npm - @cupel-sh/cli - Versions diffs - 0.3.0 → 0.4.0 - Mend

@cupel-sh/cli 0.3.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/bundle/cli.js +26 -26
package/package.json +1 -1

package/bundle/cli.js CHANGED Viewed

@@ -1,42 +1,42 @@
 #!/usr/bin/env node
-import{randomBytes as Ko}from"node:crypto";import{readFileSync as ju,renameSync as Bu,writeFileSync as jo}from"node:fs";import zu from"node:path";import{fileURLToPath as Uu}from"node:url";var zo=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function _n(e){if(!zo.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function Xn(e,n){let t=e.split(".").map(Number),i=n.split(".").map(Number);for(let r=0;r<3;r+=1){let s=t[r]??0,a=i[r]??0;if(s!==a)return s<a?-1:1}return 0}var Pt=["dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function dn(e,n){let t=_n(e);return!(n.introduced!=="0"&&Xn(t,_n(n.introduced))<0||n.fixed!==void 0&&Xn(t,_n(n.fixed))>=0||n.lastAffected!==void 0&&Xn(t,_n(n.lastAffected))>0)}function Jn(e,n,t){let i=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let o=s.get(l.callSiteId);if(o===void 0)continue;let c=i.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=i.get(l.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==u.packageName&&a.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:l.resolution})}return a}function Uo(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,i)=>t.analyzedVersion<i.analyzedVersion?1:t.analyzedVersion>i.analyzedVersion?-1:0)}function Vo(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Xi(e,n,t,i,r,s){if(s<=0)return null;let a=null,l=o=>{(a===null||o.hops<a.hops)&&(a=o)};for(let o of Uo(e,n))for(let c of o.edges){if(c.entryExport!==t||c.entryContainer!==i)continue;if(Vo(c,r,o.packageName)){l({viaPackages:[],hops:c.hops,provenance:{tool:o.tool,toolVersion:o.toolVersion,analyzedVersion:o.analyzedVersion}});continue}if(c.target.kind!=="dep")continue;let u=Xi(e,c.target.calleePackage,c.target.calleeExport,null,r,s-1);u!==null&&l({viaPackages:[c.target.calleePackage,...u.viaPackages],hops:c.hops+u.hops,provenance:u.provenance})}return a}function Lt(e,n,t,i,r,s){let a=null;for(let l of Jn(e,n,t)){let o=Xi(r,l.packageName,l.exportName,l.container,i,s);o!==null&&(a===null||o.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:o.viaPackages,totalHops:o.hops,provenance:o.provenance})}return a}function Nn(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Cn(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function Yi(e){let n=new Map,t=new Map(e.imports.map(i=>[i.id,i]));for(let i of e.importEdges){let r=t.get(i.importId);if(r===void 0)continue;let s=n.get(r.moduleId)??[];s.push(i.resolvedModuleId),n.set(r.moduleId,s)}return n}function qo(e){let n=new Map,t=new Map(e.imports.map(i=>[i.id,i]));for(let i of e.importEdges){let r=t.get(i.importId);if(r===void 0)continue;let s=n.get(i.resolvedModuleId)??[];s.push(r.moduleId),n.set(i.resolvedModuleId,s)}return n}function tn(e){let n=Yi(e),t=new Set,i=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;i.length>0;){let r=i.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let s of n.get(r)??[])t.has(s)||i.push(s)}}return t}function Ho(e,n){let t=qo(e),i=new Set,r=[n];for(;r.length>0;){let s=r.pop();if(!(s===void 0||i.has(s))){i.add(s);for(let a of t.get(s)??[])i.has(a)||r.push(a)}}return i}function Wo(e,n,t){let i=Yi(e),r=Cn(e),s=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||s.has(l))continue;s.add(l);let o=r.get(l);if(o===void 0||o.externalSurface===!0||t.has(l))return!0;for(let c of i.get(l)??[])s.has(c)||a.push(c)}return!1}function Go(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),i=Cn(e),r=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&r.set(a.id,a);let s=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=s.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let o=t.get(a.target.functionId);o===void 0||i.get(o.moduleId)?.externalSurface===!0||r.set(o.id,o)}return[...r.values()]}function Qi(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),s=r[0]?.startsWith("@")===!0?2:1;return r.slice(s).join("/")}function Xo(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let i=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let a=n.get(s.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(i){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||r.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return a.externalSurface===!0?!0:Qi(a.path)===t.sourcePath})}function Ji(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Qi(t.path)===n.sourcePath)}function Jo(e,n,t,i){let r=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(a=>{let l=r.get(a);if(l?.name!==i.exportName)return!1;let o=n.get(l.moduleId);return o?.externalSurface===!0&&o.packageName===i.packageName&&t.has(l.moduleId)}))}function Yo(e,n,t){return t.container===null?!0:e.classes.some(i=>{if(i.name!==t.container)return!1;let r=n.get(i.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function Qo(e,n,t){let i=new Map(e.callSites.map(o=>[o.id,o.enclosingFunctionId])),r=new Map;for(let o of e.callEdges){let c=i.get(o.callSiteId);if(c===void 0)continue;let u=r.get(c)??[];u.push({to:o.calleeFunctionId,res:o.resolution}),r.set(c,u)}let s=o=>{let c=new Set,u=n.map(f=>({id:f.id,prev:null}));for(let f of u)c.add(f.id);for(;u.length>0;){let f=u.shift();if(f===void 0)break;if(f.id===t){let p=[];for(let h=f;h!==null;h=h.prev)p.unshift(h.id);return p}for(let p of r.get(f.id)??[])p.res!=="unresolved"&&(p.res==="field-based"&&!o||c.has(p.to)||(c.add(p.to),u.push({id:p.to,prev:f})))}return null},a=s(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=s(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function Tt(e){return Zi(e,Cn(e),tn(e),er(e))}function Zi(e,n,t,i){let r=[],s=[],a=new Map(e.functions.map(o=>[o.id,o.moduleId])),l=o=>o!==void 0&&t.has(o)&&i.has(n.get(o)?.packageName??"");for(let o of e.callSites)o.resolution==="unresolved"&&l(a.get(o.enclosingFunctionId))&&r.push(o.range);for(let o of e.imports)!o.specifierIsLiteral&&t.has(o.moduleId)&&s.push({path:n.get(o.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:s}}function er(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function Zo(e,n){let t=new Map(e.functions.map(r=>[r.id,r])),i=Cn(e);return n.map(r=>{let s=t.get(r),a=s!==void 0?i.get(s.moduleId):void 0;return{functionId:r,functionName:s?.name,modulePath:a?.path??""}})}function Dt(e){let{graph:n,installed:t,range:i,symbol:r,coverage:s}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},o=K=>({unresolvedSites:K,unresolvedEvidence:{own:K,sets:[]}}),c=er(n),u=new Set;for(let K of e.incompleteness)K.reach.kind==="unbounded"&&u.add(K.source);let f=e.incompleteness.some(K=>K.reach.kind==="assumed-bounded")?"loader-assumption":"complete",p=K=>K==="not-reachable"?f:void 0,h=new Map,k=K=>{let q=h.get(K);return q===void 0&&(q=Wo(n,K,u),h.set(K,q)),q},x=K=>K.reach.kind==="class-scope"&&r!==null&&r.packageName===K.reach.packageName&&r.container===K.reach.container,y=K=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let q of Pt)for(let T of e.incompleteness)if(T.cause===q&&K(T))return{cause:T.cause,source:T.source};return null},w=K=>{let q;return y(T=>T.reach.kind==="unbounded"?!0:T.reach.kind==="class-scope"?x(T):K===void 0||k(T.reach.anchor)?!0:(q??=Ho(n,K),q.has(T.reach.anchor)))},N=()=>y(K=>K.reach.kind==="unbounded"?!0:K.reach.kind==="class-scope"?x(K):k(K.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${i.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:p("not-affected"),path:void 0,...l};let R;try{R=dn(t.version,i)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:p("unknown"),path:void 0,...l}}if(!R)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${i.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:p("not-affected"),path:void 0,...l};let A=Cn(n),b=tn(n),m=K=>{if(K.cause!=="dynamic-load"||K.source===null)return a;let q=A.get(K.source);return q===void 0?a:[{path:q.path,start:0,end:0}]},{dispatch:S,load:I}=Zi(n,A,b,c),P=[...S,...I],U={unresolvedSites:I,unresolvedEvidence:{own:a,sets:["load"]}},_={unresolvedSites:P,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},C=K=>{for(let q of b)if(A.get(q)?.packageName===K)return!0;return!1},B=K=>({tier:"unknown",decidedAtStage:K,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:p("unknown"),path:void 0,...l}),V=()=>{if(!C(i.packageName)){if(I.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:p("unknown"),path:void 0,...U};let K=N();return K!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:K.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(K))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:p("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${i.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${i.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}}return null};if(r===null||!r.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,basis:p("unknown"),path:void 0,..._};if(s!==null&&!s.comparedPaths.has(r.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:p("unknown"),path:void 0,..._};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:p("unknown"),path:void 0,..._};let $=Xo(n,A,r);if($===void 0||!b.has($.moduleId)){if($===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&Jo(n,A,b,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,..._};if($===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!Yo(n,A,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,..._};let K=V();if(K!==null)return K;if(P.length>0){let W=$!==void 0?A.get($.moduleId):Ji(n,r),ae=$===void 0&&W!==void 0&&W.externalSurface!==!0&&b.has(W.id)&&!c.has(W.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:I.length>0?"dynamic-load":ae?"dep-opaque":"dispatch",attribution:void 0,basis:p("unknown"),path:void 0,..._}}let q=$!==void 0?A.get($.moduleId):Ji(n,r);if($===void 0&&q!==void 0&&q.externalSurface!==!0&&b.has(q.id)&&!c.has(q.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,...l};let T=q!==void 0?w(q.id):N();return T!==null?{tier:"unknown",decidedAtStage:$===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:T.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(T))}:i.surfaceComplete?{tier:"not-reachable",decidedAtStage:$===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}:B($===void 0?"symbol-reachable":"module-reachable")}let H=Qo(n,Go(n),$.id);if(H!==null)return{tier:Nn(H.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Yn(r),basis:p("reachable-high"),path:Zo(n,H.path),...l};if(P.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but unresolved edges exist`,unknownKind:I.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:p("unknown"),path:void 0,..._};let Z=w($.moduleId);return Z!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:Z.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(Z))}:i.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}:B("call-path-confirmed")}function ea(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function na(e,n,t){let i=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let s=n.get(r.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(r.enclosingClassId!==void 0?i.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function ta(e,n,t){if(n===t)return[];let i=new Map(e.functions.map(o=>[o.id,o])),r=new Map(e.callSites.map(o=>[o.id,o])),s=new Map;for(let o of e.callEdges){if(o.resolution!=="resolved"&&o.resolution!=="field-based")continue;let c=r.get(o.callSiteId);if(c===void 0)continue;let u=c.enclosingFunctionId;if(!i.has(u)||!i.has(o.calleeFunctionId))continue;let f=s.get(u),p={to:o.calleeFunctionId,label:o.resolution};f===void 0?s.set(u,[p]):f.push(p)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let o=0;o<l.length;o++){let c=l[o];for(let u of s.get(c.at)??[]){if(a.has(u.to))continue;let f=[...c.labels,u.label];if(u.to===t)return f;a.add(u.to),l.push({at:u.to,labels:f})}}return null}function On(e,n,t,i,r){if(r.length===0)return null;let s=Jn(e,n,t);if(s.length===0)return null;let a=na(e,n,i);for(let l of r){let o=s.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),c=o.find(u=>u.resolution==="resolved")??o[0];if(c!==void 0){if(ea(l.callee,i))return{tier:Nn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[c.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=ta(e,l.callee.realFunctionId,a);if(u!==null)return{tier:Nn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[c.resolution,"modeled",...u]}}}}return null}var nr=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],tr=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function Yn(e){return e.verified?"gated":"candidate"}var Ft=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],Kt=["cupel","project"],Re={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function ir(e){return Re[e]}import{randomBytes as Xs}from"node:crypto";import{mkdirSync as Js,readdirSync as no,readFileSync as to,realpathSync as Et,renameSync as Ys,statSync as kt,writeFileSync as Qs}from"node:fs";import Qe from"node:path";import{createRequire as ia}from"node:module";var ra=ia(import.meta.url);function sa(){try{return ra("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function oa(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Qn={open(e,n){let{DatabaseSync:t}=sa(),i=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?i.exec("PRAGMA query_only = ON;"):i.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>i.exec(r),prepare:r=>oa(i.prepare(r)),close:()=>i.close()}}};function pe(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function ce(e){return typeof e=="string"?e:null}function qe(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var rr=`
+import{randomBytes as jo}from"node:crypto";import{readFileSync as zu,renameSync as Uu,writeFileSync as Bo}from"node:fs";import Vu from"node:path";import{fileURLToPath as qu}from"node:url";var Uo=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Nn(e){if(!Uo.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function Jn(e,n){let t=e.split(".").map(Number),i=n.split(".").map(Number);for(let r=0;r<3;r+=1){let s=t[r]??0,a=i[r]??0;if(s!==a)return s<a?-1:1}return 0}var Lt=["dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function fn(e,n){let t=Nn(e);return!(n.introduced!=="0"&&Jn(t,Nn(n.introduced))<0||n.fixed!==void 0&&Jn(t,Nn(n.fixed))>=0||n.lastAffected!==void 0&&Jn(t,Nn(n.lastAffected))>0)}function Yn(e,n,t){let i=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let o=s.get(l.callSiteId);if(o===void 0)continue;let c=i.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=i.get(l.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==u.packageName&&a.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:l.resolution})}return a}function Vo(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,i)=>t.analyzedVersion<i.analyzedVersion?1:t.analyzedVersion>i.analyzedVersion?-1:0)}function qo(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Ji(e,n,t,i,r,s){if(s<=0)return null;let a=null,l=o=>{(a===null||o.hops<a.hops)&&(a=o)};for(let o of Vo(e,n))for(let c of o.edges){if(c.entryExport!==t||c.entryContainer!==i)continue;if(qo(c,r,o.packageName)){l({viaPackages:[],hops:c.hops,provenance:{tool:o.tool,toolVersion:o.toolVersion,analyzedVersion:o.analyzedVersion}});continue}if(c.target.kind!=="dep")continue;let u=Ji(e,c.target.calleePackage,c.target.calleeExport,null,r,s-1);u!==null&&l({viaPackages:[c.target.calleePackage,...u.viaPackages],hops:c.hops+u.hops,provenance:u.provenance})}return a}function Tt(e,n,t,i,r,s){let a=null;for(let l of Yn(e,n,t)){let o=Ji(r,l.packageName,l.exportName,l.container,i,s);o!==null&&(a===null||o.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:o.viaPackages,totalHops:o.hops,provenance:o.provenance})}return a}function Cn(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function On(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function Qi(e){let n=new Map,t=new Map(e.imports.map(i=>[i.id,i]));for(let i of e.importEdges){let r=t.get(i.importId);if(r===void 0)continue;let s=n.get(r.moduleId)??[];s.push(i.resolvedModuleId),n.set(r.moduleId,s)}return n}function Ho(e){let n=new Map,t=new Map(e.imports.map(i=>[i.id,i]));for(let i of e.importEdges){let r=t.get(i.importId);if(r===void 0)continue;let s=n.get(i.resolvedModuleId)??[];s.push(r.moduleId),n.set(i.resolvedModuleId,s)}return n}function tn(e){let n=Qi(e),t=new Set,i=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;i.length>0;){let r=i.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let s of n.get(r)??[])t.has(s)||i.push(s)}}return t}function Wo(e,n){let t=Ho(e),i=new Set,r=[n];for(;r.length>0;){let s=r.pop();if(!(s===void 0||i.has(s))){i.add(s);for(let a of t.get(s)??[])i.has(a)||r.push(a)}}return i}function Go(e,n,t){let i=Qi(e),r=On(e),s=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||s.has(l))continue;s.add(l);let o=r.get(l);if(o===void 0||o.externalSurface===!0||t.has(l))return!0;for(let c of i.get(l)??[])s.has(c)||a.push(c)}return!1}function Xo(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),i=On(e),r=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&r.set(a.id,a);let s=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=s.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let o=t.get(a.target.functionId);o===void 0||i.get(o.moduleId)?.externalSurface===!0||r.set(o.id,o)}return[...r.values()]}function Zi(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),s=r[0]?.startsWith("@")===!0?2:1;return r.slice(s).join("/")}function Jo(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let i=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let a=n.get(s.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(i){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||r.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return a.externalSurface===!0?!0:Zi(a.path)===t.sourcePath})}function Yi(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Zi(t.path)===n.sourcePath)}function Yo(e,n,t,i){let r=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(a=>{let l=r.get(a);if(l?.name!==i.exportName)return!1;let o=n.get(l.moduleId);return o?.externalSurface===!0&&o.packageName===i.packageName&&t.has(l.moduleId)}))}function Qo(e,n,t){return t.container===null?!0:e.classes.some(i=>{if(i.name!==t.container)return!1;let r=n.get(i.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function Zo(e,n,t){let i=new Map(e.callSites.map(o=>[o.id,o.enclosingFunctionId])),r=new Map;for(let o of e.callEdges){let c=i.get(o.callSiteId);if(c===void 0)continue;let u=r.get(c)??[];u.push({to:o.calleeFunctionId,res:o.resolution}),r.set(c,u)}let s=o=>{let c=new Set,u=n.map(f=>({id:f.id,prev:null}));for(let f of u)c.add(f.id);for(;u.length>0;){let f=u.shift();if(f===void 0)break;if(f.id===t){let p=[];for(let h=f;h!==null;h=h.prev)p.unshift(h.id);return p}for(let p of r.get(f.id)??[])p.res!=="unresolved"&&(p.res==="field-based"&&!o||c.has(p.to)||(c.add(p.to),u.push({id:p.to,prev:f})))}return null},a=s(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=s(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function Dt(e){return er(e,On(e),tn(e),nr(e))}function er(e,n,t,i){let r=[],s=[],a=new Map(e.functions.map(o=>[o.id,o.moduleId])),l=o=>o!==void 0&&t.has(o)&&i.has(n.get(o)?.packageName??"");for(let o of e.callSites)o.resolution==="unresolved"&&l(a.get(o.enclosingFunctionId))&&r.push(o.range);for(let o of e.imports)!o.specifierIsLiteral&&t.has(o.moduleId)&&s.push({path:n.get(o.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:s}}function nr(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function ea(e,n){let t=new Map(e.functions.map(r=>[r.id,r])),i=On(e);return n.map(r=>{let s=t.get(r),a=s!==void 0?i.get(s.moduleId):void 0;return{functionId:r,functionName:s?.name,modulePath:a?.path??""}})}function Ft(e){let{graph:n,installed:t,range:i,symbol:r,coverage:s}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},o=K=>({unresolvedSites:K,unresolvedEvidence:{own:K,sets:[]}}),c=nr(n),u=new Set;for(let K of e.incompleteness)K.reach.kind==="unbounded"&&u.add(K.source);let f=e.incompleteness.some(K=>K.reach.kind==="assumed-bounded")?"loader-assumption":"complete",p=K=>K==="not-reachable"?f:void 0,h=new Map,E=K=>{let V=h.get(K);return V===void 0&&(V=Go(n,K,u),h.set(K,V)),V},x=K=>K.reach.kind==="class-scope"&&r!==null&&r.packageName===K.reach.packageName&&r.container===K.reach.container,y=K=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let V of Lt)for(let D of e.incompleteness)if(D.cause===V&&K(D))return{cause:D.cause,source:D.source};return null},v=K=>{let V;return y(D=>D.reach.kind==="unbounded"?!0:D.reach.kind==="class-scope"?x(D):K===void 0||E(D.reach.anchor)?!0:(V??=Wo(n,K),V.has(D.reach.anchor)))},N=()=>y(K=>K.reach.kind==="unbounded"?!0:K.reach.kind==="class-scope"?x(K):E(K.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${i.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:p("not-affected"),path:void 0,...l};let R;try{R=fn(t.version,i)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:p("unknown"),path:void 0,...l}}if(!R)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${i.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:p("not-affected"),path:void 0,...l};let A=On(n),b=tn(n),m=K=>{if(K.cause!=="dynamic-load"||K.source===null)return a;let V=A.get(K.source);return V===void 0?a:[{path:V.path,start:0,end:0}]},{dispatch:S,load:I}=er(n,A,b,c),T=[...S,...I],z={unresolvedSites:I,unresolvedEvidence:{own:a,sets:["load"]}},_={unresolvedSites:T,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},C=K=>{for(let V of b)if(A.get(V)?.packageName===K)return!0;return!1},j=K=>({tier:"unknown",decidedAtStage:K,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:p("unknown"),path:void 0,...l}),U=()=>{if(!C(i.packageName)){if(I.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:p("unknown"),path:void 0,...z};let K=N();return K!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:K.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(K))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:p("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${i.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${i.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}}return null};if(r===null||!r.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,basis:p("unknown"),path:void 0,..._};if(s!==null&&!s.comparedPaths.has(r.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:p("unknown"),path:void 0,..._};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:p("unknown"),path:void 0,..._};let $=Jo(n,A,r);if($===void 0||!b.has($.moduleId)){if($===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&Yo(n,A,b,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,..._};if($===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!Qo(n,A,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,..._};let K=U();if(K!==null)return K;if(T.length>0){let H=$!==void 0?A.get($.moduleId):Yi(n,r),se=$===void 0&&H!==void 0&&H.externalSurface!==!0&&b.has(H.id)&&!c.has(H.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:I.length>0?"dynamic-load":se?"dep-opaque":"dispatch",attribution:void 0,basis:p("unknown"),path:void 0,..._}}let V=$!==void 0?A.get($.moduleId):Yi(n,r);if($===void 0&&V!==void 0&&V.externalSurface!==!0&&b.has(V.id)&&!c.has(V.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,...l};let D=V!==void 0?v(V.id):N();return D!==null?{tier:"unknown",decidedAtStage:$===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:D.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(D))}:i.surfaceComplete?{tier:"not-reachable",decidedAtStage:$===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}:j($===void 0?"symbol-reachable":"module-reachable")}let Y=Zo(n,Xo(n),$.id);if(Y!==null)return{tier:Cn(Y.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Qn(r),basis:p("reachable-high"),path:ea(n,Y.path),...l};if(T.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but unresolved edges exist`,unknownKind:I.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:p("unknown"),path:void 0,..._};let W=v($.moduleId);return W!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:W.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(W))}:i.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}:j("call-path-confirmed")}function na(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function ta(e,n,t){let i=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let s=n.get(r.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(r.enclosingClassId!==void 0?i.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function ia(e,n,t){if(n===t)return[];let i=new Map(e.functions.map(o=>[o.id,o])),r=new Map(e.callSites.map(o=>[o.id,o])),s=new Map;for(let o of e.callEdges){if(o.resolution!=="resolved"&&o.resolution!=="field-based")continue;let c=r.get(o.callSiteId);if(c===void 0)continue;let u=c.enclosingFunctionId;if(!i.has(u)||!i.has(o.calleeFunctionId))continue;let f=s.get(u),p={to:o.calleeFunctionId,label:o.resolution};f===void 0?s.set(u,[p]):f.push(p)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let o=0;o<l.length;o++){let c=l[o];for(let u of s.get(c.at)??[]){if(a.has(u.to))continue;let f=[...c.labels,u.label];if(u.to===t)return f;a.add(u.to),l.push({at:u.to,labels:f})}}return null}function Rn(e,n,t,i,r){if(r.length===0)return null;let s=Yn(e,n,t);if(s.length===0)return null;let a=ta(e,n,i);for(let l of r){let o=s.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),c=o.find(u=>u.resolution==="resolved")??o[0];if(c!==void 0){if(na(l.callee,i))return{tier:Cn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[c.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=ia(e,l.callee.realFunctionId,a);if(u!==null)return{tier:Cn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[c.resolution,"modeled",...u]}}}}return null}var tr=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],ir=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function Qn(e){return e.verified?"gated":"candidate"}var Kt=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],jt=["cupel","project"],$e={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function rr(e){return $e[e]}import{randomBytes as Js}from"node:crypto";import{mkdirSync as Ys,readdirSync as to,readFileSync as io,realpathSync as wt,renameSync as Qs,statSync as Et,writeFileSync as Zs}from"node:fs";import Qe from"node:path";import{createRequire as ra}from"node:module";var sa=ra(import.meta.url);function oa(){try{return sa("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function aa(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Zn={open(e,n){let{DatabaseSync:t}=oa(),i=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?i.exec("PRAGMA query_only = ON;"):i.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>i.exec(r),prepare:r=>aa(i.prepare(r)),close:()=>i.close()}}};function ce(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function ae(e){return typeof e=="string"?e:null}function qe(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var sr=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,aa=`${rr}, ap.surface_complete
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,la=`${sr}, ap.surface_complete
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,la=`${rr},
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,da=`${sr},
          EXISTS (SELECT 1 FROM vulnerable_symbol vs
                  WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,da=5,ca="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",ua="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",fa="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function jt(e,n=Qn){let t=n.open(e,"readonly"),i=t.prepare(fa).get(),r=i!==void 0?pe(i.value):"",s=/^\d+$/u.test(r)&&Number(r)>=da,a=t.prepare(s?aa:la),l=t.prepare(ca),o=t.prepare(ua);return{schemaVersion:r,advisoriesForPackage(c,u){return a.all({eco:c,name:u}).map(f=>({affected:{id:qe(f.ap_id)??0,advisoryId:pe(f.advisory_id),ecosystem:pe(f.ecosystem),packageName:pe(f.package_name),introduced:ce(f.introduced),fixed:ce(f.fixed),lastAffected:ce(f.last_affected),fixCommit:ce(f.fix_commit),repoUrl:ce(f.repo_url),surfaceComplete:qe(f.surface_complete)===1?1:0},advisory:{id:pe(f.a_id),osvId:ce(f.osv_id),cveId:ce(f.cve_id),summary:ce(f.summary),severity:ce(f.severity),published:ce(f.published),source:pe(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(c){return l.all({id:c}).map(u=>({id:qe(u.id)??0,affectedPackageId:qe(u.affected_package_id)??0,exportName:ce(u.export_name),symbolKind:pe(u.symbol_kind),matchPattern:ce(u.match_pattern),matchGlobs:ce(u.match_globs),container:ce(u.container),sourcePath:ce(u.source_path),declStart:qe(u.decl_start),declEnd:qe(u.decl_end),astHashBefore:ce(u.ast_hash_before),astHashAfter:ce(u.ast_hash_after),derivation:pe(u.derivation),confidence:pe(u.confidence),verified:qe(u.verified)===1?1:0}))},aliasesForSymbol(c){return o.all({id:c}).map(u=>({id:qe(u.id)??0,vulnerableSymbolId:qe(u.vulnerable_symbol_id)??0,aliasPath:pe(u.alias_path),aliasName:pe(u.alias_name)}))},allModels(){let c;try{c=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,ca=5,ua="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",fa="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",pa="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function Bt(e,n=Zn){let t=n.open(e,"readonly"),i=t.prepare(pa).get(),r=i!==void 0?ce(i.value):"",s=/^\d+$/u.test(r)&&Number(r)>=ca,a=t.prepare(s?la:da),l=t.prepare(ua),o=t.prepare(fa);return{schemaVersion:r,advisoriesForPackage(c,u){return a.all({eco:c,name:u}).map(f=>({affected:{id:qe(f.ap_id)??0,advisoryId:ce(f.advisory_id),ecosystem:ce(f.ecosystem),packageName:ce(f.package_name),introduced:ae(f.introduced),fixed:ae(f.fixed),lastAffected:ae(f.last_affected),fixCommit:ae(f.fix_commit),repoUrl:ae(f.repo_url),surfaceComplete:qe(f.surface_complete)===1?1:0},advisory:{id:ce(f.a_id),osvId:ae(f.osv_id),cveId:ae(f.cve_id),summary:ae(f.summary),severity:ae(f.severity),published:ae(f.published),source:ce(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(c){return l.all({id:c}).map(u=>({id:qe(u.id)??0,affectedPackageId:qe(u.affected_package_id)??0,exportName:ae(u.export_name),symbolKind:ce(u.symbol_kind),matchPattern:ae(u.match_pattern),matchGlobs:ae(u.match_globs),container:ae(u.container),sourcePath:ae(u.source_path),declStart:qe(u.decl_start),declEnd:qe(u.decl_end),astHashBefore:ae(u.ast_hash_before),astHashAfter:ae(u.ast_hash_after),derivation:ce(u.derivation),confidence:ce(u.confidence),verified:qe(u.verified)===1?1:0}))},aliasesForSymbol(c){return o.all({id:c}).map(u=>({id:qe(u.id)??0,vulnerableSymbolId:qe(u.vulnerable_symbol_id)??0,aliasPath:ce(u.alias_path),aliasName:ce(u.alias_name)}))},allModels(){let c;try{c=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
                FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let u=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return c.map(f=>{let p=qe(f.id)??0;return{packageName:pe(f.package_name),modelId:pe(f.evidence_ref),introduced:pe(f.introduced),fixedBefore:ce(f.fixed_before),evidenceRef:pe(f.evidence_ref),edges:u.all({id:p}).map(h=>({kind:pe(h.kind),anchorExport:pe(h.anchor_export),anchorContainer:ce(h.anchor_container),calleePackage:pe(h.callee_package),calleeContainer:ce(h.callee_container),calleeExport:pe(h.callee_export)}))}})},close(){t.close()}}}var cn="5";import{realpathSync as Fn}from"node:fs";import nn from"node:path";import{realpathSync as pn}from"node:fs";import{isBuiltin as Xa}from"node:module";import ke from"node:path";import g from"typescript";function Bt(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function me(e){let n=Bt(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function He(e){let n=Bt(e);if(n.startsWith("@")){let i=n.indexOf("/");if(i===-1)return n;let r=n.indexOf("/",i+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function sr(e){let n=Bt(e),t=He(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as ya,statSync as zt}from"node:fs";var rn=16*1024*1024;function bn(e,n){try{let t=zt(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:ya(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function Ne(e){let n=bn(e,rn);return n.kind==="ok"?n.text:null}function We(e){try{return zt(e).isFile()}catch{return!1}}function or(e){try{let n=zt(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as xa,realpathSync as qt}from"node:fs";import ee from"node:path";import Zn from"typescript";var fr=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function je(e){return fr.some(([n])=>e.endsWith(n))}function Sa(e){for(let[n,t]of fr)if(e.endsWith(n)){let i=e.slice(0,-n.length);return t.map(r=>i+r)}return[]}var ba=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function ka(e){if(je(e))return e;for(let[n,t]of ba)if(e.endsWith(n)){let i=e.slice(0,-n.length);for(let r of t){let s=i+r;if(We(s))return s}return e}return e}var Ea=[Zn.ModuleKind.CommonJS,Zn.ModuleKind.ESNext],wa=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function pr(e,n,t,i,r,s){let a=Zn.resolveModuleName(e,n,t,i,void 0,void 0,r).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(s){for(let o of Sa(l))if(We(o))return o}return l}var mr=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],va=[".js",".json",".node"],Ia=["index.js","index.json","index.node"];function et(e){return!je(e)&&mr.some(n=>e.endsWith(n))}function hr(e){if(We(e))return e;for(let n of va)if(We(e+n))return e+n;return null}function ar(e){for(let n of Ia){let t=ee.join(e,n);if(We(t))return t}return null}var gr=[".ts",".tsx",".cts",".mts",".jsx"];function Aa(e){for(let n of gr)if(We(e+n))return e+n;return null}function _a(e){for(let n of gr){let t=ee.join(e,"index"+n);if(We(t))return t}return null}function yr(e){let n=Ne(ee.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let i=ee.join(e,t),r=hr(i)??ar(i);if(r!==null)return r}}catch{}return ar(e)}function xr(e){return hr(e)??yr(e)??Aa(e)??_a(e)}function Sr(e){return xr(e)!==null}function Na(e,n){let t=e.split(ee.sep),i=n.split("/"),r=null;for(let a=t.length-i.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&i.every((l,o)=>t[a+1+o]===l)){r=t.slice(0,a+1+i.length).join(ee.sep);break}if(r===null||r==="")return null;let s=Ne(ee.join(r,"package.json"));if(s===null)return null;try{let a=JSON.parse(s),l=a.exports,o=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||o)return null}catch{return null}try{return qt(r)}catch{return null}}function Ca(e,n){let t=xr(ee.join(e,n));if(t===null)return null;let i;try{i=qt(t)}catch{return null}let r=e.endsWith(ee.sep)?e:e+ee.sep;return i!==e&&!i.startsWith(r)||je(i)||!mr.some(s=>i.endsWith(s))?null:i}function Oa(e,n){let t=sr(e);return t===""||t.includes("\0")||t.split("/").some(i=>i===""||i==="."||i===".."||i==="node_modules")?null:Ca(n,t)}var un={kind:"nothing-loads"},Ut=8192;function Vt(e,n){let t=n.get(e);if(t!==void 0)return t;let i,r=null;try{r=xa(e);let s=new Set,a=!1;for(;;){let l=r.readSync();if(l===null)break;if(s.size>=Ut){a=!0;break}s.add(l.name)}i={names:s,truncated:a}}catch{i=null}finally{try{r?.closeSync()}catch{}}return n.set(e,i),i}var Ra=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function br(e){return Ra.some(n=>e.length>n.length&&e.endsWith(n))}function Rn(e,n){let t=e.endsWith(ee.sep)?e:e+ee.sep;return n===e||n.startsWith(t)}function lr(e,n){let t;try{t=qt(n)}catch{return{kind:"missing"}}return Rn(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function dr(e,n){let t=(n+".").toLowerCase(),i=[];for(let r of e){let s=r.toLowerCase();s.length>t.length&&s.startsWith(t)&&i.push(r)}return i}function $a(e,n,t){let i=ee.dirname(n);if(!Rn(e,i))return null;let r=Vt(i,t);if(r===null)return null;let s=ee.basename(n);return r.names.has(s)?s:null}function cr(e,n){let t=e.filter(r=>!br(r));if(t.length===0)return un;let i=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${i}") the analyzer cannot parse`}}function kr(e,n,t,i){let r=e,s=r.indexOf("?");s!==-1&&(r=r.slice(0,s));let a=r.indexOf("#");if(a!==-1&&(r=r.slice(0,a)),r===""||r.includes("\0"))return un;let l=ee.resolve(ee.dirname(n),r);if(!Rn(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed"};let o=lr(t,l);if(o.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed"};if(o.kind==="ok"){let h=or(o.real);if(h==="file"){let y=$a(t,o.real,i);return y!==null&&br(y)?un:{kind:"unanalyzable",reason:y===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${y}") the analyzer cannot parse`}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file"};let k=Vt(o.real,i);if(k===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let x=cr(dr(k.names,"index"),"a directory index");return x.kind==="unanalyzable"?x:k.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve"}:k.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Ut)} entries and was not fully probed`}:un}let c=ee.basename(l);if(c===""||c==="."||c==="..")return un;let u=lr(t,ee.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed"};if(u.kind==="missing")return un;let f=Vt(u.real,i);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let p=cr(dr(f.names,c),"a sibling file exists");return p.kind==="unanalyzable"?p:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Ut)} entries and was not fully probed`}:un}function Ma(e,n){let t=He(e),i=ee.dirname(n);for(let r=0;r<64;r+=1){let s=ee.join(i,"node_modules",...t.split("/"));if(Ne(ee.join(s,"package.json"))!==null)return s;let a=ee.dirname(i);if(a===i)return null;i=a}return null}function ur(e,n,t,i,r){let s;for(let a of Ea)for(let l of wa){let o={...t,noDtsResolution:!0,customConditions:[...l]},c=pr(e,n,o,i,a,r);if(s===void 0)s=c;else if(s!==c)return null}return s??null}function Pe(e,n,t,i){let r=me(e);if(r==="relative")return pr(e,n,t,i,void 0,!0);if(r==="package-root"){let l=ur(e,n,t,i,!0);if(l!==null)return l;let o=Ma(e,n);if(o===null||Ne(ee.join(o,"package.json"))?.includes('"exports"')===!0)return null;let c=yr(o);return c===null||je(c)?null:Rn(o,c)?c:null}let s=ur(e,n,t,i,!1);if(s===null)return null;let a=Na(s,He(e));return a!==null?Oa(e,a):je(s)?s:ka(s)}function Er(e,n,t){let i=Ne(ee.join(e,"tsconfig.json"));if(i===null)return()=>null;let r=Zn.parseConfigFileTextToJson(ee.join(e,"tsconfig.json"),i);if(r.error!==void 0)return()=>null;let s=r.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let a=s.paths;if(typeof a!="object"||a===null)return()=>null;let l=s.baseUrl,o=typeof l=="string"?ee.resolve(e,l):e,c=new Map,u=[];for(let[p,h]of Object.entries(a)){if(!Array.isArray(h))continue;let k=h.filter(y=>typeof y=="string");if(k.length===0)continue;let x=p.indexOf("*");x===-1?c.set(p,k):p.indexOf("*",x+1)===-1&&u.push({prefix:p.slice(0,x),suffix:p.slice(x+1),targets:k})}if(u.sort((p,h)=>h.prefix.length-p.prefix.length),c.size===0&&u.length===0)return()=>null;let f=p=>{let h=c.get(p);if(h!==void 0)return h;for(let k of u){if(p.length<k.prefix.length+k.suffix.length||!p.startsWith(k.prefix)||!p.endsWith(k.suffix))continue;let x=p.slice(k.prefix.length,p.length-k.suffix.length);return k.targets.map(y=>{let w=y.indexOf("*");return w===-1?y:y.slice(0,w)+x+y.slice(w+1)})}return[]};return(p,h)=>{let k=f(p);if(k.length===0||Pe(p,h,n,t)!==null)return null;for(let x of k){let y=ee.resolve(o,x),w=ee.relative(ee.dirname(h),y).split(ee.sep).join("/");if(w==="")continue;w.startsWith(".")||(w=`./${w}`);let N=Pe(w,h,n,t);if(N!==null&&Rn(e,N))return N}return null}}import{readdirSync as Pa,realpathSync as La}from"node:fs";import Ze from"node:path";import M from"typescript";function $n(e,n){if(M.isIdentifier(e))n.add(e.text);else for(let t of e.elements)M.isBindingElement(t)&&$n(t.name,n)}function kn(e){let n=new Map,t=new Set,i=o=>{n.set(o,(n.get(o)??0)+1)},r=o=>{let c=Ce(o);if(M.isIdentifier(c))t.add(c.text);else if(M.isArrayLiteralExpression(c))for(let u of c.elements)r(u);else if(M.isObjectLiteralExpression(c))for(let u of c.properties)M.isShorthandPropertyAssignment(u)?t.add(u.name.text):M.isPropertyAssignment(u)?r(u.initializer):M.isSpreadAssignment(u)&&r(u.expression);else M.isSpreadElement(c)?r(c.expression):M.isBinaryExpression(c)&&c.operatorToken.kind===M.SyntaxKind.EqualsToken&&r(c.left)},s=o=>{let c=new Set;$n(o,c);for(let u of c)i(u)},a=o=>{M.isVariableDeclaration(o)?s(o.name):M.isFunctionDeclaration(o)&&o.name!==void 0||M.isClassDeclaration(o)&&o.name!==void 0?i(o.name.text):M.isParameter(o)?s(o.name):((M.isFunctionExpression(o)||M.isClassExpression(o))&&o.name!==void 0&&M.isIdentifier(o.name)&&!(o.parent!==void 0&&M.isVariableDeclaration(o.parent)&&o.parent.initializer===o&&M.isIdentifier(o.parent.name)&&o.parent.name.text===o.name.text)||M.isImportClause(o)&&o.name!==void 0||M.isNamespaceImport(o)||M.isImportSpecifier(o)||M.isImportEqualsDeclaration(o))&&i(o.name.text),M.isBinaryExpression(o)&&o.operatorToken.kind>=M.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=M.SyntaxKind.LastAssignment?r(o.left):(M.isPrefixUnaryExpression(o)||M.isPostfixUnaryExpression(o))&&(o.operator===M.SyntaxKind.PlusPlusToken||o.operator===M.SyntaxKind.MinusMinusToken)?r(o.operand):(M.isForOfStatement(o)||M.isForInStatement(o))&&!M.isVariableDeclarationList(o.initializer)&&r(o.initializer),M.forEachChild(o,a)};a(e);let l=new Set(t);for(let[o,c]of n)c>1&&l.add(o);return l}function fn(e,n,t){let i=kn(e),r=new Map,s=a=>{M.isVariableDeclaration(a)&&M.isIdentifier(a.name)&&a.initializer!==void 0&&!i.has(a.name.text)&&!r.has(a.name.text)&&r.set(a.name.text,a.initializer),M.forEachChild(a,s)};return s(e),{containingFile:n,taintedNames:i,constBindings:r,resolveParamDirs:t}}var Ta=1024,Da=32,Fa=new Set(["filter","sort","slice","reverse"]),Ka=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ce(e){let n=e;for(;M.isParenthesizedExpression(n);)n=n.expression;return n}function wr(e,n){return M.isPropertyAccessExpression(e)&&M.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function sn(e,n,t,i){if(t>Da)return null;let r=Ce(e);if(M.isStringLiteralLike(r))return r.text;if(M.isTemplateExpression(r)){let s=r.head.text;for(let a of r.templateSpans){let l=sn(a.expression,n,t+1,i);if(l===null)return null;s+=l+a.literal.text}return s}if(M.isBinaryExpression(r)&&r.operatorToken.kind===M.SyntaxKind.PlusToken){let s=sn(r.left,n,t+1,i);if(s===null)return null;let a=sn(r.right,n,t+1,i);return a===null?null:s+a}if(M.isIdentifier(r)){if(r.text==="__dirname")return Ze.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||i.has(r.text))return null;let s=n.constBindings.get(r.text);if(s===void 0)return null;i.add(r.text);let a=sn(s,n,t+1,i);return i.delete(r.text),a}if(M.isCallExpression(r)){let s=wr(r.expression,"join"),a=wr(r.expression,"resolve");if(!s&&!a)return null;let l=[];for(let c of r.arguments){let u=sn(c,n,t+1,i);if(u===null)return null;l.push(u)}let o=l[0];return o===void 0||a&&!Ze.isAbsolute(o)?null:a?Ze.resolve(...l):Ze.join(...l)}return null}function nt(e){let n=Ce(e);if(M.isBinaryExpression(n)&&n.operatorToken.kind===M.SyntaxKind.PlusToken)return[...nt(n.left),...nt(n.right)];if(M.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let i of n.templateSpans)t.push({expr:i.expression}),i.literal.text.length>0&&t.push({lit:i.literal.text});return t}return M.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Ar(e){let n=e,t=0;for(;t++<4096;){let i=n.parent;if(i===void 0)return null;if(M.isForOfStatement(i)&&i.statement===n){let r=i.initializer;if(M.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&M.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let s=vr(i.expression);if(s!==null)return s}}if((M.isArrowFunction(n)||M.isFunctionExpression(n))&&M.isCallExpression(i)&&i.arguments.length>0&&i.arguments[0]===n&&M.isPropertyAccessExpression(i.expression)&&Ka.has(i.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&M.isIdentifier(r.name)&&r.name.text===e.text){let s=vr(i.expression.expression);if(s!==null)return s}}n=i}return null}function vr(e){let n=Ce(e),t=0;for(;M.isCallExpression(n)&&t++<16;){let i=n.expression;if(M.isPropertyAccessExpression(i)){let r=i.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(Fa.has(r)){n=Ce(i.expression);continue}return null}return M.isIdentifier(i)&&i.text==="readdirSync"?n.arguments[0]??null:null}return null}function ja(e,n){let t=nt(e);if(t.length<2)return null;let i=t[t.length-1];if(i===void 0||!("expr"in i)||!M.isIdentifier(i.expr))return null;let r=i.expr;if(n.taintedNames.has(r.text))return null;let s="";for(let c=0;c<t.length-1;c+=1){let u=t[c];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let f=sn(u.expr,n,0,new Set);if(f===null)return null;s+=f}}let a=Ar(r),l=a===null?null:sn(a,n,0,new Set);if(l===null)return null;let o=Ze.resolve(s);return o!==Ze.resolve(l)?null:o}function Ba(e){if((M.isFunctionDeclaration(e)||M.isFunctionExpression(e))&&e.name!==void 0&&M.isIdentifier(e.name)||M.isMethodDeclaration(e)&&M.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&M.isVariableDeclaration(n)&&M.isIdentifier(n.name)?n.name.text:null}function za(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!M.isFunctionLike(t))continue;let i=-1;for(let s=0;s<t.parameters.length;s+=1){let a=t.parameters[s];if(a!==void 0&&M.isIdentifier(a.name)&&a.name.text===n){i=s;break}}if(i<0)continue;let r=Ba(t);return r===null?null:{fnName:r,paramIndex:i}}return null}function Mn(e,n){let t=nt(e);if(t.length!==2)return null;let[i,r]=t;if(i===void 0||!("expr"in i)||!M.isIdentifier(i.expr)||r===void 0||!("expr"in r)||!M.isIdentifier(r.expr))return null;let s=i.expr,a=r.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(a.text))return null;let l=Ar(a);return l===null||!M.isIdentifier(l)||l.text!==s.text?null:za(s,s.text)}function Ua(e,n){if(n.resolveParamDirs===void 0)return null;let t=Mn(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function tt(e){for(let n=e.parent;n!==void 0;n=n.parent){if(M.isSourceFile(n))return!0;if(!M.isArrowFunction(n)&&M.isFunctionLike(n))return!1}return!0}function Ht(e,n){let t=sn(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let i=ja(e,n);if(i!==null)return{kind:"dir",dir:i};let r=Ua(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function _r(e,n){let t;try{t=La(e)}catch{return null}let i=n.endsWith(Ze.sep)?n:n+Ze.sep;return t===n||t.startsWith(i)?t:null}function Nr(e,n,t,i,r){let s=Pe(e,n,i,r);return s===null||je(s)||!et(s)?null:_r(s,t)}function Ir(e,n,t,i,r){let s=_r(e,t);if(s===null)return[];let a;try{a=Pa(s)}catch{return[]}if(a.length===0||a.length>Ta)return[];a.sort();let l=new Set,o=[];for(let c of a){let u=Nr(Ze.join(s,c),n,t,i,r);u!==null&&!l.has(u)&&(l.add(u),o.push(u))}return o}function it(e,n,t,i,r){let s=Ht(e,n);if(s.kind==="const"){if(me(s.value)==="package-root")return[];let a=Nr(s.value,n.containingFile,t,i,r);return a===null?[]:[a]}if(s.kind==="dir")return Ir(s.dir,n.containingFile,t,i,r);if(s.kind==="dirs"){let a=new Set,l=[];for(let o of s.dirs)for(let c of Ir(o,n.containingFile,t,i,r))a.has(c)||(a.add(c),l.push(c));return l}return[]}import Va from"node:path";import ne from"typescript";var qa=32,rt="\0",Cr=(e,n)=>`${e}${rt}${n}`,Or=(e,n,t)=>`${e}${rt}${n}${rt}${String(t)}`;function Ha(e){let n=new Map,t=new Set,i=(r,s)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,s)};for(let r of e.statements)if(ne.isImportDeclaration(r)&&ne.isStringLiteralLike(r.moduleSpecifier)){let s=r.moduleSpecifier.text,a=r.importClause;if(a===void 0)continue;a.name!==void 0&&i(a.name.text,{kind:"module",specifier:s});let l=a.namedBindings;if(l!==void 0&&ne.isNamespaceImport(l))i(l.name.text,{kind:"module",specifier:s});else if(l!==void 0&&ne.isNamedImports(l))for(let o of l.elements)i(o.name.text,{kind:"named",specifier:s,imported:(o.propertyName??o.name).text})}else if(ne.isImportEqualsDeclaration(r)&&ne.isExternalModuleReference(r.moduleReference)&&ne.isStringLiteralLike(r.moduleReference.expression))i(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(ne.isFunctionDeclaration(r)&&r.name!==void 0)i(r.name.text,{kind:"local"});else if(ne.isVariableStatement(r))for(let s of r.declarationList.declarations){if(s.initializer===void 0)continue;let a=s.initializer;if(ne.isIdentifier(s.name))ne.isArrowFunction(a)||ne.isFunctionExpression(a)?i(s.name.text,{kind:"local"}):Rr(a)&&i(s.name.text,{kind:"module",specifier:$r(a)});else if(ne.isObjectBindingPattern(s.name)&&Rr(a)){let l=$r(a);for(let o of s.name.elements){if(o.dotDotDotToken!==void 0||!ne.isIdentifier(o.name))continue;let c=o.propertyName??o.name;!ne.isIdentifier(c)&&!ne.isStringLiteralLike(c)||i(o.name.text,{kind:"named",specifier:l,imported:c.text})}}}return n}function Rr(e){return ne.isCallExpression(e)&&ne.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&ne.isStringLiteralLike(e.arguments[0])}function $r(e){let n=e.arguments[0];return n!==void 0&&ne.isStringLiteralLike(n)?n.text:"\0"}function Wa(e){let n=e.expression;if(ne.isPropertyAccessExpression(n))return n.name.text;if(ne.isIdentifier(n))return n.text}function Ga(e,n,t,i,r,s){let a=e.expression,l=o=>{let c=`${o}${rt}${n}`,u=s.get(c);if(u!==void 0||s.has(c))return u??null;let f=Pe(o,n,i,r),p=f===null?null:Va.resolve(f);return s.set(c,p),p};if(ne.isPropertyAccessExpression(a)&&ne.isIdentifier(a.expression)){let o=t.get(a.expression.text);if(o?.kind==="module"){let c=l(o.specifier);return c===null?null:{moduleReal:c,fnName:a.name.text}}return null}if(ne.isIdentifier(a)){let o=t.get(a.text);if(o?.kind==="named"){let c=l(o.specifier);return c===null?null:{moduleReal:c,fnName:o.imported}}return o?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function Mr(e,n,t,i,r=new Map){if(n.length===0)return()=>null;let s=new Map,a=new Set;for(let o of n){let c=Cr(o.definingModuleReal,o.fnName),u=s.get(c);u===void 0&&(u=new Set,s.set(c,u)),u.add(o.paramIndex),a.add(o.fnName)}let l=new Map;for(let o of e){let c=fn(o.sf,o.real),u=Ha(o.sf),f=p=>{if(ne.isCallExpression(p)){let h=Wa(p);if(h!==void 0&&a.has(h)&&tt(p)){let k=Ga(p,o.real,u,t,i,r);if(k!==null){let x=s.get(Cr(k.moduleReal,k.fnName));if(x!==void 0)for(let y of x){let w=p.arguments[y];if(w===void 0)continue;let N=Ht(w,c);if(N.kind==="const"){let R=Or(k.moduleReal,k.fnName,y),A=l.get(R);A===void 0&&(A=new Set,l.set(R,A)),A.add(N.value)}}}}}ne.forEachChild(p,f)};f(o.sf)}return(o,c,u)=>{let f=l.get(Or(o,c,u));return f===void 0||f.size===0||f.size>qa?null:[...f].sort()}}var Ge={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:g.ScriptTarget.ES2020,module:g.ModuleKind.CommonJS,moduleResolution:g.ModuleResolutionKind.Node10,types:[]},st=5e3;function Xe(e,n){let t;try{t=pn(n)}catch{t=ke.resolve(n)}let i=e.endsWith(ke.sep)?e:e+ke.sep;return t!==e&&!t.startsWith(i)?null:t===e?"":t.slice(i.length).split(ke.sep).join("/")}function ue(e){let n=e;for(;;)if(g.isParenthesizedExpression(n))n=n.expression;else if(g.isBinaryExpression(n)&&n.operatorToken.kind===g.SyntaxKind.CommaToken)n=n.right;else return n}function en(e){return g.isPropertyAccessExpression(e)?{receiver:ue(e.expression),name:e.name.text}:g.isElementAccessExpression(e)&&g.isStringLiteralLike(e.argumentExpression)?{receiver:ue(e.expression),name:e.argumentExpression.text}:null}function Tn(e){let n=ue(e.expression);if(g.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===g.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=en(n);if(t!==null){if(t.name==="require"&&g.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(g.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let i=e.arguments[1];return{specifierArg:i!==void 0&&g.isArrayLiteralExpression(i)?i.elements[0]:void 0}}}}return null}function Pr(e){let n=[],t=i=>{if(g.isImportDeclaration(i)&&g.isStringLiteralLike(i.moduleSpecifier))n.push({text:i.moduleSpecifier.text,runtime:i.importClause?.isTypeOnly!==!0});else if(g.isImportEqualsDeclaration(i)&&g.isExternalModuleReference(i.moduleReference)&&g.isStringLiteralLike(i.moduleReference.expression))n.push({text:i.moduleReference.expression.text,runtime:!0});else if(g.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&g.isStringLiteralLike(i.moduleSpecifier))n.push({text:i.moduleSpecifier.text,runtime:i.isTypeOnly!==!0});else if(g.isCallExpression(i)){let r=Tn(i),s=r?.specifierArg;r!==null&&s!==void 0&&g.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}g.forEachChild(i,t)};return t(e),n}function Ja(e,n){let t=n===g.ScriptKind.TSX?"__scriptkind_probe.tsx":n===g.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",i=g.createSourceFile(t,e,g.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:a=>a===t?i:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return g.createProgram({rootNames:[t],options:r,host:s}).getSyntacticDiagnostics(i).length}function Yt(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Lr(e){let n=0,t=i=>{(g.isCallExpression(i)||g.isNewExpression(i)||g.isTaggedTemplateExpression(i))&&(n+=1),g.forEachChild(i,t)};return t(e),n}function Fr(e,n){let t=Pr(g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0));if(!Yt(e)||!n.includes("<")||!n.includes("require"))return t;let i=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX),r=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Pr(i)){let a=`${s.runtime?"R":"T"}:${s.text}`;r.has(a)||(r.add(a),t.push(s))}return t}function Tr(e,n,t,i,r){if(!n.includes("require")&&!n.includes("import("))return[];let s=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0),a=fn(s,e,r),l=[],o=new Set;return Kr(s,c=>{for(let u of it(c,a,t,Ge,i))o.has(u)||(o.add(u),l.push(u))}),l}function Kr(e,n){let t=i=>{if(g.isCallExpression(i)){let r=Tn(i),s=r?.specifierArg;r!==null&&s!==void 0&&!g.isStringLiteralLike(s)&&n(s)}g.forEachChild(i,t)};t(e)}function Ya(e){let n=[];for(let t of e){let i=fn(t.sf,t.real);Kr(t.sf,r=>{let s=Mn(r,i);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var Qa=4,Wt=st,Gt=new Set(["eval","Function","createRequire"]),Za=new Set(["require","eval","Function","createRequire"]),lt=new Set(["module","Module","require","process","global","globalThis"]),dt=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function el(e){return e===g.SyntaxKind.LessThanToken||e===g.SyntaxKind.GreaterThanToken||e===g.SyntaxKind.LessThanEqualsToken||e===g.SyntaxKind.GreaterThanEqualsToken||e===g.SyntaxKind.EqualsEqualsToken||e===g.SyntaxKind.EqualsEqualsEqualsToken||e===g.SyntaxKind.ExclamationEqualsToken||e===g.SyntaxKind.ExclamationEqualsEqualsToken||e===g.SyntaxKind.InstanceOfKeyword||e===g.SyntaxKind.InKeyword}function nl(e){let n=e.parent;return(g.isParameter(n)||g.isVariableDeclaration(n)||g.isBindingElement(n)||g.isFunctionDeclaration(n)||g.isFunctionExpression(n)||g.isClassDeclaration(n)||g.isClassExpression(n)||g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isMethodDeclaration(n))&&n.name===e?!0:g.isPropertyAccessExpression(n)&&n.name===e}function tl(e,n){return g.isCallExpression(n)&&n.expression===e||(g.isPropertyAccessExpression(n)||g.isElementAccessExpression(n))&&n.expression===e||g.isTypeOfExpression(n)||g.isVoidExpression(n)||g.isDeleteExpression(n)||g.isPrefixUnaryExpression(n)||g.isPostfixUnaryExpression(n)?!0:g.isBinaryExpression(n)&&el(n.operatorToken.kind)}function jr(e){let n=e,t=e.parent;for(;;)if(g.isParenthesizedExpression(t))n=t,t=t.parent;else if(g.isBinaryExpression(t)&&t.operatorToken.kind===g.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!tl(n,t)}function il(e){return nl(e)?!1:jr(e)}function Br(e){let n=en(e);if(n!==null&&dt.has(n.name))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=ue(e.expression);if(g.isIdentifier(t)&&lt.has(t.text))return!0}return!1}function Pn(e){let n=en(e);if(n===null||n.name!=="constructor")return!1;let t=en(n.receiver);return t!==null&&t.name==="constructor"}function zr(e){if(!g.isCallExpression(e))return!1;let n=ue(e.expression);if(!g.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&g.isStringLiteralLike(t)&&t.text==="module"}var rl={roots:new Map,nodes:new Set,saturated:!1};function Ur(e){return g.isSourceFile(e)||g.isFunctionDeclaration(e)||g.isFunctionExpression(e)||g.isArrowFunction(e)||g.isMethodDeclaration(e)||g.isConstructorDeclaration(e)||g.isGetAccessorDeclaration(e)||g.isSetAccessorDeclaration(e)||g.isClassStaticBlockDeclaration(e)||g.isModuleDeclaration(e)}function Vr(e,n){let t=e.parent;for(;t!==void 0;){if(Ur(t))return t;t=t.parent}return n}function sl(e){let n=new Set;if(g.isFunctionLike(e))for(let i of e.parameters)for(let r of Ln(i.name))n.add(r);let t=[e];for(;t.length>0;){let i=t.pop();if(i===void 0)break;if(!(i!==e&&Ur(i))){if(g.isVariableDeclaration(i)&&g.isVariableDeclarationList(i.parent)&&!((i.parent.flags&g.NodeFlags.BlockScoped)!==0))for(let s of Ln(i.name))n.add(s);g.forEachChild(i,r=>{t.push(r)})}}return n}function ol(e,n,t){let i=Vr(e,n);if(g.isSourceFile(i))return n;let r=t.get(i);return r===void 0&&(r=sl(i),t.set(i,r)),r.has(e.text)?i:n}function ot(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let i=n;for(;;){if(t.has(i))return!0;let r=i.parent;if(r===void 0)return!g.isSourceFile(i);i=r}}var al=12,ll=8;function at(e,n){let t=ue(e);for(;;){if(n.nodes.has(t))return!0;if(g.isIdentifier(t))return lt.has(t.text)||ot(n,t);if(g.isCallExpression(t))return zr(t);let i=en(t);if(i!==null){if(i.name==="constructor")return!0;t=i.receiver;continue}if(g.isElementAccessExpression(t)){t=ue(t.expression);continue}return!1}}function qr(e){let n=en(ue(e.expression));if(n===null||n.name!=="get"||!g.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function dl(e,n){let t=qr(e);if(t===null||!at(t.target,n))return!1;let i=t.key;return i===void 0||!g.isStringLiteralLike(i)?!0:dt.has(i.text)}function Xt(e){if(!g.isFunctionExpression(e)&&!g.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,i=r=>{if(!(t||g.isFunctionExpression(r)||g.isFunctionDeclaration(r)||g.isClassLike(r))){if(g.isReturnStatement(r)&&r.expression!==void 0&&ue(r.expression).kind===g.SyntaxKind.ThisKeyword){t=!0;return}g.forEachChild(r,i)}};return i(n),t}function Ln(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isOmittedExpression(t)||n.push(...Ln(t.name));return n}function Hr(e){return e.parameters.map(n=>Ln(n.name))}function cl(e){let n=new Map,t=new Set,i=(s,a)=>{let l={fn:a,slots:Hr(a)},o=n.get(s);o===void 0?n.set(s,[l]):o.push(l),Xt(a)&&t.add(s)},r=s=>{if(g.isFunctionDeclaration(s)&&s.name!==void 0)i(s.name.text,s);else if(g.isVariableDeclaration(s)&&g.isIdentifier(s.name)&&s.initializer!==void 0){let a=ue(s.initializer);(g.isFunctionExpression(a)||g.isArrowFunction(a))&&i(s.name.text,a)}g.forEachChild(s,r)};return r(e),{params:n,thisReturning:t}}function ul(e){let n=new Map,t=new Set,i={roots:n,nodes:t},r=cl(e),s=new Map,a=new Set(r.thisReturning),l=!0;for(let o=0;l;o+=1){if(o>=al)return{roots:n,nodes:t,saturated:!0};l=!1;let c=(x,y)=>{y!==""&&!x.has(y)&&(x.add(y),l=!0)},u=(x,y)=>{if(x==="")return;let w=n.get(x);w===void 0&&(w=new Set,n.set(x,w)),w.has(y)||(w.add(y),l=!0)},f=x=>{t.has(x)||(t.add(x),l=!0)},p=(x,y)=>{let w=ue(x.expression);if(g.isIdentifier(w)&&Gt.has(w.text)||Pn(w)||g.isCallExpression(x)&&zr(x)||Xt(w))return!0;let N=en(w);if(N!==null&&(N.name==="call"||N.name==="apply"||N.name==="bind")){let R=N.receiver;if(Xt(R)||t.has(R)||g.isIdentifier(R)&&(ot(i,R)||a.has(R.text)))return!0}if(t.has(w)||(g.isCallExpression(w)||g.isNewExpression(w))&&p(w,y+1)||g.isIdentifier(w)&&(ot(i,w)||a.has(w.text)))return!0;if(g.isCallExpression(x)){let R=qr(x);if(R!==null&&at(R.target,i))return!0}return!1},h=(x,y)=>{if(y>=ll)return!0;let w=ue(x);if(t.has(w))return!0;if(g.isIdentifier(w))return lt.has(w.text)||ot(i,w);if(g.isBinaryExpression(w)){let N=w.operatorToken.kind;return N===g.SyntaxKind.BarBarToken||N===g.SyntaxKind.AmpersandAmpersandToken||N===g.SyntaxKind.QuestionQuestionToken?h(w.left,y+1)||h(w.right,y+1):!1}return g.isConditionalExpression(w)?h(w.whenTrue,y+1)||h(w.whenFalse,y+1):g.isPropertyAccessExpression(w)||g.isElementAccessExpression(w)?at(w,i):g.isCallExpression(w)||g.isNewExpression(w)?p(w,y+1):!1},k=(x,y)=>{if((g.isVariableDeclaration(x)||g.isParameter(x)||g.isBindingElement(x))&&x.initializer!==void 0){if(h(x.initializer,0)){let N=Vr(x,e);for(let R of Ln(x.name))u(R,N)}}else if(g.isBinaryExpression(x)&&x.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(x.left)&&h(x.right,0))u(x.left.text,ol(x.left,e,s));else if(g.isReturnStatement(x)&&x.expression!==void 0&&y!==void 0&&h(x.expression,0))c(a,y);else if(g.isCallExpression(x)||g.isNewExpression(x)){p(x,0)&&f(x);let N=ue(x.expression),R=en(N),A=R!==null&&R.name==="call",b=R!==null&&R.name==="apply",m=A||b?R.receiver:N,S=A?1:0,I=[];g.isFunctionExpression(m)||g.isArrowFunction(m)?I.push({fn:m,slots:Hr(m)}):g.isIdentifier(m)&&I.push(...r.params.get(m.text)??[]);let P=x.arguments??[];if(b){let U=P[1]===void 0?void 0:ue(P[1]);for(let{fn:_,slots:C}of I)if(U!==void 0&&g.isArrayLiteralExpression(U))for(let B=0;B<U.elements.length;B+=1){let V=U.elements[B],$=C[B];if(!(V===void 0||$===void 0)&&h(V,0))for(let H of $)u(H,_)}else if(U!==void 0)for(let B of C)for(let V of B)u(V,_)}else for(let{fn:U,slots:_}of I)for(let C=S;C<P.length;C+=1){let B=P[C],V=_[C-S];if(!(B===void 0||V===void 0)&&h(B,0))for(let $ of V)u($,U)}}let w=y;if(g.isFunctionDeclaration(x))w=x.name?.text;else if(g.isFunctionExpression(x)||g.isArrowFunction(x)){let N=x.parent;w=g.isVariableDeclaration(N)&&g.isIdentifier(N.name)?N.name.text:void 0}g.forEachChild(x,N=>k(N,w))};k(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function fl(e){if(g.isIdentifier(e)&&Gt.has(e.text)||Pn(e))return!0;let n=en(e);if(n!==null&&(dt.has(n.name)||(n.name==="call"||n.name==="apply")&&(g.isIdentifier(n.receiver)&&Gt.has(n.receiver.text)||Pn(n.receiver)||(g.isPropertyAccessExpression(n.receiver)||g.isElementAccessExpression(n.receiver))&&Br(n.receiver))))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=ue(e.expression);if(g.isIdentifier(t)&&lt.has(t.text))return!0}return!1}var pl=4;function Dr(e,n){for(let t of e){if(!g.isStringLiteralLike(t)||n>=pl)return!0;let i=g.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return c.map(f=>{let p=qe(f.id)??0;return{packageName:ce(f.package_name),modelId:ce(f.evidence_ref),introduced:ce(f.introduced),fixedBefore:ae(f.fixed_before),evidenceRef:ce(f.evidence_ref),edges:u.all({id:p}).map(h=>({kind:ce(h.kind),anchorExport:ce(h.anchor_export),anchorContainer:ae(h.anchor_container),calleePackage:ce(h.callee_package),calleeContainer:ae(h.callee_container),calleeExport:ce(h.callee_export)}))}})},close(){t.close()}}}var pn="5";import{realpathSync as Kn}from"node:fs";import nn from"node:path";import{realpathSync as gn}from"node:fs";import{isBuiltin as Ja}from"node:module";import Se from"node:path";import g from"typescript";function zt(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function ue(e){let n=zt(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function He(e){let n=zt(e);if(n.startsWith("@")){let i=n.indexOf("/");if(i===-1)return n;let r=n.indexOf("/",i+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function or(e){let n=zt(e),t=He(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as xa,statSync as Ut}from"node:fs";var rn=16*1024*1024;function En(e,n){try{let t=Ut(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:xa(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function _e(e){let n=En(e,rn);return n.kind==="ok"?n.text:null}function We(e){try{return Ut(e).isFile()}catch{return!1}}function ar(e){try{let n=Ut(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Sa,realpathSync as Ht}from"node:fs";import ee from"node:path";import et from"typescript";var pr=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function je(e){return pr.some(([n])=>e.endsWith(n))}function ba(e){for(let[n,t]of pr)if(e.endsWith(n)){let i=e.slice(0,-n.length);return t.map(r=>i+r)}return[]}var ka=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function Ea(e){if(je(e))return e;for(let[n,t]of ka)if(e.endsWith(n)){let i=e.slice(0,-n.length);for(let r of t){let s=i+r;if(We(s))return s}return e}return e}var wa=[et.ModuleKind.CommonJS,et.ModuleKind.ESNext],va=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function mr(e,n,t,i,r,s){let a=et.resolveModuleName(e,n,t,i,void 0,void 0,r).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(s){for(let o of ba(l))if(We(o))return o}return l}var hr=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],Ia=[".js",".json",".node"],Aa=["index.js","index.json","index.node"];function nt(e){return!je(e)&&hr.some(n=>e.endsWith(n))}function gr(e){if(We(e))return e;for(let n of Ia)if(We(e+n))return e+n;return null}function lr(e){for(let n of Aa){let t=ee.join(e,n);if(We(t))return t}return null}var yr=[".ts",".tsx",".cts",".mts",".jsx"];function _a(e){for(let n of yr)if(We(e+n))return e+n;return null}function Na(e){for(let n of yr){let t=ee.join(e,"index"+n);if(We(t))return t}return null}function xr(e){let n=_e(ee.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let i=ee.join(e,t),r=gr(i)??lr(i);if(r!==null)return r}}catch{}return lr(e)}function Sr(e){return gr(e)??xr(e)??_a(e)??Na(e)}function br(e){return Sr(e)!==null}function Ca(e,n){let t=e.split(ee.sep),i=n.split("/"),r=null;for(let a=t.length-i.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&i.every((l,o)=>t[a+1+o]===l)){r=t.slice(0,a+1+i.length).join(ee.sep);break}if(r===null||r==="")return null;let s=_e(ee.join(r,"package.json"));if(s===null)return null;try{let a=JSON.parse(s),l=a.exports,o=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||o)return null}catch{return null}try{return Ht(r)}catch{return null}}function Oa(e,n){let t=Sr(ee.join(e,n));if(t===null)return null;let i;try{i=Ht(t)}catch{return null}let r=e.endsWith(ee.sep)?e:e+ee.sep;return i!==e&&!i.startsWith(r)||je(i)||!hr.some(s=>i.endsWith(s))?null:i}function Ra(e,n){let t=or(e);return t===""||t.includes("\0")||t.split("/").some(i=>i===""||i==="."||i===".."||i==="node_modules")?null:Oa(n,t)}var mn={kind:"nothing-loads"},Vt=8192;function qt(e,n){let t=n.get(e);if(t!==void 0)return t;let i,r=null;try{r=Sa(e);let s=new Set,a=!1;for(;;){let l=r.readSync();if(l===null)break;if(s.size>=Vt){a=!0;break}s.add(l.name)}i={names:s,truncated:a}}catch{i=null}finally{try{r?.closeSync()}catch{}}return n.set(e,i),i}var $a=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function kr(e){return $a.some(n=>e.length>n.length&&e.endsWith(n))}function $n(e,n){let t=e.endsWith(ee.sep)?e:e+ee.sep;return n===e||n.startsWith(t)}function dr(e,n){let t;try{t=Ht(n)}catch{return{kind:"missing"}}return $n(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function cr(e,n){let t=(n+".").toLowerCase(),i=[];for(let r of e){let s=r.toLowerCase();s.length>t.length&&s.startsWith(t)&&i.push(r)}return i}function Ma(e,n,t){let i=ee.dirname(n);if(!$n(e,i))return null;let r=qt(i,t);if(r===null)return null;let s=ee.basename(n);return r.names.has(s)?s:null}function ur(e,n){let t=e.filter(r=>!kr(r));if(t.length===0)return mn;let i=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${i}") the analyzer cannot parse`}}function Er(e,n,t,i){let r=e,s=r.indexOf("?");s!==-1&&(r=r.slice(0,s));let a=r.indexOf("#");if(a!==-1&&(r=r.slice(0,a)),r===""||r.includes("\0"))return mn;let l=ee.resolve(ee.dirname(n),r);if(!$n(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed"};let o=dr(t,l);if(o.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed"};if(o.kind==="ok"){let h=ar(o.real);if(h==="file"){let y=Ma(t,o.real,i);return y!==null&&kr(y)?mn:{kind:"unanalyzable",reason:y===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${y}") the analyzer cannot parse`}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file"};let E=qt(o.real,i);if(E===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let x=ur(cr(E.names,"index"),"a directory index");return x.kind==="unanalyzable"?x:E.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve"}:E.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Vt)} entries and was not fully probed`}:mn}let c=ee.basename(l);if(c===""||c==="."||c==="..")return mn;let u=dr(t,ee.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed"};if(u.kind==="missing")return mn;let f=qt(u.real,i);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let p=ur(cr(f.names,c),"a sibling file exists");return p.kind==="unanalyzable"?p:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Vt)} entries and was not fully probed`}:mn}function Pa(e,n){let t=He(e),i=ee.dirname(n);for(let r=0;r<64;r+=1){let s=ee.join(i,"node_modules",...t.split("/"));if(_e(ee.join(s,"package.json"))!==null)return s;let a=ee.dirname(i);if(a===i)return null;i=a}return null}function fr(e,n,t,i,r){let s;for(let a of wa)for(let l of va){let o={...t,noDtsResolution:!0,customConditions:[...l]},c=mr(e,n,o,i,a,r);if(s===void 0)s=c;else if(s!==c)return null}return s??null}function Te(e,n,t,i){let r=ue(e);if(r==="relative")return mr(e,n,t,i,void 0,!0);if(r==="package-root"){let l=fr(e,n,t,i,!0);if(l!==null)return l;let o=Pa(e,n);if(o===null||_e(ee.join(o,"package.json"))?.includes('"exports"')===!0)return null;let c=xr(o);return c===null||je(c)?null:$n(o,c)?c:null}let s=fr(e,n,t,i,!1);if(s===null)return null;let a=Ca(s,He(e));return a!==null?Ra(e,a):je(s)?s:Ea(s)}function wr(e,n,t){let i=_e(ee.join(e,"tsconfig.json"));if(i===null)return()=>null;let r=et.parseConfigFileTextToJson(ee.join(e,"tsconfig.json"),i);if(r.error!==void 0)return()=>null;let s=r.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let a=s.paths;if(typeof a!="object"||a===null)return()=>null;let l=s.baseUrl,o=typeof l=="string"?ee.resolve(e,l):e,c=new Map,u=[];for(let[p,h]of Object.entries(a)){if(!Array.isArray(h))continue;let E=h.filter(y=>typeof y=="string");if(E.length===0)continue;let x=p.indexOf("*");x===-1?c.set(p,E):p.indexOf("*",x+1)===-1&&u.push({prefix:p.slice(0,x),suffix:p.slice(x+1),targets:E})}if(u.sort((p,h)=>h.prefix.length-p.prefix.length),c.size===0&&u.length===0)return()=>null;let f=p=>{let h=c.get(p);if(h!==void 0)return h;for(let E of u){if(p.length<E.prefix.length+E.suffix.length||!p.startsWith(E.prefix)||!p.endsWith(E.suffix))continue;let x=p.slice(E.prefix.length,p.length-E.suffix.length);return E.targets.map(y=>{let v=y.indexOf("*");return v===-1?y:y.slice(0,v)+x+y.slice(v+1)})}return[]};return(p,h)=>{let E=f(p);if(E.length===0||Te(p,h,n,t)!==null)return null;for(let x of E){let y=ee.resolve(o,x),v=ee.relative(ee.dirname(h),y).split(ee.sep).join("/");if(v==="")continue;v.startsWith(".")||(v=`./${v}`);let N=Te(v,h,n,t);if(N!==null&&$n(e,N))return N}return null}}import{readdirSync as La,realpathSync as Ta}from"node:fs";import Ze from"node:path";import L from"typescript";function Mn(e,n){if(L.isIdentifier(e))n.add(e.text);else for(let t of e.elements)L.isBindingElement(t)&&Mn(t.name,n)}function wn(e){let n=new Map,t=new Set,i=o=>{n.set(o,(n.get(o)??0)+1)},r=o=>{let c=Ne(o);if(L.isIdentifier(c))t.add(c.text);else if(L.isArrayLiteralExpression(c))for(let u of c.elements)r(u);else if(L.isObjectLiteralExpression(c))for(let u of c.properties)L.isShorthandPropertyAssignment(u)?t.add(u.name.text):L.isPropertyAssignment(u)?r(u.initializer):L.isSpreadAssignment(u)&&r(u.expression);else L.isSpreadElement(c)?r(c.expression):L.isBinaryExpression(c)&&c.operatorToken.kind===L.SyntaxKind.EqualsToken&&r(c.left)},s=o=>{let c=new Set;Mn(o,c);for(let u of c)i(u)},a=o=>{L.isVariableDeclaration(o)?s(o.name):L.isFunctionDeclaration(o)&&o.name!==void 0||L.isClassDeclaration(o)&&o.name!==void 0?i(o.name.text):L.isParameter(o)?s(o.name):((L.isFunctionExpression(o)||L.isClassExpression(o))&&o.name!==void 0&&L.isIdentifier(o.name)&&!(o.parent!==void 0&&L.isVariableDeclaration(o.parent)&&o.parent.initializer===o&&L.isIdentifier(o.parent.name)&&o.parent.name.text===o.name.text)||L.isImportClause(o)&&o.name!==void 0||L.isNamespaceImport(o)||L.isImportSpecifier(o)||L.isImportEqualsDeclaration(o))&&i(o.name.text),L.isBinaryExpression(o)&&o.operatorToken.kind>=L.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=L.SyntaxKind.LastAssignment?r(o.left):(L.isPrefixUnaryExpression(o)||L.isPostfixUnaryExpression(o))&&(o.operator===L.SyntaxKind.PlusPlusToken||o.operator===L.SyntaxKind.MinusMinusToken)?r(o.operand):(L.isForOfStatement(o)||L.isForInStatement(o))&&!L.isVariableDeclarationList(o.initializer)&&r(o.initializer),L.forEachChild(o,a)};a(e);let l=new Set(t);for(let[o,c]of n)c>1&&l.add(o);return l}function hn(e,n,t){let i=wn(e),r=new Map,s=a=>{L.isVariableDeclaration(a)&&L.isIdentifier(a.name)&&a.initializer!==void 0&&!i.has(a.name.text)&&!r.has(a.name.text)&&r.set(a.name.text,a.initializer),L.forEachChild(a,s)};return s(e),{containingFile:n,taintedNames:i,constBindings:r,resolveParamDirs:t}}var Da=1024,Fa=32,Ka=new Set(["filter","sort","slice","reverse"]),ja=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ne(e){let n=e;for(;L.isParenthesizedExpression(n);)n=n.expression;return n}function vr(e,n){return L.isPropertyAccessExpression(e)&&L.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function sn(e,n,t,i){if(t>Fa)return null;let r=Ne(e);if(L.isStringLiteralLike(r))return r.text;if(L.isTemplateExpression(r)){let s=r.head.text;for(let a of r.templateSpans){let l=sn(a.expression,n,t+1,i);if(l===null)return null;s+=l+a.literal.text}return s}if(L.isBinaryExpression(r)&&r.operatorToken.kind===L.SyntaxKind.PlusToken){let s=sn(r.left,n,t+1,i);if(s===null)return null;let a=sn(r.right,n,t+1,i);return a===null?null:s+a}if(L.isIdentifier(r)){if(r.text==="__dirname")return Ze.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||i.has(r.text))return null;let s=n.constBindings.get(r.text);if(s===void 0)return null;i.add(r.text);let a=sn(s,n,t+1,i);return i.delete(r.text),a}if(L.isCallExpression(r)){let s=vr(r.expression,"join"),a=vr(r.expression,"resolve");if(!s&&!a)return null;let l=[];for(let c of r.arguments){let u=sn(c,n,t+1,i);if(u===null)return null;l.push(u)}let o=l[0];return o===void 0||a&&!Ze.isAbsolute(o)?null:a?Ze.resolve(...l):Ze.join(...l)}return null}function tt(e){let n=Ne(e);if(L.isBinaryExpression(n)&&n.operatorToken.kind===L.SyntaxKind.PlusToken)return[...tt(n.left),...tt(n.right)];if(L.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let i of n.templateSpans)t.push({expr:i.expression}),i.literal.text.length>0&&t.push({lit:i.literal.text});return t}return L.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function _r(e){let n=e,t=0;for(;t++<4096;){let i=n.parent;if(i===void 0)return null;if(L.isForOfStatement(i)&&i.statement===n){let r=i.initializer;if(L.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&L.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let s=Ir(i.expression);if(s!==null)return s}}if((L.isArrowFunction(n)||L.isFunctionExpression(n))&&L.isCallExpression(i)&&i.arguments.length>0&&i.arguments[0]===n&&L.isPropertyAccessExpression(i.expression)&&ja.has(i.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&L.isIdentifier(r.name)&&r.name.text===e.text){let s=Ir(i.expression.expression);if(s!==null)return s}}n=i}return null}function Ir(e){let n=Ne(e),t=0;for(;L.isCallExpression(n)&&t++<16;){let i=n.expression;if(L.isPropertyAccessExpression(i)){let r=i.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(Ka.has(r)){n=Ne(i.expression);continue}return null}return L.isIdentifier(i)&&i.text==="readdirSync"?n.arguments[0]??null:null}return null}function Ba(e,n){let t=tt(e);if(t.length<2)return null;let i=t[t.length-1];if(i===void 0||!("expr"in i)||!L.isIdentifier(i.expr))return null;let r=i.expr;if(n.taintedNames.has(r.text))return null;let s="";for(let c=0;c<t.length-1;c+=1){let u=t[c];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let f=sn(u.expr,n,0,new Set);if(f===null)return null;s+=f}}let a=_r(r),l=a===null?null:sn(a,n,0,new Set);if(l===null)return null;let o=Ze.resolve(s);return o!==Ze.resolve(l)?null:o}function za(e){if((L.isFunctionDeclaration(e)||L.isFunctionExpression(e))&&e.name!==void 0&&L.isIdentifier(e.name)||L.isMethodDeclaration(e)&&L.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&L.isVariableDeclaration(n)&&L.isIdentifier(n.name)?n.name.text:null}function Ua(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!L.isFunctionLike(t))continue;let i=-1;for(let s=0;s<t.parameters.length;s+=1){let a=t.parameters[s];if(a!==void 0&&L.isIdentifier(a.name)&&a.name.text===n){i=s;break}}if(i<0)continue;let r=za(t);return r===null?null:{fnName:r,paramIndex:i}}return null}function Pn(e,n){let t=tt(e);if(t.length!==2)return null;let[i,r]=t;if(i===void 0||!("expr"in i)||!L.isIdentifier(i.expr)||r===void 0||!("expr"in r)||!L.isIdentifier(r.expr))return null;let s=i.expr,a=r.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(a.text))return null;let l=_r(a);return l===null||!L.isIdentifier(l)||l.text!==s.text?null:Ua(s,s.text)}function Va(e,n){if(n.resolveParamDirs===void 0)return null;let t=Pn(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function it(e){for(let n=e.parent;n!==void 0;n=n.parent){if(L.isSourceFile(n))return!0;if(!L.isArrowFunction(n)&&L.isFunctionLike(n))return!1}return!0}function Wt(e,n){let t=sn(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let i=Ba(e,n);if(i!==null)return{kind:"dir",dir:i};let r=Va(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function Nr(e,n){let t;try{t=Ta(e)}catch{return null}let i=n.endsWith(Ze.sep)?n:n+Ze.sep;return t===n||t.startsWith(i)?t:null}function Cr(e,n,t,i,r){let s=Te(e,n,i,r);return s===null||je(s)||!nt(s)?null:Nr(s,t)}function Ar(e,n,t,i,r){let s=Nr(e,t);if(s===null)return[];let a;try{a=La(s)}catch{return[]}if(a.length===0||a.length>Da)return[];a.sort();let l=new Set,o=[];for(let c of a){let u=Cr(Ze.join(s,c),n,t,i,r);u!==null&&!l.has(u)&&(l.add(u),o.push(u))}return o}function rt(e,n,t,i,r){let s=Wt(e,n);if(s.kind==="const"){if(ue(s.value)==="package-root")return[];let a=Cr(s.value,n.containingFile,t,i,r);return a===null?[]:[a]}if(s.kind==="dir")return Ar(s.dir,n.containingFile,t,i,r);if(s.kind==="dirs"){let a=new Set,l=[];for(let o of s.dirs)for(let c of Ar(o,n.containingFile,t,i,r))a.has(c)||(a.add(c),l.push(c));return l}return[]}import qa from"node:path";import ne from"typescript";var Ha=32,st="\0",Or=(e,n)=>`${e}${st}${n}`,Rr=(e,n,t)=>`${e}${st}${n}${st}${String(t)}`;function Wa(e){let n=new Map,t=new Set,i=(r,s)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,s)};for(let r of e.statements)if(ne.isImportDeclaration(r)&&ne.isStringLiteralLike(r.moduleSpecifier)){let s=r.moduleSpecifier.text,a=r.importClause;if(a===void 0)continue;a.name!==void 0&&i(a.name.text,{kind:"module",specifier:s});let l=a.namedBindings;if(l!==void 0&&ne.isNamespaceImport(l))i(l.name.text,{kind:"module",specifier:s});else if(l!==void 0&&ne.isNamedImports(l))for(let o of l.elements)i(o.name.text,{kind:"named",specifier:s,imported:(o.propertyName??o.name).text})}else if(ne.isImportEqualsDeclaration(r)&&ne.isExternalModuleReference(r.moduleReference)&&ne.isStringLiteralLike(r.moduleReference.expression))i(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(ne.isFunctionDeclaration(r)&&r.name!==void 0)i(r.name.text,{kind:"local"});else if(ne.isVariableStatement(r))for(let s of r.declarationList.declarations){if(s.initializer===void 0)continue;let a=s.initializer;if(ne.isIdentifier(s.name))ne.isArrowFunction(a)||ne.isFunctionExpression(a)?i(s.name.text,{kind:"local"}):$r(a)&&i(s.name.text,{kind:"module",specifier:Mr(a)});else if(ne.isObjectBindingPattern(s.name)&&$r(a)){let l=Mr(a);for(let o of s.name.elements){if(o.dotDotDotToken!==void 0||!ne.isIdentifier(o.name))continue;let c=o.propertyName??o.name;!ne.isIdentifier(c)&&!ne.isStringLiteralLike(c)||i(o.name.text,{kind:"named",specifier:l,imported:c.text})}}}return n}function $r(e){return ne.isCallExpression(e)&&ne.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&ne.isStringLiteralLike(e.arguments[0])}function Mr(e){let n=e.arguments[0];return n!==void 0&&ne.isStringLiteralLike(n)?n.text:"\0"}function Ga(e){let n=e.expression;if(ne.isPropertyAccessExpression(n))return n.name.text;if(ne.isIdentifier(n))return n.text}function Xa(e,n,t,i,r,s){let a=e.expression,l=o=>{let c=`${o}${st}${n}`,u=s.get(c);if(u!==void 0||s.has(c))return u??null;let f=Te(o,n,i,r),p=f===null?null:qa.resolve(f);return s.set(c,p),p};if(ne.isPropertyAccessExpression(a)&&ne.isIdentifier(a.expression)){let o=t.get(a.expression.text);if(o?.kind==="module"){let c=l(o.specifier);return c===null?null:{moduleReal:c,fnName:a.name.text}}return null}if(ne.isIdentifier(a)){let o=t.get(a.text);if(o?.kind==="named"){let c=l(o.specifier);return c===null?null:{moduleReal:c,fnName:o.imported}}return o?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function Pr(e,n,t,i,r=new Map){if(n.length===0)return()=>null;let s=new Map,a=new Set;for(let o of n){let c=Or(o.definingModuleReal,o.fnName),u=s.get(c);u===void 0&&(u=new Set,s.set(c,u)),u.add(o.paramIndex),a.add(o.fnName)}let l=new Map;for(let o of e){let c=hn(o.sf,o.real),u=Wa(o.sf),f=p=>{if(ne.isCallExpression(p)){let h=Ga(p);if(h!==void 0&&a.has(h)&&it(p)){let E=Xa(p,o.real,u,t,i,r);if(E!==null){let x=s.get(Or(E.moduleReal,E.fnName));if(x!==void 0)for(let y of x){let v=p.arguments[y];if(v===void 0)continue;let N=Wt(v,c);if(N.kind==="const"){let R=Rr(E.moduleReal,E.fnName,y),A=l.get(R);A===void 0&&(A=new Set,l.set(R,A)),A.add(N.value)}}}}}ne.forEachChild(p,f)};f(o.sf)}return(o,c,u)=>{let f=l.get(Rr(o,c,u));return f===void 0||f.size===0||f.size>Ha?null:[...f].sort()}}var Ge={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:g.ScriptTarget.ES2020,module:g.ModuleKind.CommonJS,moduleResolution:g.ModuleResolutionKind.Node10,types:[]},ot=5e3;function Xe(e,n){let t;try{t=gn(n)}catch{t=Se.resolve(n)}let i=e.endsWith(Se.sep)?e:e+Se.sep;return t!==e&&!t.startsWith(i)?null:t===e?"":t.slice(i.length).split(Se.sep).join("/")}function le(e){let n=e;for(;;)if(g.isParenthesizedExpression(n))n=n.expression;else if(g.isBinaryExpression(n)&&n.operatorToken.kind===g.SyntaxKind.CommaToken)n=n.right;else return n}function en(e){return g.isPropertyAccessExpression(e)?{receiver:le(e.expression),name:e.name.text}:g.isElementAccessExpression(e)&&g.isStringLiteralLike(e.argumentExpression)?{receiver:le(e.expression),name:e.argumentExpression.text}:null}function Dn(e){let n=le(e.expression);if(g.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===g.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=en(n);if(t!==null){if(t.name==="require"&&g.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(g.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let i=e.arguments[1];return{specifierArg:i!==void 0&&g.isArrayLiteralExpression(i)?i.elements[0]:void 0}}}}return null}function Lr(e){let n=[],t=i=>{if(g.isImportDeclaration(i)&&g.isStringLiteralLike(i.moduleSpecifier))n.push({text:i.moduleSpecifier.text,runtime:i.importClause?.isTypeOnly!==!0});else if(g.isImportEqualsDeclaration(i)&&g.isExternalModuleReference(i.moduleReference)&&g.isStringLiteralLike(i.moduleReference.expression))n.push({text:i.moduleReference.expression.text,runtime:!0});else if(g.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&g.isStringLiteralLike(i.moduleSpecifier))n.push({text:i.moduleSpecifier.text,runtime:i.isTypeOnly!==!0});else if(g.isCallExpression(i)){let r=Dn(i),s=r?.specifierArg;r!==null&&s!==void 0&&g.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}g.forEachChild(i,t)};return t(e),n}function Ya(e,n){let t=n===g.ScriptKind.TSX?"__scriptkind_probe.tsx":n===g.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",i=g.createSourceFile(t,e,g.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:a=>a===t?i:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return g.createProgram({rootNames:[t],options:r,host:s}).getSyntacticDiagnostics(i).length}function Qt(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Tr(e){let n=0,t=i=>{(g.isCallExpression(i)||g.isNewExpression(i)||g.isTaggedTemplateExpression(i))&&(n+=1),g.forEachChild(i,t)};return t(e),n}function Kr(e,n){let t=Lr(g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0));if(!Qt(e)||!n.includes("<")||!n.includes("require"))return t;let i=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX),r=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Lr(i)){let a=`${s.runtime?"R":"T"}:${s.text}`;r.has(a)||(r.add(a),t.push(s))}return t}function Dr(e,n,t,i,r){if(!n.includes("require")&&!n.includes("import("))return[];let s=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0),a=hn(s,e,r),l=[],o=new Set;return jr(s,c=>{for(let u of rt(c,a,t,Ge,i))o.has(u)||(o.add(u),l.push(u))}),l}function jr(e,n){let t=i=>{if(g.isCallExpression(i)){let r=Dn(i),s=r?.specifierArg;r!==null&&s!==void 0&&!g.isStringLiteralLike(s)&&n(s)}g.forEachChild(i,t)};t(e)}function Qa(e){let n=[];for(let t of e){let i=hn(t.sf,t.real);jr(t.sf,r=>{let s=Pn(r,i);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var Za=4,Gt=ot,Xt=new Set(["eval","Function","createRequire"]),el=new Set(["require","eval","Function","createRequire"]),dt=new Set(["module","Module","require","process","global","globalThis"]),ct=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function nl(e){return e===g.SyntaxKind.LessThanToken||e===g.SyntaxKind.GreaterThanToken||e===g.SyntaxKind.LessThanEqualsToken||e===g.SyntaxKind.GreaterThanEqualsToken||e===g.SyntaxKind.EqualsEqualsToken||e===g.SyntaxKind.EqualsEqualsEqualsToken||e===g.SyntaxKind.ExclamationEqualsToken||e===g.SyntaxKind.ExclamationEqualsEqualsToken||e===g.SyntaxKind.InstanceOfKeyword||e===g.SyntaxKind.InKeyword}function tl(e){let n=e.parent;return(g.isParameter(n)||g.isVariableDeclaration(n)||g.isBindingElement(n)||g.isFunctionDeclaration(n)||g.isFunctionExpression(n)||g.isClassDeclaration(n)||g.isClassExpression(n)||g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isMethodDeclaration(n))&&n.name===e?!0:g.isPropertyAccessExpression(n)&&n.name===e}function il(e,n){return g.isCallExpression(n)&&n.expression===e||(g.isPropertyAccessExpression(n)||g.isElementAccessExpression(n))&&n.expression===e||g.isTypeOfExpression(n)||g.isVoidExpression(n)||g.isDeleteExpression(n)||g.isPrefixUnaryExpression(n)||g.isPostfixUnaryExpression(n)?!0:g.isBinaryExpression(n)&&nl(n.operatorToken.kind)}function Br(e){let n=e,t=e.parent;for(;;)if(g.isParenthesizedExpression(t))n=t,t=t.parent;else if(g.isBinaryExpression(t)&&t.operatorToken.kind===g.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!il(n,t)}function rl(e){return tl(e)?!1:Br(e)}function zr(e){let n=en(e);if(n!==null&&ct.has(n.name))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=le(e.expression);if(g.isIdentifier(t)&&dt.has(t.text))return!0}return!1}function Ln(e){let n=en(e);if(n===null||n.name!=="constructor")return!1;let t=en(n.receiver);return t!==null&&t.name==="constructor"}function Ur(e){if(!g.isCallExpression(e))return!1;let n=le(e.expression);if(!g.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&g.isStringLiteralLike(t)&&t.text==="module"}var sl={roots:new Map,nodes:new Set,saturated:!1};function Vr(e){return g.isSourceFile(e)||g.isFunctionDeclaration(e)||g.isFunctionExpression(e)||g.isArrowFunction(e)||g.isMethodDeclaration(e)||g.isConstructorDeclaration(e)||g.isGetAccessorDeclaration(e)||g.isSetAccessorDeclaration(e)||g.isClassStaticBlockDeclaration(e)||g.isModuleDeclaration(e)}function qr(e,n){let t=e.parent;for(;t!==void 0;){if(Vr(t))return t;t=t.parent}return n}function ol(e){let n=new Set;if(g.isFunctionLike(e))for(let i of e.parameters)for(let r of Tn(i.name))n.add(r);let t=[e];for(;t.length>0;){let i=t.pop();if(i===void 0)break;if(!(i!==e&&Vr(i))){if(g.isVariableDeclaration(i)&&g.isVariableDeclarationList(i.parent)&&!((i.parent.flags&g.NodeFlags.BlockScoped)!==0))for(let s of Tn(i.name))n.add(s);g.forEachChild(i,r=>{t.push(r)})}}return n}function al(e,n,t){let i=qr(e,n);if(g.isSourceFile(i))return n;let r=t.get(i);return r===void 0&&(r=ol(i),t.set(i,r)),r.has(e.text)?i:n}function at(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let i=n;for(;;){if(t.has(i))return!0;let r=i.parent;if(r===void 0)return!g.isSourceFile(i);i=r}}var ll=12,dl=8;function lt(e,n){let t=le(e);for(;;){if(n.nodes.has(t))return!0;if(g.isIdentifier(t))return dt.has(t.text)||at(n,t);if(g.isCallExpression(t))return Ur(t);let i=en(t);if(i!==null){if(i.name==="constructor")return!0;t=i.receiver;continue}if(g.isElementAccessExpression(t)){t=le(t.expression);continue}return!1}}function Hr(e){let n=en(le(e.expression));if(n===null||n.name!=="get"||!g.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function cl(e,n){let t=Hr(e);if(t===null||!lt(t.target,n))return!1;let i=t.key;return i===void 0||!g.isStringLiteralLike(i)?!0:ct.has(i.text)}function Jt(e){if(!g.isFunctionExpression(e)&&!g.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,i=r=>{if(!(t||g.isFunctionExpression(r)||g.isFunctionDeclaration(r)||g.isClassLike(r))){if(g.isReturnStatement(r)&&r.expression!==void 0&&le(r.expression).kind===g.SyntaxKind.ThisKeyword){t=!0;return}g.forEachChild(r,i)}};return i(n),t}function Tn(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isOmittedExpression(t)||n.push(...Tn(t.name));return n}function Wr(e){return e.parameters.map(n=>Tn(n.name))}function ul(e){let n=new Map,t=new Set,i=(s,a)=>{let l={fn:a,slots:Wr(a)},o=n.get(s);o===void 0?n.set(s,[l]):o.push(l),Jt(a)&&t.add(s)},r=s=>{if(g.isFunctionDeclaration(s)&&s.name!==void 0)i(s.name.text,s);else if(g.isVariableDeclaration(s)&&g.isIdentifier(s.name)&&s.initializer!==void 0){let a=le(s.initializer);(g.isFunctionExpression(a)||g.isArrowFunction(a))&&i(s.name.text,a)}g.forEachChild(s,r)};return r(e),{params:n,thisReturning:t}}function fl(e){let n=new Map,t=new Set,i={roots:n,nodes:t},r=ul(e),s=new Map,a=new Set(r.thisReturning),l=!0;for(let o=0;l;o+=1){if(o>=ll)return{roots:n,nodes:t,saturated:!0};l=!1;let c=(x,y)=>{y!==""&&!x.has(y)&&(x.add(y),l=!0)},u=(x,y)=>{if(x==="")return;let v=n.get(x);v===void 0&&(v=new Set,n.set(x,v)),v.has(y)||(v.add(y),l=!0)},f=x=>{t.has(x)||(t.add(x),l=!0)},p=(x,y)=>{let v=le(x.expression);if(g.isIdentifier(v)&&Xt.has(v.text)||Ln(v)||g.isCallExpression(x)&&Ur(x)||Jt(v))return!0;let N=en(v);if(N!==null&&(N.name==="call"||N.name==="apply"||N.name==="bind")){let R=N.receiver;if(Jt(R)||t.has(R)||g.isIdentifier(R)&&(at(i,R)||a.has(R.text)))return!0}if(t.has(v)||(g.isCallExpression(v)||g.isNewExpression(v))&&p(v,y+1)||g.isIdentifier(v)&&(at(i,v)||a.has(v.text)))return!0;if(g.isCallExpression(x)){let R=Hr(x);if(R!==null&&lt(R.target,i))return!0}return!1},h=(x,y)=>{if(y>=dl)return!0;let v=le(x);if(t.has(v))return!0;if(g.isIdentifier(v))return dt.has(v.text)||at(i,v);if(g.isBinaryExpression(v)){let N=v.operatorToken.kind;return N===g.SyntaxKind.BarBarToken||N===g.SyntaxKind.AmpersandAmpersandToken||N===g.SyntaxKind.QuestionQuestionToken?h(v.left,y+1)||h(v.right,y+1):!1}return g.isConditionalExpression(v)?h(v.whenTrue,y+1)||h(v.whenFalse,y+1):g.isPropertyAccessExpression(v)||g.isElementAccessExpression(v)?lt(v,i):g.isCallExpression(v)||g.isNewExpression(v)?p(v,y+1):!1},E=(x,y)=>{if((g.isVariableDeclaration(x)||g.isParameter(x)||g.isBindingElement(x))&&x.initializer!==void 0){if(h(x.initializer,0)){let N=qr(x,e);for(let R of Tn(x.name))u(R,N)}}else if(g.isBinaryExpression(x)&&x.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(x.left)&&h(x.right,0))u(x.left.text,al(x.left,e,s));else if(g.isReturnStatement(x)&&x.expression!==void 0&&y!==void 0&&h(x.expression,0))c(a,y);else if(g.isCallExpression(x)||g.isNewExpression(x)){p(x,0)&&f(x);let N=le(x.expression),R=en(N),A=R!==null&&R.name==="call",b=R!==null&&R.name==="apply",m=A||b?R.receiver:N,S=A?1:0,I=[];g.isFunctionExpression(m)||g.isArrowFunction(m)?I.push({fn:m,slots:Wr(m)}):g.isIdentifier(m)&&I.push(...r.params.get(m.text)??[]);let T=x.arguments??[];if(b){let z=T[1]===void 0?void 0:le(T[1]);for(let{fn:_,slots:C}of I)if(z!==void 0&&g.isArrayLiteralExpression(z))for(let j=0;j<z.elements.length;j+=1){let U=z.elements[j],$=C[j];if(!(U===void 0||$===void 0)&&h(U,0))for(let Y of $)u(Y,_)}else if(z!==void 0)for(let j of C)for(let U of j)u(U,_)}else for(let{fn:z,slots:_}of I)for(let C=S;C<T.length;C+=1){let j=T[C],U=_[C-S];if(!(j===void 0||U===void 0)&&h(j,0))for(let $ of U)u($,z)}}let v=y;if(g.isFunctionDeclaration(x))v=x.name?.text;else if(g.isFunctionExpression(x)||g.isArrowFunction(x)){let N=x.parent;v=g.isVariableDeclaration(N)&&g.isIdentifier(N.name)?N.name.text:void 0}g.forEachChild(x,N=>E(N,v))};E(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function pl(e){if(g.isIdentifier(e)&&Xt.has(e.text)||Ln(e))return!0;let n=en(e);if(n!==null&&(ct.has(n.name)||(n.name==="call"||n.name==="apply")&&(g.isIdentifier(n.receiver)&&Xt.has(n.receiver.text)||Ln(n.receiver)||(g.isPropertyAccessExpression(n.receiver)||g.isElementAccessExpression(n.receiver))&&zr(n.receiver))))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=le(e.expression);if(g.isIdentifier(t)&&dt.has(t.text))return!0}return!1}var ml=4;function Fr(e,n){for(let t of e){if(!g.isStringLiteralLike(t)||n>=ml)return!0;let i=g.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,g.ScriptTarget.Latest,!0),r=i.parseDiagnostics;if(r!==void 0&&r.length>0||Jt(i,n+1,!0))return!0}return!1}function Jt(e,n=0,t=!1){let i=!1,r=t?rl:ul(e);if(r.saturated)return!0;let s=l=>g.isElementAccessExpression(l)&&!g.isStringLiteralLike(l.argumentExpression)&&at(ue(l.expression),r),a=l=>{if(!i){if(t&&(g.isCallExpression(l)||g.isNewExpression(l)||g.isTaggedTemplateExpression(l))){i=!0;return}if(g.isCallExpression(l)){let o=Tn(l);if(o!==null){let c=o.specifierArg;if(c===void 0||!g.isStringLiteralLike(c)||t){i=!0;return}}else{let c=ue(l.expression);if(g.isIdentifier(c)&&(c.text==="eval"||c.text==="Function")){if(Dr(l.arguments,n)){i=!0;return}}else if(fl(c)){i=!0;return}else if(s(c)){i=!0;return}else if(dl(l,r)){i=!0;return}}}else if(g.isNewExpression(l)){let o=ue(l.expression);if(g.isIdentifier(o)&&o.text==="Function"){if(Dr(l.arguments??[],n)){i=!0;return}}else if(Pn(o)){i=!0;return}}else if(g.isIdentifier(l)&&Za.has(l.text)&&il(l)){i=!0;return}else if((g.isPropertyAccessExpression(l)||g.isElementAccessExpression(l))&&(Br(l)||Pn(l)||s(l))&&jr(l)){i=!0;return}else if(g.isBindingElement(l)){let o=l.propertyName??l.name,c=g.isIdentifier(o)||g.isStringLiteralLike(o)?o.text:g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?o.expression.text:void 0;if(c!==void 0&&dt.has(c)){i=!0;return}}g.forEachChild(l,a)}};return a(e),i}function Wr(e,n,t){if(Jt(t))return!0;if(!Yt(e)||!n.includes("<")||!n.includes("require"))return!1;let i=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);return Jt(i)}function ml(e,n,t){if(Xa(e))return!0;let i=t.endsWith(ke.sep)?t:t+ke.sep,r=e.split("/"),s=n;for(;;){let a=ke.join(s,"node_modules",...r),l;try{l=pn(ke.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(i))return!1;let c=Ne(l);if(c===null)return!1;let u;try{u=JSON.parse(c).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(Sr(a))return!1;if(s===t)break;let o=ke.dirname(s);if(o===s||o!==t&&!o.startsWith(i))break;s=o}return!0}function hl(e,n){let t=n.endsWith(ke.sep)?n:n+ke.sep,i=ke.dirname(e);for(;;){let r=ke.join(i,"package.json"),s;try{s=pn(r)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let l=Ne(s);if(l!==null)try{let o=JSON.parse(l).name;if(typeof o=="string"&&o.length>0)return o}catch{return null}}if(i===n)break;let a=ke.dirname(i);if(a===i||a!==n&&!a.startsWith(t))break;i=a}return null}function gl(e,n,t,i,r){let s=[],a=[],l=new Set,o={},c=new Set,u=new Set,f=[],p=!1,h=(x,y)=>{let w;try{w=pn(y)}catch{return!1}let N=Xe(e,w);if(N===null)return r.push({code:"out-of-root",path:w,detail:"dependency module resolved outside the app root; not followed"}),!1;let R=!t.has(w)&&!u.has(w);return R&&u.size>=Wt?(p=!0,!1):(a.push({from:x,to:{module:N}}),R?(u.add(w),s.push(N),!0):!1)},k=(x,y)=>{if(l.add(y),c.has(y))return;c.add(y);let w=Pe(y,x,Ge,n);if(w!==null&&!je(w)){if(h({surface:y},w)){f.push(w);try{let N=Xe(e,pn(w)),R=hl(w,e);N!==null&&R!==null&&(o[N]=R)}catch{}}return}ml(y,ke.dirname(x),e)||r.push({code:"unresolved-specifier",path:y,detail:`dependency "${y}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let x of i)k(x.containingFile,x.packageName);for(;f.length>0&&u.size<Wt;){let x=f.pop();if(x===void 0)break;let y=Xe(e,x);if(y===null)continue;let w=bn(x,rn);if(w.kind==="too-large"){r.push({code:"limit-exceeded",path:y,detail:`dependency module over the ${String(rn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(w.kind==="not-regular"){r.push({code:"parse-error",path:y,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let N=g.createSourceFile(x,w.text,g.ScriptTarget.ES2020,!0),R=N.parseDiagnostics;if(R!==void 0&&R.length>0){r.push({code:"dependency-body",path:y,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}if(Wr(x,w.text,N)){r.push({code:"dependency-body",path:y,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)"});continue}r.push({code:"dependency-body",path:y,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:y});for(let A of Fr(x,w.text))if(A.runtime)if(me(A.text)==="package-root"){let b=He(A.text);a.push({from:{module:y},to:{surface:b}}),k(x,b)}else{let b=Pe(A.text,x,Ge,n);if(b===null){me(A.text)==="package-subpath"&&r.push({code:"unresolved-specifier",path:y,detail:`runtime package-subpath import "${A.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`});continue}if(je(b)){let m=Xe(e,b);r.push({code:m===null?"out-of-root":"declaration-shadow",path:y,detail:m===null?`runtime import "${A.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${A.text}" resolved to the declaration file "${m}" with no co-located runtime module; its code was not analyzed`});continue}h({module:y},b)&&f.push(b)}}return(p||f.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(Wt)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:a,surfacePackages:[...l],entryRealNames:o}}function Gr(e,n,t=!1){let i=pn(e),r=[],s=g.createCompilerHost(Ge,!0),a=t?Er(i,Ge,s):()=>null,l=new Set,o=new Set,c=n.map(_=>ke.join(i,_)),u=[],f=new Map,p=new Map,h=new Map,k=new Map,x=new Set,y=(_,C)=>{let B=`${String(_.length)}:${_}${C}`;x.has(B)||(x.add(B),r.push({code:"unresolved-specifier",path:_,detail:C}))},w=()=>null,N=0,R=(_,C)=>{let B=p.get(_);return B===void 0&&(B=g.createSourceFile(_,C,g.ScriptTarget.ES2020,!0),p.set(_,B)),{real:_,sf:B}};for(;o.size<st;){let _=c.pop();if(_===void 0){if(N>=Qa)break;N+=1;let $=[];for(let[q,T]of f)T.includes("readdir")&&(T.includes("require")||T.includes("import("))&&$.push(R(q,T));let H=Ya($);if(H.length===0)break;let Z=[];for(let[q,T]of f)Z.push(R(q,T));w=Mr(Z,H,Ge,s,h);let K=!1;for(let q of $){let T=f.get(q.real);if(T!==void 0)for(let W of Tr(q.real,T,i,s,w))o.has(W)||(c.push(W),K=!0)}if(!K)break;continue}let C;try{C=pn(_)}catch{continue}if(o.has(C))continue;if(o.add(C),Xe(i,C)===null){r.push({code:"out-of-root",path:_,detail:"resolved outside app root"});continue}let B=bn(C,rn);if(B.kind==="too-large"){r.push({code:"limit-exceeded",path:C,detail:`file is ${String(Math.round(B.bytes/1048576))}MiB, over the ${String(rn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(B.kind==="not-regular"){r.push({code:"parse-error",path:C,detail:"unreadable or not a regular file"});continue}let V=B.text;l.add(C),f.set(C,V);for(let $ of Fr(C,V)){let H=$.runtime?a($.text,C):null;if(H===null&&me($.text)==="package-root"){$.runtime&&u.push({containingFile:C,packageName:He($.text)});continue}let Z=H??Pe($.text,C,Ge,s);if(Z===null){if($.runtime){let K=me($.text);if(K==="package-subpath")y(C,`runtime package-subpath import "${$.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`);else if(K==="relative"){let q=kr($.text,C,i,k);q.kind==="unanalyzable"&&y(C,`runtime relative import "${$.text}" did not resolve and its absence could not be proven \u2014 ${q.reason}; a bundler/loader may load a module the analyzer never saw`)}}continue}if(Xe(i,Z)===null){r.push({code:"out-of-root",path:Z,detail:`specifier "${$.text}" resolved outside app root`});continue}if($.runtime&&je(Z)){r.push({code:"declaration-shadow",path:Z,detail:`runtime import "${$.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if($.runtime&&!et(Z)){r.push({code:"unanalyzable-module",path:Z,detail:`runtime import "${$.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(Z)}for(let $ of Tr(C,V,i,s,w))o.has($)||c.push($)}o.size>=st&&c.length>0&&r.push({code:"limit-exceeded",path:i,detail:`reachable file set exceeds ${String(st)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let A=gl(i,s,l,u,r),b=g.createProgram({rootNames:[...l],options:Ge,host:s}),m=new Set,S=new Map;for(let _ of b.getSourceFiles()){if(_.isDeclarationFile||b.isSourceFileDefaultLibrary(_)||Xe(i,_.fileName)===null||!Yt(_.fileName))continue;let C=b.getSyntacticDiagnostics(_).length>0;if(!C&&!_.text.includes("<")||Ja(_.text,g.ScriptKind.TSX)!==0)continue;let B=g.createSourceFile(_.fileName,_.text,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);(C||Lr(B)>Lr(_))&&(m.add(_.fileName),S.set(_.fileName,_.text))}let I=b;if(m.size>0){let _=s.getSourceFile.bind(s);s.getSourceFile=(C,B,V,$)=>{let H=S.get(C);return H!==void 0?g.createSourceFile(C,H,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX):_(C,B,V,$)},I=g.createProgram({rootNames:[...l],options:Ge,host:s,oldProgram:b})}let P=I.getTypeChecker(),U=[];for(let _ of I.getSourceFiles()){if(_.isDeclarationFile||I.isSourceFileDefaultLibrary(_)||Xe(i,_.fileName)===null)continue;U.push(_);let C=I.getSyntacticDiagnostics(_);if(C.length>0){let V=C[0],$=V!==void 0?g.flattenDiagnosticMessageText(V.messageText," "):"syntax error";r.push({code:"parse-error",path:_.fileName,detail:`${String(C.length)} syntax error(s): ${$}`})}let B=Xe(i,_.fileName);B!==null&&Wr(_.fileName,_.text,_)&&r.push({code:"loader-escape",path:B,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)"})}return{program:I,checker:P,host:s,options:Ge,appRoot:i,sourceFiles:U,diagnostics:r,depReach:A,resolveParamDirs:w,toRel:_=>Xe(i,_)}}import{existsSync as yl}from"node:fs";import xl from"node:path";var Sl=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/"},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/"},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/"},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/"},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/"},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads"}],bl=["dependencies","devDependencies"];function kl(e,n){for(let t of bl){let i=e[t];if(!(typeof i!="object"||i===null||Array.isArray(i))&&Object.hasOwn(i,n))return!0}return!1}function Qt(e,n){if(n===null)return null;for(let t of Sl)if(kl(n,t.dependency)){for(let i of t.configFiles)if(yl(xl.join(e,i)))return{name:t.name,configFile:i,entryHint:t.entryHint}}return null}function Zt(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}function Je(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let i of n){let r=i.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:i}return t}function El(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function wl(e){let n=[],t="";for(let i of e){if(i===" "||i==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=i}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var vl=/^[A-Za-z_][A-Za-z0-9_]*=/u;function Il(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var Al=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),_l=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),Nl=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function Jr(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Xr(e){if(Jr(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return Nl.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:Al.has(t)||n!==-1&&_l.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var Cl=[".js",".cjs",".mjs",".ts",".mts",".cts"];function Ol(e){return Cl.some(n=>e.endsWith(n))}var Rl=new Set(["npm","yarn","pnpm"]);function $l(e){let n=e[0];return n===void 0||!Rl.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function ei(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(El(n))return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let t=wl(n);if(t===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let i=0;for(t[i]==="env"&&(i+=1);i<t.length;i+=1){let a=t[i];if(a===void 0||!vl.test(a))break;if(Jr(a))return{kind:"unparsed",reason:`environment \`${Je(a)}\` preloads another module; the launch surface is more than one file`};let l=a.indexOf("=");if(a.slice(0,l)==="NODE_OPTIONS")for(let o of a.slice(l+1).split(/\s+/u)){if(o===""||!o.startsWith("-"))continue;let c=Xr(o);if(c!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Je(c.token)}\` ${c.why}`}}}let r=t[i];if(r===void 0)return{kind:"unparsed",reason:"no program in the command"};if($l(t.slice(i)))return{kind:"delegates",target:"scripts.start"};if(!Il(r))return{kind:"unparsed",reason:`runs \`${Je(r)}\`, not node directly \u2014 the entry file cannot be identified`};for(i+=1;i<t.length;i+=1){let a=t[i];if(a===void 0||!a.startsWith("-"))break;let l=Xr(a);if(l!==null)return{kind:"unparsed",reason:`node flag \`${Je(l.token)}\` ${l.why}`}}let s=t[i];return s===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:Ol(s)?{kind:"file",specifier:s}:{kind:"unparsed",reason:`\`${Je(s)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Ml(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Pl=64;function ni(e){let n=e.split(`
-`),t=n.length>64,i=[],r=0;for(let s of n.slice(0,64)){let a=s.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let o=a.slice(l+1).trim();if(o.length===0)continue;let c=a.slice(0,l);if(c.length>Pl||!Ml(c)){r+=1;continue}i.push({name:c,command:o})}return i.sort((s,a)=>s.name===a.name?0:s.name==="web"?-1:a.name==="web"?1:0),{entries:i,truncated:t,unnamedLines:r}}import{realpathSync as Yr}from"node:fs";import Oe from"node:path";import d from"typescript";var Qr=3;function te(e,n,t){if(e===void 0)return;let i=e[n]??={fired:0,refused:{}};t===null?i.fired+=1:i.refused[t]=(i.refused[t]??0)+1}function on(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var ut=16,ri=256,ti=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let i=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(i)||(this.moduleFor(n),this.fns.set(i,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let i=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(i)||(this.moduleFor(n),this.classNodes.set(i,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(i,[])),r}methodFor(n,t,i,r){let s=`${n}#${t}.${i}`,a=`pkg:${n}#${t}.${i}`;if(!this.fns.has(s)){let l=this.classFor(n,t);this.fns.set(s,{id:a,moduleId:`pkg:${n}`,name:i,kind:r,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function as(e,n){let t="node_modules/",i=e.lastIndexOf(t);if(i===-1)return n;let s=e.slice(i+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function Zr(e,n,t){let i=Oe.dirname(e),r=Oe.dirname(n),s=[];for(;;){let l=t.get(i);if(l!==void 0){for(let c of s)t.set(c,l);return l}s.push(i);let o=Ne(Oe.join(i,"package.json"));if(o!==null)try{let c=JSON.parse(o),u={name:c.name??"app",version:c.version??"0.0.0",dir:i};for(let f of s)t.set(f,u);return u}catch{}if(i===r||i===Oe.dirname(i))break;i=Oe.dirname(i)}let a={name:"app",version:"0.0.0",dir:null};for(let l of s)t.set(l,a);return a}function Ll(e){let n=[],t=i=>{if(d.isImportDeclaration(i)&&d.isStringLiteralLike(i.moduleSpecifier))n.push({specifier:i.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isImportEqualsDeclaration(i)&&d.isExternalModuleReference(i.moduleReference)&&d.isStringLiteralLike(i.moduleReference.expression))n.push({specifier:i.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&d.isStringLiteralLike(i.moduleSpecifier))n.push({specifier:i.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isCallExpression(i)){let r=Tn(i);if(r!==null){let s=r.specifierArg,a=s!==void 0&&d.isStringLiteralLike(s);n.push({specifier:a?s.text:void 0,specifierIsLiteral:a,dynamic:!0,...s!==void 0&&!a?{computedArg:s,loadPos:i.getStart(e)}:{}})}}d.forEachChild(i,t)};return t(e),n}function Tl(e,n,t){let i=new Map,r=Zr(Oe.join(e.appRoot,"package.json"),e.appRoot,i),s=[],a=[],l=[],o=new Map,c=new Set,u=new Set;for(let f of e.sourceFiles){let p=e.toRel(f.fileName);p!==null&&u.add(p)}for(let f of e.sourceFiles){let p=e.toRel(f.fileName);if(p===null)continue;let h=Zr(f.fileName,e.appRoot,i),k=as(p,r.name),x=p.includes("node_modules/");s.push({id:p,packageName:x&&h.name!==r.name?h.name:k,versionRange:h.version,path:p,moduleSystem:"cjs",isEntrypoint:n.has(p)}),h.dir===r.dir&&c.add(p);let y=0,w=null;for(let N of Ll(f)){let R=`${p}#import${String(y)}`;y+=1;let A=null;if(N.specifier!==void 0)if(me(N.specifier)==="package-root")A=t.moduleFor(He(N.specifier));else{let b=Pe(N.specifier,f.fileName,e.options,e.host),m=b!==null?e.toRel(b):null;m!==null&&(A=m)}if(a.push({id:R,moduleId:p,specifier:N.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:N.dynamic,specifierIsLiteral:N.specifierIsLiteral,...A!==null?{resolvedModuleId:A}:{}}),A!==null&&l.push({importId:R,resolvedModuleId:A}),N.computedArg!==void 0&&N.loadPos!==void 0){w??=fn(f,f.fileName,e.resolveParamDirs);let b=[];for(let m of it(N.computedArg,w,e.appRoot,e.options,e.host)){let S=e.toRel(m);if(S===null||!u.has(S))continue;let I=S,P=`${p}#import${String(y)}`;y+=1,a.push({id:P,moduleId:p,specifier:S,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:I}),l.push({importId:P,resolvedModuleId:I}),b.push(S)}if(b.length>0){let m=Mn(N.computedArg,w)!==null||tt(N.computedArg),S=o.get(p)??[];S.push({pos:N.loadPos,candidateRels:b,seedable:m}),o.set(p,S)}}}}return{modules:s,imports:a,importEdges:l,computedLoads:o,appOwnedPaths:c}}function Dl(e){let n=Ne(e);if(n===null)return null;let t=d.createSourceFile(e,n,d.ScriptTarget.Latest,!0),i=r=>t.statements.some(s=>d.isFunctionDeclaration(s)?s.name?.text===r:d.isVariableStatement(s)?s.declarationList.declarations.some(a=>d.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&(d.isFunctionExpression(a.initializer)||d.isArrowFunction(a.initializer))):!1);for(let r of t.statements){if(d.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(a=>a.kind===d.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!d.isExpressionStatement(r)||!d.isBinaryExpression(r.expression))continue;let s=r.expression;if(s.operatorToken.kind===d.SyntaxKind.EqualsToken&&Fl(s.left)){if(d.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(d.isIdentifier(s.right)&&i(s.right.text))return s.right.text}}return null}function Fl(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Kl(e,n,t){for(let c of e.surfacePackages)n.moduleFor(c);let i=c=>"surface"in c?n.moduleFor(c.surface):c.module,r=[],s=new Set;for(let c of e.modules)t.has(c)||s.has(c)||(s.add(c),r.push({id:c,packageName:e.entryRealNames[c]??as(c,"app"),versionRange:"",path:c,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],o=0;for(let c of e.edges){let u=i(c.from),f=i(c.to),p=`${String(u)}#depreach${String(o)}`;o+=1,a.push({id:p,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),l.push({importId:p,resolvedModuleId:f})}return{modules:r,imports:a,importEdges:l}}function es(e,n,t){let i=e.expression;if(d.isIdentifier(i)&&!t.has(i.text)){let r=n.get(i.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(d.isPropertyAccessExpression(i)&&d.isIdentifier(i.expression)&&!t.has(i.expression.text)){let r=n.get(i.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:i.name.text}}return null}function mn(e){return d.canHaveModifiers(e)&&(d.getModifiers(e)?.some(n=>n.kind===d.SyntaxKind.ExportKeyword)??!1)}function jl(e){let n=new Set,t;for(let i of e.statements){if(d.isExpressionStatement(i)&&d.isBinaryExpression(i.expression)){let r=i.expression;if(r.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(r.left)&&d.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(d.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(d.isObjectLiteralExpression(r.right))for(let s of r.right.properties)d.isShorthandPropertyAssignment(s)?n.add(s.name.text):d.isPropertyAssignment(s)&&d.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(d.isFunctionDeclaration(i)&&i.name!==void 0&&mn(i))n.add(i.name.text);else if(d.isVariableStatement(i)&&mn(i))for(let r of i.declarationList.declarations)d.isIdentifier(r.name)&&n.add(r.name.text);else if(d.isExportDeclaration(i)&&i.exportClause&&d.isNamedExports(i.exportClause))for(let r of i.exportClause.elements)n.add((r.propertyName??r.name).text);else d.isExportAssignment(i)&&d.isIdentifier(i.expression)&&(n.add(i.expression.text),t=i.expression.text)}return{reachableLocals:n,defaultTarget:t}}function Bl(e){for(let n of e.statements){if(d.isFunctionDeclaration(n)&&n.name!==void 0&&mn(n)&&d.getModifiers(n)?.some(t=>t.kind===d.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(d.isExportAssignment(n)&&!n.isExportEquals&&d.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ae(t.left)&&d.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function Ye(e){if(d.isCallExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&d.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function Ae(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Be(e){if(Ae(e))return!0;if(!d.isPropertyAccessExpression(e)&&!d.isElementAccessExpression(e))return!1;let n=e.expression;return d.isIdentifier(n)&&n.text==="exports"?!0:Ae(n)}function wn(e){return d.isPropertyAccessExpression(e.expression)&&d.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ls(e){let n=!1,t=i=>{if(!n){if(d.isCallExpression(i)){let r=Ye(i);if(r!==void 0&&me(r)!=="package-root"){n=!0;return}}d.forEachChild(i,t)}};return t(e),n}function ds(e){let n=new Set,t=r=>r!==void 0&&ls(r),i=r=>{d.isVariableDeclaration(r)&&t(r.initializer)&&$n(r.name,n),d.isBinaryExpression(r)&&r.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),d.forEachChild(r,i)};return i(e),n}function cs(e,n){for(let t of e.properties)d.isShorthandPropertyAssignment(t)?n.add(t.name.text):d.isPropertyAssignment(t)&&d.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function zl(e){let n=new Set;for(let l of e.statements)if(d.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(d.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(d.isVariableStatement(l))for(let o of l.declarationList.declarations)d.isIdentifier(o.name)&&o.initializer!==void 0&&(d.isFunctionExpression(o.initializer)||d.isArrowFunction(o.initializer)||d.isObjectLiteralExpression(o.initializer))&&n.add(o.name.text);let t=l=>d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isObjectLiteralExpression(l)||d.isIdentifier(l)&&n.has(l.text),i=new Set,r=l=>{d.isIdentifier(l)?i.add(l.text):d.isObjectLiteralExpression(l)&&cs(l,i)},s=!1,a=l=>{if(!s){if(d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken)if(Ae(l.left)){r(l.right);let o=l.right;(d.isObjectLiteralExpression(o)?o.properties.every(u=>d.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||d.isPropertyAssignment(u)&&t(u.initializer)):t(o))||(s=!0)}else Be(l.left)&&(t(l.right)||(s=!0));else(d.isCallExpression(l)&&wn(l)&&l.arguments[0]!==void 0&&hn(l.arguments[0])||d.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(s=!0);s||d.forEachChild(l,a)}};if(a(e),!s&&i.size>0){for(let l of ms(e))if(i.has(l)){s=!0;break}}return s}function hn(e){return Be(e)||d.isIdentifier(e)&&e.text==="exports"}function us(e){if(!d.isPropertyAccessExpression(e.expression)||!d.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function si(e){return us(e)&&e.arguments[0]!==void 0&&hn(e.arguments[0])}function Ul(e){return us(e)&&e.arguments[0]!==void 0&&d.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Vl(e){for(let n of e.declarations??[])if(d.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(d.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function ql(e,n,t,i,r){let s=(e.declarations??[]).filter(l=>!d.isSourceFile(l)&&!d.isModuleDeclaration(l));for(let l of s){let o=l.getSourceFile(),c=n.toRel(o.fileName);if(c===null||r.has(c))continue;let u=t.get(`${c}::${String(l.getStart(o,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of s){let o=n.toRel(l.getSourceFile().fileName);if(o===null||r.has(o))continue;let c=i.get(`${o}::${a}`);if(c!==void 0)return c}}function ft(e){return d.isPropertyAccessExpression(e)?e.name.text:d.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var oi=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function ai(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?ft(e):void 0;return n!==void 0&&n!=="__proto__"&&oi.test(n)?n:void 0}function Hl(e){return e!=="__proto__"&&oi.test(e)}function ns(e){let n=ue(e);return d.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||Ae(n)}function Wl(e){if(!d.isArrayLiteralExpression(e)&&!d.isObjectLiteralExpression(e))return!1;let n=!1,t=i=>{n||(Be(i)?n=!0:d.forEachChild(i,t))};return t(e),n}function li(e){let n=!1,t=new Map,i=r=>{if(!n){if(d.isBinaryExpression(r)&&r.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(Ae(r.left)||d.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===d.SyntaxKind.EqualsToken&&ns(r.right))n=!0;else if(Wl(r.left))n=!0;else if(Be(r.left)){let s=ai(r.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(d.isCallExpression(r)&&wn(r)&&r.arguments[0]!==void 0&&hn(r.arguments[0])||d.isCallExpression(r)&&si(r)||d.isCallExpression(r)&&Ul(r)||d.isVariableDeclaration(r)&&r.initializer!==void 0&&ns(r.initializer))&&(n=!0);n||d.forEachChild(r,i)}};return i(e),{surfaceEscapes:n,assignCount:t}}function di(e){let n=[];for(let t of e.statements){if(!d.isExpressionStatement(t)||!d.isBinaryExpression(t.expression))continue;let i=t.expression;i.operatorToken.kind===d.SyntaxKind.EqualsToken&&(!Be(i.left)||Ae(i.left)||n.push({bin:i,name:ai(i.left)}))}return n}function Gl(e){let{surfaceEscapes:n,assignCount:t}=li(e);if(n)return[];let i=[];for(let{bin:r,name:s}of di(e))s===void 0||(t.get(s)??0)!==1||(d.isFunctionExpression(r.right)||d.isArrowFunction(r.right))&&i.push({name:s,value:r.right});return i}function Xl(e,n){let{surfaceEscapes:t,assignCount:i}=li(e);if(t)return[];let r=[];for(let{bin:s,name:a}of di(e))a===void 0||(i.get(a)??0)!==1||d.isIdentifier(s.right)&&!n.has(s.right.text)&&r.push(s.right.text);return r}function Jl(e,n){let{surfaceEscapes:t,assignCount:i}=li(e);for(let{bin:r,name:s}of di(e)){let a=r.right;if(!(d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isIdentifier(a)))continue;let o=d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isIdentifier(a)&&!n.has(a.text);if(!(!t&&s!==void 0&&(i.get(s)??0)===1&&o))return!0}return!1}function Yl(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&d.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function ts(e){let n=e.parent;return n===void 0?!1:d.isPropertyAccessExpression(n)?n.name===e:d.isQualifiedName(n)?n.right===e:d.isBindingElement(n)||d.isImportSpecifier(n)?n.propertyName===e:d.isExportSpecifier(n)?!0:d.isPropertyAssignment(n)||d.isPropertyDeclaration(n)||d.isPropertySignature(n)||d.isMethodDeclaration(n)||d.isMethodSignature(n)||d.isGetAccessorDeclaration(n)||d.isSetAccessorDeclaration(n)||d.isEnumMember(n)?n.name===e:!1}function is(e){for(let n=e.parent;n!==void 0;n=n.parent){if(d.isSourceFile(n))return!0;if(!d.isArrowFunction(n)&&(d.isFunctionLike(n)||d.isClassLike(n)))return!1}return!0}function Ql(e,n){let t=i=>{d.isIdentifier(i)&&(i.text==="exports"||i.text==="module")&&n.add(i),d.forEachChild(i,t)};t(e)}function Zl(e){let n=[],t=new Set;for(let s of e.statements){if(d.isExportDeclaration(s)||d.isExportAssignment(s)||d.isImportDeclaration(s)||d.isImportEqualsDeclaration(s)||mn(s))return null;if(!d.isExpressionStatement(s)||!d.isBinaryExpression(s.expression))continue;let a=s.expression;if(a.operatorToken.kind===d.SyntaxKind.EqualsToken){if(Ae(a.left))n.push({kind:"whole",value:a.right});else if(Be(a.left)){let l=ai(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:Yl(a.left)})}else continue;Ql(a.left,t)}}let i=!1,r=s=>{if(!i){if(d.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!ts(s)){i=!0;return}if(s.kind===d.SyntaxKind.ThisKeyword&&is(s)){i=!0;return}if(d.isIdentifier(s)&&s.text==="arguments"&&!ts(s)&&is(s)){i=!0;return}d.forEachChild(s,r)}};return r(e),i?null:n}function ii(e){return d.isIdentifier(e)||d.isStringLiteralLike(e)?e.text:void 0}function rs(e,n,t){return d.isIdentifier(e)?n(e.text):t?.(e)}function ed(e,n,t,i){let r=new Map,s=Zl(e);if(s===null||s.filter(h=>h.kind==="whole").length>1)return r;let a=s.findIndex(h=>h.kind==="whole"),l=(h,k)=>a>=0&&k>a&&h.kind==="member"&&h.root==="exports",o=s.some(l);if(o){let h=s[a];if(h===void 0||h.kind!=="whole"||!d.isObjectLiteralExpression(h.value))return r}let c=o?s.filter((h,k)=>!l(h,k)):s,u=new Map;for(let h of c)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let f=h=>n.has(h)?void 0:t(h),p=(h,k)=>{k===void 0?r.delete(h):r.set(h,k)};for(let h of c){if(h.kind==="member"){p(h.name,(u.get(h.name)??0)>1?void 0:rs(h.value,f,i));continue}r.clear();let k=h.value;if(d.isObjectLiteralExpression(k))for(let x of k.properties){if(d.isSpreadAssignment(x))return new Map;if(d.isShorthandPropertyAssignment(x)){p(x.name.text,f(x.name.text));continue}let y=ii(x.name);if(y===void 0)return new Map;p(y,d.isPropertyAssignment(x)?rs(x.initializer,f,i):void 0)}}return r}function fs(e,n,t,i){let r=new Map,s=l=>l!==void 0&&me(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(d.isVariableDeclaration(l)&&l.initializer!==void 0){let o=l.initializer;if(d.isIdentifier(l.name)&&!i.has(l.name.text)){let c=s(Ye(o));if(c!==void 0)r.set(l.name.text,{kind:"whole",target:c});else if((d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o))&&d.isCallExpression(o.expression)){let u=s(Ye(o.expression)),f=ft(o);u!==void 0&&f!==void 0&&r.set(l.name.text,{kind:"member",target:u,member:f})}}else if(d.isObjectBindingPattern(l.name)){let c=s(Ye(o));if(c!==void 0){for(let u of l.name.elements)if(d.isIdentifier(u.name)&&!i.has(u.name.text)){let f=u.propertyName!==void 0&&d.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;r.set(u.name.text,{kind:"member",target:c,member:f})}}}}d.forEachChild(l,a)};return a(e),r}function nd(e,n,t,i){let r=a=>a!==void 0&&me(a)==="relative"?t.get(`${n}::${a}`):void 0,s=r(Ye(e));if(s!==void 0)return{kind:"whole",target:s};if(d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)){let a=ft(e);if(a===void 0)return;let l=r(Ye(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(d.isIdentifier(e.expression)){let o=i.get(e.expression.text);if(o?.kind==="whole")return{kind:"member",target:o.target,member:a}}return}if(d.isIdentifier(e))return i.get(e.text)}function ps(e,n,t,i,r){let s=[],a=!1,l=f=>{if(ls(f))return!0;let p=!1,h=k=>{p||(d.isIdentifier(k)&&r.has(k.text)?p=!0:d.forEachChild(k,h))};return h(f),p},o=(f,p)=>{let h=nd(f,n,t,i);h!==void 0?s.push({source:h,exportedName:p}):l(f)&&(a=!0)},c=f=>{if(d.isObjectLiteralExpression(f)){for(let p of f.properties)if(d.isSpreadAssignment(p))o(p.expression,"default");else if(d.isPropertyAssignment(p)){let h=d.isIdentifier(p.name)||d.isStringLiteralLike(p.name)?p.name.text:"default";o(p.initializer,h)}else if(d.isShorthandPropertyAssignment(p)){let h=i.get(p.name.text);h!==void 0&&s.push({source:h,exportedName:p.name.text})}return}o(f,"default")},u=f=>{if(d.isBinaryExpression(f)&&f.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(Ae(f.left)){c(f.right);return}if(Be(f.left)){let p=d.isPropertyAccessExpression(f.left)?f.left.name.text:d.isElementAccessExpression(f.left)&&d.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";o(f.right,p);return}}else if(d.isExportAssignment(f)&&f.isExportEquals){o(f.expression,"default");return}else if(d.isCallExpression(f)&&wn(f)&&f.arguments[0]!==void 0&&hn(f.arguments[0])){for(let p of f.arguments.slice(1))c(p);return}d.forEachChild(f,u)};return u(e),{sources:s,residual:a}}function ms(e){let n=new Set,t=r=>{let s=r;for(;d.isPropertyAccessExpression(s)||d.isElementAccessExpression(s);)s=s.expression;return d.isIdentifier(s)?s.text:void 0},i=r=>{let s=hs(r);if(s!==void 0){let a=t(s);a!==void 0&&n.add(a)}d.forEachChild(r,i)};return i(e),n}function hs(e){return d.isBinaryExpression(e)&&e.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=d.SyntaxKind.LastAssignment&&(d.isPropertyAccessExpression(e.left)||d.isElementAccessExpression(e.left))?e.left:void 0}function ct(e){if(d.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)d.isBindingElement(t)&&n.push(...ct(t.name));return n}function Ie(e){if(d.isIdentifier(e))return[e.text];if(d.isParenthesizedExpression(e)||d.isAsExpression(e)||d.isNonNullExpression(e)||d.isSatisfiesExpression(e)||d.isTypeAssertionExpression(e)||d.isAwaitExpression(e))return Ie(e.expression);if(d.isYieldExpression(e))return e.expression!==void 0?Ie(e.expression):[];if(d.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===d.SyntaxKind.BarBarToken||n===d.SyntaxKind.AmpersandAmpersandToken||n===d.SyntaxKind.QuestionQuestionToken?[...Ie(e.left),...Ie(e.right)]:n===d.SyntaxKind.CommaToken?Ie(e.right):[]}return d.isConditionalExpression(e)?[...Ie(e.whenTrue),...Ie(e.whenFalse)]:d.isArrayLiteralExpression(e)?e.elements.flatMap(n=>d.isSpreadElement(n)?Ie(n.expression):d.isOmittedExpression(n)?[]:Ie(n)):d.isObjectLiteralExpression(e)?e.properties.flatMap(n=>d.isShorthandPropertyAssignment(n)?[n.name.text]:d.isPropertyAssignment(n)?Ie(n.initializer):d.isSpreadAssignment(n)?Ie(n.expression):[]):[]}function gs(e,n){let t=[],i=(l,o)=>{for(let c of l)for(let u of o)c!==u&&t.push({a:c,b:u})},r=l=>d.isIdentifier(l)?[l.text]:d.isArrayLiteralExpression(l)?l.elements.flatMap(r):d.isObjectLiteralExpression(l)?l.properties.flatMap(o=>d.isShorthandPropertyAssignment(o)?[o.name.text]:d.isPropertyAssignment(o)?r(o.initializer):[]):[],s=l=>{d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken?i(r(l.left),Ie(l.right)):d.isVariableDeclaration(l)&&l.initializer!==void 0?i(ct(l.name),Ie(l.initializer)):(d.isForOfStatement(l)||d.isForInStatement(l))&&d.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&i(ct(l.initializer.declarations[0].name),Ie(l.expression)),d.forEachChild(l,s)};s(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:o,b:c}of t)a.has(o)&&!a.has(c)&&(a.add(c),l=!0),a.has(c)&&!a.has(o)&&(a.add(o),l=!0)}return a}function ys(e,n){let t=l=>{if(!d.isPropertyAccessExpression(l)&&!d.isElementAccessExpression(l))return;let o=l;for(;d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o);)o=o.expression;return d.isIdentifier(o)?o.text:void 0},i=[],r=(l,o)=>{for(let u of Ie(o))i.push({name:l,root:u});let c=t(o);c!==void 0&&i.push({name:l,root:c})},s=l=>{d.isVariableDeclaration(l)&&d.isIdentifier(l.name)&&l.initializer!==void 0?r(l.name.text,l.initializer):d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(l.left)&&r(l.left.text,l.right),d.forEachChild(l,s)};s(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:o,root:c}of i){let u=a.get(c);u!==void 0&&!a.has(o)&&(a.set(o,u),l=!0)}}return a}function xs(e){return gs(e,ms(e))}function td(e,n){let t=o=>o>=d.SyntaxKind.FirstAssignment&&o<=d.SyntaxKind.LastAssignment,i=o=>{let c=o.parent;if(c===void 0||!d.isObjectLiteralExpression(c))return!1;let u=c.parent;return u!==void 0&&d.isBinaryExpression(u)&&u.operatorToken.kind===d.SyntaxKind.EqualsToken&&u.right===c&&Be(u.left)?!0:u!==void 0&&d.isCallExpression(u)&&wn(u)&&u.arguments[0]!==void 0&&hn(u.arguments[0])&&u.arguments.indexOf(c)>0},r=(o,c)=>{if((d.isFunctionDeclaration(c)||d.isFunctionExpression(c))&&c.name===o||d.isVariableDeclaration(c)&&c.name===o||d.isParameter(c)&&c.name===o||d.isBindingElement(c)&&c.name===o||(d.isCallExpression(c)||d.isNewExpression(c))&&c.expression===o)return!0;if((d.isPropertyAccessExpression(c)||d.isElementAccessExpression(c))&&c.expression===o){let u=c;for(;u.parent!==void 0&&(d.isPropertyAccessExpression(u.parent)||d.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let f=u.parent;return!(f!==void 0&&d.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===u)}return d.isBinaryExpression(c)&&c.operatorToken.kind===d.SyntaxKind.EqualsToken&&c.right===o&&Be(c.left)?!0:d.isShorthandPropertyAssignment(c)&&c.name===o||d.isPropertyAssignment(c)&&c.initializer===o?i(c):!!(d.isExportAssignment(c)&&c.expression===o||d.isExportSpecifier(c))},s=(o,c)=>d.isPropertyAccessExpression(c)&&c.name===o||d.isPropertyAssignment(c)&&c.name===o||(d.isMethodDeclaration(c)||d.isGetAccessorDeclaration(c)||d.isSetAccessorDeclaration(c))&&c.name===o,a=!1,l=(o,c)=>{if(!a){if(d.isIdentifier(o)&&c!==void 0&&n.has(o.text)&&!s(o,c)&&!r(o,c)){a=!0;return}d.forEachChild(o,u=>l(u,o))}};return l(e,void 0),a}function id(e){let n=new Set;for(let o of e.statements)if(d.isFunctionDeclaration(o)&&o.name!==void 0)n.add(o.name.text);else if(d.isVariableStatement(o))for(let c of o.declarationList.declarations)d.isIdentifier(c.name)&&c.initializer!==void 0&&(d.isFunctionExpression(c.initializer)||d.isArrowFunction(c.initializer))&&n.add(c.name.text);let t=new Set,i=o=>{d.isBinaryExpression(o)&&o.operatorToken.kind===d.SyntaxKind.EqualsToken?(Ae(o.left)&&(d.isIdentifier(o.right)?t.add(o.right.text):d.isObjectLiteralExpression(o.right)&&cs(o.right,t)),Ae(o.right)&&d.isIdentifier(o.left)&&t.add(o.left.text)):d.isVariableDeclaration(o)&&d.isIdentifier(o.name)&&o.initializer!==void 0&&Ae(o.initializer)&&t.add(o.name.text),d.forEachChild(o,i)};if(i(e),t.size>0){if(td(e,t))return!0;let o=ys(e,new Map([...t].map(u=>[u,u]))),c=xs(e);for(let u of o.keys())if(c.has(u))return!0}let r=o=>d.isIdentifier(o)&&n.has(o.text),s=o=>o.properties.every(c=>d.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||d.isPropertyAssignment(c)&&r(c.initializer)),a=!1,l=o=>{if(!a){if(d.isBinaryExpression(o)){let c=o.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=d.SyntaxKind.LastAssignment;c&&Ae(o.left)?o.operatorToken.kind===d.SyntaxKind.EqualsToken&&(r(o.right)||d.isObjectLiteralExpression(o.right)&&s(o.right))||(a=!0):c&&Be(o.left)&&(a=!0)}else d.isCallExpression(o)?(wn(o)&&o.arguments[0]!==void 0&&hn(o.arguments[0])||si(o))&&(a=!0):(d.isExportAssignment(o)&&o.isExportEquals&&!d.isIdentifier(o.expression)||d.isExportDeclaration(o)&&o.moduleSpecifier!==void 0)&&(a=!0);a||d.forEachChild(o,l)}};return l(e),a}var rd=8;function ss(e,n,t){let i=new Set,r=fs(e,n,t,kn(e)),s=ps(e,n,t,r,ds(e));for(let{source:a}of s.sources)i.add(a.target);for(let a of e.statements)if(d.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&d.isStringLiteralLike(a.moduleSpecifier)&&me(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&i.add(l)}return i}function sd(e,n,t,i=new Map){let r=new Set(n.modules.filter(b=>b.isEntrypoint).map(b=>String(b.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(b=>b.externalSurface===!0).map(b=>String(b.id))),a=new Map,l=new Map,o=new Map,c=new Map;for(let b of t){if(b.name==="<toplevel>"){c.set(String(b.moduleId),b);continue}if(a.set(`${String(b.moduleId)}::${String(b.declRange.start)}`,b),b.name!==void 0&&l.set(`${String(b.moduleId)}::${b.name}`,b),b.isExported&&b.name!==void 0){let m=o.get(String(b.moduleId))??[];m.push(b),o.set(String(b.moduleId),m)}}if(i.size>0){let b=new Map(t.map(m=>[String(m.id),m]));for(let[m,S]of i){let I=b.get(String(S));I!==void 0&&!a.has(m)&&a.set(m,I)}}let u=new Map;for(let b of n.imports)b.resolvedModuleId!==void 0&&u.set(`${b.moduleId}::${b.specifier}`,String(b.resolvedModuleId));let f=new Map;for(let b of e.sourceFiles){let m=e.toRel(b.fileName);m!==null&&f.set(m,b)}let p=new Map,h=b=>{let m=p.get(b);if(m!==void 0)return m;let S=f.get(b),I=S===void 0?!0:id(S);return p.set(b,I),I},k=new Set,x=(b,m)=>m!==void 0&&me(m)==="relative"?u.get(`${b}::${m}`):void 0,y=b=>{if(d.isIdentifier(b))return b.text;if(d.isPropertyAccessExpression(b)){let m=y(b.expression);return m===void 0?void 0:`${m}.${b.name.text}`}if(d.isElementAccessExpression(b)&&d.isStringLiteralLike(b.argumentExpression)){let m=y(b.expression);return m===void 0?void 0:`${m}.${b.argumentExpression.text}`}},w=b=>{let m=b;for(;d.isPropertyAccessExpression(m)||d.isElementAccessExpression(m);)m=m.expression;return Ye(m)};for(let b of e.sourceFiles){let m=e.toRel(b.fileName);if(m===null)continue;let S=new Map,I=new Map,P=(C,B)=>{let V=x(m,Ye(B));if(V!==void 0){if(d.isIdentifier(C))I.set(C.text,V),S.set(C.text,V);else if(d.isObjectBindingPattern(C)||d.isArrayBindingPattern(C))for(let $ of ct(C))I.set($,V);else if(d.isPropertyAccessExpression(C)||d.isElementAccessExpression(C)){let $=y(C);$!==void 0&&S.set($,V)}}},U=C=>{d.isVariableDeclaration(C)&&C.initializer!==void 0?P(C.name,C.initializer):d.isBinaryExpression(C)&&C.operatorToken.kind===d.SyntaxKind.EqualsToken&&P(C.left,C.right),d.forEachChild(C,U)};U(b);let _=C=>{let B=hs(C);if(B!==void 0){let V=B.expression,$=x(m,w(V));$!==void 0&&k.add($);let H=y(V),Z=H!==void 0?S.get(H):void 0;Z!==void 0&&k.add(Z)}d.forEachChild(C,_)};if(_(b),I.size>0){let C=ys(b,I),B=xs(b);for(let[V,$]of C)B.has(V)&&k.add($)}}let N=[],R=[],A=[];for(let b of e.sourceFiles){let m=e.toRel(b.fileName);if(m===null||!r.has(m))continue;let S=e.checker.getSymbolAtLocation(b),I=new Set,P=new Set,U=0,_=(T,W)=>{if(s.has(String(T.moduleId))||I.has(String(T.id)))return;I.add(String(T.id));let ae=`${m}#reexport:${String(U)}:${W}`;U+=1,N.push({id:ae,moduleId:m,exportedName:W,kind:"value",reexportOf:{moduleId:String(T.moduleId),name:T.name??W}}),R.push({exportId:ae,target:{kind:"function",functionId:T.id}})},C=T=>{if(Vl(T))return;let W=T;if((T.flags&d.SymbolFlags.Alias)!==0)try{W=e.checker.getAliasedSymbol(T)}catch{return}let ae=ql(W,e,a,l,s);if(ae!==void 0){_(ae,T.getName());return}if((W.flags&d.SymbolFlags.Module)!==0&&!P.has(W)){P.add(W);try{for(let Le of e.checker.getExportsOfModule(W))C(Le)}catch{}}};if(S!==void 0)for(let T of e.checker.getExportsOfModule(S))C(T);let B=fs(b,m,u,kn(b)),V=ps(b,m,u,B,ds(b)),$=new Set,H=V.residual,Z=T=>{let W=f.get(T);T.includes("node_modules/")||W===void 0||zl(W)?H=!0:$.add(T)};for(let{source:T,exportedName:W}of V.sources){let ae=o.get(T.target)??[],Le=k.has(T.target);if(T.kind==="whole"){for(let xe of ae)_(xe,xe.name??W);Le?H=!0:(ae.length===0||h(T.target))&&Z(T.target)}else{let xe=ae.filter(Se=>Se.name===T.member);for(let Se of xe)_(Se,W);Le?H=!0:(xe.length===0||h(T.target))&&Z(T.target)}}let K=new Set,q=[];for(let T of ss(b,m,u))q.push({target:T,depth:1});for(;q.length>0;){let T=q.shift();if(T===void 0)break;let{target:W,depth:ae}=T;if(K.has(W)||ae>rd||(K.add(W),W.split("/").includes("node_modules")))continue;let Le=f.get(W);if(Le===void 0)continue;let xe=c.get(W);xe!==void 0&&!h(W)&&_(xe,"<load>");for(let Se of ss(Le,W,u))K.has(Se)||q.push({target:Se,depth:ae+1})}Jl(b,kn(b))&&(H=!0);for(let T of $)A.push({code:"unresolved-reexport",path:m,detail:`entrypoint whole/member re-exports app-owned relative module ${T} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:T});H&&A.push({code:"unresolved-reexport",path:m,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:N,exportBindings:R,diagnostics:A}}var En=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),od=new Set(["defineProperty","defineProperties","create"]);function ad(e){let n=!0,t=r=>d.isIdentifier(r)||d.isStringLiteral(r)||d.isNumericLiteral(r)?En.has(r.text):d.isComputedPropertyName(r)&&d.isStringLiteralLike(r.expression)?En.has(r.expression.text):!1,i=r=>{if(n){if(d.isNewExpression(r)||d.isForOfStatement(r)||d.isSpreadElement(r)||d.isSpreadAssignment(r)||d.isArrayBindingPattern(r)||d.isGetAccessorDeclaration(r)||d.isSetAccessorDeclaration(r)||d.isYieldExpression(r)&&r.asteriskToken!==void 0||d.canHaveDecorators(r)&&(d.getDecorators(r)?.length??0)>0){n=!1;return}if((d.isPropertyAccessExpression(r)||d.isMethodDeclaration(r)||d.isPropertyAssignment(r))&&t(r.name)||d.isPropertyDeclaration(r)&&t(r.name)||d.isShorthandPropertyAssignment(r)&&t(r.name)||d.isBindingElement(r)&&t(r.propertyName??r.name)||d.isElementAccessExpression(r)&&d.isStringLiteralLike(r.argumentExpression)&&En.has(r.argumentExpression.text)){n=!1;return}if(d.isCallExpression(r)&&d.isPropertyAccessExpression(r.expression)&&d.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&od.has(r.expression.name.text)){n=!1;return}d.forEachChild(r,i)}};return i(e),n}function pt(e){if(d.isIdentifier(e)||d.isStringLiteral(e)||d.isNumericLiteral(e))return e.text}function Ss(e){let n=t=>d.canHaveDecorators(t)&&(d.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function ld(e){let n=!1,t=new Set,i=[],r=new Map,s=(p,h)=>{let k=r.get(p);k===void 0?r.set(p,[h]):k.push(h)},a=p=>{d.isIdentifier(p)?t.add(p.text):i.push(p)},l=p=>{for(let h of p.properties)d.isShorthandPropertyAssignment(h)?t.add(h.name.text):d.isPropertyAssignment(h)?i.push(h.initializer):n=!0},o=p=>{if(d.isBinaryExpression(p)&&p.operatorToken.kind===d.SyntaxKind.EqualsToken){let h=p.left,k=p.right;Ae(h)?d.isObjectLiteralExpression(k)?l(k):d.isIdentifier(k)||d.isFunctionExpression(k)||d.isArrowFunction(k)||d.isClassExpression(k)?a(k):n=!0:Be(h)?(d.isElementAccessExpression(h)&&!d.isStringLiteralLike(h.argumentExpression)&&(n=!0),a(k)):d.isIdentifier(h)?s(h.text,k):(d.isPropertyAccessExpression(h)||d.isElementAccessExpression(h))&&d.isIdentifier(h.expression)&&s(h.expression.text,k)}else if(d.isCallExpression(p))(wn(p)&&p.arguments[0]!==void 0&&hn(p.arguments[0])||si(p))&&(n=!0);else if(d.isVariableDeclaration(p)&&d.isIdentifier(p.name)&&p.initializer!==void 0)s(p.name.text,p.initializer);else if((d.isFunctionDeclaration(p)||d.isClassDeclaration(p))&&p.name!==void 0)s(p.name.text,p),mn(p)&&t.add(p.name.text);else if(d.isExportDeclaration(p)){if(p.exportClause===void 0)n=!0;else if(p.moduleSpecifier===void 0&&d.isNamedExports(p.exportClause))for(let h of p.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(d.isExportAssignment(p))p.isExportEquals&&!d.isIdentifier(p.expression)?n=!0:a(p.expression);else if(d.isVariableStatement(p)&&mn(p))for(let h of p.declarationList.declarations)d.isIdentifier(h.name)&&t.add(h.name.text);d.forEachChild(p,o)};o(e);let c=new Set,u=[...t],f=p=>{let h=k=>{d.isIdentifier(k)&&u.push(k.text),d.forEachChild(k,h)};h(p)};for(let p of i)f(p);for(;u.length>0;){let p=u.pop();if(!(p===void 0||c.has(p))){c.add(p);for(let h of r.get(p)??[])f(h)}}return{names:c,opaque:n}}var dd=512,cd=new Set(["get","post","put","patch","delete","options","head"]);function ud(e){for(let n of e.statements){if(d.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(n.expression.left)&&d.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,i=n.expression.left.name.text;if(t==="module"&&i==="exports"||t==="exports"&&i==="default")return n.expression.right}}return null}function fd(e){let n=new Map,t=ud(e);if(t===null)return n;let i=s=>{for(let a of s.properties)if(d.isPropertyAssignment(a)&&d.isObjectLiteralExpression(a.initializer)){let l=pt(a.name);l!==void 0&&n.set(l,a.initializer)}};if(d.isObjectLiteralExpression(t))return i(t),n;if(!d.isIdentifier(t))return n;let r=t.text;for(let s of e.statements)if(d.isVariableStatement(s))for(let a of s.declarationList.declarations)d.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&d.isObjectLiteralExpression(a.initializer)&&i(a.initializer);else if(d.isExpressionStatement(s)&&d.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(s.expression.left)&&d.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===r&&d.isObjectLiteralExpression(s.expression.right)){let a=s.expression.left.name.text;n.set(a,s.expression.right)}return n}function pd(e){for(let n of e.properties){if(d.isMethodDeclaration(n)&&d.isIdentifier(n.name)&&n.name.text==="handler")return n;if(d.isPropertyAssignment(n)&&d.isIdentifier(n.name)&&n.name.text==="handler"&&(d.isArrowFunction(n.initializer)||d.isFunctionExpression(n.initializer)))return n.initializer}return null}function md(e,n){for(let i of e.properties){let r;if(d.isPropertyAssignment(i)||d.isMethodDeclaration(i)?r=pt(i.name):d.isShorthandPropertyAssignment(i)&&(r=i.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function hd(e,n){let t=[],i=new Set,r=(l,o,c)=>{if(t.length>=dd||l==="__proto__"||!oi.test(l))return;let u=`${e}#handler:${l}`;i.has(u)||(i.add(u),t.push({id:u,node:o,memberPath:l,idiom:c}))};for(let[l,o]of fd(n)){let c=pd(o);c!==null&&md(o,c)&&r(l,c,"descriptor-object")}let s=0,a=l=>{if(d.isCallExpression(l)&&d.isPropertyAccessExpression(l.expression)&&d.isIdentifier(l.expression.expression)&&cd.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&d.isStringLiteralLike(l.arguments[0])){let o=l.expression.name.text;for(let c=1;c<l.arguments.length;c+=1){let u=l.arguments[c];u!==void 0&&(d.isArrowFunction(u)||d.isFunctionExpression(u))&&r(`${o}_${String(s)}_${String(c)}`,u,"router-verb")}s+=1}d.forEachChild(l,a)};return a(n),t}function gd(e,n,t,i,r,s){let a=`${e}#class:${t}`,l=[],o=new Set;for(let c of i.members){let u,f,p;if(d.isConstructorDeclaration(c))u="constructor",f="ctor",p=!1;else if(d.isMethodDeclaration(c))u=pt(c.name),f="method",p=u!==void 0&&!En.has(u);else continue;if(u===void 0||o.has(u))continue;o.add(u);let h=`${e}#${t}.${u}`;r.push({id:h,moduleId:e,name:u,kind:f,enclosingClassId:a,declRange:on(e,c,n),isExported:!1,publicSurfaceReachable:!1}),l.push(h),p&&s.push({start:c.getStart(n,!1),end:c.getEnd(),id:h})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function yd(e,n,t=[],i=!1,r){let s=[],a=new Map,l=[],{reachableLocals:o,defaultTarget:c}=jl(n),u=kn(n),f=`${e}#<toplevel>`;s.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let p=(m,S)=>{let I=`${e}#${m}`;return s.push({id:I,moduleId:e,name:m,kind:"function",declRange:on(e,S,n),isExported:o.has(m),publicSurfaceReachable:o.has(m)}),a.set(m,{kind:"function",functionId:I}),l.push({start:S.getStart(n,!1),end:S.getEnd(),id:I}),I},h=[],k=!e.split("/").includes("node_modules");if(k)for(let m of Xl(n,u))o.add(m);let x=k?ld(n):void 0,y=(m,S,I)=>{x===void 0||x.opaque||x.names.has(m)||mn(I)||Ss(S)||h.push(gd(e,n,m,S,s,l))};for(let m of n.statements)if(d.isFunctionDeclaration(m)&&m.name!==void 0)p(m.name.text,m);else if(d.isClassDeclaration(m)&&m.name!==void 0)y(m.name.text,m,m);else if(d.isVariableStatement(m))for(let S of m.declarationList.declarations){if(d.isObjectBindingPattern(S.name)&&S.initializer!==void 0&&d.isCallExpression(S.initializer)&&d.isIdentifier(S.initializer.expression)&&S.initializer.expression.text==="require"&&S.initializer.arguments.length===1&&S.initializer.arguments[0]!==void 0&&d.isStringLiteralLike(S.initializer.arguments[0])){let P=S.initializer.arguments[0].text;for(let U of S.name.elements){if(U.dotDotDotToken!==void 0||U.initializer!==void 0||!d.isIdentifier(U.name))continue;let _=U.propertyName??U.name;!d.isIdentifier(_)&&!d.isStringLiteralLike(_)||a.set(U.name.text,{kind:"import",specifier:P,form:{named:_.text}})}continue}if(!d.isIdentifier(S.name)||S.initializer===void 0)continue;let I=S.initializer;if(d.isFunctionExpression(I)||d.isArrowFunction(I))p(S.name.text,S);else if(d.isClassExpression(I))y(S.name.text,I,m);else if(d.isCallExpression(I)&&d.isIdentifier(I.expression)&&I.expression.text==="require"&&I.arguments.length===1&&I.arguments[0]!==void 0&&d.isStringLiteralLike(I.arguments[0]))a.set(S.name.text,{kind:"import",specifier:I.arguments[0].text,form:"whole"});else if((d.isPropertyAccessExpression(I)||d.isElementAccessExpression(I))&&ft(I)==="default"&&d.isCallExpression(I.expression)){let P=Ye(I.expression);P!==void 0&&a.set(S.name.text,{kind:"import",specifier:P,form:"require-default"})}}else if(d.isImportDeclaration(m)&&d.isStringLiteralLike(m.moduleSpecifier)){let S=m.moduleSpecifier.text,I=m.importClause;if(I!==void 0){I.name!==void 0&&a.set(I.name.text,{kind:"import",specifier:S,form:"default"});let P=I.namedBindings;if(P!==void 0&&d.isNamespaceImport(P))a.set(P.name.text,{kind:"import",specifier:S,form:"namespace"});else if(P!==void 0&&d.isNamedImports(P))for(let U of P.elements){let _=(U.propertyName??U.name).text;a.set(U.name.text,{kind:"import",specifier:S,form:{named:_}})}}}else d.isImportEqualsDeclaration(m)&&d.isExternalModuleReference(m.moduleReference)&&d.isStringLiteralLike(m.moduleReference.expression)&&a.set(m.name.text,{kind:"import",specifier:m.moduleReference.expression.text,form:"whole"});let w=new Map,N,R=new Map,A=new Map;if(k)for(let{name:m,value:S}of Gl(n)){let I=`${e}#member-export:${m}`;s.push({id:I,moduleId:e,name:m,kind:d.isArrowFunction(S)?"arrow":"function",declRange:on(e,S,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:S.getStart(n,!1),end:S.getEnd(),id:I}),w.set(S.getStart(n,!1),I)}if(i&&k){let m=_=>{let C=Ce(_);return d.isFunctionExpression(C)||d.isArrowFunction(C)?C:void 0},S=(_,C)=>{let B=_;return s.push({id:B,moduleId:e,kind:d.isArrowFunction(C)?"arrow":"function",declRange:on(e,C,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:C.getStart(n,!1),end:C.getEnd(),id:B}),w.set(C.getStart(n,!1),B),B},I=[],P=[],U=[];for(let _ of n.statements)d.isExportAssignment(_)&&!_.isExportEquals?I.push(_):d.isFunctionDeclaration(_)&&d.getModifiers(_)?.some(C=>C.kind===d.SyntaxKind.DefaultKeyword)===!0?P.push(_):d.isExpressionStatement(_)&&d.isBinaryExpression(_.expression)&&_.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&Ae(_.expression.left)&&U.push(_.expression);if(I.length+P.length+U.length===1){let _=I[0],C=P[0],B=U[0];if(_!==void 0){let V=m(_.expression);if(V!==void 0){let $=S(`${e}#<default>`,V);N={id:$,esm:!0},A.set(_.getStart(n,!1),$),te(r,"2a-default",null)}}else if(C!==void 0&&C.name===void 0&&C.body!==void 0){let V=S(`${e}#<default>`,C);N={id:V,esm:!0},A.set(C.getStart(n,!1),V),te(r,"2a-default",null)}else if(B!==void 0){let V=m(B.right);if(V!==void 0){let $=S(`${e}#<default>`,V);N={id:$,esm:!1},A.set(B.getStart(n,!1),$),te(r,"2a-default",null)}else if(d.isObjectLiteralExpression(B.right)){let $=B.right,H=[],Z=!0;for(let K of $.properties){if(d.isSpreadAssignment(K)){Z=!1;break}let q=K.name,T=q===void 0?void 0:ii(q);if(T===void 0){Z=!1;break}H.push(T)}if(Z){let K=new Map;for(let q of H)K.set(q,(K.get(q)??0)+1);for(let q of $.properties){if(!d.isPropertyAssignment(q))continue;let T=ii(q.name),W=m(q.initializer);if(T!==void 0){if(!Hl(T)){W!==void 0&&te(r,"2a-member","charset-refused");continue}if((K.get(T)??0)!==1){W!==void 0&&te(r,"2a-member","duplicate-key");continue}if(W!==void 0){let ae=S(`${e}#<cjs>.${T}`,W);R.set(T,ae),A.set(q.getStart(n,!1),ae),te(r,"2a-member",null)}}}}else for(let K of $.properties)d.isPropertyAssignment(K)&&m(K.initializer)!==void 0&&te(r,"2a-member","spread-or-computed-literal")}}}else{for(let _ of I)m(_.expression)!==void 0&&te(r,"2a-default","duplicate-default-sources");for(let _ of P)_.name===void 0&&te(r,"2a-default","duplicate-default-sources");for(let _ of U)if(m(_.right)!==void 0)te(r,"2a-default","duplicate-default-sources");else if(d.isObjectLiteralExpression(_.right))for(let C of _.right.properties)d.isPropertyAssignment(C)&&m(C.initializer)!==void 0&&te(r,"2a-member","duplicate-default-sources")}}for(let m of t)s.push({id:m.id,moduleId:e,name:`handler:${m.memberPath}`,kind:d.isArrowFunction(m.node)?"arrow":"function",declRange:on(e,m.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:m.node.getStart(n,!1),end:m.node.getEnd(),id:m.id});l.sort((m,S)=>m.end-m.start-(S.end-S.start));let b=c!==void 0?`${e}#${c}`:void 0;return{rel:e,sf:n,functions:s,bindings:a,exportedFunctionId:b,exportedNames:o,tainted:u,fnRanges:l,toplevelId:f,classes:h,mintedByPos:w,mintedDefault:N,mintedMembers:R,mintSeedAliases:A}}function xd(e){return d.isIdentifier(e)?"identifier":d.isPropertyAccessExpression(e)?"member":d.isElementAccessExpression(e)?"computed-member":e.kind===d.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function os(e,n){let t=i=>{if(d.isBinaryExpression(i)&&i.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=d.SyntaxKind.LastAssignment){let r=i.left;d.isPropertyAccessExpression(r)&&d.isIdentifier(r.expression)?n(r.expression.text,r.name.text):d.isElementAccessExpression(r)&&d.isIdentifier(r.expression)&&n(r.expression.text,d.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(d.isCallExpression(i)&&d.isPropertyAccessExpression(i.expression)){let r=i.expression,s=i.arguments[0];d.isIdentifier(r.expression)&&s!==void 0&&d.isIdentifier(s)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(s.text,null)}d.forEachChild(i,t)};t(e)}function Sd(e){let n=!1,t=i=>{if(!n){if(d.isVariableDeclaration(i)||d.isParameter(i)){let r=new Set;if($n(i.name,r),r.has("require")){n=!0;return}}else if((d.isFunctionDeclaration(i)||d.isClassDeclaration(i))&&i.name!==void 0&&i.name.text==="require"){n=!0;return}d.forEachChild(i,t)}};return t(e),n}function bd(e,n,t,i=new Map,r={}){let s=r.additiveForms===!0,a=r.namelessExports===!0,l=s||a?{}:void 0,o=new Map,c=new Map;for(let m of n.imports)m.resolvedModuleId!==void 0&&c.set(`${m.moduleId}::${m.specifier}`,m.resolvedModuleId);for(let m of e.sourceFiles){let S=e.toRel(m.fileName);S!==null&&o.set(S,yd(S,m,i.get(S)??[],a,l))}let u=new Map;if(s)for(let m of o.values()){let S=new Map;for(let[I,P]of m.bindings)if(P.kind==="import"&&P.form==="whole"&&me(P.specifier)!=="package-root"){let U=c.get(`${m.rel}::${P.specifier}`);U!==void 0&&S.set(I,String(U))}S.size!==0&&os(m.sf,(I,P)=>{let U=S.get(I);if(U===void 0)return;let _=u.get(U);if(_!=="*"){if(P===null){u.set(U,"*");return}_===void 0?u.set(U,new Set([P])):_.add(P)}})}let f=new Map;for(let m of o.values())m.exportedFunctionId!==void 0&&f.set(m.rel,m.exportedFunctionId);let p=new Map;for(let m of o.values()){if(m.rel.split("/").includes("node_modules"))continue;let S=Bl(m.sf);if(S===void 0){a&&m.mintedDefault!==void 0&&p.set(m.rel,m.mintedDefault);continue}let I=m.bindings.get(S.name);I?.kind==="function"&&p.set(m.rel,{id:I.functionId,esm:S.esm})}let h=new Map;for(let m of o.values()){let S;for(let I of m.exportedNames){let P=m.bindings.get(I);P?.kind==="function"&&(S??=new Map,S.set(I,P.functionId))}S!==void 0&&h.set(m.rel,S)}let k=new Map;for(let m of o.values()){if(m.rel.split("/").includes("node_modules"))continue;let S=ed(m.sf,m.tainted,I=>{let P=m.bindings.get(I);return P?.kind==="function"?P.functionId:void 0},a?I=>{let P=Ce(I);return d.isFunctionExpression(P)||d.isArrowFunction(P)?m.mintedByPos.get(P.getStart(m.sf,!1)):void 0}:void 0);S.size>0&&k.set(m.rel,S)}let x=[],y=[],w=[],N=[],R=[],A=[];for(let m of o.values()){x.push(...m.functions),A.push(...m.classes);for(let E of m.exportedNames){let v=m.bindings.get(E);if(v?.kind==="function"){let O=`${m.rel}#export:${E}`;N.push({id:O,moduleId:m.rel,exportedName:E,kind:"value"}),R.push({exportId:O,target:{kind:"function",functionId:v.functionId}})}}if(a){if(m.mintedDefault!==void 0){let E=`${m.rel}#export:<default>`;N.push({id:E,moduleId:m.rel,exportedName:"default",kind:"value"}),R.push({exportId:E,target:{kind:"function",functionId:m.mintedDefault.id}})}for(let[E,v]of m.mintedMembers){let O=`${m.rel}#export:<cjs>.${E}`;N.push({id:O,moduleId:m.rel,exportedName:E,kind:"value"}),R.push({exportId:O,target:{kind:"function",functionId:v}})}}let S=new Map;for(let[E,v]of m.bindings){if(v.kind==="function"){S.set(E,v);continue}if(me(v.specifier)==="package-root"){let D=He(v.specifier);typeof v.form=="object"?S.set(E,{kind:"package-export",packageName:D,exportName:v.form.named}):v.form==="require-default"?S.set(E,{kind:"package-default",packageName:D}):S.set(E,{kind:"package-surface",packageName:D})}else{let D=c.get(`${m.rel}::${v.specifier}`);if(D!==void 0&&typeof v.form=="object"){let Y=h.get(String(D))?.get(v.form.named);Y!==void 0&&S.set(E,{kind:"app-named-fn",functionId:Y})}else if(D!==void 0&&v.form==="require-default"){let Y=p.get(String(D));Y!==void 0&&Y.esm&&S.set(E,{kind:"app-default-fn",functionId:Y.id})}else D!==void 0&&typeof v.form!="object"&&v.form!=="require-default"&&S.set(E,{kind:"module",resolvedModuleId:D})}}let I=new Map;for(let E of m.functions){if(E.enclosingClassId===void 0||E.name===void 0)continue;let v=I.get(E.enclosingClassId);v===void 0&&(v=new Map,I.set(E.enclosingClassId,v)),v.set(E.name,E.id)}for(let E of m.classes)E.name===void 0||m.tainted.has(E.name)||S.has(E.name)||S.set(E.name,{kind:"app-class",cls:{classId:E.id,className:E.name,memberIds:I.get(E.id)??new Map}});let P=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0&&d.isNewExpression(E.initializer)&&!m.tainted.has(E.name.text)&&!S.has(E.name.text)){let v=es(E.initializer,S,m.tainted);v!==null&&S.set(E.name.text,v)}d.forEachChild(E,P)};P(m.sf);let U=E=>{for(let v of m.fnRanges)if(E>=v.start&&E<v.end)return v.id;return m.toplevelId},_=new Map,C=new Map,B=new Map,V=(E,v,O)=>{if(O===null){E.set(v,"*");return}let D=E.get(v);D!=="*"&&(D===void 0?E.set(v,new Set([O])):D.add(O))},$=(E,v)=>{V(_,E,v);let O=S.get(E);O?.kind==="package-surface"?V(C,O.packageName,v):O?.kind==="module"&&V(B,String(O.resolvedModuleId),v)};os(m.sf,$);let H=new Map,Z=256,K=E=>{let v=H.get(E);return v===void 0&&(v=H.size>=Z?new Set([E]):gs(m.sf,new Set([E])),H.set(E,v)),v},q=(E,v)=>E==="*"||E!==void 0&&E.has(v),T=(E,v)=>{let O=S.get(E);if(O?.kind==="package-surface"&&q(C.get(O.packageName),v)||O?.kind==="module"&&q(B.get(String(O.resolvedModuleId)),v))return!0;for(let D of K(E))if(q(_.get(D),v))return!0;return!1},W=E=>{if(d.isIdentifier(E)){let v=m.tainted.has(E.text)?void 0:S.get(E.text);return v?.kind==="function"?v.functionId:v?.kind==="module"?f.get(String(v.resolvedModuleId))??null:v?.kind==="package-export"?t.exportFor(v.packageName,v.exportName):null}if(d.isPropertyAccessExpression(E)&&d.isIdentifier(E.expression)){let v=E.expression.text;if(T(v,E.name.text))return null;let O=m.tainted.has(v)?void 0:S.get(v);return O?.kind==="package-surface"?t.exportFor(O.packageName,E.name.text):O?.kind==="package-export"?t.methodFor(O.packageName,O.exportName,E.name.text,"method"):O?.kind==="package-instance"?t.methodFor(O.packageName,O.className,E.name.text,"method"):null}return null},ae=E=>{for(let v=E.parent;v!==void 0;v=v.parent)if(!d.isArrowFunction(v)){if(d.isFunctionExpression(v)||d.isFunctionDeclaration(v))return null;if(d.isMethodDeclaration(v)||d.isConstructorDeclaration(v)||d.isGetAccessorDeclaration(v)||d.isSetAccessorDeclaration(v)){let O=v.parent;if(!d.isClassLike(O)||O.name===void 0)return null;let D=m.tainted.has(O.name.text)?void 0:S.get(O.name.text);return D?.kind==="app-class"?D.cls:null}}return null},Le=s&&!m.tainted.has("require")&&!Sd(m.sf),xe=E=>{if(d.isIdentifier(E)){let D=m.tainted.has(E.text)?void 0:S.get(E.text);return D?.kind==="package-surface"||D?.kind==="package-default"?t.exportFor(D.packageName,"default"):D?.kind==="app-named-fn"||D?.kind==="app-default-fn"?D.functionId:D?.kind==="module"?p.get(String(D.resolvedModuleId))?.id??null:D?.kind==="member-value"?D.functionId:null}if(!d.isPropertyAccessExpression(E))return null;let v=E.expression;if(s&&d.isCallExpression(Ce(v))){let D=Ye(Ce(v));if(D!==void 0)if(!Le)te(l,"2b","require-shadow");else if(me(D)==="package-root")te(l,"2b","package-root");else{let Y=c.get(`${m.rel}::${D}`);if(Y===void 0)te(l,"2b","unresolved-module");else{let ie=E.name.text,ye=u.get(String(Y));if(ye==="*"||ye!==void 0&&ye.has(ie))te(l,"2b","module-mutation-gate");else{let re=k.get(String(Y))?.get(ie);if(re!==void 0)return te(l,"2b",null),re;if(ie==="default"){let le=p.get(String(Y));if(le!==void 0&&le.esm)return te(l,"2b",null),le.id;te(l,"2b","non-esm-default")}else te(l,"2b","unknown-member")}}}return null}let O;if(d.isIdentifier(v)){let D=m.tainted.has(v.text)?void 0:S.get(v.text);if(D?.kind==="app-class"||D?.kind==="app-instance")O=D.cls.memberIds;else if(D?.kind==="object-literal")O=D.obj.members;else if(D?.kind==="module"){let Y=k.get(String(D.resolvedModuleId));Y?.has(E.name.text)===!0&&!T(v.text,E.name.text)&&(O=Y)}}else if(d.isNewExpression(v)){let D=es(v,S,m.tainted);D?.kind==="app-instance"&&(O=D.cls.memberIds)}else v.kind===d.SyntaxKind.ThisKeyword&&(O=ae(E)?.memberIds);return O?.get(E.name.text)??null},Se=new Map,ln=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0&&d.isObjectLiteralExpression(E.initializer)&&!m.tainted.has(E.name.text)&&!S.has(E.name.text)&&!Se.has(E.name.text)){let v=new Map;for(let O of E.initializer.properties)if(d.isPropertyAssignment(O)&&d.isIdentifier(O.name)){let D=W(O.initializer);D!==null&&v.set(O.name.text,D)}Se.set(E.name.text,v)}d.forEachChild(E,ln)};ln(m.sf);let An=E=>{if(d.isBinaryExpression(E)&&E.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(E.left)&&d.isIdentifier(E.left.expression)&&!m.tainted.has(E.left.expression.text)){let v=Se.get(E.left.expression.text);if(v!==void 0){let O=W(E.right);O!==null&&v.set(E.left.name.text,O)}}d.forEachChild(E,An)};An(m.sf);for(let[E,v]of Se)S.set(E,{kind:"object-literal",obj:{members:v}});let F=(E,v=0)=>{if(v>Qr)return null;let O=Ce(E);if(d.isCallExpression(O)&&d.isPropertyAccessExpression(O.expression)&&O.expression.name.text==="bind")return F(O.expression.expression,v+1);if(d.isIdentifier(O)){let D=W(O);if(D!==null)return D;let Y=m.tainted.has(O.text)?void 0:S.get(O.text);return Y?.kind==="member-value"?Y.functionId:null}return d.isPropertyAccessExpression(O)?W(O)??xe(O):null},Ee=(E,v=0)=>{if(v>Qr)return"depth-cap";let O=Ce(E);if(d.isCallExpression(O)&&d.isPropertyAccessExpression(O.expression)&&O.expression.name.text==="bind")return Ee(O.expression.expression,v+1);if(d.isIdentifier(O))return m.tainted.has(O.text)?"tainted-receiver":"unresolved-receiver";if(d.isPropertyAccessExpression(O)&&d.isIdentifier(O.expression)){if(m.tainted.has(O.expression.text))return"tainted-receiver";if(T(O.expression.text,O.name.text))return"mutated-member"}return"unresolved-receiver"},we=E=>{if(d.isVariableDeclaration(E)&&d.isIdentifier(E.name)&&E.initializer!==void 0){let v=Ce(E.initializer),O=d.isPropertyAccessExpression(v),D=d.isCallExpression(v)&&d.isPropertyAccessExpression(v.expression)&&v.expression.name.text==="bind";if(O||D){let Y=O?"D1":"A2";if(m.tainted.has(E.name.text))te(l,Y,"tainted-alias");else if(S.has(E.name.text))te(l,Y,"already-bound");else{let ie=F(v);ie!==null?(S.set(E.name.text,{kind:"member-value",functionId:ie}),te(l,Y,null)):te(l,Y,Ee(v))}}}d.forEachChild(E,we)};s&&we(m.sf);let fe=0,Te=E=>{let v,O;if(d.isCallExpression(E)){let D=E.expression,Y=d.isIdentifier(D)&&D.text==="require",ie=D.kind===d.SyntaxKind.ImportKeyword;!Y&&!ie&&(v=D,O=E.arguments)}else d.isTaggedTemplateExpression(E)&&(v=E.tag);if(v!==void 0){let D=xd(v),Y=E.getStart(m.sf,!1),ie=`${m.rel}#call${String(fe)}`;fe+=1;let ye="unresolved",re=[],le=W(v);le!==null&&(ye="resolved",re.push(le)),y.push({id:ie,enclosingFunctionId:U(Y),calleeExprShape:D,resolvedTargetIds:re,resolution:ye,range:on(m.rel,E,m.sf)});for(let se of re)w.push({callSiteId:ie,calleeFunctionId:se,resolution:ye});if(le===null){let se=xe(v);if(se!==null)w.push({callSiteId:ie,calleeFunctionId:se,resolution:"field-based"});else if(s&&d.isPropertyAccessExpression(v)&&(v.name.text==="call"||v.name.text==="apply")){let be=F(v.expression);be!==null?(w.push({callSiteId:ie,calleeFunctionId:be,resolution:"field-based"}),te(l,"A3",null)):te(l,"A3",Ee(v.expression))}}for(let se of O??[]){let be=W(se);if(be!==null)w.push({callSiteId:ie,calleeFunctionId:be,resolution:"field-based"});else{let De=xe(se);if(De!==null)w.push({callSiteId:ie,calleeFunctionId:De,resolution:"field-based"});else if(s){let Fe=F(se),j=Ce(se),L=j!==se||d.isCallExpression(j)&&d.isPropertyAccessExpression(j.expression)&&j.expression.name.text==="bind";Fe!==null?(w.push({callSiteId:ie,calleeFunctionId:Fe,resolution:"field-based"}),L&&te(l,"A2p",null)):L&&te(l,"A2p",Ee(se))}}}}d.forEachChild(E,Te)};Te(m.sf);for(let E of n.computedLoads.get(m.rel)??[]){let v=E.candidateRels.filter(D=>o.has(D)).map(D=>`${D}#<toplevel>`);if(v.length===0)continue;let O=`${m.rel}#dirload${String(fe)}`;fe+=1,y.push({id:O,enclosingFunctionId:U(E.pos),calleeExprShape:"require",resolvedTargetIds:v,resolution:"field-based",range:{path:m.rel,start:E.pos,end:E.pos}});for(let D of v)w.push({callSiteId:O,calleeFunctionId:D,resolution:"field-based"})}let X=0;for(let E of i.get(m.rel)??[]){let v=`${m.rel}#handlerseed${String(X)}`;X+=1;let O=E.node.getStart(m.sf,!1);y.push({id:v,enclosingFunctionId:m.toplevelId,calleeExprShape:"member",resolvedTargetIds:[E.id],resolution:"field-based",range:{path:m.rel,start:O,end:O}}),w.push({callSiteId:v,calleeFunctionId:E.id,resolution:"field-based"})}}let b=new Map;if(a)for(let m of o.values())for(let[S,I]of m.mintSeedAliases)b.set(`${m.rel}::${String(S)}`,I);return{functions:x,callSites:y,callEdges:w,exports:N,exportBindings:R,classes:A,mintSeedAliases:b,bindingApplicability:l}}function kd(e,n,t){let i=o=>o.length===0||Oe.isAbsolute(o)||o.includes("\\")||/^[a-zA-Z]:/u.test(o)||o.split("/").some(c=>c===".."||c==="");if(i(n)||i(t))return null;let r=e.endsWith(Oe.sep)?e:e+Oe.sep,s;try{s=Yr(Oe.resolve(e,n))}catch{return null}if(!s.startsWith(r))return null;let a=s.endsWith(Oe.sep)?s:s+Oe.sep,l;try{l=Yr(Oe.resolve(s,t))}catch{return null}return l.startsWith(a)?l:null}function bs(e,n,t){let i=`${e}#class:${t}`,r=[],s=[],a=[],l=new Set;return{pushMember(o,c,u,f){if(o==="__proto__"||l.has(o))return;l.add(o);let p=`${e}#${t}.${o}`;r.push({id:p,moduleId:e,name:o,kind:u,enclosingClassId:i,declRange:on(e,c,n),isExported:!1,publicSurfaceReachable:!1}),a.push(p),s.push({name:o,id:p,kind:u,body:f})},finish(){return s.length===0?null:{functions:r,classNode:{id:i,moduleId:e,name:t,implementsRefs:[],members:a},members:s}}}}function Ed(e,n,t,i){if(Ss(i)||i.members.length>ri)return null;let r=bs(e,n,t);for(let s of i.members){let a,l,o;if(d.isConstructorDeclaration(s))a="constructor",l="ctor",o=void 0;else if(d.isMethodDeclaration(s))a=pt(s.name),l="method",o=a!==void 0&&!En.has(a)?s.body??void 0:void 0;else continue;a!==void 0&&r.pushMember(a,s,l,o)}return r.finish()}function wd(e,n,t){let i;for(let a of n.statements)if(d.isFunctionDeclaration(a)&&a.name?.text===t){i=a;break}if(i===void 0)return null;let r=[];for(let a of n.statements){if(!d.isExpressionStatement(a))continue;let l=a.expression;if(!d.isBinaryExpression(l)||l.operatorToken.kind!==d.SyntaxKind.EqualsToken)continue;let o=l.left;if(d.isPropertyAccessExpression(o)&&d.isPropertyAccessExpression(o.expression)&&d.isIdentifier(o.expression.expression)&&o.expression.expression.text===t&&o.expression.name.text==="prototype"){let c=o.name.text;d.isFunctionExpression(l.right)?r.push({name:c,fn:l.right,walk:!0}):d.isArrowFunction(l.right)&&r.push({name:c,fn:l.right,walk:!1})}}if(r.length===0||r.length+1>ri)return null;let s=bs(e,n,t);s.pushMember("constructor",i,"ctor",void 0);for(let a of r){let l=a.walk&&!En.has(a.name)&&d.isFunctionExpression(a.fn)?a.fn.body:void 0;s.pushMember(a.name,a.fn,"method",l)}return s.finish()}function vd(e,n,t){for(let i of n.statements)if(d.isClassDeclaration(i)&&i.name?.text===t)return Ed(e,n,t,i);return wd(e,n,t)}function Id(e,n,t,i,r){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let a=new Set(t.map(f=>f.packageName)),l=new Set(t.map(f=>f.path)),o=new Set,c=new Set,u=0;for(let f of n){if(!a.has(f.packageName))continue;let p=kd(e.appRoot,f.packageRootRel,f.sourcePath);if(p===null)continue;let h=e.toRel(p);if(h===null)continue;let k=`${h}#${f.container}`;if(c.has(k)||!o.has(h)&&o.size>=ut)continue;let x=Ne(p);if(x===null)continue;let y;try{y=d.createSourceFile(h,x,d.ScriptTarget.Latest,!0,d.ScriptKind.JS)}catch{continue}let w=vd(h,y,f.container);if(w===null)continue;o.add(h),c.add(k);let N=new Map,R=new Map;for(let b of w.members){let m=r.methodFor(f.packageName,f.container,b.name,b.kind);N.set(b.name,m),R.set(m,b.id)}let A=0;for(let b of w.members){if(b.body===void 0)continue;let m=(S,I)=>{if(I&&d.isCallExpression(S)&&d.isPropertyAccessExpression(S.expression)&&S.expression.expression.kind===d.SyntaxKind.ThisKeyword){let _=N.get(S.expression.name.text);if(_!==void 0){let C=`${h}#depclass:${f.container}.${b.name}#c${String(A)}`;A+=1,s.callSites.push({id:C,enclosingFunctionId:b.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:on(h,S,y)}),s.callEdges.push({callSiteId:C,calleeFunctionId:_,resolution:"field-based"})}}let P=d.isFunctionExpression(S)||d.isFunctionDeclaration(S)||d.isMethodDeclaration(S)||d.isConstructorDeclaration(S)||d.isGetAccessorDeclaration(S)||d.isSetAccessorDeclaration(S)||d.isClassLike(S),U=d.isArrowFunction(S)?I:P?!1:I;d.forEachChild(S,_=>{m(_,U)})};m(b.body,!0)}for(let b of i){let m=R.get(b.calleeFunctionId);m!==void 0&&s.callEdges.push({callSiteId:b.callSiteId,calleeFunctionId:m,resolution:"field-based"})}if(s.functions.push(...w.functions),s.classes.push(w.classNode),!l.has(h)){l.add(h),s.modules.push({id:h,packageName:f.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let b=r.moduleFor(f.packageName),m=`${String(b)}#depclass${String(u)}`;u+=1,s.imports.push({id:m,moduleId:b,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),s.importEdges.push({importId:m,resolvedModuleId:h})}s.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(w.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return s}function Ad(e,n,t,i){let r=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.packageName)),s=new Map(e.functions.map(o=>[o.id,o.moduleId])),a=new Map;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let c=s.get(o.enclosingFunctionId);c!==void 0&&a.set(c,(a.get(c)??0)+1)}let l=[];for(let o of e.modules){if(o.externalSurface===!0)continue;let c=n.get(o.path);if(c===void 0||t.has(o.path)||r.has(o.packageName)&&i.has(o.path)&&!o.path.split("/").includes("node_modules"))continue;let u=a.get(o.id)??0;if(u===0&&ad(c))continue;let f=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:o.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:o.id})}return l}function ks(e,n,t=[],i={},r=!1){let s=new ti,a=Tl(e,n,s),l=new Set;for(let A of a.computedLoads.values())for(let b of A)if(b.seedable)for(let m of b.candidateRels)l.add(m);let o=new Map;for(let A of e.sourceFiles){let b=e.toRel(A.fileName);if(b===null||!l.has(b)||b.split("/").includes("node_modules"))continue;let m=hd(b,A);m.length>0&&o.set(b,m)}let c=o.size===0?a.modules:a.modules.map(A=>o.has(A.path)&&!A.isEntrypoint?{...A,isEntrypoint:!0}:A),u={...a,modules:c},f=bd(e,u,s,o,i),p=sd(e,a,f.functions,f.mintSeedAliases),h=new Set(a.modules.map(A=>A.path)),k=Kl(e.depReach,s,h),x=[...u.modules,...k.modules,...s.modules()],y=Id(e,t,x,f.callEdges,s),w=[];if(r){let A="#default",b=new Set;for(let S of f.callEdges){let I=String(S.calleeFunctionId);!I.startsWith("pkg:")||!I.endsWith(A)||b.add(I.slice(4,I.length-A.length))}let m=new Map;for(let S of e.depReach.edges){if(!("surface"in S.from)||"surface"in S.to)continue;let I=S.from.surface;m.set(I,m.has(I)?null:S.to.module)}for(let S of b){let I=m.get(S);if(I==null)continue;let P=Dl(Oe.join(e.appRoot,I));if(P===null||P==="default")continue;let U=s.exportFor(S,P),_=`pkg:${S}${A}`;for(let C of f.callEdges)String(C.calleeFunctionId)===_&&w.push({callSiteId:C.callSiteId,calleeFunctionId:U,resolution:"field-based"})}}let N={modules:[...u.modules,...k.modules,...y.modules,...s.modules()],exports:[...f.exports,...p.exports],imports:[...a.imports,...k.imports,...y.imports],functions:[...f.functions,...s.functions(),...y.functions],callSites:[...f.callSites,...y.callSites],classes:[...f.classes,...s.classes(),...y.classes],callEdges:[...f.callEdges,...y.callEdges,...w],importEdges:[...a.importEdges,...k.importEdges,...y.importEdges],exportBindings:[...f.exportBindings,...p.exportBindings],inheritEdges:[]},R=new Map;for(let A of e.sourceFiles){let b=e.toRel(A.fileName);b!==null&&R.set(b,A)}return{graph:N,diagnostics:[...p.diagnostics,...y.diagnostics,...Ad(N,R,new Set(e.diagnostics.filter(A=>A.code==="dependency-body").map(A=>A.path)),a.appOwnedPaths)],...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var _d=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,mt=/^[A-Za-z0-9_$.-]{1,128}$/u;function Nd(e){return _d.test(e.calleePackage)?mt.test(e.anchorExport)?mt.test(e.calleeExport)?e.anchorContainer!==null&&!mt.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!mt.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Dn(e,n){let t=[],i=[],r=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.classes.map(c=>[c.id,c.name])),a=(c,u,f)=>e.functions.some(p=>{if(p.name!==u)return!1;let h=r.get(p.moduleId);return h===void 0||h.packageName!==c?!1:(p.enclosingClassId!==void 0?s.get(p.enclosingClassId)??null:null)===f}),l=(c,u,f)=>{for(let p of e.functions){if(p.name!==u)continue;let h=r.get(p.moduleId);if(!(h===void 0||h.packageName!==c||(p.enclosingClassId!==void 0?s.get(p.enclosingClassId)??null:null)!==f))return p.id}return null},o=[...n].sort((c,u)=>c.modelId<u.modelId?-1:c.modelId>u.modelId?1:0);for(let c of o){if(c.edges.length>64){t.push(`model ${c.modelId}: ${String(c.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=c.edges.map(Nd).find(h=>h!==null);if(u!==void 0){t.push(`model ${c.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let f=0,p=0;for(let h of c.edges){if(!a(c.packageName,h.anchorExport,h.anchorContainer)){p+=1;continue}i.push({modelId:c.modelId,kind:h.kind,anchor:{packageName:c.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:l(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${c.modelId}: ${String(f)} edge(s) lowered, ${String(p)} reference-gated`):t.push(`model ${c.modelId}: refused \u2014 no anchor surface in the graph (${String(p)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:i,notes:t}}}var Cd={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function ui(e){try{let n=Gr(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(a=>a.split(nn.sep).join("/"))),{graph:i,diagnostics:r,bindingApplicability:s}=ks(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:i,diagnostics:[...n.diagnostics,...r],...s!==void 0?{bindingApplicability:s}:{}}}catch(n){return{graph:Cd,diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Es(e,n){let t=512,i=(r,s)=>{if(!(t<=0||s>12)){if(t-=1,typeof r=="string"){n(r);return}if(Array.isArray(r)){for(let a of r)i(a,s+1);return}if(r!==null&&typeof r=="object")for(let[a,l]of Object.entries(r))a==="types"||a==="typings"||i(l,s+1)}};i(e,0)}function As(e,n,t,i=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=Fn(nn.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||i&&!We(r)?null:r===e?"":r.slice(n.length).split(nn.sep).join("/")}function _s(e){let n=Fn(e),t=n.endsWith(nn.sep)?n:n+nn.sep,i=new Set,r=[],s=[],a=[],l=(m,S,I=!1)=>{let P=As(n,t,m);return P===null||P.length===0?"unresolved":i.has(P)?"duplicate":(i.add(P),r.push(P),s.push({source:S,specifier:Je(typeof m=="string"?m:""),entrypoint:P,launch:I}),"added")},o=[],c=(m,S)=>{a.push({source:m,file:m,detail:S.detail}),o.push({code:S.code,path:m,detail:`${m} ${S.detail}`})},u,f,p,h=null,k=ws(n,t,"package.json",rn);k.kind==="refused"&&c("package.json",k);try{let m=k.kind==="ok"?JSON.parse(k.text):{};if(h=k.kind==="ok"?m:null,l(m.main,"main"),typeof m.bin=="string")l(m.bin,"bin");else if(m.bin!==null&&typeof m.bin=="object")for(let I of Object.values(m.bin))l(I,"bin");Es(m.exports,I=>{l(I,"exports")}),Es(m.browser,I=>{l(I,"browser")});let S=m.scripts;if(S!==null&&typeof S=="object"){let I=S;u=I.start,f=I.prestart,p=I.poststart}}catch{}if(r.length===0)try{Fn(nn.join(n,"index.js")),l("index.js","index.js fallback")}catch{}let x=(m,S)=>typeof m=="string"&&m.trim().length>0?vs(m,S,"package.json",l,a,!1)==="used"?"resolved":"gapped":m===void 0||typeof m=="string"?"absent":(a.push({source:S,file:"package.json",detail:`${S} is not a string; no entry file could be read from it`}),"gapped"),y=x(u,"scripts.start"),w=x(f,"scripts.prestart"),N=x(p,"scripts.poststart"),R=y==="resolved"&&w!=="gapped"&&N!=="gapped",A=ws(n,t,"Procfile",65536);if(A.kind==="refused")c("Procfile",A);else if(A.kind==="ok"){let{entries:m,truncated:S,unnamedLines:I}=ni(A.text);S&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),I>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(I)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let P of m)vs(P.command,`Procfile:${P.name}`,"Procfile",l,a,R)}let b=r.length===0?Qt(n,h):null;return{entrypoints:r,sources:s,gaps:a,diagnostics:o,framework:b}}function ws(e,n,t,i){let r;try{r=Fn(nn.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=bn(r,i);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(i)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function vs(e,n,t,i,r,s){let a=ei(e);return a.kind==="delegates"?s?"used":(r.push({source:n,file:t,detail:`\`${Je(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped"):a.kind==="unparsed"?(r.push({source:n,file:t,detail:`\`${Je(e)}\`: ${a.reason}`}),"gapped"):i(a.specifier,n,!0)==="unresolved"?(r.push({source:n,file:t,detail:`\`${Je(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function fi(e,n){if(n.length===0||!e.some(i=>i.launch))return[];let t=n.slice(0,3).map(i=>i.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${t}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Ns(e,n){let t=Fn(e),i=t.endsWith(nn.sep)?t:t+nn.sep,r=new Set,s=[],a=[];for(let l of n){let o=As(t,i,l,!0);if(o===null||o.length===0){a.push(l);continue}r.has(o)||(r.add(o),s.push(o))}return{entrypoints:s,rejected:a}}import{readdirSync as Fs,readFileSync as yi,realpathSync as xi,statSync as zn}from"node:fs";import Ue from"node:path";function Od(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let i=t+2;for(;i<e.length&&e.charCodeAt(i)===32;)i+=1;let r=e.charCodeAt(i);return r===38||r===42}function Kn(e,n,t){let i=n.maxLines??2e6,r=n.maxLineBytes??16384,s=!1,a=!1,l=0,o=0,c=e.charCodeAt(0)===65279?1:0;for(;c<=e.length;){let u=e.indexOf(`
-`,c),f=u===-1;f&&(u=e.length);let p=u>c&&e.charCodeAt(u-1)===13?u-1:u;if(o+=1,o>i){s=!0;break}if(p-c>r)l+=1;else{let h=c;for(;h<p&&e.charCodeAt(h)===32;)h+=1;let k=h-c,x=p;for(;x>h&&(e.charCodeAt(x-1)===32||e.charCodeAt(x-1)===9);)x-=1;if(h<x&&e.charCodeAt(h)!==35){let y=e.slice(h,x);if(Od(y)){a=!0;break}t(k,y)}}if(f)break;c=u+1}return{truncated:s||l>0,refusedAnchors:a,oversizeLines:l}}function ht(e){let n=e.charCodeAt(0);if(n===34||n===39){let i=e.indexOf(String.fromCharCode(n),1);if(i===-1)return null;let r=i+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,i+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function vn(e){return e.endsWith(":")}function ze(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function gt(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,i=t.indexOf("/");if(n){if(i<=0||t.indexOf("/",i+1)!==-1)return!1}else if(i!==-1)return!1;let r=n?[t.slice(0,i),t.slice(i+1)]:[t];for(let s of r){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let a=0;a<s.length;a+=1){let l=s.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function jn(e){return gt(e)?`node_modules/${e}`:""}function Bn(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Cs=2e5,Os=64,Rd=1024,$d=5,Md=[1,2,3];function Pd(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let i=e.slice(t+n.length);if(i==="")return null;let r=i.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function Rs(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let i=t.indexOf("@",1);if(i>0){let r=t.slice(0,i),s=t.slice(i+1);if(r.length>0&&s.length>0)return[{name:r,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function In(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function $s(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Ms(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Ps(e,n,t,i,r=!1){let s=JSON.stringify([n,t,i]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:i,dev:r})}}function Ld(e,n){for(let[t,i]of Object.entries(e)){if(t==="")continue;if(!Ms(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=In(i);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let a=s.name,l=typeof a=="string"&&a!==""?a:Pd(t),o=s.version;if(l===null||typeof o!="string"){r&&(n.unread+=1);continue}let c=s.dev===!0||s.devOptional===!0;for(let u of Rs(l,o))Ps(n,u.name,u.version,t,c)}}function Ls(e,n,t){let i=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let s=0;s<i.length;s+=1){let a=i[s];if(a===void 0)break;for(let[l,o]of Object.entries(a.deps)){if(!Ms(n))return{depthCapped:r};if(l===""){n.unread+=1;continue}let c=In(o);if(c===null){n.unread+=1;continue}let u=a.pathSafe&&gt(l),f=u?`${a.prefix}node_modules/${l}`:"",p=u&&f.length<=Rd,h=p?f:"",k=c.version,x=c.dev===!0||a.dev;if(c.link!==!0&&typeof k=="string"&&k!=="")for(let w of Rs(l,k))Ps(n,w.name,w.version,h,x);else n.unread+=1;let y=In(c.dependencies);if(y!==null){if(a.depth+1>t){r=!0;continue}i.push({deps:y,prefix:p?`${h}/`:a.prefix,depth:a.depth+1,pathSafe:p,dev:x})}}}return{depthCapped:r}}function Td(e,n,t){let i=$s(n.maxEntries),{depthCapped:r}=Ls(e,i,t),s=[],a=new Set(n.deps.map(c=>JSON.stringify([c.name,c.version]))),l=new Set,o=[];for(let c of i.deps){if(c.version.includes(":"))continue;let u=JSON.stringify([c.name,c.version]);a.has(u)||l.has(u)||(l.add(u),o.length<$d&&o.push(Bn(c.name,c.version)))}if(l.size>0){let c=l.size-o.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${o.join(", ")}${c>0?`, and ${String(c)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(i.capped||r)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function yt(e,n={}){let t=[],i;try{i=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=In(i);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=r.lockfileVersion,a=typeof s=="number"&&Number.isInteger(s)?s:null,l=typeof s=="number"?String(s):"?",o=In(r.packages),c=In(r.dependencies);if(o===null&&c===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!Md.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??Os,f=$s(n.maxEntries??Cs),p=!1;return o!==null?(Ld(o,f),c!==null&&t.push(...Td(c,f,u))):c!==null&&(p=Ls(c,f,u).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),p&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||p}}var Dd=["workspace:","link:","portal:","file:","exec:"];function Fd(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Kd(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let i=n.slice(0,t),r=n.slice(t+1);if(i.length===0)return[];for(let l of Dd)if(r.startsWith(l))return[];if(!r.startsWith("npm:"))return[i];let s=r.slice(4),a=s.indexOf("@",1);if(a>0){let l=s.slice(0,a);return l.length>0?[l]:[i]}return s.length===0||Fd(s)?[i]:[i,s]}function jd(e){if(vn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let i=e.charCodeAt(t);if(i===34||i===39){n===0?n=i:n===i&&(n=0);continue}if(n===0&&i===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Bd(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let i of n.split(",")){let r=i.trim();r.length>0&&t.push(r)}return t}function zd(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let i=t.length;for(;i<n.length&&i<t.length+3;){let s=n.charCodeAt(i);if(s<48||s>57)break;i+=1}let r=n.slice(t.length,i);return r.length>0?r:null}function Ts(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=ze(e.slice(8).trim());return t.length>0?t:null}function pi(e,n={}){let t=[],i=[],r=new Set,s=n.maxEntries??2e5,a=!1,l=null,o=!1,c=[],u=!1,f=-1,p=!1,h=0,k=()=>{c.length>0&&!u&&(h+=1)},x=Kn(e,n,(R,A)=>{if(R===0){k(),c=[],u=!1,f=-1,o=!1;let m=jd(A);if(m===null)return;let S=ze(m.trim());if(S==="__metadata"){a=!0,o=vn(A);return}for(let I of Bd(S))c.push(...Kd(I));return}if(o){if(R===2&&l===null){let m=Ts(A);m!==null&&(l=m)}return}if(c.length===0||(f===-1&&(f=R),R!==f||u))return;let b=Ts(A);if(b!==null){u=!0;for(let m of c){let S=JSON.stringify([m,b]);if(!r.has(S)){if(i.length>=s){p=!0;return}r.add(S),i.push({name:m,version:b,lockKey:jn(m),dev:!1})}}}});k();let y=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(x.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};x.oversizeLines>0&&t.push(`${y} has ${String(x.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),p&&t.push(`${y} exceeds ${String(s)} entries; truncated`);let w=l??zd(e),N=w===null?null:Number(w.split(".")[0]);return w!==null&&(N===null||!Number.isInteger(N)||N<1||N>8)&&t.push(`${y} declares unsupported lockfileVersion ${w} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${y} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:i,diagnostics:t,truncated:x.truncated||p}}function mi(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let i=n.indexOf("_");return i!==-1&&(n=n.slice(0,i)),n.trim()}function hi(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Ds(e){let n=ze(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let i=n.charCodeAt(0)===47;if(i&&(n=n.slice(1)),n.length===0)return null;if(!i&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),f=n.indexOf("@",1);u>0&&(f===-1||u<f)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let r=n.charCodeAt(0)===64,s=r?n.indexOf("/"):-1;if(r&&s<=0)return null;let a=r?s+1:0,l=-1;for(let u=a;u<n.length;u+=1){let f=n.charCodeAt(u);if(f===47||f===64){l=u;break}}if(l<=a)return null;let o=n.slice(0,l),c=mi(n.slice(l+1));return hi(c)?{name:o,version:c}:null}var Ud=new Set(["packages","snapshots","importers"]),Vd=new Set([5,6,7,8,9]);function qd(e){let n=ze(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function St(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:ze(e.slice(0,n).trim()),value:ze(t)}}function gi(e,n={}){let t=[],i=[],r=new Set,s=n.maxEntries??2e5,a="",l=null,o=!1,c=0,u=[],f=(h,k)=>{let x=JSON.stringify([h,k]);if(!r.has(x)){if(i.length>=s){o=!0;return}r.add(x),i.push({name:h,version:k,lockKey:jn(h),dev:!1})}},p=Kn(e,n,(h,k)=>{if(h===0){let x=ht(k);if(a=x===null?"":ze(x.trim()),l=null,a==="lockfileVersion"){let y=St(k),w=y===null?null:qd(y.value);y!==null&&(w===null||!Vd.has(w))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if(Ud.has(a)&&!vn(k)){let y=St(k)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(c+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(h!==2)return;let x=ht(k),y=x===null?null:Ds(x);if(y===null){c+=1;return}f(y.name,y.version);return}if(a==="importers"){if(h===6){let x=St(k);if(x===null){l=k.endsWith(":")?ze(k.slice(0,-1).trim()):null;return}l=null;let y=mi(x.value);hi(y)&&f(x.key,y);return}if(h===8&&l!==null){let x=St(k);if(x===null||x.key!=="version")return;let y=mi(x.value);hi(y)&&f(l,y)}}});return p.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),p.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(p.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),o&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),c>0&&t.push(`pnpm-lock.yaml has ${String(c)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:i,diagnostics:t,truncated:p.truncated||o})}var Hd=128*1024*1024,Wd=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>yt(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>yt(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>pi(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>gi(e,n===void 0?{}:{maxEntries:n})}],Gd=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Si(e,n){let t;try{t=xi(Ue.join(e,n))}catch{return null}let i=e.endsWith(Ue.sep)?e:e+Ue.sep;return t.startsWith(i)?t:null}function Ks(e,n){let t=Ue.join(e,"package.json"),i;try{i=xi(t)}catch{return null}if(!i.startsWith(n+Ue.sep))return null;try{if(!zn(i).isFile())return null;let r=JSON.parse(yi(i,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function js(e,n){try{return zn(Ue.join(e,n)),!0}catch{return!1}}function Xd(e,n){if(js(e,"pnpm-workspace.yaml"))return!0;let t=Si(e,"package.json");if(t===null)return js(e,"package.json");let i;try{let a=zn(t);if(!a.isFile()||a.size>n)return!0;i=yi(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(i)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=r[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let s=r.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function Bs(e,n){let t=Ue.join(e,"node_modules"),i=[],r;try{r=Fs(t,{withFileTypes:!0})}catch{return i}for(let s of r){let a=s.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let o;try{o=Fs(Ue.join(t,a),{withFileTypes:!0})}catch{continue}for(let c of o){let u=Ks(Ue.join(t,a,c.name),n);u!==null&&i.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${c.name}`,linked:c.isSymbolicLink()||s.isSymbolicLink()})}continue}let l=Ks(Ue.join(t,a),n);l!==null&&i.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:s.isSymbolicLink()})}return i}var Jd=5;function Yd(e,n,t){let i=Si(e,n);if(i===null){try{zn(Ue.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=zn(i)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:yi(i,"utf8")}}catch{return{gap:`${n} could not be read`}}}function zs(e,n){let t=xi(e),i=[],r=[],s=n?.maxLockfileBytes??Hd,a=[],l=new Set,o=[],c=Xd(t,s),u=null,f=!1,p=(k,x,y)=>{r.push({kind:k,detail:x,blindsAnalysis:y}),i.push(x)};for(let k of Wd){let x=Yd(t,k.file,s);if(x===null)continue;if("gap"in x){p("lockfile-unreadable",x.gap,!1);continue}let y=k.parse(x.text,n?.maxLockfileEntries);if(y.truncated&&(f=!0),y.deps.length===0){if(y.diagnostics.length>0||c){let w=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";p("lockfile-unparsed",`${k.file} yielded NO dependencies (${w}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&p("lockfile-partial",`${k.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),u===null&&(u=k.file),o.includes(k.source)||o.push(k.source);for(let w of y.deps){let N=JSON.stringify([w.name,w.version,w.lockKey]);l.has(N)||(l.add(N),a.push(w))}}for(let k of Gd)if(Si(t,k)!==null){p("yarn-pnp",`${k} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let k=o.length===1?o[0]??"none":"multi-lockfile";o.length>1&&i.push(`multiple lockfiles present (${o.join(", ")}); enumerated the UNION of all of them`);let x=new Set(a.map(N=>JSON.stringify([N.name,N.version]))),y=new Set,w=[];for(let N of Bs(t,t)){let R=JSON.stringify([N.name,N.version,N.lockKey]);l.has(R)||(l.add(R),a.push({name:N.name,version:N.version,lockKey:N.lockKey,dev:N.dev}));let A=JSON.stringify([N.name,N.version]);N.linked||x.has(A)||y.has(A)||(y.add(A),w.length<Jd&&w.push(Bn(N.name,N.version)))}if(y.size>0){let N=y.size-w.length;p("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${w.join(", ")}${N>0?`, and ${String(N)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:k,lockfilePath:u,diagnostics:i,truncated:f,gaps:r}}let h=Bs(t,t);return h.length>0?(p("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(k=>({name:k.name,version:k.version,lockKey:k.lockKey,dev:!1})),source:"node-modules",lockfilePath:null,diagnostics:i,truncated:f,gaps:r}):(c&&p("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:i,truncated:f,gaps:r})}import{readdirSync as Qd,readFileSync as Zd}from"node:fs";import ec from"node:path";var nc=new Set(["summarized","crashed","over-cap"]),tc=new Set(["function","method","ctor"]);function oe(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function bi(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ic(e,n){bi(e)||oe(n,"edge is not an object");let{entryPath:t,entryExport:i,entryContainer:r,hops:s}=e;(typeof t!="string"||typeof i!="string")&&oe(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&oe(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&oe(n,"hops must be a non-negative integer");let a=e.target;if(bi(a)||oe(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:o,symbolKind:c}=a;return typeof l!="string"&&oe(n,"symbol target exportName"),o!==null&&typeof o!="string"&&oe(n,"symbol target container"),(typeof c!="string"||!tc.has(c))&&oe(n,`symbol target kind ${JSON.stringify(c)}`),{entryPath:t,entryExport:i,entryContainer:r,target:{kind:"symbol",exportName:l,container:o,symbolKind:c},hops:s}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:o,calleeExport:c}=a;return(typeof l!="string"||l.length===0)&&oe(n,"dep target calleePackage"),o!==null&&typeof o!="string"&&oe(n,"dep target calleeSubpath"),(typeof c!="string"||c.length===0)&&oe(n,"dep target calleeExport"),{entryPath:t,entryExport:i,entryContainer:r,target:{kind:"dep",calleePackage:l,calleeSubpath:o,calleeExport:c},hops:s}}oe(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function rc(e,n){bi(e)||oe(n,"root is not an object");let{packageName:t,analyzedVersion:i,tool:r,toolVersion:s,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&oe(n,"packageName"),typeof i!="string"&&oe(n,"analyzedVersion"),r!=="jelly"&&oe(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof s!="string"&&oe(n,"toolVersion"),typeof a!="number"&&oe(n,"maxIndirections"),(typeof l!="string"||!nc.has(l))&&oe(n,`status ${JSON.stringify(l)} not in the enum`);let o=e.edges;return Array.isArray(o)||oe(n,"edges is not an array"),l!=="summarized"&&o.length>0&&oe(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:i,tool:r,toolVersion:s,maxIndirections:a,status:l,edges:o.map(c=>ic(c,n))}}function Us(e){let n=new Map,t=Qd(e).filter(i=>i.endsWith(".summary.json"));for(let i of t){let r=ec.join(e,i),s;try{s=JSON.parse(Zd(r,"utf8"))}catch(o){oe(i,`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}let a=rc(s,i),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{readFileSync as sc,statSync as oc}from"node:fs";var Ei=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,bt=/^[A-Za-z0-9_$.-]{1,128}$/u,Vs=64,qs=1024*1024,Hs=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Ws=/^[A-Za-z0-9@_.-]{1,128}$/u;function de(e){throw new Error(`model claims rejected: ${e}`)}function ki(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function ac(e,n){ki(e)||de(`${n}: edge is not an object`);let{kind:t,anchorExport:i,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&de(`${n}: edge kind`),(typeof i!="string"||!bt.test(i))&&de(`${n}: anchorExport ${JSON.stringify(i)}`),r!==null&&(typeof r!="string"||!bt.test(r))&&de(`${n}: anchorContainer`),(typeof s!="string"||!Ei.test(s))&&de(`${n}: calleePackage ${JSON.stringify(s)}`),a!==null&&(typeof a!="string"||!bt.test(a))&&de(`${n}: calleeContainer`),(typeof l!="string"||!bt.test(l))&&de(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:i,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}}function Gs(e){let n=oc(e).size;n>qs&&de(`file is ${String(n)} bytes, over the ${String(qs)} cap`);let t;try{t=JSON.parse(sc(e,"utf8"))}catch(r){de(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||de("root is not an array"),t.length>Vs&&de(`${String(t.length)} claims over cap ${String(Vs)}`);let i=[];for(let r of t){ki(r)||de("claim is not an object");let{packageName:s,modelId:a,range:l,edges:o}=r;(typeof s!="string"||!Ei.test(s))&&de("packageName"),(typeof a!="string"||!Ws.test(a))&&de("modelId (identifier charset, 1-128 chars)"),i.some(u=>u.model.modelId===a)&&de(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!ki(l)||typeof l.introduced!="string")&&de(`${a}: range`),Hs.test(l.introduced)||de(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let c=l.fixedBefore;c!==null&&typeof c!="string"&&de(`${a}: fixedBefore`),typeof c=="string"&&!Hs.test(c)&&de(`${a}: range.fixedBefore ${JSON.stringify(c)} is not an exact x.y.z triple`),Array.isArray(o)||de(`${a}: edges`),o.length>64&&de(`${a}: ${String(o.length)} edges over cap ${String(64)}`),i.push({model:{packageName:s,modelId:a,edges:o.map(u=>ac(u,a))},introduced:l.introduced,fixedBefore:c})}return i}var lc=["in-app-purchase@1-v1"];function wi(e,n,t){let i=[],r=[],s=[],a=(l,o,c,u)=>{r.push(c),s.push({modelId:u??l.model.modelId,status:o,reason:c,edgeCount:l.model.edges.length})};for(let l of e){if(!Ei.test(l.model.packageName)||!Ws.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&lc.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let o=n(l.model.packageName);if(o===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let c;try{c=dn(o,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${o} not an exact triple \u2014 inert (never guessed)`);continue}if(!c){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${o} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}i.push(l.model),s.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:i,notes:r,dispositions:s}}var dc=4,cc={additiveForms:!0,namelessExports:!0},uc=new Set(["dep-opaque","dynamic-load","dispatch"]),fc={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Ii(e,n,t){return e.tier==="unknown"&&fc[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&uc.has(e.unknownKind)&&n!==null&&n.verified}var pc=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),Ve=class extends Error{},Ai="cupel/coverage-gap",mc={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function Vn(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Zs(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function eo(e,n,t){let i=new Map(e.modules.map(a=>[a.path,a.id])),r=e.modules[0]?.id;if(r===void 0)return[];let s=n.map(a=>({source:i.get(a.path)??r,cause:mc[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));return t&&s.push({source:r,reach:{kind:"unbounded"},cause:"resolution-divergence"}),s}function vi(e,n,t,i,r){let s=t.filter(a=>a.exportName!==null&&(i===1||r||a.verified!==1));return s.length>0?s.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function hc(e){let n;try{n=Et(e)}catch{return!0}try{if(kt(Qe.join(n,"pnpm-workspace.yaml")).isFile())return!0}catch{}try{let s=JSON.parse(to(Qe.join(n,"package.json"),"utf8"))?.workspaces;if(Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null)return!0}catch{}let t=3,i=(r,s)=>{if(s>t)return!1;let a;try{a=no(r)}catch{return!1}for(let l of a){if(l==="node_modules"||l.startsWith("."))continue;let o=Qe.join(r,l),c;try{c=kt(o)}catch{continue}if(c.isDirectory()){try{if(kt(Qe.join(o,"package.json")).isFile())return!0}catch{}if(i(o,s+1))return!0}}return!1};return i(n,1)}function gc(e,n,t){let i=[];if(t&&i.push("nested-app-root"),n==="")return[...i,"manifest-unreadable"];let r;try{if(r=Et(Qe.resolve(e,n)),!r.startsWith(Et(e)+Qe.sep))return[...i,"manifest-unreadable"]}catch{return[...i,"manifest-unreadable"]}let s;try{let u=Qe.join(r,"package.json");if(!kt(u).isFile())return[...i,"manifest-unreadable"];s=to(u,"utf8")}catch{return[...i,"manifest-unreadable"]}let a;try{a=JSON.parse(s)}catch{return[...i,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...i,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&i.push("bin");let o=["preinstall","install","postinstall","prepare","prepublish"],c=l.scripts;if(typeof c=="object"&&c!==null){let u=c;o.some(f=>typeof u[f]=="string")&&i.push("install-script")}return(l.gypfile===!0||yc(r))&&i.push("native-artifact"),i}function yc(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=Qe.join(e,n),i;try{i=no(t)}catch{continue}if(i.some(r=>r.endsWith(".node")))return!0}return!1}function xc(e){let n=new Map;for(let t of e){let i=n.get(t.advisory.id);i===void 0?n.set(t.advisory.id,[t]):i.push(t)}return n}function Sc(e,n,t,i,r,s,a){let{finding:l}=Un(e,n,{name:t.name,version:t.version,devOnly:t.dev,outOfGraphExecution:a(t.name)},Vn(i.advisory.id,t.name,i.affected),null,r,s);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function Un(e,n,t,i,r,s,a){let l=Dt({graph:e,installed:t,range:i,symbol:r,coverage:null,incompleteness:s,analysisAborted:a});if(n!==null&&r!==null&&Ii(l,r,"base")){let o=On(e,n.modulesById,n.reachMods,r,n.records);if(o!==null)return{finding:l,hit:o}}return{finding:l,hit:null}}function bc(e,n){let t=new Set,i=[];for(let r of e.packages)for(let{advisory:s,affected:a}of n.advisoriesForPackage("npm",r.name)){let l=Vn(s.id,r.name,a),o;try{o=dn(r.version,l)}catch{continue}if(o)for(let c of n.symbolsForAffected(a.id)){if(c.verified!==1||c.symbolKind!=="method"&&c.symbolKind!=="ctor"||c.container===null||c.sourcePath===null)continue;let u=`${r.lockKey}\0${c.container}\0${c.sourcePath}`;t.has(u)||(t.add(u),i.push({packageName:r.name,packageRootRel:r.lockKey,container:c.container,sourcePath:c.sourcePath}))}}return i.sort((r,s)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),i.slice(0,ut)}function kc(e,n,t){let i=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let o=s.get(l.callSiteId);if(o===void 0)continue;let c=i.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=i.get(l.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==u.packageName&&a.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:c.id})}return a}function Ec(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),i=new Map(e.functions.map(u=>[u.id,u])),r=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&r.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let f=s.get(u.exportId);if(f===void 0||!n.has(f.moduleId))continue;let p=i.get(u.target.functionId);p===void 0||t.get(p.moduleId)?.externalSurface===!0||r.add(p.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let f=a.get(u.callSiteId);if(f===void 0)continue;let p=l.get(f);p===void 0?l.set(f,[u.calleeFunctionId]):p.push(u.calleeFunctionId)}let o=new Set(r),c=[...r];for(;c.length>0;){let u=c.pop();if(u!==void 0)for(let f of l.get(u)??[])o.has(f)||(o.add(f),c.push(f))}return o}function wc(e,n,t,i){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let s=t.filter(l=>l.packageName===r.anchor.packageName&&l.exportName===r.anchor.exportName&&l.container===r.anchor.container),a=s.find(l=>l.resolution==="resolved")??s[0];if(a!==void 0)return i.has(a.callerFunctionId)}return null}function vc(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let i=new Set(t),r=s=>i.has(s)||i.has(Re[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&r(s.unknownKind)||s.modelPromotedFromKind!==void 0&&r(s.modelPromotedFromKind))}function _i(e){let n=Et(e.dir),t=e.reader??jt(e.shardPath),i=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(cn))throw new Ve(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${cn})`);let r=null;if(e.summaryShadow!==void 0)try{r=Us(e.summaryShadow)}catch(F){throw new Ve(`--summary-shadow facts dir rejected: ${F instanceof Error?F.message:String(F)}`)}let s=null;if(e.modelShadow!==void 0)try{s=Gs(e.modelShadow.claimsPath)}catch(F){throw new Ve(`--model-shadow claims rejected: ${F instanceof Error?F.message:String(F)}`)}let a=zs(n);if(a.truncated)throw new Ve(`the dependency enumeration hit a hard cap and is incomplete (${a.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`);let l=e.entry??[],o=l.length>0?Ns(n,l):{entrypoints:[],rejected:[]},c=o.rejected,u=_s(n),f=[...new Set([...u.entrypoints,...o.entrypoints])],p=[...u.sources];for(let F of o.entrypoints)u.entrypoints.includes(F)||p.push({source:"--entry",specifier:F,entrypoint:F,launch:!1});let h=bc(a,t),k=e.bindingForms??cc,x=e.callablePackageResolver===!0,y=e.tsconfigPaths===!0,w=hc(n),N=new Map(a.packages.map(F=>[F.name,gc(n,F.lockKey,w)])),R=F=>N.get(F)??["manifest-unreadable"],A=ui({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:k,callablePackageResolver:x,tsconfigPaths:y}),b=A.graph,m=Tt(b),S=[...u.diagnostics,...fi(u.sources,u.gaps),...A.diagnostics],I=Zs(f.length,b),P=a.gaps.some(F=>F.blindsAnalysis),U=eo(b,S,P),_=t.allModels?.()??[],C=wi(_.map(F=>({model:{packageName:F.packageName,modelId:F.modelId,edges:F.edges},introduced:F.introduced,fixedBefore:F.fixedBefore})),F=>a.packages.find(Ee=>Ee.name===F)?.version),B=C.models.length>0?Dn(b,C.models).delta:null,V=B!==null?{records:B.records,reachMods:tn(b),modulesById:new Map(b.modules.map(F=>[F.id,F]))}:null,$=[],H=pc(),Z=[],K=[];for(let F of a.packages)for(let[,Ee]of xc(t.advisoriesForPackage("npm",F.name))){let we=Ee.filter(X=>Sc(b,V,F,X,U,I,R)),fe=we.length>0?we:Ee.slice(0,1),Te=we.length===0;for(let{advisory:X,affected:E}of fe){let v=Vn(X.id,F.name,E),O=X.cveId??X.id,D=Te?[]:t.symbolsForAffected(E.id),Y=D.filter(re=>re.exportName===null),ie=vi(X.id,F.name,D,E.surfaceComplete,i),ye=Un(b,V,{name:F.name,version:F.version,devOnly:F.dev,outOfGraphExecution:R(F.name)},v,null,U,I).finding;if(ye.decidedAtStage==="presence"||ye.decidedAtStage==="version-match"){H[ye.tier]+=1,$.push({...ye,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:v.surfaceComplete,advisoryId:X.id,displayId:O,packageName:F.name,version:F.version,symbolName:null,symbolPath:null,severity:X.severity,packageLocation:a.lockfilePath});continue}for(let re of ie){let{finding:le,hit:se}=Un(b,V,{name:F.name,version:F.version,devOnly:F.dev,outOfGraphExecution:R(F.name)},v,re,U,I),be=le,De,Fe;se!==null&&re!==null&&(De=se.modelId,Fe=le.unknownKind,be={basis:void 0,tier:se.tier,decidedAtStage:le.decidedAtStage,reason:`boundary model ${se.modelId}: ${se.anchorPackage}.${se.entryExport} reaches ${re.exportName} [${se.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Yn(re),path:void 0,unresolvedSites:le.unresolvedSites,unresolvedEvidence:le.unresolvedEvidence}),H[be.tier]+=1;let j={...be,modelId:De,modelPromotedFromKind:Fe,surfaceComplete:v.surfaceComplete,advisoryId:X.id,displayId:O,packageName:F.name,version:F.version,symbolName:re?.exportName??null,symbolPath:re?.sourcePath||null,severity:X.severity,packageLocation:a.lockfilePath};$.push(j);let L=new Set(["dep-opaque","dynamic-load","dispatch"]);r!==null&&j.tier==="unknown"&&j.decidedAtStage==="symbol-reachable"&&j.unknownKind!==void 0&&L.has(j.unknownKind)&&re!==null&&Z.push({finding:j,symbol:re}),s!==null&&j.tier==="unknown"&&re!==null&&K.push({finding:j,symbol:re})}for(let re of Y)H.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:v.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${O} carries a ${re.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:X.id,displayId:O,packageName:F.name,version:F.version,symbolName:null,symbolPath:null,severity:X.severity,packageLocation:a.lockfilePath})}}for(let F of a.gaps)H.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:F.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Ai,displayId:Ai,packageName:F.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:a.lockfilePath});let q=H["reachable-high"]+H["reachable-medium"],T=e.failOnReachable===!0&&q>0,W=vc($,H.unknown,e.failOnUnknown),ae=e.requireCompleteDenial===!0&&$.some(F=>F.tier==="not-reachable"&&F.basis==="loader-assumption"),Le=T||W||ae?2:0,xe;if(r!==null){let F=tn(b),Ee=new Map(b.modules.map(fe=>[fe.id,fe])),we=[];for(let{finding:fe,symbol:Te}of Z){let X=Lt(b,Ee,F,Te,r,dc);we.push({advisoryId:fe.advisoryId,packageName:fe.packageName,symbolName:fe.symbolName,unknownKind:fe.unknownKind??null,wouldPromote:X!==null,...X!==null?{anchorPackage:X.anchorPackage,entryExport:X.entryExport,viaPackages:X.viaPackages,totalHops:X.totalHops}:{}})}xe={records:we}}let Se;if(s!==null&&e.modelShadow!==void 0){let F=e.modelShadow.widened===!0?"widened":"base",Ee=new Map(a.packages.map(L=>[L.name,L.version])),{models:we,notes:fe,dispositions:Te}=wi(s,L=>Ee.get(L),{shadowConsultDenylisted:!0}),{delta:X}=Dn(b,we),E=tn(b),v=new Map(b.modules.map(L=>[L.id,L])),O=kc(b,v,E),D=Ec(b),Y=X.records.some(L=>O.some(G=>G.packageName===L.anchor.packageName&&G.exportName===L.anchor.exportName&&G.container===L.anchor.container)),ie=[],ye=Date.now();for(let{finding:L,symbol:G}of K){let Ke=X.records,he=Ii(L,G,F),Q=he?On(b,v,E,G,Ke):null,_e=X.records.filter(ve=>ve.callee.packageName===G.packageName&&ve.callee.exportName===G.exportName&&ve.callee.container===G.container||ve.callee.packageName===G.packageName&&ve.callee.realFunctionId!==null);ie.push({advisoryId:L.advisoryId,packageName:L.packageName,symbolName:L.symbolName,unknownKind:L.unknownKind??null,decidedAtStage:L.decidedAtStage,consultSurface:F,noHitReason:Q!==null?null:he?Y?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Q!==null?wc(Q,Ke,O,D):null,verdictBefore:L.tier,verdictAfter:Q!==null?"reachable-low":L.tier,wouldPromote:Q!==null,...Q!==null?{modelId:Q.modelId,anchorPackage:Q.anchorPackage,entryExport:Q.entryExport,pathLabels:Q.pathLabels,calleeBinding:_e.find(ve=>ve.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:he?_e.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${_e[0]?.anchor.packageName??"?"}#${_e[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let re=Date.now()-ye,le=Te.map(L=>{if(L.status!=="active")return{modelId:L.modelId,state:L.status,reason:L.reason,edgesLowered:0,edgesReferenceGated:0};let G=X.records.filter(he=>he.modelId===L.modelId).length;if(G>0)return{modelId:L.modelId,state:"lowered",reason:null,edgesLowered:G,edgesReferenceGated:L.edgeCount-G};let Ke=X.notes.find(he=>he.startsWith(`model ${L.modelId}:`)||he.startsWith(`model-edge ${L.modelId}:`));return{modelId:L.modelId,state:"refused",reason:Ke??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:L.edgeCount}}),se=ie.filter(L=>L.wouldPromote).length,be=H.unknown-se,De=H["reachable-high"]+H["reachable-medium"],Fe=L=>({none:0,"fail-on-reachable":De>0?2:0,"fail-on-unknown":L>0?2:0,both:De>0||L>0?2:0});Se={records:ie,notes:[...fe,...X.notes],laneStates:le,exitCodes:{baseline:Fe(H.unknown),withModels:Fe(be)},overlayWallMs:re},Js(Qe.dirname(e.modelShadow.outPath),{recursive:!0});let j=`${e.modelShadow.outPath}.tmp-${Xs(8).toString("hex")}`;Qs(j,`${JSON.stringify(Se,null,2)}
-`,{encoding:"utf8",flag:"wx"}),Ys(j,e.modelShadow.outPath)}let ln;if(e.bindingShadow!==void 0){let F=Date.now(),Ee=j=>C.models.length>0?{records:Dn(j,C.models).delta.records,reachMods:tn(j),modulesById:new Map(j.modules.map(L=>[L.id,L]))}:null,we=(j,L,G,Ke)=>{let he=[];for(let Q of a.packages)for(let{advisory:_e,affected:ve}of t.advisoriesForPackage("npm",Q.name)){let Sn=Vn(_e.id,Q.name,ve),Bo=vi(_e.id,Q.name,t.symbolsForAffected(ve.id),ve.surfaceComplete,i);for(let Wi of Bo){let{finding:Gi,hit:Mt}=Un(j,Ke,{name:Q.name,version:Q.version,devOnly:Q.dev,outOfGraphExecution:R(Q.name)},Sn,Wi,L,G);he.push({advisoryId:_e.id,packageName:Q.name,symbolName:Wi?.exportName??null,tier:Mt!==null?Mt.tier:Gi.tier,unknownKind:Mt!==null?null:Gi.unknownKind??null})}}return he},fe=j=>{let L=ui({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:j,callablePackageResolver:x,tsconfigPaths:y}),G=[...u.diagnostics,...fi(u.sources,u.gaps),...L.diagnostics];return{graph:L.graph,inc:eo(L.graph,G,P),aborted:Zs(f.length,L.graph),live:Ee(L.graph),applicability:L.bindingApplicability}},Te=j=>{let L=fe(j);return we(L.graph,L.inc,L.aborted,L.live)},X=fe({}),E=we(X.graph,X.inc,X.aborted,X.live),v=we(b,U,I,V);if(v.length!==E.length)throw new Ve("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let O=(j,L)=>L.tier!==j.tier||L.unknownKind!==j.unknownKind,D=E.some((j,L)=>{let G=v[L];return G!==void 0&&O(j,G)}),Y=D?Te({additiveForms:!0}):null,ie=D?Te({namelessExports:!0}):null,ye=0,re=E.map((j,L)=>{let G=v[L];if(G===void 0||G.advisoryId!==j.advisoryId||G.packageName!==j.packageName||G.symbolName!==j.symbolName)throw new Ve("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Ke={advisoryId:j.advisoryId,packageName:j.packageName,symbolName:j.symbolName,unknownKind:j.unknownKind,verdictBefore:j.tier,verdictAfter:G.tier,wouldPromote:G.tier!==j.tier&&(G.tier==="reachable-high"||G.tier==="reachable-medium"||G.tier==="reachable-low")};if(!O(j,G)||Y===null||ie===null)return Ke;ye+=1;let he=Y[L],Q=ie[L],_e=he!==void 0&&O(j,he),ve=Q!==void 0&&O(j,Q);return{...Ke,attributedArm:_e&&!ve?"additiveForms":ve&&!_e?"namelessExports":"both",...he!==void 0?{verdictArmA:he.tier}:{},...Q!==void 0?{verdictArmB:Q.tier}:{}}}),le={...H};E.forEach((j,L)=>{let G=v[L];G!==void 0&&G.tier!==j.tier&&(le[G.tier]-=1,le[j.tier]+=1)});let se=(j,L)=>({none:0,"fail-on-reachable":j>0?2:0,"fail-on-unknown":L>0?2:0,both:j>0||L>0?2:0}),be;if(C.models.length>0&&V!==null){be=[];for(let j of a.packages)for(let{advisory:L,affected:G}of t.advisoriesForPackage("npm",j.name)){let Ke=Vn(L.id,j.name,G),he=vi(L.id,j.name,t.symbolsForAffected(G.id),G.surfaceComplete,i);for(let Q of he){if(Q===null||!Q.verified)continue;let _e=Un(X.graph,X.live,{name:j.name,version:j.version,devOnly:j.dev,outOfGraphExecution:R(j.name)},Ke,Q,X.inc,X.aborted);if(!(_e.hit===null&&Ii(_e.finding,Q,"base")))continue;let Sn=On(b,V.modulesById,V.reachMods,Q,V.records);be.push({advisoryId:L.id,packageName:j.name,symbolName:Q.exportName,modelWouldPromote:Sn!==null,...Sn!==null?{modelId:Sn.modelId}:{},anchorCleared:Sn!==null})}}}let De=$.some(j=>j.modelId!==void 0);ln={records:re,deltas:ye,exitCodes:{baseline:se(le["reachable-high"]+le["reachable-medium"],le.unknown+(De?1:0)),withBindingForms:se(H["reachable-high"]+H["reachable-medium"],H.unknown+(De?1:0))},dualRunWallMs:Date.now()-F,...A.bindingApplicability!==void 0?{applicability:A.bindingApplicability}:{},...be!==void 0?{modelProbe:be}:{}},Js(Qe.dirname(e.bindingShadow.outPath),{recursive:!0});let Fe=`${e.bindingShadow.outPath}.tmp-${Xs(8).toString("hex")}`;Qs(Fe,`${JSON.stringify(ln,null,2)}
-`,{encoding:"utf8",flag:"wx"}),Ys(Fe,e.bindingShadow.outPath)}let An=_.length>0||C.notes.length>0?{active:C.models.length,stored:_.length,promoted:$.filter(F=>F.modelId!==void 0).length,notes:[...C.notes,...B!==null?B.notes:[]]}:void 0;return{...xe!==void 0?{summaryShadow:xe}:{},...Se!==void 0?{modelShadow:Se}:{},...ln!==void 0?{bindingShadow:ln}:{},...An!==void 0?{modelLane:An}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:a,findings:$,counts:H,analyzerDiagnostics:S,analysisAborted:I,rejectedEntries:c,entrypointSources:p,entrypointGaps:u.gaps,framework:u.framework,unresolved:m,exitCode:Le}}finally{e.reader===void 0&&t.close()}}var Ic="cupel",Ac="reachability-first SCA \u2014 verdict + call path + confidence";function Ni(e){return[`${Ic} v${e} \u2014 ${Ac}`,`cascade: ${nr.join(" \u2192 ")}`,`verdicts: ${tr.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)"].join(`
-`)}var _c=new Set([...Ft,...Kt]);function gn(e,n,t){let i=e[n+1];if(i===void 0||i.startsWith("--"))throw new Error(`${t} requires a value`);return i}function Nc(e){let n=e.split(",").map(r=>r.trim()),t=[...Ft,...Kt].join(", ");if(n.length===0||n.some(r=>r===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let i=[];for(let r of n){if(!_c.has(r))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(r)}; valid: ${t}`);i.push(r)}return i}function io(e){let n=".",t,i,r=!1,s=!1,a=!1,l=!1,o=!1,c,u,f,p=!1,h=!1,k,x=!1,y=!1,w,N=[];for(let R=0;R<e.length;R+=1){let A=e[R];if(A==="--require-complete-denial"){s=!0;continue}if(A==="--fail-on-reachable")r=!0;else if(A==="--fail-on-unknown")a="all";else if(A!==void 0&&A.startsWith("--fail-on-unknown="))a=Nc(A.slice(18));else if(A==="--offline")l=!0;else if(A==="--sarif")t=gn(e,R,"--sarif"),R+=1;else if(A==="--shard")i=gn(e,R,"--shard"),R+=1;else if(A==="--entry")N.push(gn(e,R,"--entry")),R+=1;else if(A==="--summary-shadow")c=gn(e,R,"--summary-shadow"),R+=1;else if(A==="--model-shadow")u=gn(e,R,"--model-shadow"),R+=1;else if(A==="--model-shadow-out")f=gn(e,R,"--model-shadow-out"),R+=1;else if(A==="--model-shadow-widened")p=!0;else if(A==="--binding-shadow")h=!0;else if(A==="--binding-shadow-out")k=gn(e,R,"--binding-shadow-out"),R+=1;else if(A==="--x-partial-rows")x=!0;else if(A==="--push")y=!0;else if(A!==void 0&&A.startsWith("--auth=")){let b=A.slice(7);if(b!=="oidc"&&b!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(b)}`);w=b}else{if(A!==void 0&&A.startsWith("--"))throw new Error(`unknown flag ${A}`);A!==void 0&&!o&&(n=A,o=!0)}}if(u===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(p&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(k!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(w!==void 0&&!y)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:i,failOnReachable:r,requireCompleteDenial:s,failOnUnknown:a,offline:l,entry:N,summaryShadow:c,modelShadow:u,modelShadowOut:f,modelShadowWidened:p,push:y,auth:w,bindingShadow:h,bindingShadowOut:k,partialRows:x}}import{randomBytes as Cc,createHash as Oc}from"node:crypto";import{mkdirSync as Rc,readFileSync as $c,renameSync as Mc,writeFileSync as Pc}from"node:fs";import{homedir as Lc}from"node:os";import yn from"node:path";var Ci="latest.json",Oi="latest.json.sig";function wt(e){return Oc("sha256").update(e).digest("hex")}function ro(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=Lc();if(process.platform==="darwin")return yn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,s=r!==void 0&&r!==""?r:yn.join(n,"AppData","Local");return yn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,i=t!==void 0&&t!==""?t:yn.join(n,".cache");return yn.join(i,"cupel","shards")}function Ri(e,n,t){return yn.join(e,`${n}-${t}.sqlite`)}function vt(e,n){Rc(yn.dirname(e),{recursive:!0});let t=`${e}.tmp-${Cc(8).toString("hex")}`;Pc(t,n,{flag:"wx"}),Mc(t,e)}function qn(e){try{return $c(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function so(e,n,t,i){let r=Ri(e,n,t),s=qn(r);if(s===void 0)return;let a=wt(s);if(a!==t)throw i(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:r,bytes:s}}var oo="api.cupel.sh",It=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),ao=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Nt from"node:path";function $e(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function lo(e,n={}){let t=n.maxBytes??1073741824,i=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((s,a)=>{let l=r(e,n.headers!==void 0?{headers:n.headers}:{},o=>{let c=o.statusCode??0;if(c<200||c>=300){o.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(c)}`));return}let u=[],f=0;o.on("data",p=>{if(f+=p.length,f>t){o.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(p)}),o.on("end",()=>{s(Buffer.concat(u))}),o.on("error",a)});l.on("error",a),l.setTimeout(i,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(i)}ms`))})})}async function Hn(e,n,t,i,r,s=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((o,c)=>{let u=a(n,{method:e,headers:t},f=>{let p=[],h=0;f.on("data",k=>{if(h+=k.length,h>r){f.destroy(),c(new Error(`${e} to ${l} returned more than ${String(r)} bytes`));return}p.push(k)}),f.on("end",()=>{o({status:f.statusCode??0,body:Buffer.concat(p).toString("utf8")})}),f.on("error",()=>{c(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{c(new Error(`${e} to ${l} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(s)}ms`))}),i!==void 0&&u.write(i),u.end()})}import{createPublicKey as Tc,verify as Dc}from"node:crypto";var J=class extends Error{constructor(n){super(n),this.name="DistError"}},Fc=Buffer.from("302a300506032b6570032100","hex"),Kc=32;function po(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Kc)try{return Tc({key:Buffer.concat([Fc,n]),format:"der",type:"spki"})}catch{return}}function $i(e,n,t){for(let i of t){let r=po(i);if(r!==void 0)try{if(Dc(null,e,r,n))return!0}catch{}}return!1}function mo(e){return e.some(n=>po(n)!==void 0)}var jc=/^[0-9a-f]{64}$/u,Bc=/^[a-z0-9-]+$/u;function co(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new J(`${n} must be an object`);return e}function uo(e,n){if(!Array.isArray(e))throw new J(`${n} must be an array`);return e}function At(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new J(`${n} must be an integer`);return e}function _t(e,n){if(typeof e!="string")throw new J(`${n} must be a string`);return e}function fo(e,n){let t=_t(e,n);if(Number.isNaN(Date.parse(t)))throw new J(`${n} is not a valid timestamp: ${t}`);return t}function Mi(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new J("distribution index is not valid JSON")}let i=co(t,"index"),r=At(i.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new J(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=At(i.sequence,"sequence");if(s<0)throw new J("sequence must be non-negative");let a=fo(i.generated,"generated"),l=uo(i.shards,"shards"),o;for(let k of l){let x=co(k,"shard entry"),y=_t(x.ecosystem,"ecosystem");if(!Bc.test(y))throw new J(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){o=x;break}}if(o===void 0)throw new J(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);fo(o.built,"built");let c=At(o.db_schema_version,"db_schema_version");if(c<1)throw new J("db_schema_version must be >= 1");if(c>n.supportedDbSchemaVersion)throw new J(`this shard needs a newer cupel (db_schema_version ${String(c)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=_t(o.sha256,"sha256");if(!jc.test(u))throw new J(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let f=At(o.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new J(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let p=uo(o.urls,"urls");if(p.length===0)throw new J("urls must be a non-empty array");let h=[];for(let k of p){let x=_t(k,"url");try{h.push($e(x,n.shardHosts))}catch(y){throw new J(`refusing shard url ${JSON.stringify(x)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:f,dbSchemaVersion:c,urls:h,sequence:s,generated:a}}var Ti="CUPEL_DELIVERY_TOKEN",Pi=class extends J{constructor(n){super(n),this.name="NoDeliveryTokenError"}},Li=class extends J{constructor(n){super(n),this.name="DeliveryCredentialError"}};function zc(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function ho(e,n){let t=zc(e);return t!==void 0?()=>Promise.resolve(t):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function go(e){if(e===void 0)throw new Pi(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow, elsewhere set ${Ti} to a token from app.cupel.sh, or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new Li(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Uc="/v1/resolve",Di=1024*1024,Fi=4096,yo=Di+Fi+64*1024,Vc=8,qc=2048,Hc=/^[A-Za-z0-9+/]+={0,2}$/u,Wc=3e4,ge=class extends J{constructor(n){super(n),this.name="DeliveryRefusedError"}},Wn=class extends J{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Gn=class extends J{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function Gc(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Xc(e){if(typeof e!="string"||e.length===0)throw new ge("the delivery response carried no index signature");if(e.length>Fi||!Hc.test(e))throw new ge("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new ge("the delivery response's index signature is not canonical base64");return n}function Jc(e){if(typeof e!="string"||e.length===0)throw new ge("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Di)throw new ge("the delivery response's index is larger than one can be");return n}function Yc(e){if(!Array.isArray(e)||e.length===0)throw new ge("the delivery response named no shard urls");if(e.length>Vc)throw new ge("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>qc)throw new ge("the delivery response carried a malformed shard url");n.push(t)}return n}function Qc(e,n){throw e===401||e===403?new ge(`${n} rejected the delivery credential \u2014 check ${Ti}, or that the token has not been revoked in the dashboard`):e===404?new ge(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Gn(`${n} holds nothing newer than the shard index already cached`):e===429?new Wn(`${n} rate-limited the delivery request`):e>=500?new Wn(`${n} answered ${String(e)}`):new ge(`${n} refused the delivery request with status ${String(e)}`)}async function xo(e,n,t,i,r=Wc){let s=$e(`https://${e}${Uc}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await i(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,r)}catch{throw new Wn(`${e} could not be reached`)}if(l.status!==200&&Qc(l.status,e),Buffer.byteLength(l.body,"utf8")>yo)throw new ge(`${e} returned a delivery response larger than one can be`);let o;try{o=JSON.parse(l.body)}catch{throw new ge(`${e} returned a delivery response that is not JSON`)}if(!Gc(o))throw new ge(`${e} returned a delivery response that is not an object`);return{index:Jc(o.index),sig:Xc(o.signature),shardUrls:Yc(o.shardUrls)}}var So=async(e,n,t,i)=>await Hn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,yo,i);var Zc=8,ji=class extends J{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Ki(e){return`${e.origin}${e.pathname}`}function bo(e,n,t){let i=new Map;for(let a of n)i.set(Ki(a),a);let r=[],s=[];for(let a of e.slice(0,Zc)){let l;try{l=$e(a,t)}catch(u){s.push(u.message);continue}if(l.hash!==""){s.push("a candidate carried a fragment");continue}let o=i.get(Ki(l));if(o===void 0){s.push("a candidate named an object the signed index does not list");continue}let c=new URL(`${Ki(o)}${l.search}`);r.push($e(c.href,t))}if(r.length===0)throw new ji(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return r}var nu=1,tu=1024*1024*1024;function iu(e=It){return{async resolve(n){return await xo(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},So)},async fetchShard(n,t){return $e(n.href,e),await lo(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Bi(e){return e instanceof Error?e.message:String(e)}function ko(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:nu,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:tu}}function ru(e){let n=qn(Nt.join(e.cacheDir,Ci)),t=qn(Nt.join(e.cacheDir,Oi));if(!(n===void 0||t===void 0)&&$i(n,t,e.pubkeys))try{return Mi(n,ko(e))}catch{return}}function Eo(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let i=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(i)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Ct(e,n,t){let i=so(n.cacheDir,e.ecosystem,e.sha256,r=>new J(r));if(i===void 0)throw new J(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:i.path,fromCache:!0,warnings:[...t,...Eo(e,n)],sequence:e.sequence}}async function su(e,n,t,i){let r=Ri(t.cacheDir,e.ecosystem,e.sha256),s=qn(r);if(s!==void 0&&wt(s)===e.sha256)return{path:r,downloaded:!1};let a="no shard urls";for(let l of n){let o;try{o=await i.fetchShard(l,e.sizeBytes)}catch(u){a=Bi(u);continue}let c=wt(o);if(c!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${c})`;continue}return vt(r,o),{path:r,downloaded:!0}}throw new J(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function ou(e,n,t){if(e instanceof ge)throw e;if(e instanceof Gn){if(n===void 0)throw new J(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Ct(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new J(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Bi(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Ct(n,t,[`could not refresh the shard index (${Bi(e)}); using the cached shard`])}async function wo(e,n){if(!e.activated)throw new J("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??iu(e.shardHosts);if(!mo(e.pubkeys))throw new J("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let i=ru(e);if(e.offline){if(i===void 0)throw new J(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Ct(i,e,[])}let r=await go(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:i?.sequence??0})}catch(c){return ou(c,i,e)}if(!$i(s.index,s.sig,e.pubkeys))throw new J("shard index signature did not verify against any pinned key");let a=Mi(s.index,ko(e));if(i!==void 0&&a.sequence<i.sequence)return Ct(i,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(i.sequence)}); keeping the newer cached shard`]);let l=bo(s.shardUrls,a.urls,e.shardHosts),o=await su(a,l,e,t);return vt(Nt.join(e.cacheDir,Ci),s.index),vt(Nt.join(e.cacheDir,Oi),s.sig),{path:o.path,fromCache:!o.downloaded,warnings:Eo(a,e),sequence:a.sequence}}var au="https://api.cupel.sh",vo=".actions.githubusercontent.com",lu=8192,Me=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function du(e){let n;try{n=new URL(e).hostname}catch{throw new Me("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=vo.slice(1);if(n!==t&&!n.endsWith(vo))throw new Me(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return $e(e,new Set([n]))}catch{throw new Me(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Ot(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,i=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Me("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(i===void 0||i==="")throw new Me("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=du(t);r.searchParams.set("audience",au);let s;try{s=await n(r.href,{authorization:`Bearer ${i}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Me("the ID-token request failed")}if(s.length>lu)throw new Me("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(s)}catch{throw new Me("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new Me("the ID-token response carried no token");return l}async function Io(e,n,t={}){let i=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!i)throw new Me("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Ot(e,n)};if(i)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await Ot(e,n)};throw new Me("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var zi="api.cupel.sh",cu=`https://${zi}/v1/findings`,uu=64*1024,Rt=8*1024*1024,fu=3e4,an=class extends Error{constructor(n){super(n),this.name="PushError"}};async function Ao(e,n,t,i={}){if(e.length>Rt)throw new an(`findings payload is ${String(e.length)} bytes, over the ${String(Rt)}-byte limit`);let r=$e(cu,new Set([zi])),s;try{s=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,i.timeoutMs??fu)}catch{throw new an(`the findings push to ${zi} failed`)}if(s.body.length>uu)throw new an("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new an("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new an("the control plane rejected the findings payload as malformed"):new an(`the findings push was refused with status ${String(s.status)}`)}var pu=64*1024,mu=64*1024,_o=async(e,n,t,i)=>{if(Buffer.byteLength(t,"utf8")>Rt)throw new Error("findings payload is over the size limit");return await Hn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,mu,i)};async function $t(e,n){let t=await Hn("GET",e,n,void 0,pu,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var gu=720*60*60*1e3,yu=Number(cn);function No(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Ve("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Co(e){let n=await wo({ecosystem:"npm",activated:!0,pubkeys:ao,indexHost:oo,shardHosts:It,credential:ho(process.env,()=>Ot(process.env,$t)),cacheDir:ro(),offline:e.offline,now:Date.now(),maxAgeMs:gu,supportedDbSchemaVersion:yu});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
-`);return{path:n.path,sequence:n.sequence}}var xu=6,Su={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192},xn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Ui(e){return{path:e.path,start:e.start,end:e.end}}function bu(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new xn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,i=e.modelPromotedFromKind??null;if(t===null!=(i===null))throw new xn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new xn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:ir(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(r=>({functionName:r.functionName??null,modulePath:r.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(Ui),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:i,surfaceComplete:e.surfaceComplete??null}}var ku="";function Eu(e){return[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""].join(ku)}function wu(e){let n=new Map;for(let t of e){let i=Eu(t),r=n.get(i);if(r===void 0){n.set(i,t);continue}if(r.tier!==t.tier||r.unknownKind!==t.unknownKind)throw new xn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function vu(e){let n=Su,t=(i,r,s)=>{throw new xn(`${i} has ${String(r)} entries, over the ${String(s)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let i of["dispatch","load"]){let r=e.unresolved[i].length;r>n.maxUnresolvedSites&&t(`the app-global ${i} set`,r,n.maxUnresolvedSites)}for(let i of e.findings)i.path!==null&&i.path.length>n.maxPathSteps&&t(`the call path of finding ${i.advisoryId}`,i.path.length,n.maxPathSteps),i.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${i.advisoryId}`,i.unresolvedSites.length,n.maxUnresolvedSites)}function Oo(e,n){let t={version:xu,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:wu(e.findings.map(bu)),unresolved:{dispatch:e.unresolved.dispatch.map(Ui),load:e.unresolved.load.map(Ui)}};return vu(t),t}function z(e){let n="";for(let t of e){let i=t.charCodeAt(0),r=i<32||i>=127&&i<=159;n+=r?"\\x"+i.toString(16).padStart(2,"0"):t}return n}function Iu(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var Au={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Ro=4,Vi=3,qi=10,$o={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},_u="(symbol set known incomplete)";function Nu(e){let n=(e.path??[]).map(t=>z(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Mo(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function Cu(e){let n=e.findings.filter(c=>c.tier==="unknown"&&c.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let c of n){let u=t.get(c.unknownKind)??[];u.push(c),t.set(c.unknownKind,u)}let i={cupel:0,project:0};for(let[c,u]of t)i[Re[c]]+=u.length;let r=[];r.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(c,u)=>{if(i[c]===0)return;r.push(""),r.push(`   ${u} (${String(i[c])}):`);let f=[...t.entries()].filter(([h])=>Re[h]===c).sort((h,k)=>k[1].length-h[1].length||h[0].localeCompare(k[0])),p=f.slice(0,Ro);for(let[h,k]of p){let x=c==="project"?[...new Set(k.flatMap(Mo))]:[],y=x.slice(0,Vi).map(z).join(", "),w=x.length>Vi?` (+${String(x.length-Vi)} more files)`:"";r.push(`     ${h.padEnd(21)} ${String(k.length).padStart(4)}  ${$o[h]}`+(y!==""?`
-       ${y}${w}`:""))}for(let[h,k]of f.slice(Ro))r.push(`     ${h.padEnd(21)} ${String(k.length).padStart(4)}  ${$o[h]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let c of n)if(Re[c.unknownKind]==="project")for(let u of Mo(c))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((c,u)=>u[1]-c[1]||c[0].localeCompare(u[0]))[0];l!==void 0&&i.project>0&&(r.push(""),r.push(`   \u279C Start here: ${z(l[0])} appears in ${String(l[1])} of your ${String(i.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let o=n.filter(c=>Re[c.unknownKind]==="project");if(o.length>0){r.push("");for(let c of o.slice(0,qi))r.push(`     ${z(c.displayId)}  ${z(c.packageName)}@${z(c.version)}  [${c.unknownKind}] ${z(c.reason)}`);o.length>qi&&r.push(`     \u2026 and ${String(o.length-qi)} more`)}return r.push(""),r}function Po(e){let n=[],t=e.counts,i=e.findings.filter(c=>c.tier==="reachable-high"||c.tier==="reachable-medium"||c.tier==="reachable-low");if(n.push(`cupel scan: ${z(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let c=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+c.map(u=>`${z(u.entrypoint)} [${z(u.source)}]`).join(", ")+(e.entrypointSources.length>c.length?`, \u2026 and ${String(e.entrypointSources.length-c.length)} more`:"")),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let c of e.entrypointGaps.slice(0,5))n.push(`  - ${z(c.source)} (${z(c.file)}): ${z(c.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(z).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${Zt(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,s=r.find(c=>c.kind==="no-enumeration")??null;s!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${z(s.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=r.filter(c=>c!==s);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let c of a.slice(0,10))n.push(`  - [${z(c.kind)}] ${z(c.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(r.map(c=>c.detail)),o=[...e.analyzerDiagnostics.map(c=>`${z(c.code)}: ${z(c.detail)}`),...e.installed.diagnostics.filter(c=>!l.has(c)).map(z)];if(o.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(o.length)}) \u2014 verdicts are conservative:`);for(let c of o.slice(0,10))n.push(`  - ${c}`);o.length>10&&n.push(`  \u2026 and ${String(o.length-10)} more`),n.push("")}if(i.length>0){n.push(`\u{1F3AF} Reachable (${String(i.length)}) \u2014 fix these:`);for(let c of i)n.push(`  ${Au[c.tier]} ${z(c.displayId)}  ${z(c.packageName)}@${z(c.version)}  ${z(c.symbolName??"")}`+(c.surfaceComplete===!1?`  ${_u}`:"")),n.push(`        path: ${Nu(c)}`);n.push("")}return n.push(...Cu(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${Iu(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as Ou}from"node:crypto";var Ru="https://json.schemastore.org/sarif-2.1.0.json",Lo="cupel-reachability",Hi=new Set(["dispatch","dynamic-load","coverage-gap"]);function $u(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var Mu=500,Pu=10;function Lu(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function Tu(e,n){return`${e}::${n}`}function Du(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Fu(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Ou("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Ku(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Hi.has(e.unknownKind)}var To={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function Do(e){let n=[],t=new Map,i=[];for(let o of e.findings){if(!Ku(o))continue;let c=Tu(o.displayId,o.packageName);if(!t.has(c)){t.set(c,n.length);let y=Du(o.severity);n.push({id:z(c),properties:{tags:o.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${z(o.packageName)}`]:["security","reachability",`package/${z(o.packageName)}`],...y!==void 0?{"security-severity":y}:{}}})}let u=o.tier==="reachable-high"||o.tier==="reachable-medium"||o.tier==="reachable-low",f=o.path??[],p=f.find(y=>y.modulePath!==""),h=[...new Set(o.unresolvedSites.map(y=>y.path).filter(y=>y!==""))],k=u?p!==void 0?{physicalLocation:{artifactLocation:{uri:z(p.modulePath)}},message:{text:`calls ${z(o.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:z(o.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:z(h[0])}},message:{text:`unresolved ${z(o.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:z(o.packageLocation??(o.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},x=u?f.map(y=>({physicalLocation:{artifactLocation:{uri:z(y.modulePath||"package-lock.json")}},message:{text:z(y.functionName??"<step>")}})):h.slice(1,Pu+1).map(y=>({physicalLocation:{artifactLocation:{uri:z(y)}},message:{text:"also blocked here"}}));i.push({ruleId:z(c),ruleIndex:t.get(c),level:u?"error":"warning",message:{text:z(`[${o.tier}] ${o.displayId} in ${o.packageName}@${o.version}`+(o.symbolName!==null?` \u2014 reaches ${o.symbolName}`:"")+(o.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${o.reason}`)},locations:[k],...x.length>0?{relatedLocations:x}:{},partialFingerprints:{"cupelReachability/v1":Fu(o)},properties:{tier:o.tier,advisoryId:z(o.advisoryId),...o.surfaceComplete===!1?{surfaceComplete:!1}:{},...o.modelId!==void 0?{modelId:z(o.modelId),modelPromotedFromKind:o.modelPromotedFromKind}:{},...o.unknownKind!==void 0?{unknownKind:o.unknownKind,unknownOwner:Re[o.unknownKind],unresolvedSiteCount:o.unresolvedSites.length}:{}}})}let r=new Map,s=new Map;for(let o of e.findings){if(o.tier!=="unknown"||o.unknownKind===void 0||(r.set(o.unknownKind,(r.get(o.unknownKind)??0)+1),Hi.has(o.unknownKind)))continue;let c=s.get(o.unknownKind)??[];c.length<Mu&&c.push({advisory:z(o.displayId),package:z(o.packageName),version:z(o.version)}),s.set(o.unknownKind,c)}let a={cupel:0,project:0};for(let[o,c]of r)a[Re[o]]+=c;let l={};for(let[o,c]of s){let u=r.get(o)??c.length;l[o]={count:u,owner:Re[o],note:To[o],truncated:u>c.length,advisories:c}}return{$schema:Ru,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Lo},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:z(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(o=>`${o.entrypoint} (${o.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...r.keys()].filter(o=>!Hi.has(o)&&!$u(o,e.analysisAborted)).sort().map(o=>({descriptor:{id:`unknown-${o}`},level:"warning",message:{text:`${String(r.get(o)??0)} finding(s) are unknown because ${To[o]} (owner: ${Re[o]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${o}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(o=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:z(`${o.source} (${o.file}): ${o.detail}`)}})),...e.rejectedEntries.map(o=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:z(`--entry did not resolve to a file inside the app root: ${o}`)}})),...e.analyzerDiagnostics.map(o=>({descriptor:{id:o.code},level:"warning",message:{text:z(`${o.detail} (${o.path})`)}})),...e.installed.diagnostics.map(o=>({descriptor:{id:"resolve"},level:"warning",message:{text:z(o)}}))]}],results:i,properties:{category:Lo,summary:e.counts,...Lu(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...r].sort((o,c)=>c[1]-o[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(o=>o.tier==="unknown"&&o.unknownKind==="db-gap").map(o=>({advisory:z(o.displayId),package:z(o.packageName),version:z(o.version)}))}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function Fo(){try{let e=ju(Uu(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Vu(e,n){let t=`${JSON.stringify(n,null,2)}
-`,i=`${e}.tmp-${Ko(8).toString("hex")}`;jo(i,t,{encoding:"utf8",flag:"wx"}),Bu(i,e)}async function qu(e){let n=io(e),i=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:No(n.shard),sequence:null}:await Co({offline:n.offline}),r=i.path,s=_i({dir:n.dir,shardPath:r,failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{}});if(process.stdout.write(`${Po(s)}
-`),s.modelLane!==void 0){let a=s.modelLane.notes.length>0?` (${s.modelLane.notes.map(l=>z(l)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(s.modelLane.active)}/${String(s.modelLane.stored)} active, ${String(s.modelLane.promoted)} promoted to reachable-low${a}
-`)}if(n.summaryShadow!==void 0&&s.summaryShadow!==void 0){let a=zu.join(n.summaryShadow,"shadow-report.json");jo(a,`${JSON.stringify(s.summaryShadow,null,2)}
+}`,g.ScriptTarget.Latest,!0),r=i.parseDiagnostics;if(r!==void 0&&r.length>0||Yt(i,n+1,!0))return!0}return!1}function Yt(e,n=0,t=!1){let i=!1,r=t?sl:fl(e);if(r.saturated)return!0;let s=l=>g.isElementAccessExpression(l)&&!g.isStringLiteralLike(l.argumentExpression)&&lt(le(l.expression),r),a=l=>{if(!i){if(t&&(g.isCallExpression(l)||g.isNewExpression(l)||g.isTaggedTemplateExpression(l))){i=!0;return}if(g.isCallExpression(l)){let o=Dn(l);if(o!==null){let c=o.specifierArg;if(c===void 0||!g.isStringLiteralLike(c)||t){i=!0;return}}else{let c=le(l.expression);if(g.isIdentifier(c)&&(c.text==="eval"||c.text==="Function")){if(Fr(l.arguments,n)){i=!0;return}}else if(pl(c)){i=!0;return}else if(s(c)){i=!0;return}else if(cl(l,r)){i=!0;return}}}else if(g.isNewExpression(l)){let o=le(l.expression);if(g.isIdentifier(o)&&o.text==="Function"){if(Fr(l.arguments??[],n)){i=!0;return}}else if(Ln(o)){i=!0;return}}else if(g.isIdentifier(l)&&el.has(l.text)&&rl(l)){i=!0;return}else if((g.isPropertyAccessExpression(l)||g.isElementAccessExpression(l))&&(zr(l)||Ln(l)||s(l))&&Br(l)){i=!0;return}else if(g.isBindingElement(l)){let o=l.propertyName??l.name,c=g.isIdentifier(o)||g.isStringLiteralLike(o)?o.text:g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?o.expression.text:void 0;if(c!==void 0&&ct.has(c)){i=!0;return}}g.forEachChild(l,a)}};return a(e),i}function Gr(e,n,t){if(Yt(t))return!0;if(!Qt(e)||!n.includes("<")||!n.includes("require"))return!1;let i=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);return Yt(i)}function hl(e,n,t){if(Ja(e))return!0;let i=t.endsWith(Se.sep)?t:t+Se.sep,r=e.split("/"),s=n;for(;;){let a=Se.join(s,"node_modules",...r),l;try{l=gn(Se.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(i))return!1;let c=_e(l);if(c===null)return!1;let u;try{u=JSON.parse(c).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(br(a))return!1;if(s===t)break;let o=Se.dirname(s);if(o===s||o!==t&&!o.startsWith(i))break;s=o}return!0}function gl(e,n){let t=n.endsWith(Se.sep)?n:n+Se.sep,i=Se.dirname(e);for(;;){let r=Se.join(i,"package.json"),s;try{s=gn(r)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let l=_e(s);if(l!==null)try{let o=JSON.parse(l).name;if(typeof o=="string"&&o.length>0)return o}catch{return null}}if(i===n)break;let a=Se.dirname(i);if(a===i||a!==n&&!a.startsWith(t))break;i=a}return null}function yl(e,n,t,i,r){let s=[],a=[],l=new Set,o={},c=new Set,u=new Set,f=[],p=!1,h=(x,y)=>{let v;try{v=gn(y)}catch{return!1}let N=Xe(e,v);if(N===null)return r.push({code:"out-of-root",path:v,detail:"dependency module resolved outside the app root; not followed"}),!1;let R=!t.has(v)&&!u.has(v);return R&&u.size>=Gt?(p=!0,!1):(a.push({from:x,to:{module:N}}),R?(u.add(v),s.push(N),!0):!1)},E=(x,y)=>{if(l.add(y),c.has(y))return;c.add(y);let v=Te(y,x,Ge,n);if(v!==null&&!je(v)){if(h({surface:y},v)){f.push(v);try{let N=Xe(e,gn(v)),R=gl(v,e);N!==null&&R!==null&&(o[N]=R)}catch{}}return}hl(y,Se.dirname(x),e)||r.push({code:"unresolved-specifier",path:y,detail:`dependency "${y}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let x of i)E(x.containingFile,x.packageName);for(;f.length>0&&u.size<Gt;){let x=f.pop();if(x===void 0)break;let y=Xe(e,x);if(y===null)continue;let v=En(x,rn);if(v.kind==="too-large"){r.push({code:"limit-exceeded",path:y,detail:`dependency module over the ${String(rn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(v.kind==="not-regular"){r.push({code:"parse-error",path:y,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let N=g.createSourceFile(x,v.text,g.ScriptTarget.ES2020,!0),R=N.parseDiagnostics;if(R!==void 0&&R.length>0){r.push({code:"dependency-body",path:y,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}if(Gr(x,v.text,N)){r.push({code:"dependency-body",path:y,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)"});continue}r.push({code:"dependency-body",path:y,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:y});for(let A of Kr(x,v.text))if(A.runtime)if(ue(A.text)==="package-root"){let b=He(A.text);a.push({from:{module:y},to:{surface:b}}),E(x,b)}else{let b=Te(A.text,x,Ge,n);if(b===null){ue(A.text)==="package-subpath"&&r.push({code:"unresolved-specifier",path:y,detail:`runtime package-subpath import "${A.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`});continue}if(je(b)){let m=Xe(e,b);r.push({code:m===null?"out-of-root":"declaration-shadow",path:y,detail:m===null?`runtime import "${A.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${A.text}" resolved to the declaration file "${m}" with no co-located runtime module; its code was not analyzed`});continue}h({module:y},b)&&f.push(b)}}return(p||f.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(Gt)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:a,surfacePackages:[...l],entryRealNames:o}}function Xr(e,n,t=!1){let i=gn(e),r=[],s=g.createCompilerHost(Ge,!0),a=t?wr(i,Ge,s):()=>null,l=new Set,o=new Set,c=n.map(_=>Se.join(i,_)),u=[],f=new Map,p=new Map,h=new Map,E=new Map,x=new Set,y=(_,C)=>{let j=`${String(_.length)}:${_}${C}`;x.has(j)||(x.add(j),r.push({code:"unresolved-specifier",path:_,detail:C}))},v=()=>null,N=0,R=(_,C)=>{let j=p.get(_);return j===void 0&&(j=g.createSourceFile(_,C,g.ScriptTarget.ES2020,!0),p.set(_,j)),{real:_,sf:j}};for(;o.size<ot;){let _=c.pop();if(_===void 0){if(N>=Za)break;N+=1;let $=[];for(let[V,D]of f)D.includes("readdir")&&(D.includes("require")||D.includes("import("))&&$.push(R(V,D));let Y=Qa($);if(Y.length===0)break;let W=[];for(let[V,D]of f)W.push(R(V,D));v=Pr(W,Y,Ge,s,h);let K=!1;for(let V of $){let D=f.get(V.real);if(D!==void 0)for(let H of Dr(V.real,D,i,s,v))o.has(H)||(c.push(H),K=!0)}if(!K)break;continue}let C;try{C=gn(_)}catch{continue}if(o.has(C))continue;if(o.add(C),Xe(i,C)===null){r.push({code:"out-of-root",path:_,detail:"resolved outside app root"});continue}let j=En(C,rn);if(j.kind==="too-large"){r.push({code:"limit-exceeded",path:C,detail:`file is ${String(Math.round(j.bytes/1048576))}MiB, over the ${String(rn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(j.kind==="not-regular"){r.push({code:"parse-error",path:C,detail:"unreadable or not a regular file"});continue}let U=j.text;l.add(C),f.set(C,U);for(let $ of Kr(C,U)){let Y=$.runtime?a($.text,C):null;if(Y===null&&ue($.text)==="package-root"){$.runtime&&u.push({containingFile:C,packageName:He($.text)});continue}let W=Y??Te($.text,C,Ge,s);if(W===null){if($.runtime){let K=ue($.text);if(K==="package-subpath")y(C,`runtime package-subpath import "${$.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`);else if(K==="relative"){let V=Er($.text,C,i,E);V.kind==="unanalyzable"&&y(C,`runtime relative import "${$.text}" did not resolve and its absence could not be proven \u2014 ${V.reason}; a bundler/loader may load a module the analyzer never saw`)}}continue}if(Xe(i,W)===null){r.push({code:"out-of-root",path:W,detail:`specifier "${$.text}" resolved outside app root`});continue}if($.runtime&&je(W)){r.push({code:"declaration-shadow",path:W,detail:`runtime import "${$.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if($.runtime&&!nt(W)){r.push({code:"unanalyzable-module",path:W,detail:`runtime import "${$.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(W)}for(let $ of Dr(C,U,i,s,v))o.has($)||c.push($)}o.size>=ot&&c.length>0&&r.push({code:"limit-exceeded",path:i,detail:`reachable file set exceeds ${String(ot)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let A=yl(i,s,l,u,r),b=g.createProgram({rootNames:[...l],options:Ge,host:s}),m=new Set,S=new Map;for(let _ of b.getSourceFiles()){if(_.isDeclarationFile||b.isSourceFileDefaultLibrary(_)||Xe(i,_.fileName)===null||!Qt(_.fileName))continue;let C=b.getSyntacticDiagnostics(_).length>0;if(!C&&!_.text.includes("<")||Ya(_.text,g.ScriptKind.TSX)!==0)continue;let j=g.createSourceFile(_.fileName,_.text,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);(C||Tr(j)>Tr(_))&&(m.add(_.fileName),S.set(_.fileName,_.text))}let I=b;if(m.size>0){let _=s.getSourceFile.bind(s);s.getSourceFile=(C,j,U,$)=>{let Y=S.get(C);return Y!==void 0?g.createSourceFile(C,Y,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX):_(C,j,U,$)},I=g.createProgram({rootNames:[...l],options:Ge,host:s,oldProgram:b})}let T=I.getTypeChecker(),z=[];for(let _ of I.getSourceFiles()){if(_.isDeclarationFile||I.isSourceFileDefaultLibrary(_)||Xe(i,_.fileName)===null)continue;z.push(_);let C=I.getSyntacticDiagnostics(_);if(C.length>0){let U=C[0],$=U!==void 0?g.flattenDiagnosticMessageText(U.messageText," "):"syntax error";r.push({code:"parse-error",path:_.fileName,detail:`${String(C.length)} syntax error(s): ${$}`})}let j=Xe(i,_.fileName);j!==null&&Gr(_.fileName,_.text,_)&&r.push({code:"loader-escape",path:j,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)"})}return{program:I,checker:T,host:s,options:Ge,appRoot:i,sourceFiles:z,diagnostics:r,depReach:A,resolveParamDirs:v,toRel:_=>Xe(i,_)}}import{existsSync as xl}from"node:fs";import Sl from"node:path";var bl=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/"},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/"},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/"},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/"},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/"},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads"}],kl=["dependencies","devDependencies"];function El(e,n){for(let t of kl){let i=e[t];if(!(typeof i!="object"||i===null||Array.isArray(i))&&Object.hasOwn(i,n))return!0}return!1}function Zt(e,n){if(n===null)return null;for(let t of bl)if(El(n,t.dependency)){for(let i of t.configFiles)if(xl(Sl.join(e,i)))return{name:t.name,configFile:i,entryHint:t.entryHint}}return null}function ei(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}function Je(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let i of n){let r=i.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:i}return t}function wl(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function vl(e){let n=[],t="";for(let i of e){if(i===" "||i==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=i}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var Il=/^[A-Za-z_][A-Za-z0-9_]*=/u;function Al(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var _l=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),Nl=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),Cl=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function Yr(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Jr(e){if(Yr(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return Cl.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:_l.has(t)||n!==-1&&Nl.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var Ol=[".js",".cjs",".mjs",".ts",".mts",".cts"];function Rl(e){return Ol.some(n=>e.endsWith(n))}var $l=new Set(["npm","yarn","pnpm"]);function Ml(e){let n=e[0];return n===void 0||!$l.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function ni(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(wl(n))return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let t=vl(n);if(t===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let i=0;for(t[i]==="env"&&(i+=1);i<t.length;i+=1){let a=t[i];if(a===void 0||!Il.test(a))break;if(Yr(a))return{kind:"unparsed",reason:`environment \`${Je(a)}\` preloads another module; the launch surface is more than one file`};let l=a.indexOf("=");if(a.slice(0,l)==="NODE_OPTIONS")for(let o of a.slice(l+1).split(/\s+/u)){if(o===""||!o.startsWith("-"))continue;let c=Jr(o);if(c!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Je(c.token)}\` ${c.why}`}}}let r=t[i];if(r===void 0)return{kind:"unparsed",reason:"no program in the command"};if(Ml(t.slice(i)))return{kind:"delegates",target:"scripts.start"};if(!Al(r))return{kind:"unparsed",reason:`runs \`${Je(r)}\`, not node directly \u2014 the entry file cannot be identified`};for(i+=1;i<t.length;i+=1){let a=t[i];if(a===void 0||!a.startsWith("-"))break;let l=Jr(a);if(l!==null)return{kind:"unparsed",reason:`node flag \`${Je(l.token)}\` ${l.why}`}}let s=t[i];return s===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:Rl(s)?{kind:"file",specifier:s}:{kind:"unparsed",reason:`\`${Je(s)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function Pl(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var Ll=64;function ti(e){let n=e.split(`
+`),t=n.length>64,i=[],r=0;for(let s of n.slice(0,64)){let a=s.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let o=a.slice(l+1).trim();if(o.length===0)continue;let c=a.slice(0,l);if(c.length>Ll||!Pl(c)){r+=1;continue}i.push({name:c,command:o})}return i.sort((s,a)=>s.name===a.name?0:s.name==="web"?-1:a.name==="web"?1:0),{entries:i,truncated:t,unnamedLines:r}}import{realpathSync as Qr}from"node:fs";import Ce from"node:path";import d from"typescript";var Zr=3;function te(e,n,t){if(e===void 0)return;let i=e[n]??={fired:0,refused:{}};t===null?i.fired+=1:i.refused[t]=(i.refused[t]??0)+1}function on(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var ft=16,si=256,ii=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let i=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(i)||(this.moduleFor(n),this.fns.set(i,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let i=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(i)||(this.moduleFor(n),this.classNodes.set(i,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(i,[])),r}methodFor(n,t,i,r){let s=`${n}#${t}.${i}`,a=`pkg:${n}#${t}.${i}`;if(!this.fns.has(s)){let l=this.classFor(n,t);this.fns.set(s,{id:a,moduleId:`pkg:${n}`,name:i,kind:r,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function ls(e,n){let t="node_modules/",i=e.lastIndexOf(t);if(i===-1)return n;let s=e.slice(i+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function es(e,n,t){let i=Ce.dirname(e),r=Ce.dirname(n),s=[];for(;;){let l=t.get(i);if(l!==void 0){for(let c of s)t.set(c,l);return l}s.push(i);let o=_e(Ce.join(i,"package.json"));if(o!==null)try{let c=JSON.parse(o),u={name:c.name??"app",version:c.version??"0.0.0",dir:i};for(let f of s)t.set(f,u);return u}catch{}if(i===r||i===Ce.dirname(i))break;i=Ce.dirname(i)}let a={name:"app",version:"0.0.0",dir:null};for(let l of s)t.set(l,a);return a}function Tl(e){let n=[],t=i=>{if(d.isImportDeclaration(i)&&d.isStringLiteralLike(i.moduleSpecifier))n.push({specifier:i.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isImportEqualsDeclaration(i)&&d.isExternalModuleReference(i.moduleReference)&&d.isStringLiteralLike(i.moduleReference.expression))n.push({specifier:i.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&d.isStringLiteralLike(i.moduleSpecifier))n.push({specifier:i.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isCallExpression(i)){let r=Dn(i);if(r!==null){let s=r.specifierArg,a=s!==void 0&&d.isStringLiteralLike(s);n.push({specifier:a?s.text:void 0,specifierIsLiteral:a,dynamic:!0,...s!==void 0&&!a?{computedArg:s,loadPos:i.getStart(e)}:{}})}}d.forEachChild(i,t)};return t(e),n}function Dl(e,n,t){let i=new Map,r=es(Ce.join(e.appRoot,"package.json"),e.appRoot,i),s=[],a=[],l=[],o=new Map,c=new Set,u=new Set;for(let f of e.sourceFiles){let p=e.toRel(f.fileName);p!==null&&u.add(p)}for(let f of e.sourceFiles){let p=e.toRel(f.fileName);if(p===null)continue;let h=es(f.fileName,e.appRoot,i),E=ls(p,r.name),x=p.includes("node_modules/");s.push({id:p,packageName:x&&h.name!==r.name?h.name:E,versionRange:h.version,path:p,moduleSystem:"cjs",isEntrypoint:n.has(p)}),h.dir===r.dir&&c.add(p);let y=0,v=null;for(let N of Tl(f)){let R=`${p}#import${String(y)}`;y+=1;let A=null;if(N.specifier!==void 0)if(ue(N.specifier)==="package-root")A=t.moduleFor(He(N.specifier));else{let b=Te(N.specifier,f.fileName,e.options,e.host),m=b!==null?e.toRel(b):null;m!==null&&(A=m)}if(a.push({id:R,moduleId:p,specifier:N.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:N.dynamic,specifierIsLiteral:N.specifierIsLiteral,...A!==null?{resolvedModuleId:A}:{}}),A!==null&&l.push({importId:R,resolvedModuleId:A}),N.computedArg!==void 0&&N.loadPos!==void 0){v??=hn(f,f.fileName,e.resolveParamDirs);let b=[];for(let m of rt(N.computedArg,v,e.appRoot,e.options,e.host)){let S=e.toRel(m);if(S===null||!u.has(S))continue;let I=S,T=`${p}#import${String(y)}`;y+=1,a.push({id:T,moduleId:p,specifier:S,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:I}),l.push({importId:T,resolvedModuleId:I}),b.push(S)}if(b.length>0){let m=Pn(N.computedArg,v)!==null||it(N.computedArg),S=o.get(p)??[];S.push({pos:N.loadPos,candidateRels:b,seedable:m}),o.set(p,S)}}}}return{modules:s,imports:a,importEdges:l,computedLoads:o,appOwnedPaths:c}}function Fl(e){let n=_e(e);if(n===null)return null;let t=d.createSourceFile(e,n,d.ScriptTarget.Latest,!0),i=r=>t.statements.some(s=>d.isFunctionDeclaration(s)?s.name?.text===r:d.isVariableStatement(s)?s.declarationList.declarations.some(a=>d.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&(d.isFunctionExpression(a.initializer)||d.isArrowFunction(a.initializer))):!1);for(let r of t.statements){if(d.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(a=>a.kind===d.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!d.isExpressionStatement(r)||!d.isBinaryExpression(r.expression))continue;let s=r.expression;if(s.operatorToken.kind===d.SyntaxKind.EqualsToken&&Kl(s.left)){if(d.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(d.isIdentifier(s.right)&&i(s.right.text))return s.right.text}}return null}function Kl(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function jl(e,n,t){for(let c of e.surfacePackages)n.moduleFor(c);let i=c=>"surface"in c?n.moduleFor(c.surface):c.module,r=[],s=new Set;for(let c of e.modules)t.has(c)||s.has(c)||(s.add(c),r.push({id:c,packageName:e.entryRealNames[c]??ls(c,"app"),versionRange:"",path:c,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],o=0;for(let c of e.edges){let u=i(c.from),f=i(c.to),p=`${String(u)}#depreach${String(o)}`;o+=1,a.push({id:p,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),l.push({importId:p,resolvedModuleId:f})}return{modules:r,imports:a,importEdges:l}}function ns(e,n,t){let i=e.expression;if(d.isIdentifier(i)&&!t.has(i.text)){let r=n.get(i.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(d.isPropertyAccessExpression(i)&&d.isIdentifier(i.expression)&&!t.has(i.expression.text)){let r=n.get(i.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:i.name.text}}return null}function yn(e){return d.canHaveModifiers(e)&&(d.getModifiers(e)?.some(n=>n.kind===d.SyntaxKind.ExportKeyword)??!1)}function Bl(e){let n=new Set,t;for(let i of e.statements){if(d.isExpressionStatement(i)&&d.isBinaryExpression(i.expression)){let r=i.expression;if(r.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(r.left)&&d.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(d.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(d.isObjectLiteralExpression(r.right))for(let s of r.right.properties)d.isShorthandPropertyAssignment(s)?n.add(s.name.text):d.isPropertyAssignment(s)&&d.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(d.isFunctionDeclaration(i)&&i.name!==void 0&&yn(i))n.add(i.name.text);else if(d.isVariableStatement(i)&&yn(i))for(let r of i.declarationList.declarations)d.isIdentifier(r.name)&&n.add(r.name.text);else if(d.isExportDeclaration(i)&&i.exportClause&&d.isNamedExports(i.exportClause))for(let r of i.exportClause.elements)n.add((r.propertyName??r.name).text);else d.isExportAssignment(i)&&d.isIdentifier(i.expression)&&(n.add(i.expression.text),t=i.expression.text)}return{reachableLocals:n,defaultTarget:t}}function zl(e){for(let n of e.statements){if(d.isFunctionDeclaration(n)&&n.name!==void 0&&yn(n)&&d.getModifiers(n)?.some(t=>t.kind===d.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(d.isExportAssignment(n)&&!n.isExportEquals&&d.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===d.SyntaxKind.EqualsToken&&ve(t.left)&&d.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function Ye(e){if(d.isCallExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&d.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function ve(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Be(e){if(ve(e))return!0;if(!d.isPropertyAccessExpression(e)&&!d.isElementAccessExpression(e))return!1;let n=e.expression;return d.isIdentifier(n)&&n.text==="exports"?!0:ve(n)}function In(e){return d.isPropertyAccessExpression(e.expression)&&d.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ds(e){let n=!1,t=i=>{if(!n){if(d.isCallExpression(i)){let r=Ye(i);if(r!==void 0&&ue(r)!=="package-root"){n=!0;return}}d.forEachChild(i,t)}};return t(e),n}function cs(e){let n=new Set,t=r=>r!==void 0&&ds(r),i=r=>{d.isVariableDeclaration(r)&&t(r.initializer)&&Mn(r.name,n),d.isBinaryExpression(r)&&r.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),d.forEachChild(r,i)};return i(e),n}function us(e,n){for(let t of e.properties)d.isShorthandPropertyAssignment(t)?n.add(t.name.text):d.isPropertyAssignment(t)&&d.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function Ul(e){let n=new Set;for(let l of e.statements)if(d.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(d.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(d.isVariableStatement(l))for(let o of l.declarationList.declarations)d.isIdentifier(o.name)&&o.initializer!==void 0&&(d.isFunctionExpression(o.initializer)||d.isArrowFunction(o.initializer)||d.isObjectLiteralExpression(o.initializer))&&n.add(o.name.text);let t=l=>d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isObjectLiteralExpression(l)||d.isIdentifier(l)&&n.has(l.text),i=new Set,r=l=>{d.isIdentifier(l)?i.add(l.text):d.isObjectLiteralExpression(l)&&us(l,i)},s=!1,a=l=>{if(!s){if(d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken)if(ve(l.left)){r(l.right);let o=l.right;(d.isObjectLiteralExpression(o)?o.properties.every(u=>d.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||d.isPropertyAssignment(u)&&t(u.initializer)):t(o))||(s=!0)}else Be(l.left)&&(t(l.right)||(s=!0));else(d.isCallExpression(l)&&In(l)&&l.arguments[0]!==void 0&&xn(l.arguments[0])||d.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(s=!0);s||d.forEachChild(l,a)}};if(a(e),!s&&i.size>0){for(let l of hs(e))if(i.has(l)){s=!0;break}}return s}function xn(e){return Be(e)||d.isIdentifier(e)&&e.text==="exports"}function fs(e){if(!d.isPropertyAccessExpression(e.expression)||!d.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function oi(e){return fs(e)&&e.arguments[0]!==void 0&&xn(e.arguments[0])}function Vl(e){return fs(e)&&e.arguments[0]!==void 0&&d.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function ql(e){for(let n of e.declarations??[])if(d.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(d.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Hl(e,n,t,i,r){let s=(e.declarations??[]).filter(l=>!d.isSourceFile(l)&&!d.isModuleDeclaration(l));for(let l of s){let o=l.getSourceFile(),c=n.toRel(o.fileName);if(c===null||r.has(c))continue;let u=t.get(`${c}::${String(l.getStart(o,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of s){let o=n.toRel(l.getSourceFile().fileName);if(o===null||r.has(o))continue;let c=i.get(`${o}::${a}`);if(c!==void 0)return c}}function pt(e){return d.isPropertyAccessExpression(e)?e.name.text:d.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var ai=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function li(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?pt(e):void 0;return n!==void 0&&n!=="__proto__"&&ai.test(n)?n:void 0}function Wl(e){return e!=="__proto__"&&ai.test(e)}function ts(e){let n=le(e);return d.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||ve(n)}function Gl(e){if(!d.isArrayLiteralExpression(e)&&!d.isObjectLiteralExpression(e))return!1;let n=!1,t=i=>{n||(Be(i)?n=!0:d.forEachChild(i,t))};return t(e),n}function di(e){let n=!1,t=new Map,i=r=>{if(!n){if(d.isBinaryExpression(r)&&r.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(ve(r.left)||d.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===d.SyntaxKind.EqualsToken&&ts(r.right))n=!0;else if(Gl(r.left))n=!0;else if(Be(r.left)){let s=li(r.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(d.isCallExpression(r)&&In(r)&&r.arguments[0]!==void 0&&xn(r.arguments[0])||d.isCallExpression(r)&&oi(r)||d.isCallExpression(r)&&Vl(r)||d.isVariableDeclaration(r)&&r.initializer!==void 0&&ts(r.initializer))&&(n=!0);n||d.forEachChild(r,i)}};return i(e),{surfaceEscapes:n,assignCount:t}}function ci(e){let n=[];for(let t of e.statements){if(!d.isExpressionStatement(t)||!d.isBinaryExpression(t.expression))continue;let i=t.expression;i.operatorToken.kind===d.SyntaxKind.EqualsToken&&(!Be(i.left)||ve(i.left)||n.push({bin:i,name:li(i.left)}))}return n}function Xl(e){let{surfaceEscapes:n,assignCount:t}=di(e);if(n)return[];let i=[];for(let{bin:r,name:s}of ci(e))s===void 0||(t.get(s)??0)!==1||(d.isFunctionExpression(r.right)||d.isArrowFunction(r.right))&&i.push({name:s,value:r.right});return i}function Jl(e,n){let{surfaceEscapes:t,assignCount:i}=di(e);if(t)return[];let r=[];for(let{bin:s,name:a}of ci(e))a===void 0||(i.get(a)??0)!==1||d.isIdentifier(s.right)&&!n.has(s.right.text)&&r.push(s.right.text);return r}function Yl(e,n){let{surfaceEscapes:t,assignCount:i}=di(e);for(let{bin:r,name:s}of ci(e)){let a=r.right;if(!(d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isIdentifier(a)))continue;let o=d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isIdentifier(a)&&!n.has(a.text);if(!(!t&&s!==void 0&&(i.get(s)??0)===1&&o))return!0}return!1}function Ql(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&d.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function is(e){let n=e.parent;return n===void 0?!1:d.isPropertyAccessExpression(n)?n.name===e:d.isQualifiedName(n)?n.right===e:d.isBindingElement(n)||d.isImportSpecifier(n)?n.propertyName===e:d.isExportSpecifier(n)?!0:d.isPropertyAssignment(n)||d.isPropertyDeclaration(n)||d.isPropertySignature(n)||d.isMethodDeclaration(n)||d.isMethodSignature(n)||d.isGetAccessorDeclaration(n)||d.isSetAccessorDeclaration(n)||d.isEnumMember(n)?n.name===e:!1}function rs(e){for(let n=e.parent;n!==void 0;n=n.parent){if(d.isSourceFile(n))return!0;if(!d.isArrowFunction(n)&&(d.isFunctionLike(n)||d.isClassLike(n)))return!1}return!0}function Zl(e,n){let t=i=>{d.isIdentifier(i)&&(i.text==="exports"||i.text==="module")&&n.add(i),d.forEachChild(i,t)};t(e)}function ed(e){let n=[],t=new Set;for(let s of e.statements){if(d.isExportDeclaration(s)||d.isExportAssignment(s)||d.isImportDeclaration(s)||d.isImportEqualsDeclaration(s)||yn(s))return null;if(!d.isExpressionStatement(s)||!d.isBinaryExpression(s.expression))continue;let a=s.expression;if(a.operatorToken.kind===d.SyntaxKind.EqualsToken){if(ve(a.left))n.push({kind:"whole",value:a.right});else if(Be(a.left)){let l=li(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:Ql(a.left)})}else continue;Zl(a.left,t)}}let i=!1,r=s=>{if(!i){if(d.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!is(s)){i=!0;return}if(s.kind===d.SyntaxKind.ThisKeyword&&rs(s)){i=!0;return}if(d.isIdentifier(s)&&s.text==="arguments"&&!is(s)&&rs(s)){i=!0;return}d.forEachChild(s,r)}};return r(e),i?null:n}function ri(e){return d.isIdentifier(e)||d.isStringLiteralLike(e)?e.text:void 0}function ss(e,n,t){return d.isIdentifier(e)?n(e.text):t?.(e)}function nd(e,n,t,i){let r=new Map,s=ed(e);if(s===null||s.filter(h=>h.kind==="whole").length>1)return r;let a=s.findIndex(h=>h.kind==="whole"),l=(h,E)=>a>=0&&E>a&&h.kind==="member"&&h.root==="exports",o=s.some(l);if(o){let h=s[a];if(h===void 0||h.kind!=="whole"||!d.isObjectLiteralExpression(h.value))return r}let c=o?s.filter((h,E)=>!l(h,E)):s,u=new Map;for(let h of c)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let f=h=>n.has(h)?void 0:t(h),p=(h,E)=>{E===void 0?r.delete(h):r.set(h,E)};for(let h of c){if(h.kind==="member"){p(h.name,(u.get(h.name)??0)>1?void 0:ss(h.value,f,i));continue}r.clear();let E=h.value;if(d.isObjectLiteralExpression(E))for(let x of E.properties){if(d.isSpreadAssignment(x))return new Map;if(d.isShorthandPropertyAssignment(x)){p(x.name.text,f(x.name.text));continue}let y=ri(x.name);if(y===void 0)return new Map;p(y,d.isPropertyAssignment(x)?ss(x.initializer,f,i):void 0)}}return r}function ps(e,n,t,i){let r=new Map,s=l=>l!==void 0&&ue(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(d.isVariableDeclaration(l)&&l.initializer!==void 0){let o=l.initializer;if(d.isIdentifier(l.name)&&!i.has(l.name.text)){let c=s(Ye(o));if(c!==void 0)r.set(l.name.text,{kind:"whole",target:c});else if((d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o))&&d.isCallExpression(o.expression)){let u=s(Ye(o.expression)),f=pt(o);u!==void 0&&f!==void 0&&r.set(l.name.text,{kind:"member",target:u,member:f})}}else if(d.isObjectBindingPattern(l.name)){let c=s(Ye(o));if(c!==void 0){for(let u of l.name.elements)if(d.isIdentifier(u.name)&&!i.has(u.name.text)){let f=u.propertyName!==void 0&&d.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;r.set(u.name.text,{kind:"member",target:c,member:f})}}}}d.forEachChild(l,a)};return a(e),r}function td(e,n,t,i){let r=a=>a!==void 0&&ue(a)==="relative"?t.get(`${n}::${a}`):void 0,s=r(Ye(e));if(s!==void 0)return{kind:"whole",target:s};if(d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)){let a=pt(e);if(a===void 0)return;let l=r(Ye(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(d.isIdentifier(e.expression)){let o=i.get(e.expression.text);if(o?.kind==="whole")return{kind:"member",target:o.target,member:a}}return}if(d.isIdentifier(e))return i.get(e.text)}function ms(e,n,t,i,r){let s=[],a=!1,l=f=>{if(ds(f))return!0;let p=!1,h=E=>{p||(d.isIdentifier(E)&&r.has(E.text)?p=!0:d.forEachChild(E,h))};return h(f),p},o=(f,p)=>{let h=td(f,n,t,i);h!==void 0?s.push({source:h,exportedName:p}):l(f)&&(a=!0)},c=f=>{if(d.isObjectLiteralExpression(f)){for(let p of f.properties)if(d.isSpreadAssignment(p))o(p.expression,"default");else if(d.isPropertyAssignment(p)){let h=d.isIdentifier(p.name)||d.isStringLiteralLike(p.name)?p.name.text:"default";o(p.initializer,h)}else if(d.isShorthandPropertyAssignment(p)){let h=i.get(p.name.text);h!==void 0&&s.push({source:h,exportedName:p.name.text})}return}o(f,"default")},u=f=>{if(d.isBinaryExpression(f)&&f.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(ve(f.left)){c(f.right);return}if(Be(f.left)){let p=d.isPropertyAccessExpression(f.left)?f.left.name.text:d.isElementAccessExpression(f.left)&&d.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";o(f.right,p);return}}else if(d.isExportAssignment(f)&&f.isExportEquals){o(f.expression,"default");return}else if(d.isCallExpression(f)&&In(f)&&f.arguments[0]!==void 0&&xn(f.arguments[0])){for(let p of f.arguments.slice(1))c(p);return}d.forEachChild(f,u)};return u(e),{sources:s,residual:a}}function hs(e){let n=new Set,t=r=>{let s=r;for(;d.isPropertyAccessExpression(s)||d.isElementAccessExpression(s);)s=s.expression;return d.isIdentifier(s)?s.text:void 0},i=r=>{let s=gs(r);if(s!==void 0){let a=t(s);a!==void 0&&n.add(a)}d.forEachChild(r,i)};return i(e),n}function gs(e){return d.isBinaryExpression(e)&&e.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=d.SyntaxKind.LastAssignment&&(d.isPropertyAccessExpression(e.left)||d.isElementAccessExpression(e.left))?e.left:void 0}function ut(e){if(d.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)d.isBindingElement(t)&&n.push(...ut(t.name));return n}function we(e){if(d.isIdentifier(e))return[e.text];if(d.isParenthesizedExpression(e)||d.isAsExpression(e)||d.isNonNullExpression(e)||d.isSatisfiesExpression(e)||d.isTypeAssertionExpression(e)||d.isAwaitExpression(e))return we(e.expression);if(d.isYieldExpression(e))return e.expression!==void 0?we(e.expression):[];if(d.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===d.SyntaxKind.BarBarToken||n===d.SyntaxKind.AmpersandAmpersandToken||n===d.SyntaxKind.QuestionQuestionToken?[...we(e.left),...we(e.right)]:n===d.SyntaxKind.CommaToken?we(e.right):[]}return d.isConditionalExpression(e)?[...we(e.whenTrue),...we(e.whenFalse)]:d.isArrayLiteralExpression(e)?e.elements.flatMap(n=>d.isSpreadElement(n)?we(n.expression):d.isOmittedExpression(n)?[]:we(n)):d.isObjectLiteralExpression(e)?e.properties.flatMap(n=>d.isShorthandPropertyAssignment(n)?[n.name.text]:d.isPropertyAssignment(n)?we(n.initializer):d.isSpreadAssignment(n)?we(n.expression):[]):[]}function ys(e,n){let t=[],i=(l,o)=>{for(let c of l)for(let u of o)c!==u&&t.push({a:c,b:u})},r=l=>d.isIdentifier(l)?[l.text]:d.isArrayLiteralExpression(l)?l.elements.flatMap(r):d.isObjectLiteralExpression(l)?l.properties.flatMap(o=>d.isShorthandPropertyAssignment(o)?[o.name.text]:d.isPropertyAssignment(o)?r(o.initializer):[]):[],s=l=>{d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken?i(r(l.left),we(l.right)):d.isVariableDeclaration(l)&&l.initializer!==void 0?i(ut(l.name),we(l.initializer)):(d.isForOfStatement(l)||d.isForInStatement(l))&&d.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&i(ut(l.initializer.declarations[0].name),we(l.expression)),d.forEachChild(l,s)};s(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:o,b:c}of t)a.has(o)&&!a.has(c)&&(a.add(c),l=!0),a.has(c)&&!a.has(o)&&(a.add(o),l=!0)}return a}function xs(e,n){let t=l=>{if(!d.isPropertyAccessExpression(l)&&!d.isElementAccessExpression(l))return;let o=l;for(;d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o);)o=o.expression;return d.isIdentifier(o)?o.text:void 0},i=[],r=(l,o)=>{for(let u of we(o))i.push({name:l,root:u});let c=t(o);c!==void 0&&i.push({name:l,root:c})},s=l=>{d.isVariableDeclaration(l)&&d.isIdentifier(l.name)&&l.initializer!==void 0?r(l.name.text,l.initializer):d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(l.left)&&r(l.left.text,l.right),d.forEachChild(l,s)};s(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:o,root:c}of i){let u=a.get(c);u!==void 0&&!a.has(o)&&(a.set(o,u),l=!0)}}return a}function Ss(e){return ys(e,hs(e))}function id(e,n){let t=o=>o>=d.SyntaxKind.FirstAssignment&&o<=d.SyntaxKind.LastAssignment,i=o=>{let c=o.parent;if(c===void 0||!d.isObjectLiteralExpression(c))return!1;let u=c.parent;return u!==void 0&&d.isBinaryExpression(u)&&u.operatorToken.kind===d.SyntaxKind.EqualsToken&&u.right===c&&Be(u.left)?!0:u!==void 0&&d.isCallExpression(u)&&In(u)&&u.arguments[0]!==void 0&&xn(u.arguments[0])&&u.arguments.indexOf(c)>0},r=(o,c)=>{if((d.isFunctionDeclaration(c)||d.isFunctionExpression(c))&&c.name===o||d.isVariableDeclaration(c)&&c.name===o||d.isParameter(c)&&c.name===o||d.isBindingElement(c)&&c.name===o||(d.isCallExpression(c)||d.isNewExpression(c))&&c.expression===o)return!0;if((d.isPropertyAccessExpression(c)||d.isElementAccessExpression(c))&&c.expression===o){let u=c;for(;u.parent!==void 0&&(d.isPropertyAccessExpression(u.parent)||d.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let f=u.parent;return!(f!==void 0&&d.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===u)}return d.isBinaryExpression(c)&&c.operatorToken.kind===d.SyntaxKind.EqualsToken&&c.right===o&&Be(c.left)?!0:d.isShorthandPropertyAssignment(c)&&c.name===o||d.isPropertyAssignment(c)&&c.initializer===o?i(c):!!(d.isExportAssignment(c)&&c.expression===o||d.isExportSpecifier(c))},s=(o,c)=>d.isPropertyAccessExpression(c)&&c.name===o||d.isPropertyAssignment(c)&&c.name===o||(d.isMethodDeclaration(c)||d.isGetAccessorDeclaration(c)||d.isSetAccessorDeclaration(c))&&c.name===o,a=!1,l=(o,c)=>{if(!a){if(d.isIdentifier(o)&&c!==void 0&&n.has(o.text)&&!s(o,c)&&!r(o,c)){a=!0;return}d.forEachChild(o,u=>l(u,o))}};return l(e,void 0),a}function rd(e){let n=new Set;for(let o of e.statements)if(d.isFunctionDeclaration(o)&&o.name!==void 0)n.add(o.name.text);else if(d.isVariableStatement(o))for(let c of o.declarationList.declarations)d.isIdentifier(c.name)&&c.initializer!==void 0&&(d.isFunctionExpression(c.initializer)||d.isArrowFunction(c.initializer))&&n.add(c.name.text);let t=new Set,i=o=>{d.isBinaryExpression(o)&&o.operatorToken.kind===d.SyntaxKind.EqualsToken?(ve(o.left)&&(d.isIdentifier(o.right)?t.add(o.right.text):d.isObjectLiteralExpression(o.right)&&us(o.right,t)),ve(o.right)&&d.isIdentifier(o.left)&&t.add(o.left.text)):d.isVariableDeclaration(o)&&d.isIdentifier(o.name)&&o.initializer!==void 0&&ve(o.initializer)&&t.add(o.name.text),d.forEachChild(o,i)};if(i(e),t.size>0){if(id(e,t))return!0;let o=xs(e,new Map([...t].map(u=>[u,u]))),c=Ss(e);for(let u of o.keys())if(c.has(u))return!0}let r=o=>d.isIdentifier(o)&&n.has(o.text),s=o=>o.properties.every(c=>d.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||d.isPropertyAssignment(c)&&r(c.initializer)),a=!1,l=o=>{if(!a){if(d.isBinaryExpression(o)){let c=o.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=d.SyntaxKind.LastAssignment;c&&ve(o.left)?o.operatorToken.kind===d.SyntaxKind.EqualsToken&&(r(o.right)||d.isObjectLiteralExpression(o.right)&&s(o.right))||(a=!0):c&&Be(o.left)&&(a=!0)}else d.isCallExpression(o)?(In(o)&&o.arguments[0]!==void 0&&xn(o.arguments[0])||oi(o))&&(a=!0):(d.isExportAssignment(o)&&o.isExportEquals&&!d.isIdentifier(o.expression)||d.isExportDeclaration(o)&&o.moduleSpecifier!==void 0)&&(a=!0);a||d.forEachChild(o,l)}};return l(e),a}var sd=8;function os(e,n,t){let i=new Set,r=ps(e,n,t,wn(e)),s=ms(e,n,t,r,cs(e));for(let{source:a}of s.sources)i.add(a.target);for(let a of e.statements)if(d.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&d.isStringLiteralLike(a.moduleSpecifier)&&ue(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&i.add(l)}return i}function od(e,n,t,i=new Map){let r=new Set(n.modules.filter(b=>b.isEntrypoint).map(b=>String(b.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(b=>b.externalSurface===!0).map(b=>String(b.id))),a=new Map,l=new Map,o=new Map,c=new Map;for(let b of t){if(b.name==="<toplevel>"){c.set(String(b.moduleId),b);continue}if(a.set(`${String(b.moduleId)}::${String(b.declRange.start)}`,b),b.name!==void 0&&l.set(`${String(b.moduleId)}::${b.name}`,b),b.isExported&&b.name!==void 0){let m=o.get(String(b.moduleId))??[];m.push(b),o.set(String(b.moduleId),m)}}if(i.size>0){let b=new Map(t.map(m=>[String(m.id),m]));for(let[m,S]of i){let I=b.get(String(S));I!==void 0&&!a.has(m)&&a.set(m,I)}}let u=new Map;for(let b of n.imports)b.resolvedModuleId!==void 0&&u.set(`${b.moduleId}::${b.specifier}`,String(b.resolvedModuleId));let f=new Map;for(let b of e.sourceFiles){let m=e.toRel(b.fileName);m!==null&&f.set(m,b)}let p=new Map,h=b=>{let m=p.get(b);if(m!==void 0)return m;let S=f.get(b),I=S===void 0?!0:rd(S);return p.set(b,I),I},E=new Set,x=(b,m)=>m!==void 0&&ue(m)==="relative"?u.get(`${b}::${m}`):void 0,y=b=>{if(d.isIdentifier(b))return b.text;if(d.isPropertyAccessExpression(b)){let m=y(b.expression);return m===void 0?void 0:`${m}.${b.name.text}`}if(d.isElementAccessExpression(b)&&d.isStringLiteralLike(b.argumentExpression)){let m=y(b.expression);return m===void 0?void 0:`${m}.${b.argumentExpression.text}`}},v=b=>{let m=b;for(;d.isPropertyAccessExpression(m)||d.isElementAccessExpression(m);)m=m.expression;return Ye(m)};for(let b of e.sourceFiles){let m=e.toRel(b.fileName);if(m===null)continue;let S=new Map,I=new Map,T=(C,j)=>{let U=x(m,Ye(j));if(U!==void 0){if(d.isIdentifier(C))I.set(C.text,U),S.set(C.text,U);else if(d.isObjectBindingPattern(C)||d.isArrayBindingPattern(C))for(let $ of ut(C))I.set($,U);else if(d.isPropertyAccessExpression(C)||d.isElementAccessExpression(C)){let $=y(C);$!==void 0&&S.set($,U)}}},z=C=>{d.isVariableDeclaration(C)&&C.initializer!==void 0?T(C.name,C.initializer):d.isBinaryExpression(C)&&C.operatorToken.kind===d.SyntaxKind.EqualsToken&&T(C.left,C.right),d.forEachChild(C,z)};z(b);let _=C=>{let j=gs(C);if(j!==void 0){let U=j.expression,$=x(m,v(U));$!==void 0&&E.add($);let Y=y(U),W=Y!==void 0?S.get(Y):void 0;W!==void 0&&E.add(W)}d.forEachChild(C,_)};if(_(b),I.size>0){let C=xs(b,I),j=Ss(b);for(let[U,$]of C)j.has(U)&&E.add($)}}let N=[],R=[],A=[];for(let b of e.sourceFiles){let m=e.toRel(b.fileName);if(m===null||!r.has(m))continue;let S=e.checker.getSymbolAtLocation(b),I=new Set,T=new Set,z=0,_=(D,H)=>{if(s.has(String(D.moduleId))||I.has(String(D.id)))return;I.add(String(D.id));let se=`${m}#reexport:${String(z)}:${H}`;z+=1,N.push({id:se,moduleId:m,exportedName:H,kind:"value",reexportOf:{moduleId:String(D.moduleId),name:D.name??H}}),R.push({exportId:se,target:{kind:"function",functionId:D.id}})},C=D=>{if(ql(D))return;let H=D;if((D.flags&d.SymbolFlags.Alias)!==0)try{H=e.checker.getAliasedSymbol(D)}catch{return}let se=Hl(H,e,a,l,s);if(se!==void 0){_(se,D.getName());return}if((H.flags&d.SymbolFlags.Module)!==0&&!T.has(H)){T.add(H);try{for(let De of e.checker.getExportsOfModule(H))C(De)}catch{}}};if(S!==void 0)for(let D of e.checker.getExportsOfModule(S))C(D);let j=ps(b,m,u,wn(b)),U=ms(b,m,u,j,cs(b)),$=new Set,Y=U.residual,W=D=>{let H=f.get(D);D.includes("node_modules/")||H===void 0||Ul(H)?Y=!0:$.add(D)};for(let{source:D,exportedName:H}of U.sources){let se=o.get(D.target)??[],De=E.has(D.target);if(D.kind==="whole"){for(let Ie of se)_(Ie,Ie.name??H);De?Y=!0:(se.length===0||h(D.target))&&W(D.target)}else{let Ie=se.filter(be=>be.name===D.member);for(let be of Ie)_(be,H);De?Y=!0:(Ie.length===0||h(D.target))&&W(D.target)}}let K=new Set,V=[];for(let D of os(b,m,u))V.push({target:D,depth:1});for(;V.length>0;){let D=V.shift();if(D===void 0)break;let{target:H,depth:se}=D;if(K.has(H)||se>sd||(K.add(H),H.split("/").includes("node_modules")))continue;let De=f.get(H);if(De===void 0)continue;let Ie=c.get(H);Ie!==void 0&&!h(H)&&_(Ie,"<load>");for(let be of os(De,H,u))K.has(be)||V.push({target:be,depth:se+1})}Yl(b,wn(b))&&(Y=!0);for(let D of $)A.push({code:"unresolved-reexport",path:m,detail:`entrypoint whole/member re-exports app-owned relative module ${D} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:D});Y&&A.push({code:"unresolved-reexport",path:m,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:N,exportBindings:R,diagnostics:A}}var vn=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),ad=new Set(["defineProperty","defineProperties","create"]);function ld(e){let n=!0,t=r=>d.isIdentifier(r)||d.isStringLiteral(r)||d.isNumericLiteral(r)?vn.has(r.text):d.isComputedPropertyName(r)&&d.isStringLiteralLike(r.expression)?vn.has(r.expression.text):!1,i=r=>{if(n){if(d.isNewExpression(r)||d.isForOfStatement(r)||d.isSpreadElement(r)||d.isSpreadAssignment(r)||d.isArrayBindingPattern(r)||d.isGetAccessorDeclaration(r)||d.isSetAccessorDeclaration(r)||d.isYieldExpression(r)&&r.asteriskToken!==void 0||d.canHaveDecorators(r)&&(d.getDecorators(r)?.length??0)>0){n=!1;return}if((d.isPropertyAccessExpression(r)||d.isMethodDeclaration(r)||d.isPropertyAssignment(r))&&t(r.name)||d.isPropertyDeclaration(r)&&t(r.name)||d.isShorthandPropertyAssignment(r)&&t(r.name)||d.isBindingElement(r)&&t(r.propertyName??r.name)||d.isElementAccessExpression(r)&&d.isStringLiteralLike(r.argumentExpression)&&vn.has(r.argumentExpression.text)){n=!1;return}if(d.isCallExpression(r)&&d.isPropertyAccessExpression(r.expression)&&d.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&ad.has(r.expression.name.text)){n=!1;return}d.forEachChild(r,i)}};return i(e),n}function mt(e){if(d.isIdentifier(e)||d.isStringLiteral(e)||d.isNumericLiteral(e))return e.text}function bs(e){let n=t=>d.canHaveDecorators(t)&&(d.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function dd(e){let n=!1,t=new Set,i=[],r=new Map,s=(p,h)=>{let E=r.get(p);E===void 0?r.set(p,[h]):E.push(h)},a=p=>{d.isIdentifier(p)?t.add(p.text):i.push(p)},l=p=>{for(let h of p.properties)d.isShorthandPropertyAssignment(h)?t.add(h.name.text):d.isPropertyAssignment(h)?i.push(h.initializer):n=!0},o=p=>{if(d.isBinaryExpression(p)&&p.operatorToken.kind===d.SyntaxKind.EqualsToken){let h=p.left,E=p.right;ve(h)?d.isObjectLiteralExpression(E)?l(E):d.isIdentifier(E)||d.isFunctionExpression(E)||d.isArrowFunction(E)||d.isClassExpression(E)?a(E):n=!0:Be(h)?(d.isElementAccessExpression(h)&&!d.isStringLiteralLike(h.argumentExpression)&&(n=!0),a(E)):d.isIdentifier(h)?s(h.text,E):(d.isPropertyAccessExpression(h)||d.isElementAccessExpression(h))&&d.isIdentifier(h.expression)&&s(h.expression.text,E)}else if(d.isCallExpression(p))(In(p)&&p.arguments[0]!==void 0&&xn(p.arguments[0])||oi(p))&&(n=!0);else if(d.isVariableDeclaration(p)&&d.isIdentifier(p.name)&&p.initializer!==void 0)s(p.name.text,p.initializer);else if((d.isFunctionDeclaration(p)||d.isClassDeclaration(p))&&p.name!==void 0)s(p.name.text,p),yn(p)&&t.add(p.name.text);else if(d.isExportDeclaration(p)){if(p.exportClause===void 0)n=!0;else if(p.moduleSpecifier===void 0&&d.isNamedExports(p.exportClause))for(let h of p.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(d.isExportAssignment(p))p.isExportEquals&&!d.isIdentifier(p.expression)?n=!0:a(p.expression);else if(d.isVariableStatement(p)&&yn(p))for(let h of p.declarationList.declarations)d.isIdentifier(h.name)&&t.add(h.name.text);d.forEachChild(p,o)};o(e);let c=new Set,u=[...t],f=p=>{let h=E=>{d.isIdentifier(E)&&u.push(E.text),d.forEachChild(E,h)};h(p)};for(let p of i)f(p);for(;u.length>0;){let p=u.pop();if(!(p===void 0||c.has(p))){c.add(p);for(let h of r.get(p)??[])f(h)}}return{names:c,opaque:n}}var cd=512,ud=new Set(["get","post","put","patch","delete","options","head"]);function fd(e){for(let n of e.statements){if(d.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(n.expression.left)&&d.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,i=n.expression.left.name.text;if(t==="module"&&i==="exports"||t==="exports"&&i==="default")return n.expression.right}}return null}function pd(e){let n=new Map,t=fd(e);if(t===null)return n;let i=s=>{for(let a of s.properties)if(d.isPropertyAssignment(a)&&d.isObjectLiteralExpression(a.initializer)){let l=mt(a.name);l!==void 0&&n.set(l,a.initializer)}};if(d.isObjectLiteralExpression(t))return i(t),n;if(!d.isIdentifier(t))return n;let r=t.text;for(let s of e.statements)if(d.isVariableStatement(s))for(let a of s.declarationList.declarations)d.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&d.isObjectLiteralExpression(a.initializer)&&i(a.initializer);else if(d.isExpressionStatement(s)&&d.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(s.expression.left)&&d.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===r&&d.isObjectLiteralExpression(s.expression.right)){let a=s.expression.left.name.text;n.set(a,s.expression.right)}return n}function md(e){for(let n of e.properties){if(d.isMethodDeclaration(n)&&d.isIdentifier(n.name)&&n.name.text==="handler")return n;if(d.isPropertyAssignment(n)&&d.isIdentifier(n.name)&&n.name.text==="handler"&&(d.isArrowFunction(n.initializer)||d.isFunctionExpression(n.initializer)))return n.initializer}return null}function hd(e,n){for(let i of e.properties){let r;if(d.isPropertyAssignment(i)||d.isMethodDeclaration(i)?r=mt(i.name):d.isShorthandPropertyAssignment(i)&&(r=i.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function gd(e,n){let t=[],i=new Set,r=(l,o,c)=>{if(t.length>=cd||l==="__proto__"||!ai.test(l))return;let u=`${e}#handler:${l}`;i.has(u)||(i.add(u),t.push({id:u,node:o,memberPath:l,idiom:c}))};for(let[l,o]of pd(n)){let c=md(o);c!==null&&hd(o,c)&&r(l,c,"descriptor-object")}let s=0,a=l=>{if(d.isCallExpression(l)&&d.isPropertyAccessExpression(l.expression)&&d.isIdentifier(l.expression.expression)&&ud.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&d.isStringLiteralLike(l.arguments[0])){let o=l.expression.name.text;for(let c=1;c<l.arguments.length;c+=1){let u=l.arguments[c];u!==void 0&&(d.isArrowFunction(u)||d.isFunctionExpression(u))&&r(`${o}_${String(s)}_${String(c)}`,u,"router-verb")}s+=1}d.forEachChild(l,a)};return a(n),t}function yd(e,n,t,i,r,s){let a=`${e}#class:${t}`,l=[],o=new Set;for(let c of i.members){let u,f,p;if(d.isConstructorDeclaration(c))u="constructor",f="ctor",p=!1;else if(d.isMethodDeclaration(c))u=mt(c.name),f="method",p=u!==void 0&&!vn.has(u);else continue;if(u===void 0||o.has(u))continue;o.add(u);let h=`${e}#${t}.${u}`;r.push({id:h,moduleId:e,name:u,kind:f,enclosingClassId:a,declRange:on(e,c,n),isExported:!1,publicSurfaceReachable:!1}),l.push(h),p&&s.push({start:c.getStart(n,!1),end:c.getEnd(),id:h})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function xd(e,n,t=[],i=!1,r){let s=[],a=new Map,l=[],{reachableLocals:o,defaultTarget:c}=Bl(n),u=wn(n),f=`${e}#<toplevel>`;s.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let p=(m,S)=>{let I=`${e}#${m}`;return s.push({id:I,moduleId:e,name:m,kind:"function",declRange:on(e,S,n),isExported:o.has(m),publicSurfaceReachable:o.has(m)}),a.set(m,{kind:"function",functionId:I}),l.push({start:S.getStart(n,!1),end:S.getEnd(),id:I}),I},h=[],E=!e.split("/").includes("node_modules");if(E)for(let m of Jl(n,u))o.add(m);let x=E?dd(n):void 0,y=(m,S,I)=>{x===void 0||x.opaque||x.names.has(m)||yn(I)||bs(S)||h.push(yd(e,n,m,S,s,l))};for(let m of n.statements)if(d.isFunctionDeclaration(m)&&m.name!==void 0)p(m.name.text,m);else if(d.isClassDeclaration(m)&&m.name!==void 0)y(m.name.text,m,m);else if(d.isVariableStatement(m))for(let S of m.declarationList.declarations){if(d.isObjectBindingPattern(S.name)&&S.initializer!==void 0&&d.isCallExpression(S.initializer)&&d.isIdentifier(S.initializer.expression)&&S.initializer.expression.text==="require"&&S.initializer.arguments.length===1&&S.initializer.arguments[0]!==void 0&&d.isStringLiteralLike(S.initializer.arguments[0])){let T=S.initializer.arguments[0].text;for(let z of S.name.elements){if(z.dotDotDotToken!==void 0||z.initializer!==void 0||!d.isIdentifier(z.name))continue;let _=z.propertyName??z.name;!d.isIdentifier(_)&&!d.isStringLiteralLike(_)||a.set(z.name.text,{kind:"import",specifier:T,form:{named:_.text}})}continue}if(!d.isIdentifier(S.name)||S.initializer===void 0)continue;let I=S.initializer;if(d.isFunctionExpression(I)||d.isArrowFunction(I))p(S.name.text,S);else if(d.isClassExpression(I))y(S.name.text,I,m);else if(d.isCallExpression(I)&&d.isIdentifier(I.expression)&&I.expression.text==="require"&&I.arguments.length===1&&I.arguments[0]!==void 0&&d.isStringLiteralLike(I.arguments[0]))a.set(S.name.text,{kind:"import",specifier:I.arguments[0].text,form:"whole"});else if((d.isPropertyAccessExpression(I)||d.isElementAccessExpression(I))&&pt(I)==="default"&&d.isCallExpression(I.expression)){let T=Ye(I.expression);T!==void 0&&a.set(S.name.text,{kind:"import",specifier:T,form:"require-default"})}}else if(d.isImportDeclaration(m)&&d.isStringLiteralLike(m.moduleSpecifier)){let S=m.moduleSpecifier.text,I=m.importClause;if(I!==void 0){I.name!==void 0&&a.set(I.name.text,{kind:"import",specifier:S,form:"default"});let T=I.namedBindings;if(T!==void 0&&d.isNamespaceImport(T))a.set(T.name.text,{kind:"import",specifier:S,form:"namespace"});else if(T!==void 0&&d.isNamedImports(T))for(let z of T.elements){let _=(z.propertyName??z.name).text;a.set(z.name.text,{kind:"import",specifier:S,form:{named:_}})}}}else d.isImportEqualsDeclaration(m)&&d.isExternalModuleReference(m.moduleReference)&&d.isStringLiteralLike(m.moduleReference.expression)&&a.set(m.name.text,{kind:"import",specifier:m.moduleReference.expression.text,form:"whole"});let v=new Map,N,R=new Map,A=new Map;if(E)for(let{name:m,value:S}of Xl(n)){let I=`${e}#member-export:${m}`;s.push({id:I,moduleId:e,name:m,kind:d.isArrowFunction(S)?"arrow":"function",declRange:on(e,S,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:S.getStart(n,!1),end:S.getEnd(),id:I}),v.set(S.getStart(n,!1),I)}if(i&&E){let m=_=>{let C=Ne(_);return d.isFunctionExpression(C)||d.isArrowFunction(C)?C:void 0},S=(_,C)=>{let j=_;return s.push({id:j,moduleId:e,kind:d.isArrowFunction(C)?"arrow":"function",declRange:on(e,C,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:C.getStart(n,!1),end:C.getEnd(),id:j}),v.set(C.getStart(n,!1),j),j},I=[],T=[],z=[];for(let _ of n.statements)d.isExportAssignment(_)&&!_.isExportEquals?I.push(_):d.isFunctionDeclaration(_)&&d.getModifiers(_)?.some(C=>C.kind===d.SyntaxKind.DefaultKeyword)===!0?T.push(_):d.isExpressionStatement(_)&&d.isBinaryExpression(_.expression)&&_.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&ve(_.expression.left)&&z.push(_.expression);if(I.length+T.length+z.length===1){let _=I[0],C=T[0],j=z[0];if(_!==void 0){let U=m(_.expression);if(U!==void 0){let $=S(`${e}#<default>`,U);N={id:$,esm:!0},A.set(_.getStart(n,!1),$),te(r,"2a-default",null)}}else if(C!==void 0&&C.name===void 0&&C.body!==void 0){let U=S(`${e}#<default>`,C);N={id:U,esm:!0},A.set(C.getStart(n,!1),U),te(r,"2a-default",null)}else if(j!==void 0){let U=m(j.right);if(U!==void 0){let $=S(`${e}#<default>`,U);N={id:$,esm:!1},A.set(j.getStart(n,!1),$),te(r,"2a-default",null)}else if(d.isObjectLiteralExpression(j.right)){let $=j.right,Y=[],W=!0;for(let K of $.properties){if(d.isSpreadAssignment(K)){W=!1;break}let V=K.name,D=V===void 0?void 0:ri(V);if(D===void 0){W=!1;break}Y.push(D)}if(W){let K=new Map;for(let V of Y)K.set(V,(K.get(V)??0)+1);for(let V of $.properties){if(!d.isPropertyAssignment(V))continue;let D=ri(V.name),H=m(V.initializer);if(D!==void 0){if(!Wl(D)){H!==void 0&&te(r,"2a-member","charset-refused");continue}if((K.get(D)??0)!==1){H!==void 0&&te(r,"2a-member","duplicate-key");continue}if(H!==void 0){let se=S(`${e}#<cjs>.${D}`,H);R.set(D,se),A.set(V.getStart(n,!1),se),te(r,"2a-member",null)}}}}else for(let K of $.properties)d.isPropertyAssignment(K)&&m(K.initializer)!==void 0&&te(r,"2a-member","spread-or-computed-literal")}}}else{for(let _ of I)m(_.expression)!==void 0&&te(r,"2a-default","duplicate-default-sources");for(let _ of T)_.name===void 0&&te(r,"2a-default","duplicate-default-sources");for(let _ of z)if(m(_.right)!==void 0)te(r,"2a-default","duplicate-default-sources");else if(d.isObjectLiteralExpression(_.right))for(let C of _.right.properties)d.isPropertyAssignment(C)&&m(C.initializer)!==void 0&&te(r,"2a-member","duplicate-default-sources")}}for(let m of t)s.push({id:m.id,moduleId:e,name:`handler:${m.memberPath}`,kind:d.isArrowFunction(m.node)?"arrow":"function",declRange:on(e,m.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:m.node.getStart(n,!1),end:m.node.getEnd(),id:m.id});l.sort((m,S)=>m.end-m.start-(S.end-S.start));let b=c!==void 0?`${e}#${c}`:void 0;return{rel:e,sf:n,functions:s,bindings:a,exportedFunctionId:b,exportedNames:o,tainted:u,fnRanges:l,toplevelId:f,classes:h,mintedByPos:v,mintedDefault:N,mintedMembers:R,mintSeedAliases:A}}function Sd(e){return d.isIdentifier(e)?"identifier":d.isPropertyAccessExpression(e)?"member":d.isElementAccessExpression(e)?"computed-member":e.kind===d.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function as(e,n){let t=i=>{if(d.isBinaryExpression(i)&&i.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=d.SyntaxKind.LastAssignment){let r=i.left;d.isPropertyAccessExpression(r)&&d.isIdentifier(r.expression)?n(r.expression.text,r.name.text):d.isElementAccessExpression(r)&&d.isIdentifier(r.expression)&&n(r.expression.text,d.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(d.isCallExpression(i)&&d.isPropertyAccessExpression(i.expression)){let r=i.expression,s=i.arguments[0];d.isIdentifier(r.expression)&&s!==void 0&&d.isIdentifier(s)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(s.text,null)}d.forEachChild(i,t)};t(e)}function bd(e){let n=!1,t=i=>{if(!n){if(d.isVariableDeclaration(i)||d.isParameter(i)){let r=new Set;if(Mn(i.name,r),r.has("require")){n=!0;return}}else if((d.isFunctionDeclaration(i)||d.isClassDeclaration(i))&&i.name!==void 0&&i.name.text==="require"){n=!0;return}d.forEachChild(i,t)}};return t(e),n}function kd(e,n,t,i=new Map,r={}){let s=r.additiveForms===!0,a=r.namelessExports===!0,l=s||a?{}:void 0,o=new Map,c=new Map;for(let m of n.imports)m.resolvedModuleId!==void 0&&c.set(`${m.moduleId}::${m.specifier}`,m.resolvedModuleId);for(let m of e.sourceFiles){let S=e.toRel(m.fileName);S!==null&&o.set(S,xd(S,m,i.get(S)??[],a,l))}let u=new Map;if(s)for(let m of o.values()){let S=new Map;for(let[I,T]of m.bindings)if(T.kind==="import"&&T.form==="whole"&&ue(T.specifier)!=="package-root"){let z=c.get(`${m.rel}::${T.specifier}`);z!==void 0&&S.set(I,String(z))}S.size!==0&&as(m.sf,(I,T)=>{let z=S.get(I);if(z===void 0)return;let _=u.get(z);if(_!=="*"){if(T===null){u.set(z,"*");return}_===void 0?u.set(z,new Set([T])):_.add(T)}})}let f=new Map;for(let m of o.values())m.exportedFunctionId!==void 0&&f.set(m.rel,m.exportedFunctionId);let p=new Map;for(let m of o.values()){if(m.rel.split("/").includes("node_modules"))continue;let S=zl(m.sf);if(S===void 0){a&&m.mintedDefault!==void 0&&p.set(m.rel,m.mintedDefault);continue}let I=m.bindings.get(S.name);I?.kind==="function"&&p.set(m.rel,{id:I.functionId,esm:S.esm})}let h=new Map;for(let m of o.values()){let S;for(let I of m.exportedNames){let T=m.bindings.get(I);T?.kind==="function"&&(S??=new Map,S.set(I,T.functionId))}S!==void 0&&h.set(m.rel,S)}let E=new Map;for(let m of o.values()){if(m.rel.split("/").includes("node_modules"))continue;let S=nd(m.sf,m.tainted,I=>{let T=m.bindings.get(I);return T?.kind==="function"?T.functionId:void 0},a?I=>{let T=Ne(I);return d.isFunctionExpression(T)||d.isArrowFunction(T)?m.mintedByPos.get(T.getStart(m.sf,!1)):void 0}:void 0);S.size>0&&E.set(m.rel,S)}let x=[],y=[],v=[],N=[],R=[],A=[];for(let m of o.values()){x.push(...m.functions),A.push(...m.classes);for(let k of m.exportedNames){let w=m.bindings.get(k);if(w?.kind==="function"){let O=`${m.rel}#export:${k}`;N.push({id:O,moduleId:m.rel,exportedName:k,kind:"value"}),R.push({exportId:O,target:{kind:"function",functionId:w.functionId}})}}if(a){if(m.mintedDefault!==void 0){let k=`${m.rel}#export:<default>`;N.push({id:k,moduleId:m.rel,exportedName:"default",kind:"value"}),R.push({exportId:k,target:{kind:"function",functionId:m.mintedDefault.id}})}for(let[k,w]of m.mintedMembers){let O=`${m.rel}#export:<cjs>.${k}`;N.push({id:O,moduleId:m.rel,exportedName:k,kind:"value"}),R.push({exportId:O,target:{kind:"function",functionId:w}})}}let S=new Map;for(let[k,w]of m.bindings){if(w.kind==="function"){S.set(k,w);continue}if(ue(w.specifier)==="package-root"){let M=He(w.specifier);typeof w.form=="object"?S.set(k,{kind:"package-export",packageName:M,exportName:w.form.named}):w.form==="require-default"?S.set(k,{kind:"package-default",packageName:M}):S.set(k,{kind:"package-surface",packageName:M})}else{let M=c.get(`${m.rel}::${w.specifier}`);if(M!==void 0&&typeof w.form=="object"){let J=h.get(String(M))?.get(w.form.named);J!==void 0&&S.set(k,{kind:"app-named-fn",functionId:J})}else if(M!==void 0&&w.form==="require-default"){let J=p.get(String(M));J!==void 0&&J.esm&&S.set(k,{kind:"app-default-fn",functionId:J.id})}else M!==void 0&&typeof w.form!="object"&&w.form!=="require-default"&&S.set(k,{kind:"module",resolvedModuleId:M})}}let I=new Map;for(let k of m.functions){if(k.enclosingClassId===void 0||k.name===void 0)continue;let w=I.get(k.enclosingClassId);w===void 0&&(w=new Map,I.set(k.enclosingClassId,w)),w.set(k.name,k.id)}for(let k of m.classes)k.name===void 0||m.tainted.has(k.name)||S.has(k.name)||S.set(k.name,{kind:"app-class",cls:{classId:k.id,className:k.name,memberIds:I.get(k.id)??new Map}});let T=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0&&d.isNewExpression(k.initializer)&&!m.tainted.has(k.name.text)&&!S.has(k.name.text)){let w=ns(k.initializer,S,m.tainted);w!==null&&S.set(k.name.text,w)}d.forEachChild(k,T)};T(m.sf);let z=k=>{for(let w of m.fnRanges)if(k>=w.start&&k<w.end)return w.id;return m.toplevelId},_=new Map,C=new Map,j=new Map,U=(k,w,O)=>{if(O===null){k.set(w,"*");return}let M=k.get(w);M!=="*"&&(M===void 0?k.set(w,new Set([O])):M.add(O))},$=(k,w)=>{U(_,k,w);let O=S.get(k);O?.kind==="package-surface"?U(C,O.packageName,w):O?.kind==="module"&&U(j,String(O.resolvedModuleId),w)};as(m.sf,$);let Y=new Map,W=256,K=k=>{let w=Y.get(k);return w===void 0&&(w=Y.size>=W?new Set([k]):ys(m.sf,new Set([k])),Y.set(k,w)),w},V=(k,w)=>k==="*"||k!==void 0&&k.has(w),D=(k,w)=>{let O=S.get(k);if(O?.kind==="package-surface"&&V(C.get(O.packageName),w)||O?.kind==="module"&&V(j.get(String(O.resolvedModuleId)),w))return!0;for(let M of K(k))if(V(_.get(M),w))return!0;return!1},H=k=>{if(d.isIdentifier(k)){let w=m.tainted.has(k.text)?void 0:S.get(k.text);return w?.kind==="function"?w.functionId:w?.kind==="module"?f.get(String(w.resolvedModuleId))??null:w?.kind==="package-export"?t.exportFor(w.packageName,w.exportName):null}if(d.isPropertyAccessExpression(k)&&d.isIdentifier(k.expression)){let w=k.expression.text;if(D(w,k.name.text))return null;let O=m.tainted.has(w)?void 0:S.get(w);return O?.kind==="package-surface"?t.exportFor(O.packageName,k.name.text):O?.kind==="package-export"?t.methodFor(O.packageName,O.exportName,k.name.text,"method"):O?.kind==="package-instance"?t.methodFor(O.packageName,O.className,k.name.text,"method"):null}return null},se=k=>{for(let w=k.parent;w!==void 0;w=w.parent)if(!d.isArrowFunction(w)){if(d.isFunctionExpression(w)||d.isFunctionDeclaration(w))return null;if(d.isMethodDeclaration(w)||d.isConstructorDeclaration(w)||d.isGetAccessorDeclaration(w)||d.isSetAccessorDeclaration(w)){let O=w.parent;if(!d.isClassLike(O)||O.name===void 0)return null;let M=m.tainted.has(O.name.text)?void 0:S.get(O.name.text);return M?.kind==="app-class"?M.cls:null}}return null},De=s&&!m.tainted.has("require")&&!bd(m.sf),Ie=k=>{if(d.isIdentifier(k)){let M=m.tainted.has(k.text)?void 0:S.get(k.text);return M?.kind==="package-surface"||M?.kind==="package-default"?t.exportFor(M.packageName,"default"):M?.kind==="app-named-fn"||M?.kind==="app-default-fn"?M.functionId:M?.kind==="module"?p.get(String(M.resolvedModuleId))?.id??null:M?.kind==="member-value"?M.functionId:null}if(!d.isPropertyAccessExpression(k))return null;let w=k.expression;if(s&&d.isCallExpression(Ne(w))){let M=Ye(Ne(w));if(M!==void 0)if(!De)te(l,"2b","require-shadow");else if(ue(M)==="package-root")te(l,"2b","package-root");else{let J=c.get(`${m.rel}::${M}`);if(J===void 0)te(l,"2b","unresolved-module");else{let ie=k.name.text,ge=u.get(String(J));if(ge==="*"||ge!==void 0&&ge.has(ie))te(l,"2b","module-mutation-gate");else{let Oe=E.get(String(J))?.get(ie);if(Oe!==void 0)return te(l,"2b",null),Oe;if(ie==="default"){let ye=p.get(String(J));if(ye!==void 0&&ye.esm)return te(l,"2b",null),ye.id;te(l,"2b","non-esm-default")}else te(l,"2b","unknown-member")}}}return null}let O;if(d.isIdentifier(w)){let M=m.tainted.has(w.text)?void 0:S.get(w.text);if(M?.kind==="app-class"||M?.kind==="app-instance")O=M.cls.memberIds;else if(M?.kind==="object-literal")O=M.obj.members;else if(M?.kind==="module"){let J=E.get(String(M.resolvedModuleId));J?.has(k.name.text)===!0&&!D(w.text,k.name.text)&&(O=J)}}else if(d.isNewExpression(w)){let M=ns(w,S,m.tainted);M?.kind==="app-instance"&&(O=M.cls.memberIds)}else w.kind===d.SyntaxKind.ThisKeyword&&(O=se(k)?.memberIds);return O?.get(k.name.text)??null},be=new Map,dn=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0&&d.isObjectLiteralExpression(k.initializer)&&!m.tainted.has(k.name.text)&&!S.has(k.name.text)&&!be.has(k.name.text)){let w=new Map;for(let O of k.initializer.properties)if(d.isPropertyAssignment(O)&&d.isIdentifier(O.name)){let M=H(O.initializer);M!==null&&w.set(O.name.text,M)}be.set(k.name.text,w)}d.forEachChild(k,dn)};dn(m.sf);let cn=k=>{if(d.isBinaryExpression(k)&&k.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(k.left)&&d.isIdentifier(k.left.expression)&&!m.tainted.has(k.left.expression.text)){let w=be.get(k.left.expression.text);if(w!==void 0){let O=H(k.right);O!==null&&w.set(k.left.name.text,O)}}d.forEachChild(k,cn)};cn(m.sf);for(let[k,w]of be)S.set(k,{kind:"object-literal",obj:{members:w}});let un=(k,w=0)=>{if(w>Zr)return null;let O=Ne(k);if(d.isCallExpression(O)&&d.isPropertyAccessExpression(O.expression)&&O.expression.name.text==="bind")return un(O.expression.expression,w+1);if(d.isIdentifier(O)){let M=H(O);if(M!==null)return M;let J=m.tainted.has(O.text)?void 0:S.get(O.text);return J?.kind==="member-value"?J.functionId:null}return d.isPropertyAccessExpression(O)?H(O)??Ie(O):null},F=(k,w=0)=>{if(w>Zr)return"depth-cap";let O=Ne(k);if(d.isCallExpression(O)&&d.isPropertyAccessExpression(O.expression)&&O.expression.name.text==="bind")return F(O.expression.expression,w+1);if(d.isIdentifier(O))return m.tainted.has(O.text)?"tainted-receiver":"unresolved-receiver";if(d.isPropertyAccessExpression(O)&&d.isIdentifier(O.expression)){if(m.tainted.has(O.expression.text))return"tainted-receiver";if(D(O.expression.text,O.name.text))return"mutated-member"}return"unresolved-receiver"},ke=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0){let w=Ne(k.initializer),O=d.isPropertyAccessExpression(w),M=d.isCallExpression(w)&&d.isPropertyAccessExpression(w.expression)&&w.expression.name.text==="bind";if(O||M){let J=O?"D1":"A2";if(m.tainted.has(k.name.text))te(l,J,"tainted-alias");else if(S.has(k.name.text))te(l,J,"already-bound");else{let ie=un(w);ie!==null?(S.set(k.name.text,{kind:"member-value",functionId:ie}),te(l,J,null)):te(l,J,F(w))}}}d.forEachChild(k,ke)};s&&ke(m.sf);let fe=0,de=k=>{let w,O;if(d.isCallExpression(k)){let M=k.expression,J=d.isIdentifier(M)&&M.text==="require",ie=M.kind===d.SyntaxKind.ImportKeyword;!J&&!ie&&(w=M,O=k.arguments)}else d.isTaggedTemplateExpression(k)&&(w=k.tag);if(w!==void 0){let M=Sd(w),J=k.getStart(m.sf,!1),ie=`${m.rel}#call${String(fe)}`;fe+=1;let ge="unresolved",Oe=[],ye=H(w);ye!==null&&(ge="resolved",Oe.push(ye)),y.push({id:ie,enclosingFunctionId:z(J),calleeExprShape:M,resolvedTargetIds:Oe,resolution:ge,range:on(m.rel,k,m.sf)});for(let Q of Oe)v.push({callSiteId:ie,calleeFunctionId:Q,resolution:ge});if(ye===null){let Q=Ie(w);if(Q!==null)v.push({callSiteId:ie,calleeFunctionId:Q,resolution:"field-based"});else if(s&&d.isPropertyAccessExpression(w)&&(w.name.text==="call"||w.name.text==="apply")){let xe=un(w.expression);xe!==null?(v.push({callSiteId:ie,calleeFunctionId:xe,resolution:"field-based"}),te(l,"A3",null)):te(l,"A3",F(w.expression))}}for(let Q of O??[]){let xe=H(Q);if(xe!==null)v.push({callSiteId:ie,calleeFunctionId:xe,resolution:"field-based"});else{let he=Ie(Q);if(he!==null)v.push({callSiteId:ie,calleeFunctionId:he,resolution:"field-based"});else if(s){let Le=un(Q),Re=Ne(Q),q=Re!==Q||d.isCallExpression(Re)&&d.isPropertyAccessExpression(Re.expression)&&Re.expression.name.text==="bind";Le!==null?(v.push({callSiteId:ie,calleeFunctionId:Le,resolution:"field-based"}),q&&te(l,"A2p",null)):q&&te(l,"A2p",F(Q))}}}}d.forEachChild(k,de)};de(m.sf);for(let k of n.computedLoads.get(m.rel)??[]){let w=k.candidateRels.filter(M=>o.has(M)).map(M=>`${M}#<toplevel>`);if(w.length===0)continue;let O=`${m.rel}#dirload${String(fe)}`;fe+=1,y.push({id:O,enclosingFunctionId:z(k.pos),calleeExprShape:"require",resolvedTargetIds:w,resolution:"field-based",range:{path:m.rel,start:k.pos,end:k.pos}});for(let M of w)v.push({callSiteId:O,calleeFunctionId:M,resolution:"field-based"})}let Fe=0;for(let k of i.get(m.rel)??[]){let w=`${m.rel}#handlerseed${String(Fe)}`;Fe+=1;let O=k.node.getStart(m.sf,!1);y.push({id:w,enclosingFunctionId:m.toplevelId,calleeExprShape:"member",resolvedTargetIds:[k.id],resolution:"field-based",range:{path:m.rel,start:O,end:O}}),v.push({callSiteId:w,calleeFunctionId:k.id,resolution:"field-based"})}}let b=new Map;if(a)for(let m of o.values())for(let[S,I]of m.mintSeedAliases)b.set(`${m.rel}::${String(S)}`,I);return{functions:x,callSites:y,callEdges:v,exports:N,exportBindings:R,classes:A,mintSeedAliases:b,bindingApplicability:l}}function Ed(e,n,t){let i=o=>o.length===0||Ce.isAbsolute(o)||o.includes("\\")||/^[a-zA-Z]:/u.test(o)||o.split("/").some(c=>c===".."||c==="");if(i(n)||i(t))return null;let r=e.endsWith(Ce.sep)?e:e+Ce.sep,s;try{s=Qr(Ce.resolve(e,n))}catch{return null}if(!s.startsWith(r))return null;let a=s.endsWith(Ce.sep)?s:s+Ce.sep,l;try{l=Qr(Ce.resolve(s,t))}catch{return null}return l.startsWith(a)?l:null}function ks(e,n,t){let i=`${e}#class:${t}`,r=[],s=[],a=[],l=new Set;return{pushMember(o,c,u,f){if(o==="__proto__"||l.has(o))return;l.add(o);let p=`${e}#${t}.${o}`;r.push({id:p,moduleId:e,name:o,kind:u,enclosingClassId:i,declRange:on(e,c,n),isExported:!1,publicSurfaceReachable:!1}),a.push(p),s.push({name:o,id:p,kind:u,body:f})},finish(){return s.length===0?null:{functions:r,classNode:{id:i,moduleId:e,name:t,implementsRefs:[],members:a},members:s}}}}function wd(e,n,t,i){if(bs(i)||i.members.length>si)return null;let r=ks(e,n,t);for(let s of i.members){let a,l,o;if(d.isConstructorDeclaration(s))a="constructor",l="ctor",o=void 0;else if(d.isMethodDeclaration(s))a=mt(s.name),l="method",o=a!==void 0&&!vn.has(a)?s.body??void 0:void 0;else continue;a!==void 0&&r.pushMember(a,s,l,o)}return r.finish()}function vd(e,n,t){let i;for(let a of n.statements)if(d.isFunctionDeclaration(a)&&a.name?.text===t){i=a;break}if(i===void 0)return null;let r=[];for(let a of n.statements){if(!d.isExpressionStatement(a))continue;let l=a.expression;if(!d.isBinaryExpression(l)||l.operatorToken.kind!==d.SyntaxKind.EqualsToken)continue;let o=l.left;if(d.isPropertyAccessExpression(o)&&d.isPropertyAccessExpression(o.expression)&&d.isIdentifier(o.expression.expression)&&o.expression.expression.text===t&&o.expression.name.text==="prototype"){let c=o.name.text;d.isFunctionExpression(l.right)?r.push({name:c,fn:l.right,walk:!0}):d.isArrowFunction(l.right)&&r.push({name:c,fn:l.right,walk:!1})}}if(r.length===0||r.length+1>si)return null;let s=ks(e,n,t);s.pushMember("constructor",i,"ctor",void 0);for(let a of r){let l=a.walk&&!vn.has(a.name)&&d.isFunctionExpression(a.fn)?a.fn.body:void 0;s.pushMember(a.name,a.fn,"method",l)}return s.finish()}function Id(e,n,t){for(let i of n.statements)if(d.isClassDeclaration(i)&&i.name?.text===t)return wd(e,n,t,i);return vd(e,n,t)}function Ad(e,n,t,i,r){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let a=new Set(t.map(f=>f.packageName)),l=new Set(t.map(f=>f.path)),o=new Set,c=new Set,u=0;for(let f of n){if(!a.has(f.packageName))continue;let p=Ed(e.appRoot,f.packageRootRel,f.sourcePath);if(p===null)continue;let h=e.toRel(p);if(h===null)continue;let E=`${h}#${f.container}`;if(c.has(E)||!o.has(h)&&o.size>=ft)continue;let x=_e(p);if(x===null)continue;let y;try{y=d.createSourceFile(h,x,d.ScriptTarget.Latest,!0,d.ScriptKind.JS)}catch{continue}let v=Id(h,y,f.container);if(v===null)continue;o.add(h),c.add(E);let N=new Map,R=new Map;for(let b of v.members){let m=r.methodFor(f.packageName,f.container,b.name,b.kind);N.set(b.name,m),R.set(m,b.id)}let A=0;for(let b of v.members){if(b.body===void 0)continue;let m=(S,I)=>{if(I&&d.isCallExpression(S)&&d.isPropertyAccessExpression(S.expression)&&S.expression.expression.kind===d.SyntaxKind.ThisKeyword){let _=N.get(S.expression.name.text);if(_!==void 0){let C=`${h}#depclass:${f.container}.${b.name}#c${String(A)}`;A+=1,s.callSites.push({id:C,enclosingFunctionId:b.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:on(h,S,y)}),s.callEdges.push({callSiteId:C,calleeFunctionId:_,resolution:"field-based"})}}let T=d.isFunctionExpression(S)||d.isFunctionDeclaration(S)||d.isMethodDeclaration(S)||d.isConstructorDeclaration(S)||d.isGetAccessorDeclaration(S)||d.isSetAccessorDeclaration(S)||d.isClassLike(S),z=d.isArrowFunction(S)?I:T?!1:I;d.forEachChild(S,_=>{m(_,z)})};m(b.body,!0)}for(let b of i){let m=R.get(b.calleeFunctionId);m!==void 0&&s.callEdges.push({callSiteId:b.callSiteId,calleeFunctionId:m,resolution:"field-based"})}if(s.functions.push(...v.functions),s.classes.push(v.classNode),!l.has(h)){l.add(h),s.modules.push({id:h,packageName:f.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let b=r.moduleFor(f.packageName),m=`${String(b)}#depclass${String(u)}`;u+=1,s.imports.push({id:m,moduleId:b,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),s.importEdges.push({importId:m,resolvedModuleId:h})}s.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(v.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return s}function _d(e,n,t,i){let r=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.packageName)),s=new Map(e.functions.map(o=>[o.id,o.moduleId])),a=new Map;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let c=s.get(o.enclosingFunctionId);c!==void 0&&a.set(c,(a.get(c)??0)+1)}let l=[];for(let o of e.modules){if(o.externalSurface===!0)continue;let c=n.get(o.path);if(c===void 0||t.has(o.path)||r.has(o.packageName)&&i.has(o.path)&&!o.path.split("/").includes("node_modules"))continue;let u=a.get(o.id)??0;if(u===0&&ld(c))continue;let f=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:o.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:o.id})}return l}function Es(e,n,t=[],i={},r=!1){let s=new ii,a=Dl(e,n,s),l=new Set;for(let A of a.computedLoads.values())for(let b of A)if(b.seedable)for(let m of b.candidateRels)l.add(m);let o=new Map;for(let A of e.sourceFiles){let b=e.toRel(A.fileName);if(b===null||!l.has(b)||b.split("/").includes("node_modules"))continue;let m=gd(b,A);m.length>0&&o.set(b,m)}let c=o.size===0?a.modules:a.modules.map(A=>o.has(A.path)&&!A.isEntrypoint?{...A,isEntrypoint:!0}:A),u={...a,modules:c},f=kd(e,u,s,o,i),p=od(e,a,f.functions,f.mintSeedAliases),h=new Set(a.modules.map(A=>A.path)),E=jl(e.depReach,s,h),x=[...u.modules,...E.modules,...s.modules()],y=Ad(e,t,x,f.callEdges,s),v=[];if(r){let A="#default",b=new Set;for(let S of f.callEdges){let I=String(S.calleeFunctionId);!I.startsWith("pkg:")||!I.endsWith(A)||b.add(I.slice(4,I.length-A.length))}let m=new Map;for(let S of e.depReach.edges){if(!("surface"in S.from)||"surface"in S.to)continue;let I=S.from.surface;m.set(I,m.has(I)?null:S.to.module)}for(let S of b){let I=m.get(S);if(I==null)continue;let T=Fl(Ce.join(e.appRoot,I));if(T===null||T==="default")continue;let z=s.exportFor(S,T),_=`pkg:${S}${A}`;for(let C of f.callEdges)String(C.calleeFunctionId)===_&&v.push({callSiteId:C.callSiteId,calleeFunctionId:z,resolution:"field-based"})}}let N={modules:[...u.modules,...E.modules,...y.modules,...s.modules()],exports:[...f.exports,...p.exports],imports:[...a.imports,...E.imports,...y.imports],functions:[...f.functions,...s.functions(),...y.functions],callSites:[...f.callSites,...y.callSites],classes:[...f.classes,...s.classes(),...y.classes],callEdges:[...f.callEdges,...y.callEdges,...v],importEdges:[...a.importEdges,...E.importEdges,...y.importEdges],exportBindings:[...f.exportBindings,...p.exportBindings],inheritEdges:[]},R=new Map;for(let A of e.sourceFiles){let b=e.toRel(A.fileName);b!==null&&R.set(b,A)}return{graph:N,diagnostics:[...p.diagnostics,...y.diagnostics,..._d(N,R,new Set(e.diagnostics.filter(A=>A.code==="dependency-body").map(A=>A.path)),a.appOwnedPaths)],...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var Nd=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,ht=/^[A-Za-z0-9_$.-]{1,128}$/u;function Cd(e){return Nd.test(e.calleePackage)?ht.test(e.anchorExport)?ht.test(e.calleeExport)?e.anchorContainer!==null&&!ht.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!ht.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Fn(e,n){let t=[],i=[],r=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.classes.map(c=>[c.id,c.name])),a=(c,u,f)=>e.functions.some(p=>{if(p.name!==u)return!1;let h=r.get(p.moduleId);return h===void 0||h.packageName!==c?!1:(p.enclosingClassId!==void 0?s.get(p.enclosingClassId)??null:null)===f}),l=(c,u,f)=>{for(let p of e.functions){if(p.name!==u)continue;let h=r.get(p.moduleId);if(!(h===void 0||h.packageName!==c||(p.enclosingClassId!==void 0?s.get(p.enclosingClassId)??null:null)!==f))return p.id}return null},o=[...n].sort((c,u)=>c.modelId<u.modelId?-1:c.modelId>u.modelId?1:0);for(let c of o){if(c.edges.length>64){t.push(`model ${c.modelId}: ${String(c.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=c.edges.map(Cd).find(h=>h!==null);if(u!==void 0){t.push(`model ${c.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let f=0,p=0;for(let h of c.edges){if(!a(c.packageName,h.anchorExport,h.anchorContainer)){p+=1;continue}i.push({modelId:c.modelId,kind:h.kind,anchor:{packageName:c.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:l(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${c.modelId}: ${String(f)} edge(s) lowered, ${String(p)} reference-gated`):t.push(`model ${c.modelId}: refused \u2014 no anchor surface in the graph (${String(p)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:i,notes:t}}}var Od={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function fi(e){try{let n=Xr(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(a=>a.split(nn.sep).join("/"))),{graph:i,diagnostics:r,bindingApplicability:s}=Es(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:i,diagnostics:[...n.diagnostics,...r],...s!==void 0?{bindingApplicability:s}:{}}}catch(n){return{graph:Od,diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function ws(e,n){let t=512,i=(r,s)=>{if(!(t<=0||s>12)){if(t-=1,typeof r=="string"){n(r);return}if(Array.isArray(r)){for(let a of r)i(a,s+1);return}if(r!==null&&typeof r=="object")for(let[a,l]of Object.entries(r))a==="types"||a==="typings"||i(l,s+1)}};i(e,0)}function _s(e,n,t,i=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=Kn(nn.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||i&&!We(r)?null:r===e?"":r.slice(n.length).split(nn.sep).join("/")}function Ns(e){let n=Kn(e),t=n.endsWith(nn.sep)?n:n+nn.sep,i=new Set,r=[],s=[],a=[],l=(m,S,I=!1)=>{let T=_s(n,t,m);return T===null||T.length===0?"unresolved":i.has(T)?"duplicate":(i.add(T),r.push(T),s.push({source:S,specifier:Je(typeof m=="string"?m:""),entrypoint:T,launch:I}),"added")},o=[],c=(m,S)=>{a.push({source:m,file:m,detail:S.detail}),o.push({code:S.code,path:m,detail:`${m} ${S.detail}`})},u,f,p,h=null,E=vs(n,t,"package.json",rn);E.kind==="refused"&&c("package.json",E);try{let m=E.kind==="ok"?JSON.parse(E.text):{};if(h=E.kind==="ok"?m:null,l(m.main,"main"),typeof m.bin=="string")l(m.bin,"bin");else if(m.bin!==null&&typeof m.bin=="object")for(let I of Object.values(m.bin))l(I,"bin");ws(m.exports,I=>{l(I,"exports")}),ws(m.browser,I=>{l(I,"browser")});let S=m.scripts;if(S!==null&&typeof S=="object"){let I=S;u=I.start,f=I.prestart,p=I.poststart}}catch{}if(r.length===0)try{Kn(nn.join(n,"index.js")),l("index.js","index.js fallback")}catch{}let x=(m,S)=>typeof m=="string"&&m.trim().length>0?Is(m,S,"package.json",l,a,!1)==="used"?"resolved":"gapped":m===void 0||typeof m=="string"?"absent":(a.push({source:S,file:"package.json",detail:`${S} is not a string; no entry file could be read from it`}),"gapped"),y=x(u,"scripts.start"),v=x(f,"scripts.prestart"),N=x(p,"scripts.poststart"),R=y==="resolved"&&v!=="gapped"&&N!=="gapped",A=vs(n,t,"Procfile",65536);if(A.kind==="refused")c("Procfile",A);else if(A.kind==="ok"){let{entries:m,truncated:S,unnamedLines:I}=ti(A.text);S&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),I>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(I)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let T of m)Is(T.command,`Procfile:${T.name}`,"Procfile",l,a,R)}let b=r.length===0?Zt(n,h):null;return{entrypoints:r,sources:s,gaps:a,diagnostics:o,framework:b}}function vs(e,n,t,i){let r;try{r=Kn(nn.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=En(r,i);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(i)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Is(e,n,t,i,r,s){let a=ni(e);return a.kind==="delegates"?s?"used":(r.push({source:n,file:t,detail:`\`${Je(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped"):a.kind==="unparsed"?(r.push({source:n,file:t,detail:`\`${Je(e)}\`: ${a.reason}`}),"gapped"):i(a.specifier,n,!0)==="unresolved"?(r.push({source:n,file:t,detail:`\`${Je(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function pi(e,n){if(n.length===0||!e.some(i=>i.launch))return[];let t=n.slice(0,3).map(i=>i.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${t}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Cs(e,n){let t=Kn(e),i=t.endsWith(nn.sep)?t:t+nn.sep,r=new Set,s=[],a=[];for(let l of n){let o=_s(t,i,l,!0);if(o===null||o.length===0){a.push(l);continue}r.has(o)||(r.add(o),s.push(o))}return{entrypoints:s,rejected:a}}import{readdirSync as Ks,readFileSync as xi,realpathSync as Si,statSync as Un}from"node:fs";import Ue from"node:path";function Rd(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let i=t+2;for(;i<e.length&&e.charCodeAt(i)===32;)i+=1;let r=e.charCodeAt(i);return r===38||r===42}function jn(e,n,t){let i=n.maxLines??2e6,r=n.maxLineBytes??16384,s=!1,a=!1,l=0,o=0,c=e.charCodeAt(0)===65279?1:0;for(;c<=e.length;){let u=e.indexOf(`
+`,c),f=u===-1;f&&(u=e.length);let p=u>c&&e.charCodeAt(u-1)===13?u-1:u;if(o+=1,o>i){s=!0;break}if(p-c>r)l+=1;else{let h=c;for(;h<p&&e.charCodeAt(h)===32;)h+=1;let E=h-c,x=p;for(;x>h&&(e.charCodeAt(x-1)===32||e.charCodeAt(x-1)===9);)x-=1;if(h<x&&e.charCodeAt(h)!==35){let y=e.slice(h,x);if(Rd(y)){a=!0;break}t(E,y)}}if(f)break;c=u+1}return{truncated:s||l>0,refusedAnchors:a,oversizeLines:l}}function gt(e){let n=e.charCodeAt(0);if(n===34||n===39){let i=e.indexOf(String.fromCharCode(n),1);if(i===-1)return null;let r=i+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,i+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function An(e){return e.endsWith(":")}function ze(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function yt(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,i=t.indexOf("/");if(n){if(i<=0||t.indexOf("/",i+1)!==-1)return!1}else if(i!==-1)return!1;let r=n?[t.slice(0,i),t.slice(i+1)]:[t];for(let s of r){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let a=0;a<s.length;a+=1){let l=s.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function Bn(e){return yt(e)?`node_modules/${e}`:""}function zn(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Os=2e5,Rs=64,$d=1024,Md=5,Pd=[1,2,3];function Ld(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let i=e.slice(t+n.length);if(i==="")return null;let r=i.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function $s(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let i=t.indexOf("@",1);if(i>0){let r=t.slice(0,i),s=t.slice(i+1);if(r.length>0&&s.length>0)return[{name:r,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function _n(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Ms(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Ps(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Ls(e,n,t,i,r=!1){let s=JSON.stringify([n,t,i]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:i,dev:r})}}function Td(e,n){for(let[t,i]of Object.entries(e)){if(t==="")continue;if(!Ps(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=_n(i);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let a=s.name,l=typeof a=="string"&&a!==""?a:Ld(t),o=s.version;if(l===null||typeof o!="string"){r&&(n.unread+=1);continue}let c=s.dev===!0||s.devOptional===!0;for(let u of $s(l,o))Ls(n,u.name,u.version,t,c)}}function Ts(e,n,t){let i=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let s=0;s<i.length;s+=1){let a=i[s];if(a===void 0)break;for(let[l,o]of Object.entries(a.deps)){if(!Ps(n))return{depthCapped:r};if(l===""){n.unread+=1;continue}let c=_n(o);if(c===null){n.unread+=1;continue}let u=a.pathSafe&&yt(l),f=u?`${a.prefix}node_modules/${l}`:"",p=u&&f.length<=$d,h=p?f:"",E=c.version,x=c.dev===!0||a.dev;if(c.link!==!0&&typeof E=="string"&&E!=="")for(let v of $s(l,E))Ls(n,v.name,v.version,h,x);else n.unread+=1;let y=_n(c.dependencies);if(y!==null){if(a.depth+1>t){r=!0;continue}i.push({deps:y,prefix:p?`${h}/`:a.prefix,depth:a.depth+1,pathSafe:p,dev:x})}}}return{depthCapped:r}}function Dd(e,n,t){let i=Ms(n.maxEntries),{depthCapped:r}=Ts(e,i,t),s=[],a=new Set(n.deps.map(c=>JSON.stringify([c.name,c.version]))),l=new Set,o=[];for(let c of i.deps){if(c.version.includes(":"))continue;let u=JSON.stringify([c.name,c.version]);a.has(u)||l.has(u)||(l.add(u),o.length<Md&&o.push(zn(c.name,c.version)))}if(l.size>0){let c=l.size-o.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${o.join(", ")}${c>0?`, and ${String(c)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(i.capped||r)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function xt(e,n={}){let t=[],i;try{i=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=_n(i);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=r.lockfileVersion,a=typeof s=="number"&&Number.isInteger(s)?s:null,l=typeof s=="number"?String(s):"?",o=_n(r.packages),c=_n(r.dependencies);if(o===null&&c===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!Pd.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??Rs,f=Ms(n.maxEntries??Os),p=!1;return o!==null?(Td(o,f),c!==null&&t.push(...Dd(c,f,u))):c!==null&&(p=Ts(c,f,u).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),p&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||p}}var Fd=["workspace:","link:","portal:","file:","exec:"];function Kd(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function jd(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let i=n.slice(0,t),r=n.slice(t+1);if(i.length===0)return[];for(let l of Fd)if(r.startsWith(l))return[];if(!r.startsWith("npm:"))return[i];let s=r.slice(4),a=s.indexOf("@",1);if(a>0){let l=s.slice(0,a);return l.length>0?[l]:[i]}return s.length===0||Kd(s)?[i]:[i,s]}function Bd(e){if(An(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let i=e.charCodeAt(t);if(i===34||i===39){n===0?n=i:n===i&&(n=0);continue}if(n===0&&i===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function zd(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let i of n.split(",")){let r=i.trim();r.length>0&&t.push(r)}return t}function Ud(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let i=t.length;for(;i<n.length&&i<t.length+3;){let s=n.charCodeAt(i);if(s<48||s>57)break;i+=1}let r=n.slice(t.length,i);return r.length>0?r:null}function Ds(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=ze(e.slice(8).trim());return t.length>0?t:null}function mi(e,n={}){let t=[],i=[],r=new Set,s=n.maxEntries??2e5,a=!1,l=null,o=!1,c=[],u=!1,f=-1,p=!1,h=0,E=()=>{c.length>0&&!u&&(h+=1)},x=jn(e,n,(R,A)=>{if(R===0){E(),c=[],u=!1,f=-1,o=!1;let m=Bd(A);if(m===null)return;let S=ze(m.trim());if(S==="__metadata"){a=!0,o=An(A);return}for(let I of zd(S))c.push(...jd(I));return}if(o){if(R===2&&l===null){let m=Ds(A);m!==null&&(l=m)}return}if(c.length===0||(f===-1&&(f=R),R!==f||u))return;let b=Ds(A);if(b!==null){u=!0;for(let m of c){let S=JSON.stringify([m,b]);if(!r.has(S)){if(i.length>=s){p=!0;return}r.add(S),i.push({name:m,version:b,lockKey:Bn(m),dev:!1})}}}});E();let y=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(x.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};x.oversizeLines>0&&t.push(`${y} has ${String(x.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),p&&t.push(`${y} exceeds ${String(s)} entries; truncated`);let v=l??Ud(e),N=v===null?null:Number(v.split(".")[0]);return v!==null&&(N===null||!Number.isInteger(N)||N<1||N>8)&&t.push(`${y} declares unsupported lockfileVersion ${v} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${y} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:i,diagnostics:t,truncated:x.truncated||p}}function hi(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let i=n.indexOf("_");return i!==-1&&(n=n.slice(0,i)),n.trim()}function gi(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Fs(e){let n=ze(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let i=n.charCodeAt(0)===47;if(i&&(n=n.slice(1)),n.length===0)return null;if(!i&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),f=n.indexOf("@",1);u>0&&(f===-1||u<f)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let r=n.charCodeAt(0)===64,s=r?n.indexOf("/"):-1;if(r&&s<=0)return null;let a=r?s+1:0,l=-1;for(let u=a;u<n.length;u+=1){let f=n.charCodeAt(u);if(f===47||f===64){l=u;break}}if(l<=a)return null;let o=n.slice(0,l),c=hi(n.slice(l+1));return gi(c)?{name:o,version:c}:null}var Vd=new Set(["packages","snapshots","importers"]),qd=new Set([5,6,7,8,9]);function Hd(e){let n=ze(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function bt(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:ze(e.slice(0,n).trim()),value:ze(t)}}function yi(e,n={}){let t=[],i=[],r=new Set,s=n.maxEntries??2e5,a="",l=null,o=!1,c=0,u=[],f=(h,E)=>{let x=JSON.stringify([h,E]);if(!r.has(x)){if(i.length>=s){o=!0;return}r.add(x),i.push({name:h,version:E,lockKey:Bn(h),dev:!1})}},p=jn(e,n,(h,E)=>{if(h===0){let x=gt(E);if(a=x===null?"":ze(x.trim()),l=null,a==="lockfileVersion"){let y=bt(E),v=y===null?null:Hd(y.value);y!==null&&(v===null||!qd.has(v))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if(Vd.has(a)&&!An(E)){let y=bt(E)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(c+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(h!==2)return;let x=gt(E),y=x===null?null:Fs(x);if(y===null){c+=1;return}f(y.name,y.version);return}if(a==="importers"){if(h===6){let x=bt(E);if(x===null){l=E.endsWith(":")?ze(E.slice(0,-1).trim()):null;return}l=null;let y=hi(x.value);gi(y)&&f(x.key,y);return}if(h===8&&l!==null){let x=bt(E);if(x===null||x.key!=="version")return;let y=hi(x.value);gi(y)&&f(l,y)}}});return p.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),p.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(p.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),o&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),c>0&&t.push(`pnpm-lock.yaml has ${String(c)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:i,diagnostics:t,truncated:p.truncated||o})}var Wd=128*1024*1024,Gd=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>xt(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>xt(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>mi(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>yi(e,n===void 0?{}:{maxEntries:n})}],Xd=[".pnp.cjs",".pnp.data.json",".pnp.js"];function bi(e,n){let t;try{t=Si(Ue.join(e,n))}catch{return null}let i=e.endsWith(Ue.sep)?e:e+Ue.sep;return t.startsWith(i)?t:null}function js(e,n){let t=Ue.join(e,"package.json"),i;try{i=Si(t)}catch{return null}if(!i.startsWith(n+Ue.sep))return null;try{if(!Un(i).isFile())return null;let r=JSON.parse(xi(i,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function Bs(e,n){try{return Un(Ue.join(e,n)),!0}catch{return!1}}function Jd(e,n){if(Bs(e,"pnpm-workspace.yaml"))return!0;let t=bi(e,"package.json");if(t===null)return Bs(e,"package.json");let i;try{let a=Un(t);if(!a.isFile()||a.size>n)return!0;i=xi(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(i)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=r[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let s=r.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function zs(e,n){let t=Ue.join(e,"node_modules"),i=[],r;try{r=Ks(t,{withFileTypes:!0})}catch{return i}for(let s of r){let a=s.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let o;try{o=Ks(Ue.join(t,a),{withFileTypes:!0})}catch{continue}for(let c of o){let u=js(Ue.join(t,a,c.name),n);u!==null&&i.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${c.name}`,linked:c.isSymbolicLink()||s.isSymbolicLink()})}continue}let l=js(Ue.join(t,a),n);l!==null&&i.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:s.isSymbolicLink()})}return i}var Yd=5;function Qd(e,n,t){let i=bi(e,n);if(i===null){try{Un(Ue.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=Un(i)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:xi(i,"utf8")}}catch{return{gap:`${n} could not be read`}}}function Us(e,n){let t=Si(e),i=[],r=[],s=n?.maxLockfileBytes??Wd,a=[],l=new Set,o=[],c=Jd(t,s),u=null,f=!1,p=(E,x,y)=>{r.push({kind:E,detail:x,blindsAnalysis:y}),i.push(x)};for(let E of Gd){let x=Qd(t,E.file,s);if(x===null)continue;if("gap"in x){p("lockfile-unreadable",x.gap,!1);continue}let y=E.parse(x.text,n?.maxLockfileEntries);if(y.truncated&&(f=!0),y.deps.length===0){if(y.diagnostics.length>0||c){let v=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";p("lockfile-unparsed",`${E.file} yielded NO dependencies (${v}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&p("lockfile-partial",`${E.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),u===null&&(u=E.file),o.includes(E.source)||o.push(E.source);for(let v of y.deps){let N=JSON.stringify([v.name,v.version,v.lockKey]);l.has(N)||(l.add(N),a.push(v))}}for(let E of Xd)if(bi(t,E)!==null){p("yarn-pnp",`${E} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let E=o.length===1?o[0]??"none":"multi-lockfile";o.length>1&&i.push(`multiple lockfiles present (${o.join(", ")}); enumerated the UNION of all of them`);let x=new Set(a.map(N=>JSON.stringify([N.name,N.version]))),y=new Set,v=[];for(let N of zs(t,t)){let R=JSON.stringify([N.name,N.version,N.lockKey]);l.has(R)||(l.add(R),a.push({name:N.name,version:N.version,lockKey:N.lockKey,dev:N.dev}));let A=JSON.stringify([N.name,N.version]);N.linked||x.has(A)||y.has(A)||(y.add(A),v.length<Yd&&v.push(zn(N.name,N.version)))}if(y.size>0){let N=y.size-v.length;p("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${v.join(", ")}${N>0?`, and ${String(N)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:E,lockfilePath:u,diagnostics:i,truncated:f,gaps:r}}let h=zs(t,t);return h.length>0?(p("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(E=>({name:E.name,version:E.version,lockKey:E.lockKey,dev:!1})),source:"node-modules",lockfilePath:null,diagnostics:i,truncated:f,gaps:r}):(c&&p("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:i,truncated:f,gaps:r})}import{readdirSync as Zd,readFileSync as ec}from"node:fs";import nc from"node:path";var tc=new Set(["summarized","crashed","over-cap"]),ic=new Set(["function","method","ctor"]);function re(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function ki(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function rc(e,n){ki(e)||re(n,"edge is not an object");let{entryPath:t,entryExport:i,entryContainer:r,hops:s}=e;(typeof t!="string"||typeof i!="string")&&re(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&re(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&re(n,"hops must be a non-negative integer");let a=e.target;if(ki(a)||re(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:o,symbolKind:c}=a;return typeof l!="string"&&re(n,"symbol target exportName"),o!==null&&typeof o!="string"&&re(n,"symbol target container"),(typeof c!="string"||!ic.has(c))&&re(n,`symbol target kind ${JSON.stringify(c)}`),{entryPath:t,entryExport:i,entryContainer:r,target:{kind:"symbol",exportName:l,container:o,symbolKind:c},hops:s}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:o,calleeExport:c}=a;return(typeof l!="string"||l.length===0)&&re(n,"dep target calleePackage"),o!==null&&typeof o!="string"&&re(n,"dep target calleeSubpath"),(typeof c!="string"||c.length===0)&&re(n,"dep target calleeExport"),{entryPath:t,entryExport:i,entryContainer:r,target:{kind:"dep",calleePackage:l,calleeSubpath:o,calleeExport:c},hops:s}}re(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function sc(e,n){ki(e)||re(n,"root is not an object");let{packageName:t,analyzedVersion:i,tool:r,toolVersion:s,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&re(n,"packageName"),typeof i!="string"&&re(n,"analyzedVersion"),r!=="jelly"&&re(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof s!="string"&&re(n,"toolVersion"),typeof a!="number"&&re(n,"maxIndirections"),(typeof l!="string"||!tc.has(l))&&re(n,`status ${JSON.stringify(l)} not in the enum`);let o=e.edges;return Array.isArray(o)||re(n,"edges is not an array"),l!=="summarized"&&o.length>0&&re(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:i,tool:r,toolVersion:s,maxIndirections:a,status:l,edges:o.map(c=>rc(c,n))}}function Vs(e){let n=new Map,t=Zd(e).filter(i=>i.endsWith(".summary.json"));for(let i of t){let r=nc.join(e,i),s;try{s=JSON.parse(ec(r,"utf8"))}catch(o){re(i,`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}let a=sc(s,i),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{readFileSync as oc,statSync as ac}from"node:fs";var wi=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,kt=/^[A-Za-z0-9_$.-]{1,128}$/u,qs=64,Hs=1024*1024,Ws=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Gs=/^[A-Za-z0-9@_.-]{1,128}$/u;function oe(e){throw new Error(`model claims rejected: ${e}`)}function Ei(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function lc(e,n){Ei(e)||oe(`${n}: edge is not an object`);let{kind:t,anchorExport:i,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&oe(`${n}: edge kind`),(typeof i!="string"||!kt.test(i))&&oe(`${n}: anchorExport ${JSON.stringify(i)}`),r!==null&&(typeof r!="string"||!kt.test(r))&&oe(`${n}: anchorContainer`),(typeof s!="string"||!wi.test(s))&&oe(`${n}: calleePackage ${JSON.stringify(s)}`),a!==null&&(typeof a!="string"||!kt.test(a))&&oe(`${n}: calleeContainer`),(typeof l!="string"||!kt.test(l))&&oe(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:i,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}}function Xs(e){let n=ac(e).size;n>Hs&&oe(`file is ${String(n)} bytes, over the ${String(Hs)} cap`);let t;try{t=JSON.parse(oc(e,"utf8"))}catch(r){oe(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||oe("root is not an array"),t.length>qs&&oe(`${String(t.length)} claims over cap ${String(qs)}`);let i=[];for(let r of t){Ei(r)||oe("claim is not an object");let{packageName:s,modelId:a,range:l,edges:o}=r;(typeof s!="string"||!wi.test(s))&&oe("packageName"),(typeof a!="string"||!Gs.test(a))&&oe("modelId (identifier charset, 1-128 chars)"),i.some(u=>u.model.modelId===a)&&oe(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Ei(l)||typeof l.introduced!="string")&&oe(`${a}: range`),Ws.test(l.introduced)||oe(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let c=l.fixedBefore;c!==null&&typeof c!="string"&&oe(`${a}: fixedBefore`),typeof c=="string"&&!Ws.test(c)&&oe(`${a}: range.fixedBefore ${JSON.stringify(c)} is not an exact x.y.z triple`),Array.isArray(o)||oe(`${a}: edges`),o.length>64&&oe(`${a}: ${String(o.length)} edges over cap ${String(64)}`),i.push({model:{packageName:s,modelId:a,edges:o.map(u=>lc(u,a))},introduced:l.introduced,fixedBefore:c})}return i}var dc=["in-app-purchase@1-v1"];function vi(e,n,t){let i=[],r=[],s=[],a=(l,o,c,u)=>{r.push(c),s.push({modelId:u??l.model.modelId,status:o,reason:c,edgeCount:l.model.edges.length})};for(let l of e){if(!wi.test(l.model.packageName)||!Gs.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&dc.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let o=n(l.model.packageName);if(o===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let c;try{c=fn(o,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${o} not an exact triple \u2014 inert (never guessed)`);continue}if(!c){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${o} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}i.push(l.model),s.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:i,notes:r,dispositions:s}}var cc=4,uc={additiveForms:!0,namelessExports:!0},fc=new Set(["dep-opaque","dynamic-load","dispatch"]),pc={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Ai(e,n,t){return e.tier==="unknown"&&pc[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&fc.has(e.unknownKind)&&n!==null&&n.verified}var mc=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),Ve=class extends Error{},_i="cupel/coverage-gap",hc={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function qn(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function eo(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function no(e,n,t){let i=new Map(e.modules.map(a=>[a.path,a.id])),r=e.modules[0]?.id;if(r===void 0)return[];let s=n.map(a=>({source:i.get(a.path)??r,cause:hc[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));return t&&s.push({source:r,reach:{kind:"unbounded"},cause:"resolution-divergence"}),s}function Ii(e,n,t,i,r){let s=t.filter(a=>a.exportName!==null&&(i===1||r||a.verified!==1));return s.length>0?s.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function gc(e){let n;try{n=wt(e)}catch{return!0}try{if(Et(Qe.join(n,"pnpm-workspace.yaml")).isFile())return!0}catch{}try{let s=JSON.parse(io(Qe.join(n,"package.json"),"utf8"))?.workspaces;if(Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null)return!0}catch{}let t=3,i=(r,s)=>{if(s>t)return!1;let a;try{a=to(r)}catch{return!1}for(let l of a){if(l==="node_modules"||l.startsWith("."))continue;let o=Qe.join(r,l),c;try{c=Et(o)}catch{continue}if(c.isDirectory()){try{if(Et(Qe.join(o,"package.json")).isFile())return!0}catch{}if(i(o,s+1))return!0}}return!1};return i(n,1)}function yc(e,n,t){let i=[];if(t&&i.push("nested-app-root"),n==="")return[...i,"manifest-unreadable"];let r;try{if(r=wt(Qe.resolve(e,n)),!r.startsWith(wt(e)+Qe.sep))return[...i,"manifest-unreadable"]}catch{return[...i,"manifest-unreadable"]}let s;try{let u=Qe.join(r,"package.json");if(!Et(u).isFile())return[...i,"manifest-unreadable"];s=io(u,"utf8")}catch{return[...i,"manifest-unreadable"]}let a;try{a=JSON.parse(s)}catch{return[...i,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...i,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&i.push("bin");let o=["preinstall","install","postinstall","prepare","prepublish"],c=l.scripts;if(typeof c=="object"&&c!==null){let u=c;o.some(f=>typeof u[f]=="string")&&i.push("install-script")}return(l.gypfile===!0||xc(r))&&i.push("native-artifact"),i}function xc(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=Qe.join(e,n),i;try{i=to(t)}catch{continue}if(i.some(r=>r.endsWith(".node")))return!0}return!1}function Sc(e){let n=new Map;for(let t of e){let i=n.get(t.advisory.id);i===void 0?n.set(t.advisory.id,[t]):i.push(t)}return n}function bc(e,n,t,i,r,s,a){let{finding:l}=Vn(e,n,{name:t.name,version:t.version,devOnly:t.dev,outOfGraphExecution:a(t.name)},qn(i.advisory.id,t.name,i.affected),null,r,s);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function Vn(e,n,t,i,r,s,a){let l=Ft({graph:e,installed:t,range:i,symbol:r,coverage:null,incompleteness:s,analysisAborted:a});if(n!==null&&r!==null&&Ai(l,r,"base")){let o=Rn(e,n.modulesById,n.reachMods,r,n.records);if(o!==null)return{finding:l,hit:o}}return{finding:l,hit:null}}function kc(e,n){let t=new Set,i=[];for(let r of e.packages)for(let{advisory:s,affected:a}of n.advisoriesForPackage("npm",r.name)){let l=qn(s.id,r.name,a),o;try{o=fn(r.version,l)}catch{continue}if(o)for(let c of n.symbolsForAffected(a.id)){if(c.verified!==1||c.symbolKind!=="method"&&c.symbolKind!=="ctor"||c.container===null||c.sourcePath===null)continue;let u=`${r.lockKey}\0${c.container}\0${c.sourcePath}`;t.has(u)||(t.add(u),i.push({packageName:r.name,packageRootRel:r.lockKey,container:c.container,sourcePath:c.sourcePath}))}}return i.sort((r,s)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),i.slice(0,ft)}function Ec(e,n,t){let i=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let o=s.get(l.callSiteId);if(o===void 0)continue;let c=i.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=i.get(l.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==u.packageName&&a.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:c.id})}return a}function wc(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),i=new Map(e.functions.map(u=>[u.id,u])),r=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&r.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let f=s.get(u.exportId);if(f===void 0||!n.has(f.moduleId))continue;let p=i.get(u.target.functionId);p===void 0||t.get(p.moduleId)?.externalSurface===!0||r.add(p.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let f=a.get(u.callSiteId);if(f===void 0)continue;let p=l.get(f);p===void 0?l.set(f,[u.calleeFunctionId]):p.push(u.calleeFunctionId)}let o=new Set(r),c=[...r];for(;c.length>0;){let u=c.pop();if(u!==void 0)for(let f of l.get(u)??[])o.has(f)||(o.add(f),c.push(f))}return o}function vc(e,n,t,i){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let s=t.filter(l=>l.packageName===r.anchor.packageName&&l.exportName===r.anchor.exportName&&l.container===r.anchor.container),a=s.find(l=>l.resolution==="resolved")??s[0];if(a!==void 0)return i.has(a.callerFunctionId)}return null}function Ic(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let i=new Set(t),r=s=>i.has(s)||i.has($e[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&r(s.unknownKind)||s.modelPromotedFromKind!==void 0&&r(s.modelPromotedFromKind))}function Ni(e){let n=wt(e.dir),t=e.reader??Bt(e.shardPath),i=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(pn))throw new Ve(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${pn})`);let r=null;if(e.summaryShadow!==void 0)try{r=Vs(e.summaryShadow)}catch(F){throw new Ve(`--summary-shadow facts dir rejected: ${F instanceof Error?F.message:String(F)}`)}let s=null;if(e.modelShadow!==void 0)try{s=Xs(e.modelShadow.claimsPath)}catch(F){throw new Ve(`--model-shadow claims rejected: ${F instanceof Error?F.message:String(F)}`)}let a=Us(n);if(a.truncated)throw new Ve(`the dependency enumeration hit a hard cap and is incomplete (${a.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`);let l=e.entry??[],o=l.length>0?Cs(n,l):{entrypoints:[],rejected:[]},c=o.rejected,u=Ns(n),f=[...new Set([...u.entrypoints,...o.entrypoints])],p=[...u.sources];for(let F of o.entrypoints)u.entrypoints.includes(F)||p.push({source:"--entry",specifier:F,entrypoint:F,launch:!1});let h=kc(a,t),E=e.bindingForms??uc,x=e.callablePackageResolver===!0,y=e.tsconfigPaths===!0,v=gc(n),N=new Map(a.packages.map(F=>[F.name,yc(n,F.lockKey,v)])),R=F=>N.get(F)??["manifest-unreadable"],A=fi({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:E,callablePackageResolver:x,tsconfigPaths:y}),b=A.graph,m=Dt(b),S=[...u.diagnostics,...pi(u.sources,u.gaps),...A.diagnostics],I=eo(f.length,b),T=a.gaps.some(F=>F.blindsAnalysis),z=no(b,S,T),_=t.allModels?.()??[],C=vi(_.map(F=>({model:{packageName:F.packageName,modelId:F.modelId,edges:F.edges},introduced:F.introduced,fixedBefore:F.fixedBefore})),F=>a.packages.find(ke=>ke.name===F)?.version),j=C.models.length>0?Fn(b,C.models).delta:null,U=j!==null?{records:j.records,reachMods:tn(b),modulesById:new Map(b.modules.map(F=>[F.id,F]))}:null,$=[],Y=new Map,W=mc(),K=[],V=[];for(let F of a.packages)for(let[,ke]of Sc(t.advisoriesForPackage("npm",F.name))){let fe=ke[0];if(fe!==void 0){let w=Y.get(fe.advisory.id),O=ke.map(M=>M.affected);w===void 0?Y.set(fe.advisory.id,{advisory:fe.advisory,ranges:O}):w.ranges.push(...O)}let de=ke.filter(w=>bc(b,U,F,w,z,I,R)),Fe=de.length>0?de:ke.slice(0,1),k=de.length===0;for(let{advisory:w,affected:O}of Fe){let M=qn(w.id,F.name,O),J=w.cveId??w.id,ie=k?[]:t.symbolsForAffected(O.id),ge=ie.filter(Q=>Q.exportName===null),Oe=Ii(w.id,F.name,ie,O.surfaceComplete,i),ye=Vn(b,U,{name:F.name,version:F.version,devOnly:F.dev,outOfGraphExecution:R(F.name)},M,null,z,I).finding;if(ye.decidedAtStage==="presence"||ye.decidedAtStage==="version-match"){W[ye.tier]+=1,$.push({...ye,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:M.surfaceComplete,advisoryId:w.id,displayId:J,packageName:F.name,version:F.version,symbolName:null,symbolPath:null,severity:w.severity,packageLocation:a.lockfilePath});continue}for(let Q of Oe){let{finding:xe,hit:he}=Vn(b,U,{name:F.name,version:F.version,devOnly:F.dev,outOfGraphExecution:R(F.name)},M,Q,z,I),Le=xe,Re,q;he!==null&&Q!==null&&(Re=he.modelId,q=xe.unknownKind,Le={basis:void 0,tier:he.tier,decidedAtStage:xe.decidedAtStage,reason:`boundary model ${he.modelId}: ${he.anchorPackage}.${he.entryExport} reaches ${Q.exportName} [${he.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Qn(Q),path:void 0,unresolvedSites:xe.unresolvedSites,unresolvedEvidence:xe.unresolvedEvidence}),W[Le.tier]+=1;let P={...Le,modelId:Re,modelPromotedFromKind:q,surfaceComplete:M.surfaceComplete,advisoryId:w.id,displayId:J,packageName:F.name,version:F.version,symbolName:Q?.exportName??null,symbolPath:Q?.sourcePath||null,severity:w.severity,packageLocation:a.lockfilePath};$.push(P);let G=new Set(["dep-opaque","dynamic-load","dispatch"]);r!==null&&P.tier==="unknown"&&P.decidedAtStage==="symbol-reachable"&&P.unknownKind!==void 0&&G.has(P.unknownKind)&&Q!==null&&K.push({finding:P,symbol:Q}),s!==null&&P.tier==="unknown"&&Q!==null&&V.push({finding:P,symbol:Q})}for(let Q of ge)W.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:M.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${J} carries a ${Q.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:w.id,displayId:J,packageName:F.name,version:F.version,symbolName:null,symbolPath:null,severity:w.severity,packageLocation:a.lockfilePath})}}for(let F of a.gaps)W.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:F.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:_i,displayId:_i,packageName:F.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:a.lockfilePath});let D=W["reachable-high"]+W["reachable-medium"],H=e.failOnReachable===!0&&D>0,se=Ic($,W.unknown,e.failOnUnknown),De=e.requireCompleteDenial===!0&&$.some(F=>F.tier==="not-reachable"&&F.basis==="loader-assumption"),Ie=H||se||De?2:0,be;if(r!==null){let F=tn(b),ke=new Map(b.modules.map(de=>[de.id,de])),fe=[];for(let{finding:de,symbol:Fe}of K){let k=Tt(b,ke,F,Fe,r,cc);fe.push({advisoryId:de.advisoryId,packageName:de.packageName,symbolName:de.symbolName,unknownKind:de.unknownKind??null,wouldPromote:k!==null,...k!==null?{anchorPackage:k.anchorPackage,entryExport:k.entryExport,viaPackages:k.viaPackages,totalHops:k.totalHops}:{}})}be={records:fe}}let dn;if(s!==null&&e.modelShadow!==void 0){let F=e.modelShadow.widened===!0?"widened":"base",ke=new Map(a.packages.map(P=>[P.name,P.version])),{models:fe,notes:de,dispositions:Fe}=vi(s,P=>ke.get(P),{shadowConsultDenylisted:!0}),{delta:k}=Fn(b,fe),w=tn(b),O=new Map(b.modules.map(P=>[P.id,P])),M=Ec(b,O,w),J=wc(b),ie=k.records.some(P=>M.some(G=>G.packageName===P.anchor.packageName&&G.exportName===P.anchor.exportName&&G.container===P.anchor.container)),ge=[],Oe=Date.now();for(let{finding:P,symbol:G}of V){let Ke=k.records,pe=Ai(P,G,F),Z=pe?Rn(b,O,w,G,Ke):null,Ae=k.records.filter(Ee=>Ee.callee.packageName===G.packageName&&Ee.callee.exportName===G.exportName&&Ee.callee.container===G.container||Ee.callee.packageName===G.packageName&&Ee.callee.realFunctionId!==null);ge.push({advisoryId:P.advisoryId,packageName:P.packageName,symbolName:P.symbolName,unknownKind:P.unknownKind??null,decidedAtStage:P.decidedAtStage,consultSurface:F,noHitReason:Z!==null?null:pe?ie?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Z!==null?vc(Z,Ke,M,J):null,verdictBefore:P.tier,verdictAfter:Z!==null?"reachable-low":P.tier,wouldPromote:Z!==null,...Z!==null?{modelId:Z.modelId,anchorPackage:Z.anchorPackage,entryExport:Z.entryExport,pathLabels:Z.pathLabels,calleeBinding:Ae.find(Ee=>Ee.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:pe?Ae.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Ae[0]?.anchor.packageName??"?"}#${Ae[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let ye=Date.now()-Oe,Q=Fe.map(P=>{if(P.status!=="active")return{modelId:P.modelId,state:P.status,reason:P.reason,edgesLowered:0,edgesReferenceGated:0};let G=k.records.filter(pe=>pe.modelId===P.modelId).length;if(G>0)return{modelId:P.modelId,state:"lowered",reason:null,edgesLowered:G,edgesReferenceGated:P.edgeCount-G};let Ke=k.notes.find(pe=>pe.startsWith(`model ${P.modelId}:`)||pe.startsWith(`model-edge ${P.modelId}:`));return{modelId:P.modelId,state:"refused",reason:Ke??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:P.edgeCount}}),xe=ge.filter(P=>P.wouldPromote).length,he=W.unknown-xe,Le=W["reachable-high"]+W["reachable-medium"],Re=P=>({none:0,"fail-on-reachable":Le>0?2:0,"fail-on-unknown":P>0?2:0,both:Le>0||P>0?2:0});dn={records:ge,notes:[...de,...k.notes],laneStates:Q,exitCodes:{baseline:Re(W.unknown),withModels:Re(he)},overlayWallMs:ye},Ys(Qe.dirname(e.modelShadow.outPath),{recursive:!0});let q=`${e.modelShadow.outPath}.tmp-${Js(8).toString("hex")}`;Zs(q,`${JSON.stringify(dn,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Qs(q,e.modelShadow.outPath)}let cn;if(e.bindingShadow!==void 0){let F=Date.now(),ke=q=>C.models.length>0?{records:Fn(q,C.models).delta.records,reachMods:tn(q),modulesById:new Map(q.modules.map(P=>[P.id,P]))}:null,fe=(q,P,G,Ke)=>{let pe=[];for(let Z of a.packages)for(let{advisory:Ae,affected:Ee}of t.advisoriesForPackage("npm",Z.name)){let kn=qn(Ae.id,Z.name,Ee),zo=Ii(Ae.id,Z.name,t.symbolsForAffected(Ee.id),Ee.surfaceComplete,i);for(let Gi of zo){let{finding:Xi,hit:Pt}=Vn(q,Ke,{name:Z.name,version:Z.version,devOnly:Z.dev,outOfGraphExecution:R(Z.name)},kn,Gi,P,G);pe.push({advisoryId:Ae.id,packageName:Z.name,symbolName:Gi?.exportName??null,tier:Pt!==null?Pt.tier:Xi.tier,unknownKind:Pt!==null?null:Xi.unknownKind??null})}}return pe},de=q=>{let P=fi({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:q,callablePackageResolver:x,tsconfigPaths:y}),G=[...u.diagnostics,...pi(u.sources,u.gaps),...P.diagnostics];return{graph:P.graph,inc:no(P.graph,G,T),aborted:eo(f.length,P.graph),live:ke(P.graph),applicability:P.bindingApplicability}},Fe=q=>{let P=de(q);return fe(P.graph,P.inc,P.aborted,P.live)},k=de({}),w=fe(k.graph,k.inc,k.aborted,k.live),O=fe(b,z,I,U);if(O.length!==w.length)throw new Ve("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let M=(q,P)=>P.tier!==q.tier||P.unknownKind!==q.unknownKind,J=w.some((q,P)=>{let G=O[P];return G!==void 0&&M(q,G)}),ie=J?Fe({additiveForms:!0}):null,ge=J?Fe({namelessExports:!0}):null,Oe=0,ye=w.map((q,P)=>{let G=O[P];if(G===void 0||G.advisoryId!==q.advisoryId||G.packageName!==q.packageName||G.symbolName!==q.symbolName)throw new Ve("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Ke={advisoryId:q.advisoryId,packageName:q.packageName,symbolName:q.symbolName,unknownKind:q.unknownKind,verdictBefore:q.tier,verdictAfter:G.tier,wouldPromote:G.tier!==q.tier&&(G.tier==="reachable-high"||G.tier==="reachable-medium"||G.tier==="reachable-low")};if(!M(q,G)||ie===null||ge===null)return Ke;Oe+=1;let pe=ie[P],Z=ge[P],Ae=pe!==void 0&&M(q,pe),Ee=Z!==void 0&&M(q,Z);return{...Ke,attributedArm:Ae&&!Ee?"additiveForms":Ee&&!Ae?"namelessExports":"both",...pe!==void 0?{verdictArmA:pe.tier}:{},...Z!==void 0?{verdictArmB:Z.tier}:{}}}),Q={...W};w.forEach((q,P)=>{let G=O[P];G!==void 0&&G.tier!==q.tier&&(Q[G.tier]-=1,Q[q.tier]+=1)});let xe=(q,P)=>({none:0,"fail-on-reachable":q>0?2:0,"fail-on-unknown":P>0?2:0,both:q>0||P>0?2:0}),he;if(C.models.length>0&&U!==null){he=[];for(let q of a.packages)for(let{advisory:P,affected:G}of t.advisoriesForPackage("npm",q.name)){let Ke=qn(P.id,q.name,G),pe=Ii(P.id,q.name,t.symbolsForAffected(G.id),G.surfaceComplete,i);for(let Z of pe){if(Z===null||!Z.verified)continue;let Ae=Vn(k.graph,k.live,{name:q.name,version:q.version,devOnly:q.dev,outOfGraphExecution:R(q.name)},Ke,Z,k.inc,k.aborted);if(!(Ae.hit===null&&Ai(Ae.finding,Z,"base")))continue;let kn=Rn(b,U.modulesById,U.reachMods,Z,U.records);he.push({advisoryId:P.id,packageName:q.name,symbolName:Z.exportName,modelWouldPromote:kn!==null,...kn!==null?{modelId:kn.modelId}:{},anchorCleared:kn!==null})}}}let Le=$.some(q=>q.modelId!==void 0);cn={records:ye,deltas:Oe,exitCodes:{baseline:xe(Q["reachable-high"]+Q["reachable-medium"],Q.unknown+(Le?1:0)),withBindingForms:xe(W["reachable-high"]+W["reachable-medium"],W.unknown+(Le?1:0))},dualRunWallMs:Date.now()-F,...A.bindingApplicability!==void 0?{applicability:A.bindingApplicability}:{},...he!==void 0?{modelProbe:he}:{}},Ys(Qe.dirname(e.bindingShadow.outPath),{recursive:!0});let Re=`${e.bindingShadow.outPath}.tmp-${Js(8).toString("hex")}`;Zs(Re,`${JSON.stringify(cn,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Qs(Re,e.bindingShadow.outPath)}let un=_.length>0||C.notes.length>0?{active:C.models.length,stored:_.length,promoted:$.filter(F=>F.modelId!==void 0).length,notes:[...C.notes,...j!==null?j.notes:[]]}:void 0;return{...be!==void 0?{summaryShadow:be}:{},...dn!==void 0?{modelShadow:dn}:{},...cn!==void 0?{bindingShadow:cn}:{},...un!==void 0?{modelLane:un}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:a,findings:$,counts:W,analyzerDiagnostics:S,analysisAborted:I,rejectedEntries:c,entrypointSources:p,entrypointGaps:u.gaps,framework:u.framework,unresolved:m,advisories:[...Y.values()],exitCode:Ie}}finally{e.reader===void 0&&t.close()}}var Ac="cupel",_c="reachability-first SCA \u2014 verdict + call path + confidence";function Ci(e){return[`${Ac} v${e} \u2014 ${_c}`,`cascade: ${tr.join(" \u2192 ")}`,`verdicts: ${ir.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)"].join(`
+`)}var Nc=new Set([...Kt,...jt]);function Sn(e,n,t){let i=e[n+1];if(i===void 0||i.startsWith("--"))throw new Error(`${t} requires a value`);return i}function Cc(e){let n=e.split(",").map(r=>r.trim()),t=[...Kt,...jt].join(", ");if(n.length===0||n.some(r=>r===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let i=[];for(let r of n){if(!Nc.has(r))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(r)}; valid: ${t}`);i.push(r)}return i}function ro(e){let n=".",t,i,r=!1,s=!1,a=!1,l=!1,o=!1,c,u,f,p=!1,h=!1,E,x=!1,y=!1,v,N=[];for(let R=0;R<e.length;R+=1){let A=e[R];if(A==="--require-complete-denial"){s=!0;continue}if(A==="--fail-on-reachable")r=!0;else if(A==="--fail-on-unknown")a="all";else if(A!==void 0&&A.startsWith("--fail-on-unknown="))a=Cc(A.slice(18));else if(A==="--offline")l=!0;else if(A==="--sarif")t=Sn(e,R,"--sarif"),R+=1;else if(A==="--shard")i=Sn(e,R,"--shard"),R+=1;else if(A==="--entry")N.push(Sn(e,R,"--entry")),R+=1;else if(A==="--summary-shadow")c=Sn(e,R,"--summary-shadow"),R+=1;else if(A==="--model-shadow")u=Sn(e,R,"--model-shadow"),R+=1;else if(A==="--model-shadow-out")f=Sn(e,R,"--model-shadow-out"),R+=1;else if(A==="--model-shadow-widened")p=!0;else if(A==="--binding-shadow")h=!0;else if(A==="--binding-shadow-out")E=Sn(e,R,"--binding-shadow-out"),R+=1;else if(A==="--x-partial-rows")x=!0;else if(A==="--push")y=!0;else if(A!==void 0&&A.startsWith("--auth=")){let b=A.slice(7);if(b!=="oidc"&&b!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(b)}`);v=b}else{if(A!==void 0&&A.startsWith("--"))throw new Error(`unknown flag ${A}`);A!==void 0&&!o&&(n=A,o=!0)}}if(u===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(p&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(E!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(v!==void 0&&!y)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:i,failOnReachable:r,requireCompleteDenial:s,failOnUnknown:a,offline:l,entry:N,summaryShadow:c,modelShadow:u,modelShadowOut:f,modelShadowWidened:p,push:y,auth:v,bindingShadow:h,bindingShadowOut:E,partialRows:x}}import{randomBytes as Oc,createHash as Rc}from"node:crypto";import{mkdirSync as $c,readFileSync as Mc,renameSync as Pc,writeFileSync as Lc}from"node:fs";import{homedir as Tc}from"node:os";import bn from"node:path";var Oi="latest.json",Ri="latest.json.sig";function vt(e){return Rc("sha256").update(e).digest("hex")}function so(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=Tc();if(process.platform==="darwin")return bn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,s=r!==void 0&&r!==""?r:bn.join(n,"AppData","Local");return bn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,i=t!==void 0&&t!==""?t:bn.join(n,".cache");return bn.join(i,"cupel","shards")}function $i(e,n,t){return bn.join(e,`${n}-${t}.sqlite`)}function It(e,n){$c(bn.dirname(e),{recursive:!0});let t=`${e}.tmp-${Oc(8).toString("hex")}`;Lc(t,n,{flag:"wx"}),Pc(t,e)}function Hn(e){try{return Mc(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function oo(e,n,t,i){let r=$i(e,n,t),s=Hn(r);if(s===void 0)return;let a=vt(s);if(a!==t)throw i(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:r,bytes:s}}var ao="api.cupel.sh",At=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),lo=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Ct from"node:path";function Me(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function co(e,n={}){let t=n.maxBytes??1073741824,i=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((s,a)=>{let l=r(e,n.headers!==void 0?{headers:n.headers}:{},o=>{let c=o.statusCode??0;if(c<200||c>=300){o.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(c)}`));return}let u=[],f=0;o.on("data",p=>{if(f+=p.length,f>t){o.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(p)}),o.on("end",()=>{s(Buffer.concat(u))}),o.on("error",a)});l.on("error",a),l.setTimeout(i,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(i)}ms`))})})}async function Wn(e,n,t,i,r,s=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((o,c)=>{let u=a(n,{method:e,headers:t},f=>{let p=[],h=0;f.on("data",E=>{if(h+=E.length,h>r){f.destroy(),c(new Error(`${e} to ${l} returned more than ${String(r)} bytes`));return}p.push(E)}),f.on("end",()=>{o({status:f.statusCode??0,body:Buffer.concat(p).toString("utf8")})}),f.on("error",()=>{c(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{c(new Error(`${e} to ${l} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(s)}ms`))}),i!==void 0&&u.write(i),u.end()})}import{createPublicKey as Dc,verify as Fc}from"node:crypto";var X=class extends Error{constructor(n){super(n),this.name="DistError"}},Kc=Buffer.from("302a300506032b6570032100","hex"),jc=32;function mo(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===jc)try{return Dc({key:Buffer.concat([Kc,n]),format:"der",type:"spki"})}catch{return}}function Mi(e,n,t){for(let i of t){let r=mo(i);if(r!==void 0)try{if(Fc(null,e,r,n))return!0}catch{}}return!1}function ho(e){return e.some(n=>mo(n)!==void 0)}var Bc=/^[0-9a-f]{64}$/u,zc=/^[a-z0-9-]+$/u;function uo(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new X(`${n} must be an object`);return e}function fo(e,n){if(!Array.isArray(e))throw new X(`${n} must be an array`);return e}function _t(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new X(`${n} must be an integer`);return e}function Nt(e,n){if(typeof e!="string")throw new X(`${n} must be a string`);return e}function po(e,n){let t=Nt(e,n);if(Number.isNaN(Date.parse(t)))throw new X(`${n} is not a valid timestamp: ${t}`);return t}function Pi(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new X("distribution index is not valid JSON")}let i=uo(t,"index"),r=_t(i.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new X(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=_t(i.sequence,"sequence");if(s<0)throw new X("sequence must be non-negative");let a=po(i.generated,"generated"),l=fo(i.shards,"shards"),o;for(let E of l){let x=uo(E,"shard entry"),y=Nt(x.ecosystem,"ecosystem");if(!zc.test(y))throw new X(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){o=x;break}}if(o===void 0)throw new X(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);po(o.built,"built");let c=_t(o.db_schema_version,"db_schema_version");if(c<1)throw new X("db_schema_version must be >= 1");if(c>n.supportedDbSchemaVersion)throw new X(`this shard needs a newer cupel (db_schema_version ${String(c)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=Nt(o.sha256,"sha256");if(!Bc.test(u))throw new X(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let f=_t(o.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new X(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let p=fo(o.urls,"urls");if(p.length===0)throw new X("urls must be a non-empty array");let h=[];for(let E of p){let x=Nt(E,"url");try{h.push(Me(x,n.shardHosts))}catch(y){throw new X(`refusing shard url ${JSON.stringify(x)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:f,dbSchemaVersion:c,urls:h,sequence:s,generated:a}}var Di="CUPEL_DELIVERY_TOKEN",Li=class extends X{constructor(n){super(n),this.name="NoDeliveryTokenError"}},Ti=class extends X{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Uc(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function go(e,n){let t=Uc(e);return t!==void 0?()=>Promise.resolve(t):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function yo(e){if(e===void 0)throw new Li(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow, elsewhere set ${Di} to a token from app.cupel.sh, or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new Ti(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Vc="/v1/resolve",Fi=1024*1024,Ki=4096,xo=Fi+Ki+64*1024,qc=8,Hc=2048,Wc=/^[A-Za-z0-9+/]+={0,2}$/u,Gc=3e4,me=class extends X{constructor(n){super(n),this.name="DeliveryRefusedError"}},Gn=class extends X{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Xn=class extends X{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function Xc(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Jc(e){if(typeof e!="string"||e.length===0)throw new me("the delivery response carried no index signature");if(e.length>Ki||!Wc.test(e))throw new me("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new me("the delivery response's index signature is not canonical base64");return n}function Yc(e){if(typeof e!="string"||e.length===0)throw new me("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Fi)throw new me("the delivery response's index is larger than one can be");return n}function Qc(e){if(!Array.isArray(e)||e.length===0)throw new me("the delivery response named no shard urls");if(e.length>qc)throw new me("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>Hc)throw new me("the delivery response carried a malformed shard url");n.push(t)}return n}function Zc(e,n){throw e===401||e===403?new me(`${n} rejected the delivery credential \u2014 check ${Di}, or that the token has not been revoked in the dashboard`):e===404?new me(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Xn(`${n} holds nothing newer than the shard index already cached`):e===429?new Gn(`${n} rate-limited the delivery request`):e>=500?new Gn(`${n} answered ${String(e)}`):new me(`${n} refused the delivery request with status ${String(e)}`)}async function So(e,n,t,i,r=Gc){let s=Me(`https://${e}${Vc}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await i(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,r)}catch{throw new Gn(`${e} could not be reached`)}if(l.status!==200&&Zc(l.status,e),Buffer.byteLength(l.body,"utf8")>xo)throw new me(`${e} returned a delivery response larger than one can be`);let o;try{o=JSON.parse(l.body)}catch{throw new me(`${e} returned a delivery response that is not JSON`)}if(!Xc(o))throw new me(`${e} returned a delivery response that is not an object`);return{index:Yc(o.index),sig:Jc(o.signature),shardUrls:Qc(o.shardUrls)}}var bo=async(e,n,t,i)=>await Wn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,xo,i);var eu=8,Bi=class extends X{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function ji(e){return`${e.origin}${e.pathname}`}function ko(e,n,t){let i=new Map;for(let a of n)i.set(ji(a),a);let r=[],s=[];for(let a of e.slice(0,eu)){let l;try{l=Me(a,t)}catch(u){s.push(u.message);continue}if(l.hash!==""){s.push("a candidate carried a fragment");continue}let o=i.get(ji(l));if(o===void 0){s.push("a candidate named an object the signed index does not list");continue}let c=new URL(`${ji(o)}${l.search}`);r.push(Me(c.href,t))}if(r.length===0)throw new Bi(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return r}var tu=1,iu=1024*1024*1024;function ru(e=At){return{async resolve(n){return await So(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},bo)},async fetchShard(n,t){return Me(n.href,e),await co(n.href,{maxBytes:t,timeoutMs:3e4})}}}function zi(e){return e instanceof Error?e.message:String(e)}function Eo(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:tu,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:iu}}function su(e){let n=Hn(Ct.join(e.cacheDir,Oi)),t=Hn(Ct.join(e.cacheDir,Ri));if(!(n===void 0||t===void 0)&&Mi(n,t,e.pubkeys))try{return Pi(n,Eo(e))}catch{return}}function wo(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let i=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(i)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Ot(e,n,t){let i=oo(n.cacheDir,e.ecosystem,e.sha256,r=>new X(r));if(i===void 0)throw new X(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:i.path,fromCache:!0,warnings:[...t,...wo(e,n)],sequence:e.sequence}}async function ou(e,n,t,i){let r=$i(t.cacheDir,e.ecosystem,e.sha256),s=Hn(r);if(s!==void 0&&vt(s)===e.sha256)return{path:r,downloaded:!1};let a="no shard urls";for(let l of n){let o;try{o=await i.fetchShard(l,e.sizeBytes)}catch(u){a=zi(u);continue}let c=vt(o);if(c!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${c})`;continue}return It(r,o),{path:r,downloaded:!0}}throw new X(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function au(e,n,t){if(e instanceof me)throw e;if(e instanceof Xn){if(n===void 0)throw new X(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Ot(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new X(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${zi(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Ot(n,t,[`could not refresh the shard index (${zi(e)}); using the cached shard`])}async function vo(e,n){if(!e.activated)throw new X("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??ru(e.shardHosts);if(!ho(e.pubkeys))throw new X("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let i=su(e);if(e.offline){if(i===void 0)throw new X(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Ot(i,e,[])}let r=await yo(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:i?.sequence??0})}catch(c){return au(c,i,e)}if(!Mi(s.index,s.sig,e.pubkeys))throw new X("shard index signature did not verify against any pinned key");let a=Pi(s.index,Eo(e));if(i!==void 0&&a.sequence<i.sequence)return Ot(i,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(i.sequence)}); keeping the newer cached shard`]);let l=ko(s.shardUrls,a.urls,e.shardHosts),o=await ou(a,l,e,t);return It(Ct.join(e.cacheDir,Oi),s.index),It(Ct.join(e.cacheDir,Ri),s.sig),{path:o.path,fromCache:!o.downloaded,warnings:wo(a,e),sequence:a.sequence}}var lu="https://api.cupel.sh",Io=".actions.githubusercontent.com",du=8192,Pe=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function cu(e){let n;try{n=new URL(e).hostname}catch{throw new Pe("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=Io.slice(1);if(n!==t&&!n.endsWith(Io))throw new Pe(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Me(e,new Set([n]))}catch{throw new Pe(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Rt(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,i=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Pe("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(i===void 0||i==="")throw new Pe("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=cu(t);r.searchParams.set("audience",lu);let s;try{s=await n(r.href,{authorization:`Bearer ${i}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Pe("the ID-token request failed")}if(s.length>du)throw new Pe("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(s)}catch{throw new Pe("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new Pe("the ID-token response carried no token");return l}async function Ao(e,n,t={}){let i=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!i)throw new Pe("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Rt(e,n)};if(i)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await Rt(e,n)};throw new Pe("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Ui="api.cupel.sh",uu=`https://${Ui}/v1/findings`,fu=64*1024,$t=8*1024*1024,pu=3e4,an=class extends Error{constructor(n){super(n),this.name="PushError"}};async function _o(e,n,t,i={}){if(e.length>$t)throw new an(`findings payload is ${String(e.length)} bytes, over the ${String($t)}-byte limit`);let r=Me(uu,new Set([Ui])),s;try{s=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,i.timeoutMs??pu)}catch{throw new an(`the findings push to ${Ui} failed`)}if(s.body.length>fu)throw new an("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new an("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new an("the control plane rejected the findings payload as malformed"):new an(`the findings push was refused with status ${String(s.status)}`)}var mu=64*1024,hu=64*1024,No=async(e,n,t,i)=>{if(Buffer.byteLength(t,"utf8")>$t)throw new Error("findings payload is over the size limit");return await Wn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,hu,i)};async function Mt(e,n){let t=await Wn("GET",e,n,void 0,mu,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var yu=720*60*60*1e3,xu=Number(pn);function Co(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Ve("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Oo(e){let n=await vo({ecosystem:"npm",activated:!0,pubkeys:lo,indexHost:ao,shardHosts:At,credential:go(process.env,()=>Rt(process.env,Mt)),cacheDir:so(),offline:e.offline,now:Date.now(),maxAgeMs:yu,supportedDbSchemaVersion:xu});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
+`);return{path:n.path,sequence:n.sequence}}var Su=7,bu={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64},ln=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Vi(e){return{path:e.path,start:e.start,end:e.end}}function ku(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new ln(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,i=e.modelPromotedFromKind??null;if(t===null!=(i===null))throw new ln(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new ln(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:rr(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(r=>({functionName:r.functionName??null,modulePath:r.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(Vi),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:i,surfaceComplete:e.surfaceComplete??null}}var Eu="";function wu(e){return[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""].join(Eu)}function vu(e){let n=new Map;for(let t of e){let i=wu(t),r=n.get(i);if(r===void 0){n.set(i,t);continue}if(r.tier!==t.tier||r.unknownKind!==t.unknownKind)throw new ln(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Iu(e){let n=bu,t=(i,r,s)=>{throw new ln(`${i} has ${String(r)} entries, over the ${String(s)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let i of["dispatch","load"]){let r=e.unresolved[i].length;r>n.maxUnresolvedSites&&t(`the app-global ${i} set`,r,n.maxUnresolvedSites)}for(let i of e.findings)i.path!==null&&i.path.length>n.maxPathSteps&&t(`the call path of finding ${i.advisoryId}`,i.path.length,n.maxPathSteps),i.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${i.advisoryId}`,i.unresolvedSites.length,n.maxUnresolvedSites);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let i of e.advisories)if(i.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${i.id}`,i.ranges.length,n.maxAdvisoryRanges),i.summary!==null&&i.summary.length>n.maxStringLength)throw new ln(`the summary of advisory ${i.id} is ${String(i.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`)}function Au(e,n){let t=new Set(n.map(i=>i.advisoryId));return e.advisories.filter(i=>t.has(i.advisory.id)).map(i=>({id:i.advisory.id,cveId:i.advisory.cveId,osvId:i.advisory.osvId,summary:i.advisory.summary,severity:i.advisory.severity,published:i.advisory.published,source:i.advisory.source,ranges:i.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function Ro(e,n){let t=vu(e.findings.map(ku)),i={version:Su,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(Vi),load:e.unresolved.load.map(Vi)},advisories:Au(e,t)};return Iu(i),i}function B(e){let n="";for(let t of e){let i=t.charCodeAt(0),r=i<32||i>=127&&i<=159;n+=r?"\\x"+i.toString(16).padStart(2,"0"):t}return n}function _u(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var Nu={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},$o=4,qi=3,Hi=10,Mo={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},Cu="(symbol set known incomplete)";function Ou(e){let n=(e.path??[]).map(t=>B(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Po(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function Ru(e){let n=e.findings.filter(c=>c.tier==="unknown"&&c.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let c of n){let u=t.get(c.unknownKind)??[];u.push(c),t.set(c.unknownKind,u)}let i={cupel:0,project:0};for(let[c,u]of t)i[$e[c]]+=u.length;let r=[];r.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(c,u)=>{if(i[c]===0)return;r.push(""),r.push(`   ${u} (${String(i[c])}):`);let f=[...t.entries()].filter(([h])=>$e[h]===c).sort((h,E)=>E[1].length-h[1].length||h[0].localeCompare(E[0])),p=f.slice(0,$o);for(let[h,E]of p){let x=c==="project"?[...new Set(E.flatMap(Po))]:[],y=x.slice(0,qi).map(B).join(", "),v=x.length>qi?` (+${String(x.length-qi)} more files)`:"";r.push(`     ${h.padEnd(21)} ${String(E.length).padStart(4)}  ${Mo[h]}`+(y!==""?`
+       ${y}${v}`:""))}for(let[h,E]of f.slice($o))r.push(`     ${h.padEnd(21)} ${String(E.length).padStart(4)}  ${Mo[h]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let c of n)if($e[c.unknownKind]==="project")for(let u of Po(c))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((c,u)=>u[1]-c[1]||c[0].localeCompare(u[0]))[0];l!==void 0&&i.project>0&&(r.push(""),r.push(`   \u279C Start here: ${B(l[0])} appears in ${String(l[1])} of your ${String(i.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let o=n.filter(c=>$e[c.unknownKind]==="project");if(o.length>0){r.push("");for(let c of o.slice(0,Hi))r.push(`     ${B(c.displayId)}  ${B(c.packageName)}@${B(c.version)}  [${c.unknownKind}] ${B(c.reason)}`);o.length>Hi&&r.push(`     \u2026 and ${String(o.length-Hi)} more`)}return r.push(""),r}function Lo(e){let n=[],t=e.counts,i=e.findings.filter(c=>c.tier==="reachable-high"||c.tier==="reachable-medium"||c.tier==="reachable-low");if(n.push(`cupel scan: ${B(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let c=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+c.map(u=>`${B(u.entrypoint)} [${B(u.source)}]`).join(", ")+(e.entrypointSources.length>c.length?`, \u2026 and ${String(e.entrypointSources.length-c.length)} more`:"")),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let c of e.entrypointGaps.slice(0,5))n.push(`  - ${B(c.source)} (${B(c.file)}): ${B(c.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(B).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${ei(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,s=r.find(c=>c.kind==="no-enumeration")??null;s!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${B(s.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=r.filter(c=>c!==s);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let c of a.slice(0,10))n.push(`  - [${B(c.kind)}] ${B(c.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(r.map(c=>c.detail)),o=[...e.analyzerDiagnostics.map(c=>`${B(c.code)}: ${B(c.detail)}`),...e.installed.diagnostics.filter(c=>!l.has(c)).map(B)];if(o.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(o.length)}) \u2014 verdicts are conservative:`);for(let c of o.slice(0,10))n.push(`  - ${c}`);o.length>10&&n.push(`  \u2026 and ${String(o.length-10)} more`),n.push("")}if(i.length>0){n.push(`\u{1F3AF} Reachable (${String(i.length)}) \u2014 fix these:`);for(let c of i)n.push(`  ${Nu[c.tier]} ${B(c.displayId)}  ${B(c.packageName)}@${B(c.version)}  ${B(c.symbolName??"")}`+(c.surfaceComplete===!1?`  ${Cu}`:"")),n.push(`        path: ${Ou(c)}`);n.push("")}return n.push(...Ru(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${_u(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as $u}from"node:crypto";var Mu="https://json.schemastore.org/sarif-2.1.0.json",To="cupel-reachability",Wi=new Set(["dispatch","dynamic-load","coverage-gap"]);function Pu(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var Lu=500,Tu=10;function Du(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function Fu(e,n){return`${e}::${n}`}function Ku(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function ju(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return $u("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Bu(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Wi.has(e.unknownKind)}var Do={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function Fo(e){let n=[],t=new Map,i=[];for(let o of e.findings){if(!Bu(o))continue;let c=Fu(o.displayId,o.packageName);if(!t.has(c)){t.set(c,n.length);let y=Ku(o.severity);n.push({id:B(c),properties:{tags:o.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${B(o.packageName)}`]:["security","reachability",`package/${B(o.packageName)}`],...y!==void 0?{"security-severity":y}:{}}})}let u=o.tier==="reachable-high"||o.tier==="reachable-medium"||o.tier==="reachable-low",f=o.path??[],p=f.find(y=>y.modulePath!==""),h=[...new Set(o.unresolvedSites.map(y=>y.path).filter(y=>y!==""))],E=u?p!==void 0?{physicalLocation:{artifactLocation:{uri:B(p.modulePath)}},message:{text:`calls ${B(o.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:B(o.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:B(h[0])}},message:{text:`unresolved ${B(o.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:B(o.packageLocation??(o.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},x=u?f.map(y=>({physicalLocation:{artifactLocation:{uri:B(y.modulePath||"package-lock.json")}},message:{text:B(y.functionName??"<step>")}})):h.slice(1,Tu+1).map(y=>({physicalLocation:{artifactLocation:{uri:B(y)}},message:{text:"also blocked here"}}));i.push({ruleId:B(c),ruleIndex:t.get(c),level:u?"error":"warning",message:{text:B(`[${o.tier}] ${o.displayId} in ${o.packageName}@${o.version}`+(o.symbolName!==null?` \u2014 reaches ${o.symbolName}`:"")+(o.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${o.reason}`)},locations:[E],...x.length>0?{relatedLocations:x}:{},partialFingerprints:{"cupelReachability/v1":ju(o)},properties:{tier:o.tier,advisoryId:B(o.advisoryId),...o.surfaceComplete===!1?{surfaceComplete:!1}:{},...o.modelId!==void 0?{modelId:B(o.modelId),modelPromotedFromKind:o.modelPromotedFromKind}:{},...o.unknownKind!==void 0?{unknownKind:o.unknownKind,unknownOwner:$e[o.unknownKind],unresolvedSiteCount:o.unresolvedSites.length}:{}}})}let r=new Map,s=new Map;for(let o of e.findings){if(o.tier!=="unknown"||o.unknownKind===void 0||(r.set(o.unknownKind,(r.get(o.unknownKind)??0)+1),Wi.has(o.unknownKind)))continue;let c=s.get(o.unknownKind)??[];c.length<Lu&&c.push({advisory:B(o.displayId),package:B(o.packageName),version:B(o.version)}),s.set(o.unknownKind,c)}let a={cupel:0,project:0};for(let[o,c]of r)a[$e[o]]+=c;let l={};for(let[o,c]of s){let u=r.get(o)??c.length;l[o]={count:u,owner:$e[o],note:Do[o],truncated:u>c.length,advisories:c}}return{$schema:Mu,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:To},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:B(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(o=>`${o.entrypoint} (${o.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...r.keys()].filter(o=>!Wi.has(o)&&!Pu(o,e.analysisAborted)).sort().map(o=>({descriptor:{id:`unknown-${o}`},level:"warning",message:{text:`${String(r.get(o)??0)} finding(s) are unknown because ${Do[o]} (owner: ${$e[o]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${o}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(o=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:B(`${o.source} (${o.file}): ${o.detail}`)}})),...e.rejectedEntries.map(o=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:B(`--entry did not resolve to a file inside the app root: ${o}`)}})),...e.analyzerDiagnostics.map(o=>({descriptor:{id:o.code},level:"warning",message:{text:B(`${o.detail} (${o.path})`)}})),...e.installed.diagnostics.map(o=>({descriptor:{id:"resolve"},level:"warning",message:{text:B(o)}}))]}],results:i,properties:{category:To,summary:e.counts,...Du(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...r].sort((o,c)=>c[1]-o[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(o=>o.tier==="unknown"&&o.unknownKind==="db-gap").map(o=>({advisory:B(o.displayId),package:B(o.packageName),version:B(o.version)}))}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function Ko(){try{let e=zu(qu(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Hu(e,n){let t=`${JSON.stringify(n,null,2)}
+`,i=`${e}.tmp-${jo(8).toString("hex")}`;Bo(i,t,{encoding:"utf8",flag:"wx"}),Uu(i,e)}async function Wu(e){let n=ro(e),i=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:Co(n.shard),sequence:null}:await Oo({offline:n.offline}),r=i.path,s=Ni({dir:n.dir,shardPath:r,failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{}});if(process.stdout.write(`${Lo(s)}
+`),s.modelLane!==void 0){let a=s.modelLane.notes.length>0?` (${s.modelLane.notes.map(l=>B(l)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(s.modelLane.active)}/${String(s.modelLane.stored)} active, ${String(s.modelLane.promoted)} promoted to reachable-low${a}
+`)}if(n.summaryShadow!==void 0&&s.summaryShadow!==void 0){let a=Vu.join(n.summaryShadow,"shadow-report.json");Bo(a,`${JSON.stringify(s.summaryShadow,null,2)}
 `),process.stdout.write(`summary-shadow: ${String(s.summaryShadow.records.length)} counterfactual record(s) -> ${a}
 `)}if(s.modelShadow!==void 0&&n.modelShadowOut!==void 0){let a=s.modelShadow.records.filter(l=>l.wouldPromote).length;process.stdout.write(`model-shadow: ${String(a)}/${String(s.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
 `)}if(s.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(s.bindingShadow.deltas)}/${String(s.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),n.sarif!==void 0&&Vu(n.sarif,Do(s)),n.push){let a=Oo(s,{scanId:Ko(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:i.sequence}),l=await Io(process.env,$t,{...n.auth!==void 0?{auth:n.auth}:{},warn:c=>process.stderr.write(`cupel: ${c}
-`)});try{await Ao(JSON.stringify(a),l.value,_o)}catch(c){let u=c instanceof Error?c.message:String(c);return process.stderr.write(`cupel: ${u}
+`),n.sarif!==void 0&&Hu(n.sarif,Fo(s)),n.push){let a=Ro(s,{scanId:jo(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:i.sequence}),l=await Ao(process.env,Mt,{...n.auth!==void 0?{auth:n.auth}:{},warn:c=>process.stderr.write(`cupel: ${c}
+`)});try{await _o(JSON.stringify(a),l.value,No)}catch(c){let u=c instanceof Error?c.message:String(c);return process.stderr.write(`cupel: ${u}
 `),s.exitCode===0?1:s.exitCode}let o=i.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(a.findings.length)} finding(s) to api.cupel.sh (${l.kind})${o}
-`)}return s.exitCode}async function Hu(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await qu(e.slice(1))}catch(t){let i=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${i}
-`),1}let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${Ni(Fo())}
-`),0):(process.stderr.write(`cupel: unknown command '${z(n)}'
-`),process.stderr.write(`${Ni(Fo())}
-`),1)}Hu().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`)}return s.exitCode}async function Gu(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Wu(e.slice(1))}catch(t){let i=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${i}
+`),1}let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${Ci(Ko())}
+`),0):(process.stderr.write(`cupel: unknown command '${B(n)}'
+`),process.stderr.write(`${Ci(Ko())}
+`),1)}Gu().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});