensionModules:r.extensionModules,recordKnown:n.recordText!==void 0,requiresDist:Tf(e)}}function Of(e,n,t){let s=e.get(n);s===void 0?e.set(n,[t]):s.includes(t)||s.push(t)}function qr(e){let n=new Map,t=new Map,s=[];for(let o of e){if(o.importNames.length===0){s.push(o);continue}for(let r of o.importNames)Of(n,r,o);for(let r of o.modulePrefixes)Of(t,r,o)}return{byImportName:n,byModulePrefix:t,unmapped:s}}function To(e,n){let t=n.split(".").filter(o=>o.length>0),s=t[0];if(s===void 0)return[];for(let o=Math.min(2,t.length);o>=1;o-=1){let r=e.byModulePrefix.get(t.slice(0,o).join("."));if(r!==void 0&&r.length>0)return r}return e.byImportName.get(s)??[]}var $o=class{nodes=new Map;children=new Map;importers=new Map;over=!1;node(n,t,s){if(!this.nodes.has(n)){if(this.nodes.size>=2e5){this.over=!0;return}this.nodes.set(n,{name:t,version:s})}}edge(n,t){let s=this.children.get(n);s===void 0?this.children.set(n,[t]):s.includes(t)||s.push(t)}done(){return this.over||this.importers.size===0?null:{nodes:this.nodes,children:this.children,importers:this.importers}}},es="importer:",_s="node_modules/";function nl(e){let n;try{n=JSON.parse(e)}catch{return null}let t=st(st(n)?.packages);if(t===null)return null;let s=new $o,o=new Map;for(let[d,c]of Object.entries(t)){let p=st(c);p!==null&&o.set(d,p)}let r=d=>d.startsWith(_s)||d.includes(`/${_s}`),i=d=>{let c=d;for(let p=0;p<8;p+=1){let u=o.get(c);if(u===void 0)return null;if(u.link!==!0)return c;let f=u.resolved;if(typeof f!="string")return null;c=f}return null},a=d=>r(d)?d:`${es}${d}`,l=(d,c)=>{let p=d;for(;;){let u=p===""?`${_s}${c}`:`${p}/${_s}${c}`;if(o.has(u))return i(u);if(p==="")return null;let f=p.lastIndexOf(`/${_s}`);p=f===-1?"":p.slice(0,f)}};for(let[d,c]of o){if(c.link===!0)continue;let p=r(d);if(p){let f=typeof c.name=="string"&&c.name!==""?c.name:d.slice(d.lastIndexOf(_s)+_s.length),m=c.version;if(typeof m!="string")continue;s.node(d,f,m)}else s.importers.set(`${es}${d}`,d===""?"package.json":`${d}/package.json`);let u=p?["dependencies","optionalDependencies","peerDependencies"]:["dependencies","devDependencies","optionalDependencies","peerDependencies"];for(let f of u){let m=st(c[f]);if(m!==null)for(let h of Object.keys(m)){let y=l(d,h);y!==null&&y!==d&&s.edge(a(d),a(y))}}}return s.done()}function Vr(e){let n=St(e);if(n===null)return null;let t=e.slice(n.length+1).trim();return t.length===0?null:{key:$e(n.trim()),value:$e(t)}}var el=new Set(["dependencies","optionalDependencies","devDependencies"]);function tl(e,n={}){let t=new $o,s=[],o="",r=!1,i=null,a="",l=null,d=u=>u==="."||u===""?"package.json":`${u}/package.json`,c=(u,f,m,h)=>{if(m===f){let y=Vr(h);l=y===null&&Vn(h)?$e(h.slice(0,-1).trim()):null,y!==null&&s.push({from:u,name:y.key,token:y.value});return}if(m===f+2&&l!==null){let y=Vr(h);y?.key==="version"&&s.push({from:u,name:l,token:y.value})}},p=tt(e,n,(u,f)=>{if(u===0){let m=St(f);o=m===null?"":$e(m.trim()),o==="lockfileVersion"&&(r=(Vr(f)?.value??"").startsWith("5")),i=null,el.has(o)&&Vn(f)&&(i=`${es}.`,t.importers.set(i,"package.json"),a=o,l=null);return}if(el.has(o)){i!==null&&c(i,2,u,f);return}if(o==="importers"){if(u===2){let m=St(f),h=m===null?".":$e(m.trim());i=`${es}${h}`,t.importers.set(i,d(h)),a="";return}if(i===null)return;if(u===4){a=Vn(f)?$e(f.slice(0,-1).trim()):"",l=null;return}el.has(a)&&c(i,6,u,f);return}if(!(o!=="packages"&&o!=="snapshots")){if(u===2){let m=St(f);if(m===null){i=null;return}let h=$e(m.trim()),y=h.startsWith("/")?h.slice(1):h,_=Hr(h);i=_===null?null:y,_!==null&&t.node(y,_.name,_.version),a="";return}if(i!==null){if(u===4){a=Vn(f)?$e(f.slice(0,-1).trim()):"";return}if(u===6&&(a==="dependencies"||a==="optionalDependencies")){let m=Vr(f);m!==null&&s.push({from:i,name:m.key,token:m.value})}}}});if(p.refusedAnchors||p.truncated)return null;for(let u of s){if(u.token.startsWith("link:"))continue;let m=(u.token.startsWith("/")?u.token.slice(1):null)??(r?`${u.name}/${u.token}`:`${u.name}@${u.token}`);t.nodes.has(m)&&t.edge(u.from,m)}return t.done()}function kx(e,n){let t=e.indexOf("@npm:",1);return t<=0?null:e.slice(t+5)===n?e.slice(0,t):null}function sl(e,n,t={}){let s=new $o,o=new Map,r=[],i=null,a=-1,l=!1,d=-1,c=[],p=null,u=null,f=0,m=tt(e,t,(h,y)=>{if(h===0){l=!1,a=-1,p=null,u=null;let k=Vn(y)?y.slice(0,-1):null;if(i=null,c=[],k===null)return;let w=$e(k.trim());if(w==="__metadata"||(c=w.split(",").map(R=>$e(R.trim())).filter(R=>R.length>0),c.length===0))return;f+=1,i=`y${String(f)}`;for(let R of c)o.set(R,i);let N=c.find(R=>R.includes("@workspace:"));if(N!==void 0){let R=N.slice(N.indexOf("@workspace:")+11),v=`${es}${R}`;s.importers.set(v,R==="."||R===""?"package.json":`${R}/package.json`),i=v;for(let I of c)o.set(I,v)}return}if(i===null)return;if(a===-1&&(a=h),h===a){if(l=!1,y==="dependencies:"||y==="optionalDependencies:"){l=!0,d=-1;return}if(y.startsWith("version ")||y.startsWith("version:"))p=$e(y.slice(8).trim());else if(y.startsWith("resolution:"))u=$e(y.slice(11).trim());else return;let k=c[0];if(p!==null&&k!==void 0&&!i.startsWith(es)){let w=Xa(k);if(w.length===1&&w[0]!==void 0)s.node(i,w[0],p);else if(u!==null){let N=kx(u,p);N!==null&&s.node(i,N,p)}}return}if(!l||h<=a||(d===-1&&(d=h),h!==d))return;let _=St(y),S,b;if(_!==null&&y.charCodeAt(_.length)===58)S=$e(_.trim()),b=$e(y.slice(_.length+1).trim());else{let k=y.indexOf(" ");if(k<=0)return;S=$e(y.slice(0,k)),b=$e(y.slice(k+1).trim())}S.length>0&&b.length>0&&r.push({from:i,descriptor:`${S}@${b}`})});if(m.refusedAnchors||m.truncated)return null;if(s.importers.size===0){s.importers.set(`${es}.`,"package.json");for(let[h,y]of n)r.push({from:`${es}.`,descriptor:`${h}@${y}`})}for(let h of r){let y=h.descriptor.indexOf("@",1),_=h.descriptor.slice(y+1),S=_.includes(":")?h.descriptor:`${h.descriptor.slice(0,y)}@npm:${_}`,b=o.get(h.descriptor)??o.get(S);b!==void 0&&b!==h.from&&s.edge(h.from,b)}return s.done()}function ol(e,n,t,s){let o=new Map;for(let[k,w]of e.children)for(let N of w){let R=o.get(N);R===void 0?o.set(N,[k]):R.push(k)}let r=new Set,i=[...e.importers.keys()];for(let k=0;k<i.length;k+=1)for(let w of e.children.get(i[k])??[])r.has(w)||e.importers.has(w)||(r.add(w),i.push(w));let a=[...e.nodes].filter(([k,w])=>w.name===n&&w.version===t&&r.has(k)).map(([k])=>k).sort();if(a.length===0)return null;let l=new Map(a.map(k=>[k,0])),d=[...a];for(let k=0;k<d.length;k+=1){let w=d[k];for(let N of o.get(w)??[])l.has(N)||!r.has(N)||(l.set(N,(l.get(w)??0)+1),d.push(N))}let c=[...l.keys()].sort((k,w)=>(l.get(k)??0)-(l.get(w)??0)||(k<w?-1:k>w?1:0)),p=c.filter(k=>e.nodes.has(k)),u=c.length-p.length,f=new Map(p.map((k,w)=>[k,w])),m=[];for(let k of p)for(let w of e.children.get(k)??[])f.has(w)&&m.push([k,w]);let h=new Array(p.length).fill(0);for(let[k,w]of m){let N=Math.max(f.get(k)??0,f.get(w)??0);h[N]=(h[N]??0)+1}let y=0,_=0;for(;y<p.length&&y<s.maxNodes;){let k=h[y]??0;if(_+k>s.maxEdges)break;_+=k,y+=1}let S=new Map(p.slice(0,y).map((k,w)=>[k,`p${String(w)}`])),b=k=>{let N=(o.get(k)??[]).filter(R=>e.importers.has(R)).sort()[0];return N===void 0?null:e.importers.get(N)??null};return{nodes:p.slice(0,y).map(k=>{let w=e.nodes.get(k);return{id:S.get(k),name:w.name,version:w.version,directFrom:b(k)}}),edges:m.flatMap(([k,w])=>{let N=S.get(k),R=S.get(w);return N===void 0||R===void 0?[]:[{from:N,to:R}]}),truncated:p.length-y+u}}function rl(e){let n=new Map,t=new Set(["dependencies","devDependencies","optionalDependencies","peerDependencies"]),s=[],o=1,r=!1,i=e.charCodeAt(0)===65279?1:0;for(;i<e.length;){let a=e.charCodeAt(i);if(a===10)o+=1;else if(a===123||a===91){if(s.length>=64)return null;s.push({kind:a===123?"{":"[",key:null}),r=a===123}else if(a===125||a===93)s.pop(),r=!1;else if(a===44)r=s.at(-1)?.kind==="{";else if(a===58)r=!1;else if(a===34){let l=o,d=i+1;for(;d<e.length&&e.charCodeAt(d)!==34;){if(e.charCodeAt(d)===92)d+=1;else if(e.charCodeAt(d)===10)return null;d+=1}if(d>=e.length)return null;let c=s.at(-1);if(r&&c?.kind==="{"){let p;try{p=JSON.parse(e.slice(i,d+1))}catch{return null}c.key=p;let u=s.length===2?s[0]?.key:null;u!=null&&t.has(u)&&!n.has(p)&&n.set(p,l)}r=!1,i=d}i+=1}return s.length===0?n:null}var il="importer:";function Xr(e){let n=e.indexOf(" = ");if(n<=0)return null;let t=e.slice(n+3).trim();if(t.length<2||!t.startsWith('"')||!t.endsWith('"'))return null;let s=t.slice(1,-1);return s.includes('"')?null:{key:e.slice(0,n).trim(),value:s}}function wx(e){let n=[],t=0;for(;;){let s=e.indexOf('"',t);if(s===-1)return n;let o=e.indexOf('"',s+1);if(o===-1)return n;n.push(e.slice(s+1,o)),t=o+1}}function vx(e){let n=[],t=0;for(;;){let s=e.indexOf("{",t);if(s===-1)return n;let o=e.indexOf("}",s);if(o===-1)return n;let r=e.slice(s+1,o),i=[],a=r.indexOf("extra = [");if(a!==-1){let c=r.indexOf("]",a);c!==-1&&(i=wx(r.slice(a,c)),r=r.slice(0,a)+r.slice(c+1))}let l=null,d=null;for(let c of r.split(",")){let p=Xr(c.trim());p?.key==="name"?l=p.value:p?.key==="version"&&(d=p.value)}l!==null&&n.push({name:l,version:d,extras:i}),t=o+1}}function zf(e,n,t,s,o=new Map){if(s||n.size===0)return null;let r=new Map;for(let[d,c]of e){let p=r.get(c.name);p===void 0?r.set(c.name,[d]):p.push(d)}let i=new Map,a=[...t],l=new Set;for(let d=0;d<a.length;d+=1){let c=a[d],p=xt(c.name),u=r.get(p)??[],f=c.version!==null?`${p}@${c.version}`:u.length===1?u[0]??null:null;if(f===null||!e.has(f)||f===c.from)continue;let m=i.get(c.from);m===void 0?i.set(c.from,[f]):m.includes(f)||m.push(f);for(let h of c.extras){let y=JSON.stringify([f,h]);if(!l.has(y)){l.add(y);for(let _ of o.get(f)?.get(h)??[])a.push({from:f,..._})}}}return{nodes:e,children:i,importers:n}}function ll(e,n={}){let t=new Map,s=new Map,o=[],r=!1,i=null,a=null,l=null,d=[],c=new Map,p=new Map,u="",f=!1,m="",h=null,y=b=>{let k=vx(b);h===null?d.push(...k):c.set(h,[...c.get(h)??[],...k])},_=()=>{if(i===null)return;let b=xt(i),k=null;if(l!==null?(k=`${il}${l}`,s.set(k,l==="."?"pyproject.toml":`${l}/pyproject.toml`)):a!==null&&(k=`${b}@${a}`,t.size>=2e5?r=!0:t.set(k,{name:b,version:a})),k!==null){for(let w of d)o.push({from:k,...w});c.size>0&&p.set(k,c)}i=null,a=null,l=null,d=[],c=new Map},S=tt(e,n,(b,k)=>{if(f){m+=k,k.startsWith("]")&&(y(m),f=!1);return}if(k==="[[package]]"){_(),u="package";return}if(k.startsWith("[")){u=k==="[package.dev-dependencies]"?"dev":k==="[package.optional-dependencies]"?"optional":"other";return}if(u==="other")return;let w=k.indexOf(" = ");if(w<=0)return;let N=k.slice(0,w).trim(),R=k.slice(w+3).trim();if((u==="optional"||(u==="dev"?l!==null:N==="dependencies"))&&R.startsWith("[")){h=u==="optional"?N.replaceAll('"',""):null,R.endsWith("]")?y(R):(f=!0,m=R);return}if(u!=="package")return;if(N==="source"){let A=R.startsWith("{")&&R.endsWith("}")?R.slice(1,-1):"";for(let B of A.split(",")){let O=Xr(B.trim());(O?.key==="editable"||O?.key==="virtual")&&(l=O.value)}return}let I=Xr(k);I?.key==="name"?i=I.value:I?.key==="version"&&(a=I.value)});return _(),S.refusedAnchors||S.truncated?null:zf(t,s,o,r,p)}function dl(e,n,t={}){let s=new Map,o=new Map([[`${il}.`,"pyproject.toml"]]),r=n.map(f=>({from:`${il}.`,name:f,version:null,extras:[]})),i=!1,a=null,l=null,d=[],c="",p=()=>{if(a!==null&&l!==null){let f=xt(a),m=`${f}@${l}`;s.size>=2e5?i=!0:s.set(m,{name:f,version:l});for(let h of d)r.push({from:m,name:h,version:null,extras:[]})}a=null,l=null,d=[]},u=tt(e,t,(f,m)=>{if(m==="[[package]]"){p(),c="package";return}if(m.startsWith("[")){c=m==="[package.dependencies]"?"deps":"other";return}if(c==="package"){let _=Xr(m);_?.key==="name"?a=_.value:_?.key==="version"&&(l=_.value);return}if(c!=="deps")return;let h=m.indexOf(" = ");h<=0||m.slice(h+3).includes("optional = true")||d.push(m.slice(0,h).trim().replaceAll('"',""))});return p(),u.refusedAnchors||u.truncated?null:zf(s,o,r,i)}function al(e){let n=0;for(;n<e.length;){let t=e.charCodeAt(n);if(!(t>=97&&t<=122||t>=65&&t<=90||t>=48&&t<=57||t===45||t===46||t===95))break;n+=1}return n===0?null:xt(e.slice(0,n))}function Ex(e){return e==="tool.poetry.dependencies"||e==="tool.poetry.dev-dependencies"||e.startsWith("tool.poetry.group.")&&e.endsWith(".dependencies")}function Yr(e){let n=new Map,t="",s=!1,o=0,r=d=>{d!==null&&d!=="python"&&!n.has(d)&&n.set(d,o)},i=d=>{let c=0;for(;;){let p=d.indexOf('"',c);if(p===-1)return;let u=d.indexOf('"',p+1);if(u===-1)return;r(al(d.slice(p+1,u))),c=u+1}},a=(d,c)=>d==="project"&&c==="dependencies"||d==="project.optional-dependencies"||d==="dependency-groups"||d==="tool.uv"&&c==="dev-dependencies",l=e.charCodeAt(0)===65279?1:0;for(;l<=e.length&&o<2e5;){let d=e.indexOf(`
-`,l);d===-1&&(d=e.length),o+=1;let c=e.slice(l,d);l=d+1;let p=c.indexOf("#"),u=(p===-1?c:c.slice(0,p)).trim();if(u.length>4096)continue;if(s){i(u),u.includes("]")&&(s=!1);continue}if(u.startsWith("[")&&!u.startsWith("[[")){t=u.slice(1,u.indexOf("]")===-1?u.length:u.indexOf("]")).trim();continue}let f=u.indexOf("=");if(f<=0)continue;let m=u.slice(0,f).trim().replaceAll('"',""),h=u.slice(f+1).trim();if(Ex(t)){r(al(m));continue}if(a(t,m)&&h.startsWith("[")&&(i(h),s=!h.includes("]")),d===e.length)break}return n}function cl(e){let n=new Map,t=0,s=0;for(;s<=e.length&&t<2e5;){let o=e.indexOf(`
-`,s);o===-1&&(o=e.length),t+=1;let r=e.slice(s,o);s=o+1;let i=r.trim();if(i.length>0&&i.length<=4096&&!i.startsWith("#")&&!i.startsWith("-")){let a=al(i);a!==null&&!n.has(a)&&n.set(a,t)}if(o===e.length)break}return n}import{statSync as Jx}from"node:fs";import Zx from"node:path";import{lstatSync as Ix,readFileSync as Rx,readdirSync as Ox,realpathSync as ul,statSync as Fo}from"node:fs";import je from"node:path";function Ax(e,n){let t=e.charAt(n),s="",o=n+1;for(;o<e.length;){let r=e.charAt(o);if(r===t)return{value:s,end:o+1};if(t==='"'&&r==="\\"){let i=e.charAt(o+1);if(i!=="\\"&&i!=='"')return null;s+=i,o+=2;continue}s+=r,o+=1}return null}function Nx(e){let n=[],t=0;for(;t<e.length;){let s=e.charAt(t);if(s===" "||s==="	"||s==="\r"||s==="\f"||s==="\v"){t+=1;continue}if(s==="/"&&e.charAt(t+1)==="/")break;if(s==="("||s===")"){n.push({kind:s}),t+=1;continue}if(s==='"'||s==="`"){let i=Ax(e,t);if(i===null||i.value.length>4096)return null;n.push({kind:"quoted",text:i.value}),t=i.end;continue}let o=t;for(;o<e.length;){let i=e.charAt(o);if(i===" "||i==="	"||i==="\r"||i==="("||i===")"||i==='"'||i==="`"||i==="/"&&e.charAt(o+1)==="/")break;o+=1}let r=e.slice(t,o);if(r.length>4096)return null;n.push({kind:"word",text:r}),t=o}return n}function Uf(e){return e.kind==="word"||e.kind==="quoted"?e.text:null}function Ks(e){let n=[],t=null;for(let s of e.split(`
-`)){if(n.length>=1e5)break;let o=Nx(s);if(o===null||o.length===0)continue;if(t!==null){if(o[0]?.kind===")"){t=null;continue}let l=o.map(Uf);if(l.some(d=>d===null)||l.length>16)continue;n.push({verb:t,args:l});continue}let r=o[0];if(r?.kind!=="word")continue;let i=r.text;if(o.length===2&&o[1]?.kind==="("){t=i;continue}let a=o.slice(1).map(Uf);a.some(l=>l===null)||a.length>16||n.push({verb:i,args:a})}return n}function Lo(e,n){for(let t of e)if(t.verb===n&&t.args.length>0)return t.args[0]??null;return null}function Do(e){let n=[],t=[];for(let s of e){if(s.verb!=="use")continue;let o=s.args[0];if(o===void 0||o.length===0||o.includes("\0"))continue;let r=o.replace(/\\/gu,"/");if(r.startsWith("/")||/^[A-Za-z]:\//u.test(r)){t.push(o);continue}let i=[],a=!1;for(let l of r.split("/"))if(!(l===""||l===".")){if(l===".."){if(i.length===0){a=!0;break}i.pop();continue}i.push(l)}a?t.push(o):n.push(i.join("/"))}return{inside:n,outside:t}}function jo(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}function Bo(e){return e.ecosystem==="Go"||e.alsoGo===!0}var Vf=2e4,Xf=32,Yf=256,Px=2*1024*1024,Cx=256*1024,Jf=256,Mx=16,Tx=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],$x=["pyproject.toml","setup.py","setup.cfg"],Lx=["requirements.txt","Pipfile"],Dx=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],Zf=["go.sum","vendor/modules.txt"],Fx=256*1024;function jx(e){return e===""?!1:e.split("/").some(n=>n==="vendor"||n==="testdata"||n.startsWith("_"))}var Wf={candidate:"absent",witnesses:[],admitted:!1};function Bx(e){let n=fl(je.join(e,"go.work"),Fx);return n===null?new Set:new Set(Do(Ks(n)).inside)}var Qf={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function fl(e,n){try{let t=Fo(e);return!t.isFile()||t.size>n?null:Rx(e,"utf8")}catch{return null}}function ot(e){let n;try{n=Fo(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function Gx(e){try{return Fo(e).isDirectory()}catch{return!1}}function Kx(e,n){let t=0,s=0,o=-1,r=0;for(;s<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(s)))t+=1,s+=1;else if(t<e.length&&e.charAt(t)==="*")o=t,r=s,t+=1;else if(o>=0)t=o+1,r+=1,s=r;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function zx(e,n){let t=(s,o)=>{if(s===e.length)return o===n.length;let r=e[s]??"";if(r==="**"){for(let a=o;a<=n.length;a+=1)if(t(s+1,a))return!0;return!1}if(o>=n.length)return!1;let i=n[o]??"";return(r.includes("*")||r.includes("?")?Kx(r,i):r===i)?t(s+1,o+1):!1};return t(0,0)}function Ux(e){let n=[],t=fl(je.join(e,"package.json"),Px);if(t!==null)try{let i=JSON.parse(t)?.workspaces;if(Array.isArray(i))for(let a of i)typeof a=="string"&&n.push(a);else if(typeof i=="object"&&i!==null){let a=i.packages;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l)}}catch{}let s=fl(je.join(e,"pnpm-workspace.yaml"),Cx);s!==null&&n.push(...Wx(s));let o=[];for(let r of n){if(o.length>=Jf)break;let i=r.trim();if(i.length===0)continue;for(;i.startsWith("./");)i=i.slice(2);if(i.startsWith("/")||je.isAbsolute(i))continue;let a=i.split("/").filter(l=>l.length>0);a.length===0||a.length>Mx||a.includes("..")||o.push(a.join("/"))}return o}function Wx(e){let n=[],t=!1;for(let s of e.split(`
-`)){if(n.length>=Jf)break;if(/^packages:\s*(#.*)?$/.test(s)){t=!0;continue}if(!t)continue;let o=/^\s+-\s*(.*?)\s*$/.exec(s);if(o===null){s.trim().length>0&&(t=!1);continue}let r=(o[1]??"").trim(),i=r.indexOf(" #");i>=0&&(r=r.slice(0,i).trim()),(r.startsWith('"')&&r.endsWith('"')&&r.length>=2||r.startsWith("'")&&r.endsWith("'")&&r.length>=2)&&(r=r.slice(1,-1)),r.length>0&&n.push(r)}return n}function Hf(e,n){let t=je.relative(n,e);return t.length===0?!1:t.split(je.sep).includes("node_modules")}function qf(e,n){return je.relative(e,n).split(je.sep).join("/")}function Go(e,n){let t=n?.maxDirs??Vf,s=n?.maxDepth??Xf,o=n?.maxRoots??Yf,r=n?.discoverPythonRoots??!0,i=n?.discoverGoRoots??!1,a;try{a=ul(e)}catch{return{...Qf,observations:[{kind:"refused-unreadable",rel:""}]}}let l=[],d=[],c=new Set([a]),p=0,u=0,f=0,m="complete",h=Ux(a).map(I=>I.split("/")),y=i?Bx(a):new Set,_=new Set,S=new Set,b=I=>{let A="absent";for(let O of $x){let V=ot(je.join(I,O));if(V==="regular"){A="declared";break}V==="refused"&&(A="refused")}if(A==="absent"&&Lx.some(O=>ot(je.join(I,O))==="regular")&&(A="listed"),A==="absent")return{candidate:A,witnesses:[]};let B=[];return Dx.some(O=>ot(je.join(I,O))==="regular")&&B.push("own-lockfile"),Gx(je.join(I,".venv"))&&B.push("installed-env"),{candidate:A,witnesses:B}},k=(I,A)=>{if(!i||jx(A))return Wf;let B=ot(je.join(I,"go.mod"));if(B==="absent")return Wf;let O=B==="regular"?"declared":"refused",V=[];Zf.some(D=>ot(je.join(I,D))==="regular")&&V.push("own-lockfile"),y.has(A)&&V.push("workspace-declared");let E=A===""||O==="refused"||V.length>0;return{candidate:O,witnesses:V,admitted:E}},w=(I,A,B)=>B.admitted?l.length>=o?"exhausted":(l.push({rel:A,abs:I,witnesses:B.witnesses,manifestRefused:B.candidate==="refused",ecosystem:"Go"}),_.add(I),S.add(I),"root"):"not-root",N=(I,A,B)=>{let O=b(I);return O.candidate==="absent"?"not-root":(O.candidate!=="listed"&&(u+=1),O.witnesses.length===0&&O.candidate!=="refused"?O.candidate==="declared"?(d.push({kind:"undeclared-manifest",rel:A}),"observed"):"not-root":l.length>=o?"exhausted":(l.push({rel:A,abs:I,witnesses:O.witnesses,manifestRefused:O.candidate==="refused",ecosystem:"PyPI",...B.admitted?{alsoGo:!0}:{}}),B.admitted&&_.add(I),"root"))},R=(I,A)=>{if(A.length===0){let L=ot(je.join(I,"package.json"))!=="absent",K=r?b(I):{candidate:"absent",witnesses:[]},Y=k(I,A);return Y.admitted&&_.add(I),!L&&K.candidate!=="absent"?(l.push({rel:"",abs:I,witnesses:["scan-root",...K.witnesses],manifestRefused:!1,ecosystem:"PyPI",...Y.admitted?{alsoGo:!0}:{}}),"root"):!L&&Y.admitted?(l.push({rel:"",abs:I,witnesses:["scan-root",...Y.witnesses],manifestRefused:!1,ecosystem:"Go"}),"root"):(l.push({rel:"",abs:I,witnesses:["scan-root",...K.witnesses],manifestRefused:!1,...K.witnesses.length>0?{alsoPython:!0}:{},...Y.admitted?{alsoGo:!0}:{}}),"root")}let B=ot(je.join(I,"package.json")),O=k(I,A);if(O.candidate!=="absent"&&(u+=1),B==="absent"){let L=r?N(I,A,O):"not-root";if(L==="root"||L==="exhausted")return L;let K=w(I,A,O);return K==="not-root"&&O.candidate==="declared"&&L!=="observed"&&d.push({kind:"undeclared-manifest",rel:A}),K}u+=1;let V=[],E=A.split("/");h.some(L=>zx(L,E))&&V.push("workspace-declared"),Tx.some(L=>ot(je.join(I,L))==="regular")&&V.push("own-lockfile");let D=r?b(I):{candidate:"absent",witnesses:[]};for(let L of D.witnesses)V.includes(L)||V.push(L);return V.length===0&&B!=="refused"?(d.push({kind:"undeclared-manifest",rel:A}),w(I,A,O)):l.length>=o?"exhausted":(l.push({rel:A,abs:I,witnesses:V,manifestRefused:B==="refused",...D.witnesses.length>0?{alsoPython:!0}:{},...O.admitted?{alsoGo:!0}:{}}),O.admitted&&_.add(I),"root")},v=[{abs:a,rel:"",depth:0}];for(;v.length>0;){let I=v.pop();if(I===void 0)break;if(p>=t){m="dirs-exhausted";break}p+=1;let A=R(I.abs,I.rel);if(A==="exhausted"){m="roots-exhausted";break}let B=A==="root";if(I.depth>=s){m=m==="complete"?"depth-clamped":m;continue}let O;try{O=Ox(I.abs)}catch{d.push({kind:"refused-unreadable",rel:I.rel});continue}O.sort().reverse();for(let V of O){let E=je.join(I.abs,V),D=I.rel.length===0?V:`${I.rel}/${V}`,L;try{let le=Ix(E);L=le.isDirectory()||le.isSymbolicLink()&&Fo(E).isDirectory()}catch{continue}if(!L)continue;if(V==="node_modules"){(!B||S.has(I.abs))&&d.push({kind:"unenumerated-install",rel:D});continue}if(V==="vendor"&&_.has(I.abs)&&ot(je.join(E,"modules.txt"))==="regular")continue;if(V.startsWith(".")){f+=1,d.push({kind:"skipped-dot-directory",rel:D}),ot(je.join(E,"package.json"))!=="absent"&&d.push({kind:"undeclared-manifest",rel:D});continue}let K;try{K=ul(E)}catch{d.push({kind:"refused-unreadable",rel:D});continue}let Y=a.endsWith(je.sep)?a:a+je.sep;if(K!==a&&!K.startsWith(Y)){d.push({kind:"refused-out-of-root",rel:D});continue}Hf(K,a)||c.has(K)||(c.add(K),v.push({abs:K,rel:qf(a,K),depth:I.depth+1}))}}for(let I of n?.operatorRoots??[]){let A=typeof I=="string"?I.slice(0,512):"",B=()=>{d.push({kind:"refused-operator-root",rel:A})};if(A.length===0||A.includes("\0")){B();continue}let O;try{O=ul(je.resolve(a,A))}catch{B();continue}let V=a.endsWith(je.sep)?a:a+je.sep;if(O!==a&&(!O.startsWith(V)||Hf(O,a))){B();continue}let E;try{E=Fo(O).isDirectory()}catch{E=!1}if(!E||ot(je.join(O,"package.json"))!=="regular"){B();continue}let D=l.findIndex(Y=>Y.abs===O);if(D>=0){let Y=l[D];Y!==void 0&&!Y.witnesses.includes("operator")&&(l[D]={...Y,witnesses:[...Y.witnesses,"operator"]});continue}let L=qf(a,O);l.push({rel:L,abs:O,witnesses:["operator"],manifestRefused:!1});let K=d.findIndex(Y=>Y.kind==="undeclared-manifest"&&Y.rel===L);K>=0&&d.splice(K,1)}return l.sort((I,A)=>I.rel<A.rel?-1:I.rel>A.rel?1:0),d.sort((I,A)=>I.kind!==A.kind?I.kind<A.kind?-1:1:I.rel<A.rel?-1:I.rel>A.rel?1:0),{roots:l,observations:d,budget:m,counts:{dirsWalked:p,manifestsSeen:u,rootsAdmitted:l.length,dotDirectoriesSkipped:f}}}import{lstatSync as ep,readdirSync as Hx,readFileSync as qx,realpathSync as sp,statSync as op}from"node:fs";import Cn from"node:path";var rt={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},Vx=/^python\d+\.\d+$/u;function ns(e,n){let t;try{t=op(e)}catch(s){return{why:s?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:qx(e,"utf8")}}catch{return{why:"unreadable"}}}function pl(e,n){let t;try{if(t=sp(n),!op(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+Cn.sep)?t:null}function np(e,n){return Cn.relative(e,n).split(Cn.sep).join("/")}function tp(e){try{return Hx(e).sort()}catch{return null}}function Xx(e){let n=[],t=[],s=0;for(let o of e.split(/\r?\n/u)){let r=o.trim();if(!(r===""||r.startsWith("#"))){if(/^import[ \t]/u.test(r)){s+=1;let i=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(r);i?.[1]!==void 0&&t.length<rt.maxPthPaths&&t.push(i[1]);continue}n.length<rt.maxPthPaths&&n.push(r)}}return{paths:n,importLines:s,importModules:t}}function Yx(e){let n=null;for(let t of e.split(/\r?\n/u)){let s=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(s!==null){if(s[1]==="version_info")return s[2]??null;n??=s[2]??null}}return n}function Ko(e,n){let t=n?.envDir??rt.envDir,s=n?.maxDistributions??rt.maxDistributions,o=n?.maxMetadataBytes??rt.maxMetadataBytes,r=n?.maxRecordBytes??rt.maxRecordBytes,i=n?.maxTopLevelBytes??rt.maxTopLevelBytes,a=n?.maxDirectUrlBytes??rt.maxDirectUrlBytes,l=rt.maxEntryPointsBytes,d=t,c=[],p=(I,A,B=null)=>({envRel:d,refused:I,sitePackages:[],interpreter:B,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...c,A],truncated:!1}),u;try{u=sp(e)}catch{return p("absent","the root itself could not be resolved")}let f=Cn.join(u,t),m;try{m=ep(f)}catch(I){return I?.code==="ENOENT"?p("absent",`${d}: absent`):p("not-a-directory",`${d}: could not be inspected`)}if(!m.isDirectory()&&!m.isSymbolicLink())return p("not-a-directory",`${d}: not a directory`);let h=pl(u,f);if(h===null)return p("escapes-root",`${d}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let y=ns(Cn.join(h,"pyvenv.cfg"),rt.maxPyvenvCfgBytes),_="text"in y?Yx(y.text):null;"text"in y||c.push(`${d}/pyvenv.cfg: ${y.why} \u2014 interpreter version unknown`);let S=[];for(let I of["lib","lib64"]){let A=tp(Cn.join(h,I));if(A!==null)for(let B of A)Vx.test(B)&&S.push(Cn.join(h,I,B,"site-packages"))}S.push(Cn.join(h,"Lib","site-packages"));let b=[],k=new Set;for(let I of S){let A=pl(h,I);A===null||k.has(A)||(k.add(A),b.push(A))}if(b.length===0)return p("no-site-packages",`${d}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,_);b.length>1&&c.push(`${d}: ${String(b.length)} site-packages directories; all enumerated`);let w=[],N=[],R=0,v=!1;e:for(let I of b){let A=np(u,I),B=tp(I);if(B===null){c.push(`${A}: unreadable; nothing enumerated there`);continue}for(let O of B){let V=Cn.join(I,O),E=O.endsWith(".dist-info"),D=O.endsWith(".egg-info");if(O.endsWith(".pth")){let M=ns(V,rt.maxPthBytes);if(!("text"in M)){c.push(`${A}/${O}: ${M.why}; the paths it adds were NOT enumerated`);continue}N.push({name:O,sitePackages:A,...Xx(M.text)});continue}if(!E&&!D)continue;if(w.length>=s){v=!0,c.push(`${A}: the distribution cap (${String(s)}) was hit at ${O}; the enumeration is INCOMPLETE`);break e}let L;try{L=ep(V)}catch{R+=1,c.push(`${A}/${O}: could not be inspected; not enumerated`);continue}let K=E?"dist-info":"egg-info";if(L.isFile()&&D){let M=ns(V,o);"text"in M?w.push({dir:O,kind:K,metadata:M.text,entryPointsUnknown:!0}):(R+=1,c.push(`${A}/${O}: ${M.why}; not enumerated`));continue}let Y=pl(h,V);if(Y===null){R+=1,c.push(`${A}/${O}: not a directory inside the environment; not enumerated`);continue}let le=E?"METADATA":"PKG-INFO",z=ns(Cn.join(Y,le),o);if(!("text"in z)){R+=1,c.push(`${A}/${O}: ${le} ${z.why}; not enumerated`);continue}let Z={dir:O,kind:K,metadata:z.text},de=ns(Cn.join(Y,"entry_points.txt"),l);"text"in de?Z.entryPoints=de.text:de.why!=="absent"&&(Z.entryPointsUnknown=!0,c.push(`${A}/${O}/entry_points.txt: ${de.why}; the commands it declares are UNKNOWN`));let x=ns(Cn.join(Y,"top_level.txt"),i);if("text"in x?Z.topLevel=x.text:x.why!=="absent"&&c.push(`${A}/${O}/top_level.txt: ${x.why}; ignored`),E){let M=ns(Cn.join(Y,"RECORD"),r);"text"in M?Z.record=M.text:c.push(`${A}/${O}/RECORD: ${M.why}; import names from top_level.txt only`);let X=ns(Cn.join(Y,"direct_url.json"),a);"text"in X&&(Z.directUrl=X.text)}w.push(Z)}}return{envRel:d,refused:null,sitePackages:b.map(I=>np(u,I)),interpreter:_,distInfos:w,pthFiles:N,unreadable:R,diagnostics:c,truncated:v}}var Qx=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function ek(e,n){for(let t of n)try{if(Jx(Zx.join(e,t)).isFile())return t}catch{}return null}function rp(e){let n=[],t=[],s=(p,u)=>{t.push({kind:p,detail:u,blindsAnalysis:!1,rootRel:""}),n.push(u)},o=ek(e,Qx),r=Ko(e);if(r.refused!==null){let p=r.refused==="absent"?`no \`${r.envRel}\` is installed`:`\`${r.envRel}\` could not be read (${r.refused})`;return s("no-installed-env",`${o??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:o,diagnostics:[...n,...r.diagnostics],truncated:!1,gaps:t}}let i=[],a=new Set,l=[],d=0;for(let p of r.distInfos){let u=Mo(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(u===null){d+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let f=JSON.stringify([u.name,u.version]);a.has(f)||(a.add(f),u.importNames.length===0&&l.push(u.name),i.push({name:u.name,version:u.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...r.diagnostics);let c=r.unreadable+d;return c>0&&s("installed-env-partial",`${String(c)} entr${c===1?"y":"ies"} under ${r.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(i.length)} enumerated were assessed normally.`),r.truncated&&s("installed-env-partial",`the environment walk under ${r.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),l.length>0&&n.push(`${String(l.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${l.slice(0,5).join(", ")}${l.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:i,source:i.length>0?"installed-env":"none",lockfilePath:o,diagnostics:n,truncated:r.truncated,gaps:t}}var gl=128*1024*1024,nk=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>Ur(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>Ur(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Ya(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Qa(e,n===void 0?{}:{maxEntries:n})}],tk=[".pnp.cjs",".pnp.data.json",".pnp.js"];function yl(e,n){let t;try{t=hl(it.join(e,n))}catch{return null}let s=e.endsWith(it.sep)?e:e+it.sep;return t.startsWith(s)?t:null}function ap(e,n){let t=it.join(e,"package.json"),s;try{s=hl(t)}catch{return null}if(!s.startsWith(n+it.sep))return null;try{if(!zo(s).isFile())return null;let o=JSON.parse(ml(s,"utf8"));return typeof o.name!="string"||typeof o.version!="string"?null:{name:o.name,version:o.version}}catch{return null}}function lp(e,n){try{return zo(it.join(e,n)),!0}catch{return!1}}function sk(e,n){if(lp(e,"pnpm-workspace.yaml"))return!0;let t=yl(e,"package.json");if(t===null)return lp(e,"package.json");let s;try{let i=zo(t);if(!i.isFile()||i.size>n)return!0;s=ml(t,"utf8")}catch{return!0}let o;try{o=JSON.parse(s)}catch{return!0}for(let i of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=o[i];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let r=o.workspaces;return Array.isArray(r)?r.length>0:typeof r=="object"&&r!==null}function dp(e,n){let t=it.join(e,"node_modules"),s=[],o;try{o=ip(t,{withFileTypes:!0})}catch{return s}for(let r of o){let i=r.name;if(i.startsWith("."))continue;if(i.startsWith("@")){let l;try{l=ip(it.join(t,i),{withFileTypes:!0})}catch{continue}for(let d of l){let c=ap(it.join(t,i,d.name),n);c!==null&&s.push({dev:!1,name:c.name,version:c.version,lockKey:`node_modules/${i}/${d.name}`,linked:d.isSymbolicLink()||r.isSymbolicLink()})}continue}let a=ap(it.join(t,i),n);a!==null&&s.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${i}`,linked:r.isSymbolicLink()})}return s}var ok=5;function rk(e,n,t){let s=yl(e,n);if(s===null){try{zo(it.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let o;try{o=zo(s)}catch{return null}if(!o.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(o.size>t)return{gap:`${n} is ${String(o.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:ml(s,"utf8")}}catch{return{gap:`${n} could not be read`}}}function ik(e,n){let t=hl(e),s=[],o=[],r=n?.maxLockfileBytes??gl,i=[],a=new Set,l=[],d=sk(t,r),c=null,p=!1,u=(m,h,y)=>{o.push({kind:m,detail:h,blindsAnalysis:y,rootRel:""}),s.push(h)};for(let m of nk){let h=rk(t,m.file,r);if(h===null)continue;if("gap"in h){u("lockfile-unreadable",h.gap,!1);continue}let y=m.parse(h.text,n?.maxLockfileEntries);if(y.truncated&&(p=!0),y.deps.length===0){if(y.diagnostics.length>0||d){let _=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";u("lockfile-unparsed",`${m.file} yielded NO dependencies (${_}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&u("lockfile-partial",`${m.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),c===null&&(c=m.file),l.includes(m.source)||l.push(m.source);for(let _ of y.deps){let S=JSON.stringify([_.name,_.version,_.lockKey]);a.has(S)||(a.add(S),i.push({..._,declaredIn:m.file}))}}for(let m of tk)if(yl(t,m)!==null){u("yarn-pnp",`${m} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(i.length>0){let m=l.length===1?l[0]??"none":"multi-lockfile";l.length>1&&s.push(`multiple lockfiles present (${l.join(", ")}); enumerated the UNION of all of them`);let h=new Set(i.map(S=>JSON.stringify([S.name,S.version]))),y=new Set,_=[];for(let S of dp(t,t)){let b=JSON.stringify([S.name,S.version,S.lockKey]);a.has(b)||(a.add(b),i.push({name:S.name,version:S.version,lockKey:S.lockKey,dev:S.dev,declaredIn:""}));let k=JSON.stringify([S.name,S.version]);S.linked||h.has(k)||y.has(k)||(y.add(k),_.length<ok&&_.push(Po(S.name,S.version)))}if(y.size>0){let S=y.size-_.length;u("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${_.join(", ")}${S>0?`, and ${String(S)} more`:""}): ${c??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:i,source:m,lockfilePath:c,diagnostics:s,truncated:p,gaps:o}}let f=dp(t,t);return f.length>0?(u("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(f.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:f.map(m=>({name:m.name,version:m.version,lockKey:m.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:s,truncated:p,gaps:o}):(d&&u("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:s,truncated:p,gaps:o})}function cp(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function ak(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function pp(e){return e===""||e.split("/").every(ak)}function lk(e,n){if(e===""||n==="")return n;if(!pp(e))return"";let t=`${e}/${n}`;return t.length<=zr?t:""}function up(e,n){return e===""?n:`${e}: ${n}`}function dk(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function mp(e,n,t,s){let o=t?.maxUnionEntries??Kr,r=n.roots.filter(h=>cp(h)||s?.has(h.rel)===!0),i=r.some(h=>h.rel==="")?r:[dk(e),...r],a=[],l=[],d=new Set,c=[],p=[],u=!1,f=!1;for(let h of i){let y=h.rel===""?e:h.abs,S=h.rel===""||h.ecosystem!=="Go"&&cp(h)?ik(y,t):pk,b=jo(h)?rp(y):null,k=s?.get(h.rel)??null,w=b===null?S:fp(S,b),N=k===null?w:fp(w,k),R=N.diagnostics.map(I=>up(h.rel,I));!pp(h.rel)&&N.packages.length>0&&R.push(`${h.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(N.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let v={...N,rootRel:h.rel,...h.ecosystem!==void 0?{ecosystem:h.ecosystem}:{},...b!==null?{pythonLockfilePath:b.lockfilePath===null||h.rel===""?b.lockfilePath:`${h.rel}/${b.lockfilePath}`}:{},...k!==null?{goModPath:h.rel===""?"go.mod":`${h.rel}/go.mod`}:{},packages:N.packages.map(I=>({...I,lockKey:lk(h.rel,I.lockKey),declaredIn:I.declaredIn===""||h.rel===""?I.declaredIn:`${h.rel}/${I.declaredIn}`})),lockfilePath:N.lockfilePath===null||h.rel===""?N.lockfilePath:`${h.rel}/${N.lockfilePath}`,gaps:N.gaps.map(I=>({...I,rootRel:h.rel,detail:up(h.rel,I.detail)})),diagnostics:R};a.push(v),N.truncated&&(u=!0);for(let I of v.packages){let A=JSON.stringify(I.ecosystem==="Go"?[I.name,I.version,I.lockKey,"Go"]:[I.name,I.version,I.lockKey]);if(!d.has(A)){if(l.length>=o){f=!0;break}d.add(A),l.push(I)}}c.push(...v.gaps),p.push(...v.diagnostics)}f&&(u=!0,p.push(`the union of installed sets across ${String(i.length)} roots exceeds its ceiling of ${String(o)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let m=a[0];if(m===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:m.source,lockfilePath:m.lockfilePath,diagnostics:p,truncated:u,gaps:c,perRoot:a}}function ck(e,n){let t;for(let s of e.perRoot){if(s.rootRel===""){t??=s;continue}n.startsWith(`${s.rootRel}/`)&&(t===void 0||s.rootRel.length>t.rootRel.length)&&(t=s)}return t}function Jr(e,n){return n.declaredIn!==""?n.declaredIn:ck(e,n.lockKey)?.lockfilePath??null}function hp(e,n){let t=e.perRoot.find(o=>o.rootRel===n.rootRel);if(fk.has(n.kind))return t?.goModPath??(n.rootRel===""?"go.mod":`${n.rootRel}/go.mod`);if(uk.has(n.kind))return t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`;if(t?.lockfilePath!==void 0&&t.lockfilePath!==null)return t.lockfilePath;if(n.rootRel==="")return null;let s=t?.ecosystem==="PyPI"?"pyproject.toml":t?.ecosystem==="Go"?"go.mod":"package.json";return`${n.rootRel}/${s}`}var uk=new Set(["no-installed-env","installed-env-partial"]),fk=new Set(["go-toolchain-missing","go-list-failed","go-module-missing"]),pk={packages:[],source:"none",lockfilePath:null,diagnostics:[],truncated:!1,gaps:[]};function fp(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function gp(e){let n=new Map;for(let t of e){let s=n.get(t.name)??new Set;s.add(t.version),n.set(t.name,s)}return t=>{let s=n.get(t);if(s===void 0)return;let o=[...s].sort();return o.length===1?o[0]:o}}function Uo(e){return new Set(e.map(n=>n.root))}function zs(e,n){let t=Uo(n);return e.roots.filter(s=>!t.has(s.rel)&&(s.rel===""||s.ecosystem!=="PyPI"&&s.ecosystem!=="Go"))}function _l(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function bl(e,n){return zs(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function yp(e){let n=[],t=e.observations.filter(s=>s.kind==="unenumerated-install").map(s=>s.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${_l(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let s=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(s.dirsWalked)} dirs walked, ${String(s.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function _p(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as bv}from"node:fs";import ws from"node:path";import{spawnSync as Fw}from"node:child_process";function Wo(e){{let n=oe[e];if(n===void 0)throw new Error(`the bundle does not embed ${e}; this is a cupel build defect`);return["-c",n]}}var bp=["get","post","put","patch","delete","options","head","trace"],Mn=(e,n)=>e.map(t=>`${t}.${n}()`),bn=(e,...n)=>e.flatMap(t=>n.map(s=>`${t}.${s}`)),Bn={id:"fastapi@0-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://fastapi.tiangolo.com/reference/apirouter/ \u2014 APIRouter.api_route's decorator calls add_api_route(path, func) and returns func (fastapi/routing.py, 0.141.1); FastAPI.get/\u2026 delegate to self.router","https://fastapi.tiangolo.com/tutorial/dependencies/ \u2014 a Depends parameter receives the dependency's return","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/dependencies/utils.py \u2014 add_non_field_param_to_dependency: Request, WebSocket, HTTPConnection, Response, BackgroundTasks, SecurityScopes are injected","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/security/http.py \u2014 HTTPBearer.__call__ returns HTTPAuthorizationCredentials read from the request's Authorization header"],apps:[...Mn(["fastapi","fastapi.applications"],"FastAPI"),...Mn(["fastapi","fastapi.routing"],"APIRouter")],decorators:[...bp,"api_route"],addRoute:"add_api_route",depends:bn(["fastapi","fastapi.params","fastapi.param_functions"],"Depends","Security"),injected:[...bn(["fastapi","fastapi.responses","starlette.responses"],"Response","JSONResponse","HTMLResponse","PlainTextResponse","RedirectResponse","StreamingResponse","FileResponse","ORJSONResponse","UJSONResponse","EventSourceResponse"),...bn(["fastapi","fastapi.background","starlette.background"],"BackgroundTasks"),...bn(["fastapi.security","fastapi.security.oauth2"],"SecurityScopes")],schemes:[...Mn(["fastapi.security","fastapi.security.http"],"HTTPBearer"),...Mn(["fastapi.security","fastapi.security.http"],"HTTPBasic"),...Mn(["fastapi.security","fastapi.security.http"],"HTTPDigest"),...Mn(["fastapi.security","fastapi.security.oauth2"],"OAuth2"),...Mn(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordBearer"),...Mn(["fastapi.security","fastapi.security.oauth2"],"OAuth2AuthorizationCodeBearer"),...Mn(["fastapi.security","fastapi.security.open_id_connect_url"],"OpenIdConnect"),...Mn(["fastapi.security","fastapi.security.api_key"],"APIKeyHeader"),...Mn(["fastapi.security","fastapi.security.api_key"],"APIKeyQuery"),...Mn(["fastapi.security","fastapi.security.api_key"],"APIKeyCookie")],forms:bn(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordRequestForm","OAuth2PasswordRequestFormStrict")},Xn={id:"flask@3-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://flask.palletsprojects.com/en/stable/api/#flask.Flask.route \u2014 Scaffold.route's decorator calls add_url_rule(rule, endpoint, f) and returns f (flask/sansio/scaffold.py, 3.1.3); get/post/put/delete/patch are route(methods=[\u2026])","https://flask.palletsprojects.com/en/stable/quickstart/#variable-rules \u2014 <converter:variable> sections are passed to the view as keyword arguments (werkzeug/routing/rules.py _part_re)","https://flask.palletsprojects.com/en/stable/api/#flask.request \u2014 the request object for the active context (flask/globals.py: a LocalProxy)"],apps:[...Mn(["flask","flask.app"],"Flask"),...Mn(["flask","flask.blueprints"],"Blueprint")],decorators:["route","get","post","put","delete","patch"],addRule:"add_url_rule",proxies:["flask.request","flask.globals.request"]},vn={id:"django@6-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://docs.djangoproject.com/en/6.1/topics/http/urls/#how-django-processes-a-request \u2014 the view is called with the HttpRequest, then the captured values (django/urls/resolvers.py, 6.1.1)","https://docs.djangoproject.com/en/6.1/ref/class-based-views/base/#django.views.generic.base.View.dispatch \u2014 as_view()'s view calls dispatch(request, *args, **kwargs), which calls the method named for the verb","https://docs.djangoproject.com/en/3.2/ref/urls/#url \u2014 url() (removed in 4.0) is re_path()","https://www.django-rest-framework.org/api-guide/views/#api_view \u2014 the decorated function is called by a generated APIView's handler with (request, *args, **kwargs) (rest_framework/decorators.py, 3.18.1)","https://docs.djangoproject.com/en/6.1/topics/http/decorators/ \u2014 Django's view decorators; each wrapper calls the view with (request, *args, **kwargs) (django/views/decorators/*.py, django/contrib/auth/decorators.py user_passes_test, django/utils/decorators.py make_middleware_decorator, 6.1.1)"],paths:["django.urls.path","django.urls.conf.path"],regexes:["django.urls.re_path","django.urls.conf.re_path","django.conf.urls.url"],methods:bp,passThrough:[...bn(["django.contrib.auth.decorators"],"login_required","login_required()","login_not_required","permission_required()","user_passes_test()"),...bn(["django.contrib.admin.views.decorators"],"staff_member_required","staff_member_required()"),...bn(["django.views.decorators.http"],"require_http_methods()","require_GET","require_POST","require_safe","condition()","etag()","last_modified()","conditional_page"),...bn(["django.views.decorators.csrf"],"csrf_exempt","csrf_protect","requires_csrf_token","ensure_csrf_cookie"),...bn(["django.views.decorators.cache"],"cache_page()","cache_control()","never_cache"),...bn(["django.views.decorators.vary"],"vary_on_headers()","vary_on_cookie"),...bn(["django.views.decorators.clickjacking"],"xframe_options_deny","xframe_options_sameorigin","xframe_options_exempt"),...bn(["django.views.decorators.gzip"],"gzip_page"),...bn(["django.views.decorators.debug"],"sensitive_post_parameters()","sensitive_variables()"),...bn(["django.views.decorators.common"],"no_append_slash")],apiView:"rest_framework.decorators.api_view()",apiViewSetters:bn(["rest_framework.decorators"],"renderer_classes()","parser_classes()","authentication_classes()","throttle_classes()","permission_classes()","schema()")};function Sp(e){return Xn.proxies.includes(e)?{kind:"source",sourceClass:Xn.sourceClass,model:Xn.id}:null}var mk=[Bn.addRoute,Xn.addRule,...new Set([...vn.paths,...vn.regexes].map(e=>e.slice(e.lastIndexOf(".")+1)))],hk=[...new Set([...vn.passThrough,vn.apiView,...vn.apiViewSetters].map(e=>e.split(".")[0]??e))];function xp(e){return{proxies:Xn.proxies.filter(n=>!e(n.split(".")[0]??n)),calls:mk,roots:hk.filter(n=>!e(n))}}import{readdirSync as vp,realpathSync as kp,statSync as Ep}from"node:fs";import Lt from"node:path";var Ap=32,gk=512,yk=/^[A-Za-z_][A-Za-z0-9_]*$/u,_k=[".so",".pyd",".dylib"],Zr=e=>({resolved:e,failure:null}),Us=e=>({resolved:null,failure:e});function bk(e){if(e.length===0||e.length>gk)return null;let n=e.split(".");return n.length>Ap?null:n.every(t=>yk.test(t))?n:null}function Sl(e){try{return Ep(e).isDirectory()}catch{return!1}}function Hs(e){try{return Ep(e).isFile()}catch{return!1}}var wp=new WeakMap;function Ws(e,n,t){let s=wp.get(e);s===void 0&&(s=new Map,wp.set(e,s));let o=s.get(n);if(o===void 0){try{o=new Set(vp(n))}catch{o=null}s.set(n,o)}return o?.has(t)===!0}function Ho(e,n){let t,s;try{t=kp(n),s=kp(e)}catch{return null}return t===s||t.startsWith(s+Lt.sep)?t:null}function Sk(e,n){let t;try{t=vp(e)}catch{return null}for(let s of t)if(s.startsWith(`${n}.`)&&_k.some(o=>s.endsWith(o))&&Hs(Lt.join(e,s)))return Lt.join(e,s);return null}function Dt(e,n){let t=bk(n);if(t===null)return Us("refused");let s=null,o=!1;for(let[r,i]of e.roots.entries()){let a=i,l=!1;for(let h of t.slice(0,-1)){let y=Lt.join(a,h);if(Ws(e,a,h)&&(Hs(Lt.join(y,"__init__.py"))||Sl(y))){if(!Sl(y)){l=!0;break}a=y;continue}l=!0,Ws(e,a,`${h}.py`)&&Hs(`${y}.py`)&&(o=!0);break}if(l)continue;let d=t[t.length-1];if(d===void 0)return Us("refused");let c=Lt.join(a,d,"__init__.py");if(Ws(e,a,d)&&Hs(c)){let h=Ho(i,c);return h===null?Us("escapes-root"):Zr({module:n,kind:"package",path:h,rootIndex:r})}let p=Lt.join(a,`${d}.py`);if(Ws(e,a,`${d}.py`)&&Hs(p)){let h=Ho(i,p);return h===null?Us("escapes-root"):Zr({module:n,kind:"module",path:h,rootIndex:r})}let u=Sk(a,d);if(u!==null){let h=Ho(i,u);return h===null?Us("escapes-root"):Zr({module:n,kind:"extension",path:h,rootIndex:r})}let f=Lt.join(a,d);if(s===null&&Ws(e,a,d)&&Sl(f)){let h=Ho(i,f);h!==null&&(s={module:n,kind:"namespace",path:h,rootIndex:r});continue}let m=Lt.join(a,`${d}.pyi`);if(s===null&&Ws(e,a,`${d}.pyi`)&&Hs(m)){let h=Ho(i,m);h!==null&&(s={module:n,kind:"stub-only",path:h,rootIndex:r})}}return s!==null?Zr(s):Us(o?"not-a-package":"not-found")}function Qr(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function qs(e,n,t,s){if(t<1||t>Ap)return{failure:"refused"};let o=Qr(e,n),r=o===""?[]:o.split("."),i=t-1;if(i>r.length)return{failure:"beyond-top-level"};let a=r.slice(0,r.length-i),l=s===null||s===""?[]:s.split("."),d=[...a,...l].join(".");return d===""?{failure:"beyond-top-level"}:{dotted:d}}function qo(e,n,t){if(e===null)return null;let s=r=>r.kind!=="declared-param"?r:r.index>=t?null:n==="none"?{kind:"param",index:r.index}:r.index===0?{kind:"receiver"}:{kind:"param",index:r.index-1},o=[];for(let r of e){let i=s(r.from),a=s(r.to);if(i===null||a===null)return null;o.push({from:i,to:a,kind:r.kind})}return o}var kl="https://docs.python.org/3.13/",xk=`${kl}builtins/functions.html#`,bs=`${kl}builtins/stdtypes.html#`,kt=e=>`${kl}library/${e}.html#`;function ei(e){return e===""?[]:e.split(",").map(n=>{if(n==="r")return{kind:"receiver"};let t=n.endsWith("+"),s=Number(t?n.slice(0,-1):n);if(!Number.isSafeInteger(s)||s<0)throw new Error(`runtime table: input ${n}`);return t?{kind:"args-from",index:s}:{kind:"arg",index:s}})}var Ip=new Map;function xe(e,n,t){let s=(t.mutates??"").split(";").filter(i=>i!=="").map(i=>{let[a,l]=i.split("<"),d=ei(a??"");if(d.length!==1||d[0]===void 0||l===void 0)throw new Error(`runtime table: mutation ${i}`);return{into:d[0],from:ei(l)}}),o=ei(t.program??""),r=t.returns;Ip.set(e,{summary:{id:`python:${e}`,result:ei(t.result),mutates:s,...o.length>0?{callsProgram:o}:{}},...r!==void 0?{returns:r.endsWith("?")?{type:r.slice(0,-1),exact:"inputs"}:{type:r,exact:"always"}}:{},doc:n})}function wl(e,n,t){for(let s of e)xe(s,n(s),t)}var kk=(e,n=e)=>`${xk}${n}`,Be=(e,n,t=e)=>xe(`builtins.${e}`,kk(e,t),n);Be("len",{result:"0",program:"0",returns:"int"});Be("isinstance",{result:"0+",program:"0+",returns:"bool"});Be("issubclass",{result:"0+",program:"0+",returns:"bool"});Be("callable",{result:"0",returns:"bool"});Be("str",{result:"0+",program:"0+",returns:"str?"},"func-str");Be("repr",{result:"0",program:"0",returns:"str?"});Be("ascii",{result:"0",program:"0",returns:"str?"});Be("format",{result:"0+",program:"0+",returns:"str?"});Be("bytes",{result:"0+",program:"0+",returns:"bytes?"},"func-bytes");Be("int",{result:"0+",program:"0+",returns:"int"});Be("float",{result:"0",program:"0",returns:"float"});Be("bool",{result:"0",program:"0",returns:"bool"});Be("ord",{result:"0",returns:"int"});Be("chr",{result:"0",program:"0",returns:"str"});for(let e of["hex","oct","bin"])Be(e,{result:"0",program:"0",returns:"str"});Be("hash",{result:"0",program:"0",returns:"int"});for(let e of["any","all"])Be(e,{result:"0",program:"0",returns:"bool"});for(let e of["abs","reversed","frozenset"])Be(e,{result:"0",program:"0"},e==="frozenset"?"func-frozenset":e);for(let e of["round","min","max","sum","enumerate","zip","map","iter","next"])Be(e,{result:"0+",program:"0+"});Be("range",{result:"0+",program:"0+"},"func-range");Be("filter",{result:"1",program:"0+"});Be("sorted",{result:"0",program:"0+",returns:"list"});Be("list",{result:"0",program:"0",returns:"list"},"func-list");Be("tuple",{result:"0",program:"0",returns:"tuple"},"func-tuple");Be("dict",{result:"0+",program:"0+",returns:"dict"},"func-dict");Be("set",{result:"0",program:"0",returns:"set"},"func-set");var Ft=e=>n=>`${e}.${n}`,Vs=e=>n=>`${bs}${e}.${n}`,wk=["capitalize","center","expandtabs","join","ljust","lower","lstrip","removeprefix","removesuffix","replace","rjust","rstrip","strip","swapcase","title","translate","upper","zfill"],vk=["endswith","isalnum","isalpha","isascii","isdigit","islower","isspace","istitle","isupper","startswith"],Ek=["count","find","index","rfind","rindex"];for(let e of["str","bytes"]){let n=(t,s)=>{for(let o of t)xe(Ft(e)(o),Vs(e)(o),s)};n(wk,{result:"r,0+",program:"0+",returns:e}),n(vk,{result:"r,0+",program:"0+",returns:"bool"}),n(Ek,{result:"r,0+",program:"0+",returns:"int"}),n(["split","rsplit","splitlines"],{result:"r,0+",program:"0+",returns:"list"}),n(["partition","rpartition"],{result:"r,0+",program:"0+",returns:"tuple"})}wl(["casefold","format","format_map"].map(Ft("str")),e=>`${bs}${e}`,{result:"r,0+",program:"0+",returns:"str"});wl(["isdecimal","isidentifier","isnumeric","isprintable"].map(Ft("str")),e=>`${bs}${e}`,{result:"r",returns:"bool"});xe("str.encode",`${bs}str.encode`,{result:"r,0+",program:"0+",returns:"bytes?"});xe("bytes.decode",`${bs}bytes.decode`,{result:"r,0+",program:"0+",returns:"str?"});xe("bytes.hex",`${bs}bytes.hex`,{result:"r,0+",program:"0+",returns:"str"});var Xs=Vs("dict");xe("dict.get",Xs("get"),{result:"r,1",program:"r,0"});xe("dict.pop",Xs("pop"),{result:"r,1",program:"r,0"});xe("dict.setdefault",Xs("setdefault"),{result:"r,1",mutates:"r<0,1",program:"r,0"});xe("dict.update",Xs("update"),{result:"",mutates:"r<0+",program:"r,0+"});wl(["keys","values","items","popitem"].map(Ft("dict")),e=>`${bs}${e}`,{result:"r"});xe("dict.copy",Xs("copy"),{result:"r",returns:"dict"});xe("dict.clear",Xs("clear"),{result:""});var jt=Vs("list");xe("list.append",jt("append"),{result:"",mutates:"r<0"});xe("list.extend",jt("extend"),{result:"",mutates:"r<0",program:"0"});xe("list.insert",jt("insert"),{result:"",mutates:"r<1",program:"0"});xe("list.pop",jt("pop"),{result:"r",program:"0"});xe("list.remove",jt("remove"),{result:"",program:"r,0"});xe("list.sort",jt("sort"),{result:"",program:"r,0+"});xe("list.reverse",jt("reverse"),{result:""});xe("list.clear",jt("clear"),{result:""});xe("list.copy",jt("copy"),{result:"r",returns:"list"});for(let e of["list","tuple"])for(let n of["index","count"])xe(Ft(e)(n),Vs(e)(n),{result:"r,0+",program:"r,0+",returns:"int"});var Ys=Vs("set"),vl=Vs("frozenset");xe("set.add",Ys("add"),{result:"",mutates:"r<0",program:"0"});xe("set.update",Ys("update"),{result:"",mutates:"r<0+",program:"0+"});for(let e of["intersection_update","difference_update","symmetric_difference_update"])xe(Ft("set")(e),Ys(e),{result:"",mutates:"r<0+",program:"r,0+"});for(let e of["discard","remove"])xe(Ft("set")(e),Ys(e),{result:"",program:"r,0"});xe("set.pop",Ys("pop"),{result:"r"});xe("set.clear",Ys("clear"),{result:""});xe("set.copy",vl("copy"),{result:"r",returns:"set"});for(let e of["union","intersection","difference","symmetric_difference"])xe(Ft("set")(e),vl(e),{result:"r,0+",program:"r,0+",returns:"set"});for(let e of["issubset","issuperset","isdisjoint"])xe(Ft("set")(e),vl(e),{result:"r,0+",program:"r,0+",returns:"bool"});xe("json.loads",`${kt("json")}json.loads`,{result:"0+",program:"0+"});xe("json.dumps",`${kt("json")}json.dumps`,{result:"0+",program:"0+"});xe("copy.copy",`${kt("copy")}copy.copy`,{result:"0",program:"0"});xe("copy.deepcopy",`${kt("copy")}copy.deepcopy`,{result:"0+",mutates:"1<0",program:"0+"});for(let e of["b64encode","b64decode","standard_b64encode","standard_b64decode","urlsafe_b64encode","urlsafe_b64decode"])xe(`base64.${e}`,`${kt("base64")}base64.${e}`,{result:"0+",program:"0+",returns:"bytes"});xe("unicodedata.normalize",`${kt("unicodedata")}unicodedata.normalize`,{result:"0+",returns:"str?"});for(let e of["category","bidirectional"])xe(`unicodedata.${e}`,`${kt("unicodedata")}unicodedata.${e}`,{result:"0",returns:"str"});for(let e of["bisect_left","bisect_right","bisect"])xe(`bisect.${e}`,`${kt("bisect")}bisect.${e}`,{result:"0+",program:"0+",returns:"int"});for(let e of["insort_left","insort_right","insort"])xe(`bisect.${e}`,`${kt("bisect")}bisect.${e}`,{result:"",mutates:"0<1",program:"0+"});for(let e of["join","basename","dirname","normpath","splitext","split"])xe(`os.path.${e}`,`${kt("os.path")}os.path.${e}`,{result:"0+",program:"0+"});var Np=new Set(["str","bytes","int","float","complex","bool","none","scalar"]),Ak=new Set(["str","bytes","int","float","complex","bool","tuple","list","dict","set"]),at={decl:"unknown"},Nk=8;function Rp(e,n){let t=new Map,s=c=>c==null||c.unlessWritten!==void 0&&n.written(c.unlessWritten)?null:{type:c.type,exact:!0},o=(c,p)=>c.get(xl(p))?.value??null,r=(c,p,u)=>{if(u>Nk)return at;let f=n.decls.get(c),m=f?.moduleBindings?.get(p),h=e.packageOf(c);if(m==="def"||m==="class")return h===void 0?at:{decl:h===""?"app":"dependency"};if(m!=="import"||f?.aliases.get(p)?.rows!==1)return at;let y=n.envs.get(c),_=y?.names.get(p);if(_!==void 0)return r(_.moduleId,_.name,u+1);let S=y?.externalOrigins?.get(p);return S!==void 0?i(S,u+1):at},i=(c,p)=>{let u=c.split(".");for(let m=u.length;m>=1;m-=1){let h=e.placed(u.slice(0,m).join("."));if(h===null)continue;if(h.kind==="surface")return{decl:"dependency"};let y=u.slice(m);return y.length===1&&y[0]!==void 0?r(h.id,y[0],p):at}let f=u[0];return f!==void 0&&e.stdlib.has(f)?{decl:"runtime",identity:c}:at},a=(c,p)=>{if(p.startsWith("~")){let y=e.packageOf(c);return y===void 0?at:{decl:y===""?"app":"dependency"}}let u=p,f=/^\.+/u.exec(p)?.[0].length??0;if(f>0){let y=e.dottedOf(c);if(y===void 0)return at;let _=p.slice(f),S=qs(y.dotted,y.isPackage,f,_===""?null:_);if("failure"in S)return at;u=S.dotted}let[m,h]=u.split(".");return m==="builtins"?h!==void 0&&e.builtins.has(h)?{decl:"runtime",identity:u}:at:i(u,0)},l=(c,p,u)=>{let h=(p.args??[]).map((R,v)=>{let I=p.argProofs?.[v],A=I?.unlessWritten===void 0?s(I):null;return A!==null||R.kind!=="positional"?A:o(u,R)}).map(R=>R!==null&&R.exact&&Np.has(R.type)),y=p.attr===null||p.receiverRange===null?null:s(p.receiverProof)??o(u,p.receiverRange),_=y!==null&&y.exact&&Np.has(y.type),S=at;y!==null&&p.attr!==null?Ak.has(y.type)&&e.typeAttrs.get(y.type)?.has(p.attr)===!0&&(S={decl:"runtime",identity:`${y.type}.${p.attr}`,method:!0}):p.calleeOrigin!==null&&(S=a(c,p.calleeOrigin));let b=S.identity===void 0?void 0:Ip.get(S.identity),k=b?.summary;k!==void 0&&S.method===!0&&y?.exact!==!0&&(k={...k,callsProgram:[{kind:"receiver"},...k.callsProgram??[]]});let w=b?.returns,N=w===void 0?void 0:{type:w.type,exact:w.exact==="always"||h.every(Boolean)&&(S.method!==!0||_)};return{calleeDecl:S.decl,...S.identity!==void 0?{runtimeId:`python:${S.identity}`}:{},...k!==void 0?{summary:k}:{},..._?{receiverPrimitive:!0}:{},...S.method===!0&&y?.exact===!0?{receiverMethod:y.type}:{},argPrimitive:h,...N!==void 0?{value:N}:{}}},d=c=>{let p=t.get(c);if(p!==void 0)return p;let u=new Map,f=h=>h.range.end-h.range.start,m=[...n.calls.get(c)??[]].sort((h,y)=>f(h)-f(y)||h.range.start-y.range.start);for(let h of m)f(h)>0&&u.set(xl(h.range),l(c,h,u));return t.set(c,u),u};return(c,p)=>{let u=d(c),f=u.get(xl(p.range))??l(c,p,u),{value:m,...h}=f;return h}}function xl(e){return`${String(e.start)}-${String(e.end)}`}var Il="<toplevel>",Dp=64,Ik=new Set(["self","cls"]),Xo=8,Rk=new Set(["__new__","__init_subclass__","__class_getitem__"]),ri=new Set(["__del__","__repr__","__str__","__bytes__","__format__","__lt__","__le__","__eq__","__ne__","__gt__","__ge__","__hash__","__bool__","__getattr__","__getattribute__","__setattr__","__delattr__","__dir__","__get__","__set__","__delete__","__init_subclass__","__set_name__","__mro_entries__","__prepare__","__instancecheck__","__subclasscheck__","__class_getitem__","__call__","__len__","__length_hint__","__getitem__","__setitem__","__delitem__","__missing__","__iter__","__reversed__","__contains__","__add__","__sub__","__mul__","__matmul__","__truediv__","__floordiv__","__mod__","__divmod__","__pow__","__lshift__","__rshift__","__and__","__xor__","__or__","__radd__","__rsub__","__rmul__","__rmatmul__","__rtruediv__","__rfloordiv__","__rmod__","__rdivmod__","__rpow__","__rlshift__","__rrshift__","__rand__","__rxor__","__ror__","__iadd__","__isub__","__imul__","__imatmul__","__itruediv__","__ifloordiv__","__imod__","__ipow__","__ilshift__","__irshift__","__iand__","__ixor__","__ior__","__neg__","__pos__","__abs__","__invert__","__complex__","__int__","__float__","__index__","__round__","__trunc__","__floor__","__ceil__","__enter__","__exit__","__buffer__","__release_buffer__","__await__","__aiter__","__anext__","__aenter__","__aexit__","__next__","__fspath__","__post_init__","__copy__","__deepcopy__","__reduce__","__reduce_ex__","__getstate__","__setstate__","__getnewargs__","__getnewargs_ex__","__subclasshook__","__sizeof__","_missing_","_generate_next_value_"]),Fp=new Set(["__getattr__","__dir__"]),Ok=new Set(["property","cached_property","abstractproperty","getter","setter","deleter"]),Pk=e=>e.some(n=>n!==null&&Ok.has(n.split(".").pop()??n)),Op=["__new__","__init__"],jp=new Set(["object","BaseException","Exception","ArithmeticError","AssertionError","AttributeError","BufferError","EOFError","FloatingPointError","ImportError","IndexError","KeyError","LookupError","MemoryError","ModuleNotFoundError","NameError","NotImplementedError","OSError","OverflowError","RecursionError","ReferenceError","RuntimeError","StopAsyncIteration","StopIteration","SystemError","TimeoutError","TypeError","UnboundLocalError","UnicodeError","ValueError","ZeroDivisionError","Warning","UserWarning","DeprecationWarning","RuntimeWarning"]),si=new Set([...jp,"type","dict","list","set","frozenset","tuple","str","bytes","bytearray","int","float","complex"]),Ck=new Map([["keys","any"],["get","mapping"],["close","iterator"]]),Bp=new Set(["excepthook","unraisablehook","displayhook","breakpointhook","__import__"]),Mk=new Map([["dataclass",{module:"dataclasses",name:"dataclass"}],["dataclasses.dataclass",{module:"dataclasses",name:null}],["total_ordering",{module:"functools",name:"total_ordering"}],["functools.total_ordering",{module:"functools",name:null}],["unique",{module:"enum",name:"unique"}],["enum.unique",{module:"enum",name:null}],["final",{module:"typing",name:"final"}],["typing.final",{module:"typing",name:null}]]),Pp=new Map([["ABCMeta",{module:"abc",name:"ABCMeta"}],["abc.ABCMeta",{module:"abc",name:null}],["type",null]]);function Js(e,n){return{path:e,start:n.start,end:n.end}}function Cp(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function Ol(e,n,t,s){let o=[],r=[],i=[],a=[],l=new Map,d=new Map,c=new Map,p=new Map,u=new Map,f=new Map,m=new Map,h=new Map,y=new Map,_=new Map,S=new Set,b=new Set,k=new Set,w=new Map,N=new Set,R=new Map,v=W=>{let q=new Map;for(let F of W)q.set(F,(q.get(F)??0)+1);return q},I=v(e.functions.map(W=>W.qualname)),A=v(e.classes.map(W=>W.qualname)),B=new Map(e.classes.map(W=>[W.qualname,W])),O=Fk(e),V=(W,q)=>q!==void 0&&Dk(W,q,e.moduleBindings,O),E=W=>!W.rebound&&W.decorators.every(q=>q!==null&&V(q,Mk.get(q)))&&(W.metaclass===null||V(W.metaclass,Pp.get(W.metaclass))),D=`${n}#${Il}`,L=qo(e.toplevelFlows,"none",0);o.push({id:D,moduleId:n,name:Il,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1,...L!==null?{valueFlows:L}:{}});let K=new Set,Y=new Set,le=new Set,z=new Map,Z=new Map,de=new Map,x=new Map,M=[];for(let W of e.classes){let q=`${n}#class:${W.qualname}`;W.decorators.length>0&&le.add(q),de.has(q)||de.set(q,W.range.start),c.set(W.qualname,q),_.set(q,W.qualname),W.bases.length>1&&S.add(q),W.interceptsLookup&&b.add(q),w.set(q,W.nonDefBinds),R.set(q,W.valueBases),(!E(W)||A.get(W.qualname)!==1)&&N.add(q),W.metaclass!==null&&!V(W.metaclass,Pp.get(W.metaclass))&&k.add(q);let F=u.get(q),ne=W.valueBases??W.bases;u.set(q,F===void 0?[...ne]:[...F,...ne]);let pe=W.qualname.includes(".")?W.qualname:W.name;if(r.push({id:q,moduleId:n,name:pe,implementsRefs:[],members:[]}),!x.has(q)){let Se=`${n}#<class:${W.qualname}>`;x.set(q,Se),M.push({id:Se,moduleId:n,name:pe,kind:"class",declRange:Js(t,W.range),isExported:!1,publicSurfaceReachable:!1})}}for(let W of e.functions){let q=`${n}#${W.qualname}`;l.set(W.qualname,q),h.set(W.qualname,W.params===null?null:new Set(W.params.map(Q=>Q.name)));let F=W.enclosingClass,ne=F!==null&&W.qualname===`${F}.${W.name}`,pe=ne?c.get(F):void 0,Se=F===null&&W.enclosingFunction===null,Ie=!Se&&!ne&&W.qualname===`${W.enclosingFunction??""}.${W.name}`?W.enclosingFunction:null,$=Se?Cp(W.name,e.all):ne&&!F.includes(".")?Cp(F,e.all):!1,T=ne?B.get(F):void 0,j=I.get(W.qualname)===1&&(T===void 0||A.get(T.qualname)===1)?Lk(W,T===void 0?void 0:E(T),t):null;if(j!==null&&y.set(q,j.kind),z.set(q,W.name),W.decorators.length>0&&Y.add(q),Z.get(q)!=="other"&&Z.set(q,W.decorated),(ne?ri.has(W.name)||Pk(W.decorators):Se&&Fp.has(W.name))&&K.add(q),o.push({id:q,moduleId:n,name:Se||ne?W.name:W.qualname,kind:pe!==void 0?W.name==="__init__"?"ctor":"method":"function",...pe!==void 0?{enclosingClassId:pe}:{},declRange:Js(t,W.range),isExported:$,publicSurfaceReachable:$,...j!==null?j.fields:{}}),Se&&(d.set(W.name,q),$)){let Q=s();i.push({id:Q,moduleId:n,exportedName:W.name,kind:"value"}),a.push({exportId:Q,target:{kind:"function",functionId:q}})}if(ne){let Q=p.get(F)??new Map;Q.set(W.name,q),p.set(F,Q)}if(Ie!==null){let Q=f.get(Ie)??new Map;Q.set(W.name,q),f.set(Ie,Q)}!Se&&!ne&&m.set(W.name,[...m.get(W.name)??[],q])}o.push(...M);let X=r.map(W=>{let q=[...c.entries()].find(([,ne])=>ne===W.id)?.[0],F=q===void 0?void 0:p.get(q);return F===void 0?W:{...W,members:[...F.values()]}});return{moduleId:n,functions:o,classes:X,exports:i,exportBindings:a,byQualname:l,topLevel:d,classByName:c,methods:p,baseSlots:u,nested:f,closures:m,paramNames:h,all:e.all,allComputed:e.allComputed,toplevelId:D,callable:y,moduleBindings:e.moduleBindings,staticBindings:e.staticBindings,aliases:O,classQualname:_,multiBase:S,intercepts:b,customMeta:k,nonDefBinds:w,rewrites:N,valueBases:R,starImport:e.starImport,attrWrites:e.attrWrites,implicitRoots:K,decoratedDefs:Y,decoration:Z,classStarts:de,decoratedClasses:le,defNames:z,classObjects:x,valueNames:e.valueNames,valueAttrs:e.valueAttrs,computedAccess:e.computedAccess,classBinds:e.classBinds,moduleBinds:e.moduleBinds,dunderWrites:e.dunderWrites,moduleCalls:e.moduleCalls,importRenames:e.imports.flatMap(W=>W.form==="from"?W.names.flatMap(q=>q.asname!==null?[[q.asname,q.name]]:[]):[])}}function Tk(e,n){let t=new Set,s=!1;for(let i of e.values())if(i.attrWrites===null)s=!0;else for(let a of i.attrWrites)t.add(a);let o=t.has("__class__")||t.has("__getattribute__"),r=new Map;for(let[i,a]of e){let l=new Map;for(let c of a.functions){let p=a.callable.get(c.id);if(p===void 0||s||c.name!==void 0&&t.has(c.name))continue;let u=p!=="function";u&&o||u&&c.enclosingClassId!==void 0&&n.has(c.enclosingClassId)||l.set(c.id,p)}if(l.size===a.callable.size){r.set(i,a);continue}let d=a.functions.map(c=>{if(!a.callable.has(c.id)||l.has(c.id))return c;let{params:p,receiver:u,reflectiveArguments:f,valueFlows:m,...h}=c;return h});r.set(i,{...a,functions:d,callable:l})}return r}var En={kind:"unknown"},oi={kind:"external"};function Rl(e,n,t,s,o=0,r=new Set){let[i,...a]=e;if(i===void 0||o>Xo)return En;let l=`${n}${e.join(".")}`;if(r.has(l))return En;r.add(l);let d=t.get(n),c=d?.moduleBindings;if(d===void 0||c===void 0||c===null)return En;let p=c.get(i);if(p===void 0)return o===0&&!d.starImport?oi:En;if(p==="class"){let y=a.length===0?d.classByName.get(i):void 0;return y===void 0?En:{kind:"class",id:y}}let u=d.aliases.get(i);if(p!=="import"||u?.rows!==1)return En;let f=s.get(n),m=f?.names.get(i);if(m!==void 0)return Rl([m.name,...a],m.moduleId,t,s,o+1,r);let h=f?.modules.get(i);return h!==void 0?u.exactModule&&a.length>0?Rl(a,h,t,s,o+1,r):En:f?.external?.has(i)===!0?oi:En}function $k(e,n){let t=new Map,s=new Map,o=[],r=(i,a,l)=>{let d=i.get(a);d===void 0?i.set(a,[l]):d.push(l)};for(let[i,a]of e)for(let[l,d]of a.classByName){let c=a.valueBases.get(d);if(c==null){o.push(d);continue}if(l.includes(".")){c.length>0&&o.push(d);continue}let p=!0;for(let u of c){let f=u===null?En:Rl(u.split("."),i,e,n);f.kind==="unknown"&&(p=!1),f.kind==="class"&&(r(t,f.id,d),r(s,d,f.id))}p||o.push(d)}return{sub:t,sup:s,unknown:Ss(o,t)}}function Ss(e,n){let t=new Set,s=[...e];for(let o=s.pop();o!==void 0;o=s.pop())if(!t.has(o)){t.add(o);for(let r of n.get(o)??[])s.push(r)}return t}function Lk(e,n,t){if(e.params===null||e.rebound)return null;let s;if(e.method){if(n!==!0)return null;if(e.decorated==="staticmethod")s="static-method";else if(e.decorated==="classmethod")s="class-method";else if(e.decorated==="none"&&!Rk.has(e.name))s="instance-method";else return null}else{if(e.decorated!=="none")return null;s="function"}let o=e.params;if(s==="instance-method"||s==="class-method"){let i=o[0];if(i===void 0||i.kind!=="positional"&&i.kind!=="positional-only")return null;o=o.slice(1)}let r=qo(e.valueFlows,o.length<e.params.length?"first":"none",e.params.length);return{kind:s,fields:{params:o.map((i,a)=>({index:a,kind:i.kind==="positional-only"?"positional":i.kind,...i.kind==="positional-only"?{}:{name:i.name},destructured:!1,hasDefault:i.hasDefault,range:{path:t,start:i.start,end:i.end}})),receiver:s==="instance-method"||s==="class-method"?"call":"none",reflectiveArguments:e.reflective,...r!==null?{valueFlows:r}:{}}}}function Dk(e,n,t,s){if(t===null)return!1;if(n===null)return!t.has(e);let o=e.split(".")[0]??e,r=s.get(o)?.source;return t.get(o)!=="import"||r===void 0||r.level!==0?!1:n.name===null?r.form==="import"&&r.name===n.module&&o===n.module:r.form==="from"&&r.module===n.module&&r.name===n.name&&o===n.name}function Fk(e){let n=new Map,t=(s,o,r)=>{let i=n.get(s);n.set(s,i===void 0?{rows:1,exactModule:o,...r!==void 0?{source:r}:{}}:{rows:i.rows+1,exactModule:!1})};for(let s of e.imports)for(let o of s.names){let r={form:s.form,module:s.module,level:s.level,name:o.name};s.form==="import"?t(o.asname??o.name.split(".")[0]??o.name,o.asname!==null||!o.name.includes("."),o.asname===null?r:void 0):t(o.asname??o.name,!0,o.asname===null?r:void 0)}return n}function Pl(e){let{envs:n}=e,t=e.children??new Map,s=jk(e.decls,{decls:e.decls,envs:n,children:t}),{inheritEdges:o}=s,r=$k(e.decls,n),i=[];for(let $ of e.decls.values())i.push(...$.customMeta);let a=Ss(i,r.sub),l=new Set(a);if(i.length>0)for(let $ of r.unknown)l.add($);let d=Tk(e.decls,l),c=new Map,p=($,T)=>{let j=c.get($)??[];j.includes(T)||j.push(T),c.set($,j)};for(let $ of d.values()){for(let T of $.methods.values())for(let[j,U]of T)p(j,U);for(let[T,j]of $.closures)for(let U of j)p(T,U)}for(let $ of e.rebinds??[]){let T=d.get($.moduleId)?.topLevel.get($.target);T!==void 0&&p($.attr,T)}let u=new Map;for(let $ of d.values())for(let T of $.classByName.values())u.set(T,$);let f=new Map,m=new Set,h=new Set,y=new Set(a),_=new Map;for(let $ of d.values()){for(let[T,j]of $.callable)f.set(T,j);for(let T of $.multiBase)m.add(T);for(let T of $.intercepts)h.add(T);for(let T of $.rewrites)y.add(T);for(let[T,j]of $.nonDefBinds)_.set(T,j)}let S=$=>{let T=_.get($),j=u.get($),U=j?.classQualname.get($);return T==null||j===void 0||U===void 0?null:new Set([...T,...j.methods.get(U)?.keys()??[]])},b=[],k=new Map;for(let $ of r.unknown){let T=new Set,j=!1;for(let U of Ss([$],r.sup)){let Q=S(U);if(Q===null||y.has(U)||h.has(U)){j=!0;break}for(let te of Q)T.add(te)}if(j){b.push($);continue}for(let U of T){let Q=k.get(U);Q===void 0?k.set(U,[$]):Q.push($)}}let w=$=>{let T=new Map;return j=>{let U=T.get(j);return U===void 0&&(U=Ss([j],$),T.set(j,U)),U}},N={decls:d,envs:n,kindOf:f,classOwner:u,multiBase:m,intercepts:h,rewrites:y,nonDefBinds:_,below:w(r.sub),above:w(r.sup),unplaced:r.unknown,unplacedAnyName:b,unplacedByName:k},R=[],v=[],I=0,A=0,B=new Set,O=!1,V=new Map;for(let $ of d.values()){if($.attrWrites===null)O=!0;else for(let T of $.attrWrites)B.add(T);for(let[T,j]of $.closures)V.set(T,[...V.get(T)??[],...j])}let E=new Set;for(let $ of d.values())for(let T of $.decoratedClasses)E.add(T);let D=new Map;for(let $ of d.values())for(let[T,j]of $.decoration)D.set(T,j);let L={hier:s,rewrites:y,decorated:E},K={byMethodName:c,children:t,selfTargets:Bk(s,c,{installable:$=>O||B.has($),closures:V,intercepts:h}),construct:Uk(L,$=>O||B.has($)),written:$=>O||B.has($),decoration:$=>D.get($)??"other"},Y=new Map;for(let{moduleId:$,call:T}of e.pending){let j=Y.get($);j===void 0?Y.set($,[T]):j.push(T)}let le=e.runtime===void 0?void 0:Rp(e.runtime,{decls:d,envs:n,written:K.written,calls:Y}),z=new Set,Z=new Map,de=[],x=new Map;for(let $ of e.pending){let{moduleId:T,path:j,call:U}=$,Q=d.get(T);if(Q===void 0)continue;if(U.raisedCall!==null){de.push($);continue}let te=U.enclosingFunction===null?Q.toplevelId:Q.byQualname.get(U.enclosingFunction)??Q.toplevelId,ie=Zk(U,T,Q,n.get(T),d,n,K),me=ew(U,T,Q,ie,N),ge=le?.(T,U);ie.how==="name-match"&&ie.resolution!=="unresolved"&&me.direct.size===0&&(ie=ts(ie)),Z.set(`${T}${String(U.range.start)}${String(U.range.end)}`,ie),e.preciseNames!==!1&&ie.how==="name-match"&&ie.resolution==="unresolved"&&ge?.receiverMethod!==void 0&&(ie={ids:[],resolution:"unresolved",how:"name-match"});let Re=`py-call:${T}:${String(I)}`;I+=1,x.set($,Re);let Oe=ie.resolution==="unresolved";Oe&&(A+=1,U.attr!==null&&z.add(U.attr),me=Sn),R.push({id:Re,enclosingFunctionId:te,calleeExprShape:U.receiver===null?"identifier":"member",resolvedTargetIds:Oe?[]:ie.ids,resolution:ie.resolution,range:Js(j,U.range),...tw(j,U,me.convention,ge?.argPrimitive),...ow(ge)});for(let _e of ie.ids)v.push({callSiteId:Re,calleeFunctionId:_e,resolution:Oe?"field-based":ie.resolution,...me.direct.has(_e)?{invocation:"direct"}:{}})}let M=$=>{let T=K.decoration($);return T==="none"||T==="staticmethod"||T==="classmethod"},X=Wk({decls:d,envs:n,hier:s,facts:L,intercepts:h,written:K.written,constructs:($,T)=>Z.get(`${$}${String(T.start)}${String(T.end)}`),certainTarget:M}),W=[];for(let[$,T]of x){let j=X($.moduleId,$.call);j!==void 0&&W.push({site:T,target:j})}if(W.length>0){let $=new Set(W.map(j=>j.site)),T=new Set;for(let j of v)$.has(j.callSiteId)&&T.add(`${j.callSiteId}${j.calleeFunctionId}`);for(let j of W)T.has(`${j.site}${j.target}`)||(T.add(`${j.site}${j.target}`),v.push({callSiteId:j.site,calleeFunctionId:j.target,resolution:"field-based"}))}for(let{moduleId:$,path:T,call:j}of de){let U=d.get($),Q=j.raisedCall;if(U===void 0||Q===null)continue;let te=Z.get(`${$}${String(Q.start)}${String(Q.end)}`);if(te===void 0||te.how==="construct"||te.ids.length===0)continue;let ie=`py-raise:${$}:${String(I)}`;I+=1,A+=1,R.push({id:ie,enclosingFunctionId:j.enclosingFunction===null?U.toplevelId:U.byQualname.get(j.enclosingFunction)??U.toplevelId,calleeExprShape:"unknown",resolvedTargetIds:[],resolution:"unresolved",range:Js(T,j.range)})}let q=new Map;for(let $ of e.loads??[]){let T=[$.moduleId,$.enclosingFunction??"",String($.at),$.shape].join(""),j=q.get(T);if(j===void 0)q.set(T,{load:$,targets:new Set($.targets)});else for(let U of $.targets)j.targets.add(U)}let F=0;for(let{load:$,targets:T}of q.values()){let j=d.get($.moduleId);if(j===void 0)continue;let U=new Set;for(let te of T){let ie=d.get(te)?.toplevelId;ie!==void 0&&U.add(ie)}if(U.size===0)continue;let Q=`py-load:${$.moduleId}:${String(F)}`;F+=1,R.push({id:Q,enclosingFunctionId:$.enclosingFunction===null?j.toplevelId:j.byQualname.get($.enclosingFunction)??j.toplevelId,calleeExprShape:$.shape,resolvedTargetIds:[...U],resolution:"resolved",range:{path:$.path,start:$.at,end:$.at}});for(let te of U)v.push({callSiteId:Q,calleeFunctionId:te,resolution:"resolved"})}let ne=[...d.values()].flatMap($=>$.functions),pe=new Map(ne.map($=>[$.id,$.declRange])),Se=new Set;for(let $ of R)for(let T of $.resolvedTargetIds)Se.add(`${$.enclosingFunctionId}${T}`);for(let[$,T]of d)for(let[j,U]of T.nested){let Q=T.byQualname.get(j);if(Q!==void 0)for(let te of U.values()){let ie=pe.get(te);if(ie===void 0||Se.has(`${Q}${te}`))continue;let me=`py-closure:${$}:${String(I)}`;I+=1,R.push({id:me,enclosingFunctionId:Q,calleeExprShape:"identifier",resolvedTargetIds:[te],resolution:"field-based",range:{path:ie.path,start:ie.start,end:ie.start}}),v.push({callSiteId:me,calleeFunctionId:te,resolution:"field-based"})}}let Ie=($,T,j,U,Q=$.toplevelId)=>{let te=[...new Set(j)];if(te.length===0&&!U)return;let ie=`py-implicit:${$.moduleId}:${String(I)}`;I+=1,U&&(A+=1),R.push({id:ie,enclosingFunctionId:Q,calleeExprShape:"unknown",resolvedTargetIds:U?[]:te,resolution:U?"unresolved":"field-based",range:{path:T.path,start:T.start,end:T.start}});for(let me of te)v.push({callSiteId:ie,calleeFunctionId:me,resolution:"field-based"})};for(let $ of d.values()){for(let U of $.implicitRoots){let Q=pe.get(U);Q!==void 0&&Ie($,Q,[U],!1)}let T=pe.get($.toplevelId)?.path??String($.moduleId),j=(U,Q)=>{let te=n.get($.moduleId),ie=Vk(U,{d:$,env:te,classQual:Q,decls:d,envs:n,facts:L});ie!==null&&Ie($,{path:T,start:U.at},ie.ids,ie.unnamed)};for(let[U,Q]of $.classBinds??[])for(let te of Q)j(te,U);for(let U of $.moduleBinds??[])Fp.has(U.name)&&j(U,null);for(let U of $.dunderWrites??[])(ri.has(U.name)||Bp.has(U.name))&&j(U,null);for(let[U,Q]of $.classByName){let te=$.methods.get(U);for(let[ie,me]of Ck){let ge=te?.get(ie),Re=ge===void 0?void 0:pe.get(ge);if(ge===void 0||Re===void 0)continue;(me==="any"||me==="mapping"&&El(s,Q,Gk).leaves||me==="iterator"&&El(s,Q,si,"__next__").reaches)&&Ie($,Re,[ge],!1)}if(El(s,Q,si).leaves){let ie=$.classStarts.get(Q);ie!==void 0&&Ie($,{path:T,start:ie},[],!0,Kk($,U))}}}for(let $ of d.values()){let T=pe.get($.toplevelId)?.path??String($.moduleId);for(let[j,U]of $.classObjects){let Q=new Set;for(let me of s.basesOf.get(j)??[]){if(me.kind!=="class")continue;let ge=s.classOwner.get(me.id)?.classObjects.get(me.id);ge!==void 0&&ge!==U&&Q.add(ge)}if(Q.size===0)continue;let te=`py-isa:${$.moduleId}:${String(I)}`;I+=1;let ie=$.classStarts.get(j)??0;R.push({id:te,enclosingFunctionId:U,calleeExprShape:"unknown",resolvedTargetIds:[...Q],resolution:"field-based",range:{path:T,start:ie,end:ie}});for(let me of Q)v.push({callSiteId:te,calleeFunctionId:me,resolution:"field-based"})}}return{functions:Xk(d,z),callSites:R,callEdges:v,inheritEdges:o,unresolved:A}}function Gp(e,n){return e===void 0?!1:e.allComputed?!0:e.all!==null?e.all.includes(n):!n.startsWith("_")}function ti(e,n,t,s=0,o=new Set){let[r,...i]=e;if(r===void 0||s>Xo)return En;let a=`${n}${e.join(".")}`;if(o.has(a))return En;o.add(a);let l=t.decls.get(n);if(l===void 0)return En;let d=l.classByName.get(e.join("."));if(d!==void 0)return{kind:"class",id:d};let c=t.envs.get(n),p=c?.names.get(r);if(p!==void 0){let u=ti([p.name,...i],p.moduleId,t,s+1,o);if(u.kind!=="unknown")return u}if(i.length>0){let u=c?.modules.get(r)??t.children.get(n)?.get(r);if(u!==void 0){let f=ti(i,u,t,s+1,o);if(f.kind!=="unknown")return f}}if(c?.external?.has(r)===!0)return oi;for(let u of c?.stars??[]){if(!Gp(t.decls.get(u),r))continue;let f=ti(e,u,t,s+1,o);if(f.kind!=="unknown")return f}return s===0&&l.moduleBindings!==null&&!l.moduleBindings.has(r)&&!l.starImport?oi:En}var Kp=256;function jk(e,n){let t=[],s=new Map,o=new Map,r=new Map,i=new Map,a=[],l=(m,h,y)=>{let _=m.get(h);_===void 0?m.set(h,[y]):_.push(y)};for(let[m,h]of e)for(let[y,_]of h.classByName){i.set(_,h);let S=h.baseSlots.get(_)??[],b=S.map(w=>w===null?En:ti(w.split("."),m,n));y.includes(".")&&S.length>0&&b.push(En),s.set(_,b),b.some(w=>w.kind==="unknown")&&a.push(_);let k=new Set;for(let w of b)w.kind==="class"&&k.add(w.id);for(let w of k)t.push({subclassId:_,superclassId:w,relation:"extends"}),l(o,w,_),l(r,_,w)}let d=Ss(a,o),c=new Map;for(let m of Ss(d,r)){let h=i.get(m),y=h?.classQualname.get(m),_=y===void 0?void 0:h?.methods.get(y);for(let[S,b]of _??[]){let k=c.get(S);k===void 0?c.set(S,[b]):k.push(b)}}let p=new Map,u=(m,h)=>{let y=p.get(m);if(y!==void 0)return y;if(h>Kp)return 2;p.set(m,0);let _=0;for(let b of s.get(m)??[])if(_+=b.kind==="unknown"?1:b.kind==="class"?u(b.id,h+1):0,_>=2)break;let S=Math.min(_,2);return p.set(m,S),S},f=!1;for(let m of d)if(u(m,0)>=2){f=!0;break}return{inheritEdges:t,basesOf:s,subclassesOf:o,classOwner:i,unplacedDefs:c,unplacedMixin:f}}function Cl(e,n,t){let s=e.classOwner.get(n),o=s?.classQualname.get(n);return o===void 0?void 0:s?.methods.get(o)?.get(t)}function Vo(e,n,t){let s=new Set,o=!1,r=!1,i=!1,a=new Set,l=[...n];for(let d=l.pop();d!==void 0;d=l.pop()){if(a.has(d))continue;a.add(d);let c=Cl(e,d,t);c!==void 0&&s.add(c);let p=e.classOwner.get(d),u=p?.nonDefBinds.get(d);if(u===null||u?.has(t)===!0)r=!0;else if(c===void 0){let f=p?.baseSlots.get(d)??[];for(let[m,h]of(e.basesOf.get(d)??[]).entries())h.kind==="class"?l.push(h.id):h.kind==="unknown"?o=!0:(p===void 0||!Ml(jp,f[m],p))&&(i=!0)}}return{ids:s,open:o,alias:r,outside:i}}function Bk(e,n,t){let s=new Map,o=new Map;return(r,i)=>{let a=`${r}${i}`,l=o.get(a);if(l!==void 0)return l;let d=s.get(r);d===void 0&&(d=Ss([r],e.subclassesOf),s.set(r,d));let{ids:c,open:p,alias:u,outside:f}=Vo(e,d,i),m=u,h=k=>{c.has(k)||(c.add(k),m=!0)};for(let k of e.unplacedDefs.get(i)??[])h(k);let y=t.installable(i)?t.closures.get(i)??[]:[];for(let k of y)h(k);let _="self",S;if(p||e.unplacedMixin){let k=new Set([...c,...n.get(i)??[]]);if(k.size<=Dp){if(k.size>c.size||p){for(let w of k)c.add(w);m=!0,_="name-match"}}else p&&(y.length>0||[...d].some(N=>Cl(e,N,i)!==void 0)||(S=xs),m=!0)}let b=!m&&!p&&!f&&!e.unplacedMixin&&!zp(e,d,t.intercepts);return S??=c.size===0?xs:{ids:[...c],resolution:b?c.size===1?"resolved":"field-based":"unresolved",how:_},o.set(a,S),S}}var Gk=new Set([...si].filter(e=>e!=="dict"));function El(e,n,t,s){let o=!1,r=!1,i=new Set,a=[n];for(let l=a.pop();l!==void 0;l=a.pop()){if(i.has(l))continue;i.add(l);let d=e.classOwner.get(l);if(s!==void 0){let p=d?.nonDefBinds.get(l);(Cl(e,l,s)!==void 0||p===null||p?.has(s)===!0)&&(r=!0)}let c=d?.baseSlots.get(l)??[];for(let[p,u]of(e.basesOf.get(l)??[]).entries())u.kind==="class"?a.push(u.id):(u.kind==="unknown"||d===void 0||!Ml(t,c[p],d))&&(o=!0)}return{leaves:o,reaches:o||r}}function Kk(e,n){for(let t=n;t.includes(".");){t=t.slice(0,t.lastIndexOf("."));let s=e.byQualname.get(t);if(s!==void 0)return s}return e.toplevelId}function zp(e,n,t){if(t.size===0)return!1;let s=new Set,o=[...n];for(let r=o.pop();r!==void 0;r=o.pop())if(!s.has(r)){if(s.add(r),t.has(r))return!0;for(let i of e.basesOf.get(r)??[])i.kind==="class"&&o.push(i.id)}return!1}var Ml=(e,n,t)=>typeof n=="string"&&e.has(n)&&t.moduleBindings!==null&&!t.moduleBindings.has(n)&&!t.starImport,zk=(e,n)=>Ml(si,e,n);function Tl(e,n){let t=new Set,s=[e];for(let o=s.pop();o!==void 0;o=s.pop()){if(t.has(o))continue;if(t.add(o),t.size>Kp||n.rewrites.has(o)||n.decorated.has(o))return!1;let r=n.hier.classOwner.get(o);if(r===void 0)return!1;let i=r.baseSlots.get(o)??[];for(let[a,l]of(n.hier.basesOf.get(o)??[]).entries())if(l.kind==="class")s.push(l.id);else if(l.kind==="unknown"||!zk(i[a],r))return!1}return!0}function Uk(e,n){let t=new Map;return s=>{let o=t.get(s);if(o!==void 0)return o;let r=e.hier.classOwner.get(s),i=r?.classQualname.get(s)??"",a=Op.map(p=>Vo(e.hier,[s],p)),l=i!==""&&!Op.some(n)&&!n(i.split(".").pop()??i)&&a.every(p=>!p.open&&!p.alias)&&Tl(s,e),d=r?.classObjects.get(s),c={ids:[...d!==void 0?[d]:[],...a.flatMap(p=>[...p.ids])],resolution:l?a.every(p=>p.ids.size<=1)?"resolved":"field-based":"unresolved",how:"construct",classId:s};return t.set(s,c),c}}function Zs(e,n,t,s,o=0,r=new Set,i=!1){if(o>Xo||r.has(`${e}${n}`))return;r.add(`${e}${n}`);let a=t.get(e),d=(a?.moduleBindings??(i?a?.staticBindings:null))?.get(n);if(d==="class")return a?.classByName.get(n);if(d!=="import"||a?.aliases.get(n)?.rows!==1)return;let c=s.get(e)?.names.get(n);return c===void 0?void 0:Zs(c.moduleId,c.name,t,s,o+1,r,i)}function Mp(e,n,t,s){return Zs(e,n,t,s,0,new Set,!0)}function Wk(e){let n=(o,r,i)=>{if(i>Xo)return;let a=e.decls.get(o),l=a?.moduleBindings?.get(r);if(a===void 0||l===void 0)return;if(l==="import"){let p=a.aliases.get(r)?.rows===1?e.envs.get(o)?.names.get(r):void 0;return p===void 0?void 0:n(p.moduleId,p.name,i+1)}let d=l==="other"?a.moduleCalls?.get(r):void 0,c=d===void 0?void 0:e.constructs(o,d);return c?.how==="construct"?c.classId:void 0},t=new Map,s=o=>{let r=t.get(o);if(r===void 0){let i=e.hier.classOwner.get(o)?.classQualname.get(o),a=Vo(e.hier,[o],"__new__");r=i!==void 0&&!i.includes(".")&&!e.written(i)&&!e.written("__new__")&&a.ids.size===0&&!a.open&&!a.alias&&!a.outside&&Tl(o,e.facts),t.set(o,r)}return r};return(o,r)=>{let i=r.receiver;if(r.attr===null||i===null||i.includes(".")||r.nameScope!=="module"||r.root!=="global"||e.written(i))return;let a=n(o,i,0);if(a===void 0||!s(a)||e.written(r.attr)||e.written("__class__")||e.written("__getattribute__")||zp(e.hier,[a],e.intercepts))return;let l=Vo(e.hier,[a],r.attr);if(l.open||l.alias||l.outside||l.ids.size!==1)return;let[d]=l.ids;return d!==void 0&&e.certainTarget(d)?d:void 0}}function Up(e,n,t){let s=n.aliases.get(e);return!e.includes(".")&&n.moduleBindings?.get(e)==="import"&&s?.rows===1&&s.exactModule?t?.modules.get(e):void 0}function Hk(e,n){let t=e.split(".");for(let s=t.length-1;s>0;s-=1)if(n.byQualname.has(t.slice(0,s).join(".")))return!0;return!1}function Al(e,n,t){let[s,...o]=n;if(s===void 0||o.length>0||!Tl(e,t))return null;let r=Vo(t.hier,[e],s);return r.open||r.alias?null:[...r.ids]}function qk(e,n){let[t,...s]=e.split("."),{d:o,env:r,classQual:i}=n;if(t===void 0||t==="")return null;if(i!==null){if(Hk(i,o))return null;let m=o.classByName.get(i),h=m===void 0?null:o.nonDefBinds.get(m)??null;if(h===null||h.has(t))return null;let y=o.methods.get(i)?.get(t);if(y!==void 0)return s.length===0?[y]:null}let a=o.moduleBindings?.get(t);if(o.moduleBindings===null)return null;if(a===void 0)return o.starImport||o.topLevel.has("__getattr__")?null:[];if(a==="def"){let m=o.topLevel.get(t);return m!==void 0&&s.length===0?[m]:null}if(a==="class"){let m=o.classByName.get(t);return m===void 0?null:Al(m,s,n.facts)}if(a!=="import"||o.aliases.get(t)?.rows!==1)return null;let l=r?.names.get(t);if(l!==void 0){let m=s.length===0?lt(l.moduleId,l.name,n.decls,n.envs,!0):void 0;if(m!==void 0)return[m];let h=Zs(l.moduleId,l.name,n.decls,n.envs);return h===void 0?null:Al(h,s,n.facts)}let d=Up(t,o,r),[c,...p]=s;if(d===void 0||c===void 0)return null;let u=p.length===0?lt(d,c,n.decls,n.envs,!0):void 0;if(u!==void 0)return[u];let f=Zs(d,c,n.decls,n.envs);return f===void 0?null:Al(f,p,n.facts)}function Vk(e,n){let t=e.value;if(t.kind==="const"||t.kind==="lambda"||t.kind!=="property"&&!ri.has(e.name)&&!Bp.has(e.name))return null;if(t.kind==="other")return{ids:[],unnamed:!0};let s=t.kind==="name"?[t.dotted]:t.accessors.flatMap(i=>i.kind==="name"?[i.dotted]:i.kind==="other"?[null]:[]),o=[],r=!1;for(let i of s){let a=i===null?null:qk(i,n);a===null?r=!0:o.push(...a)}return{ids:o,unnamed:r}}function Xk(e,n){let t=!1,s=new Set(n),o=new Map;for(let i of e.values()){(i.computedAccess||i.valueNames===null||i.valueAttrs===null)&&(t=!0);for(let a of i.valueNames??[])s.add(a);for(let a of i.valueAttrs??[])s.add(a);for(let[a,l]of i.importRenames){let d=o.get(a);d===void 0?o.set(a,[l]):d.push(l)}}let r=[...s];for(let i=r.pop();i!==void 0;i=r.pop())for(let a of o.get(i)??[])s.has(a)||(s.add(a),r.push(a));return[...e.values()].flatMap(i=>i.functions.map(a=>{let l=i.defNames.get(a.id)??"",d=a.id!==i.toplevelId&&(t||a.kind==="class"||a.enclosingClassId!==void 0||s.has(l)||i.decoratedDefs.has(a.id));return{...a,addressTaken:d}}))}function lt(e,n,t,s,o=!1,r=new Set,i=0){if(i>Xo)return;let a=`${e}${n}`;if(r.has(a))return;r.add(a);let l=t.get(e),d=l?.moduleBindings?.get(n),c=l?.topLevel.get(n);if(c!==void 0)return!o||d==="def"?c:void 0;let p=s.get(e),u=p?.names.get(n);if(u!==void 0)return o&&(d!=="import"||l?.aliases.get(n)?.rows!==1)?void 0:lt(u.moduleId,u.name,t,s,o,r,i+1);if(!o)for(let f of p?.stars??[]){if(!Gp(t.get(f),n))continue;let m=lt(f,n,t,s,!1,r,i+1);if(m!==void 0)return m}}var xs={ids:[],resolution:"unresolved",how:"none"};function Nl(e,n){let t=n.byMethodName.get(e)??[];return t.length===0||t.length>Dp?xs:{ids:t,resolution:"field-based",how:"name-match"}}function Yk(e,n,t){for(let s=n;s!==null&&s!=="";){if(t.byQualname.has(s)){let r=t.nested.get(s)?.get(e);if(r!==void 0)return{kind:"def",id:r};if(t.paramNames.get(s)?.has(e)===!0)return{kind:"param"}}let o=s.lastIndexOf(".");s=o<0?null:s.slice(0,o)}return{kind:"none"}}function Jk(e,n,t,s){let[o,...r]=e.split(".");if(o===void 0||o==="")return;let i=n?.modules.get(o);for(let a of r){if(i===void 0)return;i=t.get(i)?.modules.get(a)??s.get(i)?.get(a)}return i}function Zk(e,n,t,s,o,r,i){let a=e.attr,l=e.nameScope;if(a===null){if(e.callee===null||e.receiver!==null)return xs;let p=e.callee,u=Yk(p,e.enclosingFunction,t);if(l==="local-def"&&u.kind==="def")return ni({ids:[u.id],resolution:"resolved",how:"local"},i,null);let f=Qk(p,u,n,t,s,o,r);if(l!=="module")return ts(f);let m=lt(n,p,o,r,!0);if(m!==void 0&&f.ids[0]===m)return ni({ids:[m],resolution:"resolved",how:"bare"},i,p);if(f.ids.length>0)return ts(f);let h=Zs(n,p,o,r);if(h!==void 0)return i.construct(h);let y=Mp(n,p,o,r);return y===void 0?xs:Tp(i.construct(y))}if(e.receiver===null)return Nl(a,i);let d=e.receiver;if(Ik.has(d)&&e.enclosingFunction!==null){let p=e.enclosingFunction.split(".").slice(0,-1).join("."),u=t.classByName.get(p);if(u!==void 0){let f=i.selfTargets(u,a),m=t.byQualname.get(e.enclosingFunction),h=m===void 0?"other":i.decoration(m),y=e.root==="param0"&&(h==="none"||h==="classmethod");return f.resolution==="unresolved"||!y?ts(f):ni(f,i,a)}}let c=Jk(d,s,r,i.children);if(c!==void 0){let p=d.split("."),u=p[0]??d,f=l==="module"&&t.moduleBindings?.get(u)==="import"&&t.aliases.get(u)?.rows===1&&p.slice(1).every(b=>!i.written(b)),m=lt(c,a,o,r);if(m!==void 0){let b={ids:[m],resolution:"resolved",how:"module"};return f&&lt(c,a,o,r,!0)===m?ni(b,i,a):ts(b)}let h=Nl(a,i),y=f&&Up(d,t,s)===c,_=y?Zs(c,a,o,r):void 0;if(_===void 0){let b=y?Mp(c,a,o,r):void 0;if(b===void 0)return ts(h);let k=Tp(i.construct(b));return h.ids.length===0?k:{ids:[...new Set([...k.ids,...h.ids])],resolution:"unresolved",how:"construct"}}let S=i.construct(_);return h.ids.length===0?S:{ids:[...new Set([...S.ids,...h.ids])],resolution:S.resolution==="unresolved"?"unresolved":"field-based",how:"construct",classId:_}}return Nl(a,i)}function Qk(e,n,t,s,o,r,i){if(n.kind==="def")return{ids:[n.id],resolution:"resolved",how:"local"};let a=s.topLevel.get(e);if(a!==void 0)return{ids:[a],resolution:"resolved",how:"bare"};let l=o?.names.get(e),d=l!==void 0?lt(l.moduleId,l.name,r,i):lt(t,e,r,i);return d!==void 0?{ids:[d],resolution:"resolved",how:"bare"}:xs}function ts(e){return e.ids.length===0?xs:{...e,resolution:"unresolved"}}function Tp(e){let{classId:n,...t}=e;return ts(t)}function ni(e,n,t){return e.ids.some(o=>{let r=n.decoration(o);return r!=="none"&&r!=="staticmethod"&&r!=="classmethod"})||t!==null&&n.written(t)?ts(e):e}var Sn={direct:new Set,convention:"unknown"};function $p(e,n,t){return e!==void 0&&n.ids.length===1&&n.ids[0]===e&&t.get(e)==="function"?{direct:new Set([e]),convention:"direct"}:Sn}function Lp(e){return e.length>0&&e.every(n=>n==="instance-method")?"shifted":e.length>0&&e.every(n=>n==="class-method"||n==="static-method")?"direct":"unknown"}function ew(e,n,t,s,o){if(e.root!==(s.how==="self"?"param0":"global"))return Sn;let r=o.envs.get(n);switch(s.how){case"bare":return e.callee===null?Sn:$p(lt(n,e.callee,o.decls,o.envs,!0),s,o.kindOf);case"module":{let i=e.receiver===null?void 0:t.aliases.get(e.receiver),a=e.receiver===null?void 0:r?.modules.get(e.receiver);return e.receiver===null||e.attr===null||a===void 0||t.moduleBindings?.get(e.receiver)!=="import"||i?.rows!==1||!i.exactModule?Sn:$p(lt(a,e.attr,o.decls,o.envs,!0),s,o.kindOf)}case"self":{let i=e.attr,a=e.enclosingFunction===null?void 0:t.byQualname.get(e.enclosingFunction),l=a===void 0?void 0:o.kindOf.get(a);if(i===null||l!=="instance-method"&&l!=="class-method")return Sn;let d=(e.enclosingFunction??"").split(".").slice(0,-1).join("."),c=t.classByName.get(d),p=t.methods.get(d)?.get(i);if(c===void 0||p===void 0||!s.ids.includes(p))return Sn;let u=[];for(let y of s.ids){let _=o.kindOf.get(y);if(_===void 0||_==="function")return Sn;u.push(_)}let f=o.below(c),m=o.above(c);for(let y of f){if(y===c)continue;let _=o.nonDefBinds.get(y);if(o.multiBase.has(y)||o.rewrites.has(y)||o.intercepts.has(y)||_===void 0||_===null||_.has(i))return Sn;let S=o.classOwner.get(y),b=S?.classQualname.get(y),k=b===void 0?void 0:S?.methods.get(b)?.get(i);if(k!==void 0&&!s.ids.includes(k))return Sn}for(let y of m)if(o.intercepts.has(y))return Sn;if(o.unplaced.has(c)&&o.intercepts.size>0)return Sn;let h=y=>f.has(y)||m.has(y);return o.unplacedAnyName.some(y=>!h(y))||(o.unplacedByName.get(i)??[]).some(y=>!h(y))?Sn:{direct:new Set(s.ids),convention:l==="instance-method"?"direct":Lp(u)}}case"name-match":{let i=e.receiver===null||e.receiver.includes(".")?void 0:nw(e.receiver,t,r,o.decls),a=i===void 0?void 0:o.classOwner.get(i),l=i===void 0?void 0:a?.classQualname.get(i),d=l===void 0||e.attr===null?void 0:a?.methods.get(l)?.get(e.attr),c=d===void 0?void 0:o.kindOf.get(d);return d===void 0||c===void 0||c==="function"||!s.ids.includes(d)?Sn:{direct:new Set([d]),convention:Lp([c])}}default:return Sn}}function nw(e,n,t,s){let o=n.moduleBindings?.get(e);if(o==="class")return n.classByName.get(e);let r=t?.names.get(e);if(o!=="import"||r===void 0||n.aliases.get(e)?.rows!==1)return;let i=s.get(r.moduleId);return i?.moduleBindings?.get(r.name)==="class"?i.classByName.get(r.name):void 0}function tw(e,n,t,s=[]){let o=n.args,r=t==="shifted"&&o?.[0]?.kind!=="positional"?"unknown":t;return{...o!==null?{args:o.map((i,a)=>sw(e,i,a,s[a]===!0)),convention:r}:{},...n.receiverRange!==null?{receiverRange:Js(e,n.receiverRange)}:{},repeats:n.repeats}}function sw(e,n,t,s){return{index:t,...n.kind==="keyword"&&n.keyword!==void 0?{keyword:n.keyword}:{},spread:n.kind==="star"?"positional":n.kind==="double-star"?"keyword":!1,range:Js(e,n),...s?{primitive:!0}:{}}}function ow(e){return e===void 0?{}:{calleeDecl:e.calleeDecl,...e.runtimeId!==void 0?{runtimeId:e.runtimeId}:{},...e.summary!==void 0?{summary:e.summary}:{},...e.receiverPrimitive===!0?{receiverPrimitive:!0}:{}}}var rw=8,iw=new Set(["__new__","__init_subclass__","__class_getitem__"]),ii=e=>e.map(n=>n.name+"()".repeat(n.calls)).join(".");function aw(e){let n=/^(~|\.*)(.*)$/u.exec(e);if(n===null)return null;let t=[];for(let s of(n[2]??"").split(".")){let o=s.replace(/(?:\(\))+$/u,"");if(o==="")return null;t.push({name:o,calls:(s.length-o.length)/2})}return{lead:n[1]??"",segs:t}}function lw(e){let n=new Map,t=e.moduleBindings;if(t===null)return n;for(let s of e.imports)if(!(s.enclosingFunction!==null||s.guards.includes("type-checking")))for(let o of s.names){let r=o.name.split(".")[0]??o.name,i=o.asname??(s.form==="import"?r:o.name);if(t.get(i)!=="import")continue;let a=s.form==="import"?o.asname!==null?o.name:r:`${".".repeat(s.level)}${s.module!==null&&s.module!==""?`${s.module}.`:""}${o.name}`;n.set(i,a)}return n}function Vp(e,n){let t=new Map;for(let[f,m]of n.modules){let h=new Map;for(let _ of m.file.functions)h.set(_.qualname,(h.get(_.qualname)??0)+1);let y=new Map(m.file.functions.filter(_=>h.get(_.qualname)===1).map(_=>[_.qualname,_]));t.set(f,{...m,id:f,imports:lw(m.file),rows:y})}let s=(f,m,h=0)=>{if(h>rw)return null;let y=aw(f);if(y===null)return null;if(y.lead==="~"){let[S,...b]=y.segs;return S===void 0?null:o(m,S,b,h)}let _=y.segs;if(y.lead.length>0){let S=Qr(m.dotted,m.isPackage),b=S===""?[]:S.split("."),k=y.lead.length-1;if(k>=b.length)return null;_=[...b.slice(0,b.length-k).map(w=>({name:w,calls:0})),..._]}for(let S=_.length;S>=1;S-=1){if(_.slice(0,S).some(N=>N.calls>0))continue;let b=n.byDotted.get(ii(_.slice(0,S)));if(b===void 0)continue;let k=t.get(b);if(k===void 0||!k.app)return{kind:"name",text:ii(_)};let w=_[S];return w===void 0?null:o(k,w,_.slice(S+1),h)}return{kind:"name",text:ii(_)}},o=(f,m,h,y)=>{let _="()".repeat(m.calls)+h.map(N=>`.${ii([N])}`).join(""),S=f.file.moduleOrigins?.get(m.name);if(S!==void 0)return s(S+_,f,y+1);let b=f.imports.get(m.name);if(b!==void 0)return s(b+_,f,y+1);let k=f.file.moduleBindings?.get(m.name);if(k==="def"&&m.calls===0){let N=f.decls.topLevel.get(m.name),R=f.rows.get(m.name);return N===void 0||R===void 0?null:{kind:"function",module:f,id:N,row:R,rest:h}}if(k==="class"&&f.decls.classByName.has(m.name))return{kind:"class",module:f,qualname:m.name,calls:m.calls,rest:h};let w=f.file.annotatedAliases?.get(m.name);return w!==void 0&&m.calls===0&&h.length===0?{kind:"annotated",module:f,value:w}:null},r=(f,m)=>{if(f===null)return null;let h=s(f,m);return h?.kind==="name"?h.text:null},i=(f,m)=>f!==null&&m.includes(f),a=(f,m,h)=>f!==null&&m.some(y=>h.some(_=>f===`${y}.${_}()`)),l=new Map,d=new Set,c=(f,m,h)=>{let y=l.get(f);y===void 0?l.set(f,{row:m,regs:[h]}):y.regs.push(h)};for(let f of t.values()){for(let m of f.file.functions){let h=m.decoratorFacts;if(h===null||h.length===0||m.method||m.params===null)continue;let y=f.decls.byQualname.get(m.qualname);if(y===void 0||f.rows.get(m.qualname)!==m)continue;let _=h.map(b=>r(b.origin,f)),S=b=>{let k=_[b]??null;return a(k,Bn.apps,Bn.decorators)?Bn:a(k,Xn.apps,Xn.decorators)?Xn:null};h.forEach((b,k)=>{let w=S(k);if(w===null)return;d.add(y);for(let v=k+1;v<h.length;v+=1)if(S(v)===null)return;let N={path:f.path,start:b.start,end:b.end},R=w===Bn?Wp(m,f,s):Hp(m,b.rule);c(y,m,{model:w,at:N,params:R,form:"decorator"})})}for(let m of f.file.calls){let h=m.registration;if(h===null||m.args===null||m.args.length!==h.args.length)continue;let y=r(h.callee,f);if(y===null)continue;let _={path:f.path,start:m.range.start,end:m.range.end},S=(k,w)=>dw(m,k,w),b=k=>{let w=k===null?null:h.args[k]?.origin??null,N=w===null?null:s(w,f);return N?.kind!=="function"||N.rest.length!==0?null:(N.row.decoratorFacts??[null]).length===0?{id:N.id,row:N.row,ctx:N.module}:null};if(Bn.apps.some(k=>y===`${k}.${Bn.addRoute}`)){let k=b(S("endpoint",1));k!==null&&c(k.id,k.row,{model:Bn,at:_,params:Wp(k.row,k.ctx,s),form:"call"})}else if(Xn.apps.some(k=>y===`${k}.${Xn.addRule}`)){let k=b(S("view_func",2)),w=S("rule",0);k!==null&&c(k.id,k.row,{model:Xn,at:_,params:Hp(k.row,w===null?null:h.args[w]?.literal??null),form:"call"})}else if(i(y,vn.paths)||i(y,vn.regexes)){let k=i(y,vn.regexes),w=S("route",0),N=w===null?null:h.args[w]?.literal??null,R=S("view",1),v=R===null?null:h.args[R]?.origin??null,I=v===null?null:s(v,f);if(I?.kind==="function"&&I.rest.length===0&&hw(I.row,I.module,r))c(I.id,I.row,{model:vn,at:_,params:qp(I.row,0,N,k),form:"call"});else if(I?.kind==="class"&&I.calls===0&&I.rest.length===1&&I.rest[0]?.name==="as_view"&&I.rest[0].calls===1){let A=I.module.decls.methods.get(I.qualname);for(let B of vn.methods){let O=A?.get(B),V=I.module.rows.get(`${I.qualname}.${B}`);O===void 0||V===void 0||V.decorated!=="none"||c(O,V,{model:vn,at:_,params:qp(V,1,N,k),form:"call"})}}}}}let p=[];for(let[f,{regs:m}]of l)for(let h of m)p.push({handler:f,at:h.at,form:h.form});return{functions:e.map(f=>{let m=l.get(f.id),h=m?.row??cw(f,t),y=f;if(m!==void 0){let _=fw(m.row,m.regs);_.length>0&&(y={...y,sourceParams:_})}if(y.valueFlows===void 0&&h!==void 0&&h.valueFlows!==null){let S=m!==void 0||d.has(f.id)||h.valueFlows.some(b=>b.from.kind==="source")?uw(h):null;S!==null&&(y={...y,valueFlows:S})}return y}),registrations:p}}function dw(e,n,t){let s=e.args??[],o=s.findIndex(i=>i.kind==="keyword"&&i.keyword===n);if(o>=0)return o;let r=0;for(let i=0;i<s.length;i+=1){let a=s[i];if(a===void 0)break;if(a.kind==="star"||a.kind==="double-star")return null;if(a.kind==="positional"){if(r===t)return i;r+=1}}return null}function cw(e,n){let t=n.get(e.moduleId);if(t===void 0)return;let s=e.id.slice(`${e.moduleId}#`.length);return t.decls.byQualname.get(s)===e.id?t.rows.get(s):void 0}function uw(e){if(e.params===null)return null;let n;if(!e.method)n="none";else if(e.decorated==="staticmethod")n="none";else if(e.decorated==="none"&&!iw.has(e.name)||e.decorated==="classmethod")n="first";else return null;if(n==="first"){let t=e.params[0];if(t===void 0||t.kind!=="positional"&&t.kind!=="positional-only")return null}return qo(e.valueFlows,n,e.params.length)}function fw(e,n){let t=e.method&&e.decorated!=="staticmethod"?1:0,s=new Map,o=[...n].sort((r,i)=>r.at.path.localeCompare(i.at.path)||r.at.start-i.at.start);for(let r of o)for(let i of[...r.params].sort((a,l)=>a-l)){let a=i-t;a<0||s.has(a)||s.set(a,{index:a,sourceClass:r.model.sourceClass,model:r.model.id,registeredAt:r.at})}return[...s.values()].sort((r,i)=>r.index-i.index)}function Wp(e,n,t){let s=new Set,o=(a,l)=>{if(a===null)return null;let d=t(a,l);return d?.kind==="name"?d.text:null},r=(a,l)=>a!==null&&Bn.depends.includes(o(a.callee,l)??""),i=(a,l)=>Bn.schemes.includes(o(a.arg0,l)??"");return(e.params??[]).forEach((a,l)=>{let d=e.paramFacts?.[l]??null;if(d===null){s.add(l);return}let c=d.annotated!==null?{value:d.annotated,from:n}:null;if(c===null&&d.annotation!==null){let f=t(d.annotation,n);f?.kind==="annotated"&&(c={value:f.value,from:f.module})}let p=c!==null?o(c.value.type,c.from):o(d.annotation,n),u=[];r(d.default,n)&&d.default!==null&&u.push({call:d.default,from:n});for(let f of c?.value.meta??[])f!==null&&c!==null&&r(f,c.from)&&u.push({call:f,from:c.from});if(u.length>0){u.some(m=>i(m.call,m.from)||m.call.arg0===null&&Bn.forms.includes(p??""))&&s.add(l);return}Bn.injected.includes(p??"")||s.add(l)}),s}var pw=/<(?:[a-zA-Z_][a-zA-Z0-9_]*(?:\([^)]*\))?:)?([a-zA-Z_][a-zA-Z0-9_]*)>/gu;function Hp(e,n){let t=n===null?null:new Set([...n.matchAll(pw)].map(s=>s[1]));return Xp(e,0,t)}function qp(e,n,t,s){let o=e.params??[],r=o[n];if(r===void 0||r.kind!=="positional"&&r.kind!=="positional-only")return new Set;let i=new Set([n]);if(t===null)return o.forEach((c,p)=>{p>n&&i.add(p)}),i;let a=s?[...t.matchAll(/\(\?P<([^>]+)>/gu)].map(c=>c[1]):[...t.matchAll(/<(?:[^>:]+:)?([^>]+)>/gu)].map(c=>c[1]);if(a.length>0){for(let c of Xp(e,n+1,new Set(a)))i.add(c);return i}let l=s?[...t.matchAll(/(?<!\\)\((?!\?)/gu)].length:0,d=0;return o.forEach((c,p)=>{p<=n||d>=l||(c.kind==="positional"||c.kind==="positional-only"?(i.add(p),d+=1):c.kind==="rest"&&(i.add(p),d=l))}),i}function Xp(e,n,t){let s=new Set,o=t===null||t.size>0;return(e.params??[]).forEach((r,i)=>{i<n||(r.kind==="keyword-rest"?o&&s.add(i):(r.kind==="positional"||r.kind==="keyword-only")&&(t===null||t.has(r.name))&&s.add(i))}),s}var mw=new Set([...vn.passThrough,vn.apiView,...vn.apiViewSetters]);function hw(e,n,t){let s=e.decoratorFacts;return s===null?!1:s.every(o=>mw.has(t(o.origin,n)??""))}var gw=5e3,Yp=200,Jp=100,yw=new Set(["args","params","flows"]),Zp={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Qp(e){return`pkg:${e}`}function wt(e){return e.split(/[\\/]+/u).join("/")}function $l(e,n){let t=e.endsWith("/")?e:`${e}/`,s=wt(n),o=wt(t);return s.startsWith(o)?s.slice(o.length):null}function em(e){let n=wt(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let s=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),s].filter(o=>o!=="").join("."),isPackage:!1}}function Ll(e){return e.split(".")[0]??e}var _w="site-packages:";function Dl(e){let n=e.extract??ai,t=e.maxModules??gw,s=(e.externalRoots??[]).map(T=>wt(T).endsWith("/")?wt(T):`${wt(T)}/`),o=T=>{let j=wt(T);return s.find(U=>j.startsWith(U))??null},r=T=>o(T)!==null,i=[],a=new Map,l=[],d=[],c=new Set,p=new Set,u=new Map,f=new Map,m=[],h=[],y=new Map,_=new Set,S=new Set,b=[],k=0,w=()=>{let T=`py-export:${String(k)}`;return k+=1,T},N=null,R=!1,v=new Set,I=new Set,A=new Map,B=new Map,O=xp(T=>{let j=Dt(e.paths,T).resolved;return j!==null&&$l(e.projectRoot,j.path)!==null&&!r(j.path)}),V=new Map,E=[];for(let T of e.entryFiles){let j=$l(e.projectRoot,T);if(j===null){i.push({code:"unresolved-import",where:wt(T),detail:"entrypoint lies outside the project root; not analyzed"});continue}c.has(T)||(c.add(T),E.push({file:T,rel:j,isEntry:!0,packageName:"",modulePath:j}))}let D=T=>{let j=Qp(T);return a.has(j)||(p.add(T),a.set(j,{id:j,packageName:T,versionRange:"",path:T,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),j},L=0,K=(T,j,U,Q)=>{let te=`py-import:${String(L)}`;L+=1,l.push({id:te,moduleId:T,specifier:j,...U!==null?{resolvedModuleId:U}:{},isNamespace:!1,isDefault:!1,dynamic:Q,specifierIsLiteral:!0}),U!==null&&d.push({importId:te,resolvedModuleId:U})};for(let T=0;T<Jp&&E.length>0;T+=1){let j=E.slice(0,Yp);E=E.slice(Yp);let U=n(j.map(te=>te.file),e.python!==void 0?{python:e.python,hints:O}:{hints:O});if(N??=U.interpreter,v.size===0&&U.stdlib.length>0&&(v=new Set(U.stdlib)),I.size===0&&U.builtins.length>0&&(I=new Set(U.builtins)),A.size===0&&U.typeAttrs.size>0&&(A=U.typeAttrs),U.refused!==null)return i.push({code:"extract-refused",where:"",detail:`${U.refused}: ${U.diagnostics.join("; ")}`}),{graph:Zp,diagnostics:i,interpreter:U.interpreter,counts:{modules:0,surfaces:0},opaqueCode:[]};let Q=new Map(U.files.map(te=>[te.path,te]));for(let te of j){let ie=Q.get(te.file),me=te.rel,ge=em(te.modulePath);if(B.set(me,ge),a.set(me,{id:me,packageName:te.packageName,versionRange:"",path:te.modulePath,moduleSystem:"dual",isEntrypoint:te.isEntry}),ie===void 0||ie.refused!==null){i.push({code:"file-refused",where:te.rel,detail:ie?.refused??"no row was returned for this file"});continue}Y(ie,me,ge),x(ie,te.rel);let Re=ie.truncated.filter(Oe=>!yw.has(Oe));Re.length>0&&i.push({code:"extract-truncated",where:te.rel,detail:`the extract stopped at its per-file bound for ${Re.join(", ")}; what lies past it is not in this graph`}),u.set(me,Ol(ie,me,te.rel,w)),f.set(me,de(ie,me,ge)),V.set(me,{file:ie,decls:u.get(me),dotted:ge.dotted,isPackage:ge.isPackage,app:te.packageName==="",path:te.rel});for(let Oe of ie.calls)m.push({moduleId:me,path:te.rel,call:Oe});for(let Oe of ie.escapes){if(Oe.kind!=="attr-rebind")continue;let _e=Oe.attr??null;_e===null||Oe.target===null||b.push({moduleId:me,attr:_e,target:Oe.target})}}}function Y(T,j,U){for(let Q of T.imports){if(Q.guards.includes("type-checking"))continue;let te=[];if(Q.level>0){let ge=qs(U.dotted,U.isPackage,Q.level,Q.module);if("failure"in ge){i.push({code:"unresolved-import",where:T.path,detail:`relative import (level ${String(Q.level)}) ${ge.failure}`});continue}te.push(ge.dotted);for(let Re of Q.names)te.push(`${ge.dotted}.${Re.name}`)}else if(Q.module!==null){te.push(Q.module);for(let ge of Q.names)te.push(`${Q.module}.${ge.name}`)}else continue;let ie=!1,me=new Set;for(let ge of te)le(ge,j,Q.deferred,me)&&(ie=!0);if(me.size>0&&h.push({moduleId:j,path:j,enclosingFunction:Q.enclosingFunction,at:Q.range.start,shape:"require",targets:[...me]}),!ie){let ge=te[0]??"";K(j,ge,null,Q.deferred);let Re=Ll(ge);if(v.has(Re)||Q.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf(Re)===null)continue;i.push({code:"unresolved-import",where:T.path,detail:`\`${ge}\` did not resolve on the search path`})}}}function le(T,j,U,Q){let te=T.split("."),ie=!1;for(let me=1;me<=te.length;me+=1){let ge=te.slice(0,me).join("."),Re=Dt(e.paths,ge);if(Re.resolved===null)continue;let Oe=Z(Re.resolved,j,ge,U);Oe!==null&&Q.add(Oe),me===te.length&&(ie=!0)}return ie}function z(T){return c.has(T.file)||a.has(T.rel)?!0:c.size>=t?(R||(R=!0,i.push({code:"module-cap",where:T.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(c.add(T.file),E.push(T),!0)}function Z(T,j,U,Q){if(T.kind==="stub-only")return null;let te=T.kind==="module"||T.kind==="package",ie=$l(e.projectRoot,T.path);if(ie!==null&&!r(T.path)&&te){let Oe=ie;return K(j,U,Oe,Q),y.set(U,Oe),z({file:T.path,rel:ie,isEntry:!1,packageName:"",modulePath:ie}),Oe}let me=e.distributionOf(Ll(U));if(me===null)return K(j,U,null,Q),i.push({code:"unresolved-import",where:U,detail:`resolved to ${T.kind} outside the project, but no installed distribution provides \`${Ll(U)}\``}),null;let ge=o(T.path);if(!te||ge===null)return K(j,U,D(me),Q),_.add(U),(T.kind==="extension"||te&&ge===null)&&S.add(U),null;let Re=`${_w}${wt(T.path).slice(ge.length)}`;return K(j,U,Re,Q),y.set(U,Re),z({file:T.path,rel:Re,isEntry:!1,packageName:me,modulePath:wt(T.path).slice(ge.length)}),Re}function de(T,j,U){let Q=new Map,te=new Map,ie=new Set,me=new Map,ge=(_e,Ge)=>{ie.add(_e),me.set(_e,Ge)},Re=[],Oe=_e=>v.has(_e.split(".")[0]??_e)||_.has(_e);for(let _e of T.imports){if(_e.guards.includes("type-checking"))continue;let Ge=_e.module;if(_e.level>0){let Ue=qs(U.dotted,U.isPackage,_e.level,_e.module);if("failure"in Ue)continue;Ge=Ue.dotted}if(Ge!==null){if(_e.star){let Ue=y.get(Ge);Ue!==void 0&&!Re.includes(Ue)&&Re.push(Ue)}if(_e.form==="import"){let Ue=_e.names[0]?.asname??null;if(Ue!==null){let G=y.get(Ge);G!==void 0?Q.set(Ue,G):Oe(Ge)&&ge(Ue,Ge);continue}let In=Ge.split(".")[0]??Ge,Kn=y.get(In)??y.get(Ge);Kn!==void 0?Q.set(In,Kn):Oe(In)&&ge(In,In);continue}for(let Ue of _e.names){let In=Ue.asname??Ue.name,Kn=y.get(`${Ge}.${Ue.name}`);if(Kn!==void 0){Q.set(In,Kn);continue}let G=y.get(Ge);G!==void 0?te.set(In,{moduleId:G,name:Ue.name}):(Oe(Ge)||Oe(`${Ge}.${Ue.name}`))&&ge(In,`${Ge}.${Ue.name}`)}}}return Q.set("",j),{modules:Q,names:te,external:ie,externalOrigins:me,stars:Re}}function x(T,j){for(let U of T.escapes)switch(U.kind){case"loader-escape":i.push({code:"loader-escape",where:j,detail:`${U.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":i.push({code:"dynamic-load-set",where:j,detail:`${U.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":i.push({code:"module-registry-write",where:j,detail:`${U.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let Q=U.target;if(Q===null)break;let te=new Set;le(Q,j,!0,te),te.size>0&&h.push({moduleId:j,path:j,enclosingFunction:U.enclosingFunction,at:U.range.start,shape:"dynamic-import",targets:[...te]});break}case"dispatch-escape":break}}E.length>0&&i.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(Jp)} waves; the graph is INCOMPLETE`});let M=new Map;for(let[T,j]of y){let U=T.lastIndexOf(".");if(U<0)continue;let Q=y.get(T.slice(0,U));if(Q===void 0||Q===j)continue;let te=M.get(Q)??new Map;te.set(T.slice(U+1),j),M.set(Q,te)}let X=Pl({decls:u,envs:f,pending:m,rebinds:b,loads:h,children:M,preciseNames:e.preciseNames!==!1,runtime:{builtins:I,typeAttrs:A,stdlib:v,placed:T=>{let j=y.get(T);return j!==void 0?{kind:"module",id:j}:_.has(T)?{kind:"surface"}:null},packageOf:T=>a.get(T)?.packageName,dottedOf:T=>B.get(T)}}),{functions:W,registrations:q}=Vp(X.functions,{modules:V,byDotted:y}),F=new Map;for(let T of X.callSites)T.id.startsWith("py-call:")&&F.set(`${T.range.path}${String(T.range.start)}${String(T.range.end)}`,T.id);let ne=[],pe=new Set;for(let T of q){let j=T.form==="decorator"?T.at.end:T.at.start,U=F.get(`${T.at.path}${String(j)}${String(T.at.end)}`);U===void 0||pe.has(`${U}${T.handler}`)||(pe.add(`${U}${T.handler}`),ne.push({callSiteId:U,calleeFunctionId:T.handler,resolution:"field-based",invocation:"callback"}))}let Se=[...u.values()].flatMap(T=>T.classes),Ie=[...u.values()].flatMap(T=>T.exports),$=[...u.values()].flatMap(T=>T.exportBindings);return{graph:{...Zp,modules:[...a.values()],imports:l,importEdges:d,functions:W,classes:Se,exports:Ie,exportBindings:$,callSites:X.callSites,callEdges:[...X.callEdges,...ne],inheritEdges:X.inheritEdges},diagnostics:i,interpreter:N,counts:{modules:a.size-p.size,surfaces:p.size},opaqueCode:[...S].sort()}}import{readdirSync as bw,readFileSync as tm,statSync as li}from"node:fs";import An from"node:path";import{spawnSync as Sw}from"node:child_process";var xw="python3",kw=256*1024,ww=8*1024*1024,sm=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,vw=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function ss(e){try{return li(e).isFile()}catch{return!1}}function nm(e){try{return li(e).isDirectory()}catch{return!1}}function Ew(e,n){return An.relative(e,n).split(An.sep).join("/")}function Aw(e){let n=e.python??process.env.CUPEL_PYTHON??xw,t=Sw(n,["-I","-S",...Wo("metadata.py"),e.projectRoot],{encoding:"utf8",maxBuffer:ww,timeout:6e4}),s=l=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:l}]});if(t.error!==void 0||t.status!==0)return s("the declared entry surface could not be read; it is unknown, not empty");let o;try{o=JSON.parse(t.stdout)}catch{return s("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof o!="object"||o===null)return{entries:[],projectName:null,gaps:[]};let r=o,i=(Array.isArray(r.entryPoints)?r.entryPoints:[]).filter(l=>typeof l=="object"&&l!==null&&typeof l.name=="string"&&typeof l.target=="string"&&typeof l.kind=="string"),a=(Array.isArray(r.gaps)?r.gaps:[]).flatMap(l=>{if(typeof l!="object"||l===null)return[];let d=l,c=typeof d.file=="string"?d.file:"",p=typeof d.why=="string"?d.why:"";return[{source:"metadata",declaration:c,detail:p==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":p}]});return{entries:i,gaps:a,projectName:typeof r.projectName=="string"?r.projectName:null}}function Fl(e,n){let t=sm.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let s=t[1]??"",o=Dt(e.paths,s);if(o.resolved===null)return{detail:`\`${s}\` ${o.failure??"did not resolve"}`};if(o.resolved.kind==="namespace"||o.resolved.kind==="stub-only")return{detail:`\`${s}\` resolved to a ${o.resolved.kind}, which runs no code`};let r=Ew(e.projectRoot,o.resolved.path);return r.startsWith("..")?{detail:`\`${s}\` resolves outside the project root; not seeded`}:{file:r}}function Nw(e){let n=[];ss(An.join(e,"__main__.py"))&&n.push("__main__.py");let t=(s,o)=>{let r;try{r=bw(s).sort()}catch{return}for(let i of r){if(i.startsWith("."))continue;let a=An.join(s,i);nm(a)&&ss(An.join(a,"__init__.py"))&&ss(An.join(a,"__main__.py"))&&n.push(`${o}${i}/__main__.py`)}};return t(e,""),nm(An.join(e,"src"))&&t(An.join(e,"src"),"src/"),n}function Iw(e,n){let t=An.join(e,"Procfile");if(!ss(t))return[];let s;try{if(li(t).size>n)return[];s=tm(t,"utf8")}catch{return[]}let o=[];for(let r of s.split(/\r?\n/u)){let i=vw.exec(r);i?.[1]!==void 0&&o.push(i[1])}return o}var Rw=256*1024,Ow=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,Pw=/^\s*WORKDIR\s+(\S+)\s*$/imu,Cw=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,Mw=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,Tw=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function $w(e){let n=Pw.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let s=Cw.exec(t),o=s?.[1],r=s?.[2]?.replace(/\/+$/u,"");if(o===void 0||r===void 0||r!==n)continue;let i=o.replace(/\/+$/u,"");return i==="."?null:i}return null}function Lw(e,n){let t=[],s=r=>{let i=An.join(e,r);if(!ss(i))return null;try{return li(i).size>n?null:tm(i,"utf8")}catch{return null}},o=s("Dockerfile");if(o!==null){let r=$w(o);for(let i of o.split(/\r?\n/u)){let a=Ow.exec(i);a?.[1]!==void 0&&t.push({command:a[1],from:"Dockerfile",srcRoot:r})}}for(let r of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let i=s(r);if(i!==null)for(let a of i.split(/\r?\n/u)){let l=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(a);l?.[1]!==void 0&&t.push({command:l[1],from:r,srcRoot:null})}}return t}function Dw(e,n,t){let s=e.projectRoot,o=Tw.exec(n)?.[1];if(o!==void 0){for(let a of t===null?[o]:[An.join(t,o),o])if(ss(An.join(s,a)))return{file:a}}let r=Mw.exec(n)?.[1];if(r===void 0)return o===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${o}\` is not a file in this repository`};let i=sm.exec(r)?.[1]??"";for(let a of t===null?[""]:[t,""])for(let l of[`${i.replace(/\./gu,"/")}.py`,`${i.replace(/\./gu,"/")}/__init__.py`]){let d=a===""?l:An.join(a,l);if(ss(An.join(s,d)))return{file:d}}return Fl(e,r)}function jl(e){let n=[],t=[],s=new Set,o=(a,l,d)=>{let c=`${a} ${l}`;s.has(c)||(s.add(c),n.push({file:a,source:l,declaration:d}))},r=Aw(e);t.push(...r.gaps);for(let a of r.entries){let l=a.kind==="entry-point-group"?"entry-point-group":"console-script",d=Fl(e,a.target);"file"in d?o(d.file,l,`${a.name} = ${a.target}`):t.push({source:l,declaration:`${a.name} = ${a.target}`,detail:d.detail})}for(let a of Nw(e.projectRoot))o(a,"dunder-main",a);ss(An.join(e.projectRoot,"manage.py"))&&o("manage.py","manage-py","manage.py");let i=e.maxProcfileBytes??kw;for(let a of Iw(e.projectRoot,i)){let l=Fl(e,a);"file"in l?o(l.file,"launch-declaration",a):t.push({source:"launch-declaration",declaration:a,detail:l.detail})}for(let a of Lw(e.projectRoot,Rw)){let l=Dw(e,a.command,a.srcRoot),d=`${a.from}: ${a.command.trim()}`;"file"in l?o(l.file,"launch-declaration",d):t.push({source:"launch-declaration",declaration:d,detail:l.detail})}return{entrypoints:n,gaps:t,projectName:r.projectName}}var oM=256*1024*1024;var om="CUPEL_PYTHON",jw=["-I","-S"],Bw="python3",Gw=256*1024*1024,Kw=12e4,zw=512,rm=2e4,dm=new Set(["str","bytes","int","float","complex","bool","none","scalar","tuple","list","dict","set"]),Uw=new Set(["module","local-def","local","class"]);function ke(e,n=zw){return typeof e=="string"&&e.length<=n?e:null}function ks(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function Yo(e){let n=Nn(e)?e:{};return{line:ks(n.line),endLine:ks(n.endLine),col:ks(n.col),start:ks(n.start),end:ks(n.end)}}function Nn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function os(e){return Array.isArray(e)?e:[]}function Qs(e){return os(e).map(n=>ke(n))}function rs(e,n){return Number.isSafeInteger(e)&&Number.isSafeInteger(n)&&e>=0&&n>=e?{start:e,end:n}:null}var Ww={o:"positional-only",p:"positional",r:"rest",k:"keyword-only",K:"keyword-rest"},Hw={p:"positional",s:"star",k:"keyword",d:"double-star"};function eo(e,n){if(!Array.isArray(e))return null;let t=[];for(let s of e){let o=Array.isArray(s)?n(s):null;if(o===null)return null;t.push(o)}return t}function qw(e){return eo(e,([n,t,s,o,r])=>{let i=typeof n=="string"?Ww[n]:void 0,a=ke(t),l=rs(o,r);return i===void 0||a===null||a===""||typeof s!="boolean"||l===null?null:{kind:i,name:a,hasDefault:s,...l}})}function Vw(e){return eo(e,([n,t,s,o])=>{let r=typeof n=="string"?Hw[n]:void 0,i=rs(t,s);if(r===void 0||i===null)return null;if(r!=="keyword")return o===void 0?{kind:r,...i}:null;let a=ke(o);return a!==null&&a!==""?{kind:r,keyword:a,...i}:null})}var Xw=new Set(["def","class","import","other","multi"]);function im(e){if(!Nn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e))ke(t)!==null&&typeof s=="string"&&Xw.has(s)&&n.set(t,s);return n}var Yw=new Map([["c","copy"],["d","derive"],["f","field"],["w","await"],["r","return"],["a","argument"],["m","mutation"]]),Jw=new Map([["m","module"],["g","global"],["u","unknown"]]),Zw=new Set(["unmodeled","reflective","inner-function-param","caught","construct"]),Qw=256;function am(e,n){return Number.isSafeInteger(e)&&e>=n&&e<Qw?e:null}function ev(e,n){let[t,s,o,r]=e;switch(t){case"p":{let i=e.length===2&&n?am(s,0):null;return i===null?null:{kind:"declared-param",index:i}}case"l":{let i=ke(s);return e.length===3&&i!==null&&i!==""&&Number.isSafeInteger(o)&&o>=0?{kind:"local",name:i,declStart:o}:null}case"f":{let i=ke(s),a=Jw.get(o);return e.length===3&&i!==null&&i!==""&&a!==void 0?{kind:"free",name:i,binding:a}:null}case"c":case"r":{let i=e.length===3?rs(s,o):null;return i===null?null:{kind:t==="c"?"call-result":"call-receiver",at:i.start,end:i.end}}case"a":case"m":{let i=e.length===4?rs(s,o):null,a=am(r,t==="m"?-1:0);return i===null||a===null?null:{kind:t==="a"?"argument":"mutated-by-call",at:i.start,end:i.end,index:a}}case"R":return e.length===1?{kind:"return"}:null;case"k":return e.length===1?{kind:"constant"}:null;case"s":{let i=e.length===2?ke(s):null;return i===null?null:Sp(i)}case"o":return e.length===2&&Zw.has(s)?{kind:"opaque",reason:s}:null;default:return null}}function lm(e,n){if(!Nn(e))return null;let t=e.refs,s=e.edges;if(!Array.isArray(t)||!Array.isArray(s)||s.length>rm||t.length>2*rm)return null;let o=eo(t,r=>ev(r,n));return o===null?null:eo(s,([r,i,a])=>{let l=Number.isSafeInteger(r)?o[r]:void 0,d=Number.isSafeInteger(i)?o[i]:void 0,c=Yw.get(a);return l===void 0||d===void 0||c===void 0?null:{from:l,to:d,kind:c}})}var nv=/^(?:~|\.*)[^\s.()~]+(?:\(\))*(?:\.[^\s.()~]+(?:\(\))*)*$/u,tv=2048;function is(e){let n=ke(e);return n!==null&&nv.test(n)?n:null}function cm(e){return ke(e,tv)}function um(e){return Array.isArray(e)&&e.length===2?{callee:is(e[0]),arg0:is(e[1])}:null}function fm(e){return!Nn(e)||!Array.isArray(e.m)?null:{type:is(e.t),meta:e.m.map(um)}}function sv(e){return eo(e,([n,t,s,o])=>{let r=rs(t,s);return r===null?null:{origin:is(n),rule:cm(o),...r}})}function ov(e){return Array.isArray(e)?e.map(n=>{if(!Array.isArray(n)||n.length!==2)return null;let t=n[1];return{default:um(n[0]),annotated:fm(t),annotation:Nn(t)?is(t.o):null}}):null}function rv(e){if(!Array.isArray(e)||e.length!==2||!Array.isArray(e[1]))return null;let n=e[1].map(t=>Array.isArray(t)?{origin:is(t[0]),literal:cm(t[1])}:{origin:null,literal:null});return{callee:is(e[0]),args:n}}function Bl(e,n){if(!Nn(e))return null;let t=new Map;for(let[s,o]of Object.entries(e)){let r=n(o);ke(s)!==null&&r!==null&&t.set(s,r)}return t}var iv=/^(?:~|\.*)[^\s.()~]+(?:\.[^\s.()~]+)*$/u;function av(e){let n=ke(e);return n!==null&&iv.test(n)?n:null}function pm(e){if(!Array.isArray(e)||e.length<1||e.length>2||!dm.has(e[0]))return null;let n=e[0];if(e.length===1)return{type:n};let t=ke(e[1]);return t!==null&&t!==""?{type:n,unlessWritten:t}:null}function lv(e,n){return!Array.isArray(e)||n===null||e.length!==n.length?null:e.map(t=>t===null?null:pm(t))}var dv=new Set(["none","staticmethod","classmethod","other"]);function di(e){if(!Array.isArray(e))return null;let n=new Set;for(let t of e){let s=ke(t);if(s===null)return null;n.add(s)}return n}function cv(e){if(e===!0)return{kind:"lambda"};if(e===!1)return{kind:"const"};if(e===null)return{kind:"other"};let n=ke(e);return n!==null&&n!==""?{kind:"name",dotted:n}:null}function uv(e){if(!Array.isArray(e))return null;let n=e,[t,s]=n;if(t==="k"&&n.length===1)return{kind:"const"};if(t==="l"&&n.length===1)return{kind:"lambda"};if(t==="o"&&n.length===1)return{kind:"other"};if(t==="n"&&n.length===2){let o=ke(s);return o!==null&&o!==""?{kind:"name",dotted:o}:null}if(t==="p"&&n.length===2&&Array.isArray(s)){let o=[];for(let r of s){let i=cv(r);if(i===null)return null;o.push(i)}return{kind:"property",accessors:o}}return null}function Gl(e){return eo(e,([n,t,s])=>{let o=ke(n),r=uv(t);return o===null||o===""||r===null||!Number.isSafeInteger(s)||s<0?null:{name:o,value:r,at:s}})}function fv(e){if(!Nn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e)){let o=ke(t)===null?null:Gl(s);if(o===null)return null;n.set(t,o)}return n}var pv=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),mv=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function hv(e,n){if(n!==null)return[];let t=e.truncated;return Array.isArray(t)?t.map(s=>ke(s,64)??"unreadable"):["unreported"]}function gv(e){let n=Vw(e.args);return{args:n,calleeOrigin:av(e.calleeOrigin),receiverProof:pm(e.receiverProof),argProofs:lv(e.argProofs,n)}}function yv(e){let n=ke(e.path,4096);if(n===null)return null;let t=e.refused,s=typeof t=="string"&&mv.has(t)?t:null,o=ke(e.detail,200),r=os(e.imports).filter(Nn).map(b=>({form:b.form==="import"?"import":"from",module:ke(b.module),level:ks(b.level),names:os(b.names).filter(Nn).map(k=>({name:ke(k.name)??"",asname:ke(k.asname)})).filter(k=>k.name!==""),star:b.star===!0,deferred:b.deferred===!0,enclosingFunction:ke(b.enclosingFunction),guards:Qs(b.guards).filter(k=>k!==null),range:Yo(b.range)})),i=os(e.functions).filter(Nn).flatMap(b=>{let k=ke(b.name),w=ke(b.qualname);return k===null||w===null?[]:[{name:k,qualname:w,kind:b.kind==="async-function"?"async-function":"function",enclosingClass:ke(b.enclosingClass),enclosingFunction:ke(b.enclosingFunction),decorators:Qs(b.decorators),range:Yo(b.range),params:qw(b.params),method:b.method===!0,decorated:typeof b.decorated=="string"&&dv.has(b.decorated)?b.decorated:"other",rebound:b.rebound!==!1,reflective:b.reflective!==!1,valueFlows:lm(b.flows,!0),decoratorFacts:sv(b.decoratorFacts),paramFacts:ov(b.paramFacts)}]}),a=os(e.classes).filter(Nn).flatMap(b=>{let k=ke(b.name),w=ke(b.qualname);return k===null||w===null?[]:[{name:k,qualname:w,bases:Qs(b.bases),decorators:Qs(b.decorators),range:Yo(b.range),metaclass:b.metaclass===null?null:ke(b.metaclass)??"?",rebound:b.rebound!==!1,interceptsLookup:b.interceptsLookup!==!1,nonDefBinds:di(b.nonDefBinds),valueBases:Array.isArray(b.valueBases)?Qs(b.valueBases):null}]}),l=os(e.calls).filter(Nn).map(b=>({...gv(b),callee:ke(b.callee),attr:ke(b.attr),receiver:ke(b.receiver),enclosingFunction:ke(b.enclosingFunction),argCount:ks(b.argCount),range:Yo(b.range),receiverRange:Array.isArray(b.receiverRange)?rs(b.receiverRange[0],b.receiverRange[1]):null,root:b.root===null?null:b.root==="param0"||b.root==="global"?b.root:"other",nameScope:b.nameScope===null&&b.callee===null?null:Uw.has(b.nameScope)?b.nameScope:"local",raisedCall:Array.isArray(b.raisedCall)?rs(b.raisedCall[0],b.raisedCall[1]):null,repeats:b.repeats!==!1,registration:rv(b.registration)})),d=os(e.escapes).filter(Nn).flatMap(b=>{let k=b.kind,w=ke(b.callee);return typeof k!="string"||!pv.has(k)||w===null?[]:[{kind:k,callee:w,target:ke(b.target),attr:ke(b.attr),enclosingFunction:ke(b.enclosingFunction),range:Yo(b.range)}]}),c=e.all,p=Array.isArray(c)?Qs(c).filter(b=>b!==null):null,u=di(e.attrWrites),f=fv(e.classBinds),m=Gl(e.moduleBinds),h=Gl(e.dunderWrites),y=im(e.moduleBindings),_=hv(e,s),S=f===null&&a.length>0||m===null&&(y===null||y.has("__getattr__")||y.has("__dir__"))||h===null&&(u===null||[...u].some(b=>/^__.+__$/u.test(b))||l.length>0||i.length>0);return s===null&&S&&!_.includes("bindings")&&_.push("bindings"),{path:n,refused:s,...o!==null?{detail:o}:{},imports:r,functions:i,classes:a,calls:l,toplevelFlows:lm(e.toplevelFlows,!1),flowsRefused:e.flowsRefused===null?null:ke(e.flowsRefused,64)??"unreadable",escapes:d,all:p,allComputed:e.allComputed===!0,truncated:_,moduleBindings:y,staticBindings:y===null?im(e.staticBindings):null,attrWrites:u,starImport:e.starImport!==!1,moduleOrigins:Bl(e.moduleOrigins,is),annotatedAliases:Bl(e.annotatedAliases,fm),moduleCalls:Bl(e.moduleCalls,b=>Array.isArray(b)&&b.length===2?rs(b[0],b[1]):null),valueNames:di(e.valueNames),valueAttrs:di(e.valueAttrs),computedAccess:e.computedAccess!==!1,classBinds:f,moduleBinds:m,dunderWrites:h}}function ai(e,n={}){let t=n.env??process.env,s=n.python??t[om]??Bw,o=[],r=e.filter(h=>!h.includes(`
-`));r.length!==e.length&&o.push(`${String(e.length-r.length)} path(s) carried a newline and were not extracted`);let i=[...jw,...Wo("extract.py")];n.maxBytesPerFile!==void 0&&i.push("--max-bytes",String(n.maxBytesPerFile)),n.hints!==void 0&&i.push("--hints",JSON.stringify(n.hints));let a=Fw(s,i,{input:r.length>0?`${r.join(`
+}`,C.ScriptTarget.Latest,!0),r=s.parseDiagnostics;if(r!==void 0&&r.length>0||rx(s,n+1,!0))return!0}return!1}function rx(e,n=0,t=!1){return Ya(e,n,t).size>0}function Ya(e,n=0,t=!1){let s=new Set,r=t?VS:nx(e);if(r.saturated)return s.add("saturated"),s;let o=a=>C.isElementAccessExpression(a)&&!C.isStringLiteralLike(a.argumentExpression)&&qo(Ve(a.expression),r),i=a=>{if(t&&(C.isCallExpression(a)||C.isNewExpression(a)||C.isTaggedTemplateExpression(a))){s.add("eval-invocation");return}if(C.isCallExpression(a)){let l=Dr(a);if(l!==null){let d=l.specifierArg;if(d===void 0||!C.isStringLiteralLike(d)||t){s.add("non-literal-load");return}}else{let d=Ve(a.expression);if(C.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if(uf(a.arguments,n)){s.add("eval-code");return}}else if(tx(d)){s.add("loader-callee");return}else if(o(d)){s.add("computed-loader");return}else if(ZS(a,r)){s.add("reflect-get");return}}}else if(C.isNewExpression(a)){let l=Ve(a.expression);if(C.isIdentifier(l)&&l.text==="Function"){if(uf(a.arguments??[],n)){s.add("function-ctor");return}}else if($r(l)){s.add("ctor-chain");return}}else if(C.isIdentifier(a)&&zS.has(a.text)&&qS(a)){s.add("captured-loader");return}else if((C.isPropertyAccessExpression(a)||C.isElementAccessExpression(a))&&(gf(a)||$r(a)||o(a))&&mf(a)){s.add("captured-member");return}else if(C.isBindingElement(a)){let l=a.propertyName??a.name,d=C.isIdentifier(l)||C.isStringLiteralLike(l)?l.text:C.isComputedPropertyName(l)&&C.isStringLiteralLike(l.expression)?l.expression.text:void 0;if(d!==void 0&&Xo.has(d)){s.add("destructured-member");return}}C.forEachChild(a,i)};return i(e),s}function xf(e,n,t){let s=new Set(Ya(t));if(Qa(e)&&n.includes("<")&&n.includes("require")){let r=C.createSourceFile(e,n,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);for(let o of Ya(r))s.add(o)}return s}function ox(e,n,t){if(Ja(e))return!0;let s=t.endsWith(cn.sep)?t:t+cn.sep,r=e.split("/"),o=n;for(;;){let i=cn.join(o,"node_modules",...r),a;try{a=is(cn.join(i,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(s))return!1;let d=_n(a);if(d===null)return!1;let c;try{c=JSON.parse(d).exports}catch{return!1}if(typeof c=="string"||Array.isArray(c)||typeof c=="object"&&c!==null)return!1}if(Wu(i))return!1;if(o===t)break;let l=cn.dirname(o);if(l===o||l!==t&&!l.startsWith(s))break;o=l}return!0}function ix(e,n){let t=n.endsWith(cn.sep)?n:n+cn.sep,s=cn.dirname(e);for(;;){let r=cn.join(s,"package.json"),o;try{o=is(r)}catch{o=null}if(o!==null&&(o===n||o.startsWith(t))){let a=_n(o);if(a!==null)try{let l=JSON.parse(a).name;if(typeof l=="string"&&l.length>0)return l}catch{return null}}if(s===n)break;let i=cn.dirname(s);if(i===s||i!==n&&!i.startsWith(t))break;s=i}return null}function ax(e,n,t,s,r){let o=[],i=[],a=new Set,l={},d=[],c=[],f=new Set,p=new Set,u=[],m=!1,g=(b,_)=>{let S;try{S=is(_)}catch{return!1}let k=hn(e,S);if(k===null)return r.push({code:"out-of-root",path:S,detail:"dependency module resolved outside the app root; not followed"}),!1;let v=!t.has(S)&&!p.has(S);return v&&p.size>=qa?(m=!0,!1):(i.push({from:b,to:{module:k}}),v?(p.add(S),o.push(k),!0):!1)},y=(b,_)=>{if(a.add(_),f.has(_))return;f.add(_);let S=Gn(_,b,gn,n),k=S!==null?[S]:qs(_,b,gn,n);k.length>=2&&d.push({path:hn(e,b)??b,specifier:_,candidates:k.map(I=>hn(e,I)??I)});let v=!1;for(let I of k)if(!Cn(I)&&(v=!0,g({surface:_},I))){u.push(I);try{let O=hn(e,is(I)),E=ix(I,e);O!==null&&E!==null&&(l[O]=E)}catch{}}v||ox(_,cn.dirname(b),e)||r.push({code:"unresolved-specifier",path:_,reason:Cr(_,b,gn,n),detail:`dependency "${_}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let b of s)y(b.containingFile,b.packageName);for(;u.length>0&&p.size<qa;){let b=u.pop();if(b===void 0)break;let _=hn(e,b);if(_===null)continue;let S=Hs(b,ss);if(S.kind==="too-large"){r.push({code:"limit-exceeded",path:_,detail:`dependency module over the ${String(ss/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(S.kind==="not-regular"){r.push({code:"parse-error",path:_,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let k=C.createSourceFile(b,S.text,C.ScriptTarget.ES2020,!0),v=k.parseDiagnostics;if(v!==void 0&&v.length>0){r.push({code:"dependency-body",path:_,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let I=xf(b,S.text,k);if(I.size>0){r.push({code:"dependency-body",path:_,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...I].sort()});continue}r.push({code:"dependency-body",path:_,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:_});for(let O of ff(b,S.text))if(O.runtime)if(Ze(O.text)==="package-root"){let E=Bn(O.text);i.push({from:{module:_},to:{surface:E}}),y(b,E)}else{if(Ja(Bn(O.text)))continue;let E=Gn(O.text,b,gn,n),N=E!==null?[E]:qs(O.text,b,gn,n);if(N.length===0){if(Ze(O.text)==="package-subpath"){let A=Cr(O.text,b,gn,n);if(A==="no-candidate"||A==="not-installed"&&Vu(b,Bn(O.text))){c.push({path:_,specifier:O.text,why:A});continue}r.push({code:"unresolved-specifier",path:_,reason:A,detail:`runtime package-subpath import "${O.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}N.length>=2&&d.push({path:_,specifier:O.text,candidates:N.map(A=>hn(e,A)??A)});for(let A of N){if(Cn(A)){let U=hn(e,A);r.push({code:U===null?"out-of-root":"declaration-shadow",path:_,detail:U===null?`runtime import "${O.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${O.text}" resolved to the declaration file "${U}" with no co-located runtime module; its code was not analyzed`});continue}g({module:_},A)&&u.push(A)}}}return(m||u.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(qa)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:o,edges:i,surfacePackages:[...a],entryRealNames:l,conditionUnions:d,provenAbsent:c}}function kf(e,n,t=!1,s=new Set){let r=is(e),o=[],i=[],a=C.createCompilerHost(gn,!0),l=t?Xu(r,gn,a):()=>null,d=new Set,c=new Set,f=n.map(F=>cn.join(r,F)),p=[],u=new Map,m=new Map,g=new Map,y=new Map,b=new Map,_=new Set,S=(F,B,ne)=>{let X=`${String(F.length)}:${F}${B}`;_.has(X)||(_.add(X),o.push({code:"unresolved-specifier",path:F,detail:B,reason:ne}))},k=()=>null,v=0,I=(F,B)=>{let ne=g.get(F);return ne===void 0&&(ne=C.createSourceFile(F,B,C.ScriptTarget.ES2020,!0),g.set(F,ne)),{real:F,sf:ne}};for(;c.size<Uo;){let F=f.pop();if(F===void 0){if(v>=KS)break;v+=1;let Z=[];for(let[G,z]of u)z.includes("readdir")&&(z.includes("require")||z.includes("import("))&&Z.push(I(G,z));let x=GS(Z);if(x.length===0)break;let T=[];for(let[G,z]of u)T.push(I(G,z));k=af(T,x,gn,a,y);let q=!1;for(let G of Z){let z=u.get(G.real);if(z!==void 0)for(let L of cf(G.real,z,r,a,k))c.has(L)||(f.push(L),q=!0)}if(!q)break;continue}let B;try{B=is(F)}catch{continue}if(c.has(B))continue;if(c.add(B),hn(r,B)===null){o.push({code:"out-of-root",path:F,detail:"resolved outside app root"});continue}let ne=Hs(B,ss);if(ne.kind==="too-large"){o.push({code:"limit-exceeded",path:B,detail:`file is ${String(Math.round(ne.bytes/1048576))}MiB, over the ${String(ss/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(ne.kind==="not-regular"){o.push({code:"parse-error",path:B,detail:"unreadable or not a regular file"});continue}let X=St(B),Q=ne.text;if(X!==null){let Z=Or(X,ne.text);Q=Z.code,m.set(B,Z.scriptKind),Z.partial.length>0&&o.push({code:"component-partially-read",path:B,detail:`the component was not read in full: ${Z.partial.join("; ")}`})}d.add(B),u.set(B,Q);for(let Z of ff(B,Q)){let x=Z.runtime?l(Z.text,B):null;if(x===null&&Ze(Z.text)==="package-root"){Z.runtime&&p.push({containingFile:B,packageName:Bn(Z.text)});continue}let T=x??Gn(Z.text,B,gn,a),q=T!==null?[T]:Z.runtime&&x===null?qs(Z.text,B,gn,a):[];if(q.length===0){if(Z.runtime){let G=Ze(Z.text);if(!(G==="package-subpath"&&Ja(Bn(Z.text)))){if(G==="package-subpath")S(B,`runtime package-subpath import "${Z.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,Cr(Z.text,B,gn,a));else if(G==="relative"){let z=Hu(Z.text,B,r,b);z.kind==="unanalyzable"?S(B,`runtime relative import "${Z.text}" did not resolve and its absence could not be proven \u2014 ${z.reason}; a bundler/loader may load a module the analyzer never saw`,z.why):z.kind==="absent"&&Z.unguarded&&TS(r,B)&&S(B,`runtime relative import "${Z.text}" runs whenever its module runs, but nothing is on disk at its target \u2014 the module the running app loads there (a build output, a generated file) was never analyzed`,"absent-unguarded")}}}continue}q.length>=2&&i.push({path:hn(r,B)??B,specifier:Z.text,candidates:q.map(G=>hn(r,G)??G)});for(let G of q){if(hn(r,G)===null){o.push({code:"out-of-root",path:G,detail:`specifier "${Z.text}" resolved outside app root`});continue}if(Z.runtime&&Cn(G)){o.push({code:"declaration-shadow",path:G,detail:`runtime import "${Z.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(Z.runtime&&!Bo(G)){o.push({code:"unanalyzable-module",path:G,detail:`runtime import "${Z.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}f.push(G)}}for(let Z of cf(B,Q,r,a,k))c.has(Z)||f.push(Z)}c.size>=Uo&&f.length>0&&o.push({code:"limit-exceeded",path:r,detail:`reachable file set exceeds ${String(Uo)}; analysis truncated (${String(f.length)}+ files not analyzed)`});let O=ax(r,a,d,p,o),E=new Set,N=new Set,A=F=>{let B=hn(r,F);return B!==null&&s.has(B)};for(let F of d){if(!jS(F))continue;let B=u.get(F);if(B===void 0)continue;let ne=BS(B);if(ne==="other"){if(!A(F))continue;N.add(F),o.push({code:"parse-error",path:F,detail:"extensionless entrypoint declares a non-node interpreter in its shebang; it is not a JavaScript module, and the code it runs was NOT analyzed (degraded to unknown)"});continue}ne==="none"&&!A(F)||E.add(F)}let U=C.createProgram({rootNames:[...d],options:gn,host:a}),$=new Set,W=new Map;for(let F of U.getSourceFiles()){if(F.isDeclarationFile||U.isSourceFileDefaultLibrary(F)||hn(r,F.fileName)===null||!Qa(F.fileName))continue;let B=U.getSyntacticDiagnostics(F).length>0;if(!B&&!F.text.includes("<")||FS(F.text,C.ScriptKind.TSX)!==0)continue;let ne=C.createSourceFile(F.fileName,F.text,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);(B||df(ne)>df(F))&&($.add(F.fileName),W.set(F.fileName,F.text))}let w=U;if($.size>0||E.size>0||m.size>0){let F=a.getSourceFile.bind(a);a.getSourceFile=(ne,X,Q,Z)=>{let x=W.get(ne);if(x!==void 0)return C.createSourceFile(ne,x,C.ScriptTarget.ES2020,!0,C.ScriptKind.TSX);let T=m.get(ne),q=T===void 0?void 0:u.get(ne);if(q!==void 0)return C.createSourceFile(ne,q,C.ScriptTarget.ES2020,!0,T==="tsx"?C.ScriptKind.TSX:C.ScriptKind.TS);let G=E.has(ne)?u.get(ne):void 0;return G!==void 0?C.createSourceFile(ne,G,C.ScriptTarget.ES2020,!0,C.ScriptKind.JS):F(ne,X,Q,Z)};let B=ne=>U.getSourceFile(ne)!==void 0;w=C.createProgram({rootNames:[...d].filter(ne=>E.has(ne)||m.has(ne)||B(ne)),options:E.size>0||m.size>0?{...gn,allowNonTsExtensions:!0}:gn,host:a,...E.size>0||m.size>0?{}:{oldProgram:U}})}let P=w.getTypeChecker();for(let F of n){if(!s.has(F))continue;let B;try{B=is(cn.join(r,F))}catch{continue}!d.has(B)||N.has(B)||w.getSourceFile(B)===void 0&&(N.add(B),o.push({code:"parse-error",path:B,detail:"entrypoint is not a module cupel can parse (an unrecognised file type); the code it runs was NOT analyzed (degraded to unknown)"}))}let j=[];for(let F of w.getSourceFiles()){if(F.isDeclarationFile||w.isSourceFileDefaultLibrary(F)||hn(r,F.fileName)===null)continue;j.push(F);let B=w.getSyntacticDiagnostics(F);if(B.length>0){let Q=B[0],Z=Q!==void 0?C.flattenDiagnosticMessageText(Q.messageText," "):"syntax error";o.push({code:"parse-error",path:F.fileName,detail:`${String(B.length)} syntax error(s): ${Z}`})}let ne=hn(r,F.fileName),X=ne===null?null:xf(F.fileName,F.text,F);ne!==null&&X!==null&&X.size>0&&o.push({code:"loader-escape",path:ne,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...X].sort()})}return{program:w,checker:P,host:a,options:gn,appRoot:r,sourceFiles:j,diagnostics:o,depReach:O,conditionUnions:[...i,...O.conditionUnions],provenAbsent:O.provenAbsent,resolveParamDirs:k,toRel:F=>hn(r,F)}}import{opendirSync as lx,statSync as dx}from"node:fs";import Za from"node:path";var cx=8192,ux=2e4,fx=new Set(["node_modules"]),wf=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),px=16;function Yo(e,n,t,s,r={}){let o=r.maxEntries??ux,i=r.prune,a=[],l=!1,d=0,c=[{dir:Za.join(e,n),rel:n,depth:0}];for(;c.length>0;){let f=c.pop();if(f===void 0)break;if(f.depth>px){l=!0;continue}let p;try{p=lx(f.dir)}catch{l=!0;continue}try{let u=0;for(;;){let m=p.readSync();if(m===null)break;if(u+=1,d+=1,u>cx||d>o){l=!0;break}let g=f.rel+m.name;if(m.isSymbolicLink()){let y;try{y=dx(Za.join(f.dir,m.name)).isDirectory()}catch{l=!0;continue}if(y){l=!0;continue}}else if(m.isDirectory()){if(fx.has(m.name)||m.name.startsWith(".")||i?.has(m.name)===!0){l=!0;continue}c.push({dir:Za.join(f.dir,m.name),rel:`${g}/`,depth:f.depth+1});continue}else if(!m.isFile())continue;if(t(g)){if(a.length>=s){l=!0;break}a.push(g)}}}finally{try{p.closeSync()}catch{}}}return{matches:a,truncated:l}}var mx=64;function vf(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let s=n.slice(0,t),r=n.slice(t+1);if(s.startsWith("./")&&(s=s.slice(2)),s.startsWith("/")||r.includes("/")||s.split("/").includes("..")||s.includes("\\")||n.includes("\0"))return null;let o=s.slice(0,s.lastIndexOf("/")+1);return Yo(e,o,i=>i.length>=s.length+r.length&&i.startsWith(s)&&i.endsWith(r),mx)}import{existsSync as gx}from"node:fs";import hx from"node:path";var yx=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"],components:{route:e=>e.endsWith(".astro")}},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"],components:{route:e=>e==="+page.svelte"||e==="+layout.svelte"||e==="+error.svelte"}},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"],components:{route:e=>e.endsWith(".vue"),dirs:["layouts"],files:["app.vue","error.vue"]}},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],bx=["dependencies","devDependencies"];function _x(e,n){for(let t of bx){let s=e[t];if(!(typeof s!="object"||s===null||Array.isArray(s))&&Object.hasOwn(s,n))return!0}return!1}function el(e,n){if(n===null)return null;for(let t of yx)if(_x(n,t.dependency)){for(let s of t.configFiles)if(gx(hx.join(e,s)))return{name:t.name,configFile:s,entryHint:t.entryHint,rootDirs:t.rootDirs,...t.components!==void 0?{components:t.components}:{}}}return null}function nl(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var Sx=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],xx=256,kx=12e4;function tl(e,n){let t=new Set(n.rootDirs),s=n.components,r=new Set([...n.rootDirs,...s?.dirs??[]]),o=new Set(s?.files??[]);if(t.size===0&&s===void 0)return{roots:[],truncated:!1};let i=Yo(e,"",a=>{let l=a.split("/"),d=l[l.length-1]??"";if(s!==void 0&&St(d)!==null)return o.has(d)?!0:s.route(d)?l.slice(0,-1).some(c=>r.has(c)):!1;for(let c=0;c<l.length-1;c+=1){let f=l[c];if(f!==void 0&&t.has(f))return Sx.some(p=>a.endsWith(p))}return!1},xx,{maxEntries:kx,prune:wf});return{roots:i.matches,truncated:i.truncated}}function Kn(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let s of n){let r=s.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:s}return t}function wx(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function vx(e){let n=!1;for(let t=0;t<e.length;t+=1){let s=e.charAt(t),r=s.codePointAt(0)??0;if(r<32||r===127||r>=128&&r<=159)return null;if(s==="\\"){n=!0;let o=e.charAt(t+1);if(!(o>="a"&&o<="z"||o>="A"&&o<="Z"||o>="0"&&o<="9"||o==="."||o==="_"||o==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(s))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function Ex(e){let n=[],t="";for(let s of e){if(s===" "||s==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=s}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var Ax=/^[A-Za-z_][A-Za-z0-9_]*=/u;function Ix(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var Ef=new Set(["flask","granian","gunicorn","hypercorn","php","php-fpm","puma","python","python2","python3","rails","ruby","streamlit","unicorn","uvicorn","uwsgi","waitress-serve"]);function Nx(e){let n=e.slice(e.lastIndexOf("/")+1);return Ef.has(n)||Ef.has(n.replace(/[0-9.]+$/u,""))}var Rx=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),Ox=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),Px=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function If(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Af(e){if(If(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return Px.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:Rx.has(t)||n!==-1&&Ox.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var Cx=[".js",".cjs",".mjs",".ts",".mts",".cts"];function Mx(e){return Cx.some(n=>e.endsWith(n))}var Tx=new Set(["npm","yarn","pnpm"]);function $x(e){let n=e[0];return n===void 0||!Tx.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function rl(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!wx(n))return sl(n);let t=vx(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let s=sl(t.windows),r=sl(t.posixShell);if(s.kind==="file"){let o=r.kind==="file"?r.specifier:void 0;return o===void 0||o===s.specifier?{kind:"file",specifier:s.specifier}:{kind:"file",specifier:s.specifier,alt:o}}return r.kind==="file"?{kind:"file",specifier:r.specifier}:s}function sl(e){let n=Ex(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let o=n[t];if(o===void 0||!Ax.test(o))break;if(If(o))return{kind:"unparsed",reason:`environment \`${Kn(o)}\` preloads another module; the launch surface is more than one file`};let i=o.indexOf("=");if(o.slice(0,i)==="NODE_OPTIONS")for(let a of o.slice(i+1).split(/\s+/u)){if(a===""||!a.startsWith("-"))continue;let l=Af(a);if(l!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Kn(l.token)}\` ${l.why}`}}}let s=n[t];if(s===void 0)return{kind:"unparsed",reason:"no program in the command"};if($x(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!Ix(s))return Nx(s)?{kind:"foreign",binary:s}:{kind:"unparsed",reason:`runs \`${Kn(s)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let o=n[t];if(o===void 0||!o.startsWith("-"))break;let i=Af(o);if(i!==null)return{kind:"unparsed",reason:`node flag \`${Kn(i.token)}\` ${i.why}`}}let r=n[t];return r===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:Mx(r)?{kind:"file",specifier:r}:{kind:"unparsed",reason:`\`${Kn(r)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Lx(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Dx=64,ol=64*1024,Fx=64;function il(e){let n=[],t=!1;for(let s of e.split(/\r?\n/u)){if(n.length>=Fx){t=!0;break}let r=/^\s*(CMD|ENTRYPOINT)\s+(.*\S)\s*$/iu.exec(s),o=/^\s*(command|entrypoint):\s*(.*\S)\s*$/u.exec(s),i=r??o;if(i?.[1]===void 0||i[2]===void 0)continue;let a=jx(i[2]);a!==null&&n.push({label:i[1].toUpperCase(),command:a})}return{commands:n,truncated:t}}function jx(e){let n=e.trim();if(!n.startsWith("["))return n===""?null:n;let t;try{t=JSON.parse(n)}catch{return null}if(!Array.isArray(t))return null;let s=t.filter(r=>typeof r=="string");return s.length===0||s.length!==t.length?null:s.join(" ")}function al(e){let n=e.split(`
+`),t=n.length>64,s=[],r=0;for(let o of n.slice(0,64)){let i=o.trim();if(i.length===0||i.startsWith("#"))continue;let a=i.indexOf(":");if(a<=0)continue;let l=i.slice(a+1).trim();if(l.length===0)continue;let d=i.slice(0,a);if(d.length>Dx||!Lx(d)){r+=1;continue}s.push({name:d,command:l})}return s.sort((o,i)=>o.name===i.name?0:o.name==="web"?-1:i.name==="web"?1:0),{entries:s,truncated:t,unnamedLines:r}}import{realpathSync as Vf}from"node:fs";import Mn from"node:path";import h from"typescript";import M from"typescript";import Nf from"node:path";import ue from"typescript";var Bx=/^lib\.(?:es5|es20\d\d(?:\.[a-z0-9]+)*|esnext(?:\.[a-z0-9]+)*|decorators(?:\.legacy)?)\.d\.ts$/u,Gx=/^lib\.(?:dom|webworker|scripthost)(?:\.[a-z0-9]+)*\.d\.ts$/u;function Kx(e,n){if(e.isSourceFileDefaultLibrary(n)){let t=Nf.basename(n.fileName);return Bx.test(t)?"ecmascript":Gx.test(t)?"host-lib":"unknown"}return n.fileName.split(Nf.sep).join("/").includes("/node_modules/")?"dependency":"app"}function zx(e,n,t){if(t===void 0)return"unknown";let s=t;if(s.flags&ue.SymbolFlags.Alias)try{s=n.getAliasedSymbol(s)}catch{return"unknown"}let r=s.declarations??[];if(r.length===0)return"unknown";let o=new Set(r.map(i=>Kx(e,i.getSourceFile())));return o.size===1?[...o][0]:"unknown"}function ll(e,n,t){let s=t;for(;ue.isParenthesizedExpression(s);)s=s.expression;let r;if(ue.isIdentifier(s)?r=s:ue.isPropertyAccessExpression(s)?r=s.name:ue.isElementAccessExpression(s)&&ue.isStringLiteralLike(s.argumentExpression)&&(r=s.argumentExpression),r===void 0)return"unknown";let o;try{o=n.getSymbolAtLocation(r)}catch{return"unknown"}return zx(e,n,o)}function Wx(e){if(ue.isVariableDeclaration(e)){let n=e.parent;return ue.isVariableDeclarationList(n)&&ue.isVariableStatement(n.parent)&&ue.isSourceFile(n.parent.parent)}return ue.isFunctionDeclaration(e)||ue.isClassDeclaration(e)?ue.isSourceFile(e.parent):ue.isImportClause(e)||ue.isImportSpecifier(e)||ue.isNamespaceImport(e)}function Rf(e,n,t){let s;try{s=n.getSymbolAtLocation(t)}catch{return"unknown"}let r=s?.declarations??[];if(r.length===0)return"unknown";let o=t.getSourceFile();return r.every(i=>i.getSourceFile()===o&&Wx(i))?"module":r.every(i=>e.isSourceFileDefaultLibrary(i.getSourceFile()))?"global":"unknown"}var Ux=ue.TypeFlags.StringLike|ue.TypeFlags.NumberLike|ue.TypeFlags.BooleanLike|ue.TypeFlags.BigIntLike|ue.TypeFlags.ESSymbolLike|ue.TypeFlags.Null|ue.TypeFlags.Undefined|ue.TypeFlags.Void;function Of(e){return e.flags&(ue.TypeFlags.Any|ue.TypeFlags.Unknown|ue.TypeFlags.Never)?!1:e.isUnion()?e.types.every(Of):(e.flags&Ux)!==0&&(e.flags&ue.TypeFlags.Object)===0}var Hx=new Set([ue.SyntaxKind.EqualsEqualsToken,ue.SyntaxKind.EqualsEqualsEqualsToken,ue.SyntaxKind.ExclamationEqualsToken,ue.SyntaxKind.ExclamationEqualsEqualsToken,ue.SyntaxKind.LessThanToken,ue.SyntaxKind.LessThanEqualsToken,ue.SyntaxKind.GreaterThanToken,ue.SyntaxKind.GreaterThanEqualsToken,ue.SyntaxKind.InstanceOfKeyword,ue.SyntaxKind.InKeyword,ue.SyntaxKind.PlusToken,ue.SyntaxKind.MinusToken,ue.SyntaxKind.AsteriskToken,ue.SyntaxKind.AsteriskAsteriskToken,ue.SyntaxKind.SlashToken,ue.SyntaxKind.PercentToken,ue.SyntaxKind.AmpersandToken,ue.SyntaxKind.BarToken,ue.SyntaxKind.CaretToken,ue.SyntaxKind.LessThanLessThanToken,ue.SyntaxKind.GreaterThanGreaterThanToken,ue.SyntaxKind.GreaterThanGreaterThanGreaterThanToken]),qx=new Set([ue.SyntaxKind.AmpersandAmpersandToken,ue.SyntaxKind.BarBarToken,ue.SyntaxKind.QuestionQuestionToken]);function Fr(e,n,t,s=0){if(s>8)return!1;let r=t;for(;ue.isParenthesizedExpression(r);)r=r.expression;let o=i=>Fr(e,n,i,s+1);if(ue.isStringLiteral(r)||ue.isNoSubstitutionTemplateLiteral(r)||ue.isTemplateExpression(r)||ue.isNumericLiteral(r)||ue.isBigIntLiteral(r)||r.kind===ue.SyntaxKind.TrueKeyword||r.kind===ue.SyntaxKind.FalseKeyword||r.kind===ue.SyntaxKind.NullKeyword||ue.isTypeOfExpression(r)||ue.isVoidExpression(r)||ue.isPrefixUnaryExpression(r)||ue.isPostfixUnaryExpression(r)||ue.isIdentifier(r)&&r.text==="undefined")return!0;if(ue.isBinaryExpression(r)){let i=r.operatorToken.kind;return Hx.has(i)?!0:qx.has(i)?o(r.left)&&o(r.right):i===ue.SyntaxKind.CommaToken?o(r.right):!1}if(ue.isConditionalExpression(r))return o(r.whenTrue)&&o(r.whenFalse);if(ue.isCallExpression(r)){if(ll(e,n,r.expression)!=="ecmascript")return!1;try{let i=n.getResolvedSignature(r);return i!==void 0&&Of(n.getReturnTypeOfSignature(i))}catch{return!1}}if(ue.isIdentifier(r)){let i;try{i=n.getSymbolAtLocation(r)}catch{return!1}let a=i?.declarations??[],l=a.length===1?a[0]:void 0;return l===void 0||!ue.isVariableDeclaration(l)||l.initializer===void 0||!ue.isIdentifier(l.name)||!ue.isVariableDeclarationList(l.parent)||(l.parent.flags&ue.NodeFlags.Const)===0?!1:o(l.initializer)}return!1}import Xn from"typescript";var xn={kind:"receiver"},Sn=e=>({kind:"arg",index:e}),dl=e=>({kind:"args-from",index:e}),sn=dl(0),jt=(e=[sn])=>({result:[sn],mutates:[],callsProgram:e}),ot=(e=[xn,sn])=>({result:[xn,sn],mutates:[],callsProgram:e}),rt=(e=[])=>({result:[xn],mutates:[],callsProgram:e}),Vx={result:[],mutates:[]},cl=new Map,xe=(e,n)=>{for(let t of e)cl.set(t,n)};xe(["String","Number","BigInt"],{result:[Sn(0)],mutates:[],callsProgram:[Sn(0)]});xe(["Boolean"],{result:[Sn(0)],mutates:[]});xe(["parseInt","parseFloat","isNaN","isFinite","encodeURIComponent","encodeURI","decodeURIComponent","decodeURI","escape","unescape"],jt());xe(["Array","Object"],{result:[sn],mutates:[]});xe(["String.fromCharCode","String.fromCodePoint","String.raw"],jt());xe(["at","charAt","charCodeAt","codePointAt","concat","endsWith","includes","indexOf","isWellFormed","lastIndexOf","localeCompare","match","matchAll","normalize","padEnd","padStart","repeat","replace","replaceAll","search","slice","split","startsWith","substr","substring","toLocaleLowerCase","toLocaleUpperCase","toLowerCase","toString","toUpperCase","toWellFormed","trim","trimEnd","trimLeft","trimRight","trimStart","valueOf"].map(e=>`String.prototype.${e}`),ot());xe(["Object.keys","Object.values","Object.entries","Object.getOwnPropertyNames","Object.getOwnPropertySymbols","Object.getPrototypeOf","Object.fromEntries","Object.freeze","Object.seal","Object.preventExtensions","Object.isFrozen","Object.isSealed","Object.isExtensible"],{result:[Sn(0)],mutates:[],callsProgram:[Sn(0)]});xe(["Object.is","Object.hasOwn","Object.create"],jt());xe(["Object.assign"],{result:[sn],mutates:[{into:Sn(0),from:[dl(1)]}],callsProgram:[sn]});xe(["Object.defineProperty"],{result:[Sn(0)],mutates:[{into:Sn(0),from:[Sn(2)]}],callsProgram:[sn]});xe(["Object.prototype.hasOwnProperty","Object.prototype.isPrototypeOf","Object.prototype.propertyIsEnumerable","Object.prototype.toString","Object.prototype.toLocaleString","Object.prototype.valueOf"],ot());xe(["Array.isArray"],{result:[Sn(0)],mutates:[]});xe(["Array.of"],{result:[sn],mutates:[]});xe(["Array.from"],jt());var Xx=["at","concat","entries","flat","includes","indexOf","join","keys","lastIndexOf","slice","toLocaleString","toReversed","toSpliced","toString","values","with"];xe(Xx.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),ot([xn,sn]));var Yx=["every","filter","find","findIndex","findLast","findLastIndex","flatMap","forEach","map","reduce","reduceRight","some","toSorted"];xe(Yx.flatMap(e=>[`Array.prototype.${e}`,`ReadonlyArray.prototype.${e}`]),ot([xn,sn]));xe(["Array.prototype.push","Array.prototype.unshift"],{result:[xn,sn],mutates:[{into:xn,from:[sn]}]});xe(["Array.prototype.splice"],{result:[xn],mutates:[{into:xn,from:[dl(2)]}],callsProgram:[sn]});xe(["Array.prototype.fill"],{result:[xn,Sn(0)],mutates:[{into:xn,from:[Sn(0)]}],callsProgram:[sn]});xe(["Array.prototype.pop","Array.prototype.shift"],rt());xe(["Array.prototype.reverse","Array.prototype.copyWithin"],rt([sn]));xe(["Array.prototype.sort"],rt([xn,sn]));for(let e of["Map","WeakMap","ReadonlyMap"])xe([`${e}.prototype.get`],rt()),xe([`${e}.prototype.has`],ot([])),xe([`${e}.prototype.delete`],ot([])),xe([`${e}.prototype.set`],{result:[xn],mutates:[{into:xn,from:[Sn(0),Sn(1)]}]}),xe([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],rt()),xe([`${e}.prototype.forEach`],rt([sn]));for(let e of["Set","WeakSet","ReadonlySet"])xe([`${e}.prototype.has`],ot([])),xe([`${e}.prototype.delete`],ot([])),xe([`${e}.prototype.add`],{result:[xn],mutates:[{into:xn,from:[Sn(0)]}]}),xe([`${e}.prototype.keys`,`${e}.prototype.values`,`${e}.prototype.entries`],rt()),xe([`${e}.prototype.forEach`],rt([sn]));xe(["Map.prototype.clear","Set.prototype.clear"],rt());xe(["JSON.parse","JSON.stringify"],jt());xe(["Number.isInteger","Number.isFinite","Number.isNaN","Number.isSafeInteger"],{result:[Sn(0)],mutates:[]});xe(["Number.parseInt","Number.parseFloat"],jt());xe(["toExponential","toFixed","toLocaleString","toPrecision","toString","valueOf"].map(e=>`Number.prototype.${e}`),ot([sn]));xe(["abs","acos","acosh","asin","asinh","atan","atan2","atanh","cbrt","ceil","clz32","cos","cosh","exp","expm1","floor","fround","hypot","imul","log","log10","log1p","log2","max","min","pow","round","sign","sin","sinh","sqrt","tan","tanh","trunc"].map(e=>`Math.${e}`),jt());xe(["Math.random","Date.now"],Vx);xe(["RegExp.prototype.test","RegExp.prototype.exec"],ot());xe(["RegExp.prototype.toString"],rt());xe(["Date.parse","Date.UTC"],jt());xe(["getDate","getDay","getFullYear","getHours","getMilliseconds","getMinutes","getMonth","getSeconds","getTime","getTimezoneOffset","toDateString","toISOString","toJSON","toLocaleDateString","toLocaleString","toLocaleTimeString","toString","toTimeString","toUTCString","valueOf"].map(e=>`Date.prototype.${e}`),rt());xe(["Promise.resolve","Promise.all","Promise.allSettled","Promise.any","Promise.race"],jt());xe(["Promise.prototype.then","Promise.prototype.catch","Promise.prototype.finally"],ot());var Jx=new Set(["JSON","Math","Reflect","Atomics"]);function Pf(e,n){let t=n;for(;Xn.isParenthesizedExpression(t);)t=t.expression;let s=Xn.isIdentifier(t)?t:Xn.isPropertyAccessExpression(t)?t.name:void 0;if(s===void 0)return null;let r;try{r=e.getSymbolAtLocation(s),r!==void 0&&r.flags&Xn.SymbolFlags.Alias&&(r=e.getAliasedSymbol(r))}catch{return null}let o=r?.valueDeclaration??r?.declarations?.[0];if(o===void 0)return null;if(Xn.isIdentifier(t))return(Xn.isVariableDeclaration(o)||Xn.isFunctionDeclaration(o))&&o.name!==void 0&&Xn.isIdentifier(o.name)?o.name.text:null;let i=o.parent;if(Xn.isModuleBlock(i)&&Xn.isModuleDeclaration(i.parent)&&Xn.isIdentifier(i.parent.name))return`${i.parent.name.text}.${s.text}`;if(!Xn.isInterfaceDeclaration(i))return null;let a=i.name.text,l=s.text;return Jx.has(a)?`${a}.${l}`:a.endsWith("Constructor")?`${a.slice(0,-11)}.${l}`:`${a}.prototype.${l}`}function Cf(e){let n=cl.get(e);return n===void 0?void 0:{id:`ecmascript:${e}`,...n}}var YC=cl.size;import ks from"typescript";var ul=["get","post","put","patch","delete","options","head","all"],Qx=[{id:"express@4-source-v1",packages:["express"],members:new Set([...ul,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://expressjs.com/en/4x/api.html#app.METHOD \u2014 callbacks receive (req, res, next); error-handling middleware receives (err, req, res, next)"},{id:"koa@2-source-v1",packages:["koa","@koa/router","koa-router"],members:new Set([...ul,"use"]),sourceClass:"remote-unauthenticated",evidence:"https://koajs.com/#context \u2014 middleware receives (ctx, next); ctx.request carries the request"},{id:"fastify@4-source-v1",packages:["fastify"],members:new Set(ul),sourceClass:"remote-unauthenticated",evidence:"https://fastify.dev/docs/latest/Reference/Routes/ \u2014 handler receives (request, reply)"}];function Mf(e){let n=new Set(e.map(t=>t.startsWith("@")?t.split("/").slice(0,2).join("/"):t.split("/")[0]));return Qx.filter(t=>t.packages.some(s=>n.has(s)))}function Jo(e,n){if(n.length===0)return null;let t=e.expression;for(;ks.isParenthesizedExpression(t);)t=t.expression;if(!ks.isPropertyAccessExpression(t))return null;let s=t.name.text,r=n.find(a=>a.members.has(s));if(r===void 0)return null;let o=e.arguments.filter(a=>ks.isArrowFunction(a)||ks.isFunctionExpression(a)||ks.isIdentifier(a)||ks.isPropertyAccessExpression(a)),i=e.arguments.filter(ks.isCallExpression);return o.length>0||i.length>0?{model:r,handlers:o,forwarded:i}:null}function jr(e,n){return e.id.startsWith("express@")&&n===4?1:0}function ws(e){return M.isFunctionDeclaration(e)||M.isFunctionExpression(e)||M.isArrowFunction(e)||M.isMethodDeclaration(e)||M.isConstructorDeclaration(e)||M.isGetAccessorDeclaration(e)||M.isSetAccessorDeclaration(e)}var Qo=(e,n,t)=>({path:e,start:n.getStart(t,!1),end:n.getEnd()});function Zx(e,n,t){let s=[];for(let r of e.parameters){if(M.isIdentifier(r.name)&&r.name.text==="this")continue;let o=M.isIdentifier(r.name)?r.name.text:void 0;s.push({index:s.length,kind:r.dotDotDotToken!==void 0?"rest":"positional",...o!==void 0?{name:o}:{},destructured:o===void 0,hasDefault:r.initializer!==void 0,range:Qo(n,r,t)})}return s}function ek(e){return M.isArrowFunction(e)?"lexical":"call"}function nk(e){let n=!1,t=s=>{if(!n&&!(s!==e&&ws(s)&&!M.isArrowFunction(s))){if(M.isIdentifier(s)&&s.text==="arguments"){let r=s.parent;M.isPropertyAccessExpression(r)&&r.name===s||M.isPropertyAssignment(r)&&r.name===s||(n=!0)}M.isCallExpression(s)&&M.isIdentifier(s.expression)&&s.expression.text==="eval"&&(n=!0),M.forEachChild(s,t)}};e.body!==void 0&&M.forEachChild(e.body,t);for(let s of e.parameters)s.initializer!==void 0&&t(s.initializer);return n}function pl(e,n,t,s=[],r,o=new Map){let i=new Map;if(s.length>0){let p=u=>{if(M.isCallExpression(u)){let m=Jo(u,s);for(let g of m?.handlers??[])m!==null&&(M.isArrowFunction(g)||M.isFunctionExpression(g))&&i.set(g,{model:m.model,index:jr(m.model,g.parameters.length),registeredAt:Qo(t,u,n)})}M.forEachChild(u,p)};p(n)}for(let[p,u]of o)i.has(p)||i.set(p,u);let a=[],l=p=>{ws(p)&&a.push({start:p.getStart(n,!1),end:p.getEnd(),node:p}),M.forEachChild(p,l)};l(n),a.sort((p,u)=>p.start-u.start||u.end-p.end);let d=p=>{let u=0,m=a.length;for(;u<m;){let g=u+m>>>1;(a[g]?.start??1/0)<p?u=g+1:m=g}return u},c=e.map(p=>{if(p.declRange.path!==t||p.name==="<toplevel>")return;let{start:u,end:m}=p.declRange,g=d(u);for(;g<a.length&&(a[g]?.start??1/0)<m&&(a[g]?.end??0)>m;)g+=1;let y=a[g];if(y===void 0||y.start>=m||y.end>m)return;let b=a[d(y.end)];if(!(b!==void 0&&b.start<m&&b.end<=m))return y.node}),f=new Set(c.filter(p=>p!==void 0));return e.map((p,u)=>{if(p.name==="<toplevel>"&&p.declRange.path===t){let b=$f(n,f,n,i,r);return b!==void 0?{...p,valueFlows:b}:p}let m=c[u];if(m===void 0)return p;let g=$f(m,f,n,i,r),y=i.get(m);return{...p,...y!==void 0?{sourceParams:[{index:y.index,sourceClass:y.model.sourceClass,model:y.model.id,registeredAt:y.registeredAt}]}:{},params:Zx(m,t,n),receiver:ek(m),reflectiveArguments:nk(m),...g!==void 0?{valueFlows:g}:{}}})}var tk=new Set(["call","apply","bind"]),Tf=new WeakMap;function Ff(e,n){let t=Tf.get(n.checker);t===void 0&&(t=new WeakMap,Tf.set(n.checker,t));let s=t.get(e);if(s!==void 0)return s;let r=ll(n.program,n.checker,e),o=r==="ecmascript"?Pf(n.checker,e):null,i=o!==null?Cf(o):void 0,a={calleeDecl:r,identity:o,...i!==void 0?{summary:i}:{}};return t.set(e,a),a}function ml(e,n,t,s,r){let o=n;for(;M.isParenthesizedExpression(o);)o=o.expression;let i=M.isPropertyAccessExpression(o)||M.isElementAccessExpression(o)?o.expression:void 0,a=i!==void 0?{receiverRange:Qo(t,i,s)}:{},l={repeats:sk(e)},d=r!==void 0?Ff(n,r):void 0,c=d?.calleeDecl,f=d?.identity??null,p=d?.summary,u={...c!==void 0?{calleeDecl:c}:{},...p!==void 0?{summary:p}:{},...f!==null?{runtimeId:`ecmascript:${f}`}:{},...r!==void 0&&i!==void 0&&Fr(r.program,r.checker,i)?{receiverPrimitive:!0}:{}};if(M.isTaggedTemplateExpression(e))return{convention:"unknown",...a,...l,...u};let m=M.isPropertyAccessExpression(o)&&tk.has(o.name.text);return{args:e.arguments.map((y,b)=>({index:b,spread:M.isSpreadElement(y)?"positional":!1,range:Qo(t,y,s),...r!==void 0&&!M.isSpreadElement(y)&&Fr(r.program,r.checker,y)?{primitive:!0}:{}})),convention:m?"unknown":"direct",...a,...l,...u}}function sk(e){for(let n=e.parent;n!==void 0;n=n.parent){if(M.isForStatement(n)||M.isForInStatement(n)||M.isForOfStatement(n)||M.isWhileStatement(n)||M.isDoStatement(n))return!0;if(M.isFunctionDeclaration(n)||M.isMethodDeclaration(n)||M.isConstructorDeclaration(n)||M.isGetAccessorDeclaration(n)||M.isSetAccessorDeclaration(n))return!1;if(M.isFunctionExpression(n)||M.isArrowFunction(n))return!(M.isVariableDeclaration(n.parent)&&n.parent.initializer===n)}return!0}var jf=2e4,Xs={kind:"constant"},yn=e=>({kind:"opaque",reason:e}),Zo=class extends Error{},rk=new Set([M.SyntaxKind.BarBarToken,M.SyntaxKind.AmpersandAmpersandToken,M.SyntaxKind.QuestionQuestionToken,M.SyntaxKind.BarBarEqualsToken,M.SyntaxKind.AmpersandAmpersandEqualsToken,M.SyntaxKind.QuestionQuestionEqualsToken]),ok=new Set([M.SyntaxKind.EqualsToken,M.SyntaxKind.BarBarEqualsToken,M.SyntaxKind.AmpersandAmpersandEqualsToken,M.SyntaxKind.QuestionQuestionEqualsToken]);function Bt(e){switch(e.kind){case"param":return`p${String(e.index)}`;case"local":return`l${e.name}@${String(e.declStart)}`;case"free":return`f${e.name}`;case"call-result":return`c${String(e.at)}-${String(e.end)}`;case"argument":return`a${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"call-receiver":return`r${String(e.at)}-${String(e.end)}`;case"mutated-by-call":return`m${String(e.at)}-${String(e.end)}:${String(e.index)}`;case"opaque":return`o${e.reason}`;case"source":return`s${e.model}`;case"shared":return`h${String(e.id)}`;default:return e.kind}}var Br=e=>e.kind==="local"||e.kind==="param"||e.kind==="receiver"||e.kind==="free";function fl(e){if(M.isIdentifier(e))return[];let n=[];for(let t of e.elements)M.isOmittedExpression(t)||(t.initializer!==void 0&&n.push(t),n.push(...fl(t.name)));return n}function ik(e){return M.isWithStatement(e)||M.isCallExpression(e)&&M.isIdentifier(e.expression)&&e.expression.text==="eval"}function $f(e,n,t,s,r){let o=[],i=(x,T,q)=>{for(let G of x)for(let z of T)if(o.push({from:G,to:z,kind:q}),o.length>jf)throw new Zo},a=x=>x.getStart(t,!1),l=x=>({at:x.getStart(t,!1),end:x.getEnd()}),d=x=>r!==void 0&&Fr(r.program,r.checker,x),c=new Map,f=new Map,p=(x,T)=>{f.set(x,T);let q=c.get(x.text);q===void 0?c.set(x.text,[T]):q.push(T)},u=x=>{if(M.isIdentifier(x))return[x];let T=[];for(let q of x.elements)M.isOmittedExpression(q)||T.push(...u(q.name));return T},m=x=>({kind:"local",name:x.text,declStart:a(x)}),g=M.isSourceFile(e)?[]:e.parameters.filter(x=>!(M.isIdentifier(x.name)&&x.name.text==="this"));g.forEach((x,T)=>{if(M.isIdentifier(x.name))p(x.name,{kind:"param",index:T});else for(let q of u(x.name))p(q,m(q))});let y=x=>{for(let T=x.parent;T!==void 0&&T!==e;T=T.parent)if(ws(T)&&!M.isArrowFunction(T))return!0;return!1},b=x=>{if(x!==e&&ws(x)){if(n.has(x))return;for(let T of x.parameters)for(let q of u(T.name))p(q,m(q))}else if(M.isVariableDeclaration(x))for(let T of u(x.name))p(T,m(T));else if((M.isFunctionDeclaration(x)||M.isClassDeclaration(x))&&x.name!==void 0&&x!==e)p(x.name,m(x.name));else if(M.isCatchClause(x)&&x.variableDeclaration!==void 0)for(let T of u(x.variableDeclaration.name))p(T,m(T));M.forEachChild(x,b)},_=[];M.isSourceFile(e)?_.push(e):e.body!==void 0&&_.push(e.body);for(let x of g){x.initializer!==void 0&&_.push(x.initializer);for(let T of fl(x.name))T.initializer!==void 0&&_.push(T.initializer)}for(let x of _)b(x);let S=x=>r===void 0?{kind:"free",name:x.text}:{kind:"free",name:x.text,binding:Rf(r.program,r.checker,x)},k=x=>{if(r===void 0)return;let T;try{let L=x.parent;T=L!==void 0&&M.isShorthandPropertyAssignment(L)&&L.name===x?r.checker.getShorthandAssignmentValueSymbol(L):r.checker.getSymbolAtLocation(x)}catch{return}let q=T?.declarations??[];if(q.length===0)return;let G=[],z=!1;for(let L of q){let ie=M.getNameOfDeclaration(L),me=ie===void 0?void 0:f.get(ie);me===void 0?z=!0:G.push(me)}return z&&G.push(S(x)),G},v=x=>{if(x.text==="undefined")return[Xs];if(x.text==="arguments")return[yn("reflective")];let T=k(x);return T!==void 0?T:c.get(x.text)??[S(x)]},I=x=>{if(n.has(x))return[];if(M.isArrowFunction(x)&&!M.isBlock(x.body))return[x.body];let T=[],q=G=>{ws(G)||((M.isReturnStatement(G)||M.isYieldExpression(G))&&G.expression!==void 0&&T.push(G.expression),M.forEachChild(G,q))};return x.body!==void 0&&M.forEachChild(x.body,q),T},O=x=>{if(M.isStringLiteral(x)||M.isNumericLiteral(x)||M.isBigIntLiteral(x)||M.isNoSubstitutionTemplateLiteral(x)||M.isRegularExpressionLiteral(x)||x.kind===M.SyntaxKind.TrueKeyword||x.kind===M.SyntaxKind.FalseKeyword||x.kind===M.SyntaxKind.NullKeyword||M.isVoidExpression(x)||M.isDeleteExpression(x))return[Xs];if(M.isFunctionExpression(x)||M.isArrowFunction(x)||M.isClassExpression(x))return[yn("unmodeled")];if(M.isIdentifier(x))return v(x);if(x.kind===M.SyntaxKind.ThisKeyword)return y(x)||M.isSourceFile(e)?[yn("unmodeled")]:[{kind:"receiver"}];if(M.isParenthesizedExpression(x)||M.isAsExpression(x)||M.isNonNullExpression(x)||M.isTypeAssertionExpression(x)||M.isSatisfiesExpression(x)||M.isSpreadElement(x)||M.isTypeOfExpression(x)||M.isAwaitExpression(x))return O(x.expression);if(M.isYieldExpression(x))return[yn("unmodeled")];if(M.isPropertyAccessExpression(x)||M.isElementAccessExpression(x))return O(x.expression);if(M.isCallExpression(x)){if(M.isIdentifier(x.expression)&&x.expression.text==="require"){let T=x.arguments[0];return T!==void 0&&M.isStringLiteralLike(T)?[Xs]:[yn("unmodeled")]}return x.expression.kind===M.SyntaxKind.ImportKeyword?[yn("unmodeled")]:[{kind:"call-result",...l(x)}]}if(M.isTaggedTemplateExpression(x))return[{kind:"call-result",...l(x)}];if(M.isNewExpression(x))return[yn("construct")];if(M.isConditionalExpression(x))return[...O(x.whenTrue),...O(x.whenFalse)];if(M.isBinaryExpression(x)){let T=x.operatorToken.kind;return T===M.SyntaxKind.CommaToken||T===M.SyntaxKind.EqualsToken?O(x.right):[...O(x.left),...O(x.right)]}return M.isPrefixUnaryExpression(x)||M.isPostfixUnaryExpression(x)?O(x.operand):M.isTemplateExpression(x)?x.templateSpans.flatMap(T=>O(T.expression)):M.isArrayLiteralExpression(x)?x.elements.length===0?[Xs]:x.elements.flatMap(T=>O(T)):M.isObjectLiteralExpression(x)?x.properties.length===0?[Xs]:x.properties.flatMap(T=>M.isPropertyAssignment(T)?O(T.initializer):M.isShorthandPropertyAssignment(T)?v(T.name):M.isSpreadAssignment(T)?O(T.expression):M.isSetAccessorDeclaration(T)?[Xs]:[yn("unmodeled")]):[yn("unmodeled")]},E=x=>{if(M.isIdentifier(x))return v(x).filter(Br);if(x.kind===M.SyntaxKind.ThisKeyword)return O(x).filter(Br);if(M.isParenthesizedExpression(x)||M.isAsExpression(x)||M.isNonNullExpression(x)||M.isTypeAssertionExpression(x)||M.isSatisfiesExpression(x)||M.isSpreadElement(x)||M.isAwaitExpression(x)||M.isPropertyAccessExpression(x)||M.isElementAccessExpression(x))return E(x.expression);if(M.isConditionalExpression(x))return[...E(x.whenTrue),...E(x.whenFalse)];if(M.isBinaryExpression(x)){let T=x.operatorToken.kind;return T===M.SyntaxKind.CommaToken||T===M.SyntaxKind.EqualsToken?E(x.right):rk.has(T)?[...E(x.left),...E(x.right)]:[]}if(M.isArrayLiteralExpression(x))return x.elements.flatMap(T=>E(T));if(M.isObjectLiteralExpression(x))return x.properties.flatMap(T=>M.isPropertyAssignment(T)?E(T.initializer):M.isShorthandPropertyAssignment(T)?v(T.name).filter(Br):M.isSpreadAssignment(T)?E(T.expression):M.isMethodDeclaration(T)||M.isGetAccessorDeclaration(T)?I(T).flatMap(q=>E(q)):[]);if(M.isCallExpression(x)||M.isNewExpression(x)||M.isTaggedTemplateExpression(x)){if(M.isCallExpression(x)&&Lf(x))return[];if(d(x))return[];let T=M.isTaggedTemplateExpression(x)?M.isTemplateExpression(x.template)?x.template.templateSpans.map(z=>z.expression):[]:[...x.arguments??[]],q=M.isTaggedTemplateExpression(x)?x.tag:x.expression;for(;M.isParenthesizedExpression(q);)q=q.expression;let G=M.isPropertyAccessExpression(q)||M.isElementAccessExpression(q)?E(q.expression):E(q).filter(z=>z.kind!=="free");return[...T.flatMap(z=>d(z)?[]:E(z)),...G]}return M.isFunctionExpression(x)||M.isArrowFunction(x)?I(x).flatMap(T=>E(T)):[]},N=x=>M.isIdentifier(x)?v(x):M.isParenthesizedExpression(x)||M.isNonNullExpression(x)||M.isAsExpression(x)||M.isSatisfiesExpression(x)||M.isTypeAssertionExpression(x)?N(x.expression):M.isPropertyAccessExpression(x)||M.isElementAccessExpression(x)?E(x.expression):M.isArrayLiteralExpression(x)?x.elements.flatMap(T=>N(T)):M.isObjectLiteralExpression(x)?x.properties.flatMap(T=>M.isShorthandPropertyAssignment(T)?v(T.name):M.isPropertyAssignment(T)?N(T.initializer):M.isSpreadAssignment(T)?N(T.expression):[]):M.isSpreadElement(x)?N(x.expression):M.isBinaryExpression(x)&&x.operatorToken.kind===M.SyntaxKind.EqualsToken?N(x.left):[],A=x=>M.isParenthesizedExpression(x)||M.isNonNullExpression(x)||M.isAsExpression(x)||M.isSatisfiesExpression(x)||M.isTypeAssertionExpression(x)||M.isSpreadElement(x)?A(x.expression):M.isPropertyAccessExpression(x)||M.isElementAccessExpression(x)?E(x.expression):M.isArrayLiteralExpression(x)?x.elements.flatMap(T=>A(T)):M.isObjectLiteralExpression(x)?x.properties.flatMap(T=>M.isPropertyAssignment(T)?A(T.initializer):M.isSpreadAssignment(T)?A(T.expression):[]):M.isBinaryExpression(x)&&x.operatorToken.kind===M.SyntaxKind.EqualsToken?A(x.left):[],U=x=>E(x).filter(T=>T.kind==="local"||T.kind==="param"||T.kind==="receiver"),$=new Map,W=new Map,w=x=>{let T=x;for(let q=$.get(T);q!==void 0&&q!==T;q=$.get(T))T=q;for(let q=x;q!==T;){let G=$.get(q)??T;$.set(q,T),q=G}return T},P=(x,T)=>{let q=Bt(x),G=Bt(T);W.has(q)||(W.set(q,x),$.set(q,q)),W.has(G)||(W.set(G,T),$.set(G,G));let z=w(q),L=w(G);z!==L&&$.set(z,L)},j=(x,T)=>{let q=x.filter(Br);if(q.length===0)return;let G=E(T),z=G[0];if(z!==void 0){for(let L of G)P(z,L);for(let L of q)P(z,L)}},F=new Map,B=(x,T)=>{for(let q of x){if(!Br(q))continue;let G=Bt(q),z=F.get(G);z===void 0&&(z=new Map,F.set(G,z));for(let L of T)z.set(Bt(L),L)}};g.forEach((x,T)=>{let q={kind:"param",index:T};if(x.initializer!==void 0&&(i(O(x.initializer),[q],"copy"),j([q],x.initializer)),!M.isIdentifier(x.name)){let G=u(x.name).map(m);i([q],G,"field");for(let z of G)P(q,z);for(let z of fl(x.name)){if(z.initializer===void 0)continue;let L=u(z.name).map(m);i(O(z.initializer),L,"copy"),j(L,z.initializer)}}});let ne=x=>{if(x!==e&&ws(x)){if(n.has(x))return;let T=s.get(x);x.parameters.forEach((q,G)=>{let z=T!==void 0&&G===T.index?{kind:"source",sourceClass:T.model.sourceClass,model:T.model.id}:yn("inner-function-param");i([z],u(q.name).map(m),"copy")})}else if(M.isVariableDeclaration(x)&&x.initializer!==void 0){let T=u(x.name).map(m);i(O(x.initializer),T,M.isIdentifier(x.name)?"copy":"field"),j(T,x.initializer)}else if(M.isBindingElement(x)&&x.initializer!==void 0){let T=u(x.name).map(m);i(O(x.initializer),T,"copy"),j(T,x.initializer)}else if(M.isCatchClause(x)&&x.variableDeclaration!==void 0)i([yn("caught")],u(x.variableDeclaration.name).map(m),"copy");else if(M.isTryStatement(x)&&x.catchClause?.variableDeclaration!==void 0){let T=u(x.catchClause.variableDeclaration.name).map(m),q=[],G=z=>{if(!n.has(z)){if(M.isThrowStatement(z))q.push(z.expression);else if(M.isCallExpression(z)||M.isNewExpression(z)){q.push(...z.arguments??[]);let L=z.expression;for(;M.isParenthesizedExpression(L);)L=L.expression;(M.isPropertyAccessExpression(L)||M.isElementAccessExpression(L))&&q.push(L.expression)}M.forEachChild(z,G)}};G(x.tryBlock);for(let z of q)d(z)||j(T,z)}else if((M.isFunctionDeclaration(x)||M.isClassDeclaration(x))&&x.name!==void 0&&x!==e)i([yn("unmodeled")],[m(x.name)],"copy");else if(M.isForOfStatement(x)||M.isForInStatement(x)){let T=x.initializer,q=M.isVariableDeclarationList(T)?T.declarations.flatMap(z=>u(z.name).map(m)):N(T),G=O(x.expression);i(G,q,"derive"),M.isVariableDeclarationList(T)||B(A(T),G),M.isForOfStatement(x)&&j(q,x.expression)}else if(M.isBinaryExpression(x)&&ak(x.operatorToken.kind)){let T=x.operatorToken.kind===M.SyntaxKind.EqualsToken?O(x.right):[...O(x.left),...O(x.right)],q=N(x.left);i(T,q,M.isIdentifier(x.left)?"copy":"field"),B(A(x.left),T),ok.has(x.operatorToken.kind)&&j(q,x.right)}else if(M.isShorthandPropertyAssignment(x)&&x.objectAssignmentInitializer!==void 0){let T=v(x.name);i(O(x.objectAssignmentInitializer),T,"copy"),j(T,x.objectAssignmentInitializer)}else if(M.isReturnStatement(x)&&x.expression!==void 0&&Df(x)===e)i(O(x.expression),[{kind:"return"}],"return");else if(M.isYieldExpression(x)&&x.expression!==void 0&&Df(x)===e)i(O(x.expression),[{kind:"return"}],"return");else if(M.isCallExpression(x)&&!Lf(x)){let T=l(x);x.arguments.forEach((ie,me)=>{if(i(O(ie),[{kind:"argument",...T,index:me}],"argument"),!d(ie)){let be={kind:"mutated-by-call",...T,index:me},Me=U(ie);i([be],Me,"mutation"),B(Me,[be])}});let q=x.expression;for(;M.isParenthesizedExpression(q);)q=q.expression;let G=M.isPropertyAccessExpression(q)||M.isElementAccessExpression(q)?q.expression:void 0,z=ie=>ie.kind==="receiver"?G!==void 0?[G]:[]:ie.kind==="arg"?x.arguments.slice(ie.index,ie.index+1):x.arguments.slice(ie.index),L=r!==void 0?Ff(x.expression,r):void 0;for(let ie of L?.summary?.mutates??[]){let me=[...z(ie.into),...ie.from.flatMap(z)].filter(Me=>!d(Me)).flatMap(Me=>E(Me)),be=me[0];if(be!==void 0)for(let Me of me)P(be,Me)}if((M.isPropertyAccessExpression(q)||M.isElementAccessExpression(q))&&(i(O(q.expression),[{kind:"call-receiver",...T}],"argument"),!d(q.expression))){let ie={kind:"mutated-by-call",...T,index:-1},me=U(q.expression);i([ie],me,"mutation"),B(me,[ie])}}else if(M.isNewExpression(x))for(let T of x.arguments??[]){if(d(T))continue;let q=U(T);i([yn("construct")],q,"mutation"),B(q,[yn("construct")])}M.forEachChild(x,ne)},X=()=>{let x=new Map,T=z=>{for(let L of z)L.kind==="local"&&x.set(Bt(L),L)},q=z=>{let L=z.parent;L!==void 0&&L.name===z&&!M.isShorthandPropertyAssignment(L)||L!==void 0&&(M.isCallExpression(L)||M.isNewExpression(L)||M.isTaggedTemplateExpression(L))&&(M.isTaggedTemplateExpression(L)?L.tag:L.expression)===z||d(z)||T(k(z)??c.get(z.text)??[])},G=(z,L)=>{let ie=L||n.has(z);ie&&M.isIdentifier(z)&&q(z),M.forEachChild(z,me=>{G(me,ie)})};G(t,!1);for(let z of t.statements){let L=M.canHaveModifiers(z)&&(M.getModifiers(z)??[]).some(ie=>ie.kind===M.SyntaxKind.ExportKeyword);if(L&&M.isVariableStatement(z))for(let ie of z.declarationList.declarations)T(u(ie.name).map(m));else if(L&&(M.isFunctionDeclaration(z)||M.isClassDeclaration(z))&&z.name!==void 0)T([m(z.name)]);else if(M.isExportDeclaration(z)&&z.moduleSpecifier===void 0&&z.exportClause!==void 0&&M.isNamedExports(z.exportClause))for(let ie of z.exportClause.elements)T(c.get((ie.propertyName??ie.name).text)??[]);else M.isExportAssignment(z)&&T(E(z.expression))}return[...x.values()]},Q=()=>{let x=!1,T=q=>{if(!x&&!(q!==e&&n.has(q)&&!M.isSourceFile(e))){if(ik(q)){x=!0;return}M.forEachChild(q,T)}};for(let q of _)T(q);return x},Z=()=>{let x=new Map;for(let[q,G]of W){let z=w(q),L=x.get(z);L===void 0?x.set(z,[G]):L.push(G)}let T=0;for(let q of x.values()){if(q.length<2)continue;let G=new Map;for(let L of q)for(let[ie,me]of F.get(Bt(L))??[])G.set(ie,me);for(let L of q)L.kind==="free"&&G.set(Bt(L),L);if(G.size>0){let L={kind:"shared",id:T};T+=1,i([...G.values()],[L],"mutation"),i([L],q.filter(ie=>ie.kind!=="free"),"mutation")}let z=q.filter(L=>L.kind==="param"||L.kind==="receiver");if(z.length>=2)for(let L of z)i(z.filter(ie=>Bt(ie)!==Bt(L)),[L],"mutation")}};try{for(let x of _)ne(x);if(!M.isSourceFile(e)&&M.isArrowFunction(e)&&!M.isBlock(e.body)&&i(O(e.body),[{kind:"return"}],"return"),M.isSourceFile(e)){let x=X();i([yn("unmodeled")],x,"mutation"),B(x,[yn("unmodeled")])}if(Q()){let x=[...c.values()].flat(),T=g.map((G,z)=>({kind:"param",index:z})),q=M.isSourceFile(e)?[]:[{kind:"receiver"}];i([yn("reflective")],[...x,...T,...q],"mutation")}Z()}catch(x){if(x instanceof Zo)return;throw x}return o}function ak(e){return e>=M.SyntaxKind.FirstAssignment&&e<=M.SyntaxKind.LastAssignment}function Lf(e){return M.isIdentifier(e.expression)&&e.expression.text==="require"||e.expression.kind===M.SyntaxKind.ImportKeyword}function Df(e){for(let n=e.parent;n!==void 0;n=n.parent)if(ws(n))return n}import fe from"typescript";var Kf=4,lk=[{id:"express-async-handler@1-forwarder-v1",package:"express-async-handler",versions:"0.0.1 - 1.2.0: all 13 published versions, read 2026-09-24",shape:{param:0,arity:[3,0],passes:3},evidence:"index.js, 1.1.4 and 1.2.0 (npm dist.shasum 225a84908df63b35ae9df94b6f0f1af061266426, ffc9896061d90f8d2e71a2d2b8668db5b0934391): `const asyncUtil = fn => function asyncUtilWrap(...args) { const fnReturn = fn(...args) ...`, `module.exports = asyncUtil`. 0.0.1-1.0.2: `(req, res, next) => ... fn(req, res, next)`; 1.0.3-1.1.3: `(req, res, next, ...args)` calling `fn(req, res, next, ...args)` (1.1.0 on both branches of `fn instanceof Promise`). https://github.com/Abazhenov/express-async-handler"}];function zf(e){return lk.find(n=>n.package===e)}var dk=8;function Wf(e){if(!(fe.isFunctionDeclaration(e)||fe.isFunctionExpression(e)||fe.isArrowFunction(e)||fe.isMethodDeclaration(e))||e.body===void 0||ck(e)||!fe.isArrowFunction(e)&&e.asteriskToken!==void 0||fe.canHaveDecorators(e)&&(fe.getDecorators(e)??[]).length>0||fk(e))return null;let n=pk(e);if(n===null||fe.isFunctionExpression(n)&&n.asteriskToken!==void 0)return null;let t=uk(n);if(t===null||t.length===0)return null;let s=t.map(u=>u.text),r=new Set(s),o=new Map,i=Uf(e);for(let u=0;u<i.length;u+=1){let m=i[u];if(m===void 0)continue;let g=m.name;if(fe.isIdentifier(g)){if(o.has(g.text))return null;m.dotDotDotToken!==void 0||m.initializer!==void 0||r.has(g.text)||o.set(g.text,{index:u,decl:g})}}let a=[...mk(n,o,s)],l=a[0];if(a.length!==1||l===void 0||l[1].length>dk)return null;let[d,c]=l,f=o.get(d);if(f===void 0)return null;let p=0;for(let u of c)gk(u,n)&&(p=Math.max(p,u.arguments.length));return p===0||!Gf(e,new Map([[d,f.decl]]))||!Gf(n,new Map(t.slice(0,p).map(u=>[u.text,u])))?null:{param:f.index,arity:[t.length],passes:p}}function Uf(e){return e.parameters.filter(n=>!(fe.isIdentifier(n.name)&&n.name.text==="this"))}function ck(e){return fe.canHaveModifiers(e)&&(fe.getModifiers(e)??[]).some(n=>n.kind===fe.SyntaxKind.AsyncKeyword)}function uk(e){let n=[],t=new Set;for(let s of Uf(e)){let r=s.name;if(!fe.isIdentifier(r)||s.dotDotDotToken!==void 0||s.initializer!==void 0||t.has(r.text))return null;t.add(r.text),n.push(r)}return n}function fk(e){let n=!1,t=s=>{n||((fe.isWithStatement(s)||fe.isIdentifier(s)&&(s.text==="arguments"||s.text==="eval")&&!Hf(s))&&(n=!0),fe.forEachChild(s,t))};return fe.forEachChild(e,t),n}function pk(e){let n=e.body;if(n===void 0)return null;let t=i=>{if(i===void 0)return null;let a=an(i);return fe.isArrowFunction(a)||fe.isFunctionExpression(a)?a:null};if(!fe.isBlock(n))return t(n);let s=[],r=i=>{fe.isFunctionLike(i)||fe.isClassLike(i)||(fe.isReturnStatement(i)&&s.push(i),fe.forEachChild(i,r))};fe.forEachChild(n,r);let o=s[0];return s.length!==1||o===void 0||o.parent!==n?null:t(o.expression)}function mk(e,n,t){let s=new Map,r=i=>{if(fe.isCallExpression(i)&&fe.isIdentifier(i.expression)&&n.has(i.expression.text)&&i.questionDotToken===void 0&&i.arguments.length>0&&i.arguments.length<=t.length&&i.arguments.every((a,l)=>fe.isIdentifier(a)&&a.text===t[l])){let a=s.get(i.expression.text);a===void 0?s.set(i.expression.text,[i]):a.push(i)}fe.forEachChild(i,r)},o=e.body;return fe.isBlock(o)?fe.forEachChild(o,r):r(o),s}function gk(e,n){let t=e;for(;;){let s=t.parent;if(s===n)return fe.isArrowFunction(n)&&n.body===t;if(fe.isParenthesizedExpression(s)||fe.isAwaitExpression(s)||fe.isAsExpression(s)||fe.isNonNullExpression(s)||fe.isSatisfiesExpression(s)||fe.isTypeAssertionExpression(s)){t=s;continue}if((fe.isPropertyAccessExpression(s)||fe.isElementAccessExpression(s))&&s.expression===t){t=s;continue}if(fe.isCallExpression(s)){if(s.expression===t){t=s;continue}if(!fe.isOptionalChain(s)&&s.arguments.some(r=>r===t)){t=s;continue}return!1}if(fe.isVariableDeclaration(s)&&s.initializer===t){let o=s.parent.parent;return fe.isVariableStatement(o)&&Bf(o,n)}return(fe.isExpressionStatement(s)||fe.isReturnStatement(s))&&s.expression===t?Bf(s,n):!1}}function Bf(e,n){let t=e;for(;;){let s=t.parent;if(!fe.isBlock(s))return!1;for(let o of s.statements){if(o===t)break;if(!(fe.isExpressionStatement(o)||fe.isVariableStatement(o)||fe.isEmptyStatement(o)))return!1}if(s===n.body)return!0;let r=s.parent;if(!fe.isTryStatement(r)||r.tryBlock!==s)return!1;t=r}}function Gf(e,n){let t=!0,s=r=>{if(t){if(fe.isIdentifier(r)){let o=n.get(r.text);o!==void 0&&r!==o&&!Hf(r)&&!hk(r)&&(t=!1)}fe.forEachChild(r,s)}};return fe.forEachChild(e,s),t}function hk(e){let n=e.parent;return fe.isCallExpression(n)&&(n.expression===e||n.arguments.some(t=>t===e))||fe.isNewExpression(n)&&(n.arguments??[]).some(t=>t===e)||fe.isTypeOfExpression(n)||(fe.isPropertyAccessExpression(n)||fe.isElementAccessExpression(n))&&n.expression===e}function Hf(e){let n=e.parent;return(fe.isPropertyAccessExpression(n)||fe.isPropertyAssignment(n)||fe.isMethodDeclaration(n)||fe.isPropertyDeclaration(n)||fe.isGetAccessorDeclaration(n)||fe.isSetAccessorDeclaration(n))&&n.name===e||fe.isBindingElement(n)&&n.propertyName===e}function qf(e,n,t){let s=null,r=o=>{if(s!==null)return;let i=o.getStart(e,!1),a=o.getEnd();if(i===n&&a===t){if(fe.isVariableDeclaration(o)&&o.initializer!==void 0){let l=an(o.initializer);s=fe.isArrowFunction(l)||fe.isFunctionExpression(l)?l:null}else(fe.isFunctionDeclaration(o)||fe.isFunctionExpression(o)||fe.isArrowFunction(o)||fe.isMethodDeclaration(o))&&(s=o);if(s!==null)return}o.pos<=n&&a>=t&&fe.forEachChild(o,r)};return r(e),s}var Xf=3;function je(e,n,t){if(e===void 0)return;let s=e[n]??={fired:0,refused:{}};t===null?s.fired+=1:s.refused[t]=(s.refused[t]??0)+1}function xt(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var ni=16,bl=256,gl=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let s=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(s)||(this.moduleFor(n),this.fns.set(s,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let s=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(s)||(this.moduleFor(n),this.classNodes.set(s,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(s,[])),r}methodFor(n,t,s,r){let o=`${n}#${t}.${s}`,i=`pkg:${n}#${t}.${s}`;if(!this.fns.has(o)){let a=this.classFor(n,t);this.fns.set(o,{id:i,moduleId:`pkg:${n}`,name:s,kind:r,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(i)}return i}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function rp(e,n){let t="node_modules/",s=e.lastIndexOf(t);if(s===-1)return n;let o=e.slice(s+t.length).split("/");return o[0]?.startsWith("@")&&o.length>=2?`${o[0]}/${o[1]}`:o[0]??n}function Yf(e,n,t){let s=Mn.dirname(e),r=Mn.dirname(n),o=[];for(;;){let a=t.get(s);if(a!==void 0){for(let d of o)t.set(d,a);return a}o.push(s);let l=_n(Mn.join(s,"package.json"));if(l!==null)try{let d=JSON.parse(l),c={name:d.name??"app",version:d.version??"0.0.0",dir:s};for(let f of o)t.set(f,c);return c}catch{}if(s===r||s===Mn.dirname(s))break;s=Mn.dirname(s)}let i={name:"app",version:"0.0.0",dir:null};for(let a of o)t.set(a,i);return i}function hl(e){return h.isParenthesizedExpression(e)?hl(e.expression):h.isStringLiteralLike(e)?e.text:h.isTemplateExpression(e)?e.head.text:h.isBinaryExpression(e)&&e.operatorToken.kind===h.SyntaxKind.PlusToken?hl(e.left):null}function yk(e){if(!h.isCallExpression(e))return!1;let n=e.expression,t=h.isPropertyAccessExpression(n)?n.name.text:h.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let s=e.arguments[0];return s!==void 0&&h.isIdentifier(s)&&(s.text==="__dirname"||s.text==="__filename")}function op(e){let n=hl(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":yk(e)?"relative-bounded":"unknown"}function bk(e){let n=[],t=r=>{if(e.isDeclarationFile)return!0;for(let o=r.parent;o!==void 0;o=o.parent)if(h.isModuleDeclaration(o)&&(h.getCombinedModifierFlags(o)&h.ModifierFlags.Ambient)!==0)return!0;return!1},s=r=>{if(h.isImportDeclaration(r)&&h.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1,at:r.getStart(e),runsBody:r.importClause?.isTypeOnly!==!0&&!t(r),loadShape:"require"});else if(h.isImportEqualsDeclaration(r)&&h.isExternalModuleReference(r.moduleReference)&&h.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1,at:r.getStart(e),runsBody:!r.isTypeOnly&&!t(r),loadShape:"require"});else if(h.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&h.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1,at:r.getStart(e),runsBody:!r.isTypeOnly&&!t(r),loadShape:"require"});else if(h.isCallExpression(r)){let o=Dr(r);if(o!==null){let i=o.specifierArg,a=i!==void 0&&h.isStringLiteralLike(i);n.push({specifier:a?i.text:void 0,specifierIsLiteral:a,dynamic:!0,...i!==void 0&&!a?{computedArg:i,loadPos:r.getStart(e)}:{},at:r.getStart(e),runsBody:!t(r),loadShape:Ve(r.expression).kind===h.SyntaxKind.ImportKeyword?"dynamic-import":"require"})}}h.forEachChild(r,s)};return s(e),n}function _k(e,n,t){let s=new Map,r=Yf(Mn.join(e.appRoot,"package.json"),e.appRoot,s),o=[],i=[],a=[],l=new Map,d=new Map,c=new Set,f=[],p=new Set;for(let u of e.sourceFiles){let m=e.toRel(u.fileName);m!==null&&p.add(m)}for(let u of e.sourceFiles){let m=e.toRel(u.fileName);if(m===null)continue;let g=Yf(u.fileName,e.appRoot,s),y=rp(m,r.name),b=m.includes("node_modules/");o.push({id:m,packageName:b&&g.name!==r.name?g.name:y,versionRange:g.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),g.dir===r.dir&&c.add(m);let _=0,S=null;for(let k of bk(u)){let v=`${m}#import${String(_)}`;_+=1;let I=null,O=[];if(k.specifier!==void 0)if(Ze(k.specifier)==="package-root")I=t.moduleFor(Bn(k.specifier));else{let E=Gn(k.specifier,u.fileName,e.options,e.host),N=E!==null?e.toRel(E):null;if(N!==null)I=N;else if(k.specifier!==void 0){let[A,...U]=qs(k.specifier,u.fileName,e.options,e.host).map($=>e.toRel($)).filter($=>$!==null&&p.has($));A!==void 0&&U.length>=1&&(I=A,O=U.map($=>$))}}i.push({id:v,moduleId:m,specifier:k.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:k.dynamic,specifierIsLiteral:k.specifierIsLiteral,...I!==null?{resolvedModuleId:I}:{}}),I!==null&&a.push({importId:v,resolvedModuleId:I});for(let E of O)a.push({importId:v,resolvedModuleId:E});if(k.specifierIsLiteral&&k.runsBody&&I!==null){let E=[I,...O].map(N=>String(N)).filter(N=>p.has(N));if(E.length>0){let N=d.get(m)??[];N.push({pos:k.at,shape:k.loadShape,targetRels:E}),d.set(m,N)}}if(k.computedArg!==void 0&&k.loadPos!==void 0&&f.push({importId:String(v),path:m,pos:k.loadPos,shape:op(k.computedArg),text:k.computedArg.getText(u).slice(0,160)}),k.computedArg!==void 0&&k.loadPos!==void 0){S??=xs(u,u.fileName,e.resolveParamDirs);let E=[];for(let N of zo(k.computedArg,S,e.appRoot,e.options,e.host)){let A=e.toRel(N);if(A===null||!p.has(A))continue;let U=A,$=`${m}#import${String(_)}`;_+=1,i.push({id:$,moduleId:m,specifier:A,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:U}),a.push({importId:$,resolvedModuleId:U}),E.push(A)}if(E.length>0){let N=Tr(k.computedArg,S)!==null||Ko(k.computedArg),A=l.get(m)??[];A.push({pos:k.loadPos,candidateRels:E,seedable:N}),l.set(m,A)}}}}return{modules:o,imports:i,importEdges:a,computedLoads:l,literalLoads:d,appOwnedPaths:c,loadSites:f}}function Sk(e){let n=_n(e);if(n===null)return null;let t=h.createSourceFile(e,n,h.ScriptTarget.Latest,!0),s=r=>t.statements.some(o=>h.isFunctionDeclaration(o)?o.name?.text===r:h.isVariableStatement(o)?o.declarationList.declarations.some(i=>h.isIdentifier(i.name)&&i.name.text===r&&i.initializer!==void 0&&(h.isFunctionExpression(i.initializer)||h.isArrowFunction(i.initializer))):!1);for(let r of t.statements){if(h.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(i=>i.kind===h.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!h.isExpressionStatement(r)||!h.isBinaryExpression(r.expression))continue;let o=r.expression;if(o.operatorToken.kind===h.SyntaxKind.EqualsToken&&xk(o.left)){if(h.isFunctionExpression(o.right)&&o.right.name!==void 0)return o.right.name.text;if(h.isIdentifier(o.right)&&s(o.right.text))return o.right.text}}return null}function xk(e){return h.isPropertyAccessExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:h.isElementAccessExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="module"&&h.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function kk(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let s=d=>"surface"in d?n.moduleFor(d.surface):d.module,r=[],o=new Set;for(let d of e.modules)t.has(d)||o.has(d)||(o.add(d),r.push({id:d,packageName:e.entryRealNames[d]??rp(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let i=[],a=[],l=0;for(let d of e.edges){let c=s(d.from),f=s(d.to),p=`${String(c)}#depreach${String(l)}`;l+=1,i.push({id:p,moduleId:c,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),a.push({importId:p,resolvedModuleId:f})}return{modules:r,imports:i,importEdges:a}}function Jf(e,n,t){let s=e.expression;if(h.isIdentifier(s)&&!t.has(s.text)){let r=n.get(s.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(h.isPropertyAccessExpression(s)&&h.isIdentifier(s.expression)&&!t.has(s.expression.text)){let r=n.get(s.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:s.name.text}}return null}function vs(e){return h.canHaveModifiers(e)&&(h.getModifiers(e)?.some(n=>n.kind===h.SyntaxKind.ExportKeyword)??!1)}function wk(e){let n=new Set,t;for(let s of e.statements){if(h.isExpressionStatement(s)&&h.isBinaryExpression(s.expression)){let r=s.expression;if(r.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isPropertyAccessExpression(r.left)&&h.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(h.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(h.isObjectLiteralExpression(r.right))for(let o of r.right.properties)h.isShorthandPropertyAssignment(o)?n.add(o.name.text):h.isPropertyAssignment(o)&&h.isIdentifier(o.initializer)&&n.add(o.initializer.text)}continue}if(h.isFunctionDeclaration(s)&&s.name!==void 0&&vs(s))n.add(s.name.text);else if(h.isVariableStatement(s)&&vs(s))for(let r of s.declarationList.declarations)h.isIdentifier(r.name)&&n.add(r.name.text);else if(h.isExportDeclaration(s)&&s.exportClause&&h.isNamedExports(s.exportClause))for(let r of s.exportClause.elements)n.add((r.propertyName??r.name).text);else h.isExportAssignment(s)&&h.isIdentifier(s.expression)&&(n.add(s.expression.text),t=s.expression.text)}return{reachableLocals:n,defaultTarget:t}}function vk(e){for(let n of e.statements){if(h.isFunctionDeclaration(n)&&n.name!==void 0&&vs(n)&&h.getModifiers(n)?.some(t=>t.kind===h.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(h.isExportAssignment(n)&&!n.isExportEquals&&h.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(h.isExpressionStatement(n)&&h.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===h.SyntaxKind.EqualsToken&&In(t.left)&&h.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function kt(e){if(h.isCallExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&h.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function In(e){return h.isPropertyAccessExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:h.isElementAccessExpression(e)&&h.isIdentifier(e.expression)&&e.expression.text==="module"&&h.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function it(e){if(In(e))return!0;if(!h.isPropertyAccessExpression(e)&&!h.isElementAccessExpression(e))return!1;let n=e.expression;return h.isIdentifier(n)&&n.text==="exports"?!0:In(n)}function Js(e){return h.isPropertyAccessExpression(e.expression)&&h.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ip(e){let n=!1,t=s=>{if(!n){if(h.isCallExpression(s)){let r=kt(s);if(r!==void 0&&Ze(r)!=="package-root"){n=!0;return}}h.forEachChild(s,t)}};return t(e),n}function ap(e){let n=new Set,t=r=>r!==void 0&&ip(r),s=r=>{h.isVariableDeclaration(r)&&t(r.initializer)&&Mr(r.name,n),h.isBinaryExpression(r)&&r.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),h.forEachChild(r,s)};return s(e),n}function lp(e,n){for(let t of e.properties)h.isShorthandPropertyAssignment(t)?n.add(t.name.text):h.isPropertyAssignment(t)&&h.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function Ek(e){let n=new Set;for(let a of e.statements)if(h.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(h.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(h.isVariableStatement(a))for(let l of a.declarationList.declarations)h.isIdentifier(l.name)&&l.initializer!==void 0&&(h.isFunctionExpression(l.initializer)||h.isArrowFunction(l.initializer)||h.isObjectLiteralExpression(l.initializer))&&n.add(l.name.text);let t=a=>h.isFunctionExpression(a)||h.isArrowFunction(a)||h.isObjectLiteralExpression(a)||h.isIdentifier(a)&&n.has(a.text),s=new Set,r=a=>{h.isIdentifier(a)?s.add(a.text):h.isObjectLiteralExpression(a)&&lp(a,s)},o=!1,i=a=>{if(!o){if(h.isBinaryExpression(a)&&a.operatorToken.kind===h.SyntaxKind.EqualsToken)if(In(a.left)){r(a.right);let l=a.right;(h.isObjectLiteralExpression(l)?l.properties.every(c=>h.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||h.isPropertyAssignment(c)&&t(c.initializer)):t(l))||(o=!0)}else it(a.left)&&(t(a.right)||(o=!0));else(h.isCallExpression(a)&&Js(a)&&a.arguments[0]!==void 0&&Es(a.arguments[0])||h.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(o=!0);o||h.forEachChild(a,i)}};if(i(e),!o&&s.size>0){for(let a of fp(e))if(s.has(a)){o=!0;break}}return o}function Es(e){return it(e)||h.isIdentifier(e)&&e.text==="exports"}function dp(e){if(!h.isPropertyAccessExpression(e.expression)||!h.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function _l(e){return dp(e)&&e.arguments[0]!==void 0&&Es(e.arguments[0])}function Ak(e){return dp(e)&&e.arguments[0]!==void 0&&h.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Ik(e){for(let n of e.declarations??[])if(h.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(h.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(h.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(h.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Nk(e,n,t,s,r){let o=(e.declarations??[]).filter(a=>!h.isSourceFile(a)&&!h.isModuleDeclaration(a));for(let a of o){let l=a.getSourceFile(),d=n.toRel(l.fileName);if(d===null||r.has(d))continue;let c=t.get(`${d}::${String(a.getStart(l,!1))}`);if(c!==void 0)return c}let i=e.getName();for(let a of o){let l=n.toRel(a.getSourceFile().fileName);if(l===null||r.has(l))continue;let d=s.get(`${l}::${i}`);if(d!==void 0)return d}}function ti(e){return h.isPropertyAccessExpression(e)?e.name.text:h.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Sl=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function xl(e){let n=h.isPropertyAccessExpression(e)||h.isElementAccessExpression(e)?ti(e):void 0;return n!==void 0&&n!=="__proto__"&&Sl.test(n)?n:void 0}function Rk(e){return e!=="__proto__"&&Sl.test(e)}function Qf(e){let n=Ve(e);return h.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||In(n)}function Ok(e){if(!h.isArrayLiteralExpression(e)&&!h.isObjectLiteralExpression(e))return!1;let n=!1,t=s=>{n||(it(s)?n=!0:h.forEachChild(s,t))};return t(e),n}function kl(e){let n=!1,t=new Map,s=r=>{if(!n){if(h.isBinaryExpression(r)&&r.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=h.SyntaxKind.LastAssignment){if(In(r.left)||h.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===h.SyntaxKind.EqualsToken&&Qf(r.right))n=!0;else if(Ok(r.left))n=!0;else if(it(r.left)){let o=xl(r.left);o===void 0?n=!0:t.set(o,(t.get(o)??0)+1)}}else(h.isCallExpression(r)&&Js(r)&&r.arguments[0]!==void 0&&Es(r.arguments[0])||h.isCallExpression(r)&&_l(r)||h.isCallExpression(r)&&Ak(r)||h.isVariableDeclaration(r)&&r.initializer!==void 0&&Qf(r.initializer))&&(n=!0);n||h.forEachChild(r,s)}};return s(e),{surfaceEscapes:n,assignCount:t}}function wl(e){let n=[];for(let t of e.statements){if(!h.isExpressionStatement(t)||!h.isBinaryExpression(t.expression))continue;let s=t.expression;s.operatorToken.kind===h.SyntaxKind.EqualsToken&&(!it(s.left)||In(s.left)||n.push({bin:s,name:xl(s.left)}))}return n}function Pk(e){let{surfaceEscapes:n,assignCount:t}=kl(e);if(n)return[];let s=[];for(let{bin:r,name:o}of wl(e))o===void 0||(t.get(o)??0)!==1||(h.isFunctionExpression(r.right)||h.isArrowFunction(r.right))&&s.push({name:o,value:r.right});return s}function Ck(e,n){let{surfaceEscapes:t,assignCount:s}=kl(e);if(t)return[];let r=[];for(let{bin:o,name:i}of wl(e))i===void 0||(s.get(i)??0)!==1||h.isIdentifier(o.right)&&!n.has(o.right.text)&&r.push(o.right.text);return r}function Mk(e,n){let{surfaceEscapes:t,assignCount:s}=kl(e);for(let{bin:r,name:o}of wl(e)){let i=r.right;if(!(h.isFunctionExpression(i)||h.isArrowFunction(i)||h.isIdentifier(i)))continue;let l=h.isFunctionExpression(i)||h.isArrowFunction(i)||h.isIdentifier(i)&&!n.has(i.text);if(!(!t&&o!==void 0&&(s.get(o)??0)===1&&l))return!0}return!1}function Tk(e){let n=h.isPropertyAccessExpression(e)||h.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&h.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Zf(e){let n=e.parent;return n===void 0?!1:h.isPropertyAccessExpression(n)?n.name===e:h.isQualifiedName(n)?n.right===e:h.isBindingElement(n)||h.isImportSpecifier(n)?n.propertyName===e:h.isExportSpecifier(n)?!0:h.isPropertyAssignment(n)||h.isPropertyDeclaration(n)||h.isPropertySignature(n)||h.isMethodDeclaration(n)||h.isMethodSignature(n)||h.isGetAccessorDeclaration(n)||h.isSetAccessorDeclaration(n)||h.isEnumMember(n)?n.name===e:!1}function ep(e){for(let n=e.parent;n!==void 0;n=n.parent){if(h.isSourceFile(n))return!0;if(!h.isArrowFunction(n)&&(h.isFunctionLike(n)||h.isClassLike(n)))return!1}return!0}function $k(e,n){let t=s=>{h.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&n.add(s),h.forEachChild(s,t)};t(e)}function Lk(e){let n=[],t=new Set;for(let o of e.statements){if(h.isExportDeclaration(o)||h.isExportAssignment(o)||h.isImportDeclaration(o)||h.isImportEqualsDeclaration(o)||vs(o))return null;if(!h.isExpressionStatement(o)||!h.isBinaryExpression(o.expression))continue;let i=o.expression;if(i.operatorToken.kind===h.SyntaxKind.EqualsToken){if(In(i.left))n.push({kind:"whole",value:i.right});else if(it(i.left)){let a=xl(i.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:i.right,root:Tk(i.left)})}else continue;$k(i.left,t)}}let s=!1,r=o=>{if(!s){if(h.isIdentifier(o)&&(o.text==="exports"||o.text==="module")&&!t.has(o)&&!Zf(o)){s=!0;return}if(o.kind===h.SyntaxKind.ThisKeyword&&ep(o)){s=!0;return}if(h.isIdentifier(o)&&o.text==="arguments"&&!Zf(o)&&ep(o)){s=!0;return}h.forEachChild(o,r)}};return r(e),s?null:n}function yl(e){return h.isIdentifier(e)||h.isStringLiteralLike(e)?e.text:void 0}function np(e,n,t){return h.isIdentifier(e)?n(e.text):t?.(e)}function Dk(e,n,t,s){let r=new Map,o=Lk(e);if(o===null||o.filter(u=>u.kind==="whole").length>1)return r;let i=o.findIndex(u=>u.kind==="whole"),a=(u,m)=>i>=0&&m>i&&u.kind==="member"&&u.root==="exports",l=o.some(a);if(l){let u=o[i];if(u===void 0||u.kind!=="whole"||!h.isObjectLiteralExpression(u.value))return r}let d=l?o.filter((u,m)=>!a(u,m)):o,c=new Map;for(let u of d)u.kind==="member"&&c.set(u.name,(c.get(u.name)??0)+1);let f=u=>n.has(u)?void 0:t(u),p=(u,m)=>{m===void 0?r.delete(u):r.set(u,m)};for(let u of d){if(u.kind==="member"){p(u.name,(c.get(u.name)??0)>1?void 0:np(u.value,f,s));continue}r.clear();let m=u.value;if(h.isObjectLiteralExpression(m))for(let g of m.properties){if(h.isSpreadAssignment(g))return new Map;if(h.isShorthandPropertyAssignment(g)){p(g.name.text,f(g.name.text));continue}let y=yl(g.name);if(y===void 0)return new Map;p(y,h.isPropertyAssignment(g)?np(g.initializer,f,s):void 0)}}return r}function cp(e,n,t,s){let r=new Map,o=a=>a!==void 0&&Ze(a)==="relative"?t.get(`${n}::${a}`):void 0,i=a=>{if(h.isVariableDeclaration(a)&&a.initializer!==void 0){let l=a.initializer;if(h.isIdentifier(a.name)&&!s.has(a.name.text)){let d=o(kt(l));if(d!==void 0)r.set(a.name.text,{kind:"whole",target:d});else if((h.isPropertyAccessExpression(l)||h.isElementAccessExpression(l))&&h.isCallExpression(l.expression)){let c=o(kt(l.expression)),f=ti(l);c!==void 0&&f!==void 0&&r.set(a.name.text,{kind:"member",target:c,member:f})}}else if(h.isObjectBindingPattern(a.name)){let d=o(kt(l));if(d!==void 0){for(let c of a.name.elements)if(h.isIdentifier(c.name)&&!s.has(c.name.text)){let f=c.propertyName!==void 0&&h.isIdentifier(c.propertyName)?c.propertyName.text:c.name.text;r.set(c.name.text,{kind:"member",target:d,member:f})}}}}h.forEachChild(a,i)};return i(e),r}function Fk(e,n,t,s){let r=i=>i!==void 0&&Ze(i)==="relative"?t.get(`${n}::${i}`):void 0,o=r(kt(e));if(o!==void 0)return{kind:"whole",target:o};if(h.isPropertyAccessExpression(e)||h.isElementAccessExpression(e)){let i=ti(e);if(i===void 0)return;let a=r(kt(e.expression));if(a!==void 0)return{kind:"member",target:a,member:i};if(h.isIdentifier(e.expression)){let l=s.get(e.expression.text);if(l?.kind==="whole")return{kind:"member",target:l.target,member:i}}return}if(h.isIdentifier(e))return s.get(e.text)}function up(e,n,t,s,r){let o=[],i=!1,a=f=>{if(ip(f))return!0;let p=!1,u=m=>{p||(h.isIdentifier(m)&&r.has(m.text)?p=!0:h.forEachChild(m,u))};return u(f),p},l=(f,p)=>{let u=Fk(f,n,t,s);u!==void 0?o.push({source:u,exportedName:p}):a(f)&&(i=!0)},d=f=>{if(h.isObjectLiteralExpression(f)){for(let p of f.properties)if(h.isSpreadAssignment(p))l(p.expression,"default");else if(h.isPropertyAssignment(p)){let u=h.isIdentifier(p.name)||h.isStringLiteralLike(p.name)?p.name.text:"default";l(p.initializer,u)}else if(h.isShorthandPropertyAssignment(p)){let u=s.get(p.name.text);u!==void 0&&o.push({source:u,exportedName:p.name.text})}return}l(f,"default")},c=f=>{if(h.isBinaryExpression(f)&&f.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=h.SyntaxKind.LastAssignment){if(In(f.left)){d(f.right);return}if(it(f.left)){let p=h.isPropertyAccessExpression(f.left)?f.left.name.text:h.isElementAccessExpression(f.left)&&h.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";l(f.right,p);return}}else if(h.isExportAssignment(f)&&f.isExportEquals){l(f.expression,"default");return}else if(h.isCallExpression(f)&&Js(f)&&f.arguments[0]!==void 0&&Es(f.arguments[0])){for(let p of f.arguments.slice(1))d(p);return}h.forEachChild(f,c)};return c(e),{sources:o,residual:i}}function fp(e){let n=new Set,t=r=>{let o=r;for(;h.isPropertyAccessExpression(o)||h.isElementAccessExpression(o);)o=o.expression;return h.isIdentifier(o)?o.text:void 0},s=r=>{let o=pp(r);if(o!==void 0){let i=t(o);i!==void 0&&n.add(i)}h.forEachChild(r,s)};return s(e),n}function pp(e){return h.isBinaryExpression(e)&&e.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=h.SyntaxKind.LastAssignment&&(h.isPropertyAccessExpression(e.left)||h.isElementAccessExpression(e.left))?e.left:void 0}function ei(e){if(h.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)h.isBindingElement(t)&&n.push(...ei(t.name));return n}function An(e){if(h.isIdentifier(e))return[e.text];if(h.isParenthesizedExpression(e)||h.isAsExpression(e)||h.isNonNullExpression(e)||h.isSatisfiesExpression(e)||h.isTypeAssertionExpression(e)||h.isAwaitExpression(e))return An(e.expression);if(h.isYieldExpression(e))return e.expression!==void 0?An(e.expression):[];if(h.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===h.SyntaxKind.BarBarToken||n===h.SyntaxKind.AmpersandAmpersandToken||n===h.SyntaxKind.QuestionQuestionToken?[...An(e.left),...An(e.right)]:n===h.SyntaxKind.CommaToken?An(e.right):[]}return h.isConditionalExpression(e)?[...An(e.whenTrue),...An(e.whenFalse)]:h.isArrayLiteralExpression(e)?e.elements.flatMap(n=>h.isSpreadElement(n)?An(n.expression):h.isOmittedExpression(n)?[]:An(n)):h.isObjectLiteralExpression(e)?e.properties.flatMap(n=>h.isShorthandPropertyAssignment(n)?[n.name.text]:h.isPropertyAssignment(n)?An(n.initializer):h.isSpreadAssignment(n)?An(n.expression):[]):[]}function mp(e,n){let t=[],s=(a,l)=>{for(let d of a)for(let c of l)d!==c&&t.push({a:d,b:c})},r=a=>h.isIdentifier(a)?[a.text]:h.isArrayLiteralExpression(a)?a.elements.flatMap(r):h.isObjectLiteralExpression(a)?a.properties.flatMap(l=>h.isShorthandPropertyAssignment(l)?[l.name.text]:h.isPropertyAssignment(l)?r(l.initializer):[]):[],o=a=>{h.isBinaryExpression(a)&&a.operatorToken.kind===h.SyntaxKind.EqualsToken?s(r(a.left),An(a.right)):h.isVariableDeclaration(a)&&a.initializer!==void 0?s(ei(a.name),An(a.initializer)):(h.isForOfStatement(a)||h.isForInStatement(a))&&h.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&s(ei(a.initializer.declarations[0].name),An(a.expression)),h.forEachChild(a,o)};o(e);let i=new Set(n);for(let a=!0;a;){a=!1;for(let{a:l,b:d}of t)i.has(l)&&!i.has(d)&&(i.add(d),a=!0),i.has(d)&&!i.has(l)&&(i.add(l),a=!0)}return i}function gp(e,n){let t=a=>{if(!h.isPropertyAccessExpression(a)&&!h.isElementAccessExpression(a))return;let l=a;for(;h.isPropertyAccessExpression(l)||h.isElementAccessExpression(l);)l=l.expression;return h.isIdentifier(l)?l.text:void 0},s=[],r=(a,l)=>{for(let c of An(l))s.push({name:a,root:c});let d=t(l);d!==void 0&&s.push({name:a,root:d})},o=a=>{h.isVariableDeclaration(a)&&h.isIdentifier(a.name)&&a.initializer!==void 0?r(a.name.text,a.initializer):h.isBinaryExpression(a)&&a.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isIdentifier(a.left)&&r(a.left.text,a.right),h.forEachChild(a,o)};o(e);let i=new Map(n);for(let a=!0;a;){a=!1;for(let{name:l,root:d}of s){let c=i.get(d);c!==void 0&&!i.has(l)&&(i.set(l,c),a=!0)}}return i}function hp(e){return mp(e,fp(e))}function jk(e,n){let t=l=>l>=h.SyntaxKind.FirstAssignment&&l<=h.SyntaxKind.LastAssignment,s=l=>{let d=l.parent;if(d===void 0||!h.isObjectLiteralExpression(d))return!1;let c=d.parent;return c!==void 0&&h.isBinaryExpression(c)&&c.operatorToken.kind===h.SyntaxKind.EqualsToken&&c.right===d&&it(c.left)?!0:c!==void 0&&h.isCallExpression(c)&&Js(c)&&c.arguments[0]!==void 0&&Es(c.arguments[0])&&c.arguments.indexOf(d)>0},r=(l,d)=>{if((h.isFunctionDeclaration(d)||h.isFunctionExpression(d))&&d.name===l||h.isVariableDeclaration(d)&&d.name===l||h.isParameter(d)&&d.name===l||h.isBindingElement(d)&&d.name===l||(h.isCallExpression(d)||h.isNewExpression(d))&&d.expression===l)return!0;if((h.isPropertyAccessExpression(d)||h.isElementAccessExpression(d))&&d.expression===l){let c=d;for(;c.parent!==void 0&&(h.isPropertyAccessExpression(c.parent)||h.isElementAccessExpression(c.parent))&&c.parent.expression===c;)c=c.parent;let f=c.parent;return!(f!==void 0&&h.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===c)}return h.isBinaryExpression(d)&&d.operatorToken.kind===h.SyntaxKind.EqualsToken&&d.right===l&&it(d.left)?!0:h.isShorthandPropertyAssignment(d)&&d.name===l||h.isPropertyAssignment(d)&&d.initializer===l?s(d):!!(h.isExportAssignment(d)&&d.expression===l||h.isExportSpecifier(d))},o=(l,d)=>h.isPropertyAccessExpression(d)&&d.name===l||h.isPropertyAssignment(d)&&d.name===l||(h.isMethodDeclaration(d)||h.isGetAccessorDeclaration(d)||h.isSetAccessorDeclaration(d))&&d.name===l,i=!1,a=(l,d)=>{if(!i){if(h.isIdentifier(l)&&d!==void 0&&n.has(l.text)&&!o(l,d)&&!r(l,d)){i=!0;return}h.forEachChild(l,c=>a(c,l))}};return a(e,void 0),i}function Bk(e){let n=new Set;for(let l of e.statements)if(h.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(h.isVariableStatement(l))for(let d of l.declarationList.declarations)h.isIdentifier(d.name)&&d.initializer!==void 0&&(h.isFunctionExpression(d.initializer)||h.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,s=l=>{h.isBinaryExpression(l)&&l.operatorToken.kind===h.SyntaxKind.EqualsToken?(In(l.left)&&(h.isIdentifier(l.right)?t.add(l.right.text):h.isObjectLiteralExpression(l.right)&&lp(l.right,t)),In(l.right)&&h.isIdentifier(l.left)&&t.add(l.left.text)):h.isVariableDeclaration(l)&&h.isIdentifier(l.name)&&l.initializer!==void 0&&In(l.initializer)&&t.add(l.name.text),h.forEachChild(l,s)};if(s(e),t.size>0){if(jk(e,t))return!0;let l=gp(e,new Map([...t].map(c=>[c,c]))),d=hp(e);for(let c of l.keys())if(d.has(c))return!0}let r=l=>h.isIdentifier(l)&&n.has(l.text),o=l=>l.properties.every(d=>h.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||h.isPropertyAssignment(d)&&r(d.initializer)),i=!1,a=l=>{if(!i){if(h.isBinaryExpression(l)){let d=l.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&l.operatorToken.kind<=h.SyntaxKind.LastAssignment;d&&In(l.left)?l.operatorToken.kind===h.SyntaxKind.EqualsToken&&(r(l.right)||h.isObjectLiteralExpression(l.right)&&o(l.right))||(i=!0):d&&it(l.left)&&(i=!0)}else h.isCallExpression(l)?(Js(l)&&l.arguments[0]!==void 0&&Es(l.arguments[0])||_l(l))&&(i=!0):(h.isExportAssignment(l)&&l.isExportEquals&&!h.isIdentifier(l.expression)||h.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(i=!0);i||h.forEachChild(l,a)}};return a(e),i}var Gk=8;function tp(e,n,t){let s=new Set,r=cp(e,n,t,Vs(e)),o=up(e,n,t,r,ap(e));for(let{source:i}of o.sources)s.add(i.target);for(let i of e.statements)if(h.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&h.isStringLiteralLike(i.moduleSpecifier)&&Ze(i.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${i.moduleSpecifier.text}`);a!==void 0&&s.add(a)}return s}function Kk(e,n,t,s=new Map){let r=new Set(n.modules.filter(v=>v.isEntrypoint).map(v=>String(v.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let o=new Set(n.modules.filter(v=>v.externalSurface===!0).map(v=>String(v.id))),i=new Map,a=new Map,l=new Map,d=new Map;for(let v of t){if(v.name==="<toplevel>"){d.set(String(v.moduleId),v);continue}if(i.set(`${String(v.moduleId)}::${String(v.declRange.start)}`,v),v.name!==void 0&&a.set(`${String(v.moduleId)}::${v.name}`,v),v.isExported&&v.name!==void 0){let I=l.get(String(v.moduleId))??[];I.push(v),l.set(String(v.moduleId),I)}}if(s.size>0){let v=new Map(t.map(I=>[String(I.id),I]));for(let[I,O]of s){let E=v.get(String(O));E!==void 0&&!i.has(I)&&i.set(I,E)}}let c=new Map;for(let v of n.imports)v.resolvedModuleId!==void 0&&c.set(`${v.moduleId}::${v.specifier}`,String(v.resolvedModuleId));let f=new Map;for(let v of e.sourceFiles){let I=e.toRel(v.fileName);I!==null&&f.set(I,v)}let p=new Map,u=v=>{let I=p.get(v);if(I!==void 0)return I;let O=f.get(v),E=O===void 0?!0:Bk(O);return p.set(v,E),E},m=new Set,g=(v,I)=>I!==void 0&&Ze(I)==="relative"?c.get(`${v}::${I}`):void 0,y=v=>{if(h.isIdentifier(v))return v.text;if(h.isPropertyAccessExpression(v)){let I=y(v.expression);return I===void 0?void 0:`${I}.${v.name.text}`}if(h.isElementAccessExpression(v)&&h.isStringLiteralLike(v.argumentExpression)){let I=y(v.expression);return I===void 0?void 0:`${I}.${v.argumentExpression.text}`}},b=v=>{let I=v;for(;h.isPropertyAccessExpression(I)||h.isElementAccessExpression(I);)I=I.expression;return kt(I)};for(let v of e.sourceFiles){let I=e.toRel(v.fileName);if(I===null)continue;let O=new Map,E=new Map,N=($,W)=>{let w=g(I,kt(W));if(w!==void 0){if(h.isIdentifier($))E.set($.text,w),O.set($.text,w);else if(h.isObjectBindingPattern($)||h.isArrayBindingPattern($))for(let P of ei($))E.set(P,w);else if(h.isPropertyAccessExpression($)||h.isElementAccessExpression($)){let P=y($);P!==void 0&&O.set(P,w)}}},A=$=>{h.isVariableDeclaration($)&&$.initializer!==void 0?N($.name,$.initializer):h.isBinaryExpression($)&&$.operatorToken.kind===h.SyntaxKind.EqualsToken&&N($.left,$.right),h.forEachChild($,A)};A(v);let U=$=>{let W=pp($);if(W!==void 0){let w=W.expression,P=g(I,b(w));P!==void 0&&m.add(P);let j=y(w),F=j!==void 0?O.get(j):void 0;F!==void 0&&m.add(F)}h.forEachChild($,U)};if(U(v),E.size>0){let $=gp(v,E),W=hp(v);for(let[w,P]of $)W.has(w)&&m.add(P)}}let _=[],S=[],k=[];for(let v of e.sourceFiles){let I=e.toRel(v.fileName);if(I===null||!r.has(I))continue;let O=e.checker.getSymbolAtLocation(v),E=new Set,N=new Set,A=0,U=(X,Q)=>{if(o.has(String(X.moduleId))||E.has(String(X.id)))return;E.add(String(X.id));let Z=`${I}#reexport:${String(A)}:${Q}`;A+=1,_.push({id:Z,moduleId:I,exportedName:Q,kind:"value",reexportOf:{moduleId:String(X.moduleId),name:X.name??Q}}),S.push({exportId:Z,target:{kind:"function",functionId:X.id}})},$=X=>{if(Ik(X))return;let Q=X;if((X.flags&h.SymbolFlags.Alias)!==0)try{Q=e.checker.getAliasedSymbol(X)}catch{return}let Z=Nk(Q,e,i,a,o);if(Z!==void 0){U(Z,X.getName());return}if((Q.flags&h.SymbolFlags.Module)!==0&&!N.has(Q)){N.add(Q);try{for(let x of e.checker.getExportsOfModule(Q))$(x)}catch{}}};if(O!==void 0)for(let X of e.checker.getExportsOfModule(O))$(X);let W=cp(v,I,c,Vs(v)),w=up(v,I,c,W,ap(v)),P=new Set,j=w.residual,F=X=>{let Q=f.get(X);X.includes("node_modules/")||Q===void 0||Ek(Q)?j=!0:P.add(X)};for(let{source:X,exportedName:Q}of w.sources){let Z=l.get(X.target)??[],x=m.has(X.target);if(X.kind==="whole"){for(let T of Z)U(T,T.name??Q);x?j=!0:(Z.length===0||u(X.target))&&F(X.target)}else{let T=Z.filter(q=>q.name===X.member);for(let q of T)U(q,Q);x?j=!0:(T.length===0||u(X.target))&&F(X.target)}}let B=new Set,ne=[];for(let X of tp(v,I,c))ne.push({target:X,depth:1});for(;ne.length>0;){let X=ne.shift();if(X===void 0)break;let{target:Q,depth:Z}=X;if(B.has(Q)||Z>Gk||(B.add(Q),Q.split("/").includes("node_modules")))continue;let x=f.get(Q);if(x===void 0)continue;let T=d.get(Q);T!==void 0&&!u(Q)&&U(T,"<load>");for(let q of tp(x,Q,c))B.has(q)||ne.push({target:q,depth:Z+1})}Mk(v,Vs(v))&&(j=!0);for(let X of P)k.push({code:"unresolved-reexport",path:I,detail:`entrypoint whole/member re-exports app-owned relative module ${X} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:X});j&&k.push({code:"unresolved-reexport",path:I,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:_,exportBindings:S,diagnostics:k}}var Ys=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),zk=new Set(["defineProperty","defineProperties","create"]);function Wk(e){let n=!0,t=r=>h.isIdentifier(r)||h.isStringLiteral(r)||h.isNumericLiteral(r)?Ys.has(r.text):h.isComputedPropertyName(r)&&h.isStringLiteralLike(r.expression)?Ys.has(r.expression.text):!1,s=r=>{if(n){if(h.isNewExpression(r)||h.isForOfStatement(r)||h.isSpreadElement(r)||h.isSpreadAssignment(r)||h.isArrayBindingPattern(r)||h.isGetAccessorDeclaration(r)||h.isSetAccessorDeclaration(r)||h.isYieldExpression(r)&&r.asteriskToken!==void 0||h.canHaveDecorators(r)&&(h.getDecorators(r)?.length??0)>0){n=!1;return}if((h.isPropertyAccessExpression(r)||h.isMethodDeclaration(r)||h.isPropertyAssignment(r))&&t(r.name)||h.isPropertyDeclaration(r)&&t(r.name)||h.isShorthandPropertyAssignment(r)&&t(r.name)||h.isBindingElement(r)&&t(r.propertyName??r.name)||h.isElementAccessExpression(r)&&h.isStringLiteralLike(r.argumentExpression)&&Ys.has(r.argumentExpression.text)){n=!1;return}if(h.isCallExpression(r)&&h.isPropertyAccessExpression(r.expression)&&h.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&zk.has(r.expression.name.text)){n=!1;return}h.forEachChild(r,s)}};return s(e),n}function si(e){if(h.isIdentifier(e)||h.isStringLiteral(e)||h.isNumericLiteral(e))return e.text}function yp(e){let n=t=>h.canHaveDecorators(t)&&(h.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Uk(e){let n=!1,t=new Set,s=[],r=new Map,o=(p,u)=>{let m=r.get(p);m===void 0?r.set(p,[u]):m.push(u)},i=p=>{h.isIdentifier(p)?t.add(p.text):s.push(p)},a=p=>{for(let u of p.properties)h.isShorthandPropertyAssignment(u)?t.add(u.name.text):h.isPropertyAssignment(u)?s.push(u.initializer):n=!0},l=p=>{if(h.isBinaryExpression(p)&&p.operatorToken.kind===h.SyntaxKind.EqualsToken){let u=p.left,m=p.right;In(u)?h.isObjectLiteralExpression(m)?a(m):h.isIdentifier(m)||h.isFunctionExpression(m)||h.isArrowFunction(m)||h.isClassExpression(m)?i(m):n=!0:it(u)?(h.isElementAccessExpression(u)&&!h.isStringLiteralLike(u.argumentExpression)&&(n=!0),i(m)):h.isIdentifier(u)?o(u.text,m):(h.isPropertyAccessExpression(u)||h.isElementAccessExpression(u))&&h.isIdentifier(u.expression)&&o(u.expression.text,m)}else if(h.isCallExpression(p))(Js(p)&&p.arguments[0]!==void 0&&Es(p.arguments[0])||_l(p))&&(n=!0);else if(h.isVariableDeclaration(p)&&h.isIdentifier(p.name)&&p.initializer!==void 0)o(p.name.text,p.initializer);else if((h.isFunctionDeclaration(p)||h.isClassDeclaration(p))&&p.name!==void 0)o(p.name.text,p),vs(p)&&t.add(p.name.text);else if(h.isExportDeclaration(p)){if(p.exportClause===void 0)n=!0;else if(p.moduleSpecifier===void 0&&h.isNamedExports(p.exportClause))for(let u of p.exportClause.elements)t.add((u.propertyName??u.name).text)}else if(h.isExportAssignment(p))p.isExportEquals&&!h.isIdentifier(p.expression)?n=!0:i(p.expression);else if(h.isVariableStatement(p)&&vs(p))for(let u of p.declarationList.declarations)h.isIdentifier(u.name)&&t.add(u.name.text);h.forEachChild(p,l)};l(e);let d=new Set,c=[...t],f=p=>{let u=m=>{h.isIdentifier(m)&&c.push(m.text),h.forEachChild(m,u)};u(p)};for(let p of s)f(p);for(;c.length>0;){let p=c.pop();if(!(p===void 0||d.has(p))){d.add(p);for(let u of r.get(p)??[])f(u)}}return{names:d,opaque:n}}var Hk=512,qk=new Set(["get","post","put","patch","delete","options","head"]);function Vk(e){for(let n of e.statements){if(h.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(h.isExpressionStatement(n)&&h.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isPropertyAccessExpression(n.expression.left)&&h.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,s=n.expression.left.name.text;if(t==="module"&&s==="exports"||t==="exports"&&s==="default")return n.expression.right}}return null}function Xk(e){let n=new Map,t=Vk(e);if(t===null)return n;let s=o=>{for(let i of o.properties)if(h.isPropertyAssignment(i)&&h.isObjectLiteralExpression(i.initializer)){let a=si(i.name);a!==void 0&&n.set(a,i.initializer)}};if(h.isObjectLiteralExpression(t))return s(t),n;if(!h.isIdentifier(t))return n;let r=t.text;for(let o of e.statements)if(h.isVariableStatement(o))for(let i of o.declarationList.declarations)h.isIdentifier(i.name)&&i.name.text===r&&i.initializer!==void 0&&h.isObjectLiteralExpression(i.initializer)&&s(i.initializer);else if(h.isExpressionStatement(o)&&h.isBinaryExpression(o.expression)&&o.expression.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isPropertyAccessExpression(o.expression.left)&&h.isIdentifier(o.expression.left.expression)&&o.expression.left.expression.text===r&&h.isObjectLiteralExpression(o.expression.right)){let i=o.expression.left.name.text;n.set(i,o.expression.right)}return n}function Yk(e){for(let n of e.properties){if(h.isMethodDeclaration(n)&&h.isIdentifier(n.name)&&n.name.text==="handler")return n;if(h.isPropertyAssignment(n)&&h.isIdentifier(n.name)&&n.name.text==="handler"&&(h.isArrowFunction(n.initializer)||h.isFunctionExpression(n.initializer)))return n.initializer}return null}function Jk(e,n){for(let s of e.properties){let r;if(h.isPropertyAssignment(s)||h.isMethodDeclaration(s)?r=si(s.name):h.isShorthandPropertyAssignment(s)&&(r=s.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Qk(e,n){let t=[],s=new Set,r=(a,l,d)=>{if(t.length>=Hk||a==="__proto__"||!Sl.test(a))return;let c=`${e}#handler:${a}`;s.has(c)||(s.add(c),t.push({id:c,node:l,memberPath:a,idiom:d}))};for(let[a,l]of Xk(n)){let d=Yk(l);d!==null&&Jk(l,d)&&r(a,d,"descriptor-object")}let o=0,i=a=>{if(h.isCallExpression(a)&&h.isPropertyAccessExpression(a.expression)&&h.isIdentifier(a.expression.expression)&&qk.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&h.isStringLiteralLike(a.arguments[0])){let l=a.expression.name.text;for(let d=1;d<a.arguments.length;d+=1){let c=a.arguments[d];c!==void 0&&(h.isArrowFunction(c)||h.isFunctionExpression(c))&&r(`${l}_${String(o)}_${String(d)}`,c,"router-verb")}o+=1}h.forEachChild(a,i)};return i(n),t}function Zk(e,n,t,s,r,o){let i=`${e}#class:${t}`,a=[],l=new Set;for(let d of s.members){let c,f,p;if(h.isConstructorDeclaration(d))c="constructor",f="ctor",p=!1;else if(h.isMethodDeclaration(d))c=si(d.name),f="method",p=c!==void 0&&!Ys.has(c);else continue;if(c===void 0||l.has(c))continue;l.add(c);let u=`${e}#${t}.${c}`;r.push({id:u,moduleId:e,name:c,kind:f,enclosingClassId:i,declRange:xt(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(u),p&&o.push({start:d.getStart(n,!1),end:d.getEnd(),id:u})}return{id:i,moduleId:e,name:t,implementsRefs:[],members:a}}function ew(e,n,t=[],s=!1,r){let o=[],i=new Map,a=[],{reachableLocals:l,defaultTarget:d}=wk(n),c=Vs(n),f=`${e}#<toplevel>`;o.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let p=(I,O)=>{let E=`${e}#${I}`;return o.push({id:E,moduleId:e,name:I,kind:"function",declRange:xt(e,O,n),isExported:l.has(I),publicSurfaceReachable:l.has(I)}),i.set(I,{kind:"function",functionId:E}),a.push({start:O.getStart(n,!1),end:O.getEnd(),id:E}),E},u=[],m=!e.split("/").includes("node_modules");if(m)for(let I of Ck(n,c))l.add(I);let g=m?Uk(n):void 0,y=(I,O,E)=>{g===void 0||g.opaque||g.names.has(I)||vs(E)||yp(O)||u.push(Zk(e,n,I,O,o,a))};for(let I of n.statements)if(h.isFunctionDeclaration(I)&&I.name!==void 0)p(I.name.text,I);else if(h.isClassDeclaration(I)&&I.name!==void 0)y(I.name.text,I,I);else if(h.isVariableStatement(I))for(let O of I.declarationList.declarations){if(h.isObjectBindingPattern(O.name)&&O.initializer!==void 0&&h.isCallExpression(O.initializer)&&h.isIdentifier(O.initializer.expression)&&O.initializer.expression.text==="require"&&O.initializer.arguments.length===1&&O.initializer.arguments[0]!==void 0&&h.isStringLiteralLike(O.initializer.arguments[0])){let N=O.initializer.arguments[0].text;for(let A of O.name.elements){if(A.dotDotDotToken!==void 0||A.initializer!==void 0||!h.isIdentifier(A.name))continue;let U=A.propertyName??A.name;!h.isIdentifier(U)&&!h.isStringLiteralLike(U)||i.set(A.name.text,{kind:"import",specifier:N,form:{named:U.text}})}continue}if(!h.isIdentifier(O.name)||O.initializer===void 0)continue;let E=O.initializer;if(h.isFunctionExpression(E)||h.isArrowFunction(E))p(O.name.text,O);else if(h.isClassExpression(E))y(O.name.text,E,I);else if(h.isCallExpression(E)&&h.isIdentifier(E.expression)&&E.expression.text==="require"&&E.arguments.length===1&&E.arguments[0]!==void 0&&h.isStringLiteralLike(E.arguments[0]))i.set(O.name.text,{kind:"import",specifier:E.arguments[0].text,form:"whole"});else if((h.isPropertyAccessExpression(E)||h.isElementAccessExpression(E))&&ti(E)==="default"&&h.isCallExpression(E.expression)){let N=kt(E.expression);N!==void 0&&i.set(O.name.text,{kind:"import",specifier:N,form:"require-default"})}}else if(h.isImportDeclaration(I)&&h.isStringLiteralLike(I.moduleSpecifier)){let O=I.moduleSpecifier.text,E=I.importClause;if(E!==void 0){E.name!==void 0&&i.set(E.name.text,{kind:"import",specifier:O,form:"default"});let N=E.namedBindings;if(N!==void 0&&h.isNamespaceImport(N))i.set(N.name.text,{kind:"import",specifier:O,form:"namespace"});else if(N!==void 0&&h.isNamedImports(N))for(let A of N.elements){let U=(A.propertyName??A.name).text;i.set(A.name.text,{kind:"import",specifier:O,form:{named:U}})}}}else h.isImportEqualsDeclaration(I)&&h.isExternalModuleReference(I.moduleReference)&&h.isStringLiteralLike(I.moduleReference.expression)&&i.set(I.name.text,{kind:"import",specifier:I.moduleReference.expression.text,form:"whole"});let b=new Map,_,S=new Map,k=new Map;if(m)for(let{name:I,value:O}of Pk(n)){let E=`${e}#member-export:${I}`;o.push({id:E,moduleId:e,name:I,kind:h.isArrowFunction(O)?"arrow":"function",declRange:xt(e,O,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:O.getStart(n,!1),end:O.getEnd(),id:E}),b.set(O.getStart(n,!1),E)}if(s&&m){let I=U=>{let $=an(U);return h.isFunctionExpression($)||h.isArrowFunction($)?$:void 0},O=(U,$)=>{let W=U;return o.push({id:W,moduleId:e,kind:h.isArrowFunction($)?"arrow":"function",declRange:xt(e,$,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:$.getStart(n,!1),end:$.getEnd(),id:W}),b.set($.getStart(n,!1),W),W},E=[],N=[],A=[];for(let U of n.statements)h.isExportAssignment(U)&&!U.isExportEquals?E.push(U):h.isFunctionDeclaration(U)&&h.getModifiers(U)?.some($=>$.kind===h.SyntaxKind.DefaultKeyword)===!0?N.push(U):h.isExpressionStatement(U)&&h.isBinaryExpression(U.expression)&&U.expression.operatorToken.kind===h.SyntaxKind.EqualsToken&&In(U.expression.left)&&A.push(U.expression);if(E.length+N.length+A.length===1){let U=E[0],$=N[0],W=A[0];if(U!==void 0){let w=I(U.expression);if(w!==void 0){let P=O(`${e}#<default>`,w);_={id:P,esm:!0},k.set(U.getStart(n,!1),P),je(r,"2a-default",null)}}else if($!==void 0&&$.name===void 0&&$.body!==void 0){let w=O(`${e}#<default>`,$);_={id:w,esm:!0},k.set($.getStart(n,!1),w),je(r,"2a-default",null)}else if(W!==void 0){let w=I(W.right);if(w!==void 0){let P=O(`${e}#<default>`,w);_={id:P,esm:!1},k.set(W.getStart(n,!1),P),je(r,"2a-default",null)}else if(h.isObjectLiteralExpression(W.right)){let P=W.right,j=[],F=!0;for(let B of P.properties){if(h.isSpreadAssignment(B)){F=!1;break}let ne=B.name,X=ne===void 0?void 0:yl(ne);if(X===void 0){F=!1;break}j.push(X)}if(F){let B=new Map;for(let ne of j)B.set(ne,(B.get(ne)??0)+1);for(let ne of P.properties){if(!h.isPropertyAssignment(ne))continue;let X=yl(ne.name),Q=I(ne.initializer);if(X!==void 0){if(!Rk(X)){Q!==void 0&&je(r,"2a-member","charset-refused");continue}if((B.get(X)??0)!==1){Q!==void 0&&je(r,"2a-member","duplicate-key");continue}if(Q!==void 0){let Z=O(`${e}#<cjs>.${X}`,Q);S.set(X,Z),k.set(ne.getStart(n,!1),Z),je(r,"2a-member",null)}}}}else for(let B of P.properties)h.isPropertyAssignment(B)&&I(B.initializer)!==void 0&&je(r,"2a-member","spread-or-computed-literal")}}}else{for(let U of E)I(U.expression)!==void 0&&je(r,"2a-default","duplicate-default-sources");for(let U of N)U.name===void 0&&je(r,"2a-default","duplicate-default-sources");for(let U of A)if(I(U.right)!==void 0)je(r,"2a-default","duplicate-default-sources");else if(h.isObjectLiteralExpression(U.right))for(let $ of U.right.properties)h.isPropertyAssignment($)&&I($.initializer)!==void 0&&je(r,"2a-member","duplicate-default-sources")}}for(let I of t)o.push({id:I.id,moduleId:e,name:`handler:${I.memberPath}`,kind:h.isArrowFunction(I.node)?"arrow":"function",declRange:xt(e,I.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:I.node.getStart(n,!1),end:I.node.getEnd(),id:I.id});a.sort((I,O)=>I.end-I.start-(O.end-O.start));let v=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:o,bindings:i,exportedFunctionId:v,exportedNames:l,tainted:c,fnRanges:a,toplevelId:f,classes:u,mintedByPos:b,mintedDefault:_,mintedMembers:S,mintSeedAliases:k}}function nw(e){return h.isIdentifier(e)?"identifier":h.isPropertyAccessExpression(e)?"member":h.isElementAccessExpression(e)?"computed-member":e.kind===h.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function sp(e,n){let t=s=>{if(h.isBinaryExpression(s)&&s.operatorToken.kind>=h.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=h.SyntaxKind.LastAssignment){let r=s.left;h.isPropertyAccessExpression(r)&&h.isIdentifier(r.expression)?n(r.expression.text,r.name.text):h.isElementAccessExpression(r)&&h.isIdentifier(r.expression)&&n(r.expression.text,h.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(h.isCallExpression(s)&&h.isPropertyAccessExpression(s.expression)){let r=s.expression,o=s.arguments[0];h.isIdentifier(r.expression)&&o!==void 0&&h.isIdentifier(o)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(o.text,null)}h.forEachChild(s,t)};t(e)}function tw(e){let n=!1,t=s=>{if(!n){if(h.isVariableDeclaration(s)||h.isParameter(s)){let r=new Set;if(Mr(s.name,r),r.has("require")){n=!0;return}}else if((h.isFunctionDeclaration(s)||h.isClassDeclaration(s))&&s.name!==void 0&&s.name.text==="require"){n=!0;return}h.forEachChild(s,t)}};return t(e),n}function sw(e,n,t,s=new Map,r={}){let o=r.additiveForms===!0,i=r.namelessExports===!0,a=o||i?{}:void 0,l=new Map,d=new Map;for(let w of n.imports)w.resolvedModuleId!==void 0&&d.set(`${w.moduleId}::${w.specifier}`,w.resolvedModuleId);for(let w of e.sourceFiles){let P=e.toRel(w.fileName);P!==null&&l.set(P,ew(P,w,s.get(P)??[],i,a))}let c=new Map;if(o)for(let w of l.values()){let P=new Map;for(let[j,F]of w.bindings)if(F.kind==="import"&&F.form==="whole"&&Ze(F.specifier)!=="package-root"){let B=d.get(`${w.rel}::${F.specifier}`);B!==void 0&&P.set(j,String(B))}P.size!==0&&sp(w.sf,(j,F)=>{let B=P.get(j);if(B===void 0)return;let ne=c.get(B);if(ne!=="*"){if(F===null){c.set(B,"*");return}ne===void 0?c.set(B,new Set([F])):ne.add(F)}})}let f=new Map;for(let w of l.values())w.exportedFunctionId!==void 0&&f.set(w.rel,w.exportedFunctionId);let p=new Map;for(let w of l.values()){if(w.rel.split("/").includes("node_modules"))continue;let P=vk(w.sf);if(P===void 0){i&&w.mintedDefault!==void 0&&p.set(w.rel,w.mintedDefault);continue}let j=w.bindings.get(P.name);j?.kind==="function"&&p.set(w.rel,{id:j.functionId,esm:P.esm})}let u=new Map;for(let w of l.values()){let P;for(let j of w.exportedNames){let F=w.bindings.get(j);F?.kind==="function"&&(P??=new Map,P.set(j,F.functionId))}P!==void 0&&u.set(w.rel,P)}let m=new Map;for(let w of l.values()){if(w.rel.split("/").includes("node_modules"))continue;let P=Dk(w.sf,w.tainted,j=>{let F=w.bindings.get(j);return F?.kind==="function"?F.functionId:void 0},i?j=>{let F=an(j);return h.isFunctionExpression(F)||h.isArrowFunction(F)?w.mintedByPos.get(F.getStart(w.sf,!1)):void 0}:void 0);P.size>0&&m.set(w.rel,P)}let g=[],y=[],b=[],_=[],S=[],k=[],v=new Map;for(let w of n.imports){let P=v.get(w.moduleId)??[];P.push(w.specifier),v.set(w.moduleId,P)}let I=w=>Mf(v.get(w)??[]),O=new Map,E=new Map,N=new Map,A=new Map;for(let w of l.values())if(!w.rel.split("/").includes("node_modules"))for(let P of w.functions)P.id!==w.toplevelId&&A.set(P.id,{fn:P,sf:w.sf});let U=new Map,$=w=>{let P=U.get(w);if(P===void 0){let j=A.get(w),F=j===void 0?null:qf(j.sf,j.fn.declRange.start,j.fn.declRange.end);P=F===null?null:Wf(F),U.set(w,P)}return P};for(let w of l.values()){k.push(...w.classes);for(let K of w.exportedNames){let J=w.bindings.get(K);if(J?.kind==="function"){let oe=`${w.rel}#export:${K}`;_.push({id:oe,moduleId:w.rel,exportedName:K,kind:"value"}),S.push({exportId:oe,target:{kind:"function",functionId:J.functionId}})}}if(i){if(w.mintedDefault!==void 0){let K=`${w.rel}#export:<default>`;_.push({id:K,moduleId:w.rel,exportedName:"default",kind:"value"}),S.push({exportId:K,target:{kind:"function",functionId:w.mintedDefault.id}})}for(let[K,J]of w.mintedMembers){let oe=`${w.rel}#export:<cjs>.${K}`;_.push({id:oe,moduleId:w.rel,exportedName:K,kind:"value"}),S.push({exportId:oe,target:{kind:"function",functionId:J}})}}let P=new Map;for(let[K,J]of w.bindings){if(J.kind==="function"){P.set(K,J);continue}if(Ze(J.specifier)==="package-root"){let ae=Bn(J.specifier);typeof J.form=="object"?P.set(K,{kind:"package-export",packageName:ae,exportName:J.form.named}):J.form==="require-default"?P.set(K,{kind:"package-default",packageName:ae}):P.set(K,{kind:"package-surface",packageName:ae})}else{let ae=d.get(`${w.rel}::${J.specifier}`);if(ae!==void 0&&typeof J.form=="object"){let Ee=u.get(String(ae))?.get(J.form.named);Ee!==void 0&&P.set(K,{kind:"app-named-fn",functionId:Ee})}else if(ae!==void 0&&J.form==="require-default"){let Ee=p.get(String(ae));Ee!==void 0&&Ee.esm&&P.set(K,{kind:"app-default-fn",functionId:Ee.id})}else ae!==void 0&&typeof J.form!="object"&&J.form!=="require-default"&&P.set(K,{kind:"module",resolvedModuleId:ae})}}let j=new Map;for(let K of w.functions){if(K.enclosingClassId===void 0||K.name===void 0)continue;let J=j.get(K.enclosingClassId);J===void 0&&(J=new Map,j.set(K.enclosingClassId,J)),J.set(K.name,K.id)}for(let K of w.classes)K.name===void 0||w.tainted.has(K.name)||P.has(K.name)||P.set(K.name,{kind:"app-class",cls:{classId:K.id,className:K.name,memberIds:j.get(K.id)??new Map}});let F=K=>{if(h.isVariableDeclaration(K)&&h.isIdentifier(K.name)&&K.initializer!==void 0&&h.isNewExpression(K.initializer)&&!w.tainted.has(K.name.text)&&!P.has(K.name.text)){let J=Jf(K.initializer,P,w.tainted);J!==null&&P.set(K.name.text,J)}h.forEachChild(K,F)};F(w.sf);let B=K=>{for(let J of w.fnRanges)if(K>=J.start&&K<J.end)return J.id;return w.toplevelId},ne=new Map,X=new Map,Q=new Map,Z=(K,J,oe)=>{if(oe===null){K.set(J,"*");return}let ae=K.get(J);ae!=="*"&&(ae===void 0?K.set(J,new Set([oe])):ae.add(oe))},x=(K,J)=>{Z(ne,K,J);let oe=P.get(K);oe?.kind==="package-surface"?Z(X,oe.packageName,J):oe?.kind==="module"&&Z(Q,String(oe.resolvedModuleId),J)};sp(w.sf,x);let T=new Map,q=256,G=K=>{let J=T.get(K);return J===void 0&&(J=T.size>=q?new Set([K]):mp(w.sf,new Set([K])),T.set(K,J)),J},z=(K,J)=>K==="*"||K!==void 0&&K.has(J),L=(K,J)=>{let oe=P.get(K);if(oe?.kind==="package-surface"&&z(X.get(oe.packageName),J)||oe?.kind==="module"&&z(Q.get(String(oe.resolvedModuleId)),J))return!0;for(let ae of G(K))if(z(ne.get(ae),J))return!0;return!1},ie=K=>{if(h.isIdentifier(K)){let J=w.tainted.has(K.text)?void 0:P.get(K.text);return J?.kind==="function"?J.functionId:J?.kind==="module"?f.get(String(J.resolvedModuleId))??null:J?.kind==="package-export"?t.exportFor(J.packageName,J.exportName):null}if(h.isPropertyAccessExpression(K)&&h.isIdentifier(K.expression)){let J=K.expression.text;if(L(J,K.name.text))return null;let oe=w.tainted.has(J)?void 0:P.get(J);return oe?.kind==="package-surface"?t.exportFor(oe.packageName,K.name.text):oe?.kind==="package-export"?t.methodFor(oe.packageName,oe.exportName,K.name.text,"method"):oe?.kind==="package-instance"?t.methodFor(oe.packageName,oe.className,K.name.text,"method"):null}return null},me=K=>{for(let J=K.parent;J!==void 0;J=J.parent)if(!h.isArrowFunction(J)){if(h.isFunctionExpression(J)||h.isFunctionDeclaration(J))return null;if(h.isMethodDeclaration(J)||h.isConstructorDeclaration(J)||h.isGetAccessorDeclaration(J)||h.isSetAccessorDeclaration(J)){let oe=J.parent;if(!h.isClassLike(oe)||oe.name===void 0)return null;let ae=w.tainted.has(oe.name.text)?void 0:P.get(oe.name.text);return ae?.kind==="app-class"?ae.cls:null}}return null},be=o&&!w.tainted.has("require")&&!tw(w.sf),Me=K=>{if(h.isIdentifier(K)){let ae=w.tainted.has(K.text)?void 0:P.get(K.text);return ae?.kind==="package-surface"||ae?.kind==="package-default"?t.exportFor(ae.packageName,"default"):ae?.kind==="app-named-fn"||ae?.kind==="app-default-fn"?ae.functionId:ae?.kind==="module"?p.get(String(ae.resolvedModuleId))?.id??null:ae?.kind==="member-value"?ae.functionId:null}if(!h.isPropertyAccessExpression(K))return null;let J=K.expression;if(o&&h.isCallExpression(an(J))){let ae=kt(an(J));if(ae!==void 0)if(!be)je(a,"2b","require-shadow");else if(Ze(ae)==="package-root")je(a,"2b","package-root");else{let Ee=d.get(`${w.rel}::${ae}`);if(Ee===void 0)je(a,"2b","unresolved-module");else{let Te=K.name.text,En=c.get(String(Ee));if(En==="*"||En!==void 0&&En.has(Te))je(a,"2b","module-mutation-gate");else{let Un=m.get(String(Ee))?.get(Te);if(Un!==void 0)return je(a,"2b",null),Un;if(Te==="default"){let Hn=p.get(String(Ee));if(Hn!==void 0&&Hn.esm)return je(a,"2b",null),Hn.id;je(a,"2b","non-esm-default")}else je(a,"2b","unknown-member")}}}return null}let oe;if(h.isIdentifier(J)){let ae=w.tainted.has(J.text)?void 0:P.get(J.text);if(ae?.kind==="app-class"||ae?.kind==="app-instance")oe=ae.cls.memberIds;else if(ae?.kind==="object-literal")oe=ae.obj.members;else if(ae?.kind==="module"){let Ee=m.get(String(ae.resolvedModuleId));Ee?.has(K.name.text)===!0&&!L(J.text,K.name.text)&&(oe=Ee)}}else if(h.isNewExpression(J)){let ae=Jf(J,P,w.tainted);ae?.kind==="app-instance"&&(oe=ae.cls.memberIds)}else J.kind===h.SyntaxKind.ThisKeyword&&(oe=me(K)?.memberIds);return oe?.get(K.name.text)??null},re=new Map,R=K=>{if(h.isVariableDeclaration(K)&&h.isIdentifier(K.name)&&K.initializer!==void 0&&h.isObjectLiteralExpression(K.initializer)&&!w.tainted.has(K.name.text)&&!P.has(K.name.text)&&!re.has(K.name.text)){let J=new Map;for(let oe of K.initializer.properties)if(h.isPropertyAssignment(oe)&&h.isIdentifier(oe.name)){let ae=ie(oe.initializer);ae!==null&&J.set(oe.name.text,ae)}re.set(K.name.text,J)}h.forEachChild(K,R)};R(w.sf);let D=K=>{if(h.isBinaryExpression(K)&&K.operatorToken.kind===h.SyntaxKind.EqualsToken&&h.isPropertyAccessExpression(K.left)&&h.isIdentifier(K.left.expression)&&!w.tainted.has(K.left.expression.text)){let J=re.get(K.left.expression.text);if(J!==void 0){let oe=ie(K.right);oe!==null&&J.set(K.left.name.text,oe)}}h.forEachChild(K,D)};D(w.sf);for(let[K,J]of re)P.set(K,{kind:"object-literal",obj:{members:J}});let Y=(K,J=0)=>{if(J>Xf)return null;let oe=an(K);if(h.isCallExpression(oe)&&h.isPropertyAccessExpression(oe.expression)&&oe.expression.name.text==="bind")return Y(oe.expression.expression,J+1);if(h.isIdentifier(oe)){let ae=ie(oe);if(ae!==null)return ae;let Ee=w.tainted.has(oe.text)?void 0:P.get(oe.text);return Ee?.kind==="member-value"?Ee.functionId:null}return h.isPropertyAccessExpression(oe)?ie(oe)??Me(oe):null},H=(K,J=0)=>{if(J>Xf)return"depth-cap";let oe=an(K);if(h.isCallExpression(oe)&&h.isPropertyAccessExpression(oe.expression)&&oe.expression.name.text==="bind")return H(oe.expression.expression,J+1);if(h.isIdentifier(oe))return w.tainted.has(oe.text)?"tainted-receiver":"unresolved-receiver";if(h.isPropertyAccessExpression(oe)&&h.isIdentifier(oe.expression)){if(w.tainted.has(oe.expression.text))return"tainted-receiver";if(L(oe.expression.text,oe.name.text))return"mutated-member"}return"unresolved-receiver"},ee=K=>{if(h.isVariableDeclaration(K)&&h.isIdentifier(K.name)&&K.initializer!==void 0){let J=an(K.initializer),oe=h.isPropertyAccessExpression(J),ae=h.isCallExpression(J)&&h.isPropertyAccessExpression(J.expression)&&J.expression.name.text==="bind";if(oe||ae){let Ee=oe?"D1":"A2";if(w.tainted.has(K.name.text))je(a,Ee,"tainted-alias");else if(P.has(K.name.text))je(a,Ee,"already-bound");else{let Te=Y(J);Te!==null?(P.set(K.name.text,{kind:"member-value",functionId:Te}),je(a,Ee,null)):je(a,Ee,H(J))}}}h.forEachChild(K,ee)};o&&ee(w.sf);let le=I(w.rel),de=new Map,ge=new Map,ve=K=>{let J=an(K);if(!h.isIdentifier(J))return null;let oe=w.tainted.has(J.text)?void 0:P.get(J.text),ae=oe?.kind==="package-surface"||oe?.kind==="package-export"&&oe.exportName==="default"?oe.packageName:null;return ae===null?null:zf(ae)?.shape??null},Re=(K,J)=>{let oe=new Set((J.arity??[]).map(Te=>jr(J.model,Te))),[ae]=[...oe];if(oe.size!==1||ae===void 0||ae>=J.passes)return;let Ee={model:J.model,index:ae,registeredAt:J.registeredAt};if(h.isArrowFunction(K)||h.isFunctionExpression(K))ge.has(K)||ge.set(K,Ee);else if(h.isIdentifier(K)||h.isPropertyAccessExpression(K)){let Te=ie(K)??Me(K);Te!==null&&!O.has(Te)&&(O.set(Te,J.model),E.set(Te,J.registeredAt),N.set(Te,ae))}},_e=(K,J,oe)=>{let ae=de.get(K);if(ae===void 0)return;let Ee=ve(J)??(oe===null?null:$(oe));if(Ee===null||K.questionDotToken!==void 0||K.arguments.some(h.isSpreadElement))return;let Te=K.arguments[Ee.param];if(Te===void 0)return;let En={...ae,depth:ae.depth+1,arity:ae.arity??Ee.arity,passes:Math.min(ae.passes,Ee.passes)},Un=an(Te);h.isCallExpression(Un)?En.depth<Kf&&de.set(Un,En):Re(Un,En)},Ke=0,ze=K=>{let J,oe;if(h.isCallExpression(K)){let ae=K.expression,Ee=h.isIdentifier(ae)&&ae.text==="require",Te=ae.kind===h.SyntaxKind.ImportKeyword;!Ee&&!Te&&(J=ae,oe=K.arguments)}else h.isTaggedTemplateExpression(K)&&(J=K.tag);if(J!==void 0){let ae=nw(J),Ee=K.getStart(w.sf,!1),Te=`${w.rel}#call${String(Ke)}`;Ke+=1;let En="unresolved",Un=[],Hn=ie(J);if(Hn!==null&&(En="resolved",Un.push(Hn)),y.push({id:Te,enclosingFunctionId:B(Ee),calleeExprShape:ae,resolvedTargetIds:Un,resolution:En,range:xt(w.rel,K,w.sf),...ml(K,J,w.rel,w.sf,{program:e.program,checker:e.checker})}),h.isCallExpression(K)){let Ye=Jo(K,le);for(let et of Ye?.handlers??[]){if(Ye===null||!(h.isIdentifier(et)||h.isPropertyAccessExpression(et)))continue;let gt=ie(et)??Me(et);gt!==null&&!O.has(gt)&&(O.set(gt,Ye.model),E.set(gt,xt(w.rel,K,w.sf)))}for(let et of Ye?.forwarded??[])Ye!==null&&de.set(et,{model:Ye.model,registeredAt:xt(w.rel,K,w.sf),depth:0,arity:null,passes:Number.POSITIVE_INFINITY})}for(let Ye of Un)b.push({callSiteId:Te,calleeFunctionId:Ye,resolution:En,invocation:"direct"});let br=Hn===null?Me(J):null;if(Hn===null){if(br!==null)b.push({callSiteId:Te,calleeFunctionId:br,resolution:"field-based",invocation:"direct"});else if(o&&h.isPropertyAccessExpression(J)&&(J.name.text==="call"||J.name.text==="apply")){let Ye=Y(J.expression);Ye!==null?(b.push({callSiteId:Te,calleeFunctionId:Ye,resolution:"field-based"}),je(a,"A3",null)):je(a,"A3",H(J.expression))}}h.isCallExpression(K)&&_e(K,J,Hn??br);for(let Ye of oe??[]){let et=ie(Ye);if(et!==null)b.push({callSiteId:Te,calleeFunctionId:et,resolution:"field-based",invocation:"callback"});else{let gt=Me(Ye);if(gt!==null)b.push({callSiteId:Te,calleeFunctionId:gt,resolution:"field-based",invocation:"callback"});else if(o){let Ds=Y(Ye),V=an(Ye),ye=V!==Ye||h.isCallExpression(V)&&h.isPropertyAccessExpression(V.expression)&&V.expression.name.text==="bind";Ds!==null?(b.push({callSiteId:Te,calleeFunctionId:Ds,resolution:"field-based"}),ye&&je(a,"A2p",null)):ye&&je(a,"A2p",H(Ye))}}}}h.forEachChild(K,ze)};ze(w.sf),g.push(...pl(w.functions,w.sf,w.rel,le,{program:e.program,checker:e.checker},ge));for(let K of n.computedLoads.get(w.rel)??[]){let J=K.candidateRels.filter(ae=>l.has(ae)).map(ae=>`${ae}#<toplevel>`);if(J.length===0)continue;let oe=`${w.rel}#dirload${String(Ke)}`;Ke+=1,y.push({id:oe,enclosingFunctionId:B(K.pos),calleeExprShape:"require",resolvedTargetIds:J,resolution:"field-based",range:{path:w.rel,start:K.pos,end:K.pos}});for(let ae of J)b.push({callSiteId:oe,calleeFunctionId:ae,resolution:"field-based"})}let pn=0;for(let K of n.literalLoads.get(w.rel)??[]){let J=[];for(let ae of K.targetRels){let Ee=l.get(ae);Ee!==void 0&&J.push(Ee.toplevelId)}if(J.length===0)continue;let oe=`${w.rel}#load${String(pn)}`;pn+=1,y.push({id:oe,enclosingFunctionId:B(K.pos),calleeExprShape:K.shape,resolvedTargetIds:J,resolution:"resolved",range:{path:w.rel,start:K.pos,end:K.pos}});for(let ae of J)b.push({callSiteId:oe,calleeFunctionId:ae,resolution:"resolved"})}let vn=0;for(let K of s.get(w.rel)??[]){let J=`${w.rel}#handlerseed${String(vn)}`;vn+=1;let oe=K.node.getStart(w.sf,!1);y.push({id:J,enclosingFunctionId:w.toplevelId,calleeExprShape:"member",resolvedTargetIds:[K.id],resolution:"field-based",range:{path:w.rel,start:oe,end:oe}}),b.push({callSiteId:J,calleeFunctionId:K.id,resolution:"field-based"})}}let W=new Map;if(i)for(let w of l.values())for(let[P,j]of w.mintSeedAliases)W.set(`${w.rel}::${String(P)}`,j);return{functions:g.map(w=>{let P=O.get(w.id);if(P===void 0||w.sourceParams!==void 0)return w;let j=E.get(w.id);return{...w,sourceParams:[{index:N.get(w.id)??jr(P,w.params?.length??0),sourceClass:P.sourceClass,model:P.id,...j!==void 0?{registeredAt:j}:{}}]}}),callSites:y,callEdges:b,exports:_,exportBindings:S,classes:k,mintSeedAliases:W,bindingApplicability:a}}function rw(e,n,t){let s=l=>l.length===0||Mn.isAbsolute(l)||l.includes("\\")||/^[a-zA-Z]:/u.test(l)||l.split("/").some(d=>d===".."||d==="");if(s(n)||s(t))return null;let r=e.endsWith(Mn.sep)?e:e+Mn.sep,o;try{o=Vf(Mn.resolve(e,n))}catch{return null}if(!o.startsWith(r))return null;let i=o.endsWith(Mn.sep)?o:o+Mn.sep,a;try{a=Vf(Mn.resolve(o,t))}catch{return null}return a.startsWith(i)?a:null}function bp(e,n,t){let s=`${e}#class:${t}`,r=[],o=[],i=[],a=new Set;return{pushMember(l,d,c,f){if(l==="__proto__"||a.has(l))return;a.add(l);let p=`${e}#${t}.${l}`;r.push({id:p,moduleId:e,name:l,kind:c,enclosingClassId:s,declRange:xt(e,d,n),isExported:!1,publicSurfaceReachable:!1}),i.push(p),o.push({name:l,id:p,kind:c,body:f})},finish(){return o.length===0?null:{functions:r,classNode:{id:s,moduleId:e,name:t,implementsRefs:[],members:i},members:o}}}}function ow(e,n,t,s){if(yp(s)||s.members.length>bl)return null;let r=bp(e,n,t);for(let o of s.members){let i,a,l;if(h.isConstructorDeclaration(o))i="constructor",a="ctor",l=void 0;else if(h.isMethodDeclaration(o))i=si(o.name),a="method",l=i!==void 0&&!Ys.has(i)?o.body??void 0:void 0;else continue;i!==void 0&&r.pushMember(i,o,a,l)}return r.finish()}function iw(e,n,t){let s;for(let i of n.statements)if(h.isFunctionDeclaration(i)&&i.name?.text===t){s=i;break}if(s===void 0)return null;let r=[];for(let i of n.statements){if(!h.isExpressionStatement(i))continue;let a=i.expression;if(!h.isBinaryExpression(a)||a.operatorToken.kind!==h.SyntaxKind.EqualsToken)continue;let l=a.left;if(h.isPropertyAccessExpression(l)&&h.isPropertyAccessExpression(l.expression)&&h.isIdentifier(l.expression.expression)&&l.expression.expression.text===t&&l.expression.name.text==="prototype"){let d=l.name.text;h.isFunctionExpression(a.right)?r.push({name:d,fn:a.right,walk:!0}):h.isArrowFunction(a.right)&&r.push({name:d,fn:a.right,walk:!1})}}if(r.length===0||r.length+1>bl)return null;let o=bp(e,n,t);o.pushMember("constructor",s,"ctor",void 0);for(let i of r){let a=i.walk&&!Ys.has(i.name)&&h.isFunctionExpression(i.fn)?i.fn.body:void 0;o.pushMember(i.name,i.fn,"method",a)}return o.finish()}function aw(e,n,t){for(let s of n.statements)if(h.isClassDeclaration(s)&&s.name?.text===t)return ow(e,n,t,s);return iw(e,n,t)}function lw(e,n,t,s,r){let o={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return o;let i=new Set(t.map(f=>f.packageName)),a=new Set(t.map(f=>f.path)),l=new Set,d=new Set,c=0;for(let f of n){if(!i.has(f.packageName))continue;let p=rw(e.appRoot,f.packageRootRel,f.sourcePath);if(p===null)continue;let u=e.toRel(p);if(u===null)continue;let m=`${u}#${f.container}`;if(d.has(m)||!l.has(u)&&l.size>=ni)continue;let g=_n(p);if(g===null)continue;let y;try{y=h.createSourceFile(u,g,h.ScriptTarget.Latest,!0,h.ScriptKind.JS)}catch{continue}let b=aw(u,y,f.container);if(b===null)continue;l.add(u),d.add(m);let _=new Map,S=new Map;for(let v of b.members){let I=r.methodFor(f.packageName,f.container,v.name,v.kind);_.set(v.name,I),S.set(I,v.id)}let k=0;for(let v of b.members){if(v.body===void 0)continue;let I=(O,E)=>{if(E&&h.isCallExpression(O)&&h.isPropertyAccessExpression(O.expression)&&O.expression.expression.kind===h.SyntaxKind.ThisKeyword){let U=_.get(O.expression.name.text);if(U!==void 0){let $=`${u}#depclass:${f.container}.${v.name}#c${String(k)}`;k+=1,o.callSites.push({id:$,enclosingFunctionId:v.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:xt(u,O,y)}),o.callEdges.push({callSiteId:$,calleeFunctionId:U,resolution:"field-based"})}}let N=h.isFunctionExpression(O)||h.isFunctionDeclaration(O)||h.isMethodDeclaration(O)||h.isConstructorDeclaration(O)||h.isGetAccessorDeclaration(O)||h.isSetAccessorDeclaration(O)||h.isClassLike(O),A=h.isArrowFunction(O)?E:N?!1:E;h.forEachChild(O,U=>{I(U,A)})};I(v.body,!0)}for(let v of s){let I=S.get(v.calleeFunctionId);I!==void 0&&o.callEdges.push({callSiteId:v.callSiteId,calleeFunctionId:I,resolution:"field-based"})}if(o.functions.push(...b.functions),o.classes.push(b.classNode),!a.has(u)){a.add(u),o.modules.push({id:u,packageName:f.packageName,versionRange:"",path:u,moduleSystem:"cjs",isEntrypoint:!1});let v=r.moduleFor(f.packageName),I=`${String(v)}#depclass${String(c)}`;c+=1,o.imports.push({id:I,moduleId:v,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:u}),o.importEdges.push({importId:I,resolvedModuleId:u})}o.diagnostics.push({code:"dep-class-corridor",path:u,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(b.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return o}function dw(e,n,t,s){let r=new Set(e.modules.filter(l=>l.isEntrypoint).map(l=>l.packageName)),o=new Map(e.functions.map(l=>[l.id,l.moduleId])),i=new Map;for(let l of e.callSites){if(l.resolution!=="unresolved")continue;let d=o.get(l.enclosingFunctionId);d!==void 0&&i.set(d,(i.get(d)??0)+1)}let a=[];for(let l of e.modules){if(l.externalSurface===!0)continue;let d=n.get(l.path);if(d===void 0||t.has(l.path)||r.has(l.packageName)&&s.has(l.path)&&!l.path.split("/").includes("node_modules"))continue;let c=i.get(l.id)??0;if(c===0&&Wk(d))continue;let f=c>0?`${String(c)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:l.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:l.id})}return a}function _p(e,n,t=[],s={},r=!1){let o=new gl,i=_k(e,n,o),a=new Set;for(let k of i.computedLoads.values())for(let v of k)if(v.seedable)for(let I of v.candidateRels)a.add(I);let l=new Map;for(let k of e.sourceFiles){let v=e.toRel(k.fileName);if(v===null||!a.has(v)||v.split("/").includes("node_modules"))continue;let I=Qk(v,k);I.length>0&&l.set(v,I)}let d=l.size===0?i.modules:i.modules.map(k=>l.has(k.path)&&!k.isEntrypoint?{...k,isEntrypoint:!0}:k),c={...i,modules:d},f=sw(e,c,o,l,s),p=Kk(e,i,f.functions,f.mintSeedAliases),u=new Set(i.modules.map(k=>k.path)),m=kk(e.depReach,o,u),g=[...c.modules,...m.modules,...o.modules()],y=lw(e,t,g,f.callEdges,o),b=[];if(r){let k="#default",v=new Set;for(let O of f.callEdges){let E=String(O.calleeFunctionId);!E.startsWith("pkg:")||!E.endsWith(k)||v.add(E.slice(4,E.length-k.length))}let I=new Map;for(let O of e.depReach.edges){if(!("surface"in O.from)||"surface"in O.to)continue;let E=O.from.surface;I.set(E,I.has(E)?null:O.to.module)}for(let O of v){let E=I.get(O);if(E==null)continue;let N=Sk(Mn.join(e.appRoot,E));if(N===null||N==="default")continue;let A=o.exportFor(O,N),U=`pkg:${O}${k}`;for(let $ of f.callEdges)String($.calleeFunctionId)===U&&b.push({callSiteId:$.callSiteId,calleeFunctionId:A,resolution:"field-based"})}}let _={modules:[...c.modules,...m.modules,...y.modules,...o.modules()],exports:[...f.exports,...p.exports],imports:[...i.imports,...m.imports,...y.imports],functions:[...f.functions,...o.functions(),...y.functions],callSites:[...f.callSites,...y.callSites],classes:[...f.classes,...o.classes(),...y.classes],callEdges:[...f.callEdges,...y.callEdges,...b],importEdges:[...i.importEdges,...m.importEdges,...y.importEdges],exportBindings:[...f.exportBindings,...p.exportBindings],inheritEdges:[]},S=new Map;for(let k of e.sourceFiles){let v=e.toRel(k.fileName);v!==null&&S.set(v,k)}return{graph:_,diagnostics:[...p.diagnostics,...y.diagnostics,...dw(_,S,new Set(e.diagnostics.filter(k=>k.code==="dependency-body").map(k=>k.path)),i.appOwnedPaths)],loadSites:i.loadSites,...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var cw=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,ri=/^[A-Za-z0-9_$.-]{1,128}$/u;function uw(e){return cw.test(e.calleePackage)?ri.test(e.anchorExport)?ri.test(e.calleeExport)?e.anchorContainer!==null&&!ri.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!ri.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Gr(e,n){let t=[],s=[],r=new Map(e.modules.map(d=>[d.id,d])),o=new Map(e.classes.map(d=>[d.id,d.name])),i=(d,c,f)=>e.functions.some(p=>{if(p.name!==c)return!1;let u=r.get(p.moduleId);return u===void 0||u.packageName!==d?!1:(p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null)===f}),a=(d,c,f)=>{for(let p of e.functions){if(p.name!==c)continue;let u=r.get(p.moduleId);if(!(u===void 0||u.packageName!==d||(p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null)!==f))return p.id}return null},l=[...n].sort((d,c)=>d.modelId<c.modelId?-1:d.modelId>c.modelId?1:0);for(let d of l){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let c=d.edges.map(uw).find(u=>u!==null);if(c!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${c} \u2014 model refused WHOLE`);continue}let f=0,p=0;for(let u of d.edges){if(!i(d.packageName,u.anchorExport,u.anchorContainer)){p+=1;continue}s.push({modelId:d.modelId,kind:u.kind,anchor:{packageName:d.packageName,exportName:u.anchorExport,container:u.anchorContainer},callee:{packageName:u.calleePackage,exportName:u.calleeExport,container:u.calleeContainer,realFunctionId:a(u.calleePackage,u.calleeExport,u.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${d.modelId}: ${String(f)} edge(s) lowered, ${String(p)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(p)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:s,notes:t}}}var fw={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Al(e){try{let n=kf(e.appRoot,e.entrypoints,e.tsconfigPaths===!0,new Set((e.executedEntrypoints??[]).map(a=>a.split(Tn.sep).join("/")))),t=new Set(e.entrypoints.map(a=>a.split(Tn.sep).join("/"))),{graph:s,diagnostics:r,loadSites:o,bindingApplicability:i}=_p(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:s,diagnostics:[...n.diagnostics,...r],loadSites:o,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...i!==void 0?{bindingApplicability:i}:{}}}catch(n){return{graph:fw,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Sp(e,n){let t=512,s=(r,o,i)=>{if(!(t<=0||o>12)){if(t-=1,typeof r=="string"){n(r,i);return}if(Array.isArray(r)){for(let a of r)s(a,o+1,i);return}if(r!==null&&typeof r=="object")for(let[a,l]of Object.entries(r))a==="types"||a==="typings"||s(l,o+1,i||a.includes("*"))}};s(e,0,!1)}function wp(e,n,t,s=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=Gt(Tn.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||s&&!st(r)?null:r===e?"":r.slice(n.length).split(Tn.sep).join("/")}var pw=1024*1024,mw=4096;function xp(e,n){let t=e.toLowerCase(),s=0;for(;;){let r=t.indexOf(n,s);if(r===-1)return null;let o=r===0?" ":t[r-1],i=r+n.length;for(;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
+`||e[i]==="\r");)i+=1;if(/[a-z0-9_:-]/i.test(o??" ")||e[i]!=="="){s=r+n.length;continue}for(i+=1;i<e.length&&(e[i]===" "||e[i]==="	"||e[i]===`
+`||e[i]==="\r");)i+=1;let a=e[i];if(a==='"'||a==="'"){let d=e.indexOf(a,i+1);return d===-1?null:e.slice(i+1,d)}let l=i;for(;l<e.length&&!/[\s>]/.test(e[l]??"");)l+=1;return e.slice(i,l)}}function gw(e){let n=[],t=e.toLowerCase(),s=0;for(;;){let r=t.indexOf("<script",s);if(r===-1)break;let o=t[r+7];if(o!==void 0&&/[a-z0-9-]/.test(o)){s=r+7;continue}let i=e.indexOf(">",r);if(i===-1)break;s=i+1;let a=e.slice(r+7,i);if(a.length>mw)continue;let l=xp(a,"type");n.push({module:(l??"").trim().toLowerCase()==="module",src:xp(a,"src")})}return n}function hw(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function yw(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function bw(e){let n=Gt(e),t=n.endsWith(Tn.sep)?n:n+Tn.sep,s=new Set,r=[],o=[],i=[],a=[],l=[],d=!1,c=(w,P,j=!1,F)=>{let B=wp(n,t,w);return B===null||B.length===0?"unresolved":s.has(B)?"duplicate":(s.add(B),r.push(B),o.push({source:P,specifier:Kn(F??(typeof w=="string"?w:"")),entrypoint:B,launch:j}),"added")},f=new Set,p=(w,P,j=!1)=>{let F=c(w,P),B=typeof w=="string"&&w.includes("\\")?c(w.split("\\").join("/"),P,!1,w):"unresolved";if(F!=="unresolved"||B!=="unresolved"||typeof w!="string"||w.trim().length===0||w.endsWith(".d.ts")||w.endsWith(".d.mts")||w.endsWith(".d.cts"))return;if(j&&w.includes("*")){let X=vf(n,w),Q=!1;if(X!==null){for(let Z of X.matches)c(Z,P,!1,w)!=="unresolved"&&(Q=!0);if(!X.truncated&&Q)return}a.push({source:P,file:"package.json",detail:`\`${Kn(w)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let ne=`${P}\0${w}`;f.has(ne)||(f.add(ne),a.push({source:P,file:"package.json",detail:`\`${Kn(w)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},u=[],m=(w,P)=>{i.push({source:w,file:w,detail:P.detail}),u.push({code:P.code,path:w,detail:`${w} ${P.detail}`})},g,y,b,_=null,S=oi(n,t,"package.json",ss);S.kind==="refused"&&m("package.json",S);try{let w=S.kind==="ok"?JSON.parse(S.text):{};if(_=S.kind==="ok"?w:null,p(w.main,"main"),typeof w.bin=="string")p(w.bin,"bin");else if(w.bin!==null&&typeof w.bin=="object")for(let j of Object.values(w.bin))p(j,"bin");Sp(w.exports,(j,F)=>{p(j,"exports",F)}),typeof w.browser=="string"?p(w.browser,"browser"):Sp(w.browser,j=>{c(j,"browser")});let P=w.scripts;if(P!==null&&typeof P=="object"){let j=P;g=j.start,y=j.prestart,b=j.poststart}}catch{}if(r.length===0)try{Gt(Tn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let k=(w,P)=>{if(typeof w=="string"&&w.trim().length>0){let j=vl(w,P,"package.json",c,i,!1)==="used";return j&&(d=!0),j?"resolved":"gapped"}return w===void 0||typeof w=="string"?"absent":(i.push({source:P,file:"package.json",detail:`${P} is not a string; no entry file could be read from it`}),"gapped")},v=k(g,"scripts.start"),I=k(y,"scripts.prestart"),O=k(b,"scripts.poststart"),E=v==="resolved"&&I!=="gapped"&&O!=="gapped",N=oi(n,t,"Procfile",65536);if(N.kind==="refused")m("Procfile",N);else if(N.kind==="ok"){let{entries:w,truncated:P,unnamedLines:j}=al(N.text);P&&i.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),j>0&&i.push({source:"Procfile",file:"Procfile",detail:`${String(j)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let F of w)vl(F.command,`Procfile:${F.name}`,"Procfile",c,i,E)==="used"&&(d=!0)}for(let w of["Dockerfile","docker-compose.yml","docker-compose.yaml","compose.yml"]){let P=oi(n,t,w,ol);if(P.kind==="refused"){m(w,P);continue}if(P.kind!=="ok")continue;let{commands:j,truncated:F}=il(P.text);F&&i.push({source:w,file:w,detail:`${w} declares more launch commands than cupel parses; the remainder was not read`});for(let B of j)vl(B.command,`${w}:${B.label}`,w,c,i,E)==="used"&&(d=!0)}let A=r.length===0,U=oi(n,t,"index.html",pw);if(U.kind==="ok")for(let w of gw(U.text)){if(w.src===null)continue;let P=Kn(w.src);if(!w.module){l.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${P}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(hw(w.src)){l.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${P}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}c(yw(w.src),"index.html",!1,w.src)==="unresolved"&&i.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${P}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else U.kind==="refused"&&l.push({kind:U.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${U.detail}`,root:""});let $=A?el(n,_):null;if($!==null){let w=0;for(let P of tl(n,$).roots)c(P,`framework:${$.name}`)==="added"&&(w+=1);w>0&&u.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${$.name}'s directory conventions (recognised via ${$.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let W=w=>w.map(P=>({...P,root:""}));return{entrypoints:r,sources:W(o),gaps:W(i),surfaceGaps:W(a),launchResolved:d,diagnostics:u,framework:$,observations:l}}function oi(e,n,t,s){let r;try{r=Gt(Tn.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let o=Hs(r,s);return o.kind==="ok"?o:o.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(o.bytes)} bytes, over the ${String(s)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function vl(e,n,t,s,r,o){let i=rl(e);if(i.kind==="delegates")return o?"used":(r.push({source:n,file:t,detail:`\`${Kn(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(i.kind==="foreign")return"foreign";if(i.kind==="unparsed")return r.push({source:n,file:t,detail:`\`${Kn(e)}\`: ${i.reason}`}),"gapped";let a=s(i.specifier,n,!0),l=i.alt===void 0?"unresolved":s(i.alt,n,!0);return a==="unresolved"&&l==="unresolved"?(r.push({source:n,file:t,detail:`\`${Kn(i.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function Qs(e,n){return e===""?n:`${e}/${n}`}function vp(e,n){let t=Gt(e),s=t.endsWith(Tn.sep)?t:t+Tn.sep,r=new Set,o=[],i=[],a=[],l=[],d=[],c=[],f=!1,p=null,u=[...n].sort((m,g)=>m.rel===""?-1:g.rel===""?1:m.rel<g.rel?-1:m.rel>g.rel?1:0);for(let m of u){let g=Qs(m.rel,"package.json"),y=m.rel===""?".":m.rel,b;try{b=Gt(m.abs)}catch{a.push({source:"root",file:g,detail:`root \`${y}\` could not be resolved; not seeded`,root:m.rel});continue}if(b!==t&&!b.startsWith(s)){a.push({source:"root",file:g,detail:`root \`${y}\` resolves outside the scan root; refused, not seeded`,root:m.rel});continue}let _;try{_=bw(b)}catch{a.push({source:"root",file:g,detail:`root \`${y}\` could not be read; not seeded`,root:m.rel});continue}for(let S of _.sources){let k=Qs(m.rel,S.entrypoint),v,I;try{v=Gt(Tn.resolve(t,k)),I=Gt(Tn.resolve(b,S.entrypoint))}catch{a.push({source:S.source,file:g,detail:`\`${S.specifier}\` re-based to \`${k}\` did not resolve; not seeded`,root:m.rel});continue}if(!v.startsWith(s)||v!==I){a.push({source:S.source,file:g,detail:`\`${S.specifier}\` re-based to \`${k}\` escapes the scan root or names another file; refused, not seeded`,root:m.rel});continue}r.has(k)||(r.add(k),o.push(k),i.push({...S,entrypoint:k,root:m.rel}))}_.launchResolved&&(f=!0);for(let S of _.gaps)a.push({...S,file:Qs(m.rel,S.file),root:m.rel});for(let S of _.surfaceGaps)l.push({...S,file:Qs(m.rel,S.file),root:m.rel});for(let S of _.diagnostics)d.push({...S,path:Qs(m.rel,S.path)});for(let S of _.observations)c.push({...S,file:Qs(m.rel,S.file),root:m.rel});m.rel===""&&(p=_.framework)}return{entrypoints:o,sources:i,gaps:a,surfaceGaps:l,launchResolved:f,diagnostics:d,framework:p,observations:c}}function Il(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let s=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${s}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Nl(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let s=[...new Set(t.slice(0,3).map(r=>r.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${s}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Ep(e,n){let t=Gt(e),s=t.endsWith(Tn.sep)?t:t+Tn.sep,r=new Set,o=[],i=[];for(let a of n){let l=wp(t,s,a,!0);if(l===null||l.length===0){i.push(a);continue}r.has(l)||(r.add(l),o.push(l))}return{entrypoints:o,rejected:i}}import{readdirSync as cm,readFileSync as Vl,realpathSync as Xl,statSync as no}from"node:fs";import ut from"node:path";function _w(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let s=t+2;for(;s<e.length&&e.charCodeAt(s)===32;)s+=1;let r=e.charCodeAt(s);return r===38||r===42}function at(e,n,t){let s=n.maxLines??2e6,r=n.maxLineBytes??16384,o=!1,i=!1,a=0,l=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let c=e.indexOf(`
+`,d),f=c===-1;f&&(c=e.length);let p=c>d&&e.charCodeAt(c-1)===13?c-1:c;if(l+=1,l>s){o=!0;break}if(p-d>r)a+=1;else{let u=d;for(;u<p&&e.charCodeAt(u)===32;)u+=1;let m=u-d,g=p;for(;g>u&&(e.charCodeAt(g-1)===32||e.charCodeAt(g-1)===9);)g-=1;if(u<g&&e.charCodeAt(u)!==35){let y=e.slice(u,g);if(_w(y)){i=!0;break}t(m,y)}}if(f)break;d=c+1}return{truncated:o||a>0,refusedAnchors:i,oversizeLines:a}}function wt(e){let n=e.charCodeAt(0);if(n===34||n===39){let s=e.indexOf(String.fromCharCode(n),1);if(s===-1)return null;let r=s+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,s+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function Yn(e){return e.endsWith(":")}function Le(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function ii(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,s=t.indexOf("/");if(n){if(s<=0||t.indexOf("/",s+1)!==-1)return!1}else if(s!==-1)return!1;let r=n?[t.slice(0,s),t.slice(s+1)]:[t];for(let o of r){if(o.length===0||o.charCodeAt(0)===46||o.charCodeAt(0)===95)return!1;for(let i=0;i<o.length;i+=1){let a=o.charCodeAt(i);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function Kr(e){return ii(e)?`node_modules/${e}`:""}function zr(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var ai=2e5,Ap=64,li=1024,Sw=5,xw=[1,2,3];function kw(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let s=e.slice(t+n.length);if(s==="")return null;let r=s.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function Ip(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let s=t.indexOf("@",1);if(s>0){let r=t.slice(0,s),o=t.slice(s+1);if(r.length>0&&o.length>0)return[{name:r,version:o}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function lt(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Np(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Rp(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Op(e,n,t,s,r=!1){let o=JSON.stringify([n,t,s]);if(!e.seen.has(o)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(o),e.deps.push({name:n,version:t,lockKey:s,dev:r})}}function ww(e,n){for(let[t,s]of Object.entries(e)){if(t==="")continue;if(!Rp(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),o=lt(s);if(o===null){n.unread+=1;continue}if(o.link===!0)continue;let i=o.name,a=typeof i=="string"&&i!==""?i:kw(t),l=o.version;if(a===null||typeof l!="string"){r&&(n.unread+=1);continue}let d=o.dev===!0||o.devOptional===!0;for(let c of Ip(a,l))Op(n,c.name,c.version,t,d)}}function Pp(e,n,t){let s=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let o=0;o<s.length;o+=1){let i=s[o];if(i===void 0)break;for(let[a,l]of Object.entries(i.deps)){if(!Rp(n))return{depthCapped:r};if(a===""){n.unread+=1;continue}let d=lt(l);if(d===null){n.unread+=1;continue}let c=i.pathSafe&&ii(a),f=c?`${i.prefix}node_modules/${a}`:"",p=c&&f.length<=li,u=p?f:"",m=d.version,g=d.dev===!0||i.dev;if(d.link!==!0&&typeof m=="string"&&m!=="")for(let b of Ip(a,m))Op(n,b.name,b.version,u,g);else n.unread+=1;let y=lt(d.dependencies);if(y!==null){if(i.depth+1>t){r=!0;continue}s.push({deps:y,prefix:p?`${u}/`:i.prefix,depth:i.depth+1,pathSafe:p,dev:g})}}}return{depthCapped:r}}function vw(e,n,t){let s=Np(n.maxEntries),{depthCapped:r}=Pp(e,s,t),o=[],i=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),a=new Set,l=[];for(let d of s.deps){if(d.version.includes(":"))continue;let c=JSON.stringify([d.name,d.version]);i.has(c)||a.has(c)||(a.add(c),l.length<Sw&&l.push(zr(d.name,d.version)))}if(a.size>0){let d=a.size-l.length;o.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${l.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(s.capped||r)&&o.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),o}function di(e,n={}){let t=[],s;try{s=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=lt(s);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let o=r.lockfileVersion,i=typeof o=="number"&&Number.isInteger(o)?o:null,a=typeof o=="number"?String(o):"?",l=lt(r.packages),d=lt(r.dependencies);if(l===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(i===null||!xw.includes(i))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let c=n.maxDepth??Ap,f=Np(n.maxEntries??ai),p=!1;return l!==null?(ww(l,f),d!==null&&t.push(...vw(d,f,c))):d!==null&&(p=Pp(d,f,c).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),p&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(c)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||p}}var Ew=["workspace:","link:","portal:","file:","exec:"];function Aw(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Rl(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let s=n.slice(0,t),r=n.slice(t+1);if(s.length===0)return[];for(let a of Ew)if(r.startsWith(a))return[];if(!r.startsWith("npm:"))return[s];let o=r.slice(4),i=o.indexOf("@",1);if(i>0){let a=o.slice(0,i);return a.length>0?[a]:[s]}return o.length===0||Aw(o)?[s]:[s,o]}function Iw(e){if(Yn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let s=e.charCodeAt(t);if(s===34||s===39){n===0?n=s:n===s&&(n=0);continue}if(n===0&&s===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Nw(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let s of n.split(",")){let r=s.trim();r.length>0&&t.push(r)}return t}function Rw(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let s=t.length;for(;s<n.length&&s<t.length+3;){let o=n.charCodeAt(s);if(o<48||o>57)break;s+=1}let r=n.slice(t.length,s);return r.length>0?r:null}function Cp(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Le(e.slice(8).trim());return t.length>0?t:null}function Ol(e,n={}){let t=[],s=[],r=new Set,o=n.maxEntries??2e5,i=!1,a=null,l=!1,d=[],c=!1,f=-1,p=!1,u=0,m=()=>{d.length>0&&!c&&(u+=1)},g=at(e,n,(S,k)=>{if(S===0){m(),d=[],c=!1,f=-1,l=!1;let I=Iw(k);if(I===null)return;let O=Le(I.trim());if(O==="__metadata"){i=!0,l=Yn(k);return}for(let E of Nw(O))d.push(...Rl(E));return}if(l){if(S===2&&a===null){let I=Cp(k);I!==null&&(a=I)}return}if(d.length===0||(f===-1&&(f=S),S!==f||c))return;let v=Cp(k);if(v!==null){c=!0;for(let I of d){let O=JSON.stringify([I,v]);if(!r.has(O)){if(s.length>=o){p=!0;return}r.add(O),s.push({name:I,version:v,lockKey:Kr(I),dev:!1})}}}});m();let y=i?"yarn.lock (Berry)":"yarn.lock (v1)";if(g.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};g.oversizeLines>0&&t.push(`${y} has ${String(g.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),p&&t.push(`${y} exceeds ${String(o)} entries; truncated`);let b=a??Rw(e),_=b===null?null:Number(b.split(".")[0]);return b!==null&&(_===null||!Number.isInteger(_)||_<1||_>8)&&t.push(`${y} declares unsupported lockfileVersion ${b} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),u>0&&t.push(`${y} has ${String(u)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:s,diagnostics:t,truncated:g.truncated||p}}function Pl(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.indexOf("_");return s!==-1&&(n=n.slice(0,s)),n.trim()}function Cl(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function ui(e){let n=Le(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let s=n.charCodeAt(0)===47;if(s&&(n=n.slice(1)),n.length===0)return null;if(!s&&n.charCodeAt(0)!==64){let c=n.indexOf("/"),f=n.indexOf("@",1);c>0&&(f===-1||c<f)&&n.slice(0,c).includes(".")&&n.indexOf("/",c+1)!==-1&&(n=n.slice(c+1))}let r=n.charCodeAt(0)===64,o=r?n.indexOf("/"):-1;if(r&&o<=0)return null;let i=r?o+1:0,a=-1;for(let c=i;c<n.length;c+=1){let f=n.charCodeAt(c);if(f===47||f===64){a=c;break}}if(a<=i)return null;let l=n.slice(0,a),d=Pl(n.slice(a+1));return Cl(d)?{name:l,version:d}:null}var Ow=new Set(["packages","snapshots","importers"]),Pw=new Set([5,6,7,8,9]);function Cw(e){let n=Le(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function ci(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Le(e.slice(0,n).trim()),value:Le(t)}}function Ml(e,n={}){let t=[],s=[],r=new Set,o=n.maxEntries??2e5,i="",a=null,l=!1,d=0,c=[],f=(u,m)=>{let g=JSON.stringify([u,m]);if(!r.has(g)){if(s.length>=o){l=!0;return}r.add(g),s.push({name:u,version:m,lockKey:Kr(u),dev:!1})}},p=at(e,n,(u,m)=>{if(u===0){let g=wt(m);if(i=g===null?"":Le(g.trim()),a=null,i==="lockfileVersion"){let y=ci(m),b=y===null?null:Cw(y.value);y!==null&&(b===null||!Pw.has(b))&&c.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),i="";return}if(Ow.has(i)&&!Yn(m)){let y=ci(m)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(d+=1),i=""}return}if(i==="packages"||i==="snapshots"){if(u!==2)return;let g=wt(m),y=g===null?null:ui(g);if(y===null){d+=1;return}f(y.name,y.version);return}if(i==="importers"){if(u===6){let g=ci(m);if(g===null){a=m.endsWith(":")?Le(m.slice(0,-1).trim()):null;return}a=null;let y=Pl(g.value);Cl(y)&&f(g.key,y);return}if(u===8&&a!==null){let g=ci(m);if(g===null||g.key!=="version")return;let y=Pl(g.value);Cl(y)&&f(a,y)}}});return p.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...c),p.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(p.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),l&&t.push(`pnpm-lock.yaml exceeds ${String(o)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:s,diagnostics:t,truncated:p.truncated||l})}function vt(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var $p=1e6,Mp=2e5,Mw=4096,Tw=65536,$w=262144,Wr=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Lp(e){let n=[];for(let t of e.split(/\r?\n/u)){if(t==="")break;let s=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(t);s!==null&&n.push([(s[1]??"").toLowerCase(),s[2]??""])}return n}function Dp(e){if(e.length>$p)return null;let n,t;for(let[s,r]of Lp(e))s==="name"&&n===void 0?n=r.trim():s==="version"&&t===void 0&&(t=r.trim());return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}var Lw=/^([A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?)/u;function Fp(e){if(e.length>$p)return[];let n=new Set;for(let[t,s]of Lp(e)){if(t!=="requires-dist")continue;let r=Lw.exec(s.trim())?.[1];r!==void 0&&n.add(vt(r))}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function jp(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&Wr.test(n))}function Bp(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let s=e[t];if(s==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=s}return n}function Gp(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Kp(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function zp(e){let n=e.split(/\r?\n/u);return n.length>Mp?n.slice(0,Mp):n}function Wp(e){let n=new Set;for(let t of zp(e)){if(t==="")continue;let s=Bp(t).split("/"),r=s[0]??"";if(Gp(r))continue;if(s.length>1){Wr.test(r)&&n.add(r);continue}let o=Kp(r);o!==null&&Wr.test(o)&&n.add(o)}return[...n].sort((t,s)=>t<s?-1:t>s?1:0)}function Dw(e){let n=e.split("/"),t=n[0]??"";if(Gp(t))return null;let s=n[n.length-1]??"",r=Kp(s);if(r===null)return null;let o=n.slice(0,-1);if(o.some(a=>!Wr.test(a)||a==="__pycache__"))return null;let i=r==="__init__"?o:[...o,r];return i.length===0||!Wr.test(r==="__init__"?o[o.length-1]??"":r)?null:i}function Up(e,n=Mw){let t=new Set,s=0,r=0,o=!1;for(let i of zp(e)){if(i==="")continue;let a=Bp(i),l=Dw(a);if(l!==null){s+=1,(a.endsWith(".so")||a.endsWith(".pyd"))&&(r+=1);for(let d=1;d<=Math.min(2,l.length);d+=1){let c=l.slice(0,d).join(".");if(!t.has(c)){if(t.size>=n){o=!0;break}t.add(c)}}}}return{prefixes:[...t].sort((i,a)=>i<a?-1:i>a?1:0),moduleFiles:s,extensionModules:r,capped:o}}function Fw(e){if(e.length>$w)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let s=t.trim();if(!(s===""||s.startsWith("#")||s.startsWith(";"))){if(s.startsWith("[")){let r=s.slice(1,s.endsWith("]")?-1:void 0).trim();n=r==="console_scripts"||r==="gui_scripts";continue}if(n&&s.includes("="))return!0}}return!1}function Hp(e){if(e.length>Tw)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,s=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:s?.editable===!0}}function Ur(e,n){let t=Dp(e);if(t===null)return null;let s=n.topLevelText!==void 0?jp(n.topLevelText):[],r=s.length>0?s:n.recordText!==void 0?Wp(n.recordText):[],o=n.recordText!==void 0?Up(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},i=n.entryPointsText!==void 0?Fw(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",a=n.directUrlText!==void 0?Hp(n.directUrlText)?.editable??!1:!1;return{name:vt(t.name),version:t.version,importNames:r,modulePrefixes:o.prefixes,moduleFiles:o.moduleFiles,editable:a,consoleScripts:i,extensionModules:o.extensionModules,recordKnown:n.recordText!==void 0,requiresDist:Fp(e)}}function Tp(e,n,t){let s=e.get(n);s===void 0?e.set(n,[t]):s.includes(t)||s.push(t)}function fi(e){let n=new Map,t=new Map,s=[];for(let r of e){if(r.importNames.length===0){s.push(r);continue}for(let o of r.importNames)Tp(n,o,r);for(let o of r.modulePrefixes)Tp(t,o,r)}return{byImportName:n,byModulePrefix:t,unmapped:s}}function Hr(e,n){let t=n.split(".").filter(r=>r.length>0),s=t[0];if(s===void 0)return[];for(let r=Math.min(2,t.length);r>=1;r-=1){let o=e.byModulePrefix.get(t.slice(0,r).join("."));if(o!==void 0&&o.length>0)return o}return e.byImportName.get(s)??[]}var qr=class{nodes=new Map;children=new Map;importers=new Map;over=!1;node(n,t,s){if(!this.nodes.has(n)){if(this.nodes.size>=2e5){this.over=!0;return}this.nodes.set(n,{name:t,version:s})}}edge(n,t){let s=this.children.get(n);s===void 0?this.children.set(n,[t]):s.includes(t)||s.push(t)}done(){return this.over||this.importers.size===0?null:{nodes:this.nodes,children:this.children,importers:this.importers}}},as="importer:",As="node_modules/";function $l(e){let n;try{n=JSON.parse(e)}catch{return null}let t=lt(lt(n)?.packages);if(t===null)return null;let s=new qr,r=new Map;for(let[d,c]of Object.entries(t)){let f=lt(c);f!==null&&r.set(d,f)}let o=d=>d.startsWith(As)||d.includes(`/${As}`),i=d=>{let c=d;for(let f=0;f<8;f+=1){let p=r.get(c);if(p===void 0)return null;if(p.link!==!0)return c;let u=p.resolved;if(typeof u!="string")return null;c=u}return null},a=d=>o(d)?d:`${as}${d}`,l=(d,c)=>{let f=d;for(;;){let p=f===""?`${As}${c}`:`${f}/${As}${c}`;if(r.has(p))return i(p);if(f==="")return null;let u=f.lastIndexOf(`/${As}`);f=u===-1?"":f.slice(0,u)}};for(let[d,c]of r){if(c.link===!0)continue;let f=o(d);if(f){let u=typeof c.name=="string"&&c.name!==""?c.name:d.slice(d.lastIndexOf(As)+As.length),m=c.version;if(typeof m!="string")continue;s.node(d,u,m)}else s.importers.set(`${as}${d}`,d===""?"package.json":`${d}/package.json`);let p=f?["dependencies","optionalDependencies","peerDependencies"]:["dependencies","devDependencies","optionalDependencies","peerDependencies"];for(let u of p){let m=lt(c[u]);if(m!==null)for(let g of Object.keys(m)){let y=l(d,g);y!==null&&y!==d&&s.edge(a(d),a(y))}}}return s.done()}function pi(e){let n=wt(e);if(n===null)return null;let t=e.slice(n.length+1).trim();return t.length===0?null:{key:Le(n.trim()),value:Le(t)}}var Tl=new Set(["dependencies","optionalDependencies","devDependencies"]);function Ll(e,n={}){let t=new qr,s=[],r="",o=!1,i=null,a="",l=null,d=p=>p==="."||p===""?"package.json":`${p}/package.json`,c=(p,u,m,g)=>{if(m===u){let y=pi(g);l=y===null&&Yn(g)?Le(g.slice(0,-1).trim()):null,y!==null&&s.push({from:p,name:y.key,token:y.value});return}if(m===u+2&&l!==null){let y=pi(g);y?.key==="version"&&s.push({from:p,name:l,token:y.value})}},f=at(e,n,(p,u)=>{if(p===0){let m=wt(u);r=m===null?"":Le(m.trim()),r==="lockfileVersion"&&(o=(pi(u)?.value??"").startsWith("5")),i=null,Tl.has(r)&&Yn(u)&&(i=`${as}.`,t.importers.set(i,"package.json"),a=r,l=null);return}if(Tl.has(r)){i!==null&&c(i,2,p,u);return}if(r==="importers"){if(p===2){let m=wt(u),g=m===null?".":Le(m.trim());i=`${as}${g}`,t.importers.set(i,d(g)),a="";return}if(i===null)return;if(p===4){a=Yn(u)?Le(u.slice(0,-1).trim()):"",l=null;return}Tl.has(a)&&c(i,6,p,u);return}if(!(r!=="packages"&&r!=="snapshots")){if(p===2){let m=wt(u);if(m===null){i=null;return}let g=Le(m.trim()),y=g.startsWith("/")?g.slice(1):g,b=ui(g);i=b===null?null:y,b!==null&&t.node(y,b.name,b.version),a="";return}if(i!==null){if(p===4){a=Yn(u)?Le(u.slice(0,-1).trim()):"";return}if(p===6&&(a==="dependencies"||a==="optionalDependencies")){let m=pi(u);m!==null&&s.push({from:i,name:m.key,token:m.value})}}}});if(f.refusedAnchors||f.truncated)return null;for(let p of s){if(p.token.startsWith("link:"))continue;let m=(p.token.startsWith("/")?p.token.slice(1):null)??(o?`${p.name}/${p.token}`:`${p.name}@${p.token}`);t.nodes.has(m)&&t.edge(p.from,m)}return t.done()}function jw(e,n){let t=e.indexOf("@npm:",1);return t<=0?null:e.slice(t+5)===n?e.slice(0,t):null}function Dl(e,n,t={}){let s=new qr,r=new Map,o=[],i=null,a=-1,l=!1,d=-1,c=[],f=null,p=null,u=0,m=at(e,t,(g,y)=>{if(g===0){l=!1,a=-1,f=null,p=null;let k=Yn(y)?y.slice(0,-1):null;if(i=null,c=[],k===null)return;let v=Le(k.trim());if(v==="__metadata"||(c=v.split(",").map(O=>Le(O.trim())).filter(O=>O.length>0),c.length===0))return;u+=1,i=`y${String(u)}`;for(let O of c)r.set(O,i);let I=c.find(O=>O.includes("@workspace:"));if(I!==void 0){let O=I.slice(I.indexOf("@workspace:")+11),E=`${as}${O}`;s.importers.set(E,O==="."||O===""?"package.json":`${O}/package.json`),i=E;for(let N of c)r.set(N,E)}return}if(i===null)return;if(a===-1&&(a=g),g===a){if(l=!1,y==="dependencies:"||y==="optionalDependencies:"){l=!0,d=-1;return}if(y.startsWith("version ")||y.startsWith("version:"))f=Le(y.slice(8).trim());else if(y.startsWith("resolution:"))p=Le(y.slice(11).trim());else return;let k=c[0];if(f!==null&&k!==void 0&&!i.startsWith(as)){let v=Rl(k);if(v.length===1&&v[0]!==void 0)s.node(i,v[0],f);else if(p!==null){let I=jw(p,f);I!==null&&s.node(i,I,f)}}return}if(!l||g<=a||(d===-1&&(d=g),g!==d))return;let b=wt(y),_,S;if(b!==null&&y.charCodeAt(b.length)===58)_=Le(b.trim()),S=Le(y.slice(b.length+1).trim());else{let k=y.indexOf(" ");if(k<=0)return;_=Le(y.slice(0,k)),S=Le(y.slice(k+1).trim())}_.length>0&&S.length>0&&o.push({from:i,descriptor:`${_}@${S}`})});if(m.refusedAnchors||m.truncated)return null;if(s.importers.size===0){s.importers.set(`${as}.`,"package.json");for(let[g,y]of n)o.push({from:`${as}.`,descriptor:`${g}@${y}`})}for(let g of o){let y=g.descriptor.indexOf("@",1),b=g.descriptor.slice(y+1),_=b.includes(":")?g.descriptor:`${g.descriptor.slice(0,y)}@npm:${b}`,S=r.get(g.descriptor)??r.get(_);S!==void 0&&S!==g.from&&s.edge(g.from,S)}return s.done()}function Fl(e,n,t,s){let r=new Map;for(let[k,v]of e.children)for(let I of v){let O=r.get(I);O===void 0?r.set(I,[k]):O.push(k)}let o=new Set,i=[...e.importers.keys()];for(let k=0;k<i.length;k+=1)for(let v of e.children.get(i[k])??[])o.has(v)||e.importers.has(v)||(o.add(v),i.push(v));let a=[...e.nodes].filter(([k,v])=>v.name===n&&v.version===t&&o.has(k)).map(([k])=>k).sort();if(a.length===0)return null;let l=new Map(a.map(k=>[k,0])),d=[...a];for(let k=0;k<d.length;k+=1){let v=d[k];for(let I of r.get(v)??[])l.has(I)||!o.has(I)||(l.set(I,(l.get(v)??0)+1),d.push(I))}let c=[...l.keys()].sort((k,v)=>(l.get(k)??0)-(l.get(v)??0)||(k<v?-1:k>v?1:0)),f=c.filter(k=>e.nodes.has(k)),p=c.length-f.length,u=new Map(f.map((k,v)=>[k,v])),m=[];for(let k of f)for(let v of e.children.get(k)??[])u.has(v)&&m.push([k,v]);let g=new Array(f.length).fill(0);for(let[k,v]of m){let I=Math.max(u.get(k)??0,u.get(v)??0);g[I]=(g[I]??0)+1}let y=0,b=0;for(;y<f.length&&y<s.maxNodes;){let k=g[y]??0;if(b+k>s.maxEdges)break;b+=k,y+=1}let _=new Map(f.slice(0,y).map((k,v)=>[k,`p${String(v)}`])),S=k=>{let I=(r.get(k)??[]).filter(O=>e.importers.has(O)).sort()[0];return I===void 0?null:e.importers.get(I)??null};return{nodes:f.slice(0,y).map(k=>{let v=e.nodes.get(k);return{id:_.get(k),name:v.name,version:v.version,directFrom:S(k)}}),edges:m.flatMap(([k,v])=>{let I=_.get(k),O=_.get(v);return I===void 0||O===void 0?[]:[{from:I,to:O}]}),truncated:f.length-y+p}}function jl(e){let n=new Map,t=new Set(["dependencies","devDependencies","optionalDependencies","peerDependencies"]),s=[],r=1,o=!1,i=e.charCodeAt(0)===65279?1:0;for(;i<e.length;){let a=e.charCodeAt(i);if(a===10)r+=1;else if(a===123||a===91){if(s.length>=64)return null;s.push({kind:a===123?"{":"[",key:null}),o=a===123}else if(a===125||a===93)s.pop(),o=!1;else if(a===44)o=s.at(-1)?.kind==="{";else if(a===58)o=!1;else if(a===34){let l=r,d=i+1;for(;d<e.length&&e.charCodeAt(d)!==34;){if(e.charCodeAt(d)===92)d+=1;else if(e.charCodeAt(d)===10)return null;d+=1}if(d>=e.length)return null;let c=s.at(-1);if(o&&c?.kind==="{"){let f;try{f=JSON.parse(e.slice(i,d+1))}catch{return null}c.key=f;let p=s.length===2?s[0]?.key:null;p!=null&&t.has(p)&&!n.has(f)&&n.set(f,l)}o=!1,i=d}i+=1}return s.length===0?n:null}var Bl="importer:";function mi(e){let n=e.indexOf(" = ");if(n<=0)return null;let t=e.slice(n+3).trim();if(t.length<2||!t.startsWith('"')||!t.endsWith('"'))return null;let s=t.slice(1,-1);return s.includes('"')?null:{key:e.slice(0,n).trim(),value:s}}function Bw(e){let n=[],t=0;for(;;){let s=e.indexOf('"',t);if(s===-1)return n;let r=e.indexOf('"',s+1);if(r===-1)return n;n.push(e.slice(s+1,r)),t=r+1}}function Gw(e){let n=[],t=0;for(;;){let s=e.indexOf("{",t);if(s===-1)return n;let r=e.indexOf("}",s);if(r===-1)return n;let o=e.slice(s+1,r),i=[],a=o.indexOf("extra = [");if(a!==-1){let c=o.indexOf("]",a);c!==-1&&(i=Bw(o.slice(a,c)),o=o.slice(0,a)+o.slice(c+1))}let l=null,d=null;for(let c of o.split(",")){let f=mi(c.trim());f?.key==="name"?l=f.value:f?.key==="version"&&(d=f.value)}l!==null&&n.push({name:l,version:d,extras:i}),t=r+1}}function qp(e,n,t,s,r=new Map){if(s||n.size===0)return null;let o=new Map;for(let[d,c]of e){let f=o.get(c.name);f===void 0?o.set(c.name,[d]):f.push(d)}let i=new Map,a=[...t],l=new Set;for(let d=0;d<a.length;d+=1){let c=a[d],f=vt(c.name),p=o.get(f)??[],u=c.version!==null?`${f}@${c.version}`:p.length===1?p[0]??null:null;if(u===null||!e.has(u)||u===c.from)continue;let m=i.get(c.from);m===void 0?i.set(c.from,[u]):m.includes(u)||m.push(u);for(let g of c.extras){let y=JSON.stringify([u,g]);if(!l.has(y)){l.add(y);for(let b of r.get(u)?.get(g)??[])a.push({from:u,...b})}}}return{nodes:e,children:i,importers:n}}function Kl(e,n={}){let t=new Map,s=new Map,r=[],o=!1,i=null,a=null,l=null,d=[],c=new Map,f=new Map,p="",u=!1,m="",g=null,y=S=>{let k=Gw(S);g===null?d.push(...k):c.set(g,[...c.get(g)??[],...k])},b=()=>{if(i===null)return;let S=vt(i),k=null;if(l!==null?(k=`${Bl}${l}`,s.set(k,l==="."?"pyproject.toml":`${l}/pyproject.toml`)):a!==null&&(k=`${S}@${a}`,t.size>=2e5?o=!0:t.set(k,{name:S,version:a})),k!==null){for(let v of d)r.push({from:k,...v});c.size>0&&f.set(k,c)}i=null,a=null,l=null,d=[],c=new Map},_=at(e,n,(S,k)=>{if(u){m+=k,k.startsWith("]")&&(y(m),u=!1);return}if(k==="[[package]]"){b(),p="package";return}if(k.startsWith("[")){p=k==="[package.dev-dependencies]"?"dev":k==="[package.optional-dependencies]"?"optional":"other";return}if(p==="other")return;let v=k.indexOf(" = ");if(v<=0)return;let I=k.slice(0,v).trim(),O=k.slice(v+3).trim();if((p==="optional"||(p==="dev"?l!==null:I==="dependencies"))&&O.startsWith("[")){g=p==="optional"?I.replaceAll('"',""):null,O.endsWith("]")?y(O):(u=!0,m=O);return}if(p!=="package")return;if(I==="source"){let A=O.startsWith("{")&&O.endsWith("}")?O.slice(1,-1):"";for(let U of A.split(",")){let $=mi(U.trim());($?.key==="editable"||$?.key==="virtual")&&(l=$.value)}return}let N=mi(k);N?.key==="name"?i=N.value:N?.key==="version"&&(a=N.value)});return b(),_.refusedAnchors||_.truncated?null:qp(t,s,r,o,f)}function zl(e,n,t={}){let s=new Map,r=new Map([[`${Bl}.`,"pyproject.toml"]]),o=n.map(u=>({from:`${Bl}.`,name:u,version:null,extras:[]})),i=!1,a=null,l=null,d=[],c="",f=()=>{if(a!==null&&l!==null){let u=vt(a),m=`${u}@${l}`;s.size>=2e5?i=!0:s.set(m,{name:u,version:l});for(let g of d)o.push({from:m,name:g,version:null,extras:[]})}a=null,l=null,d=[]},p=at(e,t,(u,m)=>{if(m==="[[package]]"){f(),c="package";return}if(m.startsWith("[")){c=m==="[package.dependencies]"?"deps":"other";return}if(c==="package"){let b=mi(m);b?.key==="name"?a=b.value:b?.key==="version"&&(l=b.value);return}if(c!=="deps")return;let g=m.indexOf(" = ");g<=0||m.slice(g+3).includes("optional = true")||d.push(m.slice(0,g).trim().replaceAll('"',""))});return f(),p.refusedAnchors||p.truncated?null:qp(s,r,o,i)}function Gl(e){let n=0;for(;n<e.length;){let t=e.charCodeAt(n);if(!(t>=97&&t<=122||t>=65&&t<=90||t>=48&&t<=57||t===45||t===46||t===95))break;n+=1}return n===0?null:vt(e.slice(0,n))}function Kw(e){return e==="tool.poetry.dependencies"||e==="tool.poetry.dev-dependencies"||e.startsWith("tool.poetry.group.")&&e.endsWith(".dependencies")}function gi(e){let n=new Map,t="",s=!1,r=0,o=d=>{d!==null&&d!=="python"&&!n.has(d)&&n.set(d,r)},i=d=>{let c=0;for(;;){let f=d.indexOf('"',c);if(f===-1)return;let p=d.indexOf('"',f+1);if(p===-1)return;o(Gl(d.slice(f+1,p))),c=p+1}},a=(d,c)=>d==="project"&&c==="dependencies"||d==="project.optional-dependencies"||d==="dependency-groups"||d==="tool.uv"&&c==="dev-dependencies",l=e.charCodeAt(0)===65279?1:0;for(;l<=e.length&&r<2e5;){let d=e.indexOf(`
+`,l);d===-1&&(d=e.length),r+=1;let c=e.slice(l,d);l=d+1;let f=c.indexOf("#"),p=(f===-1?c:c.slice(0,f)).trim();if(p.length>4096)continue;if(s){i(p),p.includes("]")&&(s=!1);continue}if(p.startsWith("[")&&!p.startsWith("[[")){t=p.slice(1,p.indexOf("]")===-1?p.length:p.indexOf("]")).trim();continue}let u=p.indexOf("=");if(u<=0)continue;let m=p.slice(0,u).trim().replaceAll('"',""),g=p.slice(u+1).trim();if(Kw(t)){o(Gl(m));continue}if(a(t,m)&&g.startsWith("[")&&(i(g),s=!g.includes("]")),d===e.length)break}return n}function Wl(e){let n=new Map,t=0,s=0;for(;s<=e.length&&t<2e5;){let r=e.indexOf(`
+`,s);r===-1&&(r=e.length),t+=1;let o=e.slice(s,r);s=r+1;let i=o.trim();if(i.length>0&&i.length<=4096&&!i.startsWith("#")&&!i.startsWith("-")){let a=Gl(i);a!==null&&!n.has(a)&&n.set(a,t)}if(r===e.length)break}return n}import{statSync as mv}from"node:fs";import gv from"node:path";import{lstatSync as Uw,readFileSync as Hw,readdirSync as qw,realpathSync as Ul,statSync as Yr}from"node:fs";import Be from"node:path";function zw(e,n){let t=e.charAt(n),s="",r=n+1;for(;r<e.length;){let o=e.charAt(r);if(o===t)return{value:s,end:r+1};if(t==='"'&&o==="\\"){let i=e.charAt(r+1);if(i!=="\\"&&i!=='"')return null;s+=i,r+=2;continue}s+=o,r+=1}return null}function Ww(e){let n=[],t=0;for(;t<e.length;){let s=e.charAt(t);if(s===" "||s==="	"||s==="\r"||s==="\f"||s==="\v"){t+=1;continue}if(s==="/"&&e.charAt(t+1)==="/")break;if(s==="("||s===")"){n.push({kind:s}),t+=1;continue}if(s==='"'||s==="`"){let i=zw(e,t);if(i===null||i.value.length>4096)return null;n.push({kind:"quoted",text:i.value}),t=i.end;continue}let r=t;for(;r<e.length;){let i=e.charAt(r);if(i===" "||i==="	"||i==="\r"||i==="("||i===")"||i==='"'||i==="`"||i==="/"&&e.charAt(r+1)==="/")break;r+=1}let o=e.slice(t,r);if(o.length>4096)return null;n.push({kind:"word",text:o}),t=r}return n}function Vp(e){return e.kind==="word"||e.kind==="quoted"?e.text:null}function Zs(e){let n=[],t=null;for(let s of e.split(`
+`)){if(n.length>=1e5)break;let r=Ww(s);if(r===null||r.length===0)continue;if(t!==null){if(r[0]?.kind===")"){t=null;continue}let l=r.map(Vp);if(l.some(d=>d===null)||l.length>16)continue;n.push({verb:t,args:l});continue}let o=r[0];if(o?.kind!=="word")continue;let i=o.text;if(r.length===2&&r[1]?.kind==="("){t=i;continue}let a=r.slice(1).map(Vp);a.some(l=>l===null)||a.length>16||n.push({verb:i,args:a})}return n}function Vr(e,n){for(let t of e)if(t.verb===n&&t.args.length>0)return t.args[0]??null;return null}function Xr(e){let n=[],t=[];for(let s of e){if(s.verb!=="use")continue;let r=s.args[0];if(r===void 0||r.length===0||r.includes("\0"))continue;let o=r.replace(/\\/gu,"/");if(o.startsWith("/")||/^[A-Za-z]:\//u.test(o)){t.push(r);continue}let i=[],a=!1;for(let l of o.split("/"))if(!(l===""||l===".")){if(l===".."){if(i.length===0){a=!0;break}i.pop();continue}i.push(l)}a?t.push(r):n.push(i.join("/"))}return{inside:n,outside:t}}function Jr(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}function Qr(e){return e.ecosystem==="Go"||e.alsoGo===!0}var Qp=2e4,Zp=32,em=256,Vw=2*1024*1024,Xw=256*1024,nm=256,Yw=16,Jw=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],Qw=["pyproject.toml","setup.py","setup.cfg"],Zw=["requirements.txt","Pipfile"],ev=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],tm=["go.sum","vendor/modules.txt"],nv=256*1024;function tv(e){return e===""?!1:e.split("/").some(n=>n==="vendor"||n==="testdata"||n.startsWith("_"))}var Xp={candidate:"absent",witnesses:[],admitted:!1};function sv(e){let n=Hl(Be.join(e,"go.work"),nv);return n===null?new Set:new Set(Xr(Zs(n)).inside)}var sm={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function Hl(e,n){try{let t=Yr(e);return!t.isFile()||t.size>n?null:Hw(e,"utf8")}catch{return null}}function dt(e){let n;try{n=Yr(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function rv(e){try{return Yr(e).isDirectory()}catch{return!1}}function ov(e,n){let t=0,s=0,r=-1,o=0;for(;s<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(s)))t+=1,s+=1;else if(t<e.length&&e.charAt(t)==="*")r=t,o=s,t+=1;else if(r>=0)t=r+1,o+=1,s=o;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function iv(e,n){let t=(s,r)=>{if(s===e.length)return r===n.length;let o=e[s]??"";if(o==="**"){for(let a=r;a<=n.length;a+=1)if(t(s+1,a))return!0;return!1}if(r>=n.length)return!1;let i=n[r]??"";return(o.includes("*")||o.includes("?")?ov(o,i):o===i)?t(s+1,r+1):!1};return t(0,0)}function av(e){let n=[],t=Hl(Be.join(e,"package.json"),Vw);if(t!==null)try{let i=JSON.parse(t)?.workspaces;if(Array.isArray(i))for(let a of i)typeof a=="string"&&n.push(a);else if(typeof i=="object"&&i!==null){let a=i.packages;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l)}}catch{}let s=Hl(Be.join(e,"pnpm-workspace.yaml"),Xw);s!==null&&n.push(...lv(s));let r=[];for(let o of n){if(r.length>=nm)break;let i=o.trim();if(i.length===0)continue;for(;i.startsWith("./");)i=i.slice(2);if(i.startsWith("/")||Be.isAbsolute(i))continue;let a=i.split("/").filter(l=>l.length>0);a.length===0||a.length>Yw||a.includes("..")||r.push(a.join("/"))}return r}function lv(e){let n=[],t=!1;for(let s of e.split(`
+`)){if(n.length>=nm)break;if(/^packages:\s*(#.*)?$/.test(s)){t=!0;continue}if(!t)continue;let r=/^\s+-\s*(.*?)\s*$/.exec(s);if(r===null){s.trim().length>0&&(t=!1);continue}let o=(r[1]??"").trim(),i=o.indexOf(" #");i>=0&&(o=o.slice(0,i).trim()),(o.startsWith('"')&&o.endsWith('"')&&o.length>=2||o.startsWith("'")&&o.endsWith("'")&&o.length>=2)&&(o=o.slice(1,-1)),o.length>0&&n.push(o)}return n}function Yp(e,n){let t=Be.relative(n,e);return t.length===0?!1:t.split(Be.sep).includes("node_modules")}function Jp(e,n){return Be.relative(e,n).split(Be.sep).join("/")}function Zr(e,n){let t=n?.maxDirs??Qp,s=n?.maxDepth??Zp,r=n?.maxRoots??em,o=n?.discoverPythonRoots??!0,i=n?.discoverGoRoots??!1,a;try{a=Ul(e)}catch{return{...sm,observations:[{kind:"refused-unreadable",rel:""}]}}let l=[],d=[],c=new Set([a]),f=0,p=0,u=0,m="complete",g=av(a).map(N=>N.split("/")),y=i?sv(a):new Set,b=new Set,_=new Set,S=N=>{let A="absent";for(let $ of Qw){let W=dt(Be.join(N,$));if(W==="regular"){A="declared";break}W==="refused"&&(A="refused")}if(A==="absent"&&Zw.some($=>dt(Be.join(N,$))==="regular")&&(A="listed"),A==="absent")return{candidate:A,witnesses:[]};let U=[];return ev.some($=>dt(Be.join(N,$))==="regular")&&U.push("own-lockfile"),rv(Be.join(N,".venv"))&&U.push("installed-env"),{candidate:A,witnesses:U}},k=(N,A)=>{if(!i||tv(A))return Xp;let U=dt(Be.join(N,"go.mod"));if(U==="absent")return Xp;let $=U==="regular"?"declared":"refused",W=[];tm.some(P=>dt(Be.join(N,P))==="regular")&&W.push("own-lockfile"),y.has(A)&&W.push("workspace-declared");let w=A===""||$==="refused"||W.length>0;return{candidate:$,witnesses:W,admitted:w}},v=(N,A,U)=>U.admitted?l.length>=r?"exhausted":(l.push({rel:A,abs:N,witnesses:U.witnesses,manifestRefused:U.candidate==="refused",ecosystem:"Go"}),b.add(N),_.add(N),"root"):"not-root",I=(N,A,U)=>{let $=S(N);return $.candidate==="absent"?"not-root":($.candidate!=="listed"&&(p+=1),$.witnesses.length===0&&$.candidate!=="refused"?$.candidate==="declared"?(d.push({kind:"undeclared-manifest",rel:A}),"observed"):"not-root":l.length>=r?"exhausted":(l.push({rel:A,abs:N,witnesses:$.witnesses,manifestRefused:$.candidate==="refused",ecosystem:"PyPI",...U.admitted?{alsoGo:!0}:{}}),U.admitted&&b.add(N),"root"))},O=(N,A)=>{if(A.length===0){let j=dt(Be.join(N,"package.json"))!=="absent",F=o?S(N):{candidate:"absent",witnesses:[]},B=k(N,A);return B.admitted&&b.add(N),!j&&F.candidate!=="absent"?(l.push({rel:"",abs:N,witnesses:["scan-root",...F.witnesses],manifestRefused:!1,ecosystem:"PyPI",...B.admitted?{alsoGo:!0}:{}}),"root"):!j&&B.admitted?(l.push({rel:"",abs:N,witnesses:["scan-root",...B.witnesses],manifestRefused:!1,ecosystem:"Go"}),"root"):(l.push({rel:"",abs:N,witnesses:["scan-root",...F.witnesses],manifestRefused:!1,...F.witnesses.length>0?{alsoPython:!0}:{},...B.admitted?{alsoGo:!0}:{}}),"root")}let U=dt(Be.join(N,"package.json")),$=k(N,A);if($.candidate!=="absent"&&(p+=1),U==="absent"){let j=o?I(N,A,$):"not-root";if(j==="root"||j==="exhausted")return j;let F=v(N,A,$);return F==="not-root"&&$.candidate==="declared"&&j!=="observed"&&d.push({kind:"undeclared-manifest",rel:A}),F}p+=1;let W=[],w=A.split("/");g.some(j=>iv(j,w))&&W.push("workspace-declared"),Jw.some(j=>dt(Be.join(N,j))==="regular")&&W.push("own-lockfile");let P=o?S(N):{candidate:"absent",witnesses:[]};for(let j of P.witnesses)W.includes(j)||W.push(j);return W.length===0&&U!=="refused"?(d.push({kind:"undeclared-manifest",rel:A}),v(N,A,$)):l.length>=r?"exhausted":(l.push({rel:A,abs:N,witnesses:W,manifestRefused:U==="refused",...P.witnesses.length>0?{alsoPython:!0}:{},...$.admitted?{alsoGo:!0}:{}}),$.admitted&&b.add(N),"root")},E=[{abs:a,rel:"",depth:0}];for(;E.length>0;){let N=E.pop();if(N===void 0)break;if(f>=t){m="dirs-exhausted";break}f+=1;let A=O(N.abs,N.rel);if(A==="exhausted"){m="roots-exhausted";break}let U=A==="root";if(N.depth>=s){m=m==="complete"?"depth-clamped":m;continue}let $;try{$=qw(N.abs)}catch{d.push({kind:"refused-unreadable",rel:N.rel});continue}$.sort().reverse();for(let W of $){let w=Be.join(N.abs,W),P=N.rel.length===0?W:`${N.rel}/${W}`,j;try{let ne=Uw(w);j=ne.isDirectory()||ne.isSymbolicLink()&&Yr(w).isDirectory()}catch{continue}if(!j)continue;if(W==="node_modules"){(!U||_.has(N.abs))&&d.push({kind:"unenumerated-install",rel:P});continue}if(W==="vendor"&&b.has(N.abs)&&dt(Be.join(w,"modules.txt"))==="regular")continue;if(W.startsWith(".")){u+=1,d.push({kind:"skipped-dot-directory",rel:P}),dt(Be.join(w,"package.json"))!=="absent"&&d.push({kind:"undeclared-manifest",rel:P});continue}let F;try{F=Ul(w)}catch{d.push({kind:"refused-unreadable",rel:P});continue}let B=a.endsWith(Be.sep)?a:a+Be.sep;if(F!==a&&!F.startsWith(B)){d.push({kind:"refused-out-of-root",rel:P});continue}Yp(F,a)||c.has(F)||(c.add(F),E.push({abs:F,rel:Jp(a,F),depth:N.depth+1}))}}for(let N of n?.operatorRoots??[]){let A=typeof N=="string"?N.slice(0,512):"",U=()=>{d.push({kind:"refused-operator-root",rel:A})};if(A.length===0||A.includes("\0")){U();continue}let $;try{$=Ul(Be.resolve(a,A))}catch{U();continue}let W=a.endsWith(Be.sep)?a:a+Be.sep;if($!==a&&(!$.startsWith(W)||Yp($,a))){U();continue}let w;try{w=Yr($).isDirectory()}catch{w=!1}if(!w||dt(Be.join($,"package.json"))!=="regular"){U();continue}let P=l.findIndex(B=>B.abs===$);if(P>=0){let B=l[P];B!==void 0&&!B.witnesses.includes("operator")&&(l[P]={...B,witnesses:[...B.witnesses,"operator"]});continue}let j=Jp(a,$);l.push({rel:j,abs:$,witnesses:["operator"],manifestRefused:!1});let F=d.findIndex(B=>B.kind==="undeclared-manifest"&&B.rel===j);F>=0&&d.splice(F,1)}return l.sort((N,A)=>N.rel<A.rel?-1:N.rel>A.rel?1:0),d.sort((N,A)=>N.kind!==A.kind?N.kind<A.kind?-1:1:N.rel<A.rel?-1:N.rel>A.rel?1:0),{roots:l,observations:d,budget:m,counts:{dirsWalked:f,manifestsSeen:p,rootsAdmitted:l.length,dotDirectoriesSkipped:u}}}import{lstatSync as rm,readdirSync as dv,readFileSync as cv,realpathSync as am,statSync as lm}from"node:fs";import $n from"node:path";var ct={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},uv=/^python\d+\.\d+$/u;function ls(e,n){let t;try{t=lm(e)}catch(s){return{why:s?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:cv(e,"utf8")}}catch{return{why:"unreadable"}}}function ql(e,n){let t;try{if(t=am(n),!lm(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+$n.sep)?t:null}function om(e,n){return $n.relative(e,n).split($n.sep).join("/")}function im(e){try{return dv(e).sort()}catch{return null}}function fv(e){let n=[],t=[],s=0;for(let r of e.split(/\r?\n/u)){let o=r.trim();if(!(o===""||o.startsWith("#"))){if(/^import[ \t]/u.test(o)){s+=1;let i=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(o);i?.[1]!==void 0&&t.length<ct.maxPthPaths&&t.push(i[1]);continue}n.length<ct.maxPthPaths&&n.push(o)}}return{paths:n,importLines:s,importModules:t}}function pv(e){let n=null;for(let t of e.split(/\r?\n/u)){let s=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(s!==null){if(s[1]==="version_info")return s[2]??null;n??=s[2]??null}}return n}function eo(e,n){let t=n?.envDir??ct.envDir,s=n?.maxDistributions??ct.maxDistributions,r=n?.maxMetadataBytes??ct.maxMetadataBytes,o=n?.maxRecordBytes??ct.maxRecordBytes,i=n?.maxTopLevelBytes??ct.maxTopLevelBytes,a=n?.maxDirectUrlBytes??ct.maxDirectUrlBytes,l=ct.maxEntryPointsBytes,d=t,c=[],f=(N,A,U=null)=>({envRel:d,refused:N,sitePackages:[],interpreter:U,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...c,A],truncated:!1}),p;try{p=am(e)}catch{return f("absent","the root itself could not be resolved")}let u=$n.join(p,t),m;try{m=rm(u)}catch(N){return N?.code==="ENOENT"?f("absent",`${d}: absent`):f("not-a-directory",`${d}: could not be inspected`)}if(!m.isDirectory()&&!m.isSymbolicLink())return f("not-a-directory",`${d}: not a directory`);let g=ql(p,u);if(g===null)return f("escapes-root",`${d}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let y=ls($n.join(g,"pyvenv.cfg"),ct.maxPyvenvCfgBytes),b="text"in y?pv(y.text):null;"text"in y||c.push(`${d}/pyvenv.cfg: ${y.why} \u2014 interpreter version unknown`);let _=[];for(let N of["lib","lib64"]){let A=im($n.join(g,N));if(A!==null)for(let U of A)uv.test(U)&&_.push($n.join(g,N,U,"site-packages"))}_.push($n.join(g,"Lib","site-packages"));let S=[],k=new Set;for(let N of _){let A=ql(g,N);A===null||k.has(A)||(k.add(A),S.push(A))}if(S.length===0)return f("no-site-packages",`${d}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,b);S.length>1&&c.push(`${d}: ${String(S.length)} site-packages directories; all enumerated`);let v=[],I=[],O=0,E=!1;e:for(let N of S){let A=om(p,N),U=im(N);if(U===null){c.push(`${A}: unreadable; nothing enumerated there`);continue}for(let $ of U){let W=$n.join(N,$),w=$.endsWith(".dist-info"),P=$.endsWith(".egg-info");if($.endsWith(".pth")){let T=ls(W,ct.maxPthBytes);if(!("text"in T)){c.push(`${A}/${$}: ${T.why}; the paths it adds were NOT enumerated`);continue}I.push({name:$,sitePackages:A,...fv(T.text)});continue}if(!w&&!P)continue;if(v.length>=s){E=!0,c.push(`${A}: the distribution cap (${String(s)}) was hit at ${$}; the enumeration is INCOMPLETE`);break e}let j;try{j=rm(W)}catch{O+=1,c.push(`${A}/${$}: could not be inspected; not enumerated`);continue}let F=w?"dist-info":"egg-info";if(j.isFile()&&P){let T=ls(W,r);"text"in T?v.push({dir:$,kind:F,metadata:T.text,entryPointsUnknown:!0}):(O+=1,c.push(`${A}/${$}: ${T.why}; not enumerated`));continue}let B=ql(g,W);if(B===null){O+=1,c.push(`${A}/${$}: not a directory inside the environment; not enumerated`);continue}let ne=w?"METADATA":"PKG-INFO",X=ls($n.join(B,ne),r);if(!("text"in X)){O+=1,c.push(`${A}/${$}: ${ne} ${X.why}; not enumerated`);continue}let Q={dir:$,kind:F,metadata:X.text},Z=ls($n.join(B,"entry_points.txt"),l);"text"in Z?Q.entryPoints=Z.text:Z.why!=="absent"&&(Q.entryPointsUnknown=!0,c.push(`${A}/${$}/entry_points.txt: ${Z.why}; the commands it declares are UNKNOWN`));let x=ls($n.join(B,"top_level.txt"),i);if("text"in x?Q.topLevel=x.text:x.why!=="absent"&&c.push(`${A}/${$}/top_level.txt: ${x.why}; ignored`),w){let T=ls($n.join(B,"RECORD"),o);"text"in T?Q.record=T.text:c.push(`${A}/${$}/RECORD: ${T.why}; import names from top_level.txt only`);let q=ls($n.join(B,"direct_url.json"),a);"text"in q&&(Q.directUrl=q.text)}v.push(Q)}}return{envRel:d,refused:null,sitePackages:S.map(N=>om(p,N)),interpreter:b,distInfos:v,pthFiles:I,unreadable:O,diagnostics:c,truncated:E}}var hv=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function yv(e,n){for(let t of n)try{if(mv(gv.join(e,t)).isFile())return t}catch{}return null}function dm(e){let n=[],t=[],s=(f,p)=>{t.push({kind:f,detail:p,blindsAnalysis:!1,rootRel:""}),n.push(p)},r=yv(e,hv),o=eo(e);if(o.refused!==null){let f=o.refused==="absent"?`no \`${o.envRel}\` is installed`:`\`${o.envRel}\` could not be read (${o.refused})`;return s("no-installed-env",`${r??"the Python manifest"} declares a dependency set but ${f}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:r,diagnostics:[...n,...o.diagnostics],truncated:!1,gaps:t}}let i=[],a=new Set,l=[],d=0;for(let f of o.distInfos){let p=Ur(f.metadata,{...f.topLevel!==void 0?{topLevelText:f.topLevel}:{},...f.record!==void 0?{recordText:f.record}:{},...f.directUrl!==void 0?{directUrlText:f.directUrl}:{}});if(p===null){d+=1,n.push(`${f.dir}: METADATA carries no Name/Version; not enumerated`);continue}let u=JSON.stringify([p.name,p.version]);a.has(u)||(a.add(u),p.importNames.length===0&&l.push(p.name),i.push({name:p.name,version:p.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...o.diagnostics);let c=o.unreadable+d;return c>0&&s("installed-env-partial",`${String(c)} entr${c===1?"y":"ies"} under ${o.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(i.length)} enumerated were assessed normally.`),o.truncated&&s("installed-env-partial",`the environment walk under ${o.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),l.length>0&&n.push(`${String(l.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${l.slice(0,5).join(", ")}${l.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:i,source:i.length>0?"installed-env":"none",lockfilePath:r,diagnostics:n,truncated:o.truncated,gaps:t}}var Yl=128*1024*1024,bv=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>di(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>di(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Ol(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Ml(e,n===void 0?{}:{maxEntries:n})}],_v=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Jl(e,n){let t;try{t=Xl(ut.join(e,n))}catch{return null}let s=e.endsWith(ut.sep)?e:e+ut.sep;return t.startsWith(s)?t:null}function um(e,n){let t=ut.join(e,"package.json"),s;try{s=Xl(t)}catch{return null}if(!s.startsWith(n+ut.sep))return null;try{if(!no(s).isFile())return null;let r=JSON.parse(Vl(s,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function fm(e,n){try{return no(ut.join(e,n)),!0}catch{return!1}}function Sv(e,n){if(fm(e,"pnpm-workspace.yaml"))return!0;let t=Jl(e,"package.json");if(t===null)return fm(e,"package.json");let s;try{let i=no(t);if(!i.isFile()||i.size>n)return!0;s=Vl(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(s)}catch{return!0}for(let i of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=r[i];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let o=r.workspaces;return Array.isArray(o)?o.length>0:typeof o=="object"&&o!==null}function pm(e,n){let t=ut.join(e,"node_modules"),s=[],r;try{r=cm(t,{withFileTypes:!0})}catch{return s}for(let o of r){let i=o.name;if(i.startsWith("."))continue;if(i.startsWith("@")){let l;try{l=cm(ut.join(t,i),{withFileTypes:!0})}catch{continue}for(let d of l){let c=um(ut.join(t,i,d.name),n);c!==null&&s.push({dev:!1,name:c.name,version:c.version,lockKey:`node_modules/${i}/${d.name}`,linked:d.isSymbolicLink()||o.isSymbolicLink()})}continue}let a=um(ut.join(t,i),n);a!==null&&s.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${i}`,linked:o.isSymbolicLink()})}return s}var xv=5;function kv(e,n,t){let s=Jl(e,n);if(s===null){try{no(ut.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=no(s)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:Vl(s,"utf8")}}catch{return{gap:`${n} could not be read`}}}function wv(e,n){let t=Xl(e),s=[],r=[],o=n?.maxLockfileBytes??Yl,i=[],a=new Set,l=[],d=Sv(t,o),c=null,f=!1,p=(m,g,y)=>{r.push({kind:m,detail:g,blindsAnalysis:y,rootRel:""}),s.push(g)};for(let m of bv){let g=kv(t,m.file,o);if(g===null)continue;if("gap"in g){p("lockfile-unreadable",g.gap,!1);continue}let y=m.parse(g.text,n?.maxLockfileEntries);if(y.truncated&&(f=!0),y.deps.length===0){if(y.diagnostics.length>0||d){let b=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";p("lockfile-unparsed",`${m.file} yielded NO dependencies (${b}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&p("lockfile-partial",`${m.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),c===null&&(c=m.file),l.includes(m.source)||l.push(m.source);for(let b of y.deps){let _=JSON.stringify([b.name,b.version,b.lockKey]);a.has(_)||(a.add(_),i.push({...b,declaredIn:m.file}))}}for(let m of _v)if(Jl(t,m)!==null){p("yarn-pnp",`${m} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(i.length>0){let m=l.length===1?l[0]??"none":"multi-lockfile";l.length>1&&s.push(`multiple lockfiles present (${l.join(", ")}); enumerated the UNION of all of them`);let g=new Set(i.map(_=>JSON.stringify([_.name,_.version]))),y=new Set,b=[];for(let _ of pm(t,t)){let S=JSON.stringify([_.name,_.version,_.lockKey]);a.has(S)||(a.add(S),i.push({name:_.name,version:_.version,lockKey:_.lockKey,dev:_.dev,declaredIn:""}));let k=JSON.stringify([_.name,_.version]);_.linked||g.has(k)||y.has(k)||(y.add(k),b.length<xv&&b.push(zr(_.name,_.version)))}if(y.size>0){let _=y.size-b.length;p("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${b.join(", ")}${_>0?`, and ${String(_)} more`:""}): ${c??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:i,source:m,lockfilePath:c,diagnostics:s,truncated:f,gaps:r}}let u=pm(t,t);return u.length>0?(p("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(u.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:u.map(m=>({name:m.name,version:m.version,lockKey:m.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:s,truncated:f,gaps:r}):(d&&p("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:s,truncated:f,gaps:r})}function mm(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function vv(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function ym(e){return e===""||e.split("/").every(vv)}function Ev(e,n){if(e===""||n==="")return n;if(!ym(e))return"";let t=`${e}/${n}`;return t.length<=li?t:""}function gm(e,n){return e===""?n:`${e}: ${n}`}function Av(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function bm(e,n,t,s){let r=t?.maxUnionEntries??ai,o=n.roots.filter(g=>mm(g)||s?.has(g.rel)===!0),i=o.some(g=>g.rel==="")?o:[Av(e),...o],a=[],l=[],d=new Set,c=[],f=[],p=!1,u=!1;for(let g of i){let y=g.rel===""?e:g.abs,_=g.rel===""||g.ecosystem!=="Go"&&mm(g)?wv(y,t):Ov,S=Jr(g)?dm(y):null,k=s?.get(g.rel)??null,v=S===null?_:hm(_,S),I=k===null?v:hm(v,k),O=I.diagnostics.map(N=>gm(g.rel,N));!ym(g.rel)&&I.packages.length>0&&O.push(`${g.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(I.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let E={...I,rootRel:g.rel,...g.ecosystem!==void 0?{ecosystem:g.ecosystem}:{},...S!==null?{pythonLockfilePath:S.lockfilePath===null||g.rel===""?S.lockfilePath:`${g.rel}/${S.lockfilePath}`}:{},...k!==null?{goModPath:g.rel===""?"go.mod":`${g.rel}/go.mod`}:{},packages:I.packages.map(N=>({...N,lockKey:Ev(g.rel,N.lockKey),declaredIn:N.declaredIn===""||g.rel===""?N.declaredIn:`${g.rel}/${N.declaredIn}`})),lockfilePath:I.lockfilePath===null||g.rel===""?I.lockfilePath:`${g.rel}/${I.lockfilePath}`,gaps:I.gaps.map(N=>({...N,rootRel:g.rel,detail:gm(g.rel,N.detail)})),diagnostics:O};a.push(E),I.truncated&&(p=!0);for(let N of E.packages){let A=JSON.stringify(N.ecosystem==="Go"?[N.name,N.version,N.lockKey,"Go"]:[N.name,N.version,N.lockKey]);if(!d.has(A)){if(l.length>=r){u=!0;break}d.add(A),l.push(N)}}c.push(...E.gaps),f.push(...E.diagnostics)}u&&(p=!0,f.push(`the union of installed sets across ${String(i.length)} roots exceeds its ceiling of ${String(r)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let m=a[0];if(m===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:m.source,lockfilePath:m.lockfilePath,diagnostics:f,truncated:p,gaps:c,perRoot:a}}function Iv(e,n){let t;for(let s of e.perRoot){if(s.rootRel===""){t??=s;continue}n.startsWith(`${s.rootRel}/`)&&(t===void 0||s.rootRel.length>t.rootRel.length)&&(t=s)}return t}function hi(e,n){return n.declaredIn!==""?n.declaredIn:Iv(e,n.lockKey)?.lockfilePath??null}function _m(e,n){let t=e.perRoot.find(r=>r.rootRel===n.rootRel);if(Rv.has(n.kind))return t?.goModPath??(n.rootRel===""?"go.mod":`${n.rootRel}/go.mod`);if(Nv.has(n.kind))return t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`;if(t?.lockfilePath!==void 0&&t.lockfilePath!==null)return t.lockfilePath;if(n.rootRel==="")return null;let s=t?.ecosystem==="PyPI"?"pyproject.toml":t?.ecosystem==="Go"?"go.mod":"package.json";return`${n.rootRel}/${s}`}var Nv=new Set(["no-installed-env","installed-env-partial"]),Rv=new Set(["go-toolchain-missing","go-list-failed","go-module-missing"]),Ov={packages:[],source:"none",lockfilePath:null,diagnostics:[],truncated:!1,gaps:[]};function hm(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function Sm(e){let n=new Map;for(let t of e){let s=n.get(t.name)??new Set;s.add(t.version),n.set(t.name,s)}return t=>{let s=n.get(t);if(s===void 0)return;let r=[...s].sort();return r.length===1?r[0]:r}}function to(e){return new Set(e.map(n=>n.root))}function er(e,n){let t=to(n);return e.roots.filter(s=>!t.has(s.rel)&&(s.rel===""||s.ecosystem!=="PyPI"&&s.ecosystem!=="Go"))}function Ql(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function Zl(e,n){return er(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function xm(e){let n=[],t=e.observations.filter(s=>s.kind==="unenumerated-install").map(s=>s.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${Ql(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let s=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(s.dirsWalked)} dirs walked, ${String(s.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function km(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as L0}from"node:fs";import Ps from"node:path";import{spawnSync as n0}from"node:child_process";function so(e){{let n=se[e];if(n===void 0)throw new Error(`the bundle does not embed ${e}; this is a cupel build defect`);return["-c",n]}}var wm=["get","post","put","patch","delete","options","head","trace"],Ln=(e,n)=>e.map(t=>`${t}.${n}()`),kn=(e,...n)=>e.flatMap(t=>n.map(s=>`${t}.${s}`)),zn={id:"fastapi@0-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://fastapi.tiangolo.com/reference/apirouter/ \u2014 APIRouter.api_route's decorator calls add_api_route(path, func) and returns func (fastapi/routing.py, 0.141.1); FastAPI.get/\u2026 delegate to self.router","https://fastapi.tiangolo.com/tutorial/dependencies/ \u2014 a Depends parameter receives the dependency's return","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/dependencies/utils.py \u2014 add_non_field_param_to_dependency: Request, WebSocket, HTTPConnection, Response, BackgroundTasks, SecurityScopes are injected","https://github.com/fastapi/fastapi/blob/0.141.1/fastapi/security/http.py \u2014 HTTPBearer.__call__ returns HTTPAuthorizationCredentials read from the request's Authorization header"],apps:[...Ln(["fastapi","fastapi.applications"],"FastAPI"),...Ln(["fastapi","fastapi.routing"],"APIRouter")],decorators:[...wm,"api_route"],addRoute:"add_api_route",depends:kn(["fastapi","fastapi.params","fastapi.param_functions"],"Depends","Security"),injected:[...kn(["fastapi","fastapi.responses","starlette.responses"],"Response","JSONResponse","HTMLResponse","PlainTextResponse","RedirectResponse","StreamingResponse","FileResponse","ORJSONResponse","UJSONResponse","EventSourceResponse"),...kn(["fastapi","fastapi.background","starlette.background"],"BackgroundTasks"),...kn(["fastapi.security","fastapi.security.oauth2"],"SecurityScopes")],schemes:[...Ln(["fastapi.security","fastapi.security.http"],"HTTPBearer"),...Ln(["fastapi.security","fastapi.security.http"],"HTTPBasic"),...Ln(["fastapi.security","fastapi.security.http"],"HTTPDigest"),...Ln(["fastapi.security","fastapi.security.oauth2"],"OAuth2"),...Ln(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordBearer"),...Ln(["fastapi.security","fastapi.security.oauth2"],"OAuth2AuthorizationCodeBearer"),...Ln(["fastapi.security","fastapi.security.open_id_connect_url"],"OpenIdConnect"),...Ln(["fastapi.security","fastapi.security.api_key"],"APIKeyHeader"),...Ln(["fastapi.security","fastapi.security.api_key"],"APIKeyQuery"),...Ln(["fastapi.security","fastapi.security.api_key"],"APIKeyCookie")],forms:kn(["fastapi.security","fastapi.security.oauth2"],"OAuth2PasswordRequestForm","OAuth2PasswordRequestFormStrict")},Jn={id:"flask@3-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://flask.palletsprojects.com/en/stable/api/#flask.Flask.route \u2014 Scaffold.route's decorator calls add_url_rule(rule, endpoint, f) and returns f (flask/sansio/scaffold.py, 3.1.3); get/post/put/delete/patch are route(methods=[\u2026])","https://flask.palletsprojects.com/en/stable/quickstart/#variable-rules \u2014 <converter:variable> sections are passed to the view as keyword arguments (werkzeug/routing/rules.py _part_re)","https://flask.palletsprojects.com/en/stable/api/#flask.request \u2014 the request object for the active context (flask/globals.py: a LocalProxy)"],apps:[...Ln(["flask","flask.app"],"Flask"),...Ln(["flask","flask.blueprints"],"Blueprint")],decorators:["route","get","post","put","delete","patch"],addRule:"add_url_rule",proxies:["flask.request","flask.globals.request"]},Nn={id:"django@6-source-v1",sourceClass:"remote-unauthenticated",evidence:["https://docs.djangoproject.com/en/6.1/topics/http/urls/#how-django-processes-a-request \u2014 the view is called with the HttpRequest, then the captured values (django/urls/resolvers.py, 6.1.1)","https://docs.djangoproject.com/en/6.1/ref/class-based-views/base/#django.views.generic.base.View.dispatch \u2014 as_view()'s view calls dispatch(request, *args, **kwargs), which calls the method named for the verb","https://docs.djangoproject.com/en/3.2/ref/urls/#url \u2014 url() (removed in 4.0) is re_path()","https://www.django-rest-framework.org/api-guide/views/#api_view \u2014 the decorated function is called by a generated APIView's handler with (request, *args, **kwargs) (rest_framework/decorators.py, 3.18.1)","https://docs.djangoproject.com/en/6.1/topics/http/decorators/ \u2014 Django's view decorators; each wrapper calls the view with (request, *args, **kwargs) (django/views/decorators/*.py, django/contrib/auth/decorators.py user_passes_test, django/utils/decorators.py make_middleware_decorator, 6.1.1)"],paths:["django.urls.path","django.urls.conf.path"],regexes:["django.urls.re_path","django.urls.conf.re_path","django.conf.urls.url"],methods:wm,passThrough:[...kn(["django.contrib.auth.decorators"],"login_required","login_required()","login_not_required","permission_required()","user_passes_test()"),...kn(["django.contrib.admin.views.decorators"],"staff_member_required","staff_member_required()"),...kn(["django.views.decorators.http"],"require_http_methods()","require_GET","require_POST","require_safe","condition()","etag()","last_modified()","conditional_page"),...kn(["django.views.decorators.csrf"],"csrf_exempt","csrf_protect","requires_csrf_token","ensure_csrf_cookie"),...kn(["django.views.decorators.cache"],"cache_page()","cache_control()","never_cache"),...kn(["django.views.decorators.vary"],"vary_on_headers()","vary_on_cookie"),...kn(["django.views.decorators.clickjacking"],"xframe_options_deny","xframe_options_sameorigin","xframe_options_exempt"),...kn(["django.views.decorators.gzip"],"gzip_page"),...kn(["django.views.decorators.debug"],"sensitive_post_parameters()","sensitive_variables()"),...kn(["django.views.decorators.common"],"no_append_slash")],apiView:"rest_framework.decorators.api_view()",apiViewSetters:kn(["rest_framework.decorators"],"renderer_classes()","parser_classes()","authentication_classes()","throttle_classes()","permission_classes()","schema()")};function vm(e){return Jn.proxies.includes(e)?{kind:"source",sourceClass:Jn.sourceClass,model:Jn.id}:null}var Pv=[zn.addRoute,Jn.addRule,...new Set([...Nn.paths,...Nn.regexes].map(e=>e.slice(e.lastIndexOf(".")+1)))],Cv=[...new Set([...Nn.passThrough,Nn.apiView,...Nn.apiViewSetters].map(e=>e.split(".")[0]??e))];function Em(e){return{proxies:Jn.proxies.filter(n=>!e(n.split(".")[0]??n)),calls:Pv,roots:Cv.filter(n=>!e(n))}}import{readdirSync as Nm,realpathSync as Am,statSync as Rm}from"node:fs";import zt from"node:path";var Om=32,Mv=512,Tv=/^[A-Za-z_][A-Za-z0-9_]*$/u,$v=[".so",".pyd",".dylib"],yi=e=>({resolved:e,failure:null}),nr=e=>({resolved:null,failure:e});function Lv(e){if(e.length===0||e.length>Mv)return null;let n=e.split(".");return n.length>Om?null:n.every(t=>Tv.test(t))?n:null}function ed(e){try{return Rm(e).isDirectory()}catch{return!1}}function sr(e){try{return Rm(e).isFile()}catch{return!1}}var Im=new WeakMap;function tr(e,n,t){let s=Im.get(e);s===void 0&&(s=new Map,Im.set(e,s));let r=s.get(n);if(r===void 0){try{r=new Set(Nm(n))}catch{r=null}s.set(n,r)}return r?.has(t)===!0}function ro(e,n){let t,s;try{t=Am(n),s=Am(e)}catch{return null}return t===s||t.startsWith(s+zt.sep)?t:null}function Dv(e,n){let t;try{t=Nm(e)}catch{return null}for(let s of t)if(s.startsWith(`${n}.`)&&$v.some(r=>s.endsWith(r))&&sr(zt.join(e,s)))return zt.join(e,s);return null}function Wt(e,n){let t=Lv(n);if(t===null)return nr("refused");let s=null,r=!1;for(let[o,i]of e.roots.entries()){let a=i,l=!1;for(let g of t.slice(0,-1)){let y=zt.join(a,g);if(tr(e,a,g)&&(sr(zt.join(y,"__init__.py"))||ed(y))){if(!ed(y)){l=!0;break}a=y;continue}l=!0,tr(e,a,`${g}.py`)&&sr(`${y}.py`)&&(r=!0);break}if(l)continue;let d=t[t.length-1];if(d===void 0)return nr("refused");let c=zt.join(a,d,"__init__.py");if(tr(e,a,d)&&sr(c)){let g=ro(i,c);return g===null?nr("escapes-root"):yi({module:n,kind:"package",path:g,rootIndex:o})}let f=zt.join(a,`${d}.py`);if(tr(e,a,`${d}.py`)&&sr(f)){let g=ro(i,f);return g===null?nr("escapes-root"):yi({module:n,kind:"module",path:g,rootIndex:o})}let p=Dv(a,d);if(p!==null){let g=ro(i,p);return g===null?nr("escapes-root"):yi({module:n,kind:"extension",path:g,rootIndex:o})}let u=zt.join(a,d);if(s===null&&tr(e,a,d)&&ed(u)){let g=ro(i,u);g!==null&&(s={module:n,kind:"namespace",path:g,rootIndex:o});continue}let m=zt.join(a,`${d}.pyi`);if(s===null&&tr(e,a,`${d}.pyi`)&&sr(m)){let g=ro(i,m);g!==null&&(s={module:n,kind:"stub-only",path:g,rootIndex:o})}}return s!==null?yi(s):nr(r?"not-a-package":"not-found")}function bi(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function rr(e,n,t,s){if(t<1||t>Om)return{failure:"refused"};let r=bi(e,n),o=r===""?[]:r.split("."),i=t-1;if(i>o.length)return{failure:"beyond-top-level"};let a=o.slice(0,o.length-i),l=s===null||s===""?[]:s.split("."),d=[...a,...l].join(".");return d===""?{failure:"beyond-top-level"}:{dotted:d}}function oo(e,n,t){if(e===null)return null;let s=o=>o.kind!=="declared-param"?o:o.index>=t?null:n==="none"?{kind:"param",index:o.index}:o.index===0?{kind:"receiver"}:{kind:"param",index:o.index-1},r=[];for(let o of e){let i=s(o.from),a=s(o.to);if(i===null||a===null)return null;r.push({from:i,to:a,kind:o.kind})}return r}var td="https://docs.python.org/3.13/",Fv=`${td}builtins/functions.html#`,Is=`${td}builtins/stdtypes.html#`,Et=e=>`${td}library/${e}.html#`;function _i(e){return e===""?[]:e.split(",").map(n=>{if(n==="r")return{kind:"receiver"};let t=n.endsWith("+"),s=Number(t?n.slice(0,-1):n);if(!Number.isSafeInteger(s)||s<0)throw new Error(`runtime table: input ${n}`);return t?{kind:"args-from",index:s}:{kind:"arg",index:s}})}var Cm=new Map;function ke(e,n,t){let s=(t.mutates??"").split(";").filter(i=>i!=="").map(i=>{let[a,l]=i.split("<"),d=_i(a??"");if(d.length!==1||d[0]===void 0||l===void 0)throw new Error(`runtime table: mutation ${i}`);return{into:d[0],from:_i(l)}}),r=_i(t.program??""),o=t.returns;Cm.set(e,{summary:{id:`python:${e}`,result:_i(t.result),mutates:s,...r.length>0?{callsProgram:r}:{}},...o!==void 0?{returns:o.endsWith("?")?{type:o.slice(0,-1),exact:"inputs"}:{type:o,exact:"always"}}:{},doc:n})}function sd(e,n,t){for(let s of e)ke(s,n(s),t)}var jv=(e,n=e)=>`${Fv}${n}`,Ge=(e,n,t=e)=>ke(`builtins.${e}`,jv(e,t),n);Ge("len",{result:"0",program:"0",returns:"int"});Ge("isinstance",{result:"0+",program:"0+",returns:"bool"});Ge("issubclass",{result:"0+",program:"0+",returns:"bool"});Ge("callable",{result:"0",returns:"bool"});Ge("str",{result:"0+",program:"0+",returns:"str?"},"func-str");Ge("repr",{result:"0",program:"0",returns:"str?"});Ge("ascii",{result:"0",program:"0",returns:"str?"});Ge("format",{result:"0+",program:"0+",returns:"str?"});Ge("bytes",{result:"0+",program:"0+",returns:"bytes?"},"func-bytes");Ge("int",{result:"0+",program:"0+",returns:"int"});Ge("float",{result:"0",program:"0",returns:"float"});Ge("bool",{result:"0",program:"0",returns:"bool"});Ge("ord",{result:"0",returns:"int"});Ge("chr",{result:"0",program:"0",returns:"str"});for(let e of["hex","oct","bin"])Ge(e,{result:"0",program:"0",returns:"str"});Ge("hash",{result:"0",program:"0",returns:"int"});for(let e of["any","all"])Ge(e,{result:"0",program:"0",returns:"bool"});for(let e of["abs","reversed","frozenset"])Ge(e,{result:"0",program:"0"},e==="frozenset"?"func-frozenset":e);for(let e of["round","min","max","sum","enumerate","zip","map","iter","next"])Ge(e,{result:"0+",program:"0+"});Ge("range",{result:"0+",program:"0+"},"func-range");Ge("filter",{result:"1",program:"0+"});Ge("sorted",{result:"0",program:"0+",returns:"list"});Ge("list",{result:"0",program:"0",returns:"list"},"func-list");Ge("tuple",{result:"0",program:"0",returns:"tuple"},"func-tuple");Ge("dict",{result:"0+",program:"0+",returns:"dict"},"func-dict");Ge("set",{result:"0",program:"0",returns:"set"},"func-set");var Ut=e=>n=>`${e}.${n}`,or=e=>n=>`${Is}${e}.${n}`,Bv=["capitalize","center","expandtabs","join","ljust","lower","lstrip","removeprefix","removesuffix","replace","rjust","rstrip","strip","swapcase","title","translate","upper","zfill"],Gv=["endswith","isalnum","isalpha","isascii","isdigit","islower","isspace","istitle","isupper","startswith"],Kv=["count","find","index","rfind","rindex"];for(let e of["str","bytes"]){let n=(t,s)=>{for(let r of t)ke(Ut(e)(r),or(e)(r),s)};n(Bv,{result:"r,0+",program:"0+",returns:e}),n(Gv,{result:"r,0+",program:"0+",returns:"bool"}),n(Kv,{result:"r,0+",program:"0+",returns:"int"}),n(["split","rsplit","splitlines"],{result:"r,0+",program:"0+",returns:"list"}),n(["partition","rpartition"],{result:"r,0+",program:"0+",returns:"tuple"})}sd(["casefold","format","format_map"].map(Ut("str")),e=>`${Is}${e}`,{result:"r,0+",program:"0+",returns:"str"});sd(["isdecimal","isidentifier","isnumeric","isprintable"].map(Ut("str")),e=>`${Is}${e}`,{result:"r",returns:"bool"});ke("str.encode",`${Is}str.encode`,{result:"r,0+",program:"0+",returns:"bytes?"});ke("bytes.decode",`${Is}bytes.decode`,{result:"r,0+",program:"0+",returns:"str?"});ke("bytes.hex",`${Is}bytes.hex`,{result:"r,0+",program:"0+",returns:"str"});var ir=or("dict");ke("dict.get",ir("get"),{result:"r,1",program:"r,0"});ke("dict.pop",ir("pop"),{result:"r,1",program:"r,0"});ke("dict.setdefault",ir("setdefault"),{result:"r,1",mutates:"r<0,1",program:"r,0"});ke("dict.update",ir("update"),{result:"",mutates:"r<0+",program:"r,0+"});sd(["keys","values","items","popitem"].map(Ut("dict")),e=>`${Is}${e}`,{result:"r"});ke("dict.copy",ir("copy"),{result:"r",returns:"dict"});ke("dict.clear",ir("clear"),{result:""});var Ht=or("list");ke("list.append",Ht("append"),{result:"",mutates:"r<0"});ke("list.extend",Ht("extend"),{result:"",mutates:"r<0",program:"0"});ke("list.insert",Ht("insert"),{result:"",mutates:"r<1",program:"0"});ke("list.pop",Ht("pop"),{result:"r",program:"0"});ke("list.remove",Ht("remove"),{result:"",program:"r,0"});ke("list.sort",Ht("sort"),{result:"",program:"r,0+"});ke("list.reverse",Ht("reverse"),{result:""});ke("list.clear",Ht("clear"),{result:""});ke("list.copy",Ht("copy"),{result:"r",returns:"list"});for(let e of["list","tuple"])for(let n of["index","count"])ke(Ut(e)(n),or(e)(n),{result:"r,0+",program:"r,0+",returns:"int"});var ar=or("set"),rd=or("frozenset");ke("set.add",ar("add"),{result:"",mutates:"r<0",program:"0"});ke("set.update",ar("update"),{result:"",mutates:"r<0+",program:"0+"});for(let e of["intersection_update","difference_update","symmetric_difference_update"])ke(Ut("set")(e),ar(e),{result:"",mutates:"r<0+",program:"r,0+"});for(let e of["discard","remove"])ke(Ut("set")(e),ar(e),{result:"",program:"r,0"});ke("set.pop",ar("pop"),{result:"r"});ke("set.clear",ar("clear"),{result:""});ke("set.copy",rd("copy"),{result:"r",returns:"set"});for(let e of["union","intersection","difference","symmetric_difference"])ke(Ut("set")(e),rd(e),{result:"r,0+",program:"r,0+",returns:"set"});for(let e of["issubset","issuperset","isdisjoint"])ke(Ut("set")(e),rd(e),{result:"r,0+",program:"r,0+",returns:"bool"});ke("json.loads",`${Et("json")}json.loads`,{result:"0+",program:"0+"});ke("json.dumps",`${Et("json")}json.dumps`,{result:"0+",program:"0+"});ke("copy.copy",`${Et("copy")}copy.copy`,{result:"0",program:"0"});ke("copy.deepcopy",`${Et("copy")}copy.deepcopy`,{result:"0+",mutates:"1<0",program:"0+"});for(let e of["b64encode","b64decode","standard_b64encode","standard_b64decode","urlsafe_b64encode","urlsafe_b64decode"])ke(`base64.${e}`,`${Et("base64")}base64.${e}`,{result:"0+",program:"0+",returns:"bytes"});ke("unicodedata.normalize",`${Et("unicodedata")}unicodedata.normalize`,{result:"0+",returns:"str?"});for(let e of["category","bidirectional"])ke(`unicodedata.${e}`,`${Et("unicodedata")}unicodedata.${e}`,{result:"0",returns:"str"});for(let e of["bisect_left","bisect_right","bisect"])ke(`bisect.${e}`,`${Et("bisect")}bisect.${e}`,{result:"0+",program:"0+",returns:"int"});for(let e of["insort_left","insort_right","insort"])ke(`bisect.${e}`,`${Et("bisect")}bisect.${e}`,{result:"",mutates:"0<1",program:"0+"});for(let e of["join","basename","dirname","normpath","splitext","split"])ke(`os.path.${e}`,`${Et("os.path")}os.path.${e}`,{result:"0+",program:"0+"});var Pm=new Set(["str","bytes","int","float","complex","bool","none","scalar"]),zv=new Set(["str","bytes","int","float","complex","bool","tuple","list","dict","set"]),ft={decl:"unknown"},Wv=8;function Mm(e,n){let t=new Map,s=c=>c==null||c.unlessWritten!==void 0&&n.written(c.unlessWritten)?null:{type:c.type,exact:!0},r=(c,f)=>c.get(nd(f))?.value??null,o=(c,f,p)=>{if(p>Wv)return ft;let u=n.decls.get(c),m=u?.moduleBindings?.get(f),g=e.packageOf(c);if(m==="def"||m==="class")return g===void 0?ft:{decl:g===""?"app":"dependency"};if(m!=="import"||u?.aliases.get(f)?.rows!==1)return ft;let y=n.envs.get(c),b=y?.names.get(f);if(b!==void 0)return o(b.moduleId,b.name,p+1);let _=y?.externalOrigins?.get(f);return _!==void 0?i(_,p+1):ft},i=(c,f)=>{let p=c.split(".");for(let m=p.length;m>=1;m-=1){let g=e.placed(p.slice(0,m).join("."));if(g===null)continue;if(g.kind==="surface")return{decl:"dependency"};let y=p.slice(m);return y.length===1&&y[0]!==void 0?o(g.id,y[0],f):ft}let u=p[0];return u!==void 0&&e.stdlib.has(u)?{decl:"runtime",identity:c}:ft},a=(c,f)=>{if(f.startsWith("~")){let y=e.packageOf(c);return y===void 0?ft:{decl:y===""?"app":"dependency"}}let p=f,u=/^\.+/u.exec(f)?.[0].length??0;if(u>0){let y=e.dottedOf(c);if(y===void 0)return ft;let b=f.slice(u),_=rr(y.dotted,y.isPackage,u,b===""?null:b);if("failure"in _)return ft;p=_.dotted}let[m,g]=p.split(".");return m==="builtins"?g!==void 0&&e.builtins.has(g)?{decl:"runtime",identity:p}:ft:i(p,0)},l=(c,f,p)=>{let g=(f.args??[]).map((O,E)=>{let N=f.argProofs?.[E],A=N?.unlessWritten===void 0?s(N):null;return A!==null||O.kind!=="positional"?A:r(p,O)}).map(O=>O!==null&&O.exact&&Pm.has(O.type)),y=f.attr===null||f.receiverRange===null?null:s(f.receiverProof)??r(p,f.receiverRange),b=y!==null&&y.exact&&Pm.has(y.type),_=ft;y!==null&&f.attr!==null?zv.has(y.type)&&e.typeAttrs.get(y.type)?.has(f.attr)===!0&&(_={decl:"runtime",identity:`${y.type}.${f.attr}`,method:!0}):f.calleeOrigin!==null&&(_=a(c,f.calleeOrigin));let S=_.identity===void 0?void 0:Cm.get(_.identity),k=S?.summary;k!==void 0&&_.method===!0&&y?.exact!==!0&&(k={...k,callsProgram:[{kind:"receiver"},...k.callsProgram??[]]});let v=S?.returns,I=v===void 0?void 0:{type:v.type,exact:v.exact==="always"||g.every(Boolean)&&(_.method!==!0||b)};return{calleeDecl:_.decl,..._.identity!==void 0?{runtimeId:`python:${_.identity}`}:{},...k!==void 0?{summary:k}:{},...b?{receiverPrimitive:!0}:{},..._.method===!0&&y?.exact===!0?{receiverMethod:y.type}:{},argPrimitive:g,...I!==void 0?{value:I}:{}}},d=c=>{let f=t.get(c);if(f!==void 0)return f;let p=new Map,u=g=>g.range.end-g.range.start,m=[...n.calls.get(c)??[]].sort((g,y)=>u(g)-u(y)||g.range.start-y.range.start);for(let g of m)u(g)>0&&p.set(nd(g.range),l(c,g,p));return t.set(c,p),p};return(c,f)=>{let p=d(c),u=p.get(nd(f.range))??l(c,f,p),{value:m,...g}=u;return g}}function nd(e){return`${String(e.start)}-${String(e.end)}`}var ld="<toplevel>",Gm=64,Uv=new Set(["self","cls"]),ao=8,Hv=new Set(["__new__","__init_subclass__","__class_getitem__"]),vi=new Set(["__del__","__repr__","__str__","__bytes__","__format__","__lt__","__le__","__eq__","__ne__","__gt__","__ge__","__hash__","__bool__","__getattr__","__getattribute__","__setattr__","__delattr__","__dir__","__get__","__set__","__delete__","__init_subclass__","__set_name__","__mro_entries__","__prepare__","__instancecheck__","__subclasscheck__","__class_getitem__","__call__","__len__","__length_hint__","__getitem__","__setitem__","__delitem__","__missing__","__iter__","__reversed__","__contains__","__add__","__sub__","__mul__","__matmul__","__truediv__","__floordiv__","__mod__","__divmod__","__pow__","__lshift__","__rshift__","__and__","__xor__","__or__","__radd__","__rsub__","__rmul__","__rmatmul__","__rtruediv__","__rfloordiv__","__rmod__","__rdivmod__","__rpow__","__rlshift__","__rrshift__","__rand__","__rxor__","__ror__","__iadd__","__isub__","__imul__","__imatmul__","__itruediv__","__ifloordiv__","__imod__","__ipow__","__ilshift__","__irshift__","__iand__","__ixor__","__ior__","__neg__","__pos__","__abs__","__invert__","__complex__","__int__","__float__","__index__","__round__","__trunc__","__floor__","__ceil__","__enter__","__exit__","__buffer__","__release_buffer__","__await__","__aiter__","__anext__","__aenter__","__aexit__","__next__","__fspath__","__post_init__","__copy__","__deepcopy__","__reduce__","__reduce_ex__","__getstate__","__setstate__","__getnewargs__","__getnewargs_ex__","__subclasshook__","__sizeof__","_missing_","_generate_next_value_"]),Km=new Set(["__getattr__","__dir__"]),qv=new Set(["property","cached_property","abstractproperty","getter","setter","deleter"]),Vv=e=>e.some(n=>n!==null&&qv.has(n.split(".").pop()??n)),Tm=["__new__","__init__"],zm=new Set(["object","BaseException","Exception","ArithmeticError","AssertionError","AttributeError","BufferError","EOFError","FloatingPointError","ImportError","IndexError","KeyError","LookupError","MemoryError","ModuleNotFoundError","NameError","NotImplementedError","OSError","OverflowError","RecursionError","ReferenceError","RuntimeError","StopAsyncIteration","StopIteration","SystemError","TimeoutError","TypeError","UnboundLocalError","UnicodeError","ValueError","ZeroDivisionError","Warning","UserWarning","DeprecationWarning","RuntimeWarning"]),ki=new Set([...zm,"type","dict","list","set","frozenset","tuple","str","bytes","bytearray","int","float","complex"]),Xv=new Map([["keys","any"],["get","mapping"],["close","iterator"]]),Wm=new Set(["excepthook","unraisablehook","displayhook","breakpointhook","__import__"]),Yv=new Map([["dataclass",{module:"dataclasses",name:"dataclass"}],["dataclasses.dataclass",{module:"dataclasses",name:null}],["total_ordering",{module:"functools",name:"total_ordering"}],["functools.total_ordering",{module:"functools",name:null}],["unique",{module:"enum",name:"unique"}],["enum.unique",{module:"enum",name:null}],["final",{module:"typing",name:"final"}],["typing.final",{module:"typing",name:null}]]),$m=new Map([["ABCMeta",{module:"abc",name:"ABCMeta"}],["abc.ABCMeta",{module:"abc",name:null}],["type",null]]);function lr(e,n){return{path:e,start:n.start,end:n.end}}function Lm(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function cd(e,n,t,s){let r=[],o=[],i=[],a=[],l=new Map,d=new Map,c=new Map,f=new Map,p=new Map,u=new Map,m=new Map,g=new Map,y=new Map,b=new Map,_=new Set,S=new Set,k=new Set,v=new Map,I=new Set,O=new Map,E=G=>{let z=new Map;for(let L of G)z.set(L,(z.get(L)??0)+1);return z},N=E(e.functions.map(G=>G.qualname)),A=E(e.classes.map(G=>G.qualname)),U=new Map(e.classes.map(G=>[G.qualname,G])),$=nE(e),W=(G,z)=>z!==void 0&&eE(G,z,e.moduleBindings,$),w=G=>!G.rebound&&G.decorators.every(z=>z!==null&&W(z,Yv.get(z)))&&(G.metaclass===null||W(G.metaclass,$m.get(G.metaclass))),P=`${n}#${ld}`,j=oo(e.toplevelFlows,"none",0);r.push({id:P,moduleId:n,name:ld,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1,...j!==null?{valueFlows:j}:{}});let F=new Set,B=new Set,ne=new Set,X=new Map,Q=new Map,Z=new Map,x=new Map,T=[];for(let G of e.classes){let z=`${n}#class:${G.qualname}`;G.decorators.length>0&&ne.add(z),Z.has(z)||Z.set(z,G.range.start),c.set(G.qualname,z),b.set(z,G.qualname),G.bases.length>1&&_.add(z),G.interceptsLookup&&S.add(z),v.set(z,G.nonDefBinds),O.set(z,G.valueBases),(!w(G)||A.get(G.qualname)!==1)&&I.add(z),G.metaclass!==null&&!W(G.metaclass,$m.get(G.metaclass))&&k.add(z);let L=p.get(z),ie=G.valueBases??G.bases;p.set(z,L===void 0?[...ie]:[...L,...ie]);let me=G.qualname.includes(".")?G.qualname:G.name;if(o.push({id:z,moduleId:n,name:me,implementsRefs:[],members:[]}),!x.has(z)){let be=`${n}#<class:${G.qualname}>`;x.set(z,be),T.push({id:be,moduleId:n,name:me,kind:"class",declRange:lr(t,G.range),isExported:!1,publicSurfaceReachable:!1})}}for(let G of e.functions){let z=`${n}#${G.qualname}`;l.set(G.qualname,z),g.set(G.qualname,G.params===null?null:new Set(G.params.map(H=>H.name)));let L=G.enclosingClass,ie=L!==null&&G.qualname===`${L}.${G.name}`,me=ie?c.get(L):void 0,be=L===null&&G.enclosingFunction===null,Me=!be&&!ie&&G.qualname===`${G.enclosingFunction??""}.${G.name}`?G.enclosingFunction:null,re=be?Lm(G.name,e.all):ie&&!L.includes(".")?Lm(L,e.all):!1,R=ie?U.get(L):void 0,D=N.get(G.qualname)===1&&(R===void 0||A.get(R.qualname)===1)?Zv(G,R===void 0?void 0:w(R),t):null;if(D!==null&&y.set(z,D.kind),X.set(z,G.name),G.decorators.length>0&&B.add(z),Q.get(z)!=="other"&&Q.set(z,G.decorated),(ie?vi.has(G.name)||Vv(G.decorators):be&&Km.has(G.name))&&F.add(z),r.push({id:z,moduleId:n,name:be||ie?G.name:G.qualname,kind:me!==void 0?G.name==="__init__"?"ctor":"method":"function",...me!==void 0?{enclosingClassId:me}:{},declRange:lr(t,G.range),isExported:re,publicSurfaceReachable:re,...D!==null?D.fields:{}}),be&&(d.set(G.name,z),re)){let H=s();i.push({id:H,moduleId:n,exportedName:G.name,kind:"value"}),a.push({exportId:H,target:{kind:"function",functionId:z}})}if(ie){let H=f.get(L)??new Map;H.set(G.name,z),f.set(L,H)}if(Me!==null){let H=u.get(Me)??new Map;H.set(G.name,z),u.set(Me,H)}!be&&!ie&&m.set(G.name,[...m.get(G.name)??[],z])}r.push(...T);let q=o.map(G=>{let z=[...c.entries()].find(([,ie])=>ie===G.id)?.[0],L=z===void 0?void 0:f.get(z);return L===void 0?G:{...G,members:[...L.values()]}});return{moduleId:n,functions:r,classes:q,exports:i,exportBindings:a,byQualname:l,topLevel:d,classByName:c,methods:f,baseSlots:p,nested:u,closures:m,paramNames:g,all:e.all,allComputed:e.allComputed,toplevelId:P,callable:y,moduleBindings:e.moduleBindings,staticBindings:e.staticBindings,aliases:$,classQualname:b,multiBase:_,intercepts:S,customMeta:k,nonDefBinds:v,rewrites:I,valueBases:O,starImport:e.starImport,attrWrites:e.attrWrites,implicitRoots:F,decoratedDefs:B,decoration:Q,classStarts:Z,decoratedClasses:ne,defNames:X,classObjects:x,valueNames:e.valueNames,valueAttrs:e.valueAttrs,computedAccess:e.computedAccess,classBinds:e.classBinds,moduleBinds:e.moduleBinds,dunderWrites:e.dunderWrites,moduleCalls:e.moduleCalls,importRenames:e.imports.flatMap(G=>G.form==="from"?G.names.flatMap(z=>z.asname!==null?[[z.asname,z.name]]:[]):[])}}function Jv(e,n){let t=new Set,s=!1;for(let i of e.values())if(i.attrWrites===null)s=!0;else for(let a of i.attrWrites)t.add(a);let r=t.has("__class__")||t.has("__getattribute__"),o=new Map;for(let[i,a]of e){let l=new Map;for(let c of a.functions){let f=a.callable.get(c.id);if(f===void 0||s||c.name!==void 0&&t.has(c.name))continue;let p=f!=="function";p&&r||p&&c.enclosingClassId!==void 0&&n.has(c.enclosingClassId)||l.set(c.id,f)}if(l.size===a.callable.size){o.set(i,a);continue}let d=a.functions.map(c=>{if(!a.callable.has(c.id)||l.has(c.id))return c;let{params:f,receiver:p,reflectiveArguments:u,valueFlows:m,...g}=c;return g});o.set(i,{...a,functions:d,callable:l})}return o}var Rn={kind:"unknown"},wi={kind:"external"};function dd(e,n,t,s,r=0,o=new Set){let[i,...a]=e;if(i===void 0||r>ao)return Rn;let l=`${n}${e.join(".")}`;if(o.has(l))return Rn;o.add(l);let d=t.get(n),c=d?.moduleBindings;if(d===void 0||c===void 0||c===null)return Rn;let f=c.get(i);if(f===void 0)return r===0&&!d.starImport?wi:Rn;if(f==="class"){let y=a.length===0?d.classByName.get(i):void 0;return y===void 0?Rn:{kind:"class",id:y}}let p=d.aliases.get(i);if(f!=="import"||p?.rows!==1)return Rn;let u=s.get(n),m=u?.names.get(i);if(m!==void 0)return dd([m.name,...a],m.moduleId,t,s,r+1,o);let g=u?.modules.get(i);return g!==void 0?p.exactModule&&a.length>0?dd(a,g,t,s,r+1,o):Rn:u?.external?.has(i)===!0?wi:Rn}function Qv(e,n){let t=new Map,s=new Map,r=[],o=(i,a,l)=>{let d=i.get(a);d===void 0?i.set(a,[l]):d.push(l)};for(let[i,a]of e)for(let[l,d]of a.classByName){let c=a.valueBases.get(d);if(c==null){r.push(d);continue}if(l.includes(".")){c.length>0&&r.push(d);continue}let f=!0;for(let p of c){let u=p===null?Rn:dd(p.split("."),i,e,n);u.kind==="unknown"&&(f=!1),u.kind==="class"&&(o(t,u.id,d),o(s,d,u.id))}f||r.push(d)}return{sub:t,sup:s,unknown:Ns(r,t)}}function Ns(e,n){let t=new Set,s=[...e];for(let r=s.pop();r!==void 0;r=s.pop())if(!t.has(r)){t.add(r);for(let o of n.get(r)??[])s.push(o)}return t}function Zv(e,n,t){if(e.params===null||e.rebound)return null;let s;if(e.method){if(n!==!0)return null;if(e.decorated==="staticmethod")s="static-method";else if(e.decorated==="classmethod")s="class-method";else if(e.decorated==="none"&&!Hv.has(e.name))s="instance-method";else return null}else{if(e.decorated!=="none")return null;s="function"}let r=e.params;if(s==="instance-method"||s==="class-method"){let i=r[0];if(i===void 0||i.kind!=="positional"&&i.kind!=="positional-only")return null;r=r.slice(1)}let o=oo(e.valueFlows,r.length<e.params.length?"first":"none",e.params.length);return{kind:s,fields:{params:r.map((i,a)=>({index:a,kind:i.kind==="positional-only"?"positional":i.kind,...i.kind==="positional-only"?{}:{name:i.name},destructured:!1,hasDefault:i.hasDefault,range:{path:t,start:i.start,end:i.end}})),receiver:s==="instance-method"||s==="class-method"?"call":"none",reflectiveArguments:e.reflective,...o!==null?{valueFlows:o}:{}}}}function eE(e,n,t,s){if(t===null)return!1;if(n===null)return!t.has(e);let r=e.split(".")[0]??e,o=s.get(r)?.source;return t.get(r)!=="import"||o===void 0||o.level!==0?!1:n.name===null?o.form==="import"&&o.name===n.module&&r===n.module:o.form==="from"&&o.module===n.module&&o.name===n.name&&r===n.name}function nE(e){let n=new Map,t=(s,r,o)=>{let i=n.get(s);n.set(s,i===void 0?{rows:1,exactModule:r,...o!==void 0?{source:o}:{}}:{rows:i.rows+1,exactModule:!1})};for(let s of e.imports)for(let r of s.names){let o={form:s.form,module:s.module,level:s.level,name:r.name};s.form==="import"?t(r.asname??r.name.split(".")[0]??r.name,r.asname!==null||!r.name.includes("."),r.asname===null?o:void 0):t(r.asname??r.name,!0,r.asname===null?o:void 0)}return n}function ud(e){let{envs:n}=e,t=e.children??new Map,s=tE(e.decls,{decls:e.decls,envs:n,children:t}),{inheritEdges:r}=s,o=Qv(e.decls,n),i=[];for(let R of e.decls.values())i.push(...R.customMeta);let a=Ns(i,o.sub),l=new Set(a);if(i.length>0)for(let R of o.unknown)l.add(R);let d=Jv(e.decls,l),c=new Map,f=(R,D)=>{let Y=c.get(R)??[];Y.includes(D)||Y.push(D),c.set(R,Y)};for(let R of d.values()){for(let D of R.methods.values())for(let[Y,H]of D)f(Y,H);for(let[D,Y]of R.closures)for(let H of Y)f(D,H)}for(let R of e.rebinds??[]){let D=d.get(R.moduleId)?.topLevel.get(R.target);D!==void 0&&f(R.attr,D)}let p=new Map;for(let R of d.values())for(let D of R.classByName.values())p.set(D,R);let u=new Map,m=new Set,g=new Set,y=new Set(a),b=new Map;for(let R of d.values()){for(let[D,Y]of R.callable)u.set(D,Y);for(let D of R.multiBase)m.add(D);for(let D of R.intercepts)g.add(D);for(let D of R.rewrites)y.add(D);for(let[D,Y]of R.nonDefBinds)b.set(D,Y)}let _=R=>{let D=b.get(R),Y=p.get(R),H=Y?.classQualname.get(R);return D==null||Y===void 0||H===void 0?null:new Set([...D,...Y.methods.get(H)?.keys()??[]])},S=[],k=new Map;for(let R of o.unknown){let D=new Set,Y=!1;for(let H of Ns([R],o.sup)){let ee=_(H);if(ee===null||y.has(H)||g.has(H)){Y=!0;break}for(let le of ee)D.add(le)}if(Y){S.push(R);continue}for(let H of D){let ee=k.get(H);ee===void 0?k.set(H,[R]):ee.push(R)}}let v=R=>{let D=new Map;return Y=>{let H=D.get(Y);return H===void 0&&(H=Ns([Y],R),D.set(Y,H)),H}},I={decls:d,envs:n,kindOf:u,classOwner:p,multiBase:m,intercepts:g,rewrites:y,nonDefBinds:b,below:v(o.sub),above:v(o.sup),unplaced:o.unknown,unplacedAnyName:S,unplacedByName:k},O=[],E=[],N=new Set,A=0,U=0,$=new Set,W=!1,w=new Map;for(let R of d.values()){if(R.attrWrites===null)W=!0;else for(let D of R.attrWrites)$.add(D);for(let[D,Y]of R.closures)w.set(D,[...w.get(D)??[],...Y])}let P=new Set;for(let R of d.values())for(let D of R.decoratedClasses)P.add(D);let j=new Map;for(let R of d.values())for(let[D,Y]of R.decoration)j.set(D,Y);let F={hier:s,rewrites:y,decorated:P},B={byMethodName:c,children:t,selfTargets:sE(s,c,{installable:R=>W||$.has(R),closures:w,intercepts:g}),construct:aE(F,R=>W||$.has(R)),written:R=>W||$.has(R),decoration:R=>j.get(R)??"other"},ne=new Map;for(let{moduleId:R,call:D}of e.pending){let Y=ne.get(R);Y===void 0?ne.set(R,[D]):Y.push(D)}let X=e.runtime===void 0?void 0:Mm(e.runtime,{decls:d,envs:n,written:B.written,calls:ne}),Q=new Set,Z=new Map,x=[],T=new Map;for(let R of e.pending){let{moduleId:D,path:Y,call:H}=R,ee=d.get(D);if(ee===void 0)continue;if(H.raisedCall!==null){x.push(R);continue}let le=H.enclosingFunction===null?ee.toplevelId:ee.byQualname.get(H.enclosingFunction)??ee.toplevelId,de=gE(H,D,ee,n.get(D),d,n,B),ge=yE(H,D,ee,de,I),ve=X?.(D,H);de.how==="name-match"&&de.resolution!=="unresolved"&&ge.direct.size===0&&(de=ds(de)),Z.set(`${D}${String(H.range.start)}${String(H.range.end)}`,de),e.preciseNames!==!1&&de.how==="name-match"&&de.resolution==="unresolved"&&ve?.receiverMethod!==void 0&&(de={ids:[],resolution:"unresolved",how:"name-match"});let Re=`py-call:${D}:${String(A)}`;A+=1,T.set(R,Re);let _e=de.resolution==="unresolved";_e&&(U+=1,H.attr!==null&&Q.add(H.attr),ge=wn),O.push({id:Re,enclosingFunctionId:le,calleeExprShape:H.receiver===null?"identifier":"member",resolvedTargetIds:_e?[]:de.ids,resolution:de.resolution,range:lr(Y,H.range),..._E(Y,H,ge.convention,ve?.argPrimitive),...xE(ve)});let Ke=e.nameMatchLabel===!0&&de.how==="name-match";for(let ze of de.ids){let pn=ge.direct.has(ze),vn=_e?"field-based":de.resolution,K=Ke&&vn==="field-based"&&!pn;K&&N.add(E.length),E.push({callSiteId:Re,calleeFunctionId:ze,resolution:K?"name-match":vn,...pn?{invocation:"direct"}:{}})}}let q=R=>{let D=B.decoration(R);return D==="none"||D==="staticmethod"||D==="classmethod"},G=lE({decls:d,envs:n,hier:s,facts:F,intercepts:g,written:B.written,constructs:(R,D)=>Z.get(`${R}${String(D.start)}${String(D.end)}`),certainTarget:q}),z=[];for(let[R,D]of T){let Y=G(R.moduleId,R.call);Y!==void 0&&z.push({site:D,target:Y})}if(z.length>0){let R=new Set(z.map(H=>H.site)),D=new Set,Y=new Map;for(let[H,ee]of E.entries())R.has(ee.callSiteId)&&(D.add(`${ee.callSiteId}${ee.calleeFunctionId}`),N.has(H)&&Y.set(`${ee.callSiteId}${ee.calleeFunctionId}`,H));for(let H of z){let ee=Y.get(`${H.site}${H.target}`);if(ee!==void 0){let le=E[ee];le!==void 0&&(E[ee]={...le,resolution:"field-based"}),N.delete(ee)}D.has(`${H.site}${H.target}`)||(D.add(`${H.site}${H.target}`),E.push({callSiteId:H.site,calleeFunctionId:H.target,resolution:"field-based"}))}}for(let{moduleId:R,path:D,call:Y}of x){let H=d.get(R),ee=Y.raisedCall;if(H===void 0||ee===null)continue;let le=Z.get(`${R}${String(ee.start)}${String(ee.end)}`);if(le===void 0||le.how==="construct"||le.ids.length===0)continue;let de=`py-raise:${R}:${String(A)}`;A+=1,U+=1,O.push({id:de,enclosingFunctionId:Y.enclosingFunction===null?H.toplevelId:H.byQualname.get(Y.enclosingFunction)??H.toplevelId,calleeExprShape:"unknown",resolvedTargetIds:[],resolution:"unresolved",range:lr(D,Y.range)})}let L=new Map;for(let R of e.loads??[]){let D=[R.moduleId,R.enclosingFunction??"",String(R.at),R.shape].join(""),Y=L.get(D);if(Y===void 0)L.set(D,{load:R,targets:new Set(R.targets)});else for(let H of R.targets)Y.targets.add(H)}let ie=0;for(let{load:R,targets:D}of L.values()){let Y=d.get(R.moduleId);if(Y===void 0)continue;let H=new Set;for(let le of D){let de=d.get(le)?.toplevelId;de!==void 0&&H.add(de)}if(H.size===0)continue;let ee=`py-load:${R.moduleId}:${String(ie)}`;ie+=1,O.push({id:ee,enclosingFunctionId:R.enclosingFunction===null?Y.toplevelId:Y.byQualname.get(R.enclosingFunction)??Y.toplevelId,calleeExprShape:R.shape,resolvedTargetIds:[...H],resolution:"resolved",range:{path:R.path,start:R.at,end:R.at}});for(let le of H)E.push({callSiteId:ee,calleeFunctionId:le,resolution:"resolved"})}let me=[...d.values()].flatMap(R=>R.functions),be=new Map(me.map(R=>[R.id,R.declRange])),Me=new Set;for(let R of O)for(let D of R.resolvedTargetIds)Me.add(`${R.enclosingFunctionId}${D}`);for(let[R,D]of d)for(let[Y,H]of D.nested){let ee=D.byQualname.get(Y);if(ee!==void 0)for(let le of H.values()){let de=be.get(le);if(de===void 0||Me.has(`${ee}${le}`))continue;let ge=`py-closure:${R}:${String(A)}`;A+=1,O.push({id:ge,enclosingFunctionId:ee,calleeExprShape:"identifier",resolvedTargetIds:[le],resolution:"field-based",range:{path:de.path,start:de.start,end:de.start}}),E.push({callSiteId:ge,calleeFunctionId:le,resolution:"field-based"})}}let re=(R,D,Y,H,ee=R.toplevelId)=>{let le=[...new Set(Y)];if(le.length===0&&!H)return;let de=`py-implicit:${R.moduleId}:${String(A)}`;A+=1,H&&(U+=1),O.push({id:de,enclosingFunctionId:ee,calleeExprShape:"unknown",resolvedTargetIds:H?[]:le,resolution:H?"unresolved":"field-based",range:{path:D.path,start:D.start,end:D.start}});for(let ge of le)E.push({callSiteId:de,calleeFunctionId:ge,resolution:"field-based"})};for(let R of d.values()){for(let H of R.implicitRoots){let ee=be.get(H);ee!==void 0&&re(R,ee,[H],!1)}let D=be.get(R.toplevelId)?.path??String(R.moduleId),Y=(H,ee)=>{let le=n.get(R.moduleId),de=uE(H,{d:R,env:le,classQual:ee,decls:d,envs:n,facts:F});de!==null&&re(R,{path:D,start:H.at},de.ids,de.unnamed)};for(let[H,ee]of R.classBinds??[])for(let le of ee)Y(le,H);for(let H of R.moduleBinds??[])Km.has(H.name)&&Y(H,null);for(let H of R.dunderWrites??[])(vi.has(H.name)||Wm.has(H.name))&&Y(H,null);for(let[H,ee]of R.classByName){let le=R.methods.get(H);for(let[de,ge]of Xv){let ve=le?.get(de),Re=ve===void 0?void 0:be.get(ve);if(ve===void 0||Re===void 0)continue;(ge==="any"||ge==="mapping"&&od(s,ee,rE).leaves||ge==="iterator"&&od(s,ee,ki,"__next__").reaches)&&re(R,Re,[ve],!1)}if(od(s,ee,ki).leaves){let de=R.classStarts.get(ee);de!==void 0&&re(R,{path:D,start:de},[],!0,oE(R,H))}}}for(let R of d.values()){let D=be.get(R.toplevelId)?.path??String(R.moduleId);for(let[Y,H]of R.classObjects){let ee=new Set;for(let ge of s.basesOf.get(Y)??[]){if(ge.kind!=="class")continue;let ve=s.classOwner.get(ge.id)?.classObjects.get(ge.id);ve!==void 0&&ve!==H&&ee.add(ve)}if(ee.size===0)continue;let le=`py-isa:${R.moduleId}:${String(A)}`;A+=1;let de=R.classStarts.get(Y)??0;O.push({id:le,enclosingFunctionId:H,calleeExprShape:"unknown",resolvedTargetIds:[...ee],resolution:"field-based",range:{path:D,start:de,end:de}});for(let ge of ee)E.push({callSiteId:le,calleeFunctionId:ge,resolution:"field-based"})}}return{functions:fE(d,Q),callSites:O,callEdges:E,inheritEdges:r,unresolved:U}}function Um(e,n){return e===void 0?!1:e.allComputed?!0:e.all!==null?e.all.includes(n):!n.startsWith("_")}function xi(e,n,t,s=0,r=new Set){let[o,...i]=e;if(o===void 0||s>ao)return Rn;let a=`${n}${e.join(".")}`;if(r.has(a))return Rn;r.add(a);let l=t.decls.get(n);if(l===void 0)return Rn;let d=l.classByName.get(e.join("."));if(d!==void 0)return{kind:"class",id:d};let c=t.envs.get(n),f=c?.names.get(o);if(f!==void 0){let p=xi([f.name,...i],f.moduleId,t,s+1,r);if(p.kind!=="unknown")return p}if(i.length>0){let p=c?.modules.get(o)??t.children.get(n)?.get(o);if(p!==void 0){let u=xi(i,p,t,s+1,r);if(u.kind!=="unknown")return u}}if(c?.external?.has(o)===!0)return wi;for(let p of c?.stars??[]){if(!Um(t.decls.get(p),o))continue;let u=xi(e,p,t,s+1,r);if(u.kind!=="unknown")return u}return s===0&&l.moduleBindings!==null&&!l.moduleBindings.has(o)&&!l.starImport?wi:Rn}var Hm=256;function tE(e,n){let t=[],s=new Map,r=new Map,o=new Map,i=new Map,a=[],l=(m,g,y)=>{let b=m.get(g);b===void 0?m.set(g,[y]):b.push(y)};for(let[m,g]of e)for(let[y,b]of g.classByName){i.set(b,g);let _=g.baseSlots.get(b)??[],S=_.map(v=>v===null?Rn:xi(v.split("."),m,n));y.includes(".")&&_.length>0&&S.push(Rn),s.set(b,S),S.some(v=>v.kind==="unknown")&&a.push(b);let k=new Set;for(let v of S)v.kind==="class"&&k.add(v.id);for(let v of k)t.push({subclassId:b,superclassId:v,relation:"extends"}),l(r,v,b),l(o,b,v)}let d=Ns(a,r),c=new Map;for(let m of Ns(d,o)){let g=i.get(m),y=g?.classQualname.get(m),b=y===void 0?void 0:g?.methods.get(y);for(let[_,S]of b??[]){let k=c.get(_);k===void 0?c.set(_,[S]):k.push(S)}}let f=new Map,p=(m,g)=>{let y=f.get(m);if(y!==void 0)return y;if(g>Hm)return 2;f.set(m,0);let b=0;for(let S of s.get(m)??[])if(b+=S.kind==="unknown"?1:S.kind==="class"?p(S.id,g+1):0,b>=2)break;let _=Math.min(b,2);return f.set(m,_),_},u=!1;for(let m of d)if(p(m,0)>=2){u=!0;break}return{inheritEdges:t,basesOf:s,subclassesOf:r,classOwner:i,unplacedDefs:c,unplacedMixin:u}}function fd(e,n,t){let s=e.classOwner.get(n),r=s?.classQualname.get(n);return r===void 0?void 0:s?.methods.get(r)?.get(t)}function io(e,n,t){let s=new Set,r=!1,o=!1,i=!1,a=new Set,l=[...n];for(let d=l.pop();d!==void 0;d=l.pop()){if(a.has(d))continue;a.add(d);let c=fd(e,d,t);c!==void 0&&s.add(c);let f=e.classOwner.get(d),p=f?.nonDefBinds.get(d);if(p===null||p?.has(t)===!0)o=!0;else if(c===void 0){let u=f?.baseSlots.get(d)??[];for(let[m,g]of(e.basesOf.get(d)??[]).entries())g.kind==="class"?l.push(g.id):g.kind==="unknown"?r=!0:(f===void 0||!pd(zm,u[m],f))&&(i=!0)}}return{ids:s,open:r,alias:o,outside:i}}function sE(e,n,t){let s=new Map,r=new Map;return(o,i)=>{let a=`${o}${i}`,l=r.get(a);if(l!==void 0)return l;let d=s.get(o);d===void 0&&(d=Ns([o],e.subclassesOf),s.set(o,d));let{ids:c,open:f,alias:p,outside:u}=io(e,d,i),m=p,g=k=>{c.has(k)||(c.add(k),m=!0)};for(let k of e.unplacedDefs.get(i)??[])g(k);let y=t.installable(i)?t.closures.get(i)??[]:[];for(let k of y)g(k);let b="self",_;if(f||e.unplacedMixin){let k=new Set([...c,...n.get(i)??[]]);if(k.size<=Gm){if(k.size>c.size||f){for(let v of k)c.add(v);m=!0,b="name-match"}}else f&&(y.length>0||[...d].some(I=>fd(e,I,i)!==void 0)||(_=Rs),m=!0)}let S=!m&&!f&&!u&&!e.unplacedMixin&&!qm(e,d,t.intercepts);return _??=c.size===0?Rs:{ids:[...c],resolution:S?c.size===1?"resolved":"field-based":"unresolved",how:b},r.set(a,_),_}}var rE=new Set([...ki].filter(e=>e!=="dict"));function od(e,n,t,s){let r=!1,o=!1,i=new Set,a=[n];for(let l=a.pop();l!==void 0;l=a.pop()){if(i.has(l))continue;i.add(l);let d=e.classOwner.get(l);if(s!==void 0){let f=d?.nonDefBinds.get(l);(fd(e,l,s)!==void 0||f===null||f?.has(s)===!0)&&(o=!0)}let c=d?.baseSlots.get(l)??[];for(let[f,p]of(e.basesOf.get(l)??[]).entries())p.kind==="class"?a.push(p.id):(p.kind==="unknown"||d===void 0||!pd(t,c[f],d))&&(r=!0)}return{leaves:r,reaches:r||o}}function oE(e,n){for(let t=n;t.includes(".");){t=t.slice(0,t.lastIndexOf("."));let s=e.byQualname.get(t);if(s!==void 0)return s}return e.toplevelId}function qm(e,n,t){if(t.size===0)return!1;let s=new Set,r=[...n];for(let o=r.pop();o!==void 0;o=r.pop())if(!s.has(o)){if(s.add(o),t.has(o))return!0;for(let i of e.basesOf.get(o)??[])i.kind==="class"&&r.push(i.id)}return!1}var pd=(e,n,t)=>typeof n=="string"&&e.has(n)&&t.moduleBindings!==null&&!t.moduleBindings.has(n)&&!t.starImport,iE=(e,n)=>pd(ki,e,n);function md(e,n){let t=new Set,s=[e];for(let r=s.pop();r!==void 0;r=s.pop()){if(t.has(r))continue;if(t.add(r),t.size>Hm||n.rewrites.has(r)||n.decorated.has(r))return!1;let o=n.hier.classOwner.get(r);if(o===void 0)return!1;let i=o.baseSlots.get(r)??[];for(let[a,l]of(n.hier.basesOf.get(r)??[]).entries())if(l.kind==="class")s.push(l.id);else if(l.kind==="unknown"||!iE(i[a],o))return!1}return!0}function aE(e,n){let t=new Map;return s=>{let r=t.get(s);if(r!==void 0)return r;let o=e.hier.classOwner.get(s),i=o?.classQualname.get(s)??"",a=Tm.map(f=>io(e.hier,[s],f)),l=i!==""&&!Tm.some(n)&&!n(i.split(".").pop()??i)&&a.every(f=>!f.open&&!f.alias)&&md(s,e),d=o?.classObjects.get(s),c={ids:[...d!==void 0?[d]:[],...a.flatMap(f=>[...f.ids])],resolution:l?a.every(f=>f.ids.size<=1)?"resolved":"field-based":"unresolved",how:"construct",classId:s};return t.set(s,c),c}}function dr(e,n,t,s,r=0,o=new Set,i=!1){if(r>ao||o.has(`${e}${n}`))return;o.add(`${e}${n}`);let a=t.get(e),d=(a?.moduleBindings??(i?a?.staticBindings:null))?.get(n);if(d==="class")return a?.classByName.get(n);if(d!=="import"||a?.aliases.get(n)?.rows!==1)return;let c=s.get(e)?.names.get(n);return c===void 0?void 0:dr(c.moduleId,c.name,t,s,r+1,o,i)}function Dm(e,n,t,s){return dr(e,n,t,s,0,new Set,!0)}function lE(e){let n=(r,o,i)=>{if(i>ao)return;let a=e.decls.get(r),l=a?.moduleBindings?.get(o);if(a===void 0||l===void 0)return;if(l==="import"){let f=a.aliases.get(o)?.rows===1?e.envs.get(r)?.names.get(o):void 0;return f===void 0?void 0:n(f.moduleId,f.name,i+1)}let d=l==="other"?a.moduleCalls?.get(o):void 0,c=d===void 0?void 0:e.constructs(r,d);return c?.how==="construct"?c.classId:void 0},t=new Map,s=r=>{let o=t.get(r);if(o===void 0){let i=e.hier.classOwner.get(r)?.classQualname.get(r),a=io(e.hier,[r],"__new__");o=i!==void 0&&!i.includes(".")&&!e.written(i)&&!e.written("__new__")&&a.ids.size===0&&!a.open&&!a.alias&&!a.outside&&md(r,e.facts),t.set(r,o)}return o};return(r,o)=>{let i=o.receiver;if(o.attr===null||i===null||i.includes(".")||o.nameScope!=="module"||o.root!=="global"||e.written(i))return;let a=n(r,i,0);if(a===void 0||!s(a)||e.written(o.attr)||e.written("__class__")||e.written("__getattribute__")||qm(e.hier,[a],e.intercepts))return;let l=io(e.hier,[a],o.attr);if(l.open||l.alias||l.outside||l.ids.size!==1)return;let[d]=l.ids;return d!==void 0&&e.certainTarget(d)?d:void 0}}function Vm(e,n,t){let s=n.aliases.get(e);return!e.includes(".")&&n.moduleBindings?.get(e)==="import"&&s?.rows===1&&s.exactModule?t?.modules.get(e):void 0}function dE(e,n){let t=e.split(".");for(let s=t.length-1;s>0;s-=1)if(n.byQualname.has(t.slice(0,s).join(".")))return!0;return!1}function id(e,n,t){let[s,...r]=n;if(s===void 0||r.length>0||!md(e,t))return null;let o=io(t.hier,[e],s);return o.open||o.alias?null:[...o.ids]}function cE(e,n){let[t,...s]=e.split("."),{d:r,env:o,classQual:i}=n;if(t===void 0||t==="")return null;if(i!==null){if(dE(i,r))return null;let m=r.classByName.get(i),g=m===void 0?null:r.nonDefBinds.get(m)??null;if(g===null||g.has(t))return null;let y=r.methods.get(i)?.get(t);if(y!==void 0)return s.length===0?[y]:null}let a=r.moduleBindings?.get(t);if(r.moduleBindings===null)return null;if(a===void 0)return r.starImport||r.topLevel.has("__getattr__")?null:[];if(a==="def"){let m=r.topLevel.get(t);return m!==void 0&&s.length===0?[m]:null}if(a==="class"){let m=r.classByName.get(t);return m===void 0?null:id(m,s,n.facts)}if(a!=="import"||r.aliases.get(t)?.rows!==1)return null;let l=o?.names.get(t);if(l!==void 0){let m=s.length===0?pt(l.moduleId,l.name,n.decls,n.envs,!0):void 0;if(m!==void 0)return[m];let g=dr(l.moduleId,l.name,n.decls,n.envs);return g===void 0?null:id(g,s,n.facts)}let d=Vm(t,r,o),[c,...f]=s;if(d===void 0||c===void 0)return null;let p=f.length===0?pt(d,c,n.decls,n.envs,!0):void 0;if(p!==void 0)return[p];let u=dr(d,c,n.decls,n.envs);return u===void 0?null:id(u,f,n.facts)}function uE(e,n){let t=e.value;if(t.kind==="const"||t.kind==="lambda"||t.kind!=="property"&&!vi.has(e.name)&&!Wm.has(e.name))return null;if(t.kind==="other")return{ids:[],unnamed:!0};let s=t.kind==="name"?[t.dotted]:t.accessors.flatMap(i=>i.kind==="name"?[i.dotted]:i.kind==="other"?[null]:[]),r=[],o=!1;for(let i of s){let a=i===null?null:cE(i,n);a===null?o=!0:r.push(...a)}return{ids:r,unnamed:o}}function fE(e,n){let t=!1,s=new Set(n),r=new Map;for(let i of e.values()){(i.computedAccess||i.valueNames===null||i.valueAttrs===null)&&(t=!0);for(let a of i.valueNames??[])s.add(a);for(let a of i.valueAttrs??[])s.add(a);for(let[a,l]of i.importRenames){let d=r.get(a);d===void 0?r.set(a,[l]):d.push(l)}}let o=[...s];for(let i=o.pop();i!==void 0;i=o.pop())for(let a of r.get(i)??[])s.has(a)||(s.add(a),o.push(a));return[...e.values()].flatMap(i=>i.functions.map(a=>{let l=i.defNames.get(a.id)??"",d=a.id!==i.toplevelId&&(t||a.kind==="class"||a.enclosingClassId!==void 0||s.has(l)||i.decoratedDefs.has(a.id));return{...a,addressTaken:d}}))}function pt(e,n,t,s,r=!1,o=new Set,i=0){if(i>ao)return;let a=`${e}${n}`;if(o.has(a))return;o.add(a);let l=t.get(e),d=l?.moduleBindings?.get(n),c=l?.topLevel.get(n);if(c!==void 0)return!r||d==="def"?c:void 0;let f=s.get(e),p=f?.names.get(n);if(p!==void 0)return r&&(d!=="import"||l?.aliases.get(n)?.rows!==1)?void 0:pt(p.moduleId,p.name,t,s,r,o,i+1);if(!r)for(let u of f?.stars??[]){if(!Um(t.get(u),n))continue;let m=pt(u,n,t,s,!1,o,i+1);if(m!==void 0)return m}}var Rs={ids:[],resolution:"unresolved",how:"none"};function ad(e,n){let t=n.byMethodName.get(e)??[];return t.length===0||t.length>Gm?Rs:{ids:t,resolution:"field-based",how:"name-match"}}function pE(e,n,t){for(let s=n;s!==null&&s!=="";){if(t.byQualname.has(s)){let o=t.nested.get(s)?.get(e);if(o!==void 0)return{kind:"def",id:o};if(t.paramNames.get(s)?.has(e)===!0)return{kind:"param"}}let r=s.lastIndexOf(".");s=r<0?null:s.slice(0,r)}return{kind:"none"}}function mE(e,n,t,s){let[r,...o]=e.split(".");if(r===void 0||r==="")return;let i=n?.modules.get(r);for(let a of o){if(i===void 0)return;i=t.get(i)?.modules.get(a)??s.get(i)?.get(a)}return i}function gE(e,n,t,s,r,o,i){let a=e.attr,l=e.nameScope;if(a===null){if(e.callee===null||e.receiver!==null)return Rs;let f=e.callee,p=pE(f,e.enclosingFunction,t);if(l==="local-def"&&p.kind==="def")return Si({ids:[p.id],resolution:"resolved",how:"local"},i,null);let u=hE(f,p,n,t,s,r,o);if(l!=="module")return ds(u);let m=pt(n,f,r,o,!0);if(m!==void 0&&u.ids[0]===m)return Si({ids:[m],resolution:"resolved",how:"bare"},i,f);if(u.ids.length>0)return ds(u);let g=dr(n,f,r,o);if(g!==void 0)return i.construct(g);let y=Dm(n,f,r,o);return y===void 0?Rs:Fm(i.construct(y))}if(e.receiver===null)return ad(a,i);let d=e.receiver;if(Uv.has(d)&&e.enclosingFunction!==null){let f=e.enclosingFunction.split(".").slice(0,-1).join("."),p=t.classByName.get(f);if(p!==void 0){let u=i.selfTargets(p,a),m=t.byQualname.get(e.enclosingFunction),g=m===void 0?"other":i.decoration(m),y=e.root==="param0"&&(g==="none"||g==="classmethod");return u.resolution==="unresolved"||!y?ds(u):Si(u,i,a)}}let c=mE(d,s,o,i.children);if(c!==void 0){let f=d.split("."),p=f[0]??d,u=l==="module"&&t.moduleBindings?.get(p)==="import"&&t.aliases.get(p)?.rows===1&&f.slice(1).every(S=>!i.written(S)),m=pt(c,a,r,o);if(m!==void 0){let S={ids:[m],resolution:"resolved",how:"module"};return u&&pt(c,a,r,o,!0)===m?Si(S,i,a):ds(S)}let g=ad(a,i),y=u&&Vm(d,t,s)===c,b=y?dr(c,a,r,o):void 0;if(b===void 0){let S=y?Dm(c,a,r,o):void 0;if(S===void 0)return ds(g);let k=Fm(i.construct(S));return g.ids.length===0?k:{ids:[...new Set([...k.ids,...g.ids])],resolution:"unresolved",how:"construct"}}let _=i.construct(b);return g.ids.length===0?_:{ids:[...new Set([..._.ids,...g.ids])],resolution:_.resolution==="unresolved"?"unresolved":"field-based",how:"construct",classId:b}}return ad(a,i)}function hE(e,n,t,s,r,o,i){if(n.kind==="def")return{ids:[n.id],resolution:"resolved",how:"local"};let a=s.topLevel.get(e);if(a!==void 0)return{ids:[a],resolution:"resolved",how:"bare"};let l=r?.names.get(e),d=l!==void 0?pt(l.moduleId,l.name,o,i):pt(t,e,o,i);return d!==void 0?{ids:[d],resolution:"resolved",how:"bare"}:Rs}function ds(e){return e.ids.length===0?Rs:{...e,resolution:"unresolved"}}function Fm(e){let{classId:n,...t}=e;return ds(t)}function Si(e,n,t){return e.ids.some(r=>{let o=n.decoration(r);return o!=="none"&&o!=="staticmethod"&&o!=="classmethod"})||t!==null&&n.written(t)?ds(e):e}var wn={direct:new Set,convention:"unknown"};function jm(e,n,t){return e!==void 0&&n.ids.length===1&&n.ids[0]===e&&t.get(e)==="function"?{direct:new Set([e]),convention:"direct"}:wn}function Bm(e){return e.length>0&&e.every(n=>n==="instance-method")?"shifted":e.length>0&&e.every(n=>n==="class-method"||n==="static-method")?"direct":"unknown"}function yE(e,n,t,s,r){if(e.root!==(s.how==="self"?"param0":"global"))return wn;let o=r.envs.get(n);switch(s.how){case"bare":return e.callee===null?wn:jm(pt(n,e.callee,r.decls,r.envs,!0),s,r.kindOf);case"module":{let i=e.receiver===null?void 0:t.aliases.get(e.receiver),a=e.receiver===null?void 0:o?.modules.get(e.receiver);return e.receiver===null||e.attr===null||a===void 0||t.moduleBindings?.get(e.receiver)!=="import"||i?.rows!==1||!i.exactModule?wn:jm(pt(a,e.attr,r.decls,r.envs,!0),s,r.kindOf)}case"self":{let i=e.attr,a=e.enclosingFunction===null?void 0:t.byQualname.get(e.enclosingFunction),l=a===void 0?void 0:r.kindOf.get(a);if(i===null||l!=="instance-method"&&l!=="class-method")return wn;let d=(e.enclosingFunction??"").split(".").slice(0,-1).join("."),c=t.classByName.get(d),f=t.methods.get(d)?.get(i);if(c===void 0||f===void 0||!s.ids.includes(f))return wn;let p=[];for(let y of s.ids){let b=r.kindOf.get(y);if(b===void 0||b==="function")return wn;p.push(b)}let u=r.below(c),m=r.above(c);for(let y of u){if(y===c)continue;let b=r.nonDefBinds.get(y);if(r.multiBase.has(y)||r.rewrites.has(y)||r.intercepts.has(y)||b===void 0||b===null||b.has(i))return wn;let _=r.classOwner.get(y),S=_?.classQualname.get(y),k=S===void 0?void 0:_?.methods.get(S)?.get(i);if(k!==void 0&&!s.ids.includes(k))return wn}for(let y of m)if(r.intercepts.has(y))return wn;if(r.unplaced.has(c)&&r.intercepts.size>0)return wn;let g=y=>u.has(y)||m.has(y);return r.unplacedAnyName.some(y=>!g(y))||(r.unplacedByName.get(i)??[]).some(y=>!g(y))?wn:{direct:new Set(s.ids),convention:l==="instance-method"?"direct":Bm(p)}}case"name-match":{let i=e.receiver===null||e.receiver.includes(".")?void 0:bE(e.receiver,t,o,r.decls),a=i===void 0?void 0:r.classOwner.get(i),l=i===void 0?void 0:a?.classQualname.get(i),d=l===void 0||e.attr===null?void 0:a?.methods.get(l)?.get(e.attr),c=d===void 0?void 0:r.kindOf.get(d);return d===void 0||c===void 0||c==="function"||!s.ids.includes(d)?wn:{direct:new Set([d]),convention:Bm([c])}}default:return wn}}function bE(e,n,t,s){let r=n.moduleBindings?.get(e);if(r==="class")return n.classByName.get(e);let o=t?.names.get(e);if(r!=="import"||o===void 0||n.aliases.get(e)?.rows!==1)return;let i=s.get(o.moduleId);return i?.moduleBindings?.get(o.name)==="class"?i.classByName.get(o.name):void 0}function _E(e,n,t,s=[]){let r=n.args,o=t==="shifted"&&r?.[0]?.kind!=="positional"?"unknown":t;return{...r!==null?{args:r.map((i,a)=>SE(e,i,a,s[a]===!0)),convention:o}:{},...n.receiverRange!==null?{receiverRange:lr(e,n.receiverRange)}:{},repeats:n.repeats}}function SE(e,n,t,s){return{index:t,...n.kind==="keyword"&&n.keyword!==void 0?{keyword:n.keyword}:{},spread:n.kind==="star"?"positional":n.kind==="double-star"?"keyword":!1,range:lr(e,n),...s?{primitive:!0}:{}}}function xE(e){return e===void 0?{}:{calleeDecl:e.calleeDecl,...e.runtimeId!==void 0?{runtimeId:e.runtimeId}:{},...e.summary!==void 0?{summary:e.summary}:{},...e.receiverPrimitive===!0?{receiverPrimitive:!0}:{}}}var kE=8,wE=new Set(["__new__","__init_subclass__","__class_getitem__"]),Ei=e=>e.map(n=>n.name+"()".repeat(n.calls)).join(".");function vE(e){let n=/^(~|\.*)(.*)$/u.exec(e);if(n===null)return null;let t=[];for(let s of(n[2]??"").split(".")){let r=s.replace(/(?:\(\))+$/u,"");if(r==="")return null;t.push({name:r,calls:(s.length-r.length)/2})}return{lead:n[1]??"",segs:t}}function EE(e){let n=new Map,t=e.moduleBindings;if(t===null)return n;for(let s of e.imports)if(!(s.enclosingFunction!==null||s.guards.includes("type-checking")))for(let r of s.names){let o=r.name.split(".")[0]??r.name,i=r.asname??(s.form==="import"?o:r.name);if(t.get(i)!=="import")continue;let a=s.form==="import"?r.asname!==null?r.name:o:`${".".repeat(s.level)}${s.module!==null&&s.module!==""?`${s.module}.`:""}${r.name}`;n.set(i,a)}return n}function Qm(e,n){let t=new Map;for(let[u,m]of n.modules){let g=new Map;for(let b of m.file.functions)g.set(b.qualname,(g.get(b.qualname)??0)+1);let y=new Map(m.file.functions.filter(b=>g.get(b.qualname)===1).map(b=>[b.qualname,b]));t.set(u,{...m,id:u,imports:EE(m.file),rows:y})}let s=(u,m,g=0)=>{if(g>kE)return null;let y=vE(u);if(y===null)return null;if(y.lead==="~"){let[_,...S]=y.segs;return _===void 0?null:r(m,_,S,g)}let b=y.segs;if(y.lead.length>0){let _=bi(m.dotted,m.isPackage),S=_===""?[]:_.split("."),k=y.lead.length-1;if(k>=S.length)return null;b=[...S.slice(0,S.length-k).map(v=>({name:v,calls:0})),...b]}for(let _=b.length;_>=1;_-=1){if(b.slice(0,_).some(I=>I.calls>0))continue;let S=n.byDotted.get(Ei(b.slice(0,_)));if(S===void 0)continue;let k=t.get(S);if(k===void 0||!k.app)return{kind:"name",text:Ei(b)};let v=b[_];return v===void 0?null:r(k,v,b.slice(_+1),g)}return{kind:"name",text:Ei(b)}},r=(u,m,g,y)=>{let b="()".repeat(m.calls)+g.map(I=>`.${Ei([I])}`).join(""),_=u.file.moduleOrigins?.get(m.name);if(_!==void 0)return s(_+b,u,y+1);let S=u.imports.get(m.name);if(S!==void 0)return s(S+b,u,y+1);let k=u.file.moduleBindings?.get(m.name);if(k==="def"&&m.calls===0){let I=u.decls.topLevel.get(m.name),O=u.rows.get(m.name);return I===void 0||O===void 0?null:{kind:"function",module:u,id:I,row:O,rest:g}}if(k==="class"&&u.decls.classByName.has(m.name))return{kind:"class",module:u,qualname:m.name,calls:m.calls,rest:g};let v=u.file.annotatedAliases?.get(m.name);return v!==void 0&&m.calls===0&&g.length===0?{kind:"annotated",module:u,value:v}:null},o=(u,m)=>{if(u===null)return null;let g=s(u,m);return g?.kind==="name"?g.text:null},i=(u,m)=>u!==null&&m.includes(u),a=(u,m,g)=>u!==null&&m.some(y=>g.some(b=>u===`${y}.${b}()`)),l=new Map,d=new Set,c=(u,m,g)=>{let y=l.get(u);y===void 0?l.set(u,{row:m,regs:[g]}):y.regs.push(g)};for(let u of t.values()){for(let m of u.file.functions){let g=m.decoratorFacts;if(g===null||g.length===0||m.method||m.params===null)continue;let y=u.decls.byQualname.get(m.qualname);if(y===void 0||u.rows.get(m.qualname)!==m)continue;let b=g.map(S=>o(S.origin,u)),_=S=>{let k=b[S]??null;return a(k,zn.apps,zn.decorators)?zn:a(k,Jn.apps,Jn.decorators)?Jn:null};g.forEach((S,k)=>{let v=_(k);if(v===null)return;d.add(y);for(let E=k+1;E<g.length;E+=1)if(_(E)===null)return;let I={path:u.path,start:S.start,end:S.end},O=v===zn?Xm(m,u,s):Ym(m,S.rule);c(y,m,{model:v,at:I,params:O,form:"decorator"})})}for(let m of u.file.calls){let g=m.registration;if(g===null||m.args===null||m.args.length!==g.args.length)continue;let y=o(g.callee,u);if(y===null)continue;let b={path:u.path,start:m.range.start,end:m.range.end},_=(k,v)=>AE(m,k,v),S=k=>{let v=k===null?null:g.args[k]?.origin??null,I=v===null?null:s(v,u);return I?.kind!=="function"||I.rest.length!==0?null:(I.row.decoratorFacts??[null]).length===0?{id:I.id,row:I.row,ctx:I.module}:null};if(zn.apps.some(k=>y===`${k}.${zn.addRoute}`)){let k=S(_("endpoint",1));k!==null&&c(k.id,k.row,{model:zn,at:b,params:Xm(k.row,k.ctx,s),form:"call"})}else if(Jn.apps.some(k=>y===`${k}.${Jn.addRule}`)){let k=S(_("view_func",2)),v=_("rule",0);k!==null&&c(k.id,k.row,{model:Jn,at:b,params:Ym(k.row,v===null?null:g.args[v]?.literal??null),form:"call"})}else if(i(y,Nn.paths)||i(y,Nn.regexes)){let k=i(y,Nn.regexes),v=_("route",0),I=v===null?null:g.args[v]?.literal??null,O=_("view",1),E=O===null?null:g.args[O]?.origin??null,N=E===null?null:s(E,u);if(N?.kind==="function"&&N.rest.length===0&&CE(N.row,N.module,o))c(N.id,N.row,{model:Nn,at:b,params:Jm(N.row,0,I,k),form:"call"});else if(N?.kind==="class"&&N.calls===0&&N.rest.length===1&&N.rest[0]?.name==="as_view"&&N.rest[0].calls===1){let A=N.module.decls.methods.get(N.qualname);for(let U of Nn.methods){let $=A?.get(U),W=N.module.rows.get(`${N.qualname}.${U}`);$===void 0||W===void 0||W.decorated!=="none"||c($,W,{model:Nn,at:b,params:Jm(W,1,I,k),form:"call"})}}}}}let f=[];for(let[u,{regs:m}]of l)for(let g of m)f.push({handler:u,at:g.at,form:g.form});return{functions:e.map(u=>{let m=l.get(u.id),g=m?.row??IE(u,t),y=u;if(m!==void 0){let b=RE(m.row,m.regs);b.length>0&&(y={...y,sourceParams:b})}if(y.valueFlows===void 0&&g!==void 0&&g.valueFlows!==null){let _=m!==void 0||d.has(u.id)||g.valueFlows.some(S=>S.from.kind==="source")?NE(g):null;_!==null&&(y={...y,valueFlows:_})}return y}),registrations:f}}function AE(e,n,t){let s=e.args??[],r=s.findIndex(i=>i.kind==="keyword"&&i.keyword===n);if(r>=0)return r;let o=0;for(let i=0;i<s.length;i+=1){let a=s[i];if(a===void 0)break;if(a.kind==="star"||a.kind==="double-star")return null;if(a.kind==="positional"){if(o===t)return i;o+=1}}return null}function IE(e,n){let t=n.get(e.moduleId);if(t===void 0)return;let s=e.id.slice(`${e.moduleId}#`.length);return t.decls.byQualname.get(s)===e.id?t.rows.get(s):void 0}function NE(e){if(e.params===null)return null;let n;if(!e.method)n="none";else if(e.decorated==="staticmethod")n="none";else if(e.decorated==="none"&&!wE.has(e.name)||e.decorated==="classmethod")n="first";else return null;if(n==="first"){let t=e.params[0];if(t===void 0||t.kind!=="positional"&&t.kind!=="positional-only")return null}return oo(e.valueFlows,n,e.params.length)}function RE(e,n){let t=e.method&&e.decorated!=="staticmethod"?1:0,s=new Map,r=[...n].sort((o,i)=>o.at.path.localeCompare(i.at.path)||o.at.start-i.at.start);for(let o of r)for(let i of[...o.params].sort((a,l)=>a-l)){let a=i-t;a<0||s.has(a)||s.set(a,{index:a,sourceClass:o.model.sourceClass,model:o.model.id,registeredAt:o.at})}return[...s.values()].sort((o,i)=>o.index-i.index)}function Xm(e,n,t){let s=new Set,r=(a,l)=>{if(a===null)return null;let d=t(a,l);return d?.kind==="name"?d.text:null},o=(a,l)=>a!==null&&zn.depends.includes(r(a.callee,l)??""),i=(a,l)=>zn.schemes.includes(r(a.arg0,l)??"");return(e.params??[]).forEach((a,l)=>{let d=e.paramFacts?.[l]??null;if(d===null){s.add(l);return}let c=d.annotated!==null?{value:d.annotated,from:n}:null;if(c===null&&d.annotation!==null){let u=t(d.annotation,n);u?.kind==="annotated"&&(c={value:u.value,from:u.module})}let f=c!==null?r(c.value.type,c.from):r(d.annotation,n),p=[];o(d.default,n)&&d.default!==null&&p.push({call:d.default,from:n});for(let u of c?.value.meta??[])u!==null&&c!==null&&o(u,c.from)&&p.push({call:u,from:c.from});if(p.length>0){p.some(m=>i(m.call,m.from)||m.call.arg0===null&&zn.forms.includes(f??""))&&s.add(l);return}zn.injected.includes(f??"")||s.add(l)}),s}var OE=/<(?:[a-zA-Z_][a-zA-Z0-9_]*(?:\([^)]*\))?:)?([a-zA-Z_][a-zA-Z0-9_]*)>/gu;function Ym(e,n){let t=n===null?null:new Set([...n.matchAll(OE)].map(s=>s[1]));return Zm(e,0,t)}function Jm(e,n,t,s){let r=e.params??[],o=r[n];if(o===void 0||o.kind!=="positional"&&o.kind!=="positional-only")return new Set;let i=new Set([n]);if(t===null)return r.forEach((c,f)=>{f>n&&i.add(f)}),i;let a=s?[...t.matchAll(/\(\?P<([^>]+)>/gu)].map(c=>c[1]):[...t.matchAll(/<(?:[^>:]+:)?([^>]+)>/gu)].map(c=>c[1]);if(a.length>0){for(let c of Zm(e,n+1,new Set(a)))i.add(c);return i}let l=s?[...t.matchAll(/(?<!\\)\((?!\?)/gu)].length:0,d=0;return r.forEach((c,f)=>{f<=n||d>=l||(c.kind==="positional"||c.kind==="positional-only"?(i.add(f),d+=1):c.kind==="rest"&&(i.add(f),d=l))}),i}function Zm(e,n,t){let s=new Set,r=t===null||t.size>0;return(e.params??[]).forEach((o,i)=>{i<n||(o.kind==="keyword-rest"?r&&s.add(i):(o.kind==="positional"||o.kind==="keyword-only")&&(t===null||t.has(o.name))&&s.add(i))}),s}var PE=new Set([...Nn.passThrough,Nn.apiView,...Nn.apiViewSetters]);function CE(e,n,t){let s=e.decoratorFacts;return s===null?!1:s.every(r=>PE.has(t(r.origin,n)??""))}var ME=5e3,eg=200,ng=100,TE=new Set(["args","params","flows"]),tg={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function sg(e){return`pkg:${e}`}function At(e){return e.split(/[\\/]+/u).join("/")}function gd(e,n){let t=e.endsWith("/")?e:`${e}/`,s=At(n),r=At(t);return s.startsWith(r)?s.slice(r.length):null}function rg(e){let n=At(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let s=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),s].filter(r=>r!=="").join("."),isPackage:!1}}function hd(e){return e.split(".")[0]??e}var $E="site-packages:";function yd(e){let n=e.extract??cr,t=e.maxModules??ME,s=(e.externalRoots??[]).map(R=>At(R).endsWith("/")?At(R):`${At(R)}/`),r=R=>{let D=At(R);return s.find(Y=>D.startsWith(Y))??null},o=R=>r(R)!==null,i=[],a=new Map,l=[],d=[],c=new Set,f=new Set,p=new Map,u=new Map,m=[],g=[],y=new Map,b=new Set,_=new Set,S=[],k=0,v=()=>{let R=`py-export:${String(k)}`;return k+=1,R},I=null,O=!1,E=new Set,N=new Set,A=new Map,U=new Map,$=Em(R=>{let D=Wt(e.paths,R).resolved;return D!==null&&gd(e.projectRoot,D.path)!==null&&!o(D.path)}),W=new Map,w=[];for(let R of e.entryFiles){let D=gd(e.projectRoot,R);if(D===null){i.push({code:"unresolved-import",where:At(R),detail:"entrypoint lies outside the project root; not analyzed"});continue}c.has(R)||(c.add(R),w.push({file:R,rel:D,isEntry:!0,packageName:"",modulePath:D}))}let P=R=>{let D=sg(R);return a.has(D)||(f.add(R),a.set(D,{id:D,packageName:R,versionRange:"",path:R,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),D},j=0,F=(R,D,Y,H)=>{let ee=`py-import:${String(j)}`;j+=1,l.push({id:ee,moduleId:R,specifier:D,...Y!==null?{resolvedModuleId:Y}:{},isNamespace:!1,isDefault:!1,dynamic:H,specifierIsLiteral:!0}),Y!==null&&d.push({importId:ee,resolvedModuleId:Y})};for(let R=0;R<ng&&w.length>0;R+=1){let D=w.slice(0,eg);w=w.slice(eg);let Y=n(D.map(ee=>ee.file),e.python!==void 0?{python:e.python,hints:$}:{hints:$});if(I??=Y.interpreter,E.size===0&&Y.stdlib.length>0&&(E=new Set(Y.stdlib)),N.size===0&&Y.builtins.length>0&&(N=new Set(Y.builtins)),A.size===0&&Y.typeAttrs.size>0&&(A=Y.typeAttrs),Y.refused!==null)return i.push({code:"extract-refused",where:"",detail:`${Y.refused}: ${Y.diagnostics.join("; ")}`}),{graph:tg,diagnostics:i,interpreter:Y.interpreter,counts:{modules:0,surfaces:0},opaqueCode:[]};let H=new Map(Y.files.map(ee=>[ee.path,ee]));for(let ee of D){let le=H.get(ee.file),de=ee.rel,ge=rg(ee.modulePath);if(U.set(de,ge),a.set(de,{id:de,packageName:ee.packageName,versionRange:"",path:ee.modulePath,moduleSystem:"dual",isEntrypoint:ee.isEntry}),le===void 0||le.refused!==null){i.push({code:"file-refused",where:ee.rel,detail:le?.refused??"no row was returned for this file"});continue}B(le,de,ge),x(le,ee.rel);let ve=le.truncated.filter(Re=>!TE.has(Re));ve.length>0&&i.push({code:"extract-truncated",where:ee.rel,detail:`the extract stopped at its per-file bound for ${ve.join(", ")}; what lies past it is not in this graph`}),p.set(de,cd(le,de,ee.rel,v)),u.set(de,Z(le,de,ge)),W.set(de,{file:le,decls:p.get(de),dotted:ge.dotted,isPackage:ge.isPackage,app:ee.packageName==="",path:ee.rel});for(let Re of le.calls)m.push({moduleId:de,path:ee.rel,call:Re});for(let Re of le.escapes){if(Re.kind!=="attr-rebind")continue;let _e=Re.attr??null;_e===null||Re.target===null||S.push({moduleId:de,attr:_e,target:Re.target})}}}function B(R,D,Y){for(let H of R.imports){if(H.guards.includes("type-checking"))continue;let ee=[];if(H.level>0){let ge=rr(Y.dotted,Y.isPackage,H.level,H.module);if("failure"in ge){i.push({code:"unresolved-import",where:R.path,detail:`relative import (level ${String(H.level)}) ${ge.failure}`});continue}ee.push(ge.dotted);for(let ve of H.names)ee.push(`${ge.dotted}.${ve.name}`)}else if(H.module!==null){ee.push(H.module);for(let ge of H.names)ee.push(`${H.module}.${ge.name}`)}else continue;let le=!1,de=new Set;for(let ge of ee)ne(ge,D,H.deferred,de)&&(le=!0);if(de.size>0&&g.push({moduleId:D,path:D,enclosingFunction:H.enclosingFunction,at:H.range.start,shape:"require",targets:[...de]}),!le){let ge=ee[0]??"";F(D,ge,null,H.deferred);let ve=hd(ge);if(E.has(ve)||H.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf(ve)===null)continue;i.push({code:"unresolved-import",where:R.path,detail:`\`${ge}\` did not resolve on the search path`})}}}function ne(R,D,Y,H){let ee=R.split("."),le=!1;for(let de=1;de<=ee.length;de+=1){let ge=ee.slice(0,de).join("."),ve=Wt(e.paths,ge);if(ve.resolved===null)continue;let Re=Q(ve.resolved,D,ge,Y);Re!==null&&H.add(Re),de===ee.length&&(le=!0)}return le}function X(R){return c.has(R.file)||a.has(R.rel)?!0:c.size>=t?(O||(O=!0,i.push({code:"module-cap",where:R.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(c.add(R.file),w.push(R),!0)}function Q(R,D,Y,H){if(R.kind==="stub-only")return null;let ee=R.kind==="module"||R.kind==="package",le=gd(e.projectRoot,R.path);if(le!==null&&!o(R.path)&&ee){let Re=le;return F(D,Y,Re,H),y.set(Y,Re),X({file:R.path,rel:le,isEntry:!1,packageName:"",modulePath:le}),Re}let de=e.distributionOf(hd(Y));if(de===null)return F(D,Y,null,H),i.push({code:"unresolved-import",where:Y,detail:`resolved to ${R.kind} outside the project, but no installed distribution provides \`${hd(Y)}\``}),null;let ge=r(R.path);if(!ee||ge===null)return F(D,Y,P(de),H),b.add(Y),(R.kind==="extension"||ee&&ge===null)&&_.add(Y),null;let ve=`${$E}${At(R.path).slice(ge.length)}`;return F(D,Y,ve,H),y.set(Y,ve),X({file:R.path,rel:ve,isEntry:!1,packageName:de,modulePath:At(R.path).slice(ge.length)}),ve}function Z(R,D,Y){let H=new Map,ee=new Map,le=new Set,de=new Map,ge=(_e,Ke)=>{le.add(_e),de.set(_e,Ke)},ve=[],Re=_e=>E.has(_e.split(".")[0]??_e)||b.has(_e);for(let _e of R.imports){if(_e.guards.includes("type-checking"))continue;let Ke=_e.module;if(_e.level>0){let ze=rr(Y.dotted,Y.isPackage,_e.level,_e.module);if("failure"in ze)continue;Ke=ze.dotted}if(Ke!==null){if(_e.star){let ze=y.get(Ke);ze!==void 0&&!ve.includes(ze)&&ve.push(ze)}if(_e.form==="import"){let ze=_e.names[0]?.asname??null;if(ze!==null){let K=y.get(Ke);K!==void 0?H.set(ze,K):Re(Ke)&&ge(ze,Ke);continue}let pn=Ke.split(".")[0]??Ke,vn=y.get(pn)??y.get(Ke);vn!==void 0?H.set(pn,vn):Re(pn)&&ge(pn,pn);continue}for(let ze of _e.names){let pn=ze.asname??ze.name,vn=y.get(`${Ke}.${ze.name}`);if(vn!==void 0){H.set(pn,vn);continue}let K=y.get(Ke);K!==void 0?ee.set(pn,{moduleId:K,name:ze.name}):(Re(Ke)||Re(`${Ke}.${ze.name}`))&&ge(pn,`${Ke}.${ze.name}`)}}}return H.set("",D),{modules:H,names:ee,external:le,externalOrigins:de,stars:ve}}function x(R,D){for(let Y of R.escapes)switch(Y.kind){case"loader-escape":i.push({code:"loader-escape",where:D,detail:`${Y.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":i.push({code:"dynamic-load-set",where:D,detail:`${Y.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":i.push({code:"module-registry-write",where:D,detail:`${Y.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let H=Y.target;if(H===null)break;let ee=new Set;ne(H,D,!0,ee),ee.size>0&&g.push({moduleId:D,path:D,enclosingFunction:Y.enclosingFunction,at:Y.range.start,shape:"dynamic-import",targets:[...ee]});break}case"dispatch-escape":break}}w.length>0&&i.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(ng)} waves; the graph is INCOMPLETE`});let T=new Map;for(let[R,D]of y){let Y=R.lastIndexOf(".");if(Y<0)continue;let H=y.get(R.slice(0,Y));if(H===void 0||H===D)continue;let ee=T.get(H)??new Map;ee.set(R.slice(Y+1),D),T.set(H,ee)}let q=ud({decls:p,envs:u,pending:m,rebinds:S,loads:g,children:T,preciseNames:e.preciseNames!==!1,...e.nameMatchLabel===!0?{nameMatchLabel:!0}:{},runtime:{builtins:N,typeAttrs:A,stdlib:E,placed:R=>{let D=y.get(R);return D!==void 0?{kind:"module",id:D}:b.has(R)?{kind:"surface"}:null},packageOf:R=>a.get(R)?.packageName,dottedOf:R=>U.get(R)}}),{functions:G,registrations:z}=Qm(q.functions,{modules:W,byDotted:y}),L=new Map;for(let R of q.callSites)R.id.startsWith("py-call:")&&L.set(`${R.range.path}${String(R.range.start)}${String(R.range.end)}`,R.id);let ie=[],me=new Set;for(let R of z){let D=R.form==="decorator"?R.at.end:R.at.start,Y=L.get(`${R.at.path}${String(D)}${String(R.at.end)}`);Y===void 0||me.has(`${Y}${R.handler}`)||(me.add(`${Y}${R.handler}`),ie.push({callSiteId:Y,calleeFunctionId:R.handler,resolution:"field-based",invocation:"callback"}))}let be=[...p.values()].flatMap(R=>R.classes),Me=[...p.values()].flatMap(R=>R.exports),re=[...p.values()].flatMap(R=>R.exportBindings);return{graph:{...tg,modules:[...a.values()],imports:l,importEdges:d,functions:G,classes:be,exports:Me,exportBindings:re,callSites:q.callSites,callEdges:[...q.callEdges,...ie],inheritEdges:q.inheritEdges},diagnostics:i,interpreter:I,counts:{modules:a.size-f.size,surfaces:f.size},opaqueCode:[..._].sort()}}import{readdirSync as LE,readFileSync as ig,statSync as Ai}from"node:fs";import On from"node:path";import{spawnSync as DE}from"node:child_process";var FE="python3",jE=256*1024,BE=8*1024*1024,ag=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,GE=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function cs(e){try{return Ai(e).isFile()}catch{return!1}}function og(e){try{return Ai(e).isDirectory()}catch{return!1}}function KE(e,n){return On.relative(e,n).split(On.sep).join("/")}function zE(e){let n=e.python??process.env.CUPEL_PYTHON??FE,t=DE(n,["-I","-S",...so("metadata.py"),e.projectRoot],{encoding:"utf8",maxBuffer:BE,timeout:6e4}),s=l=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:l}]});if(t.error!==void 0||t.status!==0)return s("the declared entry surface could not be read; it is unknown, not empty");let r;try{r=JSON.parse(t.stdout)}catch{return s("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof r!="object"||r===null)return{entries:[],projectName:null,gaps:[]};let o=r,i=(Array.isArray(o.entryPoints)?o.entryPoints:[]).filter(l=>typeof l=="object"&&l!==null&&typeof l.name=="string"&&typeof l.target=="string"&&typeof l.kind=="string"),a=(Array.isArray(o.gaps)?o.gaps:[]).flatMap(l=>{if(typeof l!="object"||l===null)return[];let d=l,c=typeof d.file=="string"?d.file:"",f=typeof d.why=="string"?d.why:"";return[{source:"metadata",declaration:c,detail:f==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":f}]});return{entries:i,gaps:a,projectName:typeof o.projectName=="string"?o.projectName:null}}function bd(e,n){let t=ag.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let s=t[1]??"",r=Wt(e.paths,s);if(r.resolved===null)return{detail:`\`${s}\` ${r.failure??"did not resolve"}`};if(r.resolved.kind==="namespace"||r.resolved.kind==="stub-only")return{detail:`\`${s}\` resolved to a ${r.resolved.kind}, which runs no code`};let o=KE(e.projectRoot,r.resolved.path);return o.startsWith("..")?{detail:`\`${s}\` resolves outside the project root; not seeded`}:{file:o}}function WE(e){let n=[];cs(On.join(e,"__main__.py"))&&n.push("__main__.py");let t=(s,r)=>{let o;try{o=LE(s).sort()}catch{return}for(let i of o){if(i.startsWith("."))continue;let a=On.join(s,i);og(a)&&cs(On.join(a,"__init__.py"))&&cs(On.join(a,"__main__.py"))&&n.push(`${r}${i}/__main__.py`)}};return t(e,""),og(On.join(e,"src"))&&t(On.join(e,"src"),"src/"),n}function UE(e,n){let t=On.join(e,"Procfile");if(!cs(t))return[];let s;try{if(Ai(t).size>n)return[];s=ig(t,"utf8")}catch{return[]}let r=[];for(let o of s.split(/\r?\n/u)){let i=GE.exec(o);i?.[1]!==void 0&&r.push(i[1])}return r}var HE=256*1024,qE=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,VE=/^\s*WORKDIR\s+(\S+)\s*$/imu,XE=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,YE=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,JE=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function QE(e){let n=VE.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let s=XE.exec(t),r=s?.[1],o=s?.[2]?.replace(/\/+$/u,"");if(r===void 0||o===void 0||o!==n)continue;let i=r.replace(/\/+$/u,"");return i==="."?null:i}return null}function ZE(e,n){let t=[],s=o=>{let i=On.join(e,o);if(!cs(i))return null;try{return Ai(i).size>n?null:ig(i,"utf8")}catch{return null}},r=s("Dockerfile");if(r!==null){let o=QE(r);for(let i of r.split(/\r?\n/u)){let a=qE.exec(i);a?.[1]!==void 0&&t.push({command:a[1],from:"Dockerfile",srcRoot:o})}}for(let o of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let i=s(o);if(i!==null)for(let a of i.split(/\r?\n/u)){let l=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(a);l?.[1]!==void 0&&t.push({command:l[1],from:o,srcRoot:null})}}return t}function e0(e,n,t){let s=e.projectRoot,r=JE.exec(n)?.[1];if(r!==void 0){for(let a of t===null?[r]:[On.join(t,r),r])if(cs(On.join(s,a)))return{file:a}}let o=YE.exec(n)?.[1];if(o===void 0)return r===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${r}\` is not a file in this repository`};let i=ag.exec(o)?.[1]??"";for(let a of t===null?[""]:[t,""])for(let l of[`${i.replace(/\./gu,"/")}.py`,`${i.replace(/\./gu,"/")}/__init__.py`]){let d=a===""?l:On.join(a,l);if(cs(On.join(s,d)))return{file:d}}return bd(e,o)}function _d(e){let n=[],t=[],s=new Set,r=(a,l,d)=>{let c=`${a} ${l}`;s.has(c)||(s.add(c),n.push({file:a,source:l,declaration:d}))},o=zE(e);t.push(...o.gaps);for(let a of o.entries){let l=a.kind==="entry-point-group"?"entry-point-group":"console-script",d=bd(e,a.target);"file"in d?r(d.file,l,`${a.name} = ${a.target}`):t.push({source:l,declaration:`${a.name} = ${a.target}`,detail:d.detail})}for(let a of WE(e.projectRoot))r(a,"dunder-main",a);cs(On.join(e.projectRoot,"manage.py"))&&r("manage.py","manage-py","manage.py");let i=e.maxProcfileBytes??jE;for(let a of UE(e.projectRoot,i)){let l=bd(e,a);"file"in l?r(l.file,"launch-declaration",a):t.push({source:"launch-declaration",declaration:a,detail:l.detail})}for(let a of ZE(e.projectRoot,HE)){let l=e0(e,a.command,a.srcRoot),d=`${a.from}: ${a.command.trim()}`;"file"in l?r(l.file,"launch-declaration",d):t.push({source:"launch-declaration",declaration:d,detail:l.detail})}return{entrypoints:n,gaps:t,projectName:o.projectName}}var H$=256*1024*1024;var lg="CUPEL_PYTHON",t0=["-I","-S"],s0="python3",r0=256*1024*1024,o0=12e4,i0=512,dg=2e4,pg=new Set(["str","bytes","int","float","complex","bool","none","scalar","tuple","list","dict","set"]),a0=new Set(["module","local-def","local","class"]);function we(e,n=i0){return typeof e=="string"&&e.length<=n?e:null}function Os(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function lo(e){let n=Pn(e)?e:{};return{line:Os(n.line),endLine:Os(n.endLine),col:Os(n.col),start:Os(n.start),end:Os(n.end)}}function Pn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function us(e){return Array.isArray(e)?e:[]}function ur(e){return us(e).map(n=>we(n))}function fs(e,n){return Number.isSafeInteger(e)&&Number.isSafeInteger(n)&&e>=0&&n>=e?{start:e,end:n}:null}var l0={o:"positional-only",p:"positional",r:"rest",k:"keyword-only",K:"keyword-rest"},d0={p:"positional",s:"star",k:"keyword",d:"double-star"};function fr(e,n){if(!Array.isArray(e))return null;let t=[];for(let s of e){let r=Array.isArray(s)?n(s):null;if(r===null)return null;t.push(r)}return t}function c0(e){return fr(e,([n,t,s,r,o])=>{let i=typeof n=="string"?l0[n]:void 0,a=we(t),l=fs(r,o);return i===void 0||a===null||a===""||typeof s!="boolean"||l===null?null:{kind:i,name:a,hasDefault:s,...l}})}function u0(e){return fr(e,([n,t,s,r])=>{let o=typeof n=="string"?d0[n]:void 0,i=fs(t,s);if(o===void 0||i===null)return null;if(o!=="keyword")return r===void 0?{kind:o,...i}:null;let a=we(r);return a!==null&&a!==""?{kind:o,keyword:a,...i}:null})}var f0=new Set(["def","class","import","other","multi"]);function cg(e){if(!Pn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e))we(t)!==null&&typeof s=="string"&&f0.has(s)&&n.set(t,s);return n}var p0=new Map([["c","copy"],["d","derive"],["f","field"],["w","await"],["r","return"],["a","argument"],["m","mutation"]]),m0=new Map([["m","module"],["g","global"],["u","unknown"]]),g0=new Set(["unmodeled","reflective","inner-function-param","caught","construct"]),h0=256;function ug(e,n){return Number.isSafeInteger(e)&&e>=n&&e<h0?e:null}function y0(e,n){let[t,s,r,o]=e;switch(t){case"p":{let i=e.length===2&&n?ug(s,0):null;return i===null?null:{kind:"declared-param",index:i}}case"l":{let i=we(s);return e.length===3&&i!==null&&i!==""&&Number.isSafeInteger(r)&&r>=0?{kind:"local",name:i,declStart:r}:null}case"f":{let i=we(s),a=m0.get(r);return e.length===3&&i!==null&&i!==""&&a!==void 0?{kind:"free",name:i,binding:a}:null}case"c":case"r":{let i=e.length===3?fs(s,r):null;return i===null?null:{kind:t==="c"?"call-result":"call-receiver",at:i.start,end:i.end}}case"a":case"m":{let i=e.length===4?fs(s,r):null,a=ug(o,t==="m"?-1:0);return i===null||a===null?null:{kind:t==="a"?"argument":"mutated-by-call",at:i.start,end:i.end,index:a}}case"R":return e.length===1?{kind:"return"}:null;case"k":return e.length===1?{kind:"constant"}:null;case"s":{let i=e.length===2?we(s):null;return i===null?null:vm(i)}case"o":return e.length===2&&g0.has(s)?{kind:"opaque",reason:s}:null;default:return null}}function fg(e,n){if(!Pn(e))return null;let t=e.refs,s=e.edges;if(!Array.isArray(t)||!Array.isArray(s)||s.length>dg||t.length>2*dg)return null;let r=fr(t,o=>y0(o,n));return r===null?null:fr(s,([o,i,a])=>{let l=Number.isSafeInteger(o)?r[o]:void 0,d=Number.isSafeInteger(i)?r[i]:void 0,c=p0.get(a);return l===void 0||d===void 0||c===void 0?null:{from:l,to:d,kind:c}})}var b0=/^(?:~|\.*)[^\s.()~]+(?:\(\))*(?:\.[^\s.()~]+(?:\(\))*)*$/u,_0=2048;function ps(e){let n=we(e);return n!==null&&b0.test(n)?n:null}function mg(e){return we(e,_0)}function gg(e){return Array.isArray(e)&&e.length===2?{callee:ps(e[0]),arg0:ps(e[1])}:null}function hg(e){return!Pn(e)||!Array.isArray(e.m)?null:{type:ps(e.t),meta:e.m.map(gg)}}function S0(e){return fr(e,([n,t,s,r])=>{let o=fs(t,s);return o===null?null:{origin:ps(n),rule:mg(r),...o}})}function x0(e){return Array.isArray(e)?e.map(n=>{if(!Array.isArray(n)||n.length!==2)return null;let t=n[1];return{default:gg(n[0]),annotated:hg(t),annotation:Pn(t)?ps(t.o):null}}):null}function k0(e){if(!Array.isArray(e)||e.length!==2||!Array.isArray(e[1]))return null;let n=e[1].map(t=>Array.isArray(t)?{origin:ps(t[0]),literal:mg(t[1])}:{origin:null,literal:null});return{callee:ps(e[0]),args:n}}function Sd(e,n){if(!Pn(e))return null;let t=new Map;for(let[s,r]of Object.entries(e)){let o=n(r);we(s)!==null&&o!==null&&t.set(s,o)}return t}var w0=/^(?:~|\.*)[^\s.()~]+(?:\.[^\s.()~]+)*$/u;function v0(e){let n=we(e);return n!==null&&w0.test(n)?n:null}function yg(e){if(!Array.isArray(e)||e.length<1||e.length>2||!pg.has(e[0]))return null;let n=e[0];if(e.length===1)return{type:n};let t=we(e[1]);return t!==null&&t!==""?{type:n,unlessWritten:t}:null}function E0(e,n){return!Array.isArray(e)||n===null||e.length!==n.length?null:e.map(t=>t===null?null:yg(t))}var A0=new Set(["none","staticmethod","classmethod","other"]);function Ii(e){if(!Array.isArray(e))return null;let n=new Set;for(let t of e){let s=we(t);if(s===null)return null;n.add(s)}return n}function I0(e){if(e===!0)return{kind:"lambda"};if(e===!1)return{kind:"const"};if(e===null)return{kind:"other"};let n=we(e);return n!==null&&n!==""?{kind:"name",dotted:n}:null}function N0(e){if(!Array.isArray(e))return null;let n=e,[t,s]=n;if(t==="k"&&n.length===1)return{kind:"const"};if(t==="l"&&n.length===1)return{kind:"lambda"};if(t==="o"&&n.length===1)return{kind:"other"};if(t==="n"&&n.length===2){let r=we(s);return r!==null&&r!==""?{kind:"name",dotted:r}:null}if(t==="p"&&n.length===2&&Array.isArray(s)){let r=[];for(let o of s){let i=I0(o);if(i===null)return null;r.push(i)}return{kind:"property",accessors:r}}return null}function xd(e){return fr(e,([n,t,s])=>{let r=we(n),o=N0(t);return r===null||r===""||o===null||!Number.isSafeInteger(s)||s<0?null:{name:r,value:o,at:s}})}function R0(e){if(!Pn(e))return null;let n=new Map;for(let[t,s]of Object.entries(e)){let r=we(t)===null?null:xd(s);if(r===null)return null;n.set(t,r)}return n}var O0=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),P0=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function C0(e,n){if(n!==null)return[];let t=e.truncated;return Array.isArray(t)?t.map(s=>we(s,64)??"unreadable"):["unreported"]}function M0(e){let n=u0(e.args);return{args:n,calleeOrigin:v0(e.calleeOrigin),receiverProof:yg(e.receiverProof),argProofs:E0(e.argProofs,n)}}function T0(e){let n=we(e.path,4096);if(n===null)return null;let t=e.refused,s=typeof t=="string"&&P0.has(t)?t:null,r=we(e.detail,200),o=us(e.imports).filter(Pn).map(S=>({form:S.form==="import"?"import":"from",module:we(S.module),level:Os(S.level),names:us(S.names).filter(Pn).map(k=>({name:we(k.name)??"",asname:we(k.asname)})).filter(k=>k.name!==""),star:S.star===!0,deferred:S.deferred===!0,enclosingFunction:we(S.enclosingFunction),guards:ur(S.guards).filter(k=>k!==null),range:lo(S.range)})),i=us(e.functions).filter(Pn).flatMap(S=>{let k=we(S.name),v=we(S.qualname);return k===null||v===null?[]:[{name:k,qualname:v,kind:S.kind==="async-function"?"async-function":"function",enclosingClass:we(S.enclosingClass),enclosingFunction:we(S.enclosingFunction),decorators:ur(S.decorators),range:lo(S.range),params:c0(S.params),method:S.method===!0,decorated:typeof S.decorated=="string"&&A0.has(S.decorated)?S.decorated:"other",rebound:S.rebound!==!1,reflective:S.reflective!==!1,valueFlows:fg(S.flows,!0),decoratorFacts:S0(S.decoratorFacts),paramFacts:x0(S.paramFacts)}]}),a=us(e.classes).filter(Pn).flatMap(S=>{let k=we(S.name),v=we(S.qualname);return k===null||v===null?[]:[{name:k,qualname:v,bases:ur(S.bases),decorators:ur(S.decorators),range:lo(S.range),metaclass:S.metaclass===null?null:we(S.metaclass)??"?",rebound:S.rebound!==!1,interceptsLookup:S.interceptsLookup!==!1,nonDefBinds:Ii(S.nonDefBinds),valueBases:Array.isArray(S.valueBases)?ur(S.valueBases):null}]}),l=us(e.calls).filter(Pn).map(S=>({...M0(S),callee:we(S.callee),attr:we(S.attr),receiver:we(S.receiver),enclosingFunction:we(S.enclosingFunction),argCount:Os(S.argCount),range:lo(S.range),receiverRange:Array.isArray(S.receiverRange)?fs(S.receiverRange[0],S.receiverRange[1]):null,root:S.root===null?null:S.root==="param0"||S.root==="global"?S.root:"other",nameScope:S.nameScope===null&&S.callee===null?null:a0.has(S.nameScope)?S.nameScope:"local",raisedCall:Array.isArray(S.raisedCall)?fs(S.raisedCall[0],S.raisedCall[1]):null,repeats:S.repeats!==!1,registration:k0(S.registration)})),d=us(e.escapes).filter(Pn).flatMap(S=>{let k=S.kind,v=we(S.callee);return typeof k!="string"||!O0.has(k)||v===null?[]:[{kind:k,callee:v,target:we(S.target),attr:we(S.attr),enclosingFunction:we(S.enclosingFunction),range:lo(S.range)}]}),c=e.all,f=Array.isArray(c)?ur(c).filter(S=>S!==null):null,p=Ii(e.attrWrites),u=R0(e.classBinds),m=xd(e.moduleBinds),g=xd(e.dunderWrites),y=cg(e.moduleBindings),b=C0(e,s),_=u===null&&a.length>0||m===null&&(y===null||y.has("__getattr__")||y.has("__dir__"))||g===null&&(p===null||[...p].some(S=>/^__.+__$/u.test(S))||l.length>0||i.length>0);return s===null&&_&&!b.includes("bindings")&&b.push("bindings"),{path:n,refused:s,...r!==null?{detail:r}:{},imports:o,functions:i,classes:a,calls:l,toplevelFlows:fg(e.toplevelFlows,!1),flowsRefused:e.flowsRefused===null?null:we(e.flowsRefused,64)??"unreadable",escapes:d,all:f,allComputed:e.allComputed===!0,truncated:b,moduleBindings:y,staticBindings:y===null?cg(e.staticBindings):null,attrWrites:p,starImport:e.starImport!==!1,moduleOrigins:Sd(e.moduleOrigins,ps),annotatedAliases:Sd(e.annotatedAliases,hg),moduleCalls:Sd(e.moduleCalls,S=>Array.isArray(S)&&S.length===2?fs(S[0],S[1]):null),valueNames:Ii(e.valueNames),valueAttrs:Ii(e.valueAttrs),computedAccess:e.computedAccess!==!1,classBinds:u,moduleBinds:m,dunderWrites:g}}function cr(e,n={}){let t=n.env??process.env,s=n.python??t[lg]??s0,r=[],o=e.filter(g=>!g.includes(`
+`));o.length!==e.length&&r.push(`${String(e.length-o.length)} path(s) carried a newline and were not extracted`);let i=[...t0,...so("extract.py")];n.maxBytesPerFile!==void 0&&i.push("--max-bytes",String(n.maxBytesPerFile)),n.hints!==void 0&&i.push("--hints",JSON.stringify(n.hints));let a=n0(s,i,{input:o.length>0?`${o.join(`
 `)}
-`:"",encoding:"utf8",maxBuffer:Gw,timeout:n.timeoutMs??Kw,env:t});if(a.error!==void 0){let h=a.error.code,y=h==="ENOENT";return{refused:y?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...o,y?`no Python interpreter: \`${s}\` is not on PATH (set ${om} to the interpreter this project runs under)`:`the Python extract could not run (${h??a.error.message})`]}}if(a.status!==0){let h=(a.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...o,`the Python extract exited ${String(a.status??"on a signal")}${h!==""?`: ${h}`:""}`]}}let l=(a.stdout??"").split(`
-`).filter(h=>h.trim()!==""),d=null,c=[],p=[],u=new Map,f=[];for(let h of l){let y;try{y=JSON.parse(h)}catch{o.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!Nn(y))continue;if(y.kind==="header"){d=ke(y.interpreter,64);let S=y.stdlib;Array.isArray(S)&&(c=S.filter(b=>typeof b=="string"&&b.length<=128)),p=os(y.builtins).filter(b=>typeof b=="string"&&b.length<=128),u=_v(y.typeAttrs);continue}let _=yv(y);if(_===null){o.push("the Python extract emitted a file row without a path; it was skipped");continue}f.push(_)}if(d===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...o,"the Python extract did not report an interpreter version"]};let m=r.length-f.length;return m>0&&o.push(`${String(m)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:d,files:f,stdlib:c,diagnostics:o,builtins:p,typeAttrs:u}}function _v(e){let n=new Map;if(!Nn(e))return n;for(let[t,s]of Object.entries(e))!dm.has(t)||!Array.isArray(s)||n.set(t,new Set(s.filter(o=>typeof o=="string"&&o.length<=128)));return n}var Sv="python3",xv={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","extract-truncated":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function kv(e,n){let t=xv[e.code];return t!=="dynamic-load"?t:n!==void 0&&n.packageName!==""?"dep-opaque":t}function wv(e,n,t=s=>ai([],{python:s}).refused===null){let s=ws.resolve(e,n.envRel);for(let o of["bin/python3","bin/python","Scripts/python.exe"]){let r=ws.join(s,o);try{if(!bv(r).isFile())continue}catch{continue}if(t(r))return r}return Sv}function vv(e,n){let t=[e];for(let s of n.sitePackages)t.push(ws.resolve(e,s));for(let s of n.pthFiles)for(let o of s.paths)t.push(ws.isAbsolute(o)?o:ws.resolve(e,s.sitePackages,o));return{roots:[...new Set(t)]}}function Ev(e){let n=[];for(let t of e.distInfos){let s=Mo(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});s!==null&&n.push(s)}return n}function hm(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function Av(e,n,t={}){let o=(t.readEnvironment??Ko)(n),r=Ev(o),i=qr(r),a=o.diagnostics.map(b=>b),l=t.python??wv(n,o),d=vv(n,o),c=Cv(o,i,d),p=new Map;for(let b of r)p.set(b.name,Ov(b,c.distributions));for(let b of c.seen)a.push(`startup hook: ${b}`);for(let b of c.unattributed)a.push(`startup escape: ${b} \u2014 a module runs at interpreter start that no installed distribution claims`);let u=jl({projectRoot:n,paths:d,python:l});for(let b of u.gaps)a.push(`entrypoint \`${b.declaration}\` (${b.source}): ${b.detail}`);if(u.entrypoints.length===0)return a.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,graph:no,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:u.gaps,interpreter:null,diagnostics:a,execution:p};let f=Dl({projectRoot:n,paths:d,entryFiles:u.entrypoints.map(b=>ws.join(n,b.file)),environmentComplete:!o.truncated&&o.refused===null,externalRoots:o.sitePackages.map(b=>ws.resolve(n,b)),distributionOf:hm(i),python:l,...t.maxModules!==void 0?{maxModules:t.maxModules}:{},preciseNames:t.preciseNames!==!1});for(let b of f.diagnostics)a.push(`${b.code} at ${b.where}: ${b.detail}`);if(f.graph.modules.length===0)return{rootRel:e,graph:no,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:f.interpreter,diagnostics:a,execution:p};let m=new Map;for(let b of f.graph.modules)m.set(b.id,b.id),m.set(b.path,b.id);let h=new Map(f.graph.modules.map(b=>[b.id,b])),y=b=>h.get(b)??h.get(m.get(b)??""),_=f.graph.modules[0]?.id,S=f.diagnostics.map(b=>{let k=y(b.where);return{source:k?.id??_,cause:kv(b,k),reach:{kind:"unbounded"}}});if(c.unattributed.length>0&&S.push({source:_,cause:"dynamic-load",reach:{kind:"unbounded"}}),S.push(...Iv(f.graph)),f.opaqueCode.length>0){let b=f.graph.modules.find(w=>w.isEntrypoint)?.id??_,k=Nv(f.graph,f.opaqueCode,r);S.push({source:b,cause:"dep-opaque",reach:{kind:"loaded-package",ecosystem:"PyPI",alsoLoaded:k}}),a.push(`code no analysis reads is loaded (${mm(f.opaqueCode)}): a loaded package is not reported unreachable, and neither is any of the ${String(k.length)} package(s) in the declared-dependency closure of the distributions that ship it (${mm(k)})`)}return{rootRel:e,graph:f.graph,incompleteness:S,analysisAborted:null,entrypoints:u.entrypoints,entrypointGaps:u.gaps,interpreter:f.interpreter,diagnostics:a,execution:p}}var mm=e=>`${e.slice(0,5).join(", ")}${e.length>5?", \u2026":""}`;function Nv(e,n,t){let s=new Set(e.modules.map(c=>c.packageName).filter(c=>c!=="")),o=new Map;for(let c of t){let p=o.get(c.name);if(p===void 0)o.set(c.name,new Set(c.requiresDist));else for(let u of c.requiresDist)p.add(u)}let r=new Set,i=qr(t),a=hm(i);for(let c of n){let p=a(c.split(".")[0]??c);p!==null&&r.add(p);for(let u of To(i,c))r.add(u.name)}for(let c of t)s.has(c.name)&&(c.extensionModules>0||!c.recordKnown)&&r.add(c.name);let l=new Set,d=[...r];for(let c=d.pop();c!==void 0;c=d.pop())if(!l.has(c)){l.add(c);for(let p of o.get(c)??[])o.has(p)&&!l.has(p)&&d.push(p)}return[...l].sort((c,p)=>c<p?-1:c>p?1:0)}function Iv(e){let n=new Map(e.functions.map(o=>[o.id,o.moduleId])),t=new Set(e.modules.filter(o=>o.packageName!==""&&o.externalSurface!==!0).map(o=>o.id)),s=new Set;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let r=n.get(o.enclosingFunctionId);r!==void 0&&t.has(r)&&s.add(r)}return[...s].map(o=>({source:o,cause:"dep-opaque",reach:{kind:"dependency-dispatch"}}))}var no={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Rv(e){if(e.length===0)return null;let n=[],t=new Map;for(let _ of e){let S=_.rootRel===""?".":_.rootRel;for(let b of _.diagnostics)n.push(`${S}: ${b}`);for(let[b,k]of _.execution){let w=t.get(b);t.set(b,w===void 0?k:[...new Set([...w,...k])])}}let s=e.filter(_=>_.analysisAborted===null);if(s.length===0)return{graph:no,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let o=[],r=[],i=[],a=[],l=[],d=[],c=[],p=[],u=[],f=[],m=[],h=new Set;for(let _ of s){let S=_.rootRel===""?"":`${_.rootRel}::`,b=new Set(_.graph.modules.filter(A=>A.externalSurface===!0).map(A=>A.id)),k=A=>b.has(A)?A:`${S}${A}`,w=A=>`${S}${A}`,N=A=>`${S}${A}`,R=A=>`${S}${A}`,v=A=>`${S}${A}`,I=A=>`${S}${A}`;for(let A of _.graph.modules){if(A.externalSurface===!0){if(h.has(A.id))continue;h.add(A.id),o.push(A);continue}o.push({...A,id:k(A.id)})}for(let A of _.graph.imports)r.push({...A,id:w(A.id),moduleId:k(A.moduleId),...A.resolvedModuleId!==void 0?{resolvedModuleId:k(A.resolvedModuleId)}:{}});for(let A of _.graph.importEdges)i.push({importId:w(A.importId),resolvedModuleId:k(A.resolvedModuleId)});for(let A of _.incompleteness)m.push({...A,source:k(A.source)});for(let A of _.graph.functions)a.push({...A,id:N(A.id),moduleId:k(A.moduleId),...A.enclosingClassId!==void 0?{enclosingClassId:R(A.enclosingClassId)}:{}});for(let A of _.graph.classes)l.push({...A,id:R(A.id),moduleId:k(A.moduleId),members:A.members.map(N)});for(let A of _.graph.exports)d.push({...A,id:I(A.id),moduleId:k(A.moduleId)});for(let A of _.graph.exportBindings)c.push({exportId:I(A.exportId),target:A.target.kind==="function"?{kind:"function",functionId:N(A.target.functionId)}:{kind:"module",moduleId:k(A.target.moduleId)}});for(let A of _.graph.callSites)p.push({...A,id:v(A.id),enclosingFunctionId:N(A.enclosingFunctionId),resolvedTargetIds:A.resolvedTargetIds.map(N)});for(let A of _.graph.callEdges)u.push({...A,callSiteId:v(A.callSiteId),calleeFunctionId:N(A.calleeFunctionId)});for(let A of _.graph.inheritEdges)f.push({...A,subclassId:R(A.subclassId),superclassId:R(A.superclassId)})}let y=o[0]?.id;for(let _ of e)_.analysisAborted===null||y===void 0||m.push({source:y,cause:_.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:o,imports:r,importEdges:i,functions:a,classes:l,exports:d,exportBindings:c,callSites:p,callEdges:u,inheritEdges:f},incompleteness:m,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function gm(e,n={}){let t=e.filter(s=>jo(s));return t.length===0?null:Rv(t.map(s=>Av(s.rel,s.abs,n)))}function Ov(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var Pv=["sitecustomize","usercustomize"];function Cv(e,n,t){let s=new Set,o=[],r=[];for(let i of e.pthFiles){for(let l of i.importModules){let d=To(n,l);for(let p of d)s.add(p.name);let c=Dt(t,l);if(c.resolved!==null){r.push(`${i.sitePackages}/${i.name}: \`import ${l}\` runs ${c.resolved.path}`);continue}d.length===0&&o.push(`${i.sitePackages}/${i.name}: \`import ${l}\``)}let a=i.importModules.length;i.importLines>a&&o.push(`${i.sitePackages}/${i.name}: ${String(i.importLines-a)} import line(s) whose module could not be read`)}for(let i of Pv){let a=Dt(t,i);if(a.resolved===null)continue;let l=To(n,i);for(let d of l)s.add(d.name);l.length===0?o.push(`${a.resolved.path}: \`import ${i}\` runs at every interpreter start`):r.push(`${i}: \`import ${i}\` runs ${a.resolved.path}`)}return{distributions:s,unattributed:o,seen:r}}import{spawnSync as Mv}from"node:child_process";import{closeSync as Tv,lstatSync as $v,openSync as Lv,readdirSync as Am,readFileSync as Dv,readSync as Fv,realpathSync as zl,statSync as so}from"node:fs";import{homedir as ym,tmpdir as jv}from"node:os";import Le from"node:path";var Bv="ImportPath,Dir,Standard,Module,IgnoredGoFiles,Error,DepsErrors",_m=21,Nm="CUPEL_GO",Gv=3e5,Kv=256*1024*1024,zv=1e5,Uv=8,Wv=1e5,Hv=5e4,bm=1024*1024,Sm=4*1024*1024,xm=16*1024*1024,km=8,wm=200,Bt=8;function Ul(e,n,t){let s={...e};return s.GOTOOLCHAIN="local",s.GOPROXY="off",s.GOFLAGS=`-mod=${n}`,s.GO111MODULE="on",s.GOCACHE="off",t!==null&&(s.GOWORK=t),s}function Wl(e,n,t,s){let o=Mv(e.go,n,{cwd:t,env:s,encoding:"utf8",timeout:e.timeoutMs,killSignal:"SIGKILL",maxBuffer:e.maxOutputBytes,stdio:["ignore","pipe","pipe"],windowsHide:!0,shell:!1});if(o.error!==void 0){let r=o.error.code;return r==="ENOENT"?{kind:"missing"}:r==="ETIMEDOUT"?{kind:"failed",detail:`timed out after ${String(e.timeoutMs/1e3)} s`}:r==="ENOBUFS"?{kind:"failed",detail:`printed more than ${String(e.maxOutputBytes)} bytes`}:{kind:"failed",detail:`could not run (${r??"spawn error"})`}}return o.signal!==null?{kind:"failed",detail:`was killed (${o.signal})`}:{kind:"ran",status:o.status??1,stdout:o.stdout,stderr:o.stderr}}function to(e){let n="";for(let t of e.slice(-600)){let s=t.charCodeAt(0);n+=s<32||s===127||s>=128&&s<=159?" ":t}return n.replace(/ {2,}/gu," ").trim()}function Im(e){let n=e.split(" ")[0]??"",t=/^go(\d{1,4})\.(\d{1,4})(?:\.(\d{1,4}))?(?:(alpha|beta|rc)(\d{1,4}))?$/u.exec(n);if(t===null)return null;let[,s,o,r,i,a]=t,l=`${s??"0"}.${o??"0"}.${r??"0"}`;return i===void 0?l:`${l}-${i}.${a??"0"}`}function qv(e){let n=Wl(e,["env","-json","GOVERSION","GOOS","GOARCH","CGO_ENABLED","GOEXPERIMENT","GOROOT","GOMODCACHE"],jv(),Ul(e.env,"readonly","off"));if(n.kind==="missing")return{refused:"missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH (set ${Nm} to point at one)`};if(n.kind==="failed")return{refused:"unusable",detail:`\`${e.go} env\` ${n.detail}`};if(n.status!==0)return{refused:"unusable",detail:`\`${e.go} env\` exited ${String(n.status)}: ${to(n.stderr)}`};let t;try{t=JSON.parse(n.stdout)}catch{t=null}let s=typeof t=="object"&&t!==null?t:{},o=s.GOVERSION,r=s.GOOS,i=s.GOARCH,a=s.CGO_ENABLED,l=s.GOEXPERIMENT,d=f=>typeof f=="string"&&f.length>1&&f.length<=4096&&Le.isAbsolute(f)?f:null,c=f=>typeof f=="string"&&f.length>0&&f.length<=64&&/^[A-Za-z0-9_]+$/u.test(f);if(typeof o!="string"||o.length===0||o.length>256||!c(r)||!c(i))return{refused:"unusable",detail:`\`${e.go} env -json\` did not report GOVERSION, GOOS and GOARCH`};let p=Im(o),u=/^go1\.(\d+)/u.exec(o)?.[1];return p!==null&&u!==void 0&&Number(u)<_m?{refused:"unusable",detail:`the Go toolchain on PATH is ${to(o)}; the Go scan needs go1.${String(_m)} or later`}:{toolchain:{goversion:to(o),release:p,goos:r,goarch:i,cgo:a==="1",experiment:typeof l=="string"?to(l).slice(0,200):"",goroot:d(s.GOROOT),gomodcache:d(s.GOMODCACHE)}}}function vm(e){let n=e.filter(t=>t[0]!==null&&t[0].length>1).sort((t,s)=>s[0].length-t[0].length);return t=>{let s=t;for(let[o,r]of n)s=s.split(o).join(r);return s.replace(/(^|[\s(["'`=])\/[^\s:"'`()\]]+/gu,"$1<path>")}}function Rm(e,n){for(let t=0;t<e.length;t+=1){let s=e.charCodeAt(t);if(!(n&&(s===10||s===9))&&(s<32||s===127||s>=128&&s<=159))return!0}return!1}function ci(e,n){if(typeof e!="string"||e.length===0||e.length>n)return!1;for(let t=0;t<e.length;t+=1){let s=e.charCodeAt(t);if(s<=32||s>=127||s===34||s===39||s===92||s===96)return!1}return!0}function Om(e){return typeof e=="string"&&e.length>3&&e.length<=255&&e.endsWith(".go")&&!e.includes("/")&&!e.includes("\\")&&!Rm(e,!1)}var dn=class extends Error{};function Pm(e,n){if(e===void 0)return!1;if(typeof e!="boolean")throw new dn(`${n} is not a boolean`);return e}function Jo(e,n,t,s=!1){if(e==null)return null;if(typeof e!="string"||e.length>t||Rm(e,s))throw new dn(`${n} is not a bounded string`);return e}function Vv(e,n){if(e==null)return null;if(typeof e!="object"||Array.isArray(e))throw new dn(`${n}.Module is not an object`);let t=e;if(!ci(t.Path,1024))throw new dn(`${n}.Module.Path is not a module path`);let s=t.Version===void 0?"":t.Version;if(s!==""&&!ci(s,256))throw new dn(`${n}.Module.Version is not a version`);let o=null,r=t.Replace;if(r!=null){if(typeof r!="object"||Array.isArray(r))throw new dn(`${n}.Module.Replace is not an object`);let a=r,l=Jo(a.Path,`${n}.Module.Replace.Path`,4096),d=a.Version===void 0?"":a.Version;if(l===null||l.length===0)throw new dn(`${n}.Module.Replace.Path is missing`);if(d!==""&&!ci(d,256))throw new dn(`${n}.Module.Replace.Version is not a version`);o={path:l,version:d}}let i=Jo(t.Dir,`${n}.Module.Dir`,4096);if(i!==null&&!Le.isAbsolute(i))throw new dn(`${n}.Module.Dir is not absolute`);return{path:t.Path,version:s,main:Pm(t.Main,`${n}.Module.Main`),replace:o,dir:i}}function Xv(e,n){let t=`package ${String(n)}`;if(typeof e!="object"||e===null||Array.isArray(e))throw new dn(`${t} is not an object`);let s=e,o=Jo(s.ImportPath,`${t}.ImportPath`,1024);if(o===null||o.length===0)throw new dn(`${t} has no ImportPath`);let r=Jo(s.Dir,`${t}.Dir`,4096);if(r!==null&&!Le.isAbsolute(r))throw new dn(`${t}.Dir is not absolute`);let i=s.IgnoredGoFiles,a=[];if(i!=null){if(!Array.isArray(i)||i.length>1e5)throw new dn(`${t}.IgnoredGoFiles is not a bounded list`);a=i.map(p=>{if(!Om(p))throw new dn(`${t}.IgnoredGoFiles holds a name that is not a file`);return p})}let l=null,d=s.Error;if(d!=null){if(typeof d!="object"||Array.isArray(d))throw new dn(`${t}.Error is not an object`);l=Jo(d.Err,`${t}.Error.Err`,65536,!0),l??="error without a message"}let c=s.DepsErrors;if(c!=null&&!Array.isArray(c))throw new dn(`${t}.DepsErrors is not a list`);return{importPath:o,dir:r,standard:Pm(s.Standard,`${t}.Standard`),module:Vv(s.Module,t),ignoredGoFiles:a,error:l}}function Yv(e,n){let t=[],s=0,o=-1,r=!1,i=!1;try{for(let a=0;a<e.length;a+=1){let l=e.charCodeAt(a);if(r){i?i=!1:l===92?i=!0:l===34&&(r=!1);continue}if(s===0){if(l===123){s=1,o=a;continue}if(l===32||l===10||l===13||l===9)continue;return{refused:`a byte outside any object at offset ${String(a)}`}}if(l===34)r=!0;else if(l===123||l===91){if(s+=1,s>km)return{refused:`an object nested deeper than ${String(km)}`}}else if((l===125||l===93)&&(s-=1,s===0)){if(a+1-o>xm)return{refused:"an object over the size bound"};if(t.length>=n)return{refused:`more than ${String(n)} packages`};t.push(Xv(JSON.parse(e.slice(o,a+1)),t.length))}if(s>0&&a+1-o>xm)return{refused:"an object over the size bound"}}}catch(a){return{refused:a instanceof Error?a.message:"an object that is not JSON"}}return s!==0||r?{refused:"the stream ends inside an object"}:{packages:t}}function Jv(e){let n=0,t=!1,s=!1,o=null,r=e.charCodeAt(0)===65279?1:0;e:for(;r<e.length;){let i=e.indexOf(`
-`,r),a=(i<0?e.slice(r):e.slice(r,i)).trim();if(r=i<0?e.length:i+1,a.length===0&&!t){n=r;continue}if(a.startsWith("//")||(t=!0),!s&&a.startsWith("//go:build")){let l=a.slice(10);if(l.length===0||l.trim().length<l.length){if(o!==null)return!1;o=l.trim()}}for(;a.length>0;){if(s){let l=a.indexOf("*/");if(l<0)continue e;s=!1,a=a.slice(l+2).trim();continue}if(a.startsWith("//"))continue e;if(a.startsWith("/*")){s=!0,a=a.slice(2).trim();continue}break e}}if(o!==null)return o==="ignore";for(let i of e.slice(0,n).split(`
-`)){let a=i.trim();if(!a.startsWith("//"))continue;let l=a.slice(2).trim();if(!l.startsWith("+build"))continue;let d=l.slice(6);if(!(d.length>0&&d.charAt(0)!==" ")&&d.trim()==="ignore")return!0}return!1}function Zv(e){if(e.length===0||e.length>1024||e.startsWith("-")||e.startsWith(".")||e.startsWith("/")||e.endsWith("/"))return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<=32||t===127||t>=128&&t<=159||t===34||t===39||t===92||t===96||t===58)return!1}return!e.split("/").some(n=>n===""||n==="."||n==="..")}function Qv(e){let n=e.charCodeAt(0)===65279?1:0,t=e.length,s=()=>{for(;;){for(;n<t;){let d=e.charCodeAt(n);if(d===32||d===9||d===10||d===13)n+=1;else break}if(n>=t)return{kind:"eof",text:""};if(e.startsWith("//",n)){let d=e.indexOf(`
+`:"",encoding:"utf8",maxBuffer:r0,timeout:n.timeoutMs??o0,env:t});if(a.error!==void 0){let g=a.error.code,y=g==="ENOENT";return{refused:y?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,y?`no Python interpreter: \`${s}\` is not on PATH (set ${lg} to the interpreter this project runs under)`:`the Python extract could not run (${g??a.error.message})`]}}if(a.status!==0){let g=(a.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,`the Python extract exited ${String(a.status??"on a signal")}${g!==""?`: ${g}`:""}`]}}let l=(a.stdout??"").split(`
+`).filter(g=>g.trim()!==""),d=null,c=[],f=[],p=new Map,u=[];for(let g of l){let y;try{y=JSON.parse(g)}catch{r.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!Pn(y))continue;if(y.kind==="header"){d=we(y.interpreter,64);let _=y.stdlib;Array.isArray(_)&&(c=_.filter(S=>typeof S=="string"&&S.length<=128)),f=us(y.builtins).filter(S=>typeof S=="string"&&S.length<=128),p=$0(y.typeAttrs);continue}let b=T0(y);if(b===null){r.push("the Python extract emitted a file row without a path; it was skipped");continue}u.push(b)}if(d===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],builtins:[],typeAttrs:new Map,diagnostics:[...r,"the Python extract did not report an interpreter version"]};let m=o.length-u.length;return m>0&&r.push(`${String(m)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:d,files:u,stdlib:c,diagnostics:r,builtins:f,typeAttrs:p}}function $0(e){let n=new Map;if(!Pn(e))return n;for(let[t,s]of Object.entries(e))!pg.has(t)||!Array.isArray(s)||n.set(t,new Set(s.filter(r=>typeof r=="string"&&r.length<=128)));return n}var D0="python3",F0={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","extract-truncated":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function j0(e,n){let t=F0[e.code];return t!=="dynamic-load"?t:n!==void 0&&n.packageName!==""?"dep-opaque":t}function B0(e,n,t=s=>cr([],{python:s}).refused===null){let s=Ps.resolve(e,n.envRel);for(let r of["bin/python3","bin/python","Scripts/python.exe"]){let o=Ps.join(s,r);try{if(!L0(o).isFile())continue}catch{continue}if(t(o))return o}return D0}function G0(e,n){let t=[e];for(let s of n.sitePackages)t.push(Ps.resolve(e,s));for(let s of n.pthFiles)for(let r of s.paths)t.push(Ps.isAbsolute(r)?r:Ps.resolve(e,s.sitePackages,r));return{roots:[...new Set(t)]}}function K0(e){let n=[];for(let t of e.distInfos){let s=Ur(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});s!==null&&n.push(s)}return n}function _g(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function z0(e,n,t={}){let r=(t.readEnvironment??eo)(n),o=K0(r),i=fi(o),a=r.diagnostics.map(S=>S),l=t.python??B0(n,r),d=G0(n,r),c=X0(r,i,d),f=new Map;for(let S of o)f.set(S.name,q0(S,c.distributions));for(let S of c.seen)a.push(`startup hook: ${S}`);for(let S of c.unattributed)a.push(`startup escape: ${S} \u2014 a module runs at interpreter start that no installed distribution claims`);let p=_d({projectRoot:n,paths:d,python:l});for(let S of p.gaps)a.push(`entrypoint \`${S.declaration}\` (${S.source}): ${S.detail}`);if(p.entrypoints.length===0)return a.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,pythonPath:l,graph:pr,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:p.gaps,interpreter:null,diagnostics:a,execution:f};let u=yd({projectRoot:n,paths:d,entryFiles:p.entrypoints.map(S=>Ps.join(n,S.file)),environmentComplete:!r.truncated&&r.refused===null,externalRoots:r.sitePackages.map(S=>Ps.resolve(n,S)),distributionOf:_g(i),python:l,...t.maxModules!==void 0?{maxModules:t.maxModules}:{},preciseNames:t.preciseNames!==!1,...t.nameMatchLabel===!0?{nameMatchLabel:!0}:{}});for(let S of u.diagnostics)a.push(`${S.code} at ${S.where}: ${S.detail}`);if(u.graph.modules.length===0)return{rootRel:e,pythonPath:l,graph:pr,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:p.entrypoints,entrypointGaps:p.gaps,interpreter:u.interpreter,diagnostics:a,execution:f};let m=new Map;for(let S of u.graph.modules)m.set(S.id,S.id),m.set(S.path,S.id);let g=new Map(u.graph.modules.map(S=>[S.id,S])),y=S=>g.get(S)??g.get(m.get(S)??""),b=u.graph.modules[0]?.id,_=u.diagnostics.map(S=>{let k=y(S.where);return{source:k?.id??b,cause:j0(S,k),reach:{kind:"unbounded"}}});if(c.unattributed.length>0&&_.push({source:b,cause:"dynamic-load",reach:{kind:"unbounded"}}),_.push(...U0(u.graph)),u.opaqueCode.length>0){let S=u.graph.modules.find(v=>v.isEntrypoint)?.id??b,k=W0(u.graph,u.opaqueCode,o);_.push({source:S,cause:"dep-opaque",reach:{kind:"loaded-package",ecosystem:"PyPI",alsoLoaded:k}}),a.push(`code no analysis reads is loaded (${bg(u.opaqueCode)}): a loaded package is not reported unreachable, and neither is any of the ${String(k.length)} package(s) in the declared-dependency closure of the distributions that ship it (${bg(k)})`)}return{rootRel:e,pythonPath:l,graph:u.graph,incompleteness:_,analysisAborted:null,entrypoints:p.entrypoints,entrypointGaps:p.gaps,interpreter:u.interpreter,diagnostics:a,execution:f}}var bg=e=>`${e.slice(0,5).join(", ")}${e.length>5?", \u2026":""}`;function W0(e,n,t){let s=new Set(e.modules.map(c=>c.packageName).filter(c=>c!=="")),r=new Map;for(let c of t){let f=r.get(c.name);if(f===void 0)r.set(c.name,new Set(c.requiresDist));else for(let p of c.requiresDist)f.add(p)}let o=new Set,i=fi(t),a=_g(i);for(let c of n){let f=a(c.split(".")[0]??c);f!==null&&o.add(f);for(let p of Hr(i,c))o.add(p.name)}for(let c of t)s.has(c.name)&&(c.extensionModules>0||!c.recordKnown)&&o.add(c.name);let l=new Set,d=[...o];for(let c=d.pop();c!==void 0;c=d.pop())if(!l.has(c)){l.add(c);for(let f of r.get(c)??[])r.has(f)&&!l.has(f)&&d.push(f)}return[...l].sort((c,f)=>c<f?-1:c>f?1:0)}function U0(e){let n=new Map(e.functions.map(r=>[r.id,r.moduleId])),t=new Set(e.modules.filter(r=>r.packageName!==""&&r.externalSurface!==!0).map(r=>r.id)),s=new Set;for(let r of e.callSites){if(r.resolution!=="unresolved")continue;let o=n.get(r.enclosingFunctionId);o!==void 0&&t.has(o)&&s.add(o)}return[...s].map(r=>({source:r,cause:"dep-opaque",reach:{kind:"dependency-dispatch"}}))}var pr={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function H0(e){if(e.length===0)return null;let n=[],t=new Map;for(let b of e){let _=b.rootRel===""?".":b.rootRel;for(let S of b.diagnostics)n.push(`${_}: ${S}`);for(let[S,k]of b.execution){let v=t.get(S);t.set(S,v===void 0?k:[...new Set([...v,...k])])}}let s=e.filter(b=>b.analysisAborted===null);if(s.length===0)return{graph:pr,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let r=[],o=[],i=[],a=[],l=[],d=[],c=[],f=[],p=[],u=[],m=[],g=new Set;for(let b of s){let _=b.rootRel===""?"":`${b.rootRel}::`,S=new Set(b.graph.modules.filter(A=>A.externalSurface===!0).map(A=>A.id)),k=A=>S.has(A)?A:`${_}${A}`,v=A=>`${_}${A}`,I=A=>`${_}${A}`,O=A=>`${_}${A}`,E=A=>`${_}${A}`,N=A=>`${_}${A}`;for(let A of b.graph.modules){if(A.externalSurface===!0){if(g.has(A.id))continue;g.add(A.id),r.push(A);continue}r.push({...A,id:k(A.id)})}for(let A of b.graph.imports)o.push({...A,id:v(A.id),moduleId:k(A.moduleId),...A.resolvedModuleId!==void 0?{resolvedModuleId:k(A.resolvedModuleId)}:{}});for(let A of b.graph.importEdges)i.push({importId:v(A.importId),resolvedModuleId:k(A.resolvedModuleId)});for(let A of b.incompleteness)m.push({...A,source:k(A.source)});for(let A of b.graph.functions)a.push({...A,id:I(A.id),moduleId:k(A.moduleId),...A.enclosingClassId!==void 0?{enclosingClassId:O(A.enclosingClassId)}:{}});for(let A of b.graph.classes)l.push({...A,id:O(A.id),moduleId:k(A.moduleId),members:A.members.map(I)});for(let A of b.graph.exports)d.push({...A,id:N(A.id),moduleId:k(A.moduleId)});for(let A of b.graph.exportBindings)c.push({exportId:N(A.exportId),target:A.target.kind==="function"?{kind:"function",functionId:I(A.target.functionId)}:{kind:"module",moduleId:k(A.target.moduleId)}});for(let A of b.graph.callSites)f.push({...A,id:E(A.id),enclosingFunctionId:I(A.enclosingFunctionId),resolvedTargetIds:A.resolvedTargetIds.map(I)});for(let A of b.graph.callEdges)p.push({...A,callSiteId:E(A.callSiteId),calleeFunctionId:I(A.calleeFunctionId)});for(let A of b.graph.inheritEdges)u.push({...A,subclassId:O(A.subclassId),superclassId:O(A.superclassId)})}let y=r[0]?.id;for(let b of e)b.analysisAborted===null||y===void 0||m.push({source:y,cause:b.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:r,imports:o,importEdges:i,functions:a,classes:l,exports:d,exportBindings:c,callSites:f,callEdges:p,inheritEdges:u},incompleteness:m,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function Sg(e,n={}){let t=e.filter(s=>Jr(s));return t.length===0?null:H0(t.map(s=>z0(s.rel,s.abs,n)))}function q0(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var V0=["sitecustomize","usercustomize"];function X0(e,n,t){let s=new Set,r=[],o=[];for(let i of e.pthFiles){for(let l of i.importModules){let d=Hr(n,l);for(let f of d)s.add(f.name);let c=Wt(t,l);if(c.resolved!==null){o.push(`${i.sitePackages}/${i.name}: \`import ${l}\` runs ${c.resolved.path}`);continue}d.length===0&&r.push(`${i.sitePackages}/${i.name}: \`import ${l}\``)}let a=i.importModules.length;i.importLines>a&&r.push(`${i.sitePackages}/${i.name}: ${String(i.importLines-a)} import line(s) whose module could not be read`)}for(let i of V0){let a=Wt(t,i);if(a.resolved===null)continue;let l=Hr(n,i);for(let d of l)s.add(d.name);l.length===0?r.push(`${a.resolved.path}: \`import ${i}\` runs at every interpreter start`):o.push(`${i}: \`import ${i}\` runs ${a.resolved.path}`)}return{distributions:s,unattributed:r,seen:o}}import{spawnSync as Y0}from"node:child_process";import{closeSync as J0,lstatSync as Q0,openSync as Z0,readdirSync as Og,readFileSync as eA,readSync as nA,realpathSync as wd,statSync as gr}from"node:fs";import{homedir as xg,tmpdir as tA}from"node:os";import De from"node:path";var sA="ImportPath,Dir,Standard,Module,IgnoredGoFiles,Error,DepsErrors",kg=21,Pg="CUPEL_GO",rA=3e5,oA=256*1024*1024,iA=1e5,aA=8,lA=1e5,dA=5e4,wg=1024*1024,vg=4*1024*1024,Eg=16*1024*1024,Ag=8,Ig=200,qt=8;function vd(e,n,t){let s={...e};return s.GOTOOLCHAIN="local",s.GOPROXY="off",s.GOFLAGS=`-mod=${n}`,s.GO111MODULE="on",s.GOCACHE="off",t!==null&&(s.GOWORK=t),s}function Ed(e,n,t,s){let r=Y0(e.go,n,{cwd:t,env:s,encoding:"utf8",timeout:e.timeoutMs,killSignal:"SIGKILL",maxBuffer:e.maxOutputBytes,stdio:["ignore","pipe","pipe"],windowsHide:!0,shell:!1});if(r.error!==void 0){let o=r.error.code;return o==="ENOENT"?{kind:"missing"}:o==="ETIMEDOUT"?{kind:"failed",detail:`timed out after ${String(e.timeoutMs/1e3)} s`}:o==="ENOBUFS"?{kind:"failed",detail:`printed more than ${String(e.maxOutputBytes)} bytes`}:{kind:"failed",detail:`could not run (${o??"spawn error"})`}}return r.signal!==null?{kind:"failed",detail:`was killed (${r.signal})`}:{kind:"ran",status:r.status??1,stdout:r.stdout,stderr:r.stderr}}function mr(e){let n="";for(let t of e.slice(-600)){let s=t.charCodeAt(0);n+=s<32||s===127||s>=128&&s<=159?" ":t}return n.replace(/ {2,}/gu," ").trim()}function Cg(e){let n=e.split(" ")[0]??"",t=/^go(\d{1,4})\.(\d{1,4})(?:\.(\d{1,4}))?(?:(alpha|beta|rc)(\d{1,4}))?$/u.exec(n);if(t===null)return null;let[,s,r,o,i,a]=t,l=`${s??"0"}.${r??"0"}.${o??"0"}`;return i===void 0?l:`${l}-${i}.${a??"0"}`}function cA(e){let n=Ed(e,["env","-json","GOVERSION","GOOS","GOARCH","CGO_ENABLED","GOEXPERIMENT","GOROOT","GOMODCACHE"],tA(),vd(e.env,"readonly","off"));if(n.kind==="missing")return{refused:"missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH (set ${Pg} to point at one)`};if(n.kind==="failed")return{refused:"unusable",detail:`\`${e.go} env\` ${n.detail}`};if(n.status!==0)return{refused:"unusable",detail:`\`${e.go} env\` exited ${String(n.status)}: ${mr(n.stderr)}`};let t;try{t=JSON.parse(n.stdout)}catch{t=null}let s=typeof t=="object"&&t!==null?t:{},r=s.GOVERSION,o=s.GOOS,i=s.GOARCH,a=s.CGO_ENABLED,l=s.GOEXPERIMENT,d=u=>typeof u=="string"&&u.length>1&&u.length<=4096&&De.isAbsolute(u)?u:null,c=u=>typeof u=="string"&&u.length>0&&u.length<=64&&/^[A-Za-z0-9_]+$/u.test(u);if(typeof r!="string"||r.length===0||r.length>256||!c(o)||!c(i))return{refused:"unusable",detail:`\`${e.go} env -json\` did not report GOVERSION, GOOS and GOARCH`};let f=Cg(r),p=/^go1\.(\d+)/u.exec(r)?.[1];return f!==null&&p!==void 0&&Number(p)<kg?{refused:"unusable",detail:`the Go toolchain on PATH is ${mr(r)}; the Go scan needs go1.${String(kg)} or later`}:{toolchain:{goversion:mr(r),release:f,goos:o,goarch:i,cgo:a==="1",experiment:typeof l=="string"?mr(l).slice(0,200):"",goroot:d(s.GOROOT),gomodcache:d(s.GOMODCACHE)}}}function Ng(e){let n=e.filter(t=>t[0]!==null&&t[0].length>1).sort((t,s)=>s[0].length-t[0].length);return t=>{let s=t;for(let[r,o]of n)s=s.split(r).join(o);return s.replace(/(^|[\s(["'`=])\/[^\s:"'`()\]]+/gu,"$1<path>")}}function Mg(e,n){for(let t=0;t<e.length;t+=1){let s=e.charCodeAt(t);if(!(n&&(s===10||s===9))&&(s<32||s===127||s>=128&&s<=159))return!0}return!1}function Ni(e,n){if(typeof e!="string"||e.length===0||e.length>n)return!1;for(let t=0;t<e.length;t+=1){let s=e.charCodeAt(t);if(s<=32||s>=127||s===34||s===39||s===92||s===96)return!1}return!0}function Tg(e){return typeof e=="string"&&e.length>3&&e.length<=255&&e.endsWith(".go")&&!e.includes("/")&&!e.includes("\\")&&!Mg(e,!1)}var un=class extends Error{};function $g(e,n){if(e===void 0)return!1;if(typeof e!="boolean")throw new un(`${n} is not a boolean`);return e}function co(e,n,t,s=!1){if(e==null)return null;if(typeof e!="string"||e.length>t||Mg(e,s))throw new un(`${n} is not a bounded string`);return e}function uA(e,n){if(e==null)return null;if(typeof e!="object"||Array.isArray(e))throw new un(`${n}.Module is not an object`);let t=e;if(!Ni(t.Path,1024))throw new un(`${n}.Module.Path is not a module path`);let s=t.Version===void 0?"":t.Version;if(s!==""&&!Ni(s,256))throw new un(`${n}.Module.Version is not a version`);let r=null,o=t.Replace;if(o!=null){if(typeof o!="object"||Array.isArray(o))throw new un(`${n}.Module.Replace is not an object`);let a=o,l=co(a.Path,`${n}.Module.Replace.Path`,4096),d=a.Version===void 0?"":a.Version;if(l===null||l.length===0)throw new un(`${n}.Module.Replace.Path is missing`);if(d!==""&&!Ni(d,256))throw new un(`${n}.Module.Replace.Version is not a version`);r={path:l,version:d}}let i=co(t.Dir,`${n}.Module.Dir`,4096);if(i!==null&&!De.isAbsolute(i))throw new un(`${n}.Module.Dir is not absolute`);return{path:t.Path,version:s,main:$g(t.Main,`${n}.Module.Main`),replace:r,dir:i}}function fA(e,n){let t=`package ${String(n)}`;if(typeof e!="object"||e===null||Array.isArray(e))throw new un(`${t} is not an object`);let s=e,r=co(s.ImportPath,`${t}.ImportPath`,1024);if(r===null||r.length===0)throw new un(`${t} has no ImportPath`);let o=co(s.Dir,`${t}.Dir`,4096);if(o!==null&&!De.isAbsolute(o))throw new un(`${t}.Dir is not absolute`);let i=s.IgnoredGoFiles,a=[];if(i!=null){if(!Array.isArray(i)||i.length>1e5)throw new un(`${t}.IgnoredGoFiles is not a bounded list`);a=i.map(f=>{if(!Tg(f))throw new un(`${t}.IgnoredGoFiles holds a name that is not a file`);return f})}let l=null,d=s.Error;if(d!=null){if(typeof d!="object"||Array.isArray(d))throw new un(`${t}.Error is not an object`);l=co(d.Err,`${t}.Error.Err`,65536,!0),l??="error without a message"}let c=s.DepsErrors;if(c!=null&&!Array.isArray(c))throw new un(`${t}.DepsErrors is not a list`);return{importPath:r,dir:o,standard:$g(s.Standard,`${t}.Standard`),module:uA(s.Module,t),ignoredGoFiles:a,error:l}}function pA(e,n){let t=[],s=0,r=-1,o=!1,i=!1;try{for(let a=0;a<e.length;a+=1){let l=e.charCodeAt(a);if(o){i?i=!1:l===92?i=!0:l===34&&(o=!1);continue}if(s===0){if(l===123){s=1,r=a;continue}if(l===32||l===10||l===13||l===9)continue;return{refused:`a byte outside any object at offset ${String(a)}`}}if(l===34)o=!0;else if(l===123||l===91){if(s+=1,s>Ag)return{refused:`an object nested deeper than ${String(Ag)}`}}else if((l===125||l===93)&&(s-=1,s===0)){if(a+1-r>Eg)return{refused:"an object over the size bound"};if(t.length>=n)return{refused:`more than ${String(n)} packages`};t.push(fA(JSON.parse(e.slice(r,a+1)),t.length))}if(s>0&&a+1-r>Eg)return{refused:"an object over the size bound"}}}catch(a){return{refused:a instanceof Error?a.message:"an object that is not JSON"}}return s!==0||o?{refused:"the stream ends inside an object"}:{packages:t}}function mA(e){let n=0,t=!1,s=!1,r=null,o=e.charCodeAt(0)===65279?1:0;e:for(;o<e.length;){let i=e.indexOf(`
+`,o),a=(i<0?e.slice(o):e.slice(o,i)).trim();if(o=i<0?e.length:i+1,a.length===0&&!t){n=o;continue}if(a.startsWith("//")||(t=!0),!s&&a.startsWith("//go:build")){let l=a.slice(10);if(l.length===0||l.trim().length<l.length){if(r!==null)return!1;r=l.trim()}}for(;a.length>0;){if(s){let l=a.indexOf("*/");if(l<0)continue e;s=!1,a=a.slice(l+2).trim();continue}if(a.startsWith("//"))continue e;if(a.startsWith("/*")){s=!0,a=a.slice(2).trim();continue}break e}}if(r!==null)return r==="ignore";for(let i of e.slice(0,n).split(`
+`)){let a=i.trim();if(!a.startsWith("//"))continue;let l=a.slice(2).trim();if(!l.startsWith("+build"))continue;let d=l.slice(6);if(!(d.length>0&&d.charAt(0)!==" ")&&d.trim()==="ignore")return!0}return!1}function gA(e){if(e.length===0||e.length>1024||e.startsWith("-")||e.startsWith(".")||e.startsWith("/")||e.endsWith("/"))return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<=32||t===127||t>=128&&t<=159||t===34||t===39||t===92||t===96||t===58)return!1}return!e.split("/").some(n=>n===""||n==="."||n==="..")}function hA(e){let n=e.charCodeAt(0)===65279?1:0,t=e.length,s=()=>{for(;;){for(;n<t;){let d=e.charCodeAt(n);if(d===32||d===9||d===10||d===13)n+=1;else break}if(n>=t)return{kind:"eof",text:""};if(e.startsWith("//",n)){let d=e.indexOf(`
 `,n);n=d<0?t:d+1;continue}if(e.startsWith("/*",n)){let d=e.indexOf("*/",n+2);if(d<0)return{bad:"an unterminated comment"};n=d+2;continue}break}let a=e.charAt(n);if(a==='"'){let d="";for(n+=1;n<t;){let c=e.charAt(n);if(c==='"')return n+=1,{kind:"string",text:d};if(c===`
-`)return{bad:"a string broken by a newline"};if(c==="\\"){let p=e.charAt(n+1);if(p!=="\\"&&p!=='"')return{bad:"an escape in an import path"};d+=p,n+=2;continue}d+=c,n+=1}return{bad:"an unterminated string"}}if(a==="`"){let d=e.indexOf("`",n+1);if(d<0)return{bad:"an unterminated raw string"};let c=e.slice(n+1,d);return n=d+1,{kind:"string",text:c}}if(a==="("||a===")"||a===";"||a===".")return n+=1,{kind:"punct",text:a};let l=n;for(;n<t;){let d=e.charCodeAt(n);if(!(d>=48&&d<=57||d>=65&&d<=90||d>=97&&d<=122||d===95||d>127))break;n+=1}return n===l?(n+=1,{kind:"punct",text:a}):{kind:"ident",text:e.slice(l,n)}},o=[],r=s();if("bad"in r)return{refused:r.bad};if(r.kind!=="ident"||r.text!=="package")return{refused:"no package clause"};if(r=s(),"bad"in r)return{refused:r.bad};if(r.kind!=="ident")return{refused:"no package name"};let i=a=>{let l=a;return(l.kind==="ident"||l.kind==="punct"&&l.text===".")&&(l=s()),"bad"in l?l:l.kind!=="string"?{bad:"an import without a path"}:l.text};for(;;){if(r=s(),"bad"in r)return{refused:r.bad};if(!(r.kind==="punct"&&r.text===";")){if(r.kind!=="ident"||r.text!=="import")break;if(r=s(),"bad"in r)return{refused:r.bad};if(r.kind==="punct"&&r.text==="(")for(;;){if(r=s(),"bad"in r)return{refused:r.bad};if(r.kind==="punct"&&r.text===";")continue;if(r.kind==="punct"&&r.text===")")break;if(r.kind==="eof")return{refused:"an unterminated import block"};let a=i(r);if(typeof a!="string")return{refused:a.bad};o.push(a)}else{if(r.kind==="eof")return{refused:"an import declaration without a path"};let a=i(r);if(typeof a!="string")return{refused:a.bad};o.push(a)}}}return{imports:o}}function Cm(e){let n;try{let t=so(e);if(!t.isFile())return null;n=Lv(e,"r");let s=Buffer.alloc(Math.min(t.size,bm)),o=0;for(;o<s.length;){let r=Fv(n,s,o,s.length-o,o);if(r===0)break;o+=r}return{text:s.subarray(0,o).toString("utf8"),whole:t.size<=bm}}catch{return null}finally{n!==void 0&&Tv(n)}}function Em(e,n){try{let t=so(e);return!t.isFile()||t.size>n?null:Dv(e,"utf8")}catch{return null}}function eE(e){try{return so(e).isDirectory()}catch{return!1}}function nE(e,n){if(e===n)return!0;let t=n.endsWith(Le.sep)?n:n+Le.sep;return e.startsWith(t)}function tE(e,n,t){let s=/^(\d{1,4})\.(\d{1,4})/u.exec(e);if(s===null)return!1;let o=Number(s[1]),r=Number(s[2]);return o>n||o===n&&r>=t}function sE(e,n){let t=Im(e.split("+")[0]??"");if(t===null||n===null)return!0;try{return Rt(n,{advisoryId:"",packageName:"",ecosystem:"Go",introduced:"0",fixed:t,surfaceComplete:!1})}catch{return!0}}function Kl(e){return/module lookup disabled by GOPROXY=off/u.test(e)?"go-module-missing":"go-list-failed"}function Mm(e,n){if(!nE(e,n))return"a go.work outside the scan root";let t=Le.relative(n,e).split(Le.sep).join("/");return t.length===0?"go.work":t}function oE(e,n,t){let s=Wl(e,["env","-json","GOWORK","GOMOD"],t,Ul(e.env,"readonly",null));if(s.kind==="missing")return{failed:{kind:"go-toolchain-missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH`}};if(s.kind==="failed"||s.status!==0)return{failed:{kind:"go-list-failed",detail:`\`go env\` in the module ${s.kind==="failed"?s.detail:`exited ${String(s.status)}: ${to(s.stderr)}`}`}};let o={};try{let b=JSON.parse(s.stdout);typeof b=="object"&&b!==null&&(o=b)}catch{}let r=typeof o.GOMOD=="string"?o.GOMOD:"",i;try{i=r.length>0&&Le.isAbsolute(r)?Le.join(zl(Le.dirname(r)),Le.basename(r)):""}catch{i=""}if(i!==Le.join(t,"go.mod"))return{failed:{kind:"go-list-failed",detail:"the go command does not read this directory's go.mod as its module (GOMOD is another file, or none)"}};let a=Em(Le.join(t,"go.mod"),Sm),l=a===null?[]:Ks(a),d=[],c=typeof o.GOWORK=="string"?o.GOWORK:"",p=null,u=[];if(c.length>0&&c!=="off"&&Le.isAbsolute(c)){let b=Em(c,Sm);if(b===null)p=c;else{u=Ks(b);let k=Le.dirname(c),w=Do(u);[...w.inside,...w.outside].some(R=>{try{return zl(Le.resolve(k,R))===t}catch{return!1}})?p=c:d.push(`${Mm(c,n)} governs this directory but does not \`use\` this module, so the go command builds it only on its own (GOWORK=off) \u2014 that is how it was listed`)}}let f=p!==null?u:l,m=Lo(f,"go"),h=Lo(f,"toolchain"),y=Le.join(p!==null?Le.dirname(p):t,"vendor"),_="readonly";if(eE(y))if(m===null||!tE(m,1,14))d.push("a vendor directory is present, but the governing go line is older than 1.14 (or absent), so the go command does not use it: listed -mod=readonly");else{let k=(Cm(Le.join(y,"modules.txt"))?.text.slice(0,512)??"").split(`
-`)[0]??"";(k.startsWith("## ")&&k.slice(3).split(";").some(N=>N.trim()==="workspace"))===(p!==null)?_="vendor":d.push("a vendor directory is present for the other mode (workspace vs module), so the go command does not use it: listed -mod=readonly")}let S=l.filter(b=>b.verb==="tool").map(b=>b.args[0]??"").filter(b=>b.length>0);return{mode:_,gowork:p??"off",workspaceFile:p,facts:d,goLine:m,toolchainLine:h,modulePath:Lo(l,"module"),tools:S}}function rE(e,n){for(let s of n)if(e===s||e.startsWith(`${s}/`))return!1;return!(e.split("/")[0]??"").includes(".")}function iE(e,n,t){let s=[],o=[e],r=0;for(;o.length>0;){let i=o.pop();if(i===void 0)break;if(r+=1,r>t)return{dirs:s,truncated:!0};let a;try{a=Am(i).sort()}catch{continue}let l=[];for(let d of a){let c=Le.join(i,d),p;try{p=$v(c)}catch{continue}if(p.isDirectory()){if(d.startsWith(".")||d.startsWith("_")||d==="testdata"||d==="vendor")continue;try{if(so(Le.join(c,"go.mod")).isFile())continue}catch{}o.push(c)}else p.isFile()&&d.endsWith(".go")&&!d.endsWith("_test.go")&&Om(d)&&l.push(d)}l.length>0&&!n.has(i)&&s.push({dir:i,files:l})}return{dirs:s,truncated:!1}}function Tm(e,n,t,s,o){return{rootRel:e,status:"failed",mode:n,workspace:null,packages:0,otherConfiguration:0,rows:[],gaps:t,diagnostics:s,facts:o,loadedPackages:new Set,otherConfigPackages:new Set,modules:new Map,loadedNames:new Set,importsPlugin:!1,packageModules:new Map,moduleDirs:new Map}}function aE(e,n,t,s,o){let r=t.abs,i=[],a=[],l=[],d=($,T)=>{let j=o(T);i.push({kind:$,detail:j,blindsAnalysis:!1,rootRel:""}),a.push(j)},c=($,T=null)=>(d($.kind,`${$.detail} \u2014 NO Go module of this root was enumerated, so this scan says nothing about them; it is not a clean bill of health (ADR-108 D6)`),Tm(t.rel,T,i,a,l.map(o))),p=oE(e,n,r);if("failed"in p)return c(p.failed);l.push(...p.facts);let u=Ul(e.env,p.mode,p.gowork),f=$=>{let T=Wl(e,["list",`-mod=${p.mode}`,"-e","-deps",`-json=${Bv}`,"--",...$],r,u);if(T.kind==="missing")return{failed:{kind:"go-toolchain-missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH`}};if(T.kind==="failed")return{failed:{kind:"go-list-failed",detail:`\`go list\` ${T.detail}`}};if(T.status!==0){let U=to(T.stderr);return{failed:{kind:Kl(U),detail:`\`go list\` exited ${String(T.status)}: ${U}`}}}let j=Yv(T.stdout,e.maxPackages);return"refused"in j?{failed:{kind:"go-list-failed",detail:`\`go list\` printed output that was refused as malformed (${j.refused})`}}:j},m=f(["./..."]);if("failed"in m)return c(m.failed,p.mode);let h=new Map,y=new Set;p.modulePath!==null&&y.add(p.modulePath);let _=[],S=[],b=($,T)=>{T.length>=1e3||T.push(`${$.importPath} (${($.error??"").split(`
-`)[0]?.slice(0,200)??""})`)};for(let $ of m.packages)$.module!==null&&y.add($.module.path);for(let $ of m.packages){if($.importPath.startsWith(".")||$.importPath.includes("...")){$.error!==null&&b($,S);continue}$.error!==null?b($,Kl($.error)==="go-module-missing"?_:S):!$.standard&&$.module===null&&S.length<1e3&&S.push(`${$.importPath} (a package outside any module)`),h.set($.importPath,$)}let k=new Map,w=!0,N=[],R=$=>{w=!1,N.length<Bt&&N.push($)},v=h.has("plugin"),I=new Set;for(let $ of h.values())$.dir!==null&&I.add($.dir);let A=iE(r,I,e.maxWalkDirs);A.truncated&&R(`the module has more than ${String(e.maxWalkDirs)} directories`);let B=new Set([...I,...A.dirs.map($=>$.dir)]),O=p.modulePath,V=0,E=new Set,D=$=>h.has($)||k.has($),L=($,T,j)=>{if(T.endsWith("_test.go"))return;if(V+=1,V>e.maxFiles){V===e.maxFiles+1&&R(`more than ${String(e.maxFiles)} excluded files`);return}let U=Cm(Le.join($,T));if(U===null){R(`${j}/${T} could not be read`);return}if(Jv(U.text))return;let Q=Qv(U.text);if("refused"in Q){R(`${j}/${T}: ${U.whole?Q.refused:"its import clause runs past the byte bound"}`);return}for(let te of Q.imports)if(te==="plugin"&&(v=!0),!(te==="C"||!Zv(te)||rE(te,y)||D(te))){if(O!==null&&(te===O||te.startsWith(`${O}/`))){let ie=Le.join(r,...te.slice(O.length).split("/").filter(me=>me!==""));if(B.has(ie))continue}E.add(te)}};for(let $ of h.values())if(!($.standard||$.dir===null))for(let T of $.ignoredGoFiles)L($.dir,T,$.importPath);for(let $ of A.dirs){let T=Le.relative(r,$.dir).split(Le.sep).join("/");for(let j of $.files)L($.dir,j,T)}let K=0,Y=!1;for(;E.size>0&&!Y;){if(K+=1,K>e.maxRounds){R(`the closure did not finish in ${String(e.maxRounds)} rounds`);break}let $=[...E].sort();E.clear();let T=[];for(let j=0;j<$.length;j+=wm){let U=f($.slice(j,j+wm));if("failed"in U){R(`listing what another configuration imports: ${U.failed.detail.slice(0,300)}`),U.failed.kind==="go-module-missing"&&_.length<1e3&&_.push(`(another configuration) ${U.failed.detail.slice(0,200)}`);continue}T.push(...U.packages)}for(let j of T)if(!(D(j.importPath)||j.importPath.startsWith("."))){if(j.importPath==="plugin"&&(v=!0),j.error!==null&&!j.error.startsWith("build constraints exclude all Go files")&&(R(`${j.importPath}: ${j.error.split(`
-`)[0]?.slice(0,200)??""}`),Kl(j.error)==="go-module-missing"&&b(j,_)),!j.standard&&j.module===null){R(`${j.importPath} lies in no module the build list names`);continue}if(k.size+h.size>=e.maxPackages){R(`more than ${String(e.maxPackages)} packages`),Y=!0;break}if(k.set(j.importPath,j),!j.standard&&j.dir!==null)for(let U of j.ignoredGoFiles)L(j.dir,U,j.importPath)}}let le=[],z=new Map,Z=new Set,de=new Set,x=new Set,M=new Map,X=new Map,W=new Map,q=($,T)=>{if($.standard||$.module===null||(M.set($.importPath,$.module.path),X.has($.module.path)||X.set($.module.path,$.module.dir),$.module.main))return;let j=W.get($.module.path);j===void 0?W.set($.module.path,{module:$.module,inGraph:T}):T&&(j.inGraph=!0)};for(let $ of h.values())$.standard||Z.add($.importPath),q($,!0);for(let $ of k.values())$.standard||de.add($.importPath),q($,!1);let F=p.toolchainLine!==null&&sE(p.toolchainLine,s.release)?p.toolchainLine:null,ne=$=>p.tools.some(T=>T===$||T.startsWith(`${$}/`)),pe=[];for(let[$,T]of[...W.entries()].sort((j,U)=>j[0]<U[0]?-1:1)){let j=T.module.replace,U=j!==null&&j.path===$&&j.version!=="",Q=U?j.version:T.module.version;z.set($,Q),T.inGraph&&x.add($);let te={};if(j!==null){let ie=j.version===""?j.path:`${j.path}@${j.version}`;pe.push(`${$}@${T.module.version===""?"?":T.module.version} => ${ie}`),U||(te.replacedBy=o(ie))}T.inGraph||(te.otherConfiguration=!0),ne($)&&(te.tool=!0),le.push({name:$,version:Q,flags:te}),j!==null&&!U&&j.version!==""&&ci(j.path,1024)&&/^[A-Za-z0-9]/u.test(j.path)&&(T.inGraph&&x.add(j.path),le.push({name:j.path,version:j.version,flags:{replacementOf:$,...T.inGraph?{}:{otherConfiguration:!0}}}))}if(pe.length>0&&l.push(`resolution divergence: ${String(pe.length)} module(s) replaced (${pe.slice(0,Bt).join(", ")}${pe.length>Bt?", \u2026":""}); a replacement by other code or a local directory withholds the version verdict, never the import graph`),h.size>0||A.dirs.length>0){let $=s.release??s.goversion,T=F!==null?{toolchainAhead:F}:{};le.push({name:"stdlib",version:$,flags:T}),le.push({name:"toolchain",version:$,flags:T}),x.add("stdlib"),x.add("toolchain")}else l.push("the module holds no Go package, so it contributes no row");F!==null&&l.push(`the governing toolchain line is \`${F}\`, newer than ${s.goversion} on PATH: a build under GOTOOLCHAIN=auto uses that one, so the stdlib and toolchain version verdicts are withheld`),_.length>0&&d("go-module-missing",`the module cache lacks what ${String(_.length)} package(s) of this build need (${_.slice(0,Bt).join("; ")}${_.length>Bt?"; \u2026":""}) \u2014 nothing is fetched (GOPROXY=off), so their modules are MISSING from this scan. Run \`go mod download\` and re-scan`),S.length>0&&d("go-list-failed",`\`go list\` could not load ${String(S.length)} package(s) of this build (${S.slice(0,Bt).join("; ")}${S.length>Bt?"; \u2026":""}) \u2014 what they import is missing from this scan`),w||d("go-list-failed",`the packages another build configuration imports could not all be read (${N.join("; ")}) \u2014 a module imported only there may be missing from this scan`);let Ie=_.length>0||S.length>0||!w?"partial":"ok";return{rootRel:t.rel,status:Ie,mode:p.mode,workspace:p.workspaceFile===null?null:Mm(p.workspaceFile,n),packages:h.size,otherConfiguration:k.size,rows:le,gaps:i,diagnostics:a,facts:l.map(o),loadedPackages:Z,otherConfigPackages:de,modules:z,loadedNames:x,importsPlugin:v,packageModules:M,moduleDirs:X}}function $m(e,n,t={}){let s=n.filter(Bo);if(s.length===0)return null;let o=t.env??process.env,r=o[Nm],i={go:t.go??(r!==void 0&&r!==""?r:"go"),env:o,timeoutMs:t.timeoutMs??Gv,maxOutputBytes:t.maxOutputBytes??Kv,maxPackages:t.maxPackages??zv,maxRounds:t.maxRounds??Uv,maxFiles:t.maxFiles??Wv,maxWalkDirs:t.maxWalkDirs??Hv},a=e;try{a=zl(e)}catch{}let l=qv(i);if("refused"in l){let h=vm([[a,"."],[ym(),"~"]])(`${l.detail} \u2014 the Go scan needs one (ADR-108 F-108-B); NO Go module of this root was enumerated, so this scan says nothing about them; it is not a clean bill of health`);return{toolchain:null,roots:s.map(y=>Tm(y.rel,null,[{kind:"go-toolchain-missing",detail:h,blindsAnalysis:!1,rootRel:""}],[h],[])),blockers:["no Go toolchain read the build"],facts:[]}}let d=l.toolchain,c=vm([[a,"."],[d.gomodcache,"$GOMODCACHE"],[d.goroot,"$GOROOT"],[ym(),"~"]]),p=s.map(h=>aE(i,a,h,d,c)),u=[],f=p.filter(h=>h.status!=="ok").map(h=>h.rootRel===""?".":h.rootRel);f.length>0&&u.push(`the Go build of ${f.slice(0,Bt).join(", ")}${f.length>Bt?", \u2026":""} was not read completely, and what it imports may be what this finding is about`),p.some(h=>h.importsPlugin)&&u.push("the build imports `plugin`: a plugin brings in packages no import graph here holds");let m=[`read with ${d.goversion} ${d.goos}/${d.goarch}, CGO_ENABLED=${d.cgo?"1":"0"}${d.experiment.length>0?`, GOEXPERIMENT=${d.experiment}`:""}, default build tags, GOFLAGS cleared, GOTOOLCHAIN=local, GOPROXY=off \u2014 the import graph is this configuration's; a package only another configuration imports is enumerated and never denied; tests, tools and plugins' own builds are outside it`];return{toolchain:d,roots:p,blockers:u,facts:m}}function ui(e,n){return JSON.stringify([e,n])}function lE(e,n){let t=n.split("/");if(t.some(o=>o===""||o==="."||o===".."||o.includes("\\")))return!1;let s=e;for(let o of t){s=Le.join(s,o);try{if(so(Le.join(s,"go.mod")).isFile())return!1}catch{}}try{return Am(s).some(o=>o.endsWith(".go")&&!o.endsWith("_test.go")&&so(Le.join(s,o)).isFile())}catch{return!1}}function Lm(e,n,t){let s=[],o=new Map(e.rows.map(i=>[i.name,i])),r=i=>{let a=e.packageModules.get(i);if(a!==void 0)return a;let l=null;for(let p of n)i.startsWith(`${p}/`)&&(l===null||p.length>l.length)&&(l=p);if(l===null)return null;let d=i.slice(l.length+1);if(/^v[0-9]+(\/|$)/u.test(d))return null;let c=e.moduleDirs.get(l)??null;return c!==null&&lE(c,d)?l:null};for(let[i,a]of[...e.modules.entries()].sort())for(let l of t(`${i}/`)){if(n.has(l)||r(l)!==i)continue;let d=o.get(i)?.flags??{},c={packageOf:i,...d.replacedBy!==void 0?{replacedBy:d.replacedBy}:{},...d.tool===!0?{tool:!0}:{},...!e.loadedPackages.has(l)&&e.otherConfigPackages.has(l)?{otherConfiguration:!0}:{}};s.push({name:l,version:a,flags:c})}return s}import{readdirSync as dE,readFileSync as cE}from"node:fs";import uE from"node:path";var fE=new Set(["summarized","crashed","over-cap"]),pE=new Set(["function","method","ctor"]);function Xe(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function Hl(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function mE(e,n){Hl(e)||Xe(n,"edge is not an object");let{entryPath:t,entryExport:s,entryContainer:o,hops:r}=e;(typeof t!="string"||typeof s!="string")&&Xe(n,"edge entry fields must be strings"),o!==null&&typeof o!="string"&&Xe(n,"entryContainer must be string or null"),(typeof r!="number"||!Number.isInteger(r)||r<0)&&Xe(n,"hops must be a non-negative integer");let i=e.target;if(Hl(i)||Xe(n,"edge target missing"),i.kind==="symbol"){let{exportName:a,container:l,symbolKind:d}=i;return typeof a!="string"&&Xe(n,"symbol target exportName"),l!==null&&typeof l!="string"&&Xe(n,"symbol target container"),(typeof d!="string"||!pE.has(d))&&Xe(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:s,entryContainer:o,target:{kind:"symbol",exportName:a,container:l,symbolKind:d},hops:r}}if(i.kind==="dep"){let{calleePackage:a,calleeSubpath:l,calleeExport:d}=i;return(typeof a!="string"||a.length===0)&&Xe(n,"dep target calleePackage"),l!==null&&typeof l!="string"&&Xe(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&Xe(n,"dep target calleeExport"),{entryPath:t,entryExport:s,entryContainer:o,target:{kind:"dep",calleePackage:a,calleeSubpath:l,calleeExport:d},hops:r}}Xe(n,`unknown target kind ${JSON.stringify(i.kind)}`)}function hE(e,n){Hl(e)||Xe(n,"root is not an object");let{packageName:t,analyzedVersion:s,tool:o,toolVersion:r,maxIndirections:i,status:a}=e;(typeof t!="string"||t.length===0)&&Xe(n,"packageName"),typeof s!="string"&&Xe(n,"analyzedVersion"),o!=="jelly"&&Xe(n,`tool ${JSON.stringify(o)} (only 'jelly' exists)`),typeof r!="string"&&Xe(n,"toolVersion"),typeof i!="number"&&Xe(n,"maxIndirections"),(typeof a!="string"||!fE.has(a))&&Xe(n,`status ${JSON.stringify(a)} not in the enum`);let l=e.edges;return Array.isArray(l)||Xe(n,"edges is not an array"),a!=="summarized"&&l.length>0&&Xe(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:s,tool:o,toolVersion:r,maxIndirections:i,status:a,edges:l.map(d=>mE(d,n))}}function Dm(e){let n=new Map,t=dE(e).filter(s=>s.endsWith(".summary.json"));for(let s of t){let o=uE.join(e,s),r;try{r=JSON.parse(cE(o,"utf8"))}catch(l){Xe(s,`unparseable JSON: ${l instanceof Error?l.message:String(l)}`)}let i=hE(r,s),a=n.get(i.packageName);a===void 0?n.set(i.packageName,[i]):a.push(i)}return n}import vt from"node:path";function gE(e,n){let t=e.read(n);if(t===null)return null;let s=t.toString("utf8"),o=vt.posix.basename(n);if(o==="package-lock.json"||o==="npm-shrinkwrap.json")return nl(s);if(o==="pnpm-lock.yaml")return tl(s);if(o==="yarn.lock")return sl(s,yE(e,n));if(o==="uv.lock")return ll(s);if(o==="poetry.lock"){let r=e.read(vt.posix.join(vt.posix.dirname(n),"pyproject.toml")),i=r===null?[]:[...Yr(r.toString("utf8")).keys()];return dl(s,i)}return null}function yE(e,n){let t=new Map,s=e.read(vt.posix.join(vt.posix.dirname(n),"package.json"));if(s===null)return t;let o;try{o=JSON.parse(s.toString("utf8"))}catch{return t}if(typeof o!="object"||o===null)return t;for(let r of["dependencies","devDependencies","optionalDependencies"]){let i=o[r];if(!(typeof i!="object"||i===null||Array.isArray(i)))for(let[a,l]of Object.entries(i))typeof l=="string"&&!t.has(a)&&t.set(a,l)}return t}function Fm(e,n,t=[]){let s=new Ut(e,gl),o=new Map,r=new Map,i=new Map,a=[],l=u=>{if(!r.has(u)){let m=s.read(u)?.toString("utf8")??null,h=vt.posix.basename(u);r.set(u,m===null?null:h==="pyproject.toml"?Yr(m):h.endsWith(".txt")?cl(m):rl(m))}return r.get(u)??null},d=(u,f)=>{let m=u.endsWith("pyproject.toml"),h=m?xt(f):f,y=m?[u,vt.posix.join(vt.posix.dirname(u),"requirements.txt")]:[u];for(let _ of y){let S=l(_)?.get(h);if(S!==void 0)return{path:_,line:S}}return null},c=(u,f,m)=>{let h=JSON.stringify([u,f,m]),y=i.get(h);if(y!==void 0)return y;o.has(u)||o.set(u,gE(s,u));let _=o.get(u)??null,S=_===null?null:ol(_,f,m,{maxNodes:Vt.maxPackageGraphNodes,maxEdges:Vt.maxPackageGraphEdges}),b=null;if(S!==null&&a.length<Vt.maxPackageGraphs){b=`g${String(a.length)}`;let k=vt.posix.dirname(u);a.push({id:b,nodes:S.nodes.map(w=>{let N=w.directFrom===null?null:vt.posix.join(k,w.directFrom);return{id:w.id,name:w.name,version:w.version,direct:w.directFrom!==null,declaredIn:N===null?null:d(N,w.name)}}),edges:S.edges.map(w=>({from:w.from,to:w.to})),truncated:S.truncated})}return i.set(h,b),b},p=n.map(u=>{if(u.tier==="not-affected"||u.ecosystem==="Go")return null;if(u.ecosystem==="PyPI"){for(let f of t){let m=c(f,u.packageName,u.version);if(m!==null)return m}return null}return u.packageLocation===null?null:c(u.packageLocation,u.packageName,u.version)});return{graphs:a,idOf:p}}import{isBuiltin as jm}from"node:module";function re(e){let n="";for(let t of e){let s=t.charCodeAt(0),o=s<32||s>=127&&s<=159;n+=o?"\\x"+s.toString(16).padStart(2,"0"):t}return n}var Bm=1024,Gm=4096,fi=8,Km=512,zm=512,ql=8,_E=160,bE=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),Vl=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),SE=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,xE=/\.[cm]?[jt]sx?$/u;function Um(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let s=e.lastIndexOf("node_modules/");if(s!==-1){let o=e.slice(s+13).split("/"),r=o[0]??"";return r.startsWith("@")?o[1]===void 0?null:`${r}/${o[1]}`:r===""?null:r}return SE.test(e)&&!xE.test(e)?e:null}function kE(e){return re(`${e.code} ${e.path}: ${e.detail}`.slice(0,_E))}function Wm(e){let{graph:n,facts:t,diagnostics:s}=e,o=new Map(n.modules.map(F=>[F.id,F])),r=new Map(n.modules.map(F=>[F.path,F])),i=Zn(n),a=new Set;for(let F of i){let ne=o.get(F);ne!==void 0&&a.add(ne.packageName)}let l=new Map,d=0,c=!1,p=!1,u=F=>F.startsWith(`${e.appRootReal}/`)?F.slice(e.appRootReal.length+1):F;for(let F of s){if(F.code==="limit-exceeded"&&F.path===e.appRootReal){c=!0;continue}let ne=Um(u(F.path),r);if(ne===null){F.code==="out-of-root"&&d++,Vl.has(F.code)&&(p=!0);continue}let pe=r.get(u(F.path));pe!==void 0&&Vl.has(F.code)&&!pe.path.includes("node_modules/")&&(p=!0);let Se=l.get(ne);Se===void 0?l.set(ne,[F]):Se.push(F)}let f=new Map(n.imports.map(F=>[F.id,F])),m=new Set;for(let F of n.importEdges){let ne=f.get(F.importId);ne!==void 0&&o.get(ne.moduleId)?.externalSurface===!0&&m.add(ne.moduleId)}let h=[],y=new Set,_=n.modules.filter(F=>F.externalSurface===!0);for(let F of _){let ne=l.get(F.packageName)??[],pe=m.has(F.id),Se=[],Ie=_e=>_e.code==="dependency-body"&&_e.anchor===void 0&&/syntax/u.test(_e.detail),$=_e=>_e.code==="loader-escape"||_e.code==="dependency-body"&&_e.anchor===void 0&&!/syntax/u.test(_e.detail),T=ne.filter(_e=>bE.has(_e.code)),j=ne.filter($),U=ne.filter(_e=>Vl.has(_e.code)||Ie(_e)),Q=ne.filter(_e=>_e.code==="out-of-root"),te=pe&&T.length===0,ie=j.length===0,me=!c&&U.length===0,ge=d===0&&Q.length===0;pe||Se.push("(a) the package's entry was never followed to a module");for(let _e of[...T,...j,...U,...Q]){if(Se.length>=ql)break;Se.push(kE(_e))}c&&Se.length<ql&&Se.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&Se.length<ql&&Se.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let Re=["a","b","c","d"].filter(_e=>!{a:te,b:ie,c:me,d:ge}[_e]),Oe=Re.length===0;Oe&&y.add(F.id),h.push({packageName:re(F.packageName),module:re(String(F.id)),inReach:i.has(F.id),builtin:jm(F.packageName),followed:pe,d1:{a:te,b:ie,c:me,d:ge},failing:Re,transparent:Oe,evidence:Se})}let S=new Set;for(let F of t)F.reach.kind==="unbounded"&&S.add(F.source);let b=F=>({module:re(String(F.module)),kind:F.kind,packageName:o.get(F.module)?.packageName??null}),k=new Set(_.filter(F=>jm(F.packageName)).map(F=>F.id)),w=new Set([...y,...k]),N=[],R=new Map,v=0,I=0,A=0,B=0,O=[],V=new Set;for(let F of t)F.reach.kind==="unbounded"&&V.add(F.cause);for(let F of t){if(F.reach.kind==="class-scope"){O.push({packageName:F.reach.packageName,container:F.reach.container});continue}if(F.reach.kind==="unbounded"||F.reach.kind==="dependency-dispatch"||F.reach.kind==="loaded-package")continue;B++;let ne=F.reach.anchor,pe=R.get(String(ne));pe===void 0&&(pe={today:fo(n,ne,S),d1:fo(n,ne,S,y),d1Builtins:fo(n,ne,S,w)},R.set(String(ne),pe)),pe.d1Builtins.length>0&&A++,pe.today.length>0&&(v++,V.add(F.cause)),pe.d1.length>0&&I++,N.length<Gm&&N.push({anchor:re(String(ne)),packageName:re(o.get(ne)?.packageName??""),cause:F.cause,reachKind:F.reach.kind,blockersToday:pe.today.slice(0,fi).map(b),blockersUnderD1:pe.d1.slice(0,fi).map(b),blockedUnderD1Builtins:pe.d1Builtins.length>0,moreToday:Math.max(0,pe.today.length-fi),moreUnderD1:Math.max(0,pe.d1.length-fi)})}let E=s.filter(F=>F.anchor===void 0&&F.classScope===void 0),D=new Map(e.loadSites.map(F=>[F.importId,F])),L=new Map;for(let F of e.loadSites){let ne=L.get(F.path);ne===void 0?L.set(F.path,[F.shape]):ne.push(F.shape)}let K=F=>{if(F.code!=="loader-escape")return!1;let ne=F.escapes??[];if(ne.length===0||ne.some(Se=>Se!=="non-literal-load"))return!1;let pe=L.get(F.path)??[];return pe.length>0&&pe.every(Se=>Se==="relative-bounded")},Y=E.slice(0,zm).map(F=>({cause:e.causeOf(F.code),code:F.code,path:re(u(F.path)),attributedPackage:Um(u(F.path),r),...F.escapes!==void 0?{escapes:[...F.escapes]}:{},...F.reason!==void 0?{reason:F.reason}:{},d2Dischargeable:K(F)})),le={};for(let F of E){if(F.code!=="unresolved-specifier")continue;let ne=F.reason??"(none)";le[ne]=(le[ne]??0)+1}let z=S.size===0?0:t.filter(F=>F.reach.kind==="unbounded").length,Z=Math.max(0,z-E.length),de=z-E.filter(K).length,x=[],M=0,X=0,W=0;for(let F of n.imports){if(F.specifierIsLiteral)continue;W++;let ne=i.has(F.moduleId),pe=D.get(String(F.id)),Se=pe?.shape??"unrecorded";ne&&(M++,Se==="relative-bounded"&&X++),x.length<Km&&x.push({importId:re(String(F.id)),path:re(o.get(F.moduleId)?.path??""),shape:Se,text:re(pe?.text??""),inReach:ne})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:c,appCapHit:p,unattributedOutOfRoot:d,blindUnbounded:Z,unbounded:Y,anchors:N,surfaces:h.slice(0,Bm),loads:x,counts:{modules:n.modules.length,reachMods:i.size,surfaces:_.length,surfacesInReach:h.filter(F=>F.inReach).length,transparentSurfaces:y.size,builtinSurfaces:k.size,anchors:B,anchorsBlockedToday:v,anchorsBlockedUnderD1:I,anchorsBlockedUnderD1Builtins:A,unbounded:z,loadsInReach:M,loadsRelativeBounded:X,unresolvedByReason:le,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,h.length-Bm),anchors:Math.max(0,B-Gm),loads:Math.max(0,W-Km),unbounded:Math.max(0,E.length-zm)}},reachedPackages:a,aborted:e.analysisAborted,unboundedFacts:z,unboundedHard:de,anchorsBlockedToday:v,anchorsBlockedUnderD1:I,anchorsBlockedUnderD1Builtins:A,loadsInReach:M,loadsAllBounded:M>0&&X===M,d2Eligible:e.rootBudget==="complete"&&!p&&!c,classScope:O,taintCausesToday:V}}var wE=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),vE=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Hm(e,n,t,s,o){if(t===null||e.reachedPackages.has(t.packageName))return;let r=e.classScope.some(v=>v.packageName===t.packageName&&v.container===t.container),i=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||r,a=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||a||n.reasonKind!==void 0&&wE.has(n.reasonKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":i?"taint":s>0?"oog":"unexpected",c=new Set(e.taintCausesToday);r&&c.add("dep-opaque");let p=e.aborted!==null?e.aborted:vE.find(v=>c.has(v)),u=d==="pre-2b"?He(n.tier)&&(a?n.reasonKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?He(n.tier)&&n.reasonKind==="dynamic-load":d==="taint"?He(n.tier)&&n.reasonKind===p:d==="oog"?He(n.tier)&&n.reasonKind==="analysis-cap":!1,f=t.verified&&o===!0,m=e.aborted===null&&e.unboundedFacts===0&&!r&&s===0,h=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,y=f&&d==="taint"&&m&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,_=f&&d==="load"&&m&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,S=f&&(d==="load"||d==="taint")&&m&&h&&e.anchorsBlockedUnderD1===0,b=e.aborted===null&&e.unboundedHard===0&&!r&&s===0,k=f&&d==="load"&&b&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,w=f&&(d==="load"||d==="taint")&&b&&h&&e.anchorsBlockedUnderD1===0,N=f&&d==="taint"&&m&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,R=f&&(d==="load"||d==="taint")&&b&&h&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:u,verified:t.verified,surfaceComplete:o,oog:s,classScoped:r,predicted:{d1:y,d2:_,d1d2:S,d2Amended:k,d1d2Amended:w,d1Builtins:N,d1d2AmendedBuiltins:R}}}import{readFileSync as EE,statSync as AE}from"node:fs";var Yl=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,pi=/^[A-Za-z0-9_$.-]{1,128}$/u,qm=64,Vm=1024*1024,Xm=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Ym=/^[A-Za-z0-9@_.-]{1,128}$/u;function Qe(e){throw new Error(`model claims rejected: ${e}`)}function Xl(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function NE(e,n){Xl(e)||Qe(`${n}: edge is not an object`);let{kind:t,anchorExport:s,anchorContainer:o,calleePackage:r,calleeContainer:i,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&Qe(`${n}: edge kind`),(typeof s!="string"||!pi.test(s))&&Qe(`${n}: anchorExport ${JSON.stringify(s)}`),o!==null&&(typeof o!="string"||!pi.test(o))&&Qe(`${n}: anchorContainer`),(typeof r!="string"||!Yl.test(r))&&Qe(`${n}: calleePackage ${JSON.stringify(r)}`),i!==null&&(typeof i!="string"||!pi.test(i))&&Qe(`${n}: calleeContainer`),(typeof a!="string"||!pi.test(a))&&Qe(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:s,anchorContainer:o,calleePackage:r,calleeContainer:i,calleeExport:a}}function Jm(e){let n=AE(e).size;n>Vm&&Qe(`file is ${String(n)} bytes, over the ${String(Vm)} cap`);let t;try{t=JSON.parse(EE(e,"utf8"))}catch(o){Qe(`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}Array.isArray(t)||Qe("root is not an array"),t.length>qm&&Qe(`${String(t.length)} claims over cap ${String(qm)}`);let s=[];for(let o of t){Xl(o)||Qe("claim is not an object");let{packageName:r,modelId:i,range:a,edges:l}=o;(typeof r!="string"||!Yl.test(r))&&Qe("packageName"),(typeof i!="string"||!Ym.test(i))&&Qe("modelId (identifier charset, 1-128 chars)"),s.some(c=>c.model.modelId===i)&&Qe(`duplicate modelId ${i} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Xl(a)||typeof a.introduced!="string")&&Qe(`${i}: range`),Xm.test(a.introduced)||Qe(`${i}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let d=a.fixedBefore;d!==null&&typeof d!="string"&&Qe(`${i}: fixedBefore`),typeof d=="string"&&!Xm.test(d)&&Qe(`${i}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(l)||Qe(`${i}: edges`),l.length>64&&Qe(`${i}: ${String(l.length)} edges over cap ${String(64)}`),s.push({model:{packageName:r,modelId:i,edges:l.map(c=>NE(c,i))},introduced:a.introduced,fixedBefore:d})}return s}var IE=["in-app-purchase@1-v1"];function Jl(e,n,t){let s=[],o=[],r=[],i=(a,l,d,c)=>{o.push(d),r.push({modelId:c??a.model.modelId,status:l,reason:d,edgeCount:a.model.edges.length})};for(let a of e){if(!Yl.test(a.model.packageName)||!Ym.test(a.model.modelId)){i(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&IE.includes(a.model.modelId)){i(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(c=>c.kind!=="alias"&&c.kind!=="dispatch")){i(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let l=n(a.model.packageName);if(typeof l!="string"&&l!==void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} installed at more than one version (${l.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(l===void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let d;try{d=Rt(l,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${l} is not a version cupel can order \u2014 inert (never guessed)`);continue}if(!d){i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${l} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}s.push(a.model),r.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:s,notes:o,dispositions:r}}var OE=4,PE={additiveForms:!0,namelessExports:!0},CE=new Set(["dep-opaque","dynamic-load","dispatch"]),ME={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function rd(e,n,t){return He(e.tier)&&ME[t].has(e.decidedAtStage)&&e.reasonKind!==void 0&&CE.has(e.reasonKind)&&n!==null&&n.verified}var TE=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,"potentially-reachable-not-ruled-out":0,"potentially-reachable-not-analysed":0}),dt=class extends Error{},id="cupel/coverage-gap",th={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function Qo(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:t.ecosystem==="Go"?{ecosystem:"Go"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Zm(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Qm(e,n,t){let s=new Map(e.modules.map(i=>[i.path,i.id])),o=e.modules[0]?.id;if(o===void 0)return[];let r=n.map(i=>({source:s.get(i.path)??o,cause:th[i.code],reach:i.classScope!==void 0?{kind:"class-scope",packageName:i.classScope.packageName,container:i.classScope.container}:i.anchor!==void 0?{kind:"via-module",anchor:i.anchor}:{kind:"unbounded"}}));for(let i of t)r.push({source:o,reach:{kind:"unbounded"},cause:i});return r}function td(e,n,t,s,o){let r=t.filter(i=>i.exportName!==null&&(s===1||o||i.verified!==1));return r.length>0?r.map(i=>({advisoryId:e,packageName:n,exportName:i.exportName??"",container:i.container,symbolKind:i.symbolKind,sourcePath:i.sourcePath??"",derivation:i.derivation,confidence:i.confidence,verified:i.verified===1})):t.length===0||t.every(i=>i.exportName!==null&&i.verified===1)?[null]:[]}function $E(e,n){let t;try{t=er(e)}catch{return!0}let s=3,o=(r,i)=>{if(i>s)return!1;let a;try{a=nh(r)}catch{return!1}for(let l of a){if(l==="node_modules"||l.startsWith("."))continue;let d=ct.join(r,l),c;try{c=od(d)}catch{continue}if(!c.isDirectory())continue;let p=ct.relative(t,d).split(ct.sep).join("/");try{if(od(ct.join(d,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(o(d,i+1))return!0}return!1};return o(t,1)}function LE(e,n){let t="";for(let s of e)s.rel!==""&&n.startsWith(`${s.rel}/`)&&s.rel.length>t.length&&(t=s.rel);return t}function DE(e,n,t){let s=[];if(t&&s.push("nested-app-root"),n==="")return[...s,"manifest-unreadable"];let o;try{if(o=er(ct.resolve(e,n)),!o.startsWith(er(e)+ct.sep))return[...s,"manifest-unreadable"]}catch{return[...s,"manifest-unreadable"]}let r;try{let c=ct.join(o,"package.json");if(!od(c).isFile())return[...s,"manifest-unreadable"];r=RE(c,"utf8")}catch{return[...s,"manifest-unreadable"]}let i;try{i=JSON.parse(r)}catch{return[...s,"manifest-unreadable"]}if(typeof i!="object"||i===null)return[...s,"manifest-unreadable"];let a=i;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&s.push("bin");let l=["preinstall","install","postinstall","prepare","prepublish"],d=a.scripts;if(typeof d=="object"&&d!==null){let c=d;l.some(p=>typeof c[p]=="string")&&s.push("install-script")}return(a.gypfile===!0||FE(o))&&s.push("native-artifact"),s}function FE(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=ct.join(e,n),s;try{s=nh(t)}catch{continue}if(s.some(o=>o.endsWith(".node")))return!0}return!1}function jE(e){return new Set(["npm",...e.ecosystems?.()??[]])}function ad(e){return e.ecosystem??"npm"}function BE(e,n){let t=[];for(let s of e.perRoot){let o=new Map;for(let r of s.packages){let i=ad(r);n.has(i)||o.set(i,(o.get(i)??0)+1)}for(let[r,i]of[...o.entries()].sort()){let a=r==="Go"?"module(s)":"distribution(s)",l=r==="Go"?"ADR-108 D6":"ADR-109 D5";t.push({kind:"ecosystem-uncovered",detail:`${s.rootRel===""?"":`${s.rootRel}: `}${String(i)} ${r} ${a} were enumerated but the loaded shard carries no ${r} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${r} shard to assess them (${l}).`,blindsAnalysis:!1,rootRel:s.rootRel})}}return t}function GE(e,n,t){let s=new Set(e.perRoot.flatMap(i=>i.packages.map(ad))),o=new Map([...s].filter(i=>t.has(i)).map(i=>[i,KE(n,i)])),r=[];for(let i of e.perRoot)for(let a of[...new Set(i.packages.map(ad))].sort()){let l=o.get(a);if(l===void 0||l==="census")continue;let d=l==="project"?"one project's installed set":l==="corpus"?"a vetted corpus slice":"an undeclared population";r.push({kind:"shard-population-narrow",detail:`${i.rootRel===""?"":`${i.rootRel}: `}the loaded ${a} shard's population is ${d}, not the whole ${a} ecosystem: a package outside it carries no advisory row here, so it reports no findings \u2014 which is NOT a clean bill of health for it. Scan with a census shard to assess every package (ADR-114 D5).`,blindsAnalysis:!1,rootRel:i.rootRel})}return r}function KE(e,n){return e.populationModeFor!==void 0?e.populationModeFor(n):e.populationMode?.()}function sh(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function zE(e,n,t){return new Map(n.map(s=>[sh(s),DE(e,s.lockKey,t)]))}function UE(e){let n=new Map;for(let t of e){let s=n.get(t.advisory.id);s===void 0?n.set(t.advisory.id,[t]):s.push(t)}return n}function WE(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(o=>o.packageName===t.name)?e:{...e,tier:Te("symbol-unsupported"),reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,reasonKind:"symbol-unsupported",basis:void 0,path:void 0}}function eh(e,n,t){if(n.ecosystem!=="Go")return e;let s=t?.flags(n.name,n.version)??{};if(e.tier==="not-affected"&&e.decidedAtStage==="version-match")return s.replacedBy!==void 0?{...e,tier:Te("resolution-divergence"),reason:`${n.name} is replaced by ${s.replacedBy} (a go.mod replace): the code that is built is not ${n.name}@${n.version}, so its version cannot place it outside the advisory's range`,reasonKind:"resolution-divergence",basis:void 0}:s.toolchainAhead!==void 0?{...e,tier:Te("version-undecidable"),reason:`the Go on PATH is ${n.version}, but the governing toolchain line names ${s.toolchainAhead}, which a build under GOTOOLCHAIN=auto uses instead \u2014 which release builds the program is not known here`,reasonKind:"version-undecidable",basis:void 0}:e;if(e.tier!=="not-reachable")return e;let o=s.otherConfiguration===!0?"another build configuration imports it (a file this configuration excludes by a build constraint)":t===null?"no Go lane read the build":t.blockers[0];return o===void 0&&t!==null?{...e,reason:`${n.name} is imported by no package of this build \u2014 not in the import graph \`go list -deps\` reports for ${t.configuration}, and by no file another build configuration compiles (tests excepted): a package-level denial, saying nothing about symbols`}:o===void 0?e:{...e,tier:Te("analysis-cap"),reason:`${n.name} is not imported by this build's graph, but ${o} \u2014 cannot confirm it is unreachable`,reasonKind:"analysis-cap",basis:void 0,path:void 0}}function HE(e,n){return e===void 0?n:{...e.replacedBy!==void 0||n.replacedBy!==void 0?{replacedBy:e.replacedBy??n.replacedBy}:{},...e.replacementOf!==void 0||n.replacementOf!==void 0?{replacementOf:e.replacementOf??n.replacementOf}:{},...e.otherConfiguration===!0||n.otherConfiguration===!0?{otherConfiguration:!0}:{},...e.toolchainAhead!==void 0||n.toolchainAhead!==void 0?{toolchainAhead:e.toolchainAhead??n.toolchainAhead}:{},...e.tool===!0||n.tool===!0?{tool:!0}:{},...e.packageOf!==void 0||n.packageOf!==void 0?{packageOf:e.packageOf??n.packageOf}:{}}}function qE(e,n){let t=new Set;for(let l of e.roots)for(let d of l.modules.keys())t.add(d);let s=l=>n.packageNamesUnder?.("Go",l)??[],o=new Map,r=new Set,i=new Map;for(let l of e.roots){let d=Lm(l,t,s),c=[...l.rows,...d];for(let p of c){let u=ui(p.name,p.version);o.set(u,HE(o.get(u),p.flags))}for(let p of l.loadedNames)r.add(p);for(let p of d)l.loadedPackages.has(p.name)&&r.add(p.name);i.set(l.rootRel,{packages:c.map(p=>({name:p.name,version:p.version,lockKey:"",dev:!1,declaredIn:"go.mod",ecosystem:"Go"})),source:c.length>0?"go-list":"none",lockfilePath:null,diagnostics:l.diagnostics,truncated:!1,gaps:l.gaps})}let a=[...r].sort().map(l=>({id:`go:${l}`,packageName:l,versionRange:"",path:l,moduleSystem:"esm",isEntrypoint:!0}));return{sets:i,flags:o,graph:{...ld,modules:a},analyzed:e.roots.some(l=>l.status!=="failed")}}var ld={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function VE(e,n,t,s,o,r,i){let{finding:a}=Zo(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:i(t)},Qo(s.advisory.id,t.name,s.affected),null,o,r);return a.decidedAtStage!=="presence"&&a.decidedAtStage!=="version-match"?"inside":a.tier==="not-affected"?"outside":"undecidable"}function Zo(e,n,t,s,o,r,i){let a=Ki({graph:e,installed:t,range:s,symbol:o,coverage:null,incompleteness:r,analysisAborted:i});if(n!==null&&o!==null&&rd(a,o,"base")){let l=po(e,n.modulesById,n.reachMods,o,n.records);if(l!==null)return{finding:a,hit:l}}return{finding:a,hit:null}}function XE(e,n){let t=new Set,s=[];for(let o of e.packages)if((o.ecosystem??"npm")==="npm")for(let{advisory:r,affected:i}of n.advisoriesForPackage(o.ecosystem??"npm",o.name)){let a=Qo(r.id,o.name,i),l;try{l=Rt(o.version,a)}catch{continue}if(l)for(let d of n.symbolsForAffected(i.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let c=`${o.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(c)||(t.add(c),s.push({packageName:o.name,packageRootRel:o.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return s.sort((o,r)=>`${o.packageRootRel}\0${o.container}\0${o.sourcePath}`.localeCompare(`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`)),s.slice(0,Lr)}function YE(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),o=new Map(e.classes.map(a=>[a.id,a.name])),r=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let l=r.get(a.callSiteId);if(l===void 0)continue;let d=s.get(l.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let c=n.get(d.moduleId);if(c===void 0)continue;let p=s.get(a.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let u=n.get(p.moduleId);u!==void 0&&u.packageName!==c.packageName&&i.push({packageName:u.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:d.id})}return i}function JE(e){let n=new Set(e.modules.filter(c=>c.isEntrypoint).map(c=>c.id)),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.functions.map(c=>[c.id,c])),o=new Set;for(let c of e.functions)n.has(c.moduleId)&&(c.publicSurfaceReachable||c.name==="<toplevel>")&&o.add(c.id);let r=new Map(e.exports.map(c=>[c.id,c]));for(let c of e.exportBindings){if(c.target.kind!=="function")continue;let p=r.get(c.exportId);if(p===void 0||!n.has(p.moduleId))continue;let u=s.get(c.target.functionId);u===void 0||t.get(u.moduleId)?.externalSurface===!0||o.add(u.id)}let i=new Map(e.callSites.map(c=>[c.id,c.enclosingFunctionId])),a=new Map;for(let c of e.callEdges){if(c.resolution!=="resolved"&&c.resolution!=="field-based")continue;let p=i.get(c.callSiteId);if(p===void 0)continue;let u=a.get(p);u===void 0?a.set(p,[c.calleeFunctionId]):u.push(c.calleeFunctionId)}let l=new Set(o),d=[...o];for(;d.length>0;){let c=d.pop();if(c!==void 0)for(let p of a.get(c)??[])l.has(p)||(l.add(p),d.push(p))}return l}function ZE(e,n,t,s){for(let o of n){if(o.modelId!==e.modelId||o.anchor.packageName!==e.anchorPackage||o.anchor.exportName!==e.entryExport)continue;let r=t.filter(a=>a.packageName===o.anchor.packageName&&a.exportName===o.anchor.exportName&&a.container===o.anchor.container),i=r.find(a=>a.resolution==="resolved")??r[0];if(i!==void 0)return s.has(i.callerFunctionId)}return null}function QE(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(r=>r.modelId!==void 0);let s=new Set(t),o=r=>s.has(r)||s.has($n[r]??"")||s.has(mt[r]??"");return e.some(r=>He(r.tier)&&r.reasonKind!==void 0&&o(r.reasonKind)||r.modelPromotedFromKind!==void 0&&o(r.modelPromotedFromKind))}function dd(e){let n=oo.now(),t=er(e.dir),s=e.xGo===!0,o=e.reader??(s&&e.shardPathGo!==void 0?br([Xt(e.shardPath),...e.shardPathPypi!==void 0?[Xt(e.shardPathPypi)]:[],Xt(e.shardPathGo)]):e.shardPathPypi!==void 0?br([Xt(e.shardPath),Xt(e.shardPathPypi)]):Xt(e.shardPath)),r=e.partialRows===!0;try{if(!/^\d+$/u.test(o.schemaVersion)||Number(o.schemaVersion)>Number(ht))throw new dt(`shard schema ${JSON.stringify(o.schemaVersion)} is unreadable or newer than this cupel understands (v${ht})`);let i=null;if(e.summaryShadow!==void 0)try{i=Dm(e.summaryShadow)}catch(H){throw new dt(`--summary-shadow facts dir rejected: ${H instanceof Error?H.message:String(H)}`)}let a=null;if(e.modelShadow!==void 0)try{a=Jm(e.modelShadow.claimsPath)}catch(H){throw new dt(`--model-shadow claims rejected: ${H instanceof Error?H.message:String(H)}`)}let l=Go(t,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{},discoverGoRoots:s}),d=s?$m(t,l.roots,e.goScan):null,c=d===null?null:qE(d,o),p=mp(t,l,e.installedSet,c?.sets);if(p.truncated){let H=p.perRoot.filter(ye=>ye.truncated).map(ye=>ye.rootRel===""?"the scan root":`\`${ye.rootRel}\``);throw new dt(`the dependency enumeration hit a hard cap and is incomplete at ${H.length>0?H.join(", "):"the union across roots"} (${p.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let u=gm(l.roots,{preciseNames:e.pyPreciseNames!==!1}),f=u?.execution??null,m=gp(p.packages.filter(H=>(H.ecosystem??"npm")==="npm")),h=e.entry??[],y=h.length>0?xf(t,h):{entrypoints:[],rejected:[]},_=y.rejected,S=Sf(t,l.roots.filter(H=>H.rel===""||H.ecosystem!=="Go")),b=[...new Set([...S.entrypoints,...y.entrypoints])],k=[...new Set([...S.sources.filter(H=>H.source!=="exports"&&H.source!=="browser").map(H=>H.entrypoint),...y.entrypoints])],w=[...S.sources];for(let H of y.entrypoints)S.entrypoints.includes(H)||w.push({source:"--entry",specifier:H,entrypoint:H,launch:!1,root:LE(l.roots,H)});let N=[...w];for(let H of u?.roots??[])for(let ye of H.entrypoints)w.push({source:`python:${ye.source}`,specifier:ye.declaration,entrypoint:H.rootRel===""?ye.file:`${H.rootRel}/${ye.file}`,launch:ye.source==="console-script"||ye.source==="launch-declaration",root:H.rootRel});let R=XE(p,o),v=e.bindingForms??PE,I=e.callablePackageResolver===!0,A=e.tsconfigPaths!==!1,B=$E(t,Uo(w)),O=zE(t,p.packages,B),V=H=>H.ecosystem==="Go"?c?.flags.get(ui(H.name,H.version))?.tool===!0?["bin"]:[]:(H.ecosystem??"npm")!=="npm"?f?.get(H.name)??["manifest-unreadable"]:O.get(sh(H))??["manifest-unreadable"],E=Ha({appRoot:t,entrypoints:b,executedEntrypoints:k,depClassAnchors:R,bindingForms:v,callablePackageResolver:I,tsconfigPaths:A}),D=E.graph,L=Gi(D),K=[...S.diagnostics,...qa(S),...Va(S,b.length),...bl(l,N),...E.diagnostics],Y=Zm(b.length,D),le=H=>p.packages.some(ye=>(ye.ecosystem??"npm")===H),z=u===null?"no-entrypoint":u.analysisAborted,Z=(le("npm")?Y:null)??(le("PyPI")?z:null)??(le("npm")||le("PyPI")||le("Go")||d!==null?null:Y),de=jE(o),x=[...p.gaps,...yp(l),...BE(p,de),...GE(p,o,de)],M=_p(x),X=Qm(D,K,M),W={graph:no,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},q=c===null?{...W,graph:ld}:{graph:c.graph,incompleteness:[],analysisAborted:c.analyzed?null:"no-entrypoint",symbolsDecidable:!1},F=d===null||c===null?null:{flags:(H,ye)=>c.flags.get(ui(H,ye)),blockers:d.blockers,configuration:d.toolchain===null?"no toolchain":`${d.toolchain.goos}/${d.toolchain.goarch}, CGO_ENABLED=${d.toolchain.cgo?"1":"0"}, default tags`},ne=H=>(H.ecosystem??"npm")==="npm"?{graph:D,incompleteness:X,analysisAborted:Y,symbolsDecidable:!0}:H.ecosystem==="Go"?q:u===null?W:{...u,symbolsDecidable:!0},pe=t;try{pe=er(t)}catch{}let Se=Wm({graph:D,facts:X,diagnostics:K,analysisAborted:Y,loadSites:E.loadSites,conditionUnions:E.conditionUnions,provenAbsent:E.provenAbsent,appRootReal:pe,rootBudget:l.budget,causeOf:H=>th[H]}),Ie=o.allModels?.()??[],$=Jl(Ie.map(H=>({model:{packageName:H.packageName,modelId:H.modelId,edges:H.edges},introduced:H.introduced,fixedBefore:H.fixedBefore})),m),T=$.models.length>0?Ro(D,$.models).delta:null,j=T!==null?{records:T.records,reachMods:Zn(D),modulesById:new Map(D.modules.map(H=>[H.id,H]))}:null,U=oo.now(),Q=[],te=new Map,ie=TE(),me=[],ge=[];for(let H of p.packages){let ye=ne(H),Ae=(H.ecosystem??"npm")==="npm"?j:null;for(let[,Pe]of UE(o.advisoriesForPackage(H.ecosystem??"npm",H.name))){let on=Pe[0];if(on!==void 0){let an=te.get(on.advisory.id),We=Pe.map(Tn=>Tn.affected);if(an===void 0)te.set(on.advisory.id,{advisory:on.advisory,ranges:We});else{let Tn=new Set(an.ranges.map(mn=>mn.id));for(let mn of We)Tn.has(mn.id)||(Tn.add(mn.id),an.ranges.push(mn))}}let Ke=Pe.map(an=>VE(ye.graph,Ae,H,an,ye.incompleteness,ye.analysisAborted,V)),pt=new Set(Pe.filter((an,We)=>Ke[We]==="inside")),Et=Ke.indexOf("undecidable"),At=Pe.filter((an,We)=>pt.has(an)||We===Et),Is=At.length>0?At:Pe.slice(0,1);for(let an of Is){let{advisory:We,affected:Tn}=an,mn=Qo(We.id,H.name,Tn),Wn=We.cveId??We.id,ls=pt.has(an)?o.symbolsForAffected(Tn.id):[],Nt=ls.filter(se=>se.exportName===null),ds=td(We.id,H.name,ls,Tn.surfaceComplete,r),It=Zo(ye.graph,Ae,{name:H.name,version:H.version,...H.ecosystem!==void 0?{ecosystem:H.ecosystem}:{},devOnly:H.dev,outOfGraphExecution:V(H)},mn,null,ye.incompleteness,ye.analysisAborted).finding;if(It.decidedAtStage==="presence"||It.decidedAtStage==="version-match"){let se=eh(It,H,F);ie[se.tier]+=1,Q.push({...se,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:mn.surfaceComplete,advisoryId:We.id,displayId:Wn,packageName:H.name,version:H.version,ecosystem:H.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:We.severity,packageLocation:Jr(p,H)});continue}for(let se of ds){let{finding:he,hit:ve}=Zo(ye.graph,Ae,{name:H.name,version:H.version,...H.ecosystem!==void 0?{ecosystem:H.ecosystem}:{},devOnly:H.dev,outOfGraphExecution:V(H)},mn,se,ye.incompleteness,ye.analysisAborted),en=eh(WE(he,ye,H),H,F),ze,Ce;ve!==null&&se!==null&&(ze=ve.modelId,Ce=he.reasonKind,en={basis:void 0,tier:ve.tier,decidedAtStage:he.decidedAtStage,reason:`boundary model ${ve.modelId}: ${ve.anchorPackage}.${ve.entryExport} reaches ${se.exportName} [${ve.pathLabels.join(" \u2192 ")}]`,reasonKind:void 0,attribution:pr(se),path:void 0,unresolvedSites:he.unresolvedSites,unresolvedEvidence:he.unresolvedEvidence}),ie[en.tier]+=1;let nn=Hm(Se,en,se,V(H).length,mn.surfaceComplete),hn={...en,...nn!==void 0?{adr105:nn}:{},modelId:ze,modelPromotedFromKind:Ce,surfaceComplete:mn.surfaceComplete,advisoryId:We.id,displayId:Wn,packageName:H.name,version:H.version,ecosystem:H.ecosystem??"npm",symbolName:se?.exportName??null,symbolPath:se?.sourcePath||null,symbolContainer:se?.container??null,severity:We.severity,packageLocation:Jr(p,H)};Q.push(hn);let Kt=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&He(hn.tier)&&hn.decidedAtStage==="symbol-reachable"&&hn.reasonKind!==void 0&&Kt.has(hn.reasonKind)&&se!==null&&me.push({finding:hn,symbol:se}),a!==null&&He(hn.tier)&&se!==null&&ge.push({finding:hn,symbol:se})}for(let se of Nt)ie[Te("symbol-unsupported")]+=1,Q.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:mn.surfaceComplete,tier:Te("symbol-unsupported"),decidedAtStage:"symbol-reachable",reason:`advisory ${Wn} carries a ${se.symbolKind} pattern symbol; pattern matching is not evaluated yet`,reasonKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:We.id,displayId:Wn,packageName:H.name,version:H.version,ecosystem:H.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:We.severity,packageLocation:Jr(p,H)})}}}for(let H of x)ie[Te("coverage-gap")]+=1,Q.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:Te("coverage-gap"),decidedAtStage:"presence",reason:H.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:id,displayId:id,packageName:H.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:null,reasonKind:"coverage-gap",packageLocation:hp(p,H)});let Re=oo.now()-U,Oe=ie["reachable-high"]+ie["reachable-medium"],_e=e.failOnReachable===!0&&Oe>0,Ge=QE(Q,zt(ie),e.failOnPotentiallyReachable),Ue=e.requireCompleteDenial===!0&&Q.some(H=>H.tier==="not-reachable"&&H.basis==="loader-assumption"),In=_e||Ge||Ue?2:0,Kn;if(i!==null){let H=Zn(D),ye=new Map(D.modules.map(Pe=>[Pe.id,Pe])),Ae=[];for(let{finding:Pe,symbol:on}of me){let Ke=$i(D,ye,H,on,i,OE);Ae.push({advisoryId:Pe.advisoryId,packageName:Pe.packageName,symbolName:Pe.symbolName,reasonKind:Pe.reasonKind??null,wouldPromote:Ke!==null,...Ke!==null?{anchorPackage:Ke.anchorPackage,entryExport:Ke.entryExport,viaPackages:Ke.viaPackages,totalHops:Ke.totalHops}:{}})}Kn={records:Ae}}let G;if(a!==null&&e.modelShadow!==void 0){let H=e.modelShadow.widened===!0?"widened":"base",{models:ye,notes:Ae,dispositions:Pe}=Jl(a,m,{shadowConsultDenylisted:!0}),{delta:on}=Ro(D,ye),Ke=Zn(D),pt=new Map(D.modules.map(se=>[se.id,se])),Et=YE(D,pt,Ke),At=JE(D),Is=on.records.some(se=>Et.some(he=>he.packageName===se.anchor.packageName&&he.exportName===se.anchor.exportName&&he.container===se.anchor.container)),an=[],We=Date.now();for(let{finding:se,symbol:he}of ge){let ve=on.records,en=rd(se,he,H),ze=en?po(D,pt,Ke,he,ve):null,Ce=on.records.filter(nn=>nn.callee.packageName===he.packageName&&nn.callee.exportName===he.exportName&&nn.callee.container===he.container||nn.callee.packageName===he.packageName&&nn.callee.realFunctionId!==null);an.push({advisoryId:se.advisoryId,packageName:se.packageName,symbolName:se.symbolName,reasonKind:se.reasonKind??null,decidedAtStage:se.decidedAtStage,consultSurface:H,noHitReason:ze!==null?null:en?Is?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:ze!==null?ZE(ze,ve,Et,At):null,verdictBefore:se.tier,verdictAfter:ze!==null?"reachable-low":se.tier,wouldPromote:ze!==null,...ze!==null?{modelId:ze.modelId,anchorPackage:ze.anchorPackage,entryExport:ze.entryExport,pathLabels:ze.pathLabels,calleeBinding:Ce.find(nn=>nn.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:en?Ce.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Ce[0]?.anchor.packageName??"?"}#${Ce[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Tn=Date.now()-We,mn=Pe.map(se=>{if(se.status!=="active")return{modelId:se.modelId,state:se.status,reason:se.reason,edgesLowered:0,edgesReferenceGated:0};let he=on.records.filter(en=>en.modelId===se.modelId).length;if(he>0)return{modelId:se.modelId,state:"lowered",reason:null,edgesLowered:he,edgesReferenceGated:se.edgeCount-he};let ve=on.notes.find(en=>en.startsWith(`model ${se.modelId}:`)||en.startsWith(`model-edge ${se.modelId}:`));return{modelId:se.modelId,state:"refused",reason:ve??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:se.edgeCount}}),Wn=an.filter(se=>se.wouldPromote).length,ls=zt(ie)-Wn,Nt=ie["reachable-high"]+ie["reachable-medium"],ds=se=>({none:0,"fail-on-reachable":Nt>0?2:0,"fail-on-potentially-reachable":se>0?2:0,both:Nt>0||se>0?2:0});G={records:an,notes:[...Ae,...on.notes],laneStates:mn,exitCodes:{baseline:ds(zt(ie)),withModels:ds(ls)},overlayWallMs:Tn},Ql(ct.dirname(e.modelShadow.outPath),{recursive:!0});let It=`${e.modelShadow.outPath}.tmp-${Zl(8).toString("hex")}`;nd(It,`${JSON.stringify(G,null,2)}
-`,{encoding:"utf8",flag:"wx"}),ed(It,e.modelShadow.outPath)}let J;if(e.bindingShadow!==void 0){let H=Date.now(),ye=se=>$.models.length>0?{records:Ro(se,$.models).delta.records,reachMods:Zn(se),modulesById:new Map(se.modules.map(he=>[he.id,he]))}:null,Ae=(se,he,ve,en)=>{let ze=[];for(let Ce of p.packages)for(let{advisory:nn,affected:hn}of o.advisoriesForPackage(Ce.ecosystem??"npm",Ce.name)){let Kt=Qo(nn.id,Ce.name,hn),eg=td(nn.id,Ce.name,o.symbolsForAffected(hn.id),hn.surfaceComplete,r);for(let Pd of eg){let{finding:Cd,hit:Ai}=Zo(se,en,{name:Ce.name,version:Ce.version,...Ce.ecosystem!==void 0?{ecosystem:Ce.ecosystem}:{},devOnly:Ce.dev,outOfGraphExecution:V(Ce)},Kt,Pd,he,ve);ze.push({advisoryId:nn.id,packageName:Ce.name,symbolName:Pd?.exportName??null,tier:Ai!==null?Ai.tier:Cd.tier,reasonKind:Ai!==null?null:Cd.reasonKind??null})}}return ze},Pe=se=>{let he=Ha({appRoot:t,entrypoints:b,executedEntrypoints:k,depClassAnchors:R,bindingForms:se,callablePackageResolver:I,tsconfigPaths:A}),ve=[...S.diagnostics,...qa(S),...Va(S,b.length),...bl(l,N),...he.diagnostics];return{graph:he.graph,inc:Qm(he.graph,ve,M),aborted:Zm(b.length,he.graph),live:ye(he.graph),applicability:he.bindingApplicability}},on=se=>{let he=Pe(se);return Ae(he.graph,he.inc,he.aborted,he.live)},Ke=Pe({}),pt=Ae(Ke.graph,Ke.inc,Ke.aborted,Ke.live),Et=Ae(D,X,Y,j);if(Et.length!==pt.length)throw new dt("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let At=(se,he)=>he.tier!==se.tier||he.reasonKind!==se.reasonKind,Is=pt.some((se,he)=>{let ve=Et[he];return ve!==void 0&&At(se,ve)}),an=Is?on({additiveForms:!0}):null,We=Is?on({namelessExports:!0}):null,Tn=0,mn=pt.map((se,he)=>{let ve=Et[he];if(ve===void 0||ve.advisoryId!==se.advisoryId||ve.packageName!==se.packageName||ve.symbolName!==se.symbolName)throw new dt("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let en={advisoryId:se.advisoryId,packageName:se.packageName,symbolName:se.symbolName,reasonKind:se.reasonKind,verdictBefore:se.tier,verdictAfter:ve.tier,wouldPromote:ve.tier!==se.tier&&(ve.tier==="reachable-high"||ve.tier==="reachable-medium"||ve.tier==="reachable-low")};if(!At(se,ve)||an===null||We===null)return en;Tn+=1;let ze=an[he],Ce=We[he],nn=ze!==void 0&&At(se,ze),hn=Ce!==void 0&&At(se,Ce);return{...en,attributedArm:nn&&!hn?"additiveForms":hn&&!nn?"namelessExports":"both",...ze!==void 0?{verdictArmA:ze.tier}:{},...Ce!==void 0?{verdictArmB:Ce.tier}:{}}}),Wn={...ie};pt.forEach((se,he)=>{let ve=Et[he];ve!==void 0&&ve.tier!==se.tier&&(Wn[ve.tier]-=1,Wn[se.tier]+=1)});let ls=(se,he)=>({none:0,"fail-on-reachable":se>0?2:0,"fail-on-potentially-reachable":he>0?2:0,both:se>0||he>0?2:0}),Nt;if($.models.length>0&&j!==null){Nt=[];for(let se of p.packages)for(let{advisory:he,affected:ve}of o.advisoriesForPackage(se.ecosystem??"npm",se.name)){let en=Qo(he.id,se.name,ve),ze=td(he.id,se.name,o.symbolsForAffected(ve.id),ve.surfaceComplete,r);for(let Ce of ze){if(Ce===null||!Ce.verified)continue;let nn=Zo(Ke.graph,Ke.live,{name:se.name,version:se.version,...se.ecosystem!==void 0?{ecosystem:se.ecosystem}:{},devOnly:se.dev,outOfGraphExecution:V(se)},en,Ce,Ke.inc,Ke.aborted);if(!(nn.hit===null&&rd(nn.finding,Ce,"base")))continue;let Kt=po(D,j.modulesById,j.reachMods,Ce,j.records);Nt.push({advisoryId:he.id,packageName:se.name,symbolName:Ce.exportName,modelWouldPromote:Kt!==null,...Kt!==null?{modelId:Kt.modelId}:{},anchorCleared:Kt!==null})}}}let ds=Q.some(se=>se.modelId!==void 0);J={records:mn,deltas:Tn,exitCodes:{baseline:ls(Wn["reachable-high"]+Wn["reachable-medium"],zt(Wn)+(ds?1:0)),withBindingForms:ls(ie["reachable-high"]+ie["reachable-medium"],zt(ie)+(ds?1:0))},dualRunWallMs:Date.now()-H,...E.bindingApplicability!==void 0?{applicability:E.bindingApplicability}:{},...Nt!==void 0?{modelProbe:Nt}:{}},Ql(ct.dirname(e.bindingShadow.outPath),{recursive:!0});let It=`${e.bindingShadow.outPath}.tmp-${Zl(8).toString("hex")}`;nd(It,`${JSON.stringify(J,null,2)}
-`,{encoding:"utf8",flag:"wx"}),ed(It,e.bindingShadow.outPath)}let ee=new Ut(t),ae=new Map,we=H=>{let ye=ae.get(H);if(ye!==void 0)return ye;let Ae=H==="npm"?new Ts(D,ee,Ms("npm"),()=>""):H==="Go"?new Ts(ld,ee,Ms("Go"),()=>""):new Ts(u?.graph??no,ee,Ms("PyPI"),Zi((u?.roots??[]).map(Pe=>Pe.rootRel)));return ae.set(H,Ae),Ae},Me=Ie.length>0||$.notes.length>0?{active:$.models.length,stored:Ie.length,promoted:Q.filter(H=>H.modelId!==void 0).length,notes:[...$.notes,...T!==null?T.notes:[]]}:void 0,xn=e0(Q,n,Re),zn=xn.findings.map(H=>H.path===void 0?H:{...H,located:we(H.ecosystem).locate(H)}),Un=new Map,io=H=>{let ye=Un.get(H);if(ye!==void 0)return ye;let Ae=H==="npm"?gc(D,ee):H==="Go"||u===null?null:yc(u.graph,we("PyPI"),ee);return Un.set(H,Ae),Ae},Ye=zn.map(H=>{let ye=H.located?.nodeOf,Ae=H.path?.[H.path.length-1]?.functionId;if(H.influence===void 0||ye===void 0||ye===null||Ae===void 0)return H;let Pe=io(H.ecosystem);return Pe===null?H:{...H,influenceOverlay:_c(Pe.index,Ae,ye,Pe.lineOf,Pe.pathOf)}}),Yn=()=>{if(u===null)return null;let H=new Map(u.graph.modules.map(Ae=>[Ae.id,Ae])),ye=Zi(u.roots.map(Ae=>Ae.rootRel));return{graph:mr(u.graph),lineOf:Ae=>{let Pe=H.get(Ae.path);if(Pe===void 0||Pe.id.includes("site-packages:"))return null;let on=ye(Pe.id),Ke=on===""?Pe.path:`${on}/${Pe.path}`;return Wt(ee,{...Ae,path:Ke},"utf8-bytes")?.startLine??null}}},ft=Fm(t,Ye,p.perRoot.flatMap(H=>H.pythonLockfilePath?[H.pythonLockfilePath]:[])),Ns;if(e.influenceShadow!==void 0){let H=sc(D,xn.findings,()=>oo.now(),Ae=>Wt(ee,Ae,"utf16-units")?.startLine??null,Yn());Ql(ct.dirname(e.influenceShadow.outPath),{recursive:!0});let ye=`${e.influenceShadow.outPath}.tmp-${Zl(8).toString("hex")}`;nd(ye,`${JSON.stringify(H,null,2)}
-`,{encoding:"utf8",flag:"wx"}),ed(ye,e.influenceShadow.outPath),Ns={ports:H.totals.ports,byOutcome:H.totals.byOutcome,wallMs:H.wallMs}}return{...Ns!==void 0?{influenceShadow:Ns}:{},...Kn!==void 0?{summaryShadow:Kn}:{},...G!==void 0?{modelShadow:G}:{},...J!==void 0?{bindingShadow:J}:{},...Me!==void 0?{modelLane:Me}:{},dir:t,shardSchemaVersion:o.schemaVersion,installed:p,findings:Ye.map((H,ye)=>{let Ae=ft.idOf[ye]??null;return Ae===null?H:{...H,introducedBy:Ae}}),packageGraphs:ft.graphs,timings:xn.timings,counts:ie,analyzerDiagnostics:K,pythonDiagnostics:u?.diagnostics??[],...d!==null?{go:{toolchain:d.toolchain===null?null:`${d.toolchain.goversion} ${d.toolchain.goos}/${d.toolchain.goarch}`,facts:d.facts,blockers:d.blockers,roots:d.roots.map(H=>({rootRel:H.rootRel,status:H.status,mode:H.mode,workspace:H.workspace,packages:H.packages,otherConfiguration:H.otherConfiguration,modules:H.modules.size,facts:H.facts}))}}:{},analysisAborted:Z,rejectedEntries:_,entrypointSources:w,entrypointGaps:[...S.gaps,...S.surfaceGaps],entrypointObservations:S.observations,framework:S.framework,unresolved:L,advisories:[...te.values()],rootSet:l,exitCode:In,adr105:Se.report}}finally{e.reader===void 0&&o.close()}}var sd=e=>Math.round(e*10)/10;function e0(e,n,t){let s=oo.now(),o=e.map(i=>{let a=Di(i.tier);return a===void 0?i:{...i,influence:a}}),r=oo.now()-s;return{findings:o,timings:{scanMs:sd(s-n),cascadeMs:sd(t),stage6Ms:sd(r)}}}var n0="cupel",t0="reachability-first SCA \u2014 verdict + call path + confidence";function cd(e){return[`${n0} v${e} \u2014 ${t0}`,`cascade: ${Vd.join(" \u2192 ")}`,`verdicts: ${Xd.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-potentially-reachable]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-potentially-reachable","                        exit 2 when any potentially reachable finding is present (strict CI;","                        --fail-on-unknown is the old name, still accepted, with a warning)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
-`)}var s0=new Set([...mo,...zi,...cs]),nr="--fail-on-potentially-reachable",ro="--fail-on-unknown",oh=`${ro} is deprecated: use ${nr} (the same gate, renamed by ADR-128). The old spelling keeps working, with this warning, until the next major version.`;function ut(e,n,t){let s=e[n+1];if(s===void 0||s.startsWith("--"))throw new Error(`${t} requires a value`);return s}function o0(e,n){let t=n.split(",").map(r=>r.trim()),s=[...mo,...zi,...cs].join(", ");if(t.length===0||t.some(r=>r===""))throw new Error(`${e}= requires a non-empty comma-separated list of: ${s} (or pass the bare ${e} to fail on every kind)`);let o=[];for(let r of t){if(!s0.has(r))throw new Error(`unrecognised ${e} selector ${JSON.stringify(r)}; valid: ${s}`);o.push(r)}return o}function rh(e){let n=".",t,s,o,r,i=!1,a=!1,l=!1,d=!1,c=!1,p=!1,u,f,m,h=!1,y=!1,_,S,b=!1,k=!1,w=!0,N=!0,R=!1,v,I=[],A=[];for(let B=0;B<e.length;B+=1){let O=e[B];if(O==="--require-complete-denial"){a=!0;continue}if(O==="--fail-on-reachable")i=!0;else if(O===nr||O===ro)l="all",O===ro&&(d=!0);else if(O!==void 0&&(O.startsWith(`${nr}=`)||O.startsWith(`${ro}=`))){let V=O.startsWith(`${nr}=`)?nr:ro;l=o0(V,O.slice(V.length+1)),V===ro&&(d=!0)}else if(O==="--offline")c=!0;else if(O==="--sarif")t=ut(e,B,"--sarif"),B+=1;else if(O==="--shard")s=ut(e,B,"--shard"),B+=1;else if(O==="--shard-pypi")o=ut(e,B,"--shard-pypi"),B+=1;else if(O==="--shard-go")r=ut(e,B,"--shard-go"),B+=1;else if(O==="--entry")I.push(ut(e,B,"--entry")),B+=1;else if(O==="--root")A.push(ut(e,B,"--root")),B+=1;else if(O==="--summary-shadow")u=ut(e,B,"--summary-shadow"),B+=1;else if(O==="--model-shadow")f=ut(e,B,"--model-shadow"),B+=1;else if(O==="--model-shadow-out")m=ut(e,B,"--model-shadow-out"),B+=1;else if(O==="--model-shadow-widened")h=!0;else if(O==="--binding-shadow")y=!0;else if(O==="--x-influence-shadow")S=ut(e,B,"--x-influence-shadow"),B+=1;else if(O==="--binding-shadow-out")_=ut(e,B,"--binding-shadow-out"),B+=1;else if(O==="--x-partial-rows")b=!0;else if(O==="--x-go")k=!0;else if(O==="--no-py-precise-names")w=!1;else if(O==="--x-py-precise-names")w=!0;else if(O==="--no-tsconfig-paths")N=!1;else if(O==="--x-tsconfig-paths")N=!0;else if(O==="--push")R=!0;else if(O!==void 0&&O.startsWith("--auth=")){let V=O.slice(7);if(V!=="oidc"&&V!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(V)}`);v=V}else{if(O!==void 0&&O.startsWith("--"))throw new Error(`unknown flag ${O}`);O!==void 0&&!p&&(n=O,p=!0)}}if(f===void 0!=(m===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(h&&f===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(y!==(_!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(v!==void 0&&!R)throw new Error("--auth only means something with --push");if(r!==void 0&&!k)throw new Error("--shard-go only means something with --x-go");return{dir:n,sarif:t,shard:s,shardPypi:o,shardGo:r,failOnReachable:i,requireCompleteDenial:a,failOnPotentiallyReachable:l,legacyGateFlag:d,offline:c,entry:I,root:A,summaryShadow:u,modelShadow:f,modelShadowOut:m,modelShadowWidened:h,push:R,auth:v,bindingShadow:y,bindingShadowOut:_,influenceShadowOut:S,partialRows:b,xGo:k,pyPreciseNames:w,tsconfigPaths:N}}import{chmodSync as u0,mkdirSync as f0,readFileSync as p0,renameSync as m0,statSync as h0,unlinkSync as g0,writeFileSync as y0}from"node:fs";import{randomBytes as _0}from"node:crypto";import{homedir as b0}from"node:os";import vs from"node:path";import{createPublicKey as r0,verify as i0}from"node:crypto";var Ee=class extends Error{constructor(n){super(n),this.name="DistError"}},Gt=class extends Ee{constructor(n){super(n),this.name="NoCachedShardError"}},a0=Buffer.from("302a300506032b6570032100","hex"),l0=32;function dh(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===l0)try{return r0({key:Buffer.concat([a0,n]),format:"der",type:"spki"})}catch{return}}function ud(e,n,t){for(let s of t){let o=dh(s);if(o!==void 0)try{if(i0(null,e,o,n))return!0}catch{}}return!1}function ch(e){return e.some(n=>dh(n)!==void 0)}var d0=/^[0-9a-f]{64}$/u,c0=/^[a-z0-9-]+$/u;function ih(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new Ee(`${n} must be an object`);return e}function ah(e,n){if(!Array.isArray(e))throw new Ee(`${n} must be an array`);return e}function mi(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new Ee(`${n} must be an integer`);return e}function hi(e,n){if(typeof e!="string")throw new Ee(`${n} must be a string`);return e}function lh(e,n){let t=hi(e,n);if(Number.isNaN(Date.parse(t)))throw new Ee(`${n} is not a valid timestamp: ${t}`);return t}function fd(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new Ee("distribution index is not valid JSON")}let s=ih(t,"index"),o=mi(s.schema_version,"schema_version");if(o!==n.supportedIndexSchemaVersion)throw new Ee(`index schema_version ${String(o)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let r=mi(s.sequence,"sequence");if(r<0)throw new Ee("sequence must be non-negative");let i=lh(s.generated,"generated"),a=ah(s.shards,"shards"),l;for(let m of a){let h=ih(m,"shard entry"),y=hi(h.ecosystem,"ecosystem");if(!c0.test(y))throw new Ee(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){l=h;break}}if(l===void 0)throw new Ee(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);lh(l.built,"built");let d=mi(l.db_schema_version,"db_schema_version");if(d<1)throw new Ee("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new Ee(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let c=hi(l.sha256,"sha256");if(!d0.test(c))throw new Ee(`sha256 must be 64 lowercase hex, got ${JSON.stringify(c)}`);let p=mi(l.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new Ee(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let u=ah(l.urls,"urls");if(u.length===0)throw new Ee("urls must be a non-empty array");let f=[];for(let m of u){let h=hi(m,"url");try{f.push(Ln(h,n.shardHosts))}catch(y){throw new Ee(`refusing shard url ${JSON.stringify(h)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:c,sizeBytes:p,dbSchemaVersion:d,urls:f,sequence:r,generated:i}}var uh="CUPEL_CONFIG_DIR",fh="credentials.json",pd="cpd_",S0="cpl_",x0=pd.length+6+32,k0=200,w0=/^[A-Za-z0-9_-]+$/u,tr=class extends Ee{constructor(n){super(n),this.name="StoredCredentialError"}};function ph(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=b0();if(process.platform==="darwin")return vs.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let r=e.APPDATA,i=r!==void 0&&r!==""?r:vs.join(t,"AppData","Roaming");return vs.join(i,"cupel")}let s=e.XDG_CONFIG_HOME,o=s!==void 0&&s!==""?s:vs.join(t,".config");return vs.join(o,"cupel")}function gi(e){return vs.join(ph(e),fh)}function md(e){let n=e.trim();return n.startsWith(S0)?{ok:!1,reason:"push-token"}:n.startsWith(pd)?n.length<x0||n.length>k0?{ok:!1,reason:"malformed"}:w0.test(n.slice(pd.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function mh(e,n){let t=ph(e),s=vs.join(t,fh);f0(t,{recursive:!0,mode:448}),process.platform!=="win32"&&u0(t,448);let o=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),r=`${s}.tmp-${_0(8).toString("hex")}`;return y0(r,`${o}
-`,{flag:"wx",mode:384}),m0(r,s),s}function hh(e){let n=gi(e),t;try{t=h0(n)}catch(i){if(i instanceof Error&&i.code==="ENOENT")return;throw i}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new tr(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let s;try{s=JSON.parse(p0(n,"utf8"))}catch{throw new tr(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let o=typeof s=="object"&&s!==null&&"delivery_token"in s?s.delivery_token:void 0,r=md(typeof o=="string"?o:"");if(!r.ok)throw new tr(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return r.token}function gh(e){try{return g0(gi(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var sr="CUPEL_DELIVERY_TOKEN",hd=class extends Ee{constructor(n){super(n),this.name="NoDeliveryTokenError"}},gd=class extends Ee{constructor(n){super(n),this.name="DeliveryCredentialError"}};function v0(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function yh(e,n,t=()=>{}){let s=v0(e)??t();return s!==void 0?()=>Promise.resolve(s):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function _h(e){if(e===void 0)throw new hd(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${sr} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new gd(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var E0="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function A0(){return new Promise(e=>{let n=process.stdin;process.stderr.write(E0),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",s=r=>{n.setRawMode(!1),n.pause(),n.removeListener("data",o),process.stderr.write(`
-`),r===null&&process.exit(130),e(r)},o=r=>{for(let i of r){if(i==="")return s(null);if(i==="\r"||i===`
-`)return s(t);if(i==="\x7F"||i==="\b"){t=t.slice(0,-1);continue}t+=i}};n.on("data",o)})}async function N0(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function bh(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${re(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
-`),!0)}async function Sh(e){if(bh(e,"login"))return 1;let n=process.stdin.isTTY?await A0():await N0(),t=md(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
+`)return{bad:"a string broken by a newline"};if(c==="\\"){let f=e.charAt(n+1);if(f!=="\\"&&f!=='"')return{bad:"an escape in an import path"};d+=f,n+=2;continue}d+=c,n+=1}return{bad:"an unterminated string"}}if(a==="`"){let d=e.indexOf("`",n+1);if(d<0)return{bad:"an unterminated raw string"};let c=e.slice(n+1,d);return n=d+1,{kind:"string",text:c}}if(a==="("||a===")"||a===";"||a===".")return n+=1,{kind:"punct",text:a};let l=n;for(;n<t;){let d=e.charCodeAt(n);if(!(d>=48&&d<=57||d>=65&&d<=90||d>=97&&d<=122||d===95||d>127))break;n+=1}return n===l?(n+=1,{kind:"punct",text:a}):{kind:"ident",text:e.slice(l,n)}},r=[],o=s();if("bad"in o)return{refused:o.bad};if(o.kind!=="ident"||o.text!=="package")return{refused:"no package clause"};if(o=s(),"bad"in o)return{refused:o.bad};if(o.kind!=="ident")return{refused:"no package name"};let i=a=>{let l=a;return(l.kind==="ident"||l.kind==="punct"&&l.text===".")&&(l=s()),"bad"in l?l:l.kind!=="string"?{bad:"an import without a path"}:l.text};for(;;){if(o=s(),"bad"in o)return{refused:o.bad};if(!(o.kind==="punct"&&o.text===";")){if(o.kind!=="ident"||o.text!=="import")break;if(o=s(),"bad"in o)return{refused:o.bad};if(o.kind==="punct"&&o.text==="(")for(;;){if(o=s(),"bad"in o)return{refused:o.bad};if(o.kind==="punct"&&o.text===";")continue;if(o.kind==="punct"&&o.text===")")break;if(o.kind==="eof")return{refused:"an unterminated import block"};let a=i(o);if(typeof a!="string")return{refused:a.bad};r.push(a)}else{if(o.kind==="eof")return{refused:"an import declaration without a path"};let a=i(o);if(typeof a!="string")return{refused:a.bad};r.push(a)}}}return{imports:r}}function Lg(e){let n;try{let t=gr(e);if(!t.isFile())return null;n=Z0(e,"r");let s=Buffer.alloc(Math.min(t.size,wg)),r=0;for(;r<s.length;){let o=nA(n,s,r,s.length-r,r);if(o===0)break;r+=o}return{text:s.subarray(0,r).toString("utf8"),whole:t.size<=wg}}catch{return null}finally{n!==void 0&&J0(n)}}function Rg(e,n){try{let t=gr(e);return!t.isFile()||t.size>n?null:eA(e,"utf8")}catch{return null}}function yA(e){try{return gr(e).isDirectory()}catch{return!1}}function bA(e,n){if(e===n)return!0;let t=n.endsWith(De.sep)?n:n+De.sep;return e.startsWith(t)}function _A(e,n,t){let s=/^(\d{1,4})\.(\d{1,4})/u.exec(e);if(s===null)return!1;let r=Number(s[1]),o=Number(s[2]);return r>n||r===n&&o>=t}function SA(e,n){let t=Cg(e.split("+")[0]??"");if(t===null||n===null)return!0;try{return $t(n,{advisoryId:"",packageName:"",ecosystem:"Go",introduced:"0",fixed:t,surfaceComplete:!1})}catch{return!0}}function kd(e){return/module lookup disabled by GOPROXY=off/u.test(e)?"go-module-missing":"go-list-failed"}function Dg(e,n){if(!bA(e,n))return"a go.work outside the scan root";let t=De.relative(n,e).split(De.sep).join("/");return t.length===0?"go.work":t}function xA(e,n,t){let s=Ed(e,["env","-json","GOWORK","GOMOD"],t,vd(e.env,"readonly",null));if(s.kind==="missing")return{failed:{kind:"go-toolchain-missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH`}};if(s.kind==="failed"||s.status!==0)return{failed:{kind:"go-list-failed",detail:`\`go env\` in the module ${s.kind==="failed"?s.detail:`exited ${String(s.status)}: ${mr(s.stderr)}`}`}};let r={};try{let S=JSON.parse(s.stdout);typeof S=="object"&&S!==null&&(r=S)}catch{}let o=typeof r.GOMOD=="string"?r.GOMOD:"",i;try{i=o.length>0&&De.isAbsolute(o)?De.join(wd(De.dirname(o)),De.basename(o)):""}catch{i=""}if(i!==De.join(t,"go.mod"))return{failed:{kind:"go-list-failed",detail:"the go command does not read this directory's go.mod as its module (GOMOD is another file, or none)"}};let a=Rg(De.join(t,"go.mod"),vg),l=a===null?[]:Zs(a),d=[],c=typeof r.GOWORK=="string"?r.GOWORK:"",f=null,p=[];if(c.length>0&&c!=="off"&&De.isAbsolute(c)){let S=Rg(c,vg);if(S===null)f=c;else{p=Zs(S);let k=De.dirname(c),v=Xr(p);[...v.inside,...v.outside].some(O=>{try{return wd(De.resolve(k,O))===t}catch{return!1}})?f=c:d.push(`${Dg(c,n)} governs this directory but does not \`use\` this module, so the go command builds it only on its own (GOWORK=off) \u2014 that is how it was listed`)}}let u=f!==null?p:l,m=Vr(u,"go"),g=Vr(u,"toolchain"),y=De.join(f!==null?De.dirname(f):t,"vendor"),b="readonly";if(yA(y))if(m===null||!_A(m,1,14))d.push("a vendor directory is present, but the governing go line is older than 1.14 (or absent), so the go command does not use it: listed -mod=readonly");else{let k=(Lg(De.join(y,"modules.txt"))?.text.slice(0,512)??"").split(`
+`)[0]??"";(k.startsWith("## ")&&k.slice(3).split(";").some(I=>I.trim()==="workspace"))===(f!==null)?b="vendor":d.push("a vendor directory is present for the other mode (workspace vs module), so the go command does not use it: listed -mod=readonly")}let _=l.filter(S=>S.verb==="tool").map(S=>S.args[0]??"").filter(S=>S.length>0);return{mode:b,gowork:f??"off",workspaceFile:f,facts:d,goLine:m,toolchainLine:g,modulePath:Vr(l,"module"),tools:_}}function kA(e,n){for(let s of n)if(e===s||e.startsWith(`${s}/`))return!1;return!(e.split("/")[0]??"").includes(".")}function wA(e,n,t){let s=[],r=[e],o=0;for(;r.length>0;){let i=r.pop();if(i===void 0)break;if(o+=1,o>t)return{dirs:s,truncated:!0};let a;try{a=Og(i).sort()}catch{continue}let l=[];for(let d of a){let c=De.join(i,d),f;try{f=Q0(c)}catch{continue}if(f.isDirectory()){if(d.startsWith(".")||d.startsWith("_")||d==="testdata"||d==="vendor")continue;try{if(gr(De.join(c,"go.mod")).isFile())continue}catch{}r.push(c)}else f.isFile()&&d.endsWith(".go")&&!d.endsWith("_test.go")&&Tg(d)&&l.push(d)}l.length>0&&!n.has(i)&&s.push({dir:i,files:l})}return{dirs:s,truncated:!1}}function Fg(e,n,t,s,r){return{rootRel:e,status:"failed",mode:n,workspace:null,packages:0,otherConfiguration:0,rows:[],gaps:t,diagnostics:s,facts:r,loadedPackages:new Set,otherConfigPackages:new Set,modules:new Map,loadedNames:new Set,importsPlugin:!1,packageModules:new Map,moduleDirs:new Map}}function vA(e,n,t,s,r){let o=t.abs,i=[],a=[],l=[],d=(re,R)=>{let D=r(R);i.push({kind:re,detail:D,blindsAnalysis:!1,rootRel:""}),a.push(D)},c=(re,R=null)=>(d(re.kind,`${re.detail} \u2014 NO Go module of this root was enumerated, so this scan says nothing about them; it is not a clean bill of health (ADR-108 D6)`),Fg(t.rel,R,i,a,l.map(r))),f=xA(e,n,o);if("failed"in f)return c(f.failed);l.push(...f.facts);let p=vd(e.env,f.mode,f.gowork),u=re=>{let R=Ed(e,["list",`-mod=${f.mode}`,"-e","-deps",`-json=${sA}`,"--",...re],o,p);if(R.kind==="missing")return{failed:{kind:"go-toolchain-missing",detail:`no Go toolchain: \`${e.go}\` is not on PATH`}};if(R.kind==="failed")return{failed:{kind:"go-list-failed",detail:`\`go list\` ${R.detail}`}};if(R.status!==0){let Y=mr(R.stderr);return{failed:{kind:kd(Y),detail:`\`go list\` exited ${String(R.status)}: ${Y}`}}}let D=pA(R.stdout,e.maxPackages);return"refused"in D?{failed:{kind:"go-list-failed",detail:`\`go list\` printed output that was refused as malformed (${D.refused})`}}:D},m=u(["./..."]);if("failed"in m)return c(m.failed,f.mode);let g=new Map,y=new Set;f.modulePath!==null&&y.add(f.modulePath);let b=[],_=[],S=(re,R)=>{R.length>=1e3||R.push(`${re.importPath} (${(re.error??"").split(`
+`)[0]?.slice(0,200)??""})`)};for(let re of m.packages)re.module!==null&&y.add(re.module.path);for(let re of m.packages){if(re.importPath.startsWith(".")||re.importPath.includes("...")){re.error!==null&&S(re,_);continue}re.error!==null?S(re,kd(re.error)==="go-module-missing"?b:_):!re.standard&&re.module===null&&_.length<1e3&&_.push(`${re.importPath} (a package outside any module)`),g.set(re.importPath,re)}let k=new Map,v=!0,I=[],O=re=>{v=!1,I.length<qt&&I.push(re)},E=g.has("plugin"),N=new Set;for(let re of g.values())re.dir!==null&&N.add(re.dir);let A=wA(o,N,e.maxWalkDirs);A.truncated&&O(`the module has more than ${String(e.maxWalkDirs)} directories`);let U=new Set([...N,...A.dirs.map(re=>re.dir)]),$=f.modulePath,W=0,w=new Set,P=re=>g.has(re)||k.has(re),j=(re,R,D)=>{if(R.endsWith("_test.go"))return;if(W+=1,W>e.maxFiles){W===e.maxFiles+1&&O(`more than ${String(e.maxFiles)} excluded files`);return}let Y=Lg(De.join(re,R));if(Y===null){O(`${D}/${R} could not be read`);return}if(mA(Y.text))return;let H=hA(Y.text);if("refused"in H){O(`${D}/${R}: ${Y.whole?H.refused:"its import clause runs past the byte bound"}`);return}for(let ee of H.imports)if(ee==="plugin"&&(E=!0),!(ee==="C"||!gA(ee)||kA(ee,y)||P(ee))){if($!==null&&(ee===$||ee.startsWith(`${$}/`))){let le=De.join(o,...ee.slice($.length).split("/").filter(de=>de!==""));if(U.has(le))continue}w.add(ee)}};for(let re of g.values())if(!(re.standard||re.dir===null))for(let R of re.ignoredGoFiles)j(re.dir,R,re.importPath);for(let re of A.dirs){let R=De.relative(o,re.dir).split(De.sep).join("/");for(let D of re.files)j(re.dir,D,R)}let F=0,B=!1;for(;w.size>0&&!B;){if(F+=1,F>e.maxRounds){O(`the closure did not finish in ${String(e.maxRounds)} rounds`);break}let re=[...w].sort();w.clear();let R=[];for(let D=0;D<re.length;D+=Ig){let Y=u(re.slice(D,D+Ig));if("failed"in Y){O(`listing what another configuration imports: ${Y.failed.detail.slice(0,300)}`),Y.failed.kind==="go-module-missing"&&b.length<1e3&&b.push(`(another configuration) ${Y.failed.detail.slice(0,200)}`);continue}R.push(...Y.packages)}for(let D of R)if(!(P(D.importPath)||D.importPath.startsWith("."))){if(D.importPath==="plugin"&&(E=!0),D.error!==null&&!D.error.startsWith("build constraints exclude all Go files")&&(O(`${D.importPath}: ${D.error.split(`
+`)[0]?.slice(0,200)??""}`),kd(D.error)==="go-module-missing"&&S(D,b)),!D.standard&&D.module===null){O(`${D.importPath} lies in no module the build list names`);continue}if(k.size+g.size>=e.maxPackages){O(`more than ${String(e.maxPackages)} packages`),B=!0;break}if(k.set(D.importPath,D),!D.standard&&D.dir!==null)for(let Y of D.ignoredGoFiles)j(D.dir,Y,D.importPath)}}let ne=[],X=new Map,Q=new Set,Z=new Set,x=new Set,T=new Map,q=new Map,G=new Map,z=(re,R)=>{if(re.standard||re.module===null||(T.set(re.importPath,re.module.path),q.has(re.module.path)||q.set(re.module.path,re.module.dir),re.module.main))return;let D=G.get(re.module.path);D===void 0?G.set(re.module.path,{module:re.module,inGraph:R}):R&&(D.inGraph=!0)};for(let re of g.values())re.standard||Q.add(re.importPath),z(re,!0);for(let re of k.values())re.standard||Z.add(re.importPath),z(re,!1);let L=f.toolchainLine!==null&&SA(f.toolchainLine,s.release)?f.toolchainLine:null,ie=re=>f.tools.some(R=>R===re||R.startsWith(`${re}/`)),me=[];for(let[re,R]of[...G.entries()].sort((D,Y)=>D[0]<Y[0]?-1:1)){let D=R.module.replace,Y=D!==null&&D.path===re&&D.version!=="",H=Y?D.version:R.module.version;X.set(re,H),R.inGraph&&x.add(re);let ee={};if(D!==null){let le=D.version===""?D.path:`${D.path}@${D.version}`;me.push(`${re}@${R.module.version===""?"?":R.module.version} => ${le}`),Y||(ee.replacedBy=r(le))}R.inGraph||(ee.otherConfiguration=!0),ie(re)&&(ee.tool=!0),ne.push({name:re,version:H,flags:ee}),D!==null&&!Y&&D.version!==""&&Ni(D.path,1024)&&/^[A-Za-z0-9]/u.test(D.path)&&(R.inGraph&&x.add(D.path),ne.push({name:D.path,version:D.version,flags:{replacementOf:re,...R.inGraph?{}:{otherConfiguration:!0}}}))}if(me.length>0&&l.push(`resolution divergence: ${String(me.length)} module(s) replaced (${me.slice(0,qt).join(", ")}${me.length>qt?", \u2026":""}); a replacement by other code or a local directory withholds the version verdict, never the import graph`),g.size>0||A.dirs.length>0){let re=s.release??s.goversion,R=L!==null?{toolchainAhead:L}:{};ne.push({name:"stdlib",version:re,flags:R}),ne.push({name:"toolchain",version:re,flags:R}),x.add("stdlib"),x.add("toolchain")}else l.push("the module holds no Go package, so it contributes no row");L!==null&&l.push(`the governing toolchain line is \`${L}\`, newer than ${s.goversion} on PATH: a build under GOTOOLCHAIN=auto uses that one, so the stdlib and toolchain version verdicts are withheld`),b.length>0&&d("go-module-missing",`the module cache lacks what ${String(b.length)} package(s) of this build need (${b.slice(0,qt).join("; ")}${b.length>qt?"; \u2026":""}) \u2014 nothing is fetched (GOPROXY=off), so their modules are MISSING from this scan. Run \`go mod download\` and re-scan`),_.length>0&&d("go-list-failed",`\`go list\` could not load ${String(_.length)} package(s) of this build (${_.slice(0,qt).join("; ")}${_.length>qt?"; \u2026":""}) \u2014 what they import is missing from this scan`),v||d("go-list-failed",`the packages another build configuration imports could not all be read (${I.join("; ")}) \u2014 a module imported only there may be missing from this scan`);let Me=b.length>0||_.length>0||!v?"partial":"ok";return{rootRel:t.rel,status:Me,mode:f.mode,workspace:f.workspaceFile===null?null:Dg(f.workspaceFile,n),packages:g.size,otherConfiguration:k.size,rows:ne,gaps:i,diagnostics:a,facts:l.map(r),loadedPackages:Q,otherConfigPackages:Z,modules:X,loadedNames:x,importsPlugin:E,packageModules:T,moduleDirs:q}}function jg(e,n,t={}){let s=n.filter(Qr);if(s.length===0)return null;let r=t.env??process.env,o=r[Pg],i={go:t.go??(o!==void 0&&o!==""?o:"go"),env:r,timeoutMs:t.timeoutMs??rA,maxOutputBytes:t.maxOutputBytes??oA,maxPackages:t.maxPackages??iA,maxRounds:t.maxRounds??aA,maxFiles:t.maxFiles??lA,maxWalkDirs:t.maxWalkDirs??dA},a=e;try{a=wd(e)}catch{}let l=cA(i);if("refused"in l){let g=Ng([[a,"."],[xg(),"~"]])(`${l.detail} \u2014 the Go scan needs one (ADR-108 F-108-B); NO Go module of this root was enumerated, so this scan says nothing about them; it is not a clean bill of health`);return{toolchain:null,roots:s.map(y=>Fg(y.rel,null,[{kind:"go-toolchain-missing",detail:g,blindsAnalysis:!1,rootRel:""}],[g],[])),blockers:["no Go toolchain read the build"],facts:[]}}let d=l.toolchain,c=Ng([[a,"."],[d.gomodcache,"$GOMODCACHE"],[d.goroot,"$GOROOT"],[xg(),"~"]]),f=s.map(g=>vA(i,a,g,d,c)),p=[],u=f.filter(g=>g.status!=="ok").map(g=>g.rootRel===""?".":g.rootRel);u.length>0&&p.push(`the Go build of ${u.slice(0,qt).join(", ")}${u.length>qt?", \u2026":""} was not read completely, and what it imports may be what this finding is about`),f.some(g=>g.importsPlugin)&&p.push("the build imports `plugin`: a plugin brings in packages no import graph here holds");let m=[`read with ${d.goversion} ${d.goos}/${d.goarch}, CGO_ENABLED=${d.cgo?"1":"0"}${d.experiment.length>0?`, GOEXPERIMENT=${d.experiment}`:""}, default build tags, GOFLAGS cleared, GOTOOLCHAIN=local, GOPROXY=off \u2014 the import graph is this configuration's; a package only another configuration imports is enumerated and never denied; tests, tools and plugins' own builds are outside it`];return{toolchain:d,roots:f,blockers:p,facts:m}}function Ri(e,n){return JSON.stringify([e,n])}function EA(e,n){let t=n.split("/");if(t.some(r=>r===""||r==="."||r===".."||r.includes("\\")))return!1;let s=e;for(let r of t){s=De.join(s,r);try{if(gr(De.join(s,"go.mod")).isFile())return!1}catch{}}try{return Og(s).some(r=>r.endsWith(".go")&&!r.endsWith("_test.go")&&gr(De.join(s,r)).isFile())}catch{return!1}}function Bg(e,n,t){let s=[],r=new Map(e.rows.map(i=>[i.name,i])),o=i=>{let a=e.packageModules.get(i);if(a!==void 0)return a;let l=null;for(let f of n)i.startsWith(`${f}/`)&&(l===null||f.length>l.length)&&(l=f);if(l===null)return null;let d=i.slice(l.length+1);if(/^v[0-9]+(\/|$)/u.test(d))return null;let c=e.moduleDirs.get(l)??null;return c!==null&&EA(c,d)?l:null};for(let[i,a]of[...e.modules.entries()].sort())for(let l of t(`${i}/`)){if(n.has(l)||o(l)!==i)continue;let d=r.get(i)?.flags??{},c={packageOf:i,...d.replacedBy!==void 0?{replacedBy:d.replacedBy}:{},...d.tool===!0?{tool:!0}:{},...!e.loadedPackages.has(l)&&e.otherConfigPackages.has(l)?{otherConfiguration:!0}:{}};s.push({name:l,version:a,flags:c})}return s}import{readdirSync as AA,readFileSync as IA}from"node:fs";import NA from"node:path";var RA=new Set(["summarized","crashed","over-cap"]),OA=new Set(["function","method","ctor"]);function Xe(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function Ad(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function PA(e,n){Ad(e)||Xe(n,"edge is not an object");let{entryPath:t,entryExport:s,entryContainer:r,hops:o}=e;(typeof t!="string"||typeof s!="string")&&Xe(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&Xe(n,"entryContainer must be string or null"),(typeof o!="number"||!Number.isInteger(o)||o<0)&&Xe(n,"hops must be a non-negative integer");let i=e.target;if(Ad(i)||Xe(n,"edge target missing"),i.kind==="symbol"){let{exportName:a,container:l,symbolKind:d}=i;return typeof a!="string"&&Xe(n,"symbol target exportName"),l!==null&&typeof l!="string"&&Xe(n,"symbol target container"),(typeof d!="string"||!OA.has(d))&&Xe(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:s,entryContainer:r,target:{kind:"symbol",exportName:a,container:l,symbolKind:d},hops:o}}if(i.kind==="dep"){let{calleePackage:a,calleeSubpath:l,calleeExport:d}=i;return(typeof a!="string"||a.length===0)&&Xe(n,"dep target calleePackage"),l!==null&&typeof l!="string"&&Xe(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&Xe(n,"dep target calleeExport"),{entryPath:t,entryExport:s,entryContainer:r,target:{kind:"dep",calleePackage:a,calleeSubpath:l,calleeExport:d},hops:o}}Xe(n,`unknown target kind ${JSON.stringify(i.kind)}`)}function CA(e,n){Ad(e)||Xe(n,"root is not an object");let{packageName:t,analyzedVersion:s,tool:r,toolVersion:o,maxIndirections:i,status:a}=e;(typeof t!="string"||t.length===0)&&Xe(n,"packageName"),typeof s!="string"&&Xe(n,"analyzedVersion"),r!=="jelly"&&Xe(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof o!="string"&&Xe(n,"toolVersion"),typeof i!="number"&&Xe(n,"maxIndirections"),(typeof a!="string"||!RA.has(a))&&Xe(n,`status ${JSON.stringify(a)} not in the enum`);let l=e.edges;return Array.isArray(l)||Xe(n,"edges is not an array"),a!=="summarized"&&l.length>0&&Xe(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:s,tool:r,toolVersion:o,maxIndirections:i,status:a,edges:l.map(d=>PA(d,n))}}function Gg(e){let n=new Map,t=AA(e).filter(s=>s.endsWith(".summary.json"));for(let s of t){let r=NA.join(e,s),o;try{o=JSON.parse(IA(r,"utf8"))}catch(l){Xe(s,`unparseable JSON: ${l instanceof Error?l.message:String(l)}`)}let i=CA(o,s),a=n.get(i.packageName);a===void 0?n.set(i.packageName,[i]):a.push(i)}return n}import It from"node:path";function MA(e,n){let t=e.read(n);if(t===null)return null;let s=t.toString("utf8"),r=It.posix.basename(n);if(r==="package-lock.json"||r==="npm-shrinkwrap.json")return $l(s);if(r==="pnpm-lock.yaml")return Ll(s);if(r==="yarn.lock")return Dl(s,TA(e,n));if(r==="uv.lock")return Kl(s);if(r==="poetry.lock"){let o=e.read(It.posix.join(It.posix.dirname(n),"pyproject.toml")),i=o===null?[]:[...gi(o.toString("utf8")).keys()];return zl(s,i)}return null}function TA(e,n){let t=new Map,s=e.read(It.posix.join(It.posix.dirname(n),"package.json"));if(s===null)return t;let r;try{r=JSON.parse(s.toString("utf8"))}catch{return t}if(typeof r!="object"||r===null)return t;for(let o of["dependencies","devDependencies","optionalDependencies"]){let i=r[o];if(!(typeof i!="object"||i===null||Array.isArray(i)))for(let[a,l]of Object.entries(i))typeof l=="string"&&!t.has(a)&&t.set(a,l)}return t}function Kg(e,n,t=[]){let s=new Jt(e,Yl),r=new Map,o=new Map,i=new Map,a=[],l=p=>{if(!o.has(p)){let m=s.read(p)?.toString("utf8")??null,g=It.posix.basename(p);o.set(p,m===null?null:g==="pyproject.toml"?gi(m):g.endsWith(".txt")?Wl(m):jl(m))}return o.get(p)??null},d=(p,u)=>{let m=p.endsWith("pyproject.toml"),g=m?vt(u):u,y=m?[p,It.posix.join(It.posix.dirname(p),"requirements.txt")]:[p];for(let b of y){let _=l(b)?.get(g);if(_!==void 0)return{path:b,line:_}}return null},c=(p,u,m)=>{let g=JSON.stringify([p,u,m]),y=i.get(g);if(y!==void 0)return y;r.has(p)||r.set(p,MA(s,p));let b=r.get(p)??null,_=b===null?null:Fl(b,u,m,{maxNodes:ns.maxPackageGraphNodes,maxEdges:ns.maxPackageGraphEdges}),S=null;if(_!==null&&a.length<ns.maxPackageGraphs){S=`g${String(a.length)}`;let k=It.posix.dirname(p);a.push({id:S,nodes:_.nodes.map(v=>{let I=v.directFrom===null?null:It.posix.join(k,v.directFrom);return{id:v.id,name:v.name,version:v.version,direct:v.directFrom!==null,declaredIn:I===null?null:d(I,v.name)}}),edges:_.edges.map(v=>({from:v.from,to:v.to})),truncated:_.truncated})}return i.set(g,S),S},f=n.map(p=>{if(p.tier==="not-affected"||p.ecosystem==="Go")return null;if(p.ecosystem==="PyPI"){for(let u of t){let m=c(u,p.packageName,p.version);if(m!==null)return m}return null}return p.packageLocation===null?null:c(p.packageLocation,p.packageName,p.version)});return{graphs:a,idOf:f}}import{isBuiltin as zg}from"node:module";function te(e){let n="";for(let t of e){let s=t.charCodeAt(0),r=s<32||s>=127&&s<=159;n+=r?"\\x"+s.toString(16).padStart(2,"0"):t}return n}var Wg=1024,Ug=4096,Oi=8,Hg=512,qg=512,Id=8,$A=160,LA=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),Nd=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),DA=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,FA=/\.[cm]?[jt]sx?$/u;function Vg(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let s=e.lastIndexOf("node_modules/");if(s!==-1){let r=e.slice(s+13).split("/"),o=r[0]??"";return o.startsWith("@")?r[1]===void 0?null:`${o}/${r[1]}`:o===""?null:o}return DA.test(e)&&!FA.test(e)?e:null}function jA(e){return te(`${e.code} ${e.path}: ${e.detail}`.slice(0,$A))}function Xg(e){let{graph:n,facts:t,diagnostics:s}=e,r=new Map(n.modules.map(L=>[L.id,L])),o=new Map(n.modules.map(L=>[L.path,L])),i=tt(n),a=new Set;for(let L of i){let ie=r.get(L);ie!==void 0&&a.add(ie.packageName)}let l=new Map,d=0,c=!1,f=!1,p=L=>L.startsWith(`${e.appRootReal}/`)?L.slice(e.appRootReal.length+1):L;for(let L of s){if(L.code==="limit-exceeded"&&L.path===e.appRootReal){c=!0;continue}let ie=Vg(p(L.path),o);if(ie===null){L.code==="out-of-root"&&d++,Nd.has(L.code)&&(f=!0);continue}let me=o.get(p(L.path));me!==void 0&&Nd.has(L.code)&&!me.path.includes("node_modules/")&&(f=!0);let be=l.get(ie);be===void 0?l.set(ie,[L]):be.push(L)}let u=new Map(n.imports.map(L=>[L.id,L])),m=new Set;for(let L of n.importEdges){let ie=u.get(L.importId);ie!==void 0&&r.get(ie.moduleId)?.externalSurface===!0&&m.add(ie.moduleId)}let g=[],y=new Set,b=n.modules.filter(L=>L.externalSurface===!0);for(let L of b){let ie=l.get(L.packageName)??[],me=m.has(L.id),be=[],Me=_e=>_e.code==="dependency-body"&&_e.anchor===void 0&&/syntax/u.test(_e.detail),re=_e=>_e.code==="loader-escape"||_e.code==="dependency-body"&&_e.anchor===void 0&&!/syntax/u.test(_e.detail),R=ie.filter(_e=>LA.has(_e.code)),D=ie.filter(re),Y=ie.filter(_e=>Nd.has(_e.code)||Me(_e)),H=ie.filter(_e=>_e.code==="out-of-root"),ee=me&&R.length===0,le=D.length===0,de=!c&&Y.length===0,ge=d===0&&H.length===0;me||be.push("(a) the package's entry was never followed to a module");for(let _e of[...R,...D,...Y,...H]){if(be.length>=Id)break;be.push(jA(_e))}c&&be.length<Id&&be.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&be.length<Id&&be.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let ve=["a","b","c","d"].filter(_e=>!{a:ee,b:le,c:de,d:ge}[_e]),Re=ve.length===0;Re&&y.add(L.id),g.push({packageName:te(L.packageName),module:te(String(L.id)),inReach:i.has(L.id),builtin:zg(L.packageName),followed:me,d1:{a:ee,b:le,c:de,d:ge},failing:ve,transparent:Re,evidence:be})}let _=new Set;for(let L of t)L.reach.kind==="unbounded"&&_.add(L.source);let S=L=>({module:te(String(L.module)),kind:L.kind,packageName:r.get(L.module)?.packageName??null}),k=new Set(b.filter(L=>zg(L.packageName)).map(L=>L.id)),v=new Set([...y,...k]),I=[],O=new Map,E=0,N=0,A=0,U=0,$=[],W=new Set;for(let L of t)L.reach.kind==="unbounded"&&W.add(L.cause);for(let L of t){if(L.reach.kind==="class-scope"){$.push({packageName:L.reach.packageName,container:L.reach.container});continue}if(L.reach.kind==="unbounded"||L.reach.kind==="dependency-dispatch"||L.reach.kind==="loaded-package")continue;U++;let ie=L.reach.anchor,me=O.get(String(ie));me===void 0&&(me={today:wr(n,ie,_),d1:wr(n,ie,_,y),d1Builtins:wr(n,ie,_,v)},O.set(String(ie),me)),me.d1Builtins.length>0&&A++,me.today.length>0&&(E++,W.add(L.cause)),me.d1.length>0&&N++,I.length<Ug&&I.push({anchor:te(String(ie)),packageName:te(r.get(ie)?.packageName??""),cause:L.cause,reachKind:L.reach.kind,blockersToday:me.today.slice(0,Oi).map(S),blockersUnderD1:me.d1.slice(0,Oi).map(S),blockedUnderD1Builtins:me.d1Builtins.length>0,moreToday:Math.max(0,me.today.length-Oi),moreUnderD1:Math.max(0,me.d1.length-Oi)})}let w=s.filter(L=>L.anchor===void 0&&L.classScope===void 0),P=new Map(e.loadSites.map(L=>[L.importId,L])),j=new Map;for(let L of e.loadSites){let ie=j.get(L.path);ie===void 0?j.set(L.path,[L.shape]):ie.push(L.shape)}let F=L=>{if(L.code!=="loader-escape")return!1;let ie=L.escapes??[];if(ie.length===0||ie.some(be=>be!=="non-literal-load"))return!1;let me=j.get(L.path)??[];return me.length>0&&me.every(be=>be==="relative-bounded")},B=w.slice(0,qg).map(L=>({cause:e.causeOf(L.code),code:L.code,path:te(p(L.path)),attributedPackage:Vg(p(L.path),o),...L.escapes!==void 0?{escapes:[...L.escapes]}:{},...L.reason!==void 0?{reason:L.reason}:{},d2Dischargeable:F(L)})),ne={};for(let L of w){if(L.code!=="unresolved-specifier")continue;let ie=L.reason??"(none)";ne[ie]=(ne[ie]??0)+1}let X=_.size===0?0:t.filter(L=>L.reach.kind==="unbounded").length,Q=Math.max(0,X-w.length),Z=X-w.filter(F).length,x=[],T=0,q=0,G=0;for(let L of n.imports){if(L.specifierIsLiteral)continue;G++;let ie=i.has(L.moduleId),me=P.get(String(L.id)),be=me?.shape??"unrecorded";ie&&(T++,be==="relative-bounded"&&q++),x.length<Hg&&x.push({importId:te(String(L.id)),path:te(r.get(L.moduleId)?.path??""),shape:be,text:te(me?.text??""),inReach:ie})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:c,appCapHit:f,unattributedOutOfRoot:d,blindUnbounded:Q,unbounded:B,anchors:I,surfaces:g.slice(0,Wg),loads:x,counts:{modules:n.modules.length,reachMods:i.size,surfaces:b.length,surfacesInReach:g.filter(L=>L.inReach).length,transparentSurfaces:y.size,builtinSurfaces:k.size,anchors:U,anchorsBlockedToday:E,anchorsBlockedUnderD1:N,anchorsBlockedUnderD1Builtins:A,unbounded:X,loadsInReach:T,loadsRelativeBounded:q,unresolvedByReason:ne,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,g.length-Wg),anchors:Math.max(0,U-Ug),loads:Math.max(0,G-Hg),unbounded:Math.max(0,w.length-qg)}},reachedPackages:a,aborted:e.analysisAborted,unboundedFacts:X,unboundedHard:Z,anchorsBlockedToday:E,anchorsBlockedUnderD1:N,anchorsBlockedUnderD1Builtins:A,loadsInReach:T,loadsAllBounded:T>0&&q===T,d2Eligible:e.rootBudget==="complete"&&!f&&!c,classScope:$,taintCausesToday:W}}var BA=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),GA=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Yg(e,n,t,s,r){if(t===null||e.reachedPackages.has(t.packageName))return;let o=e.classScope.some(E=>E.packageName===t.packageName&&E.container===t.container),i=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||o,a=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||a||n.reasonKind!==void 0&&BA.has(n.reasonKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":i?"taint":s>0?"oog":"unexpected",c=new Set(e.taintCausesToday);o&&c.add("dep-opaque");let f=e.aborted!==null?e.aborted:GA.find(E=>c.has(E)),p=d==="pre-2b"?He(n.tier)&&(a?n.reasonKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?He(n.tier)&&n.reasonKind==="dynamic-load":d==="taint"?He(n.tier)&&n.reasonKind===f:d==="oog"?He(n.tier)&&n.reasonKind==="analysis-cap":!1,u=t.verified&&r===!0,m=e.aborted===null&&e.unboundedFacts===0&&!o&&s===0,g=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,y=u&&d==="taint"&&m&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,b=u&&d==="load"&&m&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,_=u&&(d==="load"||d==="taint")&&m&&g&&e.anchorsBlockedUnderD1===0,S=e.aborted===null&&e.unboundedHard===0&&!o&&s===0,k=u&&d==="load"&&S&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,v=u&&(d==="load"||d==="taint")&&S&&g&&e.anchorsBlockedUnderD1===0,I=u&&d==="taint"&&m&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,O=u&&(d==="load"||d==="taint")&&S&&g&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:p,verified:t.verified,surfaceComplete:r,oog:s,classScoped:o,predicted:{d1:y,d2:b,d1d2:_,d2Amended:k,d1d2Amended:v,d1Builtins:I,d1d2AmendedBuiltins:O}}}import{readFileSync as KA,statSync as zA}from"node:fs";var Od=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,Pi=/^[A-Za-z0-9_$.-]{1,128}$/u,Jg=64,Qg=1024*1024,Zg=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,eh=/^[A-Za-z0-9@_.-]{1,128}$/u;function en(e){throw new Error(`model claims rejected: ${e}`)}function Rd(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function WA(e,n){Rd(e)||en(`${n}: edge is not an object`);let{kind:t,anchorExport:s,anchorContainer:r,calleePackage:o,calleeContainer:i,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&en(`${n}: edge kind`),(typeof s!="string"||!Pi.test(s))&&en(`${n}: anchorExport ${JSON.stringify(s)}`),r!==null&&(typeof r!="string"||!Pi.test(r))&&en(`${n}: anchorContainer`),(typeof o!="string"||!Od.test(o))&&en(`${n}: calleePackage ${JSON.stringify(o)}`),i!==null&&(typeof i!="string"||!Pi.test(i))&&en(`${n}: calleeContainer`),(typeof a!="string"||!Pi.test(a))&&en(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:s,anchorContainer:r,calleePackage:o,calleeContainer:i,calleeExport:a}}function nh(e){let n=zA(e).size;n>Qg&&en(`file is ${String(n)} bytes, over the ${String(Qg)} cap`);let t;try{t=JSON.parse(KA(e,"utf8"))}catch(r){en(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||en("root is not an array"),t.length>Jg&&en(`${String(t.length)} claims over cap ${String(Jg)}`);let s=[];for(let r of t){Rd(r)||en("claim is not an object");let{packageName:o,modelId:i,range:a,edges:l}=r;(typeof o!="string"||!Od.test(o))&&en("packageName"),(typeof i!="string"||!eh.test(i))&&en("modelId (identifier charset, 1-128 chars)"),s.some(c=>c.model.modelId===i)&&en(`duplicate modelId ${i} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Rd(a)||typeof a.introduced!="string")&&en(`${i}: range`),Zg.test(a.introduced)||en(`${i}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let d=a.fixedBefore;d!==null&&typeof d!="string"&&en(`${i}: fixedBefore`),typeof d=="string"&&!Zg.test(d)&&en(`${i}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(l)||en(`${i}: edges`),l.length>64&&en(`${i}: ${String(l.length)} edges over cap ${String(64)}`),s.push({model:{packageName:o,modelId:i,edges:l.map(c=>WA(c,i))},introduced:a.introduced,fixedBefore:d})}return s}var UA=["in-app-purchase@1-v1"];function Pd(e,n,t){let s=[],r=[],o=[],i=(a,l,d,c)=>{r.push(d),o.push({modelId:c??a.model.modelId,status:l,reason:d,edgeCount:a.model.edges.length})};for(let a of e){if(!Od.test(a.model.packageName)||!eh.test(a.model.modelId)){i(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&UA.includes(a.model.modelId)){i(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(c=>c.kind!=="alias"&&c.kind!=="dispatch")){i(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let l=n(a.model.packageName);if(typeof l!="string"&&l!==void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} installed at more than one version (${l.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(l===void 0){i(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let d;try{d=$t(l,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${l} is not a version cupel can order \u2014 inert (never guessed)`);continue}if(!d){i(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${l} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}s.push(a.model),o.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:s,notes:r,dispositions:o}}var th=["javascript-typescript","python","go","rust","components"],Cd=[{language:"javascript-typescript",label:"JavaScript and TypeScript",extensions:[".js",".mjs",".cjs",".jsx",".ts",".mts",".cts",".tsx"],frontEnd:"in-process"},{language:"python",label:"Python",extensions:[".py",".pyi"],frontEnd:"interpreter"},{language:"go",label:"Go",extensions:[".go"],frontEnd:"not-on-scan-side"},{language:"rust",label:"Rust",extensions:[".rs"],frontEnd:"none"},{language:"components",label:"Component files (.vue, .svelte, .astro)",extensions:[".vue",".svelte",".astro"],frontEnd:"in-process"}],HA=new Map(Cd.flatMap(e=>e.extensions.map(n=>[n,e])));function uo(e){let n=e.lastIndexOf(".");return n<=0?null:HA.get(e.slice(n))??null}function Ci(e){let n=Cd.find(t=>t.language===e);if(n===void 0)throw new Error(`unknown inventory language ${e}`);return n}import{lstatSync as Fd,readdirSync as bI,readFileSync as _I,realpathSync as SI,statSync as jd}from"node:fs";import{join as po,relative as xI,resolve as kI}from"node:path";import{existsSync as qA,lstatSync as VA,readFileSync as sh,statSync as rh}from"node:fs";import{dirname as oh,isAbsolute as ih,join as Nt,relative as XA,resolve as Ti,sep as YA}from"node:path";var JA=64,fo=1024*1024,QA=256*1024*1024,ZA=5e6,eI=4096,nI=e=>e.split(YA).join("/");function ah(e,n){let t=tI(e);if(t===null)return null;let{root:s,dotGit:r}=t,o=sI(r);if(o===null)return null;let i=rI(o),a=Cs(Nt(i,"config"),fo),l=a===null?new Map:Mi(a,"core"),c=((a===null?new Map:Mi(a,"extensions")).get("objectformat")??"sha1").toLowerCase()==="sha256"?32:20;return{root:s,scanPrefix:nI(XA(s,Ti(e))),gitDir:o,commonDir:i,ignoreCase:(l.get("ignorecase")??"false").toLowerCase()==="true",infoExclude:Cs(Nt(i,"info","exclude"),fo),globalExcludes:oI(l.get("excludesfile"),n),index:iI(Nt(o,"index"),c)}}function tI(e){let n=Ti(e);for(let t=0;t<JA;t+=1){let s=Nt(n,".git");if(qA(s))return{root:n,dotGit:s};let r=oh(n);if(r===n)return null;n=r}return null}function sI(e){try{let r=VA(e);if(r.isDirectory())return e;if(!r.isFile())return null}catch{return null}let n=Cs(e,4096);if(n===null)return null;let t=n.split(`
+`).find(r=>r.startsWith("gitdir:"));if(t===void 0)return null;let s=t.slice(7).trim();return s.length===0?null:ih(s)?s:Ti(oh(e),s)}function rI(e){let n=Cs(Nt(e,"commondir"),4096);if(n===null)return e;let t=n.trim();return t.length===0?e:ih(t)?t:Ti(e,t)}function oI(e,n){let t=n.home,s=n.xdgConfigHome??(t===void 0?void 0:Nt(t,".config")),r=e;if(r===void 0&&t!==void 0){let a=Cs(Nt(t,".gitconfig"),fo);a!==null&&(r=Mi(a,"core").get("excludesfile"))}if(r===void 0&&s!==void 0){let a=Cs(Nt(s,"git","config"),fo);a!==null&&(r=Mi(a,"core").get("excludesfile"))}let o;if(r!==void 0?o=r.startsWith("~/")&&t!==void 0?Nt(t,r.slice(2)):r:s!==void 0&&(o=Nt(s,"git","ignore")),o===void 0)return null;let i=Cs(o,fo);return i===null?null:{path:o,text:i}}function Mi(e,n){let t=new Map,s="";for(let r of e.split(`
+`)){let o=r.trim();if(o.length===0||o.startsWith("#")||o.startsWith(";"))continue;if(o.startsWith("[")){let c=o.indexOf("]");s=c===-1?"":o.slice(1,c).trim().toLowerCase();continue}if(s!==n)continue;let i=o.indexOf("="),a=(i===-1?o:o.slice(0,i)).trim().toLowerCase(),l=i===-1?"true":o.slice(i+1).trim(),d=l.search(/\s[#;]/u);d!==-1&&!l.startsWith('"')&&(l=l.slice(0,d).trim()),l.startsWith('"')&&l.endsWith('"')&&l.length>=2&&(l=l.slice(1,-1)),t.set(a,l)}return t}function Cs(e,n){try{let t=rh(e);return!t.isFile()||t.size>n?null:sh(e,"utf8")}catch{return null}}function iI(e,n){let t;try{let s=rh(e);if(!s.isFile())return{kind:"absent"};if(s.size>QA)return{kind:"refused",reason:"index larger than 256 MiB"};t=sh(e)}catch{return{kind:"absent"}}return aI(t,n)}function aI(e,n){if(e.length<12||e.toString("latin1",0,4)!=="DIRC")return{kind:"refused",reason:"not a git index"};let t=e.readUInt32BE(4);if(t<2||t>4)return{kind:"refused",reason:`index version ${String(t)}`};let s=e.readUInt32BE(8);if(s>ZA)return{kind:"refused",reason:"too many index entries"};let r=new Set,o=[],i=40+n+2,a=12,l=Buffer.alloc(0);for(let f=0;f<s;f+=1){let p=a;if(a+i>e.length)return{kind:"refused",reason:"index truncated"};let u=e.readUInt32BE(a+24),m=e.readUInt16BE(a+40+n);if(a+=i,(m&16384)!==0){if(t<3)return{kind:"refused",reason:"extended flag in a version 2 index"};a+=2}let g;if(t===4){let b=lI(e,a);if(b===null)return{kind:"refused",reason:"index truncated"};a=b.next;let _=e.indexOf(0,a);if(_===-1||b.value>l.length)return{kind:"refused",reason:"index truncated"};g=Buffer.concat([l.subarray(0,l.length-b.value),e.subarray(a,_)]),a=_+1}else{let b=e.indexOf(0,a);if(b===-1)return{kind:"refused",reason:"index truncated"};g=e.subarray(a,b);let _=b-p+1;a=p+Math.ceil(_/8)*8}if(g.length>eI)return{kind:"refused",reason:"index path too long"};l=g;let y=g.toString("utf8");(u&61440)===16384?o.push(y.endsWith("/")?y.slice(0,-1):y):r.add(y)}let d=e.length-n;for(;a+8<=d;){if(e.toString("latin1",a,a+4)==="link")return{kind:"refused",reason:"split index"};let p=e.readUInt32BE(a+4);if(a+8+p>d)break;a+=8+p}let c=[...r].sort(dI);return{kind:"read",tracked:{files:r,sorted:c,sparseDirs:o}}}function lI(e,n){let t=n;if(t>=e.length)return null;let s=e[t]??0;t+=1;let r=s&127;for(;(s&128)!==0;){if(t>=e.length||r>16777215)return null;s=e[t]??0,t+=1,r=r+1<<7|s&127}return{value:r,next:t}}function dI(e,n){return Buffer.compare(Buffer.from(e),Buffer.from(n))}function lh(e,n){let t=`${n}/`,s=Buffer.from(t),r=0,o=e.sorted.length;for(;r<o;){let a=r+o>>1;Buffer.compare(Buffer.from(e.sorted[a]??""),s)<0?r=a+1:o=a}let i=[];for(let a=r;a<e.sorted.length;a+=1){let l=e.sorted[a]??"";if(!l.startsWith(t))break;i.push(l)}return i}function $d(e){return e==="git-global"||e==="git-info"||e==="gitignore"}var cI=4096;function Di(e,n,t,s){let r=[],o=e.split(`
+`);for(let i=0;i<o.length;i+=1){let a=Fi(o[i]??"",n,t,i+1,s);a!==null&&r.push(a)}return r}function Fi(e,n,t,s,r){let o=e.endsWith("\r")?e.slice(0,-1):e;if(o.length===0||o.length>cI||o.startsWith("#")||(o=uI(o),o.length===0))return null;let i=!1;o.startsWith("!")&&(i=!0,o=o.slice(1));let a=!1;if(o.endsWith("/")&&!dh(o,o.length-1)&&(a=!0,o=o.slice(0,-1)),o.length===0)return null;let l=o.includes("/");if(o.startsWith("/")&&(o=o.slice(1)),o.length===0)return null;let d=o.split("/").filter(c=>c.length>0);return d.length===0?null:{origin:n,source:t,line:s,pattern:e.endsWith("\r")?e.slice(0,-1):e,base:r,negate:i,dirOnly:a,anchored:l,segments:d}}function uI(e){let n=e.length;for(;n>0&&e[n-1]===" "&&!dh(e,n-1);)n-=1;return e.slice(0,n)}function dh(e,n){let t=0;for(let s=n-1;s>=0&&e[s]==="\\";s-=1)t+=1;return t%2===1}function fI(e,n,t,s=!1){if(e.dirOnly&&!t)return!1;let r=n;if(e.base!==""){if(!n.startsWith(`${e.base}/`))return!1;r=n.slice(e.base.length+1)}if(r.length===0)return!1;let o=r.split("/");if(!e.anchored){let i=o[o.length-1]??"";return ch(e.segments[0]??"",i,s)}return Td(e.segments,0,o,0,s,{steps:0})}var pI=1e5;function Td(e,n,t,s,r,o){if(o.steps+=1,o.steps>pI)return!1;if(n===e.length)return s===t.length;let i=e[n]??"";if(i==="**"){if(n===e.length-1)return s<t.length;for(let a=s;a<=t.length;a+=1)if(Td(e,n+1,t,a,r,o))return!0;return!1}return s>=t.length||!ch(i,t[s]??"",r)?!1:Td(e,n+1,t,s+1,r,o)}function ch(e,n,t=!1){let s=[...e],r=[...n],o=0,i=0,a=-1,l=0;for(;i<r.length;){let d=s[o];if(d==="*"){for(;s[o]==="*";)o+=1;a=o,l=i;continue}if(d!==void 0){let c=mI(s,o,r[i]??"",t);if(c>0){o+=c,i+=1;continue}}if(a>=0){l+=1,i=l,o=a;continue}return!1}for(;s[o]==="*";)o+=1;return o===s.length}function mI(e,n,t,s){let r=e[n];if(r===void 0)return 0;if(r==="?")return t==="/"?0:1;if(r==="\\"){let o=e[n+1];return o===void 0?$i("\\",t,s)?1:0:$i(o,t,s)?2:0}if(r==="["){let o=hI(e,n);return o===null?$i("[",t,s)?1:0:t==="/"?0:(o.test(t)||s&&(o.test(t.toLowerCase())||o.test(t.toUpperCase())))!==o.negated?o.span:0}return $i(r,t,s)?1:0}function $i(e,n,t){return t?e.toLowerCase()===n.toLowerCase():e===n}var gI={alnum:e=>Md(e)||Li(e),alpha:e=>Md(e),blank:e=>e===" "||e==="	",cntrl:e=>{let n=e.codePointAt(0)??0;return n<32||n===127},digit:e=>Li(e),graph:e=>{let n=e.codePointAt(0)??0;return n>32&&n<127},lower:e=>e>="a"&&e<="z",print:e=>{let n=e.codePointAt(0)??0;return n>=32&&n<127},punct:e=>{let n=e.codePointAt(0)??0;return n>32&&n<127&&!Md(e)&&!Li(e)},space:e=>e===" "||e>="	"&&e<="\r",upper:e=>e>="A"&&e<="Z",xdigit:e=>Li(e)||e>="a"&&e<="f"||e>="A"&&e<="F"};function Md(e){return e>="a"&&e<="z"||e>="A"&&e<="Z"}function Li(e){return e>="0"&&e<="9"}function hI(e,n){let t=n+1,s=!1;(e[t]==="!"||e[t]==="^")&&(s=!0,t+=1);let r=[],o=!0;for(;t<e.length;){let i=e[t];if(i==="]"&&!o)return{negated:s,span:t-n+1,test:d=>r.some(c=>c(d))};if(o=!1,i==="["&&e[t+1]===":"){let d=yI(e,t+2);if(d!==-1){let c=e.slice(t+2,d).join(""),f=gI[c];f!==void 0&&r.push(f),t=d+2;continue}}let a=i??"";if(a==="\\"&&t+1<e.length&&(t+=1,a=e[t]??""),e[t+1]==="-"&&e[t+2]!==void 0&&e[t+2]!=="]"){let d=e[t+2]??"",c=t+3;d==="\\"&&e[t+3]!==void 0&&(d=e[t+3]??"",c=t+4);let f=a.codePointAt(0)??0,p=d.codePointAt(0)??0;r.push(u=>{let m=u.codePointAt(0)??-1;return m>=f&&m<=p}),t=c;continue}let l=a;r.push(d=>d===l),t+=1}return null}function yI(e,n){for(let t=n;t+1<e.length;t+=1){if(e[t]===":"&&e[t+1]==="]")return t;if(e[t]==="]")return-1}return-1}function Ld(e,n,t,s=!1){for(let r=e.length-1;r>=0;r-=1){let o=e[r];if(o!==void 0&&fI(o,n,t,s))return o}return null}var wI=16*1024*1024,vI=2e5,EI=1e5,AI=128,II=1024*1024,uh="git's global excludes file",Gi=["not-utf8","over-size-cap","unreadable","symlink-loop","parse-error","name-unrepresentable","front-end-unavailable","cap-reached"],ph=["node_modules/",".venv/","venv/","vendor/","target/","dist/","build/",".next/",".nuxt/",".svelte-kit/",".output/","coverage/","__pycache__/","**/pkg/mod/"],NI=new TextDecoder("utf-8",{fatal:!0}),RI=new TextDecoder("utf-8");function mh(e,n={}){let t=kI(e),s=n.maxFiles??vI,r=n.maxDirs??EI,o=ah(t,n.gitEnv??{}),i=o?.scanPrefix??"",a=P=>i===""?P:P===""?i:`${i}/${P}`,l=o?.index.kind==="read"?o.index.tracked:null,d=o?.ignoreCase??!1,c=[],f=[];o!==null&&(o.globalExcludes!==null&&(f.push(...Di(o.globalExcludes.text,"git-global",uh,"")),c.push(uh)),o.infoExclude!==null&&(f.push(...Di(o.infoExclude,"git-info",".git/info/exclude","")),c.push(".git/info/exclude")));let p=ph.map(P=>Fi(P,"default","cupel default",0,"")),u=(n.exclude??[]).map(P=>Fi(P,"exclude-flag","--exclude",0,i)).filter(P=>P!==null),m=[],g=[];if(o!==null&&i!==""){let P=i.split("/");for(let j=0;j<P.length;j+=1){let F=P.slice(0,j).join("/"),B=po(o.root,...P.slice(0,j));m.push(ji(B,".gitignore","gitignore",F,c)),g.push(ji(B,".cupelignore","cupelignore",F,c))}}let y=[],b=[],_=[],S=null,k=0,v=new Set,I=()=>[...f,...m.flat(),...p,...g.flat(),...u],O=(P,j,F)=>{let B=a(P),ne=Ld(F,B,j,d);return ne===null||ne.negate||!j&&$d(ne.origin)&&l?.files.has(B)===!0?null:ne},E=(P,j,F,B)=>{v.has(P)||(v.add(P),y.push({rel:P,abs:j,language:F,outcome:B}))},N=P=>{try{let j=Fd(P);return j.isFile()?j.size>wI?{kind:"failed",reason:"over-size-cap",detail:`${String(j.size)} bytes`}:{kind:"candidate",bytes:j.size}:{kind:"failed",reason:"unreadable",detail:"not a regular file"}}catch(j){return{kind:"failed",reason:"unreadable",detail:Bi(j)}}},A=P=>{try{let j=SI(P);return jd(j),{kind:"excluded",rule:{origin:"symlink",source:"cupel",line:0,pattern:!xI(t,j).startsWith("..")?"a symlink: its target is counted where it lives":"a symlink out of the scanned directory"}}}catch(j){let F=Bi(j);return F==="ELOOP"?{kind:"failed",reason:"symlink-loop"}:{kind:"failed",reason:"unreadable",detail:`broken symlink (${F})`}}},U=P=>{if(l!==null)for(let j of lh(l,a(P))){let F=i===""?j:j.slice(i.length+1),B=F.slice(F.lastIndexOf("/")+1),ne=uo(B);if(ne===null)continue;let X=po(t,...F.split("/")),Q=[...p,...g.flat(),...u],Z=F.split("/"),x=null;for(let T=P.split("/").length+1;T<=Z.length&&x===null;T+=1){let q=Z.slice(0,T).join("/"),G=Ld(Q,a(q),T<Z.length,d);G!==null&&!G.negate&&(x=G)}E(F,X,ne.language,x!==null?{kind:"excluded",rule:Dd(x)}:N(X))}},$=(P,j,F)=>{if(S!==null)return;if(k>=r){S={cap:"directories",limit:r},_.push({rel:P,reason:"cap-reached"});return}if(F>AI){_.push({rel:P,reason:"cap-reached"});return}k+=1;let B;try{B=bI(j,{withFileTypes:!0,encoding:"buffer"})}catch{_.push({rel:P,reason:"unreadable"});return}B.sort((Q,Z)=>Buffer.compare(Q.name,Z.name));let ne=a(P);m.push(ji(j,".gitignore","gitignore",ne,c)),g.push(ji(j,".cupelignore","cupelignore",ne,c));let X=I();try{for(let Q of B){if(S!==null)return;let Z,x=!0;try{Z=NI.decode(Q.name)}catch{Z=RI.decode(Q.name),x=!1}let T=P===""?Z:`${P}/${Z}`,q=po(j,Z);if(Q.isDirectory()){if(!x){_.push({rel:T,reason:"name-unrepresentable"});continue}if(Z===".git"){b.push({rel:T,rule:{origin:"git-dir",source:"cupel",line:0,pattern:"git's own directory"}});continue}let L=O(T,!0,X);if(L!==null){b.push({rel:T,rule:Dd(L)}),$d(L.origin)&&U(T);continue}if(OI(q)){b.push({rel:T,rule:{origin:"virtualenv",source:"cupel default",line:0,pattern:"a virtualenv (holds pyvenv.cfg)"}});continue}$(T,q,F+1);continue}if(Q.isSymbolicLink()){let L=uo(Z);if(L!==null){if(!W())return;E(T,q,L.language,x?A(q):fh());continue}PI(q)&&_.push({rel:T,reason:CI(q)?"symlink-loop":"symlink"});continue}let G=uo(Z);if(G===null)continue;if(!W())return;if(!x){E(T,q,G.language,fh());continue}let z=O(T,!1,X);E(T,q,G.language,z!==null?{kind:"excluded",rule:Dd(z)}:N(q))}}finally{m.pop(),g.pop()}},W=()=>y.length<s?!0:(S={cap:"files",limit:s},!1);$("",t,0);let w=o===null?{kind:"none"}:o.index.kind==="read"?{kind:"index",root:o.root}:{kind:"ignore-files",root:o.root,indexNote:o.index.kind==="absent"?"no index":o.index.reason};return{files:y,excludedDirectories:b,unwalked:_,truncated:S,git:w,ignoreFiles:c}}function ji(e,n,t,s,r){let o=po(e,n);try{let i=Fd(o);if(!i.isFile()||i.size>II)return[];let a=s===""?n:`${s}/${n}`;return r.push(a),Di(_I(o,"utf8"),t,a,s)}catch{return[]}}function OI(e){try{return Fd(po(e,"pyvenv.cfg")).isFile()}catch{return!1}}function PI(e){try{return jd(e).isDirectory()}catch(n){return Bi(n)==="ELOOP"}}function CI(e){try{return jd(e),!1}catch(n){return Bi(n)==="ELOOP"}}function fh(){return{kind:"failed",reason:"name-unrepresentable"}}function Dd(e){return{origin:e.origin,source:e.source,line:e.line,pattern:e.pattern}}function Bi(e){return typeof e=="object"&&e!==null&&"code"in e?String(e.code):"error"}var Rt=class extends Error{},gh=()=>Object.fromEntries(Gi.map(e=>[e,0]));function hh(e,n){let t=new Set,s=[],r=[],o=[],i=[],a=new Map,l=new Map,d=u=>{let m=l.get(u);return m===void 0&&(m={files:0,scanned:0,unsupported:0,failed:0,excluded:0,reasons:gh()},l.set(u,m)),m};for(let u of e.files){if(t.has(u.rel))throw new Rt(`the walk counted ${u.rel} twice`);t.add(u.rel);let m=d(u.language);m.files+=1;let g=u.outcome;if(g.kind==="excluded"){m.excluded+=1,o.push({rel:u.rel,language:u.language,rule:g.rule});continue}if(g.kind==="failed"){m.failed+=1,m.reasons[g.reason]+=1,r.push({rel:u.rel,language:u.language,reason:g.reason,...g.detail===void 0?{}:{detail:g.detail}});continue}let y=n.get(u.rel);if(y===void 0){s.push(u.rel);continue}if(y.kind==="scanned"){m.scanned+=1;let b=a.get(u.language);b===void 0&&(b=new Set,a.set(u.language,b)),b.add(u.rel)}else y.kind==="unsupported"?(m.unsupported+=1,i.push({rel:u.rel,language:u.language})):(m.failed+=1,m.reasons[y.reason]+=1,r.push({rel:u.rel,language:u.language,reason:y.reason,...y.detail===void 0?{}:{detail:y.detail}}))}if(s.length>0)throw new Rt(`${String(s.length)} file(s) were walked and never given an outcome, first ${s[0]??""}`);let c=[...n.keys()].filter(u=>!t.has(u));if(c.length>0)throw new Rt(`a parse result names a file the walk never counted: ${c[0]??""}`);let f=[];for(let u of th){let m=l.get(u);if(m!==void 0){if(m.files!==m.scanned+m.unsupported+m.failed+m.excluded)throw new Rt(`${u}: the buckets do not add up to the files walked`);f.push({language:u,label:Ci(u).label,files:m.files,scanned:m.scanned,unsupported:m.unsupported,failed:m.failed,excluded:m.excluded,failedByReason:m.reasons,reached:null,coverage:yh(m.scanned,m.unsupported,m.failed)})}}let p=bh(f,null);if(p.files!==e.files.length)throw new Rt("the languages do not add up to the files walked");return{languages:f,total:p,failedFiles:r,excludedFiles:o,unsupportedFiles:i,excludedDirectories:e.excludedDirectories,unwalked:e.unwalked,truncated:e.truncated,git:e.git,ignoreFiles:e.ignoreFiles,scannedPaths:a}}function Bd(e,n){let t=e.languages.map(s=>{let r=e.scannedPaths.get(s.language)??new Set,o=0;for(let i of r)n.has(i)&&(o+=1);return{...s,reached:o}});return{...e,languages:t,total:bh(t,t.reduce((s,r)=>s+(r.reached??0),0))}}function yh(e,n,t){let s=e+n+t;return s===0?null:e/s}function bh(e,n){let t=gh(),s=0,r=0,o=0,i=0,a=0;for(let l of e){s+=l.files,r+=l.scanned,o+=l.unsupported,i+=l.failed,a+=l.excluded;for(let d of Gi)t[d]+=l.failedByReason[d]}return{files:s,scanned:r,unsupported:o,failed:i,excluded:a,failedByReason:t,reached:n,coverage:yh(r,o,i)}}function Ki(e){if(e===null)return"nothing to scan";if(e>=1)return"100%";let n=Math.floor(e*1e3)/10;return`${n.toFixed(n%1===0?0:1)}%`}import{readFileSync as MI}from"node:fs";import Vt from"typescript";var _h=100,TI=new TextDecoder("utf-8",{fatal:!0});function Sh(e,n={}){let t=new Map,s=[];for(let r of e){if(r.outcome.kind!=="candidate")continue;let o=Ci(r.language).frontEnd;o==="none"?t.set(r.rel,{kind:"unsupported"}):o==="not-on-scan-side"?t.set(r.rel,{kind:"failed",reason:"front-end-unavailable",detail:"its front end is not on the scan side yet"}):o==="in-process"?t.set(r.rel,$I(r)):s.push(r)}return DI(s,n,t),t}function $I(e){let n;try{n=TI.decode(MI(e.abs))}catch(r){return r instanceof TypeError?{kind:"failed",reason:"not-utf8"}:{kind:"failed",reason:"unreadable"}}n.startsWith("\uFEFF")&&(n=n.slice(1));let t=LI(e.rel),s=St(e.rel);if(s!==null){let r=Or(s,n);n=r.code,t=r.scriptKind==="tsx"?Vt.ScriptKind.TSX:Vt.ScriptKind.TS}try{let o=Vt.createSourceFile(e.rel,n,Vt.ScriptTarget.Latest,!1,t).parseDiagnostics;if(o!==void 0&&o.length>0){let i=o[0];return{kind:"failed",reason:"parse-error",detail:(i===void 0?"":Vt.flattenDiagnosticMessageText(i.messageText," ")).slice(0,200)}}return{kind:"scanned"}}catch(r){return{kind:"failed",reason:"parse-error",detail:r instanceof RangeError?"nested too deeply to parse":"the parser failed"}}}function LI(e){return e.endsWith(".tsx")?Vt.ScriptKind.TSX:e.endsWith(".jsx")?Vt.ScriptKind.JSX:e.endsWith(".ts")||e.endsWith(".mts")||e.endsWith(".cts")?Vt.ScriptKind.TS:Vt.ScriptKind.JS}function DI(e,n,t){let s=n.extractPython??((i,a)=>cr(i,a===void 0?{}:{python:a})),r=[];for(let i of e)i.abs.includes(`
+`)?t.set(i.rel,{kind:"failed",reason:"name-unrepresentable"}):r.push(i);let o=new Map;for(let i of r){let a=n.pythonFor?.(i.rel),l=a??"",d=o.get(l)??{python:a,files:[]};d.files.push(i),o.set(l,d)}for(let{python:i,files:a}of o.values())for(let l=0;l<a.length;l+=_h){let d=a.slice(l,l+_h),c=s(d.map(p=>p.abs),i);if(c.refused==="no-interpreter"){for(let p of d)t.set(p.rel,{kind:"failed",reason:"front-end-unavailable",detail:"no Python interpreter"});continue}if(c.refused!==null){let p=s([],i);if(p.refused!==null){for(let u of d)t.set(u.rel,{kind:"failed",reason:"front-end-unavailable",detail:`the Python interpreter did not run (${p.refused})`});continue}for(let u of d)t.set(u.rel,FI(u,i,s));continue}let f=new Map(c.files.map(p=>[p.path,p]));for(let p of d){let u=f.get(p.abs);u!==void 0&&t.set(p.rel,u.refused===null?{kind:"scanned"}:xh(u.refused))}}}function FI(e,n,t){let s=t([e.abs],n);if(s.refused==="no-interpreter")return{kind:"failed",reason:"front-end-unavailable",detail:"no Python interpreter"};if(s.refused!==null)return{kind:"failed",reason:"parse-error",detail:`the Python front end stopped on this file (${s.refused})`};let r=s.files[0];return r===void 0?{kind:"failed",reason:"parse-error",detail:"the Python front end gave no answer"}:r.refused===null?{kind:"scanned"}:xh(r.refused)}function xh(e){switch(e){case"unreadable":return{kind:"failed",reason:"unreadable"};case"oversize":return{kind:"failed",reason:"over-size-cap"};case"undecodable":return{kind:"failed",reason:"not-utf8"};case"nul-byte":return{kind:"failed",reason:"parse-error",detail:"a NUL byte in the source"};case"parse-error":return{kind:"failed",reason:"parse-error"};case"recursion":case"too-many-nodes":return{kind:"failed",reason:"cap-reached",detail:e}}}function kh(e,n={}){let t=mh(e,n);return hh(t,Sh(t.files,n))}var BI=4,GI={additiveForms:!0,namelessExports:!0},KI=new Set(["dep-opaque","dynamic-load","dispatch"]),zI={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Xd(e,n,t){return He(e.tier)&&zI[t].has(e.decidedAtStage)&&e.reasonKind!==void 0&&KI.has(e.reasonKind)&&n!==null&&n.verified}var WI=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,"potentially-reachable-not-ruled-out":0,"potentially-reachable-not-analysed":0}),Qn=class extends Error{},Yd="cupel/coverage-gap",Ih={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","component-partially-read":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function go(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:t.ecosystem==="Go"?{ecosystem:"Go"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function wh(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function vh(e,n,t){let s=new Map(e.modules.map(i=>[i.path,i.id])),r=e.modules[0]?.id;if(r===void 0)return[];let o=n.map(i=>({source:s.get(i.path)??r,cause:Ih[i.code],reach:i.classScope!==void 0?{kind:"class-scope",packageName:i.classScope.packageName,container:i.classScope.container}:i.anchor!==void 0?{kind:"via-module",anchor:i.anchor}:{kind:"unbounded"}}));for(let i of t)o.push({source:r,reach:{kind:"unbounded"},cause:i});return o}function Ud(e,n,t,s,r){let o=t.filter(i=>i.exportName!==null&&(s===1||r||i.verified!==1));return o.length>0?o.map(i=>({advisoryId:e,packageName:n,exportName:i.exportName??"",container:i.container,symbolKind:i.symbolKind,sourcePath:i.sourcePath??"",derivation:i.derivation,confidence:i.confidence,verified:i.verified===1})):t.length===0||t.every(i=>i.exportName!==null&&i.verified===1)?[null]:[]}function UI(e,n){let t;try{t=ho(e)}catch{return!0}let s=3,r=(o,i)=>{if(i>s)return!1;let a;try{a=Ah(o)}catch{return!1}for(let l of a){if(l==="node_modules"||l.startsWith("."))continue;let d=mt.join(o,l),c;try{c=Vd(d)}catch{continue}if(!c.isDirectory())continue;let f=mt.relative(t,d).split(mt.sep).join("/");try{if(Vd(mt.join(d,"package.json")).isFile()&&!n.has(f))return!0}catch{}if(r(d,i+1))return!0}return!1};return r(t,1)}function HI(e,n){let t="";for(let s of e)s.rel!==""&&n.startsWith(`${s.rel}/`)&&s.rel.length>t.length&&(t=s.rel);return t}function qI(e,n,t){let s=[];if(t&&s.push("nested-app-root"),n==="")return[...s,"manifest-unreadable"];let r;try{if(r=ho(mt.resolve(e,n)),!r.startsWith(ho(e)+mt.sep))return[...s,"manifest-unreadable"]}catch{return[...s,"manifest-unreadable"]}let o;try{let c=mt.join(r,"package.json");if(!Vd(c).isFile())return[...s,"manifest-unreadable"];o=jI(c,"utf8")}catch{return[...s,"manifest-unreadable"]}let i;try{i=JSON.parse(o)}catch{return[...s,"manifest-unreadable"]}if(typeof i!="object"||i===null)return[...s,"manifest-unreadable"];let a=i;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&s.push("bin");let l=["preinstall","install","postinstall","prepare","prepublish"],d=a.scripts;if(typeof d=="object"&&d!==null){let c=d;l.some(f=>typeof c[f]=="string")&&s.push("install-script")}return(a.gypfile===!0||VI(r))&&s.push("native-artifact"),s}function VI(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=mt.join(e,n),s;try{s=Ah(t)}catch{continue}if(s.some(r=>r.endsWith(".node")))return!0}return!1}function XI(e){return new Set(["npm",...e.ecosystems?.()??[]])}function Jd(e){return e.ecosystem??"npm"}function YI(e,n){let t=[];for(let s of e.perRoot){let r=new Map;for(let o of s.packages){let i=Jd(o);n.has(i)||r.set(i,(r.get(i)??0)+1)}for(let[o,i]of[...r.entries()].sort()){let a=o==="Go"?"module(s)":"distribution(s)",l=o==="Go"?"ADR-108 D6":"ADR-109 D5";t.push({kind:"ecosystem-uncovered",detail:`${s.rootRel===""?"":`${s.rootRel}: `}${String(i)} ${o} ${a} were enumerated but the loaded shard carries no ${o} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${o} shard to assess them (${l}).`,blindsAnalysis:!1,rootRel:s.rootRel})}}return t}function JI(e,n,t){let s=new Set(e.perRoot.flatMap(i=>i.packages.map(Jd))),r=new Map([...s].filter(i=>t.has(i)).map(i=>[i,QI(n,i)])),o=[];for(let i of e.perRoot)for(let a of[...new Set(i.packages.map(Jd))].sort()){let l=r.get(a);if(l===void 0||l==="census")continue;let d=l==="project"?"one project's installed set":l==="corpus"?"a vetted corpus slice":"an undeclared population";o.push({kind:"shard-population-narrow",detail:`${i.rootRel===""?"":`${i.rootRel}: `}the loaded ${a} shard's population is ${d}, not the whole ${a} ecosystem: a package outside it carries no advisory row here, so it reports no findings \u2014 which is NOT a clean bill of health for it. Scan with a census shard to assess every package (ADR-114 D5).`,blindsAnalysis:!1,rootRel:i.rootRel})}return o}function QI(e,n){return e.populationModeFor!==void 0?e.populationModeFor(n):e.populationMode?.()}function Nh(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function ZI(e,n,t){return new Map(n.map(s=>[Nh(s),qI(e,s.lockKey,t)]))}function eN(e){let n=new Map;for(let t of e){let s=n.get(t.advisory.id);s===void 0?n.set(t.advisory.id,[t]):s.push(t)}return n}function nN(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(r=>r.packageName===t.name)?e:{...e,tier:$e("symbol-unsupported"),reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,reasonKind:"symbol-unsupported",basis:void 0,path:void 0}}function Eh(e,n,t){if(n.ecosystem!=="Go")return e;let s=t?.flags(n.name,n.version)??{};if(e.tier==="not-affected"&&e.decidedAtStage==="version-match")return s.replacedBy!==void 0?{...e,tier:$e("resolution-divergence"),reason:`${n.name} is replaced by ${s.replacedBy} (a go.mod replace): the code that is built is not ${n.name}@${n.version}, so its version cannot place it outside the advisory's range`,reasonKind:"resolution-divergence",basis:void 0}:s.toolchainAhead!==void 0?{...e,tier:$e("version-undecidable"),reason:`the Go on PATH is ${n.version}, but the governing toolchain line names ${s.toolchainAhead}, which a build under GOTOOLCHAIN=auto uses instead \u2014 which release builds the program is not known here`,reasonKind:"version-undecidable",basis:void 0}:e;if(e.tier!=="not-reachable")return e;let r=s.otherConfiguration===!0?"another build configuration imports it (a file this configuration excludes by a build constraint)":t===null?"no Go lane read the build":t.blockers[0];return r===void 0&&t!==null?{...e,reason:`${n.name} is imported by no package of this build \u2014 not in the import graph \`go list -deps\` reports for ${t.configuration}, and by no file another build configuration compiles (tests excepted): a package-level denial, saying nothing about symbols`}:r===void 0?e:{...e,tier:$e("analysis-cap"),reason:`${n.name} is not imported by this build's graph, but ${r} \u2014 cannot confirm it is unreachable`,reasonKind:"analysis-cap",basis:void 0,path:void 0}}function tN(e,n){return e===void 0?n:{...e.replacedBy!==void 0||n.replacedBy!==void 0?{replacedBy:e.replacedBy??n.replacedBy}:{},...e.replacementOf!==void 0||n.replacementOf!==void 0?{replacementOf:e.replacementOf??n.replacementOf}:{},...e.otherConfiguration===!0||n.otherConfiguration===!0?{otherConfiguration:!0}:{},...e.toolchainAhead!==void 0||n.toolchainAhead!==void 0?{toolchainAhead:e.toolchainAhead??n.toolchainAhead}:{},...e.tool===!0||n.tool===!0?{tool:!0}:{},...e.packageOf!==void 0||n.packageOf!==void 0?{packageOf:e.packageOf??n.packageOf}:{}}}function sN(e,n){let t=new Set;for(let l of e.roots)for(let d of l.modules.keys())t.add(d);let s=l=>n.packageNamesUnder?.("Go",l)??[],r=new Map,o=new Set,i=new Map;for(let l of e.roots){let d=Bg(l,t,s),c=[...l.rows,...d];for(let f of c){let p=Ri(f.name,f.version);r.set(p,tN(r.get(p),f.flags))}for(let f of l.loadedNames)o.add(f);for(let f of d)l.loadedPackages.has(f.name)&&o.add(f.name);i.set(l.rootRel,{packages:c.map(f=>({name:f.name,version:f.version,lockKey:"",dev:!1,declaredIn:"go.mod",ecosystem:"Go"})),source:c.length>0?"go-list":"none",lockfilePath:null,diagnostics:l.diagnostics,truncated:!1,gaps:l.gaps})}let a=[...o].sort().map(l=>({id:`go:${l}`,packageName:l,versionRange:"",path:l,moduleSystem:"esm",isEntrypoint:!0}));return{sets:i,flags:r,graph:{...Qd,modules:a},analyzed:e.roots.some(l=>l.status!=="failed")}}var Qd={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function rN(e,n,t,s,r,o,i){let{finding:a}=mo(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:i(t)},go(s.advisory.id,t.name,s.affected),null,r,o);return a.decidedAtStage!=="presence"&&a.decidedAtStage!=="version-match"?"inside":a.tier==="not-affected"?"outside":"undecidable"}function mo(e,n,t,s,r,o,i){let a=ya({graph:e,installed:t,range:s,symbol:r,coverage:null,incompleteness:o,analysisAborted:i});if(n!==null&&r!==null&&Xd(a,r,"base")){let l=vr(e,n.modulesById,n.reachMods,r,n.records);if(l!==null)return{finding:a,hit:l}}return{finding:a,hit:null}}function oN(e,n){let t=new Set,s=[];for(let r of e.packages)if((r.ecosystem??"npm")==="npm")for(let{advisory:o,affected:i}of n.advisoriesForPackage(r.ecosystem??"npm",r.name)){let a=go(o.id,r.name,i),l;try{l=$t(r.version,a)}catch{continue}if(l)for(let d of n.symbolsForAffected(i.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let c=`${r.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(c)||(t.add(c),s.push({packageName:r.name,packageRootRel:r.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return s.sort((r,o)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${o.packageRootRel}\0${o.container}\0${o.sourcePath}`)),s.slice(0,ni)}function iN(e,n,t){let s=new Map(e.functions.map(a=>[a.id,a])),r=new Map(e.classes.map(a=>[a.id,a.name])),o=new Map(e.callSites.map(a=>[a.id,a])),i=[];for(let a of e.callEdges){if(a.resolution==="unresolved")continue;let l=o.get(a.callSiteId);if(l===void 0)continue;let d=s.get(l.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let c=n.get(d.moduleId);if(c===void 0)continue;let f=s.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==c.packageName&&i.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:d.id})}return i}function aN(e){let n=new Set(e.modules.filter(c=>c.isEntrypoint).map(c=>c.id)),t=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.functions.map(c=>[c.id,c])),r=new Set;for(let c of e.functions)n.has(c.moduleId)&&(c.publicSurfaceReachable||c.name==="<toplevel>")&&r.add(c.id);let o=new Map(e.exports.map(c=>[c.id,c]));for(let c of e.exportBindings){if(c.target.kind!=="function")continue;let f=o.get(c.exportId);if(f===void 0||!n.has(f.moduleId))continue;let p=s.get(c.target.functionId);p===void 0||t.get(p.moduleId)?.externalSurface===!0||r.add(p.id)}let i=new Map(e.callSites.map(c=>[c.id,c.enclosingFunctionId])),a=new Map;for(let c of e.callEdges){if(c.resolution==="unresolved")continue;let f=i.get(c.callSiteId);if(f===void 0)continue;let p=a.get(f);p===void 0?a.set(f,[c.calleeFunctionId]):p.push(c.calleeFunctionId)}let l=new Set(r),d=[...r];for(;d.length>0;){let c=d.pop();if(c!==void 0)for(let f of a.get(c)??[])l.has(f)||(l.add(f),d.push(f))}return l}function lN(e,n,t,s){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let o=t.filter(a=>a.packageName===r.anchor.packageName&&a.exportName===r.anchor.exportName&&a.container===r.anchor.container),i=o.find(a=>a.resolution==="resolved")??o[0];if(i!==void 0)return s.has(i.callerFunctionId)}return null}function Hd(e){return e.some(n=>n.pathQuality==="name-match")}function dN(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(o=>o.modelId!==void 0);let s=new Set(t),r=o=>s.has(o)||s.has(Fn[o]??"")||s.has(yt[o]??"");return e.some(o=>He(o.tier)&&o.reasonKind!==void 0&&r(o.reasonKind)||o.modelPromotedFromKind!==void 0&&r(o.modelPromotedFromKind))}function Zd(e){let n=hr.now(),t=ho(e.dir),s=e.xGo===!0,r=e.reader??(s&&e.shardPathGo!==void 0?$o([ts(e.shardPath),...e.shardPathPypi!==void 0?[ts(e.shardPathPypi)]:[],ts(e.shardPathGo)]):e.shardPathPypi!==void 0?$o([ts(e.shardPath),ts(e.shardPathPypi)]):ts(e.shardPath)),o=e.partialRows===!0;try{if(!/^\d+$/u.test(r.schemaVersion)||Number(r.schemaVersion)>Number(bt))throw new Qn(`shard schema ${JSON.stringify(r.schemaVersion)} is unreadable or newer than this cupel understands (v${bt})`);let i=null;if(e.summaryShadow!==void 0)try{i=Gg(e.summaryShadow)}catch(V){throw new Qn(`--summary-shadow facts dir rejected: ${V instanceof Error?V.message:String(V)}`)}let a=null;if(e.modelShadow!==void 0)try{a=nh(e.modelShadow.claimsPath)}catch(V){throw new Qn(`--model-shadow claims rejected: ${V instanceof Error?V.message:String(V)}`)}let l=Zr(t,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{},discoverGoRoots:s}),d=s?jg(t,l.roots,e.goScan):null,c=d===null?null:sN(d,r),f=bm(t,l,e.installedSet,c?.sets);if(f.truncated){let V=f.perRoot.filter(ye=>ye.truncated).map(ye=>ye.rootRel===""?"the scan root":`\`${ye.rootRel}\``);throw new Qn(`the dependency enumeration hit a hard cap and is incomplete at ${V.length>0?V.join(", "):"the union across roots"} (${f.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let p=Sg(l.roots,{preciseNames:e.pyPreciseNames!==!1,...e.xPyNameMatchLabel===!0?{nameMatchLabel:!0}:{}}),u=p?.execution??null,m=Sm(f.packages.filter(V=>(V.ecosystem??"npm")==="npm")),g=e.entry??[],y=g.length>0?Ep(t,g):{entrypoints:[],rejected:[]},b=y.rejected,_=vp(t,l.roots.filter(V=>V.rel===""||V.ecosystem!=="Go")),S=[...new Set([..._.entrypoints,...y.entrypoints])],k=[...new Set([..._.sources.filter(V=>V.source!=="exports"&&V.source!=="browser").map(V=>V.entrypoint),...y.entrypoints])],v=[..._.sources];for(let V of y.entrypoints)_.entrypoints.includes(V)||v.push({source:"--entry",specifier:V,entrypoint:V,launch:!1,root:HI(l.roots,V)});let I=[...v];for(let V of p?.roots??[])for(let ye of V.entrypoints)v.push({source:`python:${ye.source}`,specifier:ye.declaration,entrypoint:V.rootRel===""?ye.file:`${V.rootRel}/${ye.file}`,launch:ye.source==="console-script"||ye.source==="launch-declaration",root:V.rootRel});let O=oN(f,r),E=e.bindingForms??GI,N=e.callablePackageResolver===!0,A=e.tsconfigPaths!==!1,U=UI(t,to(v)),$=ZI(t,f.packages,U),W=V=>V.ecosystem==="Go"?c?.flags.get(Ri(V.name,V.version))?.tool===!0?["bin"]:[]:(V.ecosystem??"npm")!=="npm"?u?.get(V.name)??["manifest-unreadable"]:$.get(Nh(V))??["manifest-unreadable"],w=Al({appRoot:t,entrypoints:S,executedEntrypoints:k,depClassAnchors:O,bindingForms:E,callablePackageResolver:N,tsconfigPaths:A}),P=w.graph,j=ha(P),F=[..._.diagnostics,...Il(_),...Nl(_,S.length),...Zl(l,I),...w.diagnostics],B=wh(S.length,P),ne=V=>f.packages.some(ye=>(ye.ecosystem??"npm")===V),X=p===null?"no-entrypoint":p.analysisAborted,Q=(ne("npm")?B:null)??(ne("PyPI")?X:null)??(ne("npm")||ne("PyPI")||ne("Go")||d!==null?null:B),Z=XI(r),x=[...f.gaps,...xm(l),...YI(f,Z),...JI(f,r,Z)],T=km(x),q=vh(P,F,T),G={graph:pr,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},z=c===null?{...G,graph:Qd}:{graph:c.graph,incompleteness:[],analysisAborted:c.analyzed?null:"no-entrypoint",symbolsDecidable:!1},L=d===null||c===null?null:{flags:(V,ye)=>c.flags.get(Ri(V,ye)),blockers:d.blockers,configuration:d.toolchain===null?"no toolchain":`${d.toolchain.goos}/${d.toolchain.goarch}, CGO_ENABLED=${d.toolchain.cgo?"1":"0"}, default tags`},ie=V=>(V.ecosystem??"npm")==="npm"?{graph:P,incompleteness:q,analysisAborted:B,symbolsDecidable:!0}:V.ecosystem==="Go"?z:p===null?G:{...p,symbolsDecidable:!0},me=t;try{me=ho(t)}catch{}let be=Xg({graph:P,facts:q,diagnostics:F,analysisAborted:B,loadSites:w.loadSites,conditionUnions:w.conditionUnions,provenAbsent:w.provenAbsent,appRootReal:me,rootBudget:l.budget,causeOf:V=>Ih[V]}),Me=r.allModels?.()??[],re=Pd(Me.map(V=>({model:{packageName:V.packageName,modelId:V.modelId,edges:V.edges},introduced:V.introduced,fixedBefore:V.fixedBefore})),m),R=re.models.length>0?Gr(P,re.models).delta:null,D=R!==null?{records:R.records,reachMods:tt(P),modulesById:new Map(P.modules.map(V=>[V.id,V]))}:null,Y=hr.now(),H=[],ee=new Map,le=WI(),de=[],ge=[];for(let V of f.packages){let ye=ie(V),Oe=(V.ecosystem??"npm")==="npm"?D:null;for(let[,Ce]of eN(r.advisoriesForPackage(V.ecosystem??"npm",V.name))){let rn=Ce[0];if(rn!==void 0){let ln=ee.get(rn.advisory.id),Ue=Ce.map(Dn=>Dn.affected);if(ln===void 0)ee.set(rn.advisory.id,{advisory:rn.advisory,ranges:Ue});else{let Dn=new Set(ln.ranges.map(bn=>bn.id));for(let bn of Ue)Dn.has(bn.id)||(Dn.add(bn.id),ln.ranges.push(bn))}}let We=Ce.map(ln=>rN(ye.graph,Oe,V,ln,ye.incompleteness,ye.analysisAborted,W)),ht=new Set(Ce.filter((ln,Ue)=>We[Ue]==="inside")),Ot=We.indexOf("undecidable"),Pt=Ce.filter((ln,Ue)=>ht.has(ln)||Ue===Ot),Fs=Pt.length>0?Pt:Ce.slice(0,1);for(let ln of Fs){let{advisory:Ue,affected:Dn}=ln,bn=go(Ue.id,V.name,Dn),qn=Ue.cveId??Ue.id,gs=ht.has(ln)?r.symbolsForAffected(Dn.id):[],Ct=gs.filter(he=>he.exportName===null),hs=Ud(Ue.id,V.name,gs,Dn.surfaceComplete,o),Mt=mo(ye.graph,Oe,{name:V.name,version:V.version,...V.ecosystem!==void 0?{ecosystem:V.ecosystem}:{},devOnly:V.dev,outOfGraphExecution:W(V)},bn,null,ye.incompleteness,ye.analysisAborted).finding;if(Mt.decidedAtStage==="presence"||Mt.decidedAtStage==="version-match"){let he=Eh(Mt,V,L);le[he.tier]+=1,H.push({...he,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:bn.surfaceComplete,advisoryId:Ue.id,displayId:qn,packageName:V.name,version:V.version,ecosystem:V.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:Ue.severity,packageLocation:hi(f,V)});continue}for(let he of hs){let{finding:pe,hit:Se}=mo(ye.graph,Oe,{name:V.name,version:V.version,...V.ecosystem!==void 0?{ecosystem:V.ecosystem}:{},devOnly:V.dev,outOfGraphExecution:W(V)},bn,he,ye.incompleteness,ye.analysisAborted),Ae=Eh(nN(pe,ye,V),V,L),nn,mn;Se!==null&&he!==null&&(nn=Se.modelId,mn=pe.reasonKind,Ae={basis:void 0,tier:Se.tier,decidedAtStage:pe.decidedAtStage,reason:`boundary model ${Se.modelId}: ${Se.anchorPackage}.${Se.entryExport} reaches ${he.exportName} [${Se.pathLabels.join(" \u2192 ")}]`,reasonKind:void 0,attribution:Ro(he),pathQuality:Se.pathQuality,path:void 0,unresolvedSites:pe.unresolvedSites,unresolvedEvidence:pe.unresolvedEvidence}),le[Ae.tier]+=1;let Pe=Yg(be,Ae,he,W(V).length,bn.surfaceComplete),dn={...Ae,...Pe!==void 0?{adr105:Pe}:{},modelId:nn,modelPromotedFromKind:mn,surfaceComplete:bn.surfaceComplete,advisoryId:Ue.id,displayId:qn,packageName:V.name,version:V.version,ecosystem:V.ecosystem??"npm",symbolName:he?.exportName??null,symbolPath:he?.sourcePath||null,symbolContainer:he?.container??null,severity:Ue.severity,packageLocation:hi(f,V)};H.push(dn);let Tt=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&He(dn.tier)&&dn.decidedAtStage==="symbol-reachable"&&dn.reasonKind!==void 0&&Tt.has(dn.reasonKind)&&he!==null&&de.push({finding:dn,symbol:he}),a!==null&&He(dn.tier)&&he!==null&&ge.push({finding:dn,symbol:he})}for(let he of Ct)le[$e("symbol-unsupported")]+=1,H.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:bn.surfaceComplete,tier:$e("symbol-unsupported"),decidedAtStage:"symbol-reachable",reason:`advisory ${qn} carries a ${he.symbolKind} pattern symbol; pattern matching is not evaluated yet`,reasonKind:"symbol-unsupported",attribution:void 0,pathQuality:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Ue.id,displayId:qn,packageName:V.name,version:V.version,ecosystem:V.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:Ue.severity,packageLocation:hi(f,V)})}}}for(let V of x)le[$e("coverage-gap")]+=1,H.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:$e("coverage-gap"),decidedAtStage:"presence",reason:V.detail,attribution:void 0,pathQuality:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Yd,displayId:Yd,packageName:V.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:null,reasonKind:"coverage-gap",packageLocation:_m(f,V)});let ve=hr.now()-Y,Re=le["reachable-high"]+le["reachable-medium"],_e=e.failOnReachable===!0&&(Re>0||Hd(H)),Ke=dN(H,Yt(le),e.failOnPotentiallyReachable),ze=e.requireCompleteDenial===!0&&H.some(V=>V.tier==="not-reachable"&&V.basis==="loader-assumption"),pn=_e||Ke||ze?2:0,vn;if(i!==null){let V=tt(P),ye=new Map(P.modules.map(Ce=>[Ce.id,Ce])),Oe=[];for(let{finding:Ce,symbol:rn}of de){let We=ca(P,ye,V,rn,i,BI);Oe.push({advisoryId:Ce.advisoryId,packageName:Ce.packageName,symbolName:Ce.symbolName,reasonKind:Ce.reasonKind??null,wouldPromote:We!==null,...We!==null?{anchorPackage:We.anchorPackage,entryExport:We.entryExport,viaPackages:We.viaPackages,totalHops:We.totalHops}:{}})}vn={records:Oe}}let K;if(a!==null&&e.modelShadow!==void 0){let V=e.modelShadow.widened===!0?"widened":"base",{models:ye,notes:Oe,dispositions:Ce}=Pd(a,m,{shadowConsultDenylisted:!0}),{delta:rn}=Gr(P,ye),We=tt(P),ht=new Map(P.modules.map(he=>[he.id,he])),Ot=iN(P,ht,We),Pt=aN(P),Fs=rn.records.some(he=>Ot.some(pe=>pe.packageName===he.anchor.packageName&&pe.exportName===he.anchor.exportName&&pe.container===he.anchor.container)),ln=[],Ue=Date.now();for(let{finding:he,symbol:pe}of ge){let Se=rn.records,Ae=Xd(he,pe,V),nn=Ae?vr(P,ht,We,pe,Se):null,mn=rn.records.filter(Pe=>Pe.callee.packageName===pe.packageName&&Pe.callee.exportName===pe.exportName&&Pe.callee.container===pe.container||Pe.callee.packageName===pe.packageName&&Pe.callee.realFunctionId!==null);ln.push({advisoryId:he.advisoryId,packageName:he.packageName,symbolName:he.symbolName,reasonKind:he.reasonKind??null,decidedAtStage:he.decidedAtStage,consultSurface:V,noHitReason:nn!==null?null:Ae?Fs?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:nn!==null?lN(nn,Se,Ot,Pt):null,verdictBefore:he.tier,verdictAfter:nn!==null?"reachable-low":he.tier,wouldPromote:nn!==null,...nn!==null?{modelId:nn.modelId,anchorPackage:nn.anchorPackage,entryExport:nn.entryExport,pathLabels:nn.pathLabels,calleeBinding:mn.find(Pe=>Pe.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:Ae?mn.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${mn[0]?.anchor.packageName??"?"}#${mn[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Dn=Date.now()-Ue,bn=Ce.map(he=>{if(he.status!=="active")return{modelId:he.modelId,state:he.status,reason:he.reason,edgesLowered:0,edgesReferenceGated:0};let pe=rn.records.filter(Ae=>Ae.modelId===he.modelId).length;if(pe>0)return{modelId:he.modelId,state:"lowered",reason:null,edgesLowered:pe,edgesReferenceGated:he.edgeCount-pe};let Se=rn.notes.find(Ae=>Ae.startsWith(`model ${he.modelId}:`)||Ae.startsWith(`model-edge ${he.modelId}:`));return{modelId:he.modelId,state:"refused",reason:Se??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:he.edgeCount}}),qn=ln.filter(he=>he.wouldPromote).length,gs=Yt(le)-qn,Ct=le["reachable-high"]+le["reachable-medium"]+(Hd(H)?1:0),hs=he=>({none:0,"fail-on-reachable":Ct>0?2:0,"fail-on-potentially-reachable":he>0?2:0,both:Ct>0||he>0?2:0});K={records:ln,notes:[...Oe,...rn.notes],laneStates:bn,exitCodes:{baseline:hs(Yt(le)),withModels:hs(gs)},overlayWallMs:Dn},Kd(mt.dirname(e.modelShadow.outPath),{recursive:!0});let Mt=`${e.modelShadow.outPath}.tmp-${Gd(8).toString("hex")}`;Wd(Mt,`${JSON.stringify(K,null,2)}
+`,{encoding:"utf8",flag:"wx"}),zd(Mt,e.modelShadow.outPath)}let J;if(e.bindingShadow!==void 0){let V=Date.now(),ye=pe=>re.models.length>0?{records:Gr(pe,re.models).delta.records,reachMods:tt(pe),modulesById:new Map(pe.modules.map(Se=>[Se.id,Se]))}:null,Oe=(pe,Se,Ae,nn)=>{let mn=[];for(let Pe of f.packages)for(let{advisory:dn,affected:Tt}of r.advisoriesForPackage(Pe.ecosystem??"npm",Pe.name)){let js=go(dn.id,Pe.name,Tt),Iy=Ud(dn.id,Pe.name,r.symbolsForAffected(Tt.id),Tt.surfaceComplete,o);for(let kc of Iy){let{finding:wc,hit:na}=mo(pe,nn,{name:Pe.name,version:Pe.version,...Pe.ecosystem!==void 0?{ecosystem:Pe.ecosystem}:{},devOnly:Pe.dev,outOfGraphExecution:W(Pe)},js,kc,Se,Ae);mn.push({advisoryId:dn.id,packageName:Pe.name,symbolName:kc?.exportName??null,tier:na!==null?na.tier:wc.tier,reasonKind:na!==null?null:wc.reasonKind??null})}}return mn},Ce=pe=>{let Se=Al({appRoot:t,entrypoints:S,executedEntrypoints:k,depClassAnchors:O,bindingForms:pe,callablePackageResolver:N,tsconfigPaths:A}),Ae=[..._.diagnostics,...Il(_),...Nl(_,S.length),...Zl(l,I),...Se.diagnostics];return{graph:Se.graph,inc:vh(Se.graph,Ae,T),aborted:wh(S.length,Se.graph),live:ye(Se.graph),applicability:Se.bindingApplicability}},rn=pe=>{let Se=Ce(pe);return Oe(Se.graph,Se.inc,Se.aborted,Se.live)},We=Ce({}),ht=Oe(We.graph,We.inc,We.aborted,We.live),Ot=Oe(P,q,B,D);if(Ot.length!==ht.length)throw new Qn("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let Pt=(pe,Se)=>Se.tier!==pe.tier||Se.reasonKind!==pe.reasonKind,Fs=ht.some((pe,Se)=>{let Ae=Ot[Se];return Ae!==void 0&&Pt(pe,Ae)}),ln=Fs?rn({additiveForms:!0}):null,Ue=Fs?rn({namelessExports:!0}):null,Dn=0,bn=ht.map((pe,Se)=>{let Ae=Ot[Se];if(Ae===void 0||Ae.advisoryId!==pe.advisoryId||Ae.packageName!==pe.packageName||Ae.symbolName!==pe.symbolName)throw new Qn("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let nn={advisoryId:pe.advisoryId,packageName:pe.packageName,symbolName:pe.symbolName,reasonKind:pe.reasonKind,verdictBefore:pe.tier,verdictAfter:Ae.tier,wouldPromote:Ae.tier!==pe.tier&&(Ae.tier==="reachable-high"||Ae.tier==="reachable-medium"||Ae.tier==="reachable-low")};if(!Pt(pe,Ae)||ln===null||Ue===null)return nn;Dn+=1;let mn=ln[Se],Pe=Ue[Se],dn=mn!==void 0&&Pt(pe,mn),Tt=Pe!==void 0&&Pt(pe,Pe);return{...nn,attributedArm:dn&&!Tt?"additiveForms":Tt&&!dn?"namelessExports":"both",...mn!==void 0?{verdictArmA:mn.tier}:{},...Pe!==void 0?{verdictArmB:Pe.tier}:{}}}),qn={...le};ht.forEach((pe,Se)=>{let Ae=Ot[Se];Ae!==void 0&&Ae.tier!==pe.tier&&(qn[Ae.tier]-=1,qn[pe.tier]+=1)});let gs=(pe,Se)=>({none:0,"fail-on-reachable":pe>0?2:0,"fail-on-potentially-reachable":Se>0?2:0,both:pe>0||Se>0?2:0}),Ct;if(re.models.length>0&&D!==null){Ct=[];for(let pe of f.packages)for(let{advisory:Se,affected:Ae}of r.advisoriesForPackage(pe.ecosystem??"npm",pe.name)){let nn=go(Se.id,pe.name,Ae),mn=Ud(Se.id,pe.name,r.symbolsForAffected(Ae.id),Ae.surfaceComplete,o);for(let Pe of mn){if(Pe===null||!Pe.verified)continue;let dn=mo(We.graph,We.live,{name:pe.name,version:pe.version,...pe.ecosystem!==void 0?{ecosystem:pe.ecosystem}:{},devOnly:pe.dev,outOfGraphExecution:W(pe)},nn,Pe,We.inc,We.aborted);if(!(dn.hit===null&&Xd(dn.finding,Pe,"base")))continue;let js=vr(P,D.modulesById,D.reachMods,Pe,D.records);Ct.push({advisoryId:Se.id,packageName:pe.name,symbolName:Pe.exportName,modelWouldPromote:js!==null,...js!==null?{modelId:js.modelId}:{},anchorCleared:js!==null})}}}let hs=H.some(pe=>pe.modelId!==void 0),Mt=Hd(H)?1:0;J={records:bn,deltas:Dn,exitCodes:{baseline:gs(qn["reachable-high"]+qn["reachable-medium"]+Mt,Yt(qn)+(hs?1:0)),withBindingForms:gs(le["reachable-high"]+le["reachable-medium"]+Mt,Yt(le)+(hs?1:0))},dualRunWallMs:Date.now()-V,...w.bindingApplicability!==void 0?{applicability:w.bindingApplicability}:{},...Ct!==void 0?{modelProbe:Ct}:{}},Kd(mt.dirname(e.bindingShadow.outPath),{recursive:!0});let he=`${e.bindingShadow.outPath}.tmp-${Gd(8).toString("hex")}`;Wd(he,`${JSON.stringify(J,null,2)}
+`,{encoding:"utf8",flag:"wx"}),zd(he,e.bindingShadow.outPath)}let oe=new Jt(t),ae=new Map,Ee=V=>{let ye=ae.get(V);if(ye!==void 0)return ye;let Oe=V==="npm"?new Us(P,oe,Ws("npm"),()=>""):V==="Go"?new Us(Qd,oe,Ws("Go"),()=>""):new Us(p?.graph??pr,oe,Ws("PyPI"),Ia((p?.roots??[]).map(Ce=>Ce.rootRel)));return ae.set(V,Oe),Oe},Te=Me.length>0||re.notes.length>0?{active:re.models.length,stored:Me.length,promoted:H.filter(V=>V.modelId!==void 0).length,notes:[...re.notes,...R!==null?R.notes:[]]}:void 0,En=uN(H,n,ve),Un=En.findings.map(V=>V.path===void 0?V:{...V,located:Ee(V.ecosystem).locate(V)}),Hn=new Map,br=V=>{let ye=Hn.get(V);if(ye!==void 0)return ye;let Oe=V==="npm"?lu(P,oe):V==="Go"||p===null?null:du(p.graph,Ee("PyPI"),oe);return Hn.set(V,Oe),Oe},Ye=Un.map(V=>{let ye=V.located?.nodeOf,Oe=V.path?.[V.path.length-1]?.functionId;if(V.influence===void 0||ye===void 0||ye===null||Oe===void 0)return V;let Ce=br(V.ecosystem);return Ce===null?V:{...V,influenceOverlay:cu(Ce.index,Oe,ye,Ce.lineOf,Ce.pathOf)}}),et=()=>{if(p===null)return null;let V=new Map(p.graph.modules.map(Oe=>[Oe.id,Oe])),ye=Ia(p.roots.map(Oe=>Oe.rootRel));return{graph:Oo(p.graph),lineOf:Oe=>{let Ce=V.get(Oe.path);if(Ce===void 0||Ce.id.includes("site-packages:"))return null;let rn=ye(Ce.id),We=rn===""?Ce.path:`${rn}/${Ce.path}`;return Qt(oe,{...Oe,path:We},"utf8-bytes")?.startLine??null}}},gt=Kg(t,Ye,f.perRoot.flatMap(V=>V.pythonLockfilePath?[V.pythonLockfilePath]:[])),Ds;if(e.influenceShadow!==void 0){let V=Xc(P,En.findings,()=>hr.now(),Oe=>Qt(oe,Oe,"utf16-units")?.startLine??null,et());Kd(mt.dirname(e.influenceShadow.outPath),{recursive:!0});let ye=`${e.influenceShadow.outPath}.tmp-${Gd(8).toString("hex")}`;Wd(ye,`${JSON.stringify(V,null,2)}
+`,{encoding:"utf8",flag:"wx"}),zd(ye,e.influenceShadow.outPath),Ds={ports:V.totals.ports,byOutcome:V.totals.byOutcome,wallMs:V.wallMs}}return{...Ds!==void 0?{influenceShadow:Ds}:{},...vn!==void 0?{summaryShadow:vn}:{},...K!==void 0?{modelShadow:K}:{},...J!==void 0?{bindingShadow:J}:{},...Te!==void 0?{modelLane:Te}:{},...e.xPyNameMatchLabel===!0?{nameMatchLabel:!0}:{},dir:t,shardSchemaVersion:r.schemaVersion,installed:f,findings:Ye.map((V,ye)=>{let Oe=gt.idOf[ye]??null;return Oe===null?V:{...V,introducedBy:Oe}}),packageGraphs:gt.graphs,timings:En.timings,counts:le,analyzerDiagnostics:F,pythonDiagnostics:p?.diagnostics??[],...d!==null?{go:{toolchain:d.toolchain===null?null:`${d.toolchain.goversion} ${d.toolchain.goos}/${d.toolchain.goarch}`,facts:d.facts,blockers:d.blockers,roots:d.roots.map(V=>({rootRel:V.rootRel,status:V.status,mode:V.mode,workspace:V.workspace,packages:V.packages,otherConfiguration:V.otherConfiguration,modules:V.modules.size,facts:V.facts}))}}:{},analysisAborted:Q,rejectedEntries:b,entrypointSources:v,entrypointGaps:[..._.gaps,..._.surfaceGaps],entrypointObservations:_.observations,framework:_.framework,unresolved:j,advisories:[...ee.values()],rootSet:l,exitCode:pn,adr105:be.report,inventory:cN(t,e.exclude??[],p,P)}}finally{e.reader===void 0&&r.close()}}function cN(e,n,t,s){let r=t?.roots??[],o=d=>{let c;for(let f of r)(f.rootRel===""||d===f.rootRel||d.startsWith(`${f.rootRel}/`))&&(c===void 0||f.rootRel.length>c.rootRel.length)&&(c=f);return c?.pythonPath},i={...process.env.HOME!==void 0?{home:process.env.HOME}:{},...process.env.XDG_CONFIG_HOME!==void 0?{xdgConfigHome:process.env.XDG_CONFIG_HOME}:{}},a;try{a=kh(e,{exclude:n,gitEnv:i,pythonFor:o})}catch(d){throw d instanceof Rt?new Qn(`the file inventory does not add up (${d.message}); refusing to report coverage it cannot back (ADR-129)`):d}let l=new Set;for(let d of s.modules)d.externalSurface===!0||d.path.includes("node_modules/")||l.add(d.path);for(let d of r)for(let c of d.graph.modules)c.externalSurface===!0||c.packageName!==""||l.add(d.rootRel===""?c.id:`${d.rootRel}/${c.id}`);return Bd(a,l)}var qd=e=>Math.round(e*10)/10;function uN(e,n,t){let s=hr.now(),r=e.map(i=>{let a=fa(i.tier);return a===void 0?i:{...i,influence:a}}),o=hr.now()-s;return{findings:r,timings:{scanMs:qd(s-n),cascadeMs:qd(t),stage6Ms:qd(o)}}}var fN="cupel",pN="reachability-first SCA \u2014 verdict + call path + confidence";function ec(e){return[`${fN} v${e} \u2014 ${pN}`,`cascade: ${Bc.join(" \u2192 ")}`,`verdicts: ${Gc.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-potentially-reachable]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-potentially-reachable","                        exit 2 when any potentially reachable finding is present (strict CI;","                        --fail-on-unknown is the old name, still accepted, with a warning)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
+`)}var mN=new Set([...Er,...ba,...ys]),yo="--fail-on-potentially-reachable",yr="--fail-on-unknown",Rh=`${yr} is deprecated: use ${yo} (the same gate, renamed by ADR-128). The old spelling keeps working, with this warning, until the next major version.`;function Zn(e,n,t){let s=e[n+1];if(s===void 0||s.startsWith("--"))throw new Error(`${t} requires a value`);return s}function gN(e,n){let t=n.split(",").map(o=>o.trim()),s=[...Er,...ba,...ys].join(", ");if(t.length===0||t.some(o=>o===""))throw new Error(`${e}= requires a non-empty comma-separated list of: ${s} (or pass the bare ${e} to fail on every kind)`);let r=[];for(let o of t){if(!mN.has(o))throw new Error(`unrecognised ${e} selector ${JSON.stringify(o)}; valid: ${s}`);r.push(o)}return r}function Oh(e){let n=".",t,s,r,o,i=!1,a=!1,l=!1,d=!1,c=!1,f=!1,p,u,m,g=!1,y=!1,b,_,S=!1,k=!1,v=!0,I=!1,O=!0,E=!1,N,A=[],U=[],$=[];for(let W=0;W<e.length;W+=1){let w=e[W];if(w==="--require-complete-denial"){a=!0;continue}if(w==="--fail-on-reachable")i=!0;else if(w===yo||w===yr)l="all",w===yr&&(d=!0);else if(w!==void 0&&(w.startsWith(`${yo}=`)||w.startsWith(`${yr}=`))){let P=w.startsWith(`${yo}=`)?yo:yr;l=gN(P,w.slice(P.length+1)),P===yr&&(d=!0)}else if(w==="--offline")c=!0;else if(w==="--sarif")t=Zn(e,W,"--sarif"),W+=1;else if(w==="--shard")s=Zn(e,W,"--shard"),W+=1;else if(w==="--shard-pypi")r=Zn(e,W,"--shard-pypi"),W+=1;else if(w==="--shard-go")o=Zn(e,W,"--shard-go"),W+=1;else if(w==="--entry")A.push(Zn(e,W,"--entry")),W+=1;else if(w==="--exclude")U.push(Zn(e,W,"--exclude")),W+=1;else if(w==="--root")$.push(Zn(e,W,"--root")),W+=1;else if(w==="--summary-shadow")p=Zn(e,W,"--summary-shadow"),W+=1;else if(w==="--model-shadow")u=Zn(e,W,"--model-shadow"),W+=1;else if(w==="--model-shadow-out")m=Zn(e,W,"--model-shadow-out"),W+=1;else if(w==="--model-shadow-widened")g=!0;else if(w==="--binding-shadow")y=!0;else if(w==="--x-influence-shadow")_=Zn(e,W,"--x-influence-shadow"),W+=1;else if(w==="--binding-shadow-out")b=Zn(e,W,"--binding-shadow-out"),W+=1;else if(w==="--x-partial-rows")S=!0;else if(w==="--x-go")k=!0;else if(w==="--no-py-precise-names")v=!1;else if(w==="--x-py-precise-names")v=!0;else if(w==="--x-py-name-match-label")I=!0;else if(w==="--no-tsconfig-paths")O=!1;else if(w==="--x-tsconfig-paths")O=!0;else if(w==="--push")E=!0;else if(w!==void 0&&w.startsWith("--auth=")){let P=w.slice(7);if(P!=="oidc"&&P!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(P)}`);N=P}else{if(w!==void 0&&w.startsWith("--"))throw new Error(`unknown flag ${w}`);w!==void 0&&!f&&(n=w,f=!0)}}if(u===void 0!=(m===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(g&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(y!==(b!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(N!==void 0&&!E)throw new Error("--auth only means something with --push");if(o!==void 0&&!k)throw new Error("--shard-go only means something with --x-go");return{dir:n,sarif:t,shard:s,shardPypi:r,shardGo:o,failOnReachable:i,requireCompleteDenial:a,failOnPotentiallyReachable:l,legacyGateFlag:d,offline:c,entry:A,exclude:U,root:$,summaryShadow:p,modelShadow:u,modelShadowOut:m,modelShadowWidened:g,push:E,auth:N,bindingShadow:y,bindingShadowOut:b,influenceShadowOut:_,partialRows:S,xGo:k,pyPreciseNames:v,xPyNameMatchLabel:I,tsconfigPaths:O}}import{chmodSync as kN,mkdirSync as wN,readFileSync as vN,renameSync as EN,statSync as AN,unlinkSync as IN,writeFileSync as NN}from"node:fs";import{randomBytes as RN}from"node:crypto";import{homedir as ON}from"node:os";import Ms from"node:path";import{createPublicKey as hN,verify as yN}from"node:crypto";var Ie=class extends Error{constructor(n){super(n),this.name="DistError"}},Xt=class extends Ie{constructor(n){super(n),this.name="NoCachedShardError"}},bN=Buffer.from("302a300506032b6570032100","hex"),_N=32;function Th(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===_N)try{return hN({key:Buffer.concat([bN,n]),format:"der",type:"spki"})}catch{return}}function nc(e,n,t){for(let s of t){let r=Th(s);if(r!==void 0)try{if(yN(null,e,r,n))return!0}catch{}}return!1}function $h(e){return e.some(n=>Th(n)!==void 0)}var SN=/^[0-9a-f]{64}$/u,xN=/^[a-z0-9-]+$/u;function Ph(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new Ie(`${n} must be an object`);return e}function Ch(e,n){if(!Array.isArray(e))throw new Ie(`${n} must be an array`);return e}function zi(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new Ie(`${n} must be an integer`);return e}function Wi(e,n){if(typeof e!="string")throw new Ie(`${n} must be a string`);return e}function Mh(e,n){let t=Wi(e,n);if(Number.isNaN(Date.parse(t)))throw new Ie(`${n} is not a valid timestamp: ${t}`);return t}function tc(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new Ie("distribution index is not valid JSON")}let s=Ph(t,"index"),r=zi(s.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new Ie(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let o=zi(s.sequence,"sequence");if(o<0)throw new Ie("sequence must be non-negative");let i=Mh(s.generated,"generated"),a=Ch(s.shards,"shards"),l;for(let m of a){let g=Ph(m,"shard entry"),y=Wi(g.ecosystem,"ecosystem");if(!xN.test(y))throw new Ie(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){l=g;break}}if(l===void 0)throw new Ie(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);Mh(l.built,"built");let d=zi(l.db_schema_version,"db_schema_version");if(d<1)throw new Ie("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new Ie(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let c=Wi(l.sha256,"sha256");if(!SN.test(c))throw new Ie(`sha256 must be 64 lowercase hex, got ${JSON.stringify(c)}`);let f=zi(l.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new Ie(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let p=Ch(l.urls,"urls");if(p.length===0)throw new Ie("urls must be a non-empty array");let u=[];for(let m of p){let g=Wi(m,"url");try{u.push(jn(g,n.shardHosts))}catch(y){throw new Ie(`refusing shard url ${JSON.stringify(g)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:c,sizeBytes:f,dbSchemaVersion:d,urls:u,sequence:o,generated:i}}var Lh="CUPEL_CONFIG_DIR",Dh="credentials.json",sc="cpd_",PN="cpl_",CN=sc.length+6+32,MN=200,TN=/^[A-Za-z0-9_-]+$/u,bo=class extends Ie{constructor(n){super(n),this.name="StoredCredentialError"}};function Fh(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=ON();if(process.platform==="darwin")return Ms.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let o=e.APPDATA,i=o!==void 0&&o!==""?o:Ms.join(t,"AppData","Roaming");return Ms.join(i,"cupel")}let s=e.XDG_CONFIG_HOME,r=s!==void 0&&s!==""?s:Ms.join(t,".config");return Ms.join(r,"cupel")}function Ui(e){return Ms.join(Fh(e),Dh)}function rc(e){let n=e.trim();return n.startsWith(PN)?{ok:!1,reason:"push-token"}:n.startsWith(sc)?n.length<CN||n.length>MN?{ok:!1,reason:"malformed"}:TN.test(n.slice(sc.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function jh(e,n){let t=Fh(e),s=Ms.join(t,Dh);wN(t,{recursive:!0,mode:448}),process.platform!=="win32"&&kN(t,448);let r=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),o=`${s}.tmp-${RN(8).toString("hex")}`;return NN(o,`${r}
+`,{flag:"wx",mode:384}),EN(o,s),s}function Bh(e){let n=Ui(e),t;try{t=AN(n)}catch(i){if(i instanceof Error&&i.code==="ENOENT")return;throw i}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new bo(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let s;try{s=JSON.parse(vN(n,"utf8"))}catch{throw new bo(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let r=typeof s=="object"&&s!==null&&"delivery_token"in s?s.delivery_token:void 0,o=rc(typeof r=="string"?r:"");if(!o.ok)throw new bo(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return o.token}function Gh(e){try{return IN(Ui(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var _o="CUPEL_DELIVERY_TOKEN",oc=class extends Ie{constructor(n){super(n),this.name="NoDeliveryTokenError"}},ic=class extends Ie{constructor(n){super(n),this.name="DeliveryCredentialError"}};function $N(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function Kh(e,n,t=()=>{}){let s=$N(e)??t();return s!==void 0?()=>Promise.resolve(s):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function zh(e){if(e===void 0)throw new oc(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${_o} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new ic(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var LN="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function DN(){return new Promise(e=>{let n=process.stdin;process.stderr.write(LN),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",s=o=>{n.setRawMode(!1),n.pause(),n.removeListener("data",r),process.stderr.write(`
+`),o===null&&process.exit(130),e(o)},r=o=>{for(let i of o){if(i==="")return s(null);if(i==="\r"||i===`
+`)return s(t);if(i==="\x7F"||i==="\b"){t=t.slice(0,-1);continue}t+=i}};n.on("data",r)})}async function FN(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function Wh(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${te(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
+`),!0)}async function Uh(e){if(Wh(e,"login"))return 1;let n=process.stdin.isTTY?await DN():await FN(),t=rc(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
 `:`cupel login: that is not a delivery token. Paste the whole token as shown once on app.cupel.sh (Settings \u2192 Tokens); it starts with cpd_.
-`),1;let s=mh(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${s} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${sr} in the environment still wins, and \`cupel logout\` forgets it.
-`),0}function xh(e){if(bh(e,"logout"))return 1;let n=gi(process.env);return gh(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
-`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${uh} would point elsewhere).
-`),0}import rA from"node:path";import{randomBytes as I0,createHash as R0}from"node:crypto";import{mkdirSync as O0,readFileSync as P0,renameSync as C0,writeFileSync as M0}from"node:fs";import{homedir as T0}from"node:os";import Es from"node:path";var yd="latest.json",_d="latest.json.sig";function yi(e){return R0("sha256").update(e).digest("hex")}function bd(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=T0();if(process.platform==="darwin")return Es.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let o=process.env.LOCALAPPDATA,r=o!==void 0&&o!==""?o:Es.join(n,"AppData","Local");return Es.join(r,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,s=t!==void 0&&t!==""?t:Es.join(n,".cache");return Es.join(s,"cupel","shards")}function Sd(e,n,t){return Es.join(e,`${n}-${t}.sqlite`)}function _i(e,n){O0(Es.dirname(e),{recursive:!0});let t=`${e}.tmp-${I0(8).toString("hex")}`;M0(t,n,{flag:"wx"}),C0(t,e)}function or(e){try{return P0(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function kh(e,n,t,s){let o=Sd(e,n,t),r=or(o);if(r===void 0)return;let i=yi(r);if(i!==t)throw s(`cached shard ${o} failed sha256 re-verify (expected ${t}, got ${i})`);return{path:o,bytes:r}}var wh="api.cupel.sh",bi=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),vh=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];var $0="/v1/resolve",xd=1024*1024,kd=4096,Eh=xd+kd+64*1024,L0=8,D0=2048,F0=/^[A-Za-z0-9+/]+={0,2}$/u,j0=3e4,cn=class extends Ee{constructor(n){super(n),this.name="DeliveryRefusedError"}},As=class extends cn{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},rr=class extends Ee{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},ir=class extends Ee{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function B0(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function G0(e){if(typeof e!="string"||e.length===0)throw new cn("the delivery response carried no index signature");if(e.length>kd||!F0.test(e))throw new cn("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new cn("the delivery response's index signature is not canonical base64");return n}function K0(e){if(typeof e!="string"||e.length===0)throw new cn("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>xd)throw new cn("the delivery response's index is larger than one can be");return n}function z0(e){if(!Array.isArray(e)||e.length===0)throw new cn("the delivery response named no shard urls");if(e.length>L0)throw new cn("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>D0)throw new cn("the delivery response carried a malformed shard url");n.push(t)}return n}function U0(e,n){throw e===401||e===403?new cn(`${n} rejected the delivery credential \u2014 check ${sr} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new As(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new ir(`${n} holds nothing newer than the shard index already cached`):e===429?new rr(`${n} rate-limited the delivery request`):e>=500?new rr(`${n} answered ${String(e)}`):new cn(`${n} refused the delivery request with status ${String(e)}`)}async function Ah(e,n,t,s,o=j0){let r=Ln(`https://${e}${$0}`,new Set([e])),i=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await s(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},i,o)}catch{throw new rr(`${e} could not be reached`)}if(a.status!==200&&U0(a.status,e),Buffer.byteLength(a.body,"utf8")>Eh)throw new cn(`${e} returned a delivery response larger than one can be`);let l;try{l=JSON.parse(a.body)}catch{throw new cn(`${e} returned a delivery response that is not JSON`)}if(!B0(l))throw new cn(`${e} returned a delivery response that is not an object`);return{index:K0(l.index),sig:G0(l.signature),shardUrls:z0(l.shardUrls)}}var Nh=async(e,n,t,s)=>await ho("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Eh,s);import Si from"node:path";var W0=8,vd=class extends Ee{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function wd(e){return`${e.origin}${e.pathname}`}function Ih(e,n,t){let s=new Map;for(let i of n)s.set(wd(i),i);let o=[],r=[];for(let i of e.slice(0,W0)){let a;try{a=Ln(i,t)}catch(c){r.push(c.message);continue}if(a.hash!==""){r.push("a candidate carried a fragment");continue}let l=s.get(wd(a));if(l===void 0){r.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${wd(l)}${a.search}`);o.push(Ln(d.href,t))}if(o.length===0)throw new vd(`no pre-signed shard url matched the signed index (${r.length===0?"none offered":r.join("; ")})`);return o}var q0=1,V0=1024*1024*1024;function X0(e=bi){return{async resolve(n){return await Ah(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Nh)},async fetchShard(n,t){return Ln(n.href,e),await lc(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Ed(e){return e instanceof Error?e.message:String(e)}function Rh(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:q0,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:V0}}function Y0(e){let n=or(Si.join(e.cacheDir,yd)),t=or(Si.join(e.cacheDir,_d));if(!(n===void 0||t===void 0)&&ud(n,t,e.pubkeys))try{return fd(n,Rh(e))}catch{return}}function Oh(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let s=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(s)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function xi(e,n,t){let s=kh(n.cacheDir,e.ecosystem,e.sha256,o=>new Ee(o));if(s===void 0)throw new Ee(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:s.path,fromCache:!0,warnings:[...t,...Oh(e,n)],sequence:e.sequence}}async function J0(e,n,t,s){let o=Sd(t.cacheDir,e.ecosystem,e.sha256),r=or(o);if(r!==void 0&&yi(r)===e.sha256)return{path:o,downloaded:!1};let i="no shard urls";for(let a of n){let l;try{l=await s.fetchShard(a,e.sizeBytes)}catch(c){i=Ed(c);continue}let d=yi(l);if(d!==e.sha256){i=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return _i(o,l),{path:o,downloaded:!0}}throw new Ee(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${i}`)}function Z0(e,n,t){if(e instanceof cn)throw e;if(e instanceof ir){if(n===void 0)throw new Ee(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return xi(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new Gt(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Ed(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return xi(n,t,[`could not refresh the shard index (${Ed(e)}); using the cached shard`])}async function Ph(e,n){if(!e.activated)throw new Ee("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??X0(e.shardHosts);if(!ch(e.pubkeys))throw new Ee("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let s=Y0(e);if(e.offline){if(s===void 0)throw new Gt(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return xi(s,e,[])}let o=await _h(e.credential),r;try{r=await t.resolve({host:e.indexHost,token:o,ecosystem:e.ecosystem,sequenceFloor:s?.sequence??0})}catch(d){return Z0(d,s,e)}if(!ud(r.index,r.sig,e.pubkeys))throw new Ee("shard index signature did not verify against any pinned key");let i=fd(r.index,Rh(e));if(s!==void 0&&i.sequence<s.sequence)return xi(s,e,[`refusing a rolled-back shard index (served sequence ${String(i.sequence)} < cached ${String(s.sequence)}); keeping the newer cached shard`]);let a=Ih(r.shardUrls,i.urls,e.shardHosts),l=await J0(i,a,e,t);return _i(Si.join(e.cacheDir,yd),r.index),_i(Si.join(e.cacheDir,_d),r.sig),{path:l.path,fromCache:!l.downloaded,warnings:Oh(i,e),sequence:i.sequence}}var Q0="https://api.cupel.sh",Ch=".actions.githubusercontent.com",eA=8192;function Mh(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Gn=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function nA(e){let n;try{n=new URL(e).hostname}catch{throw new Gn("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=Ch.slice(1);if(n!==t&&!n.endsWith(Ch))throw new Gn(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Ln(e,new Set([n]))}catch{throw new Gn(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function ki(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,s=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Gn("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(s===void 0||s==="")throw new Gn("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let o=nA(t);o.searchParams.set("audience",Q0);let r;try{r=await n(o.href,{authorization:`Bearer ${s}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Gn("the ID-token request failed")}if(r.length>eA)throw new Gn("the ID-token response was larger than a token can be");let i;try{i=JSON.parse(r)}catch{throw new Gn("the ID-token response was not JSON")}let a=typeof i=="object"&&i!==null?i.value:void 0;if(typeof a!="string"||a.length===0)throw new Gn("the ID-token response carried no token");return a}async function Th(e,n,t={}){let s=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",o=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!s)throw new Gn("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await ki(e,n)};if(s)return o&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(o)return{kind:"oidc",value:await ki(e,n)};throw new Gn("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var tA=64*1024,sA=64*1024,wi=async(e,n,t,s)=>{if(Buffer.byteLength(t,"utf8")>us)throw new Error("findings payload is over the size limit");return await ho("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,sA,s)};async function vi(e,n){let t=await ho("GET",e,n,void 0,tA,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var iA=720*60*60*1e3,aA=Number(ht);function $h(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function lA(e){let n=process.env.CUPEL_SHARD_GO;return e??(n!==void 0&&n!==""?n:void 0)}function dA(e,n){return Go(e,{discoverGoRoots:!0,...n.length>0?{operatorRoots:n}:{}}).roots.some(Bo)}async function Lh(e,n={}){if(!e.xGo)return;let t=lA(e.shardGo);if(t!==void 0||e.explicitNpm)return t;if((n.holdsGoRoot??dA)(e.dir,e.root))try{return(await(n.zeroConfig??Ei)({offline:e.offline,ecosystem:"go"})).path}catch(s){if(s instanceof As||s instanceof Gt){(n.warn??(o=>process.stderr.write(o)))(`cupel: no Go shard available (${s.message}); Go modules will be reported as not assessed
-`);return}throw s}}function Dh(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new dt("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Ei(e){let n=e.ecosystem??"npm",t=await Ph({ecosystem:n,activated:!0,pubkeys:vh,indexHost:wh,shardHosts:bi,credential:yh(process.env,()=>ki(process.env,vi),()=>hh(process.env)),cacheDir:n==="npm"?bd():rA.join(bd(),n),offline:e.offline,now:Date.now(),maxAgeMs:iA,supportedDbSchemaVersion:aA});for(let s of t.warnings)process.stderr.write(`cupel: ${s}
-`);return{path:t.path,sequence:t.sequence}}var cA=`https://${go}/v1/scan-failed`,uA=400;async function Ad(e,n,t,s,o=1e4){try{let r=JSON.stringify({kind:e,detail:n.slice(0,uA)});await s(cA,{authorization:`Bearer ${t}`,"content-type":"application/json","content-length":String(Buffer.byteLength(r,"utf8"))},r,o)}catch{}}var fA={"reachable-high":"reachable","reachable-medium":"reachable","reachable-low":"reachable","potentially-reachable-not-ruled-out":"potentially-reachable","potentially-reachable-not-analysed":"potentially-reachable","not-reachable":"not-reachable","not-affected":"not-affected"};function Bh(e){let n=e.map(t=>fA[t.tier]);return n.includes("reachable")?"reachable":n.includes("potentially-reachable")?"potentially-reachable":n.length>0&&n.every(t=>t==="not-reachable")?"not-reachable":"not-affected"}function pA(e){return e.some(n=>n.tier==="potentially-reachable-not-ruled-out")?"potentially-reachable-not-ruled-out":"potentially-reachable-not-analysed"}function Fh(e,n){let t=new Map;for(let s of e){let o=n(s),r=t.get(o);r===void 0?t.set(o,[s]):r.push(s)}return[...t.values()]}function jh(e){let n={"potentially-reachable-not-ruled-out":0,"potentially-reachable-not-analysed":0},t=0,s=0,o=0,r=0,i=!1;for(let a of e){let l=Bh(a);l==="reachable"?t+=1:l==="potentially-reachable"?(s+=1,n[pA(a)]+=1):l==="not-reachable"?(o+=1,a.some(d=>d.basis==="loader-assumption")&&(i=!0)):r+=1}return{total:e.length,reachable:t,potentiallyReachable:s,byTier:n,notReachable:o,notAffected:r,notReachableAssumed:i}}function Gh(e){let n=(o,r)=>JSON.stringify([o.ecosystem,o.packageName,o.version,r]),t=Fh(e,o=>n(o,o.advisoryId)),s=0;for(let o of t)Bh(o)==="reachable"&&(s+=o.filter(r=>He(r.tier)).length);return{advisories:jh(t),vulnerabilities:jh(Fh(e,o=>n(o,o.displayId))),middleRowsInReachable:s}}function mA(e){if(e.counts["not-reachable"]===0)return"";let n=e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption");return Hh(n)}var Hh=e=>e?" (assumed: no dependency loader loads them)":" (nothing assumed)",Rd=e=>e===1?"advisory":"advisories",hA=e=>e===1?"finding":"findings",gA=mo.filter(e=>mt[e]==="potentially-reachable-not-ruled-out").join(", ");function Kh(e,n){return`${e} \u2014 ${String(n.reachable)} reachable, ${String(n.potentiallyReachable)} potentially reachable (${String(n.byTier["potentially-reachable-not-ruled-out"])} path not ruled out, ${String(n.byTier["potentially-reachable-not-analysed"])} not analysed), ${String(n.notReachable)} not-reachable${n.notReachable===0?"":Hh(n.notReachableAssumed)}, ${String(n.notAffected)} not-affected.`}function yA(e){let n=e.ecosystem==="PyPI"?"; PyPI":e.alsoPython===!0?"; npm+PyPI":"";return e.ecosystem==="Go"?"; Go":e.alsoGo!==!0?n:n===""?"; npm+Go":`${n}+Go`}var _A={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},zh=4,Nd=3,Id=10,bA={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version or advisory bound is not SemVer 2.0.0 / PEP 440 \u2014 cupel cannot order them","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},SA={"resolution-divergence":"a go.mod replace builds other code than the module@version the advisory names","version-undecidable":"the Go release that builds the program is not the one on PATH, or is not a release","analysis-cap":"another build configuration, a plugin, or an unread part of the build keeps the Go denial open","symbol-unsupported":"the package is imported; the Go scan reads packages, not calls, before S2"};function Uh(e,n){let t=SA[e];return t!==void 0&&n.length>0&&n.every(s=>s.ecosystem==="Go")?t:bA[e]}var xA="(symbol set known incomplete)";function kA(e){let n=(e.path??[]).map(t=>re(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Wh(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function wA(e,n){let t=e.findings.filter(f=>He(f.tier)&&f.reasonKind!==void 0);if(t.length===0)return[];let s=new Map;for(let f of t){let m=s.get(f.reasonKind)??[];m.push(f),s.set(f.reasonKind,m)}let o={cupel:0,project:0};for(let[f,m]of s)o[$n[f]]+=m.length;let r=[],i=n.advisories.potentiallyReachable;r.push(i>0?`\u2753 Potentially reachable (${String(i)}) \u2014 cupel could NOT rule out a path for ${String(i)} ${Rd(i)}. This is not a clean result.`:"\u2753 Potentially reachable (0) \u2014 every undecided finding sits in an advisory counted reachable above.");let a=n.advisories.byTier;r.push(`   Path not ruled out (${String(a["potentially-reachable-not-ruled-out"])}) \u2014 cupel analysed it and a path could not be ruled out (${gA}).`),r.push(`   Not analysed (${String(a["potentially-reachable-not-analysed"])}) \u2014 the function-level question could not be run (every other kind).`);let l=n.middleRowsInReachable;r.push(`   By kind, in findings (${String(t.length)}`+(l>0?`; ${String(l)} of them in advisories counted reachable above`:"")+"):");let d=(f,m)=>{if(o[f]===0)return;r.push(""),r.push(`   ${m} (${String(o[f])}):`);let h=[...s.entries()].filter(([_])=>$n[_]===f).sort((_,S)=>S[1].length-_[1].length||_[0].localeCompare(S[0])),y=h.slice(0,zh);for(let[_,S]of y){let b=f==="project"?[...new Set(S.flatMap(Wh))]:[],k=b.slice(0,Nd).map(re).join(", "),w=b.length>Nd?` (+${String(b.length-Nd)} more files)`:"";r.push(`     ${_.padEnd(21)} ${String(S.length).padStart(4)}  ${Uh(_,S)}`+(k!==""?`
-       ${k}${w}`:""))}for(let[_,S]of h.slice(zh))r.push(`     ${_.padEnd(21)} ${String(S.length).padStart(4)}  ${Uh(_,S)}`)};d("project","Your code \u2014 a change on your side would produce a real verdict"),d("cupel","cupel's gap \u2014 nothing you can do today");let c=new Map;for(let f of t)if($n[f.reasonKind]==="project")for(let m of Wh(f))c.set(m,(c.get(m)??0)+1);let p=[...c.entries()].sort((f,m)=>m[1]-f[1]||f[0].localeCompare(m[0]))[0];p!==void 0&&o.project>0&&(r.push(""),r.push(`   \u279C Start here: ${re(p[0])} appears in ${String(p[1])} of your ${String(o.project)} finding(s), across ${String(c.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let u=t.filter(f=>$n[f.reasonKind]==="project");if(u.length>0){r.push("");for(let f of u.slice(0,Id))r.push(`     ${re(f.displayId)}  ${re(f.packageName)}@${re(f.version)}  [${f.reasonKind}] ${re(f.reason)}`);u.length>Id&&r.push(`     \u2026 and ${String(u.length-Id)} more`)}return r.push(""),r}function vA(e){let n=e.go;if(n===void 0)return[];let t=[];t.push(`\u2139\uFE0F  Go, package level (${String(n.roots.length)} root${n.roots.length===1?"":"s"}): ${re(n.toolchain??"no usable Go toolchain")}`);for(let s of n.facts)t.push(`    ${re(s)}`);for(let s of n.roots.slice(0,8)){let o=s.rootRel===""?".":s.rootRel;t.push(`    ${re(o)}: ${s.status}`+(s.mode===null?"":`, -mod=${s.mode}`)+(s.workspace===null?"":`, workspace ${re(s.workspace)}`)+`, ${String(s.packages)} package(s) in the graph, ${String(s.modules)} module(s)`+(s.otherConfiguration>0?`, ${String(s.otherConfiguration)} package(s) only another build configuration imports`:""));for(let r of s.facts.slice(0,5))t.push(`      - ${re(r)}`)}return n.roots.length>8&&t.push(`    \u2026 and ${String(n.roots.length-8)} more`),n.blockers.length>0&&t.push(`    no Go not-reachable stands in this scan: ${re(n.blockers.join("; "))}`),t.push(""),t}function qh(e){let n=[],t=e.counts,s=e.findings.filter(u=>u.tier==="reachable-high"||u.tier==="reachable-medium"||u.tier==="reachable-low");if(n.push(`cupel scan: ${re(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let u=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+u.map(f=>`${re(f.entrypoint)} [${re(f.source)}]`).join(", ")+(e.entrypointSources.length>u.length?`, \u2026 and ${String(e.entrypointSources.length-u.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let u=new Map;for(let f of e.entrypointObservations)u.set(f.kind,(u.get(f.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...u.entries()].map(([f,m])=>`${String(m)} ${f}`).join(", ")+` (${re(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let u=e.rootSet,f=u.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(u.counts.rootsAdmitted)}): `+f.map(y=>`${re(y.rel===""?".":y.rel)} [${y.witnesses.join("+")}${yA(y)}]`).join(", ")+(u.roots.length>f.length?`, \u2026 and ${String(u.roots.length-f.length)} more`:"")),u.observations.length>0){let y=new Map;for(let _ of u.observations)y.set(_.kind,(y.get(_.kind)??0)+1);n.push("    not admitted: "+[...y.entries()].map(([_,S])=>`${String(S)} ${_}`).join(", "))}n.push(`    walk: ${String(u.counts.dirsWalked)} dirs, ${String(u.counts.manifestsSeen)} manifests seen, ${String(u.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${u.budget}`);let m=e.installed.perRoot.filter(y=>y.rootRel!=="");m.length>0&&n.push(`    enumerated (${String(m.length)} nested root${m.length===1?"":"s"}): `+m.slice(0,8).map(y=>`${re(y.rootRel)} (${String(y.packages.length)} packages, ${y.source})`).join(", ")+(m.length>8?`, \u2026 and ${String(m.length-8)} more`:""));let h=zs(u,e.entrypointSources);h.length>0&&n.push(`    NOT analyzed (${String(h.length)}): ${re(_l(h.map(y=>y.rel===""?".":y.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at potentially reachable until they are analyzed`),u.budget!=="complete"&&u.budget!=="not-attempted"&&n.push(`    the walk did not finish (${u.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at potentially reachable`),n.push("")}if(n.push(...vA(e)),e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let u of e.entrypointGaps.slice(0,5))n.push(`  - ${re(u.source)} (${re(u.file)}): ${re(u.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(re).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at potentially reachable, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${xa(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at potentially reachable, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let o=e.installed.gaps,r=o.find(u=>u.kind==="no-enumeration")??null;r!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${re(r.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let i=o.filter(u=>u!==r);if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let u of i.slice(0,10))n.push(`  - [${re(u.kind)}] ${re(u.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let a=new Set(o.map(u=>u.detail)),l=[...e.analyzerDiagnostics.map(u=>`${re(u.code)}: ${re(u.detail)}`),...e.pythonDiagnostics.map(u=>`python: ${re(u)}`),...e.installed.diagnostics.filter(u=>!a.has(u)).map(re)];if(l.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(l.length)}) \u2014 verdicts are conservative:`);for(let u of l.slice(0,10))n.push(`  - ${u}`);l.length>10&&n.push(`  \u2026 and ${String(l.length-10)} more`),n.push("")}let d=Gh(e.findings);if(s.length>0){let u=d.advisories.reachable;n.push(`\u{1F3AF} Reachable (${String(u)}) \u2014 fix these: ${String(u)} ${Rd(u)}, ${String(s.length)} ${hA(s.length)}, each with its call path.`);for(let f of s)n.push(`  ${_A[f.tier]} ${re(f.displayId)}  ${re(f.packageName)}@${re(f.version)}  ${re(f.symbolName??"")}`+(f.surfaceComplete===!1?`  ${xA}`:"")),n.push(`        path: ${kA(f)}`);n.push("")}n.push(...wA(e,d));let c=d.advisories,p=d.vulnerabilities;return n.push(`Summary: ${Kh(`${String(c.total)} ${Rd(c.total)}`,c)}`),n.push(`         ${Kh(`${String(p.total)} ${p.total===1?"vulnerability":"vulnerabilities"} (deduplicated by CVE)`,p)}`),n.push(`Findings: ${String(e.findings.length)} \u2014 ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t["potentially-reachable-not-ruled-out"]+t["potentially-reachable-not-analysed"])} potentially reachable (${String(t["potentially-reachable-not-ruled-out"])} path not ruled out, ${String(t["potentially-reachable-not-analysed"])} not analysed), ${String(t["not-reachable"])} not-reachable${mA(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as EA}from"node:crypto";var AA="https://json.schemastore.org/sarif-2.1.0.json",Vh="cupel-reachability",Od=new Set(["dispatch","dynamic-load","coverage-gap"]);function NA(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var IA=500,RA=10;function OA(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function PA(e,n){return`${e}::${n}`}function CA(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function MA(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return EA("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function TA(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:!He(e.tier)||e.reasonKind===void 0?!1:Od.has(e.reasonKind)}var Xh={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range: one of them is not a valid version for its ecosystem (npm: SemVer 2.0.0; PyPI: PEP 440)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function Yh(e){let n=[],t=new Map,s=[],o=new Ut(e.dir);for(let d of e.findings){if(!TA(d))continue;let c=PA(d.displayId,d.packageName);if(!t.has(c)){t.set(c,n.length);let v=CA(d.severity);n.push({id:re(c),properties:{tags:d.reasonKind==="coverage-gap"?["security","coverage-gap",`gap/${re(d.packageName)}`]:["security","reachability",`package/${re(d.packageName)}`],...v!==void 0?{"security-severity":v}:{}}})}let p=d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low",u=d.path??[],f=u.findIndex(v=>v.modulePath!==""),m=f===-1?void 0:u[f],h=Ms(d.ecosystem),y=d.located?.path??null,_=v=>y?.[v]?.modulePath??u[v]?.modulePath??"",S=(v,I)=>{if(I===null)return;let A=_(v);return Wt(o,A===""?I:{...I,path:A},h)??void 0},b=u[f+1]?.calledAt??null,k=m!==void 0&&b!==null&&b.path===m.modulePath?S(f,b):void 0,w=[...new Set(d.unresolvedSites.map(v=>v.path).filter(v=>v!==""))],N=p?m!==void 0?{physicalLocation:{artifactLocation:{uri:re(_(f))},...k!==void 0?{region:k}:{}},message:{text:`calls ${re(d.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:re(d.packageLocation??"package-lock.json")}}}:w[0]!==void 0?{physicalLocation:{artifactLocation:{uri:re(w[0])}},message:{text:`unresolved ${re(d.reasonKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:re(d.packageLocation??(d.reasonKind==="coverage-gap"?"package.json":"package-lock.json"))}}},R=p?u.map((v,I)=>({physicalLocation:{artifactLocation:{uri:re(_(I)||"package-lock.json")}},message:{text:re(v.functionName??"<step>")}})):w.slice(1,RA+1).map(v=>({physicalLocation:{artifactLocation:{uri:re(v)}},message:{text:"also blocked here"}}));s.push({ruleId:re(c),ruleIndex:t.get(c),level:p?"error":"warning",message:{text:re(`[${d.tier}] ${d.displayId} in ${d.packageName}@${d.version}`+(d.symbolName!==null?` \u2014 reaches ${d.symbolName}`:"")+(d.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${d.reason}`)},locations:[N],...R.length>0?{relatedLocations:R}:{},...p&&u.length>0?{codeFlows:[{threadFlows:[{locations:u.map((v,I)=>{let A=v.calledAt===null?void 0:S(I-1,v.calledAt),B=v.calledAt===null?_(I):_(I-1)||v.calledAt.path;return{location:{physicalLocation:{artifactLocation:{uri:re(B||"package-lock.json")},...A!==void 0?{region:A}:{}},message:{text:re(I===0?`entry ${v.functionName??"<step>"}`:`calls ${v.functionName??"<step>"}`)}}}})}]}]}:{},partialFingerprints:{"cupelReachability/v1":MA(d)},properties:{tier:d.tier,advisoryId:re(d.advisoryId),...d.surfaceComplete===!1?{surfaceComplete:!1}:{},...d.modelId!==void 0?{modelId:re(d.modelId),modelPromotedFromKind:d.modelPromotedFromKind}:{},...d.reasonKind!==void 0?{reasonKind:d.reasonKind,reasonOwner:$n[d.reasonKind],unresolvedSiteCount:d.unresolvedSites.length}:{},...d.adr105!==void 0?{adr105:d.adr105}:{},...d.influence!==void 0?{influence:{value:d.influence.value,kind:d.influence.kind,owner:co[d.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null}}:{}}})}let r=new Map,i=new Map;for(let d of e.findings){if(!He(d.tier)||d.reasonKind===void 0||(r.set(d.reasonKind,(r.get(d.reasonKind)??0)+1),Od.has(d.reasonKind)))continue;let c=i.get(d.reasonKind)??[];c.length<IA&&c.push({advisory:re(d.displayId),package:re(d.packageName),version:re(d.version)}),i.set(d.reasonKind,c)}let a={cupel:0,project:0};for(let[d,c]of r)a[$n[d]]+=c;let l={};for(let[d,c]of i){let p=r.get(d)??c.length;l[d]={count:p,owner:$n[d],note:Xh[d],truncated:p>c.length,advisories:c}}return{$schema:AA,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Vh},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:re(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(d=>`${d.entrypoint} (${d.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...r.keys()].filter(d=>!Od.has(d)&&!NA(d,e.analysisAborted)).sort().map(d=>({descriptor:{id:`potentially-reachable-${d}`},level:"warning",message:{text:`${String(r.get(d)??0)} finding(s) are Potentially reachable because ${Xh[d]} (owner: ${$n[d]}). These are counted in counts["${mt[d]}"] and itemised in run.properties.potentiallyReachable.grouped["${d}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(d=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:re(`${d.source} (${d.file}): ${d.detail}`)}})),...e.rejectedEntries.map(d=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:re(`--entry did not resolve to a file inside the app root: ${d}`)}})),...e.entrypointObservations.map(d=>({descriptor:{id:`entrypoint-observation:${d.kind}`},level:"note",message:{text:re(`${d.detail} (${d.file})`)}})),...e.analyzerDiagnostics.map(d=>({descriptor:{id:d.code},level:"warning",message:{text:re(`${d.detail}${d.reason===void 0?"":` [reason: ${d.reason}]`} (${d.path})`)}})),...e.pythonDiagnostics.map(d=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:re(d)}})),...(e.go?.facts??[]).map(d=>({descriptor:{id:"go-build-context"},level:"note",message:{text:re(d)}})),...(e.go?.blockers??[]).map(d=>({descriptor:{id:"go-denial-withheld"},level:"warning",message:{text:re(`no Go not-reachable stands in this scan: ${d}`)}})),...e.installed.diagnostics.map(d=>({descriptor:{id:"resolve"},level:"warning",message:{text:re(d)}}))]}],results:s,properties:{category:Vh,summary:e.counts,...e.timings!==void 0?{timings:e.timings}:{},installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(d=>({path:re(d.rootRel),count:d.packages.length,source:d.source}))},...e.go!==void 0?{go:{toolchain:e.go.toolchain===null?null:re(e.go.toolchain),deniesWithheld:e.go.blockers.map(re),roots:e.go.roots.slice(0,64).map(d=>({path:re(d.rootRel),status:d.status,mode:d.mode,workspace:d.workspace===null?null:re(d.workspace),packages:d.packages,otherConfiguration:d.otherConfiguration,modules:d.modules}))}}:{},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:zs(e.rootSet,e.entrypointSources).length,named:zs(e.rootSet,e.entrypointSources).slice(0,8).map(d=>re(d.rel===""?".":d.rel))},analyzed:[...Uo(e.entrypointSources)].sort().slice(0,64).map(d=>re(d===""?".":d)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(d=>({path:re(d.rel),witnesses:d.witnesses,...d.manifestRefused?{manifestRefused:!0}:{},...d.ecosystem!==void 0?{ecosystem:d.ecosystem}:{},...d.alsoPython===!0?{alsoPython:!0}:{},...d.alsoGo===!0?{alsoGo:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(d=>({kind:d.kind,path:re(d.rel)}))}}:{},...OA(e),potentiallyReachable:{total:zt(e.counts),byTier:Object.fromEntries(cs.map(d=>[d,e.counts[d]])),byKind:Object.fromEntries([...r].sort((d,c)=>c[1]-d[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(d=>He(d.tier)&&d.reasonKind==="db-gap").map(d=>({advisory:re(d.displayId),package:re(d.packageName),version:re(d.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(d=>d.adr105!==void 0).map(d=>({advisory:re(d.displayId),package:re(d.packageName),version:re(d.version),symbol:re(d.symbolName??""),tier:d.tier,...d.reasonKind!==void 0?{reasonKind:d.reasonKind}:{},...d.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function Jh(){try{let e=$A(FA(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function jA(e,n){let t=`${JSON.stringify(n,null,2)}
-`,s=`${e}.tmp-${Zh(8).toString("hex")}`;Qh(s,t,{encoding:"utf8",flag:"wx"}),LA(s,e)}async function BA(e){let n=rh(e);n.legacyGateFlag&&process.stderr.write(`cupel: ${oh}
-`);let t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",s=t?{path:Dh(n.shard),sequence:null}:await Ei({offline:n.offline}),o=s.path,i=$h(n.shardPypi);if(i===void 0&&!t)try{i=(await Ei({offline:n.offline,ecosystem:"pypi"})).path}catch(d){if(d instanceof As||d instanceof Gt)process.stderr.write(`cupel: no PyPI shard available (${d.message}); Python distributions, if any, will be reported as not assessed
-`);else throw d}let a=await Lh({xGo:n.xGo,shardGo:n.shardGo,dir:n.dir,root:n.root,offline:n.offline,explicitNpm:t}),l=dd({dir:n.dir,shardPath:o,...i!==void 0?{shardPathPypi:i}:{},...n.xGo?{xGo:!0}:{},...a!==void 0?{shardPathGo:a}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnPotentiallyReachable:n.failOnPotentiallyReachable,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.influenceShadowOut!==void 0?{influenceShadow:{outPath:n.influenceShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},pyPreciseNames:n.pyPreciseNames,tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${qh(l)}
-`),l.modelLane!==void 0){let d=l.modelLane.notes.length>0?` (${l.modelLane.notes.map(c=>re(c)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(l.modelLane.active)}/${String(l.modelLane.stored)} active, ${String(l.modelLane.promoted)} promoted to reachable-low${d}
-`)}if(n.summaryShadow!==void 0&&l.summaryShadow!==void 0){let d=DA.join(n.summaryShadow,"shadow-report.json");Qh(d,`${JSON.stringify(l.summaryShadow,null,2)}
+`),1;let s=jh(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${s} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${_o} in the environment still wins, and \`cupel logout\` forgets it.
+`),0}function Hh(e){if(Wh(e,"logout"))return 1;let n=Ui(process.env);return Gh(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
+`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${Lh} would point elsewhere).
+`),0}import hR from"node:path";import{randomBytes as jN,createHash as BN}from"node:crypto";import{mkdirSync as GN,readFileSync as KN,renameSync as zN,writeFileSync as WN}from"node:fs";import{homedir as UN}from"node:os";import Ts from"node:path";var ac="latest.json",lc="latest.json.sig";function Hi(e){return BN("sha256").update(e).digest("hex")}function dc(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=UN();if(process.platform==="darwin")return Ts.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,o=r!==void 0&&r!==""?r:Ts.join(n,"AppData","Local");return Ts.join(o,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,s=t!==void 0&&t!==""?t:Ts.join(n,".cache");return Ts.join(s,"cupel","shards")}function cc(e,n,t){return Ts.join(e,`${n}-${t}.sqlite`)}function qi(e,n){GN(Ts.dirname(e),{recursive:!0});let t=`${e}.tmp-${jN(8).toString("hex")}`;WN(t,n,{flag:"wx"}),zN(t,e)}function So(e){try{return KN(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function qh(e,n,t,s){let r=cc(e,n,t),o=So(r);if(o===void 0)return;let i=Hi(o);if(i!==t)throw s(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${i})`);return{path:r,bytes:o}}var Vh="api.cupel.sh",Vi=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Xh=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];var HN="/v1/resolve",uc=1024*1024,fc=4096,Yh=uc+fc+64*1024,qN=8,VN=2048,XN=/^[A-Za-z0-9+/]+={0,2}$/u,YN=3e4,fn=class extends Ie{constructor(n){super(n),this.name="DeliveryRefusedError"}},$s=class extends fn{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},xo=class extends Ie{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},ko=class extends Ie{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function JN(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function QN(e){if(typeof e!="string"||e.length===0)throw new fn("the delivery response carried no index signature");if(e.length>fc||!XN.test(e))throw new fn("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new fn("the delivery response's index signature is not canonical base64");return n}function ZN(e){if(typeof e!="string"||e.length===0)throw new fn("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>uc)throw new fn("the delivery response's index is larger than one can be");return n}function eR(e){if(!Array.isArray(e)||e.length===0)throw new fn("the delivery response named no shard urls");if(e.length>qN)throw new fn("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>VN)throw new fn("the delivery response carried a malformed shard url");n.push(t)}return n}function nR(e,n){throw e===401||e===403?new fn(`${n} rejected the delivery credential \u2014 check ${_o} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new $s(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new ko(`${n} holds nothing newer than the shard index already cached`):e===429?new xo(`${n} rate-limited the delivery request`):e>=500?new xo(`${n} answered ${String(e)}`):new fn(`${n} refused the delivery request with status ${String(e)}`)}async function Jh(e,n,t,s,r=YN){let o=jn(`https://${e}${HN}`,new Set([e])),i=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await s(o.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},i,r)}catch{throw new xo(`${e} could not be reached`)}if(a.status!==200&&nR(a.status,e),Buffer.byteLength(a.body,"utf8")>Yh)throw new fn(`${e} returned a delivery response larger than one can be`);let l;try{l=JSON.parse(a.body)}catch{throw new fn(`${e} returned a delivery response that is not JSON`)}if(!JN(l))throw new fn(`${e} returned a delivery response that is not an object`);return{index:ZN(l.index),sig:QN(l.signature),shardUrls:eR(l.shardUrls)}}var Qh=async(e,n,t,s)=>await Ar("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Yh,s);import Xi from"node:path";var tR=8,mc=class extends Ie{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function pc(e){return`${e.origin}${e.pathname}`}function Zh(e,n,t){let s=new Map;for(let i of n)s.set(pc(i),i);let r=[],o=[];for(let i of e.slice(0,tR)){let a;try{a=jn(i,t)}catch(c){o.push(c.message);continue}if(a.hash!==""){o.push("a candidate carried a fragment");continue}let l=s.get(pc(a));if(l===void 0){o.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${pc(l)}${a.search}`);r.push(jn(d.href,t))}if(r.length===0)throw new mc(`no pre-signed shard url matched the signed index (${o.length===0?"none offered":o.join("; ")})`);return r}var rR=1,oR=1024*1024*1024;function iR(e=Vi){return{async resolve(n){return await Jh(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Qh)},async fetchShard(n,t){return jn(n.href,e),await eu(n.href,{maxBytes:t,timeoutMs:3e4})}}}function gc(e){return e instanceof Error?e.message:String(e)}function ey(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:rR,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:oR}}function aR(e){let n=So(Xi.join(e.cacheDir,ac)),t=So(Xi.join(e.cacheDir,lc));if(!(n===void 0||t===void 0)&&nc(n,t,e.pubkeys))try{return tc(n,ey(e))}catch{return}}function ny(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let s=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(s)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Yi(e,n,t){let s=qh(n.cacheDir,e.ecosystem,e.sha256,r=>new Ie(r));if(s===void 0)throw new Ie(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:s.path,fromCache:!0,warnings:[...t,...ny(e,n)],sequence:e.sequence}}async function lR(e,n,t,s){let r=cc(t.cacheDir,e.ecosystem,e.sha256),o=So(r);if(o!==void 0&&Hi(o)===e.sha256)return{path:r,downloaded:!1};let i="no shard urls";for(let a of n){let l;try{l=await s.fetchShard(a,e.sizeBytes)}catch(c){i=gc(c);continue}let d=Hi(l);if(d!==e.sha256){i=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return qi(r,l),{path:r,downloaded:!0}}throw new Ie(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${i}`)}function dR(e,n,t){if(e instanceof fn)throw e;if(e instanceof ko){if(n===void 0)throw new Ie(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Yi(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new Xt(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${gc(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Yi(n,t,[`could not refresh the shard index (${gc(e)}); using the cached shard`])}async function ty(e,n){if(!e.activated)throw new Ie("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??iR(e.shardHosts);if(!$h(e.pubkeys))throw new Ie("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let s=aR(e);if(e.offline){if(s===void 0)throw new Xt(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Yi(s,e,[])}let r=await zh(e.credential),o;try{o=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:s?.sequence??0})}catch(d){return dR(d,s,e)}if(!nc(o.index,o.sig,e.pubkeys))throw new Ie("shard index signature did not verify against any pinned key");let i=tc(o.index,ey(e));if(s!==void 0&&i.sequence<s.sequence)return Yi(s,e,[`refusing a rolled-back shard index (served sequence ${String(i.sequence)} < cached ${String(s.sequence)}); keeping the newer cached shard`]);let a=Zh(o.shardUrls,i.urls,e.shardHosts),l=await lR(i,a,e,t);return qi(Xi.join(e.cacheDir,ac),o.index),qi(Xi.join(e.cacheDir,lc),o.sig),{path:l.path,fromCache:!l.downloaded,warnings:ny(i,e),sequence:i.sequence}}var cR="https://api.cupel.sh",sy=".actions.githubusercontent.com",uR=8192;function ry(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Wn=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function fR(e){let n;try{n=new URL(e).hostname}catch{throw new Wn("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=sy.slice(1);if(n!==t&&!n.endsWith(sy))throw new Wn(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return jn(e,new Set([n]))}catch{throw new Wn(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Ji(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,s=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Wn("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(s===void 0||s==="")throw new Wn("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=fR(t);r.searchParams.set("audience",cR);let o;try{o=await n(r.href,{authorization:`Bearer ${s}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Wn("the ID-token request failed")}if(o.length>uR)throw new Wn("the ID-token response was larger than a token can be");let i;try{i=JSON.parse(o)}catch{throw new Wn("the ID-token response was not JSON")}let a=typeof i=="object"&&i!==null?i.value:void 0;if(typeof a!="string"||a.length===0)throw new Wn("the ID-token response carried no token");return a}async function oy(e,n,t={}){let s=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!s)throw new Wn("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Ji(e,n)};if(s)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await Ji(e,n)};throw new Wn("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var pR=64*1024,mR=64*1024,Qi=async(e,n,t,s)=>{if(Buffer.byteLength(t,"utf8")>bs)throw new Error("findings payload is over the size limit");return await Ar("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,mR,s)};async function Zi(e,n){let t=await Ar("GET",e,n,void 0,pR,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var yR=720*60*60*1e3,bR=Number(bt);function iy(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function _R(e){let n=process.env.CUPEL_SHARD_GO;return e??(n!==void 0&&n!==""?n:void 0)}function SR(e,n){return Zr(e,{discoverGoRoots:!0,...n.length>0?{operatorRoots:n}:{}}).roots.some(Qr)}async function ay(e,n={}){if(!e.xGo)return;let t=_R(e.shardGo);if(t!==void 0||e.explicitNpm)return t;if((n.holdsGoRoot??SR)(e.dir,e.root))try{return(await(n.zeroConfig??ea)({offline:e.offline,ecosystem:"go"})).path}catch(s){if(s instanceof $s||s instanceof Xt){(n.warn??(r=>process.stderr.write(r)))(`cupel: no Go shard available (${s.message}); Go modules will be reported as not assessed
+`);return}throw s}}function ly(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Qn("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function ea(e){let n=e.ecosystem??"npm",t=await ty({ecosystem:n,activated:!0,pubkeys:Xh,indexHost:Vh,shardHosts:Vi,credential:Kh(process.env,()=>Ji(process.env,Zi),()=>Bh(process.env)),cacheDir:n==="npm"?dc():hR.join(dc(),n),offline:e.offline,now:Date.now(),maxAgeMs:yR,supportedDbSchemaVersion:bR});for(let s of t.warnings)process.stderr.write(`cupel: ${s}
+`);return{path:t.path,sequence:t.sequence}}var xR=`https://${Ir}/v1/scan-failed`,kR=400;async function hc(e,n,t,s,r=1e4){try{let o=JSON.stringify({kind:e,detail:n.slice(0,kR)});await s(xR,{authorization:`Bearer ${t}`,"content-type":"application/json","content-length":String(Buffer.byteLength(o,"utf8"))},o,r)}catch{}}var yc=8,wR=3,Ls=500;function vR(e){let n=[`${String(e.files)} ${e.files===1?"file":"files"}`];return n.push(`${Ki(e.coverage)} scanned`),e.reached!==null&&n.push(`${String(e.reached)} reached`),e.failed>0&&n.push(`${String(e.failed)} failed`),e.unsupported>0&&n.push(`${String(e.unsupported)} not supported yet`),e.excluded>0&&n.push(`${String(e.excluded)} excluded`),`   ${e.label}: ${n.join(" \xB7 ")}`}function dy(e){let n=[],t=e.total;n.push(`\u{1F4C2} Source files: ${String(t.files)} \xB7 ${Ki(t.coverage)} scanned`+(t.reached===null?"":` \xB7 ${String(t.reached)} reached from an entrypoint`));for(let s of e.languages)n.push(vR(s));if(e.failedFiles.length>0){n.push(`   \u26A0\uFE0F  ${String(e.failedFiles.length)} ${e.failedFiles.length===1?"file":"files"} could not be scanned:`);let s=new Map;for(let o of e.failedFiles){let i=`${o.reason}\0${o.detail??""}`,a=s.get(i)??[];a.push(o),s.set(i,a)}let r=0;for(let o of s.values()){if(r===yc)break;r+=1;let i=o[0];if(i===void 0)continue;let a=`${i.reason}${i.detail===void 0?"":` (${te(i.detail)})`}`,l=o.slice(0,wR).map(d=>te(d.rel));n.push(`      ${String(o.length)} \xD7 ${a}: ${l.join(", ")}${o.length>l.length?", \u2026":""}`)}s.size>yc&&n.push(`      \u2026 and ${String(s.size-yc)} more reasons (every file is in the SARIF output)`)}if(e.unsupportedFiles.length>0&&n.push(`   \u2139\uFE0F  ${String(e.unsupportedFiles.length)} ${e.unsupportedFiles.length===1?"file is":"files are"} in a language cupel does not read yet, counted as not scanned`),e.excludedFiles.length>0||e.excludedDirectories.length>0){let s=[];if(e.excludedFiles.length>0&&s.push(`${String(e.excludedFiles.length)} ${e.excludedFiles.length===1?"file":"files"}`),e.excludedDirectories.length>0){let r=e.excludedDirectories.slice(0,6).map(o=>`${te(o.rel)} [${AR(o.rule.origin,o.rule.source)}]`);s.push(`${String(e.excludedDirectories.length)} ${e.excludedDirectories.length===1?"directory":"directories"} (${r.join(", ")}${e.excludedDirectories.length>r.length?", \u2026":""})`)}n.push(`   \u2139\uFE0F  Excluded: ${s.join(", ")}`)}return e.unwalked.length>0&&n.push(`   \u26A0\uFE0F  Not walked: ${e.unwalked.slice(0,6).map(s=>`${te(s.rel)} [${s.reason}]`).join(", ")}${e.unwalked.length>6?", \u2026":""}`),e.truncated!==null&&n.push(`   \u26A0\uFE0F  The inventory stopped at ${String(e.truncated.limit)} ${e.truncated.cap}: files past it are not counted`),n.push(`   ${ER(e)}`),n}function ER(e){switch(e.git.kind){case"index":return"Ignore rules: git's, with its index (a tracked file is counted even under an ignore pattern)";case"ignore-files":return`Ignore rules: git's ignore files (index not read: ${te(e.git.indexNote)})`;case"none":return"Ignore rules: not a git checkout; .gitignore and .cupelignore files still apply"}}function AR(e,n){return e==="default"||e==="virtualenv"?"default":e==="git-dir"?"git":e==="symlink"?"symlink":e==="exclude-flag"?"--exclude":te(n)}function cy(e){return{total:e.total,languages:e.languages.map(n=>({language:n.language,files:n.files,scanned:n.scanned,unsupported:n.unsupported,failed:n.failed,failedByReason:n.failedByReason,excluded:n.excluded,reached:n.reached,coverage:n.coverage})),failed:e.failedFiles.slice(0,Ls).map(n=>({path:te(n.rel),language:n.language,reason:n.reason,...n.detail===void 0?{}:{detail:te(n.detail)}})),excluded:e.excludedFiles.slice(0,Ls).map(n=>({path:te(n.rel),language:n.language,rule:{origin:n.rule.origin,source:te(n.rule.source),line:n.rule.line,pattern:te(n.rule.pattern)}})),excludedDirectories:e.excludedDirectories.slice(0,Ls).map(n=>({path:te(n.rel),rule:{origin:n.rule.origin,source:te(n.rule.source),line:n.rule.line,pattern:te(n.rule.pattern)}})),unwalked:e.unwalked.slice(0,Ls).map(n=>({path:te(n.rel),reason:n.reason})),truncated:e.truncated,git:e.git.kind==="ignore-files"?{kind:e.git.kind,indexNote:te(e.git.indexNote)}:{kind:e.git.kind},omitted:{failed:Math.max(0,e.failedFiles.length-Ls),excluded:Math.max(0,e.excludedFiles.length-Ls),excludedDirectories:Math.max(0,e.excludedDirectories.length-Ls)}}}var IR={"reachable-high":"reachable","reachable-medium":"reachable","reachable-low":"reachable","potentially-reachable-not-ruled-out":"potentially-reachable","potentially-reachable-not-analysed":"potentially-reachable","not-reachable":"not-reachable","not-affected":"not-affected"};function py(e){let n=e.map(t=>IR[t.tier]);return n.includes("reachable")?"reachable":n.includes("potentially-reachable")?"potentially-reachable":n.length>0&&n.every(t=>t==="not-reachable")?"not-reachable":"not-affected"}function NR(e){return e.some(n=>n.tier==="potentially-reachable-not-ruled-out")?"potentially-reachable-not-ruled-out":"potentially-reachable-not-analysed"}function uy(e,n){let t=new Map;for(let s of e){let r=n(s),o=t.get(r);o===void 0?t.set(r,[s]):o.push(s)}return[...t.values()]}function fy(e){let n={"potentially-reachable-not-ruled-out":0,"potentially-reachable-not-analysed":0},t=0,s=0,r=0,o=0,i=!1;for(let a of e){let l=py(a);l==="reachable"?t+=1:l==="potentially-reachable"?(s+=1,n[NR(a)]+=1):l==="not-reachable"?(r+=1,a.some(d=>d.basis==="loader-assumption")&&(i=!0)):o+=1}return{total:e.length,reachable:t,potentiallyReachable:s,byTier:n,notReachable:r,notAffected:o,notReachableAssumed:i}}function my(e){let n=(r,o)=>JSON.stringify([r.ecosystem,r.packageName,r.version,o]),t=uy(e,r=>n(r,r.advisoryId)),s=0;for(let r of t)py(r)==="reachable"&&(s+=r.filter(o=>He(o.tier)).length);return{advisories:fy(t),vulnerabilities:fy(uy(e,r=>n(r,r.displayId))),middleRowsInReachable:s}}function RR(e){if(e.counts["not-reachable"]===0)return"";let n=e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption");return _y(n)}var _y=e=>e?" (assumed: no dependency loader loads them)":" (nothing assumed)",Sc=e=>e===1?"advisory":"advisories",OR=e=>e===1?"finding":"findings",PR=Er.filter(e=>yt[e]==="potentially-reachable-not-ruled-out").join(", ");function gy(e,n){return`${e} \u2014 ${String(n.reachable)} reachable, ${String(n.potentiallyReachable)} potentially reachable (${String(n.byTier["potentially-reachable-not-ruled-out"])} path not ruled out, ${String(n.byTier["potentially-reachable-not-analysed"])} not analysed), ${String(n.notReachable)} not-reachable${n.notReachable===0?"":_y(n.notReachableAssumed)}, ${String(n.notAffected)} not-affected.`}function CR(e){let n=e.ecosystem==="PyPI"?"; PyPI":e.alsoPython===!0?"; npm+PyPI":"";return e.ecosystem==="Go"?"; Go":e.alsoGo!==!0?n:n===""?"; npm+Go":`${n}+Go`}function MR(e){let n=e.findings.filter(r=>r.tier==="reachable-low"),t=n.filter(r=>r.pathQuality==="name-match").length;if(e.nameMatchLabel!==!0&&t===0)return"(modeled)";let s=n.filter(r=>r.pathQuality!=="name-match").length;return`(${String(s)} modeled, ${String(t)} name-match)`}var TR={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},hy=4,bc=3,_c=10,$R={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version or advisory bound is not SemVer 2.0.0 / PEP 440 \u2014 cupel cannot order them","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},LR={"resolution-divergence":"a go.mod replace builds other code than the module@version the advisory names","version-undecidable":"the Go release that builds the program is not the one on PATH, or is not a release","analysis-cap":"another build configuration, a plugin, or an unread part of the build keeps the Go denial open","symbol-unsupported":"the package is imported; the Go scan reads packages, not calls, before S2"};function yy(e,n){let t=LR[e];return t!==void 0&&n.length>0&&n.every(s=>s.ecosystem==="Go")?t:$R[e]}var DR="(symbol set known incomplete)";function FR(e){let n=e.path??[];return n.length===0?"(no path)":n.map((t,s)=>{let r=te(t.functionName??"<anon>");return s===0?r:`${t.via==="name-match"?" \u21E2 ":" \u2192 "}${r}`}).join("")}function jR(e){let n=e.path??[],t=n.flatMap((d,c)=>d.via==="name-match"?[c]:[]),s=t[0];if(s===void 0||s===0)return null;let r=e.located?.path?.[s-1],o=r?.modulePath??n[s]?.calledAt?.path??n[s-1]?.modulePath,i=r?.callSite?.line??null,a=`${te(o??"")}${i!==null?`:${String(i)}`:""}`,l=t.length-1;return`via name match at ${a}`+(l>0?` \u2026 and ${String(l)} more name-match hop${l===1?"":"s"}`:"")}function by(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function BR(e,n){let t=e.findings.filter(u=>He(u.tier)&&u.reasonKind!==void 0);if(t.length===0)return[];let s=new Map;for(let u of t){let m=s.get(u.reasonKind)??[];m.push(u),s.set(u.reasonKind,m)}let r={cupel:0,project:0};for(let[u,m]of s)r[Fn[u]]+=m.length;let o=[],i=n.advisories.potentiallyReachable;o.push(i>0?`\u2753 Potentially reachable (${String(i)}) \u2014 cupel could NOT rule out a path for ${String(i)} ${Sc(i)}. This is not a clean result.`:"\u2753 Potentially reachable (0) \u2014 every undecided finding sits in an advisory counted reachable above.");let a=n.advisories.byTier;o.push(`   Path not ruled out (${String(a["potentially-reachable-not-ruled-out"])}) \u2014 cupel analysed it and a path could not be ruled out (${PR}).`),o.push(`   Not analysed (${String(a["potentially-reachable-not-analysed"])}) \u2014 the function-level question could not be run (every other kind).`);let l=n.middleRowsInReachable;o.push(`   By kind, in findings (${String(t.length)}`+(l>0?`; ${String(l)} of them in advisories counted reachable above`:"")+"):");let d=(u,m)=>{if(r[u]===0)return;o.push(""),o.push(`   ${m} (${String(r[u])}):`);let g=[...s.entries()].filter(([b])=>Fn[b]===u).sort((b,_)=>_[1].length-b[1].length||b[0].localeCompare(_[0])),y=g.slice(0,hy);for(let[b,_]of y){let S=u==="project"?[...new Set(_.flatMap(by))]:[],k=S.slice(0,bc).map(te).join(", "),v=S.length>bc?` (+${String(S.length-bc)} more files)`:"";o.push(`     ${b.padEnd(21)} ${String(_.length).padStart(4)}  ${yy(b,_)}`+(k!==""?`
+       ${k}${v}`:""))}for(let[b,_]of g.slice(hy))o.push(`     ${b.padEnd(21)} ${String(_.length).padStart(4)}  ${yy(b,_)}`)};d("project","Your code \u2014 a change on your side would produce a real verdict"),d("cupel","cupel's gap \u2014 nothing you can do today");let c=new Map;for(let u of t)if(Fn[u.reasonKind]==="project")for(let m of by(u))c.set(m,(c.get(m)??0)+1);let f=[...c.entries()].sort((u,m)=>m[1]-u[1]||u[0].localeCompare(m[0]))[0];f!==void 0&&r.project>0&&(o.push(""),o.push(`   \u279C Start here: ${te(f[0])} appears in ${String(f[1])} of your ${String(r.project)} finding(s), across ${String(c.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let p=t.filter(u=>Fn[u.reasonKind]==="project");if(p.length>0){o.push("");for(let u of p.slice(0,_c))o.push(`     ${te(u.displayId)}  ${te(u.packageName)}@${te(u.version)}  [${u.reasonKind}] ${te(u.reason)}`);p.length>_c&&o.push(`     \u2026 and ${String(p.length-_c)} more`)}return o.push(""),o}function GR(e){let n=e.go;if(n===void 0)return[];let t=[];t.push(`\u2139\uFE0F  Go, package level (${String(n.roots.length)} root${n.roots.length===1?"":"s"}): ${te(n.toolchain??"no usable Go toolchain")}`);for(let s of n.facts)t.push(`    ${te(s)}`);for(let s of n.roots.slice(0,8)){let r=s.rootRel===""?".":s.rootRel;t.push(`    ${te(r)}: ${s.status}`+(s.mode===null?"":`, -mod=${s.mode}`)+(s.workspace===null?"":`, workspace ${te(s.workspace)}`)+`, ${String(s.packages)} package(s) in the graph, ${String(s.modules)} module(s)`+(s.otherConfiguration>0?`, ${String(s.otherConfiguration)} package(s) only another build configuration imports`:""));for(let o of s.facts.slice(0,5))t.push(`      - ${te(o)}`)}return n.roots.length>8&&t.push(`    \u2026 and ${String(n.roots.length-8)} more`),n.blockers.length>0&&t.push(`    no Go not-reachable stands in this scan: ${te(n.blockers.join("; "))}`),t.push(""),t}function Sy(e){let n=[],t=e.counts,s=e.findings.filter(p=>p.tier==="reachable-high"||p.tier==="reachable-medium"||p.tier==="reachable-low");if(n.push(`cupel scan: ${te(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let p=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+p.map(u=>`${te(u.entrypoint)} [${te(u.source)}]`).join(", ")+(e.entrypointSources.length>p.length?`, \u2026 and ${String(e.entrypointSources.length-p.length)} more`:"")),n.push("")}if(e.inventory!==void 0&&(n.push(...dy(e.inventory)),n.push("")),e.entrypointObservations.length>0){let p=new Map;for(let u of e.entrypointObservations)p.set(u.kind,(p.get(u.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...p.entries()].map(([u,m])=>`${String(m)} ${u}`).join(", ")+` (${te(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let p=e.rootSet,u=p.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(p.counts.rootsAdmitted)}): `+u.map(y=>`${te(y.rel===""?".":y.rel)} [${y.witnesses.join("+")}${CR(y)}]`).join(", ")+(p.roots.length>u.length?`, \u2026 and ${String(p.roots.length-u.length)} more`:"")),p.observations.length>0){let y=new Map;for(let b of p.observations)y.set(b.kind,(y.get(b.kind)??0)+1);n.push("    not admitted: "+[...y.entries()].map(([b,_])=>`${String(_)} ${b}`).join(", "))}n.push(`    walk: ${String(p.counts.dirsWalked)} dirs, ${String(p.counts.manifestsSeen)} manifests seen, ${String(p.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${p.budget}`);let m=e.installed.perRoot.filter(y=>y.rootRel!=="");m.length>0&&n.push(`    enumerated (${String(m.length)} nested root${m.length===1?"":"s"}): `+m.slice(0,8).map(y=>`${te(y.rootRel)} (${String(y.packages.length)} packages, ${y.source})`).join(", ")+(m.length>8?`, \u2026 and ${String(m.length-8)} more`:""));let g=er(p,e.entrypointSources);g.length>0&&n.push(`    NOT analyzed (${String(g.length)}): ${te(Ql(g.map(y=>y.rel===""?".":y.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at potentially reachable until they are analyzed`),p.budget!=="complete"&&p.budget!=="not-attempted"&&n.push(`    the walk did not finish (${p.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at potentially reachable`),n.push("")}if(n.push(...GR(e)),e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let p of e.entrypointGaps.slice(0,5))n.push(`  - ${te(p.source)} (${te(p.file)}): ${te(p.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(te).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at potentially reachable, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${nl(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at potentially reachable, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,o=r.find(p=>p.kind==="no-enumeration")??null;o!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${te(o.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let i=r.filter(p=>p!==o);if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let p of i.slice(0,10))n.push(`  - [${te(p.kind)}] ${te(p.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let a=new Set(r.map(p=>p.detail)),l=[...e.analyzerDiagnostics.map(p=>`${te(p.code)}: ${te(p.detail)}`),...e.pythonDiagnostics.map(p=>`python: ${te(p)}`),...e.installed.diagnostics.filter(p=>!a.has(p)).map(te)];if(l.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(l.length)}) \u2014 verdicts are conservative:`);for(let p of l.slice(0,10))n.push(`  - ${p}`);l.length>10&&n.push(`  \u2026 and ${String(l.length-10)} more`),n.push("")}let d=my(e.findings);if(s.length>0){let p=d.advisories.reachable;n.push(`\u{1F3AF} Reachable (${String(p)}) \u2014 fix these: ${String(p)} ${Sc(p)}, ${String(s.length)} ${OR(s.length)}, each with its call path.`);for(let u of s){n.push(`  ${TR[u.tier]} ${te(u.displayId)}  ${te(u.packageName)}@${te(u.version)}  ${te(u.symbolName??"")}`+(u.surfaceComplete===!1?`  ${DR}`:""));let m=jR(u);m!==null&&n.push(`        ${m}`),n.push(`        path: ${FR(u)}`)}n.push("")}n.push(...BR(e,d));let c=d.advisories,f=d.vulnerabilities;return n.push(`Summary: ${gy(`${String(c.total)} ${Sc(c.total)}`,c)}`),n.push(`         ${gy(`${String(f.total)} ${f.total===1?"vulnerability":"vulnerabilities"} (deduplicated by CVE)`,f)}`),n.push(`Findings: ${String(e.findings.length)} \u2014 ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low ${MR(e)}, ${String(t["potentially-reachable-not-ruled-out"]+t["potentially-reachable-not-analysed"])} potentially reachable (${String(t["potentially-reachable-not-ruled-out"])} path not ruled out, ${String(t["potentially-reachable-not-analysed"])} not analysed), ${String(t["not-reachable"])} not-reachable${RR(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as KR}from"node:crypto";var zR="https://json.schemastore.org/sarif-2.1.0.json",xy="cupel-reachability",xc=new Set(["dispatch","dynamic-load","coverage-gap"]);function WR(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var UR=500,HR=10;function qR(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function VR(e,n){return`${e}::${n}`}function XR(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function YR(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return KR("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function JR(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:!He(e.tier)||e.reasonKind===void 0?!1:xc.has(e.reasonKind)}var ky={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range: one of them is not a valid version for its ecosystem (npm: SemVer 2.0.0; PyPI: PEP 440)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function wy(e){let n=[],t=new Map,s=[],r=new Jt(e.dir);for(let d of e.findings){if(!JR(d))continue;let c=VR(d.displayId,d.packageName);if(!t.has(c)){t.set(c,n.length);let E=XR(d.severity);n.push({id:te(c),properties:{tags:d.reasonKind==="coverage-gap"?["security","coverage-gap",`gap/${te(d.packageName)}`]:["security","reachability",`package/${te(d.packageName)}`],...E!==void 0?{"security-severity":E}:{}}})}let f=d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low",p=d.path??[],u=p.findIndex(E=>E.modulePath!==""),m=u===-1?void 0:p[u],g=Ws(d.ecosystem),y=d.located?.path??null,b=E=>y?.[E]?.modulePath??p[E]?.modulePath??"",_=(E,N)=>{if(N===null)return;let A=b(E);return Qt(r,A===""?N:{...N,path:A},g)??void 0},S=p[u+1]?.calledAt??null,k=m!==void 0&&S!==null&&S.path===m.modulePath?_(u,S):void 0,v=[...new Set(d.unresolvedSites.map(E=>E.path).filter(E=>E!==""))],I=f?m!==void 0?{physicalLocation:{artifactLocation:{uri:te(b(u))},...k!==void 0?{region:k}:{}},message:{text:`calls ${te(d.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:te(d.packageLocation??"package-lock.json")}}}:v[0]!==void 0?{physicalLocation:{artifactLocation:{uri:te(v[0])}},message:{text:`unresolved ${te(d.reasonKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:te(d.packageLocation??(d.reasonKind==="coverage-gap"?"package.json":"package-lock.json"))}}},O=f?p.map((E,N)=>({physicalLocation:{artifactLocation:{uri:te(b(N)||"package-lock.json")}},message:{text:te(E.functionName??"<step>")}})):v.slice(1,HR+1).map(E=>({physicalLocation:{artifactLocation:{uri:te(E)}},message:{text:"also blocked here"}}));s.push({ruleId:te(c),ruleIndex:t.get(c),level:f?"error":"warning",message:{text:te(`[${d.tier}] ${d.displayId} in ${d.packageName}@${d.version}`+(d.symbolName!==null?` \u2014 reaches ${d.symbolName}`:"")+(d.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${d.reason}`)},locations:[I],...O.length>0?{relatedLocations:O}:{},...f&&p.length>0?{codeFlows:[{threadFlows:[{locations:p.map((E,N)=>{let A=E.calledAt===null?void 0:_(N-1,E.calledAt),U=E.calledAt===null?b(N):b(N-1)||E.calledAt.path;return{location:{physicalLocation:{artifactLocation:{uri:te(U||"package-lock.json")},...A!==void 0?{region:A}:{}},message:{text:te(N===0?`entry ${E.functionName??"<step>"}`:`calls ${E.functionName??"<step>"}`+(E.via==="name-match"?" via name match":""))}}}})}]}]}:{},partialFingerprints:{"cupelReachability/v1":YR(d)},properties:{tier:d.tier,...f&&(e.nameMatchLabel===!0||d.pathQuality==="name-match")?{pathQuality:d.pathQuality,nameMatchHops:p.flatMap((E,N)=>E.via==="name-match"?[N+1]:[])}:{},advisoryId:te(d.advisoryId),...d.surfaceComplete===!1?{surfaceComplete:!1}:{},...d.modelId!==void 0?{modelId:te(d.modelId),modelPromotedFromKind:d.modelPromotedFromKind}:{},...d.reasonKind!==void 0?{reasonKind:d.reasonKind,reasonOwner:Fn[d.reasonKind],unresolvedSiteCount:d.unresolvedSites.length}:{},...d.adr105!==void 0?{adr105:d.adr105}:{},...d.influence!==void 0?{influence:{value:d.influence.value,kind:d.influence.kind,owner:xr[d.influence.kind],sourceClass:null,mode:null,trigger:null,contractProvenance:null,witness:null}}:{}}})}let o=new Map,i=new Map;for(let d of e.findings){if(!He(d.tier)||d.reasonKind===void 0||(o.set(d.reasonKind,(o.get(d.reasonKind)??0)+1),xc.has(d.reasonKind)))continue;let c=i.get(d.reasonKind)??[];c.length<UR&&c.push({advisory:te(d.displayId),package:te(d.packageName),version:te(d.version)}),i.set(d.reasonKind,c)}let a={cupel:0,project:0};for(let[d,c]of o)a[Fn[d]]+=c;let l={};for(let[d,c]of i){let f=o.get(d)??c.length;l[d]={count:f,owner:Fn[d],note:ky[d],truncated:f>c.length,advisories:c}}return{$schema:zR,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:xy},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:te(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(d=>`${d.entrypoint} (${d.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...o.keys()].filter(d=>!xc.has(d)&&!WR(d,e.analysisAborted)).sort().map(d=>({descriptor:{id:`potentially-reachable-${d}`},level:"warning",message:{text:`${String(o.get(d)??0)} finding(s) are Potentially reachable because ${ky[d]} (owner: ${Fn[d]}). These are counted in counts["${yt[d]}"] and itemised in run.properties.potentiallyReachable.grouped["${d}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(d=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:te(`${d.source} (${d.file}): ${d.detail}`)}})),...e.rejectedEntries.map(d=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:te(`--entry did not resolve to a file inside the app root: ${d}`)}})),...e.entrypointObservations.map(d=>({descriptor:{id:`entrypoint-observation:${d.kind}`},level:"note",message:{text:te(`${d.detail} (${d.file})`)}})),...e.analyzerDiagnostics.map(d=>({descriptor:{id:d.code},level:"warning",message:{text:te(`${d.detail}${d.reason===void 0?"":` [reason: ${d.reason}]`} (${d.path})`)}})),...e.pythonDiagnostics.map(d=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:te(d)}})),...(e.go?.facts??[]).map(d=>({descriptor:{id:"go-build-context"},level:"note",message:{text:te(d)}})),...(e.go?.blockers??[]).map(d=>({descriptor:{id:"go-denial-withheld"},level:"warning",message:{text:te(`no Go not-reachable stands in this scan: ${d}`)}})),...e.installed.diagnostics.map(d=>({descriptor:{id:"resolve"},level:"warning",message:{text:te(d)}}))]}],results:s,properties:{category:xy,summary:e.counts,...e.inventory!==void 0?{inventory:cy(e.inventory)}:{},...e.timings!==void 0?{timings:e.timings}:{},installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(d=>({path:te(d.rootRel),count:d.packages.length,source:d.source}))},...e.go!==void 0?{go:{toolchain:e.go.toolchain===null?null:te(e.go.toolchain),deniesWithheld:e.go.blockers.map(te),roots:e.go.roots.slice(0,64).map(d=>({path:te(d.rootRel),status:d.status,mode:d.mode,workspace:d.workspace===null?null:te(d.workspace),packages:d.packages,otherConfiguration:d.otherConfiguration,modules:d.modules}))}}:{},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:er(e.rootSet,e.entrypointSources).length,named:er(e.rootSet,e.entrypointSources).slice(0,8).map(d=>te(d.rel===""?".":d.rel))},analyzed:[...to(e.entrypointSources)].sort().slice(0,64).map(d=>te(d===""?".":d)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(d=>({path:te(d.rel),witnesses:d.witnesses,...d.manifestRefused?{manifestRefused:!0}:{},...d.ecosystem!==void 0?{ecosystem:d.ecosystem}:{},...d.alsoPython===!0?{alsoPython:!0}:{},...d.alsoGo===!0?{alsoGo:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(d=>({kind:d.kind,path:te(d.rel)}))}}:{},...qR(e),potentiallyReachable:{total:Yt(e.counts),byTier:Object.fromEntries(ys.map(d=>[d,e.counts[d]])),byKind:Object.fromEntries([...o].sort((d,c)=>c[1]-d[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(d=>He(d.tier)&&d.reasonKind==="db-gap").map(d=>({advisory:te(d.displayId),package:te(d.packageName),version:te(d.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(d=>d.adr105!==void 0).map(d=>({advisory:te(d.displayId),package:te(d.packageName),version:te(d.version),symbol:te(d.symbolName??""),tier:d.tier,...d.reasonKind!==void 0?{reasonKind:d.reasonKind}:{},...d.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function vy(){try{let e=QR(nO(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function tO(e,n){let t=`${JSON.stringify(n,null,2)}
+`,s=`${e}.tmp-${Ey(8).toString("hex")}`;Ay(s,t,{encoding:"utf8",flag:"wx"}),ZR(s,e)}async function sO(e){let n=Oh(e);n.legacyGateFlag&&process.stderr.write(`cupel: ${Rh}
+`);let t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",s=t?{path:ly(n.shard),sequence:null}:await ea({offline:n.offline}),r=s.path,i=iy(n.shardPypi);if(i===void 0&&!t)try{i=(await ea({offline:n.offline,ecosystem:"pypi"})).path}catch(d){if(d instanceof $s||d instanceof Xt)process.stderr.write(`cupel: no PyPI shard available (${d.message}); Python distributions, if any, will be reported as not assessed
+`);else throw d}let a=await ay({xGo:n.xGo,shardGo:n.shardGo,dir:n.dir,root:n.root,offline:n.offline,explicitNpm:t}),l=Zd({dir:n.dir,shardPath:r,...i!==void 0?{shardPathPypi:i}:{},...n.xGo?{xGo:!0}:{},...a!==void 0?{shardPathGo:a}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnPotentiallyReachable:n.failOnPotentiallyReachable,entry:n.entry,exclude:n.exclude,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.influenceShadowOut!==void 0?{influenceShadow:{outPath:n.influenceShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},pyPreciseNames:n.pyPreciseNames,...n.xPyNameMatchLabel?{xPyNameMatchLabel:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${Sy(l)}
+`),l.modelLane!==void 0){let d=l.modelLane.notes.length>0?` (${l.modelLane.notes.map(c=>te(c)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(l.modelLane.active)}/${String(l.modelLane.stored)} active, ${String(l.modelLane.promoted)} promoted to reachable-low${d}
+`)}if(n.summaryShadow!==void 0&&l.summaryShadow!==void 0){let d=eO.join(n.summaryShadow,"shadow-report.json");Ay(d,`${JSON.stringify(l.summaryShadow,null,2)}
 `),process.stdout.write(`summary-shadow: ${String(l.summaryShadow.records.length)} counterfactual record(s) -> ${d}
 `)}if(l.modelShadow!==void 0&&n.modelShadowOut!==void 0){let d=l.modelShadow.records.filter(c=>c.wouldPromote).length;process.stdout.write(`model-shadow: ${String(d)}/${String(l.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
 `)}if(l.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(l.bindingShadow.deltas)}/${String(l.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
 `),l.influenceShadow!==void 0&&n.influenceShadowOut!==void 0){let d=l.influenceShadow.byOutcome;process.stderr.write(`influence-shadow: ${String(l.influenceShadow.ports)} port(s) \u2014 ${String(d.influenced)} influenced, ${String(d["no-source-reached"])} no-source-reached, ${String(d["reaches-entry-parameter"])} reaches-entry-parameter, ${String(d.unknown)} unknown (${String(l.influenceShadow.wallMs)} ms) -> ${n.influenceShadowOut}
-`)}if(n.sarif!==void 0&&jA(n.sarif,Yh(l)),n.push){let d=await Th(process.env,vi,{...n.auth!==void 0?{auth:n.auth}:{},warn:u=>process.stderr.write(`cupel: ${u}
-`)}),c;try{c=fc(l,{scanId:Zh(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:pc(l),shardSequence:s.sequence},{onCut:u=>process.stderr.write(`cupel: ${ac(u)}
-`)})}catch(u){let f=u instanceof Error?u.message:String(u);return process.stderr.write(`cupel: ${f}
-`),await Ad("push-refused",f,d.value,wi),l.exitCode===0?1:l.exitCode}try{await dc(JSON.stringify(c),d.value,wi)}catch(u){let f=u instanceof Error?u.message:String(u);return process.stderr.write(`cupel: ${f}
-`),await Ad("scan-error",f,d.value,wi),l.exitCode===0?1:l.exitCode}let p=s.sequence===null?" \u2014 shard version unverified, shown as unverifiable on the dashboard":"";process.stdout.write(`pushed ${String(c.findings.length)} finding(s) to api.cupel.sh (${Mh(d)})${p}
-`)}return l.exitCode}async function GA(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await BA(e.slice(1))}catch(t){let s=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${s}
-`),1}if(e[0]==="login")return await Sh(e.slice(1));if(e[0]==="logout")return xh(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${cd(Jh())}
-`),0):(process.stderr.write(`cupel: unknown command '${re(n)}'
-`),process.stderr.write(`${cd(Jh())}
-`),1)}GA().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`)}if(n.sarif!==void 0&&tO(n.sarif,wy(l)),n.push){let d=await oy(process.env,Zi,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
+`)}),c;try{c=ru(l,{scanId:Ey(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:ou(l),shardSequence:s.sequence},{onCut:p=>process.stderr.write(`cupel: ${Zc(p)}
+`)})}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
+`),await hc("push-refused",u,d.value,Qi),l.exitCode===0?1:l.exitCode}try{await nu(JSON.stringify(c),d.value,Qi)}catch(p){let u=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${u}
+`),await hc("scan-error",u,d.value,Qi),l.exitCode===0?1:l.exitCode}let f=s.sequence===null?" \u2014 shard version unverified, shown as unverifiable on the dashboard":"";process.stdout.write(`pushed ${String(c.findings.length)} finding(s) to api.cupel.sh (${ry(d)})${f}
+`)}return l.exitCode}async function rO(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await sO(e.slice(1))}catch(t){let s=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${s}
+`),1}if(e[0]==="login")return await Uh(e.slice(1));if(e[0]==="logout")return Hh(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${ec(vy())}
+`),0):(process.stderr.write(`cupel: unknown command '${te(n)}'
+`),process.stderr.write(`${ec(vy())}
+`),1)}rO().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});