npm - @cupel-sh/cli - Versions diffs - 0.5.0 → 0.6.1 - Mend

@cupel-sh/cli 0.5.0 → 0.6.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/bundle/cli.js CHANGED Viewed

@@ -1,38 +1,50 @@
 #!/usr/bin/env node
-import{randomBytes as Ho}from"node:crypto";import{readFileSync as df,renameSync as cf,writeFileSync as Wo}from"node:fs";import uf from"node:path";import{fileURLToPath as ff}from"node:url";var Xo=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Nn(e){if(!Xo.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function Jn(e,n){let t=e.split(".").map(Number),i=n.split(".").map(Number);for(let r=0;r<3;r+=1){let s=t[r]??0,a=i[r]??0;if(s!==a)return s<a?-1:1}return 0}var Tt=["dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function fn(e,n){let t=Nn(e);return!(n.introduced!=="0"&&Jn(t,Nn(n.introduced))<0||n.fixed!==void 0&&Jn(t,Nn(n.fixed))>=0||n.lastAffected!==void 0&&Jn(t,Nn(n.lastAffected))>0)}function Yn(e,n,t){let i=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let o=s.get(l.callSiteId);if(o===void 0)continue;let c=i.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=i.get(l.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==u.packageName&&a.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:l.resolution})}return a}function Jo(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,i)=>t.analyzedVersion<i.analyzedVersion?1:t.analyzedVersion>i.analyzedVersion?-1:0)}function Yo(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function nr(e,n,t,i,r,s){if(s<=0)return null;let a=null,l=o=>{(a===null||o.hops<a.hops)&&(a=o)};for(let o of Jo(e,n))for(let c of o.edges){if(c.entryExport!==t||c.entryContainer!==i)continue;if(Yo(c,r,o.packageName)){l({viaPackages:[],hops:c.hops,provenance:{tool:o.tool,toolVersion:o.toolVersion,analyzedVersion:o.analyzedVersion}});continue}if(c.target.kind!=="dep")continue;let u=nr(e,c.target.calleePackage,c.target.calleeExport,null,r,s-1);u!==null&&l({viaPackages:[c.target.calleePackage,...u.viaPackages],hops:c.hops+u.hops,provenance:u.provenance})}return a}function Dt(e,n,t,i,r,s){let a=null;for(let l of Yn(e,n,t)){let o=nr(r,l.packageName,l.exportName,l.container,i,s);o!==null&&(a===null||o.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:o.viaPackages,totalHops:o.hops,provenance:o.provenance})}return a}function Cn(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function On(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function ir(e){let n=new Map,t=new Map(e.imports.map(i=>[i.id,i]));for(let i of e.importEdges){let r=t.get(i.importId);if(r===void 0)continue;let s=n.get(r.moduleId)??[];s.push(i.resolvedModuleId),n.set(r.moduleId,s)}return n}function Zo(e){let n=new Map,t=new Map(e.imports.map(i=>[i.id,i]));for(let i of e.importEdges){let r=t.get(i.importId);if(r===void 0)continue;let s=n.get(i.resolvedModuleId)??[];s.push(r.moduleId),n.set(i.resolvedModuleId,s)}return n}function rn(e){let n=ir(e),t=new Set,i=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;i.length>0;){let r=i.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let s of n.get(r)??[])t.has(s)||i.push(s)}}return t}function Qo(e,n){let t=Zo(e),i=new Set,r=[n];for(;r.length>0;){let s=r.pop();if(!(s===void 0||i.has(s))){i.add(s);for(let a of t.get(s)??[])i.has(a)||r.push(a)}}return i}function ea(e,n,t){let i=ir(e),r=On(e),s=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||s.has(l))continue;s.add(l);let o=r.get(l);if(o===void 0||o.externalSurface===!0||t.has(l))return!0;for(let c of i.get(l)??[])s.has(c)||a.push(c)}return!1}function na(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),i=On(e),r=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&r.set(a.id,a);let s=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=s.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let o=t.get(a.target.functionId);o===void 0||i.get(o.moduleId)?.externalSurface===!0||r.set(o.id,o)}return[...r.values()]}function rr(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),s=r[0]?.startsWith("@")===!0?2:1;return r.slice(s).join("/")}function ta(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let i=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let a=n.get(s.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(i){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||r.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return a.externalSurface===!0?!0:rr(a.path)===t.sourcePath})}function tr(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&rr(t.path)===n.sourcePath)}function ia(e,n,t,i){let r=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(a=>{let l=r.get(a);if(l?.name!==i.exportName)return!1;let o=n.get(l.moduleId);return o?.externalSurface===!0&&o.packageName===i.packageName&&t.has(l.moduleId)}))}function ra(e,n,t){return t.container===null?!0:e.classes.some(i=>{if(i.name!==t.container)return!1;let r=n.get(i.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function sa(e,n,t){let i=new Map(e.callSites.map(o=>[o.id,o.enclosingFunctionId])),r=new Map;for(let o of e.callEdges){let c=i.get(o.callSiteId);if(c===void 0)continue;let u=r.get(c)??[];u.push({to:o.calleeFunctionId,res:o.resolution}),r.set(c,u)}let s=o=>{let c=new Set,u=n.map(f=>({id:f.id,prev:null}));for(let f of u)c.add(f.id);for(;u.length>0;){let f=u.shift();if(f===void 0)break;if(f.id===t){let p=[];for(let h=f;h!==null;h=h.prev)p.unshift(h.id);return p}for(let p of r.get(f.id)??[])p.res!=="unresolved"&&(p.res==="field-based"&&!o||c.has(p.to)||(c.add(p.to),u.push({id:p.to,prev:f})))}return null},a=s(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=s(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function Ft(e){return sr(e,On(e),rn(e),or(e))}function sr(e,n,t,i){let r=[],s=[],a=new Map(e.functions.map(o=>[o.id,o.moduleId])),l=o=>o!==void 0&&t.has(o)&&i.has(n.get(o)?.packageName??"");for(let o of e.callSites)o.resolution==="unresolved"&&l(a.get(o.enclosingFunctionId))&&r.push(o.range);for(let o of e.imports)!o.specifierIsLiteral&&t.has(o.moduleId)&&s.push({path:n.get(o.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:s}}function or(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function oa(e,n){let t=new Map(e.functions.map(r=>[r.id,r])),i=On(e);return n.map(r=>{let s=t.get(r),a=s!==void 0?i.get(s.moduleId):void 0;return{functionId:r,functionName:s?.name,modulePath:a?.path??""}})}function jt(e){let{graph:n,installed:t,range:i,symbol:r,coverage:s}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},o=K=>({unresolvedSites:K,unresolvedEvidence:{own:K,sets:[]}}),c=or(n),u=new Set;for(let K of e.incompleteness)K.reach.kind==="unbounded"&&u.add(K.source);let f=e.incompleteness.some(K=>K.reach.kind==="assumed-bounded")?"loader-assumption":"complete",p=K=>K==="not-reachable"?f:void 0,h=new Map,S=K=>{let V=h.get(K);return V===void 0&&(V=ea(n,K,u),h.set(K,V)),V},x=K=>K.reach.kind==="class-scope"&&r!==null&&r.packageName===K.reach.packageName&&r.container===K.reach.container,y=K=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let V of Tt)for(let D of e.incompleteness)if(D.cause===V&&K(D))return{cause:D.cause,source:D.source};return null},v=K=>{let V;return y(D=>D.reach.kind==="unbounded"?!0:D.reach.kind==="class-scope"?x(D):K===void 0||S(D.reach.anchor)?!0:(V??=Qo(n,K),V.has(D.reach.anchor)))},C=()=>y(K=>K.reach.kind==="unbounded"?!0:K.reach.kind==="class-scope"?x(K):S(K.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${i.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:p("not-affected"),path:void 0,...l};let $;try{$=fn(t.version,i)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:p("unknown"),path:void 0,...l}}if(!$)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${i.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:p("not-affected"),path:void 0,...l};let N=On(n),b=rn(n),m=K=>{if(K.cause!=="dynamic-load"||K.source===null)return a;let V=N.get(K.source);return V===void 0?a:[{path:V.path,start:0,end:0}]},{dispatch:E,load:_}=sr(n,N,b,c),F=[...E,..._],O={unresolvedSites:_,unresolvedEvidence:{own:a,sets:["load"]}},I={unresolvedSites:F,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},A=K=>{for(let V of b)if(N.get(V)?.packageName===K)return!0;return!1},j=K=>({tier:"unknown",decidedAtStage:K,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:p("unknown"),path:void 0,...l}),z=()=>{if(!A(i.packageName)){if(_.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:p("unknown"),path:void 0,...O};let K=C();return K!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:K.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(K))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:p("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${i.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${i.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}}return null};if(r===null||!r.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,basis:p("unknown"),path:void 0,...I};if(s!==null&&!s.comparedPaths.has(r.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:p("unknown"),path:void 0,...I};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:p("unknown"),path:void 0,...I};let M=ta(n,N,r);if(M===void 0||!b.has(M.moduleId)){if(M===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&ia(n,N,b,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,...I};if(M===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!ra(n,N,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,...I};let K=z();if(K!==null)return K;if(F.length>0){let W=M!==void 0?N.get(M.moduleId):tr(n,r),se=M===void 0&&W!==void 0&&W.externalSurface!==!0&&b.has(W.id)&&!c.has(W.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:_.length>0?"dynamic-load":se?"dep-opaque":"dispatch",attribution:void 0,basis:p("unknown"),path:void 0,...I}}let V=M!==void 0?N.get(M.moduleId):tr(n,r);if(M===void 0&&V!==void 0&&V.externalSurface!==!0&&b.has(V.id)&&!c.has(V.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,...l};let D=V!==void 0?v(V.id):C();return D!==null?{tier:"unknown",decidedAtStage:M===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:D.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(D))}:i.surfaceComplete?{tier:"not-reachable",decidedAtStage:M===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}:j(M===void 0?"symbol-reachable":"module-reachable")}let X=sa(n,na(n),M.id);if(X!==null)return{tier:Cn(X.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:Zn(r),basis:p("reachable-high"),path:oa(n,X.path),...l};if(F.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but unresolved edges exist`,unknownKind:_.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:p("unknown"),path:void 0,...I};let H=v(M.moduleId);return H!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:H.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(H))}:i.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}:j("call-path-confirmed")}function aa(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function la(e,n,t){let i=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let s=n.get(r.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(r.enclosingClassId!==void 0?i.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function da(e,n,t){if(n===t)return[];let i=new Map(e.functions.map(o=>[o.id,o])),r=new Map(e.callSites.map(o=>[o.id,o])),s=new Map;for(let o of e.callEdges){if(o.resolution!=="resolved"&&o.resolution!=="field-based")continue;let c=r.get(o.callSiteId);if(c===void 0)continue;let u=c.enclosingFunctionId;if(!i.has(u)||!i.has(o.calleeFunctionId))continue;let f=s.get(u),p={to:o.calleeFunctionId,label:o.resolution};f===void 0?s.set(u,[p]):f.push(p)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let o=0;o<l.length;o++){let c=l[o];for(let u of s.get(c.at)??[]){if(a.has(u.to))continue;let f=[...c.labels,u.label];if(u.to===t)return f;a.add(u.to),l.push({at:u.to,labels:f})}}return null}function Rn(e,n,t,i,r){if(r.length===0)return null;let s=Yn(e,n,t);if(s.length===0)return null;let a=la(e,n,i);for(let l of r){let o=s.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),c=o.find(u=>u.resolution==="resolved")??o[0];if(c!==void 0){if(aa(l.callee,i))return{tier:Cn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[c.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=da(e,l.callee.realFunctionId,a);if(u!==null)return{tier:Cn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[c.resolution,"modeled",...u]}}}}return null}var ar=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],lr=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function Zn(e){return e.verified?"gated":"candidate"}var Kt=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],Bt=["cupel","project"],$e={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function dr(e){return $e[e]}import{randomBytes as to}from"node:crypto";import{mkdirSync as io,readdirSync as lo,readFileSync as co,realpathSync as vt,renameSync as ro,statSync as wt,writeFileSync as so}from"node:fs";import Ze from"node:path";import{createRequire as ca}from"node:module";var ua=ca(import.meta.url);function fa(){try{return ua("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function pa(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Qn={open(e,n){let{DatabaseSync:t}=fa(),i=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?i.exec("PRAGMA query_only = ON;"):i.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>i.exec(r),prepare:r=>pa(i.prepare(r)),close:()=>i.close()}}};function ce(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function oe(e){return typeof e=="string"?e:null}function He(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var ma=`
+import{randomBytes as cl}from"node:crypto";import{readFileSync as ym,renameSync as xm,writeFileSync as ul}from"node:fs";import Sm from"node:path";import{fileURLToPath as bm}from"node:url";var pl=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Bn(e){if(!pl.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function mt(e,n){let t=e.split(".").map(Number),r=n.split(".").map(Number);for(let o=0;o<3;o+=1){let i=t[o]??0,a=r[o]??0;if(i!==a)return i<a?-1:1}return 0}var ir=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function bn(e,n){let t=Bn(e);return!(n.introduced!=="0"&&mt(t,Bn(n.introduced))<0||n.fixed!==void 0&&mt(t,Bn(n.fixed))>=0||n.lastAffected!==void 0&&mt(t,Bn(n.lastAffected))>0)}function ht(e,n,t){let r=new Map(e.functions.map(l=>[l.id,l])),o=new Map(e.classes.map(l=>[l.id,l.name])),i=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let s=i.get(l.callSiteId);if(s===void 0)continue;let d=r.get(s.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=r.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:l.resolution})}return a}function ml(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,r)=>t.analyzedVersion<r.analyzedVersion?1:t.analyzedVersion>r.analyzedVersion?-1:0)}function hl(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Bo(e,n,t,r,o,i){if(i<=0)return null;let a=null,l=s=>{(a===null||s.hops<a.hops)&&(a=s)};for(let s of ml(e,n))for(let d of s.edges){if(d.entryExport!==t||d.entryContainer!==r)continue;if(hl(d,o,s.packageName)){l({viaPackages:[],hops:d.hops,provenance:{tool:s.tool,toolVersion:s.toolVersion,analyzedVersion:s.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let u=Bo(e,d.target.calleePackage,d.target.calleeExport,null,o,i-1);u!==null&&l({viaPackages:[d.target.calleePackage,...u.viaPackages],hops:d.hops+u.hops,provenance:u.provenance})}return a}function sr(e,n,t,r,o,i){let a=null;for(let l of ht(e,n,t)){let s=Bo(o,l.packageName,l.exportName,l.container,r,i);s!==null&&(a===null||s.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:s.viaPackages,totalHops:s.hops,provenance:s.provenance})}return a}function zn(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Cn(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function ar(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let o=t.get(r.importId);if(o===void 0)continue;let i=n.get(o.moduleId)??[];i.push(r.resolvedModuleId),n.set(o.moduleId,i)}return n}function gl(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let o=t.get(r.importId);if(o===void 0)continue;let i=n.get(r.resolvedModuleId)??[];i.push(o.moduleId),n.set(r.resolvedModuleId,i)}return n}function Je(e){let n=ar(e),t=new Set,r=e.modules.filter(o=>o.isEntrypoint).map(o=>o.id);for(;r.length>0;){let o=r.pop();if(!(o===void 0||t.has(o))){t.add(o);for(let i of n.get(o)??[])t.has(i)||r.push(i)}}return t}function yl(e,n){let t=gl(e),r=new Set,o=[n];for(;o.length>0;){let i=o.pop();if(!(i===void 0||r.has(i))){r.add(i);for(let a of t.get(i)??[])r.has(a)||o.push(a)}}return r}function xl(e,n,t){let r=ar(e),o=Cn(e),i=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||i.has(l))continue;i.add(l);let s=o.get(l);if(s===void 0||s.externalSurface===!0||t.has(l))return!0;for(let d of r.get(l)??[])i.has(d)||a.push(d)}return!1}function Un(e,n,t,r=new Set){let o=ar(e),i=Cn(e),a=new Set,l=[],s=[n];for(;s.length>0;){let d=s.pop();if(d===void 0||a.has(d))continue;a.add(d);let u=i.get(d);if(u===void 0){l.push({module:d,kind:"absent"});continue}if(t.has(d)){l.push({module:d,kind:"unbounded"});continue}if(u.externalSurface===!0&&!r.has(d)){l.push({module:d,kind:"surface"});continue}for(let p of o.get(d)??[])a.has(p)||s.push(p)}return l}function Sl(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),r=Cn(e),o=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&o.set(a.id,a);let i=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=i.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let s=t.get(a.target.functionId);s===void 0||r.get(s.moduleId)?.externalSurface===!0||o.set(s.id,s)}return[...o.values()]}function Uo(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let o=e.slice(t+n.length).split("/"),i=o[0]?.startsWith("@")===!0?2:1;return o.slice(i).join("/")}function bl(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let r=t.symbolKind==="method"||t.symbolKind==="ctor",o=new Map(e.classes.map(i=>[i.id,i]));return e.functions.find(i=>{if(i.name!==t.exportName)return!1;let a=n.get(i.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(r){if(i.kind!==t.symbolKind||i.enclosingClassId===void 0||o.get(i.enclosingClassId)?.name!==t.container)return!1}else if(i.kind!=="function")return!1;return a.externalSurface===!0?!0:Uo(a.path)===t.sourcePath})}function zo(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&Uo(t.path)===n.sourcePath)}function kl(e,n,t,r){let o=new Map(e.functions.map(i=>[i.id,i]));return e.callSites.some(i=>i.calleeExprShape!=="member"||i.resolution!=="resolved"?!1:i.resolvedTargetIds.some(a=>{let l=o.get(a);if(l?.name!==r.exportName)return!1;let s=n.get(l.moduleId);return s?.externalSurface===!0&&s.packageName===r.packageName&&t.has(l.moduleId)}))}function El(e,n,t){return t.container===null?!0:e.classes.some(r=>{if(r.name!==t.container)return!1;let o=n.get(r.moduleId);return o!==void 0&&o.packageName===t.packageName&&o.externalSurface!==!0})}function wl(e,n,t){let r=new Map(e.callSites.map(s=>[s.id,s.enclosingFunctionId])),o=new Map;for(let s of e.callEdges){let d=r.get(s.callSiteId);if(d===void 0)continue;let u=o.get(d)??[];u.push({to:s.calleeFunctionId,res:s.resolution}),o.set(d,u)}let i=s=>{let d=new Set,u=n.map(p=>({id:p.id,prev:null}));for(let p of u)d.add(p.id);for(;u.length>0;){let p=u.shift();if(p===void 0)break;if(p.id===t){let f=[];for(let h=p;h!==null;h=h.prev)f.unshift(h.id);return f}for(let f of o.get(p.id)??[])f.res!=="unresolved"&&(f.res==="field-based"&&!s||d.has(f.to)||(d.add(f.to),u.push({id:f.to,prev:p})))}return null},a=i(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=i(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function lr(e){return Vo(e,Cn(e),Je(e),qo(e))}function Vo(e,n,t,r){let o=[],i=[],a=new Map(e.functions.map(s=>[s.id,s.moduleId])),l=s=>s!==void 0&&t.has(s)&&r.has(n.get(s)?.packageName??"");for(let s of e.callSites)s.resolution==="unresolved"&&l(a.get(s.enclosingFunctionId))&&o.push(s.range);for(let s of e.imports)!s.specifierIsLiteral&&t.has(s.moduleId)&&i.push({path:n.get(s.moduleId)?.path??"",start:0,end:0});return{dispatch:o,load:i}}function qo(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function vl(e,n){let t=new Map(e.functions.map(o=>[o.id,o])),r=Cn(e);return n.map(o=>{let i=t.get(o),a=i!==void 0?r.get(i.moduleId):void 0;return{functionId:o,functionName:i?.name,modulePath:a?.path??""}})}function dr(e){let{graph:n,installed:t,range:r,symbol:o,coverage:i}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},s=z=>({unresolvedSites:z,unresolvedEvidence:{own:z,sets:[]}}),d=qo(n),u=new Set;for(let z of e.incompleteness)z.reach.kind==="unbounded"&&u.add(z.source);let p=e.incompleteness.some(z=>z.reach.kind==="assumed-bounded")?"loader-assumption":"complete",f=z=>z==="not-reachable"?p:void 0,h=new Map,g=z=>{let q=h.get(z);return q===void 0&&(q=xl(n,z,u),h.set(z,q)),q},k=z=>z.reach.kind==="class-scope"&&o!==null&&o.packageName===z.reach.packageName&&o.container===z.reach.container,S=z=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let q of ir)for(let $ of e.incompleteness)if($.cause===q&&z($))return{cause:$.cause,source:$.source};return null},w=z=>{let q;return S($=>$.reach.kind==="unbounded"?!0:$.reach.kind==="class-scope"?k($):z===void 0||g($.reach.anchor)?!0:(q??=yl(n,z),q.has($.reach.anchor)))},v=()=>S(z=>z.reach.kind==="unbounded"?!0:z.reach.kind==="class-scope"?k(z):g(z.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${r.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let I;try{I=bn(t.version,r)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:f("unknown"),path:void 0,...l}}if(!I)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${r.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let C=Cn(n),E=Je(n),m=z=>{if(z.cause!=="dynamic-load"||z.source===null)return a;let q=C.get(z.source);return q===void 0?a:[{path:q.path,start:0,end:0}]},{dispatch:x,load:A}=Vo(n,C,E,d),O=[...x,...A],j={unresolvedSites:A,unresolvedEvidence:{own:a,sets:["load"]}},T={unresolvedSites:O,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},N=z=>{for(let q of E)if(C.get(q)?.packageName===z)return!0;return!1},L=z=>({tier:"unknown",decidedAtStage:z,reason:`${o?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:f("unknown"),path:void 0,...l}),R=()=>{if(!N(r.packageName)){if(A.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:f("unknown"),path:void 0,...j};let z=v();return z!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:z.cause,attribution:void 0,basis:f("unknown"),path:void 0,...s(m(z))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:f("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${r.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${r.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}}return null};if(o===null||!o.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:o===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:o===null?"db-gap":"unverified-symbol",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(i!==null&&!i.comparedPaths.has(o.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${o.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(o.symbolKind==="accessor"||o.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a ${o.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:f("unknown"),path:void 0,...T};let P=bl(n,C,o);if(P===void 0||!E.has(P.moduleId)){if(P===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&kl(n,C,E,o))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(P===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&!El(n,C,o))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a method of the dependency class ${o.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...T};let z=R();if(z!==null)return z;if(O.length>0){let W=P!==void 0?C.get(P.moduleId):zo(n,o),X=P===void 0&&W!==void 0&&W.externalSurface!==!0&&E.has(W.id)&&!d.has(W.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:A.length>0?"dynamic-load":X?"dep-opaque":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...T}}let q=P!==void 0?C.get(P.moduleId):zo(n,o);if(P===void 0&&q!==void 0&&q.externalSurface!==!0&&E.has(q.id)&&!d.has(q.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...l};let $=q!==void 0?w(q.id):v();return $!==null?{tier:"unknown",decidedAtStage:P===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:$.cause,attribution:void 0,basis:f("unknown"),path:void 0,...s(m($))}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:P===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:L(P===void 0?"symbol-reachable":"module-reachable")}let K=wl(n,Sl(n),P.id);if(K!==null)return{tier:zn(K.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${o.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:gt(o),basis:f("reachable-high"),path:vl(n,K.path),...l};if(O.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${o.exportName}, but unresolved edges exist`,unknownKind:A.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...T};let H=w(P.moduleId);return H!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${o.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:H.cause,attribution:void 0,basis:f("unknown"),path:void 0,...s(m(H))}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${o.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:L("call-path-confirmed")}function Il(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Al(e,n,t){let r=new Map(e.classes.map(o=>[o.id,o.name]));for(let o of e.functions){if(o.name!==t.exportName)continue;let i=n.get(o.moduleId);if(!(i===void 0||i.packageName!==t.packageName||(o.enclosingClassId!==void 0?r.get(o.enclosingClassId)??null:null)!==t.container))return o.id}return null}function _l(e,n,t){if(n===t)return[];let r=new Map(e.functions.map(s=>[s.id,s])),o=new Map(e.callSites.map(s=>[s.id,s])),i=new Map;for(let s of e.callEdges){if(s.resolution!=="resolved"&&s.resolution!=="field-based")continue;let d=o.get(s.callSiteId);if(d===void 0)continue;let u=d.enclosingFunctionId;if(!r.has(u)||!r.has(s.calleeFunctionId))continue;let p=i.get(u),f={to:s.calleeFunctionId,label:s.resolution};p===void 0?i.set(u,[f]):p.push(f)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let s=0;s<l.length;s++){let d=l[s];for(let u of i.get(d.at)??[]){if(a.has(u.to))continue;let p=[...d.labels,u.label];if(u.to===t)return p;a.add(u.to),l.push({at:u.to,labels:p})}}return null}function Vn(e,n,t,r,o){if(o.length===0)return null;let i=ht(e,n,t);if(i.length===0)return null;let a=Al(e,n,r);for(let l of o){let s=i.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),d=s.find(u=>u.resolution==="resolved")??s[0];if(d!==void 0){if(Il(l.callee,r))return{tier:zn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=_l(e,l.callee.realFunctionId,a);if(u!==null)return{tier:zn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled",...u]}}}}return null}var Wo=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Go=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function gt(e){return e.verified?"gated":"candidate"}var cr=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],ur=["cupel","project"],Fe={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Ho(e){return Fe[e]}import{randomBytes as ca}from"node:crypto";import{mkdirSync as ua,readdirSync as ga,readFileSync as kf,realpathSync as st,renameSync as fa,statSync as ho,writeFileSync as pa}from"node:fs";import nn from"node:path";import{createRequire as Nl}from"node:module";var Rl=Nl(import.meta.url);function Cl(){try{return Rl("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function Ol(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var yt={open(e,n){let{DatabaseSync:t}=Cl(),r=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?r.exec("PRAGMA query_only = ON;"):r.exec("PRAGMA journal_mode = DELETE;"),{exec:o=>r.exec(o),prepare:o=>Ol(r.prepare(o)),close:()=>r.close()}}};function be(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function he(e){return typeof e=="string"?e:null}function Ze(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var $l=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,ha=`
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Ml=`
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,ga=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
-                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,ya=5,xa=6;function Sa(e){let n=e>=xa?"a.details":"NULL AS details",t=e>=ya?"ap.surface_complete":ga;return`${ma}, ${n}, ${t}${ha}`}var ba="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",ka="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Ea="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function zt(e,n=Qn){let t=n.open(e,"readonly"),i=t.prepare(Ea).get(),r=i!==void 0?ce(i.value):"",s=/^\d+$/u.test(r)?Number(r):0,a=t.prepare(Sa(s)),l=t.prepare(ba),o=t.prepare(ka);return{schemaVersion:r,advisoriesForPackage(c,u){return a.all({eco:c,name:u}).map(f=>({affected:{id:He(f.ap_id)??0,advisoryId:ce(f.advisory_id),ecosystem:ce(f.ecosystem),packageName:ce(f.package_name),introduced:oe(f.introduced),fixed:oe(f.fixed),lastAffected:oe(f.last_affected),fixCommit:oe(f.fix_commit),repoUrl:oe(f.repo_url),surfaceComplete:He(f.surface_complete)===1?1:0},advisory:{id:ce(f.a_id),osvId:oe(f.osv_id),cveId:oe(f.cve_id),summary:oe(f.summary),details:oe(f.details),severity:oe(f.severity),published:oe(f.published),source:ce(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(c){return l.all({id:c}).map(u=>({id:He(u.id)??0,affectedPackageId:He(u.affected_package_id)??0,exportName:oe(u.export_name),symbolKind:ce(u.symbol_kind),matchPattern:oe(u.match_pattern),matchGlobs:oe(u.match_globs),container:oe(u.container),sourcePath:oe(u.source_path),declStart:He(u.decl_start),declEnd:He(u.decl_end),astHashBefore:oe(u.ast_hash_before),astHashAfter:oe(u.ast_hash_after),derivation:ce(u.derivation),confidence:ce(u.confidence),verified:He(u.verified)===1?1:0}))},aliasesForSymbol(c){return o.all({id:c}).map(u=>({id:He(u.id)??0,vulnerableSymbolId:He(u.vulnerable_symbol_id)??0,aliasPath:ce(u.alias_path),aliasName:ce(u.alias_name)}))},allModels(){let c;try{c=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Dl=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
+                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Tl=5,Pl=6;function Ll(e){let n=e>=Pl?"a.details":"NULL AS details",t=e>=Tl?"ap.surface_complete":Dl;return`${$l}, ${n}, ${t}${Ml}`}var Fl="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",jl="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Kl="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function fr(e,n=yt){let t=n.open(e,"readonly"),r=t.prepare(Kl).get(),o=r!==void 0?be(r.value):"",i=/^\d+$/u.test(o)?Number(o):0,a=t.prepare(Ll(i)),l=t.prepare(Fl),s=t.prepare(jl);return{schemaVersion:o,advisoriesForPackage(d,u){return a.all({eco:d,name:u}).map(p=>({affected:{id:Ze(p.ap_id)??0,advisoryId:be(p.advisory_id),ecosystem:be(p.ecosystem),packageName:be(p.package_name),introduced:he(p.introduced),fixed:he(p.fixed),lastAffected:he(p.last_affected),fixCommit:he(p.fix_commit),repoUrl:he(p.repo_url),surfaceComplete:Ze(p.surface_complete)===1?1:0},advisory:{id:be(p.a_id),osvId:he(p.osv_id),cveId:he(p.cve_id),summary:he(p.summary),details:he(p.details),severity:he(p.severity),published:he(p.published),source:be(p.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(d){return l.all({id:d}).map(u=>({id:Ze(u.id)??0,affectedPackageId:Ze(u.affected_package_id)??0,exportName:he(u.export_name),symbolKind:be(u.symbol_kind),matchPattern:he(u.match_pattern),matchGlobs:he(u.match_globs),container:he(u.container),sourcePath:he(u.source_path),declStart:Ze(u.decl_start),declEnd:Ze(u.decl_end),astHashBefore:he(u.ast_hash_before),astHashAfter:he(u.ast_hash_after),derivation:be(u.derivation),confidence:be(u.confidence),verified:Ze(u.verified)===1?1:0}))},aliasesForSymbol(d){return s.all({id:d}).map(u=>({id:Ze(u.id)??0,vulnerableSymbolId:Ze(u.vulnerable_symbol_id)??0,aliasPath:be(u.alias_path),aliasName:be(u.alias_name)}))},allModels(){let d;try{d=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
                FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let u=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return c.map(f=>{let p=He(f.id)??0;return{packageName:ce(f.package_name),modelId:ce(f.evidence_ref),introduced:ce(f.introduced),fixedBefore:oe(f.fixed_before),evidenceRef:ce(f.evidence_ref),edges:u.all({id:p}).map(h=>({kind:ce(h.kind),anchorExport:ce(h.anchor_export),anchorContainer:oe(h.anchor_container),calleePackage:ce(h.callee_package),calleeContainer:oe(h.callee_container),calleeExport:ce(h.callee_export)}))}})},close(){t.close()}}}var pn="6";import{realpathSync as jn}from"node:fs";import nn from"node:path";import{realpathSync as gn}from"node:fs";import{isBuiltin as sl}from"node:module";import Se from"node:path";import g from"typescript";function Ut(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function ue(e){let n=Ut(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function We(e){let n=Ut(e);if(n.startsWith("@")){let i=n.indexOf("/");if(i===-1)return n;let r=n.indexOf("/",i+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function cr(e){let n=Ut(e),t=We(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as _a,statSync as Vt}from"node:fs";var sn=16*1024*1024;function En(e,n){try{let t=Vt(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:_a(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function _e(e){let n=En(e,sn);return n.kind==="ok"?n.text:null}function Ge(e){try{return Vt(e).isFile()}catch{return!1}}function ur(e){try{let n=Vt(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Na,realpathSync as Wt}from"node:fs";import ee from"node:path";import et from"typescript";var yr=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Be(e){return yr.some(([n])=>e.endsWith(n))}function Ca(e){for(let[n,t]of yr)if(e.endsWith(n)){let i=e.slice(0,-n.length);return t.map(r=>i+r)}return[]}var Oa=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function Ra(e){if(Be(e))return e;for(let[n,t]of Oa)if(e.endsWith(n)){let i=e.slice(0,-n.length);for(let r of t){let s=i+r;if(Ge(s))return s}return e}return e}var $a=[et.ModuleKind.CommonJS,et.ModuleKind.ESNext],Ma=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function xr(e,n,t,i,r,s){let a=et.resolveModuleName(e,n,t,i,void 0,void 0,r).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(s){for(let o of Ca(l))if(Ge(o))return o}return l}var Sr=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],Pa=[".js",".json",".node"],La=["index.js","index.json","index.node"];function nt(e){return!Be(e)&&Sr.some(n=>e.endsWith(n))}function br(e){if(Ge(e))return e;for(let n of Pa)if(Ge(e+n))return e+n;return null}function fr(e){for(let n of La){let t=ee.join(e,n);if(Ge(t))return t}return null}var kr=[".ts",".tsx",".cts",".mts",".jsx"];function Ta(e){for(let n of kr)if(Ge(e+n))return e+n;return null}function Da(e){for(let n of kr){let t=ee.join(e,"index"+n);if(Ge(t))return t}return null}function Er(e){let n=_e(ee.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let i=ee.join(e,t),r=br(i)??fr(i);if(r!==null)return r}}catch{}return fr(e)}function wr(e){return br(e)??Er(e)??Ta(e)??Da(e)}function vr(e){return wr(e)!==null}function Fa(e,n){let t=e.split(ee.sep),i=n.split("/"),r=null;for(let a=t.length-i.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&i.every((l,o)=>t[a+1+o]===l)){r=t.slice(0,a+1+i.length).join(ee.sep);break}if(r===null||r==="")return null;let s=_e(ee.join(r,"package.json"));if(s===null)return null;try{let a=JSON.parse(s),l=a.exports,o=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||o)return null}catch{return null}try{return Wt(r)}catch{return null}}function ja(e,n){let t=wr(ee.join(e,n));if(t===null)return null;let i;try{i=Wt(t)}catch{return null}let r=e.endsWith(ee.sep)?e:e+ee.sep;return i!==e&&!i.startsWith(r)||Be(i)||!Sr.some(s=>i.endsWith(s))?null:i}function Ka(e,n){let t=cr(e);return t===""||t.includes("\0")||t.split("/").some(i=>i===""||i==="."||i===".."||i==="node_modules")?null:ja(n,t)}var mn={kind:"nothing-loads"},qt=8192;function Ht(e,n){let t=n.get(e);if(t!==void 0)return t;let i,r=null;try{r=Na(e);let s=new Set,a=!1;for(;;){let l=r.readSync();if(l===null)break;if(s.size>=qt){a=!0;break}s.add(l.name)}i={names:s,truncated:a}}catch{i=null}finally{try{r?.closeSync()}catch{}}return n.set(e,i),i}var Ba=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function Ir(e){return Ba.some(n=>e.length>n.length&&e.endsWith(n))}function $n(e,n){let t=e.endsWith(ee.sep)?e:e+ee.sep;return n===e||n.startsWith(t)}function pr(e,n){let t;try{t=Wt(n)}catch{return{kind:"missing"}}return $n(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function mr(e,n){let t=(n+".").toLowerCase(),i=[];for(let r of e){let s=r.toLowerCase();s.length>t.length&&s.startsWith(t)&&i.push(r)}return i}function za(e,n,t){let i=ee.dirname(n);if(!$n(e,i))return null;let r=Ht(i,t);if(r===null)return null;let s=ee.basename(n);return r.names.has(s)?s:null}function hr(e,n){let t=e.filter(r=>!Ir(r));if(t.length===0)return mn;let i=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${i}") the analyzer cannot parse`}}function Ar(e,n,t,i){let r=e,s=r.indexOf("?");s!==-1&&(r=r.slice(0,s));let a=r.indexOf("#");if(a!==-1&&(r=r.slice(0,a)),r===""||r.includes("\0"))return mn;let l=ee.resolve(ee.dirname(n),r);if(!$n(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed"};let o=pr(t,l);if(o.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed"};if(o.kind==="ok"){let h=ur(o.real);if(h==="file"){let y=za(t,o.real,i);return y!==null&&Ir(y)?mn:{kind:"unanalyzable",reason:y===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${y}") the analyzer cannot parse`}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file"};let S=Ht(o.real,i);if(S===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let x=hr(mr(S.names,"index"),"a directory index");return x.kind==="unanalyzable"?x:S.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve"}:S.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(qt)} entries and was not fully probed`}:mn}let c=ee.basename(l);if(c===""||c==="."||c==="..")return mn;let u=pr(t,ee.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed"};if(u.kind==="missing")return mn;let f=Ht(u.real,i);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let p=hr(mr(f.names,c),"a sibling file exists");return p.kind==="unanalyzable"?p:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(qt)} entries and was not fully probed`}:mn}function Ua(e,n){let t=We(e),i=ee.dirname(n);for(let r=0;r<64;r+=1){let s=ee.join(i,"node_modules",...t.split("/"));if(_e(ee.join(s,"package.json"))!==null)return s;let a=ee.dirname(i);if(a===i)return null;i=a}return null}function gr(e,n,t,i,r){let s;for(let a of $a)for(let l of Ma){let o={...t,noDtsResolution:!0,customConditions:[...l]},c=xr(e,n,o,i,a,r);if(s===void 0)s=c;else if(s!==c)return null}return s??null}function Te(e,n,t,i){let r=ue(e);if(r==="relative")return xr(e,n,t,i,void 0,!0);if(r==="package-root"){let l=gr(e,n,t,i,!0);if(l!==null)return l;let o=Ua(e,n);if(o===null||_e(ee.join(o,"package.json"))?.includes('"exports"')===!0)return null;let c=Er(o);return c===null||Be(c)?null:$n(o,c)?c:null}let s=gr(e,n,t,i,!1);if(s===null)return null;let a=Fa(s,We(e));return a!==null?Ka(e,a):Be(s)?s:Ra(s)}function _r(e,n,t){let i=_e(ee.join(e,"tsconfig.json"));if(i===null)return()=>null;let r=et.parseConfigFileTextToJson(ee.join(e,"tsconfig.json"),i);if(r.error!==void 0)return()=>null;let s=r.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let a=s.paths;if(typeof a!="object"||a===null)return()=>null;let l=s.baseUrl,o=typeof l=="string"?ee.resolve(e,l):e,c=new Map,u=[];for(let[p,h]of Object.entries(a)){if(!Array.isArray(h))continue;let S=h.filter(y=>typeof y=="string");if(S.length===0)continue;let x=p.indexOf("*");x===-1?c.set(p,S):p.indexOf("*",x+1)===-1&&u.push({prefix:p.slice(0,x),suffix:p.slice(x+1),targets:S})}if(u.sort((p,h)=>h.prefix.length-p.prefix.length),c.size===0&&u.length===0)return()=>null;let f=p=>{let h=c.get(p);if(h!==void 0)return h;for(let S of u){if(p.length<S.prefix.length+S.suffix.length||!p.startsWith(S.prefix)||!p.endsWith(S.suffix))continue;let x=p.slice(S.prefix.length,p.length-S.suffix.length);return S.targets.map(y=>{let v=y.indexOf("*");return v===-1?y:y.slice(0,v)+x+y.slice(v+1)})}return[]};return(p,h)=>{let S=f(p);if(S.length===0||Te(p,h,n,t)!==null)return null;for(let x of S){let y=ee.resolve(o,x),v=ee.relative(ee.dirname(h),y).split(ee.sep).join("/");if(v==="")continue;v.startsWith(".")||(v=`./${v}`);let C=Te(v,h,n,t);if(C!==null&&$n(e,C))return C}return null}}import{readdirSync as Va,realpathSync as qa}from"node:fs";import Qe from"node:path";import T from"typescript";function Mn(e,n){if(T.isIdentifier(e))n.add(e.text);else for(let t of e.elements)T.isBindingElement(t)&&Mn(t.name,n)}function wn(e){let n=new Map,t=new Set,i=o=>{n.set(o,(n.get(o)??0)+1)},r=o=>{let c=Ne(o);if(T.isIdentifier(c))t.add(c.text);else if(T.isArrayLiteralExpression(c))for(let u of c.elements)r(u);else if(T.isObjectLiteralExpression(c))for(let u of c.properties)T.isShorthandPropertyAssignment(u)?t.add(u.name.text):T.isPropertyAssignment(u)?r(u.initializer):T.isSpreadAssignment(u)&&r(u.expression);else T.isSpreadElement(c)?r(c.expression):T.isBinaryExpression(c)&&c.operatorToken.kind===T.SyntaxKind.EqualsToken&&r(c.left)},s=o=>{let c=new Set;Mn(o,c);for(let u of c)i(u)},a=o=>{T.isVariableDeclaration(o)?s(o.name):T.isFunctionDeclaration(o)&&o.name!==void 0||T.isClassDeclaration(o)&&o.name!==void 0?i(o.name.text):T.isParameter(o)?s(o.name):((T.isFunctionExpression(o)||T.isClassExpression(o))&&o.name!==void 0&&T.isIdentifier(o.name)&&!(o.parent!==void 0&&T.isVariableDeclaration(o.parent)&&o.parent.initializer===o&&T.isIdentifier(o.parent.name)&&o.parent.name.text===o.name.text)||T.isImportClause(o)&&o.name!==void 0||T.isNamespaceImport(o)||T.isImportSpecifier(o)||T.isImportEqualsDeclaration(o))&&i(o.name.text),T.isBinaryExpression(o)&&o.operatorToken.kind>=T.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=T.SyntaxKind.LastAssignment?r(o.left):(T.isPrefixUnaryExpression(o)||T.isPostfixUnaryExpression(o))&&(o.operator===T.SyntaxKind.PlusPlusToken||o.operator===T.SyntaxKind.MinusMinusToken)?r(o.operand):(T.isForOfStatement(o)||T.isForInStatement(o))&&!T.isVariableDeclarationList(o.initializer)&&r(o.initializer),T.forEachChild(o,a)};a(e);let l=new Set(t);for(let[o,c]of n)c>1&&l.add(o);return l}function hn(e,n,t){let i=wn(e),r=new Map,s=a=>{T.isVariableDeclaration(a)&&T.isIdentifier(a.name)&&a.initializer!==void 0&&!i.has(a.name.text)&&!r.has(a.name.text)&&r.set(a.name.text,a.initializer),T.forEachChild(a,s)};return s(e),{containingFile:n,taintedNames:i,constBindings:r,resolveParamDirs:t}}var Ha=1024,Wa=32,Ga=new Set(["filter","sort","slice","reverse"]),Xa=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ne(e){let n=e;for(;T.isParenthesizedExpression(n);)n=n.expression;return n}function Nr(e,n){return T.isPropertyAccessExpression(e)&&T.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function on(e,n,t,i){if(t>Wa)return null;let r=Ne(e);if(T.isStringLiteralLike(r))return r.text;if(T.isTemplateExpression(r)){let s=r.head.text;for(let a of r.templateSpans){let l=on(a.expression,n,t+1,i);if(l===null)return null;s+=l+a.literal.text}return s}if(T.isBinaryExpression(r)&&r.operatorToken.kind===T.SyntaxKind.PlusToken){let s=on(r.left,n,t+1,i);if(s===null)return null;let a=on(r.right,n,t+1,i);return a===null?null:s+a}if(T.isIdentifier(r)){if(r.text==="__dirname")return Qe.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||i.has(r.text))return null;let s=n.constBindings.get(r.text);if(s===void 0)return null;i.add(r.text);let a=on(s,n,t+1,i);return i.delete(r.text),a}if(T.isCallExpression(r)){let s=Nr(r.expression,"join"),a=Nr(r.expression,"resolve");if(!s&&!a)return null;let l=[];for(let c of r.arguments){let u=on(c,n,t+1,i);if(u===null)return null;l.push(u)}let o=l[0];return o===void 0||a&&!Qe.isAbsolute(o)?null:a?Qe.resolve(...l):Qe.join(...l)}return null}function tt(e){let n=Ne(e);if(T.isBinaryExpression(n)&&n.operatorToken.kind===T.SyntaxKind.PlusToken)return[...tt(n.left),...tt(n.right)];if(T.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let i of n.templateSpans)t.push({expr:i.expression}),i.literal.text.length>0&&t.push({lit:i.literal.text});return t}return T.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Rr(e){let n=e,t=0;for(;t++<4096;){let i=n.parent;if(i===void 0)return null;if(T.isForOfStatement(i)&&i.statement===n){let r=i.initializer;if(T.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&T.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let s=Cr(i.expression);if(s!==null)return s}}if((T.isArrowFunction(n)||T.isFunctionExpression(n))&&T.isCallExpression(i)&&i.arguments.length>0&&i.arguments[0]===n&&T.isPropertyAccessExpression(i.expression)&&Xa.has(i.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&T.isIdentifier(r.name)&&r.name.text===e.text){let s=Cr(i.expression.expression);if(s!==null)return s}}n=i}return null}function Cr(e){let n=Ne(e),t=0;for(;T.isCallExpression(n)&&t++<16;){let i=n.expression;if(T.isPropertyAccessExpression(i)){let r=i.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(Ga.has(r)){n=Ne(i.expression);continue}return null}return T.isIdentifier(i)&&i.text==="readdirSync"?n.arguments[0]??null:null}return null}function Ja(e,n){let t=tt(e);if(t.length<2)return null;let i=t[t.length-1];if(i===void 0||!("expr"in i)||!T.isIdentifier(i.expr))return null;let r=i.expr;if(n.taintedNames.has(r.text))return null;let s="";for(let c=0;c<t.length-1;c+=1){let u=t[c];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let f=on(u.expr,n,0,new Set);if(f===null)return null;s+=f}}let a=Rr(r),l=a===null?null:on(a,n,0,new Set);if(l===null)return null;let o=Qe.resolve(s);return o!==Qe.resolve(l)?null:o}function Ya(e){if((T.isFunctionDeclaration(e)||T.isFunctionExpression(e))&&e.name!==void 0&&T.isIdentifier(e.name)||T.isMethodDeclaration(e)&&T.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&T.isVariableDeclaration(n)&&T.isIdentifier(n.name)?n.name.text:null}function Za(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!T.isFunctionLike(t))continue;let i=-1;for(let s=0;s<t.parameters.length;s+=1){let a=t.parameters[s];if(a!==void 0&&T.isIdentifier(a.name)&&a.name.text===n){i=s;break}}if(i<0)continue;let r=Ya(t);return r===null?null:{fnName:r,paramIndex:i}}return null}function Pn(e,n){let t=tt(e);if(t.length!==2)return null;let[i,r]=t;if(i===void 0||!("expr"in i)||!T.isIdentifier(i.expr)||r===void 0||!("expr"in r)||!T.isIdentifier(r.expr))return null;let s=i.expr,a=r.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(a.text))return null;let l=Rr(a);return l===null||!T.isIdentifier(l)||l.text!==s.text?null:Za(s,s.text)}function Qa(e,n){if(n.resolveParamDirs===void 0)return null;let t=Pn(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function it(e){for(let n=e.parent;n!==void 0;n=n.parent){if(T.isSourceFile(n))return!0;if(!T.isArrowFunction(n)&&T.isFunctionLike(n))return!1}return!0}function Gt(e,n){let t=on(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let i=Ja(e,n);if(i!==null)return{kind:"dir",dir:i};let r=Qa(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function $r(e,n){let t;try{t=qa(e)}catch{return null}let i=n.endsWith(Qe.sep)?n:n+Qe.sep;return t===n||t.startsWith(i)?t:null}function Mr(e,n,t,i,r){let s=Te(e,n,i,r);return s===null||Be(s)||!nt(s)?null:$r(s,t)}function Or(e,n,t,i,r){let s=$r(e,t);if(s===null)return[];let a;try{a=Va(s)}catch{return[]}if(a.length===0||a.length>Ha)return[];a.sort();let l=new Set,o=[];for(let c of a){let u=Mr(Qe.join(s,c),n,t,i,r);u!==null&&!l.has(u)&&(l.add(u),o.push(u))}return o}function rt(e,n,t,i,r){let s=Gt(e,n);if(s.kind==="const"){if(ue(s.value)==="package-root")return[];let a=Mr(s.value,n.containingFile,t,i,r);return a===null?[]:[a]}if(s.kind==="dir")return Or(s.dir,n.containingFile,t,i,r);if(s.kind==="dirs"){let a=new Set,l=[];for(let o of s.dirs)for(let c of Or(o,n.containingFile,t,i,r))a.has(c)||(a.add(c),l.push(c));return l}return[]}import el from"node:path";import ne from"typescript";var nl=32,st="\0",Pr=(e,n)=>`${e}${st}${n}`,Lr=(e,n,t)=>`${e}${st}${n}${st}${String(t)}`;function tl(e){let n=new Map,t=new Set,i=(r,s)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,s)};for(let r of e.statements)if(ne.isImportDeclaration(r)&&ne.isStringLiteralLike(r.moduleSpecifier)){let s=r.moduleSpecifier.text,a=r.importClause;if(a===void 0)continue;a.name!==void 0&&i(a.name.text,{kind:"module",specifier:s});let l=a.namedBindings;if(l!==void 0&&ne.isNamespaceImport(l))i(l.name.text,{kind:"module",specifier:s});else if(l!==void 0&&ne.isNamedImports(l))for(let o of l.elements)i(o.name.text,{kind:"named",specifier:s,imported:(o.propertyName??o.name).text})}else if(ne.isImportEqualsDeclaration(r)&&ne.isExternalModuleReference(r.moduleReference)&&ne.isStringLiteralLike(r.moduleReference.expression))i(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(ne.isFunctionDeclaration(r)&&r.name!==void 0)i(r.name.text,{kind:"local"});else if(ne.isVariableStatement(r))for(let s of r.declarationList.declarations){if(s.initializer===void 0)continue;let a=s.initializer;if(ne.isIdentifier(s.name))ne.isArrowFunction(a)||ne.isFunctionExpression(a)?i(s.name.text,{kind:"local"}):Tr(a)&&i(s.name.text,{kind:"module",specifier:Dr(a)});else if(ne.isObjectBindingPattern(s.name)&&Tr(a)){let l=Dr(a);for(let o of s.name.elements){if(o.dotDotDotToken!==void 0||!ne.isIdentifier(o.name))continue;let c=o.propertyName??o.name;!ne.isIdentifier(c)&&!ne.isStringLiteralLike(c)||i(o.name.text,{kind:"named",specifier:l,imported:c.text})}}}return n}function Tr(e){return ne.isCallExpression(e)&&ne.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&ne.isStringLiteralLike(e.arguments[0])}function Dr(e){let n=e.arguments[0];return n!==void 0&&ne.isStringLiteralLike(n)?n.text:"\0"}function il(e){let n=e.expression;if(ne.isPropertyAccessExpression(n))return n.name.text;if(ne.isIdentifier(n))return n.text}function rl(e,n,t,i,r,s){let a=e.expression,l=o=>{let c=`${o}${st}${n}`,u=s.get(c);if(u!==void 0||s.has(c))return u??null;let f=Te(o,n,i,r),p=f===null?null:el.resolve(f);return s.set(c,p),p};if(ne.isPropertyAccessExpression(a)&&ne.isIdentifier(a.expression)){let o=t.get(a.expression.text);if(o?.kind==="module"){let c=l(o.specifier);return c===null?null:{moduleReal:c,fnName:a.name.text}}return null}if(ne.isIdentifier(a)){let o=t.get(a.text);if(o?.kind==="named"){let c=l(o.specifier);return c===null?null:{moduleReal:c,fnName:o.imported}}return o?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function Fr(e,n,t,i,r=new Map){if(n.length===0)return()=>null;let s=new Map,a=new Set;for(let o of n){let c=Pr(o.definingModuleReal,o.fnName),u=s.get(c);u===void 0&&(u=new Set,s.set(c,u)),u.add(o.paramIndex),a.add(o.fnName)}let l=new Map;for(let o of e){let c=hn(o.sf,o.real),u=tl(o.sf),f=p=>{if(ne.isCallExpression(p)){let h=il(p);if(h!==void 0&&a.has(h)&&it(p)){let S=rl(p,o.real,u,t,i,r);if(S!==null){let x=s.get(Pr(S.moduleReal,S.fnName));if(x!==void 0)for(let y of x){let v=p.arguments[y];if(v===void 0)continue;let C=Gt(v,c);if(C.kind==="const"){let $=Lr(S.moduleReal,S.fnName,y),N=l.get($);N===void 0&&(N=new Set,l.set($,N)),N.add(C.value)}}}}}ne.forEachChild(p,f)};f(o.sf)}return(o,c,u)=>{let f=l.get(Lr(o,c,u));return f===void 0||f.size===0||f.size>nl?null:[...f].sort()}}var Xe={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:g.ScriptTarget.ES2020,module:g.ModuleKind.CommonJS,moduleResolution:g.ModuleResolutionKind.Node10,types:[]},ot=5e3;function Je(e,n){let t;try{t=gn(n)}catch{t=Se.resolve(n)}let i=e.endsWith(Se.sep)?e:e+Se.sep;return t!==e&&!t.startsWith(i)?null:t===e?"":t.slice(i.length).split(Se.sep).join("/")}function le(e){let n=e;for(;;)if(g.isParenthesizedExpression(n))n=n.expression;else if(g.isBinaryExpression(n)&&n.operatorToken.kind===g.SyntaxKind.CommaToken)n=n.right;else return n}function en(e){return g.isPropertyAccessExpression(e)?{receiver:le(e.expression),name:e.name.text}:g.isElementAccessExpression(e)&&g.isStringLiteralLike(e.argumentExpression)?{receiver:le(e.expression),name:e.argumentExpression.text}:null}function Dn(e){let n=le(e.expression);if(g.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===g.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=en(n);if(t!==null){if(t.name==="require"&&g.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(g.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let i=e.arguments[1];return{specifierArg:i!==void 0&&g.isArrayLiteralExpression(i)?i.elements[0]:void 0}}}}return null}function jr(e){let n=[],t=i=>{if(g.isImportDeclaration(i)&&g.isStringLiteralLike(i.moduleSpecifier))n.push({text:i.moduleSpecifier.text,runtime:i.importClause?.isTypeOnly!==!0});else if(g.isImportEqualsDeclaration(i)&&g.isExternalModuleReference(i.moduleReference)&&g.isStringLiteralLike(i.moduleReference.expression))n.push({text:i.moduleReference.expression.text,runtime:!0});else if(g.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&g.isStringLiteralLike(i.moduleSpecifier))n.push({text:i.moduleSpecifier.text,runtime:i.isTypeOnly!==!0});else if(g.isCallExpression(i)){let r=Dn(i),s=r?.specifierArg;r!==null&&s!==void 0&&g.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}g.forEachChild(i,t)};return t(e),n}function ol(e,n){let t=n===g.ScriptKind.TSX?"__scriptkind_probe.tsx":n===g.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",i=g.createSourceFile(t,e,g.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:a=>a===t?i:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return g.createProgram({rootNames:[t],options:r,host:s}).getSyntacticDiagnostics(i).length}function Qt(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Kr(e){let n=0,t=i=>{(g.isCallExpression(i)||g.isNewExpression(i)||g.isTaggedTemplateExpression(i))&&(n+=1),g.forEachChild(i,t)};return t(e),n}function Ur(e,n){let t=jr(g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0));if(!Qt(e)||!n.includes("<")||!n.includes("require"))return t;let i=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX),r=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of jr(i)){let a=`${s.runtime?"R":"T"}:${s.text}`;r.has(a)||(r.add(a),t.push(s))}return t}function Br(e,n,t,i,r){if(!n.includes("require")&&!n.includes("import("))return[];let s=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0),a=hn(s,e,r),l=[],o=new Set;return Vr(s,c=>{for(let u of rt(c,a,t,Xe,i))o.has(u)||(o.add(u),l.push(u))}),l}function Vr(e,n){let t=i=>{if(g.isCallExpression(i)){let r=Dn(i),s=r?.specifierArg;r!==null&&s!==void 0&&!g.isStringLiteralLike(s)&&n(s)}g.forEachChild(i,t)};t(e)}function al(e){let n=[];for(let t of e){let i=hn(t.sf,t.real);Vr(t.sf,r=>{let s=Pn(r,i);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var ll=4,Xt=ot,Jt=new Set(["eval","Function","createRequire"]),dl=new Set(["require","eval","Function","createRequire"]),dt=new Set(["module","Module","require","process","global","globalThis"]),ct=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function cl(e){return e===g.SyntaxKind.LessThanToken||e===g.SyntaxKind.GreaterThanToken||e===g.SyntaxKind.LessThanEqualsToken||e===g.SyntaxKind.GreaterThanEqualsToken||e===g.SyntaxKind.EqualsEqualsToken||e===g.SyntaxKind.EqualsEqualsEqualsToken||e===g.SyntaxKind.ExclamationEqualsToken||e===g.SyntaxKind.ExclamationEqualsEqualsToken||e===g.SyntaxKind.InstanceOfKeyword||e===g.SyntaxKind.InKeyword}function ul(e){let n=e.parent;return(g.isParameter(n)||g.isVariableDeclaration(n)||g.isBindingElement(n)||g.isFunctionDeclaration(n)||g.isFunctionExpression(n)||g.isClassDeclaration(n)||g.isClassExpression(n)||g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isMethodDeclaration(n))&&n.name===e?!0:g.isPropertyAccessExpression(n)&&n.name===e}function fl(e,n){return g.isCallExpression(n)&&n.expression===e||(g.isPropertyAccessExpression(n)||g.isElementAccessExpression(n))&&n.expression===e||g.isTypeOfExpression(n)||g.isVoidExpression(n)||g.isDeleteExpression(n)||g.isPrefixUnaryExpression(n)||g.isPostfixUnaryExpression(n)?!0:g.isBinaryExpression(n)&&cl(n.operatorToken.kind)}function qr(e){let n=e,t=e.parent;for(;;)if(g.isParenthesizedExpression(t))n=t,t=t.parent;else if(g.isBinaryExpression(t)&&t.operatorToken.kind===g.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!fl(n,t)}function pl(e){return ul(e)?!1:qr(e)}function Hr(e){let n=en(e);if(n!==null&&ct.has(n.name))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=le(e.expression);if(g.isIdentifier(t)&&dt.has(t.text))return!0}return!1}function Ln(e){let n=en(e);if(n===null||n.name!=="constructor")return!1;let t=en(n.receiver);return t!==null&&t.name==="constructor"}function Wr(e){if(!g.isCallExpression(e))return!1;let n=le(e.expression);if(!g.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&g.isStringLiteralLike(t)&&t.text==="module"}var ml={roots:new Map,nodes:new Set,saturated:!1};function Gr(e){return g.isSourceFile(e)||g.isFunctionDeclaration(e)||g.isFunctionExpression(e)||g.isArrowFunction(e)||g.isMethodDeclaration(e)||g.isConstructorDeclaration(e)||g.isGetAccessorDeclaration(e)||g.isSetAccessorDeclaration(e)||g.isClassStaticBlockDeclaration(e)||g.isModuleDeclaration(e)}function Xr(e,n){let t=e.parent;for(;t!==void 0;){if(Gr(t))return t;t=t.parent}return n}function hl(e){let n=new Set;if(g.isFunctionLike(e))for(let i of e.parameters)for(let r of Tn(i.name))n.add(r);let t=[e];for(;t.length>0;){let i=t.pop();if(i===void 0)break;if(!(i!==e&&Gr(i))){if(g.isVariableDeclaration(i)&&g.isVariableDeclarationList(i.parent)&&!((i.parent.flags&g.NodeFlags.BlockScoped)!==0))for(let s of Tn(i.name))n.add(s);g.forEachChild(i,r=>{t.push(r)})}}return n}function gl(e,n,t){let i=Xr(e,n);if(g.isSourceFile(i))return n;let r=t.get(i);return r===void 0&&(r=hl(i),t.set(i,r)),r.has(e.text)?i:n}function at(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let i=n;for(;;){if(t.has(i))return!0;let r=i.parent;if(r===void 0)return!g.isSourceFile(i);i=r}}var yl=12,xl=8;function lt(e,n){let t=le(e);for(;;){if(n.nodes.has(t))return!0;if(g.isIdentifier(t))return dt.has(t.text)||at(n,t);if(g.isCallExpression(t))return Wr(t);let i=en(t);if(i!==null){if(i.name==="constructor")return!0;t=i.receiver;continue}if(g.isElementAccessExpression(t)){t=le(t.expression);continue}return!1}}function Jr(e){let n=en(le(e.expression));if(n===null||n.name!=="get"||!g.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function Sl(e,n){let t=Jr(e);if(t===null||!lt(t.target,n))return!1;let i=t.key;return i===void 0||!g.isStringLiteralLike(i)?!0:ct.has(i.text)}function Yt(e){if(!g.isFunctionExpression(e)&&!g.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,i=r=>{if(!(t||g.isFunctionExpression(r)||g.isFunctionDeclaration(r)||g.isClassLike(r))){if(g.isReturnStatement(r)&&r.expression!==void 0&&le(r.expression).kind===g.SyntaxKind.ThisKeyword){t=!0;return}g.forEachChild(r,i)}};return i(n),t}function Tn(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isOmittedExpression(t)||n.push(...Tn(t.name));return n}function Yr(e){return e.parameters.map(n=>Tn(n.name))}function bl(e){let n=new Map,t=new Set,i=(s,a)=>{let l={fn:a,slots:Yr(a)},o=n.get(s);o===void 0?n.set(s,[l]):o.push(l),Yt(a)&&t.add(s)},r=s=>{if(g.isFunctionDeclaration(s)&&s.name!==void 0)i(s.name.text,s);else if(g.isVariableDeclaration(s)&&g.isIdentifier(s.name)&&s.initializer!==void 0){let a=le(s.initializer);(g.isFunctionExpression(a)||g.isArrowFunction(a))&&i(s.name.text,a)}g.forEachChild(s,r)};return r(e),{params:n,thisReturning:t}}function kl(e){let n=new Map,t=new Set,i={roots:n,nodes:t},r=bl(e),s=new Map,a=new Set(r.thisReturning),l=!0;for(let o=0;l;o+=1){if(o>=yl)return{roots:n,nodes:t,saturated:!0};l=!1;let c=(x,y)=>{y!==""&&!x.has(y)&&(x.add(y),l=!0)},u=(x,y)=>{if(x==="")return;let v=n.get(x);v===void 0&&(v=new Set,n.set(x,v)),v.has(y)||(v.add(y),l=!0)},f=x=>{t.has(x)||(t.add(x),l=!0)},p=(x,y)=>{let v=le(x.expression);if(g.isIdentifier(v)&&Jt.has(v.text)||Ln(v)||g.isCallExpression(x)&&Wr(x)||Yt(v))return!0;let C=en(v);if(C!==null&&(C.name==="call"||C.name==="apply"||C.name==="bind")){let $=C.receiver;if(Yt($)||t.has($)||g.isIdentifier($)&&(at(i,$)||a.has($.text)))return!0}if(t.has(v)||(g.isCallExpression(v)||g.isNewExpression(v))&&p(v,y+1)||g.isIdentifier(v)&&(at(i,v)||a.has(v.text)))return!0;if(g.isCallExpression(x)){let $=Jr(x);if($!==null&&lt($.target,i))return!0}return!1},h=(x,y)=>{if(y>=xl)return!0;let v=le(x);if(t.has(v))return!0;if(g.isIdentifier(v))return dt.has(v.text)||at(i,v);if(g.isBinaryExpression(v)){let C=v.operatorToken.kind;return C===g.SyntaxKind.BarBarToken||C===g.SyntaxKind.AmpersandAmpersandToken||C===g.SyntaxKind.QuestionQuestionToken?h(v.left,y+1)||h(v.right,y+1):!1}return g.isConditionalExpression(v)?h(v.whenTrue,y+1)||h(v.whenFalse,y+1):g.isPropertyAccessExpression(v)||g.isElementAccessExpression(v)?lt(v,i):g.isCallExpression(v)||g.isNewExpression(v)?p(v,y+1):!1},S=(x,y)=>{if((g.isVariableDeclaration(x)||g.isParameter(x)||g.isBindingElement(x))&&x.initializer!==void 0){if(h(x.initializer,0)){let C=Xr(x,e);for(let $ of Tn(x.name))u($,C)}}else if(g.isBinaryExpression(x)&&x.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(x.left)&&h(x.right,0))u(x.left.text,gl(x.left,e,s));else if(g.isReturnStatement(x)&&x.expression!==void 0&&y!==void 0&&h(x.expression,0))c(a,y);else if(g.isCallExpression(x)||g.isNewExpression(x)){p(x,0)&&f(x);let C=le(x.expression),$=en(C),N=$!==null&&$.name==="call",b=$!==null&&$.name==="apply",m=N||b?$.receiver:C,E=N?1:0,_=[];g.isFunctionExpression(m)||g.isArrowFunction(m)?_.push({fn:m,slots:Yr(m)}):g.isIdentifier(m)&&_.push(...r.params.get(m.text)??[]);let F=x.arguments??[];if(b){let O=F[1]===void 0?void 0:le(F[1]);for(let{fn:I,slots:A}of _)if(O!==void 0&&g.isArrayLiteralExpression(O))for(let j=0;j<O.elements.length;j+=1){let z=O.elements[j],M=A[j];if(!(z===void 0||M===void 0)&&h(z,0))for(let X of M)u(X,I)}else if(O!==void 0)for(let j of A)for(let z of j)u(z,I)}else for(let{fn:O,slots:I}of _)for(let A=E;A<F.length;A+=1){let j=F[A],z=I[A-E];if(!(j===void 0||z===void 0)&&h(j,0))for(let M of z)u(M,O)}}let v=y;if(g.isFunctionDeclaration(x))v=x.name?.text;else if(g.isFunctionExpression(x)||g.isArrowFunction(x)){let C=x.parent;v=g.isVariableDeclaration(C)&&g.isIdentifier(C.name)?C.name.text:void 0}g.forEachChild(x,C=>S(C,v))};S(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function El(e){if(g.isIdentifier(e)&&Jt.has(e.text)||Ln(e))return!0;let n=en(e);if(n!==null&&(ct.has(n.name)||(n.name==="call"||n.name==="apply")&&(g.isIdentifier(n.receiver)&&Jt.has(n.receiver.text)||Ln(n.receiver)||(g.isPropertyAccessExpression(n.receiver)||g.isElementAccessExpression(n.receiver))&&Hr(n.receiver))))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=le(e.expression);if(g.isIdentifier(t)&&dt.has(t.text))return!0}return!1}var wl=4;function zr(e,n){for(let t of e){if(!g.isStringLiteralLike(t)||n>=wl)return!0;let i=g.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return d.map(p=>{let f=Ze(p.id)??0;return{packageName:be(p.package_name),modelId:be(p.evidence_ref),introduced:be(p.introduced),fixedBefore:he(p.fixed_before),evidenceRef:be(p.evidence_ref),edges:u.all({id:f}).map(h=>({kind:be(h.kind),anchorExport:be(h.anchor_export),anchorContainer:he(h.anchor_container),calleePackage:be(h.callee_package),calleeContainer:he(h.callee_container),calleeExport:be(h.callee_export)}))}})},close(){t.close()}}}var kn="6";import{realpathSync as ln}from"node:fs";import ze from"node:path";import{realpathSync as vn}from"node:fs";import{isBuiltin as _r}from"node:module";import Re from"node:path";import b from"typescript";function pr(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function ge(e){let n=pr(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function je(e){let n=pr(e);if(n.startsWith("@")){let r=n.indexOf("/");if(r===-1)return n;let o=n.indexOf("/",r+1);return o===-1?n:n.slice(0,o)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Xo(e){let n=pr(e),t=je(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as ql,statSync as mr}from"node:fs";var un=16*1024*1024;function On(e,n){try{let t=mr(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:ql(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function _e(e){let n=On(e,un);return n.kind==="ok"?n.text:null}function Qe(e){try{return mr(e).isFile()}catch{return!1}}function Yo(e){try{let n=mr(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Wl,realpathSync as yr}from"node:fs";import re from"node:path";import xt from"typescript";var ti=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function De(e){return ti.some(([n])=>e.endsWith(n))}function Gl(e){for(let[n,t]of ti)if(e.endsWith(n)){let r=e.slice(0,-n.length);return t.map(o=>r+o)}return[]}var Hl=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function ri(e){if(De(e))return e;for(let[n,t]of Hl)if(e.endsWith(n)){let r=e.slice(0,-n.length);for(let o of t){let i=r+o;if(Qe(i))return i}return e}return e}var xr=[xt.ModuleKind.CommonJS,xt.ModuleKind.ESNext],Sr=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function qn(e,n,t,r,o,i){let a=xt.resolveModuleName(e,n,t,r,void 0,void 0,o).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(i){for(let s of Gl(l))if(Qe(s))return s}return l}var oi=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],Xl=[".js",".json",".node"],Yl=["index.js","index.json","index.node"];function St(e){return!De(e)&&oi.some(n=>e.endsWith(n))}function ii(e){if(Qe(e))return e;for(let n of Xl)if(Qe(e+n))return e+n;return null}function Jo(e){for(let n of Yl){let t=re.join(e,n);if(Qe(t))return t}return null}var si=[".ts",".tsx",".cts",".mts",".jsx"];function Jl(e){for(let n of si)if(Qe(e+n))return e+n;return null}function Zl(e){for(let n of si){let t=re.join(e,"index"+n);if(Qe(t))return t}return null}function br(e){let n=_e(re.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let r=re.join(e,t),o=ii(r)??Jo(r);if(o!==null)return o}}catch{}return Jo(e)}function ai(e){return ii(e)??br(e)??Jl(e)??Zl(e)}function li(e){return ai(e)!==null}function Ql(e,n){let t=e.split(re.sep),r=n.split("/"),o=null;for(let a=t.length-r.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&r.every((l,s)=>t[a+1+s]===l)){o=t.slice(0,a+1+r.length).join(re.sep);break}if(o===null||o==="")return null;let i=_e(re.join(o,"package.json"));if(i===null)return null;try{let a=JSON.parse(i),l=a.exports,s=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||s)return null}catch{return null}try{return yr(o)}catch{return null}}function ed(e,n){let t=ai(re.join(e,n));if(t===null)return null;let r;try{r=yr(t)}catch{return null}let o=e.endsWith(re.sep)?e:e+re.sep;return r!==e&&!r.startsWith(o)||De(r)||!oi.some(i=>r.endsWith(i))?null:r}function nd(e,n){let t=Xo(e);return t===""||t.includes("\0")||t.split("/").some(r=>r===""||r==="."||r===".."||r==="node_modules")?null:ed(n,t)}var En={kind:"nothing-loads"},hr=8192;function gr(e,n){let t=n.get(e);if(t!==void 0)return t;let r,o=null;try{o=Wl(e);let i=new Set,a=!1;for(;;){let l=o.readSync();if(l===null)break;if(i.size>=hr){a=!0;break}i.add(l.name)}r={names:i,truncated:a}}catch{r=null}finally{try{o?.closeSync()}catch{}}return n.set(e,r),r}var td=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function di(e){return td.some(n=>e.length>n.length&&e.endsWith(n))}function fn(e,n){let t=e.endsWith(re.sep)?e:e+re.sep;return n===e||n.startsWith(t)}function Zo(e,n){let t;try{t=yr(n)}catch{return{kind:"missing"}}return fn(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Qo(e,n){let t=(n+".").toLowerCase(),r=[];for(let o of e){let i=o.toLowerCase();i.length>t.length&&i.startsWith(t)&&r.push(o)}return r}function rd(e,n,t){let r=re.dirname(n);if(!fn(e,r))return null;let o=gr(r,t);if(o===null)return null;let i=re.basename(n);return o.names.has(i)?i:null}function ei(e,n){let t=e.filter(o=>!di(o));if(t.length===0)return En;let r=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${r}") the analyzer cannot parse`,why:"sibling-unparsable"}}function ci(e,n,t,r){let o=e,i=o.indexOf("?");i!==-1&&(o=o.slice(0,i));let a=o.indexOf("#");if(a!==-1&&(o=o.slice(0,a)),o===""||o.includes("\0"))return En;let l=re.resolve(re.dirname(n),o);if(!fn(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let s=Zo(t,l);if(s.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(s.kind==="ok"){let h=Yo(s.real);if(h==="file"){let S=rd(t,s.real,r);return S!==null&&di(S)?En:{kind:"unanalyzable",reason:S===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${S}") the analyzer cannot parse`,why:S===null?"probe-refused":"sibling-unparsable"}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let g=gr(s.real,r);if(g===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let k=ei(Qo(g.names,"index"),"a directory index");return k.kind==="unanalyzable"?k:g.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:g.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(hr)} entries and was not fully probed`,why:"probe-refused"}:En}let d=re.basename(l);if(d===""||d==="."||d==="..")return En;let u=Zo(t,re.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(u.kind==="missing")return En;let p=gr(u.real,r);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let f=ei(Qo(p.names,d),"a sibling file exists");return f.kind==="unanalyzable"?f:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(hr)} entries and was not fully probed`,why:"probe-refused"}:En}function kr(e,n){let t=je(e),r=re.dirname(n);for(let o=0;o<64;o+=1){let i=re.join(r,"node_modules",...t.split("/"));if(_e(re.join(i,"package.json"))!==null)return i;let a=re.dirname(r);if(a===r)return null;r=a}return null}function ni(e,n,t,r,o){let i;for(let a of xr)for(let l of Sr){let s={...t,noDtsResolution:!0,customConditions:[...l]},d=qn(e,n,s,r,a,o);if(i===void 0)i=d;else if(i!==d)return null}return i??null}function Ke(e,n,t,r){let o=ge(e);if(o==="relative")return qn(e,n,t,r,void 0,!0);if(o==="package-root"){let l=ni(e,n,t,r,!0);if(l!==null)return l;let s=kr(e,n);if(s===null||_e(re.join(s,"package.json"))?.includes('"exports"')===!0)return null;let d=br(s);return d===null||De(d)?null:fn(s,d)?d:null}let i=ni(e,n,t,r,!1);if(i===null)return null;let a=Ql(i,je(e));return a!==null?nd(e,a):De(i)?i:ri(i)}function ui(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function Wn(e,n,t,r){let o=ge(e);if(o==="relative")return"no-candidate";if(ui(e))return"alias-unmapped";let i=new Set;for(let g of xr)for(let k of Sr){let S={...t,noDtsResolution:!0,customConditions:[...k]};i.add(qn(e,n,S,r,g,o==="package-root"))}if(i.size>1)return"divergent-exports";let a=kr(e,n);if(a===null)return"not-installed";let l=_e(re.join(a,"package.json"));if(l===null)return"unreadable-manifest";let s;try{s=JSON.parse(l)}catch{return"unreadable-manifest"}if(typeof s!="object"||s===null)return"unreadable-manifest";let d=s,u=d.exports!==void 0&&d.exports!==null,p=typeof d.typesVersions=="object"&&d.typesVersions!==null,[f]=i;if(f!=null)return fn(a,f)?!u&&p?"types-versions-remap":De(f)?"declaration-only":"no-candidate":"out-of-root";let h=qn(e,n,t,r,void 0,!1);if(h!==null&&De(h))return!u&&p?"types-versions-remap":"declaration-only";if(o==="package-root"&&!u){let g=br(a);if(g!==null&&!fn(a,g))return"out-of-root"}return"no-candidate"}function $n(e,n,t,r){let o=Ke(e,n,t,r);if(o!==null)return[o];let i=ge(e);if(i==="relative")return[];let a=new Set;for(let d of xr)for(let u of Sr){let p={...t,noDtsResolution:!0,customConditions:[...u]};a.add(qn(e,n,p,r,d,i==="package-root"))}if(a.size<2||a.has(null))return[];let l=kr(e,n);if(l===null)return[];let s=[];for(let d of a){if(d===null)return[];let u=ri(d);if(De(u)||!fn(l,u))return[];s.push(u)}return[...new Set(s)].sort()}function fi(e,n){let t=re.dirname(e);for(let r=0;r<64;r+=1){let o=_e(re.join(t,"package.json"));if(o!==null){try{let a=JSON.parse(o);if(typeof a!="object"||a===null)return!1;let l=a.optionalDependencies;if(typeof l=="object"&&l!==null&&n in l)return!0;let s=a.peerDependenciesMeta;if(typeof s=="object"&&s!==null){let d=s[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let i=re.dirname(t);if(i===t)return!1;t=i}return!1}function pi(e,n,t){let r=_e(re.join(e,"tsconfig.json"));if(r===null)return()=>null;let o=xt.parseConfigFileTextToJson(re.join(e,"tsconfig.json"),r);if(o.error!==void 0)return()=>null;let i=o.config?.compilerOptions;if(typeof i!="object"||i===null)return()=>null;let a=i.paths;if(typeof a!="object"||a===null)return()=>null;let l=i.baseUrl,s=typeof l=="string"?re.resolve(e,l):e,d=new Map,u=[];for(let[f,h]of Object.entries(a)){if(!Array.isArray(h))continue;let g=h.filter(S=>typeof S=="string");if(g.length===0)continue;let k=f.indexOf("*");k===-1?d.set(f,g):f.indexOf("*",k+1)===-1&&u.push({prefix:f.slice(0,k),suffix:f.slice(k+1),targets:g})}if(u.sort((f,h)=>h.prefix.length-f.prefix.length),d.size===0&&u.length===0)return()=>null;let p=f=>{let h=d.get(f);if(h!==void 0)return h;for(let g of u){if(f.length<g.prefix.length+g.suffix.length||!f.startsWith(g.prefix)||!f.endsWith(g.suffix))continue;let k=f.slice(g.prefix.length,f.length-g.suffix.length);return g.targets.map(S=>{let w=S.indexOf("*");return w===-1?S:S.slice(0,w)+k+S.slice(w+1)})}return[]};return(f,h)=>{let g=p(f);if(g.length===0||Ke(f,h,n,t)!==null)return null;for(let k of g){let S=re.resolve(s,k),w=re.relative(re.dirname(h),S).split(re.sep).join("/");if(w==="")continue;w.startsWith(".")||(w=`./${w}`);let v=Ke(w,h,n,t);if(v!==null&&fn(e,v))return v}return null}}import{readdirSync as od,realpathSync as id}from"node:fs";import sn from"node:path";import V from"typescript";function Gn(e,n){if(V.isIdentifier(e))n.add(e.text);else for(let t of e.elements)V.isBindingElement(t)&&Gn(t.name,n)}function Mn(e){let n=new Map,t=new Set,r=s=>{n.set(s,(n.get(s)??0)+1)},o=s=>{let d=Te(s);if(V.isIdentifier(d))t.add(d.text);else if(V.isArrayLiteralExpression(d))for(let u of d.elements)o(u);else if(V.isObjectLiteralExpression(d))for(let u of d.properties)V.isShorthandPropertyAssignment(u)?t.add(u.name.text):V.isPropertyAssignment(u)?o(u.initializer):V.isSpreadAssignment(u)&&o(u.expression);else V.isSpreadElement(d)?o(d.expression):V.isBinaryExpression(d)&&d.operatorToken.kind===V.SyntaxKind.EqualsToken&&o(d.left)},i=s=>{let d=new Set;Gn(s,d);for(let u of d)r(u)},a=s=>{V.isVariableDeclaration(s)?i(s.name):V.isFunctionDeclaration(s)&&s.name!==void 0||V.isClassDeclaration(s)&&s.name!==void 0?r(s.name.text):V.isParameter(s)?i(s.name):((V.isFunctionExpression(s)||V.isClassExpression(s))&&s.name!==void 0&&V.isIdentifier(s.name)&&!(s.parent!==void 0&&V.isVariableDeclaration(s.parent)&&s.parent.initializer===s&&V.isIdentifier(s.parent.name)&&s.parent.name.text===s.name.text)||V.isImportClause(s)&&s.name!==void 0||V.isNamespaceImport(s)||V.isImportSpecifier(s)||V.isImportEqualsDeclaration(s))&&r(s.name.text),V.isBinaryExpression(s)&&s.operatorToken.kind>=V.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=V.SyntaxKind.LastAssignment?o(s.left):(V.isPrefixUnaryExpression(s)||V.isPostfixUnaryExpression(s))&&(s.operator===V.SyntaxKind.PlusPlusToken||s.operator===V.SyntaxKind.MinusMinusToken)?o(s.operand):(V.isForOfStatement(s)||V.isForInStatement(s))&&!V.isVariableDeclarationList(s.initializer)&&o(s.initializer),V.forEachChild(s,a)};a(e);let l=new Set(t);for(let[s,d]of n)d>1&&l.add(s);return l}function wn(e,n,t){let r=Mn(e),o=new Map,i=a=>{V.isVariableDeclaration(a)&&V.isIdentifier(a.name)&&a.initializer!==void 0&&!r.has(a.name.text)&&!o.has(a.name.text)&&o.set(a.name.text,a.initializer),V.forEachChild(a,i)};return i(e),{containingFile:n,taintedNames:r,constBindings:o,resolveParamDirs:t}}var sd=1024,ad=32,ld=new Set(["filter","sort","slice","reverse"]),dd=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Te(e){let n=e;for(;V.isParenthesizedExpression(n);)n=n.expression;return n}function mi(e,n){return V.isPropertyAccessExpression(e)&&V.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function pn(e,n,t,r){if(t>ad)return null;let o=Te(e);if(V.isStringLiteralLike(o))return o.text;if(V.isTemplateExpression(o)){let i=o.head.text;for(let a of o.templateSpans){let l=pn(a.expression,n,t+1,r);if(l===null)return null;i+=l+a.literal.text}return i}if(V.isBinaryExpression(o)&&o.operatorToken.kind===V.SyntaxKind.PlusToken){let i=pn(o.left,n,t+1,r);if(i===null)return null;let a=pn(o.right,n,t+1,r);return a===null?null:i+a}if(V.isIdentifier(o)){if(o.text==="__dirname")return sn.dirname(n.containingFile);if(o.text==="__filename")return n.containingFile;if(n.taintedNames.has(o.text)||r.has(o.text))return null;let i=n.constBindings.get(o.text);if(i===void 0)return null;r.add(o.text);let a=pn(i,n,t+1,r);return r.delete(o.text),a}if(V.isCallExpression(o)){let i=mi(o.expression,"join"),a=mi(o.expression,"resolve");if(!i&&!a)return null;let l=[];for(let d of o.arguments){let u=pn(d,n,t+1,r);if(u===null)return null;l.push(u)}let s=l[0];return s===void 0||a&&!sn.isAbsolute(s)?null:a?sn.resolve(...l):sn.join(...l)}return null}function bt(e){let n=Te(e);if(V.isBinaryExpression(n)&&n.operatorToken.kind===V.SyntaxKind.PlusToken)return[...bt(n.left),...bt(n.right)];if(V.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let r of n.templateSpans)t.push({expr:r.expression}),r.literal.text.length>0&&t.push({lit:r.literal.text});return t}return V.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function yi(e){let n=e,t=0;for(;t++<4096;){let r=n.parent;if(r===void 0)return null;if(V.isForOfStatement(r)&&r.statement===n){let o=r.initializer;if(V.isVariableDeclarationList(o)&&o.declarations.length===1&&o.declarations[0]!==void 0&&V.isIdentifier(o.declarations[0].name)&&o.declarations[0].name.text===e.text){let i=hi(r.expression);if(i!==null)return i}}if((V.isArrowFunction(n)||V.isFunctionExpression(n))&&V.isCallExpression(r)&&r.arguments.length>0&&r.arguments[0]===n&&V.isPropertyAccessExpression(r.expression)&&dd.has(r.expression.name.text)){let o=n.parameters[0];if(o!==void 0&&V.isIdentifier(o.name)&&o.name.text===e.text){let i=hi(r.expression.expression);if(i!==null)return i}}n=r}return null}function hi(e){let n=Te(e),t=0;for(;V.isCallExpression(n)&&t++<16;){let r=n.expression;if(V.isPropertyAccessExpression(r)){let o=r.name.text;if(o==="readdirSync")return n.arguments[0]??null;if(ld.has(o)){n=Te(r.expression);continue}return null}return V.isIdentifier(r)&&r.text==="readdirSync"?n.arguments[0]??null:null}return null}function cd(e,n){let t=bt(e);if(t.length<2)return null;let r=t[t.length-1];if(r===void 0||!("expr"in r)||!V.isIdentifier(r.expr))return null;let o=r.expr;if(n.taintedNames.has(o.text))return null;let i="";for(let d=0;d<t.length-1;d+=1){let u=t[d];if(u===void 0)return null;if("lit"in u)i+=u.lit;else{let p=pn(u.expr,n,0,new Set);if(p===null)return null;i+=p}}let a=yi(o),l=a===null?null:pn(a,n,0,new Set);if(l===null)return null;let s=sn.resolve(i);return s!==sn.resolve(l)?null:s}function ud(e){if((V.isFunctionDeclaration(e)||V.isFunctionExpression(e))&&e.name!==void 0&&V.isIdentifier(e.name)||V.isMethodDeclaration(e)&&V.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&V.isVariableDeclaration(n)&&V.isIdentifier(n.name)?n.name.text:null}function fd(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!V.isFunctionLike(t))continue;let r=-1;for(let i=0;i<t.parameters.length;i+=1){let a=t.parameters[i];if(a!==void 0&&V.isIdentifier(a.name)&&a.name.text===n){r=i;break}}if(r<0)continue;let o=ud(t);return o===null?null:{fnName:o,paramIndex:r}}return null}function Hn(e,n){let t=bt(e);if(t.length!==2)return null;let[r,o]=t;if(r===void 0||!("expr"in r)||!V.isIdentifier(r.expr)||o===void 0||!("expr"in o)||!V.isIdentifier(o.expr))return null;let i=r.expr,a=o.expr;if(n.taintedNames.has(i.text)||n.taintedNames.has(a.text))return null;let l=yi(a);return l===null||!V.isIdentifier(l)||l.text!==i.text?null:fd(i,i.text)}function pd(e,n){if(n.resolveParamDirs===void 0)return null;let t=Hn(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function kt(e){for(let n=e.parent;n!==void 0;n=n.parent){if(V.isSourceFile(n))return!0;if(!V.isArrowFunction(n)&&V.isFunctionLike(n))return!1}return!0}function Er(e,n){let t=pn(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let r=cd(e,n);if(r!==null)return{kind:"dir",dir:r};let o=pd(e,n);return o!==null&&o.length>0?{kind:"dirs",dirs:[...o]}:{kind:"opaque"}}function xi(e,n){let t;try{t=id(e)}catch{return null}let r=n.endsWith(sn.sep)?n:n+sn.sep;return t===n||t.startsWith(r)?t:null}function Si(e,n,t,r,o){let i=Ke(e,n,r,o);return i===null||De(i)||!St(i)?null:xi(i,t)}function gi(e,n,t,r,o){let i=xi(e,t);if(i===null)return[];let a;try{a=od(i)}catch{return[]}if(a.length===0||a.length>sd)return[];a.sort();let l=new Set,s=[];for(let d of a){let u=Si(sn.join(i,d),n,t,r,o);u!==null&&!l.has(u)&&(l.add(u),s.push(u))}return s}function Et(e,n,t,r,o){let i=Er(e,n);if(i.kind==="const"){if(ge(i.value)==="package-root")return[];let a=Si(i.value,n.containingFile,t,r,o);return a===null?[]:[a]}if(i.kind==="dir")return gi(i.dir,n.containingFile,t,r,o);if(i.kind==="dirs"){let a=new Set,l=[];for(let s of i.dirs)for(let d of gi(s,n.containingFile,t,r,o))a.has(d)||(a.add(d),l.push(d));return l}return[]}import md from"node:path";import se from"typescript";var hd=32,wt="\0",bi=(e,n)=>`${e}${wt}${n}`,ki=(e,n,t)=>`${e}${wt}${n}${wt}${String(t)}`;function gd(e){let n=new Map,t=new Set,r=(o,i)=>{if(t.has(o)){n.delete(o);return}t.add(o),n.set(o,i)};for(let o of e.statements)if(se.isImportDeclaration(o)&&se.isStringLiteralLike(o.moduleSpecifier)){let i=o.moduleSpecifier.text,a=o.importClause;if(a===void 0)continue;a.name!==void 0&&r(a.name.text,{kind:"module",specifier:i});let l=a.namedBindings;if(l!==void 0&&se.isNamespaceImport(l))r(l.name.text,{kind:"module",specifier:i});else if(l!==void 0&&se.isNamedImports(l))for(let s of l.elements)r(s.name.text,{kind:"named",specifier:i,imported:(s.propertyName??s.name).text})}else if(se.isImportEqualsDeclaration(o)&&se.isExternalModuleReference(o.moduleReference)&&se.isStringLiteralLike(o.moduleReference.expression))r(o.name.text,{kind:"module",specifier:o.moduleReference.expression.text});else if(se.isFunctionDeclaration(o)&&o.name!==void 0)r(o.name.text,{kind:"local"});else if(se.isVariableStatement(o))for(let i of o.declarationList.declarations){if(i.initializer===void 0)continue;let a=i.initializer;if(se.isIdentifier(i.name))se.isArrowFunction(a)||se.isFunctionExpression(a)?r(i.name.text,{kind:"local"}):Ei(a)&&r(i.name.text,{kind:"module",specifier:wi(a)});else if(se.isObjectBindingPattern(i.name)&&Ei(a)){let l=wi(a);for(let s of i.name.elements){if(s.dotDotDotToken!==void 0||!se.isIdentifier(s.name))continue;let d=s.propertyName??s.name;!se.isIdentifier(d)&&!se.isStringLiteralLike(d)||r(s.name.text,{kind:"named",specifier:l,imported:d.text})}}}return n}function Ei(e){return se.isCallExpression(e)&&se.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&se.isStringLiteralLike(e.arguments[0])}function wi(e){let n=e.arguments[0];return n!==void 0&&se.isStringLiteralLike(n)?n.text:"\0"}function yd(e){let n=e.expression;if(se.isPropertyAccessExpression(n))return n.name.text;if(se.isIdentifier(n))return n.text}function xd(e,n,t,r,o,i){let a=e.expression,l=s=>{let d=`${s}${wt}${n}`,u=i.get(d);if(u!==void 0||i.has(d))return u??null;let p=Ke(s,n,r,o),f=p===null?null:md.resolve(p);return i.set(d,f),f};if(se.isPropertyAccessExpression(a)&&se.isIdentifier(a.expression)){let s=t.get(a.expression.text);if(s?.kind==="module"){let d=l(s.specifier);return d===null?null:{moduleReal:d,fnName:a.name.text}}return null}if(se.isIdentifier(a)){let s=t.get(a.text);if(s?.kind==="named"){let d=l(s.specifier);return d===null?null:{moduleReal:d,fnName:s.imported}}return s?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function vi(e,n,t,r,o=new Map){if(n.length===0)return()=>null;let i=new Map,a=new Set;for(let s of n){let d=bi(s.definingModuleReal,s.fnName),u=i.get(d);u===void 0&&(u=new Set,i.set(d,u)),u.add(s.paramIndex),a.add(s.fnName)}let l=new Map;for(let s of e){let d=wn(s.sf,s.real),u=gd(s.sf),p=f=>{if(se.isCallExpression(f)){let h=yd(f);if(h!==void 0&&a.has(h)&&kt(f)){let g=xd(f,s.real,u,t,r,o);if(g!==null){let k=i.get(bi(g.moduleReal,g.fnName));if(k!==void 0)for(let S of k){let w=f.arguments[S];if(w===void 0)continue;let v=Er(w,d);if(v.kind==="const"){let I=ki(g.moduleReal,g.fnName,S),C=l.get(I);C===void 0&&(C=new Set,l.set(I,C)),C.add(v.value)}}}}}se.forEachChild(f,p)};p(s.sf)}return(s,d,u)=>{let p=l.get(ki(s,d,u));return p===void 0||p.size===0||p.size>hd?null:[...p].sort()}}var Ne={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:b.ScriptTarget.ES2020,module:b.ModuleKind.CommonJS,moduleResolution:b.ModuleResolutionKind.Node10,types:[]},vt=5e3;function Oe(e,n){let t;try{t=vn(n)}catch{t=Re.resolve(n)}let r=e.endsWith(Re.sep)?e:e+Re.sep;return t!==e&&!t.startsWith(r)?null:t===e?"":t.slice(r.length).split(Re.sep).join("/")}function Se(e){let n=e;for(;;)if(b.isParenthesizedExpression(n))n=n.expression;else if(b.isBinaryExpression(n)&&n.operatorToken.kind===b.SyntaxKind.CommaToken)n=n.right;else return n}function an(e){return b.isPropertyAccessExpression(e)?{receiver:Se(e.expression),name:e.name.text}:b.isElementAccessExpression(e)&&b.isStringLiteralLike(e.argumentExpression)?{receiver:Se(e.expression),name:e.argumentExpression.text}:null}function Jn(e){let n=Se(e.expression);if(b.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===b.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=an(n);if(t!==null){if(t.name==="require"&&b.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(b.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let r=e.arguments[1];return{specifierArg:r!==void 0&&b.isArrayLiteralExpression(r)?r.elements[0]:void 0}}}}return null}function Ii(e){let n=[],t=r=>{if(b.isImportDeclaration(r)&&b.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.importClause?.isTypeOnly!==!0});else if(b.isImportEqualsDeclaration(r)&&b.isExternalModuleReference(r.moduleReference)&&b.isStringLiteralLike(r.moduleReference.expression))n.push({text:r.moduleReference.expression.text,runtime:!0});else if(b.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&b.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.isTypeOnly!==!0});else if(b.isCallExpression(r)){let o=Jn(r),i=o?.specifierArg;o!==null&&i!==void 0&&b.isStringLiteralLike(i)&&n.push({text:i.text,runtime:!0})}b.forEachChild(r,t)};return t(e),n}function Sd(e,n){let t=n===b.ScriptKind.TSX?"__scriptkind_probe.tsx":n===b.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",r=b.createSourceFile(t,e,b.ScriptTarget.ES2020,!0,n),o={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},i={getSourceFile:a=>a===t?r:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return b.createProgram({rootNames:[t],options:o,host:i}).getSyntacticDiagnostics(r).length}function Nr(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Ai(e){let n=0,t=r=>{(b.isCallExpression(r)||b.isNewExpression(r)||b.isTaggedTemplateExpression(r))&&(n+=1),b.forEachChild(r,t)};return t(e),n}function Ri(e,n){let t=Ii(b.createSourceFile(e,n,b.ScriptTarget.ES2020,!0));if(!Nr(e)||!n.includes("<")||!n.includes("require"))return t;let r=b.createSourceFile(e,n,b.ScriptTarget.ES2020,!0,b.ScriptKind.TSX),o=new Set(t.map(i=>`${i.runtime?"R":"T"}:${i.text}`));for(let i of Ii(r)){let a=`${i.runtime?"R":"T"}:${i.text}`;o.has(a)||(o.add(a),t.push(i))}return t}function _i(e,n,t,r,o){if(!n.includes("require")&&!n.includes("import("))return[];let i=b.createSourceFile(e,n,b.ScriptTarget.ES2020,!0),a=wn(i,e,o),l=[],s=new Set;return Ci(i,d=>{for(let u of Et(d,a,t,Ne,r))s.has(u)||(s.add(u),l.push(u))}),l}function Ci(e,n){let t=r=>{if(b.isCallExpression(r)){let o=Jn(r),i=o?.specifierArg;o!==null&&i!==void 0&&!b.isStringLiteralLike(i)&&n(i)}b.forEachChild(r,t)};t(e)}function bd(e){let n=[];for(let t of e){let r=wn(t.sf,t.real);Ci(t.sf,o=>{let i=Hn(o,r);i!==null&&n.push({definingModuleReal:t.real,fnName:i.fnName,paramIndex:i.paramIndex})})}return n}var kd=4,wr=vt,vr=new Set(["eval","Function","createRequire"]),Ed=new Set(["require","eval","Function","createRequire"]),_t=new Set(["module","Module","require","process","global","globalThis"]),Nt=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function wd(e){return e===b.SyntaxKind.LessThanToken||e===b.SyntaxKind.GreaterThanToken||e===b.SyntaxKind.LessThanEqualsToken||e===b.SyntaxKind.GreaterThanEqualsToken||e===b.SyntaxKind.EqualsEqualsToken||e===b.SyntaxKind.EqualsEqualsEqualsToken||e===b.SyntaxKind.ExclamationEqualsToken||e===b.SyntaxKind.ExclamationEqualsEqualsToken||e===b.SyntaxKind.InstanceOfKeyword||e===b.SyntaxKind.InKeyword}function vd(e){let n=e.parent;return(b.isParameter(n)||b.isVariableDeclaration(n)||b.isBindingElement(n)||b.isFunctionDeclaration(n)||b.isFunctionExpression(n)||b.isClassDeclaration(n)||b.isClassExpression(n)||b.isPropertyAssignment(n)||b.isPropertyDeclaration(n)||b.isMethodDeclaration(n))&&n.name===e?!0:b.isPropertyAccessExpression(n)&&n.name===e}function Id(e,n){return b.isCallExpression(n)&&n.expression===e||(b.isPropertyAccessExpression(n)||b.isElementAccessExpression(n))&&n.expression===e||b.isTypeOfExpression(n)||b.isVoidExpression(n)||b.isDeleteExpression(n)||b.isPrefixUnaryExpression(n)||b.isPostfixUnaryExpression(n)?!0:b.isBinaryExpression(n)&&wd(n.operatorToken.kind)}function Oi(e){let n=e,t=e.parent;for(;;)if(b.isParenthesizedExpression(t))n=t,t=t.parent;else if(b.isBinaryExpression(t)&&t.operatorToken.kind===b.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Id(n,t)}function Ad(e){return vd(e)?!1:Oi(e)}function $i(e){let n=an(e);if(n!==null&&Nt.has(n.name))return!0;if(b.isElementAccessExpression(e)&&!b.isStringLiteralLike(e.argumentExpression)){let t=Se(e.expression);if(b.isIdentifier(t)&&_t.has(t.text))return!0}return!1}function Xn(e){let n=an(e);if(n===null||n.name!=="constructor")return!1;let t=an(n.receiver);return t!==null&&t.name==="constructor"}function Mi(e){if(!b.isCallExpression(e))return!1;let n=Se(e.expression);if(!b.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&b.isStringLiteralLike(t)&&t.text==="module"}var _d={roots:new Map,nodes:new Set,saturated:!1};function Di(e){return b.isSourceFile(e)||b.isFunctionDeclaration(e)||b.isFunctionExpression(e)||b.isArrowFunction(e)||b.isMethodDeclaration(e)||b.isConstructorDeclaration(e)||b.isGetAccessorDeclaration(e)||b.isSetAccessorDeclaration(e)||b.isClassStaticBlockDeclaration(e)||b.isModuleDeclaration(e)}function Ti(e,n){let t=e.parent;for(;t!==void 0;){if(Di(t))return t;t=t.parent}return n}function Nd(e){let n=new Set;if(b.isFunctionLike(e))for(let r of e.parameters)for(let o of Yn(r.name))n.add(o);let t=[e];for(;t.length>0;){let r=t.pop();if(r===void 0)break;if(!(r!==e&&Di(r))){if(b.isVariableDeclaration(r)&&b.isVariableDeclarationList(r.parent)&&!((r.parent.flags&b.NodeFlags.BlockScoped)!==0))for(let i of Yn(r.name))n.add(i);b.forEachChild(r,o=>{t.push(o)})}}return n}function Rd(e,n,t){let r=Ti(e,n);if(b.isSourceFile(r))return n;let o=t.get(r);return o===void 0&&(o=Nd(r),t.set(r,o)),o.has(e.text)?r:n}function It(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let r=n;for(;;){if(t.has(r))return!0;let o=r.parent;if(o===void 0)return!b.isSourceFile(r);r=o}}var Cd=12,Od=8;function At(e,n){let t=Se(e);for(;;){if(n.nodes.has(t))return!0;if(b.isIdentifier(t))return _t.has(t.text)||It(n,t);if(b.isCallExpression(t))return Mi(t);let r=an(t);if(r!==null){if(r.name==="constructor")return!0;t=r.receiver;continue}if(b.isElementAccessExpression(t)){t=Se(t.expression);continue}return!1}}function Pi(e){let n=an(Se(e.expression));if(n===null||n.name!=="get"||!b.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function $d(e,n){let t=Pi(e);if(t===null||!At(t.target,n))return!1;let r=t.key;return r===void 0||!b.isStringLiteralLike(r)?!0:Nt.has(r.text)}function Ir(e){if(!b.isFunctionExpression(e)&&!b.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,r=o=>{if(!(t||b.isFunctionExpression(o)||b.isFunctionDeclaration(o)||b.isClassLike(o))){if(b.isReturnStatement(o)&&o.expression!==void 0&&Se(o.expression).kind===b.SyntaxKind.ThisKeyword){t=!0;return}b.forEachChild(o,r)}};return r(n),t}function Yn(e){if(b.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)b.isOmittedExpression(t)||n.push(...Yn(t.name));return n}function Li(e){return e.parameters.map(n=>Yn(n.name))}function Md(e){let n=new Map,t=new Set,r=(i,a)=>{let l={fn:a,slots:Li(a)},s=n.get(i);s===void 0?n.set(i,[l]):s.push(l),Ir(a)&&t.add(i)},o=i=>{if(b.isFunctionDeclaration(i)&&i.name!==void 0)r(i.name.text,i);else if(b.isVariableDeclaration(i)&&b.isIdentifier(i.name)&&i.initializer!==void 0){let a=Se(i.initializer);(b.isFunctionExpression(a)||b.isArrowFunction(a))&&r(i.name.text,a)}b.forEachChild(i,o)};return o(e),{params:n,thisReturning:t}}function Dd(e){let n=new Map,t=new Set,r={roots:n,nodes:t},o=Md(e),i=new Map,a=new Set(o.thisReturning),l=!0;for(let s=0;l;s+=1){if(s>=Cd)return{roots:n,nodes:t,saturated:!0};l=!1;let d=(k,S)=>{S!==""&&!k.has(S)&&(k.add(S),l=!0)},u=(k,S)=>{if(k==="")return;let w=n.get(k);w===void 0&&(w=new Set,n.set(k,w)),w.has(S)||(w.add(S),l=!0)},p=k=>{t.has(k)||(t.add(k),l=!0)},f=(k,S)=>{let w=Se(k.expression);if(b.isIdentifier(w)&&vr.has(w.text)||Xn(w)||b.isCallExpression(k)&&Mi(k)||Ir(w))return!0;let v=an(w);if(v!==null&&(v.name==="call"||v.name==="apply"||v.name==="bind")){let I=v.receiver;if(Ir(I)||t.has(I)||b.isIdentifier(I)&&(It(r,I)||a.has(I.text)))return!0}if(t.has(w)||(b.isCallExpression(w)||b.isNewExpression(w))&&f(w,S+1)||b.isIdentifier(w)&&(It(r,w)||a.has(w.text)))return!0;if(b.isCallExpression(k)){let I=Pi(k);if(I!==null&&At(I.target,r))return!0}return!1},h=(k,S)=>{if(S>=Od)return!0;let w=Se(k);if(t.has(w))return!0;if(b.isIdentifier(w))return _t.has(w.text)||It(r,w);if(b.isBinaryExpression(w)){let v=w.operatorToken.kind;return v===b.SyntaxKind.BarBarToken||v===b.SyntaxKind.AmpersandAmpersandToken||v===b.SyntaxKind.QuestionQuestionToken?h(w.left,S+1)||h(w.right,S+1):!1}return b.isConditionalExpression(w)?h(w.whenTrue,S+1)||h(w.whenFalse,S+1):b.isPropertyAccessExpression(w)||b.isElementAccessExpression(w)?At(w,r):b.isCallExpression(w)||b.isNewExpression(w)?f(w,S+1):!1},g=(k,S)=>{if((b.isVariableDeclaration(k)||b.isParameter(k)||b.isBindingElement(k))&&k.initializer!==void 0){if(h(k.initializer,0)){let v=Ti(k,e);for(let I of Yn(k.name))u(I,v)}}else if(b.isBinaryExpression(k)&&k.operatorToken.kind===b.SyntaxKind.EqualsToken&&b.isIdentifier(k.left)&&h(k.right,0))u(k.left.text,Rd(k.left,e,i));else if(b.isReturnStatement(k)&&k.expression!==void 0&&S!==void 0&&h(k.expression,0))d(a,S);else if(b.isCallExpression(k)||b.isNewExpression(k)){f(k,0)&&p(k);let v=Se(k.expression),I=an(v),C=I!==null&&I.name==="call",E=I!==null&&I.name==="apply",m=C||E?I.receiver:v,x=C?1:0,A=[];b.isFunctionExpression(m)||b.isArrowFunction(m)?A.push({fn:m,slots:Li(m)}):b.isIdentifier(m)&&A.push(...o.params.get(m.text)??[]);let O=k.arguments??[];if(E){let j=O[1]===void 0?void 0:Se(O[1]);for(let{fn:T,slots:N}of A)if(j!==void 0&&b.isArrayLiteralExpression(j))for(let L=0;L<j.elements.length;L+=1){let R=j.elements[L],P=N[L];if(!(R===void 0||P===void 0)&&h(R,0))for(let K of P)u(K,T)}else if(j!==void 0)for(let L of N)for(let R of L)u(R,T)}else for(let{fn:j,slots:T}of A)for(let N=x;N<O.length;N+=1){let L=O[N],R=T[N-x];if(!(L===void 0||R===void 0)&&h(L,0))for(let P of R)u(P,j)}}let w=S;if(b.isFunctionDeclaration(k))w=k.name?.text;else if(b.isFunctionExpression(k)||b.isArrowFunction(k)){let v=k.parent;w=b.isVariableDeclaration(v)&&b.isIdentifier(v.name)?v.name.text:void 0}b.forEachChild(k,v=>g(v,w))};g(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Td(e){if(b.isIdentifier(e)&&vr.has(e.text)||Xn(e))return!0;let n=an(e);if(n!==null&&(Nt.has(n.name)||(n.name==="call"||n.name==="apply")&&(b.isIdentifier(n.receiver)&&vr.has(n.receiver.text)||Xn(n.receiver)||(b.isPropertyAccessExpression(n.receiver)||b.isElementAccessExpression(n.receiver))&&$i(n.receiver))))return!0;if(b.isElementAccessExpression(e)&&!b.isStringLiteralLike(e.argumentExpression)){let t=Se(e.expression);if(b.isIdentifier(t)&&_t.has(t.text))return!0}return!1}var Pd=4;function Ni(e,n){for(let t of e){if(!b.isStringLiteralLike(t)||n>=Pd)return!0;let r=b.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,g.ScriptTarget.Latest,!0),r=i.parseDiagnostics;if(r!==void 0&&r.length>0||Zt(i,n+1,!0))return!0}return!1}function Zt(e,n=0,t=!1){let i=!1,r=t?ml:kl(e);if(r.saturated)return!0;let s=l=>g.isElementAccessExpression(l)&&!g.isStringLiteralLike(l.argumentExpression)&&lt(le(l.expression),r),a=l=>{if(!i){if(t&&(g.isCallExpression(l)||g.isNewExpression(l)||g.isTaggedTemplateExpression(l))){i=!0;return}if(g.isCallExpression(l)){let o=Dn(l);if(o!==null){let c=o.specifierArg;if(c===void 0||!g.isStringLiteralLike(c)||t){i=!0;return}}else{let c=le(l.expression);if(g.isIdentifier(c)&&(c.text==="eval"||c.text==="Function")){if(zr(l.arguments,n)){i=!0;return}}else if(El(c)){i=!0;return}else if(s(c)){i=!0;return}else if(Sl(l,r)){i=!0;return}}}else if(g.isNewExpression(l)){let o=le(l.expression);if(g.isIdentifier(o)&&o.text==="Function"){if(zr(l.arguments??[],n)){i=!0;return}}else if(Ln(o)){i=!0;return}}else if(g.isIdentifier(l)&&dl.has(l.text)&&pl(l)){i=!0;return}else if((g.isPropertyAccessExpression(l)||g.isElementAccessExpression(l))&&(Hr(l)||Ln(l)||s(l))&&qr(l)){i=!0;return}else if(g.isBindingElement(l)){let o=l.propertyName??l.name,c=g.isIdentifier(o)||g.isStringLiteralLike(o)?o.text:g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?o.expression.text:void 0;if(c!==void 0&&ct.has(c)){i=!0;return}}g.forEachChild(l,a)}};return a(e),i}function Zr(e,n,t){if(Zt(t))return!0;if(!Qt(e)||!n.includes("<")||!n.includes("require"))return!1;let i=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);return Zt(i)}function vl(e,n,t){if(sl(e))return!0;let i=t.endsWith(Se.sep)?t:t+Se.sep,r=e.split("/"),s=n;for(;;){let a=Se.join(s,"node_modules",...r),l;try{l=gn(Se.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(i))return!1;let c=_e(l);if(c===null)return!1;let u;try{u=JSON.parse(c).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(vr(a))return!1;if(s===t)break;let o=Se.dirname(s);if(o===s||o!==t&&!o.startsWith(i))break;s=o}return!0}function Il(e,n){let t=n.endsWith(Se.sep)?n:n+Se.sep,i=Se.dirname(e);for(;;){let r=Se.join(i,"package.json"),s;try{s=gn(r)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let l=_e(s);if(l!==null)try{let o=JSON.parse(l).name;if(typeof o=="string"&&o.length>0)return o}catch{return null}}if(i===n)break;let a=Se.dirname(i);if(a===i||a!==n&&!a.startsWith(t))break;i=a}return null}function Al(e,n,t,i,r){let s=[],a=[],l=new Set,o={},c=new Set,u=new Set,f=[],p=!1,h=(x,y)=>{let v;try{v=gn(y)}catch{return!1}let C=Je(e,v);if(C===null)return r.push({code:"out-of-root",path:v,detail:"dependency module resolved outside the app root; not followed"}),!1;let $=!t.has(v)&&!u.has(v);return $&&u.size>=Xt?(p=!0,!1):(a.push({from:x,to:{module:C}}),$?(u.add(v),s.push(C),!0):!1)},S=(x,y)=>{if(l.add(y),c.has(y))return;c.add(y);let v=Te(y,x,Xe,n);if(v!==null&&!Be(v)){if(h({surface:y},v)){f.push(v);try{let C=Je(e,gn(v)),$=Il(v,e);C!==null&&$!==null&&(o[C]=$)}catch{}}return}vl(y,Se.dirname(x),e)||r.push({code:"unresolved-specifier",path:y,detail:`dependency "${y}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let x of i)S(x.containingFile,x.packageName);for(;f.length>0&&u.size<Xt;){let x=f.pop();if(x===void 0)break;let y=Je(e,x);if(y===null)continue;let v=En(x,sn);if(v.kind==="too-large"){r.push({code:"limit-exceeded",path:y,detail:`dependency module over the ${String(sn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(v.kind==="not-regular"){r.push({code:"parse-error",path:y,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let C=g.createSourceFile(x,v.text,g.ScriptTarget.ES2020,!0),$=C.parseDiagnostics;if($!==void 0&&$.length>0){r.push({code:"dependency-body",path:y,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}if(Zr(x,v.text,C)){r.push({code:"dependency-body",path:y,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)"});continue}r.push({code:"dependency-body",path:y,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:y});for(let N of Ur(x,v.text))if(N.runtime)if(ue(N.text)==="package-root"){let b=We(N.text);a.push({from:{module:y},to:{surface:b}}),S(x,b)}else{let b=Te(N.text,x,Xe,n);if(b===null){ue(N.text)==="package-subpath"&&r.push({code:"unresolved-specifier",path:y,detail:`runtime package-subpath import "${N.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`});continue}if(Be(b)){let m=Je(e,b);r.push({code:m===null?"out-of-root":"declaration-shadow",path:y,detail:m===null?`runtime import "${N.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${N.text}" resolved to the declaration file "${m}" with no co-located runtime module; its code was not analyzed`});continue}h({module:y},b)&&f.push(b)}}return(p||f.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(Xt)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:a,surfacePackages:[...l],entryRealNames:o}}function Qr(e,n,t=!1){let i=gn(e),r=[],s=g.createCompilerHost(Xe,!0),a=t?_r(i,Xe,s):()=>null,l=new Set,o=new Set,c=n.map(I=>Se.join(i,I)),u=[],f=new Map,p=new Map,h=new Map,S=new Map,x=new Set,y=(I,A)=>{let j=`${String(I.length)}:${I}${A}`;x.has(j)||(x.add(j),r.push({code:"unresolved-specifier",path:I,detail:A}))},v=()=>null,C=0,$=(I,A)=>{let j=p.get(I);return j===void 0&&(j=g.createSourceFile(I,A,g.ScriptTarget.ES2020,!0),p.set(I,j)),{real:I,sf:j}};for(;o.size<ot;){let I=c.pop();if(I===void 0){if(C>=ll)break;C+=1;let M=[];for(let[V,D]of f)D.includes("readdir")&&(D.includes("require")||D.includes("import("))&&M.push($(V,D));let X=al(M);if(X.length===0)break;let H=[];for(let[V,D]of f)H.push($(V,D));v=Fr(H,X,Xe,s,h);let K=!1;for(let V of M){let D=f.get(V.real);if(D!==void 0)for(let W of Br(V.real,D,i,s,v))o.has(W)||(c.push(W),K=!0)}if(!K)break;continue}let A;try{A=gn(I)}catch{continue}if(o.has(A))continue;if(o.add(A),Je(i,A)===null){r.push({code:"out-of-root",path:I,detail:"resolved outside app root"});continue}let j=En(A,sn);if(j.kind==="too-large"){r.push({code:"limit-exceeded",path:A,detail:`file is ${String(Math.round(j.bytes/1048576))}MiB, over the ${String(sn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(j.kind==="not-regular"){r.push({code:"parse-error",path:A,detail:"unreadable or not a regular file"});continue}let z=j.text;l.add(A),f.set(A,z);for(let M of Ur(A,z)){let X=M.runtime?a(M.text,A):null;if(X===null&&ue(M.text)==="package-root"){M.runtime&&u.push({containingFile:A,packageName:We(M.text)});continue}let H=X??Te(M.text,A,Xe,s);if(H===null){if(M.runtime){let K=ue(M.text);if(K==="package-subpath")y(A,`runtime package-subpath import "${M.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`);else if(K==="relative"){let V=Ar(M.text,A,i,S);V.kind==="unanalyzable"&&y(A,`runtime relative import "${M.text}" did not resolve and its absence could not be proven \u2014 ${V.reason}; a bundler/loader may load a module the analyzer never saw`)}}continue}if(Je(i,H)===null){r.push({code:"out-of-root",path:H,detail:`specifier "${M.text}" resolved outside app root`});continue}if(M.runtime&&Be(H)){r.push({code:"declaration-shadow",path:H,detail:`runtime import "${M.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(M.runtime&&!nt(H)){r.push({code:"unanalyzable-module",path:H,detail:`runtime import "${M.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(H)}for(let M of Br(A,z,i,s,v))o.has(M)||c.push(M)}o.size>=ot&&c.length>0&&r.push({code:"limit-exceeded",path:i,detail:`reachable file set exceeds ${String(ot)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let N=Al(i,s,l,u,r),b=g.createProgram({rootNames:[...l],options:Xe,host:s}),m=new Set,E=new Map;for(let I of b.getSourceFiles()){if(I.isDeclarationFile||b.isSourceFileDefaultLibrary(I)||Je(i,I.fileName)===null||!Qt(I.fileName))continue;let A=b.getSyntacticDiagnostics(I).length>0;if(!A&&!I.text.includes("<")||ol(I.text,g.ScriptKind.TSX)!==0)continue;let j=g.createSourceFile(I.fileName,I.text,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);(A||Kr(j)>Kr(I))&&(m.add(I.fileName),E.set(I.fileName,I.text))}let _=b;if(m.size>0){let I=s.getSourceFile.bind(s);s.getSourceFile=(A,j,z,M)=>{let X=E.get(A);return X!==void 0?g.createSourceFile(A,X,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX):I(A,j,z,M)},_=g.createProgram({rootNames:[...l],options:Xe,host:s,oldProgram:b})}let F=_.getTypeChecker(),O=[];for(let I of _.getSourceFiles()){if(I.isDeclarationFile||_.isSourceFileDefaultLibrary(I)||Je(i,I.fileName)===null)continue;O.push(I);let A=_.getSyntacticDiagnostics(I);if(A.length>0){let z=A[0],M=z!==void 0?g.flattenDiagnosticMessageText(z.messageText," "):"syntax error";r.push({code:"parse-error",path:I.fileName,detail:`${String(A.length)} syntax error(s): ${M}`})}let j=Je(i,I.fileName);j!==null&&Zr(I.fileName,I.text,I)&&r.push({code:"loader-escape",path:j,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)"})}return{program:_,checker:F,host:s,options:Xe,appRoot:i,sourceFiles:O,diagnostics:r,depReach:N,resolveParamDirs:v,toRel:I=>Je(i,I)}}import{opendirSync as _l,statSync as Nl}from"node:fs";import ei from"node:path";var Cl=8192,Ol=2e4,Rl=new Set(["node_modules"]),es=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),$l=16;function ut(e,n,t,i,r={}){let s=r.maxEntries??Ol,a=r.prune,l=[],o=!1,c=0,u=[{dir:ei.join(e,n),rel:n,depth:0}];for(;u.length>0;){let f=u.pop();if(f===void 0)break;if(f.depth>$l){o=!0;continue}let p;try{p=_l(f.dir)}catch{o=!0;continue}try{let h=0;for(;;){let S=p.readSync();if(S===null)break;if(h+=1,c+=1,h>Cl||c>s){o=!0;break}let x=f.rel+S.name;if(S.isSymbolicLink()){let y;try{y=Nl(ei.join(f.dir,S.name)).isDirectory()}catch{o=!0;continue}if(y){o=!0;continue}}else if(S.isDirectory()){if(Rl.has(S.name)||S.name.startsWith(".")||a?.has(S.name)===!0){o=!0;continue}u.push({dir:ei.join(f.dir,S.name),rel:`${x}/`,depth:f.depth+1});continue}else if(!S.isFile())continue;if(t(x)){if(l.length>=i){o=!0;break}l.push(x)}}}finally{try{p.closeSync()}catch{}}}return{matches:l,truncated:o}}var Ml=64;function ns(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let i=n.slice(0,t),r=n.slice(t+1);if(i.startsWith("./")&&(i=i.slice(2)),i.startsWith("/")||r.includes("/")||i.split("/").includes("..")||i.includes("\\")||n.includes("\0"))return null;let s=i.slice(0,i.lastIndexOf("/")+1);return ut(e,s,a=>a.length>=i.length+r.length&&a.startsWith(i)&&a.endsWith(r),Ml)}import{existsSync as Pl}from"node:fs";import Ll from"node:path";var Tl=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],Dl=["dependencies","devDependencies"];function Fl(e,n){for(let t of Dl){let i=e[t];if(!(typeof i!="object"||i===null||Array.isArray(i))&&Object.hasOwn(i,n))return!0}return!1}function ni(e,n){if(n===null)return null;for(let t of Tl)if(Fl(n,t.dependency)){for(let i of t.configFiles)if(Pl(Ll.join(e,i)))return{name:t.name,configFile:i,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function ti(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var jl=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],Kl=256,Bl=12e4;function ii(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let i=ut(e,"",r=>{let s=r.split("/");for(let a=0;a<s.length-1;a+=1){let l=s[a];if(l!==void 0&&t.has(l))return jl.some(o=>r.endsWith(o))}return!1},Kl,{maxEntries:Bl,prune:es});return{roots:i.matches,truncated:i.truncated}}function De(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let i of n){let r=i.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:i}return t}function zl(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function Ul(e){let n=!1;for(let t=0;t<e.length;t+=1){let i=e.charAt(t),r=i.codePointAt(0)??0;if(r<32||r===127||r>=128&&r<=159)return null;if(i==="\\"){n=!0;let s=e.charAt(t+1);if(!(s>="a"&&s<="z"||s>="A"&&s<="Z"||s>="0"&&s<="9"||s==="."||s==="_"||s==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(i))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function Vl(e){let n=[],t="";for(let i of e){if(i===" "||i==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=i}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var ql=/^[A-Za-z_][A-Za-z0-9_]*=/u;function Hl(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var Wl=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),Gl=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),Xl=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function is(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function ts(e){if(is(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return Xl.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:Wl.has(t)||n!==-1&&Gl.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var Jl=[".js",".cjs",".mjs",".ts",".mts",".cts"];function Yl(e){return Jl.some(n=>e.endsWith(n))}var Zl=new Set(["npm","yarn","pnpm"]);function Ql(e){let n=e[0];return n===void 0||!Zl.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function si(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!zl(n))return ri(n);let t=Ul(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let i=ri(t.windows),r=ri(t.posixShell);if(i.kind==="file"){let s=r.kind==="file"?r.specifier:void 0;return s===void 0||s===i.specifier?{kind:"file",specifier:i.specifier}:{kind:"file",specifier:i.specifier,alt:s}}return r.kind==="file"?{kind:"file",specifier:r.specifier}:i}function ri(e){let n=Vl(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let s=n[t];if(s===void 0||!ql.test(s))break;if(is(s))return{kind:"unparsed",reason:`environment \`${De(s)}\` preloads another module; the launch surface is more than one file`};let a=s.indexOf("=");if(s.slice(0,a)==="NODE_OPTIONS")for(let l of s.slice(a+1).split(/\s+/u)){if(l===""||!l.startsWith("-"))continue;let o=ts(l);if(o!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${De(o.token)}\` ${o.why}`}}}let i=n[t];if(i===void 0)return{kind:"unparsed",reason:"no program in the command"};if(Ql(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!Hl(i))return{kind:"unparsed",reason:`runs \`${De(i)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let s=n[t];if(s===void 0||!s.startsWith("-"))break;let a=ts(s);if(a!==null)return{kind:"unparsed",reason:`node flag \`${De(a.token)}\` ${a.why}`}}let r=n[t];return r===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:Yl(r)?{kind:"file",specifier:r}:{kind:"unparsed",reason:`\`${De(r)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function ed(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var nd=64;function oi(e){let n=e.split(`
-`),t=n.length>64,i=[],r=0;for(let s of n.slice(0,64)){let a=s.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let o=a.slice(l+1).trim();if(o.length===0)continue;let c=a.slice(0,l);if(c.length>nd||!ed(c)){r+=1;continue}i.push({name:c,command:o})}return i.sort((s,a)=>s.name===a.name?0:s.name==="web"?-1:a.name==="web"?1:0),{entries:i,truncated:t,unnamedLines:r}}import{realpathSync as rs}from"node:fs";import Ce from"node:path";import d from"typescript";var ss=3;function te(e,n,t){if(e===void 0)return;let i=e[n]??={fired:0,refused:{}};t===null?i.fired+=1:i.refused[t]=(i.refused[t]??0)+1}function an(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var pt=16,di=256,ai=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let i=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(i)||(this.moduleFor(n),this.fns.set(i,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let i=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(i)||(this.moduleFor(n),this.classNodes.set(i,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(i,[])),r}methodFor(n,t,i,r){let s=`${n}#${t}.${i}`,a=`pkg:${n}#${t}.${i}`;if(!this.fns.has(s)){let l=this.classFor(n,t);this.fns.set(s,{id:a,moduleId:`pkg:${n}`,name:i,kind:r,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function ms(e,n){let t="node_modules/",i=e.lastIndexOf(t);if(i===-1)return n;let s=e.slice(i+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function os(e,n,t){let i=Ce.dirname(e),r=Ce.dirname(n),s=[];for(;;){let l=t.get(i);if(l!==void 0){for(let c of s)t.set(c,l);return l}s.push(i);let o=_e(Ce.join(i,"package.json"));if(o!==null)try{let c=JSON.parse(o),u={name:c.name??"app",version:c.version??"0.0.0",dir:i};for(let f of s)t.set(f,u);return u}catch{}if(i===r||i===Ce.dirname(i))break;i=Ce.dirname(i)}let a={name:"app",version:"0.0.0",dir:null};for(let l of s)t.set(l,a);return a}function td(e){let n=[],t=i=>{if(d.isImportDeclaration(i)&&d.isStringLiteralLike(i.moduleSpecifier))n.push({specifier:i.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isImportEqualsDeclaration(i)&&d.isExternalModuleReference(i.moduleReference)&&d.isStringLiteralLike(i.moduleReference.expression))n.push({specifier:i.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isExportDeclaration(i)&&i.moduleSpecifier!==void 0&&d.isStringLiteralLike(i.moduleSpecifier))n.push({specifier:i.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isCallExpression(i)){let r=Dn(i);if(r!==null){let s=r.specifierArg,a=s!==void 0&&d.isStringLiteralLike(s);n.push({specifier:a?s.text:void 0,specifierIsLiteral:a,dynamic:!0,...s!==void 0&&!a?{computedArg:s,loadPos:i.getStart(e)}:{}})}}d.forEachChild(i,t)};return t(e),n}function id(e,n,t){let i=new Map,r=os(Ce.join(e.appRoot,"package.json"),e.appRoot,i),s=[],a=[],l=[],o=new Map,c=new Set,u=new Set;for(let f of e.sourceFiles){let p=e.toRel(f.fileName);p!==null&&u.add(p)}for(let f of e.sourceFiles){let p=e.toRel(f.fileName);if(p===null)continue;let h=os(f.fileName,e.appRoot,i),S=ms(p,r.name),x=p.includes("node_modules/");s.push({id:p,packageName:x&&h.name!==r.name?h.name:S,versionRange:h.version,path:p,moduleSystem:"cjs",isEntrypoint:n.has(p)}),h.dir===r.dir&&c.add(p);let y=0,v=null;for(let C of td(f)){let $=`${p}#import${String(y)}`;y+=1;let N=null;if(C.specifier!==void 0)if(ue(C.specifier)==="package-root")N=t.moduleFor(We(C.specifier));else{let b=Te(C.specifier,f.fileName,e.options,e.host),m=b!==null?e.toRel(b):null;m!==null&&(N=m)}if(a.push({id:$,moduleId:p,specifier:C.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:C.dynamic,specifierIsLiteral:C.specifierIsLiteral,...N!==null?{resolvedModuleId:N}:{}}),N!==null&&l.push({importId:$,resolvedModuleId:N}),C.computedArg!==void 0&&C.loadPos!==void 0){v??=hn(f,f.fileName,e.resolveParamDirs);let b=[];for(let m of rt(C.computedArg,v,e.appRoot,e.options,e.host)){let E=e.toRel(m);if(E===null||!u.has(E))continue;let _=E,F=`${p}#import${String(y)}`;y+=1,a.push({id:F,moduleId:p,specifier:E,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:_}),l.push({importId:F,resolvedModuleId:_}),b.push(E)}if(b.length>0){let m=Pn(C.computedArg,v)!==null||it(C.computedArg),E=o.get(p)??[];E.push({pos:C.loadPos,candidateRels:b,seedable:m}),o.set(p,E)}}}}return{modules:s,imports:a,importEdges:l,computedLoads:o,appOwnedPaths:c}}function rd(e){let n=_e(e);if(n===null)return null;let t=d.createSourceFile(e,n,d.ScriptTarget.Latest,!0),i=r=>t.statements.some(s=>d.isFunctionDeclaration(s)?s.name?.text===r:d.isVariableStatement(s)?s.declarationList.declarations.some(a=>d.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&(d.isFunctionExpression(a.initializer)||d.isArrowFunction(a.initializer))):!1);for(let r of t.statements){if(d.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(a=>a.kind===d.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!d.isExpressionStatement(r)||!d.isBinaryExpression(r.expression))continue;let s=r.expression;if(s.operatorToken.kind===d.SyntaxKind.EqualsToken&&sd(s.left)){if(d.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(d.isIdentifier(s.right)&&i(s.right.text))return s.right.text}}return null}function sd(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function od(e,n,t){for(let c of e.surfacePackages)n.moduleFor(c);let i=c=>"surface"in c?n.moduleFor(c.surface):c.module,r=[],s=new Set;for(let c of e.modules)t.has(c)||s.has(c)||(s.add(c),r.push({id:c,packageName:e.entryRealNames[c]??ms(c,"app"),versionRange:"",path:c,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],o=0;for(let c of e.edges){let u=i(c.from),f=i(c.to),p=`${String(u)}#depreach${String(o)}`;o+=1,a.push({id:p,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),l.push({importId:p,resolvedModuleId:f})}return{modules:r,imports:a,importEdges:l}}function as(e,n,t){let i=e.expression;if(d.isIdentifier(i)&&!t.has(i.text)){let r=n.get(i.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(d.isPropertyAccessExpression(i)&&d.isIdentifier(i.expression)&&!t.has(i.expression.text)){let r=n.get(i.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:i.name.text}}return null}function yn(e){return d.canHaveModifiers(e)&&(d.getModifiers(e)?.some(n=>n.kind===d.SyntaxKind.ExportKeyword)??!1)}function ad(e){let n=new Set,t;for(let i of e.statements){if(d.isExpressionStatement(i)&&d.isBinaryExpression(i.expression)){let r=i.expression;if(r.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(r.left)&&d.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(d.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(d.isObjectLiteralExpression(r.right))for(let s of r.right.properties)d.isShorthandPropertyAssignment(s)?n.add(s.name.text):d.isPropertyAssignment(s)&&d.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(d.isFunctionDeclaration(i)&&i.name!==void 0&&yn(i))n.add(i.name.text);else if(d.isVariableStatement(i)&&yn(i))for(let r of i.declarationList.declarations)d.isIdentifier(r.name)&&n.add(r.name.text);else if(d.isExportDeclaration(i)&&i.exportClause&&d.isNamedExports(i.exportClause))for(let r of i.exportClause.elements)n.add((r.propertyName??r.name).text);else d.isExportAssignment(i)&&d.isIdentifier(i.expression)&&(n.add(i.expression.text),t=i.expression.text)}return{reachableLocals:n,defaultTarget:t}}function ld(e){for(let n of e.statements){if(d.isFunctionDeclaration(n)&&n.name!==void 0&&yn(n)&&d.getModifiers(n)?.some(t=>t.kind===d.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(d.isExportAssignment(n)&&!n.isExportEquals&&d.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===d.SyntaxKind.EqualsToken&&ve(t.left)&&d.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function Ye(e){if(d.isCallExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&d.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function ve(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function ze(e){if(ve(e))return!0;if(!d.isPropertyAccessExpression(e)&&!d.isElementAccessExpression(e))return!1;let n=e.expression;return d.isIdentifier(n)&&n.text==="exports"?!0:ve(n)}function In(e){return d.isPropertyAccessExpression(e.expression)&&d.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function hs(e){let n=!1,t=i=>{if(!n){if(d.isCallExpression(i)){let r=Ye(i);if(r!==void 0&&ue(r)!=="package-root"){n=!0;return}}d.forEachChild(i,t)}};return t(e),n}function gs(e){let n=new Set,t=r=>r!==void 0&&hs(r),i=r=>{d.isVariableDeclaration(r)&&t(r.initializer)&&Mn(r.name,n),d.isBinaryExpression(r)&&r.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),d.forEachChild(r,i)};return i(e),n}function ys(e,n){for(let t of e.properties)d.isShorthandPropertyAssignment(t)?n.add(t.name.text):d.isPropertyAssignment(t)&&d.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function dd(e){let n=new Set;for(let l of e.statements)if(d.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(d.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(d.isVariableStatement(l))for(let o of l.declarationList.declarations)d.isIdentifier(o.name)&&o.initializer!==void 0&&(d.isFunctionExpression(o.initializer)||d.isArrowFunction(o.initializer)||d.isObjectLiteralExpression(o.initializer))&&n.add(o.name.text);let t=l=>d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isObjectLiteralExpression(l)||d.isIdentifier(l)&&n.has(l.text),i=new Set,r=l=>{d.isIdentifier(l)?i.add(l.text):d.isObjectLiteralExpression(l)&&ys(l,i)},s=!1,a=l=>{if(!s){if(d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken)if(ve(l.left)){r(l.right);let o=l.right;(d.isObjectLiteralExpression(o)?o.properties.every(u=>d.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||d.isPropertyAssignment(u)&&t(u.initializer)):t(o))||(s=!0)}else ze(l.left)&&(t(l.right)||(s=!0));else(d.isCallExpression(l)&&In(l)&&l.arguments[0]!==void 0&&xn(l.arguments[0])||d.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(s=!0);s||d.forEachChild(l,a)}};if(a(e),!s&&i.size>0){for(let l of ks(e))if(i.has(l)){s=!0;break}}return s}function xn(e){return ze(e)||d.isIdentifier(e)&&e.text==="exports"}function xs(e){if(!d.isPropertyAccessExpression(e.expression)||!d.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function ci(e){return xs(e)&&e.arguments[0]!==void 0&&xn(e.arguments[0])}function cd(e){return xs(e)&&e.arguments[0]!==void 0&&d.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function ud(e){for(let n of e.declarations??[])if(d.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(d.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function fd(e,n,t,i,r){let s=(e.declarations??[]).filter(l=>!d.isSourceFile(l)&&!d.isModuleDeclaration(l));for(let l of s){let o=l.getSourceFile(),c=n.toRel(o.fileName);if(c===null||r.has(c))continue;let u=t.get(`${c}::${String(l.getStart(o,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of s){let o=n.toRel(l.getSourceFile().fileName);if(o===null||r.has(o))continue;let c=i.get(`${o}::${a}`);if(c!==void 0)return c}}function mt(e){return d.isPropertyAccessExpression(e)?e.name.text:d.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var ui=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function fi(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?mt(e):void 0;return n!==void 0&&n!=="__proto__"&&ui.test(n)?n:void 0}function pd(e){return e!=="__proto__"&&ui.test(e)}function ls(e){let n=le(e);return d.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||ve(n)}function md(e){if(!d.isArrayLiteralExpression(e)&&!d.isObjectLiteralExpression(e))return!1;let n=!1,t=i=>{n||(ze(i)?n=!0:d.forEachChild(i,t))};return t(e),n}function pi(e){let n=!1,t=new Map,i=r=>{if(!n){if(d.isBinaryExpression(r)&&r.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(ve(r.left)||d.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===d.SyntaxKind.EqualsToken&&ls(r.right))n=!0;else if(md(r.left))n=!0;else if(ze(r.left)){let s=fi(r.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(d.isCallExpression(r)&&In(r)&&r.arguments[0]!==void 0&&xn(r.arguments[0])||d.isCallExpression(r)&&ci(r)||d.isCallExpression(r)&&cd(r)||d.isVariableDeclaration(r)&&r.initializer!==void 0&&ls(r.initializer))&&(n=!0);n||d.forEachChild(r,i)}};return i(e),{surfaceEscapes:n,assignCount:t}}function mi(e){let n=[];for(let t of e.statements){if(!d.isExpressionStatement(t)||!d.isBinaryExpression(t.expression))continue;let i=t.expression;i.operatorToken.kind===d.SyntaxKind.EqualsToken&&(!ze(i.left)||ve(i.left)||n.push({bin:i,name:fi(i.left)}))}return n}function hd(e){let{surfaceEscapes:n,assignCount:t}=pi(e);if(n)return[];let i=[];for(let{bin:r,name:s}of mi(e))s===void 0||(t.get(s)??0)!==1||(d.isFunctionExpression(r.right)||d.isArrowFunction(r.right))&&i.push({name:s,value:r.right});return i}function gd(e,n){let{surfaceEscapes:t,assignCount:i}=pi(e);if(t)return[];let r=[];for(let{bin:s,name:a}of mi(e))a===void 0||(i.get(a)??0)!==1||d.isIdentifier(s.right)&&!n.has(s.right.text)&&r.push(s.right.text);return r}function yd(e,n){let{surfaceEscapes:t,assignCount:i}=pi(e);for(let{bin:r,name:s}of mi(e)){let a=r.right;if(!(d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isIdentifier(a)))continue;let o=d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isIdentifier(a)&&!n.has(a.text);if(!(!t&&s!==void 0&&(i.get(s)??0)===1&&o))return!0}return!1}function xd(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&d.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function ds(e){let n=e.parent;return n===void 0?!1:d.isPropertyAccessExpression(n)?n.name===e:d.isQualifiedName(n)?n.right===e:d.isBindingElement(n)||d.isImportSpecifier(n)?n.propertyName===e:d.isExportSpecifier(n)?!0:d.isPropertyAssignment(n)||d.isPropertyDeclaration(n)||d.isPropertySignature(n)||d.isMethodDeclaration(n)||d.isMethodSignature(n)||d.isGetAccessorDeclaration(n)||d.isSetAccessorDeclaration(n)||d.isEnumMember(n)?n.name===e:!1}function cs(e){for(let n=e.parent;n!==void 0;n=n.parent){if(d.isSourceFile(n))return!0;if(!d.isArrowFunction(n)&&(d.isFunctionLike(n)||d.isClassLike(n)))return!1}return!0}function Sd(e,n){let t=i=>{d.isIdentifier(i)&&(i.text==="exports"||i.text==="module")&&n.add(i),d.forEachChild(i,t)};t(e)}function bd(e){let n=[],t=new Set;for(let s of e.statements){if(d.isExportDeclaration(s)||d.isExportAssignment(s)||d.isImportDeclaration(s)||d.isImportEqualsDeclaration(s)||yn(s))return null;if(!d.isExpressionStatement(s)||!d.isBinaryExpression(s.expression))continue;let a=s.expression;if(a.operatorToken.kind===d.SyntaxKind.EqualsToken){if(ve(a.left))n.push({kind:"whole",value:a.right});else if(ze(a.left)){let l=fi(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:xd(a.left)})}else continue;Sd(a.left,t)}}let i=!1,r=s=>{if(!i){if(d.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!ds(s)){i=!0;return}if(s.kind===d.SyntaxKind.ThisKeyword&&cs(s)){i=!0;return}if(d.isIdentifier(s)&&s.text==="arguments"&&!ds(s)&&cs(s)){i=!0;return}d.forEachChild(s,r)}};return r(e),i?null:n}function li(e){return d.isIdentifier(e)||d.isStringLiteralLike(e)?e.text:void 0}function us(e,n,t){return d.isIdentifier(e)?n(e.text):t?.(e)}function kd(e,n,t,i){let r=new Map,s=bd(e);if(s===null||s.filter(h=>h.kind==="whole").length>1)return r;let a=s.findIndex(h=>h.kind==="whole"),l=(h,S)=>a>=0&&S>a&&h.kind==="member"&&h.root==="exports",o=s.some(l);if(o){let h=s[a];if(h===void 0||h.kind!=="whole"||!d.isObjectLiteralExpression(h.value))return r}let c=o?s.filter((h,S)=>!l(h,S)):s,u=new Map;for(let h of c)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let f=h=>n.has(h)?void 0:t(h),p=(h,S)=>{S===void 0?r.delete(h):r.set(h,S)};for(let h of c){if(h.kind==="member"){p(h.name,(u.get(h.name)??0)>1?void 0:us(h.value,f,i));continue}r.clear();let S=h.value;if(d.isObjectLiteralExpression(S))for(let x of S.properties){if(d.isSpreadAssignment(x))return new Map;if(d.isShorthandPropertyAssignment(x)){p(x.name.text,f(x.name.text));continue}let y=li(x.name);if(y===void 0)return new Map;p(y,d.isPropertyAssignment(x)?us(x.initializer,f,i):void 0)}}return r}function Ss(e,n,t,i){let r=new Map,s=l=>l!==void 0&&ue(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(d.isVariableDeclaration(l)&&l.initializer!==void 0){let o=l.initializer;if(d.isIdentifier(l.name)&&!i.has(l.name.text)){let c=s(Ye(o));if(c!==void 0)r.set(l.name.text,{kind:"whole",target:c});else if((d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o))&&d.isCallExpression(o.expression)){let u=s(Ye(o.expression)),f=mt(o);u!==void 0&&f!==void 0&&r.set(l.name.text,{kind:"member",target:u,member:f})}}else if(d.isObjectBindingPattern(l.name)){let c=s(Ye(o));if(c!==void 0){for(let u of l.name.elements)if(d.isIdentifier(u.name)&&!i.has(u.name.text)){let f=u.propertyName!==void 0&&d.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;r.set(u.name.text,{kind:"member",target:c,member:f})}}}}d.forEachChild(l,a)};return a(e),r}function Ed(e,n,t,i){let r=a=>a!==void 0&&ue(a)==="relative"?t.get(`${n}::${a}`):void 0,s=r(Ye(e));if(s!==void 0)return{kind:"whole",target:s};if(d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)){let a=mt(e);if(a===void 0)return;let l=r(Ye(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(d.isIdentifier(e.expression)){let o=i.get(e.expression.text);if(o?.kind==="whole")return{kind:"member",target:o.target,member:a}}return}if(d.isIdentifier(e))return i.get(e.text)}function bs(e,n,t,i,r){let s=[],a=!1,l=f=>{if(hs(f))return!0;let p=!1,h=S=>{p||(d.isIdentifier(S)&&r.has(S.text)?p=!0:d.forEachChild(S,h))};return h(f),p},o=(f,p)=>{let h=Ed(f,n,t,i);h!==void 0?s.push({source:h,exportedName:p}):l(f)&&(a=!0)},c=f=>{if(d.isObjectLiteralExpression(f)){for(let p of f.properties)if(d.isSpreadAssignment(p))o(p.expression,"default");else if(d.isPropertyAssignment(p)){let h=d.isIdentifier(p.name)||d.isStringLiteralLike(p.name)?p.name.text:"default";o(p.initializer,h)}else if(d.isShorthandPropertyAssignment(p)){let h=i.get(p.name.text);h!==void 0&&s.push({source:h,exportedName:p.name.text})}return}o(f,"default")},u=f=>{if(d.isBinaryExpression(f)&&f.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(ve(f.left)){c(f.right);return}if(ze(f.left)){let p=d.isPropertyAccessExpression(f.left)?f.left.name.text:d.isElementAccessExpression(f.left)&&d.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";o(f.right,p);return}}else if(d.isExportAssignment(f)&&f.isExportEquals){o(f.expression,"default");return}else if(d.isCallExpression(f)&&In(f)&&f.arguments[0]!==void 0&&xn(f.arguments[0])){for(let p of f.arguments.slice(1))c(p);return}d.forEachChild(f,u)};return u(e),{sources:s,residual:a}}function ks(e){let n=new Set,t=r=>{let s=r;for(;d.isPropertyAccessExpression(s)||d.isElementAccessExpression(s);)s=s.expression;return d.isIdentifier(s)?s.text:void 0},i=r=>{let s=Es(r);if(s!==void 0){let a=t(s);a!==void 0&&n.add(a)}d.forEachChild(r,i)};return i(e),n}function Es(e){return d.isBinaryExpression(e)&&e.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=d.SyntaxKind.LastAssignment&&(d.isPropertyAccessExpression(e.left)||d.isElementAccessExpression(e.left))?e.left:void 0}function ft(e){if(d.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)d.isBindingElement(t)&&n.push(...ft(t.name));return n}function we(e){if(d.isIdentifier(e))return[e.text];if(d.isParenthesizedExpression(e)||d.isAsExpression(e)||d.isNonNullExpression(e)||d.isSatisfiesExpression(e)||d.isTypeAssertionExpression(e)||d.isAwaitExpression(e))return we(e.expression);if(d.isYieldExpression(e))return e.expression!==void 0?we(e.expression):[];if(d.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===d.SyntaxKind.BarBarToken||n===d.SyntaxKind.AmpersandAmpersandToken||n===d.SyntaxKind.QuestionQuestionToken?[...we(e.left),...we(e.right)]:n===d.SyntaxKind.CommaToken?we(e.right):[]}return d.isConditionalExpression(e)?[...we(e.whenTrue),...we(e.whenFalse)]:d.isArrayLiteralExpression(e)?e.elements.flatMap(n=>d.isSpreadElement(n)?we(n.expression):d.isOmittedExpression(n)?[]:we(n)):d.isObjectLiteralExpression(e)?e.properties.flatMap(n=>d.isShorthandPropertyAssignment(n)?[n.name.text]:d.isPropertyAssignment(n)?we(n.initializer):d.isSpreadAssignment(n)?we(n.expression):[]):[]}function ws(e,n){let t=[],i=(l,o)=>{for(let c of l)for(let u of o)c!==u&&t.push({a:c,b:u})},r=l=>d.isIdentifier(l)?[l.text]:d.isArrayLiteralExpression(l)?l.elements.flatMap(r):d.isObjectLiteralExpression(l)?l.properties.flatMap(o=>d.isShorthandPropertyAssignment(o)?[o.name.text]:d.isPropertyAssignment(o)?r(o.initializer):[]):[],s=l=>{d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken?i(r(l.left),we(l.right)):d.isVariableDeclaration(l)&&l.initializer!==void 0?i(ft(l.name),we(l.initializer)):(d.isForOfStatement(l)||d.isForInStatement(l))&&d.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&i(ft(l.initializer.declarations[0].name),we(l.expression)),d.forEachChild(l,s)};s(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:o,b:c}of t)a.has(o)&&!a.has(c)&&(a.add(c),l=!0),a.has(c)&&!a.has(o)&&(a.add(o),l=!0)}return a}function vs(e,n){let t=l=>{if(!d.isPropertyAccessExpression(l)&&!d.isElementAccessExpression(l))return;let o=l;for(;d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o);)o=o.expression;return d.isIdentifier(o)?o.text:void 0},i=[],r=(l,o)=>{for(let u of we(o))i.push({name:l,root:u});let c=t(o);c!==void 0&&i.push({name:l,root:c})},s=l=>{d.isVariableDeclaration(l)&&d.isIdentifier(l.name)&&l.initializer!==void 0?r(l.name.text,l.initializer):d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(l.left)&&r(l.left.text,l.right),d.forEachChild(l,s)};s(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:o,root:c}of i){let u=a.get(c);u!==void 0&&!a.has(o)&&(a.set(o,u),l=!0)}}return a}function Is(e){return ws(e,ks(e))}function wd(e,n){let t=o=>o>=d.SyntaxKind.FirstAssignment&&o<=d.SyntaxKind.LastAssignment,i=o=>{let c=o.parent;if(c===void 0||!d.isObjectLiteralExpression(c))return!1;let u=c.parent;return u!==void 0&&d.isBinaryExpression(u)&&u.operatorToken.kind===d.SyntaxKind.EqualsToken&&u.right===c&&ze(u.left)?!0:u!==void 0&&d.isCallExpression(u)&&In(u)&&u.arguments[0]!==void 0&&xn(u.arguments[0])&&u.arguments.indexOf(c)>0},r=(o,c)=>{if((d.isFunctionDeclaration(c)||d.isFunctionExpression(c))&&c.name===o||d.isVariableDeclaration(c)&&c.name===o||d.isParameter(c)&&c.name===o||d.isBindingElement(c)&&c.name===o||(d.isCallExpression(c)||d.isNewExpression(c))&&c.expression===o)return!0;if((d.isPropertyAccessExpression(c)||d.isElementAccessExpression(c))&&c.expression===o){let u=c;for(;u.parent!==void 0&&(d.isPropertyAccessExpression(u.parent)||d.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let f=u.parent;return!(f!==void 0&&d.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===u)}return d.isBinaryExpression(c)&&c.operatorToken.kind===d.SyntaxKind.EqualsToken&&c.right===o&&ze(c.left)?!0:d.isShorthandPropertyAssignment(c)&&c.name===o||d.isPropertyAssignment(c)&&c.initializer===o?i(c):!!(d.isExportAssignment(c)&&c.expression===o||d.isExportSpecifier(c))},s=(o,c)=>d.isPropertyAccessExpression(c)&&c.name===o||d.isPropertyAssignment(c)&&c.name===o||(d.isMethodDeclaration(c)||d.isGetAccessorDeclaration(c)||d.isSetAccessorDeclaration(c))&&c.name===o,a=!1,l=(o,c)=>{if(!a){if(d.isIdentifier(o)&&c!==void 0&&n.has(o.text)&&!s(o,c)&&!r(o,c)){a=!0;return}d.forEachChild(o,u=>l(u,o))}};return l(e,void 0),a}function vd(e){let n=new Set;for(let o of e.statements)if(d.isFunctionDeclaration(o)&&o.name!==void 0)n.add(o.name.text);else if(d.isVariableStatement(o))for(let c of o.declarationList.declarations)d.isIdentifier(c.name)&&c.initializer!==void 0&&(d.isFunctionExpression(c.initializer)||d.isArrowFunction(c.initializer))&&n.add(c.name.text);let t=new Set,i=o=>{d.isBinaryExpression(o)&&o.operatorToken.kind===d.SyntaxKind.EqualsToken?(ve(o.left)&&(d.isIdentifier(o.right)?t.add(o.right.text):d.isObjectLiteralExpression(o.right)&&ys(o.right,t)),ve(o.right)&&d.isIdentifier(o.left)&&t.add(o.left.text)):d.isVariableDeclaration(o)&&d.isIdentifier(o.name)&&o.initializer!==void 0&&ve(o.initializer)&&t.add(o.name.text),d.forEachChild(o,i)};if(i(e),t.size>0){if(wd(e,t))return!0;let o=vs(e,new Map([...t].map(u=>[u,u]))),c=Is(e);for(let u of o.keys())if(c.has(u))return!0}let r=o=>d.isIdentifier(o)&&n.has(o.text),s=o=>o.properties.every(c=>d.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||d.isPropertyAssignment(c)&&r(c.initializer)),a=!1,l=o=>{if(!a){if(d.isBinaryExpression(o)){let c=o.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=d.SyntaxKind.LastAssignment;c&&ve(o.left)?o.operatorToken.kind===d.SyntaxKind.EqualsToken&&(r(o.right)||d.isObjectLiteralExpression(o.right)&&s(o.right))||(a=!0):c&&ze(o.left)&&(a=!0)}else d.isCallExpression(o)?(In(o)&&o.arguments[0]!==void 0&&xn(o.arguments[0])||ci(o))&&(a=!0):(d.isExportAssignment(o)&&o.isExportEquals&&!d.isIdentifier(o.expression)||d.isExportDeclaration(o)&&o.moduleSpecifier!==void 0)&&(a=!0);a||d.forEachChild(o,l)}};return l(e),a}var Id=8;function fs(e,n,t){let i=new Set,r=Ss(e,n,t,wn(e)),s=bs(e,n,t,r,gs(e));for(let{source:a}of s.sources)i.add(a.target);for(let a of e.statements)if(d.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&d.isStringLiteralLike(a.moduleSpecifier)&&ue(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&i.add(l)}return i}function Ad(e,n,t,i=new Map){let r=new Set(n.modules.filter(b=>b.isEntrypoint).map(b=>String(b.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(b=>b.externalSurface===!0).map(b=>String(b.id))),a=new Map,l=new Map,o=new Map,c=new Map;for(let b of t){if(b.name==="<toplevel>"){c.set(String(b.moduleId),b);continue}if(a.set(`${String(b.moduleId)}::${String(b.declRange.start)}`,b),b.name!==void 0&&l.set(`${String(b.moduleId)}::${b.name}`,b),b.isExported&&b.name!==void 0){let m=o.get(String(b.moduleId))??[];m.push(b),o.set(String(b.moduleId),m)}}if(i.size>0){let b=new Map(t.map(m=>[String(m.id),m]));for(let[m,E]of i){let _=b.get(String(E));_!==void 0&&!a.has(m)&&a.set(m,_)}}let u=new Map;for(let b of n.imports)b.resolvedModuleId!==void 0&&u.set(`${b.moduleId}::${b.specifier}`,String(b.resolvedModuleId));let f=new Map;for(let b of e.sourceFiles){let m=e.toRel(b.fileName);m!==null&&f.set(m,b)}let p=new Map,h=b=>{let m=p.get(b);if(m!==void 0)return m;let E=f.get(b),_=E===void 0?!0:vd(E);return p.set(b,_),_},S=new Set,x=(b,m)=>m!==void 0&&ue(m)==="relative"?u.get(`${b}::${m}`):void 0,y=b=>{if(d.isIdentifier(b))return b.text;if(d.isPropertyAccessExpression(b)){let m=y(b.expression);return m===void 0?void 0:`${m}.${b.name.text}`}if(d.isElementAccessExpression(b)&&d.isStringLiteralLike(b.argumentExpression)){let m=y(b.expression);return m===void 0?void 0:`${m}.${b.argumentExpression.text}`}},v=b=>{let m=b;for(;d.isPropertyAccessExpression(m)||d.isElementAccessExpression(m);)m=m.expression;return Ye(m)};for(let b of e.sourceFiles){let m=e.toRel(b.fileName);if(m===null)continue;let E=new Map,_=new Map,F=(A,j)=>{let z=x(m,Ye(j));if(z!==void 0){if(d.isIdentifier(A))_.set(A.text,z),E.set(A.text,z);else if(d.isObjectBindingPattern(A)||d.isArrayBindingPattern(A))for(let M of ft(A))_.set(M,z);else if(d.isPropertyAccessExpression(A)||d.isElementAccessExpression(A)){let M=y(A);M!==void 0&&E.set(M,z)}}},O=A=>{d.isVariableDeclaration(A)&&A.initializer!==void 0?F(A.name,A.initializer):d.isBinaryExpression(A)&&A.operatorToken.kind===d.SyntaxKind.EqualsToken&&F(A.left,A.right),d.forEachChild(A,O)};O(b);let I=A=>{let j=Es(A);if(j!==void 0){let z=j.expression,M=x(m,v(z));M!==void 0&&S.add(M);let X=y(z),H=X!==void 0?E.get(X):void 0;H!==void 0&&S.add(H)}d.forEachChild(A,I)};if(I(b),_.size>0){let A=vs(b,_),j=Is(b);for(let[z,M]of A)j.has(z)&&S.add(M)}}let C=[],$=[],N=[];for(let b of e.sourceFiles){let m=e.toRel(b.fileName);if(m===null||!r.has(m))continue;let E=e.checker.getSymbolAtLocation(b),_=new Set,F=new Set,O=0,I=(D,W)=>{if(s.has(String(D.moduleId))||_.has(String(D.id)))return;_.add(String(D.id));let se=`${m}#reexport:${String(O)}:${W}`;O+=1,C.push({id:se,moduleId:m,exportedName:W,kind:"value",reexportOf:{moduleId:String(D.moduleId),name:D.name??W}}),$.push({exportId:se,target:{kind:"function",functionId:D.id}})},A=D=>{if(ud(D))return;let W=D;if((D.flags&d.SymbolFlags.Alias)!==0)try{W=e.checker.getAliasedSymbol(D)}catch{return}let se=fd(W,e,a,l,s);if(se!==void 0){I(se,D.getName());return}if((W.flags&d.SymbolFlags.Module)!==0&&!F.has(W)){F.add(W);try{for(let Fe of e.checker.getExportsOfModule(W))A(Fe)}catch{}}};if(E!==void 0)for(let D of e.checker.getExportsOfModule(E))A(D);let j=Ss(b,m,u,wn(b)),z=bs(b,m,u,j,gs(b)),M=new Set,X=z.residual,H=D=>{let W=f.get(D);D.includes("node_modules/")||W===void 0||dd(W)?X=!0:M.add(D)};for(let{source:D,exportedName:W}of z.sources){let se=o.get(D.target)??[],Fe=S.has(D.target);if(D.kind==="whole"){for(let Ie of se)I(Ie,Ie.name??W);Fe?X=!0:(se.length===0||h(D.target))&&H(D.target)}else{let Ie=se.filter(be=>be.name===D.member);for(let be of Ie)I(be,W);Fe?X=!0:(Ie.length===0||h(D.target))&&H(D.target)}}let K=new Set,V=[];for(let D of fs(b,m,u))V.push({target:D,depth:1});for(;V.length>0;){let D=V.shift();if(D===void 0)break;let{target:W,depth:se}=D;if(K.has(W)||se>Id||(K.add(W),W.split("/").includes("node_modules")))continue;let Fe=f.get(W);if(Fe===void 0)continue;let Ie=c.get(W);Ie!==void 0&&!h(W)&&I(Ie,"<load>");for(let be of fs(Fe,W,u))K.has(be)||V.push({target:be,depth:se+1})}yd(b,wn(b))&&(X=!0);for(let D of M)N.push({code:"unresolved-reexport",path:m,detail:`entrypoint whole/member re-exports app-owned relative module ${D} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:D});X&&N.push({code:"unresolved-reexport",path:m,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:C,exportBindings:$,diagnostics:N}}var vn=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),_d=new Set(["defineProperty","defineProperties","create"]);function Nd(e){let n=!0,t=r=>d.isIdentifier(r)||d.isStringLiteral(r)||d.isNumericLiteral(r)?vn.has(r.text):d.isComputedPropertyName(r)&&d.isStringLiteralLike(r.expression)?vn.has(r.expression.text):!1,i=r=>{if(n){if(d.isNewExpression(r)||d.isForOfStatement(r)||d.isSpreadElement(r)||d.isSpreadAssignment(r)||d.isArrayBindingPattern(r)||d.isGetAccessorDeclaration(r)||d.isSetAccessorDeclaration(r)||d.isYieldExpression(r)&&r.asteriskToken!==void 0||d.canHaveDecorators(r)&&(d.getDecorators(r)?.length??0)>0){n=!1;return}if((d.isPropertyAccessExpression(r)||d.isMethodDeclaration(r)||d.isPropertyAssignment(r))&&t(r.name)||d.isPropertyDeclaration(r)&&t(r.name)||d.isShorthandPropertyAssignment(r)&&t(r.name)||d.isBindingElement(r)&&t(r.propertyName??r.name)||d.isElementAccessExpression(r)&&d.isStringLiteralLike(r.argumentExpression)&&vn.has(r.argumentExpression.text)){n=!1;return}if(d.isCallExpression(r)&&d.isPropertyAccessExpression(r.expression)&&d.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&_d.has(r.expression.name.text)){n=!1;return}d.forEachChild(r,i)}};return i(e),n}function ht(e){if(d.isIdentifier(e)||d.isStringLiteral(e)||d.isNumericLiteral(e))return e.text}function As(e){let n=t=>d.canHaveDecorators(t)&&(d.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Cd(e){let n=!1,t=new Set,i=[],r=new Map,s=(p,h)=>{let S=r.get(p);S===void 0?r.set(p,[h]):S.push(h)},a=p=>{d.isIdentifier(p)?t.add(p.text):i.push(p)},l=p=>{for(let h of p.properties)d.isShorthandPropertyAssignment(h)?t.add(h.name.text):d.isPropertyAssignment(h)?i.push(h.initializer):n=!0},o=p=>{if(d.isBinaryExpression(p)&&p.operatorToken.kind===d.SyntaxKind.EqualsToken){let h=p.left,S=p.right;ve(h)?d.isObjectLiteralExpression(S)?l(S):d.isIdentifier(S)||d.isFunctionExpression(S)||d.isArrowFunction(S)||d.isClassExpression(S)?a(S):n=!0:ze(h)?(d.isElementAccessExpression(h)&&!d.isStringLiteralLike(h.argumentExpression)&&(n=!0),a(S)):d.isIdentifier(h)?s(h.text,S):(d.isPropertyAccessExpression(h)||d.isElementAccessExpression(h))&&d.isIdentifier(h.expression)&&s(h.expression.text,S)}else if(d.isCallExpression(p))(In(p)&&p.arguments[0]!==void 0&&xn(p.arguments[0])||ci(p))&&(n=!0);else if(d.isVariableDeclaration(p)&&d.isIdentifier(p.name)&&p.initializer!==void 0)s(p.name.text,p.initializer);else if((d.isFunctionDeclaration(p)||d.isClassDeclaration(p))&&p.name!==void 0)s(p.name.text,p),yn(p)&&t.add(p.name.text);else if(d.isExportDeclaration(p)){if(p.exportClause===void 0)n=!0;else if(p.moduleSpecifier===void 0&&d.isNamedExports(p.exportClause))for(let h of p.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(d.isExportAssignment(p))p.isExportEquals&&!d.isIdentifier(p.expression)?n=!0:a(p.expression);else if(d.isVariableStatement(p)&&yn(p))for(let h of p.declarationList.declarations)d.isIdentifier(h.name)&&t.add(h.name.text);d.forEachChild(p,o)};o(e);let c=new Set,u=[...t],f=p=>{let h=S=>{d.isIdentifier(S)&&u.push(S.text),d.forEachChild(S,h)};h(p)};for(let p of i)f(p);for(;u.length>0;){let p=u.pop();if(!(p===void 0||c.has(p))){c.add(p);for(let h of r.get(p)??[])f(h)}}return{names:c,opaque:n}}var Od=512,Rd=new Set(["get","post","put","patch","delete","options","head"]);function $d(e){for(let n of e.statements){if(d.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(n.expression.left)&&d.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,i=n.expression.left.name.text;if(t==="module"&&i==="exports"||t==="exports"&&i==="default")return n.expression.right}}return null}function Md(e){let n=new Map,t=$d(e);if(t===null)return n;let i=s=>{for(let a of s.properties)if(d.isPropertyAssignment(a)&&d.isObjectLiteralExpression(a.initializer)){let l=ht(a.name);l!==void 0&&n.set(l,a.initializer)}};if(d.isObjectLiteralExpression(t))return i(t),n;if(!d.isIdentifier(t))return n;let r=t.text;for(let s of e.statements)if(d.isVariableStatement(s))for(let a of s.declarationList.declarations)d.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&d.isObjectLiteralExpression(a.initializer)&&i(a.initializer);else if(d.isExpressionStatement(s)&&d.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(s.expression.left)&&d.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===r&&d.isObjectLiteralExpression(s.expression.right)){let a=s.expression.left.name.text;n.set(a,s.expression.right)}return n}function Pd(e){for(let n of e.properties){if(d.isMethodDeclaration(n)&&d.isIdentifier(n.name)&&n.name.text==="handler")return n;if(d.isPropertyAssignment(n)&&d.isIdentifier(n.name)&&n.name.text==="handler"&&(d.isArrowFunction(n.initializer)||d.isFunctionExpression(n.initializer)))return n.initializer}return null}function Ld(e,n){for(let i of e.properties){let r;if(d.isPropertyAssignment(i)||d.isMethodDeclaration(i)?r=ht(i.name):d.isShorthandPropertyAssignment(i)&&(r=i.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Td(e,n){let t=[],i=new Set,r=(l,o,c)=>{if(t.length>=Od||l==="__proto__"||!ui.test(l))return;let u=`${e}#handler:${l}`;i.has(u)||(i.add(u),t.push({id:u,node:o,memberPath:l,idiom:c}))};for(let[l,o]of Md(n)){let c=Pd(o);c!==null&&Ld(o,c)&&r(l,c,"descriptor-object")}let s=0,a=l=>{if(d.isCallExpression(l)&&d.isPropertyAccessExpression(l.expression)&&d.isIdentifier(l.expression.expression)&&Rd.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&d.isStringLiteralLike(l.arguments[0])){let o=l.expression.name.text;for(let c=1;c<l.arguments.length;c+=1){let u=l.arguments[c];u!==void 0&&(d.isArrowFunction(u)||d.isFunctionExpression(u))&&r(`${o}_${String(s)}_${String(c)}`,u,"router-verb")}s+=1}d.forEachChild(l,a)};return a(n),t}function Dd(e,n,t,i,r,s){let a=`${e}#class:${t}`,l=[],o=new Set;for(let c of i.members){let u,f,p;if(d.isConstructorDeclaration(c))u="constructor",f="ctor",p=!1;else if(d.isMethodDeclaration(c))u=ht(c.name),f="method",p=u!==void 0&&!vn.has(u);else continue;if(u===void 0||o.has(u))continue;o.add(u);let h=`${e}#${t}.${u}`;r.push({id:h,moduleId:e,name:u,kind:f,enclosingClassId:a,declRange:an(e,c,n),isExported:!1,publicSurfaceReachable:!1}),l.push(h),p&&s.push({start:c.getStart(n,!1),end:c.getEnd(),id:h})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function Fd(e,n,t=[],i=!1,r){let s=[],a=new Map,l=[],{reachableLocals:o,defaultTarget:c}=ad(n),u=wn(n),f=`${e}#<toplevel>`;s.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let p=(m,E)=>{let _=`${e}#${m}`;return s.push({id:_,moduleId:e,name:m,kind:"function",declRange:an(e,E,n),isExported:o.has(m),publicSurfaceReachable:o.has(m)}),a.set(m,{kind:"function",functionId:_}),l.push({start:E.getStart(n,!1),end:E.getEnd(),id:_}),_},h=[],S=!e.split("/").includes("node_modules");if(S)for(let m of gd(n,u))o.add(m);let x=S?Cd(n):void 0,y=(m,E,_)=>{x===void 0||x.opaque||x.names.has(m)||yn(_)||As(E)||h.push(Dd(e,n,m,E,s,l))};for(let m of n.statements)if(d.isFunctionDeclaration(m)&&m.name!==void 0)p(m.name.text,m);else if(d.isClassDeclaration(m)&&m.name!==void 0)y(m.name.text,m,m);else if(d.isVariableStatement(m))for(let E of m.declarationList.declarations){if(d.isObjectBindingPattern(E.name)&&E.initializer!==void 0&&d.isCallExpression(E.initializer)&&d.isIdentifier(E.initializer.expression)&&E.initializer.expression.text==="require"&&E.initializer.arguments.length===1&&E.initializer.arguments[0]!==void 0&&d.isStringLiteralLike(E.initializer.arguments[0])){let F=E.initializer.arguments[0].text;for(let O of E.name.elements){if(O.dotDotDotToken!==void 0||O.initializer!==void 0||!d.isIdentifier(O.name))continue;let I=O.propertyName??O.name;!d.isIdentifier(I)&&!d.isStringLiteralLike(I)||a.set(O.name.text,{kind:"import",specifier:F,form:{named:I.text}})}continue}if(!d.isIdentifier(E.name)||E.initializer===void 0)continue;let _=E.initializer;if(d.isFunctionExpression(_)||d.isArrowFunction(_))p(E.name.text,E);else if(d.isClassExpression(_))y(E.name.text,_,m);else if(d.isCallExpression(_)&&d.isIdentifier(_.expression)&&_.expression.text==="require"&&_.arguments.length===1&&_.arguments[0]!==void 0&&d.isStringLiteralLike(_.arguments[0]))a.set(E.name.text,{kind:"import",specifier:_.arguments[0].text,form:"whole"});else if((d.isPropertyAccessExpression(_)||d.isElementAccessExpression(_))&&mt(_)==="default"&&d.isCallExpression(_.expression)){let F=Ye(_.expression);F!==void 0&&a.set(E.name.text,{kind:"import",specifier:F,form:"require-default"})}}else if(d.isImportDeclaration(m)&&d.isStringLiteralLike(m.moduleSpecifier)){let E=m.moduleSpecifier.text,_=m.importClause;if(_!==void 0){_.name!==void 0&&a.set(_.name.text,{kind:"import",specifier:E,form:"default"});let F=_.namedBindings;if(F!==void 0&&d.isNamespaceImport(F))a.set(F.name.text,{kind:"import",specifier:E,form:"namespace"});else if(F!==void 0&&d.isNamedImports(F))for(let O of F.elements){let I=(O.propertyName??O.name).text;a.set(O.name.text,{kind:"import",specifier:E,form:{named:I}})}}}else d.isImportEqualsDeclaration(m)&&d.isExternalModuleReference(m.moduleReference)&&d.isStringLiteralLike(m.moduleReference.expression)&&a.set(m.name.text,{kind:"import",specifier:m.moduleReference.expression.text,form:"whole"});let v=new Map,C,$=new Map,N=new Map;if(S)for(let{name:m,value:E}of hd(n)){let _=`${e}#member-export:${m}`;s.push({id:_,moduleId:e,name:m,kind:d.isArrowFunction(E)?"arrow":"function",declRange:an(e,E,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:E.getStart(n,!1),end:E.getEnd(),id:_}),v.set(E.getStart(n,!1),_)}if(i&&S){let m=I=>{let A=Ne(I);return d.isFunctionExpression(A)||d.isArrowFunction(A)?A:void 0},E=(I,A)=>{let j=I;return s.push({id:j,moduleId:e,kind:d.isArrowFunction(A)?"arrow":"function",declRange:an(e,A,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:A.getStart(n,!1),end:A.getEnd(),id:j}),v.set(A.getStart(n,!1),j),j},_=[],F=[],O=[];for(let I of n.statements)d.isExportAssignment(I)&&!I.isExportEquals?_.push(I):d.isFunctionDeclaration(I)&&d.getModifiers(I)?.some(A=>A.kind===d.SyntaxKind.DefaultKeyword)===!0?F.push(I):d.isExpressionStatement(I)&&d.isBinaryExpression(I.expression)&&I.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&ve(I.expression.left)&&O.push(I.expression);if(_.length+F.length+O.length===1){let I=_[0],A=F[0],j=O[0];if(I!==void 0){let z=m(I.expression);if(z!==void 0){let M=E(`${e}#<default>`,z);C={id:M,esm:!0},N.set(I.getStart(n,!1),M),te(r,"2a-default",null)}}else if(A!==void 0&&A.name===void 0&&A.body!==void 0){let z=E(`${e}#<default>`,A);C={id:z,esm:!0},N.set(A.getStart(n,!1),z),te(r,"2a-default",null)}else if(j!==void 0){let z=m(j.right);if(z!==void 0){let M=E(`${e}#<default>`,z);C={id:M,esm:!1},N.set(j.getStart(n,!1),M),te(r,"2a-default",null)}else if(d.isObjectLiteralExpression(j.right)){let M=j.right,X=[],H=!0;for(let K of M.properties){if(d.isSpreadAssignment(K)){H=!1;break}let V=K.name,D=V===void 0?void 0:li(V);if(D===void 0){H=!1;break}X.push(D)}if(H){let K=new Map;for(let V of X)K.set(V,(K.get(V)??0)+1);for(let V of M.properties){if(!d.isPropertyAssignment(V))continue;let D=li(V.name),W=m(V.initializer);if(D!==void 0){if(!pd(D)){W!==void 0&&te(r,"2a-member","charset-refused");continue}if((K.get(D)??0)!==1){W!==void 0&&te(r,"2a-member","duplicate-key");continue}if(W!==void 0){let se=E(`${e}#<cjs>.${D}`,W);$.set(D,se),N.set(V.getStart(n,!1),se),te(r,"2a-member",null)}}}}else for(let K of M.properties)d.isPropertyAssignment(K)&&m(K.initializer)!==void 0&&te(r,"2a-member","spread-or-computed-literal")}}}else{for(let I of _)m(I.expression)!==void 0&&te(r,"2a-default","duplicate-default-sources");for(let I of F)I.name===void 0&&te(r,"2a-default","duplicate-default-sources");for(let I of O)if(m(I.right)!==void 0)te(r,"2a-default","duplicate-default-sources");else if(d.isObjectLiteralExpression(I.right))for(let A of I.right.properties)d.isPropertyAssignment(A)&&m(A.initializer)!==void 0&&te(r,"2a-member","duplicate-default-sources")}}for(let m of t)s.push({id:m.id,moduleId:e,name:`handler:${m.memberPath}`,kind:d.isArrowFunction(m.node)?"arrow":"function",declRange:an(e,m.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:m.node.getStart(n,!1),end:m.node.getEnd(),id:m.id});l.sort((m,E)=>m.end-m.start-(E.end-E.start));let b=c!==void 0?`${e}#${c}`:void 0;return{rel:e,sf:n,functions:s,bindings:a,exportedFunctionId:b,exportedNames:o,tainted:u,fnRanges:l,toplevelId:f,classes:h,mintedByPos:v,mintedDefault:C,mintedMembers:$,mintSeedAliases:N}}function jd(e){return d.isIdentifier(e)?"identifier":d.isPropertyAccessExpression(e)?"member":d.isElementAccessExpression(e)?"computed-member":e.kind===d.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function ps(e,n){let t=i=>{if(d.isBinaryExpression(i)&&i.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=d.SyntaxKind.LastAssignment){let r=i.left;d.isPropertyAccessExpression(r)&&d.isIdentifier(r.expression)?n(r.expression.text,r.name.text):d.isElementAccessExpression(r)&&d.isIdentifier(r.expression)&&n(r.expression.text,d.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(d.isCallExpression(i)&&d.isPropertyAccessExpression(i.expression)){let r=i.expression,s=i.arguments[0];d.isIdentifier(r.expression)&&s!==void 0&&d.isIdentifier(s)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(s.text,null)}d.forEachChild(i,t)};t(e)}function Kd(e){let n=!1,t=i=>{if(!n){if(d.isVariableDeclaration(i)||d.isParameter(i)){let r=new Set;if(Mn(i.name,r),r.has("require")){n=!0;return}}else if((d.isFunctionDeclaration(i)||d.isClassDeclaration(i))&&i.name!==void 0&&i.name.text==="require"){n=!0;return}d.forEachChild(i,t)}};return t(e),n}function Bd(e,n,t,i=new Map,r={}){let s=r.additiveForms===!0,a=r.namelessExports===!0,l=s||a?{}:void 0,o=new Map,c=new Map;for(let m of n.imports)m.resolvedModuleId!==void 0&&c.set(`${m.moduleId}::${m.specifier}`,m.resolvedModuleId);for(let m of e.sourceFiles){let E=e.toRel(m.fileName);E!==null&&o.set(E,Fd(E,m,i.get(E)??[],a,l))}let u=new Map;if(s)for(let m of o.values()){let E=new Map;for(let[_,F]of m.bindings)if(F.kind==="import"&&F.form==="whole"&&ue(F.specifier)!=="package-root"){let O=c.get(`${m.rel}::${F.specifier}`);O!==void 0&&E.set(_,String(O))}E.size!==0&&ps(m.sf,(_,F)=>{let O=E.get(_);if(O===void 0)return;let I=u.get(O);if(I!=="*"){if(F===null){u.set(O,"*");return}I===void 0?u.set(O,new Set([F])):I.add(F)}})}let f=new Map;for(let m of o.values())m.exportedFunctionId!==void 0&&f.set(m.rel,m.exportedFunctionId);let p=new Map;for(let m of o.values()){if(m.rel.split("/").includes("node_modules"))continue;let E=ld(m.sf);if(E===void 0){a&&m.mintedDefault!==void 0&&p.set(m.rel,m.mintedDefault);continue}let _=m.bindings.get(E.name);_?.kind==="function"&&p.set(m.rel,{id:_.functionId,esm:E.esm})}let h=new Map;for(let m of o.values()){let E;for(let _ of m.exportedNames){let F=m.bindings.get(_);F?.kind==="function"&&(E??=new Map,E.set(_,F.functionId))}E!==void 0&&h.set(m.rel,E)}let S=new Map;for(let m of o.values()){if(m.rel.split("/").includes("node_modules"))continue;let E=kd(m.sf,m.tainted,_=>{let F=m.bindings.get(_);return F?.kind==="function"?F.functionId:void 0},a?_=>{let F=Ne(_);return d.isFunctionExpression(F)||d.isArrowFunction(F)?m.mintedByPos.get(F.getStart(m.sf,!1)):void 0}:void 0);E.size>0&&S.set(m.rel,E)}let x=[],y=[],v=[],C=[],$=[],N=[];for(let m of o.values()){x.push(...m.functions),N.push(...m.classes);for(let k of m.exportedNames){let w=m.bindings.get(k);if(w?.kind==="function"){let R=`${m.rel}#export:${k}`;C.push({id:R,moduleId:m.rel,exportedName:k,kind:"value"}),$.push({exportId:R,target:{kind:"function",functionId:w.functionId}})}}if(a){if(m.mintedDefault!==void 0){let k=`${m.rel}#export:<default>`;C.push({id:k,moduleId:m.rel,exportedName:"default",kind:"value"}),$.push({exportId:k,target:{kind:"function",functionId:m.mintedDefault.id}})}for(let[k,w]of m.mintedMembers){let R=`${m.rel}#export:<cjs>.${k}`;C.push({id:R,moduleId:m.rel,exportedName:k,kind:"value"}),$.push({exportId:R,target:{kind:"function",functionId:w}})}}let E=new Map;for(let[k,w]of m.bindings){if(w.kind==="function"){E.set(k,w);continue}if(ue(w.specifier)==="package-root"){let P=We(w.specifier);typeof w.form=="object"?E.set(k,{kind:"package-export",packageName:P,exportName:w.form.named}):w.form==="require-default"?E.set(k,{kind:"package-default",packageName:P}):E.set(k,{kind:"package-surface",packageName:P})}else{let P=c.get(`${m.rel}::${w.specifier}`);if(P!==void 0&&typeof w.form=="object"){let Y=h.get(String(P))?.get(w.form.named);Y!==void 0&&E.set(k,{kind:"app-named-fn",functionId:Y})}else if(P!==void 0&&w.form==="require-default"){let Y=p.get(String(P));Y!==void 0&&Y.esm&&E.set(k,{kind:"app-default-fn",functionId:Y.id})}else P!==void 0&&typeof w.form!="object"&&w.form!=="require-default"&&E.set(k,{kind:"module",resolvedModuleId:P})}}let _=new Map;for(let k of m.functions){if(k.enclosingClassId===void 0||k.name===void 0)continue;let w=_.get(k.enclosingClassId);w===void 0&&(w=new Map,_.set(k.enclosingClassId,w)),w.set(k.name,k.id)}for(let k of m.classes)k.name===void 0||m.tainted.has(k.name)||E.has(k.name)||E.set(k.name,{kind:"app-class",cls:{classId:k.id,className:k.name,memberIds:_.get(k.id)??new Map}});let F=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0&&d.isNewExpression(k.initializer)&&!m.tainted.has(k.name.text)&&!E.has(k.name.text)){let w=as(k.initializer,E,m.tainted);w!==null&&E.set(k.name.text,w)}d.forEachChild(k,F)};F(m.sf);let O=k=>{for(let w of m.fnRanges)if(k>=w.start&&k<w.end)return w.id;return m.toplevelId},I=new Map,A=new Map,j=new Map,z=(k,w,R)=>{if(R===null){k.set(w,"*");return}let P=k.get(w);P!=="*"&&(P===void 0?k.set(w,new Set([R])):P.add(R))},M=(k,w)=>{z(I,k,w);let R=E.get(k);R?.kind==="package-surface"?z(A,R.packageName,w):R?.kind==="module"&&z(j,String(R.resolvedModuleId),w)};ps(m.sf,M);let X=new Map,H=256,K=k=>{let w=X.get(k);return w===void 0&&(w=X.size>=H?new Set([k]):ws(m.sf,new Set([k])),X.set(k,w)),w},V=(k,w)=>k==="*"||k!==void 0&&k.has(w),D=(k,w)=>{let R=E.get(k);if(R?.kind==="package-surface"&&V(A.get(R.packageName),w)||R?.kind==="module"&&V(j.get(String(R.resolvedModuleId)),w))return!0;for(let P of K(k))if(V(I.get(P),w))return!0;return!1},W=k=>{if(d.isIdentifier(k)){let w=m.tainted.has(k.text)?void 0:E.get(k.text);return w?.kind==="function"?w.functionId:w?.kind==="module"?f.get(String(w.resolvedModuleId))??null:w?.kind==="package-export"?t.exportFor(w.packageName,w.exportName):null}if(d.isPropertyAccessExpression(k)&&d.isIdentifier(k.expression)){let w=k.expression.text;if(D(w,k.name.text))return null;let R=m.tainted.has(w)?void 0:E.get(w);return R?.kind==="package-surface"?t.exportFor(R.packageName,k.name.text):R?.kind==="package-export"?t.methodFor(R.packageName,R.exportName,k.name.text,"method"):R?.kind==="package-instance"?t.methodFor(R.packageName,R.className,k.name.text,"method"):null}return null},se=k=>{for(let w=k.parent;w!==void 0;w=w.parent)if(!d.isArrowFunction(w)){if(d.isFunctionExpression(w)||d.isFunctionDeclaration(w))return null;if(d.isMethodDeclaration(w)||d.isConstructorDeclaration(w)||d.isGetAccessorDeclaration(w)||d.isSetAccessorDeclaration(w)){let R=w.parent;if(!d.isClassLike(R)||R.name===void 0)return null;let P=m.tainted.has(R.name.text)?void 0:E.get(R.name.text);return P?.kind==="app-class"?P.cls:null}}return null},Fe=s&&!m.tainted.has("require")&&!Kd(m.sf),Ie=k=>{if(d.isIdentifier(k)){let P=m.tainted.has(k.text)?void 0:E.get(k.text);return P?.kind==="package-surface"||P?.kind==="package-default"?t.exportFor(P.packageName,"default"):P?.kind==="app-named-fn"||P?.kind==="app-default-fn"?P.functionId:P?.kind==="module"?p.get(String(P.resolvedModuleId))?.id??null:P?.kind==="member-value"?P.functionId:null}if(!d.isPropertyAccessExpression(k))return null;let w=k.expression;if(s&&d.isCallExpression(Ne(w))){let P=Ye(Ne(w));if(P!==void 0)if(!Fe)te(l,"2b","require-shadow");else if(ue(P)==="package-root")te(l,"2b","package-root");else{let Y=c.get(`${m.rel}::${P}`);if(Y===void 0)te(l,"2b","unresolved-module");else{let ie=k.name.text,ge=u.get(String(Y));if(ge==="*"||ge!==void 0&&ge.has(ie))te(l,"2b","module-mutation-gate");else{let Oe=S.get(String(Y))?.get(ie);if(Oe!==void 0)return te(l,"2b",null),Oe;if(ie==="default"){let ye=p.get(String(Y));if(ye!==void 0&&ye.esm)return te(l,"2b",null),ye.id;te(l,"2b","non-esm-default")}else te(l,"2b","unknown-member")}}}return null}let R;if(d.isIdentifier(w)){let P=m.tainted.has(w.text)?void 0:E.get(w.text);if(P?.kind==="app-class"||P?.kind==="app-instance")R=P.cls.memberIds;else if(P?.kind==="object-literal")R=P.obj.members;else if(P?.kind==="module"){let Y=S.get(String(P.resolvedModuleId));Y?.has(k.name.text)===!0&&!D(w.text,k.name.text)&&(R=Y)}}else if(d.isNewExpression(w)){let P=as(w,E,m.tainted);P?.kind==="app-instance"&&(R=P.cls.memberIds)}else w.kind===d.SyntaxKind.ThisKeyword&&(R=se(k)?.memberIds);return R?.get(k.name.text)??null},be=new Map,dn=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0&&d.isObjectLiteralExpression(k.initializer)&&!m.tainted.has(k.name.text)&&!E.has(k.name.text)&&!be.has(k.name.text)){let w=new Map;for(let R of k.initializer.properties)if(d.isPropertyAssignment(R)&&d.isIdentifier(R.name)){let P=W(R.initializer);P!==null&&w.set(R.name.text,P)}be.set(k.name.text,w)}d.forEachChild(k,dn)};dn(m.sf);let cn=k=>{if(d.isBinaryExpression(k)&&k.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(k.left)&&d.isIdentifier(k.left.expression)&&!m.tainted.has(k.left.expression.text)){let w=be.get(k.left.expression.text);if(w!==void 0){let R=W(k.right);R!==null&&w.set(k.left.name.text,R)}}d.forEachChild(k,cn)};cn(m.sf);for(let[k,w]of be)E.set(k,{kind:"object-literal",obj:{members:w}});let un=(k,w=0)=>{if(w>ss)return null;let R=Ne(k);if(d.isCallExpression(R)&&d.isPropertyAccessExpression(R.expression)&&R.expression.name.text==="bind")return un(R.expression.expression,w+1);if(d.isIdentifier(R)){let P=W(R);if(P!==null)return P;let Y=m.tainted.has(R.text)?void 0:E.get(R.text);return Y?.kind==="member-value"?Y.functionId:null}return d.isPropertyAccessExpression(R)?W(R)??Ie(R):null},B=(k,w=0)=>{if(w>ss)return"depth-cap";let R=Ne(k);if(d.isCallExpression(R)&&d.isPropertyAccessExpression(R.expression)&&R.expression.name.text==="bind")return B(R.expression.expression,w+1);if(d.isIdentifier(R))return m.tainted.has(R.text)?"tainted-receiver":"unresolved-receiver";if(d.isPropertyAccessExpression(R)&&d.isIdentifier(R.expression)){if(m.tainted.has(R.expression.text))return"tainted-receiver";if(D(R.expression.text,R.name.text))return"mutated-member"}return"unresolved-receiver"},ke=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0){let w=Ne(k.initializer),R=d.isPropertyAccessExpression(w),P=d.isCallExpression(w)&&d.isPropertyAccessExpression(w.expression)&&w.expression.name.text==="bind";if(R||P){let Y=R?"D1":"A2";if(m.tainted.has(k.name.text))te(l,Y,"tainted-alias");else if(E.has(k.name.text))te(l,Y,"already-bound");else{let ie=un(w);ie!==null?(E.set(k.name.text,{kind:"member-value",functionId:ie}),te(l,Y,null)):te(l,Y,B(w))}}}d.forEachChild(k,ke)};s&&ke(m.sf);let fe=0,de=k=>{let w,R;if(d.isCallExpression(k)){let P=k.expression,Y=d.isIdentifier(P)&&P.text==="require",ie=P.kind===d.SyntaxKind.ImportKeyword;!Y&&!ie&&(w=P,R=k.arguments)}else d.isTaggedTemplateExpression(k)&&(w=k.tag);if(w!==void 0){let P=jd(w),Y=k.getStart(m.sf,!1),ie=`${m.rel}#call${String(fe)}`;fe+=1;let ge="unresolved",Oe=[],ye=W(w);ye!==null&&(ge="resolved",Oe.push(ye)),y.push({id:ie,enclosingFunctionId:O(Y),calleeExprShape:P,resolvedTargetIds:Oe,resolution:ge,range:an(m.rel,k,m.sf)});for(let Z of Oe)v.push({callSiteId:ie,calleeFunctionId:Z,resolution:ge});if(ye===null){let Z=Ie(w);if(Z!==null)v.push({callSiteId:ie,calleeFunctionId:Z,resolution:"field-based"});else if(s&&d.isPropertyAccessExpression(w)&&(w.name.text==="call"||w.name.text==="apply")){let xe=un(w.expression);xe!==null?(v.push({callSiteId:ie,calleeFunctionId:xe,resolution:"field-based"}),te(l,"A3",null)):te(l,"A3",B(w.expression))}}for(let Z of R??[]){let xe=W(Z);if(xe!==null)v.push({callSiteId:ie,calleeFunctionId:xe,resolution:"field-based"});else{let he=Ie(Z);if(he!==null)v.push({callSiteId:ie,calleeFunctionId:he,resolution:"field-based"});else if(s){let Le=un(Z),Re=Ne(Z),q=Re!==Z||d.isCallExpression(Re)&&d.isPropertyAccessExpression(Re.expression)&&Re.expression.name.text==="bind";Le!==null?(v.push({callSiteId:ie,calleeFunctionId:Le,resolution:"field-based"}),q&&te(l,"A2p",null)):q&&te(l,"A2p",B(Z))}}}}d.forEachChild(k,de)};de(m.sf);for(let k of n.computedLoads.get(m.rel)??[]){let w=k.candidateRels.filter(P=>o.has(P)).map(P=>`${P}#<toplevel>`);if(w.length===0)continue;let R=`${m.rel}#dirload${String(fe)}`;fe+=1,y.push({id:R,enclosingFunctionId:O(k.pos),calleeExprShape:"require",resolvedTargetIds:w,resolution:"field-based",range:{path:m.rel,start:k.pos,end:k.pos}});for(let P of w)v.push({callSiteId:R,calleeFunctionId:P,resolution:"field-based"})}let je=0;for(let k of i.get(m.rel)??[]){let w=`${m.rel}#handlerseed${String(je)}`;je+=1;let R=k.node.getStart(m.sf,!1);y.push({id:w,enclosingFunctionId:m.toplevelId,calleeExprShape:"member",resolvedTargetIds:[k.id],resolution:"field-based",range:{path:m.rel,start:R,end:R}}),v.push({callSiteId:w,calleeFunctionId:k.id,resolution:"field-based"})}}let b=new Map;if(a)for(let m of o.values())for(let[E,_]of m.mintSeedAliases)b.set(`${m.rel}::${String(E)}`,_);return{functions:x,callSites:y,callEdges:v,exports:C,exportBindings:$,classes:N,mintSeedAliases:b,bindingApplicability:l}}function zd(e,n,t){let i=o=>o.length===0||Ce.isAbsolute(o)||o.includes("\\")||/^[a-zA-Z]:/u.test(o)||o.split("/").some(c=>c===".."||c==="");if(i(n)||i(t))return null;let r=e.endsWith(Ce.sep)?e:e+Ce.sep,s;try{s=rs(Ce.resolve(e,n))}catch{return null}if(!s.startsWith(r))return null;let a=s.endsWith(Ce.sep)?s:s+Ce.sep,l;try{l=rs(Ce.resolve(s,t))}catch{return null}return l.startsWith(a)?l:null}function _s(e,n,t){let i=`${e}#class:${t}`,r=[],s=[],a=[],l=new Set;return{pushMember(o,c,u,f){if(o==="__proto__"||l.has(o))return;l.add(o);let p=`${e}#${t}.${o}`;r.push({id:p,moduleId:e,name:o,kind:u,enclosingClassId:i,declRange:an(e,c,n),isExported:!1,publicSurfaceReachable:!1}),a.push(p),s.push({name:o,id:p,kind:u,body:f})},finish(){return s.length===0?null:{functions:r,classNode:{id:i,moduleId:e,name:t,implementsRefs:[],members:a},members:s}}}}function Ud(e,n,t,i){if(As(i)||i.members.length>di)return null;let r=_s(e,n,t);for(let s of i.members){let a,l,o;if(d.isConstructorDeclaration(s))a="constructor",l="ctor",o=void 0;else if(d.isMethodDeclaration(s))a=ht(s.name),l="method",o=a!==void 0&&!vn.has(a)?s.body??void 0:void 0;else continue;a!==void 0&&r.pushMember(a,s,l,o)}return r.finish()}function Vd(e,n,t){let i;for(let a of n.statements)if(d.isFunctionDeclaration(a)&&a.name?.text===t){i=a;break}if(i===void 0)return null;let r=[];for(let a of n.statements){if(!d.isExpressionStatement(a))continue;let l=a.expression;if(!d.isBinaryExpression(l)||l.operatorToken.kind!==d.SyntaxKind.EqualsToken)continue;let o=l.left;if(d.isPropertyAccessExpression(o)&&d.isPropertyAccessExpression(o.expression)&&d.isIdentifier(o.expression.expression)&&o.expression.expression.text===t&&o.expression.name.text==="prototype"){let c=o.name.text;d.isFunctionExpression(l.right)?r.push({name:c,fn:l.right,walk:!0}):d.isArrowFunction(l.right)&&r.push({name:c,fn:l.right,walk:!1})}}if(r.length===0||r.length+1>di)return null;let s=_s(e,n,t);s.pushMember("constructor",i,"ctor",void 0);for(let a of r){let l=a.walk&&!vn.has(a.name)&&d.isFunctionExpression(a.fn)?a.fn.body:void 0;s.pushMember(a.name,a.fn,"method",l)}return s.finish()}function qd(e,n,t){for(let i of n.statements)if(d.isClassDeclaration(i)&&i.name?.text===t)return Ud(e,n,t,i);return Vd(e,n,t)}function Hd(e,n,t,i,r){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let a=new Set(t.map(f=>f.packageName)),l=new Set(t.map(f=>f.path)),o=new Set,c=new Set,u=0;for(let f of n){if(!a.has(f.packageName))continue;let p=zd(e.appRoot,f.packageRootRel,f.sourcePath);if(p===null)continue;let h=e.toRel(p);if(h===null)continue;let S=`${h}#${f.container}`;if(c.has(S)||!o.has(h)&&o.size>=pt)continue;let x=_e(p);if(x===null)continue;let y;try{y=d.createSourceFile(h,x,d.ScriptTarget.Latest,!0,d.ScriptKind.JS)}catch{continue}let v=qd(h,y,f.container);if(v===null)continue;o.add(h),c.add(S);let C=new Map,$=new Map;for(let b of v.members){let m=r.methodFor(f.packageName,f.container,b.name,b.kind);C.set(b.name,m),$.set(m,b.id)}let N=0;for(let b of v.members){if(b.body===void 0)continue;let m=(E,_)=>{if(_&&d.isCallExpression(E)&&d.isPropertyAccessExpression(E.expression)&&E.expression.expression.kind===d.SyntaxKind.ThisKeyword){let I=C.get(E.expression.name.text);if(I!==void 0){let A=`${h}#depclass:${f.container}.${b.name}#c${String(N)}`;N+=1,s.callSites.push({id:A,enclosingFunctionId:b.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:an(h,E,y)}),s.callEdges.push({callSiteId:A,calleeFunctionId:I,resolution:"field-based"})}}let F=d.isFunctionExpression(E)||d.isFunctionDeclaration(E)||d.isMethodDeclaration(E)||d.isConstructorDeclaration(E)||d.isGetAccessorDeclaration(E)||d.isSetAccessorDeclaration(E)||d.isClassLike(E),O=d.isArrowFunction(E)?_:F?!1:_;d.forEachChild(E,I=>{m(I,O)})};m(b.body,!0)}for(let b of i){let m=$.get(b.calleeFunctionId);m!==void 0&&s.callEdges.push({callSiteId:b.callSiteId,calleeFunctionId:m,resolution:"field-based"})}if(s.functions.push(...v.functions),s.classes.push(v.classNode),!l.has(h)){l.add(h),s.modules.push({id:h,packageName:f.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let b=r.moduleFor(f.packageName),m=`${String(b)}#depclass${String(u)}`;u+=1,s.imports.push({id:m,moduleId:b,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),s.importEdges.push({importId:m,resolvedModuleId:h})}s.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(v.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return s}function Wd(e,n,t,i){let r=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.packageName)),s=new Map(e.functions.map(o=>[o.id,o.moduleId])),a=new Map;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let c=s.get(o.enclosingFunctionId);c!==void 0&&a.set(c,(a.get(c)??0)+1)}let l=[];for(let o of e.modules){if(o.externalSurface===!0)continue;let c=n.get(o.path);if(c===void 0||t.has(o.path)||r.has(o.packageName)&&i.has(o.path)&&!o.path.split("/").includes("node_modules"))continue;let u=a.get(o.id)??0;if(u===0&&Nd(c))continue;let f=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:o.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:o.id})}return l}function Ns(e,n,t=[],i={},r=!1){let s=new ai,a=id(e,n,s),l=new Set;for(let N of a.computedLoads.values())for(let b of N)if(b.seedable)for(let m of b.candidateRels)l.add(m);let o=new Map;for(let N of e.sourceFiles){let b=e.toRel(N.fileName);if(b===null||!l.has(b)||b.split("/").includes("node_modules"))continue;let m=Td(b,N);m.length>0&&o.set(b,m)}let c=o.size===0?a.modules:a.modules.map(N=>o.has(N.path)&&!N.isEntrypoint?{...N,isEntrypoint:!0}:N),u={...a,modules:c},f=Bd(e,u,s,o,i),p=Ad(e,a,f.functions,f.mintSeedAliases),h=new Set(a.modules.map(N=>N.path)),S=od(e.depReach,s,h),x=[...u.modules,...S.modules,...s.modules()],y=Hd(e,t,x,f.callEdges,s),v=[];if(r){let N="#default",b=new Set;for(let E of f.callEdges){let _=String(E.calleeFunctionId);!_.startsWith("pkg:")||!_.endsWith(N)||b.add(_.slice(4,_.length-N.length))}let m=new Map;for(let E of e.depReach.edges){if(!("surface"in E.from)||"surface"in E.to)continue;let _=E.from.surface;m.set(_,m.has(_)?null:E.to.module)}for(let E of b){let _=m.get(E);if(_==null)continue;let F=rd(Ce.join(e.appRoot,_));if(F===null||F==="default")continue;let O=s.exportFor(E,F),I=`pkg:${E}${N}`;for(let A of f.callEdges)String(A.calleeFunctionId)===I&&v.push({callSiteId:A.callSiteId,calleeFunctionId:O,resolution:"field-based"})}}let C={modules:[...u.modules,...S.modules,...y.modules,...s.modules()],exports:[...f.exports,...p.exports],imports:[...a.imports,...S.imports,...y.imports],functions:[...f.functions,...s.functions(),...y.functions],callSites:[...f.callSites,...y.callSites],classes:[...f.classes,...s.classes(),...y.classes],callEdges:[...f.callEdges,...y.callEdges,...v],importEdges:[...a.importEdges,...S.importEdges,...y.importEdges],exportBindings:[...f.exportBindings,...p.exportBindings],inheritEdges:[]},$=new Map;for(let N of e.sourceFiles){let b=e.toRel(N.fileName);b!==null&&$.set(b,N)}return{graph:C,diagnostics:[...p.diagnostics,...y.diagnostics,...Wd(C,$,new Set(e.diagnostics.filter(N=>N.code==="dependency-body").map(N=>N.path)),a.appOwnedPaths)],...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var Gd=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,gt=/^[A-Za-z0-9_$.-]{1,128}$/u;function Xd(e){return Gd.test(e.calleePackage)?gt.test(e.anchorExport)?gt.test(e.calleeExport)?e.anchorContainer!==null&&!gt.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!gt.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Fn(e,n){let t=[],i=[],r=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.classes.map(c=>[c.id,c.name])),a=(c,u,f)=>e.functions.some(p=>{if(p.name!==u)return!1;let h=r.get(p.moduleId);return h===void 0||h.packageName!==c?!1:(p.enclosingClassId!==void 0?s.get(p.enclosingClassId)??null:null)===f}),l=(c,u,f)=>{for(let p of e.functions){if(p.name!==u)continue;let h=r.get(p.moduleId);if(!(h===void 0||h.packageName!==c||(p.enclosingClassId!==void 0?s.get(p.enclosingClassId)??null:null)!==f))return p.id}return null},o=[...n].sort((c,u)=>c.modelId<u.modelId?-1:c.modelId>u.modelId?1:0);for(let c of o){if(c.edges.length>64){t.push(`model ${c.modelId}: ${String(c.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=c.edges.map(Xd).find(h=>h!==null);if(u!==void 0){t.push(`model ${c.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let f=0,p=0;for(let h of c.edges){if(!a(c.packageName,h.anchorExport,h.anchorContainer)){p+=1;continue}i.push({modelId:c.modelId,kind:h.kind,anchor:{packageName:c.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:l(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${c.modelId}: ${String(f)} edge(s) lowered, ${String(p)} reference-gated`):t.push(`model ${c.modelId}: refused \u2014 no anchor surface in the graph (${String(p)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:i,notes:t}}}var Jd={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function gi(e){try{let n=Qr(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(a=>a.split(nn.sep).join("/"))),{graph:i,diagnostics:r,bindingApplicability:s}=Ns(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:i,diagnostics:[...n.diagnostics,...r],...s!==void 0?{bindingApplicability:s}:{}}}catch(n){return{graph:Jd,diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Cs(e,n){let t=512,i=(r,s,a)=>{if(!(t<=0||s>12)){if(t-=1,typeof r=="string"){n(r,a);return}if(Array.isArray(r)){for(let l of r)i(l,s+1,a);return}if(r!==null&&typeof r=="object")for(let[l,o]of Object.entries(r))l==="types"||l==="typings"||i(o,s+1,a||l.includes("*"))}};i(e,0,!1)}function Ms(e,n,t,i=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=jn(nn.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||i&&!Ge(r)?null:r===e?"":r.slice(n.length).split(nn.sep).join("/")}function Ps(e){let n=jn(e),t=n.endsWith(nn.sep)?n:n+nn.sep,i=new Set,r=[],s=[],a=[],l=[],o=!1,c=(O,I,A=!1,j)=>{let z=Ms(n,t,O);return z===null||z.length===0?"unresolved":i.has(z)?"duplicate":(i.add(z),r.push(z),s.push({source:I,specifier:De(j??(typeof O=="string"?O:"")),entrypoint:z,launch:A}),"added")},u=new Set,f=(O,I,A=!1)=>{let j=c(O,I),z=typeof O=="string"&&O.includes("\\")?c(O.split("\\").join("/"),I,!1,O):"unresolved";if(j!=="unresolved"||z!=="unresolved"||typeof O!="string"||O.trim().length===0||O.endsWith(".d.ts")||O.endsWith(".d.mts")||O.endsWith(".d.cts"))return;if(A&&O.includes("*")){let X=ns(n,O),H=!1;if(X!==null){for(let K of X.matches)c(K,I,!1,O)!=="unresolved"&&(H=!0);if(!X.truncated&&H)return}l.push({source:I,file:"package.json",detail:`\`${De(O)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let M=`${I}\0${O}`;u.has(M)||(u.add(M),l.push({source:I,file:"package.json",detail:`\`${De(O)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},p=[],h=(O,I)=>{a.push({source:O,file:O,detail:I.detail}),p.push({code:I.code,path:O,detail:`${O} ${I.detail}`})},S,x,y,v=null,C=Os(n,t,"package.json",sn);C.kind==="refused"&&h("package.json",C);try{let O=C.kind==="ok"?JSON.parse(C.text):{};if(v=C.kind==="ok"?O:null,f(O.main,"main"),typeof O.bin=="string")f(O.bin,"bin");else if(O.bin!==null&&typeof O.bin=="object")for(let A of Object.values(O.bin))f(A,"bin");Cs(O.exports,(A,j)=>{f(A,"exports",j)}),typeof O.browser=="string"?f(O.browser,"browser"):Cs(O.browser,A=>{c(A,"browser")});let I=O.scripts;if(I!==null&&typeof I=="object"){let A=I;S=A.start,x=A.prestart,y=A.poststart}}catch{}if(r.length===0)try{jn(nn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let $=(O,I)=>{if(typeof O=="string"&&O.trim().length>0){let A=Rs(O,I,"package.json",c,a,!1)==="used";return A&&(o=!0),A?"resolved":"gapped"}return O===void 0||typeof O=="string"?"absent":(a.push({source:I,file:"package.json",detail:`${I} is not a string; no entry file could be read from it`}),"gapped")},N=$(S,"scripts.start"),b=$(x,"scripts.prestart"),m=$(y,"scripts.poststart"),E=N==="resolved"&&b!=="gapped"&&m!=="gapped",_=Os(n,t,"Procfile",65536);if(_.kind==="refused")h("Procfile",_);else if(_.kind==="ok"){let{entries:O,truncated:I,unnamedLines:A}=oi(_.text);I&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),A>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(A)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let j of O)Rs(j.command,`Procfile:${j.name}`,"Procfile",c,a,E)==="used"&&(o=!0)}let F=r.length===0?ni(n,v):null;if(F!==null){for(let O of ii(n,F).roots)c(O,`framework:${F.name}`);r.length>0&&p.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${F.name}'s directory conventions (recognised via ${F.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}return{entrypoints:r,sources:s,gaps:a,surfaceGaps:l,launchResolved:o,diagnostics:p,framework:F}}function Os(e,n,t,i){let r;try{r=jn(nn.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=En(r,i);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(i)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Rs(e,n,t,i,r,s){let a=si(e);if(a.kind==="delegates")return s?"used":(r.push({source:n,file:t,detail:`\`${De(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(a.kind==="unparsed")return r.push({source:n,file:t,detail:`\`${De(e)}\`: ${a.reason}`}),"gapped";let l=i(a.specifier,n,!0),o=a.alt===void 0?"unresolved":i(a.alt,n,!0);return l==="unresolved"&&o==="unresolved"?(r.push({source:n,file:t,detail:`\`${De(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function yi(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let i=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${i}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function xi(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let i=[...new Set(t.slice(0,3).map(r=>r.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${i}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Ls(e,n){let t=jn(e),i=t.endsWith(nn.sep)?t:t+nn.sep,r=new Set,s=[],a=[];for(let l of n){let o=Ms(t,i,l,!0);if(o===null||o.length===0){a.push(l);continue}r.has(o)||(r.add(o),s.push(o))}return{entrypoints:s,rejected:a}}import{readdirSync as qs,readFileSync as wi,realpathSync as vi,statSync as Un}from"node:fs";import Ve from"node:path";function Yd(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let i=t+2;for(;i<e.length&&e.charCodeAt(i)===32;)i+=1;let r=e.charCodeAt(i);return r===38||r===42}function Kn(e,n,t){let i=n.maxLines??2e6,r=n.maxLineBytes??16384,s=!1,a=!1,l=0,o=0,c=e.charCodeAt(0)===65279?1:0;for(;c<=e.length;){let u=e.indexOf(`
-`,c),f=u===-1;f&&(u=e.length);let p=u>c&&e.charCodeAt(u-1)===13?u-1:u;if(o+=1,o>i){s=!0;break}if(p-c>r)l+=1;else{let h=c;for(;h<p&&e.charCodeAt(h)===32;)h+=1;let S=h-c,x=p;for(;x>h&&(e.charCodeAt(x-1)===32||e.charCodeAt(x-1)===9);)x-=1;if(h<x&&e.charCodeAt(h)!==35){let y=e.slice(h,x);if(Yd(y)){a=!0;break}t(S,y)}}if(f)break;c=u+1}return{truncated:s||l>0,refusedAnchors:a,oversizeLines:l}}function yt(e){let n=e.charCodeAt(0);if(n===34||n===39){let i=e.indexOf(String.fromCharCode(n),1);if(i===-1)return null;let r=i+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,i+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function An(e){return e.endsWith(":")}function Ue(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function xt(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,i=t.indexOf("/");if(n){if(i<=0||t.indexOf("/",i+1)!==-1)return!1}else if(i!==-1)return!1;let r=n?[t.slice(0,i),t.slice(i+1)]:[t];for(let s of r){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let a=0;a<s.length;a+=1){let l=s.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function Bn(e){return xt(e)?`node_modules/${e}`:""}function zn(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Ts=2e5,Ds=64,Zd=1024,Qd=5,ec=[1,2,3];function nc(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let i=e.slice(t+n.length);if(i==="")return null;let r=i.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function Fs(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let i=t.indexOf("@",1);if(i>0){let r=t.slice(0,i),s=t.slice(i+1);if(r.length>0&&s.length>0)return[{name:r,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function _n(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function js(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Ks(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Bs(e,n,t,i,r=!1){let s=JSON.stringify([n,t,i]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:i,dev:r})}}function tc(e,n){for(let[t,i]of Object.entries(e)){if(t==="")continue;if(!Ks(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=_n(i);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let a=s.name,l=typeof a=="string"&&a!==""?a:nc(t),o=s.version;if(l===null||typeof o!="string"){r&&(n.unread+=1);continue}let c=s.dev===!0||s.devOptional===!0;for(let u of Fs(l,o))Bs(n,u.name,u.version,t,c)}}function zs(e,n,t){let i=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let s=0;s<i.length;s+=1){let a=i[s];if(a===void 0)break;for(let[l,o]of Object.entries(a.deps)){if(!Ks(n))return{depthCapped:r};if(l===""){n.unread+=1;continue}let c=_n(o);if(c===null){n.unread+=1;continue}let u=a.pathSafe&&xt(l),f=u?`${a.prefix}node_modules/${l}`:"",p=u&&f.length<=Zd,h=p?f:"",S=c.version,x=c.dev===!0||a.dev;if(c.link!==!0&&typeof S=="string"&&S!=="")for(let v of Fs(l,S))Bs(n,v.name,v.version,h,x);else n.unread+=1;let y=_n(c.dependencies);if(y!==null){if(a.depth+1>t){r=!0;continue}i.push({deps:y,prefix:p?`${h}/`:a.prefix,depth:a.depth+1,pathSafe:p,dev:x})}}}return{depthCapped:r}}function ic(e,n,t){let i=js(n.maxEntries),{depthCapped:r}=zs(e,i,t),s=[],a=new Set(n.deps.map(c=>JSON.stringify([c.name,c.version]))),l=new Set,o=[];for(let c of i.deps){if(c.version.includes(":"))continue;let u=JSON.stringify([c.name,c.version]);a.has(u)||l.has(u)||(l.add(u),o.length<Qd&&o.push(zn(c.name,c.version)))}if(l.size>0){let c=l.size-o.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${o.join(", ")}${c>0?`, and ${String(c)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(i.capped||r)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function St(e,n={}){let t=[],i;try{i=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=_n(i);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=r.lockfileVersion,a=typeof s=="number"&&Number.isInteger(s)?s:null,l=typeof s=="number"?String(s):"?",o=_n(r.packages),c=_n(r.dependencies);if(o===null&&c===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!ec.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??Ds,f=js(n.maxEntries??Ts),p=!1;return o!==null?(tc(o,f),c!==null&&t.push(...ic(c,f,u))):c!==null&&(p=zs(c,f,u).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),p&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||p}}var rc=["workspace:","link:","portal:","file:","exec:"];function sc(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function oc(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let i=n.slice(0,t),r=n.slice(t+1);if(i.length===0)return[];for(let l of rc)if(r.startsWith(l))return[];if(!r.startsWith("npm:"))return[i];let s=r.slice(4),a=s.indexOf("@",1);if(a>0){let l=s.slice(0,a);return l.length>0?[l]:[i]}return s.length===0||sc(s)?[i]:[i,s]}function ac(e){if(An(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let i=e.charCodeAt(t);if(i===34||i===39){n===0?n=i:n===i&&(n=0);continue}if(n===0&&i===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function lc(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let i of n.split(",")){let r=i.trim();r.length>0&&t.push(r)}return t}function dc(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let i=t.length;for(;i<n.length&&i<t.length+3;){let s=n.charCodeAt(i);if(s<48||s>57)break;i+=1}let r=n.slice(t.length,i);return r.length>0?r:null}function Us(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Ue(e.slice(8).trim());return t.length>0?t:null}function Si(e,n={}){let t=[],i=[],r=new Set,s=n.maxEntries??2e5,a=!1,l=null,o=!1,c=[],u=!1,f=-1,p=!1,h=0,S=()=>{c.length>0&&!u&&(h+=1)},x=Kn(e,n,($,N)=>{if($===0){S(),c=[],u=!1,f=-1,o=!1;let m=ac(N);if(m===null)return;let E=Ue(m.trim());if(E==="__metadata"){a=!0,o=An(N);return}for(let _ of lc(E))c.push(...oc(_));return}if(o){if($===2&&l===null){let m=Us(N);m!==null&&(l=m)}return}if(c.length===0||(f===-1&&(f=$),$!==f||u))return;let b=Us(N);if(b!==null){u=!0;for(let m of c){let E=JSON.stringify([m,b]);if(!r.has(E)){if(i.length>=s){p=!0;return}r.add(E),i.push({name:m,version:b,lockKey:Bn(m),dev:!1})}}}});S();let y=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(x.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};x.oversizeLines>0&&t.push(`${y} has ${String(x.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),p&&t.push(`${y} exceeds ${String(s)} entries; truncated`);let v=l??dc(e),C=v===null?null:Number(v.split(".")[0]);return v!==null&&(C===null||!Number.isInteger(C)||C<1||C>8)&&t.push(`${y} declares unsupported lockfileVersion ${v} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${y} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:i,diagnostics:t,truncated:x.truncated||p}}function bi(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let i=n.indexOf("_");return i!==-1&&(n=n.slice(0,i)),n.trim()}function ki(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Vs(e){let n=Ue(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let i=n.charCodeAt(0)===47;if(i&&(n=n.slice(1)),n.length===0)return null;if(!i&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),f=n.indexOf("@",1);u>0&&(f===-1||u<f)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let r=n.charCodeAt(0)===64,s=r?n.indexOf("/"):-1;if(r&&s<=0)return null;let a=r?s+1:0,l=-1;for(let u=a;u<n.length;u+=1){let f=n.charCodeAt(u);if(f===47||f===64){l=u;break}}if(l<=a)return null;let o=n.slice(0,l),c=bi(n.slice(l+1));return ki(c)?{name:o,version:c}:null}var cc=new Set(["packages","snapshots","importers"]),uc=new Set([5,6,7,8,9]);function fc(e){let n=Ue(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function kt(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Ue(e.slice(0,n).trim()),value:Ue(t)}}function Ei(e,n={}){let t=[],i=[],r=new Set,s=n.maxEntries??2e5,a="",l=null,o=!1,c=0,u=[],f=(h,S)=>{let x=JSON.stringify([h,S]);if(!r.has(x)){if(i.length>=s){o=!0;return}r.add(x),i.push({name:h,version:S,lockKey:Bn(h),dev:!1})}},p=Kn(e,n,(h,S)=>{if(h===0){let x=yt(S);if(a=x===null?"":Ue(x.trim()),l=null,a==="lockfileVersion"){let y=kt(S),v=y===null?null:fc(y.value);y!==null&&(v===null||!uc.has(v))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if(cc.has(a)&&!An(S)){let y=kt(S)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(c+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(h!==2)return;let x=yt(S),y=x===null?null:Vs(x);if(y===null){c+=1;return}f(y.name,y.version);return}if(a==="importers"){if(h===6){let x=kt(S);if(x===null){l=S.endsWith(":")?Ue(S.slice(0,-1).trim()):null;return}l=null;let y=bi(x.value);ki(y)&&f(x.key,y);return}if(h===8&&l!==null){let x=kt(S);if(x===null||x.key!=="version")return;let y=bi(x.value);ki(y)&&f(l,y)}}});return p.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),p.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(p.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),o&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),c>0&&t.push(`pnpm-lock.yaml has ${String(c)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:i,diagnostics:t,truncated:p.truncated||o})}var pc=128*1024*1024,mc=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>St(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>St(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Si(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Ei(e,n===void 0?{}:{maxEntries:n})}],hc=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Ii(e,n){let t;try{t=vi(Ve.join(e,n))}catch{return null}let i=e.endsWith(Ve.sep)?e:e+Ve.sep;return t.startsWith(i)?t:null}function Hs(e,n){let t=Ve.join(e,"package.json"),i;try{i=vi(t)}catch{return null}if(!i.startsWith(n+Ve.sep))return null;try{if(!Un(i).isFile())return null;let r=JSON.parse(wi(i,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function Ws(e,n){try{return Un(Ve.join(e,n)),!0}catch{return!1}}function gc(e,n){if(Ws(e,"pnpm-workspace.yaml"))return!0;let t=Ii(e,"package.json");if(t===null)return Ws(e,"package.json");let i;try{let a=Un(t);if(!a.isFile()||a.size>n)return!0;i=wi(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(i)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=r[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let s=r.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function Gs(e,n){let t=Ve.join(e,"node_modules"),i=[],r;try{r=qs(t,{withFileTypes:!0})}catch{return i}for(let s of r){let a=s.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let o;try{o=qs(Ve.join(t,a),{withFileTypes:!0})}catch{continue}for(let c of o){let u=Hs(Ve.join(t,a,c.name),n);u!==null&&i.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${c.name}`,linked:c.isSymbolicLink()||s.isSymbolicLink()})}continue}let l=Hs(Ve.join(t,a),n);l!==null&&i.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:s.isSymbolicLink()})}return i}var yc=5;function xc(e,n,t){let i=Ii(e,n);if(i===null){try{Un(Ve.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=Un(i)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:wi(i,"utf8")}}catch{return{gap:`${n} could not be read`}}}function Xs(e,n){let t=vi(e),i=[],r=[],s=n?.maxLockfileBytes??pc,a=[],l=new Set,o=[],c=gc(t,s),u=null,f=!1,p=(S,x,y)=>{r.push({kind:S,detail:x,blindsAnalysis:y}),i.push(x)};for(let S of mc){let x=xc(t,S.file,s);if(x===null)continue;if("gap"in x){p("lockfile-unreadable",x.gap,!1);continue}let y=S.parse(x.text,n?.maxLockfileEntries);if(y.truncated&&(f=!0),y.deps.length===0){if(y.diagnostics.length>0||c){let v=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";p("lockfile-unparsed",`${S.file} yielded NO dependencies (${v}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&p("lockfile-partial",`${S.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),u===null&&(u=S.file),o.includes(S.source)||o.push(S.source);for(let v of y.deps){let C=JSON.stringify([v.name,v.version,v.lockKey]);l.has(C)||(l.add(C),a.push(v))}}for(let S of hc)if(Ii(t,S)!==null){p("yarn-pnp",`${S} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let S=o.length===1?o[0]??"none":"multi-lockfile";o.length>1&&i.push(`multiple lockfiles present (${o.join(", ")}); enumerated the UNION of all of them`);let x=new Set(a.map(C=>JSON.stringify([C.name,C.version]))),y=new Set,v=[];for(let C of Gs(t,t)){let $=JSON.stringify([C.name,C.version,C.lockKey]);l.has($)||(l.add($),a.push({name:C.name,version:C.version,lockKey:C.lockKey,dev:C.dev}));let N=JSON.stringify([C.name,C.version]);C.linked||x.has(N)||y.has(N)||(y.add(N),v.length<yc&&v.push(zn(C.name,C.version)))}if(y.size>0){let C=y.size-v.length;p("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${v.join(", ")}${C>0?`, and ${String(C)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:S,lockfilePath:u,diagnostics:i,truncated:f,gaps:r}}let h=Gs(t,t);return h.length>0?(p("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(S=>({name:S.name,version:S.version,lockKey:S.lockKey,dev:!1})),source:"node-modules",lockfilePath:null,diagnostics:i,truncated:f,gaps:r}):(c&&p("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:i,truncated:f,gaps:r})}import{readdirSync as Sc,readFileSync as bc}from"node:fs";import kc from"node:path";var Ec=new Set(["summarized","crashed","over-cap"]),wc=new Set(["function","method","ctor"]);function re(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function Ai(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function vc(e,n){Ai(e)||re(n,"edge is not an object");let{entryPath:t,entryExport:i,entryContainer:r,hops:s}=e;(typeof t!="string"||typeof i!="string")&&re(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&re(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&re(n,"hops must be a non-negative integer");let a=e.target;if(Ai(a)||re(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:o,symbolKind:c}=a;return typeof l!="string"&&re(n,"symbol target exportName"),o!==null&&typeof o!="string"&&re(n,"symbol target container"),(typeof c!="string"||!wc.has(c))&&re(n,`symbol target kind ${JSON.stringify(c)}`),{entryPath:t,entryExport:i,entryContainer:r,target:{kind:"symbol",exportName:l,container:o,symbolKind:c},hops:s}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:o,calleeExport:c}=a;return(typeof l!="string"||l.length===0)&&re(n,"dep target calleePackage"),o!==null&&typeof o!="string"&&re(n,"dep target calleeSubpath"),(typeof c!="string"||c.length===0)&&re(n,"dep target calleeExport"),{entryPath:t,entryExport:i,entryContainer:r,target:{kind:"dep",calleePackage:l,calleeSubpath:o,calleeExport:c},hops:s}}re(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function Ic(e,n){Ai(e)||re(n,"root is not an object");let{packageName:t,analyzedVersion:i,tool:r,toolVersion:s,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&re(n,"packageName"),typeof i!="string"&&re(n,"analyzedVersion"),r!=="jelly"&&re(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof s!="string"&&re(n,"toolVersion"),typeof a!="number"&&re(n,"maxIndirections"),(typeof l!="string"||!Ec.has(l))&&re(n,`status ${JSON.stringify(l)} not in the enum`);let o=e.edges;return Array.isArray(o)||re(n,"edges is not an array"),l!=="summarized"&&o.length>0&&re(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:i,tool:r,toolVersion:s,maxIndirections:a,status:l,edges:o.map(c=>vc(c,n))}}function Js(e){let n=new Map,t=Sc(e).filter(i=>i.endsWith(".summary.json"));for(let i of t){let r=kc.join(e,i),s;try{s=JSON.parse(bc(r,"utf8"))}catch(o){re(i,`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}let a=Ic(s,i),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{readFileSync as Ac,statSync as _c}from"node:fs";var Ni=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,Et=/^[A-Za-z0-9_$.-]{1,128}$/u,Ys=64,Zs=1024*1024,Qs=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,eo=/^[A-Za-z0-9@_.-]{1,128}$/u;function ae(e){throw new Error(`model claims rejected: ${e}`)}function _i(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Nc(e,n){_i(e)||ae(`${n}: edge is not an object`);let{kind:t,anchorExport:i,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&ae(`${n}: edge kind`),(typeof i!="string"||!Et.test(i))&&ae(`${n}: anchorExport ${JSON.stringify(i)}`),r!==null&&(typeof r!="string"||!Et.test(r))&&ae(`${n}: anchorContainer`),(typeof s!="string"||!Ni.test(s))&&ae(`${n}: calleePackage ${JSON.stringify(s)}`),a!==null&&(typeof a!="string"||!Et.test(a))&&ae(`${n}: calleeContainer`),(typeof l!="string"||!Et.test(l))&&ae(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:i,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}}function no(e){let n=_c(e).size;n>Zs&&ae(`file is ${String(n)} bytes, over the ${String(Zs)} cap`);let t;try{t=JSON.parse(Ac(e,"utf8"))}catch(r){ae(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||ae("root is not an array"),t.length>Ys&&ae(`${String(t.length)} claims over cap ${String(Ys)}`);let i=[];for(let r of t){_i(r)||ae("claim is not an object");let{packageName:s,modelId:a,range:l,edges:o}=r;(typeof s!="string"||!Ni.test(s))&&ae("packageName"),(typeof a!="string"||!eo.test(a))&&ae("modelId (identifier charset, 1-128 chars)"),i.some(u=>u.model.modelId===a)&&ae(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!_i(l)||typeof l.introduced!="string")&&ae(`${a}: range`),Qs.test(l.introduced)||ae(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let c=l.fixedBefore;c!==null&&typeof c!="string"&&ae(`${a}: fixedBefore`),typeof c=="string"&&!Qs.test(c)&&ae(`${a}: range.fixedBefore ${JSON.stringify(c)} is not an exact x.y.z triple`),Array.isArray(o)||ae(`${a}: edges`),o.length>64&&ae(`${a}: ${String(o.length)} edges over cap ${String(64)}`),i.push({model:{packageName:s,modelId:a,edges:o.map(u=>Nc(u,a))},introduced:l.introduced,fixedBefore:c})}return i}var Cc=["in-app-purchase@1-v1"];function Ci(e,n,t){let i=[],r=[],s=[],a=(l,o,c,u)=>{r.push(c),s.push({modelId:u??l.model.modelId,status:o,reason:c,edgeCount:l.model.edges.length})};for(let l of e){if(!Ni.test(l.model.packageName)||!eo.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Cc.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let o=n(l.model.packageName);if(o===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let c;try{c=fn(o,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${o} not an exact triple \u2014 inert (never guessed)`);continue}if(!c){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${o} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}i.push(l.model),s.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:i,notes:r,dispositions:s}}var Oc=4,Rc={additiveForms:!0,namelessExports:!0},$c=new Set(["dep-opaque","dynamic-load","dispatch"]),Mc={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Ri(e,n,t){return e.tier==="unknown"&&Mc[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&$c.has(e.unknownKind)&&n!==null&&n.verified}var Pc=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),qe=class extends Error{},$i="cupel/coverage-gap",Lc={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function qn(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function oo(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function ao(e,n,t){let i=new Map(e.modules.map(a=>[a.path,a.id])),r=e.modules[0]?.id;if(r===void 0)return[];let s=n.map(a=>({source:i.get(a.path)??r,cause:Lc[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));return t&&s.push({source:r,reach:{kind:"unbounded"},cause:"resolution-divergence"}),s}function Oi(e,n,t,i,r){let s=t.filter(a=>a.exportName!==null&&(i===1||r||a.verified!==1));return s.length>0?s.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function Tc(e){let n;try{n=vt(e)}catch{return!0}try{if(wt(Ze.join(n,"pnpm-workspace.yaml")).isFile())return!0}catch{}try{let s=JSON.parse(co(Ze.join(n,"package.json"),"utf8"))?.workspaces;if(Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null)return!0}catch{}let t=3,i=(r,s)=>{if(s>t)return!1;let a;try{a=lo(r)}catch{return!1}for(let l of a){if(l==="node_modules"||l.startsWith("."))continue;let o=Ze.join(r,l),c;try{c=wt(o)}catch{continue}if(c.isDirectory()){try{if(wt(Ze.join(o,"package.json")).isFile())return!0}catch{}if(i(o,s+1))return!0}}return!1};return i(n,1)}function Dc(e,n,t){let i=[];if(t&&i.push("nested-app-root"),n==="")return[...i,"manifest-unreadable"];let r;try{if(r=vt(Ze.resolve(e,n)),!r.startsWith(vt(e)+Ze.sep))return[...i,"manifest-unreadable"]}catch{return[...i,"manifest-unreadable"]}let s;try{let u=Ze.join(r,"package.json");if(!wt(u).isFile())return[...i,"manifest-unreadable"];s=co(u,"utf8")}catch{return[...i,"manifest-unreadable"]}let a;try{a=JSON.parse(s)}catch{return[...i,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...i,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&i.push("bin");let o=["preinstall","install","postinstall","prepare","prepublish"],c=l.scripts;if(typeof c=="object"&&c!==null){let u=c;o.some(f=>typeof u[f]=="string")&&i.push("install-script")}return(l.gypfile===!0||Fc(r))&&i.push("native-artifact"),i}function Fc(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=Ze.join(e,n),i;try{i=lo(t)}catch{continue}if(i.some(r=>r.endsWith(".node")))return!0}return!1}function jc(e){let n=new Map;for(let t of e){let i=n.get(t.advisory.id);i===void 0?n.set(t.advisory.id,[t]):i.push(t)}return n}function Kc(e,n,t,i,r,s,a){let{finding:l}=Vn(e,n,{name:t.name,version:t.version,devOnly:t.dev,outOfGraphExecution:a(t.name)},qn(i.advisory.id,t.name,i.affected),null,r,s);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function Vn(e,n,t,i,r,s,a){let l=jt({graph:e,installed:t,range:i,symbol:r,coverage:null,incompleteness:s,analysisAborted:a});if(n!==null&&r!==null&&Ri(l,r,"base")){let o=Rn(e,n.modulesById,n.reachMods,r,n.records);if(o!==null)return{finding:l,hit:o}}return{finding:l,hit:null}}function Bc(e,n){let t=new Set,i=[];for(let r of e.packages)for(let{advisory:s,affected:a}of n.advisoriesForPackage("npm",r.name)){let l=qn(s.id,r.name,a),o;try{o=fn(r.version,l)}catch{continue}if(o)for(let c of n.symbolsForAffected(a.id)){if(c.verified!==1||c.symbolKind!=="method"&&c.symbolKind!=="ctor"||c.container===null||c.sourcePath===null)continue;let u=`${r.lockKey}\0${c.container}\0${c.sourcePath}`;t.has(u)||(t.add(u),i.push({packageName:r.name,packageRootRel:r.lockKey,container:c.container,sourcePath:c.sourcePath}))}}return i.sort((r,s)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),i.slice(0,pt)}function zc(e,n,t){let i=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let o=s.get(l.callSiteId);if(o===void 0)continue;let c=i.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=i.get(l.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==u.packageName&&a.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?r.get(f.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:c.id})}return a}function Uc(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),i=new Map(e.functions.map(u=>[u.id,u])),r=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&r.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let f=s.get(u.exportId);if(f===void 0||!n.has(f.moduleId))continue;let p=i.get(u.target.functionId);p===void 0||t.get(p.moduleId)?.externalSurface===!0||r.add(p.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let f=a.get(u.callSiteId);if(f===void 0)continue;let p=l.get(f);p===void 0?l.set(f,[u.calleeFunctionId]):p.push(u.calleeFunctionId)}let o=new Set(r),c=[...r];for(;c.length>0;){let u=c.pop();if(u!==void 0)for(let f of l.get(u)??[])o.has(f)||(o.add(f),c.push(f))}return o}function Vc(e,n,t,i){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let s=t.filter(l=>l.packageName===r.anchor.packageName&&l.exportName===r.anchor.exportName&&l.container===r.anchor.container),a=s.find(l=>l.resolution==="resolved")??s[0];if(a!==void 0)return i.has(a.callerFunctionId)}return null}function qc(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let i=new Set(t),r=s=>i.has(s)||i.has($e[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&r(s.unknownKind)||s.modelPromotedFromKind!==void 0&&r(s.modelPromotedFromKind))}function Mi(e){let n=vt(e.dir),t=e.reader??zt(e.shardPath),i=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(pn))throw new qe(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${pn})`);let r=null;if(e.summaryShadow!==void 0)try{r=Js(e.summaryShadow)}catch(B){throw new qe(`--summary-shadow facts dir rejected: ${B instanceof Error?B.message:String(B)}`)}let s=null;if(e.modelShadow!==void 0)try{s=no(e.modelShadow.claimsPath)}catch(B){throw new qe(`--model-shadow claims rejected: ${B instanceof Error?B.message:String(B)}`)}let a=Xs(n);if(a.truncated)throw new qe(`the dependency enumeration hit a hard cap and is incomplete (${a.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`);let l=e.entry??[],o=l.length>0?Ls(n,l):{entrypoints:[],rejected:[]},c=o.rejected,u=Ps(n),f=[...new Set([...u.entrypoints,...o.entrypoints])],p=[...u.sources];for(let B of o.entrypoints)u.entrypoints.includes(B)||p.push({source:"--entry",specifier:B,entrypoint:B,launch:!1});let h=Bc(a,t),S=e.bindingForms??Rc,x=e.callablePackageResolver===!0,y=e.tsconfigPaths===!0,v=Tc(n),C=new Map(a.packages.map(B=>[B.name,Dc(n,B.lockKey,v)])),$=B=>C.get(B)??["manifest-unreadable"],N=gi({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:S,callablePackageResolver:x,tsconfigPaths:y}),b=N.graph,m=Ft(b),E=[...u.diagnostics,...yi(u),...xi(u,f.length),...N.diagnostics],_=oo(f.length,b),F=a.gaps.some(B=>B.blindsAnalysis),O=ao(b,E,F),I=t.allModels?.()??[],A=Ci(I.map(B=>({model:{packageName:B.packageName,modelId:B.modelId,edges:B.edges},introduced:B.introduced,fixedBefore:B.fixedBefore})),B=>a.packages.find(ke=>ke.name===B)?.version),j=A.models.length>0?Fn(b,A.models).delta:null,z=j!==null?{records:j.records,reachMods:rn(b),modulesById:new Map(b.modules.map(B=>[B.id,B]))}:null,M=[],X=new Map,H=Pc(),K=[],V=[];for(let B of a.packages)for(let[,ke]of jc(t.advisoriesForPackage("npm",B.name))){let fe=ke[0];if(fe!==void 0){let w=X.get(fe.advisory.id),R=ke.map(P=>P.affected);w===void 0?X.set(fe.advisory.id,{advisory:fe.advisory,ranges:R}):w.ranges.push(...R)}let de=ke.filter(w=>Kc(b,z,B,w,O,_,$)),je=de.length>0?de:ke.slice(0,1),k=de.length===0;for(let{advisory:w,affected:R}of je){let P=qn(w.id,B.name,R),Y=w.cveId??w.id,ie=k?[]:t.symbolsForAffected(R.id),ge=ie.filter(Z=>Z.exportName===null),Oe=Oi(w.id,B.name,ie,R.surfaceComplete,i),ye=Vn(b,z,{name:B.name,version:B.version,devOnly:B.dev,outOfGraphExecution:$(B.name)},P,null,O,_).finding;if(ye.decidedAtStage==="presence"||ye.decidedAtStage==="version-match"){H[ye.tier]+=1,M.push({...ye,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:P.surfaceComplete,advisoryId:w.id,displayId:Y,packageName:B.name,version:B.version,symbolName:null,symbolPath:null,severity:w.severity,packageLocation:a.lockfilePath});continue}for(let Z of Oe){let{finding:xe,hit:he}=Vn(b,z,{name:B.name,version:B.version,devOnly:B.dev,outOfGraphExecution:$(B.name)},P,Z,O,_),Le=xe,Re,q;he!==null&&Z!==null&&(Re=he.modelId,q=xe.unknownKind,Le={basis:void 0,tier:he.tier,decidedAtStage:xe.decidedAtStage,reason:`boundary model ${he.modelId}: ${he.anchorPackage}.${he.entryExport} reaches ${Z.exportName} [${he.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:Zn(Z),path:void 0,unresolvedSites:xe.unresolvedSites,unresolvedEvidence:xe.unresolvedEvidence}),H[Le.tier]+=1;let L={...Le,modelId:Re,modelPromotedFromKind:q,surfaceComplete:P.surfaceComplete,advisoryId:w.id,displayId:Y,packageName:B.name,version:B.version,symbolName:Z?.exportName??null,symbolPath:Z?.sourcePath||null,severity:w.severity,packageLocation:a.lockfilePath};M.push(L);let G=new Set(["dep-opaque","dynamic-load","dispatch"]);r!==null&&L.tier==="unknown"&&L.decidedAtStage==="symbol-reachable"&&L.unknownKind!==void 0&&G.has(L.unknownKind)&&Z!==null&&K.push({finding:L,symbol:Z}),s!==null&&L.tier==="unknown"&&Z!==null&&V.push({finding:L,symbol:Z})}for(let Z of ge)H.unknown+=1,M.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:P.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${Y} carries a ${Z.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:w.id,displayId:Y,packageName:B.name,version:B.version,symbolName:null,symbolPath:null,severity:w.severity,packageLocation:a.lockfilePath})}}for(let B of a.gaps)H.unknown+=1,M.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:B.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:$i,displayId:$i,packageName:B.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:a.lockfilePath});let D=H["reachable-high"]+H["reachable-medium"],W=e.failOnReachable===!0&&D>0,se=qc(M,H.unknown,e.failOnUnknown),Fe=e.requireCompleteDenial===!0&&M.some(B=>B.tier==="not-reachable"&&B.basis==="loader-assumption"),Ie=W||se||Fe?2:0,be;if(r!==null){let B=rn(b),ke=new Map(b.modules.map(de=>[de.id,de])),fe=[];for(let{finding:de,symbol:je}of K){let k=Dt(b,ke,B,je,r,Oc);fe.push({advisoryId:de.advisoryId,packageName:de.packageName,symbolName:de.symbolName,unknownKind:de.unknownKind??null,wouldPromote:k!==null,...k!==null?{anchorPackage:k.anchorPackage,entryExport:k.entryExport,viaPackages:k.viaPackages,totalHops:k.totalHops}:{}})}be={records:fe}}let dn;if(s!==null&&e.modelShadow!==void 0){let B=e.modelShadow.widened===!0?"widened":"base",ke=new Map(a.packages.map(L=>[L.name,L.version])),{models:fe,notes:de,dispositions:je}=Ci(s,L=>ke.get(L),{shadowConsultDenylisted:!0}),{delta:k}=Fn(b,fe),w=rn(b),R=new Map(b.modules.map(L=>[L.id,L])),P=zc(b,R,w),Y=Uc(b),ie=k.records.some(L=>P.some(G=>G.packageName===L.anchor.packageName&&G.exportName===L.anchor.exportName&&G.container===L.anchor.container)),ge=[],Oe=Date.now();for(let{finding:L,symbol:G}of V){let Ke=k.records,pe=Ri(L,G,B),Q=pe?Rn(b,R,w,G,Ke):null,Ae=k.records.filter(Ee=>Ee.callee.packageName===G.packageName&&Ee.callee.exportName===G.exportName&&Ee.callee.container===G.container||Ee.callee.packageName===G.packageName&&Ee.callee.realFunctionId!==null);ge.push({advisoryId:L.advisoryId,packageName:L.packageName,symbolName:L.symbolName,unknownKind:L.unknownKind??null,decidedAtStage:L.decidedAtStage,consultSurface:B,noHitReason:Q!==null?null:pe?ie?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Q!==null?Vc(Q,Ke,P,Y):null,verdictBefore:L.tier,verdictAfter:Q!==null?"reachable-low":L.tier,wouldPromote:Q!==null,...Q!==null?{modelId:Q.modelId,anchorPackage:Q.anchorPackage,entryExport:Q.entryExport,pathLabels:Q.pathLabels,calleeBinding:Ae.find(Ee=>Ee.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:pe?Ae.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Ae[0]?.anchor.packageName??"?"}#${Ae[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let ye=Date.now()-Oe,Z=je.map(L=>{if(L.status!=="active")return{modelId:L.modelId,state:L.status,reason:L.reason,edgesLowered:0,edgesReferenceGated:0};let G=k.records.filter(pe=>pe.modelId===L.modelId).length;if(G>0)return{modelId:L.modelId,state:"lowered",reason:null,edgesLowered:G,edgesReferenceGated:L.edgeCount-G};let Ke=k.notes.find(pe=>pe.startsWith(`model ${L.modelId}:`)||pe.startsWith(`model-edge ${L.modelId}:`));return{modelId:L.modelId,state:"refused",reason:Ke??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:L.edgeCount}}),xe=ge.filter(L=>L.wouldPromote).length,he=H.unknown-xe,Le=H["reachable-high"]+H["reachable-medium"],Re=L=>({none:0,"fail-on-reachable":Le>0?2:0,"fail-on-unknown":L>0?2:0,both:Le>0||L>0?2:0});dn={records:ge,notes:[...de,...k.notes],laneStates:Z,exitCodes:{baseline:Re(H.unknown),withModels:Re(he)},overlayWallMs:ye},io(Ze.dirname(e.modelShadow.outPath),{recursive:!0});let q=`${e.modelShadow.outPath}.tmp-${to(8).toString("hex")}`;so(q,`${JSON.stringify(dn,null,2)}
-`,{encoding:"utf8",flag:"wx"}),ro(q,e.modelShadow.outPath)}let cn;if(e.bindingShadow!==void 0){let B=Date.now(),ke=q=>A.models.length>0?{records:Fn(q,A.models).delta.records,reachMods:rn(q),modulesById:new Map(q.modules.map(L=>[L.id,L]))}:null,fe=(q,L,G,Ke)=>{let pe=[];for(let Q of a.packages)for(let{advisory:Ae,affected:Ee}of t.advisoriesForPackage("npm",Q.name)){let kn=qn(Ae.id,Q.name,Ee),Go=Oi(Ae.id,Q.name,t.symbolsForAffected(Ee.id),Ee.surfaceComplete,i);for(let Qi of Go){let{finding:er,hit:Lt}=Vn(q,Ke,{name:Q.name,version:Q.version,devOnly:Q.dev,outOfGraphExecution:$(Q.name)},kn,Qi,L,G);pe.push({advisoryId:Ae.id,packageName:Q.name,symbolName:Qi?.exportName??null,tier:Lt!==null?Lt.tier:er.tier,unknownKind:Lt!==null?null:er.unknownKind??null})}}return pe},de=q=>{let L=gi({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:q,callablePackageResolver:x,tsconfigPaths:y}),G=[...u.diagnostics,...yi(u),...xi(u,f.length),...L.diagnostics];return{graph:L.graph,inc:ao(L.graph,G,F),aborted:oo(f.length,L.graph),live:ke(L.graph),applicability:L.bindingApplicability}},je=q=>{let L=de(q);return fe(L.graph,L.inc,L.aborted,L.live)},k=de({}),w=fe(k.graph,k.inc,k.aborted,k.live),R=fe(b,O,_,z);if(R.length!==w.length)throw new qe("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let P=(q,L)=>L.tier!==q.tier||L.unknownKind!==q.unknownKind,Y=w.some((q,L)=>{let G=R[L];return G!==void 0&&P(q,G)}),ie=Y?je({additiveForms:!0}):null,ge=Y?je({namelessExports:!0}):null,Oe=0,ye=w.map((q,L)=>{let G=R[L];if(G===void 0||G.advisoryId!==q.advisoryId||G.packageName!==q.packageName||G.symbolName!==q.symbolName)throw new qe("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Ke={advisoryId:q.advisoryId,packageName:q.packageName,symbolName:q.symbolName,unknownKind:q.unknownKind,verdictBefore:q.tier,verdictAfter:G.tier,wouldPromote:G.tier!==q.tier&&(G.tier==="reachable-high"||G.tier==="reachable-medium"||G.tier==="reachable-low")};if(!P(q,G)||ie===null||ge===null)return Ke;Oe+=1;let pe=ie[L],Q=ge[L],Ae=pe!==void 0&&P(q,pe),Ee=Q!==void 0&&P(q,Q);return{...Ke,attributedArm:Ae&&!Ee?"additiveForms":Ee&&!Ae?"namelessExports":"both",...pe!==void 0?{verdictArmA:pe.tier}:{},...Q!==void 0?{verdictArmB:Q.tier}:{}}}),Z={...H};w.forEach((q,L)=>{let G=R[L];G!==void 0&&G.tier!==q.tier&&(Z[G.tier]-=1,Z[q.tier]+=1)});let xe=(q,L)=>({none:0,"fail-on-reachable":q>0?2:0,"fail-on-unknown":L>0?2:0,both:q>0||L>0?2:0}),he;if(A.models.length>0&&z!==null){he=[];for(let q of a.packages)for(let{advisory:L,affected:G}of t.advisoriesForPackage("npm",q.name)){let Ke=qn(L.id,q.name,G),pe=Oi(L.id,q.name,t.symbolsForAffected(G.id),G.surfaceComplete,i);for(let Q of pe){if(Q===null||!Q.verified)continue;let Ae=Vn(k.graph,k.live,{name:q.name,version:q.version,devOnly:q.dev,outOfGraphExecution:$(q.name)},Ke,Q,k.inc,k.aborted);if(!(Ae.hit===null&&Ri(Ae.finding,Q,"base")))continue;let kn=Rn(b,z.modulesById,z.reachMods,Q,z.records);he.push({advisoryId:L.id,packageName:q.name,symbolName:Q.exportName,modelWouldPromote:kn!==null,...kn!==null?{modelId:kn.modelId}:{},anchorCleared:kn!==null})}}}let Le=M.some(q=>q.modelId!==void 0);cn={records:ye,deltas:Oe,exitCodes:{baseline:xe(Z["reachable-high"]+Z["reachable-medium"],Z.unknown+(Le?1:0)),withBindingForms:xe(H["reachable-high"]+H["reachable-medium"],H.unknown+(Le?1:0))},dualRunWallMs:Date.now()-B,...N.bindingApplicability!==void 0?{applicability:N.bindingApplicability}:{},...he!==void 0?{modelProbe:he}:{}},io(Ze.dirname(e.bindingShadow.outPath),{recursive:!0});let Re=`${e.bindingShadow.outPath}.tmp-${to(8).toString("hex")}`;so(Re,`${JSON.stringify(cn,null,2)}
-`,{encoding:"utf8",flag:"wx"}),ro(Re,e.bindingShadow.outPath)}let un=I.length>0||A.notes.length>0?{active:A.models.length,stored:I.length,promoted:M.filter(B=>B.modelId!==void 0).length,notes:[...A.notes,...j!==null?j.notes:[]]}:void 0;return{...be!==void 0?{summaryShadow:be}:{},...dn!==void 0?{modelShadow:dn}:{},...cn!==void 0?{bindingShadow:cn}:{},...un!==void 0?{modelLane:un}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:a,findings:M,counts:H,analyzerDiagnostics:E,analysisAborted:_,rejectedEntries:c,entrypointSources:p,entrypointGaps:[...u.gaps,...u.surfaceGaps],framework:u.framework,unresolved:m,advisories:[...X.values()],exitCode:Ie}}finally{e.reader===void 0&&t.close()}}var Hc="cupel",Wc="reachability-first SCA \u2014 verdict + call path + confidence";function Pi(e){return[`${Hc} v${e} \u2014 ${Wc}`,`cascade: ${ar.join(" \u2192 ")}`,`verdicts: ${lr.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)"].join(`
-`)}var Gc=new Set([...Kt,...Bt]);function Sn(e,n,t){let i=e[n+1];if(i===void 0||i.startsWith("--"))throw new Error(`${t} requires a value`);return i}function Xc(e){let n=e.split(",").map(r=>r.trim()),t=[...Kt,...Bt].join(", ");if(n.length===0||n.some(r=>r===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let i=[];for(let r of n){if(!Gc.has(r))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(r)}; valid: ${t}`);i.push(r)}return i}function uo(e){let n=".",t,i,r=!1,s=!1,a=!1,l=!1,o=!1,c,u,f,p=!1,h=!1,S,x=!1,y=!1,v,C=[];for(let $=0;$<e.length;$+=1){let N=e[$];if(N==="--require-complete-denial"){s=!0;continue}if(N==="--fail-on-reachable")r=!0;else if(N==="--fail-on-unknown")a="all";else if(N!==void 0&&N.startsWith("--fail-on-unknown="))a=Xc(N.slice(18));else if(N==="--offline")l=!0;else if(N==="--sarif")t=Sn(e,$,"--sarif"),$+=1;else if(N==="--shard")i=Sn(e,$,"--shard"),$+=1;else if(N==="--entry")C.push(Sn(e,$,"--entry")),$+=1;else if(N==="--summary-shadow")c=Sn(e,$,"--summary-shadow"),$+=1;else if(N==="--model-shadow")u=Sn(e,$,"--model-shadow"),$+=1;else if(N==="--model-shadow-out")f=Sn(e,$,"--model-shadow-out"),$+=1;else if(N==="--model-shadow-widened")p=!0;else if(N==="--binding-shadow")h=!0;else if(N==="--binding-shadow-out")S=Sn(e,$,"--binding-shadow-out"),$+=1;else if(N==="--x-partial-rows")x=!0;else if(N==="--push")y=!0;else if(N!==void 0&&N.startsWith("--auth=")){let b=N.slice(7);if(b!=="oidc"&&b!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(b)}`);v=b}else{if(N!==void 0&&N.startsWith("--"))throw new Error(`unknown flag ${N}`);N!==void 0&&!o&&(n=N,o=!0)}}if(u===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(p&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(S!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(v!==void 0&&!y)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:i,failOnReachable:r,requireCompleteDenial:s,failOnUnknown:a,offline:l,entry:C,summaryShadow:c,modelShadow:u,modelShadowOut:f,modelShadowWidened:p,push:y,auth:v,bindingShadow:h,bindingShadowOut:S,partialRows:x}}import{randomBytes as Jc,createHash as Yc}from"node:crypto";import{mkdirSync as Zc,readFileSync as Qc,renameSync as eu,writeFileSync as nu}from"node:fs";import{homedir as tu}from"node:os";import bn from"node:path";var Li="latest.json",Ti="latest.json.sig";function It(e){return Yc("sha256").update(e).digest("hex")}function fo(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=tu();if(process.platform==="darwin")return bn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,s=r!==void 0&&r!==""?r:bn.join(n,"AppData","Local");return bn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,i=t!==void 0&&t!==""?t:bn.join(n,".cache");return bn.join(i,"cupel","shards")}function Di(e,n,t){return bn.join(e,`${n}-${t}.sqlite`)}function At(e,n){Zc(bn.dirname(e),{recursive:!0});let t=`${e}.tmp-${Jc(8).toString("hex")}`;nu(t,n,{flag:"wx"}),eu(t,e)}function Hn(e){try{return Qc(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function po(e,n,t,i){let r=Di(e,n,t),s=Hn(r);if(s===void 0)return;let a=It(s);if(a!==t)throw i(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:r,bytes:s}}var mo="api.cupel.sh",_t=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),ho=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Ot from"node:path";function Me(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function go(e,n={}){let t=n.maxBytes??1073741824,i=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((s,a)=>{let l=r(e,n.headers!==void 0?{headers:n.headers}:{},o=>{let c=o.statusCode??0;if(c<200||c>=300){o.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(c)}`));return}let u=[],f=0;o.on("data",p=>{if(f+=p.length,f>t){o.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(p)}),o.on("end",()=>{s(Buffer.concat(u))}),o.on("error",a)});l.on("error",a),l.setTimeout(i,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(i)}ms`))})})}async function Wn(e,n,t,i,r,s=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((o,c)=>{let u=a(n,{method:e,headers:t},f=>{let p=[],h=0;f.on("data",S=>{if(h+=S.length,h>r){f.destroy(),c(new Error(`${e} to ${l} returned more than ${String(r)} bytes`));return}p.push(S)}),f.on("end",()=>{o({status:f.statusCode??0,body:Buffer.concat(p).toString("utf8")})}),f.on("error",()=>{c(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{c(new Error(`${e} to ${l} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(s)}ms`))}),i!==void 0&&u.write(i),u.end()})}import{createPublicKey as iu,verify as ru}from"node:crypto";var J=class extends Error{constructor(n){super(n),this.name="DistError"}},su=Buffer.from("302a300506032b6570032100","hex"),ou=32;function bo(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===ou)try{return iu({key:Buffer.concat([su,n]),format:"der",type:"spki"})}catch{return}}function Fi(e,n,t){for(let i of t){let r=bo(i);if(r!==void 0)try{if(ru(null,e,r,n))return!0}catch{}}return!1}function ko(e){return e.some(n=>bo(n)!==void 0)}var au=/^[0-9a-f]{64}$/u,lu=/^[a-z0-9-]+$/u;function yo(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new J(`${n} must be an object`);return e}function xo(e,n){if(!Array.isArray(e))throw new J(`${n} must be an array`);return e}function Nt(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new J(`${n} must be an integer`);return e}function Ct(e,n){if(typeof e!="string")throw new J(`${n} must be a string`);return e}function So(e,n){let t=Ct(e,n);if(Number.isNaN(Date.parse(t)))throw new J(`${n} is not a valid timestamp: ${t}`);return t}function ji(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new J("distribution index is not valid JSON")}let i=yo(t,"index"),r=Nt(i.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new J(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=Nt(i.sequence,"sequence");if(s<0)throw new J("sequence must be non-negative");let a=So(i.generated,"generated"),l=xo(i.shards,"shards"),o;for(let S of l){let x=yo(S,"shard entry"),y=Ct(x.ecosystem,"ecosystem");if(!lu.test(y))throw new J(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){o=x;break}}if(o===void 0)throw new J(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);So(o.built,"built");let c=Nt(o.db_schema_version,"db_schema_version");if(c<1)throw new J("db_schema_version must be >= 1");if(c>n.supportedDbSchemaVersion)throw new J(`this shard needs a newer cupel (db_schema_version ${String(c)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=Ct(o.sha256,"sha256");if(!au.test(u))throw new J(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let f=Nt(o.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new J(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let p=xo(o.urls,"urls");if(p.length===0)throw new J("urls must be a non-empty array");let h=[];for(let S of p){let x=Ct(S,"url");try{h.push(Me(x,n.shardHosts))}catch(y){throw new J(`refusing shard url ${JSON.stringify(x)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:f,dbSchemaVersion:c,urls:h,sequence:s,generated:a}}var zi="CUPEL_DELIVERY_TOKEN",Ki=class extends J{constructor(n){super(n),this.name="NoDeliveryTokenError"}},Bi=class extends J{constructor(n){super(n),this.name="DeliveryCredentialError"}};function du(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function Eo(e,n){let t=du(e);return t!==void 0?()=>Promise.resolve(t):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function wo(e){if(e===void 0)throw new Ki(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow, elsewhere set ${zi} to a token from app.cupel.sh, or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new Bi(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var cu="/v1/resolve",Ui=1024*1024,Vi=4096,vo=Ui+Vi+64*1024,uu=8,fu=2048,pu=/^[A-Za-z0-9+/]+={0,2}$/u,mu=3e4,me=class extends J{constructor(n){super(n),this.name="DeliveryRefusedError"}},Gn=class extends J{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Xn=class extends J{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function hu(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function gu(e){if(typeof e!="string"||e.length===0)throw new me("the delivery response carried no index signature");if(e.length>Vi||!pu.test(e))throw new me("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new me("the delivery response's index signature is not canonical base64");return n}function yu(e){if(typeof e!="string"||e.length===0)throw new me("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Ui)throw new me("the delivery response's index is larger than one can be");return n}function xu(e){if(!Array.isArray(e)||e.length===0)throw new me("the delivery response named no shard urls");if(e.length>uu)throw new me("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>fu)throw new me("the delivery response carried a malformed shard url");n.push(t)}return n}function Su(e,n){throw e===401||e===403?new me(`${n} rejected the delivery credential \u2014 check ${zi}, or that the token has not been revoked in the dashboard`):e===404?new me(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Xn(`${n} holds nothing newer than the shard index already cached`):e===429?new Gn(`${n} rate-limited the delivery request`):e>=500?new Gn(`${n} answered ${String(e)}`):new me(`${n} refused the delivery request with status ${String(e)}`)}async function Io(e,n,t,i,r=mu){let s=Me(`https://${e}${cu}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await i(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,r)}catch{throw new Gn(`${e} could not be reached`)}if(l.status!==200&&Su(l.status,e),Buffer.byteLength(l.body,"utf8")>vo)throw new me(`${e} returned a delivery response larger than one can be`);let o;try{o=JSON.parse(l.body)}catch{throw new me(`${e} returned a delivery response that is not JSON`)}if(!hu(o))throw new me(`${e} returned a delivery response that is not an object`);return{index:yu(o.index),sig:gu(o.signature),shardUrls:xu(o.shardUrls)}}var Ao=async(e,n,t,i)=>await Wn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,vo,i);var bu=8,Hi=class extends J{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function qi(e){return`${e.origin}${e.pathname}`}function _o(e,n,t){let i=new Map;for(let a of n)i.set(qi(a),a);let r=[],s=[];for(let a of e.slice(0,bu)){let l;try{l=Me(a,t)}catch(u){s.push(u.message);continue}if(l.hash!==""){s.push("a candidate carried a fragment");continue}let o=i.get(qi(l));if(o===void 0){s.push("a candidate named an object the signed index does not list");continue}let c=new URL(`${qi(o)}${l.search}`);r.push(Me(c.href,t))}if(r.length===0)throw new Hi(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return r}var Eu=1,wu=1024*1024*1024;function vu(e=_t){return{async resolve(n){return await Io(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Ao)},async fetchShard(n,t){return Me(n.href,e),await go(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Wi(e){return e instanceof Error?e.message:String(e)}function No(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Eu,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:wu}}function Iu(e){let n=Hn(Ot.join(e.cacheDir,Li)),t=Hn(Ot.join(e.cacheDir,Ti));if(!(n===void 0||t===void 0)&&Fi(n,t,e.pubkeys))try{return ji(n,No(e))}catch{return}}function Co(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let i=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(i)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Rt(e,n,t){let i=po(n.cacheDir,e.ecosystem,e.sha256,r=>new J(r));if(i===void 0)throw new J(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:i.path,fromCache:!0,warnings:[...t,...Co(e,n)],sequence:e.sequence}}async function Au(e,n,t,i){let r=Di(t.cacheDir,e.ecosystem,e.sha256),s=Hn(r);if(s!==void 0&&It(s)===e.sha256)return{path:r,downloaded:!1};let a="no shard urls";for(let l of n){let o;try{o=await i.fetchShard(l,e.sizeBytes)}catch(u){a=Wi(u);continue}let c=It(o);if(c!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${c})`;continue}return At(r,o),{path:r,downloaded:!0}}throw new J(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function _u(e,n,t){if(e instanceof me)throw e;if(e instanceof Xn){if(n===void 0)throw new J(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Rt(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new J(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Wi(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Rt(n,t,[`could not refresh the shard index (${Wi(e)}); using the cached shard`])}async function Oo(e,n){if(!e.activated)throw new J("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??vu(e.shardHosts);if(!ko(e.pubkeys))throw new J("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let i=Iu(e);if(e.offline){if(i===void 0)throw new J(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Rt(i,e,[])}let r=await wo(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:i?.sequence??0})}catch(c){return _u(c,i,e)}if(!Fi(s.index,s.sig,e.pubkeys))throw new J("shard index signature did not verify against any pinned key");let a=ji(s.index,No(e));if(i!==void 0&&a.sequence<i.sequence)return Rt(i,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(i.sequence)}); keeping the newer cached shard`]);let l=_o(s.shardUrls,a.urls,e.shardHosts),o=await Au(a,l,e,t);return At(Ot.join(e.cacheDir,Li),s.index),At(Ot.join(e.cacheDir,Ti),s.sig),{path:o.path,fromCache:!o.downloaded,warnings:Co(a,e),sequence:a.sequence}}var Nu="https://api.cupel.sh",Ro=".actions.githubusercontent.com",Cu=8192,Pe=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function Ou(e){let n;try{n=new URL(e).hostname}catch{throw new Pe("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=Ro.slice(1);if(n!==t&&!n.endsWith(Ro))throw new Pe(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Me(e,new Set([n]))}catch{throw new Pe(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function $t(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,i=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Pe("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(i===void 0||i==="")throw new Pe("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=Ou(t);r.searchParams.set("audience",Nu);let s;try{s=await n(r.href,{authorization:`Bearer ${i}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Pe("the ID-token request failed")}if(s.length>Cu)throw new Pe("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(s)}catch{throw new Pe("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new Pe("the ID-token response carried no token");return l}async function $o(e,n,t={}){let i=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!i)throw new Pe("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await $t(e,n)};if(i)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await $t(e,n)};throw new Pe("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Gi="api.cupel.sh",Ru=`https://${Gi}/v1/findings`,$u=64*1024,Mt=8*1024*1024,Mu=3e4,ln=class extends Error{constructor(n){super(n),this.name="PushError"}};async function Mo(e,n,t,i={}){if(e.length>Mt)throw new ln(`findings payload is ${String(e.length)} bytes, over the ${String(Mt)}-byte limit`);let r=Me(Ru,new Set([Gi])),s;try{s=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,i.timeoutMs??Mu)}catch{throw new ln(`the findings push to ${Gi} failed`)}if(s.body.length>$u)throw new ln("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new ln("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new ln("the control plane rejected the findings payload as malformed"):new ln(`the findings push was refused with status ${String(s.status)}`)}var Pu=64*1024,Lu=64*1024,Po=async(e,n,t,i)=>{if(Buffer.byteLength(t,"utf8")>Mt)throw new Error("findings payload is over the size limit");return await Wn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Lu,i)};async function Pt(e,n){let t=await Wn("GET",e,n,void 0,Pu,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var Du=720*60*60*1e3,Fu=Number(pn);function Lo(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new qe("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function To(e){let n=await Oo({ecosystem:"npm",activated:!0,pubkeys:ho,indexHost:mo,shardHosts:_t,credential:Eo(process.env,()=>$t(process.env,Pt)),cacheDir:fo(),offline:e.offline,now:Date.now(),maxAgeMs:Du,supportedDbSchemaVersion:Fu});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
-`);return{path:n.path,sequence:n.sequence}}var ju=8,Ku={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64,maxAdvisoryDetails:8e3},tn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Xi(e){return{path:e.path,start:e.start,end:e.end}}function Bu(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new tn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,i=e.modelPromotedFromKind??null;if(t===null!=(i===null))throw new tn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new tn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:dr(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(r=>({functionName:r.functionName??null,modulePath:r.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(Xi),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:i,surfaceComplete:e.surfaceComplete??null}}var zu="";function Uu(e){return[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""].join(zu)}function Vu(e){let n=new Map;for(let t of e){let i=Uu(t),r=n.get(i);if(r===void 0){n.set(i,t);continue}if(r.tier!==t.tier||r.unknownKind!==t.unknownKind)throw new tn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function qu(e){let n=Ku,t=(i,r,s)=>{throw new tn(`${i} has ${String(r)} entries, over the ${String(s)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let i of["dispatch","load"]){let r=e.unresolved[i].length;r>n.maxUnresolvedSites&&t(`the app-global ${i} set`,r,n.maxUnresolvedSites)}for(let i of e.findings)i.path!==null&&i.path.length>n.maxPathSteps&&t(`the call path of finding ${i.advisoryId}`,i.path.length,n.maxPathSteps),i.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${i.advisoryId}`,i.unresolvedSites.length,n.maxUnresolvedSites);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let i of e.advisories){if(i.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${i.id}`,i.ranges.length,n.maxAdvisoryRanges),i.summary!==null&&i.summary.length>n.maxStringLength)throw new tn(`the summary of advisory ${i.id} is ${String(i.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(i.details!==null&&i.details.length>n.maxAdvisoryDetails)throw new tn(`the description of advisory ${i.id} is ${String(i.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function Hu(e,n){let t=new Set(n.map(i=>i.advisoryId));return e.advisories.filter(i=>t.has(i.advisory.id)).map(i=>({id:i.advisory.id,cveId:i.advisory.cveId,osvId:i.advisory.osvId,summary:i.advisory.summary,details:i.advisory.details??null,severity:i.advisory.severity,published:i.advisory.published,source:i.advisory.source,ranges:i.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function Do(e,n){let t=Vu(e.findings.map(Bu)),i={version:ju,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(Xi),load:e.unresolved.load.map(Xi)},advisories:Hu(e,t)};return qu(i),i}function U(e){let n="";for(let t of e){let i=t.charCodeAt(0),r=i<32||i>=127&&i<=159;n+=r?"\\x"+i.toString(16).padStart(2,"0"):t}return n}function Wu(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var Gu={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Fo=4,Ji=3,Yi=10,jo={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},Xu="(symbol set known incomplete)";function Ju(e){let n=(e.path??[]).map(t=>U(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Ko(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function Yu(e){let n=e.findings.filter(c=>c.tier==="unknown"&&c.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let c of n){let u=t.get(c.unknownKind)??[];u.push(c),t.set(c.unknownKind,u)}let i={cupel:0,project:0};for(let[c,u]of t)i[$e[c]]+=u.length;let r=[];r.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(c,u)=>{if(i[c]===0)return;r.push(""),r.push(`   ${u} (${String(i[c])}):`);let f=[...t.entries()].filter(([h])=>$e[h]===c).sort((h,S)=>S[1].length-h[1].length||h[0].localeCompare(S[0])),p=f.slice(0,Fo);for(let[h,S]of p){let x=c==="project"?[...new Set(S.flatMap(Ko))]:[],y=x.slice(0,Ji).map(U).join(", "),v=x.length>Ji?` (+${String(x.length-Ji)} more files)`:"";r.push(`     ${h.padEnd(21)} ${String(S.length).padStart(4)}  ${jo[h]}`+(y!==""?`
-       ${y}${v}`:""))}for(let[h,S]of f.slice(Fo))r.push(`     ${h.padEnd(21)} ${String(S.length).padStart(4)}  ${jo[h]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let c of n)if($e[c.unknownKind]==="project")for(let u of Ko(c))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((c,u)=>u[1]-c[1]||c[0].localeCompare(u[0]))[0];l!==void 0&&i.project>0&&(r.push(""),r.push(`   \u279C Start here: ${U(l[0])} appears in ${String(l[1])} of your ${String(i.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let o=n.filter(c=>$e[c.unknownKind]==="project");if(o.length>0){r.push("");for(let c of o.slice(0,Yi))r.push(`     ${U(c.displayId)}  ${U(c.packageName)}@${U(c.version)}  [${c.unknownKind}] ${U(c.reason)}`);o.length>Yi&&r.push(`     \u2026 and ${String(o.length-Yi)} more`)}return r.push(""),r}function Bo(e){let n=[],t=e.counts,i=e.findings.filter(c=>c.tier==="reachable-high"||c.tier==="reachable-medium"||c.tier==="reachable-low");if(n.push(`cupel scan: ${U(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let c=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+c.map(u=>`${U(u.entrypoint)} [${U(u.source)}]`).join(", ")+(e.entrypointSources.length>c.length?`, \u2026 and ${String(e.entrypointSources.length-c.length)} more`:"")),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let c of e.entrypointGaps.slice(0,5))n.push(`  - ${U(c.source)} (${U(c.file)}): ${U(c.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(U).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${ti(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,s=r.find(c=>c.kind==="no-enumeration")??null;s!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${U(s.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=r.filter(c=>c!==s);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let c of a.slice(0,10))n.push(`  - [${U(c.kind)}] ${U(c.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(r.map(c=>c.detail)),o=[...e.analyzerDiagnostics.map(c=>`${U(c.code)}: ${U(c.detail)}`),...e.installed.diagnostics.filter(c=>!l.has(c)).map(U)];if(o.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(o.length)}) \u2014 verdicts are conservative:`);for(let c of o.slice(0,10))n.push(`  - ${c}`);o.length>10&&n.push(`  \u2026 and ${String(o.length-10)} more`),n.push("")}if(i.length>0){n.push(`\u{1F3AF} Reachable (${String(i.length)}) \u2014 fix these:`);for(let c of i)n.push(`  ${Gu[c.tier]} ${U(c.displayId)}  ${U(c.packageName)}@${U(c.version)}  ${U(c.symbolName??"")}`+(c.surfaceComplete===!1?`  ${Xu}`:"")),n.push(`        path: ${Ju(c)}`);n.push("")}return n.push(...Yu(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${Wu(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as Zu}from"node:crypto";var Qu="https://json.schemastore.org/sarif-2.1.0.json",zo="cupel-reachability",Zi=new Set(["dispatch","dynamic-load","coverage-gap"]);function ef(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var nf=500,tf=10;function rf(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function sf(e,n){return`${e}::${n}`}function of(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function af(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Zu("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function lf(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Zi.has(e.unknownKind)}var Uo={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function Vo(e){let n=[],t=new Map,i=[];for(let o of e.findings){if(!lf(o))continue;let c=sf(o.displayId,o.packageName);if(!t.has(c)){t.set(c,n.length);let y=of(o.severity);n.push({id:U(c),properties:{tags:o.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${U(o.packageName)}`]:["security","reachability",`package/${U(o.packageName)}`],...y!==void 0?{"security-severity":y}:{}}})}let u=o.tier==="reachable-high"||o.tier==="reachable-medium"||o.tier==="reachable-low",f=o.path??[],p=f.find(y=>y.modulePath!==""),h=[...new Set(o.unresolvedSites.map(y=>y.path).filter(y=>y!==""))],S=u?p!==void 0?{physicalLocation:{artifactLocation:{uri:U(p.modulePath)}},message:{text:`calls ${U(o.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:U(o.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:U(h[0])}},message:{text:`unresolved ${U(o.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:U(o.packageLocation??(o.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},x=u?f.map(y=>({physicalLocation:{artifactLocation:{uri:U(y.modulePath||"package-lock.json")}},message:{text:U(y.functionName??"<step>")}})):h.slice(1,tf+1).map(y=>({physicalLocation:{artifactLocation:{uri:U(y)}},message:{text:"also blocked here"}}));i.push({ruleId:U(c),ruleIndex:t.get(c),level:u?"error":"warning",message:{text:U(`[${o.tier}] ${o.displayId} in ${o.packageName}@${o.version}`+(o.symbolName!==null?` \u2014 reaches ${o.symbolName}`:"")+(o.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${o.reason}`)},locations:[S],...x.length>0?{relatedLocations:x}:{},partialFingerprints:{"cupelReachability/v1":af(o)},properties:{tier:o.tier,advisoryId:U(o.advisoryId),...o.surfaceComplete===!1?{surfaceComplete:!1}:{},...o.modelId!==void 0?{modelId:U(o.modelId),modelPromotedFromKind:o.modelPromotedFromKind}:{},...o.unknownKind!==void 0?{unknownKind:o.unknownKind,unknownOwner:$e[o.unknownKind],unresolvedSiteCount:o.unresolvedSites.length}:{}}})}let r=new Map,s=new Map;for(let o of e.findings){if(o.tier!=="unknown"||o.unknownKind===void 0||(r.set(o.unknownKind,(r.get(o.unknownKind)??0)+1),Zi.has(o.unknownKind)))continue;let c=s.get(o.unknownKind)??[];c.length<nf&&c.push({advisory:U(o.displayId),package:U(o.packageName),version:U(o.version)}),s.set(o.unknownKind,c)}let a={cupel:0,project:0};for(let[o,c]of r)a[$e[o]]+=c;let l={};for(let[o,c]of s){let u=r.get(o)??c.length;l[o]={count:u,owner:$e[o],note:Uo[o],truncated:u>c.length,advisories:c}}return{$schema:Qu,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:zo},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:U(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(o=>`${o.entrypoint} (${o.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...r.keys()].filter(o=>!Zi.has(o)&&!ef(o,e.analysisAborted)).sort().map(o=>({descriptor:{id:`unknown-${o}`},level:"warning",message:{text:`${String(r.get(o)??0)} finding(s) are unknown because ${Uo[o]} (owner: ${$e[o]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${o}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(o=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:U(`${o.source} (${o.file}): ${o.detail}`)}})),...e.rejectedEntries.map(o=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:U(`--entry did not resolve to a file inside the app root: ${o}`)}})),...e.analyzerDiagnostics.map(o=>({descriptor:{id:o.code},level:"warning",message:{text:U(`${o.detail} (${o.path})`)}})),...e.installed.diagnostics.map(o=>({descriptor:{id:"resolve"},level:"warning",message:{text:U(o)}}))]}],results:i,properties:{category:zo,summary:e.counts,...rf(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...r].sort((o,c)=>c[1]-o[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(o=>o.tier==="unknown"&&o.unknownKind==="db-gap").map(o=>({advisory:U(o.displayId),package:U(o.packageName),version:U(o.version)}))}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function qo(){try{let e=df(ff(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function pf(e,n){let t=`${JSON.stringify(n,null,2)}
-`,i=`${e}.tmp-${Ho(8).toString("hex")}`;Wo(i,t,{encoding:"utf8",flag:"wx"}),cf(i,e)}async function mf(e){let n=uo(e),i=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:Lo(n.shard),sequence:null}:await To({offline:n.offline}),r=i.path,s=Mi({dir:n.dir,shardPath:r,failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{}});if(process.stdout.write(`${Bo(s)}
-`),s.modelLane!==void 0){let a=s.modelLane.notes.length>0?` (${s.modelLane.notes.map(l=>U(l)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(s.modelLane.active)}/${String(s.modelLane.stored)} active, ${String(s.modelLane.promoted)} promoted to reachable-low${a}
-`)}if(n.summaryShadow!==void 0&&s.summaryShadow!==void 0){let a=uf.join(n.summaryShadow,"shadow-report.json");Wo(a,`${JSON.stringify(s.summaryShadow,null,2)}
-`),process.stdout.write(`summary-shadow: ${String(s.summaryShadow.records.length)} counterfactual record(s) -> ${a}
-`)}if(s.modelShadow!==void 0&&n.modelShadowOut!==void 0){let a=s.modelShadow.records.filter(l=>l.wouldPromote).length;process.stdout.write(`model-shadow: ${String(a)}/${String(s.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
-`)}if(s.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(s.bindingShadow.deltas)}/${String(s.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),n.sarif!==void 0&&pf(n.sarif,Vo(s)),n.push){let a=Do(s,{scanId:Ho(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:i.sequence}),l=await $o(process.env,Pt,{...n.auth!==void 0?{auth:n.auth}:{},warn:c=>process.stderr.write(`cupel: ${c}
-`)});try{await Mo(JSON.stringify(a),l.value,Po)}catch(c){let u=c instanceof Error?c.message:String(c);return process.stderr.write(`cupel: ${u}
-`),s.exitCode===0?1:s.exitCode}let o=i.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(a.findings.length)} finding(s) to api.cupel.sh (${l.kind})${o}
-`)}return s.exitCode}async function hf(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await mf(e.slice(1))}catch(t){let i=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${i}
-`),1}let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${Pi(qo())}
-`),0):(process.stderr.write(`cupel: unknown command '${U(n)}'
-`),process.stderr.write(`${Pi(qo())}
-`),1)}hf().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+}`,b.ScriptTarget.Latest,!0),o=r.parseDiagnostics;if(o!==void 0&&o.length>0||Ld(r,n+1,!0))return!0}return!1}function Ld(e,n=0,t=!1){return Ar(e,n,t).size>0}function Ar(e,n=0,t=!1){let r=new Set,o=t?_d:Dd(e);if(o.saturated)return r.add("saturated"),r;let i=l=>b.isElementAccessExpression(l)&&!b.isStringLiteralLike(l.argumentExpression)&&At(Se(l.expression),o),a=l=>{if(t&&(b.isCallExpression(l)||b.isNewExpression(l)||b.isTaggedTemplateExpression(l))){r.add("eval-invocation");return}if(b.isCallExpression(l)){let s=Jn(l);if(s!==null){let d=s.specifierArg;if(d===void 0||!b.isStringLiteralLike(d)||t){r.add("non-literal-load");return}}else{let d=Se(l.expression);if(b.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if(Ni(l.arguments,n)){r.add("eval-code");return}}else if(Td(d)){r.add("loader-callee");return}else if(i(d)){r.add("computed-loader");return}else if($d(l,o)){r.add("reflect-get");return}}}else if(b.isNewExpression(l)){let s=Se(l.expression);if(b.isIdentifier(s)&&s.text==="Function"){if(Ni(l.arguments??[],n)){r.add("function-ctor");return}}else if(Xn(s)){r.add("ctor-chain");return}}else if(b.isIdentifier(l)&&Ed.has(l.text)&&Ad(l)){r.add("captured-loader");return}else if((b.isPropertyAccessExpression(l)||b.isElementAccessExpression(l))&&($i(l)||Xn(l)||i(l))&&Oi(l)){r.add("captured-member");return}else if(b.isBindingElement(l)){let s=l.propertyName??l.name,d=b.isIdentifier(s)||b.isStringLiteralLike(s)?s.text:b.isComputedPropertyName(s)&&b.isStringLiteralLike(s.expression)?s.expression.text:void 0;if(d!==void 0&&Nt.has(d)){r.add("destructured-member");return}}b.forEachChild(l,a)};return a(e),r}function Fi(e,n,t){let r=new Set(Ar(t));if(Nr(e)&&n.includes("<")&&n.includes("require")){let o=b.createSourceFile(e,n,b.ScriptTarget.ES2020,!0,b.ScriptKind.TSX);for(let i of Ar(o))r.add(i)}return r}function Fd(e,n,t){if(_r(e))return!0;let r=t.endsWith(Re.sep)?t:t+Re.sep,o=e.split("/"),i=n;for(;;){let a=Re.join(i,"node_modules",...o),l;try{l=vn(Re.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(r))return!1;let d=_e(l);if(d===null)return!1;let u;try{u=JSON.parse(d).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(li(a))return!1;if(i===t)break;let s=Re.dirname(i);if(s===i||s!==t&&!s.startsWith(r))break;i=s}return!0}function jd(e,n){let t=n.endsWith(Re.sep)?n:n+Re.sep,r=Re.dirname(e);for(;;){let o=Re.join(r,"package.json"),i;try{i=vn(o)}catch{i=null}if(i!==null&&(i===n||i.startsWith(t))){let l=_e(i);if(l!==null)try{let s=JSON.parse(l).name;if(typeof s=="string"&&s.length>0)return s}catch{return null}}if(r===n)break;let a=Re.dirname(r);if(a===r||a!==n&&!a.startsWith(t))break;r=a}return null}function Kd(e,n,t,r,o){let i=[],a=[],l=new Set,s={},d=[],u=[],p=new Set,f=new Set,h=[],g=!1,k=(w,v)=>{let I;try{I=vn(v)}catch{return!1}let C=Oe(e,I);if(C===null)return o.push({code:"out-of-root",path:I,detail:"dependency module resolved outside the app root; not followed"}),!1;let E=!t.has(I)&&!f.has(I);return E&&f.size>=wr?(g=!0,!1):(a.push({from:w,to:{module:C}}),E?(f.add(I),i.push(C),!0):!1)},S=(w,v)=>{if(l.add(v),p.has(v))return;p.add(v);let I=Ke(v,w,Ne,n),C=I!==null?[I]:$n(v,w,Ne,n);C.length>=2&&d.push({path:Oe(e,w)??w,specifier:v,candidates:C.map(m=>Oe(e,m)??m)});let E=!1;for(let m of C)if(!De(m)&&(E=!0,k({surface:v},m))){h.push(m);try{let x=Oe(e,vn(m)),A=jd(m,e);x!==null&&A!==null&&(s[x]=A)}catch{}}E||Fd(v,Re.dirname(w),e)||o.push({code:"unresolved-specifier",path:v,reason:Wn(v,w,Ne,n),detail:`dependency "${v}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let w of r)S(w.containingFile,w.packageName);for(;h.length>0&&f.size<wr;){let w=h.pop();if(w===void 0)break;let v=Oe(e,w);if(v===null)continue;let I=On(w,un);if(I.kind==="too-large"){o.push({code:"limit-exceeded",path:v,detail:`dependency module over the ${String(un/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(I.kind==="not-regular"){o.push({code:"parse-error",path:v,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let C=b.createSourceFile(w,I.text,b.ScriptTarget.ES2020,!0),E=C.parseDiagnostics;if(E!==void 0&&E.length>0){o.push({code:"dependency-body",path:v,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let m=Fi(w,I.text,C);if(m.size>0){o.push({code:"dependency-body",path:v,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...m].sort()});continue}o.push({code:"dependency-body",path:v,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:v});for(let x of Ri(w,I.text))if(x.runtime)if(ge(x.text)==="package-root"){let A=je(x.text);a.push({from:{module:v},to:{surface:A}}),S(w,A)}else{if(_r(je(x.text)))continue;let A=Ke(x.text,w,Ne,n),O=A!==null?[A]:$n(x.text,w,Ne,n);if(O.length===0){if(ge(x.text)==="package-subpath"){let j=Wn(x.text,w,Ne,n);if(j==="no-candidate"||j==="not-installed"&&fi(w,je(x.text))){u.push({path:v,specifier:x.text,why:j});continue}o.push({code:"unresolved-specifier",path:v,reason:j,detail:`runtime package-subpath import "${x.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}O.length>=2&&d.push({path:v,specifier:x.text,candidates:O.map(j=>Oe(e,j)??j)});for(let j of O){if(De(j)){let T=Oe(e,j);o.push({code:T===null?"out-of-root":"declaration-shadow",path:v,detail:T===null?`runtime import "${x.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${x.text}" resolved to the declaration file "${T}" with no co-located runtime module; its code was not analyzed`});continue}k({module:v},j)&&h.push(j)}}}return(g||h.length>0)&&o.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(wr)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:i,edges:a,surfacePackages:[...l],entryRealNames:s,conditionUnions:d,provenAbsent:u}}function ji(e,n,t=!1){let r=vn(e),o=[],i=[],a=b.createCompilerHost(Ne,!0),l=t?pi(r,Ne,a):()=>null,s=new Set,d=new Set,u=n.map(N=>Re.join(r,N)),p=[],f=new Map,h=new Map,g=new Map,k=new Map,S=new Set,w=(N,L,R)=>{let P=`${String(N.length)}:${N}${L}`;S.has(P)||(S.add(P),o.push({code:"unresolved-specifier",path:N,detail:L,reason:R}))},v=()=>null,I=0,C=(N,L)=>{let R=h.get(N);return R===void 0&&(R=b.createSourceFile(N,L,b.ScriptTarget.ES2020,!0),h.set(N,R)),{real:N,sf:R}};for(;d.size<vt;){let N=u.pop();if(N===void 0){if(I>=kd)break;I+=1;let K=[];for(let[$,W]of f)W.includes("readdir")&&(W.includes("require")||W.includes("import("))&&K.push(C($,W));let H=bd(K);if(H.length===0)break;let z=[];for(let[$,W]of f)z.push(C($,W));v=vi(z,H,Ne,a,g);let q=!1;for(let $ of K){let W=f.get($.real);if(W!==void 0)for(let X of _i($.real,W,r,a,v))d.has(X)||(u.push(X),q=!0)}if(!q)break;continue}let L;try{L=vn(N)}catch{continue}if(d.has(L))continue;if(d.add(L),Oe(r,L)===null){o.push({code:"out-of-root",path:N,detail:"resolved outside app root"});continue}let R=On(L,un);if(R.kind==="too-large"){o.push({code:"limit-exceeded",path:L,detail:`file is ${String(Math.round(R.bytes/1048576))}MiB, over the ${String(un/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(R.kind==="not-regular"){o.push({code:"parse-error",path:L,detail:"unreadable or not a regular file"});continue}let P=R.text;s.add(L),f.set(L,P);for(let K of Ri(L,P)){let H=K.runtime?l(K.text,L):null;if(H===null&&ge(K.text)==="package-root"){K.runtime&&p.push({containingFile:L,packageName:je(K.text)});continue}let z=H??Ke(K.text,L,Ne,a),q=z!==null?[z]:K.runtime&&H===null?$n(K.text,L,Ne,a):[];if(q.length===0){if(K.runtime){let $=ge(K.text);if(!($==="package-subpath"&&_r(je(K.text)))){if($==="package-subpath")w(L,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,Wn(K.text,L,Ne,a));else if($==="relative"){let W=ci(K.text,L,r,k);W.kind==="unanalyzable"&&w(L,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${W.reason}; a bundler/loader may load a module the analyzer never saw`,W.why)}}}continue}q.length>=2&&i.push({path:Oe(r,L)??L,specifier:K.text,candidates:q.map($=>Oe(r,$)??$)});for(let $ of q){if(Oe(r,$)===null){o.push({code:"out-of-root",path:$,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&De($)){o.push({code:"declaration-shadow",path:$,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!St($)){o.push({code:"unanalyzable-module",path:$,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}u.push($)}}for(let K of _i(L,P,r,a,v))d.has(K)||u.push(K)}d.size>=vt&&u.length>0&&o.push({code:"limit-exceeded",path:r,detail:`reachable file set exceeds ${String(vt)}; analysis truncated (${String(u.length)}+ files not analyzed)`});let E=Kd(r,a,s,p,o),m=b.createProgram({rootNames:[...s],options:Ne,host:a}),x=new Set,A=new Map;for(let N of m.getSourceFiles()){if(N.isDeclarationFile||m.isSourceFileDefaultLibrary(N)||Oe(r,N.fileName)===null||!Nr(N.fileName))continue;let L=m.getSyntacticDiagnostics(N).length>0;if(!L&&!N.text.includes("<")||Sd(N.text,b.ScriptKind.TSX)!==0)continue;let R=b.createSourceFile(N.fileName,N.text,b.ScriptTarget.ES2020,!0,b.ScriptKind.TSX);(L||Ai(R)>Ai(N))&&(x.add(N.fileName),A.set(N.fileName,N.text))}let O=m;if(x.size>0){let N=a.getSourceFile.bind(a);a.getSourceFile=(L,R,P,K)=>{let H=A.get(L);return H!==void 0?b.createSourceFile(L,H,b.ScriptTarget.ES2020,!0,b.ScriptKind.TSX):N(L,R,P,K)},O=b.createProgram({rootNames:[...s],options:Ne,host:a,oldProgram:m})}let j=O.getTypeChecker(),T=[];for(let N of O.getSourceFiles()){if(N.isDeclarationFile||O.isSourceFileDefaultLibrary(N)||Oe(r,N.fileName)===null)continue;T.push(N);let L=O.getSyntacticDiagnostics(N);if(L.length>0){let K=L[0],H=K!==void 0?b.flattenDiagnosticMessageText(K.messageText," "):"syntax error";o.push({code:"parse-error",path:N.fileName,detail:`${String(L.length)} syntax error(s): ${H}`})}let R=Oe(r,N.fileName),P=R===null?null:Fi(N.fileName,N.text,N);R!==null&&P!==null&&P.size>0&&o.push({code:"loader-escape",path:R,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...P].sort()})}return{program:O,checker:j,host:a,options:Ne,appRoot:r,sourceFiles:T,diagnostics:o,depReach:E,conditionUnions:[...i,...E.conditionUnions],provenAbsent:E.provenAbsent,resolveParamDirs:v,toRel:N=>Oe(r,N)}}import{opendirSync as Bd,statSync as zd}from"node:fs";import Rr from"node:path";var Ud=8192,Vd=2e4,qd=new Set(["node_modules"]),Ki=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),Wd=16;function Rt(e,n,t,r,o={}){let i=o.maxEntries??Vd,a=o.prune,l=[],s=!1,d=0,u=[{dir:Rr.join(e,n),rel:n,depth:0}];for(;u.length>0;){let p=u.pop();if(p===void 0)break;if(p.depth>Wd){s=!0;continue}let f;try{f=Bd(p.dir)}catch{s=!0;continue}try{let h=0;for(;;){let g=f.readSync();if(g===null)break;if(h+=1,d+=1,h>Ud||d>i){s=!0;break}let k=p.rel+g.name;if(g.isSymbolicLink()){let S;try{S=zd(Rr.join(p.dir,g.name)).isDirectory()}catch{s=!0;continue}if(S){s=!0;continue}}else if(g.isDirectory()){if(qd.has(g.name)||g.name.startsWith(".")||a?.has(g.name)===!0){s=!0;continue}u.push({dir:Rr.join(p.dir,g.name),rel:`${k}/`,depth:p.depth+1});continue}else if(!g.isFile())continue;if(t(k)){if(l.length>=r){s=!0;break}l.push(k)}}}finally{try{f.closeSync()}catch{}}}return{matches:l,truncated:s}}var Gd=64;function Bi(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let r=n.slice(0,t),o=n.slice(t+1);if(r.startsWith("./")&&(r=r.slice(2)),r.startsWith("/")||o.includes("/")||r.split("/").includes("..")||r.includes("\\")||n.includes("\0"))return null;let i=r.slice(0,r.lastIndexOf("/")+1);return Rt(e,i,a=>a.length>=r.length+o.length&&a.startsWith(r)&&a.endsWith(o),Gd)}import{existsSync as Hd}from"node:fs";import Xd from"node:path";var Yd=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],Jd=["dependencies","devDependencies"];function Zd(e,n){for(let t of Jd){let r=e[t];if(!(typeof r!="object"||r===null||Array.isArray(r))&&Object.hasOwn(r,n))return!0}return!1}function Cr(e,n){if(n===null)return null;for(let t of Yd)if(Zd(n,t.dependency)){for(let r of t.configFiles)if(Hd(Xd.join(e,r)))return{name:t.name,configFile:r,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function Or(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var Qd=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],ec=256,nc=12e4;function $r(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let r=Rt(e,"",o=>{let i=o.split("/");for(let a=0;a<i.length-1;a+=1){let l=i[a];if(l!==void 0&&t.has(l))return Qd.some(s=>o.endsWith(s))}return!1},ec,{maxEntries:nc,prune:Ki});return{roots:r.matches,truncated:r.truncated}}function Be(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let r of n){let o=r.codePointAt(0)??0;t+=o<32||o>=127&&o<=159?`\\x${o.toString(16).padStart(2,"0")}`:r}return t}function tc(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function rc(e){let n=!1;for(let t=0;t<e.length;t+=1){let r=e.charAt(t),o=r.codePointAt(0)??0;if(o<32||o===127||o>=128&&o<=159)return null;if(r==="\\"){n=!0;let i=e.charAt(t+1);if(!(i>="a"&&i<="z"||i>="A"&&i<="Z"||i>="0"&&i<="9"||i==="."||i==="_"||i==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(r))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function oc(e){let n=[],t="";for(let r of e){if(r===" "||r==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=r}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var ic=/^[A-Za-z_][A-Za-z0-9_]*=/u;function sc(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var ac=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),lc=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),dc=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function Ui(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function zi(e){if(Ui(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return dc.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:ac.has(t)||n!==-1&&lc.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var cc=[".js",".cjs",".mjs",".ts",".mts",".cts"];function uc(e){return cc.some(n=>e.endsWith(n))}var fc=new Set(["npm","yarn","pnpm"]);function pc(e){let n=e[0];return n===void 0||!fc.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Dr(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!tc(n))return Mr(n);let t=rc(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let r=Mr(t.windows),o=Mr(t.posixShell);if(r.kind==="file"){let i=o.kind==="file"?o.specifier:void 0;return i===void 0||i===r.specifier?{kind:"file",specifier:r.specifier}:{kind:"file",specifier:r.specifier,alt:i}}return o.kind==="file"?{kind:"file",specifier:o.specifier}:r}function Mr(e){let n=oc(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let i=n[t];if(i===void 0||!ic.test(i))break;if(Ui(i))return{kind:"unparsed",reason:`environment \`${Be(i)}\` preloads another module; the launch surface is more than one file`};let a=i.indexOf("=");if(i.slice(0,a)==="NODE_OPTIONS")for(let l of i.slice(a+1).split(/\s+/u)){if(l===""||!l.startsWith("-"))continue;let s=zi(l);if(s!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Be(s.token)}\` ${s.why}`}}}let r=n[t];if(r===void 0)return{kind:"unparsed",reason:"no program in the command"};if(pc(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!sc(r))return{kind:"unparsed",reason:`runs \`${Be(r)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let i=n[t];if(i===void 0||!i.startsWith("-"))break;let a=zi(i);if(a!==null)return{kind:"unparsed",reason:`node flag \`${Be(a.token)}\` ${a.why}`}}let o=n[t];return o===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:uc(o)?{kind:"file",specifier:o}:{kind:"unparsed",reason:`\`${Be(o)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function mc(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var hc=64;function Tr(e){let n=e.split(`
+`),t=n.length>64,r=[],o=0;for(let i of n.slice(0,64)){let a=i.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let s=a.slice(l+1).trim();if(s.length===0)continue;let d=a.slice(0,l);if(d.length>hc||!mc(d)){o+=1;continue}r.push({name:d,command:s})}return r.sort((i,a)=>i.name===a.name?0:i.name==="web"?-1:a.name==="web"?1:0),{entries:r,truncated:t,unnamedLines:o}}import{realpathSync as Vi}from"node:fs";import Pe from"node:path";import c from"typescript";var qi=3;function ae(e,n,t){if(e===void 0)return;let r=e[n]??={fired:0,refused:{}};t===null?r.fired+=1:r.refused[t]=(r.refused[t]??0)+1}function mn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var Ot=16,jr=256,Pr=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let r=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.fns.has(r)||(this.moduleFor(n),this.fns.set(r,{id:o,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),o}classFor(n,t){let r=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.classNodes.has(r)||(this.moduleFor(n),this.classNodes.set(r,{id:o,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(r,[])),o}methodFor(n,t,r,o){let i=`${n}#${t}.${r}`,a=`pkg:${n}#${t}.${r}`;if(!this.fns.has(i)){let l=this.classFor(n,t);this.fns.set(i,{id:a,moduleId:`pkg:${n}`,name:r,kind:o,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function es(e,n){let t="node_modules/",r=e.lastIndexOf(t);if(r===-1)return n;let i=e.slice(r+t.length).split("/");return i[0]?.startsWith("@")&&i.length>=2?`${i[0]}/${i[1]}`:i[0]??n}function Wi(e,n,t){let r=Pe.dirname(e),o=Pe.dirname(n),i=[];for(;;){let l=t.get(r);if(l!==void 0){for(let d of i)t.set(d,l);return l}i.push(r);let s=_e(Pe.join(r,"package.json"));if(s!==null)try{let d=JSON.parse(s),u={name:d.name??"app",version:d.version??"0.0.0",dir:r};for(let p of i)t.set(p,u);return u}catch{}if(r===o||r===Pe.dirname(r))break;r=Pe.dirname(r)}let a={name:"app",version:"0.0.0",dir:null};for(let l of i)t.set(l,a);return a}function Lr(e){return c.isParenthesizedExpression(e)?Lr(e.expression):c.isStringLiteralLike(e)?e.text:c.isTemplateExpression(e)?e.head.text:c.isBinaryExpression(e)&&e.operatorToken.kind===c.SyntaxKind.PlusToken?Lr(e.left):null}function gc(e){if(!c.isCallExpression(e))return!1;let n=e.expression,t=c.isPropertyAccessExpression(n)?n.name.text:c.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let r=e.arguments[0];return r!==void 0&&c.isIdentifier(r)&&(r.text==="__dirname"||r.text==="__filename")}function ns(e){let n=Lr(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":gc(e)?"relative-bounded":"unknown"}function yc(e){let n=[],t=r=>{if(c.isImportDeclaration(r)&&c.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isImportEqualsDeclaration(r)&&c.isExternalModuleReference(r.moduleReference)&&c.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&c.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isCallExpression(r)){let o=Jn(r);if(o!==null){let i=o.specifierArg,a=i!==void 0&&c.isStringLiteralLike(i);n.push({specifier:a?i.text:void 0,specifierIsLiteral:a,dynamic:!0,...i!==void 0&&!a?{computedArg:i,loadPos:r.getStart(e)}:{}})}}c.forEachChild(r,t)};return t(e),n}function xc(e,n,t){let r=new Map,o=Wi(Pe.join(e.appRoot,"package.json"),e.appRoot,r),i=[],a=[],l=[],s=new Map,d=new Set,u=[],p=new Set;for(let f of e.sourceFiles){let h=e.toRel(f.fileName);h!==null&&p.add(h)}for(let f of e.sourceFiles){let h=e.toRel(f.fileName);if(h===null)continue;let g=Wi(f.fileName,e.appRoot,r),k=es(h,o.name),S=h.includes("node_modules/");i.push({id:h,packageName:S&&g.name!==o.name?g.name:k,versionRange:g.version,path:h,moduleSystem:"cjs",isEntrypoint:n.has(h)}),g.dir===o.dir&&d.add(h);let w=0,v=null;for(let I of yc(f)){let C=`${h}#import${String(w)}`;w+=1;let E=null,m=[];if(I.specifier!==void 0)if(ge(I.specifier)==="package-root")E=t.moduleFor(je(I.specifier));else{let x=Ke(I.specifier,f.fileName,e.options,e.host),A=x!==null?e.toRel(x):null;if(A!==null)E=A;else if(I.specifier!==void 0){let[O,...j]=$n(I.specifier,f.fileName,e.options,e.host).map(T=>e.toRel(T)).filter(T=>T!==null&&p.has(T));O!==void 0&&j.length>=1&&(E=O,m=j.map(T=>T))}}a.push({id:C,moduleId:h,specifier:I.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:I.dynamic,specifierIsLiteral:I.specifierIsLiteral,...E!==null?{resolvedModuleId:E}:{}}),E!==null&&l.push({importId:C,resolvedModuleId:E});for(let x of m)l.push({importId:C,resolvedModuleId:x});if(I.computedArg!==void 0&&I.loadPos!==void 0&&u.push({importId:String(C),path:h,pos:I.loadPos,shape:ns(I.computedArg),text:I.computedArg.getText(f).slice(0,160)}),I.computedArg!==void 0&&I.loadPos!==void 0){v??=wn(f,f.fileName,e.resolveParamDirs);let x=[];for(let A of Et(I.computedArg,v,e.appRoot,e.options,e.host)){let O=e.toRel(A);if(O===null||!p.has(O))continue;let j=O,T=`${h}#import${String(w)}`;w+=1,a.push({id:T,moduleId:h,specifier:O,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:j}),l.push({importId:T,resolvedModuleId:j}),x.push(O)}if(x.length>0){let A=Hn(I.computedArg,v)!==null||kt(I.computedArg),O=s.get(h)??[];O.push({pos:I.loadPos,candidateRels:x,seedable:A}),s.set(h,O)}}}}return{modules:i,imports:a,importEdges:l,computedLoads:s,appOwnedPaths:d,loadSites:u}}function Sc(e){let n=_e(e);if(n===null)return null;let t=c.createSourceFile(e,n,c.ScriptTarget.Latest,!0),r=o=>t.statements.some(i=>c.isFunctionDeclaration(i)?i.name?.text===o:c.isVariableStatement(i)?i.declarationList.declarations.some(a=>c.isIdentifier(a.name)&&a.name.text===o&&a.initializer!==void 0&&(c.isFunctionExpression(a.initializer)||c.isArrowFunction(a.initializer))):!1);for(let o of t.statements){if(c.isFunctionDeclaration(o)&&o.name!==void 0&&o.modifiers?.some(a=>a.kind===c.SyntaxKind.DefaultKeyword)===!0)return o.name.text;if(!c.isExpressionStatement(o)||!c.isBinaryExpression(o.expression))continue;let i=o.expression;if(i.operatorToken.kind===c.SyntaxKind.EqualsToken&&bc(i.left)){if(c.isFunctionExpression(i.right)&&i.right.name!==void 0)return i.right.name.text;if(c.isIdentifier(i.right)&&r(i.right.text))return i.right.text}}return null}function bc(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function kc(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let r=d=>"surface"in d?n.moduleFor(d.surface):d.module,o=[],i=new Set;for(let d of e.modules)t.has(d)||i.has(d)||(i.add(d),o.push({id:d,packageName:e.entryRealNames[d]??es(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],s=0;for(let d of e.edges){let u=r(d.from),p=r(d.to),f=`${String(u)}#depreach${String(s)}`;s+=1,a.push({id:f,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),l.push({importId:f,resolvedModuleId:p})}return{modules:o,imports:a,importEdges:l}}function Gi(e,n,t){let r=e.expression;if(c.isIdentifier(r)&&!t.has(r.text)){let o=n.get(r.text);if(o?.kind==="package-export")return{kind:"package-instance",packageName:o.packageName,className:o.exportName};if(o?.kind==="app-class")return{kind:"app-instance",cls:o.cls}}else if(c.isPropertyAccessExpression(r)&&c.isIdentifier(r.expression)&&!t.has(r.expression.text)){let o=n.get(r.expression.text);if(o?.kind==="package-surface")return{kind:"package-instance",packageName:o.packageName,className:r.name.text}}return null}function In(e){return c.canHaveModifiers(e)&&(c.getModifiers(e)?.some(n=>n.kind===c.SyntaxKind.ExportKeyword)??!1)}function Ec(e){let n=new Set,t;for(let r of e.statements){if(c.isExpressionStatement(r)&&c.isBinaryExpression(r.expression)){let o=r.expression;if(o.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(o.left)&&c.isIdentifier(o.left.expression)&&o.left.expression.text==="module"&&o.left.name.text==="exports"){if(c.isIdentifier(o.right))n.add(o.right.text),t=o.right.text;else if(c.isObjectLiteralExpression(o.right))for(let i of o.right.properties)c.isShorthandPropertyAssignment(i)?n.add(i.name.text):c.isPropertyAssignment(i)&&c.isIdentifier(i.initializer)&&n.add(i.initializer.text)}continue}if(c.isFunctionDeclaration(r)&&r.name!==void 0&&In(r))n.add(r.name.text);else if(c.isVariableStatement(r)&&In(r))for(let o of r.declarationList.declarations)c.isIdentifier(o.name)&&n.add(o.name.text);else if(c.isExportDeclaration(r)&&r.exportClause&&c.isNamedExports(r.exportClause))for(let o of r.exportClause.elements)n.add((o.propertyName??o.name).text);else c.isExportAssignment(r)&&c.isIdentifier(r.expression)&&(n.add(r.expression.text),t=r.expression.text)}return{reachableLocals:n,defaultTarget:t}}function wc(e){for(let n of e.statements){if(c.isFunctionDeclaration(n)&&n.name!==void 0&&In(n)&&c.getModifiers(n)?.some(t=>t.kind===c.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(c.isExportAssignment(n)&&!n.isExportEquals&&c.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===c.SyntaxKind.EqualsToken&&Me(t.left)&&c.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function en(e){if(c.isCallExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&c.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function Me(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function qe(e){if(Me(e))return!0;if(!c.isPropertyAccessExpression(e)&&!c.isElementAccessExpression(e))return!1;let n=e.expression;return c.isIdentifier(n)&&n.text==="exports"?!0:Me(n)}function Tn(e){return c.isPropertyAccessExpression(e.expression)&&c.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ts(e){let n=!1,t=r=>{if(!n){if(c.isCallExpression(r)){let o=en(r);if(o!==void 0&&ge(o)!=="package-root"){n=!0;return}}c.forEachChild(r,t)}};return t(e),n}function rs(e){let n=new Set,t=o=>o!==void 0&&ts(o),r=o=>{c.isVariableDeclaration(o)&&t(o.initializer)&&Gn(o.name,n),c.isBinaryExpression(o)&&o.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(o.left)&&t(o.right)&&n.add(o.left.text),c.forEachChild(o,r)};return r(e),n}function os(e,n){for(let t of e.properties)c.isShorthandPropertyAssignment(t)?n.add(t.name.text):c.isPropertyAssignment(t)&&c.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function vc(e){let n=new Set;for(let l of e.statements)if(c.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isVariableStatement(l))for(let s of l.declarationList.declarations)c.isIdentifier(s.name)&&s.initializer!==void 0&&(c.isFunctionExpression(s.initializer)||c.isArrowFunction(s.initializer)||c.isObjectLiteralExpression(s.initializer))&&n.add(s.name.text);let t=l=>c.isFunctionExpression(l)||c.isArrowFunction(l)||c.isObjectLiteralExpression(l)||c.isIdentifier(l)&&n.has(l.text),r=new Set,o=l=>{c.isIdentifier(l)?r.add(l.text):c.isObjectLiteralExpression(l)&&os(l,r)},i=!1,a=l=>{if(!i){if(c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken)if(Me(l.left)){o(l.right);let s=l.right;(c.isObjectLiteralExpression(s)?s.properties.every(u=>c.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||c.isPropertyAssignment(u)&&t(u.initializer)):t(s))||(i=!0)}else qe(l.left)&&(t(l.right)||(i=!0));else(c.isCallExpression(l)&&Tn(l)&&l.arguments[0]!==void 0&&An(l.arguments[0])||c.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(i=!0);i||c.forEachChild(l,a)}};if(a(e),!i&&r.size>0){for(let l of ls(e))if(r.has(l)){i=!0;break}}return i}function An(e){return qe(e)||c.isIdentifier(e)&&e.text==="exports"}function is(e){if(!c.isPropertyAccessExpression(e.expression)||!c.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Kr(e){return is(e)&&e.arguments[0]!==void 0&&An(e.arguments[0])}function Ic(e){return is(e)&&e.arguments[0]!==void 0&&c.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Ac(e){for(let n of e.declarations??[])if(c.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(c.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function _c(e,n,t,r,o){let i=(e.declarations??[]).filter(l=>!c.isSourceFile(l)&&!c.isModuleDeclaration(l));for(let l of i){let s=l.getSourceFile(),d=n.toRel(s.fileName);if(d===null||o.has(d))continue;let u=t.get(`${d}::${String(l.getStart(s,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of i){let s=n.toRel(l.getSourceFile().fileName);if(s===null||o.has(s))continue;let d=r.get(`${s}::${a}`);if(d!==void 0)return d}}function $t(e){return c.isPropertyAccessExpression(e)?e.name.text:c.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Br=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function zr(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?$t(e):void 0;return n!==void 0&&n!=="__proto__"&&Br.test(n)?n:void 0}function Nc(e){return e!=="__proto__"&&Br.test(e)}function Hi(e){let n=Se(e);return c.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||Me(n)}function Rc(e){if(!c.isArrayLiteralExpression(e)&&!c.isObjectLiteralExpression(e))return!1;let n=!1,t=r=>{n||(qe(r)?n=!0:c.forEachChild(r,t))};return t(e),n}function Ur(e){let n=!1,t=new Map,r=o=>{if(!n){if(c.isBinaryExpression(o)&&o.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=c.SyntaxKind.LastAssignment){if(Me(o.left)||c.isIdentifier(o.left)&&o.left.text==="exports")n=!0;else if(o.operatorToken.kind===c.SyntaxKind.EqualsToken&&Hi(o.right))n=!0;else if(Rc(o.left))n=!0;else if(qe(o.left)){let i=zr(o.left);i===void 0?n=!0:t.set(i,(t.get(i)??0)+1)}}else(c.isCallExpression(o)&&Tn(o)&&o.arguments[0]!==void 0&&An(o.arguments[0])||c.isCallExpression(o)&&Kr(o)||c.isCallExpression(o)&&Ic(o)||c.isVariableDeclaration(o)&&o.initializer!==void 0&&Hi(o.initializer))&&(n=!0);n||c.forEachChild(o,r)}};return r(e),{surfaceEscapes:n,assignCount:t}}function Vr(e){let n=[];for(let t of e.statements){if(!c.isExpressionStatement(t)||!c.isBinaryExpression(t.expression))continue;let r=t.expression;r.operatorToken.kind===c.SyntaxKind.EqualsToken&&(!qe(r.left)||Me(r.left)||n.push({bin:r,name:zr(r.left)}))}return n}function Cc(e){let{surfaceEscapes:n,assignCount:t}=Ur(e);if(n)return[];let r=[];for(let{bin:o,name:i}of Vr(e))i===void 0||(t.get(i)??0)!==1||(c.isFunctionExpression(o.right)||c.isArrowFunction(o.right))&&r.push({name:i,value:o.right});return r}function Oc(e,n){let{surfaceEscapes:t,assignCount:r}=Ur(e);if(t)return[];let o=[];for(let{bin:i,name:a}of Vr(e))a===void 0||(r.get(a)??0)!==1||c.isIdentifier(i.right)&&!n.has(i.right.text)&&o.push(i.right.text);return o}function $c(e,n){let{surfaceEscapes:t,assignCount:r}=Ur(e);for(let{bin:o,name:i}of Vr(e)){let a=o.right;if(!(c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)))continue;let s=c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)&&!n.has(a.text);if(!(!t&&i!==void 0&&(r.get(i)??0)===1&&s))return!0}return!1}function Mc(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&c.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Xi(e){let n=e.parent;return n===void 0?!1:c.isPropertyAccessExpression(n)?n.name===e:c.isQualifiedName(n)?n.right===e:c.isBindingElement(n)||c.isImportSpecifier(n)?n.propertyName===e:c.isExportSpecifier(n)?!0:c.isPropertyAssignment(n)||c.isPropertyDeclaration(n)||c.isPropertySignature(n)||c.isMethodDeclaration(n)||c.isMethodSignature(n)||c.isGetAccessorDeclaration(n)||c.isSetAccessorDeclaration(n)||c.isEnumMember(n)?n.name===e:!1}function Yi(e){for(let n=e.parent;n!==void 0;n=n.parent){if(c.isSourceFile(n))return!0;if(!c.isArrowFunction(n)&&(c.isFunctionLike(n)||c.isClassLike(n)))return!1}return!0}function Dc(e,n){let t=r=>{c.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&n.add(r),c.forEachChild(r,t)};t(e)}function Tc(e){let n=[],t=new Set;for(let i of e.statements){if(c.isExportDeclaration(i)||c.isExportAssignment(i)||c.isImportDeclaration(i)||c.isImportEqualsDeclaration(i)||In(i))return null;if(!c.isExpressionStatement(i)||!c.isBinaryExpression(i.expression))continue;let a=i.expression;if(a.operatorToken.kind===c.SyntaxKind.EqualsToken){if(Me(a.left))n.push({kind:"whole",value:a.right});else if(qe(a.left)){let l=zr(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:Mc(a.left)})}else continue;Dc(a.left,t)}}let r=!1,o=i=>{if(!r){if(c.isIdentifier(i)&&(i.text==="exports"||i.text==="module")&&!t.has(i)&&!Xi(i)){r=!0;return}if(i.kind===c.SyntaxKind.ThisKeyword&&Yi(i)){r=!0;return}if(c.isIdentifier(i)&&i.text==="arguments"&&!Xi(i)&&Yi(i)){r=!0;return}c.forEachChild(i,o)}};return o(e),r?null:n}function Fr(e){return c.isIdentifier(e)||c.isStringLiteralLike(e)?e.text:void 0}function Ji(e,n,t){return c.isIdentifier(e)?n(e.text):t?.(e)}function Pc(e,n,t,r){let o=new Map,i=Tc(e);if(i===null||i.filter(h=>h.kind==="whole").length>1)return o;let a=i.findIndex(h=>h.kind==="whole"),l=(h,g)=>a>=0&&g>a&&h.kind==="member"&&h.root==="exports",s=i.some(l);if(s){let h=i[a];if(h===void 0||h.kind!=="whole"||!c.isObjectLiteralExpression(h.value))return o}let d=s?i.filter((h,g)=>!l(h,g)):i,u=new Map;for(let h of d)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let p=h=>n.has(h)?void 0:t(h),f=(h,g)=>{g===void 0?o.delete(h):o.set(h,g)};for(let h of d){if(h.kind==="member"){f(h.name,(u.get(h.name)??0)>1?void 0:Ji(h.value,p,r));continue}o.clear();let g=h.value;if(c.isObjectLiteralExpression(g))for(let k of g.properties){if(c.isSpreadAssignment(k))return new Map;if(c.isShorthandPropertyAssignment(k)){f(k.name.text,p(k.name.text));continue}let S=Fr(k.name);if(S===void 0)return new Map;f(S,c.isPropertyAssignment(k)?Ji(k.initializer,p,r):void 0)}}return o}function ss(e,n,t,r){let o=new Map,i=l=>l!==void 0&&ge(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(c.isVariableDeclaration(l)&&l.initializer!==void 0){let s=l.initializer;if(c.isIdentifier(l.name)&&!r.has(l.name.text)){let d=i(en(s));if(d!==void 0)o.set(l.name.text,{kind:"whole",target:d});else if((c.isPropertyAccessExpression(s)||c.isElementAccessExpression(s))&&c.isCallExpression(s.expression)){let u=i(en(s.expression)),p=$t(s);u!==void 0&&p!==void 0&&o.set(l.name.text,{kind:"member",target:u,member:p})}}else if(c.isObjectBindingPattern(l.name)){let d=i(en(s));if(d!==void 0){for(let u of l.name.elements)if(c.isIdentifier(u.name)&&!r.has(u.name.text)){let p=u.propertyName!==void 0&&c.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;o.set(u.name.text,{kind:"member",target:d,member:p})}}}}c.forEachChild(l,a)};return a(e),o}function Lc(e,n,t,r){let o=a=>a!==void 0&&ge(a)==="relative"?t.get(`${n}::${a}`):void 0,i=o(en(e));if(i!==void 0)return{kind:"whole",target:i};if(c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)){let a=$t(e);if(a===void 0)return;let l=o(en(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(c.isIdentifier(e.expression)){let s=r.get(e.expression.text);if(s?.kind==="whole")return{kind:"member",target:s.target,member:a}}return}if(c.isIdentifier(e))return r.get(e.text)}function as(e,n,t,r,o){let i=[],a=!1,l=p=>{if(ts(p))return!0;let f=!1,h=g=>{f||(c.isIdentifier(g)&&o.has(g.text)?f=!0:c.forEachChild(g,h))};return h(p),f},s=(p,f)=>{let h=Lc(p,n,t,r);h!==void 0?i.push({source:h,exportedName:f}):l(p)&&(a=!0)},d=p=>{if(c.isObjectLiteralExpression(p)){for(let f of p.properties)if(c.isSpreadAssignment(f))s(f.expression,"default");else if(c.isPropertyAssignment(f)){let h=c.isIdentifier(f.name)||c.isStringLiteralLike(f.name)?f.name.text:"default";s(f.initializer,h)}else if(c.isShorthandPropertyAssignment(f)){let h=r.get(f.name.text);h!==void 0&&i.push({source:h,exportedName:f.name.text})}return}s(p,"default")},u=p=>{if(c.isBinaryExpression(p)&&p.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=c.SyntaxKind.LastAssignment){if(Me(p.left)){d(p.right);return}if(qe(p.left)){let f=c.isPropertyAccessExpression(p.left)?p.left.name.text:c.isElementAccessExpression(p.left)&&c.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";s(p.right,f);return}}else if(c.isExportAssignment(p)&&p.isExportEquals){s(p.expression,"default");return}else if(c.isCallExpression(p)&&Tn(p)&&p.arguments[0]!==void 0&&An(p.arguments[0])){for(let f of p.arguments.slice(1))d(f);return}c.forEachChild(p,u)};return u(e),{sources:i,residual:a}}function ls(e){let n=new Set,t=o=>{let i=o;for(;c.isPropertyAccessExpression(i)||c.isElementAccessExpression(i);)i=i.expression;return c.isIdentifier(i)?i.text:void 0},r=o=>{let i=ds(o);if(i!==void 0){let a=t(i);a!==void 0&&n.add(a)}c.forEachChild(o,r)};return r(e),n}function ds(e){return c.isBinaryExpression(e)&&e.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=c.SyntaxKind.LastAssignment&&(c.isPropertyAccessExpression(e.left)||c.isElementAccessExpression(e.left))?e.left:void 0}function Ct(e){if(c.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)c.isBindingElement(t)&&n.push(...Ct(t.name));return n}function $e(e){if(c.isIdentifier(e))return[e.text];if(c.isParenthesizedExpression(e)||c.isAsExpression(e)||c.isNonNullExpression(e)||c.isSatisfiesExpression(e)||c.isTypeAssertionExpression(e)||c.isAwaitExpression(e))return $e(e.expression);if(c.isYieldExpression(e))return e.expression!==void 0?$e(e.expression):[];if(c.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===c.SyntaxKind.BarBarToken||n===c.SyntaxKind.AmpersandAmpersandToken||n===c.SyntaxKind.QuestionQuestionToken?[...$e(e.left),...$e(e.right)]:n===c.SyntaxKind.CommaToken?$e(e.right):[]}return c.isConditionalExpression(e)?[...$e(e.whenTrue),...$e(e.whenFalse)]:c.isArrayLiteralExpression(e)?e.elements.flatMap(n=>c.isSpreadElement(n)?$e(n.expression):c.isOmittedExpression(n)?[]:$e(n)):c.isObjectLiteralExpression(e)?e.properties.flatMap(n=>c.isShorthandPropertyAssignment(n)?[n.name.text]:c.isPropertyAssignment(n)?$e(n.initializer):c.isSpreadAssignment(n)?$e(n.expression):[]):[]}function cs(e,n){let t=[],r=(l,s)=>{for(let d of l)for(let u of s)d!==u&&t.push({a:d,b:u})},o=l=>c.isIdentifier(l)?[l.text]:c.isArrayLiteralExpression(l)?l.elements.flatMap(o):c.isObjectLiteralExpression(l)?l.properties.flatMap(s=>c.isShorthandPropertyAssignment(s)?[s.name.text]:c.isPropertyAssignment(s)?o(s.initializer):[]):[],i=l=>{c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken?r(o(l.left),$e(l.right)):c.isVariableDeclaration(l)&&l.initializer!==void 0?r(Ct(l.name),$e(l.initializer)):(c.isForOfStatement(l)||c.isForInStatement(l))&&c.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&r(Ct(l.initializer.declarations[0].name),$e(l.expression)),c.forEachChild(l,i)};i(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:s,b:d}of t)a.has(s)&&!a.has(d)&&(a.add(d),l=!0),a.has(d)&&!a.has(s)&&(a.add(s),l=!0)}return a}function us(e,n){let t=l=>{if(!c.isPropertyAccessExpression(l)&&!c.isElementAccessExpression(l))return;let s=l;for(;c.isPropertyAccessExpression(s)||c.isElementAccessExpression(s);)s=s.expression;return c.isIdentifier(s)?s.text:void 0},r=[],o=(l,s)=>{for(let u of $e(s))r.push({name:l,root:u});let d=t(s);d!==void 0&&r.push({name:l,root:d})},i=l=>{c.isVariableDeclaration(l)&&c.isIdentifier(l.name)&&l.initializer!==void 0?o(l.name.text,l.initializer):c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(l.left)&&o(l.left.text,l.right),c.forEachChild(l,i)};i(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:s,root:d}of r){let u=a.get(d);u!==void 0&&!a.has(s)&&(a.set(s,u),l=!0)}}return a}function fs(e){return cs(e,ls(e))}function Fc(e,n){let t=s=>s>=c.SyntaxKind.FirstAssignment&&s<=c.SyntaxKind.LastAssignment,r=s=>{let d=s.parent;if(d===void 0||!c.isObjectLiteralExpression(d))return!1;let u=d.parent;return u!==void 0&&c.isBinaryExpression(u)&&u.operatorToken.kind===c.SyntaxKind.EqualsToken&&u.right===d&&qe(u.left)?!0:u!==void 0&&c.isCallExpression(u)&&Tn(u)&&u.arguments[0]!==void 0&&An(u.arguments[0])&&u.arguments.indexOf(d)>0},o=(s,d)=>{if((c.isFunctionDeclaration(d)||c.isFunctionExpression(d))&&d.name===s||c.isVariableDeclaration(d)&&d.name===s||c.isParameter(d)&&d.name===s||c.isBindingElement(d)&&d.name===s||(c.isCallExpression(d)||c.isNewExpression(d))&&d.expression===s)return!0;if((c.isPropertyAccessExpression(d)||c.isElementAccessExpression(d))&&d.expression===s){let u=d;for(;u.parent!==void 0&&(c.isPropertyAccessExpression(u.parent)||c.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let p=u.parent;return!(p!==void 0&&c.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===u)}return c.isBinaryExpression(d)&&d.operatorToken.kind===c.SyntaxKind.EqualsToken&&d.right===s&&qe(d.left)?!0:c.isShorthandPropertyAssignment(d)&&d.name===s||c.isPropertyAssignment(d)&&d.initializer===s?r(d):!!(c.isExportAssignment(d)&&d.expression===s||c.isExportSpecifier(d))},i=(s,d)=>c.isPropertyAccessExpression(d)&&d.name===s||c.isPropertyAssignment(d)&&d.name===s||(c.isMethodDeclaration(d)||c.isGetAccessorDeclaration(d)||c.isSetAccessorDeclaration(d))&&d.name===s,a=!1,l=(s,d)=>{if(!a){if(c.isIdentifier(s)&&d!==void 0&&n.has(s.text)&&!i(s,d)&&!o(s,d)){a=!0;return}c.forEachChild(s,u=>l(u,s))}};return l(e,void 0),a}function jc(e){let n=new Set;for(let s of e.statements)if(c.isFunctionDeclaration(s)&&s.name!==void 0)n.add(s.name.text);else if(c.isVariableStatement(s))for(let d of s.declarationList.declarations)c.isIdentifier(d.name)&&d.initializer!==void 0&&(c.isFunctionExpression(d.initializer)||c.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,r=s=>{c.isBinaryExpression(s)&&s.operatorToken.kind===c.SyntaxKind.EqualsToken?(Me(s.left)&&(c.isIdentifier(s.right)?t.add(s.right.text):c.isObjectLiteralExpression(s.right)&&os(s.right,t)),Me(s.right)&&c.isIdentifier(s.left)&&t.add(s.left.text)):c.isVariableDeclaration(s)&&c.isIdentifier(s.name)&&s.initializer!==void 0&&Me(s.initializer)&&t.add(s.name.text),c.forEachChild(s,r)};if(r(e),t.size>0){if(Fc(e,t))return!0;let s=us(e,new Map([...t].map(u=>[u,u]))),d=fs(e);for(let u of s.keys())if(d.has(u))return!0}let o=s=>c.isIdentifier(s)&&n.has(s.text),i=s=>s.properties.every(d=>c.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||c.isPropertyAssignment(d)&&o(d.initializer)),a=!1,l=s=>{if(!a){if(c.isBinaryExpression(s)){let d=s.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=c.SyntaxKind.LastAssignment;d&&Me(s.left)?s.operatorToken.kind===c.SyntaxKind.EqualsToken&&(o(s.right)||c.isObjectLiteralExpression(s.right)&&i(s.right))||(a=!0):d&&qe(s.left)&&(a=!0)}else c.isCallExpression(s)?(Tn(s)&&s.arguments[0]!==void 0&&An(s.arguments[0])||Kr(s))&&(a=!0):(c.isExportAssignment(s)&&s.isExportEquals&&!c.isIdentifier(s.expression)||c.isExportDeclaration(s)&&s.moduleSpecifier!==void 0)&&(a=!0);a||c.forEachChild(s,l)}};return l(e),a}var Kc=8;function Zi(e,n,t){let r=new Set,o=ss(e,n,t,Mn(e)),i=as(e,n,t,o,rs(e));for(let{source:a}of i.sources)r.add(a.target);for(let a of e.statements)if(c.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&c.isStringLiteralLike(a.moduleSpecifier)&&ge(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&r.add(l)}return r}function Bc(e,n,t,r=new Map){let o=new Set(n.modules.filter(E=>E.isEntrypoint).map(E=>String(E.id)));if(o.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let i=new Set(n.modules.filter(E=>E.externalSurface===!0).map(E=>String(E.id))),a=new Map,l=new Map,s=new Map,d=new Map;for(let E of t){if(E.name==="<toplevel>"){d.set(String(E.moduleId),E);continue}if(a.set(`${String(E.moduleId)}::${String(E.declRange.start)}`,E),E.name!==void 0&&l.set(`${String(E.moduleId)}::${E.name}`,E),E.isExported&&E.name!==void 0){let m=s.get(String(E.moduleId))??[];m.push(E),s.set(String(E.moduleId),m)}}if(r.size>0){let E=new Map(t.map(m=>[String(m.id),m]));for(let[m,x]of r){let A=E.get(String(x));A!==void 0&&!a.has(m)&&a.set(m,A)}}let u=new Map;for(let E of n.imports)E.resolvedModuleId!==void 0&&u.set(`${E.moduleId}::${E.specifier}`,String(E.resolvedModuleId));let p=new Map;for(let E of e.sourceFiles){let m=e.toRel(E.fileName);m!==null&&p.set(m,E)}let f=new Map,h=E=>{let m=f.get(E);if(m!==void 0)return m;let x=p.get(E),A=x===void 0?!0:jc(x);return f.set(E,A),A},g=new Set,k=(E,m)=>m!==void 0&&ge(m)==="relative"?u.get(`${E}::${m}`):void 0,S=E=>{if(c.isIdentifier(E))return E.text;if(c.isPropertyAccessExpression(E)){let m=S(E.expression);return m===void 0?void 0:`${m}.${E.name.text}`}if(c.isElementAccessExpression(E)&&c.isStringLiteralLike(E.argumentExpression)){let m=S(E.expression);return m===void 0?void 0:`${m}.${E.argumentExpression.text}`}},w=E=>{let m=E;for(;c.isPropertyAccessExpression(m)||c.isElementAccessExpression(m);)m=m.expression;return en(m)};for(let E of e.sourceFiles){let m=e.toRel(E.fileName);if(m===null)continue;let x=new Map,A=new Map,O=(N,L)=>{let R=k(m,en(L));if(R!==void 0){if(c.isIdentifier(N))A.set(N.text,R),x.set(N.text,R);else if(c.isObjectBindingPattern(N)||c.isArrayBindingPattern(N))for(let P of Ct(N))A.set(P,R);else if(c.isPropertyAccessExpression(N)||c.isElementAccessExpression(N)){let P=S(N);P!==void 0&&x.set(P,R)}}},j=N=>{c.isVariableDeclaration(N)&&N.initializer!==void 0?O(N.name,N.initializer):c.isBinaryExpression(N)&&N.operatorToken.kind===c.SyntaxKind.EqualsToken&&O(N.left,N.right),c.forEachChild(N,j)};j(E);let T=N=>{let L=ds(N);if(L!==void 0){let R=L.expression,P=k(m,w(R));P!==void 0&&g.add(P);let K=S(R),H=K!==void 0?x.get(K):void 0;H!==void 0&&g.add(H)}c.forEachChild(N,T)};if(T(E),A.size>0){let N=us(E,A),L=fs(E);for(let[R,P]of N)L.has(R)&&g.add(P)}}let v=[],I=[],C=[];for(let E of e.sourceFiles){let m=e.toRel(E.fileName);if(m===null||!o.has(m))continue;let x=e.checker.getSymbolAtLocation(E),A=new Set,O=new Set,j=0,T=($,W)=>{if(i.has(String($.moduleId))||A.has(String($.id)))return;A.add(String($.id));let X=`${m}#reexport:${String(j)}:${W}`;j+=1,v.push({id:X,moduleId:m,exportedName:W,kind:"value",reexportOf:{moduleId:String($.moduleId),name:$.name??W}}),I.push({exportId:X,target:{kind:"function",functionId:$.id}})},N=$=>{if(Ac($))return;let W=$;if(($.flags&c.SymbolFlags.Alias)!==0)try{W=e.checker.getAliasedSymbol($)}catch{return}let X=_c(W,e,a,l,i);if(X!==void 0){T(X,$.getName());return}if((W.flags&c.SymbolFlags.Module)!==0&&!O.has(W)){O.add(W);try{for(let Ae of e.checker.getExportsOfModule(W))N(Ae)}catch{}}};if(x!==void 0)for(let $ of e.checker.getExportsOfModule(x))N($);let L=ss(E,m,u,Mn(E)),R=as(E,m,u,L,rs(E)),P=new Set,K=R.residual,H=$=>{let W=p.get($);$.includes("node_modules/")||W===void 0||vc(W)?K=!0:P.add($)};for(let{source:$,exportedName:W}of R.sources){let X=s.get($.target)??[],Ae=g.has($.target);if($.kind==="whole"){for(let me of X)T(me,me.name??W);Ae?K=!0:(X.length===0||h($.target))&&H($.target)}else{let me=X.filter(Ee=>Ee.name===$.member);for(let Ee of me)T(Ee,W);Ae?K=!0:(me.length===0||h($.target))&&H($.target)}}let z=new Set,q=[];for(let $ of Zi(E,m,u))q.push({target:$,depth:1});for(;q.length>0;){let $=q.shift();if($===void 0)break;let{target:W,depth:X}=$;if(z.has(W)||X>Kc||(z.add(W),W.split("/").includes("node_modules")))continue;let Ae=p.get(W);if(Ae===void 0)continue;let me=d.get(W);me!==void 0&&!h(W)&&T(me,"<load>");for(let Ee of Zi(Ae,W,u))z.has(Ee)||q.push({target:Ee,depth:X+1})}$c(E,Mn(E))&&(K=!0);for(let $ of P)C.push({code:"unresolved-reexport",path:m,detail:`entrypoint whole/member re-exports app-owned relative module ${$} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:$});K&&C.push({code:"unresolved-reexport",path:m,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:v,exportBindings:I,diagnostics:C}}var Dn=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),zc=new Set(["defineProperty","defineProperties","create"]);function Uc(e){let n=!0,t=o=>c.isIdentifier(o)||c.isStringLiteral(o)||c.isNumericLiteral(o)?Dn.has(o.text):c.isComputedPropertyName(o)&&c.isStringLiteralLike(o.expression)?Dn.has(o.expression.text):!1,r=o=>{if(n){if(c.isNewExpression(o)||c.isForOfStatement(o)||c.isSpreadElement(o)||c.isSpreadAssignment(o)||c.isArrayBindingPattern(o)||c.isGetAccessorDeclaration(o)||c.isSetAccessorDeclaration(o)||c.isYieldExpression(o)&&o.asteriskToken!==void 0||c.canHaveDecorators(o)&&(c.getDecorators(o)?.length??0)>0){n=!1;return}if((c.isPropertyAccessExpression(o)||c.isMethodDeclaration(o)||c.isPropertyAssignment(o))&&t(o.name)||c.isPropertyDeclaration(o)&&t(o.name)||c.isShorthandPropertyAssignment(o)&&t(o.name)||c.isBindingElement(o)&&t(o.propertyName??o.name)||c.isElementAccessExpression(o)&&c.isStringLiteralLike(o.argumentExpression)&&Dn.has(o.argumentExpression.text)){n=!1;return}if(c.isCallExpression(o)&&c.isPropertyAccessExpression(o.expression)&&c.isIdentifier(o.expression.expression)&&o.expression.expression.text==="Object"&&zc.has(o.expression.name.text)){n=!1;return}c.forEachChild(o,r)}};return r(e),n}function Mt(e){if(c.isIdentifier(e)||c.isStringLiteral(e)||c.isNumericLiteral(e))return e.text}function ps(e){let n=t=>c.canHaveDecorators(t)&&(c.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Vc(e){let n=!1,t=new Set,r=[],o=new Map,i=(f,h)=>{let g=o.get(f);g===void 0?o.set(f,[h]):g.push(h)},a=f=>{c.isIdentifier(f)?t.add(f.text):r.push(f)},l=f=>{for(let h of f.properties)c.isShorthandPropertyAssignment(h)?t.add(h.name.text):c.isPropertyAssignment(h)?r.push(h.initializer):n=!0},s=f=>{if(c.isBinaryExpression(f)&&f.operatorToken.kind===c.SyntaxKind.EqualsToken){let h=f.left,g=f.right;Me(h)?c.isObjectLiteralExpression(g)?l(g):c.isIdentifier(g)||c.isFunctionExpression(g)||c.isArrowFunction(g)||c.isClassExpression(g)?a(g):n=!0:qe(h)?(c.isElementAccessExpression(h)&&!c.isStringLiteralLike(h.argumentExpression)&&(n=!0),a(g)):c.isIdentifier(h)?i(h.text,g):(c.isPropertyAccessExpression(h)||c.isElementAccessExpression(h))&&c.isIdentifier(h.expression)&&i(h.expression.text,g)}else if(c.isCallExpression(f))(Tn(f)&&f.arguments[0]!==void 0&&An(f.arguments[0])||Kr(f))&&(n=!0);else if(c.isVariableDeclaration(f)&&c.isIdentifier(f.name)&&f.initializer!==void 0)i(f.name.text,f.initializer);else if((c.isFunctionDeclaration(f)||c.isClassDeclaration(f))&&f.name!==void 0)i(f.name.text,f),In(f)&&t.add(f.name.text);else if(c.isExportDeclaration(f)){if(f.exportClause===void 0)n=!0;else if(f.moduleSpecifier===void 0&&c.isNamedExports(f.exportClause))for(let h of f.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(c.isExportAssignment(f))f.isExportEquals&&!c.isIdentifier(f.expression)?n=!0:a(f.expression);else if(c.isVariableStatement(f)&&In(f))for(let h of f.declarationList.declarations)c.isIdentifier(h.name)&&t.add(h.name.text);c.forEachChild(f,s)};s(e);let d=new Set,u=[...t],p=f=>{let h=g=>{c.isIdentifier(g)&&u.push(g.text),c.forEachChild(g,h)};h(f)};for(let f of r)p(f);for(;u.length>0;){let f=u.pop();if(!(f===void 0||d.has(f))){d.add(f);for(let h of o.get(f)??[])p(h)}}return{names:d,opaque:n}}var qc=512,Wc=new Set(["get","post","put","patch","delete","options","head"]);function Gc(e){for(let n of e.statements){if(c.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(n.expression.left)&&c.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,r=n.expression.left.name.text;if(t==="module"&&r==="exports"||t==="exports"&&r==="default")return n.expression.right}}return null}function Hc(e){let n=new Map,t=Gc(e);if(t===null)return n;let r=i=>{for(let a of i.properties)if(c.isPropertyAssignment(a)&&c.isObjectLiteralExpression(a.initializer)){let l=Mt(a.name);l!==void 0&&n.set(l,a.initializer)}};if(c.isObjectLiteralExpression(t))return r(t),n;if(!c.isIdentifier(t))return n;let o=t.text;for(let i of e.statements)if(c.isVariableStatement(i))for(let a of i.declarationList.declarations)c.isIdentifier(a.name)&&a.name.text===o&&a.initializer!==void 0&&c.isObjectLiteralExpression(a.initializer)&&r(a.initializer);else if(c.isExpressionStatement(i)&&c.isBinaryExpression(i.expression)&&i.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(i.expression.left)&&c.isIdentifier(i.expression.left.expression)&&i.expression.left.expression.text===o&&c.isObjectLiteralExpression(i.expression.right)){let a=i.expression.left.name.text;n.set(a,i.expression.right)}return n}function Xc(e){for(let n of e.properties){if(c.isMethodDeclaration(n)&&c.isIdentifier(n.name)&&n.name.text==="handler")return n;if(c.isPropertyAssignment(n)&&c.isIdentifier(n.name)&&n.name.text==="handler"&&(c.isArrowFunction(n.initializer)||c.isFunctionExpression(n.initializer)))return n.initializer}return null}function Yc(e,n){for(let r of e.properties){let o;if(c.isPropertyAssignment(r)||c.isMethodDeclaration(r)?o=Mt(r.name):c.isShorthandPropertyAssignment(r)&&(o=r.name.text),o==="method"||o==="url"||o==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Jc(e,n){let t=[],r=new Set,o=(l,s,d)=>{if(t.length>=qc||l==="__proto__"||!Br.test(l))return;let u=`${e}#handler:${l}`;r.has(u)||(r.add(u),t.push({id:u,node:s,memberPath:l,idiom:d}))};for(let[l,s]of Hc(n)){let d=Xc(s);d!==null&&Yc(s,d)&&o(l,d,"descriptor-object")}let i=0,a=l=>{if(c.isCallExpression(l)&&c.isPropertyAccessExpression(l.expression)&&c.isIdentifier(l.expression.expression)&&Wc.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&c.isStringLiteralLike(l.arguments[0])){let s=l.expression.name.text;for(let d=1;d<l.arguments.length;d+=1){let u=l.arguments[d];u!==void 0&&(c.isArrowFunction(u)||c.isFunctionExpression(u))&&o(`${s}_${String(i)}_${String(d)}`,u,"router-verb")}i+=1}c.forEachChild(l,a)};return a(n),t}function Zc(e,n,t,r,o,i){let a=`${e}#class:${t}`,l=[],s=new Set;for(let d of r.members){let u,p,f;if(c.isConstructorDeclaration(d))u="constructor",p="ctor",f=!1;else if(c.isMethodDeclaration(d))u=Mt(d.name),p="method",f=u!==void 0&&!Dn.has(u);else continue;if(u===void 0||s.has(u))continue;s.add(u);let h=`${e}#${t}.${u}`;o.push({id:h,moduleId:e,name:u,kind:p,enclosingClassId:a,declRange:mn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),l.push(h),f&&i.push({start:d.getStart(n,!1),end:d.getEnd(),id:h})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function Qc(e,n,t=[],r=!1,o){let i=[],a=new Map,l=[],{reachableLocals:s,defaultTarget:d}=Ec(n),u=Mn(n),p=`${e}#<toplevel>`;i.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let f=(m,x)=>{let A=`${e}#${m}`;return i.push({id:A,moduleId:e,name:m,kind:"function",declRange:mn(e,x,n),isExported:s.has(m),publicSurfaceReachable:s.has(m)}),a.set(m,{kind:"function",functionId:A}),l.push({start:x.getStart(n,!1),end:x.getEnd(),id:A}),A},h=[],g=!e.split("/").includes("node_modules");if(g)for(let m of Oc(n,u))s.add(m);let k=g?Vc(n):void 0,S=(m,x,A)=>{k===void 0||k.opaque||k.names.has(m)||In(A)||ps(x)||h.push(Zc(e,n,m,x,i,l))};for(let m of n.statements)if(c.isFunctionDeclaration(m)&&m.name!==void 0)f(m.name.text,m);else if(c.isClassDeclaration(m)&&m.name!==void 0)S(m.name.text,m,m);else if(c.isVariableStatement(m))for(let x of m.declarationList.declarations){if(c.isObjectBindingPattern(x.name)&&x.initializer!==void 0&&c.isCallExpression(x.initializer)&&c.isIdentifier(x.initializer.expression)&&x.initializer.expression.text==="require"&&x.initializer.arguments.length===1&&x.initializer.arguments[0]!==void 0&&c.isStringLiteralLike(x.initializer.arguments[0])){let O=x.initializer.arguments[0].text;for(let j of x.name.elements){if(j.dotDotDotToken!==void 0||j.initializer!==void 0||!c.isIdentifier(j.name))continue;let T=j.propertyName??j.name;!c.isIdentifier(T)&&!c.isStringLiteralLike(T)||a.set(j.name.text,{kind:"import",specifier:O,form:{named:T.text}})}continue}if(!c.isIdentifier(x.name)||x.initializer===void 0)continue;let A=x.initializer;if(c.isFunctionExpression(A)||c.isArrowFunction(A))f(x.name.text,x);else if(c.isClassExpression(A))S(x.name.text,A,m);else if(c.isCallExpression(A)&&c.isIdentifier(A.expression)&&A.expression.text==="require"&&A.arguments.length===1&&A.arguments[0]!==void 0&&c.isStringLiteralLike(A.arguments[0]))a.set(x.name.text,{kind:"import",specifier:A.arguments[0].text,form:"whole"});else if((c.isPropertyAccessExpression(A)||c.isElementAccessExpression(A))&&$t(A)==="default"&&c.isCallExpression(A.expression)){let O=en(A.expression);O!==void 0&&a.set(x.name.text,{kind:"import",specifier:O,form:"require-default"})}}else if(c.isImportDeclaration(m)&&c.isStringLiteralLike(m.moduleSpecifier)){let x=m.moduleSpecifier.text,A=m.importClause;if(A!==void 0){A.name!==void 0&&a.set(A.name.text,{kind:"import",specifier:x,form:"default"});let O=A.namedBindings;if(O!==void 0&&c.isNamespaceImport(O))a.set(O.name.text,{kind:"import",specifier:x,form:"namespace"});else if(O!==void 0&&c.isNamedImports(O))for(let j of O.elements){let T=(j.propertyName??j.name).text;a.set(j.name.text,{kind:"import",specifier:x,form:{named:T}})}}}else c.isImportEqualsDeclaration(m)&&c.isExternalModuleReference(m.moduleReference)&&c.isStringLiteralLike(m.moduleReference.expression)&&a.set(m.name.text,{kind:"import",specifier:m.moduleReference.expression.text,form:"whole"});let w=new Map,v,I=new Map,C=new Map;if(g)for(let{name:m,value:x}of Cc(n)){let A=`${e}#member-export:${m}`;i.push({id:A,moduleId:e,name:m,kind:c.isArrowFunction(x)?"arrow":"function",declRange:mn(e,x,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:x.getStart(n,!1),end:x.getEnd(),id:A}),w.set(x.getStart(n,!1),A)}if(r&&g){let m=T=>{let N=Te(T);return c.isFunctionExpression(N)||c.isArrowFunction(N)?N:void 0},x=(T,N)=>{let L=T;return i.push({id:L,moduleId:e,kind:c.isArrowFunction(N)?"arrow":"function",declRange:mn(e,N,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:N.getStart(n,!1),end:N.getEnd(),id:L}),w.set(N.getStart(n,!1),L),L},A=[],O=[],j=[];for(let T of n.statements)c.isExportAssignment(T)&&!T.isExportEquals?A.push(T):c.isFunctionDeclaration(T)&&c.getModifiers(T)?.some(N=>N.kind===c.SyntaxKind.DefaultKeyword)===!0?O.push(T):c.isExpressionStatement(T)&&c.isBinaryExpression(T.expression)&&T.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&Me(T.expression.left)&&j.push(T.expression);if(A.length+O.length+j.length===1){let T=A[0],N=O[0],L=j[0];if(T!==void 0){let R=m(T.expression);if(R!==void 0){let P=x(`${e}#<default>`,R);v={id:P,esm:!0},C.set(T.getStart(n,!1),P),ae(o,"2a-default",null)}}else if(N!==void 0&&N.name===void 0&&N.body!==void 0){let R=x(`${e}#<default>`,N);v={id:R,esm:!0},C.set(N.getStart(n,!1),R),ae(o,"2a-default",null)}else if(L!==void 0){let R=m(L.right);if(R!==void 0){let P=x(`${e}#<default>`,R);v={id:P,esm:!1},C.set(L.getStart(n,!1),P),ae(o,"2a-default",null)}else if(c.isObjectLiteralExpression(L.right)){let P=L.right,K=[],H=!0;for(let z of P.properties){if(c.isSpreadAssignment(z)){H=!1;break}let q=z.name,$=q===void 0?void 0:Fr(q);if($===void 0){H=!1;break}K.push($)}if(H){let z=new Map;for(let q of K)z.set(q,(z.get(q)??0)+1);for(let q of P.properties){if(!c.isPropertyAssignment(q))continue;let $=Fr(q.name),W=m(q.initializer);if($!==void 0){if(!Nc($)){W!==void 0&&ae(o,"2a-member","charset-refused");continue}if((z.get($)??0)!==1){W!==void 0&&ae(o,"2a-member","duplicate-key");continue}if(W!==void 0){let X=x(`${e}#<cjs>.${$}`,W);I.set($,X),C.set(q.getStart(n,!1),X),ae(o,"2a-member",null)}}}}else for(let z of P.properties)c.isPropertyAssignment(z)&&m(z.initializer)!==void 0&&ae(o,"2a-member","spread-or-computed-literal")}}}else{for(let T of A)m(T.expression)!==void 0&&ae(o,"2a-default","duplicate-default-sources");for(let T of O)T.name===void 0&&ae(o,"2a-default","duplicate-default-sources");for(let T of j)if(m(T.right)!==void 0)ae(o,"2a-default","duplicate-default-sources");else if(c.isObjectLiteralExpression(T.right))for(let N of T.right.properties)c.isPropertyAssignment(N)&&m(N.initializer)!==void 0&&ae(o,"2a-member","duplicate-default-sources")}}for(let m of t)i.push({id:m.id,moduleId:e,name:`handler:${m.memberPath}`,kind:c.isArrowFunction(m.node)?"arrow":"function",declRange:mn(e,m.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:m.node.getStart(n,!1),end:m.node.getEnd(),id:m.id});l.sort((m,x)=>m.end-m.start-(x.end-x.start));let E=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:i,bindings:a,exportedFunctionId:E,exportedNames:s,tainted:u,fnRanges:l,toplevelId:p,classes:h,mintedByPos:w,mintedDefault:v,mintedMembers:I,mintSeedAliases:C}}function eu(e){return c.isIdentifier(e)?"identifier":c.isPropertyAccessExpression(e)?"member":c.isElementAccessExpression(e)?"computed-member":e.kind===c.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function Qi(e,n){let t=r=>{if(c.isBinaryExpression(r)&&r.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=c.SyntaxKind.LastAssignment){let o=r.left;c.isPropertyAccessExpression(o)&&c.isIdentifier(o.expression)?n(o.expression.text,o.name.text):c.isElementAccessExpression(o)&&c.isIdentifier(o.expression)&&n(o.expression.text,c.isStringLiteralLike(o.argumentExpression)?o.argumentExpression.text:null)}else if(c.isCallExpression(r)&&c.isPropertyAccessExpression(r.expression)){let o=r.expression,i=r.arguments[0];c.isIdentifier(o.expression)&&i!==void 0&&c.isIdentifier(i)&&(o.expression.text==="Object"&&(o.name.text==="assign"||o.name.text==="defineProperty"||o.name.text==="defineProperties")||o.expression.text==="Reflect"&&o.name.text==="defineProperty")&&n(i.text,null)}c.forEachChild(r,t)};t(e)}function nu(e){let n=!1,t=r=>{if(!n){if(c.isVariableDeclaration(r)||c.isParameter(r)){let o=new Set;if(Gn(r.name,o),o.has("require")){n=!0;return}}else if((c.isFunctionDeclaration(r)||c.isClassDeclaration(r))&&r.name!==void 0&&r.name.text==="require"){n=!0;return}c.forEachChild(r,t)}};return t(e),n}function tu(e,n,t,r=new Map,o={}){let i=o.additiveForms===!0,a=o.namelessExports===!0,l=i||a?{}:void 0,s=new Map,d=new Map;for(let m of n.imports)m.resolvedModuleId!==void 0&&d.set(`${m.moduleId}::${m.specifier}`,m.resolvedModuleId);for(let m of e.sourceFiles){let x=e.toRel(m.fileName);x!==null&&s.set(x,Qc(x,m,r.get(x)??[],a,l))}let u=new Map;if(i)for(let m of s.values()){let x=new Map;for(let[A,O]of m.bindings)if(O.kind==="import"&&O.form==="whole"&&ge(O.specifier)!=="package-root"){let j=d.get(`${m.rel}::${O.specifier}`);j!==void 0&&x.set(A,String(j))}x.size!==0&&Qi(m.sf,(A,O)=>{let j=x.get(A);if(j===void 0)return;let T=u.get(j);if(T!=="*"){if(O===null){u.set(j,"*");return}T===void 0?u.set(j,new Set([O])):T.add(O)}})}let p=new Map;for(let m of s.values())m.exportedFunctionId!==void 0&&p.set(m.rel,m.exportedFunctionId);let f=new Map;for(let m of s.values()){if(m.rel.split("/").includes("node_modules"))continue;let x=wc(m.sf);if(x===void 0){a&&m.mintedDefault!==void 0&&f.set(m.rel,m.mintedDefault);continue}let A=m.bindings.get(x.name);A?.kind==="function"&&f.set(m.rel,{id:A.functionId,esm:x.esm})}let h=new Map;for(let m of s.values()){let x;for(let A of m.exportedNames){let O=m.bindings.get(A);O?.kind==="function"&&(x??=new Map,x.set(A,O.functionId))}x!==void 0&&h.set(m.rel,x)}let g=new Map;for(let m of s.values()){if(m.rel.split("/").includes("node_modules"))continue;let x=Pc(m.sf,m.tainted,A=>{let O=m.bindings.get(A);return O?.kind==="function"?O.functionId:void 0},a?A=>{let O=Te(A);return c.isFunctionExpression(O)||c.isArrowFunction(O)?m.mintedByPos.get(O.getStart(m.sf,!1)):void 0}:void 0);x.size>0&&g.set(m.rel,x)}let k=[],S=[],w=[],v=[],I=[],C=[];for(let m of s.values()){k.push(...m.functions),C.push(...m.classes);for(let y of m.exportedNames){let _=m.bindings.get(y);if(_?.kind==="function"){let D=`${m.rel}#export:${y}`;v.push({id:D,moduleId:m.rel,exportedName:y,kind:"value"}),I.push({exportId:D,target:{kind:"function",functionId:_.functionId}})}}if(a){if(m.mintedDefault!==void 0){let y=`${m.rel}#export:<default>`;v.push({id:y,moduleId:m.rel,exportedName:"default",kind:"value"}),I.push({exportId:y,target:{kind:"function",functionId:m.mintedDefault.id}})}for(let[y,_]of m.mintedMembers){let D=`${m.rel}#export:<cjs>.${y}`;v.push({id:D,moduleId:m.rel,exportedName:y,kind:"value"}),I.push({exportId:D,target:{kind:"function",functionId:_}})}}let x=new Map;for(let[y,_]of m.bindings){if(_.kind==="function"){x.set(y,_);continue}if(ge(_.specifier)==="package-root"){let F=je(_.specifier);typeof _.form=="object"?x.set(y,{kind:"package-export",packageName:F,exportName:_.form.named}):_.form==="require-default"?x.set(y,{kind:"package-default",packageName:F}):x.set(y,{kind:"package-surface",packageName:F})}else{let F=d.get(`${m.rel}::${_.specifier}`);if(F!==void 0&&typeof _.form=="object"){let Y=h.get(String(F))?.get(_.form.named);Y!==void 0&&x.set(y,{kind:"app-named-fn",functionId:Y})}else if(F!==void 0&&_.form==="require-default"){let Y=f.get(String(F));Y!==void 0&&Y.esm&&x.set(y,{kind:"app-default-fn",functionId:Y.id})}else F!==void 0&&typeof _.form!="object"&&_.form!=="require-default"&&x.set(y,{kind:"module",resolvedModuleId:F})}}let A=new Map;for(let y of m.functions){if(y.enclosingClassId===void 0||y.name===void 0)continue;let _=A.get(y.enclosingClassId);_===void 0&&(_=new Map,A.set(y.enclosingClassId,_)),_.set(y.name,y.id)}for(let y of m.classes)y.name===void 0||m.tainted.has(y.name)||x.has(y.name)||x.set(y.name,{kind:"app-class",cls:{classId:y.id,className:y.name,memberIds:A.get(y.id)??new Map}});let O=y=>{if(c.isVariableDeclaration(y)&&c.isIdentifier(y.name)&&y.initializer!==void 0&&c.isNewExpression(y.initializer)&&!m.tainted.has(y.name.text)&&!x.has(y.name.text)){let _=Gi(y.initializer,x,m.tainted);_!==null&&x.set(y.name.text,_)}c.forEachChild(y,O)};O(m.sf);let j=y=>{for(let _ of m.fnRanges)if(y>=_.start&&y<_.end)return _.id;return m.toplevelId},T=new Map,N=new Map,L=new Map,R=(y,_,D)=>{if(D===null){y.set(_,"*");return}let F=y.get(_);F!=="*"&&(F===void 0?y.set(_,new Set([D])):F.add(D))},P=(y,_)=>{R(T,y,_);let D=x.get(y);D?.kind==="package-surface"?R(N,D.packageName,_):D?.kind==="module"&&R(L,String(D.resolvedModuleId),_)};Qi(m.sf,P);let K=new Map,H=256,z=y=>{let _=K.get(y);return _===void 0&&(_=K.size>=H?new Set([y]):cs(m.sf,new Set([y])),K.set(y,_)),_},q=(y,_)=>y==="*"||y!==void 0&&y.has(_),$=(y,_)=>{let D=x.get(y);if(D?.kind==="package-surface"&&q(N.get(D.packageName),_)||D?.kind==="module"&&q(L.get(String(D.resolvedModuleId)),_))return!0;for(let F of z(y))if(q(T.get(F),_))return!0;return!1},W=y=>{if(c.isIdentifier(y)){let _=m.tainted.has(y.text)?void 0:x.get(y.text);return _?.kind==="function"?_.functionId:_?.kind==="module"?p.get(String(_.resolvedModuleId))??null:_?.kind==="package-export"?t.exportFor(_.packageName,_.exportName):null}if(c.isPropertyAccessExpression(y)&&c.isIdentifier(y.expression)){let _=y.expression.text;if($(_,y.name.text))return null;let D=m.tainted.has(_)?void 0:x.get(_);return D?.kind==="package-surface"?t.exportFor(D.packageName,y.name.text):D?.kind==="package-export"?t.methodFor(D.packageName,D.exportName,y.name.text,"method"):D?.kind==="package-instance"?t.methodFor(D.packageName,D.className,y.name.text,"method"):null}return null},X=y=>{for(let _=y.parent;_!==void 0;_=_.parent)if(!c.isArrowFunction(_)){if(c.isFunctionExpression(_)||c.isFunctionDeclaration(_))return null;if(c.isMethodDeclaration(_)||c.isConstructorDeclaration(_)||c.isGetAccessorDeclaration(_)||c.isSetAccessorDeclaration(_)){let D=_.parent;if(!c.isClassLike(D)||D.name===void 0)return null;let F=m.tainted.has(D.name.text)?void 0:x.get(D.name.text);return F?.kind==="app-class"?F.cls:null}}return null},Ae=i&&!m.tainted.has("require")&&!nu(m.sf),me=y=>{if(c.isIdentifier(y)){let F=m.tainted.has(y.text)?void 0:x.get(y.text);return F?.kind==="package-surface"||F?.kind==="package-default"?t.exportFor(F.packageName,"default"):F?.kind==="app-named-fn"||F?.kind==="app-default-fn"?F.functionId:F?.kind==="module"?f.get(String(F.resolvedModuleId))?.id??null:F?.kind==="member-value"?F.functionId:null}if(!c.isPropertyAccessExpression(y))return null;let _=y.expression;if(i&&c.isCallExpression(Te(_))){let F=en(Te(_));if(F!==void 0)if(!Ae)ae(l,"2b","require-shadow");else if(ge(F)==="package-root")ae(l,"2b","package-root");else{let Y=d.get(`${m.rel}::${F}`);if(Y===void 0)ae(l,"2b","unresolved-module");else{let Z=y.name.text,te=u.get(String(Y));if(te==="*"||te!==void 0&&te.has(Z))ae(l,"2b","module-mutation-gate");else{let ue=g.get(String(Y))?.get(Z);if(ue!==void 0)return ae(l,"2b",null),ue;if(Z==="default"){let le=f.get(String(Y));if(le!==void 0&&le.esm)return ae(l,"2b",null),le.id;ae(l,"2b","non-esm-default")}else ae(l,"2b","unknown-member")}}}return null}let D;if(c.isIdentifier(_)){let F=m.tainted.has(_.text)?void 0:x.get(_.text);if(F?.kind==="app-class"||F?.kind==="app-instance")D=F.cls.memberIds;else if(F?.kind==="object-literal")D=F.obj.members;else if(F?.kind==="module"){let Y=g.get(String(F.resolvedModuleId));Y?.has(y.name.text)===!0&&!$(_.text,y.name.text)&&(D=Y)}}else if(c.isNewExpression(_)){let F=Gi(_,x,m.tainted);F?.kind==="app-instance"&&(D=F.cls.memberIds)}else _.kind===c.SyntaxKind.ThisKeyword&&(D=X(y)?.memberIds);return D?.get(y.name.text)??null},Ee=new Map,yn=y=>{if(c.isVariableDeclaration(y)&&c.isIdentifier(y.name)&&y.initializer!==void 0&&c.isObjectLiteralExpression(y.initializer)&&!m.tainted.has(y.name.text)&&!x.has(y.name.text)&&!Ee.has(y.name.text)){let _=new Map;for(let D of y.initializer.properties)if(c.isPropertyAssignment(D)&&c.isIdentifier(D.name)){let F=W(D.initializer);F!==null&&_.set(D.name.text,F)}Ee.set(y.name.text,_)}c.forEachChild(y,yn)};yn(m.sf);let Kn=y=>{if(c.isBinaryExpression(y)&&y.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(y.left)&&c.isIdentifier(y.left.expression)&&!m.tainted.has(y.left.expression.text)){let _=Ee.get(y.left.expression.text);if(_!==void 0){let D=W(y.right);D!==null&&_.set(y.left.name.text,D)}}c.forEachChild(y,Kn)};Kn(m.sf);for(let[y,_]of Ee)x.set(y,{kind:"object-literal",obj:{members:_}});let M=(y,_=0)=>{if(_>qi)return null;let D=Te(y);if(c.isCallExpression(D)&&c.isPropertyAccessExpression(D.expression)&&D.expression.name.text==="bind")return M(D.expression.expression,_+1);if(c.isIdentifier(D)){let F=W(D);if(F!==null)return F;let Y=m.tainted.has(D.text)?void 0:x.get(D.text);return Y?.kind==="member-value"?Y.functionId:null}return c.isPropertyAccessExpression(D)?W(D)??me(D):null},J=(y,_=0)=>{if(_>qi)return"depth-cap";let D=Te(y);if(c.isCallExpression(D)&&c.isPropertyAccessExpression(D.expression)&&D.expression.name.text==="bind")return J(D.expression.expression,_+1);if(c.isIdentifier(D))return m.tainted.has(D.text)?"tainted-receiver":"unresolved-receiver";if(c.isPropertyAccessExpression(D)&&c.isIdentifier(D.expression)){if(m.tainted.has(D.expression.text))return"tainted-receiver";if($(D.expression.text,D.name.text))return"mutated-member"}return"unresolved-receiver"},oe=y=>{if(c.isVariableDeclaration(y)&&c.isIdentifier(y.name)&&y.initializer!==void 0){let _=Te(y.initializer),D=c.isPropertyAccessExpression(_),F=c.isCallExpression(_)&&c.isPropertyAccessExpression(_.expression)&&_.expression.name.text==="bind";if(D||F){let Y=D?"D1":"A2";if(m.tainted.has(y.name.text))ae(l,Y,"tainted-alias");else if(x.has(y.name.text))ae(l,Y,"already-bound");else{let Z=M(_);Z!==null?(x.set(y.name.text,{kind:"member-value",functionId:Z}),ae(l,Y,null)):ae(l,Y,J(_))}}}c.forEachChild(y,oe)};i&&oe(m.sf);let ie=0,tn=y=>{let _,D;if(c.isCallExpression(y)){let F=y.expression,Y=c.isIdentifier(F)&&F.text==="require",Z=F.kind===c.SyntaxKind.ImportKeyword;!Y&&!Z&&(_=F,D=y.arguments)}else c.isTaggedTemplateExpression(y)&&(_=y.tag);if(_!==void 0){let F=eu(_),Y=y.getStart(m.sf,!1),Z=`${m.rel}#call${String(ie)}`;ie+=1;let te="unresolved",ue=[],le=W(_);le!==null&&(te="resolved",ue.push(le)),S.push({id:Z,enclosingFunctionId:j(Y),calleeExprShape:F,resolvedTargetIds:ue,resolution:te,range:mn(m.rel,y,m.sf)});for(let fe of ue)w.push({callSiteId:Z,calleeFunctionId:fe,resolution:te});if(le===null){let fe=me(_);if(fe!==null)w.push({callSiteId:Z,calleeFunctionId:fe,resolution:"field-based"});else if(i&&c.isPropertyAccessExpression(_)&&(_.name.text==="call"||_.name.text==="apply")){let ne=M(_.expression);ne!==null?(w.push({callSiteId:Z,calleeFunctionId:ne,resolution:"field-based"}),ae(l,"A3",null)):ae(l,"A3",J(_.expression))}}for(let fe of D??[]){let ne=W(fe);if(ne!==null)w.push({callSiteId:Z,calleeFunctionId:ne,resolution:"field-based"});else{let rn=me(fe);if(rn!==null)w.push({callSiteId:Z,calleeFunctionId:rn,resolution:"field-based"});else if(i){let on=M(fe),Le=Te(fe),de=Le!==fe||c.isCallExpression(Le)&&c.isPropertyAccessExpression(Le.expression)&&Le.expression.name.text==="bind";on!==null?(w.push({callSiteId:Z,calleeFunctionId:on,resolution:"field-based"}),de&&ae(l,"A2p",null)):de&&ae(l,"A2p",J(fe))}}}}c.forEachChild(y,tn)};tn(m.sf);for(let y of n.computedLoads.get(m.rel)??[]){let _=y.candidateRels.filter(F=>s.has(F)).map(F=>`${F}#<toplevel>`);if(_.length===0)continue;let D=`${m.rel}#dirload${String(ie)}`;ie+=1,S.push({id:D,enclosingFunctionId:j(y.pos),calleeExprShape:"require",resolvedTargetIds:_,resolution:"field-based",range:{path:m.rel,start:y.pos,end:y.pos}});for(let F of _)w.push({callSiteId:D,calleeFunctionId:F,resolution:"field-based"})}let xn=0;for(let y of r.get(m.rel)??[]){let _=`${m.rel}#handlerseed${String(xn)}`;xn+=1;let D=y.node.getStart(m.sf,!1);S.push({id:_,enclosingFunctionId:m.toplevelId,calleeExprShape:"member",resolvedTargetIds:[y.id],resolution:"field-based",range:{path:m.rel,start:D,end:D}}),w.push({callSiteId:_,calleeFunctionId:y.id,resolution:"field-based"})}}let E=new Map;if(a)for(let m of s.values())for(let[x,A]of m.mintSeedAliases)E.set(`${m.rel}::${String(x)}`,A);return{functions:k,callSites:S,callEdges:w,exports:v,exportBindings:I,classes:C,mintSeedAliases:E,bindingApplicability:l}}function ru(e,n,t){let r=s=>s.length===0||Pe.isAbsolute(s)||s.includes("\\")||/^[a-zA-Z]:/u.test(s)||s.split("/").some(d=>d===".."||d==="");if(r(n)||r(t))return null;let o=e.endsWith(Pe.sep)?e:e+Pe.sep,i;try{i=Vi(Pe.resolve(e,n))}catch{return null}if(!i.startsWith(o))return null;let a=i.endsWith(Pe.sep)?i:i+Pe.sep,l;try{l=Vi(Pe.resolve(i,t))}catch{return null}return l.startsWith(a)?l:null}function ms(e,n,t){let r=`${e}#class:${t}`,o=[],i=[],a=[],l=new Set;return{pushMember(s,d,u,p){if(s==="__proto__"||l.has(s))return;l.add(s);let f=`${e}#${t}.${s}`;o.push({id:f,moduleId:e,name:s,kind:u,enclosingClassId:r,declRange:mn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),i.push({name:s,id:f,kind:u,body:p})},finish(){return i.length===0?null:{functions:o,classNode:{id:r,moduleId:e,name:t,implementsRefs:[],members:a},members:i}}}}function ou(e,n,t,r){if(ps(r)||r.members.length>jr)return null;let o=ms(e,n,t);for(let i of r.members){let a,l,s;if(c.isConstructorDeclaration(i))a="constructor",l="ctor",s=void 0;else if(c.isMethodDeclaration(i))a=Mt(i.name),l="method",s=a!==void 0&&!Dn.has(a)?i.body??void 0:void 0;else continue;a!==void 0&&o.pushMember(a,i,l,s)}return o.finish()}function iu(e,n,t){let r;for(let a of n.statements)if(c.isFunctionDeclaration(a)&&a.name?.text===t){r=a;break}if(r===void 0)return null;let o=[];for(let a of n.statements){if(!c.isExpressionStatement(a))continue;let l=a.expression;if(!c.isBinaryExpression(l)||l.operatorToken.kind!==c.SyntaxKind.EqualsToken)continue;let s=l.left;if(c.isPropertyAccessExpression(s)&&c.isPropertyAccessExpression(s.expression)&&c.isIdentifier(s.expression.expression)&&s.expression.expression.text===t&&s.expression.name.text==="prototype"){let d=s.name.text;c.isFunctionExpression(l.right)?o.push({name:d,fn:l.right,walk:!0}):c.isArrowFunction(l.right)&&o.push({name:d,fn:l.right,walk:!1})}}if(o.length===0||o.length+1>jr)return null;let i=ms(e,n,t);i.pushMember("constructor",r,"ctor",void 0);for(let a of o){let l=a.walk&&!Dn.has(a.name)&&c.isFunctionExpression(a.fn)?a.fn.body:void 0;i.pushMember(a.name,a.fn,"method",l)}return i.finish()}function su(e,n,t){for(let r of n.statements)if(c.isClassDeclaration(r)&&r.name?.text===t)return ou(e,n,t,r);return iu(e,n,t)}function au(e,n,t,r,o){let i={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return i;let a=new Set(t.map(p=>p.packageName)),l=new Set(t.map(p=>p.path)),s=new Set,d=new Set,u=0;for(let p of n){if(!a.has(p.packageName))continue;let f=ru(e.appRoot,p.packageRootRel,p.sourcePath);if(f===null)continue;let h=e.toRel(f);if(h===null)continue;let g=`${h}#${p.container}`;if(d.has(g)||!s.has(h)&&s.size>=Ot)continue;let k=_e(f);if(k===null)continue;let S;try{S=c.createSourceFile(h,k,c.ScriptTarget.Latest,!0,c.ScriptKind.JS)}catch{continue}let w=su(h,S,p.container);if(w===null)continue;s.add(h),d.add(g);let v=new Map,I=new Map;for(let E of w.members){let m=o.methodFor(p.packageName,p.container,E.name,E.kind);v.set(E.name,m),I.set(m,E.id)}let C=0;for(let E of w.members){if(E.body===void 0)continue;let m=(x,A)=>{if(A&&c.isCallExpression(x)&&c.isPropertyAccessExpression(x.expression)&&x.expression.expression.kind===c.SyntaxKind.ThisKeyword){let T=v.get(x.expression.name.text);if(T!==void 0){let N=`${h}#depclass:${p.container}.${E.name}#c${String(C)}`;C+=1,i.callSites.push({id:N,enclosingFunctionId:E.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:mn(h,x,S)}),i.callEdges.push({callSiteId:N,calleeFunctionId:T,resolution:"field-based"})}}let O=c.isFunctionExpression(x)||c.isFunctionDeclaration(x)||c.isMethodDeclaration(x)||c.isConstructorDeclaration(x)||c.isGetAccessorDeclaration(x)||c.isSetAccessorDeclaration(x)||c.isClassLike(x),j=c.isArrowFunction(x)?A:O?!1:A;c.forEachChild(x,T=>{m(T,j)})};m(E.body,!0)}for(let E of r){let m=I.get(E.calleeFunctionId);m!==void 0&&i.callEdges.push({callSiteId:E.callSiteId,calleeFunctionId:m,resolution:"field-based"})}if(i.functions.push(...w.functions),i.classes.push(w.classNode),!l.has(h)){l.add(h),i.modules.push({id:h,packageName:p.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let E=o.moduleFor(p.packageName),m=`${String(E)}#depclass${String(u)}`;u+=1,i.imports.push({id:m,moduleId:E,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),i.importEdges.push({importId:m,resolvedModuleId:h})}i.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(w.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return i}function lu(e,n,t,r){let o=new Set(e.modules.filter(s=>s.isEntrypoint).map(s=>s.packageName)),i=new Map(e.functions.map(s=>[s.id,s.moduleId])),a=new Map;for(let s of e.callSites){if(s.resolution!=="unresolved")continue;let d=i.get(s.enclosingFunctionId);d!==void 0&&a.set(d,(a.get(d)??0)+1)}let l=[];for(let s of e.modules){if(s.externalSurface===!0)continue;let d=n.get(s.path);if(d===void 0||t.has(s.path)||o.has(s.packageName)&&r.has(s.path)&&!s.path.split("/").includes("node_modules"))continue;let u=a.get(s.id)??0;if(u===0&&Uc(d))continue;let p=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:s.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:s.id})}return l}function hs(e,n,t=[],r={},o=!1){let i=new Pr,a=xc(e,n,i),l=new Set;for(let C of a.computedLoads.values())for(let E of C)if(E.seedable)for(let m of E.candidateRels)l.add(m);let s=new Map;for(let C of e.sourceFiles){let E=e.toRel(C.fileName);if(E===null||!l.has(E)||E.split("/").includes("node_modules"))continue;let m=Jc(E,C);m.length>0&&s.set(E,m)}let d=s.size===0?a.modules:a.modules.map(C=>s.has(C.path)&&!C.isEntrypoint?{...C,isEntrypoint:!0}:C),u={...a,modules:d},p=tu(e,u,i,s,r),f=Bc(e,a,p.functions,p.mintSeedAliases),h=new Set(a.modules.map(C=>C.path)),g=kc(e.depReach,i,h),k=[...u.modules,...g.modules,...i.modules()],S=au(e,t,k,p.callEdges,i),w=[];if(o){let C="#default",E=new Set;for(let x of p.callEdges){let A=String(x.calleeFunctionId);!A.startsWith("pkg:")||!A.endsWith(C)||E.add(A.slice(4,A.length-C.length))}let m=new Map;for(let x of e.depReach.edges){if(!("surface"in x.from)||"surface"in x.to)continue;let A=x.from.surface;m.set(A,m.has(A)?null:x.to.module)}for(let x of E){let A=m.get(x);if(A==null)continue;let O=Sc(Pe.join(e.appRoot,A));if(O===null||O==="default")continue;let j=i.exportFor(x,O),T=`pkg:${x}${C}`;for(let N of p.callEdges)String(N.calleeFunctionId)===T&&w.push({callSiteId:N.callSiteId,calleeFunctionId:j,resolution:"field-based"})}}let v={modules:[...u.modules,...g.modules,...S.modules,...i.modules()],exports:[...p.exports,...f.exports],imports:[...a.imports,...g.imports,...S.imports],functions:[...p.functions,...i.functions(),...S.functions],callSites:[...p.callSites,...S.callSites],classes:[...p.classes,...i.classes(),...S.classes],callEdges:[...p.callEdges,...S.callEdges,...w],importEdges:[...a.importEdges,...g.importEdges,...S.importEdges],exportBindings:[...p.exportBindings,...f.exportBindings],inheritEdges:[]},I=new Map;for(let C of e.sourceFiles){let E=e.toRel(C.fileName);E!==null&&I.set(E,C)}return{graph:v,diagnostics:[...f.diagnostics,...S.diagnostics,...lu(v,I,new Set(e.diagnostics.filter(C=>C.code==="dependency-body").map(C=>C.path)),a.appOwnedPaths)],loadSites:a.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var du=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,Dt=/^[A-Za-z0-9_$.-]{1,128}$/u;function cu(e){return du.test(e.calleePackage)?Dt.test(e.anchorExport)?Dt.test(e.calleeExport)?e.anchorContainer!==null&&!Dt.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!Dt.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Zn(e,n){let t=[],r=[],o=new Map(e.modules.map(d=>[d.id,d])),i=new Map(e.classes.map(d=>[d.id,d.name])),a=(d,u,p)=>e.functions.some(f=>{if(f.name!==u)return!1;let h=o.get(f.moduleId);return h===void 0||h.packageName!==d?!1:(f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null)===p}),l=(d,u,p)=>{for(let f of e.functions){if(f.name!==u)continue;let h=o.get(f.moduleId);if(!(h===void 0||h.packageName!==d||(f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null)!==p))return f.id}return null},s=[...n].sort((d,u)=>d.modelId<u.modelId?-1:d.modelId>u.modelId?1:0);for(let d of s){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=d.edges.map(cu).find(h=>h!==null);if(u!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let p=0,f=0;for(let h of d.edges){if(!a(d.packageName,h.anchorExport,h.anchorContainer)){f+=1;continue}r.push({modelId:d.modelId,kind:h.kind,anchor:{packageName:d.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:l(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${d.modelId}: ${String(p)} edge(s) lowered, ${String(f)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(f)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:r,notes:t}}}var uu={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Gr(e){try{let n=ji(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(l=>l.split(ze.sep).join("/"))),{graph:r,diagnostics:o,loadSites:i,bindingApplicability:a}=hs(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:r,diagnostics:[...n.diagnostics,...o],loadSites:i,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...a!==void 0?{bindingApplicability:a}:{}}}catch(n){return{graph:uu,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function gs(e,n){let t=512,r=(o,i,a)=>{if(!(t<=0||i>12)){if(t-=1,typeof o=="string"){n(o,a);return}if(Array.isArray(o)){for(let l of o)r(l,i+1,a);return}if(o!==null&&typeof o=="object")for(let[l,s]of Object.entries(o))l==="types"||l==="typings"||r(s,i+1,a||l.includes("*"))}};r(e,0,!1)}function bs(e,n,t,r=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let o;try{o=ln(ze.resolve(e,t))}catch{return null}return o!==e&&!o.startsWith(n)||r&&!Qe(o)?null:o===e?"":o.slice(n.length).split(ze.sep).join("/")}var fu=1024*1024,pu=4096;function ys(e,n){let t=e.toLowerCase(),r=0;for(;;){let o=t.indexOf(n,r);if(o===-1)return null;let i=o===0?" ":t[o-1],a=o+n.length;for(;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
+`||e[a]==="\r");)a+=1;if(/[a-z0-9_:-]/i.test(i??" ")||e[a]!=="="){r=o+n.length;continue}for(a+=1;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
+`||e[a]==="\r");)a+=1;let l=e[a];if(l==='"'||l==="'"){let d=e.indexOf(l,a+1);return d===-1?null:e.slice(a+1,d)}let s=a;for(;s<e.length&&!/[\s>]/.test(e[s]??"");)s+=1;return e.slice(a,s)}}function mu(e){let n=[],t=e.toLowerCase(),r=0;for(;;){let o=t.indexOf("<script",r);if(o===-1)break;let i=t[o+7];if(i!==void 0&&/[a-z0-9-]/.test(i)){r=o+7;continue}let a=e.indexOf(">",o);if(a===-1)break;r=a+1;let l=e.slice(o+7,a);if(l.length>pu)continue;let s=ys(l,"type");n.push({module:(s??"").trim().toLowerCase()==="module",src:ys(l,"src")})}return n}function hu(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function gu(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function yu(e){let n=ln(e),t=n.endsWith(ze.sep)?n:n+ze.sep,r=new Set,o=[],i=[],a=[],l=[],s=[],d=!1,u=(R,P,K=!1,H)=>{let z=bs(n,t,R);return z===null||z.length===0?"unresolved":r.has(z)?"duplicate":(r.add(z),o.push(z),i.push({source:P,specifier:Be(H??(typeof R=="string"?R:"")),entrypoint:z,launch:K}),"added")},p=new Set,f=(R,P,K=!1)=>{let H=u(R,P),z=typeof R=="string"&&R.includes("\\")?u(R.split("\\").join("/"),P,!1,R):"unresolved";if(H!=="unresolved"||z!=="unresolved"||typeof R!="string"||R.trim().length===0||R.endsWith(".d.ts")||R.endsWith(".d.mts")||R.endsWith(".d.cts"))return;if(K&&R.includes("*")){let $=Bi(n,R),W=!1;if($!==null){for(let X of $.matches)u(X,P,!1,R)!=="unresolved"&&(W=!0);if(!$.truncated&&W)return}l.push({source:P,file:"package.json",detail:`\`${Be(R)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let q=`${P}\0${R}`;p.has(q)||(p.add(q),l.push({source:P,file:"package.json",detail:`\`${Be(R)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},h=[],g=(R,P)=>{a.push({source:R,file:R,detail:P.detail}),h.push({code:P.code,path:R,detail:`${R} ${P.detail}`})},k,S,w,v=null,I=qr(n,t,"package.json",un);I.kind==="refused"&&g("package.json",I);try{let R=I.kind==="ok"?JSON.parse(I.text):{};if(v=I.kind==="ok"?R:null,f(R.main,"main"),typeof R.bin=="string")f(R.bin,"bin");else if(R.bin!==null&&typeof R.bin=="object")for(let K of Object.values(R.bin))f(K,"bin");gs(R.exports,(K,H)=>{f(K,"exports",H)}),typeof R.browser=="string"?f(R.browser,"browser"):gs(R.browser,K=>{u(K,"browser")});let P=R.scripts;if(P!==null&&typeof P=="object"){let K=P;k=K.start,S=K.prestart,w=K.poststart}}catch{}if(o.length===0)try{ln(ze.join(n,"index.js")),u("index.js","index.js fallback")}catch{}let C=(R,P)=>{if(typeof R=="string"&&R.trim().length>0){let K=xs(R,P,"package.json",u,a,!1)==="used";return K&&(d=!0),K?"resolved":"gapped"}return R===void 0||typeof R=="string"?"absent":(a.push({source:P,file:"package.json",detail:`${P} is not a string; no entry file could be read from it`}),"gapped")},E=C(k,"scripts.start"),m=C(S,"scripts.prestart"),x=C(w,"scripts.poststart"),A=E==="resolved"&&m!=="gapped"&&x!=="gapped",O=qr(n,t,"Procfile",65536);if(O.kind==="refused")g("Procfile",O);else if(O.kind==="ok"){let{entries:R,truncated:P,unnamedLines:K}=Tr(O.text);P&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),K>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(K)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let H of R)xs(H.command,`Procfile:${H.name}`,"Procfile",u,a,A)==="used"&&(d=!0)}let j=o.length===0,T=qr(n,t,"index.html",fu);if(T.kind==="ok")for(let R of mu(T.text)){if(R.src===null)continue;let P=Be(R.src);if(!R.module){s.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${P}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(hu(R.src)){s.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${P}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}u(gu(R.src),"index.html",!1,R.src)==="unresolved"&&a.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${P}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else T.kind==="refused"&&s.push({kind:T.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${T.detail}`,root:""});let N=j?Cr(n,v):null;if(N!==null){let R=0;for(let P of $r(n,N).roots)u(P,`framework:${N.name}`)==="added"&&(R+=1);R>0&&h.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${N.name}'s directory conventions (recognised via ${N.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let L=R=>R.map(P=>({...P,root:""}));return{entrypoints:o,sources:L(i),gaps:L(a),surfaceGaps:L(l),launchResolved:d,diagnostics:h,framework:N,observations:s}}function qr(e,n,t,r){let o;try{o=ln(ze.join(e,t))}catch{return{kind:"absent"}}if(!o.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let i=On(o,r);return i.kind==="ok"?i:i.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(i.bytes)} bytes, over the ${String(r)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function xs(e,n,t,r,o,i){let a=Dr(e);if(a.kind==="delegates")return i?"used":(o.push({source:n,file:t,detail:`\`${Be(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(a.kind==="unparsed")return o.push({source:n,file:t,detail:`\`${Be(e)}\`: ${a.reason}`}),"gapped";let l=r(a.specifier,n,!0),s=a.alt===void 0?"unresolved":r(a.alt,n,!0);return l==="unresolved"&&s==="unresolved"?(o.push({source:n,file:t,detail:`\`${Be(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function Pn(e,n){return e===""?n:`${e}/${n}`}function ks(e,n){let t=ln(e),r=t.endsWith(ze.sep)?t:t+ze.sep,o=new Set,i=[],a=[],l=[],s=[],d=[],u=[],p=!1,f=null,h=[...n].sort((g,k)=>g.rel===""?-1:k.rel===""?1:g.rel<k.rel?-1:g.rel>k.rel?1:0);for(let g of h){let k=Pn(g.rel,"package.json"),S=g.rel===""?".":g.rel,w;try{w=ln(g.abs)}catch{l.push({source:"root",file:k,detail:`root \`${S}\` could not be resolved; not seeded`,root:g.rel});continue}if(w!==t&&!w.startsWith(r)){l.push({source:"root",file:k,detail:`root \`${S}\` resolves outside the scan root; refused, not seeded`,root:g.rel});continue}let v;try{v=yu(w)}catch{l.push({source:"root",file:k,detail:`root \`${S}\` could not be read; not seeded`,root:g.rel});continue}for(let I of v.sources){let C=Pn(g.rel,I.entrypoint),E,m;try{E=ln(ze.resolve(t,C)),m=ln(ze.resolve(w,I.entrypoint))}catch{l.push({source:I.source,file:k,detail:`\`${I.specifier}\` re-based to \`${C}\` did not resolve; not seeded`,root:g.rel});continue}if(!E.startsWith(r)||E!==m){l.push({source:I.source,file:k,detail:`\`${I.specifier}\` re-based to \`${C}\` escapes the scan root or names another file; refused, not seeded`,root:g.rel});continue}o.has(C)||(o.add(C),i.push(C),a.push({...I,entrypoint:C,root:g.rel}))}v.launchResolved&&(p=!0);for(let I of v.gaps)l.push({...I,file:Pn(g.rel,I.file),root:g.rel});for(let I of v.surfaceGaps)s.push({...I,file:Pn(g.rel,I.file),root:g.rel});for(let I of v.diagnostics)d.push({...I,path:Pn(g.rel,I.path)});for(let I of v.observations)u.push({...I,file:Pn(g.rel,I.file),root:g.rel});g.rel===""&&(f=v.framework)}return{entrypoints:i,sources:a,gaps:l,surfaceGaps:s,launchResolved:p,diagnostics:d,framework:f,observations:u}}function Hr(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let r=n.slice(0,3).map(o=>o.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${r}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Xr(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let r=[...new Set(t.slice(0,3).map(o=>o.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${r}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Es(e,n){let t=ln(e),r=t.endsWith(ze.sep)?t:t+ze.sep,o=new Set,i=[],a=[];for(let l of n){let s=bs(t,r,l,!0);if(s===null||s.length===0){a.push(l);continue}o.has(s)||(o.add(s),i.push(s))}return{entrypoints:i,rejected:a}}import{readdirSync as Os,readFileSync as eo,realpathSync as no,statSync as tt}from"node:fs";import Ge from"node:path";function xu(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let r=t+2;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;let o=e.charCodeAt(r);return o===38||o===42}function Qn(e,n,t){let r=n.maxLines??2e6,o=n.maxLineBytes??16384,i=!1,a=!1,l=0,s=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let u=e.indexOf(`
+`,d),p=u===-1;p&&(u=e.length);let f=u>d&&e.charCodeAt(u-1)===13?u-1:u;if(s+=1,s>r){i=!0;break}if(f-d>o)l+=1;else{let h=d;for(;h<f&&e.charCodeAt(h)===32;)h+=1;let g=h-d,k=f;for(;k>h&&(e.charCodeAt(k-1)===32||e.charCodeAt(k-1)===9);)k-=1;if(h<k&&e.charCodeAt(h)!==35){let S=e.slice(h,k);if(xu(S)){a=!0;break}t(g,S)}}if(p)break;d=u+1}return{truncated:i||l>0,refusedAnchors:a,oversizeLines:l}}function Tt(e){let n=e.charCodeAt(0);if(n===34||n===39){let r=e.indexOf(String.fromCharCode(n),1);if(r===-1)return null;let o=r+1;for(;o<e.length&&e.charCodeAt(o)===32;)o+=1;return e.charCodeAt(o)===58?e.slice(0,r+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function Ln(e){return e.endsWith(":")}function We(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function Pt(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,r=t.indexOf("/");if(n){if(r<=0||t.indexOf("/",r+1)!==-1)return!1}else if(r!==-1)return!1;let o=n?[t.slice(0,r),t.slice(r+1)]:[t];for(let i of o){if(i.length===0||i.charCodeAt(0)===46||i.charCodeAt(0)===95)return!1;for(let a=0;a<i.length;a+=1){let l=i.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function et(e){return Pt(e)?`node_modules/${e}`:""}function nt(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Lt=2e5,ws=64,Ft=1024,Su=5,bu=[1,2,3];function ku(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let r=e.slice(t+n.length);if(r==="")return null;let o=r.split("/");return o[0]?.startsWith("@")?o.length>=2?`${o[0]}/${o[1]}`:null:o[0]??null}function vs(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let r=t.indexOf("@",1);if(r>0){let o=t.slice(0,r),i=t.slice(r+1);if(o.length>0&&i.length>0)return[{name:o,version:i}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function Fn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Is(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function As(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function _s(e,n,t,r,o=!1){let i=JSON.stringify([n,t,r]);if(!e.seen.has(i)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(i),e.deps.push({name:n,version:t,lockKey:r,dev:o})}}function Eu(e,n){for(let[t,r]of Object.entries(e)){if(t==="")continue;if(!As(n))return;let o=t.startsWith("node_modules/")||t.includes("/node_modules/"),i=Fn(r);if(i===null){n.unread+=1;continue}if(i.link===!0)continue;let a=i.name,l=typeof a=="string"&&a!==""?a:ku(t),s=i.version;if(l===null||typeof s!="string"){o&&(n.unread+=1);continue}let d=i.dev===!0||i.devOptional===!0;for(let u of vs(l,s))_s(n,u.name,u.version,t,d)}}function Ns(e,n,t){let r=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],o=!1;for(let i=0;i<r.length;i+=1){let a=r[i];if(a===void 0)break;for(let[l,s]of Object.entries(a.deps)){if(!As(n))return{depthCapped:o};if(l===""){n.unread+=1;continue}let d=Fn(s);if(d===null){n.unread+=1;continue}let u=a.pathSafe&&Pt(l),p=u?`${a.prefix}node_modules/${l}`:"",f=u&&p.length<=Ft,h=f?p:"",g=d.version,k=d.dev===!0||a.dev;if(d.link!==!0&&typeof g=="string"&&g!=="")for(let w of vs(l,g))_s(n,w.name,w.version,h,k);else n.unread+=1;let S=Fn(d.dependencies);if(S!==null){if(a.depth+1>t){o=!0;continue}r.push({deps:S,prefix:f?`${h}/`:a.prefix,depth:a.depth+1,pathSafe:f,dev:k})}}}return{depthCapped:o}}function wu(e,n,t){let r=Is(n.maxEntries),{depthCapped:o}=Ns(e,r,t),i=[],a=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),l=new Set,s=[];for(let d of r.deps){if(d.version.includes(":"))continue;let u=JSON.stringify([d.name,d.version]);a.has(u)||l.has(u)||(l.add(u),s.length<Su&&s.push(nt(d.name,d.version)))}if(l.size>0){let d=l.size-s.length;i.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${s.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(r.capped||o)&&i.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),i}function jt(e,n={}){let t=[],r;try{r=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let o=Fn(r);if(o===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let i=o.lockfileVersion,a=typeof i=="number"&&Number.isInteger(i)?i:null,l=typeof i=="number"?String(i):"?",s=Fn(o.packages),d=Fn(o.dependencies);if(s===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!bu.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??ws,p=Is(n.maxEntries??Lt),f=!1;return s!==null?(Eu(s,p),d!==null&&t.push(...wu(d,p,u))):d!==null&&(f=Ns(d,p,u).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),f&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||f}}var vu=["workspace:","link:","portal:","file:","exec:"];function Iu(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Au(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let r=n.slice(0,t),o=n.slice(t+1);if(r.length===0)return[];for(let l of vu)if(o.startsWith(l))return[];if(!o.startsWith("npm:"))return[r];let i=o.slice(4),a=i.indexOf("@",1);if(a>0){let l=i.slice(0,a);return l.length>0?[l]:[r]}return i.length===0||Iu(i)?[r]:[r,i]}function _u(e){if(Ln(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let r=e.charCodeAt(t);if(r===34||r===39){n===0?n=r:n===r&&(n=0);continue}if(n===0&&r===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Nu(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let r of n.split(",")){let o=r.trim();o.length>0&&t.push(o)}return t}function Ru(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let r=t.length;for(;r<n.length&&r<t.length+3;){let i=n.charCodeAt(r);if(i<48||i>57)break;r+=1}let o=n.slice(t.length,r);return o.length>0?o:null}function Rs(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=We(e.slice(8).trim());return t.length>0?t:null}function Yr(e,n={}){let t=[],r=[],o=new Set,i=n.maxEntries??2e5,a=!1,l=null,s=!1,d=[],u=!1,p=-1,f=!1,h=0,g=()=>{d.length>0&&!u&&(h+=1)},k=Qn(e,n,(I,C)=>{if(I===0){g(),d=[],u=!1,p=-1,s=!1;let m=_u(C);if(m===null)return;let x=We(m.trim());if(x==="__metadata"){a=!0,s=Ln(C);return}for(let A of Nu(x))d.push(...Au(A));return}if(s){if(I===2&&l===null){let m=Rs(C);m!==null&&(l=m)}return}if(d.length===0||(p===-1&&(p=I),I!==p||u))return;let E=Rs(C);if(E!==null){u=!0;for(let m of d){let x=JSON.stringify([m,E]);if(!o.has(x)){if(r.length>=i){f=!0;return}o.add(x),r.push({name:m,version:E,lockKey:et(m),dev:!1})}}}});g();let S=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(k.refusedAnchors)return{deps:[],diagnostics:[`${S} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};k.oversizeLines>0&&t.push(`${S} has ${String(k.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),f&&t.push(`${S} exceeds ${String(i)} entries; truncated`);let w=l??Ru(e),v=w===null?null:Number(w.split(".")[0]);return w!==null&&(v===null||!Number.isInteger(v)||v<1||v>8)&&t.push(`${S} declares unsupported lockfileVersion ${w} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${S} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:r,diagnostics:t,truncated:k.truncated||f}}function Jr(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.indexOf("_");return r!==-1&&(n=n.slice(0,r)),n.trim()}function Zr(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Cs(e){let n=We(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.charCodeAt(0)===47;if(r&&(n=n.slice(1)),n.length===0)return null;if(!r&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),p=n.indexOf("@",1);u>0&&(p===-1||u<p)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let o=n.charCodeAt(0)===64,i=o?n.indexOf("/"):-1;if(o&&i<=0)return null;let a=o?i+1:0,l=-1;for(let u=a;u<n.length;u+=1){let p=n.charCodeAt(u);if(p===47||p===64){l=u;break}}if(l<=a)return null;let s=n.slice(0,l),d=Jr(n.slice(l+1));return Zr(d)?{name:s,version:d}:null}var Cu=new Set(["packages","snapshots","importers"]),Ou=new Set([5,6,7,8,9]);function $u(e){let n=We(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function Bt(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:We(e.slice(0,n).trim()),value:We(t)}}function Qr(e,n={}){let t=[],r=[],o=new Set,i=n.maxEntries??2e5,a="",l=null,s=!1,d=0,u=[],p=(h,g)=>{let k=JSON.stringify([h,g]);if(!o.has(k)){if(r.length>=i){s=!0;return}o.add(k),r.push({name:h,version:g,lockKey:et(h),dev:!1})}},f=Qn(e,n,(h,g)=>{if(h===0){let k=Tt(g);if(a=k===null?"":We(k.trim()),l=null,a==="lockfileVersion"){let S=Bt(g),w=S===null?null:$u(S.value);S!==null&&(w===null||!Ou.has(w))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${S.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if(Cu.has(a)&&!Ln(g)){let S=Bt(g)?.value.trim()??"";S!=="{}"&&S!=="[]"&&(d+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(h!==2)return;let k=Tt(g),S=k===null?null:Cs(k);if(S===null){d+=1;return}p(S.name,S.version);return}if(a==="importers"){if(h===6){let k=Bt(g);if(k===null){l=g.endsWith(":")?We(g.slice(0,-1).trim()):null;return}l=null;let S=Jr(k.value);Zr(S)&&p(k.key,S);return}if(h===8&&l!==null){let k=Bt(g);if(k===null||k.key!=="version")return;let S=Jr(k.value);Zr(S)&&p(l,S)}}});return f.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),f.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(f.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),s&&t.push(`pnpm-lock.yaml exceeds ${String(i)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:r,diagnostics:t,truncated:f.truncated||s})}var Mu=128*1024*1024,Du=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>jt(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>jt(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Yr(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Qr(e,n===void 0?{}:{maxEntries:n})}],Tu=[".pnp.cjs",".pnp.data.json",".pnp.js"];function to(e,n){let t;try{t=no(Ge.join(e,n))}catch{return null}let r=e.endsWith(Ge.sep)?e:e+Ge.sep;return t.startsWith(r)?t:null}function $s(e,n){let t=Ge.join(e,"package.json"),r;try{r=no(t)}catch{return null}if(!r.startsWith(n+Ge.sep))return null;try{if(!tt(r).isFile())return null;let o=JSON.parse(eo(r,"utf8"));return typeof o.name!="string"||typeof o.version!="string"?null:{name:o.name,version:o.version}}catch{return null}}function Ms(e,n){try{return tt(Ge.join(e,n)),!0}catch{return!1}}function Pu(e,n){if(Ms(e,"pnpm-workspace.yaml"))return!0;let t=to(e,"package.json");if(t===null)return Ms(e,"package.json");let r;try{let a=tt(t);if(!a.isFile()||a.size>n)return!0;r=eo(t,"utf8")}catch{return!0}let o;try{o=JSON.parse(r)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=o[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let i=o.workspaces;return Array.isArray(i)?i.length>0:typeof i=="object"&&i!==null}function Ds(e,n){let t=Ge.join(e,"node_modules"),r=[],o;try{o=Os(t,{withFileTypes:!0})}catch{return r}for(let i of o){let a=i.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let s;try{s=Os(Ge.join(t,a),{withFileTypes:!0})}catch{continue}for(let d of s){let u=$s(Ge.join(t,a,d.name),n);u!==null&&r.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${d.name}`,linked:d.isSymbolicLink()||i.isSymbolicLink()})}continue}let l=$s(Ge.join(t,a),n);l!==null&&r.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:i.isSymbolicLink()})}return r}var Lu=5;function Fu(e,n,t){let r=to(e,n);if(r===null){try{tt(Ge.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let o;try{o=tt(r)}catch{return null}if(!o.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(o.size>t)return{gap:`${n} is ${String(o.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:eo(r,"utf8")}}catch{return{gap:`${n} could not be read`}}}function ju(e,n){let t=no(e),r=[],o=[],i=n?.maxLockfileBytes??Mu,a=[],l=new Set,s=[],d=Pu(t,i),u=null,p=!1,f=(g,k,S)=>{o.push({kind:g,detail:k,blindsAnalysis:S,rootRel:""}),r.push(k)};for(let g of Du){let k=Fu(t,g.file,i);if(k===null)continue;if("gap"in k){f("lockfile-unreadable",k.gap,!1);continue}let S=g.parse(k.text,n?.maxLockfileEntries);if(S.truncated&&(p=!0),S.deps.length===0){if(S.diagnostics.length>0||d){let w=S.diagnostics.length>0?S.diagnostics.join("; "):"no entries found";f("lockfile-unparsed",`${g.file} yielded NO dependencies (${w}); its transitive dependency set was not enumerated`,!1)}continue}S.diagnostics.length>0&&f("lockfile-partial",`${g.file} was only partly enumerated (${S.diagnostics.join("; ")})`,!1),u===null&&(u=g.file),s.includes(g.source)||s.push(g.source);for(let w of S.deps){let v=JSON.stringify([w.name,w.version,w.lockKey]);l.has(v)||(l.add(v),a.push({...w,declaredIn:g.file}))}}for(let g of Tu)if(to(t,g)!==null){f("yarn-pnp",`${g} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let g=s.length===1?s[0]??"none":"multi-lockfile";s.length>1&&r.push(`multiple lockfiles present (${s.join(", ")}); enumerated the UNION of all of them`);let k=new Set(a.map(v=>JSON.stringify([v.name,v.version]))),S=new Set,w=[];for(let v of Ds(t,t)){let I=JSON.stringify([v.name,v.version,v.lockKey]);l.has(I)||(l.add(I),a.push({name:v.name,version:v.version,lockKey:v.lockKey,dev:v.dev,declaredIn:""}));let C=JSON.stringify([v.name,v.version]);v.linked||k.has(C)||S.has(C)||(S.add(C),w.length<Lu&&w.push(nt(v.name,v.version)))}if(S.size>0){let v=S.size-w.length;f("lockfile-skew",`node_modules holds ${String(S.size)} package(s) at a (name, version) no lockfile lists (${w.join(", ")}${v>0?`, and ${String(v)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:g,lockfilePath:u,diagnostics:r,truncated:p,gaps:o}}let h=Ds(t,t);return h.length>0?(f("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(g=>({name:g.name,version:g.version,lockKey:g.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:r,truncated:p,gaps:o}):(d&&f("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:r,truncated:p,gaps:o})}function Ku(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.manifestRefused}function Bu(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function Ps(e){return e===""||e.split("/").every(Bu)}function zu(e,n){if(e===""||n==="")return n;if(!Ps(e))return"";let t=`${e}/${n}`;return t.length<=Ft?t:""}function Ts(e,n){return e===""?n:`${e}: ${n}`}function Uu(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function Ls(e,n,t){let r=t?.maxUnionEntries??Lt,o=n.roots.filter(Ku),i=o.some(g=>g.rel==="")?o:[Uu(e),...o],a=[],l=[],s=new Set,d=[],u=[],p=!1,f=!1;for(let g of i){let k=ju(g.rel===""?e:g.abs,t),S=k.diagnostics.map(v=>Ts(g.rel,v));!Ps(g.rel)&&k.packages.length>0&&S.push(`${g.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(k.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let w={...k,rootRel:g.rel,packages:k.packages.map(v=>({...v,lockKey:zu(g.rel,v.lockKey),declaredIn:v.declaredIn===""||g.rel===""?v.declaredIn:`${g.rel}/${v.declaredIn}`})),lockfilePath:k.lockfilePath===null||g.rel===""?k.lockfilePath:`${g.rel}/${k.lockfilePath}`,gaps:k.gaps.map(v=>({...v,rootRel:g.rel,detail:Ts(g.rel,v.detail)})),diagnostics:S};a.push(w),k.truncated&&(p=!0);for(let v of w.packages){let I=JSON.stringify([v.name,v.version,v.lockKey]);if(!s.has(I)){if(l.length>=r){f=!0;break}s.add(I),l.push(v)}}d.push(...w.gaps),u.push(...w.diagnostics)}f&&(p=!0,u.push(`the union of installed sets across ${String(i.length)} roots exceeds its ceiling of ${String(r)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let h=a[0];if(h===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:h.source,lockfilePath:h.lockfilePath,diagnostics:u,truncated:p,gaps:d,perRoot:a}}function Vu(e,n){let t;for(let r of e.perRoot){if(r.rootRel===""){t??=r;continue}n.startsWith(`${r.rootRel}/`)&&(t===void 0||r.rootRel.length>t.rootRel.length)&&(t=r)}return t}function zt(e,n){return n.declaredIn!==""?n.declaredIn:Vu(e,n.lockKey)?.lockfilePath??null}function Fs(e,n){return e.perRoot.find(r=>r.rootRel===n.rootRel)?.lockfilePath??(n.rootRel===""?null:`${n.rootRel}/package.json`)}function js(e){let n=new Map;for(let t of e){let r=n.get(t.name)??new Set;r.add(t.version),n.set(t.name,r)}return t=>{let r=n.get(t);if(r===void 0)return;let o=[...r].sort();return o.length===1?o[0]:o}}function rt(e){return new Set(e.map(n=>n.root))}function jn(e,n){let t=rt(n);return e.roots.filter(r=>!t.has(r.rel))}function ro(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function oo(e,n){return jn(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its code, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) this scan did not analyze; code there can load any installed package, so every \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function Ks(e){let n=[],t=e.observations.filter(r=>r.kind==="unenumerated-install").map(r=>r.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${ro(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let r=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(r.dirsWalked)} dirs walked, ${String(r.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function Bs(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{lstatSync as qu,readFileSync as Wu,readdirSync as Gu,realpathSync as io,statSync as Vt}from"node:fs";import Ie from"node:path";var qs=2e4,Ws=32,Gs=256,Hu=2*1024*1024,Xu=256*1024,Hs=256,Yu=16,Ju=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],Xs={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function zs(e,n){try{let t=Vt(e);return!t.isFile()||t.size>n?null:Wu(e,"utf8")}catch{return null}}function Ut(e){let n;try{n=Vt(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function Zu(e,n){let t=0,r=0,o=-1,i=0;for(;r<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(r)))t+=1,r+=1;else if(t<e.length&&e.charAt(t)==="*")o=t,i=r,t+=1;else if(o>=0)t=o+1,i+=1,r=i;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function Qu(e,n){let t=(r,o)=>{if(r===e.length)return o===n.length;let i=e[r]??"";if(i==="**"){for(let l=o;l<=n.length;l+=1)if(t(r+1,l))return!0;return!1}if(o>=n.length)return!1;let a=n[o]??"";return(i.includes("*")||i.includes("?")?Zu(i,a):i===a)?t(r+1,o+1):!1};return t(0,0)}function ef(e){let n=[],t=zs(Ie.join(e,"package.json"),Hu);if(t!==null)try{let a=JSON.parse(t)?.workspaces;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l);else if(typeof a=="object"&&a!==null){let l=a.packages;if(Array.isArray(l))for(let s of l)typeof s=="string"&&n.push(s)}}catch{}let r=zs(Ie.join(e,"pnpm-workspace.yaml"),Xu);r!==null&&n.push(...nf(r));let o=[];for(let i of n){if(o.length>=Hs)break;let a=i.trim();if(a.length===0)continue;for(;a.startsWith("./");)a=a.slice(2);if(a.startsWith("/")||Ie.isAbsolute(a))continue;let l=a.split("/").filter(s=>s.length>0);l.length===0||l.length>Yu||l.includes("..")||o.push(l.join("/"))}return o}function nf(e){let n=[],t=!1;for(let r of e.split(`
+`)){if(n.length>=Hs)break;if(/^packages:\s*(#.*)?$/.test(r)){t=!0;continue}if(!t)continue;let o=/^\s+-\s*(.*?)\s*$/.exec(r);if(o===null){r.trim().length>0&&(t=!1);continue}let i=(o[1]??"").trim(),a=i.indexOf(" #");a>=0&&(i=i.slice(0,a).trim()),(i.startsWith('"')&&i.endsWith('"')&&i.length>=2||i.startsWith("'")&&i.endsWith("'")&&i.length>=2)&&(i=i.slice(1,-1)),i.length>0&&n.push(i)}return n}function Us(e,n){let t=Ie.relative(n,e);return t.length===0?!1:t.split(Ie.sep).includes("node_modules")}function Vs(e,n){return Ie.relative(e,n).split(Ie.sep).join("/")}function so(e,n){let t=n?.maxDirs??qs,r=n?.maxDepth??Ws,o=n?.maxRoots??Gs,i;try{i=io(e)}catch{return{...Xs,observations:[{kind:"refused-unreadable",rel:""}]}}let a=[],l=[],s=new Set([i]),d=0,u=0,p=0,f="complete",h=ef(i).map(S=>S.split("/")),g=(S,w)=>{if(w.length===0)return a.push({rel:"",abs:S,witnesses:["scan-root"],manifestRefused:!1}),"root";let v=Ut(Ie.join(S,"package.json"));if(v==="absent")return"not-root";u+=1;let I=[],C=w.split("/");return h.some(E=>Qu(E,C))&&I.push("workspace-declared"),Ju.some(E=>Ut(Ie.join(S,E))==="regular")&&I.push("own-lockfile"),I.length===0&&v!=="refused"?(l.push({kind:"undeclared-manifest",rel:w}),"not-root"):a.length>=o?"exhausted":(a.push({rel:w,abs:S,witnesses:I,manifestRefused:v==="refused"}),"root")},k=[{abs:i,rel:"",depth:0}];for(;k.length>0;){let S=k.pop();if(S===void 0)break;if(d>=t){f="dirs-exhausted";break}d+=1;let w=g(S.abs,S.rel);if(w==="exhausted"){f="roots-exhausted";break}let v=w==="root";if(S.depth>=r){f=f==="complete"?"depth-clamped":f;continue}let I;try{I=Gu(S.abs)}catch{l.push({kind:"refused-unreadable",rel:S.rel});continue}I.sort().reverse();for(let C of I){let E=Ie.join(S.abs,C),m=S.rel.length===0?C:`${S.rel}/${C}`,x;try{let j=qu(E);x=j.isDirectory()||j.isSymbolicLink()&&Vt(E).isDirectory()}catch{continue}if(!x)continue;if(C==="node_modules"){v||l.push({kind:"unenumerated-install",rel:m});continue}if(C.startsWith(".")){p+=1,l.push({kind:"skipped-dot-directory",rel:m}),Ut(Ie.join(E,"package.json"))!=="absent"&&l.push({kind:"undeclared-manifest",rel:m});continue}let A;try{A=io(E)}catch{l.push({kind:"refused-unreadable",rel:m});continue}let O=i.endsWith(Ie.sep)?i:i+Ie.sep;if(A!==i&&!A.startsWith(O)){l.push({kind:"refused-out-of-root",rel:m});continue}Us(A,i)||s.has(A)||(s.add(A),k.push({abs:A,rel:Vs(i,A),depth:S.depth+1}))}}for(let S of n?.operatorRoots??[]){let w=typeof S=="string"?S.slice(0,512):"",v=()=>{l.push({kind:"refused-operator-root",rel:w})};if(w.length===0||w.includes("\0")){v();continue}let I;try{I=io(Ie.resolve(i,w))}catch{v();continue}let C=i.endsWith(Ie.sep)?i:i+Ie.sep;if(I!==i&&(!I.startsWith(C)||Us(I,i))){v();continue}let E;try{E=Vt(I).isDirectory()}catch{E=!1}if(!E||Ut(Ie.join(I,"package.json"))!=="regular"){v();continue}let m=a.findIndex(O=>O.abs===I);if(m>=0){let O=a[m];O!==void 0&&!O.witnesses.includes("operator")&&(a[m]={...O,witnesses:[...O.witnesses,"operator"]});continue}let x=Vs(i,I);a.push({rel:x,abs:I,witnesses:["operator"],manifestRefused:!1});let A=l.findIndex(O=>O.kind==="undeclared-manifest"&&O.rel===x);A>=0&&l.splice(A,1)}return a.sort((S,w)=>S.rel<w.rel?-1:S.rel>w.rel?1:0),l.sort((S,w)=>S.kind!==w.kind?S.kind<w.kind?-1:1:S.rel<w.rel?-1:S.rel>w.rel?1:0),{roots:a,observations:l,budget:f,counts:{dirsWalked:d,manifestsSeen:u,rootsAdmitted:a.length,dotDirectoriesSkipped:p}}}import{readdirSync as tf,readFileSync as rf}from"node:fs";import of from"node:path";var sf=new Set(["summarized","crashed","over-cap"]),af=new Set(["function","method","ctor"]);function pe(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function ao(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function lf(e,n){ao(e)||pe(n,"edge is not an object");let{entryPath:t,entryExport:r,entryContainer:o,hops:i}=e;(typeof t!="string"||typeof r!="string")&&pe(n,"edge entry fields must be strings"),o!==null&&typeof o!="string"&&pe(n,"entryContainer must be string or null"),(typeof i!="number"||!Number.isInteger(i)||i<0)&&pe(n,"hops must be a non-negative integer");let a=e.target;if(ao(a)||pe(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:s,symbolKind:d}=a;return typeof l!="string"&&pe(n,"symbol target exportName"),s!==null&&typeof s!="string"&&pe(n,"symbol target container"),(typeof d!="string"||!af.has(d))&&pe(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:r,entryContainer:o,target:{kind:"symbol",exportName:l,container:s,symbolKind:d},hops:i}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:s,calleeExport:d}=a;return(typeof l!="string"||l.length===0)&&pe(n,"dep target calleePackage"),s!==null&&typeof s!="string"&&pe(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&pe(n,"dep target calleeExport"),{entryPath:t,entryExport:r,entryContainer:o,target:{kind:"dep",calleePackage:l,calleeSubpath:s,calleeExport:d},hops:i}}pe(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function df(e,n){ao(e)||pe(n,"root is not an object");let{packageName:t,analyzedVersion:r,tool:o,toolVersion:i,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&pe(n,"packageName"),typeof r!="string"&&pe(n,"analyzedVersion"),o!=="jelly"&&pe(n,`tool ${JSON.stringify(o)} (only 'jelly' exists)`),typeof i!="string"&&pe(n,"toolVersion"),typeof a!="number"&&pe(n,"maxIndirections"),(typeof l!="string"||!sf.has(l))&&pe(n,`status ${JSON.stringify(l)} not in the enum`);let s=e.edges;return Array.isArray(s)||pe(n,"edges is not an array"),l!=="summarized"&&s.length>0&&pe(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:r,tool:o,toolVersion:i,maxIndirections:a,status:l,edges:s.map(d=>lf(d,n))}}function Ys(e){let n=new Map,t=tf(e).filter(r=>r.endsWith(".summary.json"));for(let r of t){let o=of.join(e,r),i;try{i=JSON.parse(rf(o,"utf8"))}catch(s){pe(r,`unparseable JSON: ${s instanceof Error?s.message:String(s)}`)}let a=df(i,r),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{isBuiltin as Js}from"node:module";function B(e){let n="";for(let t of e){let r=t.charCodeAt(0),o=r<32||r>=127&&r<=159;n+=o?"\\x"+r.toString(16).padStart(2,"0"):t}return n}var Zs=1024,Qs=4096,qt=8,ea=512,na=512,lo=8,cf=160,uf=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),co=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),ff=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,pf=/\.[cm]?[jt]sx?$/u;function ta(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let r=e.lastIndexOf("node_modules/");if(r!==-1){let o=e.slice(r+13).split("/"),i=o[0]??"";return i.startsWith("@")?o[1]===void 0?null:`${i}/${o[1]}`:i===""?null:i}return ff.test(e)&&!pf.test(e)?e:null}function mf(e){return B(`${e.code} ${e.path}: ${e.detail}`.slice(0,cf))}function ra(e){let{graph:n,facts:t,diagnostics:r}=e,o=new Map(n.modules.map(M=>[M.id,M])),i=new Map(n.modules.map(M=>[M.path,M])),a=Je(n),l=new Set;for(let M of a){let J=o.get(M);J!==void 0&&l.add(J.packageName)}let s=new Map,d=0,u=!1,p=!1,f=M=>M.startsWith(`${e.appRootReal}/`)?M.slice(e.appRootReal.length+1):M;for(let M of r){if(M.code==="limit-exceeded"&&M.path===e.appRootReal){u=!0;continue}let J=ta(f(M.path),i);if(J===null){M.code==="out-of-root"&&d++,co.has(M.code)&&(p=!0);continue}let oe=i.get(f(M.path));oe!==void 0&&co.has(M.code)&&!oe.path.includes("node_modules/")&&(p=!0);let ie=s.get(J);ie===void 0?s.set(J,[M]):ie.push(M)}let h=new Map(n.imports.map(M=>[M.id,M])),g=new Set;for(let M of n.importEdges){let J=h.get(M.importId);J!==void 0&&o.get(J.moduleId)?.externalSurface===!0&&g.add(J.moduleId)}let k=[],S=new Set,w=n.modules.filter(M=>M.externalSurface===!0);for(let M of w){let J=s.get(M.packageName)??[],oe=g.has(M.id),ie=[],tn=ne=>ne.code==="dependency-body"&&ne.anchor===void 0&&/syntax/u.test(ne.detail),xn=ne=>ne.code==="loader-escape"||ne.code==="dependency-body"&&ne.anchor===void 0&&!/syntax/u.test(ne.detail),y=J.filter(ne=>uf.has(ne.code)),_=J.filter(xn),D=J.filter(ne=>co.has(ne.code)||tn(ne)),F=J.filter(ne=>ne.code==="out-of-root"),Y=oe&&y.length===0,Z=_.length===0,te=!u&&D.length===0,ue=d===0&&F.length===0;oe||ie.push("(a) the package's entry was never followed to a module");for(let ne of[...y,..._,...D,...F]){if(ie.length>=lo)break;ie.push(mf(ne))}u&&ie.length<lo&&ie.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&ie.length<lo&&ie.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let le=["a","b","c","d"].filter(ne=>!{a:Y,b:Z,c:te,d:ue}[ne]),fe=le.length===0;fe&&S.add(M.id),k.push({packageName:B(M.packageName),module:B(String(M.id)),inReach:a.has(M.id),builtin:Js(M.packageName),followed:oe,d1:{a:Y,b:Z,c:te,d:ue},failing:le,transparent:fe,evidence:ie})}let v=new Set;for(let M of t)M.reach.kind==="unbounded"&&v.add(M.source);let I=M=>({module:B(String(M.module)),kind:M.kind,packageName:o.get(M.module)?.packageName??null}),C=new Set(w.filter(M=>Js(M.packageName)).map(M=>M.id)),E=new Set([...S,...C]),m=[],x=new Map,A=0,O=0,j=0,T=0,N=[],L=new Set;for(let M of t)M.reach.kind==="unbounded"&&L.add(M.cause);for(let M of t){if(M.reach.kind==="class-scope"){N.push({packageName:M.reach.packageName,container:M.reach.container});continue}if(M.reach.kind==="unbounded")continue;T++;let J=M.reach.anchor,oe=x.get(String(J));oe===void 0&&(oe={today:Un(n,J,v),d1:Un(n,J,v,S),d1Builtins:Un(n,J,v,E)},x.set(String(J),oe)),oe.d1Builtins.length>0&&j++,oe.today.length>0&&(A++,L.add(M.cause)),oe.d1.length>0&&O++,m.length<Qs&&m.push({anchor:B(String(J)),packageName:B(o.get(J)?.packageName??""),cause:M.cause,reachKind:M.reach.kind,blockersToday:oe.today.slice(0,qt).map(I),blockersUnderD1:oe.d1.slice(0,qt).map(I),blockedUnderD1Builtins:oe.d1Builtins.length>0,moreToday:Math.max(0,oe.today.length-qt),moreUnderD1:Math.max(0,oe.d1.length-qt)})}let R=r.filter(M=>M.anchor===void 0&&M.classScope===void 0),P=new Map(e.loadSites.map(M=>[M.importId,M])),K=new Map;for(let M of e.loadSites){let J=K.get(M.path);J===void 0?K.set(M.path,[M.shape]):J.push(M.shape)}let H=M=>{if(M.code!=="loader-escape")return!1;let J=M.escapes??[];if(J.length===0||J.some(ie=>ie!=="non-literal-load"))return!1;let oe=K.get(M.path)??[];return oe.length>0&&oe.every(ie=>ie==="relative-bounded")},z=R.slice(0,na).map(M=>({cause:e.causeOf(M.code),code:M.code,path:B(f(M.path)),attributedPackage:ta(f(M.path),i),...M.escapes!==void 0?{escapes:[...M.escapes]}:{},...M.reason!==void 0?{reason:M.reason}:{},d2Dischargeable:H(M)})),q={};for(let M of R){if(M.code!=="unresolved-specifier")continue;let J=M.reason??"(none)";q[J]=(q[J]??0)+1}let $=v.size===0?0:t.filter(M=>M.reach.kind==="unbounded").length,W=Math.max(0,$-R.length),X=$-R.filter(H).length,Ae=[],me=0,Ee=0,yn=0;for(let M of n.imports){if(M.specifierIsLiteral)continue;yn++;let J=a.has(M.moduleId),oe=P.get(String(M.id)),ie=oe?.shape??"unrecorded";J&&(me++,ie==="relative-bounded"&&Ee++),Ae.length<ea&&Ae.push({importId:B(String(M.id)),path:B(o.get(M.moduleId)?.path??""),shape:ie,text:B(oe?.text??""),inReach:J})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:u,appCapHit:p,unattributedOutOfRoot:d,blindUnbounded:W,unbounded:z,anchors:m,surfaces:k.slice(0,Zs),loads:Ae,counts:{modules:n.modules.length,reachMods:a.size,surfaces:w.length,surfacesInReach:k.filter(M=>M.inReach).length,transparentSurfaces:S.size,builtinSurfaces:C.size,anchors:T,anchorsBlockedToday:A,anchorsBlockedUnderD1:O,anchorsBlockedUnderD1Builtins:j,unbounded:$,loadsInReach:me,loadsRelativeBounded:Ee,unresolvedByReason:q,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,k.length-Zs),anchors:Math.max(0,T-Qs),loads:Math.max(0,yn-ea),unbounded:Math.max(0,R.length-na)}},reachedPackages:l,aborted:e.analysisAborted,unboundedFacts:$,unboundedHard:X,anchorsBlockedToday:A,anchorsBlockedUnderD1:O,anchorsBlockedUnderD1Builtins:j,loadsInReach:me,loadsAllBounded:me>0&&Ee===me,d2Eligible:e.rootBudget==="complete"&&!p&&!u,classScope:N,taintCausesToday:L}}var hf=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),gf=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function oa(e,n,t,r,o){if(t===null||e.reachedPackages.has(t.packageName))return;let i=e.classScope.some(A=>A.packageName===t.packageName&&A.container===t.container),a=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||i,l=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||l||n.unknownKind!==void 0&&hf.has(n.unknownKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":a?"taint":r>0?"oog":"unexpected",u=new Set(e.taintCausesToday);i&&u.add("dep-opaque");let p=e.aborted!==null?e.aborted:gf.find(A=>u.has(A)),f=d==="pre-2b"?n.tier==="unknown"&&(l?n.unknownKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?n.tier==="unknown"&&n.unknownKind==="dynamic-load":d==="taint"?n.tier==="unknown"&&n.unknownKind===p:d==="oog"?n.tier==="unknown"&&n.unknownKind==="analysis-cap":!1,h=t.verified&&o===!0,g=e.aborted===null&&e.unboundedFacts===0&&!i&&r===0,k=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,S=h&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,w=h&&d==="load"&&g&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,v=h&&(d==="load"||d==="taint")&&g&&k&&e.anchorsBlockedUnderD1===0,I=e.aborted===null&&e.unboundedHard===0&&!i&&r===0,C=h&&d==="load"&&I&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,E=h&&(d==="load"||d==="taint")&&I&&k&&e.anchorsBlockedUnderD1===0,m=h&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,x=h&&(d==="load"||d==="taint")&&I&&k&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:f,verified:t.verified,surfaceComplete:o,oog:r,classScoped:i,predicted:{d1:S,d2:w,d1d2:v,d2Amended:C,d1d2Amended:E,d1Builtins:m,d1d2AmendedBuiltins:x}}}import{readFileSync as yf,statSync as xf}from"node:fs";var fo=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,Wt=/^[A-Za-z0-9_$.-]{1,128}$/u,ia=64,sa=1024*1024,aa=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,la=/^[A-Za-z0-9@_.-]{1,128}$/u;function ye(e){throw new Error(`model claims rejected: ${e}`)}function uo(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Sf(e,n){uo(e)||ye(`${n}: edge is not an object`);let{kind:t,anchorExport:r,anchorContainer:o,calleePackage:i,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&ye(`${n}: edge kind`),(typeof r!="string"||!Wt.test(r))&&ye(`${n}: anchorExport ${JSON.stringify(r)}`),o!==null&&(typeof o!="string"||!Wt.test(o))&&ye(`${n}: anchorContainer`),(typeof i!="string"||!fo.test(i))&&ye(`${n}: calleePackage ${JSON.stringify(i)}`),a!==null&&(typeof a!="string"||!Wt.test(a))&&ye(`${n}: calleeContainer`),(typeof l!="string"||!Wt.test(l))&&ye(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:r,anchorContainer:o,calleePackage:i,calleeContainer:a,calleeExport:l}}function da(e){let n=xf(e).size;n>sa&&ye(`file is ${String(n)} bytes, over the ${String(sa)} cap`);let t;try{t=JSON.parse(yf(e,"utf8"))}catch(o){ye(`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}Array.isArray(t)||ye("root is not an array"),t.length>ia&&ye(`${String(t.length)} claims over cap ${String(ia)}`);let r=[];for(let o of t){uo(o)||ye("claim is not an object");let{packageName:i,modelId:a,range:l,edges:s}=o;(typeof i!="string"||!fo.test(i))&&ye("packageName"),(typeof a!="string"||!la.test(a))&&ye("modelId (identifier charset, 1-128 chars)"),r.some(u=>u.model.modelId===a)&&ye(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!uo(l)||typeof l.introduced!="string")&&ye(`${a}: range`),aa.test(l.introduced)||ye(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let d=l.fixedBefore;d!==null&&typeof d!="string"&&ye(`${a}: fixedBefore`),typeof d=="string"&&!aa.test(d)&&ye(`${a}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(s)||ye(`${a}: edges`),s.length>64&&ye(`${a}: ${String(s.length)} edges over cap ${String(64)}`),r.push({model:{packageName:i,modelId:a,edges:s.map(u=>Sf(u,a))},introduced:l.introduced,fixedBefore:d})}return r}var bf=["in-app-purchase@1-v1"];function po(e,n,t){let r=[],o=[],i=[],a=(l,s,d,u)=>{o.push(d),i.push({modelId:u??l.model.modelId,status:s,reason:d,edgeCount:l.model.edges.length})};for(let l of e){if(!fo.test(l.model.packageName)||!la.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&bf.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let s=n(l.model.packageName);if(typeof s!="string"&&s!==void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} installed at more than one version (${s.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(s===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let d;try{d=bn(s,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${s} not an exact triple \u2014 inert (never guessed)`);continue}if(!d){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${s} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}r.push(l.model),i.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:r,notes:o,dispositions:i}}var Ef=4,wf={additiveForms:!0,namelessExports:!0},vf=new Set(["dep-opaque","dynamic-load","dispatch"]),If={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function go(e,n,t){return e.tier==="unknown"&&If[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&vf.has(e.unknownKind)&&n!==null&&n.verified}var Af=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),He=class extends Error{},yo="cupel/coverage-gap",ya={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function it(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function ma(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function ha(e,n,t){let r=new Map(e.modules.map(a=>[a.path,a.id])),o=e.modules[0]?.id;if(o===void 0)return[];let i=n.map(a=>({source:r.get(a.path)??o,cause:ya[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));for(let a of t)i.push({source:o,reach:{kind:"unbounded"},cause:a});return i}function mo(e,n,t,r,o){let i=t.filter(a=>a.exportName!==null&&(r===1||o||a.verified!==1));return i.length>0?i.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function _f(e,n){let t;try{t=st(e)}catch{return!0}let r=3,o=(i,a)=>{if(a>r)return!1;let l;try{l=ga(i)}catch{return!1}for(let s of l){if(s==="node_modules"||s.startsWith("."))continue;let d=nn.join(i,s),u;try{u=ho(d)}catch{continue}if(!u.isDirectory())continue;let p=nn.relative(t,d).split(nn.sep).join("/");try{if(ho(nn.join(d,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(o(d,a+1))return!0}return!1};return o(t,1)}function Nf(e,n){let t="";for(let r of e)r.rel!==""&&n.startsWith(`${r.rel}/`)&&r.rel.length>t.length&&(t=r.rel);return t}function Rf(e,n,t){let r=[];if(t&&r.push("nested-app-root"),n==="")return[...r,"manifest-unreadable"];let o;try{if(o=st(nn.resolve(e,n)),!o.startsWith(st(e)+nn.sep))return[...r,"manifest-unreadable"]}catch{return[...r,"manifest-unreadable"]}let i;try{let u=nn.join(o,"package.json");if(!ho(u).isFile())return[...r,"manifest-unreadable"];i=kf(u,"utf8")}catch{return[...r,"manifest-unreadable"]}let a;try{a=JSON.parse(i)}catch{return[...r,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...r,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&r.push("bin");let s=["preinstall","install","postinstall","prepare","prepublish"],d=l.scripts;if(typeof d=="object"&&d!==null){let u=d;s.some(p=>typeof u[p]=="string")&&r.push("install-script")}return(l.gypfile===!0||Cf(o))&&r.push("native-artifact"),r}function Cf(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=nn.join(e,n),r;try{r=ga(t)}catch{continue}if(r.some(o=>o.endsWith(".node")))return!0}return!1}function xa(e){return JSON.stringify([e.name,e.version,e.lockKey])}function Of(e,n,t){return new Map(n.map(r=>[xa(r),Rf(e,r.lockKey,t)]))}function $f(e){let n=new Map;for(let t of e){let r=n.get(t.advisory.id);r===void 0?n.set(t.advisory.id,[t]):r.push(t)}return n}function Mf(e,n,t,r,o,i,a){let{finding:l}=ot(e,n,{name:t.name,version:t.version,devOnly:t.dev,outOfGraphExecution:a(t)},it(r.advisory.id,t.name,r.affected),null,o,i);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function ot(e,n,t,r,o,i,a){let l=dr({graph:e,installed:t,range:r,symbol:o,coverage:null,incompleteness:i,analysisAborted:a});if(n!==null&&o!==null&&go(l,o,"base")){let s=Vn(e,n.modulesById,n.reachMods,o,n.records);if(s!==null)return{finding:l,hit:s}}return{finding:l,hit:null}}function Df(e,n){let t=new Set,r=[];for(let o of e.packages)for(let{advisory:i,affected:a}of n.advisoriesForPackage("npm",o.name)){let l=it(i.id,o.name,a),s;try{s=bn(o.version,l)}catch{continue}if(s)for(let d of n.symbolsForAffected(a.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let u=`${o.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(u)||(t.add(u),r.push({packageName:o.name,packageRootRel:o.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return r.sort((o,i)=>`${o.packageRootRel}\0${o.container}\0${o.sourcePath}`.localeCompare(`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`)),r.slice(0,Ot)}function Tf(e,n,t){let r=new Map(e.functions.map(l=>[l.id,l])),o=new Map(e.classes.map(l=>[l.id,l.name])),i=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let s=i.get(l.callSiteId);if(s===void 0)continue;let d=r.get(s.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=r.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:d.id})}return a}function Pf(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),r=new Map(e.functions.map(u=>[u.id,u])),o=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&o.add(u.id);let i=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let p=i.get(u.exportId);if(p===void 0||!n.has(p.moduleId))continue;let f=r.get(u.target.functionId);f===void 0||t.get(f.moduleId)?.externalSurface===!0||o.add(f.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let p=a.get(u.callSiteId);if(p===void 0)continue;let f=l.get(p);f===void 0?l.set(p,[u.calleeFunctionId]):f.push(u.calleeFunctionId)}let s=new Set(o),d=[...o];for(;d.length>0;){let u=d.pop();if(u!==void 0)for(let p of l.get(u)??[])s.has(p)||(s.add(p),d.push(p))}return s}function Lf(e,n,t,r){for(let o of n){if(o.modelId!==e.modelId||o.anchor.packageName!==e.anchorPackage||o.anchor.exportName!==e.entryExport)continue;let i=t.filter(l=>l.packageName===o.anchor.packageName&&l.exportName===o.anchor.exportName&&l.container===o.anchor.container),a=i.find(l=>l.resolution==="resolved")??i[0];if(a!==void 0)return r.has(a.callerFunctionId)}return null}function Ff(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(i=>i.modelId!==void 0);let r=new Set(t),o=i=>r.has(i)||r.has(Fe[i]??"");return e.some(i=>i.tier==="unknown"&&i.unknownKind!==void 0&&o(i.unknownKind)||i.modelPromotedFromKind!==void 0&&o(i.modelPromotedFromKind))}function xo(e){let n=st(e.dir),t=e.reader??fr(e.shardPath),r=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(kn))throw new He(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${kn})`);let o=null;if(e.summaryShadow!==void 0)try{o=Ys(e.summaryShadow)}catch(y){throw new He(`--summary-shadow facts dir rejected: ${y instanceof Error?y.message:String(y)}`)}let i=null;if(e.modelShadow!==void 0)try{i=da(e.modelShadow.claimsPath)}catch(y){throw new He(`--model-shadow claims rejected: ${y instanceof Error?y.message:String(y)}`)}let a=so(n,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{}}),l=Ls(n,a,e.installedSet);if(l.truncated){let y=l.perRoot.filter(_=>_.truncated).map(_=>_.rootRel===""?"the scan root":`\`${_.rootRel}\``);throw new He(`the dependency enumeration hit a hard cap and is incomplete at ${y.length>0?y.join(", "):"the union across roots"} (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let s=js(l.packages),d=e.entry??[],u=d.length>0?Es(n,d):{entrypoints:[],rejected:[]},p=u.rejected,f=ks(n,a.roots),h=[...new Set([...f.entrypoints,...u.entrypoints])],g=[...f.sources];for(let y of u.entrypoints)f.entrypoints.includes(y)||g.push({source:"--entry",specifier:y,entrypoint:y,launch:!1,root:Nf(a.roots,y)});let k=Df(l,t),S=e.bindingForms??wf,w=e.callablePackageResolver===!0,v=e.tsconfigPaths!==!1,I=_f(n,rt(g)),C=Of(n,l.packages,I),E=y=>C.get(xa(y))??["manifest-unreadable"],m=Gr({appRoot:n,entrypoints:h,depClassAnchors:k,bindingForms:S,callablePackageResolver:w,tsconfigPaths:v}),x=m.graph,A=lr(x),O=[...f.diagnostics,...Hr(f),...Xr(f,h.length),...oo(a,g),...m.diagnostics],j=ma(h.length,x),T=[...l.gaps,...Ks(a)],N=Bs(T),L=ha(x,O,N),R=n;try{R=st(n)}catch{}let P=ra({graph:x,facts:L,diagnostics:O,analysisAborted:j,loadSites:m.loadSites,conditionUnions:m.conditionUnions,provenAbsent:m.provenAbsent,appRootReal:R,rootBudget:a.budget,causeOf:y=>ya[y]}),K=t.allModels?.()??[],H=po(K.map(y=>({model:{packageName:y.packageName,modelId:y.modelId,edges:y.edges},introduced:y.introduced,fixedBefore:y.fixedBefore})),s),z=H.models.length>0?Zn(x,H.models).delta:null,q=z!==null?{records:z.records,reachMods:Je(x),modulesById:new Map(x.modules.map(y=>[y.id,y]))}:null,$=[],W=new Map,X=Af(),Ae=[],me=[];for(let y of l.packages)for(let[,_]of $f(t.advisoriesForPackage("npm",y.name))){let D=_[0];if(D!==void 0){let te=W.get(D.advisory.id),ue=_.map(le=>le.affected);te===void 0?W.set(D.advisory.id,{advisory:D.advisory,ranges:ue}):te.ranges.push(...ue)}let F=_.filter(te=>Mf(x,q,y,te,L,j,E)),Y=F.length>0?F:_.slice(0,1),Z=F.length===0;for(let{advisory:te,affected:ue}of Y){let le=it(te.id,y.name,ue),fe=te.cveId??te.id,ne=Z?[]:t.symbolsForAffected(ue.id),rn=ne.filter(de=>de.exportName===null),on=mo(te.id,y.name,ne,ue.surfaceComplete,r),Le=ot(x,q,{name:y.name,version:y.version,devOnly:y.dev,outOfGraphExecution:E(y)},le,null,L,j).finding;if(Le.decidedAtStage==="presence"||Le.decidedAtStage==="version-match"){X[Le.tier]+=1,$.push({...Le,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:le.surfaceComplete,advisoryId:te.id,displayId:fe,packageName:y.name,version:y.version,symbolName:null,symbolPath:null,severity:te.severity,packageLocation:zt(l,y)});continue}for(let de of on){let{finding:Xe,hit:Ce}=ot(x,q,{name:y.name,version:y.version,devOnly:y.dev,outOfGraphExecution:E(y)},le,de,L,j),Ye=Xe,cn,U;Ce!==null&&de!==null&&(cn=Ce.modelId,U=Xe.unknownKind,Ye={basis:void 0,tier:Ce.tier,decidedAtStage:Xe.decidedAtStage,reason:`boundary model ${Ce.modelId}: ${Ce.anchorPackage}.${Ce.entryExport} reaches ${de.exportName} [${Ce.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:gt(de),path:void 0,unresolvedSites:Xe.unresolvedSites,unresolvedEvidence:Xe.unresolvedEvidence}),X[Ye.tier]+=1;let G=oa(P,Ye,de,E(y).length,le.surfaceComplete),Q={...Ye,...G!==void 0?{adr105:G}:{},modelId:cn,modelPromotedFromKind:U,surfaceComplete:le.surfaceComplete,advisoryId:te.id,displayId:fe,packageName:y.name,version:y.version,symbolName:de?.exportName??null,symbolPath:de?.sourcePath||null,severity:te.severity,packageLocation:zt(l,y)};$.push(Q);let we=new Set(["dep-opaque","dynamic-load","dispatch"]);o!==null&&Q.tier==="unknown"&&Q.decidedAtStage==="symbol-reachable"&&Q.unknownKind!==void 0&&we.has(Q.unknownKind)&&de!==null&&Ae.push({finding:Q,symbol:de}),i!==null&&Q.tier==="unknown"&&de!==null&&me.push({finding:Q,symbol:de})}for(let de of rn)X.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:le.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${fe} carries a ${de.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:te.id,displayId:fe,packageName:y.name,version:y.version,symbolName:null,symbolPath:null,severity:te.severity,packageLocation:zt(l,y)})}}for(let y of T)X.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:y.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:yo,displayId:yo,packageName:y.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:Fs(l,y)});let Ee=X["reachable-high"]+X["reachable-medium"],yn=e.failOnReachable===!0&&Ee>0,Kn=Ff($,X.unknown,e.failOnUnknown),M=e.requireCompleteDenial===!0&&$.some(y=>y.tier==="not-reachable"&&y.basis==="loader-assumption"),J=yn||Kn||M?2:0,oe;if(o!==null){let y=Je(x),_=new Map(x.modules.map(F=>[F.id,F])),D=[];for(let{finding:F,symbol:Y}of Ae){let Z=sr(x,_,y,Y,o,Ef);D.push({advisoryId:F.advisoryId,packageName:F.packageName,symbolName:F.symbolName,unknownKind:F.unknownKind??null,wouldPromote:Z!==null,...Z!==null?{anchorPackage:Z.anchorPackage,entryExport:Z.entryExport,viaPackages:Z.viaPackages,totalHops:Z.totalHops}:{}})}oe={records:D}}let ie;if(i!==null&&e.modelShadow!==void 0){let y=e.modelShadow.widened===!0?"widened":"base",{models:_,notes:D,dispositions:F}=po(i,s,{shadowConsultDenylisted:!0}),{delta:Y}=Zn(x,_),Z=Je(x),te=new Map(x.modules.map(U=>[U.id,U])),ue=Tf(x,te,Z),le=Pf(x),fe=Y.records.some(U=>ue.some(G=>G.packageName===U.anchor.packageName&&G.exportName===U.anchor.exportName&&G.container===U.anchor.container)),ne=[],rn=Date.now();for(let{finding:U,symbol:G}of me){let Q=Y.records,we=go(U,G,y),xe=we?Vn(x,te,Z,G,Q):null,ce=Y.records.filter(ve=>ve.callee.packageName===G.packageName&&ve.callee.exportName===G.exportName&&ve.callee.container===G.container||ve.callee.packageName===G.packageName&&ve.callee.realFunctionId!==null);ne.push({advisoryId:U.advisoryId,packageName:U.packageName,symbolName:U.symbolName,unknownKind:U.unknownKind??null,decidedAtStage:U.decidedAtStage,consultSurface:y,noHitReason:xe!==null?null:we?fe?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:xe!==null?Lf(xe,Q,ue,le):null,verdictBefore:U.tier,verdictAfter:xe!==null?"reachable-low":U.tier,wouldPromote:xe!==null,...xe!==null?{modelId:xe.modelId,anchorPackage:xe.anchorPackage,entryExport:xe.entryExport,pathLabels:xe.pathLabels,calleeBinding:ce.find(ve=>ve.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:we?ce.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${ce[0]?.anchor.packageName??"?"}#${ce[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let on=Date.now()-rn,Le=F.map(U=>{if(U.status!=="active")return{modelId:U.modelId,state:U.status,reason:U.reason,edgesLowered:0,edgesReferenceGated:0};let G=Y.records.filter(we=>we.modelId===U.modelId).length;if(G>0)return{modelId:U.modelId,state:"lowered",reason:null,edgesLowered:G,edgesReferenceGated:U.edgeCount-G};let Q=Y.notes.find(we=>we.startsWith(`model ${U.modelId}:`)||we.startsWith(`model-edge ${U.modelId}:`));return{modelId:U.modelId,state:"refused",reason:Q??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:U.edgeCount}}),de=ne.filter(U=>U.wouldPromote).length,Xe=X.unknown-de,Ce=X["reachable-high"]+X["reachable-medium"],Ye=U=>({none:0,"fail-on-reachable":Ce>0?2:0,"fail-on-unknown":U>0?2:0,both:Ce>0||U>0?2:0});ie={records:ne,notes:[...D,...Y.notes],laneStates:Le,exitCodes:{baseline:Ye(X.unknown),withModels:Ye(Xe)},overlayWallMs:on},ua(nn.dirname(e.modelShadow.outPath),{recursive:!0});let cn=`${e.modelShadow.outPath}.tmp-${ca(8).toString("hex")}`;pa(cn,`${JSON.stringify(ie,null,2)}
+`,{encoding:"utf8",flag:"wx"}),fa(cn,e.modelShadow.outPath)}let tn;if(e.bindingShadow!==void 0){let y=Date.now(),_=U=>H.models.length>0?{records:Zn(U,H.models).delta.records,reachMods:Je(U),modulesById:new Map(U.modules.map(G=>[G.id,G]))}:null,D=(U,G,Q,we)=>{let xe=[];for(let ce of l.packages)for(let{advisory:ve,affected:Sn}of t.advisoriesForPackage("npm",ce.name)){let Rn=it(ve.id,ce.name,Sn),fl=mo(ve.id,ce.name,t.symbolsForAffected(Sn.id),Sn.surfaceComplete,r);for(let jo of fl){let{finding:Ko,hit:or}=ot(U,we,{name:ce.name,version:ce.version,devOnly:ce.dev,outOfGraphExecution:E(ce)},Rn,jo,G,Q);xe.push({advisoryId:ve.id,packageName:ce.name,symbolName:jo?.exportName??null,tier:or!==null?or.tier:Ko.tier,unknownKind:or!==null?null:Ko.unknownKind??null})}}return xe},F=U=>{let G=Gr({appRoot:n,entrypoints:h,depClassAnchors:k,bindingForms:U,callablePackageResolver:w,tsconfigPaths:v}),Q=[...f.diagnostics,...Hr(f),...Xr(f,h.length),...oo(a,g),...G.diagnostics];return{graph:G.graph,inc:ha(G.graph,Q,N),aborted:ma(h.length,G.graph),live:_(G.graph),applicability:G.bindingApplicability}},Y=U=>{let G=F(U);return D(G.graph,G.inc,G.aborted,G.live)},Z=F({}),te=D(Z.graph,Z.inc,Z.aborted,Z.live),ue=D(x,L,j,q);if(ue.length!==te.length)throw new He("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let le=(U,G)=>G.tier!==U.tier||G.unknownKind!==U.unknownKind,fe=te.some((U,G)=>{let Q=ue[G];return Q!==void 0&&le(U,Q)}),ne=fe?Y({additiveForms:!0}):null,rn=fe?Y({namelessExports:!0}):null,on=0,Le=te.map((U,G)=>{let Q=ue[G];if(Q===void 0||Q.advisoryId!==U.advisoryId||Q.packageName!==U.packageName||Q.symbolName!==U.symbolName)throw new He("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let we={advisoryId:U.advisoryId,packageName:U.packageName,symbolName:U.symbolName,unknownKind:U.unknownKind,verdictBefore:U.tier,verdictAfter:Q.tier,wouldPromote:Q.tier!==U.tier&&(Q.tier==="reachable-high"||Q.tier==="reachable-medium"||Q.tier==="reachable-low")};if(!le(U,Q)||ne===null||rn===null)return we;on+=1;let xe=ne[G],ce=rn[G],ve=xe!==void 0&&le(U,xe),Sn=ce!==void 0&&le(U,ce);return{...we,attributedArm:ve&&!Sn?"additiveForms":Sn&&!ve?"namelessExports":"both",...xe!==void 0?{verdictArmA:xe.tier}:{},...ce!==void 0?{verdictArmB:ce.tier}:{}}}),de={...X};te.forEach((U,G)=>{let Q=ue[G];Q!==void 0&&Q.tier!==U.tier&&(de[Q.tier]-=1,de[U.tier]+=1)});let Xe=(U,G)=>({none:0,"fail-on-reachable":U>0?2:0,"fail-on-unknown":G>0?2:0,both:U>0||G>0?2:0}),Ce;if(H.models.length>0&&q!==null){Ce=[];for(let U of l.packages)for(let{advisory:G,affected:Q}of t.advisoriesForPackage("npm",U.name)){let we=it(G.id,U.name,Q),xe=mo(G.id,U.name,t.symbolsForAffected(Q.id),Q.surfaceComplete,r);for(let ce of xe){if(ce===null||!ce.verified)continue;let ve=ot(Z.graph,Z.live,{name:U.name,version:U.version,devOnly:U.dev,outOfGraphExecution:E(U)},we,ce,Z.inc,Z.aborted);if(!(ve.hit===null&&go(ve.finding,ce,"base")))continue;let Rn=Vn(x,q.modulesById,q.reachMods,ce,q.records);Ce.push({advisoryId:G.id,packageName:U.name,symbolName:ce.exportName,modelWouldPromote:Rn!==null,...Rn!==null?{modelId:Rn.modelId}:{},anchorCleared:Rn!==null})}}}let Ye=$.some(U=>U.modelId!==void 0);tn={records:Le,deltas:on,exitCodes:{baseline:Xe(de["reachable-high"]+de["reachable-medium"],de.unknown+(Ye?1:0)),withBindingForms:Xe(X["reachable-high"]+X["reachable-medium"],X.unknown+(Ye?1:0))},dualRunWallMs:Date.now()-y,...m.bindingApplicability!==void 0?{applicability:m.bindingApplicability}:{},...Ce!==void 0?{modelProbe:Ce}:{}},ua(nn.dirname(e.bindingShadow.outPath),{recursive:!0});let cn=`${e.bindingShadow.outPath}.tmp-${ca(8).toString("hex")}`;pa(cn,`${JSON.stringify(tn,null,2)}
+`,{encoding:"utf8",flag:"wx"}),fa(cn,e.bindingShadow.outPath)}let xn=K.length>0||H.notes.length>0?{active:H.models.length,stored:K.length,promoted:$.filter(y=>y.modelId!==void 0).length,notes:[...H.notes,...z!==null?z.notes:[]]}:void 0;return{...oe!==void 0?{summaryShadow:oe}:{},...ie!==void 0?{modelShadow:ie}:{},...tn!==void 0?{bindingShadow:tn}:{},...xn!==void 0?{modelLane:xn}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:$,counts:X,analyzerDiagnostics:O,analysisAborted:j,rejectedEntries:p,entrypointSources:g,entrypointGaps:[...f.gaps,...f.surfaceGaps],entrypointObservations:f.observations,framework:f.framework,unresolved:A,advisories:[...W.values()],rootSet:a,exitCode:J,adr105:P.report}}finally{e.reader===void 0&&t.close()}}var jf="cupel",Kf="reachability-first SCA \u2014 verdict + call path + confidence";function So(e){return[`${jf} v${e} \u2014 ${Kf}`,`cascade: ${Wo.join(" \u2192 ")}`,`verdicts: ${Go.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
+`)}var Bf=new Set([...cr,...ur]);function hn(e,n,t){let r=e[n+1];if(r===void 0||r.startsWith("--"))throw new Error(`${t} requires a value`);return r}function zf(e){let n=e.split(",").map(o=>o.trim()),t=[...cr,...ur].join(", ");if(n.length===0||n.some(o=>o===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let r=[];for(let o of n){if(!Bf.has(o))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(o)}; valid: ${t}`);r.push(o)}return r}function Sa(e){let n=".",t,r,o=!1,i=!1,a=!1,l=!1,s=!1,d,u,p,f=!1,h=!1,g,k=!1,S=!0,w=!1,v,I=[],C=[];for(let E=0;E<e.length;E+=1){let m=e[E];if(m==="--require-complete-denial"){i=!0;continue}if(m==="--fail-on-reachable")o=!0;else if(m==="--fail-on-unknown")a="all";else if(m!==void 0&&m.startsWith("--fail-on-unknown="))a=zf(m.slice(18));else if(m==="--offline")l=!0;else if(m==="--sarif")t=hn(e,E,"--sarif"),E+=1;else if(m==="--shard")r=hn(e,E,"--shard"),E+=1;else if(m==="--entry")I.push(hn(e,E,"--entry")),E+=1;else if(m==="--root")C.push(hn(e,E,"--root")),E+=1;else if(m==="--summary-shadow")d=hn(e,E,"--summary-shadow"),E+=1;else if(m==="--model-shadow")u=hn(e,E,"--model-shadow"),E+=1;else if(m==="--model-shadow-out")p=hn(e,E,"--model-shadow-out"),E+=1;else if(m==="--model-shadow-widened")f=!0;else if(m==="--binding-shadow")h=!0;else if(m==="--binding-shadow-out")g=hn(e,E,"--binding-shadow-out"),E+=1;else if(m==="--x-partial-rows")k=!0;else if(m==="--no-tsconfig-paths")S=!1;else if(m==="--x-tsconfig-paths")S=!0;else if(m==="--push")w=!0;else if(m!==void 0&&m.startsWith("--auth=")){let x=m.slice(7);if(x!=="oidc"&&x!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(x)}`);v=x}else{if(m!==void 0&&m.startsWith("--"))throw new Error(`unknown flag ${m}`);m!==void 0&&!s&&(n=m,s=!0)}}if(u===void 0!=(p===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(f&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(g!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(v!==void 0&&!w)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:r,failOnReachable:o,requireCompleteDenial:i,failOnUnknown:a,offline:l,entry:I,root:C,summaryShadow:d,modelShadow:u,modelShadowOut:p,modelShadowWidened:f,push:w,auth:v,bindingShadow:h,bindingShadowOut:g,partialRows:k,tsconfigPaths:S}}import{chmodSync as Xf,mkdirSync as Yf,readFileSync as Jf,renameSync as Zf,statSync as Qf,unlinkSync as ep,writeFileSync as np}from"node:fs";import{randomBytes as tp}from"node:crypto";import{homedir as rp}from"node:os";import _n from"node:path";import{createPublicKey as Uf,verify as Vf}from"node:crypto";function Ue(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function ba(e,n={}){let t=n.maxBytes??1073741824,r=n.timeoutMs??3e4,{get:o}=await import("node:https");return await new Promise((i,a)=>{let l=o(e,n.headers!==void 0?{headers:n.headers}:{},s=>{let d=s.statusCode??0;if(d<200||d>=300){s.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let u=[],p=0;s.on("data",f=>{if(p+=f.length,p>t){s.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(f)}),s.on("end",()=>{i(Buffer.concat(u))}),s.on("error",a)});l.on("error",a),l.setTimeout(r,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(r)}ms`))})})}async function at(e,n,t,r,o,i=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((s,d)=>{let u=a(n,{method:e,headers:t},p=>{let f=[],h=0;p.on("data",g=>{if(h+=g.length,h>o){p.destroy(),d(new Error(`${e} to ${l} returned more than ${String(o)} bytes`));return}f.push(g)}),p.on("end",()=>{s({status:p.statusCode??0,body:Buffer.concat(f).toString("utf8")})}),p.on("error",()=>{d(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{d(new Error(`${e} to ${l} failed`))}),u.setTimeout(i,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(i)}ms`))}),r!==void 0&&u.write(r),u.end()})}var ee=class extends Error{constructor(n){super(n),this.name="DistError"}},qf=Buffer.from("302a300506032b6570032100","hex"),Wf=32;function va(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===Wf)try{return Uf({key:Buffer.concat([qf,n]),format:"der",type:"spki"})}catch{return}}function bo(e,n,t){for(let r of t){let o=va(r);if(o!==void 0)try{if(Vf(null,e,o,n))return!0}catch{}}return!1}function Ia(e){return e.some(n=>va(n)!==void 0)}var Gf=/^[0-9a-f]{64}$/u,Hf=/^[a-z0-9-]+$/u;function ka(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new ee(`${n} must be an object`);return e}function Ea(e,n){if(!Array.isArray(e))throw new ee(`${n} must be an array`);return e}function Gt(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new ee(`${n} must be an integer`);return e}function Ht(e,n){if(typeof e!="string")throw new ee(`${n} must be a string`);return e}function wa(e,n){let t=Ht(e,n);if(Number.isNaN(Date.parse(t)))throw new ee(`${n} is not a valid timestamp: ${t}`);return t}function ko(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new ee("distribution index is not valid JSON")}let r=ka(t,"index"),o=Gt(r.schema_version,"schema_version");if(o!==n.supportedIndexSchemaVersion)throw new ee(`index schema_version ${String(o)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let i=Gt(r.sequence,"sequence");if(i<0)throw new ee("sequence must be non-negative");let a=wa(r.generated,"generated"),l=Ea(r.shards,"shards"),s;for(let g of l){let k=ka(g,"shard entry"),S=Ht(k.ecosystem,"ecosystem");if(!Hf.test(S))throw new ee(`ecosystem ${JSON.stringify(S)} is malformed`);if(S===n.ecosystem){s=k;break}}if(s===void 0)throw new ee(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);wa(s.built,"built");let d=Gt(s.db_schema_version,"db_schema_version");if(d<1)throw new ee("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new ee(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=Ht(s.sha256,"sha256");if(!Gf.test(u))throw new ee(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let p=Gt(s.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new ee(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let f=Ea(s.urls,"urls");if(f.length===0)throw new ee("urls must be a non-empty array");let h=[];for(let g of f){let k=Ht(g,"url");try{h.push(Ue(k,n.shardHosts))}catch(S){throw new ee(`refusing shard url ${JSON.stringify(k)}: ${S.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:p,dbSchemaVersion:d,urls:h,sequence:i,generated:a}}var Aa="CUPEL_CONFIG_DIR",_a="credentials.json",Eo="cpd_",op="cpl_",ip=Eo.length+6+32,sp=200,ap=/^[A-Za-z0-9_-]+$/u,lt=class extends ee{constructor(n){super(n),this.name="StoredCredentialError"}};function Na(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=rp();if(process.platform==="darwin")return _n.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let i=e.APPDATA,a=i!==void 0&&i!==""?i:_n.join(t,"AppData","Roaming");return _n.join(a,"cupel")}let r=e.XDG_CONFIG_HOME,o=r!==void 0&&r!==""?r:_n.join(t,".config");return _n.join(o,"cupel")}function Xt(e){return _n.join(Na(e),_a)}function wo(e){let n=e.trim();return n.startsWith(op)?{ok:!1,reason:"push-token"}:n.startsWith(Eo)?n.length<ip||n.length>sp?{ok:!1,reason:"malformed"}:ap.test(n.slice(Eo.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function Ra(e,n){let t=Na(e),r=_n.join(t,_a);Yf(t,{recursive:!0,mode:448}),process.platform!=="win32"&&Xf(t,448);let o=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),i=`${r}.tmp-${tp(8).toString("hex")}`;return np(i,`${o}
+`,{flag:"wx",mode:384}),Zf(i,r),r}function Ca(e){let n=Xt(e),t;try{t=Qf(n)}catch(a){if(a instanceof Error&&a.code==="ENOENT")return;throw a}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new lt(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let r;try{r=JSON.parse(Jf(n,"utf8"))}catch{throw new lt(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let o=typeof r=="object"&&r!==null&&"delivery_token"in r?r.delivery_token:void 0,i=wo(typeof o=="string"?o:"");if(!i.ok)throw new lt(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return i.token}function Oa(e){try{return ep(Xt(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var dt="CUPEL_DELIVERY_TOKEN",vo=class extends ee{constructor(n){super(n),this.name="NoDeliveryTokenError"}},Io=class extends ee{constructor(n){super(n),this.name="DeliveryCredentialError"}};function lp(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function $a(e,n,t=()=>{}){let r=lp(e)??t();return r!==void 0?()=>Promise.resolve(r):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function Ma(e){if(e===void 0)throw new vo(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${dt} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new Io(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var dp="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function cp(){return new Promise(e=>{let n=process.stdin;process.stderr.write(dp),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",r=i=>{n.setRawMode(!1),n.pause(),n.removeListener("data",o),process.stderr.write(`
+`),i===null&&process.exit(130),e(i)},o=i=>{for(let a of i){if(a==="")return r(null);if(a==="\r"||a===`
+`)return r(t);if(a==="\x7F"||a==="\b"){t=t.slice(0,-1);continue}t+=a}};n.on("data",o)})}async function up(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function Da(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${B(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
+`),!0)}async function Ta(e){if(Da(e,"login"))return 1;let n=process.stdin.isTTY?await cp():await up(),t=wo(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
+`:`cupel login: that is not a delivery token. Paste the whole token as shown once on app.cupel.sh (Settings \u2192 Tokens); it starts with cpd_.
+`),1;let r=Ra(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${r} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${dt} in the environment still wins, and \`cupel logout\` forgets it.
+`),0}function Pa(e){if(Da(e,"logout"))return 1;let n=Xt(process.env);return Oa(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
+`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${Aa} would point elsewhere).
+`),0}import{randomBytes as fp,createHash as pp}from"node:crypto";import{mkdirSync as mp,readFileSync as hp,renameSync as gp,writeFileSync as yp}from"node:fs";import{homedir as xp}from"node:os";import Nn from"node:path";var Ao="latest.json",_o="latest.json.sig";function Yt(e){return pp("sha256").update(e).digest("hex")}function La(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=xp();if(process.platform==="darwin")return Nn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let o=process.env.LOCALAPPDATA,i=o!==void 0&&o!==""?o:Nn.join(n,"AppData","Local");return Nn.join(i,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,r=t!==void 0&&t!==""?t:Nn.join(n,".cache");return Nn.join(r,"cupel","shards")}function No(e,n,t){return Nn.join(e,`${n}-${t}.sqlite`)}function Jt(e,n){mp(Nn.dirname(e),{recursive:!0});let t=`${e}.tmp-${fp(8).toString("hex")}`;yp(t,n,{flag:"wx"}),gp(t,e)}function ct(e){try{return hp(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function Fa(e,n,t,r){let o=No(e,n,t),i=ct(o);if(i===void 0)return;let a=Yt(i);if(a!==t)throw r(`cached shard ${o} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:o,bytes:i}}var ja="api.cupel.sh",Zt=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Ka=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Qt from"node:path";var Sp="/v1/resolve",Ro=1024*1024,Co=4096,Ba=Ro+Co+64*1024,bp=8,kp=2048,Ep=/^[A-Za-z0-9+/]+={0,2}$/u,wp=3e4,ke=class extends ee{constructor(n){super(n),this.name="DeliveryRefusedError"}},ut=class extends ee{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},ft=class extends ee{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function vp(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ip(e){if(typeof e!="string"||e.length===0)throw new ke("the delivery response carried no index signature");if(e.length>Co||!Ep.test(e))throw new ke("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new ke("the delivery response's index signature is not canonical base64");return n}function Ap(e){if(typeof e!="string"||e.length===0)throw new ke("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Ro)throw new ke("the delivery response's index is larger than one can be");return n}function _p(e){if(!Array.isArray(e)||e.length===0)throw new ke("the delivery response named no shard urls");if(e.length>bp)throw new ke("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>kp)throw new ke("the delivery response carried a malformed shard url");n.push(t)}return n}function Np(e,n){throw e===401||e===403?new ke(`${n} rejected the delivery credential \u2014 check ${dt} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new ke(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new ft(`${n} holds nothing newer than the shard index already cached`):e===429?new ut(`${n} rate-limited the delivery request`):e>=500?new ut(`${n} answered ${String(e)}`):new ke(`${n} refused the delivery request with status ${String(e)}`)}async function za(e,n,t,r,o=wp){let i=Ue(`https://${e}${Sp}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await r(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,o)}catch{throw new ut(`${e} could not be reached`)}if(l.status!==200&&Np(l.status,e),Buffer.byteLength(l.body,"utf8")>Ba)throw new ke(`${e} returned a delivery response larger than one can be`);let s;try{s=JSON.parse(l.body)}catch{throw new ke(`${e} returned a delivery response that is not JSON`)}if(!vp(s))throw new ke(`${e} returned a delivery response that is not an object`);return{index:Ap(s.index),sig:Ip(s.signature),shardUrls:_p(s.shardUrls)}}var Ua=async(e,n,t,r)=>await at("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Ba,r);var Rp=8,$o=class extends ee{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Oo(e){return`${e.origin}${e.pathname}`}function Va(e,n,t){let r=new Map;for(let a of n)r.set(Oo(a),a);let o=[],i=[];for(let a of e.slice(0,Rp)){let l;try{l=Ue(a,t)}catch(u){i.push(u.message);continue}if(l.hash!==""){i.push("a candidate carried a fragment");continue}let s=r.get(Oo(l));if(s===void 0){i.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${Oo(s)}${l.search}`);o.push(Ue(d.href,t))}if(o.length===0)throw new $o(`no pre-signed shard url matched the signed index (${i.length===0?"none offered":i.join("; ")})`);return o}var Op=1,$p=1024*1024*1024;function Mp(e=Zt){return{async resolve(n){return await za(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Ua)},async fetchShard(n,t){return Ue(n.href,e),await ba(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Mo(e){return e instanceof Error?e.message:String(e)}function qa(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Op,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:$p}}function Dp(e){let n=ct(Qt.join(e.cacheDir,Ao)),t=ct(Qt.join(e.cacheDir,_o));if(!(n===void 0||t===void 0)&&bo(n,t,e.pubkeys))try{return ko(n,qa(e))}catch{return}}function Wa(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let r=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(r)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function er(e,n,t){let r=Fa(n.cacheDir,e.ecosystem,e.sha256,o=>new ee(o));if(r===void 0)throw new ee(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:r.path,fromCache:!0,warnings:[...t,...Wa(e,n)],sequence:e.sequence}}async function Tp(e,n,t,r){let o=No(t.cacheDir,e.ecosystem,e.sha256),i=ct(o);if(i!==void 0&&Yt(i)===e.sha256)return{path:o,downloaded:!1};let a="no shard urls";for(let l of n){let s;try{s=await r.fetchShard(l,e.sizeBytes)}catch(u){a=Mo(u);continue}let d=Yt(s);if(d!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return Jt(o,s),{path:o,downloaded:!0}}throw new ee(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function Pp(e,n,t){if(e instanceof ke)throw e;if(e instanceof ft){if(n===void 0)throw new ee(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return er(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new ee(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Mo(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return er(n,t,[`could not refresh the shard index (${Mo(e)}); using the cached shard`])}async function Ga(e,n){if(!e.activated)throw new ee("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??Mp(e.shardHosts);if(!Ia(e.pubkeys))throw new ee("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let r=Dp(e);if(e.offline){if(r===void 0)throw new ee(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return er(r,e,[])}let o=await Ma(e.credential),i;try{i=await t.resolve({host:e.indexHost,token:o,ecosystem:e.ecosystem,sequenceFloor:r?.sequence??0})}catch(d){return Pp(d,r,e)}if(!bo(i.index,i.sig,e.pubkeys))throw new ee("shard index signature did not verify against any pinned key");let a=ko(i.index,qa(e));if(r!==void 0&&a.sequence<r.sequence)return er(r,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(r.sequence)}); keeping the newer cached shard`]);let l=Va(i.shardUrls,a.urls,e.shardHosts),s=await Tp(a,l,e,t);return Jt(Qt.join(e.cacheDir,Ao),i.index),Jt(Qt.join(e.cacheDir,_o),i.sig),{path:s.path,fromCache:!s.downloaded,warnings:Wa(a,e),sequence:a.sequence}}var Lp="https://api.cupel.sh",Ha=".actions.githubusercontent.com",Fp=8192;function Xa(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Ve=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function jp(e){let n;try{n=new URL(e).hostname}catch{throw new Ve("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=Ha.slice(1);if(n!==t&&!n.endsWith(Ha))throw new Ve(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Ue(e,new Set([n]))}catch{throw new Ve(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function nr(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,r=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Ve("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(r===void 0||r==="")throw new Ve("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let o=jp(t);o.searchParams.set("audience",Lp);let i;try{i=await n(o.href,{authorization:`Bearer ${r}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Ve("the ID-token request failed")}if(i.length>Fp)throw new Ve("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(i)}catch{throw new Ve("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new Ve("the ID-token response carried no token");return l}async function Ya(e,n,t={}){let r=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",o=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!r)throw new Ve("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await nr(e,n)};if(r)return o&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(o)return{kind:"oidc",value:await nr(e,n)};throw new Ve("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Do="api.cupel.sh",Kp=`https://${Do}/v1/findings`,Bp=64*1024,tr=8*1024*1024,zp=3e4,gn=class extends Error{constructor(n){super(n),this.name="PushError"}};async function Ja(e,n,t,r={}){if(e.length>tr)throw new gn(`findings payload is ${String(e.length)} bytes, over the ${String(tr)}-byte limit`);let o=Ue(Kp,new Set([Do])),i;try{i=await t(o.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,r.timeoutMs??zp)}catch{throw new gn(`the findings push to ${Do} failed`)}if(i.body.length>Bp)throw new gn("the control plane returned a response larger than it should");if(!(i.status===202||i.status===200))throw i.status===401||i.status===403?new gn("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):i.status===400?new gn("the control plane rejected the findings payload as malformed"):new gn(`the findings push was refused with status ${String(i.status)}`)}var Up=64*1024,Vp=64*1024,Za=async(e,n,t,r)=>{if(Buffer.byteLength(t,"utf8")>tr)throw new Error("findings payload is over the size limit");return await at("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Vp,r)};async function rr(e,n){let t=await at("GET",e,n,void 0,Up,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var Wp=720*60*60*1e3,Gp=Number(kn);function Qa(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new He("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function el(e){let n=await Ga({ecosystem:"npm",activated:!0,pubkeys:Ka,indexHost:ja,shardHosts:Zt,credential:$a(process.env,()=>nr(process.env,rr),()=>Ca(process.env)),cacheDir:La(),offline:e.offline,now:Date.now(),maxAgeMs:Wp,supportedDbSchemaVersion:Gp});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
+`);return{path:n.path,sequence:n.sequence}}var Hp=8,Xp={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64,maxAdvisoryDetails:8e3},dn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function To(e){return{path:e.path,start:e.start,end:e.end}}function Yp(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new dn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,r=e.modelPromotedFromKind??null;if(t===null!=(r===null))throw new dn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new dn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:Ho(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(o=>({functionName:o.functionName??null,modulePath:o.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(To),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null}}var Jp="";function Zp(e){return[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""].join(Jp)}function Qp(e){let n=new Map;for(let t of e){let r=Zp(t),o=n.get(r);if(o===void 0){n.set(r,t);continue}if(o.tier!==t.tier||o.unknownKind!==t.unknownKind)throw new dn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${o.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function em(e){let n=Xp,t=(r,o,i)=>{throw new dn(`${r} has ${String(o)} entries, over the ${String(i)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let r of["dispatch","load"]){let o=e.unresolved[r].length;o>n.maxUnresolvedSites&&t(`the app-global ${r} set`,o,n.maxUnresolvedSites)}for(let r of e.findings)r.path!==null&&r.path.length>n.maxPathSteps&&t(`the call path of finding ${r.advisoryId}`,r.path.length,n.maxPathSteps),r.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${r.advisoryId}`,r.unresolvedSites.length,n.maxUnresolvedSites);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let r of e.advisories){if(r.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${r.id}`,r.ranges.length,n.maxAdvisoryRanges),r.summary!==null&&r.summary.length>n.maxStringLength)throw new dn(`the summary of advisory ${r.id} is ${String(r.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(r.details!==null&&r.details.length>n.maxAdvisoryDetails)throw new dn(`the description of advisory ${r.id} is ${String(r.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function nm(e,n){let t=new Set(n.map(r=>r.advisoryId));return e.advisories.filter(r=>t.has(r.advisory.id)).map(r=>({id:r.advisory.id,cveId:r.advisory.cveId,osvId:r.advisory.osvId,summary:r.advisory.summary,details:r.advisory.details??null,severity:r.advisory.severity,published:r.advisory.published,source:r.advisory.source,ranges:r.ranges.map(o=>({packageName:o.packageName,introduced:o.introduced,fixed:o.fixed,lastAffected:o.lastAffected}))}))}function nl(e,n){let t=Qp(e.findings.map(Yp)),r={version:Hp,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(To),load:e.unresolved.load.map(To)},advisories:nm(e,t)};return em(r),r}function tm(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var rm={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},tl=4,Po=3,Lo=10,rl={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},om="(symbol set known incomplete)";function im(e){let n=(e.path??[]).map(t=>B(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function ol(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function sm(e){let n=e.findings.filter(d=>d.tier==="unknown"&&d.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let d of n){let u=t.get(d.unknownKind)??[];u.push(d),t.set(d.unknownKind,u)}let r={cupel:0,project:0};for(let[d,u]of t)r[Fe[d]]+=u.length;let o=[];o.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let i=(d,u)=>{if(r[d]===0)return;o.push(""),o.push(`   ${u} (${String(r[d])}):`);let p=[...t.entries()].filter(([h])=>Fe[h]===d).sort((h,g)=>g[1].length-h[1].length||h[0].localeCompare(g[0])),f=p.slice(0,tl);for(let[h,g]of f){let k=d==="project"?[...new Set(g.flatMap(ol))]:[],S=k.slice(0,Po).map(B).join(", "),w=k.length>Po?` (+${String(k.length-Po)} more files)`:"";o.push(`     ${h.padEnd(21)} ${String(g.length).padStart(4)}  ${rl[h]}`+(S!==""?`
+       ${S}${w}`:""))}for(let[h,g]of p.slice(tl))o.push(`     ${h.padEnd(21)} ${String(g.length).padStart(4)}  ${rl[h]}`)};i("project","Your code \u2014 a change on your side would produce a real verdict"),i("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let d of n)if(Fe[d.unknownKind]==="project")for(let u of ol(d))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((d,u)=>u[1]-d[1]||d[0].localeCompare(u[0]))[0];l!==void 0&&r.project>0&&(o.push(""),o.push(`   \u279C Start here: ${B(l[0])} appears in ${String(l[1])} of your ${String(r.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let s=n.filter(d=>Fe[d.unknownKind]==="project");if(s.length>0){o.push("");for(let d of s.slice(0,Lo))o.push(`     ${B(d.displayId)}  ${B(d.packageName)}@${B(d.version)}  [${d.unknownKind}] ${B(d.reason)}`);s.length>Lo&&o.push(`     \u2026 and ${String(s.length-Lo)} more`)}return o.push(""),o}function il(e){let n=[],t=e.counts,r=e.findings.filter(d=>d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low");if(n.push(`cupel scan: ${B(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let d=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+d.map(u=>`${B(u.entrypoint)} [${B(u.source)}]`).join(", ")+(e.entrypointSources.length>d.length?`, \u2026 and ${String(e.entrypointSources.length-d.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let d=new Map;for(let u of e.entrypointObservations)d.set(u.kind,(d.get(u.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...d.entries()].map(([u,p])=>`${String(p)} ${u}`).join(", ")+` (${B(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let d=e.rootSet,u=d.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(d.counts.rootsAdmitted)}): `+u.map(h=>`${B(h.rel===""?".":h.rel)} [${h.witnesses.join("+")}]`).join(", ")+(d.roots.length>u.length?`, \u2026 and ${String(d.roots.length-u.length)} more`:"")),d.observations.length>0){let h=new Map;for(let g of d.observations)h.set(g.kind,(h.get(g.kind)??0)+1);n.push("    not admitted: "+[...h.entries()].map(([g,k])=>`${String(k)} ${g}`).join(", "))}n.push(`    walk: ${String(d.counts.dirsWalked)} dirs, ${String(d.counts.manifestsSeen)} manifests seen, ${String(d.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${d.budget}`);let p=e.installed.perRoot.filter(h=>h.rootRel!=="");p.length>0&&n.push(`    enumerated (${String(p.length)} nested root${p.length===1?"":"s"}): `+p.slice(0,8).map(h=>`${B(h.rootRel)} (${String(h.packages.length)} packages, ${h.source})`).join(", ")+(p.length>8?`, \u2026 and ${String(p.length-8)} more`:""));let f=jn(d,e.entrypointSources);f.length>0&&n.push(`    NOT analyzed (${String(f.length)}): ${B(ro(f.map(h=>h.rel===""?".":h.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at unknown until they are analyzed`),d.budget!=="complete"&&d.budget!=="not-attempted"&&n.push(`    the walk did not finish (${d.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at unknown`),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let d of e.entrypointGaps.slice(0,5))n.push(`  - ${B(d.source)} (${B(d.file)}): ${B(d.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(B).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${Or(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let o=e.installed.gaps,i=o.find(d=>d.kind==="no-enumeration")??null;i!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${B(i.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=o.filter(d=>d!==i);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let d of a.slice(0,10))n.push(`  - [${B(d.kind)}] ${B(d.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(o.map(d=>d.detail)),s=[...e.analyzerDiagnostics.map(d=>`${B(d.code)}: ${B(d.detail)}`),...e.installed.diagnostics.filter(d=>!l.has(d)).map(B)];if(s.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(s.length)}) \u2014 verdicts are conservative:`);for(let d of s.slice(0,10))n.push(`  - ${d}`);s.length>10&&n.push(`  \u2026 and ${String(s.length-10)} more`),n.push("")}if(r.length>0){n.push(`\u{1F3AF} Reachable (${String(r.length)}) \u2014 fix these:`);for(let d of r)n.push(`  ${rm[d.tier]} ${B(d.displayId)}  ${B(d.packageName)}@${B(d.version)}  ${B(d.symbolName??"")}`+(d.surfaceComplete===!1?`  ${om}`:"")),n.push(`        path: ${im(d)}`);n.push("")}return n.push(...sm(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${tm(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as am}from"node:crypto";var lm="https://json.schemastore.org/sarif-2.1.0.json",sl="cupel-reachability",Fo=new Set(["dispatch","dynamic-load","coverage-gap"]);function dm(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var cm=500,um=10;function fm(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function pm(e,n){return`${e}::${n}`}function mm(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function hm(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return am("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function gm(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Fo.has(e.unknownKind)}var al={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function ll(e){let n=[],t=new Map,r=[];for(let s of e.findings){if(!gm(s))continue;let d=pm(s.displayId,s.packageName);if(!t.has(d)){t.set(d,n.length);let S=mm(s.severity);n.push({id:B(d),properties:{tags:s.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${B(s.packageName)}`]:["security","reachability",`package/${B(s.packageName)}`],...S!==void 0?{"security-severity":S}:{}}})}let u=s.tier==="reachable-high"||s.tier==="reachable-medium"||s.tier==="reachable-low",p=s.path??[],f=p.find(S=>S.modulePath!==""),h=[...new Set(s.unresolvedSites.map(S=>S.path).filter(S=>S!==""))],g=u?f!==void 0?{physicalLocation:{artifactLocation:{uri:B(f.modulePath)}},message:{text:`calls ${B(s.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:B(s.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:B(h[0])}},message:{text:`unresolved ${B(s.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:B(s.packageLocation??(s.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},k=u?p.map(S=>({physicalLocation:{artifactLocation:{uri:B(S.modulePath||"package-lock.json")}},message:{text:B(S.functionName??"<step>")}})):h.slice(1,um+1).map(S=>({physicalLocation:{artifactLocation:{uri:B(S)}},message:{text:"also blocked here"}}));r.push({ruleId:B(d),ruleIndex:t.get(d),level:u?"error":"warning",message:{text:B(`[${s.tier}] ${s.displayId} in ${s.packageName}@${s.version}`+(s.symbolName!==null?` \u2014 reaches ${s.symbolName}`:"")+(s.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${s.reason}`)},locations:[g],...k.length>0?{relatedLocations:k}:{},partialFingerprints:{"cupelReachability/v1":hm(s)},properties:{tier:s.tier,advisoryId:B(s.advisoryId),...s.surfaceComplete===!1?{surfaceComplete:!1}:{},...s.modelId!==void 0?{modelId:B(s.modelId),modelPromotedFromKind:s.modelPromotedFromKind}:{},...s.unknownKind!==void 0?{unknownKind:s.unknownKind,unknownOwner:Fe[s.unknownKind],unresolvedSiteCount:s.unresolvedSites.length}:{},...s.adr105!==void 0?{adr105:s.adr105}:{}}})}let o=new Map,i=new Map;for(let s of e.findings){if(s.tier!=="unknown"||s.unknownKind===void 0||(o.set(s.unknownKind,(o.get(s.unknownKind)??0)+1),Fo.has(s.unknownKind)))continue;let d=i.get(s.unknownKind)??[];d.length<cm&&d.push({advisory:B(s.displayId),package:B(s.packageName),version:B(s.version)}),i.set(s.unknownKind,d)}let a={cupel:0,project:0};for(let[s,d]of o)a[Fe[s]]+=d;let l={};for(let[s,d]of i){let u=o.get(s)??d.length;l[s]={count:u,owner:Fe[s],note:al[s],truncated:u>d.length,advisories:d}}return{$schema:lm,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:sl},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:B(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(s=>`${s.entrypoint} (${s.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...o.keys()].filter(s=>!Fo.has(s)&&!dm(s,e.analysisAborted)).sort().map(s=>({descriptor:{id:`unknown-${s}`},level:"warning",message:{text:`${String(o.get(s)??0)} finding(s) are unknown because ${al[s]} (owner: ${Fe[s]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${s}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(s=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:B(`${s.source} (${s.file}): ${s.detail}`)}})),...e.rejectedEntries.map(s=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:B(`--entry did not resolve to a file inside the app root: ${s}`)}})),...e.entrypointObservations.map(s=>({descriptor:{id:`entrypoint-observation:${s.kind}`},level:"note",message:{text:B(`${s.detail} (${s.file})`)}})),...e.analyzerDiagnostics.map(s=>({descriptor:{id:s.code},level:"warning",message:{text:B(`${s.detail}${s.reason===void 0?"":` [reason: ${s.reason}]`} (${s.path})`)}})),...e.installed.diagnostics.map(s=>({descriptor:{id:"resolve"},level:"warning",message:{text:B(s)}}))]}],results:r,properties:{category:sl,summary:e.counts,installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(s=>({path:B(s.rootRel),count:s.packages.length,source:s.source}))},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:jn(e.rootSet,e.entrypointSources).length,named:jn(e.rootSet,e.entrypointSources).slice(0,8).map(s=>B(s.rel===""?".":s.rel))},analyzed:[...rt(e.entrypointSources)].sort().slice(0,64).map(s=>B(s===""?".":s)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(s=>({path:B(s.rel),witnesses:s.witnesses,...s.manifestRefused?{manifestRefused:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(s=>({kind:s.kind,path:B(s.rel)}))}}:{},...fm(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...o].sort((s,d)=>d[1]-s[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(s=>s.tier==="unknown"&&s.unknownKind==="db-gap").map(s=>({advisory:B(s.displayId),package:B(s.packageName),version:B(s.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(s=>s.adr105!==void 0).map(s=>({advisory:B(s.displayId),package:B(s.packageName),version:B(s.version),symbol:B(s.symbolName??""),tier:s.tier,...s.unknownKind!==void 0?{unknownKind:s.unknownKind}:{},...s.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function dl(){try{let e=ym(bm(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function km(e,n){let t=`${JSON.stringify(n,null,2)}
+`,r=`${e}.tmp-${cl(8).toString("hex")}`;ul(r,t,{encoding:"utf8",flag:"wx"}),xm(r,e)}async function Em(e){let n=Sa(e),r=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:Qa(n.shard),sequence:null}:await el({offline:n.offline}),o=r.path,i=xo({dir:n.dir,shardPath:o,failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${il(i)}
+`),i.modelLane!==void 0){let a=i.modelLane.notes.length>0?` (${i.modelLane.notes.map(l=>B(l)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(i.modelLane.active)}/${String(i.modelLane.stored)} active, ${String(i.modelLane.promoted)} promoted to reachable-low${a}
+`)}if(n.summaryShadow!==void 0&&i.summaryShadow!==void 0){let a=Sm.join(n.summaryShadow,"shadow-report.json");ul(a,`${JSON.stringify(i.summaryShadow,null,2)}
+`),process.stdout.write(`summary-shadow: ${String(i.summaryShadow.records.length)} counterfactual record(s) -> ${a}
+`)}if(i.modelShadow!==void 0&&n.modelShadowOut!==void 0){let a=i.modelShadow.records.filter(l=>l.wouldPromote).length;process.stdout.write(`model-shadow: ${String(a)}/${String(i.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
+`)}if(i.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(i.bindingShadow.deltas)}/${String(i.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
+`),n.sarif!==void 0&&km(n.sarif,ll(i)),n.push){let a=nl(i,{scanId:cl(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:r.sequence}),l=await Ya(process.env,rr,{...n.auth!==void 0?{auth:n.auth}:{},warn:d=>process.stderr.write(`cupel: ${d}
+`)});try{await Ja(JSON.stringify(a),l.value,Za)}catch(d){let u=d instanceof Error?d.message:String(d);return process.stderr.write(`cupel: ${u}
+`),i.exitCode===0?1:i.exitCode}let s=r.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(a.findings.length)} finding(s) to api.cupel.sh (${Xa(l)})${s}
+`)}return i.exitCode}async function wm(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Em(e.slice(1))}catch(t){let r=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${r}
+`),1}if(e[0]==="login")return await Ta(e.slice(1));if(e[0]==="logout")return Pa(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${So(dl())}
+`),0):(process.stderr.write(`cupel: unknown command '${B(n)}'
+`),process.stderr.write(`${So(dl())}
+`),1)}wm().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});