npm - @cupel-sh/cli - Versions diffs - 0.2.1 → 0.2.2 - Mend

@cupel-sh/cli 0.2.1 → 0.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/bundle/cli.js +23 -23
package/package.json +1 -1

package/bundle/cli.js CHANGED Viewed

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{randomBytes as Po}from"node:crypto";import{readFileSync as $u,renameSync as Pu,writeFileSync as Lo}from"node:fs";import Lu from"node:path";import{fileURLToPath as Tu}from"node:url";var Do=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function _n(e){if(!Do.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function qn(e,n){let t=e.split(".").map(Number),r=n.split(".").map(Number);for(let i=0;i<3;i+=1){let s=t[i]??0,l=r[i]??0;if(s!==l)return s<l?-1:1}return 0}var $t=["dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function an(e,n){let t=_n(e);return!(n.introduced!=="0"&&qn(t,_n(n.introduced))<0||n.fixed!==void 0&&qn(t,_n(n.fixed))>=0||n.lastAffected!==void 0&&qn(t,_n(n.lastAffected))>0)}function Hn(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),i=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),l=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let o=s.get(a.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let m=n.get(f.moduleId);m!==void 0&&m.packageName!==u.packageName&&l.push({packageName:m.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:a.resolution})}return l}function Fo(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,r)=>t.analyzedVersion<r.analyzedVersion?1:t.analyzedVersion>r.analyzedVersion?-1:0)}function Ko(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Hi(e,n,t,r,i,s){if(s<=0)return null;let l=null,a=o=>{(l===null||o.hops<l.hops)&&(l=o)};for(let o of Fo(e,n))for(let c of o.edges){if(c.entryExport!==t||c.entryContainer!==r)continue;if(Ko(c,i,o.packageName)){a({viaPackages:[],hops:c.hops,provenance:{tool:o.tool,toolVersion:o.toolVersion,analyzedVersion:o.analyzedVersion}});continue}if(c.target.kind!=="dep")continue;let u=Hi(e,c.target.calleePackage,c.target.calleeExport,null,i,s-1);u!==null&&a({viaPackages:[c.target.calleePackage,...u.viaPackages],hops:c.hops+u.hops,provenance:u.provenance})}return l}function Pt(e,n,t,r,i,s){let l=null;for(let a of Hn(e,n,t)){let o=Hi(i,a.packageName,a.exportName,a.container,r,s);o!==null&&(l===null||o.hops<l.totalHops)&&(l={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:o.viaPackages,totalHops:o.hops,provenance:o.provenance})}return l}function An(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Wn(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function Gi(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(i.moduleId)??[];s.push(r.resolvedModuleId),n.set(i.moduleId,s)}return n}function jo(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(r.resolvedModuleId)??[];s.push(i.moduleId),n.set(r.resolvedModuleId,s)}return n}function ln(e){let n=Gi(e),t=new Set,r=e.modules.filter(i=>i.isEntrypoint).map(i=>i.id);for(;r.length>0;){let i=r.pop();if(!(i===void 0||t.has(i))){t.add(i);for(let s of n.get(i)??[])t.has(s)||r.push(s)}}return t}function Bo(e,n){let t=jo(e),r=new Set,i=[n];for(;i.length>0;){let s=i.pop();if(!(s===void 0||r.has(s))){r.add(s);for(let l of t.get(s)??[])r.has(l)||i.push(l)}}return r}function zo(e,n,t){let r=Gi(e),i=Wn(e),s=new Set,l=[n];for(;l.length>0;){let a=l.pop();if(a===void 0||s.has(a))continue;s.add(a);let o=i.get(a);if(o===void 0||o.externalSurface===!0||t.has(a))return!0;for(let c of r.get(a)??[])s.has(c)||l.push(c)}return!1}function Uo(e){let n=new Set(e.modules.filter(l=>l.isEntrypoint).map(l=>l.id)),t=new Map(e.functions.map(l=>[l.id,l])),r=Wn(e),i=new Map;for(let l of e.functions)n.has(l.moduleId)&&(l.publicSurfaceReachable||l.name==="<toplevel>")&&i.set(l.id,l);let s=new Map(e.exports.map(l=>[l.id,l]));for(let l of e.exportBindings){if(l.target.kind!=="function")continue;let a=s.get(l.exportId);if(a===void 0||!n.has(a.moduleId))continue;let o=t.get(l.target.functionId);o===void 0||r.get(o.moduleId)?.externalSurface===!0||i.set(o.id,o)}return[...i.values()]}function Xi(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let i=e.slice(t+n.length).split("/"),s=i[0]?.startsWith("@")===!0?2:1;return i.slice(s).join("/")}function Vo(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let r=t.symbolKind==="method"||t.symbolKind==="ctor",i=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let l=n.get(s.moduleId);if(l===void 0||l.packageName!==t.packageName)return!1;if(r){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||i.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return l.externalSurface===!0?!0:Xi(l.path)===t.sourcePath})}function Wi(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Xi(t.path)===n.sourcePath)}function qo(e,n,t,r){let i=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(l=>{let a=i.get(l);if(a?.name!==r.exportName)return!1;let o=n.get(a.moduleId);return o?.externalSurface===!0&&o.packageName===r.packageName&&t.has(a.moduleId)}))}function Ho(e,n,t){return t.container===null?!0:e.classes.some(r=>{if(r.name!==t.container)return!1;let i=n.get(r.moduleId);return i!==void 0&&i.packageName===t.packageName&&i.externalSurface!==!0})}function Wo(e,n,t){let r=new Map(e.callSites.map(o=>[o.id,o.enclosingFunctionId])),i=new Map;for(let o of e.callEdges){let c=r.get(o.callSiteId);if(c===void 0)continue;let u=i.get(c)??[];u.push({to:o.calleeFunctionId,res:o.resolution}),i.set(c,u)}let s=o=>{let c=new Set,u=n.map(f=>({id:f.id,prev:null}));for(let f of u)c.add(f.id);for(;u.length>0;){let f=u.shift();if(f===void 0)break;if(f.id===t){let m=[];for(let h=f;h!==null;h=h.prev)m.unshift(h.id);return m}for(let m of i.get(f.id)??[])m.res!=="unresolved"&&(m.res==="field-based"&&!o||c.has(m.to)||(c.add(m.to),u.push({id:m.to,prev:f})))}return null},l=s(!1);if(l!==null)return{path:l,usedFieldBased:!1};let a=s(!0);return a!==null?{path:a,usedFieldBased:!0}:null}function Go(e,n,t,r){let i=[],s=[],l=new Map(e.functions.map(o=>[o.id,o.moduleId])),a=o=>o!==void 0&&t.has(o)&&r.has(n.get(o)?.packageName??"");for(let o of e.callSites)o.resolution==="unresolved"&&a(l.get(o.enclosingFunctionId))&&i.push(o.range);for(let o of e.imports)!o.specifierIsLiteral&&t.has(o.moduleId)&&s.push({path:n.get(o.moduleId)?.path??"",start:0,end:0});return{dispatch:i,load:s}}function Xo(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function Jo(e,n){let t=new Map(e.functions.map(i=>[i.id,i])),r=Wn(e);return n.map(i=>{let s=t.get(i),l=s!==void 0?r.get(s.moduleId):void 0;return{functionId:i,functionName:s?.name,modulePath:l?.path??""}})}function Lt(e){let{graph:n,installed:t,range:r,symbol:i,coverage:s}=e,l=[],a=Xo(n),o=new Set;for(let M of e.incompleteness)M.reach.kind==="unbounded"&&o.add(M.source);let c=e.incompleteness.some(M=>M.reach.kind==="assumed-bounded")?"loader-assumption":"complete",u=M=>M==="not-reachable"?c:void 0,f=new Map,m=M=>{let R=f.get(M);return R===void 0&&(R=zo(n,M,o),f.set(M,R)),R},h=M=>M.reach.kind==="class-scope"&&i!==null&&i.packageName===M.reach.packageName&&i.container===M.reach.container,b=M=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let R of $t)for(let V of e.incompleteness)if(V.cause===R&&M(V))return{cause:V.cause,source:V.source};return null},S=M=>{let R;return b(V=>V.reach.kind==="unbounded"?!0:V.reach.kind==="class-scope"?h(V):M===void 0||m(V.reach.anchor)?!0:(R??=Bo(n,M),R.has(V.reach.anchor)))},x=()=>b(M=>M.reach.kind==="unbounded"?!0:M.reach.kind==="class-scope"?h(M):m(M.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${r.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,unresolvedSites:l};let w;try{w=an(t.version,r)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:l}}if(!w)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${r.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,unresolvedSites:l};let A=Wn(n),$=ln(n),N=M=>{if(M.cause!=="dynamic-load"||M.source===null)return l;let R=A.get(M.source);return R===void 0?l:[{path:R.path,start:0,end:0}]},{dispatch:k,load:p}=Go(n,A,$,a),y=[...k,...p],_=M=>{for(let R of $)if(A.get(R)?.packageName===M)return!0;return!1},L=M=>({tier:"unknown",decidedAtStage:M,reason:`${i?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:l}),z=()=>{if(!_(r.packageName)){if(p.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:p};let M=x();return M!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:M.cause,attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:N(M)}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${r.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${r.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,unresolvedSites:l}}return null};if(i===null||!i.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:i===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:i===null?"db-gap":"unverified-symbol",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};if(s!==null&&!s.comparedPaths.has(i.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${i.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};if(i.symbolKind==="accessor"||i.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a ${i.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};let I=Vo(n,A,i);if(I===void 0||!$.has(I.moduleId)){if(I===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&qo(n,A,$,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};if(I===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&!Ho(n,A,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a method of the dependency class ${i.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};let M=z();if(M!==null)return M;if(y.length>0){let X=I!==void 0?A.get(I.moduleId):Wi(n,i),te=I===void 0&&X!==void 0&&X.externalSurface!==!0&&$.has(X.id)&&!a.has(X.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:p.length>0?"dynamic-load":te?"dep-opaque":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y}}let R=I!==void 0?A.get(I.moduleId):Wi(n,i);if(I===void 0&&R!==void 0&&R.externalSurface!==!0&&$.has(R.id)&&!a.has(R.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:l};let V=R!==void 0?S(R.id):x();return V!==null?{tier:"unknown",decidedAtStage:I===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:V.cause,attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:N(V)}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:I===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,unresolvedSites:l}:L(I===void 0?"symbol-reachable":"module-reachable")}let C=Wo(n,Uo(n),I.id);if(C!==null)return{tier:An(C.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Gn(i),basis:u("reachable-high"),path:Jo(n,C.path),unresolvedSites:l};if(y.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but unresolved edges exist`,unknownKind:p.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};let K=S(I.moduleId);return K!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:K.cause,attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:N(K)}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,unresolvedSites:l}:L("call-path-confirmed")}function Yo(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Qo(e,n,t){let r=new Map(e.classes.map(i=>[i.id,i.name]));for(let i of e.functions){if(i.name!==t.exportName)continue;let s=n.get(i.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(i.enclosingClassId!==void 0?r.get(i.enclosingClassId)??null:null)!==t.container))return i.id}return null}function Zo(e,n,t){if(n===t)return[];let r=new Map(e.functions.map(o=>[o.id,o])),i=new Map(e.callSites.map(o=>[o.id,o])),s=new Map;for(let o of e.callEdges){if(o.resolution!=="resolved"&&o.resolution!=="field-based")continue;let c=i.get(o.callSiteId);if(c===void 0)continue;let u=c.enclosingFunctionId;if(!r.has(u)||!r.has(o.calleeFunctionId))continue;let f=s.get(u),m={to:o.calleeFunctionId,label:o.resolution};f===void 0?s.set(u,[m]):f.push(m)}let l=new Set([n]),a=[{at:n,labels:[]}];for(let o=0;o<a.length;o++){let c=a[o];for(let u of s.get(c.at)??[]){if(l.has(u.to))continue;let f=[...c.labels,u.label];if(u.to===t)return f;l.add(u.to),a.push({at:u.to,labels:f})}}return null}function Nn(e,n,t,r,i){if(i.length===0)return null;let s=Hn(e,n,t);if(s.length===0)return null;let l=Qo(e,n,r);for(let a of i){let o=s.filter(u=>u.packageName===a.anchor.packageName&&u.exportName===a.anchor.exportName&&u.container===a.anchor.container),c=o.find(u=>u.resolution==="resolved")??o[0];if(c!==void 0){if(Yo(a.callee,r))return{tier:An("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[c.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&l!==null){let u=Zo(e,a.callee.realFunctionId,l);if(u!==null)return{tier:An("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[c.resolution,"modeled",...u]}}}}return null}var Ji=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Yi=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function Gn(e){return e.verified?"gated":"candidate"}var Tt=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],Dt=["cupel","project"],Me={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Qi(e){return Me[e]}import{randomBytes as Vs}from"node:crypto";import{mkdirSync as qs,readdirSync as Js,readFileSync as Ys,realpathSync as kt,renameSync as Hs,statSync as St,writeFileSync as Ws}from"node:fs";import Ye from"node:path";import{createRequire as ea}from"node:module";var na=ea(import.meta.url);function ta(){try{return na("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function ia(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Xn={open(e,n){let{DatabaseSync:t}=ta(),r=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?r.exec("PRAGMA query_only = ON;"):r.exec("PRAGMA journal_mode = DELETE;"),{exec:i=>r.exec(i),prepare:i=>ia(r.prepare(i)),close:()=>r.close()}}};function pe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function ce(e){return typeof e=="string"?e:null}function Ve(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Zi=`
+import{randomBytes as Po}from"node:crypto";import{readFileSync as Lu,renameSync as Tu,writeFileSync as Lo}from"node:fs";import Du from"node:path";import{fileURLToPath as Fu}from"node:url";var Do=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function An(e){if(!Do.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function Wn(e,n){let t=e.split(".").map(Number),r=n.split(".").map(Number);for(let i=0;i<3;i+=1){let s=t[i]??0,l=r[i]??0;if(s!==l)return s<l?-1:1}return 0}var $t=["dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function an(e,n){let t=An(e);return!(n.introduced!=="0"&&Wn(t,An(n.introduced))<0||n.fixed!==void 0&&Wn(t,An(n.fixed))>=0||n.lastAffected!==void 0&&Wn(t,An(n.lastAffected))>0)}function Gn(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),i=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),l=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let o=s.get(a.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let m=n.get(f.moduleId);m!==void 0&&m.packageName!==u.packageName&&l.push({packageName:m.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:a.resolution})}return l}function Fo(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,r)=>t.analyzedVersion<r.analyzedVersion?1:t.analyzedVersion>r.analyzedVersion?-1:0)}function Ko(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Hi(e,n,t,r,i,s){if(s<=0)return null;let l=null,a=o=>{(l===null||o.hops<l.hops)&&(l=o)};for(let o of Fo(e,n))for(let c of o.edges){if(c.entryExport!==t||c.entryContainer!==r)continue;if(Ko(c,i,o.packageName)){a({viaPackages:[],hops:c.hops,provenance:{tool:o.tool,toolVersion:o.toolVersion,analyzedVersion:o.analyzedVersion}});continue}if(c.target.kind!=="dep")continue;let u=Hi(e,c.target.calleePackage,c.target.calleeExport,null,i,s-1);u!==null&&a({viaPackages:[c.target.calleePackage,...u.viaPackages],hops:c.hops+u.hops,provenance:u.provenance})}return l}function Pt(e,n,t,r,i,s){let l=null;for(let a of Gn(e,n,t)){let o=Hi(i,a.packageName,a.exportName,a.container,r,s);o!==null&&(l===null||o.hops<l.totalHops)&&(l={tier:"reachable-low",anchorPackage:a.packageName,entryExport:a.exportName,viaPackages:o.viaPackages,totalHops:o.hops,provenance:o.provenance})}return l}function _n(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Xn(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function Gi(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(i.moduleId)??[];s.push(r.resolvedModuleId),n.set(i.moduleId,s)}return n}function jo(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(r.resolvedModuleId)??[];s.push(i.moduleId),n.set(r.resolvedModuleId,s)}return n}function ln(e){let n=Gi(e),t=new Set,r=e.modules.filter(i=>i.isEntrypoint).map(i=>i.id);for(;r.length>0;){let i=r.pop();if(!(i===void 0||t.has(i))){t.add(i);for(let s of n.get(i)??[])t.has(s)||r.push(s)}}return t}function Bo(e,n){let t=jo(e),r=new Set,i=[n];for(;i.length>0;){let s=i.pop();if(!(s===void 0||r.has(s))){r.add(s);for(let l of t.get(s)??[])r.has(l)||i.push(l)}}return r}function zo(e,n,t){let r=Gi(e),i=Xn(e),s=new Set,l=[n];for(;l.length>0;){let a=l.pop();if(a===void 0||s.has(a))continue;s.add(a);let o=i.get(a);if(o===void 0||o.externalSurface===!0||t.has(a))return!0;for(let c of r.get(a)??[])s.has(c)||l.push(c)}return!1}function Uo(e){let n=new Set(e.modules.filter(l=>l.isEntrypoint).map(l=>l.id)),t=new Map(e.functions.map(l=>[l.id,l])),r=Xn(e),i=new Map;for(let l of e.functions)n.has(l.moduleId)&&(l.publicSurfaceReachable||l.name==="<toplevel>")&&i.set(l.id,l);let s=new Map(e.exports.map(l=>[l.id,l]));for(let l of e.exportBindings){if(l.target.kind!=="function")continue;let a=s.get(l.exportId);if(a===void 0||!n.has(a.moduleId))continue;let o=t.get(l.target.functionId);o===void 0||r.get(o.moduleId)?.externalSurface===!0||i.set(o.id,o)}return[...i.values()]}function Xi(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let i=e.slice(t+n.length).split("/"),s=i[0]?.startsWith("@")===!0?2:1;return i.slice(s).join("/")}function Vo(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let r=t.symbolKind==="method"||t.symbolKind==="ctor",i=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let l=n.get(s.moduleId);if(l===void 0||l.packageName!==t.packageName)return!1;if(r){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||i.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return l.externalSurface===!0?!0:Xi(l.path)===t.sourcePath})}function Wi(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Xi(t.path)===n.sourcePath)}function qo(e,n,t,r){let i=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(l=>{let a=i.get(l);if(a?.name!==r.exportName)return!1;let o=n.get(a.moduleId);return o?.externalSurface===!0&&o.packageName===r.packageName&&t.has(a.moduleId)}))}function Ho(e,n,t){return t.container===null?!0:e.classes.some(r=>{if(r.name!==t.container)return!1;let i=n.get(r.moduleId);return i!==void 0&&i.packageName===t.packageName&&i.externalSurface!==!0})}function Wo(e,n,t){let r=new Map(e.callSites.map(o=>[o.id,o.enclosingFunctionId])),i=new Map;for(let o of e.callEdges){let c=r.get(o.callSiteId);if(c===void 0)continue;let u=i.get(c)??[];u.push({to:o.calleeFunctionId,res:o.resolution}),i.set(c,u)}let s=o=>{let c=new Set,u=n.map(f=>({id:f.id,prev:null}));for(let f of u)c.add(f.id);for(;u.length>0;){let f=u.shift();if(f===void 0)break;if(f.id===t){let m=[];for(let h=f;h!==null;h=h.prev)m.unshift(h.id);return m}for(let m of i.get(f.id)??[])m.res!=="unresolved"&&(m.res==="field-based"&&!o||c.has(m.to)||(c.add(m.to),u.push({id:m.to,prev:f})))}return null},l=s(!1);if(l!==null)return{path:l,usedFieldBased:!1};let a=s(!0);return a!==null?{path:a,usedFieldBased:!0}:null}function Go(e,n,t,r){let i=[],s=[],l=new Map(e.functions.map(o=>[o.id,o.moduleId])),a=o=>o!==void 0&&t.has(o)&&r.has(n.get(o)?.packageName??"");for(let o of e.callSites)o.resolution==="unresolved"&&a(l.get(o.enclosingFunctionId))&&i.push(o.range);for(let o of e.imports)!o.specifierIsLiteral&&t.has(o.moduleId)&&s.push({path:n.get(o.moduleId)?.path??"",start:0,end:0});return{dispatch:i,load:s}}function Xo(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function Jo(e,n){let t=new Map(e.functions.map(i=>[i.id,i])),r=Xn(e);return n.map(i=>{let s=t.get(i),l=s!==void 0?r.get(s.moduleId):void 0;return{functionId:i,functionName:s?.name,modulePath:l?.path??""}})}function Lt(e){let{graph:n,installed:t,range:r,symbol:i,coverage:s}=e,l=[],a=Xo(n),o=new Set;for(let R of e.incompleteness)R.reach.kind==="unbounded"&&o.add(R.source);let c=e.incompleteness.some(R=>R.reach.kind==="assumed-bounded")?"loader-assumption":"complete",u=R=>R==="not-reachable"?c:void 0,f=new Map,m=R=>{let O=f.get(R);return O===void 0&&(O=zo(n,R,o),f.set(R,O)),O},h=R=>R.reach.kind==="class-scope"&&i!==null&&i.packageName===R.reach.packageName&&i.container===R.reach.container,b=R=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let O of $t)for(let V of e.incompleteness)if(V.cause===O&&R(V))return{cause:V.cause,source:V.source};return null},S=R=>{let O;return b(V=>V.reach.kind==="unbounded"?!0:V.reach.kind==="class-scope"?h(V):R===void 0||m(V.reach.anchor)?!0:(O??=Bo(n,R),O.has(V.reach.anchor)))},x=()=>b(R=>R.reach.kind==="unbounded"?!0:R.reach.kind==="class-scope"?h(R):m(R.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${r.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,unresolvedSites:l};let w;try{w=an(t.version,r)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:l}}if(!w)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${r.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:u("not-affected"),path:void 0,unresolvedSites:l};let _=Xn(n),$=ln(n),N=R=>{if(R.cause!=="dynamic-load"||R.source===null)return l;let O=_.get(R.source);return O===void 0?l:[{path:O.path,start:0,end:0}]},{dispatch:k,load:p}=Go(n,_,$,a),y=[...k,...p],A=R=>{for(let O of $)if(_.get(O)?.packageName===R)return!0;return!1},L=R=>({tier:"unknown",decidedAtStage:R,reason:`${i?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:l}),U=()=>{if(!A(r.packageName)){if(p.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:p};let R=x();return R!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:R.cause,attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:N(R)}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${r.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${r.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,unresolvedSites:l}}return null};if(i===null||!i.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:i===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:i===null?"db-gap":"unverified-symbol",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};if(s!==null&&!s.comparedPaths.has(i.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${i.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};if(i.symbolKind==="accessor"||i.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a ${i.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};let I=Vo(n,_,i);if(I===void 0||!$.has(I.moduleId)){if(I===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&qo(n,_,$,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};if(I===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&!Ho(n,_,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a method of the dependency class ${i.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};let R=U();if(R!==null)return R;if(y.length>0){let J=I!==void 0?_.get(I.moduleId):Wi(n,i),re=I===void 0&&J!==void 0&&J.externalSurface!==!0&&$.has(J.id)&&!a.has(J.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:p.length>0?"dynamic-load":re?"dep-opaque":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y}}let O=I!==void 0?_.get(I.moduleId):Wi(n,i);if(I===void 0&&O!==void 0&&O.externalSurface!==!0&&$.has(O.id)&&!a.has(O.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:l};let V=O!==void 0?S(O.id):x();return V!==null?{tier:"unknown",decidedAtStage:I===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:V.cause,attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:N(V)}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:I===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,unresolvedSites:l}:L(I===void 0?"symbol-reachable":"module-reachable")}let C=Wo(n,Uo(n),I.id);if(C!==null)return{tier:_n(C.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Jn(i),basis:u("reachable-high"),path:Jo(n,C.path),unresolvedSites:l};if(y.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but unresolved edges exist`,unknownKind:p.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:y};let K=S(I.moduleId);return K!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:K.cause,attribution:void 0,basis:u("unknown"),path:void 0,unresolvedSites:N(K)}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:u("not-reachable"),path:void 0,unresolvedSites:l}:L("call-path-confirmed")}function Yo(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Qo(e,n,t){let r=new Map(e.classes.map(i=>[i.id,i.name]));for(let i of e.functions){if(i.name!==t.exportName)continue;let s=n.get(i.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(i.enclosingClassId!==void 0?r.get(i.enclosingClassId)??null:null)!==t.container))return i.id}return null}function Zo(e,n,t){if(n===t)return[];let r=new Map(e.functions.map(o=>[o.id,o])),i=new Map(e.callSites.map(o=>[o.id,o])),s=new Map;for(let o of e.callEdges){if(o.resolution!=="resolved"&&o.resolution!=="field-based")continue;let c=i.get(o.callSiteId);if(c===void 0)continue;let u=c.enclosingFunctionId;if(!r.has(u)||!r.has(o.calleeFunctionId))continue;let f=s.get(u),m={to:o.calleeFunctionId,label:o.resolution};f===void 0?s.set(u,[m]):f.push(m)}let l=new Set([n]),a=[{at:n,labels:[]}];for(let o=0;o<a.length;o++){let c=a[o];for(let u of s.get(c.at)??[]){if(l.has(u.to))continue;let f=[...c.labels,u.label];if(u.to===t)return f;l.add(u.to),a.push({at:u.to,labels:f})}}return null}function Nn(e,n,t,r,i){if(i.length===0)return null;let s=Gn(e,n,t);if(s.length===0)return null;let l=Qo(e,n,r);for(let a of i){let o=s.filter(u=>u.packageName===a.anchor.packageName&&u.exportName===a.anchor.exportName&&u.container===a.anchor.container),c=o.find(u=>u.resolution==="resolved")??o[0];if(c!==void 0){if(Yo(a.callee,r))return{tier:_n("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[c.resolution,"modeled"]};if(a.callee.realFunctionId!==null&&l!==null){let u=Zo(e,a.callee.realFunctionId,l);if(u!==null)return{tier:_n("modeled"),modelId:a.modelId,anchorPackage:a.anchor.packageName,entryExport:a.anchor.exportName,pathLabels:[c.resolution,"modeled",...u]}}}}return null}var Ji=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Yi=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function Jn(e){return e.verified?"gated":"candidate"}var Tt=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],Dt=["cupel","project"],Pe={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Qi(e){return Pe[e]}import{randomBytes as Vs}from"node:crypto";import{mkdirSync as qs,readdirSync as Js,readFileSync as Ys,realpathSync as kt,renameSync as Hs,statSync as bt,writeFileSync as Ws}from"node:fs";import Qe from"node:path";import{createRequire as ea}from"node:module";var na=ea(import.meta.url);function ta(){try{return na("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function ia(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Yn={open(e,n){let{DatabaseSync:t}=ta(),r=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?r.exec("PRAGMA query_only = ON;"):r.exec("PRAGMA journal_mode = DELETE;"),{exec:i=>r.exec(i),prepare:i=>ia(r.prepare(i)),close:()=>r.close()}}};function pe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function de(e){return typeof e=="string"?e:null}function qe(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Zi=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
          ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,ra=`${Zi}, ap.surface_complete
@@ -10,33 +10,33 @@ import{randomBytes as Po}from"node:crypto";import{readFileSync as $u,renameSync
                  WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,oa=5,aa="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",la="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",da="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function Ft(e,n=Xn){let t=n.open(e,"readonly"),r=t.prepare(da).get(),i=r!==void 0?pe(r.value):"",s=/^\d+$/u.test(i)&&Number(i)>=oa,l=t.prepare(s?ra:sa),a=t.prepare(aa),o=t.prepare(la);return{schemaVersion:i,advisoriesForPackage(c,u){return l.all({eco:c,name:u}).map(f=>({affected:{id:Ve(f.ap_id)??0,advisoryId:pe(f.advisory_id),ecosystem:pe(f.ecosystem),packageName:pe(f.package_name),introduced:ce(f.introduced),fixed:ce(f.fixed),lastAffected:ce(f.last_affected),fixCommit:ce(f.fix_commit),repoUrl:ce(f.repo_url),surfaceComplete:Ve(f.surface_complete)===1?1:0},advisory:{id:pe(f.a_id),osvId:ce(f.osv_id),cveId:ce(f.cve_id),summary:ce(f.summary),severity:ce(f.severity),published:ce(f.published),source:pe(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(c){return a.all({id:c}).map(u=>({id:Ve(u.id)??0,affectedPackageId:Ve(u.affected_package_id)??0,exportName:ce(u.export_name),symbolKind:pe(u.symbol_kind),matchPattern:ce(u.match_pattern),matchGlobs:ce(u.match_globs),container:ce(u.container),sourcePath:ce(u.source_path),declStart:Ve(u.decl_start),declEnd:Ve(u.decl_end),astHashBefore:ce(u.ast_hash_before),astHashAfter:ce(u.ast_hash_after),derivation:pe(u.derivation),confidence:pe(u.confidence),verified:Ve(u.verified)===1?1:0}))},aliasesForSymbol(c){return o.all({id:c}).map(u=>({id:Ve(u.id)??0,vulnerableSymbolId:Ve(u.vulnerable_symbol_id)??0,aliasPath:pe(u.alias_path),aliasName:pe(u.alias_name)}))},allModels(){let c;try{c=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,oa=5,aa="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",la="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",da="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function Ft(e,n=Yn){let t=n.open(e,"readonly"),r=t.prepare(da).get(),i=r!==void 0?pe(r.value):"",s=/^\d+$/u.test(i)&&Number(i)>=oa,l=t.prepare(s?ra:sa),a=t.prepare(aa),o=t.prepare(la);return{schemaVersion:i,advisoriesForPackage(c,u){return l.all({eco:c,name:u}).map(f=>({affected:{id:qe(f.ap_id)??0,advisoryId:pe(f.advisory_id),ecosystem:pe(f.ecosystem),packageName:pe(f.package_name),introduced:de(f.introduced),fixed:de(f.fixed),lastAffected:de(f.last_affected),fixCommit:de(f.fix_commit),repoUrl:de(f.repo_url),surfaceComplete:qe(f.surface_complete)===1?1:0},advisory:{id:pe(f.a_id),osvId:de(f.osv_id),cveId:de(f.cve_id),summary:de(f.summary),severity:de(f.severity),published:de(f.published),source:pe(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(c){return a.all({id:c}).map(u=>({id:qe(u.id)??0,affectedPackageId:qe(u.affected_package_id)??0,exportName:de(u.export_name),symbolKind:pe(u.symbol_kind),matchPattern:de(u.match_pattern),matchGlobs:de(u.match_globs),container:de(u.container),sourcePath:de(u.source_path),declStart:qe(u.decl_start),declEnd:qe(u.decl_end),astHashBefore:de(u.ast_hash_before),astHashAfter:de(u.ast_hash_after),derivation:pe(u.derivation),confidence:pe(u.confidence),verified:qe(u.verified)===1?1:0}))},aliasesForSymbol(c){return o.all({id:c}).map(u=>({id:qe(u.id)??0,vulnerableSymbolId:qe(u.vulnerable_symbol_id)??0,aliasPath:pe(u.alias_path),aliasName:pe(u.alias_name)}))},allModels(){let c;try{c=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
                FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let u=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return c.map(f=>{let m=Ve(f.id)??0;return{packageName:pe(f.package_name),modelId:pe(f.evidence_ref),introduced:pe(f.introduced),fixedBefore:ce(f.fixed_before),evidenceRef:pe(f.evidence_ref),edges:u.all({id:m}).map(h=>({kind:pe(h.kind),anchorExport:pe(h.anchor_export),anchorContainer:ce(h.anchor_container),calleePackage:pe(h.callee_package),calleeContainer:ce(h.callee_container),calleeExport:pe(h.callee_export)}))}})},close(){t.close()}}}var dn="5";import{realpathSync as Tn}from"node:fs";import en from"node:path";import{realpathSync as fn}from"node:fs";import{isBuiltin as Ha}from"node:module";import Ee from"node:path";import g from"typescript";function Kt(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function me(e){let n=Kt(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function qe(e){let n=Kt(e);if(n.startsWith("@")){let r=n.indexOf("/");if(r===-1)return n;let i=n.indexOf("/",r+1);return i===-1?n:n.slice(0,i)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function er(e){let n=Kt(e),t=qe(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as ma,statSync as jt}from"node:fs";var tn=16*1024*1024;function xn(e,n){try{let t=jt(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:ma(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function Ne(e){let n=xn(e,tn);return n.kind==="ok"?n.text:null}function He(e){try{return jt(e).isFile()}catch{return!1}}function nr(e){try{let n=jt(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as ha,realpathSync as Ut}from"node:fs";import Q from"node:path";import Jn from"typescript";var ar=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Ke(e){return ar.some(([n])=>e.endsWith(n))}function ga(e){for(let[n,t]of ar)if(e.endsWith(n)){let r=e.slice(0,-n.length);return t.map(i=>r+i)}return[]}var ya=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function xa(e){if(Ke(e))return e;for(let[n,t]of ya)if(e.endsWith(n)){let r=e.slice(0,-n.length);for(let i of t){let s=r+i;if(He(s))return s}return e}return e}var Sa=[Jn.ModuleKind.CommonJS,Jn.ModuleKind.ESNext],ba=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function lr(e,n,t,r,i,s){let l=Jn.resolveModuleName(e,n,t,r,void 0,void 0,i).resolvedModule;if(l===void 0)return null;let a=l.resolvedFileName;if(s){for(let o of ga(a))if(He(o))return o}return a}var dr=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],ka=[".js",".json",".node"],Ea=["index.js","index.json","index.node"];function Yn(e){return!Ke(e)&&dr.some(n=>e.endsWith(n))}function cr(e){if(He(e))return e;for(let n of ka)if(He(e+n))return e+n;return null}function tr(e){for(let n of Ea){let t=Q.join(e,n);if(He(t))return t}return null}var ur=[".ts",".tsx",".cts",".mts",".jsx"];function wa(e){for(let n of ur)if(He(e+n))return e+n;return null}function va(e){for(let n of ur){let t=Q.join(e,"index"+n);if(He(t))return t}return null}function fr(e){let n=Ne(Q.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let r=Q.join(e,t),i=cr(r)??tr(r);if(i!==null)return i}}catch{}return tr(e)}function pr(e){return cr(e)??fr(e)??wa(e)??va(e)}function mr(e){return pr(e)!==null}function Ia(e,n){let t=e.split(Q.sep),r=n.split("/"),i=null;for(let l=t.length-r.length-1;l>=0;l-=1)if(t[l]==="node_modules"&&r.every((a,o)=>t[l+1+o]===a)){i=t.slice(0,l+1+r.length).join(Q.sep);break}if(i===null||i==="")return null;let s=Ne(Q.join(i,"package.json"));if(s===null)return null;try{let l=JSON.parse(s),a=l.exports,o=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(l.name!==n||o)return null}catch{return null}try{return Ut(i)}catch{return null}}function _a(e,n){let t=pr(Q.join(e,n));if(t===null)return null;let r;try{r=Ut(t)}catch{return null}let i=e.endsWith(Q.sep)?e:e+Q.sep;return r!==e&&!r.startsWith(i)||Ke(r)||!dr.some(s=>r.endsWith(s))?null:r}function Aa(e,n){let t=er(e);return t===""||t.includes("\0")||t.split("/").some(r=>r===""||r==="."||r===".."||r==="node_modules")?null:_a(n,t)}var cn={kind:"nothing-loads"},Bt=8192;function zt(e,n){let t=n.get(e);if(t!==void 0)return t;let r,i=null;try{i=ha(e);let s=new Set,l=!1;for(;;){let a=i.readSync();if(a===null)break;if(s.size>=Bt){l=!0;break}s.add(a.name)}r={names:s,truncated:l}}catch{r=null}finally{try{i?.closeSync()}catch{}}return n.set(e,r),r}var Na=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function hr(e){return Na.some(n=>e.length>n.length&&e.endsWith(n))}function Cn(e,n){let t=e.endsWith(Q.sep)?e:e+Q.sep;return n===e||n.startsWith(t)}function ir(e,n){let t;try{t=Ut(n)}catch{return{kind:"missing"}}return Cn(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function rr(e,n){let t=(n+".").toLowerCase(),r=[];for(let i of e){let s=i.toLowerCase();s.length>t.length&&s.startsWith(t)&&r.push(i)}return r}function Ca(e,n,t){let r=Q.dirname(n);if(!Cn(e,r))return null;let i=zt(r,t);if(i===null)return null;let s=Q.basename(n);return i.names.has(s)?s:null}function sr(e,n){let t=e.filter(i=>!hr(i));if(t.length===0)return cn;let r=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${r}") the analyzer cannot parse`}}function gr(e,n,t,r){let i=e,s=i.indexOf("?");s!==-1&&(i=i.slice(0,s));let l=i.indexOf("#");if(l!==-1&&(i=i.slice(0,l)),i===""||i.includes("\0"))return cn;let a=Q.resolve(Q.dirname(n),i);if(!Cn(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed"};let o=ir(t,a);if(o.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed"};if(o.kind==="ok"){let h=nr(o.real);if(h==="file"){let x=Ca(t,o.real,r);return x!==null&&hr(x)?cn:{kind:"unanalyzable",reason:x===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${x}") the analyzer cannot parse`}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file"};let b=zt(o.real,r);if(b===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let S=sr(rr(b.names,"index"),"a directory index");return S.kind==="unanalyzable"?S:b.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve"}:b.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Bt)} entries and was not fully probed`}:cn}let c=Q.basename(a);if(c===""||c==="."||c==="..")return cn;let u=ir(t,Q.dirname(a));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed"};if(u.kind==="missing")return cn;let f=zt(u.real,r);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let m=sr(rr(f.names,c),"a sibling file exists");return m.kind==="unanalyzable"?m:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Bt)} entries and was not fully probed`}:cn}function Oa(e,n){let t=qe(e),r=Q.dirname(n);for(let i=0;i<64;i+=1){let s=Q.join(r,"node_modules",...t.split("/"));if(Ne(Q.join(s,"package.json"))!==null)return s;let l=Q.dirname(r);if(l===r)return null;r=l}return null}function or(e,n,t,r,i){let s;for(let l of Sa)for(let a of ba){let o={...t,noDtsResolution:!0,customConditions:[...a]},c=lr(e,n,o,r,l,i);if(s===void 0)s=c;else if(s!==c)return null}return s??null}function Te(e,n,t,r){let i=me(e);if(i==="relative")return lr(e,n,t,r,void 0,!0);if(i==="package-root"){let a=or(e,n,t,r,!0);if(a!==null)return a;let o=Oa(e,n);if(o===null||Ne(Q.join(o,"package.json"))?.includes('"exports"')===!0)return null;let c=fr(o);return c===null||Ke(c)?null:Cn(o,c)?c:null}let s=or(e,n,t,r,!1);if(s===null)return null;let l=Ia(s,qe(e));return l!==null?Aa(e,l):Ke(s)?s:xa(s)}function yr(e,n,t){let r=Ne(Q.join(e,"tsconfig.json"));if(r===null)return()=>null;let i=Jn.parseConfigFileTextToJson(Q.join(e,"tsconfig.json"),r);if(i.error!==void 0)return()=>null;let s=i.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let l=s.paths;if(typeof l!="object"||l===null)return()=>null;let a=s.baseUrl,o=typeof a=="string"?Q.resolve(e,a):e,c=new Map,u=[];for(let[m,h]of Object.entries(l)){if(!Array.isArray(h))continue;let b=h.filter(x=>typeof x=="string");if(b.length===0)continue;let S=m.indexOf("*");S===-1?c.set(m,b):m.indexOf("*",S+1)===-1&&u.push({prefix:m.slice(0,S),suffix:m.slice(S+1),targets:b})}if(u.sort((m,h)=>h.prefix.length-m.prefix.length),c.size===0&&u.length===0)return()=>null;let f=m=>{let h=c.get(m);if(h!==void 0)return h;for(let b of u){if(m.length<b.prefix.length+b.suffix.length||!m.startsWith(b.prefix)||!m.endsWith(b.suffix))continue;let S=m.slice(b.prefix.length,m.length-b.suffix.length);return b.targets.map(x=>{let w=x.indexOf("*");return w===-1?x:x.slice(0,w)+S+x.slice(w+1)})}return[]};return(m,h)=>{let b=f(m);if(b.length===0||Te(m,h,n,t)!==null)return null;for(let S of b){let x=Q.resolve(o,S),w=Q.relative(Q.dirname(h),x).split(Q.sep).join("/");if(w==="")continue;w.startsWith(".")||(w=`./${w}`);let A=Te(w,h,n,t);if(A!==null&&Cn(e,A))return A}return null}}import{readdirSync as Ra,realpathSync as Ma}from"node:fs";import Qe from"node:path";import P from"typescript";function On(e,n){if(P.isIdentifier(e))n.add(e.text);else for(let t of e.elements)P.isBindingElement(t)&&On(t.name,n)}function Sn(e){let n=new Map,t=new Set,r=o=>{n.set(o,(n.get(o)??0)+1)},i=o=>{let c=Ce(o);if(P.isIdentifier(c))t.add(c.text);else if(P.isArrayLiteralExpression(c))for(let u of c.elements)i(u);else if(P.isObjectLiteralExpression(c))for(let u of c.properties)P.isShorthandPropertyAssignment(u)?t.add(u.name.text):P.isPropertyAssignment(u)?i(u.initializer):P.isSpreadAssignment(u)&&i(u.expression);else P.isSpreadElement(c)?i(c.expression):P.isBinaryExpression(c)&&c.operatorToken.kind===P.SyntaxKind.EqualsToken&&i(c.left)},s=o=>{let c=new Set;On(o,c);for(let u of c)r(u)},l=o=>{P.isVariableDeclaration(o)?s(o.name):P.isFunctionDeclaration(o)&&o.name!==void 0||P.isClassDeclaration(o)&&o.name!==void 0?r(o.name.text):P.isParameter(o)?s(o.name):((P.isFunctionExpression(o)||P.isClassExpression(o))&&o.name!==void 0&&P.isIdentifier(o.name)&&!(o.parent!==void 0&&P.isVariableDeclaration(o.parent)&&o.parent.initializer===o&&P.isIdentifier(o.parent.name)&&o.parent.name.text===o.name.text)||P.isImportClause(o)&&o.name!==void 0||P.isNamespaceImport(o)||P.isImportSpecifier(o)||P.isImportEqualsDeclaration(o))&&r(o.name.text),P.isBinaryExpression(o)&&o.operatorToken.kind>=P.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=P.SyntaxKind.LastAssignment?i(o.left):(P.isPrefixUnaryExpression(o)||P.isPostfixUnaryExpression(o))&&(o.operator===P.SyntaxKind.PlusPlusToken||o.operator===P.SyntaxKind.MinusMinusToken)?i(o.operand):(P.isForOfStatement(o)||P.isForInStatement(o))&&!P.isVariableDeclarationList(o.initializer)&&i(o.initializer),P.forEachChild(o,l)};l(e);let a=new Set(t);for(let[o,c]of n)c>1&&a.add(o);return a}function un(e,n,t){let r=Sn(e),i=new Map,s=l=>{P.isVariableDeclaration(l)&&P.isIdentifier(l.name)&&l.initializer!==void 0&&!r.has(l.name.text)&&!i.has(l.name.text)&&i.set(l.name.text,l.initializer),P.forEachChild(l,s)};return s(e),{containingFile:n,taintedNames:r,constBindings:i,resolveParamDirs:t}}var $a=1024,Pa=32,La=new Set(["filter","sort","slice","reverse"]),Ta=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ce(e){let n=e;for(;P.isParenthesizedExpression(n);)n=n.expression;return n}function xr(e,n){return P.isPropertyAccessExpression(e)&&P.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function rn(e,n,t,r){if(t>Pa)return null;let i=Ce(e);if(P.isStringLiteralLike(i))return i.text;if(P.isTemplateExpression(i)){let s=i.head.text;for(let l of i.templateSpans){let a=rn(l.expression,n,t+1,r);if(a===null)return null;s+=a+l.literal.text}return s}if(P.isBinaryExpression(i)&&i.operatorToken.kind===P.SyntaxKind.PlusToken){let s=rn(i.left,n,t+1,r);if(s===null)return null;let l=rn(i.right,n,t+1,r);return l===null?null:s+l}if(P.isIdentifier(i)){if(i.text==="__dirname")return Qe.dirname(n.containingFile);if(i.text==="__filename")return n.containingFile;if(n.taintedNames.has(i.text)||r.has(i.text))return null;let s=n.constBindings.get(i.text);if(s===void 0)return null;r.add(i.text);let l=rn(s,n,t+1,r);return r.delete(i.text),l}if(P.isCallExpression(i)){let s=xr(i.expression,"join"),l=xr(i.expression,"resolve");if(!s&&!l)return null;let a=[];for(let c of i.arguments){let u=rn(c,n,t+1,r);if(u===null)return null;a.push(u)}let o=a[0];return o===void 0||l&&!Qe.isAbsolute(o)?null:l?Qe.resolve(...a):Qe.join(...a)}return null}function Qn(e){let n=Ce(e);if(P.isBinaryExpression(n)&&n.operatorToken.kind===P.SyntaxKind.PlusToken)return[...Qn(n.left),...Qn(n.right)];if(P.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let r of n.templateSpans)t.push({expr:r.expression}),r.literal.text.length>0&&t.push({lit:r.literal.text});return t}return P.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function kr(e){let n=e,t=0;for(;t++<4096;){let r=n.parent;if(r===void 0)return null;if(P.isForOfStatement(r)&&r.statement===n){let i=r.initializer;if(P.isVariableDeclarationList(i)&&i.declarations.length===1&&i.declarations[0]!==void 0&&P.isIdentifier(i.declarations[0].name)&&i.declarations[0].name.text===e.text){let s=Sr(r.expression);if(s!==null)return s}}if((P.isArrowFunction(n)||P.isFunctionExpression(n))&&P.isCallExpression(r)&&r.arguments.length>0&&r.arguments[0]===n&&P.isPropertyAccessExpression(r.expression)&&Ta.has(r.expression.name.text)){let i=n.parameters[0];if(i!==void 0&&P.isIdentifier(i.name)&&i.name.text===e.text){let s=Sr(r.expression.expression);if(s!==null)return s}}n=r}return null}function Sr(e){let n=Ce(e),t=0;for(;P.isCallExpression(n)&&t++<16;){let r=n.expression;if(P.isPropertyAccessExpression(r)){let i=r.name.text;if(i==="readdirSync")return n.arguments[0]??null;if(La.has(i)){n=Ce(r.expression);continue}return null}return P.isIdentifier(r)&&r.text==="readdirSync"?n.arguments[0]??null:null}return null}function Da(e,n){let t=Qn(e);if(t.length<2)return null;let r=t[t.length-1];if(r===void 0||!("expr"in r)||!P.isIdentifier(r.expr))return null;let i=r.expr;if(n.taintedNames.has(i.text))return null;let s="";for(let c=0;c<t.length-1;c+=1){let u=t[c];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let f=rn(u.expr,n,0,new Set);if(f===null)return null;s+=f}}let l=kr(i),a=l===null?null:rn(l,n,0,new Set);if(a===null)return null;let o=Qe.resolve(s);return o!==Qe.resolve(a)?null:o}function Fa(e){if((P.isFunctionDeclaration(e)||P.isFunctionExpression(e))&&e.name!==void 0&&P.isIdentifier(e.name)||P.isMethodDeclaration(e)&&P.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&P.isVariableDeclaration(n)&&P.isIdentifier(n.name)?n.name.text:null}function Ka(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!P.isFunctionLike(t))continue;let r=-1;for(let s=0;s<t.parameters.length;s+=1){let l=t.parameters[s];if(l!==void 0&&P.isIdentifier(l.name)&&l.name.text===n){r=s;break}}if(r<0)continue;let i=Fa(t);return i===null?null:{fnName:i,paramIndex:r}}return null}function Rn(e,n){let t=Qn(e);if(t.length!==2)return null;let[r,i]=t;if(r===void 0||!("expr"in r)||!P.isIdentifier(r.expr)||i===void 0||!("expr"in i)||!P.isIdentifier(i.expr))return null;let s=r.expr,l=i.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(l.text))return null;let a=kr(l);return a===null||!P.isIdentifier(a)||a.text!==s.text?null:Ka(s,s.text)}function ja(e,n){if(n.resolveParamDirs===void 0)return null;let t=Rn(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function Zn(e){for(let n=e.parent;n!==void 0;n=n.parent){if(P.isSourceFile(n))return!0;if(!P.isArrowFunction(n)&&P.isFunctionLike(n))return!1}return!0}function Vt(e,n){let t=rn(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let r=Da(e,n);if(r!==null)return{kind:"dir",dir:r};let i=ja(e,n);return i!==null&&i.length>0?{kind:"dirs",dirs:[...i]}:{kind:"opaque"}}function Er(e,n){let t;try{t=Ma(e)}catch{return null}let r=n.endsWith(Qe.sep)?n:n+Qe.sep;return t===n||t.startsWith(r)?t:null}function wr(e,n,t,r,i){let s=Te(e,n,r,i);return s===null||Ke(s)||!Yn(s)?null:Er(s,t)}function br(e,n,t,r,i){let s=Er(e,t);if(s===null)return[];let l;try{l=Ra(s)}catch{return[]}if(l.length===0||l.length>$a)return[];l.sort();let a=new Set,o=[];for(let c of l){let u=wr(Qe.join(s,c),n,t,r,i);u!==null&&!a.has(u)&&(a.add(u),o.push(u))}return o}function et(e,n,t,r,i){let s=Vt(e,n);if(s.kind==="const"){if(me(s.value)==="package-root")return[];let l=wr(s.value,n.containingFile,t,r,i);return l===null?[]:[l]}if(s.kind==="dir")return br(s.dir,n.containingFile,t,r,i);if(s.kind==="dirs"){let l=new Set,a=[];for(let o of s.dirs)for(let c of br(o,n.containingFile,t,r,i))l.has(c)||(l.add(c),a.push(c));return a}return[]}import Ba from"node:path";import ee from"typescript";var za=32,nt="\0",vr=(e,n)=>`${e}${nt}${n}`,Ir=(e,n,t)=>`${e}${nt}${n}${nt}${String(t)}`;function Ua(e){let n=new Map,t=new Set,r=(i,s)=>{if(t.has(i)){n.delete(i);return}t.add(i),n.set(i,s)};for(let i of e.statements)if(ee.isImportDeclaration(i)&&ee.isStringLiteralLike(i.moduleSpecifier)){let s=i.moduleSpecifier.text,l=i.importClause;if(l===void 0)continue;l.name!==void 0&&r(l.name.text,{kind:"module",specifier:s});let a=l.namedBindings;if(a!==void 0&&ee.isNamespaceImport(a))r(a.name.text,{kind:"module",specifier:s});else if(a!==void 0&&ee.isNamedImports(a))for(let o of a.elements)r(o.name.text,{kind:"named",specifier:s,imported:(o.propertyName??o.name).text})}else if(ee.isImportEqualsDeclaration(i)&&ee.isExternalModuleReference(i.moduleReference)&&ee.isStringLiteralLike(i.moduleReference.expression))r(i.name.text,{kind:"module",specifier:i.moduleReference.expression.text});else if(ee.isFunctionDeclaration(i)&&i.name!==void 0)r(i.name.text,{kind:"local"});else if(ee.isVariableStatement(i))for(let s of i.declarationList.declarations){if(s.initializer===void 0)continue;let l=s.initializer;if(ee.isIdentifier(s.name))ee.isArrowFunction(l)||ee.isFunctionExpression(l)?r(s.name.text,{kind:"local"}):_r(l)&&r(s.name.text,{kind:"module",specifier:Ar(l)});else if(ee.isObjectBindingPattern(s.name)&&_r(l)){let a=Ar(l);for(let o of s.name.elements){if(o.dotDotDotToken!==void 0||!ee.isIdentifier(o.name))continue;let c=o.propertyName??o.name;!ee.isIdentifier(c)&&!ee.isStringLiteralLike(c)||r(o.name.text,{kind:"named",specifier:a,imported:c.text})}}}return n}function _r(e){return ee.isCallExpression(e)&&ee.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&ee.isStringLiteralLike(e.arguments[0])}function Ar(e){let n=e.arguments[0];return n!==void 0&&ee.isStringLiteralLike(n)?n.text:"\0"}function Va(e){let n=e.expression;if(ee.isPropertyAccessExpression(n))return n.name.text;if(ee.isIdentifier(n))return n.text}function qa(e,n,t,r,i,s){let l=e.expression,a=o=>{let c=`${o}${nt}${n}`,u=s.get(c);if(u!==void 0||s.has(c))return u??null;let f=Te(o,n,r,i),m=f===null?null:Ba.resolve(f);return s.set(c,m),m};if(ee.isPropertyAccessExpression(l)&&ee.isIdentifier(l.expression)){let o=t.get(l.expression.text);if(o?.kind==="module"){let c=a(o.specifier);return c===null?null:{moduleReal:c,fnName:l.name.text}}return null}if(ee.isIdentifier(l)){let o=t.get(l.text);if(o?.kind==="named"){let c=a(o.specifier);return c===null?null:{moduleReal:c,fnName:o.imported}}return o?.kind==="local"?{moduleReal:n,fnName:l.text}:null}return null}function Nr(e,n,t,r,i=new Map){if(n.length===0)return()=>null;let s=new Map,l=new Set;for(let o of n){let c=vr(o.definingModuleReal,o.fnName),u=s.get(c);u===void 0&&(u=new Set,s.set(c,u)),u.add(o.paramIndex),l.add(o.fnName)}let a=new Map;for(let o of e){let c=un(o.sf,o.real),u=Ua(o.sf),f=m=>{if(ee.isCallExpression(m)){let h=Va(m);if(h!==void 0&&l.has(h)&&Zn(m)){let b=qa(m,o.real,u,t,r,i);if(b!==null){let S=s.get(vr(b.moduleReal,b.fnName));if(S!==void 0)for(let x of S){let w=m.arguments[x];if(w===void 0)continue;let A=Vt(w,c);if(A.kind==="const"){let $=Ir(b.moduleReal,b.fnName,x),N=a.get($);N===void 0&&(N=new Set,a.set($,N)),N.add(A.value)}}}}}ee.forEachChild(m,f)};f(o.sf)}return(o,c,u)=>{let f=a.get(Ir(o,c,u));return f===void 0||f.size===0||f.size>za?null:[...f].sort()}}var We={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:g.ScriptTarget.ES2020,module:g.ModuleKind.CommonJS,moduleResolution:g.ModuleResolutionKind.Node10,types:[]},tt=5e3;function Ge(e,n){let t;try{t=fn(n)}catch{t=Ee.resolve(n)}let r=e.endsWith(Ee.sep)?e:e+Ee.sep;return t!==e&&!t.startsWith(r)?null:t===e?"":t.slice(r.length).split(Ee.sep).join("/")}function ue(e){let n=e;for(;;)if(g.isParenthesizedExpression(n))n=n.expression;else if(g.isBinaryExpression(n)&&n.operatorToken.kind===g.SyntaxKind.CommaToken)n=n.right;else return n}function Ze(e){return g.isPropertyAccessExpression(e)?{receiver:ue(e.expression),name:e.name.text}:g.isElementAccessExpression(e)&&g.isStringLiteralLike(e.argumentExpression)?{receiver:ue(e.expression),name:e.argumentExpression.text}:null}function Pn(e){let n=ue(e.expression);if(g.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===g.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=Ze(n);if(t!==null){if(t.name==="require"&&g.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(g.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let r=e.arguments[1];return{specifierArg:r!==void 0&&g.isArrayLiteralExpression(r)?r.elements[0]:void 0}}}}return null}function Cr(e){let n=[],t=r=>{if(g.isImportDeclaration(r)&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.importClause?.isTypeOnly!==!0});else if(g.isImportEqualsDeclaration(r)&&g.isExternalModuleReference(r.moduleReference)&&g.isStringLiteralLike(r.moduleReference.expression))n.push({text:r.moduleReference.expression.text,runtime:!0});else if(g.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.isTypeOnly!==!0});else if(g.isCallExpression(r)){let i=Pn(r),s=i?.specifierArg;i!==null&&s!==void 0&&g.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}g.forEachChild(r,t)};return t(e),n}function Wa(e,n){let t=n===g.ScriptKind.TSX?"__scriptkind_probe.tsx":n===g.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",r=g.createSourceFile(t,e,g.ScriptTarget.ES2020,!0,n),i={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:l=>l===t?r:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:l=>l,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:l=>l===t,readFile:l=>l===t?e:void 0};return g.createProgram({rootNames:[t],options:i,host:s}).getSyntacticDiagnostics(r).length}function Xt(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Or(e){let n=0,t=r=>{(g.isCallExpression(r)||g.isNewExpression(r)||g.isTaggedTemplateExpression(r))&&(n+=1),g.forEachChild(r,t)};return t(e),n}function $r(e,n){let t=Cr(g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0));if(!Xt(e)||!n.includes("<")||!n.includes("require"))return t;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX),i=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Cr(r)){let l=`${s.runtime?"R":"T"}:${s.text}`;i.has(l)||(i.add(l),t.push(s))}return t}function Rr(e,n,t,r,i){if(!n.includes("require")&&!n.includes("import("))return[];let s=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0),l=un(s,e,i),a=[],o=new Set;return Pr(s,c=>{for(let u of et(c,l,t,We,r))o.has(u)||(o.add(u),a.push(u))}),a}function Pr(e,n){let t=r=>{if(g.isCallExpression(r)){let i=Pn(r),s=i?.specifierArg;i!==null&&s!==void 0&&!g.isStringLiteralLike(s)&&n(s)}g.forEachChild(r,t)};t(e)}function Ga(e){let n=[];for(let t of e){let r=un(t.sf,t.real);Pr(t.sf,i=>{let s=Rn(i,r);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var Xa=4,qt=tt,Ht=new Set(["eval","Function","createRequire"]),Ja=new Set(["require","eval","Function","createRequire"]),st=new Set(["module","Module","require","process","global","globalThis"]),ot=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function Ya(e){return e===g.SyntaxKind.LessThanToken||e===g.SyntaxKind.GreaterThanToken||e===g.SyntaxKind.LessThanEqualsToken||e===g.SyntaxKind.GreaterThanEqualsToken||e===g.SyntaxKind.EqualsEqualsToken||e===g.SyntaxKind.EqualsEqualsEqualsToken||e===g.SyntaxKind.ExclamationEqualsToken||e===g.SyntaxKind.ExclamationEqualsEqualsToken||e===g.SyntaxKind.InstanceOfKeyword||e===g.SyntaxKind.InKeyword}function Qa(e){let n=e.parent;return(g.isParameter(n)||g.isVariableDeclaration(n)||g.isBindingElement(n)||g.isFunctionDeclaration(n)||g.isFunctionExpression(n)||g.isClassDeclaration(n)||g.isClassExpression(n)||g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isMethodDeclaration(n))&&n.name===e?!0:g.isPropertyAccessExpression(n)&&n.name===e}function Za(e,n){return g.isCallExpression(n)&&n.expression===e||(g.isPropertyAccessExpression(n)||g.isElementAccessExpression(n))&&n.expression===e||g.isTypeOfExpression(n)||g.isVoidExpression(n)||g.isDeleteExpression(n)||g.isPrefixUnaryExpression(n)||g.isPostfixUnaryExpression(n)?!0:g.isBinaryExpression(n)&&Ya(n.operatorToken.kind)}function Lr(e){let n=e,t=e.parent;for(;;)if(g.isParenthesizedExpression(t))n=t,t=t.parent;else if(g.isBinaryExpression(t)&&t.operatorToken.kind===g.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Za(n,t)}function el(e){return Qa(e)?!1:Lr(e)}function Tr(e){let n=Ze(e);if(n!==null&&ot.has(n.name))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=ue(e.expression);if(g.isIdentifier(t)&&st.has(t.text))return!0}return!1}function Mn(e){let n=Ze(e);if(n===null||n.name!=="constructor")return!1;let t=Ze(n.receiver);return t!==null&&t.name==="constructor"}function Dr(e){if(!g.isCallExpression(e))return!1;let n=ue(e.expression);if(!g.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&g.isStringLiteralLike(t)&&t.text==="module"}var nl={roots:new Map,nodes:new Set,saturated:!1};function Fr(e){return g.isSourceFile(e)||g.isFunctionDeclaration(e)||g.isFunctionExpression(e)||g.isArrowFunction(e)||g.isMethodDeclaration(e)||g.isConstructorDeclaration(e)||g.isGetAccessorDeclaration(e)||g.isSetAccessorDeclaration(e)||g.isClassStaticBlockDeclaration(e)||g.isModuleDeclaration(e)}function Kr(e,n){let t=e.parent;for(;t!==void 0;){if(Fr(t))return t;t=t.parent}return n}function tl(e){let n=new Set;if(g.isFunctionLike(e))for(let r of e.parameters)for(let i of $n(r.name))n.add(i);let t=[e];for(;t.length>0;){let r=t.pop();if(r===void 0)break;if(!(r!==e&&Fr(r))){if(g.isVariableDeclaration(r)&&g.isVariableDeclarationList(r.parent)&&!((r.parent.flags&g.NodeFlags.BlockScoped)!==0))for(let s of $n(r.name))n.add(s);g.forEachChild(r,i=>{t.push(i)})}}return n}function il(e,n,t){let r=Kr(e,n);if(g.isSourceFile(r))return n;let i=t.get(r);return i===void 0&&(i=tl(r),t.set(r,i)),i.has(e.text)?r:n}function it(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let r=n;for(;;){if(t.has(r))return!0;let i=r.parent;if(i===void 0)return!g.isSourceFile(r);r=i}}var rl=12,sl=8;function rt(e,n){let t=ue(e);for(;;){if(n.nodes.has(t))return!0;if(g.isIdentifier(t))return st.has(t.text)||it(n,t);if(g.isCallExpression(t))return Dr(t);let r=Ze(t);if(r!==null){if(r.name==="constructor")return!0;t=r.receiver;continue}if(g.isElementAccessExpression(t)){t=ue(t.expression);continue}return!1}}function jr(e){let n=Ze(ue(e.expression));if(n===null||n.name!=="get"||!g.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function ol(e,n){let t=jr(e);if(t===null||!rt(t.target,n))return!1;let r=t.key;return r===void 0||!g.isStringLiteralLike(r)?!0:ot.has(r.text)}function Wt(e){if(!g.isFunctionExpression(e)&&!g.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,r=i=>{if(!(t||g.isFunctionExpression(i)||g.isFunctionDeclaration(i)||g.isClassLike(i))){if(g.isReturnStatement(i)&&i.expression!==void 0&&ue(i.expression).kind===g.SyntaxKind.ThisKeyword){t=!0;return}g.forEachChild(i,r)}};return r(n),t}function $n(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isOmittedExpression(t)||n.push(...$n(t.name));return n}function Br(e){return e.parameters.map(n=>$n(n.name))}function al(e){let n=new Map,t=new Set,r=(s,l)=>{let a={fn:l,slots:Br(l)},o=n.get(s);o===void 0?n.set(s,[a]):o.push(a),Wt(l)&&t.add(s)},i=s=>{if(g.isFunctionDeclaration(s)&&s.name!==void 0)r(s.name.text,s);else if(g.isVariableDeclaration(s)&&g.isIdentifier(s.name)&&s.initializer!==void 0){let l=ue(s.initializer);(g.isFunctionExpression(l)||g.isArrowFunction(l))&&r(s.name.text,l)}g.forEachChild(s,i)};return i(e),{params:n,thisReturning:t}}function ll(e){let n=new Map,t=new Set,r={roots:n,nodes:t},i=al(e),s=new Map,l=new Set(i.thisReturning),a=!0;for(let o=0;a;o+=1){if(o>=rl)return{roots:n,nodes:t,saturated:!0};a=!1;let c=(S,x)=>{x!==""&&!S.has(x)&&(S.add(x),a=!0)},u=(S,x)=>{if(S==="")return;let w=n.get(S);w===void 0&&(w=new Set,n.set(S,w)),w.has(x)||(w.add(x),a=!0)},f=S=>{t.has(S)||(t.add(S),a=!0)},m=(S,x)=>{let w=ue(S.expression);if(g.isIdentifier(w)&&Ht.has(w.text)||Mn(w)||g.isCallExpression(S)&&Dr(S)||Wt(w))return!0;let A=Ze(w);if(A!==null&&(A.name==="call"||A.name==="apply"||A.name==="bind")){let $=A.receiver;if(Wt($)||t.has($)||g.isIdentifier($)&&(it(r,$)||l.has($.text)))return!0}if(t.has(w)||(g.isCallExpression(w)||g.isNewExpression(w))&&m(w,x+1)||g.isIdentifier(w)&&(it(r,w)||l.has(w.text)))return!0;if(g.isCallExpression(S)){let $=jr(S);if($!==null&&rt($.target,r))return!0}return!1},h=(S,x)=>{if(x>=sl)return!0;let w=ue(S);if(t.has(w))return!0;if(g.isIdentifier(w))return st.has(w.text)||it(r,w);if(g.isBinaryExpression(w)){let A=w.operatorToken.kind;return A===g.SyntaxKind.BarBarToken||A===g.SyntaxKind.AmpersandAmpersandToken||A===g.SyntaxKind.QuestionQuestionToken?h(w.left,x+1)||h(w.right,x+1):!1}return g.isConditionalExpression(w)?h(w.whenTrue,x+1)||h(w.whenFalse,x+1):g.isPropertyAccessExpression(w)||g.isElementAccessExpression(w)?rt(w,r):g.isCallExpression(w)||g.isNewExpression(w)?m(w,x+1):!1},b=(S,x)=>{if((g.isVariableDeclaration(S)||g.isParameter(S)||g.isBindingElement(S))&&S.initializer!==void 0){if(h(S.initializer,0)){let A=Kr(S,e);for(let $ of $n(S.name))u($,A)}}else if(g.isBinaryExpression(S)&&S.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(S.left)&&h(S.right,0))u(S.left.text,il(S.left,e,s));else if(g.isReturnStatement(S)&&S.expression!==void 0&&x!==void 0&&h(S.expression,0))c(l,x);else if(g.isCallExpression(S)||g.isNewExpression(S)){m(S,0)&&f(S);let A=ue(S.expression),$=Ze(A),N=$!==null&&$.name==="call",k=$!==null&&$.name==="apply",p=N||k?$.receiver:A,y=N?1:0,_=[];g.isFunctionExpression(p)||g.isArrowFunction(p)?_.push({fn:p,slots:Br(p)}):g.isIdentifier(p)&&_.push(...i.params.get(p.text)??[]);let L=S.arguments??[];if(k){let z=L[1]===void 0?void 0:ue(L[1]);for(let{fn:I,slots:C}of _)if(z!==void 0&&g.isArrayLiteralExpression(z))for(let K=0;K<z.elements.length;K+=1){let M=z.elements[K],R=C[K];if(!(M===void 0||R===void 0)&&h(M,0))for(let V of R)u(V,I)}else if(z!==void 0)for(let K of C)for(let M of K)u(M,I)}else for(let{fn:z,slots:I}of _)for(let C=y;C<L.length;C+=1){let K=L[C],M=I[C-y];if(!(K===void 0||M===void 0)&&h(K,0))for(let R of M)u(R,z)}}let w=x;if(g.isFunctionDeclaration(S))w=S.name?.text;else if(g.isFunctionExpression(S)||g.isArrowFunction(S)){let A=S.parent;w=g.isVariableDeclaration(A)&&g.isIdentifier(A.name)?A.name.text:void 0}g.forEachChild(S,A=>b(A,w))};b(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function dl(e){if(g.isIdentifier(e)&&Ht.has(e.text)||Mn(e))return!0;let n=Ze(e);if(n!==null&&(ot.has(n.name)||(n.name==="call"||n.name==="apply")&&(g.isIdentifier(n.receiver)&&Ht.has(n.receiver.text)||Mn(n.receiver)||(g.isPropertyAccessExpression(n.receiver)||g.isElementAccessExpression(n.receiver))&&Tr(n.receiver))))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=ue(e.expression);if(g.isIdentifier(t)&&st.has(t.text))return!0}return!1}var cl=4;function Mr(e,n){for(let t of e){if(!g.isStringLiteralLike(t)||n>=cl)return!0;let r=g.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return c.map(f=>{let m=qe(f.id)??0;return{packageName:pe(f.package_name),modelId:pe(f.evidence_ref),introduced:pe(f.introduced),fixedBefore:de(f.fixed_before),evidenceRef:pe(f.evidence_ref),edges:u.all({id:m}).map(h=>({kind:pe(h.kind),anchorExport:pe(h.anchor_export),anchorContainer:de(h.anchor_container),calleePackage:pe(h.callee_package),calleeContainer:de(h.callee_container),calleeExport:pe(h.callee_export)}))}})},close(){t.close()}}}var dn="5";import{realpathSync as Tn}from"node:fs";import nn from"node:path";import{realpathSync as fn}from"node:fs";import{isBuiltin as Ha}from"node:module";import ke from"node:path";import g from"typescript";function Kt(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function me(e){let n=Kt(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function He(e){let n=Kt(e);if(n.startsWith("@")){let r=n.indexOf("/");if(r===-1)return n;let i=n.indexOf("/",r+1);return i===-1?n:n.slice(0,i)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function er(e){let n=Kt(e),t=He(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as ma,statSync as jt}from"node:fs";var tn=16*1024*1024;function xn(e,n){try{let t=jt(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:ma(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function Ce(e){let n=xn(e,tn);return n.kind==="ok"?n.text:null}function We(e){try{return jt(e).isFile()}catch{return!1}}function nr(e){try{let n=jt(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as ha,realpathSync as Ut}from"node:fs";import Z from"node:path";import Qn from"typescript";var ar=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function je(e){return ar.some(([n])=>e.endsWith(n))}function ga(e){for(let[n,t]of ar)if(e.endsWith(n)){let r=e.slice(0,-n.length);return t.map(i=>r+i)}return[]}var ya=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function xa(e){if(je(e))return e;for(let[n,t]of ya)if(e.endsWith(n)){let r=e.slice(0,-n.length);for(let i of t){let s=r+i;if(We(s))return s}return e}return e}var Sa=[Qn.ModuleKind.CommonJS,Qn.ModuleKind.ESNext],ba=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function lr(e,n,t,r,i,s){let l=Qn.resolveModuleName(e,n,t,r,void 0,void 0,i).resolvedModule;if(l===void 0)return null;let a=l.resolvedFileName;if(s){for(let o of ga(a))if(We(o))return o}return a}var dr=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],ka=[".js",".json",".node"],Ea=["index.js","index.json","index.node"];function Zn(e){return!je(e)&&dr.some(n=>e.endsWith(n))}function cr(e){if(We(e))return e;for(let n of ka)if(We(e+n))return e+n;return null}function tr(e){for(let n of Ea){let t=Z.join(e,n);if(We(t))return t}return null}var ur=[".ts",".tsx",".cts",".mts",".jsx"];function wa(e){for(let n of ur)if(We(e+n))return e+n;return null}function va(e){for(let n of ur){let t=Z.join(e,"index"+n);if(We(t))return t}return null}function fr(e){let n=Ce(Z.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let r=Z.join(e,t),i=cr(r)??tr(r);if(i!==null)return i}}catch{}return tr(e)}function pr(e){return cr(e)??fr(e)??wa(e)??va(e)}function mr(e){return pr(e)!==null}function Ia(e,n){let t=e.split(Z.sep),r=n.split("/"),i=null;for(let l=t.length-r.length-1;l>=0;l-=1)if(t[l]==="node_modules"&&r.every((a,o)=>t[l+1+o]===a)){i=t.slice(0,l+1+r.length).join(Z.sep);break}if(i===null||i==="")return null;let s=Ce(Z.join(i,"package.json"));if(s===null)return null;try{let l=JSON.parse(s),a=l.exports,o=typeof a=="string"||Array.isArray(a)||typeof a=="object"&&a!==null;if(l.name!==n||o)return null}catch{return null}try{return Ut(i)}catch{return null}}function Aa(e,n){let t=pr(Z.join(e,n));if(t===null)return null;let r;try{r=Ut(t)}catch{return null}let i=e.endsWith(Z.sep)?e:e+Z.sep;return r!==e&&!r.startsWith(i)||je(r)||!dr.some(s=>r.endsWith(s))?null:r}function _a(e,n){let t=er(e);return t===""||t.includes("\0")||t.split("/").some(r=>r===""||r==="."||r===".."||r==="node_modules")?null:Aa(n,t)}var cn={kind:"nothing-loads"},Bt=8192;function zt(e,n){let t=n.get(e);if(t!==void 0)return t;let r,i=null;try{i=ha(e);let s=new Set,l=!1;for(;;){let a=i.readSync();if(a===null)break;if(s.size>=Bt){l=!0;break}s.add(a.name)}r={names:s,truncated:l}}catch{r=null}finally{try{i?.closeSync()}catch{}}return n.set(e,r),r}var Na=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function hr(e){return Na.some(n=>e.length>n.length&&e.endsWith(n))}function Cn(e,n){let t=e.endsWith(Z.sep)?e:e+Z.sep;return n===e||n.startsWith(t)}function ir(e,n){let t;try{t=Ut(n)}catch{return{kind:"missing"}}return Cn(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function rr(e,n){let t=(n+".").toLowerCase(),r=[];for(let i of e){let s=i.toLowerCase();s.length>t.length&&s.startsWith(t)&&r.push(i)}return r}function Ca(e,n,t){let r=Z.dirname(n);if(!Cn(e,r))return null;let i=zt(r,t);if(i===null)return null;let s=Z.basename(n);return i.names.has(s)?s:null}function sr(e,n){let t=e.filter(i=>!hr(i));if(t.length===0)return cn;let r=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${r}") the analyzer cannot parse`}}function gr(e,n,t,r){let i=e,s=i.indexOf("?");s!==-1&&(i=i.slice(0,s));let l=i.indexOf("#");if(l!==-1&&(i=i.slice(0,l)),i===""||i.includes("\0"))return cn;let a=Z.resolve(Z.dirname(n),i);if(!Cn(t,a))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed"};let o=ir(t,a);if(o.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed"};if(o.kind==="ok"){let h=nr(o.real);if(h==="file"){let x=Ca(t,o.real,r);return x!==null&&hr(x)?cn:{kind:"unanalyzable",reason:x===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${x}") the analyzer cannot parse`}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file"};let b=zt(o.real,r);if(b===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let S=sr(rr(b.names,"index"),"a directory index");return S.kind==="unanalyzable"?S:b.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve"}:b.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Bt)} entries and was not fully probed`}:cn}let c=Z.basename(a);if(c===""||c==="."||c==="..")return cn;let u=ir(t,Z.dirname(a));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed"};if(u.kind==="missing")return cn;let f=zt(u.real,r);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let m=sr(rr(f.names,c),"a sibling file exists");return m.kind==="unanalyzable"?m:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Bt)} entries and was not fully probed`}:cn}function Oa(e,n){let t=He(e),r=Z.dirname(n);for(let i=0;i<64;i+=1){let s=Z.join(r,"node_modules",...t.split("/"));if(Ce(Z.join(s,"package.json"))!==null)return s;let l=Z.dirname(r);if(l===r)return null;r=l}return null}function or(e,n,t,r,i){let s;for(let l of Sa)for(let a of ba){let o={...t,noDtsResolution:!0,customConditions:[...a]},c=lr(e,n,o,r,l,i);if(s===void 0)s=c;else if(s!==c)return null}return s??null}function De(e,n,t,r){let i=me(e);if(i==="relative")return lr(e,n,t,r,void 0,!0);if(i==="package-root"){let a=or(e,n,t,r,!0);if(a!==null)return a;let o=Oa(e,n);if(o===null||Ce(Z.join(o,"package.json"))?.includes('"exports"')===!0)return null;let c=fr(o);return c===null||je(c)?null:Cn(o,c)?c:null}let s=or(e,n,t,r,!1);if(s===null)return null;let l=Ia(s,He(e));return l!==null?_a(e,l):je(s)?s:xa(s)}function yr(e,n,t){let r=Ce(Z.join(e,"tsconfig.json"));if(r===null)return()=>null;let i=Qn.parseConfigFileTextToJson(Z.join(e,"tsconfig.json"),r);if(i.error!==void 0)return()=>null;let s=i.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let l=s.paths;if(typeof l!="object"||l===null)return()=>null;let a=s.baseUrl,o=typeof a=="string"?Z.resolve(e,a):e,c=new Map,u=[];for(let[m,h]of Object.entries(l)){if(!Array.isArray(h))continue;let b=h.filter(x=>typeof x=="string");if(b.length===0)continue;let S=m.indexOf("*");S===-1?c.set(m,b):m.indexOf("*",S+1)===-1&&u.push({prefix:m.slice(0,S),suffix:m.slice(S+1),targets:b})}if(u.sort((m,h)=>h.prefix.length-m.prefix.length),c.size===0&&u.length===0)return()=>null;let f=m=>{let h=c.get(m);if(h!==void 0)return h;for(let b of u){if(m.length<b.prefix.length+b.suffix.length||!m.startsWith(b.prefix)||!m.endsWith(b.suffix))continue;let S=m.slice(b.prefix.length,m.length-b.suffix.length);return b.targets.map(x=>{let w=x.indexOf("*");return w===-1?x:x.slice(0,w)+S+x.slice(w+1)})}return[]};return(m,h)=>{let b=f(m);if(b.length===0||De(m,h,n,t)!==null)return null;for(let S of b){let x=Z.resolve(o,S),w=Z.relative(Z.dirname(h),x).split(Z.sep).join("/");if(w==="")continue;w.startsWith(".")||(w=`./${w}`);let _=De(w,h,n,t);if(_!==null&&Cn(e,_))return _}return null}}import{readdirSync as Ra,realpathSync as Ma}from"node:fs";import Ze from"node:path";import T from"typescript";function On(e,n){if(T.isIdentifier(e))n.add(e.text);else for(let t of e.elements)T.isBindingElement(t)&&On(t.name,n)}function Sn(e){let n=new Map,t=new Set,r=o=>{n.set(o,(n.get(o)??0)+1)},i=o=>{let c=Oe(o);if(T.isIdentifier(c))t.add(c.text);else if(T.isArrayLiteralExpression(c))for(let u of c.elements)i(u);else if(T.isObjectLiteralExpression(c))for(let u of c.properties)T.isShorthandPropertyAssignment(u)?t.add(u.name.text):T.isPropertyAssignment(u)?i(u.initializer):T.isSpreadAssignment(u)&&i(u.expression);else T.isSpreadElement(c)?i(c.expression):T.isBinaryExpression(c)&&c.operatorToken.kind===T.SyntaxKind.EqualsToken&&i(c.left)},s=o=>{let c=new Set;On(o,c);for(let u of c)r(u)},l=o=>{T.isVariableDeclaration(o)?s(o.name):T.isFunctionDeclaration(o)&&o.name!==void 0||T.isClassDeclaration(o)&&o.name!==void 0?r(o.name.text):T.isParameter(o)?s(o.name):((T.isFunctionExpression(o)||T.isClassExpression(o))&&o.name!==void 0&&T.isIdentifier(o.name)&&!(o.parent!==void 0&&T.isVariableDeclaration(o.parent)&&o.parent.initializer===o&&T.isIdentifier(o.parent.name)&&o.parent.name.text===o.name.text)||T.isImportClause(o)&&o.name!==void 0||T.isNamespaceImport(o)||T.isImportSpecifier(o)||T.isImportEqualsDeclaration(o))&&r(o.name.text),T.isBinaryExpression(o)&&o.operatorToken.kind>=T.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=T.SyntaxKind.LastAssignment?i(o.left):(T.isPrefixUnaryExpression(o)||T.isPostfixUnaryExpression(o))&&(o.operator===T.SyntaxKind.PlusPlusToken||o.operator===T.SyntaxKind.MinusMinusToken)?i(o.operand):(T.isForOfStatement(o)||T.isForInStatement(o))&&!T.isVariableDeclarationList(o.initializer)&&i(o.initializer),T.forEachChild(o,l)};l(e);let a=new Set(t);for(let[o,c]of n)c>1&&a.add(o);return a}function un(e,n,t){let r=Sn(e),i=new Map,s=l=>{T.isVariableDeclaration(l)&&T.isIdentifier(l.name)&&l.initializer!==void 0&&!r.has(l.name.text)&&!i.has(l.name.text)&&i.set(l.name.text,l.initializer),T.forEachChild(l,s)};return s(e),{containingFile:n,taintedNames:r,constBindings:i,resolveParamDirs:t}}var $a=1024,Pa=32,La=new Set(["filter","sort","slice","reverse"]),Ta=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Oe(e){let n=e;for(;T.isParenthesizedExpression(n);)n=n.expression;return n}function xr(e,n){return T.isPropertyAccessExpression(e)&&T.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function rn(e,n,t,r){if(t>Pa)return null;let i=Oe(e);if(T.isStringLiteralLike(i))return i.text;if(T.isTemplateExpression(i)){let s=i.head.text;for(let l of i.templateSpans){let a=rn(l.expression,n,t+1,r);if(a===null)return null;s+=a+l.literal.text}return s}if(T.isBinaryExpression(i)&&i.operatorToken.kind===T.SyntaxKind.PlusToken){let s=rn(i.left,n,t+1,r);if(s===null)return null;let l=rn(i.right,n,t+1,r);return l===null?null:s+l}if(T.isIdentifier(i)){if(i.text==="__dirname")return Ze.dirname(n.containingFile);if(i.text==="__filename")return n.containingFile;if(n.taintedNames.has(i.text)||r.has(i.text))return null;let s=n.constBindings.get(i.text);if(s===void 0)return null;r.add(i.text);let l=rn(s,n,t+1,r);return r.delete(i.text),l}if(T.isCallExpression(i)){let s=xr(i.expression,"join"),l=xr(i.expression,"resolve");if(!s&&!l)return null;let a=[];for(let c of i.arguments){let u=rn(c,n,t+1,r);if(u===null)return null;a.push(u)}let o=a[0];return o===void 0||l&&!Ze.isAbsolute(o)?null:l?Ze.resolve(...a):Ze.join(...a)}return null}function et(e){let n=Oe(e);if(T.isBinaryExpression(n)&&n.operatorToken.kind===T.SyntaxKind.PlusToken)return[...et(n.left),...et(n.right)];if(T.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let r of n.templateSpans)t.push({expr:r.expression}),r.literal.text.length>0&&t.push({lit:r.literal.text});return t}return T.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function kr(e){let n=e,t=0;for(;t++<4096;){let r=n.parent;if(r===void 0)return null;if(T.isForOfStatement(r)&&r.statement===n){let i=r.initializer;if(T.isVariableDeclarationList(i)&&i.declarations.length===1&&i.declarations[0]!==void 0&&T.isIdentifier(i.declarations[0].name)&&i.declarations[0].name.text===e.text){let s=Sr(r.expression);if(s!==null)return s}}if((T.isArrowFunction(n)||T.isFunctionExpression(n))&&T.isCallExpression(r)&&r.arguments.length>0&&r.arguments[0]===n&&T.isPropertyAccessExpression(r.expression)&&Ta.has(r.expression.name.text)){let i=n.parameters[0];if(i!==void 0&&T.isIdentifier(i.name)&&i.name.text===e.text){let s=Sr(r.expression.expression);if(s!==null)return s}}n=r}return null}function Sr(e){let n=Oe(e),t=0;for(;T.isCallExpression(n)&&t++<16;){let r=n.expression;if(T.isPropertyAccessExpression(r)){let i=r.name.text;if(i==="readdirSync")return n.arguments[0]??null;if(La.has(i)){n=Oe(r.expression);continue}return null}return T.isIdentifier(r)&&r.text==="readdirSync"?n.arguments[0]??null:null}return null}function Da(e,n){let t=et(e);if(t.length<2)return null;let r=t[t.length-1];if(r===void 0||!("expr"in r)||!T.isIdentifier(r.expr))return null;let i=r.expr;if(n.taintedNames.has(i.text))return null;let s="";for(let c=0;c<t.length-1;c+=1){let u=t[c];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let f=rn(u.expr,n,0,new Set);if(f===null)return null;s+=f}}let l=kr(i),a=l===null?null:rn(l,n,0,new Set);if(a===null)return null;let o=Ze.resolve(s);return o!==Ze.resolve(a)?null:o}function Fa(e){if((T.isFunctionDeclaration(e)||T.isFunctionExpression(e))&&e.name!==void 0&&T.isIdentifier(e.name)||T.isMethodDeclaration(e)&&T.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&T.isVariableDeclaration(n)&&T.isIdentifier(n.name)?n.name.text:null}function Ka(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!T.isFunctionLike(t))continue;let r=-1;for(let s=0;s<t.parameters.length;s+=1){let l=t.parameters[s];if(l!==void 0&&T.isIdentifier(l.name)&&l.name.text===n){r=s;break}}if(r<0)continue;let i=Fa(t);return i===null?null:{fnName:i,paramIndex:r}}return null}function Rn(e,n){let t=et(e);if(t.length!==2)return null;let[r,i]=t;if(r===void 0||!("expr"in r)||!T.isIdentifier(r.expr)||i===void 0||!("expr"in i)||!T.isIdentifier(i.expr))return null;let s=r.expr,l=i.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(l.text))return null;let a=kr(l);return a===null||!T.isIdentifier(a)||a.text!==s.text?null:Ka(s,s.text)}function ja(e,n){if(n.resolveParamDirs===void 0)return null;let t=Rn(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function nt(e){for(let n=e.parent;n!==void 0;n=n.parent){if(T.isSourceFile(n))return!0;if(!T.isArrowFunction(n)&&T.isFunctionLike(n))return!1}return!0}function Vt(e,n){let t=rn(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let r=Da(e,n);if(r!==null)return{kind:"dir",dir:r};let i=ja(e,n);return i!==null&&i.length>0?{kind:"dirs",dirs:[...i]}:{kind:"opaque"}}function Er(e,n){let t;try{t=Ma(e)}catch{return null}let r=n.endsWith(Ze.sep)?n:n+Ze.sep;return t===n||t.startsWith(r)?t:null}function wr(e,n,t,r,i){let s=De(e,n,r,i);return s===null||je(s)||!Zn(s)?null:Er(s,t)}function br(e,n,t,r,i){let s=Er(e,t);if(s===null)return[];let l;try{l=Ra(s)}catch{return[]}if(l.length===0||l.length>$a)return[];l.sort();let a=new Set,o=[];for(let c of l){let u=wr(Ze.join(s,c),n,t,r,i);u!==null&&!a.has(u)&&(a.add(u),o.push(u))}return o}function tt(e,n,t,r,i){let s=Vt(e,n);if(s.kind==="const"){if(me(s.value)==="package-root")return[];let l=wr(s.value,n.containingFile,t,r,i);return l===null?[]:[l]}if(s.kind==="dir")return br(s.dir,n.containingFile,t,r,i);if(s.kind==="dirs"){let l=new Set,a=[];for(let o of s.dirs)for(let c of br(o,n.containingFile,t,r,i))l.has(c)||(l.add(c),a.push(c));return a}return[]}import Ba from"node:path";import ee from"typescript";var za=32,it="\0",vr=(e,n)=>`${e}${it}${n}`,Ir=(e,n,t)=>`${e}${it}${n}${it}${String(t)}`;function Ua(e){let n=new Map,t=new Set,r=(i,s)=>{if(t.has(i)){n.delete(i);return}t.add(i),n.set(i,s)};for(let i of e.statements)if(ee.isImportDeclaration(i)&&ee.isStringLiteralLike(i.moduleSpecifier)){let s=i.moduleSpecifier.text,l=i.importClause;if(l===void 0)continue;l.name!==void 0&&r(l.name.text,{kind:"module",specifier:s});let a=l.namedBindings;if(a!==void 0&&ee.isNamespaceImport(a))r(a.name.text,{kind:"module",specifier:s});else if(a!==void 0&&ee.isNamedImports(a))for(let o of a.elements)r(o.name.text,{kind:"named",specifier:s,imported:(o.propertyName??o.name).text})}else if(ee.isImportEqualsDeclaration(i)&&ee.isExternalModuleReference(i.moduleReference)&&ee.isStringLiteralLike(i.moduleReference.expression))r(i.name.text,{kind:"module",specifier:i.moduleReference.expression.text});else if(ee.isFunctionDeclaration(i)&&i.name!==void 0)r(i.name.text,{kind:"local"});else if(ee.isVariableStatement(i))for(let s of i.declarationList.declarations){if(s.initializer===void 0)continue;let l=s.initializer;if(ee.isIdentifier(s.name))ee.isArrowFunction(l)||ee.isFunctionExpression(l)?r(s.name.text,{kind:"local"}):Ar(l)&&r(s.name.text,{kind:"module",specifier:_r(l)});else if(ee.isObjectBindingPattern(s.name)&&Ar(l)){let a=_r(l);for(let o of s.name.elements){if(o.dotDotDotToken!==void 0||!ee.isIdentifier(o.name))continue;let c=o.propertyName??o.name;!ee.isIdentifier(c)&&!ee.isStringLiteralLike(c)||r(o.name.text,{kind:"named",specifier:a,imported:c.text})}}}return n}function Ar(e){return ee.isCallExpression(e)&&ee.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&ee.isStringLiteralLike(e.arguments[0])}function _r(e){let n=e.arguments[0];return n!==void 0&&ee.isStringLiteralLike(n)?n.text:"\0"}function Va(e){let n=e.expression;if(ee.isPropertyAccessExpression(n))return n.name.text;if(ee.isIdentifier(n))return n.text}function qa(e,n,t,r,i,s){let l=e.expression,a=o=>{let c=`${o}${it}${n}`,u=s.get(c);if(u!==void 0||s.has(c))return u??null;let f=De(o,n,r,i),m=f===null?null:Ba.resolve(f);return s.set(c,m),m};if(ee.isPropertyAccessExpression(l)&&ee.isIdentifier(l.expression)){let o=t.get(l.expression.text);if(o?.kind==="module"){let c=a(o.specifier);return c===null?null:{moduleReal:c,fnName:l.name.text}}return null}if(ee.isIdentifier(l)){let o=t.get(l.text);if(o?.kind==="named"){let c=a(o.specifier);return c===null?null:{moduleReal:c,fnName:o.imported}}return o?.kind==="local"?{moduleReal:n,fnName:l.text}:null}return null}function Nr(e,n,t,r,i=new Map){if(n.length===0)return()=>null;let s=new Map,l=new Set;for(let o of n){let c=vr(o.definingModuleReal,o.fnName),u=s.get(c);u===void 0&&(u=new Set,s.set(c,u)),u.add(o.paramIndex),l.add(o.fnName)}let a=new Map;for(let o of e){let c=un(o.sf,o.real),u=Ua(o.sf),f=m=>{if(ee.isCallExpression(m)){let h=Va(m);if(h!==void 0&&l.has(h)&&nt(m)){let b=qa(m,o.real,u,t,r,i);if(b!==null){let S=s.get(vr(b.moduleReal,b.fnName));if(S!==void 0)for(let x of S){let w=m.arguments[x];if(w===void 0)continue;let _=Vt(w,c);if(_.kind==="const"){let $=Ir(b.moduleReal,b.fnName,x),N=a.get($);N===void 0&&(N=new Set,a.set($,N)),N.add(_.value)}}}}}ee.forEachChild(m,f)};f(o.sf)}return(o,c,u)=>{let f=a.get(Ir(o,c,u));return f===void 0||f.size===0||f.size>za?null:[...f].sort()}}var Ge={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:g.ScriptTarget.ES2020,module:g.ModuleKind.CommonJS,moduleResolution:g.ModuleResolutionKind.Node10,types:[]},rt=5e3;function Xe(e,n){let t;try{t=fn(n)}catch{t=ke.resolve(n)}let r=e.endsWith(ke.sep)?e:e+ke.sep;return t!==e&&!t.startsWith(r)?null:t===e?"":t.slice(r.length).split(ke.sep).join("/")}function ce(e){let n=e;for(;;)if(g.isParenthesizedExpression(n))n=n.expression;else if(g.isBinaryExpression(n)&&n.operatorToken.kind===g.SyntaxKind.CommaToken)n=n.right;else return n}function en(e){return g.isPropertyAccessExpression(e)?{receiver:ce(e.expression),name:e.name.text}:g.isElementAccessExpression(e)&&g.isStringLiteralLike(e.argumentExpression)?{receiver:ce(e.expression),name:e.argumentExpression.text}:null}function Pn(e){let n=ce(e.expression);if(g.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===g.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=en(n);if(t!==null){if(t.name==="require"&&g.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(g.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let r=e.arguments[1];return{specifierArg:r!==void 0&&g.isArrayLiteralExpression(r)?r.elements[0]:void 0}}}}return null}function Cr(e){let n=[],t=r=>{if(g.isImportDeclaration(r)&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.importClause?.isTypeOnly!==!0});else if(g.isImportEqualsDeclaration(r)&&g.isExternalModuleReference(r.moduleReference)&&g.isStringLiteralLike(r.moduleReference.expression))n.push({text:r.moduleReference.expression.text,runtime:!0});else if(g.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.isTypeOnly!==!0});else if(g.isCallExpression(r)){let i=Pn(r),s=i?.specifierArg;i!==null&&s!==void 0&&g.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}g.forEachChild(r,t)};return t(e),n}function Wa(e,n){let t=n===g.ScriptKind.TSX?"__scriptkind_probe.tsx":n===g.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",r=g.createSourceFile(t,e,g.ScriptTarget.ES2020,!0,n),i={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:l=>l===t?r:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:l=>l,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:l=>l===t,readFile:l=>l===t?e:void 0};return g.createProgram({rootNames:[t],options:i,host:s}).getSyntacticDiagnostics(r).length}function Xt(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Or(e){let n=0,t=r=>{(g.isCallExpression(r)||g.isNewExpression(r)||g.isTaggedTemplateExpression(r))&&(n+=1),g.forEachChild(r,t)};return t(e),n}function $r(e,n){let t=Cr(g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0));if(!Xt(e)||!n.includes("<")||!n.includes("require"))return t;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX),i=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Cr(r)){let l=`${s.runtime?"R":"T"}:${s.text}`;i.has(l)||(i.add(l),t.push(s))}return t}function Rr(e,n,t,r,i){if(!n.includes("require")&&!n.includes("import("))return[];let s=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0),l=un(s,e,i),a=[],o=new Set;return Pr(s,c=>{for(let u of tt(c,l,t,Ge,r))o.has(u)||(o.add(u),a.push(u))}),a}function Pr(e,n){let t=r=>{if(g.isCallExpression(r)){let i=Pn(r),s=i?.specifierArg;i!==null&&s!==void 0&&!g.isStringLiteralLike(s)&&n(s)}g.forEachChild(r,t)};t(e)}function Ga(e){let n=[];for(let t of e){let r=un(t.sf,t.real);Pr(t.sf,i=>{let s=Rn(i,r);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var Xa=4,qt=rt,Ht=new Set(["eval","Function","createRequire"]),Ja=new Set(["require","eval","Function","createRequire"]),at=new Set(["module","Module","require","process","global","globalThis"]),lt=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function Ya(e){return e===g.SyntaxKind.LessThanToken||e===g.SyntaxKind.GreaterThanToken||e===g.SyntaxKind.LessThanEqualsToken||e===g.SyntaxKind.GreaterThanEqualsToken||e===g.SyntaxKind.EqualsEqualsToken||e===g.SyntaxKind.EqualsEqualsEqualsToken||e===g.SyntaxKind.ExclamationEqualsToken||e===g.SyntaxKind.ExclamationEqualsEqualsToken||e===g.SyntaxKind.InstanceOfKeyword||e===g.SyntaxKind.InKeyword}function Qa(e){let n=e.parent;return(g.isParameter(n)||g.isVariableDeclaration(n)||g.isBindingElement(n)||g.isFunctionDeclaration(n)||g.isFunctionExpression(n)||g.isClassDeclaration(n)||g.isClassExpression(n)||g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isMethodDeclaration(n))&&n.name===e?!0:g.isPropertyAccessExpression(n)&&n.name===e}function Za(e,n){return g.isCallExpression(n)&&n.expression===e||(g.isPropertyAccessExpression(n)||g.isElementAccessExpression(n))&&n.expression===e||g.isTypeOfExpression(n)||g.isVoidExpression(n)||g.isDeleteExpression(n)||g.isPrefixUnaryExpression(n)||g.isPostfixUnaryExpression(n)?!0:g.isBinaryExpression(n)&&Ya(n.operatorToken.kind)}function Lr(e){let n=e,t=e.parent;for(;;)if(g.isParenthesizedExpression(t))n=t,t=t.parent;else if(g.isBinaryExpression(t)&&t.operatorToken.kind===g.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Za(n,t)}function el(e){return Qa(e)?!1:Lr(e)}function Tr(e){let n=en(e);if(n!==null&&lt.has(n.name))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=ce(e.expression);if(g.isIdentifier(t)&&at.has(t.text))return!0}return!1}function Mn(e){let n=en(e);if(n===null||n.name!=="constructor")return!1;let t=en(n.receiver);return t!==null&&t.name==="constructor"}function Dr(e){if(!g.isCallExpression(e))return!1;let n=ce(e.expression);if(!g.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&g.isStringLiteralLike(t)&&t.text==="module"}var nl={roots:new Map,nodes:new Set,saturated:!1};function Fr(e){return g.isSourceFile(e)||g.isFunctionDeclaration(e)||g.isFunctionExpression(e)||g.isArrowFunction(e)||g.isMethodDeclaration(e)||g.isConstructorDeclaration(e)||g.isGetAccessorDeclaration(e)||g.isSetAccessorDeclaration(e)||g.isClassStaticBlockDeclaration(e)||g.isModuleDeclaration(e)}function Kr(e,n){let t=e.parent;for(;t!==void 0;){if(Fr(t))return t;t=t.parent}return n}function tl(e){let n=new Set;if(g.isFunctionLike(e))for(let r of e.parameters)for(let i of $n(r.name))n.add(i);let t=[e];for(;t.length>0;){let r=t.pop();if(r===void 0)break;if(!(r!==e&&Fr(r))){if(g.isVariableDeclaration(r)&&g.isVariableDeclarationList(r.parent)&&!((r.parent.flags&g.NodeFlags.BlockScoped)!==0))for(let s of $n(r.name))n.add(s);g.forEachChild(r,i=>{t.push(i)})}}return n}function il(e,n,t){let r=Kr(e,n);if(g.isSourceFile(r))return n;let i=t.get(r);return i===void 0&&(i=tl(r),t.set(r,i)),i.has(e.text)?r:n}function st(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let r=n;for(;;){if(t.has(r))return!0;let i=r.parent;if(i===void 0)return!g.isSourceFile(r);r=i}}var rl=12,sl=8;function ot(e,n){let t=ce(e);for(;;){if(n.nodes.has(t))return!0;if(g.isIdentifier(t))return at.has(t.text)||st(n,t);if(g.isCallExpression(t))return Dr(t);let r=en(t);if(r!==null){if(r.name==="constructor")return!0;t=r.receiver;continue}if(g.isElementAccessExpression(t)){t=ce(t.expression);continue}return!1}}function jr(e){let n=en(ce(e.expression));if(n===null||n.name!=="get"||!g.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function ol(e,n){let t=jr(e);if(t===null||!ot(t.target,n))return!1;let r=t.key;return r===void 0||!g.isStringLiteralLike(r)?!0:lt.has(r.text)}function Wt(e){if(!g.isFunctionExpression(e)&&!g.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,r=i=>{if(!(t||g.isFunctionExpression(i)||g.isFunctionDeclaration(i)||g.isClassLike(i))){if(g.isReturnStatement(i)&&i.expression!==void 0&&ce(i.expression).kind===g.SyntaxKind.ThisKeyword){t=!0;return}g.forEachChild(i,r)}};return r(n),t}function $n(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isOmittedExpression(t)||n.push(...$n(t.name));return n}function Br(e){return e.parameters.map(n=>$n(n.name))}function al(e){let n=new Map,t=new Set,r=(s,l)=>{let a={fn:l,slots:Br(l)},o=n.get(s);o===void 0?n.set(s,[a]):o.push(a),Wt(l)&&t.add(s)},i=s=>{if(g.isFunctionDeclaration(s)&&s.name!==void 0)r(s.name.text,s);else if(g.isVariableDeclaration(s)&&g.isIdentifier(s.name)&&s.initializer!==void 0){let l=ce(s.initializer);(g.isFunctionExpression(l)||g.isArrowFunction(l))&&r(s.name.text,l)}g.forEachChild(s,i)};return i(e),{params:n,thisReturning:t}}function ll(e){let n=new Map,t=new Set,r={roots:n,nodes:t},i=al(e),s=new Map,l=new Set(i.thisReturning),a=!0;for(let o=0;a;o+=1){if(o>=rl)return{roots:n,nodes:t,saturated:!0};a=!1;let c=(S,x)=>{x!==""&&!S.has(x)&&(S.add(x),a=!0)},u=(S,x)=>{if(S==="")return;let w=n.get(S);w===void 0&&(w=new Set,n.set(S,w)),w.has(x)||(w.add(x),a=!0)},f=S=>{t.has(S)||(t.add(S),a=!0)},m=(S,x)=>{let w=ce(S.expression);if(g.isIdentifier(w)&&Ht.has(w.text)||Mn(w)||g.isCallExpression(S)&&Dr(S)||Wt(w))return!0;let _=en(w);if(_!==null&&(_.name==="call"||_.name==="apply"||_.name==="bind")){let $=_.receiver;if(Wt($)||t.has($)||g.isIdentifier($)&&(st(r,$)||l.has($.text)))return!0}if(t.has(w)||(g.isCallExpression(w)||g.isNewExpression(w))&&m(w,x+1)||g.isIdentifier(w)&&(st(r,w)||l.has(w.text)))return!0;if(g.isCallExpression(S)){let $=jr(S);if($!==null&&ot($.target,r))return!0}return!1},h=(S,x)=>{if(x>=sl)return!0;let w=ce(S);if(t.has(w))return!0;if(g.isIdentifier(w))return at.has(w.text)||st(r,w);if(g.isBinaryExpression(w)){let _=w.operatorToken.kind;return _===g.SyntaxKind.BarBarToken||_===g.SyntaxKind.AmpersandAmpersandToken||_===g.SyntaxKind.QuestionQuestionToken?h(w.left,x+1)||h(w.right,x+1):!1}return g.isConditionalExpression(w)?h(w.whenTrue,x+1)||h(w.whenFalse,x+1):g.isPropertyAccessExpression(w)||g.isElementAccessExpression(w)?ot(w,r):g.isCallExpression(w)||g.isNewExpression(w)?m(w,x+1):!1},b=(S,x)=>{if((g.isVariableDeclaration(S)||g.isParameter(S)||g.isBindingElement(S))&&S.initializer!==void 0){if(h(S.initializer,0)){let _=Kr(S,e);for(let $ of $n(S.name))u($,_)}}else if(g.isBinaryExpression(S)&&S.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(S.left)&&h(S.right,0))u(S.left.text,il(S.left,e,s));else if(g.isReturnStatement(S)&&S.expression!==void 0&&x!==void 0&&h(S.expression,0))c(l,x);else if(g.isCallExpression(S)||g.isNewExpression(S)){m(S,0)&&f(S);let _=ce(S.expression),$=en(_),N=$!==null&&$.name==="call",k=$!==null&&$.name==="apply",p=N||k?$.receiver:_,y=N?1:0,A=[];g.isFunctionExpression(p)||g.isArrowFunction(p)?A.push({fn:p,slots:Br(p)}):g.isIdentifier(p)&&A.push(...i.params.get(p.text)??[]);let L=S.arguments??[];if(k){let U=L[1]===void 0?void 0:ce(L[1]);for(let{fn:I,slots:C}of A)if(U!==void 0&&g.isArrayLiteralExpression(U))for(let K=0;K<U.elements.length;K+=1){let R=U.elements[K],O=C[K];if(!(R===void 0||O===void 0)&&h(R,0))for(let V of O)u(V,I)}else if(U!==void 0)for(let K of C)for(let R of K)u(R,I)}else for(let{fn:U,slots:I}of A)for(let C=y;C<L.length;C+=1){let K=L[C],R=I[C-y];if(!(K===void 0||R===void 0)&&h(K,0))for(let O of R)u(O,U)}}let w=x;if(g.isFunctionDeclaration(S))w=S.name?.text;else if(g.isFunctionExpression(S)||g.isArrowFunction(S)){let _=S.parent;w=g.isVariableDeclaration(_)&&g.isIdentifier(_.name)?_.name.text:void 0}g.forEachChild(S,_=>b(_,w))};b(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function dl(e){if(g.isIdentifier(e)&&Ht.has(e.text)||Mn(e))return!0;let n=en(e);if(n!==null&&(lt.has(n.name)||(n.name==="call"||n.name==="apply")&&(g.isIdentifier(n.receiver)&&Ht.has(n.receiver.text)||Mn(n.receiver)||(g.isPropertyAccessExpression(n.receiver)||g.isElementAccessExpression(n.receiver))&&Tr(n.receiver))))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=ce(e.expression);if(g.isIdentifier(t)&&at.has(t.text))return!0}return!1}var cl=4;function Mr(e,n){for(let t of e){if(!g.isStringLiteralLike(t)||n>=cl)return!0;let r=g.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,g.ScriptTarget.Latest,!0),i=r.parseDiagnostics;if(i!==void 0&&i.length>0||Gt(r,n+1,!0))return!0}return!1}function Gt(e,n=0,t=!1){let r=!1,i=t?nl:ll(e);if(i.saturated)return!0;let s=a=>g.isElementAccessExpression(a)&&!g.isStringLiteralLike(a.argumentExpression)&&rt(ue(a.expression),i),l=a=>{if(!r){if(t&&(g.isCallExpression(a)||g.isNewExpression(a)||g.isTaggedTemplateExpression(a))){r=!0;return}if(g.isCallExpression(a)){let o=Pn(a);if(o!==null){let c=o.specifierArg;if(c===void 0||!g.isStringLiteralLike(c)||t){r=!0;return}}else{let c=ue(a.expression);if(g.isIdentifier(c)&&(c.text==="eval"||c.text==="Function")){if(Mr(a.arguments,n)){r=!0;return}}else if(dl(c)){r=!0;return}else if(s(c)){r=!0;return}else if(ol(a,i)){r=!0;return}}}else if(g.isNewExpression(a)){let o=ue(a.expression);if(g.isIdentifier(o)&&o.text==="Function"){if(Mr(a.arguments??[],n)){r=!0;return}}else if(Mn(o)){r=!0;return}}else if(g.isIdentifier(a)&&Ja.has(a.text)&&el(a)){r=!0;return}else if((g.isPropertyAccessExpression(a)||g.isElementAccessExpression(a))&&(Tr(a)||Mn(a)||s(a))&&Lr(a)){r=!0;return}else if(g.isBindingElement(a)){let o=a.propertyName??a.name,c=g.isIdentifier(o)||g.isStringLiteralLike(o)?o.text:g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?o.expression.text:void 0;if(c!==void 0&&ot.has(c)){r=!0;return}}g.forEachChild(a,l)}};return l(e),r}function zr(e,n,t){if(Gt(t))return!0;if(!Xt(e)||!n.includes("<")||!n.includes("require"))return!1;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);return Gt(r)}function ul(e,n,t){if(Ha(e))return!0;let r=t.endsWith(Ee.sep)?t:t+Ee.sep,i=e.split("/"),s=n;for(;;){let l=Ee.join(s,"node_modules",...i),a;try{a=fn(Ee.join(l,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(r))return!1;let c=Ne(a);if(c===null)return!1;let u;try{u=JSON.parse(c).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(mr(l))return!1;if(s===t)break;let o=Ee.dirname(s);if(o===s||o!==t&&!o.startsWith(r))break;s=o}return!0}function fl(e,n){let t=n.endsWith(Ee.sep)?n:n+Ee.sep,r=Ee.dirname(e);for(;;){let i=Ee.join(r,"package.json"),s;try{s=fn(i)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let a=Ne(s);if(a!==null)try{let o=JSON.parse(a).name;if(typeof o=="string"&&o.length>0)return o}catch{return null}}if(r===n)break;let l=Ee.dirname(r);if(l===r||l!==n&&!l.startsWith(t))break;r=l}return null}function pl(e,n,t,r,i){let s=[],l=[],a=new Set,o={},c=new Set,u=new Set,f=[],m=!1,h=(S,x)=>{let w;try{w=fn(x)}catch{return!1}let A=Ge(e,w);if(A===null)return i.push({code:"out-of-root",path:w,detail:"dependency module resolved outside the app root; not followed"}),!1;let $=!t.has(w)&&!u.has(w);return $&&u.size>=qt?(m=!0,!1):(l.push({from:S,to:{module:A}}),$?(u.add(w),s.push(A),!0):!1)},b=(S,x)=>{if(a.add(x),c.has(x))return;c.add(x);let w=Te(x,S,We,n);if(w!==null&&!Ke(w)){if(h({surface:x},w)){f.push(w);try{let A=Ge(e,fn(w)),$=fl(w,e);A!==null&&$!==null&&(o[A]=$)}catch{}}return}ul(x,Ee.dirname(S),e)||i.push({code:"unresolved-specifier",path:x,detail:`dependency "${x}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let S of r)b(S.containingFile,S.packageName);for(;f.length>0&&u.size<qt;){let S=f.pop();if(S===void 0)break;let x=Ge(e,S);if(x===null)continue;let w=xn(S,tn);if(w.kind==="too-large"){i.push({code:"limit-exceeded",path:x,detail:`dependency module over the ${String(tn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(w.kind==="not-regular"){i.push({code:"parse-error",path:x,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let A=g.createSourceFile(S,w.text,g.ScriptTarget.ES2020,!0),$=A.parseDiagnostics;if($!==void 0&&$.length>0){i.push({code:"dependency-body",path:x,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}if(zr(S,w.text,A)){i.push({code:"dependency-body",path:x,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)"});continue}i.push({code:"dependency-body",path:x,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:x});for(let N of $r(S,w.text))if(N.runtime)if(me(N.text)==="package-root"){let k=qe(N.text);l.push({from:{module:x},to:{surface:k}}),b(S,k)}else{let k=Te(N.text,S,We,n);if(k===null){me(N.text)==="package-subpath"&&i.push({code:"unresolved-specifier",path:x,detail:`runtime package-subpath import "${N.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`});continue}if(Ke(k)){let p=Ge(e,k);i.push({code:p===null?"out-of-root":"declaration-shadow",path:x,detail:p===null?`runtime import "${N.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${N.text}" resolved to the declaration file "${p}" with no co-located runtime module; its code was not analyzed`});continue}h({module:x},k)&&f.push(k)}}return(m||f.length>0)&&i.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(qt)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:l,surfacePackages:[...a],entryRealNames:o}}function Ur(e,n,t=!1){let r=fn(e),i=[],s=g.createCompilerHost(We,!0),l=t?yr(r,We,s):()=>null,a=new Set,o=new Set,c=n.map(I=>Ee.join(r,I)),u=[],f=new Map,m=new Map,h=new Map,b=new Map,S=new Set,x=(I,C)=>{let K=`${String(I.length)}:${I}${C}`;S.has(K)||(S.add(K),i.push({code:"unresolved-specifier",path:I,detail:C}))},w=()=>null,A=0,$=(I,C)=>{let K=m.get(I);return K===void 0&&(K=g.createSourceFile(I,C,g.ScriptTarget.ES2020,!0),m.set(I,K)),{real:I,sf:K}};for(;o.size<tt;){let I=c.pop();if(I===void 0){if(A>=Xa)break;A+=1;let R=[];for(let[J,j]of f)j.includes("readdir")&&(j.includes("require")||j.includes("import("))&&R.push($(J,j));let V=Ga(R);if(V.length===0)break;let X=[];for(let[J,j]of f)X.push($(J,j));w=Nr(X,V,We,s,h);let te=!1;for(let J of R){let j=f.get(J.real);if(j!==void 0)for(let H of Rr(J.real,j,r,s,w))o.has(H)||(c.push(H),te=!0)}if(!te)break;continue}let C;try{C=fn(I)}catch{continue}if(o.has(C))continue;if(o.add(C),Ge(r,C)===null){i.push({code:"out-of-root",path:I,detail:"resolved outside app root"});continue}let K=xn(C,tn);if(K.kind==="too-large"){i.push({code:"limit-exceeded",path:C,detail:`file is ${String(Math.round(K.bytes/1048576))}MiB, over the ${String(tn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(K.kind==="not-regular"){i.push({code:"parse-error",path:C,detail:"unreadable or not a regular file"});continue}let M=K.text;a.add(C),f.set(C,M);for(let R of $r(C,M)){let V=R.runtime?l(R.text,C):null;if(V===null&&me(R.text)==="package-root"){R.runtime&&u.push({containingFile:C,packageName:qe(R.text)});continue}let X=V??Te(R.text,C,We,s);if(X===null){if(R.runtime){let te=me(R.text);if(te==="package-subpath")x(C,`runtime package-subpath import "${R.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`);else if(te==="relative"){let J=gr(R.text,C,r,b);J.kind==="unanalyzable"&&x(C,`runtime relative import "${R.text}" did not resolve and its absence could not be proven \u2014 ${J.reason}; a bundler/loader may load a module the analyzer never saw`)}}continue}if(Ge(r,X)===null){i.push({code:"out-of-root",path:X,detail:`specifier "${R.text}" resolved outside app root`});continue}if(R.runtime&&Ke(X)){i.push({code:"declaration-shadow",path:X,detail:`runtime import "${R.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(R.runtime&&!Yn(X)){i.push({code:"unanalyzable-module",path:X,detail:`runtime import "${R.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(X)}for(let R of Rr(C,M,r,s,w))o.has(R)||c.push(R)}o.size>=tt&&c.length>0&&i.push({code:"limit-exceeded",path:r,detail:`reachable file set exceeds ${String(tt)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let N=pl(r,s,a,u,i),k=g.createProgram({rootNames:[...a],options:We,host:s}),p=new Set,y=new Map;for(let I of k.getSourceFiles()){if(I.isDeclarationFile||k.isSourceFileDefaultLibrary(I)||Ge(r,I.fileName)===null||!Xt(I.fileName))continue;let C=k.getSyntacticDiagnostics(I).length>0;if(!C&&!I.text.includes("<")||Wa(I.text,g.ScriptKind.TSX)!==0)continue;let K=g.createSourceFile(I.fileName,I.text,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);(C||Or(K)>Or(I))&&(p.add(I.fileName),y.set(I.fileName,I.text))}let _=k;if(p.size>0){let I=s.getSourceFile.bind(s);s.getSourceFile=(C,K,M,R)=>{let V=y.get(C);return V!==void 0?g.createSourceFile(C,V,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX):I(C,K,M,R)},_=g.createProgram({rootNames:[...a],options:We,host:s,oldProgram:k})}let L=_.getTypeChecker(),z=[];for(let I of _.getSourceFiles()){if(I.isDeclarationFile||_.isSourceFileDefaultLibrary(I)||Ge(r,I.fileName)===null)continue;z.push(I);let C=_.getSyntacticDiagnostics(I);if(C.length>0){let M=C[0],R=M!==void 0?g.flattenDiagnosticMessageText(M.messageText," "):"syntax error";i.push({code:"parse-error",path:I.fileName,detail:`${String(C.length)} syntax error(s): ${R}`})}let K=Ge(r,I.fileName);K!==null&&zr(I.fileName,I.text,I)&&i.push({code:"loader-escape",path:K,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)"})}return{program:_,checker:L,host:s,options:We,appRoot:r,sourceFiles:z,diagnostics:i,depReach:N,resolveParamDirs:w,toRel:I=>Ge(r,I)}}import{existsSync as ml}from"node:fs";import hl from"node:path";var gl=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/"},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/"},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/"},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/"},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/"},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads"}],yl=["dependencies","devDependencies"];function xl(e,n){for(let t of yl){let r=e[t];if(!(typeof r!="object"||r===null||Array.isArray(r))&&Object.hasOwn(r,n))return!0}return!1}function Jt(e,n){if(n===null)return null;for(let t of gl)if(xl(n,t.dependency)){for(let r of t.configFiles)if(ml(hl.join(e,r)))return{name:t.name,configFile:r,entryHint:t.entryHint}}return null}function Yt(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}function Xe(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let r of n){let i=r.codePointAt(0)??0;t+=i<32||i>=127&&i<=159?`\\x${i.toString(16).padStart(2,"0")}`:r}return t}function Sl(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function bl(e){let n=[],t="";for(let r of e){if(r===" "||r==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=r}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var kl=/^[A-Za-z_][A-Za-z0-9_]*=/u;function El(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var wl=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),vl=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),Il=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function qr(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Vr(e){if(qr(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return Il.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:wl.has(t)||n!==-1&&vl.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var _l=[".js",".cjs",".mjs",".ts",".mts",".cts"];function Al(e){return _l.some(n=>e.endsWith(n))}var Nl=new Set(["npm","yarn","pnpm"]);function Cl(e){let n=e[0];return n===void 0||!Nl.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Qt(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(Sl(n))return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let t=bl(n);if(t===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let r=0;for(t[r]==="env"&&(r+=1);r<t.length;r+=1){let l=t[r];if(l===void 0||!kl.test(l))break;if(qr(l))return{kind:"unparsed",reason:`environment \`${Xe(l)}\` preloads another module; the launch surface is more than one file`};let a=l.indexOf("=");if(l.slice(0,a)==="NODE_OPTIONS")for(let o of l.slice(a+1).split(/\s+/u)){if(o===""||!o.startsWith("-"))continue;let c=Vr(o);if(c!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Xe(c.token)}\` ${c.why}`}}}let i=t[r];if(i===void 0)return{kind:"unparsed",reason:"no program in the command"};if(Cl(t.slice(r)))return{kind:"delegates",target:"scripts.start"};if(!El(i))return{kind:"unparsed",reason:`runs \`${Xe(i)}\`, not node directly \u2014 the entry file cannot be identified`};for(r+=1;r<t.length;r+=1){let l=t[r];if(l===void 0||!l.startsWith("-"))break;let a=Vr(l);if(a!==null)return{kind:"unparsed",reason:`node flag \`${Xe(a.token)}\` ${a.why}`}}let s=t[r];return s===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:Al(s)?{kind:"file",specifier:s}:{kind:"unparsed",reason:`\`${Xe(s)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Ol(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Rl=64;function Zt(e){let n=e.split(`
-`),t=n.length>64,r=[],i=0;for(let s of n.slice(0,64)){let l=s.trim();if(l.length===0||l.startsWith("#"))continue;let a=l.indexOf(":");if(a<=0)continue;let o=l.slice(a+1).trim();if(o.length===0)continue;let c=l.slice(0,a);if(c.length>Rl||!Ol(c)){i+=1;continue}r.push({name:c,command:o})}return r.sort((s,l)=>s.name===l.name?0:s.name==="web"?-1:l.name==="web"?1:0),{entries:r,truncated:t,unnamedLines:i}}import{realpathSync as Hr}from"node:fs";import Oe from"node:path";import d from"typescript";var Wr=3;function ne(e,n,t){if(e===void 0)return;let r=e[n]??={fired:0,refused:{}};t===null?r.fired+=1:r.refused[t]=(r.refused[t]??0)+1}function sn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var lt=16,ti=256,ei=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.fns.has(r)||(this.moduleFor(n),this.fns.set(r,{id:i,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),i}classFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.classNodes.has(r)||(this.moduleFor(n),this.classNodes.set(r,{id:i,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(r,[])),i}methodFor(n,t,r,i){let s=`${n}#${t}.${r}`,l=`pkg:${n}#${t}.${r}`;if(!this.fns.has(s)){let a=this.classFor(n,t);this.fns.set(s,{id:l,moduleId:`pkg:${n}`,name:r,kind:i,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(l)}return l}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function ts(e,n){let t="node_modules/",r=e.lastIndexOf(t);if(r===-1)return n;let s=e.slice(r+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function Gr(e,n,t){let r=Oe.dirname(e),i=Oe.dirname(n),s=[];for(;;){let a=t.get(r);if(a!==void 0){for(let c of s)t.set(c,a);return a}s.push(r);let o=Ne(Oe.join(r,"package.json"));if(o!==null)try{let c=JSON.parse(o),u={name:c.name??"app",version:c.version??"0.0.0",dir:r};for(let f of s)t.set(f,u);return u}catch{}if(r===i||r===Oe.dirname(r))break;r=Oe.dirname(r)}let l={name:"app",version:"0.0.0",dir:null};for(let a of s)t.set(a,l);return l}function Ml(e){let n=[],t=r=>{if(d.isImportDeclaration(r)&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isImportEqualsDeclaration(r)&&d.isExternalModuleReference(r.moduleReference)&&d.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isCallExpression(r)){let i=Pn(r);if(i!==null){let s=i.specifierArg,l=s!==void 0&&d.isStringLiteralLike(s);n.push({specifier:l?s.text:void 0,specifierIsLiteral:l,dynamic:!0,...s!==void 0&&!l?{computedArg:s,loadPos:r.getStart(e)}:{}})}}d.forEachChild(r,t)};return t(e),n}function $l(e,n,t){let r=new Map,i=Gr(Oe.join(e.appRoot,"package.json"),e.appRoot,r),s=[],l=[],a=[],o=new Map,c=new Set,u=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&u.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let h=Gr(f.fileName,e.appRoot,r),b=ts(m,i.name),S=m.includes("node_modules/");s.push({id:m,packageName:S&&h.name!==i.name?h.name:b,versionRange:h.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),h.dir===i.dir&&c.add(m);let x=0,w=null;for(let A of Ml(f)){let $=`${m}#import${String(x)}`;x+=1;let N=null;if(A.specifier!==void 0)if(me(A.specifier)==="package-root")N=t.moduleFor(qe(A.specifier));else{let k=Te(A.specifier,f.fileName,e.options,e.host),p=k!==null?e.toRel(k):null;p!==null&&(N=p)}if(l.push({id:$,moduleId:m,specifier:A.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:A.dynamic,specifierIsLiteral:A.specifierIsLiteral,...N!==null?{resolvedModuleId:N}:{}}),N!==null&&a.push({importId:$,resolvedModuleId:N}),A.computedArg!==void 0&&A.loadPos!==void 0){w??=un(f,f.fileName,e.resolveParamDirs);let k=[];for(let p of et(A.computedArg,w,e.appRoot,e.options,e.host)){let y=e.toRel(p);if(y===null||!u.has(y))continue;let _=y,L=`${m}#import${String(x)}`;x+=1,l.push({id:L,moduleId:m,specifier:y,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:_}),a.push({importId:L,resolvedModuleId:_}),k.push(y)}if(k.length>0){let p=Rn(A.computedArg,w)!==null||Zn(A.computedArg),y=o.get(m)??[];y.push({pos:A.loadPos,candidateRels:k,seedable:p}),o.set(m,y)}}}}return{modules:s,imports:l,importEdges:a,computedLoads:o,appOwnedPaths:c}}function Pl(e){let n=Ne(e);if(n===null)return null;let t=d.createSourceFile(e,n,d.ScriptTarget.Latest,!0),r=i=>t.statements.some(s=>d.isFunctionDeclaration(s)?s.name?.text===i:d.isVariableStatement(s)?s.declarationList.declarations.some(l=>d.isIdentifier(l.name)&&l.name.text===i&&l.initializer!==void 0&&(d.isFunctionExpression(l.initializer)||d.isArrowFunction(l.initializer))):!1);for(let i of t.statements){if(d.isFunctionDeclaration(i)&&i.name!==void 0&&i.modifiers?.some(l=>l.kind===d.SyntaxKind.DefaultKeyword)===!0)return i.name.text;if(!d.isExpressionStatement(i)||!d.isBinaryExpression(i.expression))continue;let s=i.expression;if(s.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ll(s.left)){if(d.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(d.isIdentifier(s.right)&&r(s.right.text))return s.right.text}}return null}function Ll(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Tl(e,n,t){for(let c of e.surfacePackages)n.moduleFor(c);let r=c=>"surface"in c?n.moduleFor(c.surface):c.module,i=[],s=new Set;for(let c of e.modules)t.has(c)||s.has(c)||(s.add(c),i.push({id:c,packageName:e.entryRealNames[c]??ts(c,"app"),versionRange:"",path:c,moduleSystem:"cjs",isEntrypoint:!1}));let l=[],a=[],o=0;for(let c of e.edges){let u=r(c.from),f=r(c.to),m=`${String(u)}#depreach${String(o)}`;o+=1,l.push({id:m,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),a.push({importId:m,resolvedModuleId:f})}return{modules:i,imports:l,importEdges:a}}function Xr(e,n,t){let r=e.expression;if(d.isIdentifier(r)&&!t.has(r.text)){let i=n.get(r.text);if(i?.kind==="package-export")return{kind:"package-instance",packageName:i.packageName,className:i.exportName};if(i?.kind==="app-class")return{kind:"app-instance",cls:i.cls}}else if(d.isPropertyAccessExpression(r)&&d.isIdentifier(r.expression)&&!t.has(r.expression.text)){let i=n.get(r.expression.text);if(i?.kind==="package-surface")return{kind:"package-instance",packageName:i.packageName,className:r.name.text}}return null}function pn(e){return d.canHaveModifiers(e)&&(d.getModifiers(e)?.some(n=>n.kind===d.SyntaxKind.ExportKeyword)??!1)}function Dl(e){let n=new Set,t;for(let r of e.statements){if(d.isExpressionStatement(r)&&d.isBinaryExpression(r.expression)){let i=r.expression;if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(i.left)&&d.isIdentifier(i.left.expression)&&i.left.expression.text==="module"&&i.left.name.text==="exports"){if(d.isIdentifier(i.right))n.add(i.right.text),t=i.right.text;else if(d.isObjectLiteralExpression(i.right))for(let s of i.right.properties)d.isShorthandPropertyAssignment(s)?n.add(s.name.text):d.isPropertyAssignment(s)&&d.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(d.isFunctionDeclaration(r)&&r.name!==void 0&&pn(r))n.add(r.name.text);else if(d.isVariableStatement(r)&&pn(r))for(let i of r.declarationList.declarations)d.isIdentifier(i.name)&&n.add(i.name.text);else if(d.isExportDeclaration(r)&&r.exportClause&&d.isNamedExports(r.exportClause))for(let i of r.exportClause.elements)n.add((i.propertyName??i.name).text);else d.isExportAssignment(r)&&d.isIdentifier(r.expression)&&(n.add(r.expression.text),t=r.expression.text)}return{reachableLocals:n,defaultTarget:t}}function Fl(e){for(let n of e.statements){if(d.isFunctionDeclaration(n)&&n.name!==void 0&&pn(n)&&d.getModifiers(n)?.some(t=>t.kind===d.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(d.isExportAssignment(n)&&!n.isExportEquals&&d.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ie(t.left)&&d.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function Je(e){if(d.isCallExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&d.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function Ie(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function je(e){if(Ie(e))return!0;if(!d.isPropertyAccessExpression(e)&&!d.isElementAccessExpression(e))return!1;let n=e.expression;return d.isIdentifier(n)&&n.text==="exports"?!0:Ie(n)}function kn(e){return d.isPropertyAccessExpression(e.expression)&&d.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function is(e){let n=!1,t=r=>{if(!n){if(d.isCallExpression(r)){let i=Je(r);if(i!==void 0&&me(i)!=="package-root"){n=!0;return}}d.forEachChild(r,t)}};return t(e),n}function rs(e){let n=new Set,t=i=>i!==void 0&&is(i),r=i=>{d.isVariableDeclaration(i)&&t(i.initializer)&&On(i.name,n),d.isBinaryExpression(i)&&i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(i.left)&&t(i.right)&&n.add(i.left.text),d.forEachChild(i,r)};return r(e),n}function ss(e,n){for(let t of e.properties)d.isShorthandPropertyAssignment(t)?n.add(t.name.text):d.isPropertyAssignment(t)&&d.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function Kl(e){let n=new Set;for(let a of e.statements)if(d.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(d.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(d.isVariableStatement(a))for(let o of a.declarationList.declarations)d.isIdentifier(o.name)&&o.initializer!==void 0&&(d.isFunctionExpression(o.initializer)||d.isArrowFunction(o.initializer)||d.isObjectLiteralExpression(o.initializer))&&n.add(o.name.text);let t=a=>d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isObjectLiteralExpression(a)||d.isIdentifier(a)&&n.has(a.text),r=new Set,i=a=>{d.isIdentifier(a)?r.add(a.text):d.isObjectLiteralExpression(a)&&ss(a,r)},s=!1,l=a=>{if(!s){if(d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken)if(Ie(a.left)){i(a.right);let o=a.right;(d.isObjectLiteralExpression(o)?o.properties.every(u=>d.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||d.isPropertyAssignment(u)&&t(u.initializer)):t(o))||(s=!0)}else je(a.left)&&(t(a.right)||(s=!0));else(d.isCallExpression(a)&&kn(a)&&a.arguments[0]!==void 0&&mn(a.arguments[0])||d.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(s=!0);s||d.forEachChild(a,l)}};if(l(e),!s&&r.size>0){for(let a of ds(e))if(r.has(a)){s=!0;break}}return s}function mn(e){return je(e)||d.isIdentifier(e)&&e.text==="exports"}function os(e){if(!d.isPropertyAccessExpression(e.expression)||!d.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function ii(e){return os(e)&&e.arguments[0]!==void 0&&mn(e.arguments[0])}function jl(e){return os(e)&&e.arguments[0]!==void 0&&d.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Bl(e){for(let n of e.declarations??[])if(d.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(d.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function zl(e,n,t,r,i){let s=(e.declarations??[]).filter(a=>!d.isSourceFile(a)&&!d.isModuleDeclaration(a));for(let a of s){let o=a.getSourceFile(),c=n.toRel(o.fileName);if(c===null||i.has(c))continue;let u=t.get(`${c}::${String(a.getStart(o,!1))}`);if(u!==void 0)return u}let l=e.getName();for(let a of s){let o=n.toRel(a.getSourceFile().fileName);if(o===null||i.has(o))continue;let c=r.get(`${o}::${l}`);if(c!==void 0)return c}}function dt(e){return d.isPropertyAccessExpression(e)?e.name.text:d.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var ri=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function si(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?dt(e):void 0;return n!==void 0&&n!=="__proto__"&&ri.test(n)?n:void 0}function Ul(e){return e!=="__proto__"&&ri.test(e)}function Jr(e){let n=ue(e);return d.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||Ie(n)}function Vl(e){if(!d.isArrayLiteralExpression(e)&&!d.isObjectLiteralExpression(e))return!1;let n=!1,t=r=>{n||(je(r)?n=!0:d.forEachChild(r,t))};return t(e),n}function oi(e){let n=!1,t=new Map,r=i=>{if(!n){if(d.isBinaryExpression(i)&&i.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(Ie(i.left)||d.isIdentifier(i.left)&&i.left.text==="exports")n=!0;else if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&Jr(i.right))n=!0;else if(Vl(i.left))n=!0;else if(je(i.left)){let s=si(i.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(d.isCallExpression(i)&&kn(i)&&i.arguments[0]!==void 0&&mn(i.arguments[0])||d.isCallExpression(i)&&ii(i)||d.isCallExpression(i)&&jl(i)||d.isVariableDeclaration(i)&&i.initializer!==void 0&&Jr(i.initializer))&&(n=!0);n||d.forEachChild(i,r)}};return r(e),{surfaceEscapes:n,assignCount:t}}function ai(e){let n=[];for(let t of e.statements){if(!d.isExpressionStatement(t)||!d.isBinaryExpression(t.expression))continue;let r=t.expression;r.operatorToken.kind===d.SyntaxKind.EqualsToken&&(!je(r.left)||Ie(r.left)||n.push({bin:r,name:si(r.left)}))}return n}function ql(e){let{surfaceEscapes:n,assignCount:t}=oi(e);if(n)return[];let r=[];for(let{bin:i,name:s}of ai(e))s===void 0||(t.get(s)??0)!==1||(d.isFunctionExpression(i.right)||d.isArrowFunction(i.right))&&r.push({name:s,value:i.right});return r}function Hl(e,n){let{surfaceEscapes:t,assignCount:r}=oi(e);if(t)return[];let i=[];for(let{bin:s,name:l}of ai(e))l===void 0||(r.get(l)??0)!==1||d.isIdentifier(s.right)&&!n.has(s.right.text)&&i.push(s.right.text);return i}function Wl(e,n){let{surfaceEscapes:t,assignCount:r}=oi(e);for(let{bin:i,name:s}of ai(e)){let l=i.right;if(!(d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isIdentifier(l)))continue;let o=d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isIdentifier(l)&&!n.has(l.text);if(!(!t&&s!==void 0&&(r.get(s)??0)===1&&o))return!0}return!1}function Gl(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&d.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Yr(e){let n=e.parent;return n===void 0?!1:d.isPropertyAccessExpression(n)?n.name===e:d.isQualifiedName(n)?n.right===e:d.isBindingElement(n)||d.isImportSpecifier(n)?n.propertyName===e:d.isExportSpecifier(n)?!0:d.isPropertyAssignment(n)||d.isPropertyDeclaration(n)||d.isPropertySignature(n)||d.isMethodDeclaration(n)||d.isMethodSignature(n)||d.isGetAccessorDeclaration(n)||d.isSetAccessorDeclaration(n)||d.isEnumMember(n)?n.name===e:!1}function Qr(e){for(let n=e.parent;n!==void 0;n=n.parent){if(d.isSourceFile(n))return!0;if(!d.isArrowFunction(n)&&(d.isFunctionLike(n)||d.isClassLike(n)))return!1}return!0}function Xl(e,n){let t=r=>{d.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&n.add(r),d.forEachChild(r,t)};t(e)}function Jl(e){let n=[],t=new Set;for(let s of e.statements){if(d.isExportDeclaration(s)||d.isExportAssignment(s)||d.isImportDeclaration(s)||d.isImportEqualsDeclaration(s)||pn(s))return null;if(!d.isExpressionStatement(s)||!d.isBinaryExpression(s.expression))continue;let l=s.expression;if(l.operatorToken.kind===d.SyntaxKind.EqualsToken){if(Ie(l.left))n.push({kind:"whole",value:l.right});else if(je(l.left)){let a=si(l.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:l.right,root:Gl(l.left)})}else continue;Xl(l.left,t)}}let r=!1,i=s=>{if(!r){if(d.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!Yr(s)){r=!0;return}if(s.kind===d.SyntaxKind.ThisKeyword&&Qr(s)){r=!0;return}if(d.isIdentifier(s)&&s.text==="arguments"&&!Yr(s)&&Qr(s)){r=!0;return}d.forEachChild(s,i)}};return i(e),r?null:n}function ni(e){return d.isIdentifier(e)||d.isStringLiteralLike(e)?e.text:void 0}function Zr(e,n,t){return d.isIdentifier(e)?n(e.text):t?.(e)}function Yl(e,n,t,r){let i=new Map,s=Jl(e);if(s===null||s.filter(h=>h.kind==="whole").length>1)return i;let l=s.findIndex(h=>h.kind==="whole"),a=(h,b)=>l>=0&&b>l&&h.kind==="member"&&h.root==="exports",o=s.some(a);if(o){let h=s[l];if(h===void 0||h.kind!=="whole"||!d.isObjectLiteralExpression(h.value))return i}let c=o?s.filter((h,b)=>!a(h,b)):s,u=new Map;for(let h of c)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let f=h=>n.has(h)?void 0:t(h),m=(h,b)=>{b===void 0?i.delete(h):i.set(h,b)};for(let h of c){if(h.kind==="member"){m(h.name,(u.get(h.name)??0)>1?void 0:Zr(h.value,f,r));continue}i.clear();let b=h.value;if(d.isObjectLiteralExpression(b))for(let S of b.properties){if(d.isSpreadAssignment(S))return new Map;if(d.isShorthandPropertyAssignment(S)){m(S.name.text,f(S.name.text));continue}let x=ni(S.name);if(x===void 0)return new Map;m(x,d.isPropertyAssignment(S)?Zr(S.initializer,f,r):void 0)}}return i}function as(e,n,t,r){let i=new Map,s=a=>a!==void 0&&me(a)==="relative"?t.get(`${n}::${a}`):void 0,l=a=>{if(d.isVariableDeclaration(a)&&a.initializer!==void 0){let o=a.initializer;if(d.isIdentifier(a.name)&&!r.has(a.name.text)){let c=s(Je(o));if(c!==void 0)i.set(a.name.text,{kind:"whole",target:c});else if((d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o))&&d.isCallExpression(o.expression)){let u=s(Je(o.expression)),f=dt(o);u!==void 0&&f!==void 0&&i.set(a.name.text,{kind:"member",target:u,member:f})}}else if(d.isObjectBindingPattern(a.name)){let c=s(Je(o));if(c!==void 0){for(let u of a.name.elements)if(d.isIdentifier(u.name)&&!r.has(u.name.text)){let f=u.propertyName!==void 0&&d.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;i.set(u.name.text,{kind:"member",target:c,member:f})}}}}d.forEachChild(a,l)};return l(e),i}function Ql(e,n,t,r){let i=l=>l!==void 0&&me(l)==="relative"?t.get(`${n}::${l}`):void 0,s=i(Je(e));if(s!==void 0)return{kind:"whole",target:s};if(d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)){let l=dt(e);if(l===void 0)return;let a=i(Je(e.expression));if(a!==void 0)return{kind:"member",target:a,member:l};if(d.isIdentifier(e.expression)){let o=r.get(e.expression.text);if(o?.kind==="whole")return{kind:"member",target:o.target,member:l}}return}if(d.isIdentifier(e))return r.get(e.text)}function ls(e,n,t,r,i){let s=[],l=!1,a=f=>{if(is(f))return!0;let m=!1,h=b=>{m||(d.isIdentifier(b)&&i.has(b.text)?m=!0:d.forEachChild(b,h))};return h(f),m},o=(f,m)=>{let h=Ql(f,n,t,r);h!==void 0?s.push({source:h,exportedName:m}):a(f)&&(l=!0)},c=f=>{if(d.isObjectLiteralExpression(f)){for(let m of f.properties)if(d.isSpreadAssignment(m))o(m.expression,"default");else if(d.isPropertyAssignment(m)){let h=d.isIdentifier(m.name)||d.isStringLiteralLike(m.name)?m.name.text:"default";o(m.initializer,h)}else if(d.isShorthandPropertyAssignment(m)){let h=r.get(m.name.text);h!==void 0&&s.push({source:h,exportedName:m.name.text})}return}o(f,"default")},u=f=>{if(d.isBinaryExpression(f)&&f.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(Ie(f.left)){c(f.right);return}if(je(f.left)){let m=d.isPropertyAccessExpression(f.left)?f.left.name.text:d.isElementAccessExpression(f.left)&&d.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";o(f.right,m);return}}else if(d.isExportAssignment(f)&&f.isExportEquals){o(f.expression,"default");return}else if(d.isCallExpression(f)&&kn(f)&&f.arguments[0]!==void 0&&mn(f.arguments[0])){for(let m of f.arguments.slice(1))c(m);return}d.forEachChild(f,u)};return u(e),{sources:s,residual:l}}function ds(e){let n=new Set,t=i=>{let s=i;for(;d.isPropertyAccessExpression(s)||d.isElementAccessExpression(s);)s=s.expression;return d.isIdentifier(s)?s.text:void 0},r=i=>{let s=cs(i);if(s!==void 0){let l=t(s);l!==void 0&&n.add(l)}d.forEachChild(i,r)};return r(e),n}function cs(e){return d.isBinaryExpression(e)&&e.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=d.SyntaxKind.LastAssignment&&(d.isPropertyAccessExpression(e.left)||d.isElementAccessExpression(e.left))?e.left:void 0}function at(e){if(d.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)d.isBindingElement(t)&&n.push(...at(t.name));return n}function ve(e){if(d.isIdentifier(e))return[e.text];if(d.isParenthesizedExpression(e)||d.isAsExpression(e)||d.isNonNullExpression(e)||d.isSatisfiesExpression(e)||d.isTypeAssertionExpression(e)||d.isAwaitExpression(e))return ve(e.expression);if(d.isYieldExpression(e))return e.expression!==void 0?ve(e.expression):[];if(d.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===d.SyntaxKind.BarBarToken||n===d.SyntaxKind.AmpersandAmpersandToken||n===d.SyntaxKind.QuestionQuestionToken?[...ve(e.left),...ve(e.right)]:n===d.SyntaxKind.CommaToken?ve(e.right):[]}return d.isConditionalExpression(e)?[...ve(e.whenTrue),...ve(e.whenFalse)]:d.isArrayLiteralExpression(e)?e.elements.flatMap(n=>d.isSpreadElement(n)?ve(n.expression):d.isOmittedExpression(n)?[]:ve(n)):d.isObjectLiteralExpression(e)?e.properties.flatMap(n=>d.isShorthandPropertyAssignment(n)?[n.name.text]:d.isPropertyAssignment(n)?ve(n.initializer):d.isSpreadAssignment(n)?ve(n.expression):[]):[]}function us(e,n){let t=[],r=(a,o)=>{for(let c of a)for(let u of o)c!==u&&t.push({a:c,b:u})},i=a=>d.isIdentifier(a)?[a.text]:d.isArrayLiteralExpression(a)?a.elements.flatMap(i):d.isObjectLiteralExpression(a)?a.properties.flatMap(o=>d.isShorthandPropertyAssignment(o)?[o.name.text]:d.isPropertyAssignment(o)?i(o.initializer):[]):[],s=a=>{d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken?r(i(a.left),ve(a.right)):d.isVariableDeclaration(a)&&a.initializer!==void 0?r(at(a.name),ve(a.initializer)):(d.isForOfStatement(a)||d.isForInStatement(a))&&d.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&r(at(a.initializer.declarations[0].name),ve(a.expression)),d.forEachChild(a,s)};s(e);let l=new Set(n);for(let a=!0;a;){a=!1;for(let{a:o,b:c}of t)l.has(o)&&!l.has(c)&&(l.add(c),a=!0),l.has(c)&&!l.has(o)&&(l.add(o),a=!0)}return l}function fs(e,n){let t=a=>{if(!d.isPropertyAccessExpression(a)&&!d.isElementAccessExpression(a))return;let o=a;for(;d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o);)o=o.expression;return d.isIdentifier(o)?o.text:void 0},r=[],i=(a,o)=>{for(let u of ve(o))r.push({name:a,root:u});let c=t(o);c!==void 0&&r.push({name:a,root:c})},s=a=>{d.isVariableDeclaration(a)&&d.isIdentifier(a.name)&&a.initializer!==void 0?i(a.name.text,a.initializer):d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(a.left)&&i(a.left.text,a.right),d.forEachChild(a,s)};s(e);let l=new Map(n);for(let a=!0;a;){a=!1;for(let{name:o,root:c}of r){let u=l.get(c);u!==void 0&&!l.has(o)&&(l.set(o,u),a=!0)}}return l}function ps(e){return us(e,ds(e))}function Zl(e,n){let t=o=>o>=d.SyntaxKind.FirstAssignment&&o<=d.SyntaxKind.LastAssignment,r=o=>{let c=o.parent;if(c===void 0||!d.isObjectLiteralExpression(c))return!1;let u=c.parent;return u!==void 0&&d.isBinaryExpression(u)&&u.operatorToken.kind===d.SyntaxKind.EqualsToken&&u.right===c&&je(u.left)?!0:u!==void 0&&d.isCallExpression(u)&&kn(u)&&u.arguments[0]!==void 0&&mn(u.arguments[0])&&u.arguments.indexOf(c)>0},i=(o,c)=>{if((d.isFunctionDeclaration(c)||d.isFunctionExpression(c))&&c.name===o||d.isVariableDeclaration(c)&&c.name===o||d.isParameter(c)&&c.name===o||d.isBindingElement(c)&&c.name===o||(d.isCallExpression(c)||d.isNewExpression(c))&&c.expression===o)return!0;if((d.isPropertyAccessExpression(c)||d.isElementAccessExpression(c))&&c.expression===o){let u=c;for(;u.parent!==void 0&&(d.isPropertyAccessExpression(u.parent)||d.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let f=u.parent;return!(f!==void 0&&d.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===u)}return d.isBinaryExpression(c)&&c.operatorToken.kind===d.SyntaxKind.EqualsToken&&c.right===o&&je(c.left)?!0:d.isShorthandPropertyAssignment(c)&&c.name===o||d.isPropertyAssignment(c)&&c.initializer===o?r(c):!!(d.isExportAssignment(c)&&c.expression===o||d.isExportSpecifier(c))},s=(o,c)=>d.isPropertyAccessExpression(c)&&c.name===o||d.isPropertyAssignment(c)&&c.name===o||(d.isMethodDeclaration(c)||d.isGetAccessorDeclaration(c)||d.isSetAccessorDeclaration(c))&&c.name===o,l=!1,a=(o,c)=>{if(!l){if(d.isIdentifier(o)&&c!==void 0&&n.has(o.text)&&!s(o,c)&&!i(o,c)){l=!0;return}d.forEachChild(o,u=>a(u,o))}};return a(e,void 0),l}function ed(e){let n=new Set;for(let o of e.statements)if(d.isFunctionDeclaration(o)&&o.name!==void 0)n.add(o.name.text);else if(d.isVariableStatement(o))for(let c of o.declarationList.declarations)d.isIdentifier(c.name)&&c.initializer!==void 0&&(d.isFunctionExpression(c.initializer)||d.isArrowFunction(c.initializer))&&n.add(c.name.text);let t=new Set,r=o=>{d.isBinaryExpression(o)&&o.operatorToken.kind===d.SyntaxKind.EqualsToken?(Ie(o.left)&&(d.isIdentifier(o.right)?t.add(o.right.text):d.isObjectLiteralExpression(o.right)&&ss(o.right,t)),Ie(o.right)&&d.isIdentifier(o.left)&&t.add(o.left.text)):d.isVariableDeclaration(o)&&d.isIdentifier(o.name)&&o.initializer!==void 0&&Ie(o.initializer)&&t.add(o.name.text),d.forEachChild(o,r)};if(r(e),t.size>0){if(Zl(e,t))return!0;let o=fs(e,new Map([...t].map(u=>[u,u]))),c=ps(e);for(let u of o.keys())if(c.has(u))return!0}let i=o=>d.isIdentifier(o)&&n.has(o.text),s=o=>o.properties.every(c=>d.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||d.isPropertyAssignment(c)&&i(c.initializer)),l=!1,a=o=>{if(!l){if(d.isBinaryExpression(o)){let c=o.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=d.SyntaxKind.LastAssignment;c&&Ie(o.left)?o.operatorToken.kind===d.SyntaxKind.EqualsToken&&(i(o.right)||d.isObjectLiteralExpression(o.right)&&s(o.right))||(l=!0):c&&je(o.left)&&(l=!0)}else d.isCallExpression(o)?(kn(o)&&o.arguments[0]!==void 0&&mn(o.arguments[0])||ii(o))&&(l=!0):(d.isExportAssignment(o)&&o.isExportEquals&&!d.isIdentifier(o.expression)||d.isExportDeclaration(o)&&o.moduleSpecifier!==void 0)&&(l=!0);l||d.forEachChild(o,a)}};return a(e),l}var nd=8;function es(e,n,t){let r=new Set,i=as(e,n,t,Sn(e)),s=ls(e,n,t,i,rs(e));for(let{source:l}of s.sources)r.add(l.target);for(let l of e.statements)if(d.isExportDeclaration(l)&&l.moduleSpecifier!==void 0&&d.isStringLiteralLike(l.moduleSpecifier)&&me(l.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${l.moduleSpecifier.text}`);a!==void 0&&r.add(a)}return r}function td(e,n,t,r=new Map){let i=new Set(n.modules.filter(k=>k.isEntrypoint).map(k=>String(k.id)));if(i.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(k=>k.externalSurface===!0).map(k=>String(k.id))),l=new Map,a=new Map,o=new Map,c=new Map;for(let k of t){if(k.name==="<toplevel>"){c.set(String(k.moduleId),k);continue}if(l.set(`${String(k.moduleId)}::${String(k.declRange.start)}`,k),k.name!==void 0&&a.set(`${String(k.moduleId)}::${k.name}`,k),k.isExported&&k.name!==void 0){let p=o.get(String(k.moduleId))??[];p.push(k),o.set(String(k.moduleId),p)}}if(r.size>0){let k=new Map(t.map(p=>[String(p.id),p]));for(let[p,y]of r){let _=k.get(String(y));_!==void 0&&!l.has(p)&&l.set(p,_)}}let u=new Map;for(let k of n.imports)k.resolvedModuleId!==void 0&&u.set(`${k.moduleId}::${k.specifier}`,String(k.resolvedModuleId));let f=new Map;for(let k of e.sourceFiles){let p=e.toRel(k.fileName);p!==null&&f.set(p,k)}let m=new Map,h=k=>{let p=m.get(k);if(p!==void 0)return p;let y=f.get(k),_=y===void 0?!0:ed(y);return m.set(k,_),_},b=new Set,S=(k,p)=>p!==void 0&&me(p)==="relative"?u.get(`${k}::${p}`):void 0,x=k=>{if(d.isIdentifier(k))return k.text;if(d.isPropertyAccessExpression(k)){let p=x(k.expression);return p===void 0?void 0:`${p}.${k.name.text}`}if(d.isElementAccessExpression(k)&&d.isStringLiteralLike(k.argumentExpression)){let p=x(k.expression);return p===void 0?void 0:`${p}.${k.argumentExpression.text}`}},w=k=>{let p=k;for(;d.isPropertyAccessExpression(p)||d.isElementAccessExpression(p);)p=p.expression;return Je(p)};for(let k of e.sourceFiles){let p=e.toRel(k.fileName);if(p===null)continue;let y=new Map,_=new Map,L=(C,K)=>{let M=S(p,Je(K));if(M!==void 0){if(d.isIdentifier(C))_.set(C.text,M),y.set(C.text,M);else if(d.isObjectBindingPattern(C)||d.isArrayBindingPattern(C))for(let R of at(C))_.set(R,M);else if(d.isPropertyAccessExpression(C)||d.isElementAccessExpression(C)){let R=x(C);R!==void 0&&y.set(R,M)}}},z=C=>{d.isVariableDeclaration(C)&&C.initializer!==void 0?L(C.name,C.initializer):d.isBinaryExpression(C)&&C.operatorToken.kind===d.SyntaxKind.EqualsToken&&L(C.left,C.right),d.forEachChild(C,z)};z(k);let I=C=>{let K=cs(C);if(K!==void 0){let M=K.expression,R=S(p,w(M));R!==void 0&&b.add(R);let V=x(M),X=V!==void 0?y.get(V):void 0;X!==void 0&&b.add(X)}d.forEachChild(C,I)};if(I(k),_.size>0){let C=fs(k,_),K=ps(k);for(let[M,R]of C)K.has(M)&&b.add(R)}}let A=[],$=[],N=[];for(let k of e.sourceFiles){let p=e.toRel(k.fileName);if(p===null||!i.has(p))continue;let y=e.checker.getSymbolAtLocation(k),_=new Set,L=new Set,z=0,I=(j,H)=>{if(s.has(String(j.moduleId))||_.has(String(j.id)))return;_.add(String(j.id));let fe=`${p}#reexport:${String(z)}:${H}`;z+=1,A.push({id:fe,moduleId:p,exportedName:H,kind:"value",reexportOf:{moduleId:String(j.moduleId),name:j.name??H}}),$.push({exportId:fe,target:{kind:"function",functionId:j.id}})},C=j=>{if(Bl(j))return;let H=j;if((j.flags&d.SymbolFlags.Alias)!==0)try{H=e.checker.getAliasedSymbol(j)}catch{return}let fe=zl(H,e,l,a,s);if(fe!==void 0){I(fe,j.getName());return}if((H.flags&d.SymbolFlags.Module)!==0&&!L.has(H)){L.add(H);try{for(let Re of e.checker.getExportsOfModule(H))C(Re)}catch{}}};if(y!==void 0)for(let j of e.checker.getExportsOfModule(y))C(j);let K=as(k,p,u,Sn(k)),M=ls(k,p,u,K,rs(k)),R=new Set,V=M.residual,X=j=>{let H=f.get(j);j.includes("node_modules/")||H===void 0||Kl(H)?V=!0:R.add(j)};for(let{source:j,exportedName:H}of M.sources){let fe=o.get(j.target)??[],Re=b.has(j.target);if(j.kind==="whole"){for(let ye of fe)I(ye,ye.name??H);Re?V=!0:(fe.length===0||h(j.target))&&X(j.target)}else{let ye=fe.filter(be=>be.name===j.member);for(let be of ye)I(be,H);Re?V=!0:(ye.length===0||h(j.target))&&X(j.target)}}let te=new Set,J=[];for(let j of es(k,p,u))J.push({target:j,depth:1});for(;J.length>0;){let j=J.shift();if(j===void 0)break;let{target:H,depth:fe}=j;if(te.has(H)||fe>nd||(te.add(H),H.split("/").includes("node_modules")))continue;let Re=f.get(H);if(Re===void 0)continue;let ye=c.get(H);ye!==void 0&&!h(H)&&I(ye,"<load>");for(let be of es(Re,H,u))te.has(be)||J.push({target:be,depth:fe+1})}Wl(k,Sn(k))&&(V=!0);for(let j of R)N.push({code:"unresolved-reexport",path:p,detail:`entrypoint whole/member re-exports app-owned relative module ${j} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:j});V&&N.push({code:"unresolved-reexport",path:p,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:A,exportBindings:$,diagnostics:N}}var bn=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),id=new Set(["defineProperty","defineProperties","create"]);function rd(e){let n=!0,t=i=>d.isIdentifier(i)||d.isStringLiteral(i)||d.isNumericLiteral(i)?bn.has(i.text):d.isComputedPropertyName(i)&&d.isStringLiteralLike(i.expression)?bn.has(i.expression.text):!1,r=i=>{if(n){if(d.isNewExpression(i)||d.isForOfStatement(i)||d.isSpreadElement(i)||d.isSpreadAssignment(i)||d.isArrayBindingPattern(i)||d.isGetAccessorDeclaration(i)||d.isSetAccessorDeclaration(i)||d.isYieldExpression(i)&&i.asteriskToken!==void 0||d.canHaveDecorators(i)&&(d.getDecorators(i)?.length??0)>0){n=!1;return}if((d.isPropertyAccessExpression(i)||d.isMethodDeclaration(i)||d.isPropertyAssignment(i))&&t(i.name)||d.isPropertyDeclaration(i)&&t(i.name)||d.isShorthandPropertyAssignment(i)&&t(i.name)||d.isBindingElement(i)&&t(i.propertyName??i.name)||d.isElementAccessExpression(i)&&d.isStringLiteralLike(i.argumentExpression)&&bn.has(i.argumentExpression.text)){n=!1;return}if(d.isCallExpression(i)&&d.isPropertyAccessExpression(i.expression)&&d.isIdentifier(i.expression.expression)&&i.expression.expression.text==="Object"&&id.has(i.expression.name.text)){n=!1;return}d.forEachChild(i,r)}};return r(e),n}function ct(e){if(d.isIdentifier(e)||d.isStringLiteral(e)||d.isNumericLiteral(e))return e.text}function ms(e){let n=t=>d.canHaveDecorators(t)&&(d.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function sd(e){let n=!1,t=new Set,r=[],i=new Map,s=(m,h)=>{let b=i.get(m);b===void 0?i.set(m,[h]):b.push(h)},l=m=>{d.isIdentifier(m)?t.add(m.text):r.push(m)},a=m=>{for(let h of m.properties)d.isShorthandPropertyAssignment(h)?t.add(h.name.text):d.isPropertyAssignment(h)?r.push(h.initializer):n=!0},o=m=>{if(d.isBinaryExpression(m)&&m.operatorToken.kind===d.SyntaxKind.EqualsToken){let h=m.left,b=m.right;Ie(h)?d.isObjectLiteralExpression(b)?a(b):d.isIdentifier(b)||d.isFunctionExpression(b)||d.isArrowFunction(b)||d.isClassExpression(b)?l(b):n=!0:je(h)?(d.isElementAccessExpression(h)&&!d.isStringLiteralLike(h.argumentExpression)&&(n=!0),l(b)):d.isIdentifier(h)?s(h.text,b):(d.isPropertyAccessExpression(h)||d.isElementAccessExpression(h))&&d.isIdentifier(h.expression)&&s(h.expression.text,b)}else if(d.isCallExpression(m))(kn(m)&&m.arguments[0]!==void 0&&mn(m.arguments[0])||ii(m))&&(n=!0);else if(d.isVariableDeclaration(m)&&d.isIdentifier(m.name)&&m.initializer!==void 0)s(m.name.text,m.initializer);else if((d.isFunctionDeclaration(m)||d.isClassDeclaration(m))&&m.name!==void 0)s(m.name.text,m),pn(m)&&t.add(m.name.text);else if(d.isExportDeclaration(m)){if(m.exportClause===void 0)n=!0;else if(m.moduleSpecifier===void 0&&d.isNamedExports(m.exportClause))for(let h of m.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(d.isExportAssignment(m))m.isExportEquals&&!d.isIdentifier(m.expression)?n=!0:l(m.expression);else if(d.isVariableStatement(m)&&pn(m))for(let h of m.declarationList.declarations)d.isIdentifier(h.name)&&t.add(h.name.text);d.forEachChild(m,o)};o(e);let c=new Set,u=[...t],f=m=>{let h=b=>{d.isIdentifier(b)&&u.push(b.text),d.forEachChild(b,h)};h(m)};for(let m of r)f(m);for(;u.length>0;){let m=u.pop();if(!(m===void 0||c.has(m))){c.add(m);for(let h of i.get(m)??[])f(h)}}return{names:c,opaque:n}}var od=512,ad=new Set(["get","post","put","patch","delete","options","head"]);function ld(e){for(let n of e.statements){if(d.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(n.expression.left)&&d.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,r=n.expression.left.name.text;if(t==="module"&&r==="exports"||t==="exports"&&r==="default")return n.expression.right}}return null}function dd(e){let n=new Map,t=ld(e);if(t===null)return n;let r=s=>{for(let l of s.properties)if(d.isPropertyAssignment(l)&&d.isObjectLiteralExpression(l.initializer)){let a=ct(l.name);a!==void 0&&n.set(a,l.initializer)}};if(d.isObjectLiteralExpression(t))return r(t),n;if(!d.isIdentifier(t))return n;let i=t.text;for(let s of e.statements)if(d.isVariableStatement(s))for(let l of s.declarationList.declarations)d.isIdentifier(l.name)&&l.name.text===i&&l.initializer!==void 0&&d.isObjectLiteralExpression(l.initializer)&&r(l.initializer);else if(d.isExpressionStatement(s)&&d.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(s.expression.left)&&d.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===i&&d.isObjectLiteralExpression(s.expression.right)){let l=s.expression.left.name.text;n.set(l,s.expression.right)}return n}function cd(e){for(let n of e.properties){if(d.isMethodDeclaration(n)&&d.isIdentifier(n.name)&&n.name.text==="handler")return n;if(d.isPropertyAssignment(n)&&d.isIdentifier(n.name)&&n.name.text==="handler"&&(d.isArrowFunction(n.initializer)||d.isFunctionExpression(n.initializer)))return n.initializer}return null}function ud(e,n){for(let r of e.properties){let i;if(d.isPropertyAssignment(r)||d.isMethodDeclaration(r)?i=ct(r.name):d.isShorthandPropertyAssignment(r)&&(i=r.name.text),i==="method"||i==="url"||i==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function fd(e,n){let t=[],r=new Set,i=(a,o,c)=>{if(t.length>=od||a==="__proto__"||!ri.test(a))return;let u=`${e}#handler:${a}`;r.has(u)||(r.add(u),t.push({id:u,node:o,memberPath:a,idiom:c}))};for(let[a,o]of dd(n)){let c=cd(o);c!==null&&ud(o,c)&&i(a,c,"descriptor-object")}let s=0,l=a=>{if(d.isCallExpression(a)&&d.isPropertyAccessExpression(a.expression)&&d.isIdentifier(a.expression.expression)&&ad.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&d.isStringLiteralLike(a.arguments[0])){let o=a.expression.name.text;for(let c=1;c<a.arguments.length;c+=1){let u=a.arguments[c];u!==void 0&&(d.isArrowFunction(u)||d.isFunctionExpression(u))&&i(`${o}_${String(s)}_${String(c)}`,u,"router-verb")}s+=1}d.forEachChild(a,l)};return l(n),t}function pd(e,n,t,r,i,s){let l=`${e}#class:${t}`,a=[],o=new Set;for(let c of r.members){let u,f,m;if(d.isConstructorDeclaration(c))u="constructor",f="ctor",m=!1;else if(d.isMethodDeclaration(c))u=ct(c.name),f="method",m=u!==void 0&&!bn.has(u);else continue;if(u===void 0||o.has(u))continue;o.add(u);let h=`${e}#${t}.${u}`;i.push({id:h,moduleId:e,name:u,kind:f,enclosingClassId:l,declRange:sn(e,c,n),isExported:!1,publicSurfaceReachable:!1}),a.push(h),m&&s.push({start:c.getStart(n,!1),end:c.getEnd(),id:h})}return{id:l,moduleId:e,name:t,implementsRefs:[],members:a}}function md(e,n,t=[],r=!1,i){let s=[],l=new Map,a=[],{reachableLocals:o,defaultTarget:c}=Dl(n),u=Sn(n),f=`${e}#<toplevel>`;s.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let m=(p,y)=>{let _=`${e}#${p}`;return s.push({id:_,moduleId:e,name:p,kind:"function",declRange:sn(e,y,n),isExported:o.has(p),publicSurfaceReachable:o.has(p)}),l.set(p,{kind:"function",functionId:_}),a.push({start:y.getStart(n,!1),end:y.getEnd(),id:_}),_},h=[],b=!e.split("/").includes("node_modules");if(b)for(let p of Hl(n,u))o.add(p);let S=b?sd(n):void 0,x=(p,y,_)=>{S===void 0||S.opaque||S.names.has(p)||pn(_)||ms(y)||h.push(pd(e,n,p,y,s,a))};for(let p of n.statements)if(d.isFunctionDeclaration(p)&&p.name!==void 0)m(p.name.text,p);else if(d.isClassDeclaration(p)&&p.name!==void 0)x(p.name.text,p,p);else if(d.isVariableStatement(p))for(let y of p.declarationList.declarations){if(d.isObjectBindingPattern(y.name)&&y.initializer!==void 0&&d.isCallExpression(y.initializer)&&d.isIdentifier(y.initializer.expression)&&y.initializer.expression.text==="require"&&y.initializer.arguments.length===1&&y.initializer.arguments[0]!==void 0&&d.isStringLiteralLike(y.initializer.arguments[0])){let L=y.initializer.arguments[0].text;for(let z of y.name.elements){if(z.dotDotDotToken!==void 0||z.initializer!==void 0||!d.isIdentifier(z.name))continue;let I=z.propertyName??z.name;!d.isIdentifier(I)&&!d.isStringLiteralLike(I)||l.set(z.name.text,{kind:"import",specifier:L,form:{named:I.text}})}continue}if(!d.isIdentifier(y.name)||y.initializer===void 0)continue;let _=y.initializer;if(d.isFunctionExpression(_)||d.isArrowFunction(_))m(y.name.text,y);else if(d.isClassExpression(_))x(y.name.text,_,p);else if(d.isCallExpression(_)&&d.isIdentifier(_.expression)&&_.expression.text==="require"&&_.arguments.length===1&&_.arguments[0]!==void 0&&d.isStringLiteralLike(_.arguments[0]))l.set(y.name.text,{kind:"import",specifier:_.arguments[0].text,form:"whole"});else if((d.isPropertyAccessExpression(_)||d.isElementAccessExpression(_))&&dt(_)==="default"&&d.isCallExpression(_.expression)){let L=Je(_.expression);L!==void 0&&l.set(y.name.text,{kind:"import",specifier:L,form:"require-default"})}}else if(d.isImportDeclaration(p)&&d.isStringLiteralLike(p.moduleSpecifier)){let y=p.moduleSpecifier.text,_=p.importClause;if(_!==void 0){_.name!==void 0&&l.set(_.name.text,{kind:"import",specifier:y,form:"default"});let L=_.namedBindings;if(L!==void 0&&d.isNamespaceImport(L))l.set(L.name.text,{kind:"import",specifier:y,form:"namespace"});else if(L!==void 0&&d.isNamedImports(L))for(let z of L.elements){let I=(z.propertyName??z.name).text;l.set(z.name.text,{kind:"import",specifier:y,form:{named:I}})}}}else d.isImportEqualsDeclaration(p)&&d.isExternalModuleReference(p.moduleReference)&&d.isStringLiteralLike(p.moduleReference.expression)&&l.set(p.name.text,{kind:"import",specifier:p.moduleReference.expression.text,form:"whole"});let w=new Map,A,$=new Map,N=new Map;if(b)for(let{name:p,value:y}of ql(n)){let _=`${e}#member-export:${p}`;s.push({id:_,moduleId:e,name:p,kind:d.isArrowFunction(y)?"arrow":"function",declRange:sn(e,y,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:y.getStart(n,!1),end:y.getEnd(),id:_}),w.set(y.getStart(n,!1),_)}if(r&&b){let p=I=>{let C=Ce(I);return d.isFunctionExpression(C)||d.isArrowFunction(C)?C:void 0},y=(I,C)=>{let K=I;return s.push({id:K,moduleId:e,kind:d.isArrowFunction(C)?"arrow":"function",declRange:sn(e,C,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:C.getStart(n,!1),end:C.getEnd(),id:K}),w.set(C.getStart(n,!1),K),K},_=[],L=[],z=[];for(let I of n.statements)d.isExportAssignment(I)&&!I.isExportEquals?_.push(I):d.isFunctionDeclaration(I)&&d.getModifiers(I)?.some(C=>C.kind===d.SyntaxKind.DefaultKeyword)===!0?L.push(I):d.isExpressionStatement(I)&&d.isBinaryExpression(I.expression)&&I.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ie(I.expression.left)&&z.push(I.expression);if(_.length+L.length+z.length===1){let I=_[0],C=L[0],K=z[0];if(I!==void 0){let M=p(I.expression);if(M!==void 0){let R=y(`${e}#<default>`,M);A={id:R,esm:!0},N.set(I.getStart(n,!1),R),ne(i,"2a-default",null)}}else if(C!==void 0&&C.name===void 0&&C.body!==void 0){let M=y(`${e}#<default>`,C);A={id:M,esm:!0},N.set(C.getStart(n,!1),M),ne(i,"2a-default",null)}else if(K!==void 0){let M=p(K.right);if(M!==void 0){let R=y(`${e}#<default>`,M);A={id:R,esm:!1},N.set(K.getStart(n,!1),R),ne(i,"2a-default",null)}else if(d.isObjectLiteralExpression(K.right)){let R=K.right,V=[],X=!0;for(let te of R.properties){if(d.isSpreadAssignment(te)){X=!1;break}let J=te.name,j=J===void 0?void 0:ni(J);if(j===void 0){X=!1;break}V.push(j)}if(X){let te=new Map;for(let J of V)te.set(J,(te.get(J)??0)+1);for(let J of R.properties){if(!d.isPropertyAssignment(J))continue;let j=ni(J.name),H=p(J.initializer);if(j!==void 0){if(!Ul(j)){H!==void 0&&ne(i,"2a-member","charset-refused");continue}if((te.get(j)??0)!==1){H!==void 0&&ne(i,"2a-member","duplicate-key");continue}if(H!==void 0){let fe=y(`${e}#<cjs>.${j}`,H);$.set(j,fe),N.set(J.getStart(n,!1),fe),ne(i,"2a-member",null)}}}}else for(let te of R.properties)d.isPropertyAssignment(te)&&p(te.initializer)!==void 0&&ne(i,"2a-member","spread-or-computed-literal")}}}else{for(let I of _)p(I.expression)!==void 0&&ne(i,"2a-default","duplicate-default-sources");for(let I of L)I.name===void 0&&ne(i,"2a-default","duplicate-default-sources");for(let I of z)if(p(I.right)!==void 0)ne(i,"2a-default","duplicate-default-sources");else if(d.isObjectLiteralExpression(I.right))for(let C of I.right.properties)d.isPropertyAssignment(C)&&p(C.initializer)!==void 0&&ne(i,"2a-member","duplicate-default-sources")}}for(let p of t)s.push({id:p.id,moduleId:e,name:`handler:${p.memberPath}`,kind:d.isArrowFunction(p.node)?"arrow":"function",declRange:sn(e,p.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:p.node.getStart(n,!1),end:p.node.getEnd(),id:p.id});a.sort((p,y)=>p.end-p.start-(y.end-y.start));let k=c!==void 0?`${e}#${c}`:void 0;return{rel:e,sf:n,functions:s,bindings:l,exportedFunctionId:k,exportedNames:o,tainted:u,fnRanges:a,toplevelId:f,classes:h,mintedByPos:w,mintedDefault:A,mintedMembers:$,mintSeedAliases:N}}function hd(e){return d.isIdentifier(e)?"identifier":d.isPropertyAccessExpression(e)?"member":d.isElementAccessExpression(e)?"computed-member":e.kind===d.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function ns(e,n){let t=r=>{if(d.isBinaryExpression(r)&&r.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=d.SyntaxKind.LastAssignment){let i=r.left;d.isPropertyAccessExpression(i)&&d.isIdentifier(i.expression)?n(i.expression.text,i.name.text):d.isElementAccessExpression(i)&&d.isIdentifier(i.expression)&&n(i.expression.text,d.isStringLiteralLike(i.argumentExpression)?i.argumentExpression.text:null)}else if(d.isCallExpression(r)&&d.isPropertyAccessExpression(r.expression)){let i=r.expression,s=r.arguments[0];d.isIdentifier(i.expression)&&s!==void 0&&d.isIdentifier(s)&&(i.expression.text==="Object"&&(i.name.text==="assign"||i.name.text==="defineProperty"||i.name.text==="defineProperties")||i.expression.text==="Reflect"&&i.name.text==="defineProperty")&&n(s.text,null)}d.forEachChild(r,t)};t(e)}function gd(e){let n=!1,t=r=>{if(!n){if(d.isVariableDeclaration(r)||d.isParameter(r)){let i=new Set;if(On(r.name,i),i.has("require")){n=!0;return}}else if((d.isFunctionDeclaration(r)||d.isClassDeclaration(r))&&r.name!==void 0&&r.name.text==="require"){n=!0;return}d.forEachChild(r,t)}};return t(e),n}function yd(e,n,t,r=new Map,i={}){let s=i.additiveForms===!0,l=i.namelessExports===!0,a=s||l?{}:void 0,o=new Map,c=new Map;for(let p of n.imports)p.resolvedModuleId!==void 0&&c.set(`${p.moduleId}::${p.specifier}`,p.resolvedModuleId);for(let p of e.sourceFiles){let y=e.toRel(p.fileName);y!==null&&o.set(y,md(y,p,r.get(y)??[],l,a))}let u=new Map;if(s)for(let p of o.values()){let y=new Map;for(let[_,L]of p.bindings)if(L.kind==="import"&&L.form==="whole"&&me(L.specifier)!=="package-root"){let z=c.get(`${p.rel}::${L.specifier}`);z!==void 0&&y.set(_,String(z))}y.size!==0&&ns(p.sf,(_,L)=>{let z=y.get(_);if(z===void 0)return;let I=u.get(z);if(I!=="*"){if(L===null){u.set(z,"*");return}I===void 0?u.set(z,new Set([L])):I.add(L)}})}let f=new Map;for(let p of o.values())p.exportedFunctionId!==void 0&&f.set(p.rel,p.exportedFunctionId);let m=new Map;for(let p of o.values()){if(p.rel.split("/").includes("node_modules"))continue;let y=Fl(p.sf);if(y===void 0){l&&p.mintedDefault!==void 0&&m.set(p.rel,p.mintedDefault);continue}let _=p.bindings.get(y.name);_?.kind==="function"&&m.set(p.rel,{id:_.functionId,esm:y.esm})}let h=new Map;for(let p of o.values()){let y;for(let _ of p.exportedNames){let L=p.bindings.get(_);L?.kind==="function"&&(y??=new Map,y.set(_,L.functionId))}y!==void 0&&h.set(p.rel,y)}let b=new Map;for(let p of o.values()){if(p.rel.split("/").includes("node_modules"))continue;let y=Yl(p.sf,p.tainted,_=>{let L=p.bindings.get(_);return L?.kind==="function"?L.functionId:void 0},l?_=>{let L=Ce(_);return d.isFunctionExpression(L)||d.isArrowFunction(L)?p.mintedByPos.get(L.getStart(p.sf,!1)):void 0}:void 0);y.size>0&&b.set(p.rel,y)}let S=[],x=[],w=[],A=[],$=[],N=[];for(let p of o.values()){S.push(...p.functions),N.push(...p.classes);for(let E of p.exportedNames){let v=p.bindings.get(E);if(v?.kind==="function"){let O=`${p.rel}#export:${E}`;A.push({id:O,moduleId:p.rel,exportedName:E,kind:"value"}),$.push({exportId:O,target:{kind:"function",functionId:v.functionId}})}}if(l){if(p.mintedDefault!==void 0){let E=`${p.rel}#export:<default>`;A.push({id:E,moduleId:p.rel,exportedName:"default",kind:"value"}),$.push({exportId:E,target:{kind:"function",functionId:p.mintedDefault.id}})}for(let[E,v]of p.mintedMembers){let O=`${p.rel}#export:<cjs>.${E}`;A.push({id:O,moduleId:p.rel,exportedName:E,kind:"value"}),$.push({exportId:O,target:{kind:"function",functionId:v}})}}let y=new Map;for(let[E,v]of p.bindings){if(v.kind==="function"){y.set(E,v);continue}if(me(v.specifier)==="package-root"){let T=qe(v.specifier);typeof v.form=="object"?y.set(E,{kind:"package-export",packageName:T,exportName:v.form.named}):v.form==="require-default"?y.set(E,{kind:"package-default",packageName:T}):y.set(E,{kind:"package-surface",packageName:T})}else{let T=c.get(`${p.rel}::${v.specifier}`);if(T!==void 0&&typeof v.form=="object"){let W=h.get(String(T))?.get(v.form.named);W!==void 0&&y.set(E,{kind:"app-named-fn",functionId:W})}else if(T!==void 0&&v.form==="require-default"){let W=m.get(String(T));W!==void 0&&W.esm&&y.set(E,{kind:"app-default-fn",functionId:W.id})}else T!==void 0&&typeof v.form!="object"&&v.form!=="require-default"&&y.set(E,{kind:"module",resolvedModuleId:T})}}let _=new Map;for(let E of p.functions){if(E.enclosingClassId===void 0||E.name===void 0)continue;let v=_.get(E.enclosingClassId);v===void 0&&(v=new Map,_.set(E.enclosingClassId,v)),v.set(E.name,E.id)}for(let E of p.classes)E.name===void 0||p.tainted.has(E.name)||y.has(E.name)||y.set(E.name,{kind:"app-class",cls:{classId:E.id,className:E.name,memberIds:_.get(E.id)??new Map}});let L=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0&&d.isNewExpression(E.initializer)&&!p.tainted.has(E.name.text)&&!y.has(E.name.text)){let v=Xr(E.initializer,y,p.tainted);v!==null&&y.set(E.name.text,v)}d.forEachChild(E,L)};L(p.sf);let z=E=>{for(let v of p.fnRanges)if(E>=v.start&&E<v.end)return v.id;return p.toplevelId},I=new Map,C=new Map,K=new Map,M=(E,v,O)=>{if(O===null){E.set(v,"*");return}let T=E.get(v);T!=="*"&&(T===void 0?E.set(v,new Set([O])):T.add(O))},R=(E,v)=>{M(I,E,v);let O=y.get(E);O?.kind==="package-surface"?M(C,O.packageName,v):O?.kind==="module"&&M(K,String(O.resolvedModuleId),v)};ns(p.sf,R);let V=new Map,X=256,te=E=>{let v=V.get(E);return v===void 0&&(v=V.size>=X?new Set([E]):us(p.sf,new Set([E])),V.set(E,v)),v},J=(E,v)=>E==="*"||E!==void 0&&E.has(v),j=(E,v)=>{let O=y.get(E);if(O?.kind==="package-surface"&&J(C.get(O.packageName),v)||O?.kind==="module"&&J(K.get(String(O.resolvedModuleId)),v))return!0;for(let T of te(E))if(J(I.get(T),v))return!0;return!1},H=E=>{if(d.isIdentifier(E)){let v=p.tainted.has(E.text)?void 0:y.get(E.text);return v?.kind==="function"?v.functionId:v?.kind==="module"?f.get(String(v.resolvedModuleId))??null:v?.kind==="package-export"?t.exportFor(v.packageName,v.exportName):null}if(d.isPropertyAccessExpression(E)&&d.isIdentifier(E.expression)){let v=E.expression.text;if(j(v,E.name.text))return null;let O=p.tainted.has(v)?void 0:y.get(v);return O?.kind==="package-surface"?t.exportFor(O.packageName,E.name.text):O?.kind==="package-export"?t.methodFor(O.packageName,O.exportName,E.name.text,"method"):O?.kind==="package-instance"?t.methodFor(O.packageName,O.className,E.name.text,"method"):null}return null},fe=E=>{for(let v=E.parent;v!==void 0;v=v.parent)if(!d.isArrowFunction(v)){if(d.isFunctionExpression(v)||d.isFunctionDeclaration(v))return null;if(d.isMethodDeclaration(v)||d.isConstructorDeclaration(v)||d.isGetAccessorDeclaration(v)||d.isSetAccessorDeclaration(v)){let O=v.parent;if(!d.isClassLike(O)||O.name===void 0)return null;let T=p.tainted.has(O.name.text)?void 0:y.get(O.name.text);return T?.kind==="app-class"?T.cls:null}}return null},Re=s&&!p.tainted.has("require")&&!gd(p.sf),ye=E=>{if(d.isIdentifier(E)){let T=p.tainted.has(E.text)?void 0:y.get(E.text);return T?.kind==="package-surface"||T?.kind==="package-default"?t.exportFor(T.packageName,"default"):T?.kind==="app-named-fn"||T?.kind==="app-default-fn"?T.functionId:T?.kind==="module"?m.get(String(T.resolvedModuleId))?.id??null:T?.kind==="member-value"?T.functionId:null}if(!d.isPropertyAccessExpression(E))return null;let v=E.expression;if(s&&d.isCallExpression(Ce(v))){let T=Je(Ce(v));if(T!==void 0)if(!Re)ne(a,"2b","require-shadow");else if(me(T)==="package-root")ne(a,"2b","package-root");else{let W=c.get(`${p.rel}::${T}`);if(W===void 0)ne(a,"2b","unresolved-module");else{let ie=E.name.text,_e=u.get(String(W));if(_e==="*"||_e!==void 0&&_e.has(ie))ne(a,"2b","module-mutation-gate");else{let Se=b.get(String(W))?.get(ie);if(Se!==void 0)return ne(a,"2b",null),Se;if(ie==="default"){let ae=m.get(String(W));if(ae!==void 0&&ae.esm)return ne(a,"2b",null),ae.id;ne(a,"2b","non-esm-default")}else ne(a,"2b","unknown-member")}}}return null}let O;if(d.isIdentifier(v)){let T=p.tainted.has(v.text)?void 0:y.get(v.text);if(T?.kind==="app-class"||T?.kind==="app-instance")O=T.cls.memberIds;else if(T?.kind==="object-literal")O=T.obj.members;else if(T?.kind==="module"){let W=b.get(String(T.resolvedModuleId));W?.has(E.name.text)===!0&&!j(v.text,E.name.text)&&(O=W)}}else if(d.isNewExpression(v)){let T=Xr(v,y,p.tainted);T?.kind==="app-instance"&&(O=T.cls.memberIds)}else v.kind===d.SyntaxKind.ThisKeyword&&(O=fe(E)?.memberIds);return O?.get(E.name.text)??null},be=new Map,In=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0&&d.isObjectLiteralExpression(E.initializer)&&!p.tainted.has(E.name.text)&&!y.has(E.name.text)&&!be.has(E.name.text)){let v=new Map;for(let O of E.initializer.properties)if(d.isPropertyAssignment(O)&&d.isIdentifier(O.name)){let T=H(O.initializer);T!==null&&v.set(O.name.text,T)}be.set(E.name.text,v)}d.forEachChild(E,In)};In(p.sf);let F=E=>{if(d.isBinaryExpression(E)&&E.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(E.left)&&d.isIdentifier(E.left.expression)&&!p.tainted.has(E.left.expression.text)){let v=be.get(E.left.expression.text);if(v!==void 0){let O=H(E.right);O!==null&&v.set(E.left.name.text,O)}}d.forEachChild(E,F)};F(p.sf);for(let[E,v]of be)y.set(E,{kind:"object-literal",obj:{members:v}});let re=(E,v=0)=>{if(v>Wr)return null;let O=Ce(E);if(d.isCallExpression(O)&&d.isPropertyAccessExpression(O.expression)&&O.expression.name.text==="bind")return re(O.expression.expression,v+1);if(d.isIdentifier(O)){let T=H(O);if(T!==null)return T;let W=p.tainted.has(O.text)?void 0:y.get(O.text);return W?.kind==="member-value"?W.functionId:null}return d.isPropertyAccessExpression(O)?H(O)??ye(O):null},xe=(E,v=0)=>{if(v>Wr)return"depth-cap";let O=Ce(E);if(d.isCallExpression(O)&&d.isPropertyAccessExpression(O.expression)&&O.expression.name.text==="bind")return xe(O.expression.expression,v+1);if(d.isIdentifier(O))return p.tainted.has(O.text)?"tainted-receiver":"unresolved-receiver";if(d.isPropertyAccessExpression(O)&&d.isIdentifier(O.expression)){if(p.tainted.has(O.expression.text))return"tainted-receiver";if(j(O.expression.text,O.name.text))return"mutated-member"}return"unresolved-receiver"},oe=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0){let v=Ce(E.initializer),O=d.isPropertyAccessExpression(v),T=d.isCallExpression(v)&&d.isPropertyAccessExpression(v.expression)&&v.expression.name.text==="bind";if(O||T){let W=O?"D1":"A2";if(p.tainted.has(E.name.text))ne(a,W,"tainted-alias");else if(y.has(E.name.text))ne(a,W,"already-bound");else{let ie=re(v);ie!==null?(y.set(E.name.text,{kind:"member-value",functionId:ie}),ne(a,W,null)):ne(a,W,xe(v))}}}d.forEachChild(E,oe)};s&&oe(p.sf);let ke=0,Z=E=>{let v,O;if(d.isCallExpression(E)){let T=E.expression,W=d.isIdentifier(T)&&T.text==="require",ie=T.kind===d.SyntaxKind.ImportKeyword;!W&&!ie&&(v=T,O=E.arguments)}else d.isTaggedTemplateExpression(E)&&(v=E.tag);if(v!==void 0){let T=hd(v),W=E.getStart(p.sf,!1),ie=`${p.rel}#call${String(ke)}`;ke+=1;let _e="unresolved",Se=[],ae=H(v);ae!==null&&(_e="resolved",Se.push(ae)),x.push({id:ie,enclosingFunctionId:z(W),calleeExprShape:T,resolvedTargetIds:Se,resolution:_e,range:sn(p.rel,E,p.sf)});for(let de of Se)w.push({callSiteId:ie,calleeFunctionId:de,resolution:_e});if(ae===null){let de=ye(v);if(de!==null)w.push({callSiteId:ie,calleeFunctionId:de,resolution:"field-based"});else if(s&&d.isPropertyAccessExpression(v)&&(v.name.text==="call"||v.name.text==="apply")){let De=re(v.expression);De!==null?(w.push({callSiteId:ie,calleeFunctionId:De,resolution:"field-based"}),ne(a,"A3",null)):ne(a,"A3",xe(v.expression))}}for(let de of O??[]){let De=H(de);if(De!==null)w.push({callSiteId:ie,calleeFunctionId:De,resolution:"field-based"});else{let nn=ye(de);if(nn!==null)w.push({callSiteId:ie,calleeFunctionId:nn,resolution:"field-based"});else if(s){let U=re(de),D=Ce(de),q=D!==de||d.isCallExpression(D)&&d.isPropertyAccessExpression(D.expression)&&D.expression.name.text==="bind";U!==null?(w.push({callSiteId:ie,calleeFunctionId:U,resolution:"field-based"}),q&&ne(a,"A2p",null)):q&&ne(a,"A2p",xe(de))}}}}d.forEachChild(E,Z)};Z(p.sf);for(let E of n.computedLoads.get(p.rel)??[]){let v=E.candidateRels.filter(T=>o.has(T)).map(T=>`${T}#<toplevel>`);if(v.length===0)continue;let O=`${p.rel}#dirload${String(ke)}`;ke+=1,x.push({id:O,enclosingFunctionId:z(E.pos),calleeExprShape:"require",resolvedTargetIds:v,resolution:"field-based",range:{path:p.rel,start:E.pos,end:E.pos}});for(let T of v)w.push({callSiteId:O,calleeFunctionId:T,resolution:"field-based"})}let Le=0;for(let E of r.get(p.rel)??[]){let v=`${p.rel}#handlerseed${String(Le)}`;Le+=1;let O=E.node.getStart(p.sf,!1);x.push({id:v,enclosingFunctionId:p.toplevelId,calleeExprShape:"member",resolvedTargetIds:[E.id],resolution:"field-based",range:{path:p.rel,start:O,end:O}}),w.push({callSiteId:v,calleeFunctionId:E.id,resolution:"field-based"})}}let k=new Map;if(l)for(let p of o.values())for(let[y,_]of p.mintSeedAliases)k.set(`${p.rel}::${String(y)}`,_);return{functions:S,callSites:x,callEdges:w,exports:A,exportBindings:$,classes:N,mintSeedAliases:k,bindingApplicability:a}}function xd(e,n,t){let r=o=>o.length===0||Oe.isAbsolute(o)||o.includes("\\")||/^[a-zA-Z]:/u.test(o)||o.split("/").some(c=>c===".."||c==="");if(r(n)||r(t))return null;let i=e.endsWith(Oe.sep)?e:e+Oe.sep,s;try{s=Hr(Oe.resolve(e,n))}catch{return null}if(!s.startsWith(i))return null;let l=s.endsWith(Oe.sep)?s:s+Oe.sep,a;try{a=Hr(Oe.resolve(s,t))}catch{return null}return a.startsWith(l)?a:null}function hs(e,n,t){let r=`${e}#class:${t}`,i=[],s=[],l=[],a=new Set;return{pushMember(o,c,u,f){if(o==="__proto__"||a.has(o))return;a.add(o);let m=`${e}#${t}.${o}`;i.push({id:m,moduleId:e,name:o,kind:u,enclosingClassId:r,declRange:sn(e,c,n),isExported:!1,publicSurfaceReachable:!1}),l.push(m),s.push({name:o,id:m,kind:u,body:f})},finish(){return s.length===0?null:{functions:i,classNode:{id:r,moduleId:e,name:t,implementsRefs:[],members:l},members:s}}}}function Sd(e,n,t,r){if(ms(r)||r.members.length>ti)return null;let i=hs(e,n,t);for(let s of r.members){let l,a,o;if(d.isConstructorDeclaration(s))l="constructor",a="ctor",o=void 0;else if(d.isMethodDeclaration(s))l=ct(s.name),a="method",o=l!==void 0&&!bn.has(l)?s.body??void 0:void 0;else continue;l!==void 0&&i.pushMember(l,s,a,o)}return i.finish()}function bd(e,n,t){let r;for(let l of n.statements)if(d.isFunctionDeclaration(l)&&l.name?.text===t){r=l;break}if(r===void 0)return null;let i=[];for(let l of n.statements){if(!d.isExpressionStatement(l))continue;let a=l.expression;if(!d.isBinaryExpression(a)||a.operatorToken.kind!==d.SyntaxKind.EqualsToken)continue;let o=a.left;if(d.isPropertyAccessExpression(o)&&d.isPropertyAccessExpression(o.expression)&&d.isIdentifier(o.expression.expression)&&o.expression.expression.text===t&&o.expression.name.text==="prototype"){let c=o.name.text;d.isFunctionExpression(a.right)?i.push({name:c,fn:a.right,walk:!0}):d.isArrowFunction(a.right)&&i.push({name:c,fn:a.right,walk:!1})}}if(i.length===0||i.length+1>ti)return null;let s=hs(e,n,t);s.pushMember("constructor",r,"ctor",void 0);for(let l of i){let a=l.walk&&!bn.has(l.name)&&d.isFunctionExpression(l.fn)?l.fn.body:void 0;s.pushMember(l.name,l.fn,"method",a)}return s.finish()}function kd(e,n,t){for(let r of n.statements)if(d.isClassDeclaration(r)&&r.name?.text===t)return Sd(e,n,t,r);return bd(e,n,t)}function Ed(e,n,t,r,i){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let l=new Set(t.map(f=>f.packageName)),a=new Set(t.map(f=>f.path)),o=new Set,c=new Set,u=0;for(let f of n){if(!l.has(f.packageName))continue;let m=xd(e.appRoot,f.packageRootRel,f.sourcePath);if(m===null)continue;let h=e.toRel(m);if(h===null)continue;let b=`${h}#${f.container}`;if(c.has(b)||!o.has(h)&&o.size>=lt)continue;let S=Ne(m);if(S===null)continue;let x;try{x=d.createSourceFile(h,S,d.ScriptTarget.Latest,!0,d.ScriptKind.JS)}catch{continue}let w=kd(h,x,f.container);if(w===null)continue;o.add(h),c.add(b);let A=new Map,$=new Map;for(let k of w.members){let p=i.methodFor(f.packageName,f.container,k.name,k.kind);A.set(k.name,p),$.set(p,k.id)}let N=0;for(let k of w.members){if(k.body===void 0)continue;let p=(y,_)=>{if(_&&d.isCallExpression(y)&&d.isPropertyAccessExpression(y.expression)&&y.expression.expression.kind===d.SyntaxKind.ThisKeyword){let I=A.get(y.expression.name.text);if(I!==void 0){let C=`${h}#depclass:${f.container}.${k.name}#c${String(N)}`;N+=1,s.callSites.push({id:C,enclosingFunctionId:k.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:sn(h,y,x)}),s.callEdges.push({callSiteId:C,calleeFunctionId:I,resolution:"field-based"})}}let L=d.isFunctionExpression(y)||d.isFunctionDeclaration(y)||d.isMethodDeclaration(y)||d.isConstructorDeclaration(y)||d.isGetAccessorDeclaration(y)||d.isSetAccessorDeclaration(y)||d.isClassLike(y),z=d.isArrowFunction(y)?_:L?!1:_;d.forEachChild(y,I=>{p(I,z)})};p(k.body,!0)}for(let k of r){let p=$.get(k.calleeFunctionId);p!==void 0&&s.callEdges.push({callSiteId:k.callSiteId,calleeFunctionId:p,resolution:"field-based"})}if(s.functions.push(...w.functions),s.classes.push(w.classNode),!a.has(h)){a.add(h),s.modules.push({id:h,packageName:f.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let k=i.moduleFor(f.packageName),p=`${String(k)}#depclass${String(u)}`;u+=1,s.imports.push({id:p,moduleId:k,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),s.importEdges.push({importId:p,resolvedModuleId:h})}s.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(w.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return s}function wd(e,n,t,r){let i=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.packageName)),s=new Map(e.functions.map(o=>[o.id,o.moduleId])),l=new Map;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let c=s.get(o.enclosingFunctionId);c!==void 0&&l.set(c,(l.get(c)??0)+1)}let a=[];for(let o of e.modules){if(o.externalSurface===!0)continue;let c=n.get(o.path);if(c===void 0||t.has(o.path)||i.has(o.packageName)&&r.has(o.path)&&!o.path.split("/").includes("node_modules"))continue;let u=l.get(o.id)??0;if(u===0&&rd(c))continue;let f=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:o.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:o.id})}return a}function gs(e,n,t=[],r={},i=!1){let s=new ei,l=$l(e,n,s),a=new Set;for(let N of l.computedLoads.values())for(let k of N)if(k.seedable)for(let p of k.candidateRels)a.add(p);let o=new Map;for(let N of e.sourceFiles){let k=e.toRel(N.fileName);if(k===null||!a.has(k)||k.split("/").includes("node_modules"))continue;let p=fd(k,N);p.length>0&&o.set(k,p)}let c=o.size===0?l.modules:l.modules.map(N=>o.has(N.path)&&!N.isEntrypoint?{...N,isEntrypoint:!0}:N),u={...l,modules:c},f=yd(e,u,s,o,r),m=td(e,l,f.functions,f.mintSeedAliases),h=new Set(l.modules.map(N=>N.path)),b=Tl(e.depReach,s,h),S=[...u.modules,...b.modules,...s.modules()],x=Ed(e,t,S,f.callEdges,s),w=[];if(i){let N="#default",k=new Set;for(let y of f.callEdges){let _=String(y.calleeFunctionId);!_.startsWith("pkg:")||!_.endsWith(N)||k.add(_.slice(4,_.length-N.length))}let p=new Map;for(let y of e.depReach.edges){if(!("surface"in y.from)||"surface"in y.to)continue;let _=y.from.surface;p.set(_,p.has(_)?null:y.to.module)}for(let y of k){let _=p.get(y);if(_==null)continue;let L=Pl(Oe.join(e.appRoot,_));if(L===null||L==="default")continue;let z=s.exportFor(y,L),I=`pkg:${y}${N}`;for(let C of f.callEdges)String(C.calleeFunctionId)===I&&w.push({callSiteId:C.callSiteId,calleeFunctionId:z,resolution:"field-based"})}}let A={modules:[...u.modules,...b.modules,...x.modules,...s.modules()],exports:[...f.exports,...m.exports],imports:[...l.imports,...b.imports,...x.imports],functions:[...f.functions,...s.functions(),...x.functions],callSites:[...f.callSites,...x.callSites],classes:[...f.classes,...s.classes(),...x.classes],callEdges:[...f.callEdges,...x.callEdges,...w],importEdges:[...l.importEdges,...b.importEdges,...x.importEdges],exportBindings:[...f.exportBindings,...m.exportBindings],inheritEdges:[]},$=new Map;for(let N of e.sourceFiles){let k=e.toRel(N.fileName);k!==null&&$.set(k,N)}return{graph:A,diagnostics:[...m.diagnostics,...x.diagnostics,...wd(A,$,new Set(e.diagnostics.filter(N=>N.code==="dependency-body").map(N=>N.path)),l.appOwnedPaths)],...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var vd=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,ut=/^[A-Za-z0-9_$.-]{1,128}$/u;function Id(e){return vd.test(e.calleePackage)?ut.test(e.anchorExport)?ut.test(e.calleeExport)?e.anchorContainer!==null&&!ut.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!ut.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Ln(e,n){let t=[],r=[],i=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.classes.map(c=>[c.id,c.name])),l=(c,u,f)=>e.functions.some(m=>{if(m.name!==u)return!1;let h=i.get(m.moduleId);return h===void 0||h.packageName!==c?!1:(m.enclosingClassId!==void 0?s.get(m.enclosingClassId)??null:null)===f}),a=(c,u,f)=>{for(let m of e.functions){if(m.name!==u)continue;let h=i.get(m.moduleId);if(!(h===void 0||h.packageName!==c||(m.enclosingClassId!==void 0?s.get(m.enclosingClassId)??null:null)!==f))return m.id}return null},o=[...n].sort((c,u)=>c.modelId<u.modelId?-1:c.modelId>u.modelId?1:0);for(let c of o){if(c.edges.length>64){t.push(`model ${c.modelId}: ${String(c.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=c.edges.map(Id).find(h=>h!==null);if(u!==void 0){t.push(`model ${c.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let f=0,m=0;for(let h of c.edges){if(!l(c.packageName,h.anchorExport,h.anchorContainer)){m+=1;continue}r.push({modelId:c.modelId,kind:h.kind,anchor:{packageName:c.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:a(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${c.modelId}: ${String(f)} edge(s) lowered, ${String(m)} reference-gated`):t.push(`model ${c.modelId}: refused \u2014 no anchor surface in the graph (${String(m)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:r,notes:t}}}var _d={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function di(e){try{let n=Ur(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(l=>l.split(en.sep).join("/"))),{graph:r,diagnostics:i,bindingApplicability:s}=gs(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:r,diagnostics:[...n.diagnostics,...i],...s!==void 0?{bindingApplicability:s}:{}}}catch(n){return{graph:_d,diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function ys(e,n){let t=512,r=(i,s)=>{if(!(t<=0||s>12)){if(t-=1,typeof i=="string"){n(i);return}if(Array.isArray(i)){for(let l of i)r(l,s+1);return}if(i!==null&&typeof i=="object")for(let[l,a]of Object.entries(i))l==="types"||l==="typings"||r(a,s+1)}};r(e,0)}function ks(e,n,t,r=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let i;try{i=Tn(en.resolve(e,t))}catch{return null}return i!==e&&!i.startsWith(n)||r&&!He(i)?null:i===e?"":i.slice(n.length).split(en.sep).join("/")}function Es(e){let n=Tn(e),t=n.endsWith(en.sep)?n:n+en.sep,r=new Set,i=[],s=[],l=[],a=(p,y,_=!1)=>{let L=ks(n,t,p);return L===null||L.length===0?"unresolved":r.has(L)?"duplicate":(r.add(L),i.push(L),s.push({source:y,specifier:Xe(typeof p=="string"?p:""),entrypoint:L,launch:_}),"added")},o=[],c=(p,y)=>{l.push({source:p,file:p,detail:y.detail}),o.push({code:y.code,path:p,detail:`${p} ${y.detail}`})},u,f,m,h=null,b=xs(n,t,"package.json",tn);b.kind==="refused"&&c("package.json",b);try{let p=b.kind==="ok"?JSON.parse(b.text):{};if(h=b.kind==="ok"?p:null,a(p.main,"main"),typeof p.bin=="string")a(p.bin,"bin");else if(p.bin!==null&&typeof p.bin=="object")for(let _ of Object.values(p.bin))a(_,"bin");ys(p.exports,_=>{a(_,"exports")}),ys(p.browser,_=>{a(_,"browser")});let y=p.scripts;if(y!==null&&typeof y=="object"){let _=y;u=_.start,f=_.prestart,m=_.poststart}}catch{}if(i.length===0)try{Tn(en.join(n,"index.js")),a("index.js","index.js fallback")}catch{}let S=(p,y)=>typeof p=="string"&&p.trim().length>0?Ss(p,y,"package.json",a,l,!1)==="used"?"resolved":"gapped":p===void 0||typeof p=="string"?"absent":(l.push({source:y,file:"package.json",detail:`${y} is not a string; no entry file could be read from it`}),"gapped"),x=S(u,"scripts.start"),w=S(f,"scripts.prestart"),A=S(m,"scripts.poststart"),$=x==="resolved"&&w!=="gapped"&&A!=="gapped",N=xs(n,t,"Procfile",65536);if(N.kind==="refused")c("Procfile",N);else if(N.kind==="ok"){let{entries:p,truncated:y,unnamedLines:_}=Zt(N.text);y&&l.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),_>0&&l.push({source:"Procfile",file:"Procfile",detail:`${String(_)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let L of p)Ss(L.command,`Procfile:${L.name}`,"Procfile",a,l,$)}let k=i.length===0?Jt(n,h):null;return{entrypoints:i,sources:s,gaps:l,diagnostics:o,framework:k}}function xs(e,n,t,r){let i;try{i=Tn(en.join(e,t))}catch{return{kind:"absent"}}if(!i.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=xn(i,r);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(r)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Ss(e,n,t,r,i,s){let l=Qt(e);return l.kind==="delegates"?s?"used":(i.push({source:n,file:t,detail:`\`${Xe(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped"):l.kind==="unparsed"?(i.push({source:n,file:t,detail:`\`${Xe(e)}\`: ${l.reason}`}),"gapped"):r(l.specifier,n,!0)==="unresolved"?(i.push({source:n,file:t,detail:`\`${Xe(l.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function ci(e,n){if(n.length===0||!e.some(r=>r.launch))return[];let t=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${t}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function ws(e,n){let t=Tn(e),r=t.endsWith(en.sep)?t:t+en.sep,i=new Set,s=[],l=[];for(let a of n){let o=ks(t,r,a,!0);if(o===null||o.length===0){l.push(a);continue}i.has(o)||(i.add(o),s.push(o))}return{entrypoints:s,rejected:l}}import{readdirSync as $s,readFileSync as hi,realpathSync as gi,statSync as jn}from"node:fs";import ze from"node:path";function Ad(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let r=t+2;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;let i=e.charCodeAt(r);return i===38||i===42}function Dn(e,n,t){let r=n.maxLines??2e6,i=n.maxLineBytes??16384,s=!1,l=!1,a=0,o=0,c=e.charCodeAt(0)===65279?1:0;for(;c<=e.length;){let u=e.indexOf(`
-`,c),f=u===-1;f&&(u=e.length);let m=u>c&&e.charCodeAt(u-1)===13?u-1:u;if(o+=1,o>r){s=!0;break}if(m-c>i)a+=1;else{let h=c;for(;h<m&&e.charCodeAt(h)===32;)h+=1;let b=h-c,S=m;for(;S>h&&(e.charCodeAt(S-1)===32||e.charCodeAt(S-1)===9);)S-=1;if(h<S&&e.charCodeAt(h)!==35){let x=e.slice(h,S);if(Ad(x)){l=!0;break}t(b,x)}}if(f)break;c=u+1}return{truncated:s||a>0,refusedAnchors:l,oversizeLines:a}}function ft(e){let n=e.charCodeAt(0);if(n===34||n===39){let r=e.indexOf(String.fromCharCode(n),1);if(r===-1)return null;let i=r+1;for(;i<e.length&&e.charCodeAt(i)===32;)i+=1;return e.charCodeAt(i)===58?e.slice(0,r+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function En(e){return e.endsWith(":")}function Be(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function pt(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,r=t.indexOf("/");if(n){if(r<=0||t.indexOf("/",r+1)!==-1)return!1}else if(r!==-1)return!1;let i=n?[t.slice(0,r),t.slice(r+1)]:[t];for(let s of i){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let l=0;l<s.length;l+=1){let a=s.charCodeAt(l);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function Fn(e){return pt(e)?`node_modules/${e}`:""}function Kn(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var vs=2e5,Is=64,Nd=1024,Cd=5,Od=[1,2,3];function Rd(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let r=e.slice(t+n.length);if(r==="")return null;let i=r.split("/");return i[0]?.startsWith("@")?i.length>=2?`${i[0]}/${i[1]}`:null:i[0]??null}function _s(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let r=t.indexOf("@",1);if(r>0){let i=t.slice(0,r),s=t.slice(r+1);if(i.length>0&&s.length>0)return[{name:i,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function wn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function As(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Ns(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Cs(e,n,t,r,i=!1){let s=JSON.stringify([n,t,r]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:r,dev:i})}}function Md(e,n){for(let[t,r]of Object.entries(e)){if(t==="")continue;if(!Ns(n))return;let i=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=wn(r);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let l=s.name,a=typeof l=="string"&&l!==""?l:Rd(t),o=s.version;if(a===null||typeof o!="string"){i&&(n.unread+=1);continue}let c=s.dev===!0||s.devOptional===!0;for(let u of _s(a,o))Cs(n,u.name,u.version,t,c)}}function Os(e,n,t){let r=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],i=!1;for(let s=0;s<r.length;s+=1){let l=r[s];if(l===void 0)break;for(let[a,o]of Object.entries(l.deps)){if(!Ns(n))return{depthCapped:i};if(a===""){n.unread+=1;continue}let c=wn(o);if(c===null){n.unread+=1;continue}let u=l.pathSafe&&pt(a),f=u?`${l.prefix}node_modules/${a}`:"",m=u&&f.length<=Nd,h=m?f:"",b=c.version,S=c.dev===!0||l.dev;if(c.link!==!0&&typeof b=="string"&&b!=="")for(let w of _s(a,b))Cs(n,w.name,w.version,h,S);else n.unread+=1;let x=wn(c.dependencies);if(x!==null){if(l.depth+1>t){i=!0;continue}r.push({deps:x,prefix:m?`${h}/`:l.prefix,depth:l.depth+1,pathSafe:m,dev:S})}}}return{depthCapped:i}}function $d(e,n,t){let r=As(n.maxEntries),{depthCapped:i}=Os(e,r,t),s=[],l=new Set(n.deps.map(c=>JSON.stringify([c.name,c.version]))),a=new Set,o=[];for(let c of r.deps){if(c.version.includes(":"))continue;let u=JSON.stringify([c.name,c.version]);l.has(u)||a.has(u)||(a.add(u),o.length<Cd&&o.push(Kn(c.name,c.version)))}if(a.size>0){let c=a.size-o.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${o.join(", ")}${c>0?`, and ${String(c)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(r.capped||i)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function mt(e,n={}){let t=[],r;try{r=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let i=wn(r);if(i===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=i.lockfileVersion,l=typeof s=="number"&&Number.isInteger(s)?s:null,a=typeof s=="number"?String(s):"?",o=wn(i.packages),c=wn(i.dependencies);if(o===null&&c===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(l===null||!Od.includes(l))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??Is,f=As(n.maxEntries??vs),m=!1;return o!==null?(Md(o,f),c!==null&&t.push(...$d(c,f,u))):c!==null&&(m=Os(c,f,u).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),m&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||m}}var Pd=["workspace:","link:","portal:","file:","exec:"];function Ld(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Td(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let r=n.slice(0,t),i=n.slice(t+1);if(r.length===0)return[];for(let a of Pd)if(i.startsWith(a))return[];if(!i.startsWith("npm:"))return[r];let s=i.slice(4),l=s.indexOf("@",1);if(l>0){let a=s.slice(0,l);return a.length>0?[a]:[r]}return s.length===0||Ld(s)?[r]:[r,s]}function Dd(e){if(En(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let r=e.charCodeAt(t);if(r===34||r===39){n===0?n=r:n===r&&(n=0);continue}if(n===0&&r===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Fd(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let r of n.split(",")){let i=r.trim();i.length>0&&t.push(i)}return t}function Kd(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let r=t.length;for(;r<n.length&&r<t.length+3;){let s=n.charCodeAt(r);if(s<48||s>57)break;r+=1}let i=n.slice(t.length,r);return i.length>0?i:null}function Rs(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Be(e.slice(8).trim());return t.length>0?t:null}function ui(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,l=!1,a=null,o=!1,c=[],u=!1,f=-1,m=!1,h=0,b=()=>{c.length>0&&!u&&(h+=1)},S=Dn(e,n,($,N)=>{if($===0){b(),c=[],u=!1,f=-1,o=!1;let p=Dd(N);if(p===null)return;let y=Be(p.trim());if(y==="__metadata"){l=!0,o=En(N);return}for(let _ of Fd(y))c.push(...Td(_));return}if(o){if($===2&&a===null){let p=Rs(N);p!==null&&(a=p)}return}if(c.length===0||(f===-1&&(f=$),$!==f||u))return;let k=Rs(N);if(k!==null){u=!0;for(let p of c){let y=JSON.stringify([p,k]);if(!i.has(y)){if(r.length>=s){m=!0;return}i.add(y),r.push({name:p,version:k,lockKey:Fn(p),dev:!1})}}}});b();let x=l?"yarn.lock (Berry)":"yarn.lock (v1)";if(S.refusedAnchors)return{deps:[],diagnostics:[`${x} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};S.oversizeLines>0&&t.push(`${x} has ${String(S.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),m&&t.push(`${x} exceeds ${String(s)} entries; truncated`);let w=a??Kd(e),A=w===null?null:Number(w.split(".")[0]);return w!==null&&(A===null||!Number.isInteger(A)||A<1||A>8)&&t.push(`${x} declares unsupported lockfileVersion ${w} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${x} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:r,diagnostics:t,truncated:S.truncated||m}}function fi(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.indexOf("_");return r!==-1&&(n=n.slice(0,r)),n.trim()}function pi(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Ms(e){let n=Be(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.charCodeAt(0)===47;if(r&&(n=n.slice(1)),n.length===0)return null;if(!r&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),f=n.indexOf("@",1);u>0&&(f===-1||u<f)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let i=n.charCodeAt(0)===64,s=i?n.indexOf("/"):-1;if(i&&s<=0)return null;let l=i?s+1:0,a=-1;for(let u=l;u<n.length;u+=1){let f=n.charCodeAt(u);if(f===47||f===64){a=u;break}}if(a<=l)return null;let o=n.slice(0,a),c=fi(n.slice(a+1));return pi(c)?{name:o,version:c}:null}var jd=new Set(["packages","snapshots","importers"]),Bd=new Set([5,6,7,8,9]);function zd(e){let n=Be(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function gt(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Be(e.slice(0,n).trim()),value:Be(t)}}function mi(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,l="",a=null,o=!1,c=0,u=[],f=(h,b)=>{let S=JSON.stringify([h,b]);if(!i.has(S)){if(r.length>=s){o=!0;return}i.add(S),r.push({name:h,version:b,lockKey:Fn(h),dev:!1})}},m=Dn(e,n,(h,b)=>{if(h===0){let S=ft(b);if(l=S===null?"":Be(S.trim()),a=null,l==="lockfileVersion"){let x=gt(b),w=x===null?null:zd(x.value);x!==null&&(w===null||!Bd.has(w))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${x.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),l="";return}if(jd.has(l)&&!En(b)){let x=gt(b)?.value.trim()??"";x!=="{}"&&x!=="[]"&&(c+=1),l=""}return}if(l==="packages"||l==="snapshots"){if(h!==2)return;let S=ft(b),x=S===null?null:Ms(S);if(x===null){c+=1;return}f(x.name,x.version);return}if(l==="importers"){if(h===6){let S=gt(b);if(S===null){a=b.endsWith(":")?Be(b.slice(0,-1).trim()):null;return}a=null;let x=fi(S.value);pi(x)&&f(S.key,x);return}if(h===8&&a!==null){let S=gt(b);if(S===null||S.key!=="version")return;let x=fi(S.value);pi(x)&&f(a,x)}}});return m.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),m.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(m.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),o&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),c>0&&t.push(`pnpm-lock.yaml has ${String(c)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:r,diagnostics:t,truncated:m.truncated||o})}var Ud=128*1024*1024,Vd=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>mt(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>mt(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>ui(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>mi(e,n===void 0?{}:{maxEntries:n})}],qd=[".pnp.cjs",".pnp.data.json",".pnp.js"];function yi(e,n){let t;try{t=gi(ze.join(e,n))}catch{return null}let r=e.endsWith(ze.sep)?e:e+ze.sep;return t.startsWith(r)?t:null}function Ps(e,n){let t=ze.join(e,"package.json"),r;try{r=gi(t)}catch{return null}if(!r.startsWith(n+ze.sep))return null;try{if(!jn(r).isFile())return null;let i=JSON.parse(hi(r,"utf8"));return typeof i.name!="string"||typeof i.version!="string"?null:{name:i.name,version:i.version}}catch{return null}}function Ls(e,n){try{return jn(ze.join(e,n)),!0}catch{return!1}}function Hd(e,n){if(Ls(e,"pnpm-workspace.yaml"))return!0;let t=yi(e,"package.json");if(t===null)return Ls(e,"package.json");let r;try{let l=jn(t);if(!l.isFile()||l.size>n)return!0;r=hi(t,"utf8")}catch{return!0}let i;try{i=JSON.parse(r)}catch{return!0}for(let l of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=i[l];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let s=i.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function Ts(e,n){let t=ze.join(e,"node_modules"),r=[],i;try{i=$s(t,{withFileTypes:!0})}catch{return r}for(let s of i){let l=s.name;if(l.startsWith("."))continue;if(l.startsWith("@")){let o;try{o=$s(ze.join(t,l),{withFileTypes:!0})}catch{continue}for(let c of o){let u=Ps(ze.join(t,l,c.name),n);u!==null&&r.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${l}/${c.name}`,linked:c.isSymbolicLink()||s.isSymbolicLink()})}continue}let a=Ps(ze.join(t,l),n);a!==null&&r.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${l}`,linked:s.isSymbolicLink()})}return r}var Wd=5;function Gd(e,n,t){let r=yi(e,n);if(r===null){try{jn(ze.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let i;try{i=jn(r)}catch{return null}if(!i.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(i.size>t)return{gap:`${n} is ${String(i.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:hi(r,"utf8")}}catch{return{gap:`${n} could not be read`}}}function Ds(e,n){let t=gi(e),r=[],i=[],s=n?.maxLockfileBytes??Ud,l=[],a=new Set,o=[],c=Hd(t,s),u=null,f=!1,m=(b,S,x)=>{i.push({kind:b,detail:S,blindsAnalysis:x}),r.push(S)};for(let b of Vd){let S=Gd(t,b.file,s);if(S===null)continue;if("gap"in S){m("lockfile-unreadable",S.gap,!1);continue}let x=b.parse(S.text,n?.maxLockfileEntries);if(x.truncated&&(f=!0),x.deps.length===0){if(x.diagnostics.length>0||c){let w=x.diagnostics.length>0?x.diagnostics.join("; "):"no entries found";m("lockfile-unparsed",`${b.file} yielded NO dependencies (${w}); its transitive dependency set was not enumerated`,!1)}continue}x.diagnostics.length>0&&m("lockfile-partial",`${b.file} was only partly enumerated (${x.diagnostics.join("; ")})`,!1),u===null&&(u=b.file),o.includes(b.source)||o.push(b.source);for(let w of x.deps){let A=JSON.stringify([w.name,w.version,w.lockKey]);a.has(A)||(a.add(A),l.push(w))}}for(let b of qd)if(yi(t,b)!==null){m("yarn-pnp",`${b} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(l.length>0){let b=o.length===1?o[0]??"none":"multi-lockfile";o.length>1&&r.push(`multiple lockfiles present (${o.join(", ")}); enumerated the UNION of all of them`);let S=new Set(l.map(A=>JSON.stringify([A.name,A.version]))),x=new Set,w=[];for(let A of Ts(t,t)){let $=JSON.stringify([A.name,A.version,A.lockKey]);a.has($)||(a.add($),l.push({name:A.name,version:A.version,lockKey:A.lockKey,dev:A.dev}));let N=JSON.stringify([A.name,A.version]);A.linked||S.has(N)||x.has(N)||(x.add(N),w.length<Wd&&w.push(Kn(A.name,A.version)))}if(x.size>0){let A=x.size-w.length;m("lockfile-skew",`node_modules holds ${String(x.size)} package(s) at a (name, version) no lockfile lists (${w.join(", ")}${A>0?`, and ${String(A)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:l,source:b,lockfilePath:u,diagnostics:r,truncated:f,gaps:i}}let h=Ts(t,t);return h.length>0?(m("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(b=>({name:b.name,version:b.version,lockKey:b.lockKey,dev:!1})),source:"node-modules",lockfilePath:null,diagnostics:r,truncated:f,gaps:i}):(c&&m("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:r,truncated:f,gaps:i})}import{readdirSync as Xd,readFileSync as Jd}from"node:fs";import Yd from"node:path";var Qd=new Set(["summarized","crashed","over-cap"]),Zd=new Set(["function","method","ctor"]);function se(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function xi(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ec(e,n){xi(e)||se(n,"edge is not an object");let{entryPath:t,entryExport:r,entryContainer:i,hops:s}=e;(typeof t!="string"||typeof r!="string")&&se(n,"edge entry fields must be strings"),i!==null&&typeof i!="string"&&se(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&se(n,"hops must be a non-negative integer");let l=e.target;if(xi(l)||se(n,"edge target missing"),l.kind==="symbol"){let{exportName:a,container:o,symbolKind:c}=l;return typeof a!="string"&&se(n,"symbol target exportName"),o!==null&&typeof o!="string"&&se(n,"symbol target container"),(typeof c!="string"||!Zd.has(c))&&se(n,`symbol target kind ${JSON.stringify(c)}`),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"symbol",exportName:a,container:o,symbolKind:c},hops:s}}if(l.kind==="dep"){let{calleePackage:a,calleeSubpath:o,calleeExport:c}=l;return(typeof a!="string"||a.length===0)&&se(n,"dep target calleePackage"),o!==null&&typeof o!="string"&&se(n,"dep target calleeSubpath"),(typeof c!="string"||c.length===0)&&se(n,"dep target calleeExport"),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"dep",calleePackage:a,calleeSubpath:o,calleeExport:c},hops:s}}se(n,`unknown target kind ${JSON.stringify(l.kind)}`)}function nc(e,n){xi(e)||se(n,"root is not an object");let{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:l,status:a}=e;(typeof t!="string"||t.length===0)&&se(n,"packageName"),typeof r!="string"&&se(n,"analyzedVersion"),i!=="jelly"&&se(n,`tool ${JSON.stringify(i)} (only 'jelly' exists)`),typeof s!="string"&&se(n,"toolVersion"),typeof l!="number"&&se(n,"maxIndirections"),(typeof a!="string"||!Qd.has(a))&&se(n,`status ${JSON.stringify(a)} not in the enum`);let o=e.edges;return Array.isArray(o)||se(n,"edges is not an array"),a!=="summarized"&&o.length>0&&se(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:l,status:a,edges:o.map(c=>ec(c,n))}}function Fs(e){let n=new Map,t=Xd(e).filter(r=>r.endsWith(".summary.json"));for(let r of t){let i=Yd.join(e,r),s;try{s=JSON.parse(Jd(i,"utf8"))}catch(o){se(r,`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}let l=nc(s,r),a=n.get(l.packageName);a===void 0?n.set(l.packageName,[l]):a.push(l)}return n}import{readFileSync as tc,statSync as ic}from"node:fs";var bi=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,yt=/^[A-Za-z0-9_$.-]{1,128}$/u,Ks=64,js=1024*1024,Bs=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,zs=/^[A-Za-z0-9@_.-]{1,128}$/u;function le(e){throw new Error(`model claims rejected: ${e}`)}function Si(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function rc(e,n){Si(e)||le(`${n}: edge is not an object`);let{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:l,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&le(`${n}: edge kind`),(typeof r!="string"||!yt.test(r))&&le(`${n}: anchorExport ${JSON.stringify(r)}`),i!==null&&(typeof i!="string"||!yt.test(i))&&le(`${n}: anchorContainer`),(typeof s!="string"||!bi.test(s))&&le(`${n}: calleePackage ${JSON.stringify(s)}`),l!==null&&(typeof l!="string"||!yt.test(l))&&le(`${n}: calleeContainer`),(typeof a!="string"||!yt.test(a))&&le(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:l,calleeExport:a}}function Us(e){let n=ic(e).size;n>js&&le(`file is ${String(n)} bytes, over the ${String(js)} cap`);let t;try{t=JSON.parse(tc(e,"utf8"))}catch(i){le(`unparseable JSON: ${i instanceof Error?i.message:String(i)}`)}Array.isArray(t)||le("root is not an array"),t.length>Ks&&le(`${String(t.length)} claims over cap ${String(Ks)}`);let r=[];for(let i of t){Si(i)||le("claim is not an object");let{packageName:s,modelId:l,range:a,edges:o}=i;(typeof s!="string"||!bi.test(s))&&le("packageName"),(typeof l!="string"||!zs.test(l))&&le("modelId (identifier charset, 1-128 chars)"),r.some(u=>u.model.modelId===l)&&le(`duplicate modelId ${l} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Si(a)||typeof a.introduced!="string")&&le(`${l}: range`),Bs.test(a.introduced)||le(`${l}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let c=a.fixedBefore;c!==null&&typeof c!="string"&&le(`${l}: fixedBefore`),typeof c=="string"&&!Bs.test(c)&&le(`${l}: range.fixedBefore ${JSON.stringify(c)} is not an exact x.y.z triple`),Array.isArray(o)||le(`${l}: edges`),o.length>64&&le(`${l}: ${String(o.length)} edges over cap ${String(64)}`),r.push({model:{packageName:s,modelId:l,edges:o.map(u=>rc(u,l))},introduced:a.introduced,fixedBefore:c})}return r}var sc=["in-app-purchase@1-v1"];function ki(e,n,t){let r=[],i=[],s=[],l=(a,o,c,u)=>{i.push(c),s.push({modelId:u??a.model.modelId,status:o,reason:c,edgeCount:a.model.edges.length})};for(let a of e){if(!bi.test(a.model.packageName)||!zs.test(a.model.modelId)){l(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&sc.includes(a.model.modelId)){l(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){l(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let o=n(a.model.packageName);if(o===void 0){l(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let c;try{c=an(o,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{l(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${o} not an exact triple \u2014 inert (never guessed)`);continue}if(!c){l(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${o} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}r.push(a.model),s.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:r,notes:i,dispositions:s}}var oc=4,ac={additiveForms:!0,namelessExports:!0},lc=new Set(["dep-opaque","dynamic-load","dispatch"]),dc={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function wi(e,n,t){return e.tier==="unknown"&&dc[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&lc.has(e.unknownKind)&&n!==null&&n.verified}var cc=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),Ue=class extends Error{},vi="cupel/coverage-gap",uc={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function bt(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Gs(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Xs(e,n,t){let r=new Map(e.modules.map(l=>[l.path,l.id])),i=e.modules[0]?.id;if(i===void 0)return[];let s=n.map(l=>({source:r.get(l.path)??i,cause:uc[l.code],reach:l.classScope!==void 0?{kind:"class-scope",packageName:l.classScope.packageName,container:l.classScope.container}:l.anchor!==void 0?{kind:"via-module",anchor:l.anchor}:{kind:"unbounded"}}));return t&&s.push({source:i,reach:{kind:"unbounded"},cause:"resolution-divergence"}),s}function Ei(e,n,t,r,i){let s=t.filter(l=>l.exportName!==null&&(r===1||i||l.verified!==1));return s.length>0?s.map(l=>({advisoryId:e,packageName:n,exportName:l.exportName??"",container:l.container,symbolKind:l.symbolKind,sourcePath:l.sourcePath??"",derivation:l.derivation,confidence:l.confidence,verified:l.verified===1})):t.length===0||t.every(l=>l.exportName!==null&&l.verified===1)?[null]:[]}function fc(e){let n;try{n=kt(e)}catch{return!0}try{if(St(Ye.join(n,"pnpm-workspace.yaml")).isFile())return!0}catch{}try{let s=JSON.parse(Ys(Ye.join(n,"package.json"),"utf8"))?.workspaces;if(Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null)return!0}catch{}let t=3,r=(i,s)=>{if(s>t)return!1;let l;try{l=Js(i)}catch{return!1}for(let a of l){if(a==="node_modules"||a.startsWith("."))continue;let o=Ye.join(i,a),c;try{c=St(o)}catch{continue}if(c.isDirectory()){try{if(St(Ye.join(o,"package.json")).isFile())return!0}catch{}if(r(o,s+1))return!0}}return!1};return r(n,1)}function pc(e,n,t){let r=[];if(t&&r.push("nested-app-root"),n==="")return[...r,"manifest-unreadable"];let i;try{if(i=kt(Ye.resolve(e,n)),!i.startsWith(kt(e)+Ye.sep))return[...r,"manifest-unreadable"]}catch{return[...r,"manifest-unreadable"]}let s;try{let u=Ye.join(i,"package.json");if(!St(u).isFile())return[...r,"manifest-unreadable"];s=Ys(u,"utf8")}catch{return[...r,"manifest-unreadable"]}let l;try{l=JSON.parse(s)}catch{return[...r,"manifest-unreadable"]}if(typeof l!="object"||l===null)return[...r,"manifest-unreadable"];let a=l;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&r.push("bin");let o=["preinstall","install","postinstall","prepare","prepublish"],c=a.scripts;if(typeof c=="object"&&c!==null){let u=c;o.some(f=>typeof u[f]=="string")&&r.push("install-script")}return(a.gypfile===!0||mc(i))&&r.push("native-artifact"),r}function mc(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=Ye.join(e,n),r;try{r=Js(t)}catch{continue}if(r.some(i=>i.endsWith(".node")))return!0}return!1}function xt(e,n,t,r,i,s,l){let a=Lt({graph:e,installed:t,range:r,symbol:i,coverage:null,incompleteness:s,analysisAborted:l});if(n!==null&&i!==null&&wi(a,i,"base")){let o=Nn(e,n.modulesById,n.reachMods,i,n.records);if(o!==null)return{finding:a,hit:o}}return{finding:a,hit:null}}function hc(e,n){let t=new Set,r=[];for(let i of e.packages)for(let{advisory:s,affected:l}of n.advisoriesForPackage("npm",i.name)){let a=bt(s.id,i.name,l),o;try{o=an(i.version,a)}catch{continue}if(o)for(let c of n.symbolsForAffected(l.id)){if(c.verified!==1||c.symbolKind!=="method"&&c.symbolKind!=="ctor"||c.container===null||c.sourcePath===null)continue;let u=`${i.lockKey}\0${c.container}\0${c.sourcePath}`;t.has(u)||(t.add(u),r.push({packageName:i.name,packageRootRel:i.lockKey,container:c.container,sourcePath:c.sourcePath}))}}return r.sort((i,s)=>`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),r.slice(0,lt)}function gc(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),i=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),l=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let o=s.get(a.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let m=n.get(f.moduleId);m!==void 0&&m.packageName!==u.packageName&&l.push({packageName:m.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:c.id})}return l}function yc(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),r=new Map(e.functions.map(u=>[u.id,u])),i=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&i.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let f=s.get(u.exportId);if(f===void 0||!n.has(f.moduleId))continue;let m=r.get(u.target.functionId);m===void 0||t.get(m.moduleId)?.externalSurface===!0||i.add(m.id)}let l=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),a=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let f=l.get(u.callSiteId);if(f===void 0)continue;let m=a.get(f);m===void 0?a.set(f,[u.calleeFunctionId]):m.push(u.calleeFunctionId)}let o=new Set(i),c=[...i];for(;c.length>0;){let u=c.pop();if(u!==void 0)for(let f of a.get(u)??[])o.has(f)||(o.add(f),c.push(f))}return o}function xc(e,n,t,r){for(let i of n){if(i.modelId!==e.modelId||i.anchor.packageName!==e.anchorPackage||i.anchor.exportName!==e.entryExport)continue;let s=t.filter(a=>a.packageName===i.anchor.packageName&&a.exportName===i.anchor.exportName&&a.container===i.anchor.container),l=s.find(a=>a.resolution==="resolved")??s[0];if(l!==void 0)return r.has(l.callerFunctionId)}return null}function Sc(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let r=new Set(t),i=s=>r.has(s)||r.has(Me[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&i(s.unknownKind)||s.modelPromotedFromKind!==void 0&&i(s.modelPromotedFromKind))}function Ii(e){let n=kt(e.dir),t=e.reader??Ft(e.shardPath),r=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(dn))throw new Ue(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${dn})`);let i=null;if(e.summaryShadow!==void 0)try{i=Fs(e.summaryShadow)}catch(F){throw new Ue(`--summary-shadow facts dir rejected: ${F instanceof Error?F.message:String(F)}`)}let s=null;if(e.modelShadow!==void 0)try{s=Us(e.modelShadow.claimsPath)}catch(F){throw new Ue(`--model-shadow claims rejected: ${F instanceof Error?F.message:String(F)}`)}let l=Ds(n);if(l.truncated)throw new Ue(`the dependency enumeration hit a hard cap and is incomplete (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`);let a=e.entry??[],o=a.length>0?ws(n,a):{entrypoints:[],rejected:[]},c=o.rejected,u=Es(n),f=[...new Set([...u.entrypoints,...o.entrypoints])],m=[...u.sources];for(let F of o.entrypoints)u.entrypoints.includes(F)||m.push({source:"--entry",specifier:F,entrypoint:F,launch:!1});let h=hc(l,t),b=e.bindingForms??ac,S=e.callablePackageResolver===!0,x=e.tsconfigPaths===!0,w=fc(n),A=new Map(l.packages.map(F=>[F.name,pc(n,F.lockKey,w)])),$=F=>A.get(F)??["manifest-unreadable"],N=di({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:b,callablePackageResolver:S,tsconfigPaths:x}),k=N.graph,p=[...u.diagnostics,...ci(u.sources,u.gaps),...N.diagnostics],y=Gs(f.length,k),_=l.gaps.some(F=>F.blindsAnalysis),L=Xs(k,p,_),z=t.allModels?.()??[],I=ki(z.map(F=>({model:{packageName:F.packageName,modelId:F.modelId,edges:F.edges},introduced:F.introduced,fixedBefore:F.fixedBefore})),F=>l.packages.find(re=>re.name===F)?.version),C=I.models.length>0?Ln(k,I.models).delta:null,K=C!==null?{records:C.records,reachMods:ln(k),modulesById:new Map(k.modules.map(F=>[F.id,F]))}:null,M=[],R=cc(),V=[],X=[];for(let F of l.packages)for(let{advisory:re,affected:xe}of t.advisoriesForPackage("npm",F.name)){let oe=bt(re.id,F.name,xe),ke=re.cveId??re.id,Z=t.symbolsForAffected(xe.id),Le=Z.filter(O=>O.exportName===null),E=Ei(re.id,F.name,Z,xe.surfaceComplete,r),v=xt(k,K,{name:F.name,version:F.version,devOnly:F.dev,outOfGraphExecution:$(F.name)},oe,null,L,y).finding;if(v.decidedAtStage==="presence"||v.decidedAtStage==="version-match"){R[v.tier]+=1,M.push({...v,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:oe.surfaceComplete,advisoryId:re.id,displayId:ke,packageName:F.name,version:F.version,symbolName:null,symbolPath:null,severity:re.severity,packageLocation:l.lockfilePath});continue}for(let O of E){let{finding:T,hit:W}=xt(k,K,{name:F.name,version:F.version,devOnly:F.dev,outOfGraphExecution:$(F.name)},oe,O,L,y),ie=T,_e,Se;W!==null&&O!==null&&(_e=W.modelId,Se=T.unknownKind,ie={basis:void 0,tier:W.tier,decidedAtStage:T.decidedAtStage,reason:`boundary model ${W.modelId}: ${W.anchorPackage}.${W.entryExport} reaches ${O.exportName} [${W.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Gn(O),path:void 0,unresolvedSites:T.unresolvedSites}),R[ie.tier]+=1;let ae={...ie,modelId:_e,modelPromotedFromKind:Se,surfaceComplete:oe.surfaceComplete,advisoryId:re.id,displayId:ke,packageName:F.name,version:F.version,symbolName:O?.exportName??null,symbolPath:O?.sourcePath||null,severity:re.severity,packageLocation:l.lockfilePath};M.push(ae);let de=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&ae.tier==="unknown"&&ae.decidedAtStage==="symbol-reachable"&&ae.unknownKind!==void 0&&de.has(ae.unknownKind)&&O!==null&&V.push({finding:ae,symbol:O}),s!==null&&ae.tier==="unknown"&&O!==null&&X.push({finding:ae,symbol:O})}for(let O of Le)R.unknown+=1,M.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:oe.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${ke} carries a ${O.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],advisoryId:re.id,displayId:ke,packageName:F.name,version:F.version,symbolName:null,symbolPath:null,severity:re.severity,packageLocation:l.lockfilePath})}for(let F of l.gaps)R.unknown+=1,M.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:F.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],advisoryId:vi,displayId:vi,packageName:F.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:l.lockfilePath});let te=R["reachable-high"]+R["reachable-medium"],J=e.failOnReachable===!0&&te>0,j=Sc(M,R.unknown,e.failOnUnknown),H=e.requireCompleteDenial===!0&&M.some(F=>F.tier==="not-reachable"&&F.basis==="loader-assumption"),fe=J||j||H?2:0,Re;if(i!==null){let F=ln(k),re=new Map(k.modules.map(oe=>[oe.id,oe])),xe=[];for(let{finding:oe,symbol:ke}of V){let Z=Pt(k,re,F,ke,i,oc);xe.push({advisoryId:oe.advisoryId,packageName:oe.packageName,symbolName:oe.symbolName,unknownKind:oe.unknownKind??null,wouldPromote:Z!==null,...Z!==null?{anchorPackage:Z.anchorPackage,entryExport:Z.entryExport,viaPackages:Z.viaPackages,totalHops:Z.totalHops}:{}})}Re={records:xe}}let ye;if(s!==null&&e.modelShadow!==void 0){let F=e.modelShadow.widened===!0?"widened":"base",re=new Map(l.packages.map(D=>[D.name,D.version])),{models:xe,notes:oe,dispositions:ke}=ki(s,D=>re.get(D),{shadowConsultDenylisted:!0}),{delta:Z}=Ln(k,xe),Le=ln(k),E=new Map(k.modules.map(D=>[D.id,D])),v=gc(k,E,Le),O=yc(k),T=Z.records.some(D=>v.some(q=>q.packageName===D.anchor.packageName&&q.exportName===D.anchor.exportName&&q.container===D.anchor.container)),W=[],ie=Date.now();for(let{finding:D,symbol:q}of X){let Fe=Z.records,he=wi(D,q,F),Y=he?Nn(k,E,Le,q,Fe):null,Ae=Z.records.filter(we=>we.callee.packageName===q.packageName&&we.callee.exportName===q.exportName&&we.callee.container===q.container||we.callee.packageName===q.packageName&&we.callee.realFunctionId!==null);W.push({advisoryId:D.advisoryId,packageName:D.packageName,symbolName:D.symbolName,unknownKind:D.unknownKind??null,decidedAtStage:D.decidedAtStage,consultSurface:F,noHitReason:Y!==null?null:he?T?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Y!==null?xc(Y,Fe,v,O):null,verdictBefore:D.tier,verdictAfter:Y!==null?"reachable-low":D.tier,wouldPromote:Y!==null,...Y!==null?{modelId:Y.modelId,anchorPackage:Y.anchorPackage,entryExport:Y.entryExport,pathLabels:Y.pathLabels,calleeBinding:Ae.find(we=>we.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:he?Ae.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Ae[0]?.anchor.packageName??"?"}#${Ae[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let _e=Date.now()-ie,Se=ke.map(D=>{if(D.status!=="active")return{modelId:D.modelId,state:D.status,reason:D.reason,edgesLowered:0,edgesReferenceGated:0};let q=Z.records.filter(he=>he.modelId===D.modelId).length;if(q>0)return{modelId:D.modelId,state:"lowered",reason:null,edgesLowered:q,edgesReferenceGated:D.edgeCount-q};let Fe=Z.notes.find(he=>he.startsWith(`model ${D.modelId}:`)||he.startsWith(`model-edge ${D.modelId}:`));return{modelId:D.modelId,state:"refused",reason:Fe??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:D.edgeCount}}),ae=W.filter(D=>D.wouldPromote).length,de=R.unknown-ae,De=R["reachable-high"]+R["reachable-medium"],nn=D=>({none:0,"fail-on-reachable":De>0?2:0,"fail-on-unknown":D>0?2:0,both:De>0||D>0?2:0});ye={records:W,notes:[...oe,...Z.notes],laneStates:Se,exitCodes:{baseline:nn(R.unknown),withModels:nn(de)},overlayWallMs:_e},qs(Ye.dirname(e.modelShadow.outPath),{recursive:!0});let U=`${e.modelShadow.outPath}.tmp-${Vs(8).toString("hex")}`;Ws(U,`${JSON.stringify(ye,null,2)}
-`,{encoding:"utf8",flag:"wx"}),Hs(U,e.modelShadow.outPath)}let be;if(e.bindingShadow!==void 0){let F=Date.now(),re=U=>I.models.length>0?{records:Ln(U,I.models).delta.records,reachMods:ln(U),modulesById:new Map(U.modules.map(D=>[D.id,D]))}:null,xe=(U,D,q,Fe)=>{let he=[];for(let Y of l.packages)for(let{advisory:Ae,affected:we}of t.advisoriesForPackage("npm",Y.name)){let yn=bt(Ae.id,Y.name,we),To=Ei(Ae.id,Y.name,t.symbolsForAffected(we.id),we.surfaceComplete,r);for(let Vi of To){let{finding:qi,hit:Mt}=xt(U,Fe,{name:Y.name,version:Y.version,devOnly:Y.dev,outOfGraphExecution:$(Y.name)},yn,Vi,D,q);he.push({advisoryId:Ae.id,packageName:Y.name,symbolName:Vi?.exportName??null,tier:Mt!==null?Mt.tier:qi.tier,unknownKind:Mt!==null?null:qi.unknownKind??null})}}return he},oe=U=>{let D=di({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:U,callablePackageResolver:S,tsconfigPaths:x}),q=[...u.diagnostics,...ci(u.sources,u.gaps),...D.diagnostics];return{graph:D.graph,inc:Xs(D.graph,q,_),aborted:Gs(f.length,D.graph),live:re(D.graph),applicability:D.bindingApplicability}},ke=U=>{let D=oe(U);return xe(D.graph,D.inc,D.aborted,D.live)},Z=oe({}),Le=xe(Z.graph,Z.inc,Z.aborted,Z.live),E=xe(k,L,y,K);if(E.length!==Le.length)throw new Ue("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let v=(U,D)=>D.tier!==U.tier||D.unknownKind!==U.unknownKind,O=Le.some((U,D)=>{let q=E[D];return q!==void 0&&v(U,q)}),T=O?ke({additiveForms:!0}):null,W=O?ke({namelessExports:!0}):null,ie=0,_e=Le.map((U,D)=>{let q=E[D];if(q===void 0||q.advisoryId!==U.advisoryId||q.packageName!==U.packageName||q.symbolName!==U.symbolName)throw new Ue("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Fe={advisoryId:U.advisoryId,packageName:U.packageName,symbolName:U.symbolName,unknownKind:U.unknownKind,verdictBefore:U.tier,verdictAfter:q.tier,wouldPromote:q.tier!==U.tier&&(q.tier==="reachable-high"||q.tier==="reachable-medium"||q.tier==="reachable-low")};if(!v(U,q)||T===null||W===null)return Fe;ie+=1;let he=T[D],Y=W[D],Ae=he!==void 0&&v(U,he),we=Y!==void 0&&v(U,Y);return{...Fe,attributedArm:Ae&&!we?"additiveForms":we&&!Ae?"namelessExports":"both",...he!==void 0?{verdictArmA:he.tier}:{},...Y!==void 0?{verdictArmB:Y.tier}:{}}}),Se={...R};Le.forEach((U,D)=>{let q=E[D];q!==void 0&&q.tier!==U.tier&&(Se[q.tier]-=1,Se[U.tier]+=1)});let ae=(U,D)=>({none:0,"fail-on-reachable":U>0?2:0,"fail-on-unknown":D>0?2:0,both:U>0||D>0?2:0}),de;if(I.models.length>0&&K!==null){de=[];for(let U of l.packages)for(let{advisory:D,affected:q}of t.advisoriesForPackage("npm",U.name)){let Fe=bt(D.id,U.name,q),he=Ei(D.id,U.name,t.symbolsForAffected(q.id),q.surfaceComplete,r);for(let Y of he){if(Y===null||!Y.verified)continue;let Ae=xt(Z.graph,Z.live,{name:U.name,version:U.version,devOnly:U.dev,outOfGraphExecution:$(U.name)},Fe,Y,Z.inc,Z.aborted);if(!(Ae.hit===null&&wi(Ae.finding,Y,"base")))continue;let yn=Nn(k,K.modulesById,K.reachMods,Y,K.records);de.push({advisoryId:D.id,packageName:U.name,symbolName:Y.exportName,modelWouldPromote:yn!==null,...yn!==null?{modelId:yn.modelId}:{},anchorCleared:yn!==null})}}}let De=M.some(U=>U.modelId!==void 0);be={records:_e,deltas:ie,exitCodes:{baseline:ae(Se["reachable-high"]+Se["reachable-medium"],Se.unknown+(De?1:0)),withBindingForms:ae(R["reachable-high"]+R["reachable-medium"],R.unknown+(De?1:0))},dualRunWallMs:Date.now()-F,...N.bindingApplicability!==void 0?{applicability:N.bindingApplicability}:{},...de!==void 0?{modelProbe:de}:{}},qs(Ye.dirname(e.bindingShadow.outPath),{recursive:!0});let nn=`${e.bindingShadow.outPath}.tmp-${Vs(8).toString("hex")}`;Ws(nn,`${JSON.stringify(be,null,2)}
-`,{encoding:"utf8",flag:"wx"}),Hs(nn,e.bindingShadow.outPath)}let In=z.length>0||I.notes.length>0?{active:I.models.length,stored:z.length,promoted:M.filter(F=>F.modelId!==void 0).length,notes:[...I.notes,...C!==null?C.notes:[]]}:void 0;return{...Re!==void 0?{summaryShadow:Re}:{},...ye!==void 0?{modelShadow:ye}:{},...be!==void 0?{bindingShadow:be}:{},...In!==void 0?{modelLane:In}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:M,counts:R,analyzerDiagnostics:p,analysisAborted:y,rejectedEntries:c,entrypointSources:m,entrypointGaps:u.gaps,framework:u.framework,exitCode:fe}}finally{e.reader===void 0&&t.close()}}var bc="cupel",kc="reachability-first SCA \u2014 verdict + call path + confidence";function _i(e){return[`${bc} v${e} \u2014 ${kc}`,`cascade: ${Ji.join(" \u2192 ")}`,`verdicts: ${Yi.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)"].join(`
-`)}var Ec=new Set([...Tt,...Dt]);function hn(e,n,t){let r=e[n+1];if(r===void 0||r.startsWith("--"))throw new Error(`${t} requires a value`);return r}function wc(e){let n=e.split(",").map(i=>i.trim()),t=[...Tt,...Dt].join(", ");if(n.length===0||n.some(i=>i===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let r=[];for(let i of n){if(!Ec.has(i))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(i)}; valid: ${t}`);r.push(i)}return r}function Qs(e){let n=".",t,r,i=!1,s=!1,l=!1,a=!1,o=!1,c,u,f,m=!1,h=!1,b,S=!1,x=!1,w,A=[];for(let $=0;$<e.length;$+=1){let N=e[$];if(N==="--require-complete-denial"){s=!0;continue}if(N==="--fail-on-reachable")i=!0;else if(N==="--fail-on-unknown")l="all";else if(N!==void 0&&N.startsWith("--fail-on-unknown="))l=wc(N.slice(18));else if(N==="--offline")a=!0;else if(N==="--sarif")t=hn(e,$,"--sarif"),$+=1;else if(N==="--shard")r=hn(e,$,"--shard"),$+=1;else if(N==="--entry")A.push(hn(e,$,"--entry")),$+=1;else if(N==="--summary-shadow")c=hn(e,$,"--summary-shadow"),$+=1;else if(N==="--model-shadow")u=hn(e,$,"--model-shadow"),$+=1;else if(N==="--model-shadow-out")f=hn(e,$,"--model-shadow-out"),$+=1;else if(N==="--model-shadow-widened")m=!0;else if(N==="--binding-shadow")h=!0;else if(N==="--binding-shadow-out")b=hn(e,$,"--binding-shadow-out"),$+=1;else if(N==="--x-partial-rows")S=!0;else if(N==="--push")x=!0;else if(N!==void 0&&N.startsWith("--auth=")){let k=N.slice(7);if(k!=="oidc"&&k!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(k)}`);w=k}else{if(N!==void 0&&N.startsWith("--"))throw new Error(`unknown flag ${N}`);N!==void 0&&!o&&(n=N,o=!0)}}if(u===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(m&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(b!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(w!==void 0&&!x)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:r,failOnReachable:i,requireCompleteDenial:s,failOnUnknown:l,offline:a,entry:A,summaryShadow:c,modelShadow:u,modelShadowOut:f,modelShadowWidened:m,push:x,auth:w,bindingShadow:h,bindingShadowOut:b,partialRows:S}}import{randomBytes as vc,createHash as Ic}from"node:crypto";import{mkdirSync as _c,readFileSync as Ac,renameSync as Nc,writeFileSync as Cc}from"node:fs";import{homedir as Oc}from"node:os";import gn from"node:path";var Ai="latest.json",Ni="latest.json.sig";function Et(e){return Ic("sha256").update(e).digest("hex")}function Zs(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=Oc();if(process.platform==="darwin")return gn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let i=process.env.LOCALAPPDATA,s=i!==void 0&&i!==""?i:gn.join(n,"AppData","Local");return gn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,r=t!==void 0&&t!==""?t:gn.join(n,".cache");return gn.join(r,"cupel","shards")}function Ci(e,n,t){return gn.join(e,`${n}-${t}.sqlite`)}function wt(e,n){_c(gn.dirname(e),{recursive:!0});let t=`${e}.tmp-${vc(8).toString("hex")}`;Cc(t,n,{flag:"wx"}),Nc(t,e)}function Bn(e){try{return Ac(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function eo(e,n,t,r){let i=Ci(e,n,t),s=Bn(i);if(s===void 0)return;let l=Et(s);if(l!==t)throw r(`cached shard ${i} failed sha256 re-verify (expected ${t}, got ${l})`);return{path:i,bytes:s}}var no="api.cupel.sh",vt=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),to=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import At from"node:path";function $e(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function io(e,n={}){let t=n.maxBytes??1073741824,r=n.timeoutMs??3e4,{get:i}=await import("node:https");return await new Promise((s,l)=>{let a=i(e,n.headers!==void 0?{headers:n.headers}:{},o=>{let c=o.statusCode??0;if(c<200||c>=300){o.resume(),l(new Error(`GET ${e} \u2192 HTTP ${String(c)}`));return}let u=[],f=0;o.on("data",m=>{if(f+=m.length,f>t){o.destroy(),l(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(m)}),o.on("end",()=>{s(Buffer.concat(u))}),o.on("error",l)});a.on("error",l),a.setTimeout(r,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(r)}ms`))})})}async function zn(e,n,t,r,i,s=3e4){let{request:l}=await import("node:https"),a=new URL(n).hostname;return await new Promise((o,c)=>{let u=l(n,{method:e,headers:t},f=>{let m=[],h=0;f.on("data",b=>{if(h+=b.length,h>i){f.destroy(),c(new Error(`${e} to ${a} returned more than ${String(i)} bytes`));return}m.push(b)}),f.on("end",()=>{o({status:f.statusCode??0,body:Buffer.concat(m).toString("utf8")})}),f.on("error",()=>{c(new Error(`${e} to ${a} failed`))})});u.on("error",()=>{c(new Error(`${e} to ${a} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${a} timed out after ${String(s)}ms`))}),r!==void 0&&u.write(r),u.end()})}import{createPublicKey as Rc,verify as Mc}from"node:crypto";var G=class extends Error{constructor(n){super(n),this.name="DistError"}},$c=Buffer.from("302a300506032b6570032100","hex"),Pc=32;function ao(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Pc)try{return Rc({key:Buffer.concat([$c,n]),format:"der",type:"spki"})}catch{return}}function Oi(e,n,t){for(let r of t){let i=ao(r);if(i!==void 0)try{if(Mc(null,e,i,n))return!0}catch{}}return!1}function lo(e){return e.some(n=>ao(n)!==void 0)}var Lc=/^[0-9a-f]{64}$/u,Tc=/^[a-z0-9-]+$/u;function ro(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new G(`${n} must be an object`);return e}function so(e,n){if(!Array.isArray(e))throw new G(`${n} must be an array`);return e}function It(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new G(`${n} must be an integer`);return e}function _t(e,n){if(typeof e!="string")throw new G(`${n} must be a string`);return e}function oo(e,n){let t=_t(e,n);if(Number.isNaN(Date.parse(t)))throw new G(`${n} is not a valid timestamp: ${t}`);return t}function Ri(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new G("distribution index is not valid JSON")}let r=ro(t,"index"),i=It(r.schema_version,"schema_version");if(i!==n.supportedIndexSchemaVersion)throw new G(`index schema_version ${String(i)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=It(r.sequence,"sequence");if(s<0)throw new G("sequence must be non-negative");let l=oo(r.generated,"generated"),a=so(r.shards,"shards"),o;for(let b of a){let S=ro(b,"shard entry"),x=_t(S.ecosystem,"ecosystem");if(!Tc.test(x))throw new G(`ecosystem ${JSON.stringify(x)} is malformed`);if(x===n.ecosystem){o=S;break}}if(o===void 0)throw new G(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);oo(o.built,"built");let c=It(o.db_schema_version,"db_schema_version");if(c<1)throw new G("db_schema_version must be >= 1");if(c>n.supportedDbSchemaVersion)throw new G(`this shard needs a newer cupel (db_schema_version ${String(c)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=_t(o.sha256,"sha256");if(!Lc.test(u))throw new G(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let f=It(o.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new G(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let m=so(o.urls,"urls");if(m.length===0)throw new G("urls must be a non-empty array");let h=[];for(let b of m){let S=_t(b,"url");try{h.push($e(S,n.shardHosts))}catch(x){throw new G(`refusing shard url ${JSON.stringify(S)}: ${x.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:f,dbSchemaVersion:c,urls:h,sequence:s,generated:l}}var Pi="CUPEL_DELIVERY_TOKEN",Mi=class extends G{constructor(n){super(n),this.name="NoDeliveryTokenError"}},$i=class extends G{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Dc(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function co(e,n){let t=Dc(e);return t!==void 0?()=>Promise.resolve(t):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function uo(e){if(e===void 0)throw new Mi(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow, elsewhere set ${Pi} to a token from app.cupel.sh, or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new $i(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Fc="/v1/resolve",Li=1024*1024,Ti=4096,fo=Li+Ti+64*1024,Kc=8,jc=2048,Bc=/^[A-Za-z0-9+/]+={0,2}$/u,zc=3e4,ge=class extends G{constructor(n){super(n),this.name="DeliveryRefusedError"}},Un=class extends G{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Vn=class extends G{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function Uc(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Vc(e){if(typeof e!="string"||e.length===0)throw new ge("the delivery response carried no index signature");if(e.length>Ti||!Bc.test(e))throw new ge("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new ge("the delivery response's index signature is not canonical base64");return n}function qc(e){if(typeof e!="string"||e.length===0)throw new ge("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Li)throw new ge("the delivery response's index is larger than one can be");return n}function Hc(e){if(!Array.isArray(e)||e.length===0)throw new ge("the delivery response named no shard urls");if(e.length>Kc)throw new ge("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>jc)throw new ge("the delivery response carried a malformed shard url");n.push(t)}return n}function Wc(e,n){throw e===401||e===403?new ge(`${n} rejected the delivery credential \u2014 check ${Pi}, or that the token has not been revoked in the dashboard`):e===404?new ge(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Vn(`${n} holds nothing newer than the shard index already cached`):e===429?new Un(`${n} rate-limited the delivery request`):e>=500?new Un(`${n} answered ${String(e)}`):new ge(`${n} refused the delivery request with status ${String(e)}`)}async function po(e,n,t,r,i=zc){let s=$e(`https://${e}${Fc}`,new Set([e])),l=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await r(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},l,i)}catch{throw new Un(`${e} could not be reached`)}if(a.status!==200&&Wc(a.status,e),Buffer.byteLength(a.body,"utf8")>fo)throw new ge(`${e} returned a delivery response larger than one can be`);let o;try{o=JSON.parse(a.body)}catch{throw new ge(`${e} returned a delivery response that is not JSON`)}if(!Uc(o))throw new ge(`${e} returned a delivery response that is not an object`);return{index:qc(o.index),sig:Vc(o.signature),shardUrls:Hc(o.shardUrls)}}var mo=async(e,n,t,r)=>await zn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,fo,r);var Gc=8,Fi=class extends G{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Di(e){return`${e.origin}${e.pathname}`}function ho(e,n,t){let r=new Map;for(let l of n)r.set(Di(l),l);let i=[],s=[];for(let l of e.slice(0,Gc)){let a;try{a=$e(l,t)}catch(u){s.push(u.message);continue}if(a.hash!==""){s.push("a candidate carried a fragment");continue}let o=r.get(Di(a));if(o===void 0){s.push("a candidate named an object the signed index does not list");continue}let c=new URL(`${Di(o)}${a.search}`);i.push($e(c.href,t))}if(i.length===0)throw new Fi(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return i}var Jc=1,Yc=1024*1024*1024;function Qc(e=vt){return{async resolve(n){return await po(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},mo)},async fetchShard(n,t){return $e(n.href,e),await io(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Ki(e){return e instanceof Error?e.message:String(e)}function go(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Jc,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:Yc}}function Zc(e){let n=Bn(At.join(e.cacheDir,Ai)),t=Bn(At.join(e.cacheDir,Ni));if(!(n===void 0||t===void 0)&&Oi(n,t,e.pubkeys))try{return Ri(n,go(e))}catch{return}}function yo(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let r=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(r)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Nt(e,n,t){let r=eo(n.cacheDir,e.ecosystem,e.sha256,i=>new G(i));if(r===void 0)throw new G(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:r.path,fromCache:!0,warnings:[...t,...yo(e,n)],sequence:e.sequence}}async function eu(e,n,t,r){let i=Ci(t.cacheDir,e.ecosystem,e.sha256),s=Bn(i);if(s!==void 0&&Et(s)===e.sha256)return{path:i,downloaded:!1};let l="no shard urls";for(let a of n){let o;try{o=await r.fetchShard(a,e.sizeBytes)}catch(u){l=Ki(u);continue}let c=Et(o);if(c!==e.sha256){l=`sha256 mismatch (expected ${e.sha256}, got ${c})`;continue}return wt(i,o),{path:i,downloaded:!0}}throw new G(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${l}`)}function nu(e,n,t){if(e instanceof ge)throw e;if(e instanceof Vn){if(n===void 0)throw new G(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Nt(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new G(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Ki(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Nt(n,t,[`could not refresh the shard index (${Ki(e)}); using the cached shard`])}async function xo(e,n){if(!e.activated)throw new G("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??Qc(e.shardHosts);if(!lo(e.pubkeys))throw new G("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let r=Zc(e);if(e.offline){if(r===void 0)throw new G(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Nt(r,e,[])}let i=await uo(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:i,ecosystem:e.ecosystem,sequenceFloor:r?.sequence??0})}catch(c){return nu(c,r,e)}if(!Oi(s.index,s.sig,e.pubkeys))throw new G("shard index signature did not verify against any pinned key");let l=Ri(s.index,go(e));if(r!==void 0&&l.sequence<r.sequence)return Nt(r,e,[`refusing a rolled-back shard index (served sequence ${String(l.sequence)} < cached ${String(r.sequence)}); keeping the newer cached shard`]);let a=ho(s.shardUrls,l.urls,e.shardHosts),o=await eu(l,a,e,t);return wt(At.join(e.cacheDir,Ai),s.index),wt(At.join(e.cacheDir,Ni),s.sig),{path:o.path,fromCache:!o.downloaded,warnings:yo(l,e),sequence:l.sequence}}var tu="https://api.cupel.sh",So=".actions.githubusercontent.com",iu=8192,Pe=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function ru(e){let n;try{n=new URL(e).hostname}catch{throw new Pe("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=So.slice(1);if(n!==t&&!n.endsWith(So))throw new Pe(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return $e(e,new Set([n]))}catch{throw new Pe(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Ct(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,r=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Pe("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(r===void 0||r==="")throw new Pe("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let i=ru(t);i.searchParams.set("audience",tu);let s;try{s=await n(i.href,{authorization:`Bearer ${r}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Pe("the ID-token request failed")}if(s.length>iu)throw new Pe("the ID-token response was larger than a token can be");let l;try{l=JSON.parse(s)}catch{throw new Pe("the ID-token response was not JSON")}let a=typeof l=="object"&&l!==null?l.value:void 0;if(typeof a!="string"||a.length===0)throw new Pe("the ID-token response carried no token");return a}async function bo(e,n,t={}){let r=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",i=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!r)throw new Pe("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Ct(e,n)};if(r)return i&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(i)return{kind:"oidc",value:await Ct(e,n)};throw new Pe("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var ji="api.cupel.sh",su=`https://${ji}/v1/findings`,ou=64*1024,Ot=8*1024*1024,au=3e4,on=class extends Error{constructor(n){super(n),this.name="PushError"}};async function ko(e,n,t,r={}){if(e.length>Ot)throw new on(`findings payload is ${String(e.length)} bytes, over the ${String(Ot)}-byte limit`);let i=$e(su,new Set([ji])),s;try{s=await t(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,r.timeoutMs??au)}catch{throw new on(`the findings push to ${ji} failed`)}if(s.body.length>ou)throw new on("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new on("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new on("the control plane rejected the findings payload as malformed"):new on(`the findings push was refused with status ${String(s.status)}`)}var lu=64*1024,du=64*1024,Eo=async(e,n,t,r)=>{if(Buffer.byteLength(t,"utf8")>Ot)throw new Error("findings payload is over the size limit");return await zn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,du,r)};async function Rt(e,n){let t=await zn("GET",e,n,void 0,lu,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var uu=720*60*60*1e3,fu=Number(dn);function wo(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Ue("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function vo(e){let n=await xo({ecosystem:"npm",activated:!0,pubkeys:to,indexHost:no,shardHosts:vt,credential:co(process.env,()=>Ct(process.env,Rt)),cacheDir:Zs(),offline:e.offline,now:Date.now(),maxAgeMs:uu,supportedDbSchemaVersion:fu});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
-`);return{path:n.path,sequence:n.sequence}}var pu=5,vn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function mu(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new vn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,r=e.modelPromotedFromKind??null;if(t===null!=(r===null))throw new vn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new vn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:Qi(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(i=>({functionName:i.functionName??null,modulePath:i.modulePath})),unresolvedSites:e.unresolvedSites.map(i=>({path:i.path,start:i.start,end:i.end})),modelId:t,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null}}var hu="";function gu(e){return[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""].join(hu)}function yu(e){let n=new Map;for(let t of e){let r=gu(t),i=n.get(r);if(i===void 0){n.set(r,t);continue}if(i.tier!==t.tier||i.unknownKind!==t.unknownKind)throw new vn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${i.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Io(e,n){return{version:pu,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:yu(e.findings.map(mu))}}function B(e){let n="";for(let t of e){let r=t.charCodeAt(0),i=r<32||r>=127&&r<=159;n+=i?"\\x"+r.toString(16).padStart(2,"0"):t}return n}function xu(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var Su={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},_o=4,Bi=3,zi=10,Ao={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},bu="(symbol set known incomplete)";function ku(e){let n=(e.path??[]).map(t=>B(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function No(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function Eu(e){let n=e.findings.filter(c=>c.tier==="unknown"&&c.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let c of n){let u=t.get(c.unknownKind)??[];u.push(c),t.set(c.unknownKind,u)}let r={cupel:0,project:0};for(let[c,u]of t)r[Me[c]]+=u.length;let i=[];i.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(c,u)=>{if(r[c]===0)return;i.push(""),i.push(`   ${u} (${String(r[c])}):`);let f=[...t.entries()].filter(([h])=>Me[h]===c).sort((h,b)=>b[1].length-h[1].length||h[0].localeCompare(b[0])),m=f.slice(0,_o);for(let[h,b]of m){let S=c==="project"?[...new Set(b.flatMap(No))]:[],x=S.slice(0,Bi).map(B).join(", "),w=S.length>Bi?` (+${String(S.length-Bi)} more files)`:"";i.push(`     ${h.padEnd(21)} ${String(b.length).padStart(4)}  ${Ao[h]}`+(x!==""?`
-       ${x}${w}`:""))}for(let[h,b]of f.slice(_o))i.push(`     ${h.padEnd(21)} ${String(b.length).padStart(4)}  ${Ao[h]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let l=new Map;for(let c of n)if(Me[c.unknownKind]==="project")for(let u of No(c))l.set(u,(l.get(u)??0)+1);let a=[...l.entries()].sort((c,u)=>u[1]-c[1]||c[0].localeCompare(u[0]))[0];a!==void 0&&r.project>0&&(i.push(""),i.push(`   \u279C Start here: ${B(a[0])} appears in ${String(a[1])} of your ${String(r.project)} finding(s), across ${String(l.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let o=n.filter(c=>Me[c.unknownKind]==="project");if(o.length>0){i.push("");for(let c of o.slice(0,zi))i.push(`     ${B(c.displayId)}  ${B(c.packageName)}@${B(c.version)}  [${c.unknownKind}] ${B(c.reason)}`);o.length>zi&&i.push(`     \u2026 and ${String(o.length-zi)} more`)}return i.push(""),i}function Co(e){let n=[],t=e.counts,r=e.findings.filter(a=>a.tier==="reachable-high"||a.tier==="reachable-medium"||a.tier==="reachable-low");if(n.push(`cupel scan: ${B(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let a=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+a.map(o=>`${B(o.entrypoint)} [${B(o.source)}]`).join(", ")+(e.entrypointSources.length>a.length?`, \u2026 and ${String(e.entrypointSources.length-a.length)} more`:"")),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let a of e.entrypointGaps.slice(0,5))n.push(`  - ${B(a.source)} (${B(a.file)}): ${B(a.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(B).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${Yt(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let i=e.installed.gaps;if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let a of i.slice(0,10))n.push(`  - [${B(a.kind)}] ${B(a.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let s=new Set(i.map(a=>a.detail)),l=[...e.analyzerDiagnostics.map(a=>`${B(a.code)}: ${B(a.detail)}`),...e.installed.diagnostics.filter(a=>!s.has(a)).map(B)];if(l.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(l.length)}) \u2014 verdicts are conservative:`);for(let a of l.slice(0,10))n.push(`  - ${a}`);l.length>10&&n.push(`  \u2026 and ${String(l.length-10)} more`),n.push("")}if(r.length>0){n.push(`\u{1F3AF} Reachable (${String(r.length)}) \u2014 fix these:`);for(let a of r)n.push(`  ${Su[a.tier]} ${B(a.displayId)}  ${B(a.packageName)}@${B(a.version)}  ${B(a.symbolName??"")}`+(a.surfaceComplete===!1?`  ${bu}`:"")),n.push(`        path: ${ku(a)}`);n.push("")}return n.push(...Eu(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${xu(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as wu}from"node:crypto";var vu="https://json.schemastore.org/sarif-2.1.0.json",Oo="cupel-reachability",Ui=new Set(["dispatch","dynamic-load","coverage-gap"]);function Iu(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var _u=500,Au=10;function Nu(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function Cu(e,n){return`${e}::${n}`}function Ou(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Ru(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return wu("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Mu(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Ui.has(e.unknownKind)}var Ro={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function Mo(e){let n=[],t=new Map,r=[];for(let o of e.findings){if(!Mu(o))continue;let c=Cu(o.displayId,o.packageName);if(!t.has(c)){t.set(c,n.length);let x=Ou(o.severity);n.push({id:B(c),properties:{tags:o.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${B(o.packageName)}`]:["security","reachability",`package/${B(o.packageName)}`],...x!==void 0?{"security-severity":x}:{}}})}let u=o.tier==="reachable-high"||o.tier==="reachable-medium"||o.tier==="reachable-low",f=o.path??[],m=f.find(x=>x.modulePath!==""),h=[...new Set(o.unresolvedSites.map(x=>x.path).filter(x=>x!==""))],b=u?m!==void 0?{physicalLocation:{artifactLocation:{uri:B(m.modulePath)}},message:{text:`calls ${B(o.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:B(o.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:B(h[0])}},message:{text:`unresolved ${B(o.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:B(o.packageLocation??(o.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},S=u?f.map(x=>({physicalLocation:{artifactLocation:{uri:B(x.modulePath||"package-lock.json")}},message:{text:B(x.functionName??"<step>")}})):h.slice(1,Au+1).map(x=>({physicalLocation:{artifactLocation:{uri:B(x)}},message:{text:"also blocked here"}}));r.push({ruleId:B(c),ruleIndex:t.get(c),level:u?"error":"warning",message:{text:B(`[${o.tier}] ${o.displayId} in ${o.packageName}@${o.version}`+(o.symbolName!==null?` \u2014 reaches ${o.symbolName}`:"")+(o.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${o.reason}`)},locations:[b],...S.length>0?{relatedLocations:S}:{},partialFingerprints:{"cupelReachability/v1":Ru(o)},properties:{tier:o.tier,advisoryId:B(o.advisoryId),...o.surfaceComplete===!1?{surfaceComplete:!1}:{},...o.modelId!==void 0?{modelId:B(o.modelId),modelPromotedFromKind:o.modelPromotedFromKind}:{},...o.unknownKind!==void 0?{unknownKind:o.unknownKind,unknownOwner:Me[o.unknownKind],unresolvedSiteCount:o.unresolvedSites.length}:{}}})}let i=new Map,s=new Map;for(let o of e.findings){if(o.tier!=="unknown"||o.unknownKind===void 0||(i.set(o.unknownKind,(i.get(o.unknownKind)??0)+1),Ui.has(o.unknownKind)))continue;let c=s.get(o.unknownKind)??[];c.length<_u&&c.push({advisory:B(o.displayId),package:B(o.packageName),version:B(o.version)}),s.set(o.unknownKind,c)}let l={cupel:0,project:0};for(let[o,c]of i)l[Me[o]]+=c;let a={};for(let[o,c]of s){let u=i.get(o)??c.length;a[o]={count:u,owner:Me[o],note:Ro[o],truncated:u>c.length,advisories:c}}return{$schema:vu,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Oo},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:B(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(o=>`${o.entrypoint} (${o.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...i.keys()].filter(o=>!Ui.has(o)&&!Iu(o,e.analysisAborted)).sort().map(o=>({descriptor:{id:`unknown-${o}`},level:"warning",message:{text:`${String(i.get(o)??0)} finding(s) are unknown because ${Ro[o]} (owner: ${Me[o]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${o}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(o=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:B(`${o.source} (${o.file}): ${o.detail}`)}})),...e.rejectedEntries.map(o=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:B(`--entry did not resolve to a file inside the app root: ${o}`)}})),...e.analyzerDiagnostics.map(o=>({descriptor:{id:o.code},level:"warning",message:{text:B(`${o.detail} (${o.path})`)}})),...e.installed.diagnostics.map(o=>({descriptor:{id:"resolve"},level:"warning",message:{text:B(o)}}))]}],results:r,properties:{category:Oo,summary:e.counts,...Nu(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...i].sort((o,c)=>c[1]-o[1])),byOwner:l,grouped:a},dbCoverageGaps:e.findings.filter(o=>o.tier==="unknown"&&o.unknownKind==="db-gap").map(o=>({advisory:B(o.displayId),package:B(o.packageName),version:B(o.version)}))}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function $o(){try{let e=$u(Tu(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Du(e,n){let t=`${JSON.stringify(n,null,2)}
-`,r=`${e}.tmp-${Po(8).toString("hex")}`;Lo(r,t,{encoding:"utf8",flag:"wx"}),Pu(r,e)}async function Fu(e){let n=Qs(e),r=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:wo(n.shard),sequence:null}:await vo({offline:n.offline}),i=r.path,s=Ii({dir:n.dir,shardPath:i,failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{}});if(process.stdout.write(`${Co(s)}
-`),s.modelLane!==void 0){let l=s.modelLane.notes.length>0?` (${s.modelLane.notes.map(a=>B(a)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(s.modelLane.active)}/${String(s.modelLane.stored)} active, ${String(s.modelLane.promoted)} promoted to reachable-low${l}
-`)}if(n.summaryShadow!==void 0&&s.summaryShadow!==void 0){let l=Lu.join(n.summaryShadow,"shadow-report.json");Lo(l,`${JSON.stringify(s.summaryShadow,null,2)}
+}`,g.ScriptTarget.Latest,!0),i=r.parseDiagnostics;if(i!==void 0&&i.length>0||Gt(r,n+1,!0))return!0}return!1}function Gt(e,n=0,t=!1){let r=!1,i=t?nl:ll(e);if(i.saturated)return!0;let s=a=>g.isElementAccessExpression(a)&&!g.isStringLiteralLike(a.argumentExpression)&&ot(ce(a.expression),i),l=a=>{if(!r){if(t&&(g.isCallExpression(a)||g.isNewExpression(a)||g.isTaggedTemplateExpression(a))){r=!0;return}if(g.isCallExpression(a)){let o=Pn(a);if(o!==null){let c=o.specifierArg;if(c===void 0||!g.isStringLiteralLike(c)||t){r=!0;return}}else{let c=ce(a.expression);if(g.isIdentifier(c)&&(c.text==="eval"||c.text==="Function")){if(Mr(a.arguments,n)){r=!0;return}}else if(dl(c)){r=!0;return}else if(s(c)){r=!0;return}else if(ol(a,i)){r=!0;return}}}else if(g.isNewExpression(a)){let o=ce(a.expression);if(g.isIdentifier(o)&&o.text==="Function"){if(Mr(a.arguments??[],n)){r=!0;return}}else if(Mn(o)){r=!0;return}}else if(g.isIdentifier(a)&&Ja.has(a.text)&&el(a)){r=!0;return}else if((g.isPropertyAccessExpression(a)||g.isElementAccessExpression(a))&&(Tr(a)||Mn(a)||s(a))&&Lr(a)){r=!0;return}else if(g.isBindingElement(a)){let o=a.propertyName??a.name,c=g.isIdentifier(o)||g.isStringLiteralLike(o)?o.text:g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?o.expression.text:void 0;if(c!==void 0&&lt.has(c)){r=!0;return}}g.forEachChild(a,l)}};return l(e),r}function zr(e,n,t){if(Gt(t))return!0;if(!Xt(e)||!n.includes("<")||!n.includes("require"))return!1;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);return Gt(r)}function ul(e,n,t){if(Ha(e))return!0;let r=t.endsWith(ke.sep)?t:t+ke.sep,i=e.split("/"),s=n;for(;;){let l=ke.join(s,"node_modules",...i),a;try{a=fn(ke.join(l,"package.json"))}catch{a=null}if(a!==null){if(!a.startsWith(r))return!1;let c=Ce(a);if(c===null)return!1;let u;try{u=JSON.parse(c).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(mr(l))return!1;if(s===t)break;let o=ke.dirname(s);if(o===s||o!==t&&!o.startsWith(r))break;s=o}return!0}function fl(e,n){let t=n.endsWith(ke.sep)?n:n+ke.sep,r=ke.dirname(e);for(;;){let i=ke.join(r,"package.json"),s;try{s=fn(i)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let a=Ce(s);if(a!==null)try{let o=JSON.parse(a).name;if(typeof o=="string"&&o.length>0)return o}catch{return null}}if(r===n)break;let l=ke.dirname(r);if(l===r||l!==n&&!l.startsWith(t))break;r=l}return null}function pl(e,n,t,r,i){let s=[],l=[],a=new Set,o={},c=new Set,u=new Set,f=[],m=!1,h=(S,x)=>{let w;try{w=fn(x)}catch{return!1}let _=Xe(e,w);if(_===null)return i.push({code:"out-of-root",path:w,detail:"dependency module resolved outside the app root; not followed"}),!1;let $=!t.has(w)&&!u.has(w);return $&&u.size>=qt?(m=!0,!1):(l.push({from:S,to:{module:_}}),$?(u.add(w),s.push(_),!0):!1)},b=(S,x)=>{if(a.add(x),c.has(x))return;c.add(x);let w=De(x,S,Ge,n);if(w!==null&&!je(w)){if(h({surface:x},w)){f.push(w);try{let _=Xe(e,fn(w)),$=fl(w,e);_!==null&&$!==null&&(o[_]=$)}catch{}}return}ul(x,ke.dirname(S),e)||i.push({code:"unresolved-specifier",path:x,detail:`dependency "${x}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let S of r)b(S.containingFile,S.packageName);for(;f.length>0&&u.size<qt;){let S=f.pop();if(S===void 0)break;let x=Xe(e,S);if(x===null)continue;let w=xn(S,tn);if(w.kind==="too-large"){i.push({code:"limit-exceeded",path:x,detail:`dependency module over the ${String(tn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(w.kind==="not-regular"){i.push({code:"parse-error",path:x,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let _=g.createSourceFile(S,w.text,g.ScriptTarget.ES2020,!0),$=_.parseDiagnostics;if($!==void 0&&$.length>0){i.push({code:"dependency-body",path:x,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}if(zr(S,w.text,_)){i.push({code:"dependency-body",path:x,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)"});continue}i.push({code:"dependency-body",path:x,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:x});for(let N of $r(S,w.text))if(N.runtime)if(me(N.text)==="package-root"){let k=He(N.text);l.push({from:{module:x},to:{surface:k}}),b(S,k)}else{let k=De(N.text,S,Ge,n);if(k===null){me(N.text)==="package-subpath"&&i.push({code:"unresolved-specifier",path:x,detail:`runtime package-subpath import "${N.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`});continue}if(je(k)){let p=Xe(e,k);i.push({code:p===null?"out-of-root":"declaration-shadow",path:x,detail:p===null?`runtime import "${N.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${N.text}" resolved to the declaration file "${p}" with no co-located runtime module; its code was not analyzed`});continue}h({module:x},k)&&f.push(k)}}return(m||f.length>0)&&i.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(qt)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:l,surfacePackages:[...a],entryRealNames:o}}function Ur(e,n,t=!1){let r=fn(e),i=[],s=g.createCompilerHost(Ge,!0),l=t?yr(r,Ge,s):()=>null,a=new Set,o=new Set,c=n.map(I=>ke.join(r,I)),u=[],f=new Map,m=new Map,h=new Map,b=new Map,S=new Set,x=(I,C)=>{let K=`${String(I.length)}:${I}${C}`;S.has(K)||(S.add(K),i.push({code:"unresolved-specifier",path:I,detail:C}))},w=()=>null,_=0,$=(I,C)=>{let K=m.get(I);return K===void 0&&(K=g.createSourceFile(I,C,g.ScriptTarget.ES2020,!0),m.set(I,K)),{real:I,sf:K}};for(;o.size<rt;){let I=c.pop();if(I===void 0){if(_>=Xa)break;_+=1;let O=[];for(let[Y,j]of f)j.includes("readdir")&&(j.includes("require")||j.includes("import("))&&O.push($(Y,j));let V=Ga(O);if(V.length===0)break;let J=[];for(let[Y,j]of f)J.push($(Y,j));w=Nr(J,V,Ge,s,h);let re=!1;for(let Y of O){let j=f.get(Y.real);if(j!==void 0)for(let H of Rr(Y.real,j,r,s,w))o.has(H)||(c.push(H),re=!0)}if(!re)break;continue}let C;try{C=fn(I)}catch{continue}if(o.has(C))continue;if(o.add(C),Xe(r,C)===null){i.push({code:"out-of-root",path:I,detail:"resolved outside app root"});continue}let K=xn(C,tn);if(K.kind==="too-large"){i.push({code:"limit-exceeded",path:C,detail:`file is ${String(Math.round(K.bytes/1048576))}MiB, over the ${String(tn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(K.kind==="not-regular"){i.push({code:"parse-error",path:C,detail:"unreadable or not a regular file"});continue}let R=K.text;a.add(C),f.set(C,R);for(let O of $r(C,R)){let V=O.runtime?l(O.text,C):null;if(V===null&&me(O.text)==="package-root"){O.runtime&&u.push({containingFile:C,packageName:He(O.text)});continue}let J=V??De(O.text,C,Ge,s);if(J===null){if(O.runtime){let re=me(O.text);if(re==="package-subpath")x(C,`runtime package-subpath import "${O.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`);else if(re==="relative"){let Y=gr(O.text,C,r,b);Y.kind==="unanalyzable"&&x(C,`runtime relative import "${O.text}" did not resolve and its absence could not be proven \u2014 ${Y.reason}; a bundler/loader may load a module the analyzer never saw`)}}continue}if(Xe(r,J)===null){i.push({code:"out-of-root",path:J,detail:`specifier "${O.text}" resolved outside app root`});continue}if(O.runtime&&je(J)){i.push({code:"declaration-shadow",path:J,detail:`runtime import "${O.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(O.runtime&&!Zn(J)){i.push({code:"unanalyzable-module",path:J,detail:`runtime import "${O.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(J)}for(let O of Rr(C,R,r,s,w))o.has(O)||c.push(O)}o.size>=rt&&c.length>0&&i.push({code:"limit-exceeded",path:r,detail:`reachable file set exceeds ${String(rt)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let N=pl(r,s,a,u,i),k=g.createProgram({rootNames:[...a],options:Ge,host:s}),p=new Set,y=new Map;for(let I of k.getSourceFiles()){if(I.isDeclarationFile||k.isSourceFileDefaultLibrary(I)||Xe(r,I.fileName)===null||!Xt(I.fileName))continue;let C=k.getSyntacticDiagnostics(I).length>0;if(!C&&!I.text.includes("<")||Wa(I.text,g.ScriptKind.TSX)!==0)continue;let K=g.createSourceFile(I.fileName,I.text,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);(C||Or(K)>Or(I))&&(p.add(I.fileName),y.set(I.fileName,I.text))}let A=k;if(p.size>0){let I=s.getSourceFile.bind(s);s.getSourceFile=(C,K,R,O)=>{let V=y.get(C);return V!==void 0?g.createSourceFile(C,V,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX):I(C,K,R,O)},A=g.createProgram({rootNames:[...a],options:Ge,host:s,oldProgram:k})}let L=A.getTypeChecker(),U=[];for(let I of A.getSourceFiles()){if(I.isDeclarationFile||A.isSourceFileDefaultLibrary(I)||Xe(r,I.fileName)===null)continue;U.push(I);let C=A.getSyntacticDiagnostics(I);if(C.length>0){let R=C[0],O=R!==void 0?g.flattenDiagnosticMessageText(R.messageText," "):"syntax error";i.push({code:"parse-error",path:I.fileName,detail:`${String(C.length)} syntax error(s): ${O}`})}let K=Xe(r,I.fileName);K!==null&&zr(I.fileName,I.text,I)&&i.push({code:"loader-escape",path:K,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)"})}return{program:A,checker:L,host:s,options:Ge,appRoot:r,sourceFiles:U,diagnostics:i,depReach:N,resolveParamDirs:w,toRel:I=>Xe(r,I)}}import{existsSync as ml}from"node:fs";import hl from"node:path";var gl=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/"},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/"},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/"},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/"},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/"},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads"}],yl=["dependencies","devDependencies"];function xl(e,n){for(let t of yl){let r=e[t];if(!(typeof r!="object"||r===null||Array.isArray(r))&&Object.hasOwn(r,n))return!0}return!1}function Jt(e,n){if(n===null)return null;for(let t of gl)if(xl(n,t.dependency)){for(let r of t.configFiles)if(ml(hl.join(e,r)))return{name:t.name,configFile:r,entryHint:t.entryHint}}return null}function Yt(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}function Je(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let r of n){let i=r.codePointAt(0)??0;t+=i<32||i>=127&&i<=159?`\\x${i.toString(16).padStart(2,"0")}`:r}return t}function Sl(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function bl(e){let n=[],t="";for(let r of e){if(r===" "||r==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=r}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var kl=/^[A-Za-z_][A-Za-z0-9_]*=/u;function El(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var wl=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),vl=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),Il=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function qr(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Vr(e){if(qr(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return Il.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:wl.has(t)||n!==-1&&vl.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var Al=[".js",".cjs",".mjs",".ts",".mts",".cts"];function _l(e){return Al.some(n=>e.endsWith(n))}var Nl=new Set(["npm","yarn","pnpm"]);function Cl(e){let n=e[0];return n===void 0||!Nl.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Qt(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(Sl(n))return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let t=bl(n);if(t===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let r=0;for(t[r]==="env"&&(r+=1);r<t.length;r+=1){let l=t[r];if(l===void 0||!kl.test(l))break;if(qr(l))return{kind:"unparsed",reason:`environment \`${Je(l)}\` preloads another module; the launch surface is more than one file`};let a=l.indexOf("=");if(l.slice(0,a)==="NODE_OPTIONS")for(let o of l.slice(a+1).split(/\s+/u)){if(o===""||!o.startsWith("-"))continue;let c=Vr(o);if(c!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Je(c.token)}\` ${c.why}`}}}let i=t[r];if(i===void 0)return{kind:"unparsed",reason:"no program in the command"};if(Cl(t.slice(r)))return{kind:"delegates",target:"scripts.start"};if(!El(i))return{kind:"unparsed",reason:`runs \`${Je(i)}\`, not node directly \u2014 the entry file cannot be identified`};for(r+=1;r<t.length;r+=1){let l=t[r];if(l===void 0||!l.startsWith("-"))break;let a=Vr(l);if(a!==null)return{kind:"unparsed",reason:`node flag \`${Je(a.token)}\` ${a.why}`}}let s=t[r];return s===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:_l(s)?{kind:"file",specifier:s}:{kind:"unparsed",reason:`\`${Je(s)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Ol(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Rl=64;function Zt(e){let n=e.split(`
+`),t=n.length>64,r=[],i=0;for(let s of n.slice(0,64)){let l=s.trim();if(l.length===0||l.startsWith("#"))continue;let a=l.indexOf(":");if(a<=0)continue;let o=l.slice(a+1).trim();if(o.length===0)continue;let c=l.slice(0,a);if(c.length>Rl||!Ol(c)){i+=1;continue}r.push({name:c,command:o})}return r.sort((s,l)=>s.name===l.name?0:s.name==="web"?-1:l.name==="web"?1:0),{entries:r,truncated:t,unnamedLines:i}}import{realpathSync as Hr}from"node:fs";import Re from"node:path";import d from"typescript";var Wr=3;function ne(e,n,t){if(e===void 0)return;let r=e[n]??={fired:0,refused:{}};t===null?r.fired+=1:r.refused[t]=(r.refused[t]??0)+1}function sn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var ct=16,ti=256,ei=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.fns.has(r)||(this.moduleFor(n),this.fns.set(r,{id:i,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),i}classFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.classNodes.has(r)||(this.moduleFor(n),this.classNodes.set(r,{id:i,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(r,[])),i}methodFor(n,t,r,i){let s=`${n}#${t}.${r}`,l=`pkg:${n}#${t}.${r}`;if(!this.fns.has(s)){let a=this.classFor(n,t);this.fns.set(s,{id:l,moduleId:`pkg:${n}`,name:r,kind:i,enclosingClassId:a,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(l)}return l}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function ts(e,n){let t="node_modules/",r=e.lastIndexOf(t);if(r===-1)return n;let s=e.slice(r+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function Gr(e,n,t){let r=Re.dirname(e),i=Re.dirname(n),s=[];for(;;){let a=t.get(r);if(a!==void 0){for(let c of s)t.set(c,a);return a}s.push(r);let o=Ce(Re.join(r,"package.json"));if(o!==null)try{let c=JSON.parse(o),u={name:c.name??"app",version:c.version??"0.0.0",dir:r};for(let f of s)t.set(f,u);return u}catch{}if(r===i||r===Re.dirname(r))break;r=Re.dirname(r)}let l={name:"app",version:"0.0.0",dir:null};for(let a of s)t.set(a,l);return l}function Ml(e){let n=[],t=r=>{if(d.isImportDeclaration(r)&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isImportEqualsDeclaration(r)&&d.isExternalModuleReference(r.moduleReference)&&d.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isCallExpression(r)){let i=Pn(r);if(i!==null){let s=i.specifierArg,l=s!==void 0&&d.isStringLiteralLike(s);n.push({specifier:l?s.text:void 0,specifierIsLiteral:l,dynamic:!0,...s!==void 0&&!l?{computedArg:s,loadPos:r.getStart(e)}:{}})}}d.forEachChild(r,t)};return t(e),n}function $l(e,n,t){let r=new Map,i=Gr(Re.join(e.appRoot,"package.json"),e.appRoot,r),s=[],l=[],a=[],o=new Map,c=new Set,u=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&u.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let h=Gr(f.fileName,e.appRoot,r),b=ts(m,i.name),S=m.includes("node_modules/");s.push({id:m,packageName:S&&h.name!==i.name?h.name:b,versionRange:h.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),h.dir===i.dir&&c.add(m);let x=0,w=null;for(let _ of Ml(f)){let $=`${m}#import${String(x)}`;x+=1;let N=null;if(_.specifier!==void 0)if(me(_.specifier)==="package-root")N=t.moduleFor(He(_.specifier));else{let k=De(_.specifier,f.fileName,e.options,e.host),p=k!==null?e.toRel(k):null;p!==null&&(N=p)}if(l.push({id:$,moduleId:m,specifier:_.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:_.dynamic,specifierIsLiteral:_.specifierIsLiteral,...N!==null?{resolvedModuleId:N}:{}}),N!==null&&a.push({importId:$,resolvedModuleId:N}),_.computedArg!==void 0&&_.loadPos!==void 0){w??=un(f,f.fileName,e.resolveParamDirs);let k=[];for(let p of tt(_.computedArg,w,e.appRoot,e.options,e.host)){let y=e.toRel(p);if(y===null||!u.has(y))continue;let A=y,L=`${m}#import${String(x)}`;x+=1,l.push({id:L,moduleId:m,specifier:y,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:A}),a.push({importId:L,resolvedModuleId:A}),k.push(y)}if(k.length>0){let p=Rn(_.computedArg,w)!==null||nt(_.computedArg),y=o.get(m)??[];y.push({pos:_.loadPos,candidateRels:k,seedable:p}),o.set(m,y)}}}}return{modules:s,imports:l,importEdges:a,computedLoads:o,appOwnedPaths:c}}function Pl(e){let n=Ce(e);if(n===null)return null;let t=d.createSourceFile(e,n,d.ScriptTarget.Latest,!0),r=i=>t.statements.some(s=>d.isFunctionDeclaration(s)?s.name?.text===i:d.isVariableStatement(s)?s.declarationList.declarations.some(l=>d.isIdentifier(l.name)&&l.name.text===i&&l.initializer!==void 0&&(d.isFunctionExpression(l.initializer)||d.isArrowFunction(l.initializer))):!1);for(let i of t.statements){if(d.isFunctionDeclaration(i)&&i.name!==void 0&&i.modifiers?.some(l=>l.kind===d.SyntaxKind.DefaultKeyword)===!0)return i.name.text;if(!d.isExpressionStatement(i)||!d.isBinaryExpression(i.expression))continue;let s=i.expression;if(s.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ll(s.left)){if(d.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(d.isIdentifier(s.right)&&r(s.right.text))return s.right.text}}return null}function Ll(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Tl(e,n,t){for(let c of e.surfacePackages)n.moduleFor(c);let r=c=>"surface"in c?n.moduleFor(c.surface):c.module,i=[],s=new Set;for(let c of e.modules)t.has(c)||s.has(c)||(s.add(c),i.push({id:c,packageName:e.entryRealNames[c]??ts(c,"app"),versionRange:"",path:c,moduleSystem:"cjs",isEntrypoint:!1}));let l=[],a=[],o=0;for(let c of e.edges){let u=r(c.from),f=r(c.to),m=`${String(u)}#depreach${String(o)}`;o+=1,l.push({id:m,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),a.push({importId:m,resolvedModuleId:f})}return{modules:i,imports:l,importEdges:a}}function Xr(e,n,t){let r=e.expression;if(d.isIdentifier(r)&&!t.has(r.text)){let i=n.get(r.text);if(i?.kind==="package-export")return{kind:"package-instance",packageName:i.packageName,className:i.exportName};if(i?.kind==="app-class")return{kind:"app-instance",cls:i.cls}}else if(d.isPropertyAccessExpression(r)&&d.isIdentifier(r.expression)&&!t.has(r.expression.text)){let i=n.get(r.expression.text);if(i?.kind==="package-surface")return{kind:"package-instance",packageName:i.packageName,className:r.name.text}}return null}function pn(e){return d.canHaveModifiers(e)&&(d.getModifiers(e)?.some(n=>n.kind===d.SyntaxKind.ExportKeyword)??!1)}function Dl(e){let n=new Set,t;for(let r of e.statements){if(d.isExpressionStatement(r)&&d.isBinaryExpression(r.expression)){let i=r.expression;if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(i.left)&&d.isIdentifier(i.left.expression)&&i.left.expression.text==="module"&&i.left.name.text==="exports"){if(d.isIdentifier(i.right))n.add(i.right.text),t=i.right.text;else if(d.isObjectLiteralExpression(i.right))for(let s of i.right.properties)d.isShorthandPropertyAssignment(s)?n.add(s.name.text):d.isPropertyAssignment(s)&&d.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(d.isFunctionDeclaration(r)&&r.name!==void 0&&pn(r))n.add(r.name.text);else if(d.isVariableStatement(r)&&pn(r))for(let i of r.declarationList.declarations)d.isIdentifier(i.name)&&n.add(i.name.text);else if(d.isExportDeclaration(r)&&r.exportClause&&d.isNamedExports(r.exportClause))for(let i of r.exportClause.elements)n.add((i.propertyName??i.name).text);else d.isExportAssignment(r)&&d.isIdentifier(r.expression)&&(n.add(r.expression.text),t=r.expression.text)}return{reachableLocals:n,defaultTarget:t}}function Fl(e){for(let n of e.statements){if(d.isFunctionDeclaration(n)&&n.name!==void 0&&pn(n)&&d.getModifiers(n)?.some(t=>t.kind===d.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(d.isExportAssignment(n)&&!n.isExportEquals&&d.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ie(t.left)&&d.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function Ye(e){if(d.isCallExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&d.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function Ie(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Be(e){if(Ie(e))return!0;if(!d.isPropertyAccessExpression(e)&&!d.isElementAccessExpression(e))return!1;let n=e.expression;return d.isIdentifier(n)&&n.text==="exports"?!0:Ie(n)}function kn(e){return d.isPropertyAccessExpression(e.expression)&&d.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function is(e){let n=!1,t=r=>{if(!n){if(d.isCallExpression(r)){let i=Ye(r);if(i!==void 0&&me(i)!=="package-root"){n=!0;return}}d.forEachChild(r,t)}};return t(e),n}function rs(e){let n=new Set,t=i=>i!==void 0&&is(i),r=i=>{d.isVariableDeclaration(i)&&t(i.initializer)&&On(i.name,n),d.isBinaryExpression(i)&&i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(i.left)&&t(i.right)&&n.add(i.left.text),d.forEachChild(i,r)};return r(e),n}function ss(e,n){for(let t of e.properties)d.isShorthandPropertyAssignment(t)?n.add(t.name.text):d.isPropertyAssignment(t)&&d.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function Kl(e){let n=new Set;for(let a of e.statements)if(d.isFunctionDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(d.isClassDeclaration(a)&&a.name!==void 0)n.add(a.name.text);else if(d.isVariableStatement(a))for(let o of a.declarationList.declarations)d.isIdentifier(o.name)&&o.initializer!==void 0&&(d.isFunctionExpression(o.initializer)||d.isArrowFunction(o.initializer)||d.isObjectLiteralExpression(o.initializer))&&n.add(o.name.text);let t=a=>d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isObjectLiteralExpression(a)||d.isIdentifier(a)&&n.has(a.text),r=new Set,i=a=>{d.isIdentifier(a)?r.add(a.text):d.isObjectLiteralExpression(a)&&ss(a,r)},s=!1,l=a=>{if(!s){if(d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken)if(Ie(a.left)){i(a.right);let o=a.right;(d.isObjectLiteralExpression(o)?o.properties.every(u=>d.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||d.isPropertyAssignment(u)&&t(u.initializer)):t(o))||(s=!0)}else Be(a.left)&&(t(a.right)||(s=!0));else(d.isCallExpression(a)&&kn(a)&&a.arguments[0]!==void 0&&mn(a.arguments[0])||d.isExportDeclaration(a)&&a.moduleSpecifier!==void 0)&&(s=!0);s||d.forEachChild(a,l)}};if(l(e),!s&&r.size>0){for(let a of ds(e))if(r.has(a)){s=!0;break}}return s}function mn(e){return Be(e)||d.isIdentifier(e)&&e.text==="exports"}function os(e){if(!d.isPropertyAccessExpression(e.expression)||!d.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function ii(e){return os(e)&&e.arguments[0]!==void 0&&mn(e.arguments[0])}function jl(e){return os(e)&&e.arguments[0]!==void 0&&d.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Bl(e){for(let n of e.declarations??[])if(d.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(d.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function zl(e,n,t,r,i){let s=(e.declarations??[]).filter(a=>!d.isSourceFile(a)&&!d.isModuleDeclaration(a));for(let a of s){let o=a.getSourceFile(),c=n.toRel(o.fileName);if(c===null||i.has(c))continue;let u=t.get(`${c}::${String(a.getStart(o,!1))}`);if(u!==void 0)return u}let l=e.getName();for(let a of s){let o=n.toRel(a.getSourceFile().fileName);if(o===null||i.has(o))continue;let c=r.get(`${o}::${l}`);if(c!==void 0)return c}}function ut(e){return d.isPropertyAccessExpression(e)?e.name.text:d.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var ri=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function si(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?ut(e):void 0;return n!==void 0&&n!=="__proto__"&&ri.test(n)?n:void 0}function Ul(e){return e!=="__proto__"&&ri.test(e)}function Jr(e){let n=ce(e);return d.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||Ie(n)}function Vl(e){if(!d.isArrayLiteralExpression(e)&&!d.isObjectLiteralExpression(e))return!1;let n=!1,t=r=>{n||(Be(r)?n=!0:d.forEachChild(r,t))};return t(e),n}function oi(e){let n=!1,t=new Map,r=i=>{if(!n){if(d.isBinaryExpression(i)&&i.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(Ie(i.left)||d.isIdentifier(i.left)&&i.left.text==="exports")n=!0;else if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&Jr(i.right))n=!0;else if(Vl(i.left))n=!0;else if(Be(i.left)){let s=si(i.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(d.isCallExpression(i)&&kn(i)&&i.arguments[0]!==void 0&&mn(i.arguments[0])||d.isCallExpression(i)&&ii(i)||d.isCallExpression(i)&&jl(i)||d.isVariableDeclaration(i)&&i.initializer!==void 0&&Jr(i.initializer))&&(n=!0);n||d.forEachChild(i,r)}};return r(e),{surfaceEscapes:n,assignCount:t}}function ai(e){let n=[];for(let t of e.statements){if(!d.isExpressionStatement(t)||!d.isBinaryExpression(t.expression))continue;let r=t.expression;r.operatorToken.kind===d.SyntaxKind.EqualsToken&&(!Be(r.left)||Ie(r.left)||n.push({bin:r,name:si(r.left)}))}return n}function ql(e){let{surfaceEscapes:n,assignCount:t}=oi(e);if(n)return[];let r=[];for(let{bin:i,name:s}of ai(e))s===void 0||(t.get(s)??0)!==1||(d.isFunctionExpression(i.right)||d.isArrowFunction(i.right))&&r.push({name:s,value:i.right});return r}function Hl(e,n){let{surfaceEscapes:t,assignCount:r}=oi(e);if(t)return[];let i=[];for(let{bin:s,name:l}of ai(e))l===void 0||(r.get(l)??0)!==1||d.isIdentifier(s.right)&&!n.has(s.right.text)&&i.push(s.right.text);return i}function Wl(e,n){let{surfaceEscapes:t,assignCount:r}=oi(e);for(let{bin:i,name:s}of ai(e)){let l=i.right;if(!(d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isIdentifier(l)))continue;let o=d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isIdentifier(l)&&!n.has(l.text);if(!(!t&&s!==void 0&&(r.get(s)??0)===1&&o))return!0}return!1}function Gl(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&d.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Yr(e){let n=e.parent;return n===void 0?!1:d.isPropertyAccessExpression(n)?n.name===e:d.isQualifiedName(n)?n.right===e:d.isBindingElement(n)||d.isImportSpecifier(n)?n.propertyName===e:d.isExportSpecifier(n)?!0:d.isPropertyAssignment(n)||d.isPropertyDeclaration(n)||d.isPropertySignature(n)||d.isMethodDeclaration(n)||d.isMethodSignature(n)||d.isGetAccessorDeclaration(n)||d.isSetAccessorDeclaration(n)||d.isEnumMember(n)?n.name===e:!1}function Qr(e){for(let n=e.parent;n!==void 0;n=n.parent){if(d.isSourceFile(n))return!0;if(!d.isArrowFunction(n)&&(d.isFunctionLike(n)||d.isClassLike(n)))return!1}return!0}function Xl(e,n){let t=r=>{d.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&n.add(r),d.forEachChild(r,t)};t(e)}function Jl(e){let n=[],t=new Set;for(let s of e.statements){if(d.isExportDeclaration(s)||d.isExportAssignment(s)||d.isImportDeclaration(s)||d.isImportEqualsDeclaration(s)||pn(s))return null;if(!d.isExpressionStatement(s)||!d.isBinaryExpression(s.expression))continue;let l=s.expression;if(l.operatorToken.kind===d.SyntaxKind.EqualsToken){if(Ie(l.left))n.push({kind:"whole",value:l.right});else if(Be(l.left)){let a=si(l.left);if(a===void 0)return null;n.push({kind:"member",name:a,value:l.right,root:Gl(l.left)})}else continue;Xl(l.left,t)}}let r=!1,i=s=>{if(!r){if(d.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!Yr(s)){r=!0;return}if(s.kind===d.SyntaxKind.ThisKeyword&&Qr(s)){r=!0;return}if(d.isIdentifier(s)&&s.text==="arguments"&&!Yr(s)&&Qr(s)){r=!0;return}d.forEachChild(s,i)}};return i(e),r?null:n}function ni(e){return d.isIdentifier(e)||d.isStringLiteralLike(e)?e.text:void 0}function Zr(e,n,t){return d.isIdentifier(e)?n(e.text):t?.(e)}function Yl(e,n,t,r){let i=new Map,s=Jl(e);if(s===null||s.filter(h=>h.kind==="whole").length>1)return i;let l=s.findIndex(h=>h.kind==="whole"),a=(h,b)=>l>=0&&b>l&&h.kind==="member"&&h.root==="exports",o=s.some(a);if(o){let h=s[l];if(h===void 0||h.kind!=="whole"||!d.isObjectLiteralExpression(h.value))return i}let c=o?s.filter((h,b)=>!a(h,b)):s,u=new Map;for(let h of c)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let f=h=>n.has(h)?void 0:t(h),m=(h,b)=>{b===void 0?i.delete(h):i.set(h,b)};for(let h of c){if(h.kind==="member"){m(h.name,(u.get(h.name)??0)>1?void 0:Zr(h.value,f,r));continue}i.clear();let b=h.value;if(d.isObjectLiteralExpression(b))for(let S of b.properties){if(d.isSpreadAssignment(S))return new Map;if(d.isShorthandPropertyAssignment(S)){m(S.name.text,f(S.name.text));continue}let x=ni(S.name);if(x===void 0)return new Map;m(x,d.isPropertyAssignment(S)?Zr(S.initializer,f,r):void 0)}}return i}function as(e,n,t,r){let i=new Map,s=a=>a!==void 0&&me(a)==="relative"?t.get(`${n}::${a}`):void 0,l=a=>{if(d.isVariableDeclaration(a)&&a.initializer!==void 0){let o=a.initializer;if(d.isIdentifier(a.name)&&!r.has(a.name.text)){let c=s(Ye(o));if(c!==void 0)i.set(a.name.text,{kind:"whole",target:c});else if((d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o))&&d.isCallExpression(o.expression)){let u=s(Ye(o.expression)),f=ut(o);u!==void 0&&f!==void 0&&i.set(a.name.text,{kind:"member",target:u,member:f})}}else if(d.isObjectBindingPattern(a.name)){let c=s(Ye(o));if(c!==void 0){for(let u of a.name.elements)if(d.isIdentifier(u.name)&&!r.has(u.name.text)){let f=u.propertyName!==void 0&&d.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;i.set(u.name.text,{kind:"member",target:c,member:f})}}}}d.forEachChild(a,l)};return l(e),i}function Ql(e,n,t,r){let i=l=>l!==void 0&&me(l)==="relative"?t.get(`${n}::${l}`):void 0,s=i(Ye(e));if(s!==void 0)return{kind:"whole",target:s};if(d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)){let l=ut(e);if(l===void 0)return;let a=i(Ye(e.expression));if(a!==void 0)return{kind:"member",target:a,member:l};if(d.isIdentifier(e.expression)){let o=r.get(e.expression.text);if(o?.kind==="whole")return{kind:"member",target:o.target,member:l}}return}if(d.isIdentifier(e))return r.get(e.text)}function ls(e,n,t,r,i){let s=[],l=!1,a=f=>{if(is(f))return!0;let m=!1,h=b=>{m||(d.isIdentifier(b)&&i.has(b.text)?m=!0:d.forEachChild(b,h))};return h(f),m},o=(f,m)=>{let h=Ql(f,n,t,r);h!==void 0?s.push({source:h,exportedName:m}):a(f)&&(l=!0)},c=f=>{if(d.isObjectLiteralExpression(f)){for(let m of f.properties)if(d.isSpreadAssignment(m))o(m.expression,"default");else if(d.isPropertyAssignment(m)){let h=d.isIdentifier(m.name)||d.isStringLiteralLike(m.name)?m.name.text:"default";o(m.initializer,h)}else if(d.isShorthandPropertyAssignment(m)){let h=r.get(m.name.text);h!==void 0&&s.push({source:h,exportedName:m.name.text})}return}o(f,"default")},u=f=>{if(d.isBinaryExpression(f)&&f.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(Ie(f.left)){c(f.right);return}if(Be(f.left)){let m=d.isPropertyAccessExpression(f.left)?f.left.name.text:d.isElementAccessExpression(f.left)&&d.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";o(f.right,m);return}}else if(d.isExportAssignment(f)&&f.isExportEquals){o(f.expression,"default");return}else if(d.isCallExpression(f)&&kn(f)&&f.arguments[0]!==void 0&&mn(f.arguments[0])){for(let m of f.arguments.slice(1))c(m);return}d.forEachChild(f,u)};return u(e),{sources:s,residual:l}}function ds(e){let n=new Set,t=i=>{let s=i;for(;d.isPropertyAccessExpression(s)||d.isElementAccessExpression(s);)s=s.expression;return d.isIdentifier(s)?s.text:void 0},r=i=>{let s=cs(i);if(s!==void 0){let l=t(s);l!==void 0&&n.add(l)}d.forEachChild(i,r)};return r(e),n}function cs(e){return d.isBinaryExpression(e)&&e.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=d.SyntaxKind.LastAssignment&&(d.isPropertyAccessExpression(e.left)||d.isElementAccessExpression(e.left))?e.left:void 0}function dt(e){if(d.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)d.isBindingElement(t)&&n.push(...dt(t.name));return n}function ve(e){if(d.isIdentifier(e))return[e.text];if(d.isParenthesizedExpression(e)||d.isAsExpression(e)||d.isNonNullExpression(e)||d.isSatisfiesExpression(e)||d.isTypeAssertionExpression(e)||d.isAwaitExpression(e))return ve(e.expression);if(d.isYieldExpression(e))return e.expression!==void 0?ve(e.expression):[];if(d.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===d.SyntaxKind.BarBarToken||n===d.SyntaxKind.AmpersandAmpersandToken||n===d.SyntaxKind.QuestionQuestionToken?[...ve(e.left),...ve(e.right)]:n===d.SyntaxKind.CommaToken?ve(e.right):[]}return d.isConditionalExpression(e)?[...ve(e.whenTrue),...ve(e.whenFalse)]:d.isArrayLiteralExpression(e)?e.elements.flatMap(n=>d.isSpreadElement(n)?ve(n.expression):d.isOmittedExpression(n)?[]:ve(n)):d.isObjectLiteralExpression(e)?e.properties.flatMap(n=>d.isShorthandPropertyAssignment(n)?[n.name.text]:d.isPropertyAssignment(n)?ve(n.initializer):d.isSpreadAssignment(n)?ve(n.expression):[]):[]}function us(e,n){let t=[],r=(a,o)=>{for(let c of a)for(let u of o)c!==u&&t.push({a:c,b:u})},i=a=>d.isIdentifier(a)?[a.text]:d.isArrayLiteralExpression(a)?a.elements.flatMap(i):d.isObjectLiteralExpression(a)?a.properties.flatMap(o=>d.isShorthandPropertyAssignment(o)?[o.name.text]:d.isPropertyAssignment(o)?i(o.initializer):[]):[],s=a=>{d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken?r(i(a.left),ve(a.right)):d.isVariableDeclaration(a)&&a.initializer!==void 0?r(dt(a.name),ve(a.initializer)):(d.isForOfStatement(a)||d.isForInStatement(a))&&d.isVariableDeclarationList(a.initializer)&&a.initializer.declarations[0]!==void 0&&r(dt(a.initializer.declarations[0].name),ve(a.expression)),d.forEachChild(a,s)};s(e);let l=new Set(n);for(let a=!0;a;){a=!1;for(let{a:o,b:c}of t)l.has(o)&&!l.has(c)&&(l.add(c),a=!0),l.has(c)&&!l.has(o)&&(l.add(o),a=!0)}return l}function fs(e,n){let t=a=>{if(!d.isPropertyAccessExpression(a)&&!d.isElementAccessExpression(a))return;let o=a;for(;d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o);)o=o.expression;return d.isIdentifier(o)?o.text:void 0},r=[],i=(a,o)=>{for(let u of ve(o))r.push({name:a,root:u});let c=t(o);c!==void 0&&r.push({name:a,root:c})},s=a=>{d.isVariableDeclaration(a)&&d.isIdentifier(a.name)&&a.initializer!==void 0?i(a.name.text,a.initializer):d.isBinaryExpression(a)&&a.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(a.left)&&i(a.left.text,a.right),d.forEachChild(a,s)};s(e);let l=new Map(n);for(let a=!0;a;){a=!1;for(let{name:o,root:c}of r){let u=l.get(c);u!==void 0&&!l.has(o)&&(l.set(o,u),a=!0)}}return l}function ps(e){return us(e,ds(e))}function Zl(e,n){let t=o=>o>=d.SyntaxKind.FirstAssignment&&o<=d.SyntaxKind.LastAssignment,r=o=>{let c=o.parent;if(c===void 0||!d.isObjectLiteralExpression(c))return!1;let u=c.parent;return u!==void 0&&d.isBinaryExpression(u)&&u.operatorToken.kind===d.SyntaxKind.EqualsToken&&u.right===c&&Be(u.left)?!0:u!==void 0&&d.isCallExpression(u)&&kn(u)&&u.arguments[0]!==void 0&&mn(u.arguments[0])&&u.arguments.indexOf(c)>0},i=(o,c)=>{if((d.isFunctionDeclaration(c)||d.isFunctionExpression(c))&&c.name===o||d.isVariableDeclaration(c)&&c.name===o||d.isParameter(c)&&c.name===o||d.isBindingElement(c)&&c.name===o||(d.isCallExpression(c)||d.isNewExpression(c))&&c.expression===o)return!0;if((d.isPropertyAccessExpression(c)||d.isElementAccessExpression(c))&&c.expression===o){let u=c;for(;u.parent!==void 0&&(d.isPropertyAccessExpression(u.parent)||d.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let f=u.parent;return!(f!==void 0&&d.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===u)}return d.isBinaryExpression(c)&&c.operatorToken.kind===d.SyntaxKind.EqualsToken&&c.right===o&&Be(c.left)?!0:d.isShorthandPropertyAssignment(c)&&c.name===o||d.isPropertyAssignment(c)&&c.initializer===o?r(c):!!(d.isExportAssignment(c)&&c.expression===o||d.isExportSpecifier(c))},s=(o,c)=>d.isPropertyAccessExpression(c)&&c.name===o||d.isPropertyAssignment(c)&&c.name===o||(d.isMethodDeclaration(c)||d.isGetAccessorDeclaration(c)||d.isSetAccessorDeclaration(c))&&c.name===o,l=!1,a=(o,c)=>{if(!l){if(d.isIdentifier(o)&&c!==void 0&&n.has(o.text)&&!s(o,c)&&!i(o,c)){l=!0;return}d.forEachChild(o,u=>a(u,o))}};return a(e,void 0),l}function ed(e){let n=new Set;for(let o of e.statements)if(d.isFunctionDeclaration(o)&&o.name!==void 0)n.add(o.name.text);else if(d.isVariableStatement(o))for(let c of o.declarationList.declarations)d.isIdentifier(c.name)&&c.initializer!==void 0&&(d.isFunctionExpression(c.initializer)||d.isArrowFunction(c.initializer))&&n.add(c.name.text);let t=new Set,r=o=>{d.isBinaryExpression(o)&&o.operatorToken.kind===d.SyntaxKind.EqualsToken?(Ie(o.left)&&(d.isIdentifier(o.right)?t.add(o.right.text):d.isObjectLiteralExpression(o.right)&&ss(o.right,t)),Ie(o.right)&&d.isIdentifier(o.left)&&t.add(o.left.text)):d.isVariableDeclaration(o)&&d.isIdentifier(o.name)&&o.initializer!==void 0&&Ie(o.initializer)&&t.add(o.name.text),d.forEachChild(o,r)};if(r(e),t.size>0){if(Zl(e,t))return!0;let o=fs(e,new Map([...t].map(u=>[u,u]))),c=ps(e);for(let u of o.keys())if(c.has(u))return!0}let i=o=>d.isIdentifier(o)&&n.has(o.text),s=o=>o.properties.every(c=>d.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||d.isPropertyAssignment(c)&&i(c.initializer)),l=!1,a=o=>{if(!l){if(d.isBinaryExpression(o)){let c=o.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=d.SyntaxKind.LastAssignment;c&&Ie(o.left)?o.operatorToken.kind===d.SyntaxKind.EqualsToken&&(i(o.right)||d.isObjectLiteralExpression(o.right)&&s(o.right))||(l=!0):c&&Be(o.left)&&(l=!0)}else d.isCallExpression(o)?(kn(o)&&o.arguments[0]!==void 0&&mn(o.arguments[0])||ii(o))&&(l=!0):(d.isExportAssignment(o)&&o.isExportEquals&&!d.isIdentifier(o.expression)||d.isExportDeclaration(o)&&o.moduleSpecifier!==void 0)&&(l=!0);l||d.forEachChild(o,a)}};return a(e),l}var nd=8;function es(e,n,t){let r=new Set,i=as(e,n,t,Sn(e)),s=ls(e,n,t,i,rs(e));for(let{source:l}of s.sources)r.add(l.target);for(let l of e.statements)if(d.isExportDeclaration(l)&&l.moduleSpecifier!==void 0&&d.isStringLiteralLike(l.moduleSpecifier)&&me(l.moduleSpecifier.text)==="relative"){let a=t.get(`${n}::${l.moduleSpecifier.text}`);a!==void 0&&r.add(a)}return r}function td(e,n,t,r=new Map){let i=new Set(n.modules.filter(k=>k.isEntrypoint).map(k=>String(k.id)));if(i.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(k=>k.externalSurface===!0).map(k=>String(k.id))),l=new Map,a=new Map,o=new Map,c=new Map;for(let k of t){if(k.name==="<toplevel>"){c.set(String(k.moduleId),k);continue}if(l.set(`${String(k.moduleId)}::${String(k.declRange.start)}`,k),k.name!==void 0&&a.set(`${String(k.moduleId)}::${k.name}`,k),k.isExported&&k.name!==void 0){let p=o.get(String(k.moduleId))??[];p.push(k),o.set(String(k.moduleId),p)}}if(r.size>0){let k=new Map(t.map(p=>[String(p.id),p]));for(let[p,y]of r){let A=k.get(String(y));A!==void 0&&!l.has(p)&&l.set(p,A)}}let u=new Map;for(let k of n.imports)k.resolvedModuleId!==void 0&&u.set(`${k.moduleId}::${k.specifier}`,String(k.resolvedModuleId));let f=new Map;for(let k of e.sourceFiles){let p=e.toRel(k.fileName);p!==null&&f.set(p,k)}let m=new Map,h=k=>{let p=m.get(k);if(p!==void 0)return p;let y=f.get(k),A=y===void 0?!0:ed(y);return m.set(k,A),A},b=new Set,S=(k,p)=>p!==void 0&&me(p)==="relative"?u.get(`${k}::${p}`):void 0,x=k=>{if(d.isIdentifier(k))return k.text;if(d.isPropertyAccessExpression(k)){let p=x(k.expression);return p===void 0?void 0:`${p}.${k.name.text}`}if(d.isElementAccessExpression(k)&&d.isStringLiteralLike(k.argumentExpression)){let p=x(k.expression);return p===void 0?void 0:`${p}.${k.argumentExpression.text}`}},w=k=>{let p=k;for(;d.isPropertyAccessExpression(p)||d.isElementAccessExpression(p);)p=p.expression;return Ye(p)};for(let k of e.sourceFiles){let p=e.toRel(k.fileName);if(p===null)continue;let y=new Map,A=new Map,L=(C,K)=>{let R=S(p,Ye(K));if(R!==void 0){if(d.isIdentifier(C))A.set(C.text,R),y.set(C.text,R);else if(d.isObjectBindingPattern(C)||d.isArrayBindingPattern(C))for(let O of dt(C))A.set(O,R);else if(d.isPropertyAccessExpression(C)||d.isElementAccessExpression(C)){let O=x(C);O!==void 0&&y.set(O,R)}}},U=C=>{d.isVariableDeclaration(C)&&C.initializer!==void 0?L(C.name,C.initializer):d.isBinaryExpression(C)&&C.operatorToken.kind===d.SyntaxKind.EqualsToken&&L(C.left,C.right),d.forEachChild(C,U)};U(k);let I=C=>{let K=cs(C);if(K!==void 0){let R=K.expression,O=S(p,w(R));O!==void 0&&b.add(O);let V=x(R),J=V!==void 0?y.get(V):void 0;J!==void 0&&b.add(J)}d.forEachChild(C,I)};if(I(k),A.size>0){let C=fs(k,A),K=ps(k);for(let[R,O]of C)K.has(R)&&b.add(O)}}let _=[],$=[],N=[];for(let k of e.sourceFiles){let p=e.toRel(k.fileName);if(p===null||!i.has(p))continue;let y=e.checker.getSymbolAtLocation(k),A=new Set,L=new Set,U=0,I=(j,H)=>{if(s.has(String(j.moduleId))||A.has(String(j.id)))return;A.add(String(j.id));let ue=`${p}#reexport:${String(U)}:${H}`;U+=1,_.push({id:ue,moduleId:p,exportedName:H,kind:"value",reexportOf:{moduleId:String(j.moduleId),name:j.name??H}}),$.push({exportId:ue,target:{kind:"function",functionId:j.id}})},C=j=>{if(Bl(j))return;let H=j;if((j.flags&d.SymbolFlags.Alias)!==0)try{H=e.checker.getAliasedSymbol(j)}catch{return}let ue=zl(H,e,l,a,s);if(ue!==void 0){I(ue,j.getName());return}if((H.flags&d.SymbolFlags.Module)!==0&&!L.has(H)){L.add(H);try{for(let Me of e.checker.getExportsOfModule(H))C(Me)}catch{}}};if(y!==void 0)for(let j of e.checker.getExportsOfModule(y))C(j);let K=as(k,p,u,Sn(k)),R=ls(k,p,u,K,rs(k)),O=new Set,V=R.residual,J=j=>{let H=f.get(j);j.includes("node_modules/")||H===void 0||Kl(H)?V=!0:O.add(j)};for(let{source:j,exportedName:H}of R.sources){let ue=o.get(j.target)??[],Me=b.has(j.target);if(j.kind==="whole"){for(let ye of ue)I(ye,ye.name??H);Me?V=!0:(ue.length===0||h(j.target))&&J(j.target)}else{let ye=ue.filter(be=>be.name===j.member);for(let be of ye)I(be,H);Me?V=!0:(ye.length===0||h(j.target))&&J(j.target)}}let re=new Set,Y=[];for(let j of es(k,p,u))Y.push({target:j,depth:1});for(;Y.length>0;){let j=Y.shift();if(j===void 0)break;let{target:H,depth:ue}=j;if(re.has(H)||ue>nd||(re.add(H),H.split("/").includes("node_modules")))continue;let Me=f.get(H);if(Me===void 0)continue;let ye=c.get(H);ye!==void 0&&!h(H)&&I(ye,"<load>");for(let be of es(Me,H,u))re.has(be)||Y.push({target:be,depth:ue+1})}Wl(k,Sn(k))&&(V=!0);for(let j of O)N.push({code:"unresolved-reexport",path:p,detail:`entrypoint whole/member re-exports app-owned relative module ${j} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:j});V&&N.push({code:"unresolved-reexport",path:p,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:_,exportBindings:$,diagnostics:N}}var bn=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),id=new Set(["defineProperty","defineProperties","create"]);function rd(e){let n=!0,t=i=>d.isIdentifier(i)||d.isStringLiteral(i)||d.isNumericLiteral(i)?bn.has(i.text):d.isComputedPropertyName(i)&&d.isStringLiteralLike(i.expression)?bn.has(i.expression.text):!1,r=i=>{if(n){if(d.isNewExpression(i)||d.isForOfStatement(i)||d.isSpreadElement(i)||d.isSpreadAssignment(i)||d.isArrayBindingPattern(i)||d.isGetAccessorDeclaration(i)||d.isSetAccessorDeclaration(i)||d.isYieldExpression(i)&&i.asteriskToken!==void 0||d.canHaveDecorators(i)&&(d.getDecorators(i)?.length??0)>0){n=!1;return}if((d.isPropertyAccessExpression(i)||d.isMethodDeclaration(i)||d.isPropertyAssignment(i))&&t(i.name)||d.isPropertyDeclaration(i)&&t(i.name)||d.isShorthandPropertyAssignment(i)&&t(i.name)||d.isBindingElement(i)&&t(i.propertyName??i.name)||d.isElementAccessExpression(i)&&d.isStringLiteralLike(i.argumentExpression)&&bn.has(i.argumentExpression.text)){n=!1;return}if(d.isCallExpression(i)&&d.isPropertyAccessExpression(i.expression)&&d.isIdentifier(i.expression.expression)&&i.expression.expression.text==="Object"&&id.has(i.expression.name.text)){n=!1;return}d.forEachChild(i,r)}};return r(e),n}function ft(e){if(d.isIdentifier(e)||d.isStringLiteral(e)||d.isNumericLiteral(e))return e.text}function ms(e){let n=t=>d.canHaveDecorators(t)&&(d.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function sd(e){let n=!1,t=new Set,r=[],i=new Map,s=(m,h)=>{let b=i.get(m);b===void 0?i.set(m,[h]):b.push(h)},l=m=>{d.isIdentifier(m)?t.add(m.text):r.push(m)},a=m=>{for(let h of m.properties)d.isShorthandPropertyAssignment(h)?t.add(h.name.text):d.isPropertyAssignment(h)?r.push(h.initializer):n=!0},o=m=>{if(d.isBinaryExpression(m)&&m.operatorToken.kind===d.SyntaxKind.EqualsToken){let h=m.left,b=m.right;Ie(h)?d.isObjectLiteralExpression(b)?a(b):d.isIdentifier(b)||d.isFunctionExpression(b)||d.isArrowFunction(b)||d.isClassExpression(b)?l(b):n=!0:Be(h)?(d.isElementAccessExpression(h)&&!d.isStringLiteralLike(h.argumentExpression)&&(n=!0),l(b)):d.isIdentifier(h)?s(h.text,b):(d.isPropertyAccessExpression(h)||d.isElementAccessExpression(h))&&d.isIdentifier(h.expression)&&s(h.expression.text,b)}else if(d.isCallExpression(m))(kn(m)&&m.arguments[0]!==void 0&&mn(m.arguments[0])||ii(m))&&(n=!0);else if(d.isVariableDeclaration(m)&&d.isIdentifier(m.name)&&m.initializer!==void 0)s(m.name.text,m.initializer);else if((d.isFunctionDeclaration(m)||d.isClassDeclaration(m))&&m.name!==void 0)s(m.name.text,m),pn(m)&&t.add(m.name.text);else if(d.isExportDeclaration(m)){if(m.exportClause===void 0)n=!0;else if(m.moduleSpecifier===void 0&&d.isNamedExports(m.exportClause))for(let h of m.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(d.isExportAssignment(m))m.isExportEquals&&!d.isIdentifier(m.expression)?n=!0:l(m.expression);else if(d.isVariableStatement(m)&&pn(m))for(let h of m.declarationList.declarations)d.isIdentifier(h.name)&&t.add(h.name.text);d.forEachChild(m,o)};o(e);let c=new Set,u=[...t],f=m=>{let h=b=>{d.isIdentifier(b)&&u.push(b.text),d.forEachChild(b,h)};h(m)};for(let m of r)f(m);for(;u.length>0;){let m=u.pop();if(!(m===void 0||c.has(m))){c.add(m);for(let h of i.get(m)??[])f(h)}}return{names:c,opaque:n}}var od=512,ad=new Set(["get","post","put","patch","delete","options","head"]);function ld(e){for(let n of e.statements){if(d.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(n.expression.left)&&d.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,r=n.expression.left.name.text;if(t==="module"&&r==="exports"||t==="exports"&&r==="default")return n.expression.right}}return null}function dd(e){let n=new Map,t=ld(e);if(t===null)return n;let r=s=>{for(let l of s.properties)if(d.isPropertyAssignment(l)&&d.isObjectLiteralExpression(l.initializer)){let a=ft(l.name);a!==void 0&&n.set(a,l.initializer)}};if(d.isObjectLiteralExpression(t))return r(t),n;if(!d.isIdentifier(t))return n;let i=t.text;for(let s of e.statements)if(d.isVariableStatement(s))for(let l of s.declarationList.declarations)d.isIdentifier(l.name)&&l.name.text===i&&l.initializer!==void 0&&d.isObjectLiteralExpression(l.initializer)&&r(l.initializer);else if(d.isExpressionStatement(s)&&d.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(s.expression.left)&&d.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===i&&d.isObjectLiteralExpression(s.expression.right)){let l=s.expression.left.name.text;n.set(l,s.expression.right)}return n}function cd(e){for(let n of e.properties){if(d.isMethodDeclaration(n)&&d.isIdentifier(n.name)&&n.name.text==="handler")return n;if(d.isPropertyAssignment(n)&&d.isIdentifier(n.name)&&n.name.text==="handler"&&(d.isArrowFunction(n.initializer)||d.isFunctionExpression(n.initializer)))return n.initializer}return null}function ud(e,n){for(let r of e.properties){let i;if(d.isPropertyAssignment(r)||d.isMethodDeclaration(r)?i=ft(r.name):d.isShorthandPropertyAssignment(r)&&(i=r.name.text),i==="method"||i==="url"||i==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function fd(e,n){let t=[],r=new Set,i=(a,o,c)=>{if(t.length>=od||a==="__proto__"||!ri.test(a))return;let u=`${e}#handler:${a}`;r.has(u)||(r.add(u),t.push({id:u,node:o,memberPath:a,idiom:c}))};for(let[a,o]of dd(n)){let c=cd(o);c!==null&&ud(o,c)&&i(a,c,"descriptor-object")}let s=0,l=a=>{if(d.isCallExpression(a)&&d.isPropertyAccessExpression(a.expression)&&d.isIdentifier(a.expression.expression)&&ad.has(a.expression.name.text)&&a.arguments.length>=2&&a.arguments[0]!==void 0&&d.isStringLiteralLike(a.arguments[0])){let o=a.expression.name.text;for(let c=1;c<a.arguments.length;c+=1){let u=a.arguments[c];u!==void 0&&(d.isArrowFunction(u)||d.isFunctionExpression(u))&&i(`${o}_${String(s)}_${String(c)}`,u,"router-verb")}s+=1}d.forEachChild(a,l)};return l(n),t}function pd(e,n,t,r,i,s){let l=`${e}#class:${t}`,a=[],o=new Set;for(let c of r.members){let u,f,m;if(d.isConstructorDeclaration(c))u="constructor",f="ctor",m=!1;else if(d.isMethodDeclaration(c))u=ft(c.name),f="method",m=u!==void 0&&!bn.has(u);else continue;if(u===void 0||o.has(u))continue;o.add(u);let h=`${e}#${t}.${u}`;i.push({id:h,moduleId:e,name:u,kind:f,enclosingClassId:l,declRange:sn(e,c,n),isExported:!1,publicSurfaceReachable:!1}),a.push(h),m&&s.push({start:c.getStart(n,!1),end:c.getEnd(),id:h})}return{id:l,moduleId:e,name:t,implementsRefs:[],members:a}}function md(e,n,t=[],r=!1,i){let s=[],l=new Map,a=[],{reachableLocals:o,defaultTarget:c}=Dl(n),u=Sn(n),f=`${e}#<toplevel>`;s.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let m=(p,y)=>{let A=`${e}#${p}`;return s.push({id:A,moduleId:e,name:p,kind:"function",declRange:sn(e,y,n),isExported:o.has(p),publicSurfaceReachable:o.has(p)}),l.set(p,{kind:"function",functionId:A}),a.push({start:y.getStart(n,!1),end:y.getEnd(),id:A}),A},h=[],b=!e.split("/").includes("node_modules");if(b)for(let p of Hl(n,u))o.add(p);let S=b?sd(n):void 0,x=(p,y,A)=>{S===void 0||S.opaque||S.names.has(p)||pn(A)||ms(y)||h.push(pd(e,n,p,y,s,a))};for(let p of n.statements)if(d.isFunctionDeclaration(p)&&p.name!==void 0)m(p.name.text,p);else if(d.isClassDeclaration(p)&&p.name!==void 0)x(p.name.text,p,p);else if(d.isVariableStatement(p))for(let y of p.declarationList.declarations){if(d.isObjectBindingPattern(y.name)&&y.initializer!==void 0&&d.isCallExpression(y.initializer)&&d.isIdentifier(y.initializer.expression)&&y.initializer.expression.text==="require"&&y.initializer.arguments.length===1&&y.initializer.arguments[0]!==void 0&&d.isStringLiteralLike(y.initializer.arguments[0])){let L=y.initializer.arguments[0].text;for(let U of y.name.elements){if(U.dotDotDotToken!==void 0||U.initializer!==void 0||!d.isIdentifier(U.name))continue;let I=U.propertyName??U.name;!d.isIdentifier(I)&&!d.isStringLiteralLike(I)||l.set(U.name.text,{kind:"import",specifier:L,form:{named:I.text}})}continue}if(!d.isIdentifier(y.name)||y.initializer===void 0)continue;let A=y.initializer;if(d.isFunctionExpression(A)||d.isArrowFunction(A))m(y.name.text,y);else if(d.isClassExpression(A))x(y.name.text,A,p);else if(d.isCallExpression(A)&&d.isIdentifier(A.expression)&&A.expression.text==="require"&&A.arguments.length===1&&A.arguments[0]!==void 0&&d.isStringLiteralLike(A.arguments[0]))l.set(y.name.text,{kind:"import",specifier:A.arguments[0].text,form:"whole"});else if((d.isPropertyAccessExpression(A)||d.isElementAccessExpression(A))&&ut(A)==="default"&&d.isCallExpression(A.expression)){let L=Ye(A.expression);L!==void 0&&l.set(y.name.text,{kind:"import",specifier:L,form:"require-default"})}}else if(d.isImportDeclaration(p)&&d.isStringLiteralLike(p.moduleSpecifier)){let y=p.moduleSpecifier.text,A=p.importClause;if(A!==void 0){A.name!==void 0&&l.set(A.name.text,{kind:"import",specifier:y,form:"default"});let L=A.namedBindings;if(L!==void 0&&d.isNamespaceImport(L))l.set(L.name.text,{kind:"import",specifier:y,form:"namespace"});else if(L!==void 0&&d.isNamedImports(L))for(let U of L.elements){let I=(U.propertyName??U.name).text;l.set(U.name.text,{kind:"import",specifier:y,form:{named:I}})}}}else d.isImportEqualsDeclaration(p)&&d.isExternalModuleReference(p.moduleReference)&&d.isStringLiteralLike(p.moduleReference.expression)&&l.set(p.name.text,{kind:"import",specifier:p.moduleReference.expression.text,form:"whole"});let w=new Map,_,$=new Map,N=new Map;if(b)for(let{name:p,value:y}of ql(n)){let A=`${e}#member-export:${p}`;s.push({id:A,moduleId:e,name:p,kind:d.isArrowFunction(y)?"arrow":"function",declRange:sn(e,y,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:y.getStart(n,!1),end:y.getEnd(),id:A}),w.set(y.getStart(n,!1),A)}if(r&&b){let p=I=>{let C=Oe(I);return d.isFunctionExpression(C)||d.isArrowFunction(C)?C:void 0},y=(I,C)=>{let K=I;return s.push({id:K,moduleId:e,kind:d.isArrowFunction(C)?"arrow":"function",declRange:sn(e,C,n),isExported:!0,publicSurfaceReachable:!0}),a.push({start:C.getStart(n,!1),end:C.getEnd(),id:K}),w.set(C.getStart(n,!1),K),K},A=[],L=[],U=[];for(let I of n.statements)d.isExportAssignment(I)&&!I.isExportEquals?A.push(I):d.isFunctionDeclaration(I)&&d.getModifiers(I)?.some(C=>C.kind===d.SyntaxKind.DefaultKeyword)===!0?L.push(I):d.isExpressionStatement(I)&&d.isBinaryExpression(I.expression)&&I.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ie(I.expression.left)&&U.push(I.expression);if(A.length+L.length+U.length===1){let I=A[0],C=L[0],K=U[0];if(I!==void 0){let R=p(I.expression);if(R!==void 0){let O=y(`${e}#<default>`,R);_={id:O,esm:!0},N.set(I.getStart(n,!1),O),ne(i,"2a-default",null)}}else if(C!==void 0&&C.name===void 0&&C.body!==void 0){let R=y(`${e}#<default>`,C);_={id:R,esm:!0},N.set(C.getStart(n,!1),R),ne(i,"2a-default",null)}else if(K!==void 0){let R=p(K.right);if(R!==void 0){let O=y(`${e}#<default>`,R);_={id:O,esm:!1},N.set(K.getStart(n,!1),O),ne(i,"2a-default",null)}else if(d.isObjectLiteralExpression(K.right)){let O=K.right,V=[],J=!0;for(let re of O.properties){if(d.isSpreadAssignment(re)){J=!1;break}let Y=re.name,j=Y===void 0?void 0:ni(Y);if(j===void 0){J=!1;break}V.push(j)}if(J){let re=new Map;for(let Y of V)re.set(Y,(re.get(Y)??0)+1);for(let Y of O.properties){if(!d.isPropertyAssignment(Y))continue;let j=ni(Y.name),H=p(Y.initializer);if(j!==void 0){if(!Ul(j)){H!==void 0&&ne(i,"2a-member","charset-refused");continue}if((re.get(j)??0)!==1){H!==void 0&&ne(i,"2a-member","duplicate-key");continue}if(H!==void 0){let ue=y(`${e}#<cjs>.${j}`,H);$.set(j,ue),N.set(Y.getStart(n,!1),ue),ne(i,"2a-member",null)}}}}else for(let re of O.properties)d.isPropertyAssignment(re)&&p(re.initializer)!==void 0&&ne(i,"2a-member","spread-or-computed-literal")}}}else{for(let I of A)p(I.expression)!==void 0&&ne(i,"2a-default","duplicate-default-sources");for(let I of L)I.name===void 0&&ne(i,"2a-default","duplicate-default-sources");for(let I of U)if(p(I.right)!==void 0)ne(i,"2a-default","duplicate-default-sources");else if(d.isObjectLiteralExpression(I.right))for(let C of I.right.properties)d.isPropertyAssignment(C)&&p(C.initializer)!==void 0&&ne(i,"2a-member","duplicate-default-sources")}}for(let p of t)s.push({id:p.id,moduleId:e,name:`handler:${p.memberPath}`,kind:d.isArrowFunction(p.node)?"arrow":"function",declRange:sn(e,p.node,n),isExported:!1,publicSurfaceReachable:!1}),a.push({start:p.node.getStart(n,!1),end:p.node.getEnd(),id:p.id});a.sort((p,y)=>p.end-p.start-(y.end-y.start));let k=c!==void 0?`${e}#${c}`:void 0;return{rel:e,sf:n,functions:s,bindings:l,exportedFunctionId:k,exportedNames:o,tainted:u,fnRanges:a,toplevelId:f,classes:h,mintedByPos:w,mintedDefault:_,mintedMembers:$,mintSeedAliases:N}}function hd(e){return d.isIdentifier(e)?"identifier":d.isPropertyAccessExpression(e)?"member":d.isElementAccessExpression(e)?"computed-member":e.kind===d.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function ns(e,n){let t=r=>{if(d.isBinaryExpression(r)&&r.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=d.SyntaxKind.LastAssignment){let i=r.left;d.isPropertyAccessExpression(i)&&d.isIdentifier(i.expression)?n(i.expression.text,i.name.text):d.isElementAccessExpression(i)&&d.isIdentifier(i.expression)&&n(i.expression.text,d.isStringLiteralLike(i.argumentExpression)?i.argumentExpression.text:null)}else if(d.isCallExpression(r)&&d.isPropertyAccessExpression(r.expression)){let i=r.expression,s=r.arguments[0];d.isIdentifier(i.expression)&&s!==void 0&&d.isIdentifier(s)&&(i.expression.text==="Object"&&(i.name.text==="assign"||i.name.text==="defineProperty"||i.name.text==="defineProperties")||i.expression.text==="Reflect"&&i.name.text==="defineProperty")&&n(s.text,null)}d.forEachChild(r,t)};t(e)}function gd(e){let n=!1,t=r=>{if(!n){if(d.isVariableDeclaration(r)||d.isParameter(r)){let i=new Set;if(On(r.name,i),i.has("require")){n=!0;return}}else if((d.isFunctionDeclaration(r)||d.isClassDeclaration(r))&&r.name!==void 0&&r.name.text==="require"){n=!0;return}d.forEachChild(r,t)}};return t(e),n}function yd(e,n,t,r=new Map,i={}){let s=i.additiveForms===!0,l=i.namelessExports===!0,a=s||l?{}:void 0,o=new Map,c=new Map;for(let p of n.imports)p.resolvedModuleId!==void 0&&c.set(`${p.moduleId}::${p.specifier}`,p.resolvedModuleId);for(let p of e.sourceFiles){let y=e.toRel(p.fileName);y!==null&&o.set(y,md(y,p,r.get(y)??[],l,a))}let u=new Map;if(s)for(let p of o.values()){let y=new Map;for(let[A,L]of p.bindings)if(L.kind==="import"&&L.form==="whole"&&me(L.specifier)!=="package-root"){let U=c.get(`${p.rel}::${L.specifier}`);U!==void 0&&y.set(A,String(U))}y.size!==0&&ns(p.sf,(A,L)=>{let U=y.get(A);if(U===void 0)return;let I=u.get(U);if(I!=="*"){if(L===null){u.set(U,"*");return}I===void 0?u.set(U,new Set([L])):I.add(L)}})}let f=new Map;for(let p of o.values())p.exportedFunctionId!==void 0&&f.set(p.rel,p.exportedFunctionId);let m=new Map;for(let p of o.values()){if(p.rel.split("/").includes("node_modules"))continue;let y=Fl(p.sf);if(y===void 0){l&&p.mintedDefault!==void 0&&m.set(p.rel,p.mintedDefault);continue}let A=p.bindings.get(y.name);A?.kind==="function"&&m.set(p.rel,{id:A.functionId,esm:y.esm})}let h=new Map;for(let p of o.values()){let y;for(let A of p.exportedNames){let L=p.bindings.get(A);L?.kind==="function"&&(y??=new Map,y.set(A,L.functionId))}y!==void 0&&h.set(p.rel,y)}let b=new Map;for(let p of o.values()){if(p.rel.split("/").includes("node_modules"))continue;let y=Yl(p.sf,p.tainted,A=>{let L=p.bindings.get(A);return L?.kind==="function"?L.functionId:void 0},l?A=>{let L=Oe(A);return d.isFunctionExpression(L)||d.isArrowFunction(L)?p.mintedByPos.get(L.getStart(p.sf,!1)):void 0}:void 0);y.size>0&&b.set(p.rel,y)}let S=[],x=[],w=[],_=[],$=[],N=[];for(let p of o.values()){S.push(...p.functions),N.push(...p.classes);for(let E of p.exportedNames){let v=p.bindings.get(E);if(v?.kind==="function"){let M=`${p.rel}#export:${E}`;_.push({id:M,moduleId:p.rel,exportedName:E,kind:"value"}),$.push({exportId:M,target:{kind:"function",functionId:v.functionId}})}}if(l){if(p.mintedDefault!==void 0){let E=`${p.rel}#export:<default>`;_.push({id:E,moduleId:p.rel,exportedName:"default",kind:"value"}),$.push({exportId:E,target:{kind:"function",functionId:p.mintedDefault.id}})}for(let[E,v]of p.mintedMembers){let M=`${p.rel}#export:<cjs>.${E}`;_.push({id:M,moduleId:p.rel,exportedName:E,kind:"value"}),$.push({exportId:M,target:{kind:"function",functionId:v}})}}let y=new Map;for(let[E,v]of p.bindings){if(v.kind==="function"){y.set(E,v);continue}if(me(v.specifier)==="package-root"){let D=He(v.specifier);typeof v.form=="object"?y.set(E,{kind:"package-export",packageName:D,exportName:v.form.named}):v.form==="require-default"?y.set(E,{kind:"package-default",packageName:D}):y.set(E,{kind:"package-surface",packageName:D})}else{let D=c.get(`${p.rel}::${v.specifier}`);if(D!==void 0&&typeof v.form=="object"){let X=h.get(String(D))?.get(v.form.named);X!==void 0&&y.set(E,{kind:"app-named-fn",functionId:X})}else if(D!==void 0&&v.form==="require-default"){let X=m.get(String(D));X!==void 0&&X.esm&&y.set(E,{kind:"app-default-fn",functionId:X.id})}else D!==void 0&&typeof v.form!="object"&&v.form!=="require-default"&&y.set(E,{kind:"module",resolvedModuleId:D})}}let A=new Map;for(let E of p.functions){if(E.enclosingClassId===void 0||E.name===void 0)continue;let v=A.get(E.enclosingClassId);v===void 0&&(v=new Map,A.set(E.enclosingClassId,v)),v.set(E.name,E.id)}for(let E of p.classes)E.name===void 0||p.tainted.has(E.name)||y.has(E.name)||y.set(E.name,{kind:"app-class",cls:{classId:E.id,className:E.name,memberIds:A.get(E.id)??new Map}});let L=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0&&d.isNewExpression(E.initializer)&&!p.tainted.has(E.name.text)&&!y.has(E.name.text)){let v=Xr(E.initializer,y,p.tainted);v!==null&&y.set(E.name.text,v)}d.forEachChild(E,L)};L(p.sf);let U=E=>{for(let v of p.fnRanges)if(E>=v.start&&E<v.end)return v.id;return p.toplevelId},I=new Map,C=new Map,K=new Map,R=(E,v,M)=>{if(M===null){E.set(v,"*");return}let D=E.get(v);D!=="*"&&(D===void 0?E.set(v,new Set([M])):D.add(M))},O=(E,v)=>{R(I,E,v);let M=y.get(E);M?.kind==="package-surface"?R(C,M.packageName,v):M?.kind==="module"&&R(K,String(M.resolvedModuleId),v)};ns(p.sf,O);let V=new Map,J=256,re=E=>{let v=V.get(E);return v===void 0&&(v=V.size>=J?new Set([E]):us(p.sf,new Set([E])),V.set(E,v)),v},Y=(E,v)=>E==="*"||E!==void 0&&E.has(v),j=(E,v)=>{let M=y.get(E);if(M?.kind==="package-surface"&&Y(C.get(M.packageName),v)||M?.kind==="module"&&Y(K.get(String(M.resolvedModuleId)),v))return!0;for(let D of re(E))if(Y(I.get(D),v))return!0;return!1},H=E=>{if(d.isIdentifier(E)){let v=p.tainted.has(E.text)?void 0:y.get(E.text);return v?.kind==="function"?v.functionId:v?.kind==="module"?f.get(String(v.resolvedModuleId))??null:v?.kind==="package-export"?t.exportFor(v.packageName,v.exportName):null}if(d.isPropertyAccessExpression(E)&&d.isIdentifier(E.expression)){let v=E.expression.text;if(j(v,E.name.text))return null;let M=p.tainted.has(v)?void 0:y.get(v);return M?.kind==="package-surface"?t.exportFor(M.packageName,E.name.text):M?.kind==="package-export"?t.methodFor(M.packageName,M.exportName,E.name.text,"method"):M?.kind==="package-instance"?t.methodFor(M.packageName,M.className,E.name.text,"method"):null}return null},ue=E=>{for(let v=E.parent;v!==void 0;v=v.parent)if(!d.isArrowFunction(v)){if(d.isFunctionExpression(v)||d.isFunctionDeclaration(v))return null;if(d.isMethodDeclaration(v)||d.isConstructorDeclaration(v)||d.isGetAccessorDeclaration(v)||d.isSetAccessorDeclaration(v)){let M=v.parent;if(!d.isClassLike(M)||M.name===void 0)return null;let D=p.tainted.has(M.name.text)?void 0:y.get(M.name.text);return D?.kind==="app-class"?D.cls:null}}return null},Me=s&&!p.tainted.has("require")&&!gd(p.sf),ye=E=>{if(d.isIdentifier(E)){let D=p.tainted.has(E.text)?void 0:y.get(E.text);return D?.kind==="package-surface"||D?.kind==="package-default"?t.exportFor(D.packageName,"default"):D?.kind==="app-named-fn"||D?.kind==="app-default-fn"?D.functionId:D?.kind==="module"?m.get(String(D.resolvedModuleId))?.id??null:D?.kind==="member-value"?D.functionId:null}if(!d.isPropertyAccessExpression(E))return null;let v=E.expression;if(s&&d.isCallExpression(Oe(v))){let D=Ye(Oe(v));if(D!==void 0)if(!Me)ne(a,"2b","require-shadow");else if(me(D)==="package-root")ne(a,"2b","package-root");else{let X=c.get(`${p.rel}::${D}`);if(X===void 0)ne(a,"2b","unresolved-module");else{let te=E.name.text,ie=u.get(String(X));if(ie==="*"||ie!==void 0&&ie.has(te))ne(a,"2b","module-mutation-gate");else{let fe=b.get(String(X))?.get(te);if(fe!==void 0)return ne(a,"2b",null),fe;if(te==="default"){let le=m.get(String(X));if(le!==void 0&&le.esm)return ne(a,"2b",null),le.id;ne(a,"2b","non-esm-default")}else ne(a,"2b","unknown-member")}}}return null}let M;if(d.isIdentifier(v)){let D=p.tainted.has(v.text)?void 0:y.get(v.text);if(D?.kind==="app-class"||D?.kind==="app-instance")M=D.cls.memberIds;else if(D?.kind==="object-literal")M=D.obj.members;else if(D?.kind==="module"){let X=b.get(String(D.resolvedModuleId));X?.has(E.name.text)===!0&&!j(v.text,E.name.text)&&(M=X)}}else if(d.isNewExpression(v)){let D=Xr(v,y,p.tainted);D?.kind==="app-instance"&&(M=D.cls.memberIds)}else v.kind===d.SyntaxKind.ThisKeyword&&(M=ue(E)?.memberIds);return M?.get(E.name.text)??null},be=new Map,In=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0&&d.isObjectLiteralExpression(E.initializer)&&!p.tainted.has(E.name.text)&&!y.has(E.name.text)&&!be.has(E.name.text)){let v=new Map;for(let M of E.initializer.properties)if(d.isPropertyAssignment(M)&&d.isIdentifier(M.name)){let D=H(M.initializer);D!==null&&v.set(M.name.text,D)}be.set(E.name.text,v)}d.forEachChild(E,In)};In(p.sf);let F=E=>{if(d.isBinaryExpression(E)&&E.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(E.left)&&d.isIdentifier(E.left.expression)&&!p.tainted.has(E.left.expression.text)){let v=be.get(E.left.expression.text);if(v!==void 0){let M=H(E.right);M!==null&&v.set(E.left.name.text,M)}}d.forEachChild(E,F)};F(p.sf);for(let[E,v]of be)y.set(E,{kind:"object-literal",obj:{members:v}});let Ee=(E,v=0)=>{if(v>Wr)return null;let M=Oe(E);if(d.isCallExpression(M)&&d.isPropertyAccessExpression(M.expression)&&M.expression.name.text==="bind")return Ee(M.expression.expression,v+1);if(d.isIdentifier(M)){let D=H(M);if(D!==null)return D;let X=p.tainted.has(M.text)?void 0:y.get(M.text);return X?.kind==="member-value"?X.functionId:null}return d.isPropertyAccessExpression(M)?H(M)??ye(M):null},xe=(E,v=0)=>{if(v>Wr)return"depth-cap";let M=Oe(E);if(d.isCallExpression(M)&&d.isPropertyAccessExpression(M.expression)&&M.expression.name.text==="bind")return xe(M.expression.expression,v+1);if(d.isIdentifier(M))return p.tainted.has(M.text)?"tainted-receiver":"unresolved-receiver";if(d.isPropertyAccessExpression(M)&&d.isIdentifier(M.expression)){if(p.tainted.has(M.expression.text))return"tainted-receiver";if(j(M.expression.text,M.name.text))return"mutated-member"}return"unresolved-receiver"},Se=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0){let v=Oe(E.initializer),M=d.isPropertyAccessExpression(v),D=d.isCallExpression(v)&&d.isPropertyAccessExpression(v.expression)&&v.expression.name.text==="bind";if(M||D){let X=M?"D1":"A2";if(p.tainted.has(E.name.text))ne(a,X,"tainted-alias");else if(y.has(E.name.text))ne(a,X,"already-bound");else{let te=Ee(v);te!==null?(y.set(E.name.text,{kind:"member-value",functionId:te}),ne(a,X,null)):ne(a,X,xe(v))}}}d.forEachChild(E,Se)};s&&Se(p.sf);let $e=0,W=E=>{let v,M;if(d.isCallExpression(E)){let D=E.expression,X=d.isIdentifier(D)&&D.text==="require",te=D.kind===d.SyntaxKind.ImportKeyword;!X&&!te&&(v=D,M=E.arguments)}else d.isTaggedTemplateExpression(E)&&(v=E.tag);if(v!==void 0){let D=hd(v),X=E.getStart(p.sf,!1),te=`${p.rel}#call${String($e)}`;$e+=1;let ie="unresolved",fe=[],le=H(v);le!==null&&(ie="resolved",fe.push(le)),x.push({id:te,enclosingFunctionId:U(X),calleeExprShape:D,resolvedTargetIds:fe,resolution:ie,range:sn(p.rel,E,p.sf)});for(let se of fe)w.push({callSiteId:te,calleeFunctionId:se,resolution:ie});if(le===null){let se=ye(v);if(se!==null)w.push({callSiteId:te,calleeFunctionId:se,resolution:"field-based"});else if(s&&d.isPropertyAccessExpression(v)&&(v.name.text==="call"||v.name.text==="apply")){let _e=Ee(v.expression);_e!==null?(w.push({callSiteId:te,calleeFunctionId:_e,resolution:"field-based"}),ne(a,"A3",null)):ne(a,"A3",xe(v.expression))}}for(let se of M??[]){let _e=H(se);if(_e!==null)w.push({callSiteId:te,calleeFunctionId:_e,resolution:"field-based"});else{let Fe=ye(se);if(Fe!==null)w.push({callSiteId:te,calleeFunctionId:Fe,resolution:"field-based"});else if(s){let B=Ee(se),P=Oe(se),q=P!==se||d.isCallExpression(P)&&d.isPropertyAccessExpression(P.expression)&&P.expression.name.text==="bind";B!==null?(w.push({callSiteId:te,calleeFunctionId:B,resolution:"field-based"}),q&&ne(a,"A2p",null)):q&&ne(a,"A2p",xe(se))}}}}d.forEachChild(E,W)};W(p.sf);for(let E of n.computedLoads.get(p.rel)??[]){let v=E.candidateRels.filter(D=>o.has(D)).map(D=>`${D}#<toplevel>`);if(v.length===0)continue;let M=`${p.rel}#dirload${String($e)}`;$e+=1,x.push({id:M,enclosingFunctionId:U(E.pos),calleeExprShape:"require",resolvedTargetIds:v,resolution:"field-based",range:{path:p.rel,start:E.pos,end:E.pos}});for(let D of v)w.push({callSiteId:M,calleeFunctionId:D,resolution:"field-based"})}let Ae=0;for(let E of r.get(p.rel)??[]){let v=`${p.rel}#handlerseed${String(Ae)}`;Ae+=1;let M=E.node.getStart(p.sf,!1);x.push({id:v,enclosingFunctionId:p.toplevelId,calleeExprShape:"member",resolvedTargetIds:[E.id],resolution:"field-based",range:{path:p.rel,start:M,end:M}}),w.push({callSiteId:v,calleeFunctionId:E.id,resolution:"field-based"})}}let k=new Map;if(l)for(let p of o.values())for(let[y,A]of p.mintSeedAliases)k.set(`${p.rel}::${String(y)}`,A);return{functions:S,callSites:x,callEdges:w,exports:_,exportBindings:$,classes:N,mintSeedAliases:k,bindingApplicability:a}}function xd(e,n,t){let r=o=>o.length===0||Re.isAbsolute(o)||o.includes("\\")||/^[a-zA-Z]:/u.test(o)||o.split("/").some(c=>c===".."||c==="");if(r(n)||r(t))return null;let i=e.endsWith(Re.sep)?e:e+Re.sep,s;try{s=Hr(Re.resolve(e,n))}catch{return null}if(!s.startsWith(i))return null;let l=s.endsWith(Re.sep)?s:s+Re.sep,a;try{a=Hr(Re.resolve(s,t))}catch{return null}return a.startsWith(l)?a:null}function hs(e,n,t){let r=`${e}#class:${t}`,i=[],s=[],l=[],a=new Set;return{pushMember(o,c,u,f){if(o==="__proto__"||a.has(o))return;a.add(o);let m=`${e}#${t}.${o}`;i.push({id:m,moduleId:e,name:o,kind:u,enclosingClassId:r,declRange:sn(e,c,n),isExported:!1,publicSurfaceReachable:!1}),l.push(m),s.push({name:o,id:m,kind:u,body:f})},finish(){return s.length===0?null:{functions:i,classNode:{id:r,moduleId:e,name:t,implementsRefs:[],members:l},members:s}}}}function Sd(e,n,t,r){if(ms(r)||r.members.length>ti)return null;let i=hs(e,n,t);for(let s of r.members){let l,a,o;if(d.isConstructorDeclaration(s))l="constructor",a="ctor",o=void 0;else if(d.isMethodDeclaration(s))l=ft(s.name),a="method",o=l!==void 0&&!bn.has(l)?s.body??void 0:void 0;else continue;l!==void 0&&i.pushMember(l,s,a,o)}return i.finish()}function bd(e,n,t){let r;for(let l of n.statements)if(d.isFunctionDeclaration(l)&&l.name?.text===t){r=l;break}if(r===void 0)return null;let i=[];for(let l of n.statements){if(!d.isExpressionStatement(l))continue;let a=l.expression;if(!d.isBinaryExpression(a)||a.operatorToken.kind!==d.SyntaxKind.EqualsToken)continue;let o=a.left;if(d.isPropertyAccessExpression(o)&&d.isPropertyAccessExpression(o.expression)&&d.isIdentifier(o.expression.expression)&&o.expression.expression.text===t&&o.expression.name.text==="prototype"){let c=o.name.text;d.isFunctionExpression(a.right)?i.push({name:c,fn:a.right,walk:!0}):d.isArrowFunction(a.right)&&i.push({name:c,fn:a.right,walk:!1})}}if(i.length===0||i.length+1>ti)return null;let s=hs(e,n,t);s.pushMember("constructor",r,"ctor",void 0);for(let l of i){let a=l.walk&&!bn.has(l.name)&&d.isFunctionExpression(l.fn)?l.fn.body:void 0;s.pushMember(l.name,l.fn,"method",a)}return s.finish()}function kd(e,n,t){for(let r of n.statements)if(d.isClassDeclaration(r)&&r.name?.text===t)return Sd(e,n,t,r);return bd(e,n,t)}function Ed(e,n,t,r,i){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let l=new Set(t.map(f=>f.packageName)),a=new Set(t.map(f=>f.path)),o=new Set,c=new Set,u=0;for(let f of n){if(!l.has(f.packageName))continue;let m=xd(e.appRoot,f.packageRootRel,f.sourcePath);if(m===null)continue;let h=e.toRel(m);if(h===null)continue;let b=`${h}#${f.container}`;if(c.has(b)||!o.has(h)&&o.size>=ct)continue;let S=Ce(m);if(S===null)continue;let x;try{x=d.createSourceFile(h,S,d.ScriptTarget.Latest,!0,d.ScriptKind.JS)}catch{continue}let w=kd(h,x,f.container);if(w===null)continue;o.add(h),c.add(b);let _=new Map,$=new Map;for(let k of w.members){let p=i.methodFor(f.packageName,f.container,k.name,k.kind);_.set(k.name,p),$.set(p,k.id)}let N=0;for(let k of w.members){if(k.body===void 0)continue;let p=(y,A)=>{if(A&&d.isCallExpression(y)&&d.isPropertyAccessExpression(y.expression)&&y.expression.expression.kind===d.SyntaxKind.ThisKeyword){let I=_.get(y.expression.name.text);if(I!==void 0){let C=`${h}#depclass:${f.container}.${k.name}#c${String(N)}`;N+=1,s.callSites.push({id:C,enclosingFunctionId:k.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:sn(h,y,x)}),s.callEdges.push({callSiteId:C,calleeFunctionId:I,resolution:"field-based"})}}let L=d.isFunctionExpression(y)||d.isFunctionDeclaration(y)||d.isMethodDeclaration(y)||d.isConstructorDeclaration(y)||d.isGetAccessorDeclaration(y)||d.isSetAccessorDeclaration(y)||d.isClassLike(y),U=d.isArrowFunction(y)?A:L?!1:A;d.forEachChild(y,I=>{p(I,U)})};p(k.body,!0)}for(let k of r){let p=$.get(k.calleeFunctionId);p!==void 0&&s.callEdges.push({callSiteId:k.callSiteId,calleeFunctionId:p,resolution:"field-based"})}if(s.functions.push(...w.functions),s.classes.push(w.classNode),!a.has(h)){a.add(h),s.modules.push({id:h,packageName:f.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let k=i.moduleFor(f.packageName),p=`${String(k)}#depclass${String(u)}`;u+=1,s.imports.push({id:p,moduleId:k,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),s.importEdges.push({importId:p,resolvedModuleId:h})}s.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(w.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return s}function wd(e,n,t,r){let i=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.packageName)),s=new Map(e.functions.map(o=>[o.id,o.moduleId])),l=new Map;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let c=s.get(o.enclosingFunctionId);c!==void 0&&l.set(c,(l.get(c)??0)+1)}let a=[];for(let o of e.modules){if(o.externalSurface===!0)continue;let c=n.get(o.path);if(c===void 0||t.has(o.path)||i.has(o.packageName)&&r.has(o.path)&&!o.path.split("/").includes("node_modules"))continue;let u=l.get(o.id)??0;if(u===0&&rd(c))continue;let f=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";a.push({code:"dependency-body",path:o.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:o.id})}return a}function gs(e,n,t=[],r={},i=!1){let s=new ei,l=$l(e,n,s),a=new Set;for(let N of l.computedLoads.values())for(let k of N)if(k.seedable)for(let p of k.candidateRels)a.add(p);let o=new Map;for(let N of e.sourceFiles){let k=e.toRel(N.fileName);if(k===null||!a.has(k)||k.split("/").includes("node_modules"))continue;let p=fd(k,N);p.length>0&&o.set(k,p)}let c=o.size===0?l.modules:l.modules.map(N=>o.has(N.path)&&!N.isEntrypoint?{...N,isEntrypoint:!0}:N),u={...l,modules:c},f=yd(e,u,s,o,r),m=td(e,l,f.functions,f.mintSeedAliases),h=new Set(l.modules.map(N=>N.path)),b=Tl(e.depReach,s,h),S=[...u.modules,...b.modules,...s.modules()],x=Ed(e,t,S,f.callEdges,s),w=[];if(i){let N="#default",k=new Set;for(let y of f.callEdges){let A=String(y.calleeFunctionId);!A.startsWith("pkg:")||!A.endsWith(N)||k.add(A.slice(4,A.length-N.length))}let p=new Map;for(let y of e.depReach.edges){if(!("surface"in y.from)||"surface"in y.to)continue;let A=y.from.surface;p.set(A,p.has(A)?null:y.to.module)}for(let y of k){let A=p.get(y);if(A==null)continue;let L=Pl(Re.join(e.appRoot,A));if(L===null||L==="default")continue;let U=s.exportFor(y,L),I=`pkg:${y}${N}`;for(let C of f.callEdges)String(C.calleeFunctionId)===I&&w.push({callSiteId:C.callSiteId,calleeFunctionId:U,resolution:"field-based"})}}let _={modules:[...u.modules,...b.modules,...x.modules,...s.modules()],exports:[...f.exports,...m.exports],imports:[...l.imports,...b.imports,...x.imports],functions:[...f.functions,...s.functions(),...x.functions],callSites:[...f.callSites,...x.callSites],classes:[...f.classes,...s.classes(),...x.classes],callEdges:[...f.callEdges,...x.callEdges,...w],importEdges:[...l.importEdges,...b.importEdges,...x.importEdges],exportBindings:[...f.exportBindings,...m.exportBindings],inheritEdges:[]},$=new Map;for(let N of e.sourceFiles){let k=e.toRel(N.fileName);k!==null&&$.set(k,N)}return{graph:_,diagnostics:[...m.diagnostics,...x.diagnostics,...wd(_,$,new Set(e.diagnostics.filter(N=>N.code==="dependency-body").map(N=>N.path)),l.appOwnedPaths)],...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var vd=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,pt=/^[A-Za-z0-9_$.-]{1,128}$/u;function Id(e){return vd.test(e.calleePackage)?pt.test(e.anchorExport)?pt.test(e.calleeExport)?e.anchorContainer!==null&&!pt.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!pt.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Ln(e,n){let t=[],r=[],i=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.classes.map(c=>[c.id,c.name])),l=(c,u,f)=>e.functions.some(m=>{if(m.name!==u)return!1;let h=i.get(m.moduleId);return h===void 0||h.packageName!==c?!1:(m.enclosingClassId!==void 0?s.get(m.enclosingClassId)??null:null)===f}),a=(c,u,f)=>{for(let m of e.functions){if(m.name!==u)continue;let h=i.get(m.moduleId);if(!(h===void 0||h.packageName!==c||(m.enclosingClassId!==void 0?s.get(m.enclosingClassId)??null:null)!==f))return m.id}return null},o=[...n].sort((c,u)=>c.modelId<u.modelId?-1:c.modelId>u.modelId?1:0);for(let c of o){if(c.edges.length>64){t.push(`model ${c.modelId}: ${String(c.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=c.edges.map(Id).find(h=>h!==null);if(u!==void 0){t.push(`model ${c.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let f=0,m=0;for(let h of c.edges){if(!l(c.packageName,h.anchorExport,h.anchorContainer)){m+=1;continue}r.push({modelId:c.modelId,kind:h.kind,anchor:{packageName:c.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:a(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${c.modelId}: ${String(f)} edge(s) lowered, ${String(m)} reference-gated`):t.push(`model ${c.modelId}: refused \u2014 no anchor surface in the graph (${String(m)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:r,notes:t}}}var Ad={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function di(e){try{let n=Ur(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(l=>l.split(nn.sep).join("/"))),{graph:r,diagnostics:i,bindingApplicability:s}=gs(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:r,diagnostics:[...n.diagnostics,...i],...s!==void 0?{bindingApplicability:s}:{}}}catch(n){return{graph:Ad,diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function ys(e,n){let t=512,r=(i,s)=>{if(!(t<=0||s>12)){if(t-=1,typeof i=="string"){n(i);return}if(Array.isArray(i)){for(let l of i)r(l,s+1);return}if(i!==null&&typeof i=="object")for(let[l,a]of Object.entries(i))l==="types"||l==="typings"||r(a,s+1)}};r(e,0)}function ks(e,n,t,r=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let i;try{i=Tn(nn.resolve(e,t))}catch{return null}return i!==e&&!i.startsWith(n)||r&&!We(i)?null:i===e?"":i.slice(n.length).split(nn.sep).join("/")}function Es(e){let n=Tn(e),t=n.endsWith(nn.sep)?n:n+nn.sep,r=new Set,i=[],s=[],l=[],a=(p,y,A=!1)=>{let L=ks(n,t,p);return L===null||L.length===0?"unresolved":r.has(L)?"duplicate":(r.add(L),i.push(L),s.push({source:y,specifier:Je(typeof p=="string"?p:""),entrypoint:L,launch:A}),"added")},o=[],c=(p,y)=>{l.push({source:p,file:p,detail:y.detail}),o.push({code:y.code,path:p,detail:`${p} ${y.detail}`})},u,f,m,h=null,b=xs(n,t,"package.json",tn);b.kind==="refused"&&c("package.json",b);try{let p=b.kind==="ok"?JSON.parse(b.text):{};if(h=b.kind==="ok"?p:null,a(p.main,"main"),typeof p.bin=="string")a(p.bin,"bin");else if(p.bin!==null&&typeof p.bin=="object")for(let A of Object.values(p.bin))a(A,"bin");ys(p.exports,A=>{a(A,"exports")}),ys(p.browser,A=>{a(A,"browser")});let y=p.scripts;if(y!==null&&typeof y=="object"){let A=y;u=A.start,f=A.prestart,m=A.poststart}}catch{}if(i.length===0)try{Tn(nn.join(n,"index.js")),a("index.js","index.js fallback")}catch{}let S=(p,y)=>typeof p=="string"&&p.trim().length>0?Ss(p,y,"package.json",a,l,!1)==="used"?"resolved":"gapped":p===void 0||typeof p=="string"?"absent":(l.push({source:y,file:"package.json",detail:`${y} is not a string; no entry file could be read from it`}),"gapped"),x=S(u,"scripts.start"),w=S(f,"scripts.prestart"),_=S(m,"scripts.poststart"),$=x==="resolved"&&w!=="gapped"&&_!=="gapped",N=xs(n,t,"Procfile",65536);if(N.kind==="refused")c("Procfile",N);else if(N.kind==="ok"){let{entries:p,truncated:y,unnamedLines:A}=Zt(N.text);y&&l.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),A>0&&l.push({source:"Procfile",file:"Procfile",detail:`${String(A)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let L of p)Ss(L.command,`Procfile:${L.name}`,"Procfile",a,l,$)}let k=i.length===0?Jt(n,h):null;return{entrypoints:i,sources:s,gaps:l,diagnostics:o,framework:k}}function xs(e,n,t,r){let i;try{i=Tn(nn.join(e,t))}catch{return{kind:"absent"}}if(!i.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=xn(i,r);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(r)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Ss(e,n,t,r,i,s){let l=Qt(e);return l.kind==="delegates"?s?"used":(i.push({source:n,file:t,detail:`\`${Je(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped"):l.kind==="unparsed"?(i.push({source:n,file:t,detail:`\`${Je(e)}\`: ${l.reason}`}),"gapped"):r(l.specifier,n,!0)==="unresolved"?(i.push({source:n,file:t,detail:`\`${Je(l.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function ci(e,n){if(n.length===0||!e.some(r=>r.launch))return[];let t=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${t}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function ws(e,n){let t=Tn(e),r=t.endsWith(nn.sep)?t:t+nn.sep,i=new Set,s=[],l=[];for(let a of n){let o=ks(t,r,a,!0);if(o===null||o.length===0){l.push(a);continue}i.has(o)||(i.add(o),s.push(o))}return{entrypoints:s,rejected:l}}import{readdirSync as $s,readFileSync as hi,realpathSync as gi,statSync as jn}from"node:fs";import Ue from"node:path";function _d(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let r=t+2;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;let i=e.charCodeAt(r);return i===38||i===42}function Dn(e,n,t){let r=n.maxLines??2e6,i=n.maxLineBytes??16384,s=!1,l=!1,a=0,o=0,c=e.charCodeAt(0)===65279?1:0;for(;c<=e.length;){let u=e.indexOf(`
+`,c),f=u===-1;f&&(u=e.length);let m=u>c&&e.charCodeAt(u-1)===13?u-1:u;if(o+=1,o>r){s=!0;break}if(m-c>i)a+=1;else{let h=c;for(;h<m&&e.charCodeAt(h)===32;)h+=1;let b=h-c,S=m;for(;S>h&&(e.charCodeAt(S-1)===32||e.charCodeAt(S-1)===9);)S-=1;if(h<S&&e.charCodeAt(h)!==35){let x=e.slice(h,S);if(_d(x)){l=!0;break}t(b,x)}}if(f)break;c=u+1}return{truncated:s||a>0,refusedAnchors:l,oversizeLines:a}}function mt(e){let n=e.charCodeAt(0);if(n===34||n===39){let r=e.indexOf(String.fromCharCode(n),1);if(r===-1)return null;let i=r+1;for(;i<e.length&&e.charCodeAt(i)===32;)i+=1;return e.charCodeAt(i)===58?e.slice(0,r+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function En(e){return e.endsWith(":")}function ze(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function ht(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,r=t.indexOf("/");if(n){if(r<=0||t.indexOf("/",r+1)!==-1)return!1}else if(r!==-1)return!1;let i=n?[t.slice(0,r),t.slice(r+1)]:[t];for(let s of i){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let l=0;l<s.length;l+=1){let a=s.charCodeAt(l);if(!(a>=97&&a<=122||a>=65&&a<=90||a>=48&&a<=57||a===45||a===46||a===95||a===126))return!1}}return!0}function Fn(e){return ht(e)?`node_modules/${e}`:""}function Kn(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var vs=2e5,Is=64,Nd=1024,Cd=5,Od=[1,2,3];function Rd(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let r=e.slice(t+n.length);if(r==="")return null;let i=r.split("/");return i[0]?.startsWith("@")?i.length>=2?`${i[0]}/${i[1]}`:null:i[0]??null}function As(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let r=t.indexOf("@",1);if(r>0){let i=t.slice(0,r),s=t.slice(r+1);if(i.length>0&&s.length>0)return[{name:i,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function wn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function _s(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Ns(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Cs(e,n,t,r,i=!1){let s=JSON.stringify([n,t,r]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:r,dev:i})}}function Md(e,n){for(let[t,r]of Object.entries(e)){if(t==="")continue;if(!Ns(n))return;let i=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=wn(r);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let l=s.name,a=typeof l=="string"&&l!==""?l:Rd(t),o=s.version;if(a===null||typeof o!="string"){i&&(n.unread+=1);continue}let c=s.dev===!0||s.devOptional===!0;for(let u of As(a,o))Cs(n,u.name,u.version,t,c)}}function Os(e,n,t){let r=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],i=!1;for(let s=0;s<r.length;s+=1){let l=r[s];if(l===void 0)break;for(let[a,o]of Object.entries(l.deps)){if(!Ns(n))return{depthCapped:i};if(a===""){n.unread+=1;continue}let c=wn(o);if(c===null){n.unread+=1;continue}let u=l.pathSafe&&ht(a),f=u?`${l.prefix}node_modules/${a}`:"",m=u&&f.length<=Nd,h=m?f:"",b=c.version,S=c.dev===!0||l.dev;if(c.link!==!0&&typeof b=="string"&&b!=="")for(let w of As(a,b))Cs(n,w.name,w.version,h,S);else n.unread+=1;let x=wn(c.dependencies);if(x!==null){if(l.depth+1>t){i=!0;continue}r.push({deps:x,prefix:m?`${h}/`:l.prefix,depth:l.depth+1,pathSafe:m,dev:S})}}}return{depthCapped:i}}function $d(e,n,t){let r=_s(n.maxEntries),{depthCapped:i}=Os(e,r,t),s=[],l=new Set(n.deps.map(c=>JSON.stringify([c.name,c.version]))),a=new Set,o=[];for(let c of r.deps){if(c.version.includes(":"))continue;let u=JSON.stringify([c.name,c.version]);l.has(u)||a.has(u)||(a.add(u),o.length<Cd&&o.push(Kn(c.name,c.version)))}if(a.size>0){let c=a.size-o.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(a.size)} install(s) the tree describes are absent from the map (${o.join(", ")}${c>0?`, and ${String(c)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(r.capped||i)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function gt(e,n={}){let t=[],r;try{r=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let i=wn(r);if(i===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=i.lockfileVersion,l=typeof s=="number"&&Number.isInteger(s)?s:null,a=typeof s=="number"?String(s):"?",o=wn(i.packages),c=wn(i.dependencies);if(o===null&&c===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${a}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(l===null||!Od.includes(l))&&t.push(`package-lock.json declares unsupported lockfileVersion ${a} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??Is,f=_s(n.maxEntries??vs),m=!1;return o!==null?(Md(o,f),c!==null&&t.push(...$d(c,f,u))):c!==null&&(m=Os(c,f,u).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),m&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||m}}var Pd=["workspace:","link:","portal:","file:","exec:"];function Ld(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Td(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let r=n.slice(0,t),i=n.slice(t+1);if(r.length===0)return[];for(let a of Pd)if(i.startsWith(a))return[];if(!i.startsWith("npm:"))return[r];let s=i.slice(4),l=s.indexOf("@",1);if(l>0){let a=s.slice(0,l);return a.length>0?[a]:[r]}return s.length===0||Ld(s)?[r]:[r,s]}function Dd(e){if(En(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let r=e.charCodeAt(t);if(r===34||r===39){n===0?n=r:n===r&&(n=0);continue}if(n===0&&r===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Fd(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let r of n.split(",")){let i=r.trim();i.length>0&&t.push(i)}return t}function Kd(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let r=t.length;for(;r<n.length&&r<t.length+3;){let s=n.charCodeAt(r);if(s<48||s>57)break;r+=1}let i=n.slice(t.length,r);return i.length>0?i:null}function Rs(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=ze(e.slice(8).trim());return t.length>0?t:null}function ui(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,l=!1,a=null,o=!1,c=[],u=!1,f=-1,m=!1,h=0,b=()=>{c.length>0&&!u&&(h+=1)},S=Dn(e,n,($,N)=>{if($===0){b(),c=[],u=!1,f=-1,o=!1;let p=Dd(N);if(p===null)return;let y=ze(p.trim());if(y==="__metadata"){l=!0,o=En(N);return}for(let A of Fd(y))c.push(...Td(A));return}if(o){if($===2&&a===null){let p=Rs(N);p!==null&&(a=p)}return}if(c.length===0||(f===-1&&(f=$),$!==f||u))return;let k=Rs(N);if(k!==null){u=!0;for(let p of c){let y=JSON.stringify([p,k]);if(!i.has(y)){if(r.length>=s){m=!0;return}i.add(y),r.push({name:p,version:k,lockKey:Fn(p),dev:!1})}}}});b();let x=l?"yarn.lock (Berry)":"yarn.lock (v1)";if(S.refusedAnchors)return{deps:[],diagnostics:[`${x} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};S.oversizeLines>0&&t.push(`${x} has ${String(S.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),m&&t.push(`${x} exceeds ${String(s)} entries; truncated`);let w=a??Kd(e),_=w===null?null:Number(w.split(".")[0]);return w!==null&&(_===null||!Number.isInteger(_)||_<1||_>8)&&t.push(`${x} declares unsupported lockfileVersion ${w} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${x} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:r,diagnostics:t,truncated:S.truncated||m}}function fi(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.indexOf("_");return r!==-1&&(n=n.slice(0,r)),n.trim()}function pi(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Ms(e){let n=ze(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.charCodeAt(0)===47;if(r&&(n=n.slice(1)),n.length===0)return null;if(!r&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),f=n.indexOf("@",1);u>0&&(f===-1||u<f)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let i=n.charCodeAt(0)===64,s=i?n.indexOf("/"):-1;if(i&&s<=0)return null;let l=i?s+1:0,a=-1;for(let u=l;u<n.length;u+=1){let f=n.charCodeAt(u);if(f===47||f===64){a=u;break}}if(a<=l)return null;let o=n.slice(0,a),c=fi(n.slice(a+1));return pi(c)?{name:o,version:c}:null}var jd=new Set(["packages","snapshots","importers"]),Bd=new Set([5,6,7,8,9]);function zd(e){let n=ze(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function xt(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:ze(e.slice(0,n).trim()),value:ze(t)}}function mi(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,l="",a=null,o=!1,c=0,u=[],f=(h,b)=>{let S=JSON.stringify([h,b]);if(!i.has(S)){if(r.length>=s){o=!0;return}i.add(S),r.push({name:h,version:b,lockKey:Fn(h),dev:!1})}},m=Dn(e,n,(h,b)=>{if(h===0){let S=mt(b);if(l=S===null?"":ze(S.trim()),a=null,l==="lockfileVersion"){let x=xt(b),w=x===null?null:zd(x.value);x!==null&&(w===null||!Bd.has(w))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${x.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),l="";return}if(jd.has(l)&&!En(b)){let x=xt(b)?.value.trim()??"";x!=="{}"&&x!=="[]"&&(c+=1),l=""}return}if(l==="packages"||l==="snapshots"){if(h!==2)return;let S=mt(b),x=S===null?null:Ms(S);if(x===null){c+=1;return}f(x.name,x.version);return}if(l==="importers"){if(h===6){let S=xt(b);if(S===null){a=b.endsWith(":")?ze(b.slice(0,-1).trim()):null;return}a=null;let x=fi(S.value);pi(x)&&f(S.key,x);return}if(h===8&&a!==null){let S=xt(b);if(S===null||S.key!=="version")return;let x=fi(S.value);pi(x)&&f(a,x)}}});return m.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),m.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(m.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),o&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),c>0&&t.push(`pnpm-lock.yaml has ${String(c)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:r,diagnostics:t,truncated:m.truncated||o})}var Ud=128*1024*1024,Vd=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>gt(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>gt(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>ui(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>mi(e,n===void 0?{}:{maxEntries:n})}],qd=[".pnp.cjs",".pnp.data.json",".pnp.js"];function yi(e,n){let t;try{t=gi(Ue.join(e,n))}catch{return null}let r=e.endsWith(Ue.sep)?e:e+Ue.sep;return t.startsWith(r)?t:null}function Ps(e,n){let t=Ue.join(e,"package.json"),r;try{r=gi(t)}catch{return null}if(!r.startsWith(n+Ue.sep))return null;try{if(!jn(r).isFile())return null;let i=JSON.parse(hi(r,"utf8"));return typeof i.name!="string"||typeof i.version!="string"?null:{name:i.name,version:i.version}}catch{return null}}function Ls(e,n){try{return jn(Ue.join(e,n)),!0}catch{return!1}}function Hd(e,n){if(Ls(e,"pnpm-workspace.yaml"))return!0;let t=yi(e,"package.json");if(t===null)return Ls(e,"package.json");let r;try{let l=jn(t);if(!l.isFile()||l.size>n)return!0;r=hi(t,"utf8")}catch{return!0}let i;try{i=JSON.parse(r)}catch{return!0}for(let l of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let a=i[l];if(typeof a=="object"&&a!==null&&Object.keys(a).length>0)return!0}let s=i.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function Ts(e,n){let t=Ue.join(e,"node_modules"),r=[],i;try{i=$s(t,{withFileTypes:!0})}catch{return r}for(let s of i){let l=s.name;if(l.startsWith("."))continue;if(l.startsWith("@")){let o;try{o=$s(Ue.join(t,l),{withFileTypes:!0})}catch{continue}for(let c of o){let u=Ps(Ue.join(t,l,c.name),n);u!==null&&r.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${l}/${c.name}`,linked:c.isSymbolicLink()||s.isSymbolicLink()})}continue}let a=Ps(Ue.join(t,l),n);a!==null&&r.push({dev:!1,name:a.name,version:a.version,lockKey:`node_modules/${l}`,linked:s.isSymbolicLink()})}return r}var Wd=5;function Gd(e,n,t){let r=yi(e,n);if(r===null){try{jn(Ue.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let i;try{i=jn(r)}catch{return null}if(!i.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(i.size>t)return{gap:`${n} is ${String(i.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:hi(r,"utf8")}}catch{return{gap:`${n} could not be read`}}}function Ds(e,n){let t=gi(e),r=[],i=[],s=n?.maxLockfileBytes??Ud,l=[],a=new Set,o=[],c=Hd(t,s),u=null,f=!1,m=(b,S,x)=>{i.push({kind:b,detail:S,blindsAnalysis:x}),r.push(S)};for(let b of Vd){let S=Gd(t,b.file,s);if(S===null)continue;if("gap"in S){m("lockfile-unreadable",S.gap,!1);continue}let x=b.parse(S.text,n?.maxLockfileEntries);if(x.truncated&&(f=!0),x.deps.length===0){if(x.diagnostics.length>0||c){let w=x.diagnostics.length>0?x.diagnostics.join("; "):"no entries found";m("lockfile-unparsed",`${b.file} yielded NO dependencies (${w}); its transitive dependency set was not enumerated`,!1)}continue}x.diagnostics.length>0&&m("lockfile-partial",`${b.file} was only partly enumerated (${x.diagnostics.join("; ")})`,!1),u===null&&(u=b.file),o.includes(b.source)||o.push(b.source);for(let w of x.deps){let _=JSON.stringify([w.name,w.version,w.lockKey]);a.has(_)||(a.add(_),l.push(w))}}for(let b of qd)if(yi(t,b)!==null){m("yarn-pnp",`${b} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(l.length>0){let b=o.length===1?o[0]??"none":"multi-lockfile";o.length>1&&r.push(`multiple lockfiles present (${o.join(", ")}); enumerated the UNION of all of them`);let S=new Set(l.map(_=>JSON.stringify([_.name,_.version]))),x=new Set,w=[];for(let _ of Ts(t,t)){let $=JSON.stringify([_.name,_.version,_.lockKey]);a.has($)||(a.add($),l.push({name:_.name,version:_.version,lockKey:_.lockKey,dev:_.dev}));let N=JSON.stringify([_.name,_.version]);_.linked||S.has(N)||x.has(N)||(x.add(N),w.length<Wd&&w.push(Kn(_.name,_.version)))}if(x.size>0){let _=x.size-w.length;m("lockfile-skew",`node_modules holds ${String(x.size)} package(s) at a (name, version) no lockfile lists (${w.join(", ")}${_>0?`, and ${String(_)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:l,source:b,lockfilePath:u,diagnostics:r,truncated:f,gaps:i}}let h=Ts(t,t);return h.length>0?(m("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(b=>({name:b.name,version:b.version,lockKey:b.lockKey,dev:!1})),source:"node-modules",lockfilePath:null,diagnostics:r,truncated:f,gaps:i}):(c&&m("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:r,truncated:f,gaps:i})}import{readdirSync as Xd,readFileSync as Jd}from"node:fs";import Yd from"node:path";var Qd=new Set(["summarized","crashed","over-cap"]),Zd=new Set(["function","method","ctor"]);function oe(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function xi(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ec(e,n){xi(e)||oe(n,"edge is not an object");let{entryPath:t,entryExport:r,entryContainer:i,hops:s}=e;(typeof t!="string"||typeof r!="string")&&oe(n,"edge entry fields must be strings"),i!==null&&typeof i!="string"&&oe(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&oe(n,"hops must be a non-negative integer");let l=e.target;if(xi(l)||oe(n,"edge target missing"),l.kind==="symbol"){let{exportName:a,container:o,symbolKind:c}=l;return typeof a!="string"&&oe(n,"symbol target exportName"),o!==null&&typeof o!="string"&&oe(n,"symbol target container"),(typeof c!="string"||!Zd.has(c))&&oe(n,`symbol target kind ${JSON.stringify(c)}`),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"symbol",exportName:a,container:o,symbolKind:c},hops:s}}if(l.kind==="dep"){let{calleePackage:a,calleeSubpath:o,calleeExport:c}=l;return(typeof a!="string"||a.length===0)&&oe(n,"dep target calleePackage"),o!==null&&typeof o!="string"&&oe(n,"dep target calleeSubpath"),(typeof c!="string"||c.length===0)&&oe(n,"dep target calleeExport"),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"dep",calleePackage:a,calleeSubpath:o,calleeExport:c},hops:s}}oe(n,`unknown target kind ${JSON.stringify(l.kind)}`)}function nc(e,n){xi(e)||oe(n,"root is not an object");let{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:l,status:a}=e;(typeof t!="string"||t.length===0)&&oe(n,"packageName"),typeof r!="string"&&oe(n,"analyzedVersion"),i!=="jelly"&&oe(n,`tool ${JSON.stringify(i)} (only 'jelly' exists)`),typeof s!="string"&&oe(n,"toolVersion"),typeof l!="number"&&oe(n,"maxIndirections"),(typeof a!="string"||!Qd.has(a))&&oe(n,`status ${JSON.stringify(a)} not in the enum`);let o=e.edges;return Array.isArray(o)||oe(n,"edges is not an array"),a!=="summarized"&&o.length>0&&oe(n,`status='${a}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:l,status:a,edges:o.map(c=>ec(c,n))}}function Fs(e){let n=new Map,t=Xd(e).filter(r=>r.endsWith(".summary.json"));for(let r of t){let i=Yd.join(e,r),s;try{s=JSON.parse(Jd(i,"utf8"))}catch(o){oe(r,`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}let l=nc(s,r),a=n.get(l.packageName);a===void 0?n.set(l.packageName,[l]):a.push(l)}return n}import{readFileSync as tc,statSync as ic}from"node:fs";var bi=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,St=/^[A-Za-z0-9_$.-]{1,128}$/u,Ks=64,js=1024*1024,Bs=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,zs=/^[A-Za-z0-9@_.-]{1,128}$/u;function ae(e){throw new Error(`model claims rejected: ${e}`)}function Si(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function rc(e,n){Si(e)||ae(`${n}: edge is not an object`);let{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:l,calleeExport:a}=e;return t!=="alias"&&t!=="dispatch"&&ae(`${n}: edge kind`),(typeof r!="string"||!St.test(r))&&ae(`${n}: anchorExport ${JSON.stringify(r)}`),i!==null&&(typeof i!="string"||!St.test(i))&&ae(`${n}: anchorContainer`),(typeof s!="string"||!bi.test(s))&&ae(`${n}: calleePackage ${JSON.stringify(s)}`),l!==null&&(typeof l!="string"||!St.test(l))&&ae(`${n}: calleeContainer`),(typeof a!="string"||!St.test(a))&&ae(`${n}: calleeExport ${JSON.stringify(a)}`),{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:l,calleeExport:a}}function Us(e){let n=ic(e).size;n>js&&ae(`file is ${String(n)} bytes, over the ${String(js)} cap`);let t;try{t=JSON.parse(tc(e,"utf8"))}catch(i){ae(`unparseable JSON: ${i instanceof Error?i.message:String(i)}`)}Array.isArray(t)||ae("root is not an array"),t.length>Ks&&ae(`${String(t.length)} claims over cap ${String(Ks)}`);let r=[];for(let i of t){Si(i)||ae("claim is not an object");let{packageName:s,modelId:l,range:a,edges:o}=i;(typeof s!="string"||!bi.test(s))&&ae("packageName"),(typeof l!="string"||!zs.test(l))&&ae("modelId (identifier charset, 1-128 chars)"),r.some(u=>u.model.modelId===l)&&ae(`duplicate modelId ${l} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Si(a)||typeof a.introduced!="string")&&ae(`${l}: range`),Bs.test(a.introduced)||ae(`${l}: range.introduced ${JSON.stringify(a.introduced)} is not '0' or an exact x.y.z triple`);let c=a.fixedBefore;c!==null&&typeof c!="string"&&ae(`${l}: fixedBefore`),typeof c=="string"&&!Bs.test(c)&&ae(`${l}: range.fixedBefore ${JSON.stringify(c)} is not an exact x.y.z triple`),Array.isArray(o)||ae(`${l}: edges`),o.length>64&&ae(`${l}: ${String(o.length)} edges over cap ${String(64)}`),r.push({model:{packageName:s,modelId:l,edges:o.map(u=>rc(u,l))},introduced:a.introduced,fixedBefore:c})}return r}var sc=["in-app-purchase@1-v1"];function ki(e,n,t){let r=[],i=[],s=[],l=(a,o,c,u)=>{i.push(c),s.push({modelId:u??a.model.modelId,status:o,reason:c,edgeCount:a.model.edges.length})};for(let a of e){if(!bi.test(a.model.packageName)||!zs.test(a.model.modelId)){l(a,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&sc.includes(a.model.modelId)){l(a,"denylisted",`model ${a.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(a.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){l(a,"refused",`model ${a.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let o=n(a.model.packageName);if(o===void 0){l(a,"inert",`model ${a.model.modelId}: anchor ${a.model.packageName} not installed \u2014 inert`);continue}let c;try{c=an(o,{advisoryId:a.model.modelId,packageName:a.model.packageName,introduced:a.introduced,...a.fixedBefore!==null?{fixed:a.fixedBefore}:{},surfaceComplete:!1})}catch{l(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${o} not an exact triple \u2014 inert (never guessed)`);continue}if(!c){l(a,"inert",`model ${a.model.modelId}: installed ${a.model.packageName}@${o} outside [${a.introduced}, ${a.fixedBefore??"\u221E"}) \u2014 inert`);continue}r.push(a.model),s.push({modelId:a.model.modelId,status:"active",reason:null,edgeCount:a.model.edges.length})}return{models:r,notes:i,dispositions:s}}var oc=4,ac={additiveForms:!0,namelessExports:!0},lc=new Set(["dep-opaque","dynamic-load","dispatch"]),dc={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function wi(e,n,t){return e.tier==="unknown"&&dc[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&lc.has(e.unknownKind)&&n!==null&&n.verified}var cc=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),Ve=class extends Error{},vi="cupel/coverage-gap",uc={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function zn(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Gs(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Xs(e,n,t){let r=new Map(e.modules.map(l=>[l.path,l.id])),i=e.modules[0]?.id;if(i===void 0)return[];let s=n.map(l=>({source:r.get(l.path)??i,cause:uc[l.code],reach:l.classScope!==void 0?{kind:"class-scope",packageName:l.classScope.packageName,container:l.classScope.container}:l.anchor!==void 0?{kind:"via-module",anchor:l.anchor}:{kind:"unbounded"}}));return t&&s.push({source:i,reach:{kind:"unbounded"},cause:"resolution-divergence"}),s}function Ei(e,n,t,r,i){let s=t.filter(l=>l.exportName!==null&&(r===1||i||l.verified!==1));return s.length>0?s.map(l=>({advisoryId:e,packageName:n,exportName:l.exportName??"",container:l.container,symbolKind:l.symbolKind,sourcePath:l.sourcePath??"",derivation:l.derivation,confidence:l.confidence,verified:l.verified===1})):t.length===0||t.every(l=>l.exportName!==null&&l.verified===1)?[null]:[]}function fc(e){let n;try{n=kt(e)}catch{return!0}try{if(bt(Qe.join(n,"pnpm-workspace.yaml")).isFile())return!0}catch{}try{let s=JSON.parse(Ys(Qe.join(n,"package.json"),"utf8"))?.workspaces;if(Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null)return!0}catch{}let t=3,r=(i,s)=>{if(s>t)return!1;let l;try{l=Js(i)}catch{return!1}for(let a of l){if(a==="node_modules"||a.startsWith("."))continue;let o=Qe.join(i,a),c;try{c=bt(o)}catch{continue}if(c.isDirectory()){try{if(bt(Qe.join(o,"package.json")).isFile())return!0}catch{}if(r(o,s+1))return!0}}return!1};return r(n,1)}function pc(e,n,t){let r=[];if(t&&r.push("nested-app-root"),n==="")return[...r,"manifest-unreadable"];let i;try{if(i=kt(Qe.resolve(e,n)),!i.startsWith(kt(e)+Qe.sep))return[...r,"manifest-unreadable"]}catch{return[...r,"manifest-unreadable"]}let s;try{let u=Qe.join(i,"package.json");if(!bt(u).isFile())return[...r,"manifest-unreadable"];s=Ys(u,"utf8")}catch{return[...r,"manifest-unreadable"]}let l;try{l=JSON.parse(s)}catch{return[...r,"manifest-unreadable"]}if(typeof l!="object"||l===null)return[...r,"manifest-unreadable"];let a=l;(typeof a.bin=="string"||typeof a.bin=="object"&&a.bin!==null)&&r.push("bin");let o=["preinstall","install","postinstall","prepare","prepublish"],c=a.scripts;if(typeof c=="object"&&c!==null){let u=c;o.some(f=>typeof u[f]=="string")&&r.push("install-script")}return(a.gypfile===!0||mc(i))&&r.push("native-artifact"),r}function mc(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=Qe.join(e,n),r;try{r=Js(t)}catch{continue}if(r.some(i=>i.endsWith(".node")))return!0}return!1}function hc(e){let n=new Map;for(let t of e){let r=n.get(t.advisory.id);r===void 0?n.set(t.advisory.id,[t]):r.push(t)}return n}function gc(e,n,t,r,i,s,l){let{finding:a}=Bn(e,n,{name:t.name,version:t.version,devOnly:t.dev,outOfGraphExecution:l(t.name)},zn(r.advisory.id,t.name,r.affected),null,i,s);return a.decidedAtStage!=="presence"&&a.decidedAtStage!=="version-match"}function Bn(e,n,t,r,i,s,l){let a=Lt({graph:e,installed:t,range:r,symbol:i,coverage:null,incompleteness:s,analysisAborted:l});if(n!==null&&i!==null&&wi(a,i,"base")){let o=Nn(e,n.modulesById,n.reachMods,i,n.records);if(o!==null)return{finding:a,hit:o}}return{finding:a,hit:null}}function yc(e,n){let t=new Set,r=[];for(let i of e.packages)for(let{advisory:s,affected:l}of n.advisoriesForPackage("npm",i.name)){let a=zn(s.id,i.name,l),o;try{o=an(i.version,a)}catch{continue}if(o)for(let c of n.symbolsForAffected(l.id)){if(c.verified!==1||c.symbolKind!=="method"&&c.symbolKind!=="ctor"||c.container===null||c.sourcePath===null)continue;let u=`${i.lockKey}\0${c.container}\0${c.sourcePath}`;t.has(u)||(t.add(u),r.push({packageName:i.name,packageRootRel:i.lockKey,container:c.container,sourcePath:c.sourcePath}))}}return r.sort((i,s)=>`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),r.slice(0,ct)}function xc(e,n,t){let r=new Map(e.functions.map(a=>[a.id,a])),i=new Map(e.classes.map(a=>[a.id,a.name])),s=new Map(e.callSites.map(a=>[a.id,a])),l=[];for(let a of e.callEdges){if(a.resolution!=="resolved"&&a.resolution!=="field-based")continue;let o=s.get(a.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(a.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let m=n.get(f.moduleId);m!==void 0&&m.packageName!==u.packageName&&l.push({packageName:m.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:a.resolution,callerFunctionId:c.id})}return l}function Sc(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),r=new Map(e.functions.map(u=>[u.id,u])),i=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&i.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let f=s.get(u.exportId);if(f===void 0||!n.has(f.moduleId))continue;let m=r.get(u.target.functionId);m===void 0||t.get(m.moduleId)?.externalSurface===!0||i.add(m.id)}let l=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),a=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let f=l.get(u.callSiteId);if(f===void 0)continue;let m=a.get(f);m===void 0?a.set(f,[u.calleeFunctionId]):m.push(u.calleeFunctionId)}let o=new Set(i),c=[...i];for(;c.length>0;){let u=c.pop();if(u!==void 0)for(let f of a.get(u)??[])o.has(f)||(o.add(f),c.push(f))}return o}function bc(e,n,t,r){for(let i of n){if(i.modelId!==e.modelId||i.anchor.packageName!==e.anchorPackage||i.anchor.exportName!==e.entryExport)continue;let s=t.filter(a=>a.packageName===i.anchor.packageName&&a.exportName===i.anchor.exportName&&a.container===i.anchor.container),l=s.find(a=>a.resolution==="resolved")??s[0];if(l!==void 0)return r.has(l.callerFunctionId)}return null}function kc(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let r=new Set(t),i=s=>r.has(s)||r.has(Pe[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&i(s.unknownKind)||s.modelPromotedFromKind!==void 0&&i(s.modelPromotedFromKind))}function Ii(e){let n=kt(e.dir),t=e.reader??Ft(e.shardPath),r=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(dn))throw new Ve(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${dn})`);let i=null;if(e.summaryShadow!==void 0)try{i=Fs(e.summaryShadow)}catch(F){throw new Ve(`--summary-shadow facts dir rejected: ${F instanceof Error?F.message:String(F)}`)}let s=null;if(e.modelShadow!==void 0)try{s=Us(e.modelShadow.claimsPath)}catch(F){throw new Ve(`--model-shadow claims rejected: ${F instanceof Error?F.message:String(F)}`)}let l=Ds(n);if(l.truncated)throw new Ve(`the dependency enumeration hit a hard cap and is incomplete (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`);let a=e.entry??[],o=a.length>0?ws(n,a):{entrypoints:[],rejected:[]},c=o.rejected,u=Es(n),f=[...new Set([...u.entrypoints,...o.entrypoints])],m=[...u.sources];for(let F of o.entrypoints)u.entrypoints.includes(F)||m.push({source:"--entry",specifier:F,entrypoint:F,launch:!1});let h=yc(l,t),b=e.bindingForms??ac,S=e.callablePackageResolver===!0,x=e.tsconfigPaths===!0,w=fc(n),_=new Map(l.packages.map(F=>[F.name,pc(n,F.lockKey,w)])),$=F=>_.get(F)??["manifest-unreadable"],N=di({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:b,callablePackageResolver:S,tsconfigPaths:x}),k=N.graph,p=[...u.diagnostics,...ci(u.sources,u.gaps),...N.diagnostics],y=Gs(f.length,k),A=l.gaps.some(F=>F.blindsAnalysis),L=Xs(k,p,A),U=t.allModels?.()??[],I=ki(U.map(F=>({model:{packageName:F.packageName,modelId:F.modelId,edges:F.edges},introduced:F.introduced,fixedBefore:F.fixedBefore})),F=>l.packages.find(Ee=>Ee.name===F)?.version),C=I.models.length>0?Ln(k,I.models).delta:null,K=C!==null?{records:C.records,reachMods:ln(k),modulesById:new Map(k.modules.map(F=>[F.id,F]))}:null,R=[],O=cc(),V=[],J=[];for(let F of l.packages)for(let[,Ee]of hc(t.advisoriesForPackage("npm",F.name))){let xe=Ee.filter(W=>gc(k,K,F,W,L,y,$)),Se=xe.length>0?xe:Ee.slice(0,1),$e=xe.length===0;for(let{advisory:W,affected:Ae}of Se){let E=zn(W.id,F.name,Ae),v=W.cveId??W.id,M=$e?[]:t.symbolsForAffected(Ae.id),D=M.filter(ie=>ie.exportName===null),X=Ei(W.id,F.name,M,Ae.surfaceComplete,r),te=Bn(k,K,{name:F.name,version:F.version,devOnly:F.dev,outOfGraphExecution:$(F.name)},E,null,L,y).finding;if(te.decidedAtStage==="presence"||te.decidedAtStage==="version-match"){O[te.tier]+=1,R.push({...te,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:E.surfaceComplete,advisoryId:W.id,displayId:v,packageName:F.name,version:F.version,symbolName:null,symbolPath:null,severity:W.severity,packageLocation:l.lockfilePath});continue}for(let ie of X){let{finding:fe,hit:le}=Bn(k,K,{name:F.name,version:F.version,devOnly:F.dev,outOfGraphExecution:$(F.name)},E,ie,L,y),se=fe,_e,Fe;le!==null&&ie!==null&&(_e=le.modelId,Fe=fe.unknownKind,se={basis:void 0,tier:le.tier,decidedAtStage:fe.decidedAtStage,reason:`boundary model ${le.modelId}: ${le.anchorPackage}.${le.entryExport} reaches ${ie.exportName} [${le.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Jn(ie),path:void 0,unresolvedSites:fe.unresolvedSites}),O[se.tier]+=1;let B={...se,modelId:_e,modelPromotedFromKind:Fe,surfaceComplete:E.surfaceComplete,advisoryId:W.id,displayId:v,packageName:F.name,version:F.version,symbolName:ie?.exportName??null,symbolPath:ie?.sourcePath||null,severity:W.severity,packageLocation:l.lockfilePath};R.push(B);let P=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&B.tier==="unknown"&&B.decidedAtStage==="symbol-reachable"&&B.unknownKind!==void 0&&P.has(B.unknownKind)&&ie!==null&&V.push({finding:B,symbol:ie}),s!==null&&B.tier==="unknown"&&ie!==null&&J.push({finding:B,symbol:ie})}for(let ie of D)O.unknown+=1,R.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:E.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${v} carries a ${ie.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],advisoryId:W.id,displayId:v,packageName:F.name,version:F.version,symbolName:null,symbolPath:null,severity:W.severity,packageLocation:l.lockfilePath})}}for(let F of l.gaps)O.unknown+=1,R.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:F.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],advisoryId:vi,displayId:vi,packageName:F.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:l.lockfilePath});let re=O["reachable-high"]+O["reachable-medium"],Y=e.failOnReachable===!0&&re>0,j=kc(R,O.unknown,e.failOnUnknown),H=e.requireCompleteDenial===!0&&R.some(F=>F.tier==="not-reachable"&&F.basis==="loader-assumption"),ue=Y||j||H?2:0,Me;if(i!==null){let F=ln(k),Ee=new Map(k.modules.map(Se=>[Se.id,Se])),xe=[];for(let{finding:Se,symbol:$e}of V){let W=Pt(k,Ee,F,$e,i,oc);xe.push({advisoryId:Se.advisoryId,packageName:Se.packageName,symbolName:Se.symbolName,unknownKind:Se.unknownKind??null,wouldPromote:W!==null,...W!==null?{anchorPackage:W.anchorPackage,entryExport:W.entryExport,viaPackages:W.viaPackages,totalHops:W.totalHops}:{}})}Me={records:xe}}let ye;if(s!==null&&e.modelShadow!==void 0){let F=e.modelShadow.widened===!0?"widened":"base",Ee=new Map(l.packages.map(P=>[P.name,P.version])),{models:xe,notes:Se,dispositions:$e}=ki(s,P=>Ee.get(P),{shadowConsultDenylisted:!0}),{delta:W}=Ln(k,xe),Ae=ln(k),E=new Map(k.modules.map(P=>[P.id,P])),v=xc(k,E,Ae),M=Sc(k),D=W.records.some(P=>v.some(q=>q.packageName===P.anchor.packageName&&q.exportName===P.anchor.exportName&&q.container===P.anchor.container)),X=[],te=Date.now();for(let{finding:P,symbol:q}of J){let Ke=W.records,he=wi(P,q,F),Q=he?Nn(k,E,Ae,q,Ke):null,Ne=W.records.filter(we=>we.callee.packageName===q.packageName&&we.callee.exportName===q.exportName&&we.callee.container===q.container||we.callee.packageName===q.packageName&&we.callee.realFunctionId!==null);X.push({advisoryId:P.advisoryId,packageName:P.packageName,symbolName:P.symbolName,unknownKind:P.unknownKind??null,decidedAtStage:P.decidedAtStage,consultSurface:F,noHitReason:Q!==null?null:he?D?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Q!==null?bc(Q,Ke,v,M):null,verdictBefore:P.tier,verdictAfter:Q!==null?"reachable-low":P.tier,wouldPromote:Q!==null,...Q!==null?{modelId:Q.modelId,anchorPackage:Q.anchorPackage,entryExport:Q.entryExport,pathLabels:Q.pathLabels,calleeBinding:Ne.find(we=>we.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:he?Ne.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Ne[0]?.anchor.packageName??"?"}#${Ne[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let ie=Date.now()-te,fe=$e.map(P=>{if(P.status!=="active")return{modelId:P.modelId,state:P.status,reason:P.reason,edgesLowered:0,edgesReferenceGated:0};let q=W.records.filter(he=>he.modelId===P.modelId).length;if(q>0)return{modelId:P.modelId,state:"lowered",reason:null,edgesLowered:q,edgesReferenceGated:P.edgeCount-q};let Ke=W.notes.find(he=>he.startsWith(`model ${P.modelId}:`)||he.startsWith(`model-edge ${P.modelId}:`));return{modelId:P.modelId,state:"refused",reason:Ke??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:P.edgeCount}}),le=X.filter(P=>P.wouldPromote).length,se=O.unknown-le,_e=O["reachable-high"]+O["reachable-medium"],Fe=P=>({none:0,"fail-on-reachable":_e>0?2:0,"fail-on-unknown":P>0?2:0,both:_e>0||P>0?2:0});ye={records:X,notes:[...Se,...W.notes],laneStates:fe,exitCodes:{baseline:Fe(O.unknown),withModels:Fe(se)},overlayWallMs:ie},qs(Qe.dirname(e.modelShadow.outPath),{recursive:!0});let B=`${e.modelShadow.outPath}.tmp-${Vs(8).toString("hex")}`;Ws(B,`${JSON.stringify(ye,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Hs(B,e.modelShadow.outPath)}let be;if(e.bindingShadow!==void 0){let F=Date.now(),Ee=B=>I.models.length>0?{records:Ln(B,I.models).delta.records,reachMods:ln(B),modulesById:new Map(B.modules.map(P=>[P.id,P]))}:null,xe=(B,P,q,Ke)=>{let he=[];for(let Q of l.packages)for(let{advisory:Ne,affected:we}of t.advisoriesForPackage("npm",Q.name)){let yn=zn(Ne.id,Q.name,we),To=Ei(Ne.id,Q.name,t.symbolsForAffected(we.id),we.surfaceComplete,r);for(let Vi of To){let{finding:qi,hit:Mt}=Bn(B,Ke,{name:Q.name,version:Q.version,devOnly:Q.dev,outOfGraphExecution:$(Q.name)},yn,Vi,P,q);he.push({advisoryId:Ne.id,packageName:Q.name,symbolName:Vi?.exportName??null,tier:Mt!==null?Mt.tier:qi.tier,unknownKind:Mt!==null?null:qi.unknownKind??null})}}return he},Se=B=>{let P=di({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:B,callablePackageResolver:S,tsconfigPaths:x}),q=[...u.diagnostics,...ci(u.sources,u.gaps),...P.diagnostics];return{graph:P.graph,inc:Xs(P.graph,q,A),aborted:Gs(f.length,P.graph),live:Ee(P.graph),applicability:P.bindingApplicability}},$e=B=>{let P=Se(B);return xe(P.graph,P.inc,P.aborted,P.live)},W=Se({}),Ae=xe(W.graph,W.inc,W.aborted,W.live),E=xe(k,L,y,K);if(E.length!==Ae.length)throw new Ve("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let v=(B,P)=>P.tier!==B.tier||P.unknownKind!==B.unknownKind,M=Ae.some((B,P)=>{let q=E[P];return q!==void 0&&v(B,q)}),D=M?$e({additiveForms:!0}):null,X=M?$e({namelessExports:!0}):null,te=0,ie=Ae.map((B,P)=>{let q=E[P];if(q===void 0||q.advisoryId!==B.advisoryId||q.packageName!==B.packageName||q.symbolName!==B.symbolName)throw new Ve("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Ke={advisoryId:B.advisoryId,packageName:B.packageName,symbolName:B.symbolName,unknownKind:B.unknownKind,verdictBefore:B.tier,verdictAfter:q.tier,wouldPromote:q.tier!==B.tier&&(q.tier==="reachable-high"||q.tier==="reachable-medium"||q.tier==="reachable-low")};if(!v(B,q)||D===null||X===null)return Ke;te+=1;let he=D[P],Q=X[P],Ne=he!==void 0&&v(B,he),we=Q!==void 0&&v(B,Q);return{...Ke,attributedArm:Ne&&!we?"additiveForms":we&&!Ne?"namelessExports":"both",...he!==void 0?{verdictArmA:he.tier}:{},...Q!==void 0?{verdictArmB:Q.tier}:{}}}),fe={...O};Ae.forEach((B,P)=>{let q=E[P];q!==void 0&&q.tier!==B.tier&&(fe[q.tier]-=1,fe[B.tier]+=1)});let le=(B,P)=>({none:0,"fail-on-reachable":B>0?2:0,"fail-on-unknown":P>0?2:0,both:B>0||P>0?2:0}),se;if(I.models.length>0&&K!==null){se=[];for(let B of l.packages)for(let{advisory:P,affected:q}of t.advisoriesForPackage("npm",B.name)){let Ke=zn(P.id,B.name,q),he=Ei(P.id,B.name,t.symbolsForAffected(q.id),q.surfaceComplete,r);for(let Q of he){if(Q===null||!Q.verified)continue;let Ne=Bn(W.graph,W.live,{name:B.name,version:B.version,devOnly:B.dev,outOfGraphExecution:$(B.name)},Ke,Q,W.inc,W.aborted);if(!(Ne.hit===null&&wi(Ne.finding,Q,"base")))continue;let yn=Nn(k,K.modulesById,K.reachMods,Q,K.records);se.push({advisoryId:P.id,packageName:B.name,symbolName:Q.exportName,modelWouldPromote:yn!==null,...yn!==null?{modelId:yn.modelId}:{},anchorCleared:yn!==null})}}}let _e=R.some(B=>B.modelId!==void 0);be={records:ie,deltas:te,exitCodes:{baseline:le(fe["reachable-high"]+fe["reachable-medium"],fe.unknown+(_e?1:0)),withBindingForms:le(O["reachable-high"]+O["reachable-medium"],O.unknown+(_e?1:0))},dualRunWallMs:Date.now()-F,...N.bindingApplicability!==void 0?{applicability:N.bindingApplicability}:{},...se!==void 0?{modelProbe:se}:{}},qs(Qe.dirname(e.bindingShadow.outPath),{recursive:!0});let Fe=`${e.bindingShadow.outPath}.tmp-${Vs(8).toString("hex")}`;Ws(Fe,`${JSON.stringify(be,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Hs(Fe,e.bindingShadow.outPath)}let In=U.length>0||I.notes.length>0?{active:I.models.length,stored:U.length,promoted:R.filter(F=>F.modelId!==void 0).length,notes:[...I.notes,...C!==null?C.notes:[]]}:void 0;return{...Me!==void 0?{summaryShadow:Me}:{},...ye!==void 0?{modelShadow:ye}:{},...be!==void 0?{bindingShadow:be}:{},...In!==void 0?{modelLane:In}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:R,counts:O,analyzerDiagnostics:p,analysisAborted:y,rejectedEntries:c,entrypointSources:m,entrypointGaps:u.gaps,framework:u.framework,exitCode:ue}}finally{e.reader===void 0&&t.close()}}var Ec="cupel",wc="reachability-first SCA \u2014 verdict + call path + confidence";function Ai(e){return[`${Ec} v${e} \u2014 ${wc}`,`cascade: ${Ji.join(" \u2192 ")}`,`verdicts: ${Yi.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)"].join(`
+`)}var vc=new Set([...Tt,...Dt]);function hn(e,n,t){let r=e[n+1];if(r===void 0||r.startsWith("--"))throw new Error(`${t} requires a value`);return r}function Ic(e){let n=e.split(",").map(i=>i.trim()),t=[...Tt,...Dt].join(", ");if(n.length===0||n.some(i=>i===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let r=[];for(let i of n){if(!vc.has(i))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(i)}; valid: ${t}`);r.push(i)}return r}function Qs(e){let n=".",t,r,i=!1,s=!1,l=!1,a=!1,o=!1,c,u,f,m=!1,h=!1,b,S=!1,x=!1,w,_=[];for(let $=0;$<e.length;$+=1){let N=e[$];if(N==="--require-complete-denial"){s=!0;continue}if(N==="--fail-on-reachable")i=!0;else if(N==="--fail-on-unknown")l="all";else if(N!==void 0&&N.startsWith("--fail-on-unknown="))l=Ic(N.slice(18));else if(N==="--offline")a=!0;else if(N==="--sarif")t=hn(e,$,"--sarif"),$+=1;else if(N==="--shard")r=hn(e,$,"--shard"),$+=1;else if(N==="--entry")_.push(hn(e,$,"--entry")),$+=1;else if(N==="--summary-shadow")c=hn(e,$,"--summary-shadow"),$+=1;else if(N==="--model-shadow")u=hn(e,$,"--model-shadow"),$+=1;else if(N==="--model-shadow-out")f=hn(e,$,"--model-shadow-out"),$+=1;else if(N==="--model-shadow-widened")m=!0;else if(N==="--binding-shadow")h=!0;else if(N==="--binding-shadow-out")b=hn(e,$,"--binding-shadow-out"),$+=1;else if(N==="--x-partial-rows")S=!0;else if(N==="--push")x=!0;else if(N!==void 0&&N.startsWith("--auth=")){let k=N.slice(7);if(k!=="oidc"&&k!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(k)}`);w=k}else{if(N!==void 0&&N.startsWith("--"))throw new Error(`unknown flag ${N}`);N!==void 0&&!o&&(n=N,o=!0)}}if(u===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(m&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(b!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(w!==void 0&&!x)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:r,failOnReachable:i,requireCompleteDenial:s,failOnUnknown:l,offline:a,entry:_,summaryShadow:c,modelShadow:u,modelShadowOut:f,modelShadowWidened:m,push:x,auth:w,bindingShadow:h,bindingShadowOut:b,partialRows:S}}import{randomBytes as Ac,createHash as _c}from"node:crypto";import{mkdirSync as Nc,readFileSync as Cc,renameSync as Oc,writeFileSync as Rc}from"node:fs";import{homedir as Mc}from"node:os";import gn from"node:path";var _i="latest.json",Ni="latest.json.sig";function Et(e){return _c("sha256").update(e).digest("hex")}function Zs(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=Mc();if(process.platform==="darwin")return gn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let i=process.env.LOCALAPPDATA,s=i!==void 0&&i!==""?i:gn.join(n,"AppData","Local");return gn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,r=t!==void 0&&t!==""?t:gn.join(n,".cache");return gn.join(r,"cupel","shards")}function Ci(e,n,t){return gn.join(e,`${n}-${t}.sqlite`)}function wt(e,n){Nc(gn.dirname(e),{recursive:!0});let t=`${e}.tmp-${Ac(8).toString("hex")}`;Rc(t,n,{flag:"wx"}),Oc(t,e)}function Un(e){try{return Cc(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function eo(e,n,t,r){let i=Ci(e,n,t),s=Un(i);if(s===void 0)return;let l=Et(s);if(l!==t)throw r(`cached shard ${i} failed sha256 re-verify (expected ${t}, got ${l})`);return{path:i,bytes:s}}var no="api.cupel.sh",vt=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),to=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import _t from"node:path";function Le(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function io(e,n={}){let t=n.maxBytes??1073741824,r=n.timeoutMs??3e4,{get:i}=await import("node:https");return await new Promise((s,l)=>{let a=i(e,n.headers!==void 0?{headers:n.headers}:{},o=>{let c=o.statusCode??0;if(c<200||c>=300){o.resume(),l(new Error(`GET ${e} \u2192 HTTP ${String(c)}`));return}let u=[],f=0;o.on("data",m=>{if(f+=m.length,f>t){o.destroy(),l(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(m)}),o.on("end",()=>{s(Buffer.concat(u))}),o.on("error",l)});a.on("error",l),a.setTimeout(r,()=>{a.destroy(new Error(`GET ${e} timed out after ${String(r)}ms`))})})}async function Vn(e,n,t,r,i,s=3e4){let{request:l}=await import("node:https"),a=new URL(n).hostname;return await new Promise((o,c)=>{let u=l(n,{method:e,headers:t},f=>{let m=[],h=0;f.on("data",b=>{if(h+=b.length,h>i){f.destroy(),c(new Error(`${e} to ${a} returned more than ${String(i)} bytes`));return}m.push(b)}),f.on("end",()=>{o({status:f.statusCode??0,body:Buffer.concat(m).toString("utf8")})}),f.on("error",()=>{c(new Error(`${e} to ${a} failed`))})});u.on("error",()=>{c(new Error(`${e} to ${a} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${a} timed out after ${String(s)}ms`))}),r!==void 0&&u.write(r),u.end()})}import{createPublicKey as $c,verify as Pc}from"node:crypto";var G=class extends Error{constructor(n){super(n),this.name="DistError"}},Lc=Buffer.from("302a300506032b6570032100","hex"),Tc=32;function ao(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Tc)try{return $c({key:Buffer.concat([Lc,n]),format:"der",type:"spki"})}catch{return}}function Oi(e,n,t){for(let r of t){let i=ao(r);if(i!==void 0)try{if(Pc(null,e,i,n))return!0}catch{}}return!1}function lo(e){return e.some(n=>ao(n)!==void 0)}var Dc=/^[0-9a-f]{64}$/u,Fc=/^[a-z0-9-]+$/u;function ro(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new G(`${n} must be an object`);return e}function so(e,n){if(!Array.isArray(e))throw new G(`${n} must be an array`);return e}function It(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new G(`${n} must be an integer`);return e}function At(e,n){if(typeof e!="string")throw new G(`${n} must be a string`);return e}function oo(e,n){let t=At(e,n);if(Number.isNaN(Date.parse(t)))throw new G(`${n} is not a valid timestamp: ${t}`);return t}function Ri(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new G("distribution index is not valid JSON")}let r=ro(t,"index"),i=It(r.schema_version,"schema_version");if(i!==n.supportedIndexSchemaVersion)throw new G(`index schema_version ${String(i)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=It(r.sequence,"sequence");if(s<0)throw new G("sequence must be non-negative");let l=oo(r.generated,"generated"),a=so(r.shards,"shards"),o;for(let b of a){let S=ro(b,"shard entry"),x=At(S.ecosystem,"ecosystem");if(!Fc.test(x))throw new G(`ecosystem ${JSON.stringify(x)} is malformed`);if(x===n.ecosystem){o=S;break}}if(o===void 0)throw new G(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);oo(o.built,"built");let c=It(o.db_schema_version,"db_schema_version");if(c<1)throw new G("db_schema_version must be >= 1");if(c>n.supportedDbSchemaVersion)throw new G(`this shard needs a newer cupel (db_schema_version ${String(c)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=At(o.sha256,"sha256");if(!Dc.test(u))throw new G(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let f=It(o.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new G(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let m=so(o.urls,"urls");if(m.length===0)throw new G("urls must be a non-empty array");let h=[];for(let b of m){let S=At(b,"url");try{h.push(Le(S,n.shardHosts))}catch(x){throw new G(`refusing shard url ${JSON.stringify(S)}: ${x.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:f,dbSchemaVersion:c,urls:h,sequence:s,generated:l}}var Pi="CUPEL_DELIVERY_TOKEN",Mi=class extends G{constructor(n){super(n),this.name="NoDeliveryTokenError"}},$i=class extends G{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Kc(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function co(e,n){let t=Kc(e);return t!==void 0?()=>Promise.resolve(t):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function uo(e){if(e===void 0)throw new Mi(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow, elsewhere set ${Pi} to a token from app.cupel.sh, or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new $i(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var jc="/v1/resolve",Li=1024*1024,Ti=4096,fo=Li+Ti+64*1024,Bc=8,zc=2048,Uc=/^[A-Za-z0-9+/]+={0,2}$/u,Vc=3e4,ge=class extends G{constructor(n){super(n),this.name="DeliveryRefusedError"}},qn=class extends G{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Hn=class extends G{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function qc(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Hc(e){if(typeof e!="string"||e.length===0)throw new ge("the delivery response carried no index signature");if(e.length>Ti||!Uc.test(e))throw new ge("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new ge("the delivery response's index signature is not canonical base64");return n}function Wc(e){if(typeof e!="string"||e.length===0)throw new ge("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Li)throw new ge("the delivery response's index is larger than one can be");return n}function Gc(e){if(!Array.isArray(e)||e.length===0)throw new ge("the delivery response named no shard urls");if(e.length>Bc)throw new ge("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>zc)throw new ge("the delivery response carried a malformed shard url");n.push(t)}return n}function Xc(e,n){throw e===401||e===403?new ge(`${n} rejected the delivery credential \u2014 check ${Pi}, or that the token has not been revoked in the dashboard`):e===404?new ge(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Hn(`${n} holds nothing newer than the shard index already cached`):e===429?new qn(`${n} rate-limited the delivery request`):e>=500?new qn(`${n} answered ${String(e)}`):new ge(`${n} refused the delivery request with status ${String(e)}`)}async function po(e,n,t,r,i=Vc){let s=Le(`https://${e}${jc}`,new Set([e])),l=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),a;try{a=await r(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},l,i)}catch{throw new qn(`${e} could not be reached`)}if(a.status!==200&&Xc(a.status,e),Buffer.byteLength(a.body,"utf8")>fo)throw new ge(`${e} returned a delivery response larger than one can be`);let o;try{o=JSON.parse(a.body)}catch{throw new ge(`${e} returned a delivery response that is not JSON`)}if(!qc(o))throw new ge(`${e} returned a delivery response that is not an object`);return{index:Wc(o.index),sig:Hc(o.signature),shardUrls:Gc(o.shardUrls)}}var mo=async(e,n,t,r)=>await Vn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,fo,r);var Jc=8,Fi=class extends G{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Di(e){return`${e.origin}${e.pathname}`}function ho(e,n,t){let r=new Map;for(let l of n)r.set(Di(l),l);let i=[],s=[];for(let l of e.slice(0,Jc)){let a;try{a=Le(l,t)}catch(u){s.push(u.message);continue}if(a.hash!==""){s.push("a candidate carried a fragment");continue}let o=r.get(Di(a));if(o===void 0){s.push("a candidate named an object the signed index does not list");continue}let c=new URL(`${Di(o)}${a.search}`);i.push(Le(c.href,t))}if(i.length===0)throw new Fi(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return i}var Qc=1,Zc=1024*1024*1024;function eu(e=vt){return{async resolve(n){return await po(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},mo)},async fetchShard(n,t){return Le(n.href,e),await io(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Ki(e){return e instanceof Error?e.message:String(e)}function go(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Qc,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:Zc}}function nu(e){let n=Un(_t.join(e.cacheDir,_i)),t=Un(_t.join(e.cacheDir,Ni));if(!(n===void 0||t===void 0)&&Oi(n,t,e.pubkeys))try{return Ri(n,go(e))}catch{return}}function yo(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let r=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(r)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Nt(e,n,t){let r=eo(n.cacheDir,e.ecosystem,e.sha256,i=>new G(i));if(r===void 0)throw new G(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:r.path,fromCache:!0,warnings:[...t,...yo(e,n)],sequence:e.sequence}}async function tu(e,n,t,r){let i=Ci(t.cacheDir,e.ecosystem,e.sha256),s=Un(i);if(s!==void 0&&Et(s)===e.sha256)return{path:i,downloaded:!1};let l="no shard urls";for(let a of n){let o;try{o=await r.fetchShard(a,e.sizeBytes)}catch(u){l=Ki(u);continue}let c=Et(o);if(c!==e.sha256){l=`sha256 mismatch (expected ${e.sha256}, got ${c})`;continue}return wt(i,o),{path:i,downloaded:!0}}throw new G(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${l}`)}function iu(e,n,t){if(e instanceof ge)throw e;if(e instanceof Hn){if(n===void 0)throw new G(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Nt(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new G(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Ki(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Nt(n,t,[`could not refresh the shard index (${Ki(e)}); using the cached shard`])}async function xo(e,n){if(!e.activated)throw new G("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??eu(e.shardHosts);if(!lo(e.pubkeys))throw new G("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let r=nu(e);if(e.offline){if(r===void 0)throw new G(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Nt(r,e,[])}let i=await uo(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:i,ecosystem:e.ecosystem,sequenceFloor:r?.sequence??0})}catch(c){return iu(c,r,e)}if(!Oi(s.index,s.sig,e.pubkeys))throw new G("shard index signature did not verify against any pinned key");let l=Ri(s.index,go(e));if(r!==void 0&&l.sequence<r.sequence)return Nt(r,e,[`refusing a rolled-back shard index (served sequence ${String(l.sequence)} < cached ${String(r.sequence)}); keeping the newer cached shard`]);let a=ho(s.shardUrls,l.urls,e.shardHosts),o=await tu(l,a,e,t);return wt(_t.join(e.cacheDir,_i),s.index),wt(_t.join(e.cacheDir,Ni),s.sig),{path:o.path,fromCache:!o.downloaded,warnings:yo(l,e),sequence:l.sequence}}var ru="https://api.cupel.sh",So=".actions.githubusercontent.com",su=8192,Te=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function ou(e){let n;try{n=new URL(e).hostname}catch{throw new Te("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=So.slice(1);if(n!==t&&!n.endsWith(So))throw new Te(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Le(e,new Set([n]))}catch{throw new Te(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Ct(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,r=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Te("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(r===void 0||r==="")throw new Te("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let i=ou(t);i.searchParams.set("audience",ru);let s;try{s=await n(i.href,{authorization:`Bearer ${r}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Te("the ID-token request failed")}if(s.length>su)throw new Te("the ID-token response was larger than a token can be");let l;try{l=JSON.parse(s)}catch{throw new Te("the ID-token response was not JSON")}let a=typeof l=="object"&&l!==null?l.value:void 0;if(typeof a!="string"||a.length===0)throw new Te("the ID-token response carried no token");return a}async function bo(e,n,t={}){let r=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",i=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!r)throw new Te("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Ct(e,n)};if(r)return i&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(i)return{kind:"oidc",value:await Ct(e,n)};throw new Te("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var ji="api.cupel.sh",au=`https://${ji}/v1/findings`,lu=64*1024,Ot=8*1024*1024,du=3e4,on=class extends Error{constructor(n){super(n),this.name="PushError"}};async function ko(e,n,t,r={}){if(e.length>Ot)throw new on(`findings payload is ${String(e.length)} bytes, over the ${String(Ot)}-byte limit`);let i=Le(au,new Set([ji])),s;try{s=await t(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,r.timeoutMs??du)}catch{throw new on(`the findings push to ${ji} failed`)}if(s.body.length>lu)throw new on("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new on("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new on("the control plane rejected the findings payload as malformed"):new on(`the findings push was refused with status ${String(s.status)}`)}var cu=64*1024,uu=64*1024,Eo=async(e,n,t,r)=>{if(Buffer.byteLength(t,"utf8")>Ot)throw new Error("findings payload is over the size limit");return await Vn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,uu,r)};async function Rt(e,n){let t=await Vn("GET",e,n,void 0,cu,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var pu=720*60*60*1e3,mu=Number(dn);function wo(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Ve("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function vo(e){let n=await xo({ecosystem:"npm",activated:!0,pubkeys:to,indexHost:no,shardHosts:vt,credential:co(process.env,()=>Ct(process.env,Rt)),cacheDir:Zs(),offline:e.offline,now:Date.now(),maxAgeMs:pu,supportedDbSchemaVersion:mu});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
+`);return{path:n.path,sequence:n.sequence}}var hu=5,vn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function gu(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new vn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,r=e.modelPromotedFromKind??null;if(t===null!=(r===null))throw new vn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new vn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:Qi(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(i=>({functionName:i.functionName??null,modulePath:i.modulePath})),unresolvedSites:e.unresolvedSites.map(i=>({path:i.path,start:i.start,end:i.end})),modelId:t,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null}}var yu="";function xu(e){return[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""].join(yu)}function Su(e){let n=new Map;for(let t of e){let r=xu(t),i=n.get(r);if(i===void 0){n.set(r,t);continue}if(i.tier!==t.tier||i.unknownKind!==t.unknownKind)throw new vn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${i.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Io(e,n){return{version:hu,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:Su(e.findings.map(gu))}}function z(e){let n="";for(let t of e){let r=t.charCodeAt(0),i=r<32||r>=127&&r<=159;n+=i?"\\x"+r.toString(16).padStart(2,"0"):t}return n}function bu(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var ku={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Ao=4,Bi=3,zi=10,_o={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},Eu="(symbol set known incomplete)";function wu(e){let n=(e.path??[]).map(t=>z(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function No(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function vu(e){let n=e.findings.filter(c=>c.tier==="unknown"&&c.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let c of n){let u=t.get(c.unknownKind)??[];u.push(c),t.set(c.unknownKind,u)}let r={cupel:0,project:0};for(let[c,u]of t)r[Pe[c]]+=u.length;let i=[];i.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(c,u)=>{if(r[c]===0)return;i.push(""),i.push(`   ${u} (${String(r[c])}):`);let f=[...t.entries()].filter(([h])=>Pe[h]===c).sort((h,b)=>b[1].length-h[1].length||h[0].localeCompare(b[0])),m=f.slice(0,Ao);for(let[h,b]of m){let S=c==="project"?[...new Set(b.flatMap(No))]:[],x=S.slice(0,Bi).map(z).join(", "),w=S.length>Bi?` (+${String(S.length-Bi)} more files)`:"";i.push(`     ${h.padEnd(21)} ${String(b.length).padStart(4)}  ${_o[h]}`+(x!==""?`
+       ${x}${w}`:""))}for(let[h,b]of f.slice(Ao))i.push(`     ${h.padEnd(21)} ${String(b.length).padStart(4)}  ${_o[h]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let l=new Map;for(let c of n)if(Pe[c.unknownKind]==="project")for(let u of No(c))l.set(u,(l.get(u)??0)+1);let a=[...l.entries()].sort((c,u)=>u[1]-c[1]||c[0].localeCompare(u[0]))[0];a!==void 0&&r.project>0&&(i.push(""),i.push(`   \u279C Start here: ${z(a[0])} appears in ${String(a[1])} of your ${String(r.project)} finding(s), across ${String(l.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let o=n.filter(c=>Pe[c.unknownKind]==="project");if(o.length>0){i.push("");for(let c of o.slice(0,zi))i.push(`     ${z(c.displayId)}  ${z(c.packageName)}@${z(c.version)}  [${c.unknownKind}] ${z(c.reason)}`);o.length>zi&&i.push(`     \u2026 and ${String(o.length-zi)} more`)}return i.push(""),i}function Co(e){let n=[],t=e.counts,r=e.findings.filter(a=>a.tier==="reachable-high"||a.tier==="reachable-medium"||a.tier==="reachable-low");if(n.push(`cupel scan: ${z(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let a=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+a.map(o=>`${z(o.entrypoint)} [${z(o.source)}]`).join(", ")+(e.entrypointSources.length>a.length?`, \u2026 and ${String(e.entrypointSources.length-a.length)} more`:"")),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let a of e.entrypointGaps.slice(0,5))n.push(`  - ${z(a.source)} (${z(a.file)}): ${z(a.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(z).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${Yt(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let i=e.installed.gaps;if(i.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(i.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let a of i.slice(0,10))n.push(`  - [${z(a.kind)}] ${z(a.detail)}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}let s=new Set(i.map(a=>a.detail)),l=[...e.analyzerDiagnostics.map(a=>`${z(a.code)}: ${z(a.detail)}`),...e.installed.diagnostics.filter(a=>!s.has(a)).map(z)];if(l.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(l.length)}) \u2014 verdicts are conservative:`);for(let a of l.slice(0,10))n.push(`  - ${a}`);l.length>10&&n.push(`  \u2026 and ${String(l.length-10)} more`),n.push("")}if(r.length>0){n.push(`\u{1F3AF} Reachable (${String(r.length)}) \u2014 fix these:`);for(let a of r)n.push(`  ${ku[a.tier]} ${z(a.displayId)}  ${z(a.packageName)}@${z(a.version)}  ${z(a.symbolName??"")}`+(a.surfaceComplete===!1?`  ${Eu}`:"")),n.push(`        path: ${wu(a)}`);n.push("")}return n.push(...vu(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${bu(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as Iu}from"node:crypto";var Au="https://json.schemastore.org/sarif-2.1.0.json",Oo="cupel-reachability",Ui=new Set(["dispatch","dynamic-load","coverage-gap"]);function _u(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var Nu=500,Cu=10;function Ou(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function Ru(e,n){return`${e}::${n}`}function Mu(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function $u(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Iu("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Pu(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Ui.has(e.unknownKind)}var Ro={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function Mo(e){let n=[],t=new Map,r=[];for(let o of e.findings){if(!Pu(o))continue;let c=Ru(o.displayId,o.packageName);if(!t.has(c)){t.set(c,n.length);let x=Mu(o.severity);n.push({id:z(c),properties:{tags:o.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${z(o.packageName)}`]:["security","reachability",`package/${z(o.packageName)}`],...x!==void 0?{"security-severity":x}:{}}})}let u=o.tier==="reachable-high"||o.tier==="reachable-medium"||o.tier==="reachable-low",f=o.path??[],m=f.find(x=>x.modulePath!==""),h=[...new Set(o.unresolvedSites.map(x=>x.path).filter(x=>x!==""))],b=u?m!==void 0?{physicalLocation:{artifactLocation:{uri:z(m.modulePath)}},message:{text:`calls ${z(o.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:z(o.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:z(h[0])}},message:{text:`unresolved ${z(o.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:z(o.packageLocation??(o.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},S=u?f.map(x=>({physicalLocation:{artifactLocation:{uri:z(x.modulePath||"package-lock.json")}},message:{text:z(x.functionName??"<step>")}})):h.slice(1,Cu+1).map(x=>({physicalLocation:{artifactLocation:{uri:z(x)}},message:{text:"also blocked here"}}));r.push({ruleId:z(c),ruleIndex:t.get(c),level:u?"error":"warning",message:{text:z(`[${o.tier}] ${o.displayId} in ${o.packageName}@${o.version}`+(o.symbolName!==null?` \u2014 reaches ${o.symbolName}`:"")+(o.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${o.reason}`)},locations:[b],...S.length>0?{relatedLocations:S}:{},partialFingerprints:{"cupelReachability/v1":$u(o)},properties:{tier:o.tier,advisoryId:z(o.advisoryId),...o.surfaceComplete===!1?{surfaceComplete:!1}:{},...o.modelId!==void 0?{modelId:z(o.modelId),modelPromotedFromKind:o.modelPromotedFromKind}:{},...o.unknownKind!==void 0?{unknownKind:o.unknownKind,unknownOwner:Pe[o.unknownKind],unresolvedSiteCount:o.unresolvedSites.length}:{}}})}let i=new Map,s=new Map;for(let o of e.findings){if(o.tier!=="unknown"||o.unknownKind===void 0||(i.set(o.unknownKind,(i.get(o.unknownKind)??0)+1),Ui.has(o.unknownKind)))continue;let c=s.get(o.unknownKind)??[];c.length<Nu&&c.push({advisory:z(o.displayId),package:z(o.packageName),version:z(o.version)}),s.set(o.unknownKind,c)}let l={cupel:0,project:0};for(let[o,c]of i)l[Pe[o]]+=c;let a={};for(let[o,c]of s){let u=i.get(o)??c.length;a[o]={count:u,owner:Pe[o],note:Ro[o],truncated:u>c.length,advisories:c}}return{$schema:Au,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Oo},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:z(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(o=>`${o.entrypoint} (${o.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...i.keys()].filter(o=>!Ui.has(o)&&!_u(o,e.analysisAborted)).sort().map(o=>({descriptor:{id:`unknown-${o}`},level:"warning",message:{text:`${String(i.get(o)??0)} finding(s) are unknown because ${Ro[o]} (owner: ${Pe[o]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${o}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(o=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:z(`${o.source} (${o.file}): ${o.detail}`)}})),...e.rejectedEntries.map(o=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:z(`--entry did not resolve to a file inside the app root: ${o}`)}})),...e.analyzerDiagnostics.map(o=>({descriptor:{id:o.code},level:"warning",message:{text:z(`${o.detail} (${o.path})`)}})),...e.installed.diagnostics.map(o=>({descriptor:{id:"resolve"},level:"warning",message:{text:z(o)}}))]}],results:r,properties:{category:Oo,summary:e.counts,...Ou(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...i].sort((o,c)=>c[1]-o[1])),byOwner:l,grouped:a},dbCoverageGaps:e.findings.filter(o=>o.tier==="unknown"&&o.unknownKind==="db-gap").map(o=>({advisory:z(o.displayId),package:z(o.packageName),version:z(o.version)}))}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function $o(){try{let e=Lu(Fu(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Ku(e,n){let t=`${JSON.stringify(n,null,2)}
+`,r=`${e}.tmp-${Po(8).toString("hex")}`;Lo(r,t,{encoding:"utf8",flag:"wx"}),Tu(r,e)}async function ju(e){let n=Qs(e),r=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:wo(n.shard),sequence:null}:await vo({offline:n.offline}),i=r.path,s=Ii({dir:n.dir,shardPath:i,failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{}});if(process.stdout.write(`${Co(s)}
+`),s.modelLane!==void 0){let l=s.modelLane.notes.length>0?` (${s.modelLane.notes.map(a=>z(a)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(s.modelLane.active)}/${String(s.modelLane.stored)} active, ${String(s.modelLane.promoted)} promoted to reachable-low${l}
+`)}if(n.summaryShadow!==void 0&&s.summaryShadow!==void 0){let l=Du.join(n.summaryShadow,"shadow-report.json");Lo(l,`${JSON.stringify(s.summaryShadow,null,2)}
 `),process.stdout.write(`summary-shadow: ${String(s.summaryShadow.records.length)} counterfactual record(s) -> ${l}
 `)}if(s.modelShadow!==void 0&&n.modelShadowOut!==void 0){let l=s.modelShadow.records.filter(a=>a.wouldPromote).length;process.stdout.write(`model-shadow: ${String(l)}/${String(s.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
 `)}if(s.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(s.bindingShadow.deltas)}/${String(s.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),n.sarif!==void 0&&Du(n.sarif,Mo(s)),n.push){let l=Io(s,{scanId:Po(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:r.sequence}),a=await bo(process.env,Rt,{...n.auth!==void 0?{auth:n.auth}:{},warn:c=>process.stderr.write(`cupel: ${c}
+`),n.sarif!==void 0&&Ku(n.sarif,Mo(s)),n.push){let l=Io(s,{scanId:Po(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:r.sequence}),a=await bo(process.env,Rt,{...n.auth!==void 0?{auth:n.auth}:{},warn:c=>process.stderr.write(`cupel: ${c}
 `)});try{await ko(JSON.stringify(l),a.value,Eo)}catch(c){let u=c instanceof Error?c.message:String(c);return process.stderr.write(`cupel: ${u}
 `),s.exitCode===0?1:s.exitCode}let o=r.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(l.findings.length)} finding(s) to api.cupel.sh (${a.kind})${o}
-`)}return s.exitCode}async function Ku(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Fu(e.slice(1))}catch(t){let r=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${r}
-`),1}let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${_i($o())}
-`),0):(process.stderr.write(`cupel: unknown command '${B(n)}'
-`),process.stderr.write(`${_i($o())}
-`),1)}Ku().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`)}return s.exitCode}async function Bu(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await ju(e.slice(1))}catch(t){let r=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${r}
+`),1}let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${Ai($o())}
+`),0):(process.stderr.write(`cupel: unknown command '${z(n)}'
+`),process.stderr.write(`${Ai($o())}
+`),1)}Bu().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});