npm - @cupel-sh/cli - Versions diffs - 0.6.0 → 0.7.0 - Mend

@cupel-sh/cli 0.6.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2) hide show

package/bundle/cli.js +42 -38
package/package.json +2 -1

package/bundle/cli.js CHANGED Viewed

@@ -1,47 +1,51 @@
 #!/usr/bin/env node
-import{randomBytes as oa}from"node:crypto";import{readFileSync as jf,renameSync as Kf,writeFileSync as aa}from"node:fs";import Bf from"node:path";import{fileURLToPath as zf}from"node:url";var da=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Cn(e){if(!da.test(e))throw new Error(`not an exact x.y.z version: ${JSON.stringify(e)}`);return e}function Qn(e,n){let t=e.split(".").map(Number),r=n.split(".").map(Number);for(let i=0;i<3;i+=1){let s=t[i]??0,a=r[i]??0;if(s!==a)return s<a?-1:1}return 0}var Kt=["dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function fn(e,n){let t=Cn(e);return!(n.introduced!=="0"&&Qn(t,Cn(n.introduced))<0||n.fixed!==void 0&&Qn(t,Cn(n.fixed))>=0||n.lastAffected!==void 0&&Qn(t,Cn(n.lastAffected))>0)}function et(e,n,t){let r=new Map(e.functions.map(l=>[l.id,l])),i=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let o=s.get(l.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(l.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==u.packageName&&a.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:l.resolution})}return a}function ca(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,r)=>t.analyzedVersion<r.analyzedVersion?1:t.analyzedVersion>r.analyzedVersion?-1:0)}function ua(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function oi(e,n,t,r,i,s){if(s<=0)return null;let a=null,l=o=>{(a===null||o.hops<a.hops)&&(a=o)};for(let o of ca(e,n))for(let c of o.edges){if(c.entryExport!==t||c.entryContainer!==r)continue;if(ua(c,i,o.packageName)){l({viaPackages:[],hops:c.hops,provenance:{tool:o.tool,toolVersion:o.toolVersion,analyzedVersion:o.analyzedVersion}});continue}if(c.target.kind!=="dep")continue;let u=oi(e,c.target.calleePackage,c.target.calleeExport,null,i,s-1);u!==null&&l({viaPackages:[c.target.calleePackage,...u.viaPackages],hops:c.hops+u.hops,provenance:u.provenance})}return a}function Bt(e,n,t,r,i,s){let a=null;for(let l of et(e,n,t)){let o=oi(i,l.packageName,l.exportName,l.container,r,s);o!==null&&(a===null||o.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:o.viaPackages,totalHops:o.hops,provenance:o.provenance})}return a}function On(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Rn(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function li(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(i.moduleId)??[];s.push(r.resolvedModuleId),n.set(i.moduleId,s)}return n}function fa(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let i=t.get(r.importId);if(i===void 0)continue;let s=n.get(r.resolvedModuleId)??[];s.push(i.moduleId),n.set(r.resolvedModuleId,s)}return n}function rn(e){let n=li(e),t=new Set,r=e.modules.filter(i=>i.isEntrypoint).map(i=>i.id);for(;r.length>0;){let i=r.pop();if(!(i===void 0||t.has(i))){t.add(i);for(let s of n.get(i)??[])t.has(s)||r.push(s)}}return t}function pa(e,n){let t=fa(e),r=new Set,i=[n];for(;i.length>0;){let s=i.pop();if(!(s===void 0||r.has(s))){r.add(s);for(let a of t.get(s)??[])r.has(a)||i.push(a)}}return r}function ma(e,n,t){let r=li(e),i=Rn(e),s=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||s.has(l))continue;s.add(l);let o=i.get(l);if(o===void 0||o.externalSurface===!0||t.has(l))return!0;for(let c of r.get(l)??[])s.has(c)||a.push(c)}return!1}function ha(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),r=Rn(e),i=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&i.set(a.id,a);let s=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=s.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let o=t.get(a.target.functionId);o===void 0||r.get(o.moduleId)?.externalSurface===!0||i.set(o.id,o)}return[...i.values()]}function di(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let i=e.slice(t+n.length).split("/"),s=i[0]?.startsWith("@")===!0?2:1;return i.slice(s).join("/")}function ga(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let r=t.symbolKind==="method"||t.symbolKind==="ctor",i=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let a=n.get(s.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(r){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||i.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return a.externalSurface===!0?!0:di(a.path)===t.sourcePath})}function ai(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&di(t.path)===n.sourcePath)}function ya(e,n,t,r){let i=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(a=>{let l=i.get(a);if(l?.name!==r.exportName)return!1;let o=n.get(l.moduleId);return o?.externalSurface===!0&&o.packageName===r.packageName&&t.has(l.moduleId)}))}function xa(e,n,t){return t.container===null?!0:e.classes.some(r=>{if(r.name!==t.container)return!1;let i=n.get(r.moduleId);return i!==void 0&&i.packageName===t.packageName&&i.externalSurface!==!0})}function Sa(e,n,t){let r=new Map(e.callSites.map(o=>[o.id,o.enclosingFunctionId])),i=new Map;for(let o of e.callEdges){let c=r.get(o.callSiteId);if(c===void 0)continue;let u=i.get(c)??[];u.push({to:o.calleeFunctionId,res:o.resolution}),i.set(c,u)}let s=o=>{let c=new Set,u=n.map(f=>({id:f.id,prev:null}));for(let f of u)c.add(f.id);for(;u.length>0;){let f=u.shift();if(f===void 0)break;if(f.id===t){let p=[];for(let h=f;h!==null;h=h.prev)p.unshift(h.id);return p}for(let p of i.get(f.id)??[])p.res!=="unresolved"&&(p.res==="field-based"&&!o||c.has(p.to)||(c.add(p.to),u.push({id:p.to,prev:f})))}return null},a=s(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=s(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function zt(e){return ci(e,Rn(e),rn(e),ui(e))}function ci(e,n,t,r){let i=[],s=[],a=new Map(e.functions.map(o=>[o.id,o.moduleId])),l=o=>o!==void 0&&t.has(o)&&r.has(n.get(o)?.packageName??"");for(let o of e.callSites)o.resolution==="unresolved"&&l(a.get(o.enclosingFunctionId))&&i.push(o.range);for(let o of e.imports)!o.specifierIsLiteral&&t.has(o.moduleId)&&s.push({path:n.get(o.moduleId)?.path??"",start:0,end:0});return{dispatch:i,load:s}}function ui(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function ba(e,n){let t=new Map(e.functions.map(i=>[i.id,i])),r=Rn(e);return n.map(i=>{let s=t.get(i),a=s!==void 0?r.get(s.moduleId):void 0;return{functionId:i,functionName:s?.name,modulePath:a?.path??""}})}function Ut(e){let{graph:n,installed:t,range:r,symbol:i,coverage:s}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},o=K=>({unresolvedSites:K,unresolvedEvidence:{own:K,sets:[]}}),c=ui(n),u=new Set;for(let K of e.incompleteness)K.reach.kind==="unbounded"&&u.add(K.source);let f=e.incompleteness.some(K=>K.reach.kind==="assumed-bounded")?"loader-assumption":"complete",p=K=>K==="not-reachable"?f:void 0,h=new Map,S=K=>{let V=h.get(K);return V===void 0&&(V=ma(n,K,u),h.set(K,V)),V},x=K=>K.reach.kind==="class-scope"&&i!==null&&i.packageName===K.reach.packageName&&i.container===K.reach.container,y=K=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let V of Kt)for(let D of e.incompleteness)if(D.cause===V&&K(D))return{cause:D.cause,source:D.source};return null},v=K=>{let V;return y(D=>D.reach.kind==="unbounded"?!0:D.reach.kind==="class-scope"?x(D):K===void 0||S(D.reach.anchor)?!0:(V??=pa(n,K),V.has(D.reach.anchor)))},C=()=>y(K=>K.reach.kind==="unbounded"?!0:K.reach.kind==="class-scope"?x(K):S(K.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${r.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:p("not-affected"),path:void 0,...l};let $;try{$=fn(t.version,r)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:p("unknown"),path:void 0,...l}}if(!$)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${r.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:p("not-affected"),path:void 0,...l};let N=Rn(n),b=rn(n),m=K=>{if(K.cause!=="dynamic-load"||K.source===null)return a;let V=N.get(K.source);return V===void 0?a:[{path:V.path,start:0,end:0}]},{dispatch:E,load:_}=ci(n,N,b,c),F=[...E,..._],O={unresolvedSites:_,unresolvedEvidence:{own:a,sets:["load"]}},I={unresolvedSites:F,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},A=K=>{for(let V of b)if(N.get(V)?.packageName===K)return!0;return!1},j=K=>({tier:"unknown",decidedAtStage:K,reason:`${i?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:p("unknown"),path:void 0,...l}),z=()=>{if(!A(r.packageName)){if(_.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:p("unknown"),path:void 0,...O};let K=C();return K!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:K.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(K))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:p("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${r.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${r.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}}return null};if(i===null||!i.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:i===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:i===null?"db-gap":"unverified-symbol",attribution:void 0,basis:p("unknown"),path:void 0,...I};if(s!==null&&!s.comparedPaths.has(i.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${i.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:p("unknown"),path:void 0,...I};if(i.symbolKind==="accessor"||i.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a ${i.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:p("unknown"),path:void 0,...I};let M=ga(n,N,i);if(M===void 0||!b.has(M.moduleId)){if(M===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&ya(n,N,b,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,...I};if(M===void 0&&(i.symbolKind==="method"||i.symbolKind==="ctor")&&!xa(n,N,i))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is a method of the dependency class ${i.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,...I};let K=z();if(K!==null)return K;if(F.length>0){let W=M!==void 0?N.get(M.moduleId):ai(n,i),se=M===void 0&&W!==void 0&&W.externalSurface!==!0&&b.has(W.id)&&!c.has(W.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:_.length>0?"dynamic-load":se?"dep-opaque":"dispatch",attribution:void 0,basis:p("unknown"),path:void 0,...I}}let V=M!==void 0?N.get(M.moduleId):ai(n,i);if(M===void 0&&V!==void 0&&V.externalSurface!==!0&&b.has(V.id)&&!c.has(V.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${i.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:p("unknown"),path:void 0,...l};let D=V!==void 0?v(V.id):C();return D!==null?{tier:"unknown",decidedAtStage:M===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:D.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(D))}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:M===void 0?"symbol-reachable":"module-reachable",reason:`${i.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}:j(M===void 0?"symbol-reachable":"module-reachable")}let J=Sa(n,ha(n),M.id);if(J!==null)return{tier:On(J.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:nt(i),basis:p("reachable-high"),path:ba(n,J.path),...l};if(F.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but unresolved edges exist`,unknownKind:_.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:p("unknown"),path:void 0,...I};let H=v(M.moduleId);return H!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${i.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:H.cause,attribution:void 0,basis:p("unknown"),path:void 0,...o(m(H))}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${i.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:p("not-reachable"),path:void 0,...l}:j("call-path-confirmed")}function ka(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Ea(e,n,t){let r=new Map(e.classes.map(i=>[i.id,i.name]));for(let i of e.functions){if(i.name!==t.exportName)continue;let s=n.get(i.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(i.enclosingClassId!==void 0?r.get(i.enclosingClassId)??null:null)!==t.container))return i.id}return null}function wa(e,n,t){if(n===t)return[];let r=new Map(e.functions.map(o=>[o.id,o])),i=new Map(e.callSites.map(o=>[o.id,o])),s=new Map;for(let o of e.callEdges){if(o.resolution!=="resolved"&&o.resolution!=="field-based")continue;let c=i.get(o.callSiteId);if(c===void 0)continue;let u=c.enclosingFunctionId;if(!r.has(u)||!r.has(o.calleeFunctionId))continue;let f=s.get(u),p={to:o.calleeFunctionId,label:o.resolution};f===void 0?s.set(u,[p]):f.push(p)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let o=0;o<l.length;o++){let c=l[o];for(let u of s.get(c.at)??[]){if(a.has(u.to))continue;let f=[...c.labels,u.label];if(u.to===t)return f;a.add(u.to),l.push({at:u.to,labels:f})}}return null}function $n(e,n,t,r,i){if(i.length===0)return null;let s=et(e,n,t);if(s.length===0)return null;let a=Ea(e,n,r);for(let l of i){let o=s.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),c=o.find(u=>u.resolution==="resolved")??o[0];if(c!==void 0){if(ka(l.callee,r))return{tier:On("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[c.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=wa(e,l.callee.realFunctionId,a);if(u!==null)return{tier:On("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[c.resolution,"modeled",...u]}}}}return null}var fi=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],pi=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function nt(e){return e.verified?"gated":"candidate"}var Vt=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],qt=["cupel","project"],$e={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function mi(e){return $e[e]}import{randomBytes as ao}from"node:crypto";import{mkdirSync as lo,readdirSync as mo,readFileSync as ho,realpathSync as _t,renameSync as co,statSync as At,writeFileSync as uo}from"node:fs";import Ze from"node:path";import{createRequire as va}from"node:module";var Ia=va(import.meta.url);function Aa(){try{return Ia("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function _a(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var tt={open(e,n){let{DatabaseSync:t}=Aa(),r=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?r.exec("PRAGMA query_only = ON;"):r.exec("PRAGMA journal_mode = DELETE;"),{exec:i=>r.exec(i),prepare:i=>_a(r.prepare(i)),close:()=>r.close()}}};function ce(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function oe(e){return typeof e=="string"?e:null}function He(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Na=`
+import{randomBytes as Vl}from"node:crypto";import{readFileSync as Oh,renameSync as Ph,writeFileSync as Wl}from"node:fs";import $h from"node:path";import{fileURLToPath as Mh}from"node:url";var Gl=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Hl(e){let n=Gl.exec(e);return n===null?null:{kind:"npm",release:[Number(n[1]),Number(n[2]),Number(n[3])]}}function Xl(e,n){for(let t=0;t<3;t+=1){let r=e.release[t]??0,o=n.release[t]??0;if(r!==o)return r<o?-1:1}return 0}var Yl=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,Jl={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function Dn(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function Zl(e){let n=Yl.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,r=(t.release??"").split(".");if(r.length===0||r.length>32)return null;let o=[];for(let u of r){let p=Dn(u);if(p===null)return null;o.push(p)}let i=0;if(t.epoch!==void 0){let u=Dn(t.epoch);if(u===null)return null;i=u}let a=null;if(t.preL!==void 0){let u=t.preN===void 0?0:Dn(t.preN);if(u===null)return null;a=[Jl[t.preL]??t.preL,u]}let l=null;if(t.postImplicit!==void 0){let u=Dn(t.postImplicit);if(u===null)return null;l=u}else if(t.postL!==void 0){let u=t.postN===void 0?0:Dn(t.postN);if(u===null)return null;l=u}let s=null;if(t.devL!==void 0){let u=t.devN===void 0?0:Dn(t.devN);if(u===null)return null;s=u}let d=t.local===void 0?null:t.local.split(/[-_.]/u).map(u=>/^[0-9]+$/u.test(u)?Number(u):u);return{kind:"PyPI",epoch:i,release:o,pre:a,post:l,dev:s,local:d}}function Tn(e,n){return e===n?0:e<n?-1:1}function ti(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function Ql(e,n){let t=ti(e),r=ti(n),o=Math.max(t.length,r.length);for(let i=0;i<o;i+=1){let a=Tn(t[i]??0,r[i]??0);if(a!==0)return a}return 0}function ri(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function ed(e,n){let t=ri(e),r=ri(n);return t!==r?t<r?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:Tn(e.pre[1],n.pre[1])}function nd(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:Tn(e,n)}function td(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:Tn(e,n)}function rd(e,n){let t=typeof e=="number",r=typeof n=="number";return t&&r?Tn(e,n):!t&&!r?e===n?0:e<n?-1:1:t?1:-1}function od(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let r=0;r<t;r+=1){let o=e[r],i=n[r];if(o===void 0)return-1;if(i===void 0)return 1;let a=rd(o,i);if(a!==0)return a}return 0}function id(e,n){let t=Tn(e.epoch,n.epoch);if(t!==0)return t;let r=Ql(e.release,n.release);if(r!==0)return r;let o=ed(e,n);if(o!==0)return o;let i=nd(e.post,n.post);if(i!==0)return i;let a=td(e.dev,n.dev);return a!==0?a:od(e.local,n.local)}function sd(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=e==="npm"?Hl(n):Zl(n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function Hn(e,n){let t=sd(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function It(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return Xl(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return id(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function oi(e,n,t){let r=Hn(e,n);return!(t.introduced!=="0"&&It(r,Hn(e,t.introduced))<0||t.fixed!==void 0&&It(r,Hn(e,t.fixed))>=0||t.lastAffected!==void 0&&It(r,Hn(e,t.lastAffected))>0)}var mr=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function En(e,n){return oi(n.ecosystem??"npm",e,n)}function At(e,n,t){let r=new Map(e.functions.map(l=>[l.id,l])),o=new Map(e.classes.map(l=>[l.id,l.name])),i=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let s=i.get(l.callSiteId);if(s===void 0)continue;let d=r.get(s.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=r.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:l.resolution})}return a}function ad(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,r)=>t.analyzedVersion<r.analyzedVersion?1:t.analyzedVersion>r.analyzedVersion?-1:0)}function ld(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function ii(e,n,t,r,o,i){if(i<=0)return null;let a=null,l=s=>{(a===null||s.hops<a.hops)&&(a=s)};for(let s of ad(e,n))for(let d of s.edges){if(d.entryExport!==t||d.entryContainer!==r)continue;if(ld(d,o,s.packageName)){l({viaPackages:[],hops:d.hops,provenance:{tool:s.tool,toolVersion:s.toolVersion,analyzedVersion:s.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let u=ii(e,d.target.calleePackage,d.target.calleeExport,null,o,i-1);u!==null&&l({viaPackages:[d.target.calleePackage,...u.viaPackages],hops:d.hops+u.hops,provenance:u.provenance})}return a}function hr(e,n,t,r,o,i){let a=null;for(let l of At(e,n,t)){let s=ii(o,l.packageName,l.exportName,l.container,r,i);s!==null&&(a===null||s.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:s.viaPackages,totalHops:s.hops,provenance:s.provenance})}return a}function Xn(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function Ln(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function gr(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let o=t.get(r.importId);if(o===void 0)continue;let i=n.get(o.moduleId)??[];i.push(r.resolvedModuleId),n.set(o.moduleId,i)}return n}function dd(e){let n=new Map,t=new Map(e.imports.map(r=>[r.id,r]));for(let r of e.importEdges){let o=t.get(r.importId);if(o===void 0)continue;let i=n.get(r.resolvedModuleId)??[];i.push(o.moduleId),n.set(r.resolvedModuleId,i)}return n}function Ze(e){let n=gr(e),t=new Set,r=e.modules.filter(o=>o.isEntrypoint).map(o=>o.id);for(;r.length>0;){let o=r.pop();if(!(o===void 0||t.has(o))){t.add(o);for(let i of n.get(o)??[])t.has(i)||r.push(i)}}return t}function cd(e,n){let t=dd(e),r=new Set,o=[n];for(;o.length>0;){let i=o.pop();if(!(i===void 0||r.has(i))){r.add(i);for(let a of t.get(i)??[])r.has(a)||o.push(a)}}return r}function ud(e,n,t){let r=gr(e),o=Ln(e),i=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||i.has(l))continue;i.add(l);let s=o.get(l);if(s===void 0||s.externalSurface===!0||t.has(l))return!0;for(let d of r.get(l)??[])i.has(d)||a.push(d)}return!1}function Yn(e,n,t,r=new Set){let o=gr(e),i=Ln(e),a=new Set,l=[],s=[n];for(;s.length>0;){let d=s.pop();if(d===void 0||a.has(d))continue;a.add(d);let u=i.get(d);if(u===void 0){l.push({module:d,kind:"absent"});continue}if(t.has(d)){l.push({module:d,kind:"unbounded"});continue}if(u.externalSurface===!0&&!r.has(d)){l.push({module:d,kind:"surface"});continue}for(let p of o.get(d)??[])a.has(p)||s.push(p)}return l}function fd(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),r=Ln(e),o=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&o.set(a.id,a);let i=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=i.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let s=t.get(a.target.functionId);s===void 0||r.get(s.moduleId)?.externalSurface===!0||o.set(s.id,s)}return[...o.values()]}function ai(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let o=e.slice(t+n.length).split("/"),i=o[0]?.startsWith("@")===!0?2:1;return o.slice(i).join("/")}function pd(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let r=t.symbolKind==="method"||t.symbolKind==="ctor",o=new Map(e.classes.map(i=>[i.id,i]));return e.functions.find(i=>{if(i.name!==t.exportName)return!1;let a=n.get(i.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(r){if(i.kind!==t.symbolKind||i.enclosingClassId===void 0||o.get(i.enclosingClassId)?.name!==t.container)return!1}else if(i.kind!=="function")return!1;return a.externalSurface===!0?!0:ai(a.path)===t.sourcePath})}function si(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&ai(t.path)===n.sourcePath)}function md(e,n,t,r){let o=new Map(e.functions.map(i=>[i.id,i]));return e.callSites.some(i=>i.calleeExprShape!=="member"||i.resolution!=="resolved"?!1:i.resolvedTargetIds.some(a=>{let l=o.get(a);if(l?.name!==r.exportName)return!1;let s=n.get(l.moduleId);return s?.externalSurface===!0&&s.packageName===r.packageName&&t.has(l.moduleId)}))}function hd(e,n,t){return t.container===null?!0:e.classes.some(r=>{if(r.name!==t.container)return!1;let o=n.get(r.moduleId);return o!==void 0&&o.packageName===t.packageName&&o.externalSurface!==!0})}function gd(e,n,t){let r=new Map(e.callSites.map(s=>[s.id,s.enclosingFunctionId])),o=new Map;for(let s of e.callEdges){let d=r.get(s.callSiteId);if(d===void 0)continue;let u=o.get(d)??[];u.push({to:s.calleeFunctionId,res:s.resolution}),o.set(d,u)}let i=s=>{let d=new Set,u=n.map(p=>({id:p.id,prev:null}));for(let p of u)d.add(p.id);for(;u.length>0;){let p=u.shift();if(p===void 0)break;if(p.id===t){let f=[];for(let h=p;h!==null;h=h.prev)f.unshift(h.id);return f}for(let f of o.get(p.id)??[])f.res!=="unresolved"&&(f.res==="field-based"&&!s||d.has(f.to)||(d.add(f.to),u.push({id:f.to,prev:p})))}return null},a=i(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=i(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function yr(e){return li(e,Ln(e),Ze(e),di(e))}function li(e,n,t,r){let o=[],i=[],a=new Map(e.functions.map(s=>[s.id,s.moduleId])),l=s=>s!==void 0&&t.has(s)&&r.has(n.get(s)?.packageName??"");for(let s of e.callSites)s.resolution==="unresolved"&&l(a.get(s.enclosingFunctionId))&&o.push(s.range);for(let s of e.imports)!s.specifierIsLiteral&&t.has(s.moduleId)&&i.push({path:n.get(s.moduleId)?.path??"",start:0,end:0});return{dispatch:o,load:i}}function di(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function yd(e,n){let t=new Map(e.functions.map(o=>[o.id,o])),r=Ln(e);return n.map(o=>{let i=t.get(o),a=i!==void 0?r.get(i.moduleId):void 0;return{functionId:o,functionName:i?.name,modulePath:a?.path??""}})}function xr(e){let{graph:n,installed:t,range:r,symbol:o,coverage:i}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},s=B=>({unresolvedSites:B,unresolvedEvidence:{own:B,sets:[]}}),d=di(n),u=new Set;for(let B of e.incompleteness)B.reach.kind==="unbounded"&&u.add(B.source);let p=e.incompleteness.some(B=>B.reach.kind==="assumed-bounded")?"loader-assumption":"complete",f=B=>B==="not-reachable"?p:void 0,h=new Map,g=B=>{let W=h.get(B);return W===void 0&&(W=ud(n,B,u),h.set(B,W)),W},S=B=>B.reach.kind==="class-scope"&&o!==null&&o.packageName===B.reach.packageName&&o.container===B.reach.container,E=B=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let W of mr)for(let $ of e.incompleteness)if($.cause===W&&B($))return{cause:$.cause,source:$.source};return null},w=B=>{let W;return E($=>$.reach.kind==="unbounded"?!0:$.reach.kind==="class-scope"?S($):B===void 0||g($.reach.anchor)?!0:(W??=cd(n,B),W.has($.reach.anchor)))},I=()=>E(B=>B.reach.kind==="unbounded"?!0:B.reach.kind==="class-scope"?S(B):g(B.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${r.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let v;try{if((t.ecosystem??"npm")!==(r.ecosystem??"npm"))throw new Error("ecosystem mismatch");v=En(t.version,r)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:f("unknown"),path:void 0,...l}}if(!v)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${r.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let _=Ln(n),k=Ze(n),m=B=>{if(B.cause!=="dynamic-load"||B.source===null)return a;let W=_.get(B.source);return W===void 0?a:[{path:W.path,start:0,end:0}]},{dispatch:y,load:A}=li(n,_,k,d),C=[...y,...A],T={unresolvedSites:A,unresolvedEvidence:{own:a,sets:["load"]}},P={unresolvedSites:C,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},R=B=>{for(let W of k)if(_.get(W)?.packageName===B)return!0;return!1},F=B=>({tier:"unknown",decidedAtStage:B,reason:`${o?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:f("unknown"),path:void 0,...l}),O=()=>{if(!R(r.packageName)){if(A.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:f("unknown"),path:void 0,...T};let B=I();return B!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:B.cause,attribution:void 0,basis:f("unknown"),path:void 0,...s(m(B))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:f("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${r.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${r.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}}return null};if(o===null||!o.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:o===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:o===null?"db-gap":"unverified-symbol",attribution:void 0,basis:f("unknown"),path:void 0,...P};if(i!==null&&!i.comparedPaths.has(o.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${o.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:f("unknown"),path:void 0,...P};if(o.symbolKind==="accessor"||o.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a ${o.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:f("unknown"),path:void 0,...P};let L=pd(n,_,o);if(L===void 0||!k.has(L.moduleId)){if(L===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&md(n,_,k,o))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...P};if(L===void 0&&(o.symbolKind==="method"||o.symbolKind==="ctor")&&!hd(n,_,o))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is a method of the dependency class ${o.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...P};let B=O();if(B!==null)return B;if(C.length>0){let q=L!==void 0?_.get(L.moduleId):si(n,o),H=L===void 0&&q!==void 0&&q.externalSurface!==!0&&k.has(q.id)&&!d.has(q.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:A.length>0?"dynamic-load":H?"dep-opaque":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...P}}let W=L!==void 0?_.get(L.moduleId):si(n,o);if(L===void 0&&W!==void 0&&W.externalSurface!==!0&&k.has(W.id)&&!d.has(W.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...l};let $=W!==void 0?w(W.id):I();return $!==null?{tier:"unknown",decidedAtStage:L===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:$.cause,attribution:void 0,basis:f("unknown"),path:void 0,...s(m($))}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:L===void 0?"symbol-reachable":"module-reachable",reason:`${o.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:F(L===void 0?"symbol-reachable":"module-reachable")}let K=gd(n,fd(n),L.id);if(K!==null)return{tier:Xn(K.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${o.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:_t(o),basis:f("reachable-high"),path:yd(n,K.path),...l};if(C.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${o.exportName}, but unresolved edges exist`,unknownKind:A.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...P};let G=w(L.moduleId);return G!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${o.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:G.cause,attribution:void 0,basis:f("unknown"),path:void 0,...s(m(G))}:r.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${o.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:F("call-path-confirmed")}function xd(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Sd(e,n,t){let r=new Map(e.classes.map(o=>[o.id,o.name]));for(let o of e.functions){if(o.name!==t.exportName)continue;let i=n.get(o.moduleId);if(!(i===void 0||i.packageName!==t.packageName||(o.enclosingClassId!==void 0?r.get(o.enclosingClassId)??null:null)!==t.container))return o.id}return null}function bd(e,n,t){if(n===t)return[];let r=new Map(e.functions.map(s=>[s.id,s])),o=new Map(e.callSites.map(s=>[s.id,s])),i=new Map;for(let s of e.callEdges){if(s.resolution!=="resolved"&&s.resolution!=="field-based")continue;let d=o.get(s.callSiteId);if(d===void 0)continue;let u=d.enclosingFunctionId;if(!r.has(u)||!r.has(s.calleeFunctionId))continue;let p=i.get(u),f={to:s.calleeFunctionId,label:s.resolution};p===void 0?i.set(u,[f]):p.push(f)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let s=0;s<l.length;s++){let d=l[s];for(let u of i.get(d.at)??[]){if(a.has(u.to))continue;let p=[...d.labels,u.label];if(u.to===t)return p;a.add(u.to),l.push({at:u.to,labels:p})}}return null}function Jn(e,n,t,r,o){if(o.length===0)return null;let i=At(e,n,t);if(i.length===0)return null;let a=Sd(e,n,r);for(let l of o){let s=i.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),d=s.find(u=>u.resolution==="resolved")??s[0];if(d!==void 0){if(xd(l.callee,r))return{tier:Xn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=bd(e,l.callee.realFunctionId,a);if(u!==null)return{tier:Xn("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled",...u]}}}}return null}var ci=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],ui=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function _t(e){return e.verified?"gated":"candidate"}var Sr=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],br=["cupel","project"],Fe={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function fi(e){return Fe[e]}import{randomBytes as Wa}from"node:crypto";import{mkdirSync as qa,readdirSync as Ja,readFileSync as $p,realpathSync as gt,renameSync as Ga,statSync as No,writeFileSync as Ha}from"node:fs";import tn from"node:path";import{createRequire as kd}from"node:module";var Ed=kd(import.meta.url);function wd(){try{return Ed("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function vd(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var Nt={open(e,n){let{DatabaseSync:t}=wd(),r=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?r.exec("PRAGMA query_only = ON;"):r.exec("PRAGMA journal_mode = DELETE;"),{exec:o=>r.exec(o),prepare:o=>vd(r.prepare(o)),close:()=>r.close()}}};function be(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function ge(e){return typeof e=="string"?e:null}function Qe(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Id=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Ca=`
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Ad=`
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Oa=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
-                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Ra=5,$a=6;function Ma(e){let n=e>=$a?"a.details":"NULL AS details",t=e>=Ra?"ap.surface_complete":Oa;return`${Na}, ${n}, ${t}${Ca}`}var Pa="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",La="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Ta="SELECT value FROM ingest_meta WHERE key = 'schema_version'";function Ht(e,n=tt){let t=n.open(e,"readonly"),r=t.prepare(Ta).get(),i=r!==void 0?ce(r.value):"",s=/^\d+$/u.test(i)?Number(i):0,a=t.prepare(Ma(s)),l=t.prepare(Pa),o=t.prepare(La);return{schemaVersion:i,advisoriesForPackage(c,u){return a.all({eco:c,name:u}).map(f=>({affected:{id:He(f.ap_id)??0,advisoryId:ce(f.advisory_id),ecosystem:ce(f.ecosystem),packageName:ce(f.package_name),introduced:oe(f.introduced),fixed:oe(f.fixed),lastAffected:oe(f.last_affected),fixCommit:oe(f.fix_commit),repoUrl:oe(f.repo_url),surfaceComplete:He(f.surface_complete)===1?1:0},advisory:{id:ce(f.a_id),osvId:oe(f.osv_id),cveId:oe(f.cve_id),summary:oe(f.summary),details:oe(f.details),severity:oe(f.severity),published:oe(f.published),source:ce(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(c){return l.all({id:c}).map(u=>({id:He(u.id)??0,affectedPackageId:He(u.affected_package_id)??0,exportName:oe(u.export_name),symbolKind:ce(u.symbol_kind),matchPattern:oe(u.match_pattern),matchGlobs:oe(u.match_globs),container:oe(u.container),sourcePath:oe(u.source_path),declStart:He(u.decl_start),declEnd:He(u.decl_end),astHashBefore:oe(u.ast_hash_before),astHashAfter:oe(u.ast_hash_after),derivation:ce(u.derivation),confidence:ce(u.confidence),verified:He(u.verified)===1?1:0}))},aliasesForSymbol(c){return o.all({id:c}).map(u=>({id:He(u.id)??0,vulnerableSymbolId:He(u.vulnerable_symbol_id)??0,aliasPath:ce(u.alias_path),aliasName:ce(u.alias_name)}))},allModels(){let c;try{c=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
-               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let u=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return c.map(f=>{let p=He(f.id)??0;return{packageName:ce(f.package_name),modelId:ce(f.evidence_ref),introduced:ce(f.introduced),fixedBefore:oe(f.fixed_before),evidenceRef:ce(f.evidence_ref),edges:u.all({id:p}).map(h=>({kind:ce(h.kind),anchorExport:ce(h.anchor_export),anchorContainer:oe(h.anchor_container),calleePackage:ce(h.callee_package),calleeContainer:oe(h.callee_container),calleeExport:ce(h.callee_export)}))}})},close(){t.close()}}}var pn="6";import{realpathSync as Kn}from"node:fs";import nn from"node:path";import{realpathSync as gn}from"node:fs";import{isBuiltin as Sl}from"node:module";import Se from"node:path";import g from"typescript";function Wt(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function ue(e){let n=Wt(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function We(e){let n=Wt(e);if(n.startsWith("@")){let r=n.indexOf("/");if(r===-1)return n;let i=n.indexOf("/",r+1);return i===-1?n:n.slice(0,i)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function hi(e){let n=Wt(e),t=We(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as Ba,statSync as Gt}from"node:fs";var sn=16*1024*1024;function wn(e,n){try{let t=Gt(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:Ba(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function _e(e){let n=wn(e,sn);return n.kind==="ok"?n.text:null}function Ge(e){try{return Gt(e).isFile()}catch{return!1}}function gi(e){try{let n=Gt(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as za,realpathSync as Yt}from"node:fs";import ee from"node:path";import rt from"typescript";var Ei=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Be(e){return Ei.some(([n])=>e.endsWith(n))}function Ua(e){for(let[n,t]of Ei)if(e.endsWith(n)){let r=e.slice(0,-n.length);return t.map(i=>r+i)}return[]}var Va=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function qa(e){if(Be(e))return e;for(let[n,t]of Va)if(e.endsWith(n)){let r=e.slice(0,-n.length);for(let i of t){let s=r+i;if(Ge(s))return s}return e}return e}var Ha=[rt.ModuleKind.CommonJS,rt.ModuleKind.ESNext],Wa=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function wi(e,n,t,r,i,s){let a=rt.resolveModuleName(e,n,t,r,void 0,void 0,i).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(s){for(let o of Ua(l))if(Ge(o))return o}return l}var vi=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],Ga=[".js",".json",".node"],Xa=["index.js","index.json","index.node"];function it(e){return!Be(e)&&vi.some(n=>e.endsWith(n))}function Ii(e){if(Ge(e))return e;for(let n of Ga)if(Ge(e+n))return e+n;return null}function yi(e){for(let n of Xa){let t=ee.join(e,n);if(Ge(t))return t}return null}var Ai=[".ts",".tsx",".cts",".mts",".jsx"];function Ja(e){for(let n of Ai)if(Ge(e+n))return e+n;return null}function Ya(e){for(let n of Ai){let t=ee.join(e,"index"+n);if(Ge(t))return t}return null}function _i(e){let n=_e(ee.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let r=ee.join(e,t),i=Ii(r)??yi(r);if(i!==null)return i}}catch{}return yi(e)}function Ni(e){return Ii(e)??_i(e)??Ja(e)??Ya(e)}function Ci(e){return Ni(e)!==null}function Za(e,n){let t=e.split(ee.sep),r=n.split("/"),i=null;for(let a=t.length-r.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&r.every((l,o)=>t[a+1+o]===l)){i=t.slice(0,a+1+r.length).join(ee.sep);break}if(i===null||i==="")return null;let s=_e(ee.join(i,"package.json"));if(s===null)return null;try{let a=JSON.parse(s),l=a.exports,o=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||o)return null}catch{return null}try{return Yt(i)}catch{return null}}function Qa(e,n){let t=Ni(ee.join(e,n));if(t===null)return null;let r;try{r=Yt(t)}catch{return null}let i=e.endsWith(ee.sep)?e:e+ee.sep;return r!==e&&!r.startsWith(i)||Be(r)||!vi.some(s=>r.endsWith(s))?null:r}function el(e,n){let t=hi(e);return t===""||t.includes("\0")||t.split("/").some(r=>r===""||r==="."||r===".."||r==="node_modules")?null:Qa(n,t)}var mn={kind:"nothing-loads"},Xt=8192;function Jt(e,n){let t=n.get(e);if(t!==void 0)return t;let r,i=null;try{i=za(e);let s=new Set,a=!1;for(;;){let l=i.readSync();if(l===null)break;if(s.size>=Xt){a=!0;break}s.add(l.name)}r={names:s,truncated:a}}catch{r=null}finally{try{i?.closeSync()}catch{}}return n.set(e,r),r}var nl=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function Oi(e){return nl.some(n=>e.length>n.length&&e.endsWith(n))}function Mn(e,n){let t=e.endsWith(ee.sep)?e:e+ee.sep;return n===e||n.startsWith(t)}function xi(e,n){let t;try{t=Yt(n)}catch{return{kind:"missing"}}return Mn(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function Si(e,n){let t=(n+".").toLowerCase(),r=[];for(let i of e){let s=i.toLowerCase();s.length>t.length&&s.startsWith(t)&&r.push(i)}return r}function tl(e,n,t){let r=ee.dirname(n);if(!Mn(e,r))return null;let i=Jt(r,t);if(i===null)return null;let s=ee.basename(n);return i.names.has(s)?s:null}function bi(e,n){let t=e.filter(i=>!Oi(i));if(t.length===0)return mn;let r=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${r}") the analyzer cannot parse`}}function Ri(e,n,t,r){let i=e,s=i.indexOf("?");s!==-1&&(i=i.slice(0,s));let a=i.indexOf("#");if(a!==-1&&(i=i.slice(0,a)),i===""||i.includes("\0"))return mn;let l=ee.resolve(ee.dirname(n),i);if(!Mn(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed"};let o=xi(t,l);if(o.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed"};if(o.kind==="ok"){let h=gi(o.real);if(h==="file"){let y=tl(t,o.real,r);return y!==null&&Oi(y)?mn:{kind:"unanalyzable",reason:y===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${y}") the analyzer cannot parse`}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file"};let S=Jt(o.real,r);if(S===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let x=bi(Si(S.names,"index"),"a directory index");return x.kind==="unanalyzable"?x:S.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve"}:S.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Xt)} entries and was not fully probed`}:mn}let c=ee.basename(l);if(c===""||c==="."||c==="..")return mn;let u=xi(t,ee.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed"};if(u.kind==="missing")return mn;let f=Jt(u.real,r);if(f===null)return{kind:"unanalyzable",reason:"its target directory could not be listed"};let p=bi(Si(f.names,c),"a sibling file exists");return p.kind==="unanalyzable"?p:f.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(Xt)} entries and was not fully probed`}:mn}function rl(e,n){let t=We(e),r=ee.dirname(n);for(let i=0;i<64;i+=1){let s=ee.join(r,"node_modules",...t.split("/"));if(_e(ee.join(s,"package.json"))!==null)return s;let a=ee.dirname(r);if(a===r)return null;r=a}return null}function ki(e,n,t,r,i){let s;for(let a of Ha)for(let l of Wa){let o={...t,noDtsResolution:!0,customConditions:[...l]},c=wi(e,n,o,r,a,i);if(s===void 0)s=c;else if(s!==c)return null}return s??null}function Te(e,n,t,r){let i=ue(e);if(i==="relative")return wi(e,n,t,r,void 0,!0);if(i==="package-root"){let l=ki(e,n,t,r,!0);if(l!==null)return l;let o=rl(e,n);if(o===null||_e(ee.join(o,"package.json"))?.includes('"exports"')===!0)return null;let c=_i(o);return c===null||Be(c)?null:Mn(o,c)?c:null}let s=ki(e,n,t,r,!1);if(s===null)return null;let a=Za(s,We(e));return a!==null?el(e,a):Be(s)?s:qa(s)}function $i(e,n,t){let r=_e(ee.join(e,"tsconfig.json"));if(r===null)return()=>null;let i=rt.parseConfigFileTextToJson(ee.join(e,"tsconfig.json"),r);if(i.error!==void 0)return()=>null;let s=i.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let a=s.paths;if(typeof a!="object"||a===null)return()=>null;let l=s.baseUrl,o=typeof l=="string"?ee.resolve(e,l):e,c=new Map,u=[];for(let[p,h]of Object.entries(a)){if(!Array.isArray(h))continue;let S=h.filter(y=>typeof y=="string");if(S.length===0)continue;let x=p.indexOf("*");x===-1?c.set(p,S):p.indexOf("*",x+1)===-1&&u.push({prefix:p.slice(0,x),suffix:p.slice(x+1),targets:S})}if(u.sort((p,h)=>h.prefix.length-p.prefix.length),c.size===0&&u.length===0)return()=>null;let f=p=>{let h=c.get(p);if(h!==void 0)return h;for(let S of u){if(p.length<S.prefix.length+S.suffix.length||!p.startsWith(S.prefix)||!p.endsWith(S.suffix))continue;let x=p.slice(S.prefix.length,p.length-S.suffix.length);return S.targets.map(y=>{let v=y.indexOf("*");return v===-1?y:y.slice(0,v)+x+y.slice(v+1)})}return[]};return(p,h)=>{let S=f(p);if(S.length===0||Te(p,h,n,t)!==null)return null;for(let x of S){let y=ee.resolve(o,x),v=ee.relative(ee.dirname(h),y).split(ee.sep).join("/");if(v==="")continue;v.startsWith(".")||(v=`./${v}`);let C=Te(v,h,n,t);if(C!==null&&Mn(e,C))return C}return null}}import{readdirSync as il,realpathSync as sl}from"node:fs";import Qe from"node:path";import T from"typescript";function Pn(e,n){if(T.isIdentifier(e))n.add(e.text);else for(let t of e.elements)T.isBindingElement(t)&&Pn(t.name,n)}function vn(e){let n=new Map,t=new Set,r=o=>{n.set(o,(n.get(o)??0)+1)},i=o=>{let c=Ne(o);if(T.isIdentifier(c))t.add(c.text);else if(T.isArrayLiteralExpression(c))for(let u of c.elements)i(u);else if(T.isObjectLiteralExpression(c))for(let u of c.properties)T.isShorthandPropertyAssignment(u)?t.add(u.name.text):T.isPropertyAssignment(u)?i(u.initializer):T.isSpreadAssignment(u)&&i(u.expression);else T.isSpreadElement(c)?i(c.expression):T.isBinaryExpression(c)&&c.operatorToken.kind===T.SyntaxKind.EqualsToken&&i(c.left)},s=o=>{let c=new Set;Pn(o,c);for(let u of c)r(u)},a=o=>{T.isVariableDeclaration(o)?s(o.name):T.isFunctionDeclaration(o)&&o.name!==void 0||T.isClassDeclaration(o)&&o.name!==void 0?r(o.name.text):T.isParameter(o)?s(o.name):((T.isFunctionExpression(o)||T.isClassExpression(o))&&o.name!==void 0&&T.isIdentifier(o.name)&&!(o.parent!==void 0&&T.isVariableDeclaration(o.parent)&&o.parent.initializer===o&&T.isIdentifier(o.parent.name)&&o.parent.name.text===o.name.text)||T.isImportClause(o)&&o.name!==void 0||T.isNamespaceImport(o)||T.isImportSpecifier(o)||T.isImportEqualsDeclaration(o))&&r(o.name.text),T.isBinaryExpression(o)&&o.operatorToken.kind>=T.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=T.SyntaxKind.LastAssignment?i(o.left):(T.isPrefixUnaryExpression(o)||T.isPostfixUnaryExpression(o))&&(o.operator===T.SyntaxKind.PlusPlusToken||o.operator===T.SyntaxKind.MinusMinusToken)?i(o.operand):(T.isForOfStatement(o)||T.isForInStatement(o))&&!T.isVariableDeclarationList(o.initializer)&&i(o.initializer),T.forEachChild(o,a)};a(e);let l=new Set(t);for(let[o,c]of n)c>1&&l.add(o);return l}function hn(e,n,t){let r=vn(e),i=new Map,s=a=>{T.isVariableDeclaration(a)&&T.isIdentifier(a.name)&&a.initializer!==void 0&&!r.has(a.name.text)&&!i.has(a.name.text)&&i.set(a.name.text,a.initializer),T.forEachChild(a,s)};return s(e),{containingFile:n,taintedNames:r,constBindings:i,resolveParamDirs:t}}var ol=1024,al=32,ll=new Set(["filter","sort","slice","reverse"]),dl=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ne(e){let n=e;for(;T.isParenthesizedExpression(n);)n=n.expression;return n}function Mi(e,n){return T.isPropertyAccessExpression(e)&&T.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function on(e,n,t,r){if(t>al)return null;let i=Ne(e);if(T.isStringLiteralLike(i))return i.text;if(T.isTemplateExpression(i)){let s=i.head.text;for(let a of i.templateSpans){let l=on(a.expression,n,t+1,r);if(l===null)return null;s+=l+a.literal.text}return s}if(T.isBinaryExpression(i)&&i.operatorToken.kind===T.SyntaxKind.PlusToken){let s=on(i.left,n,t+1,r);if(s===null)return null;let a=on(i.right,n,t+1,r);return a===null?null:s+a}if(T.isIdentifier(i)){if(i.text==="__dirname")return Qe.dirname(n.containingFile);if(i.text==="__filename")return n.containingFile;if(n.taintedNames.has(i.text)||r.has(i.text))return null;let s=n.constBindings.get(i.text);if(s===void 0)return null;r.add(i.text);let a=on(s,n,t+1,r);return r.delete(i.text),a}if(T.isCallExpression(i)){let s=Mi(i.expression,"join"),a=Mi(i.expression,"resolve");if(!s&&!a)return null;let l=[];for(let c of i.arguments){let u=on(c,n,t+1,r);if(u===null)return null;l.push(u)}let o=l[0];return o===void 0||a&&!Qe.isAbsolute(o)?null:a?Qe.resolve(...l):Qe.join(...l)}return null}function st(e){let n=Ne(e);if(T.isBinaryExpression(n)&&n.operatorToken.kind===T.SyntaxKind.PlusToken)return[...st(n.left),...st(n.right)];if(T.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let r of n.templateSpans)t.push({expr:r.expression}),r.literal.text.length>0&&t.push({lit:r.literal.text});return t}return T.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Ti(e){let n=e,t=0;for(;t++<4096;){let r=n.parent;if(r===void 0)return null;if(T.isForOfStatement(r)&&r.statement===n){let i=r.initializer;if(T.isVariableDeclarationList(i)&&i.declarations.length===1&&i.declarations[0]!==void 0&&T.isIdentifier(i.declarations[0].name)&&i.declarations[0].name.text===e.text){let s=Pi(r.expression);if(s!==null)return s}}if((T.isArrowFunction(n)||T.isFunctionExpression(n))&&T.isCallExpression(r)&&r.arguments.length>0&&r.arguments[0]===n&&T.isPropertyAccessExpression(r.expression)&&dl.has(r.expression.name.text)){let i=n.parameters[0];if(i!==void 0&&T.isIdentifier(i.name)&&i.name.text===e.text){let s=Pi(r.expression.expression);if(s!==null)return s}}n=r}return null}function Pi(e){let n=Ne(e),t=0;for(;T.isCallExpression(n)&&t++<16;){let r=n.expression;if(T.isPropertyAccessExpression(r)){let i=r.name.text;if(i==="readdirSync")return n.arguments[0]??null;if(ll.has(i)){n=Ne(r.expression);continue}return null}return T.isIdentifier(r)&&r.text==="readdirSync"?n.arguments[0]??null:null}return null}function cl(e,n){let t=st(e);if(t.length<2)return null;let r=t[t.length-1];if(r===void 0||!("expr"in r)||!T.isIdentifier(r.expr))return null;let i=r.expr;if(n.taintedNames.has(i.text))return null;let s="";for(let c=0;c<t.length-1;c+=1){let u=t[c];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let f=on(u.expr,n,0,new Set);if(f===null)return null;s+=f}}let a=Ti(i),l=a===null?null:on(a,n,0,new Set);if(l===null)return null;let o=Qe.resolve(s);return o!==Qe.resolve(l)?null:o}function ul(e){if((T.isFunctionDeclaration(e)||T.isFunctionExpression(e))&&e.name!==void 0&&T.isIdentifier(e.name)||T.isMethodDeclaration(e)&&T.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&T.isVariableDeclaration(n)&&T.isIdentifier(n.name)?n.name.text:null}function fl(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!T.isFunctionLike(t))continue;let r=-1;for(let s=0;s<t.parameters.length;s+=1){let a=t.parameters[s];if(a!==void 0&&T.isIdentifier(a.name)&&a.name.text===n){r=s;break}}if(r<0)continue;let i=ul(t);return i===null?null:{fnName:i,paramIndex:r}}return null}function Ln(e,n){let t=st(e);if(t.length!==2)return null;let[r,i]=t;if(r===void 0||!("expr"in r)||!T.isIdentifier(r.expr)||i===void 0||!("expr"in i)||!T.isIdentifier(i.expr))return null;let s=r.expr,a=i.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(a.text))return null;let l=Ti(a);return l===null||!T.isIdentifier(l)||l.text!==s.text?null:fl(s,s.text)}function pl(e,n){if(n.resolveParamDirs===void 0)return null;let t=Ln(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function ot(e){for(let n=e.parent;n!==void 0;n=n.parent){if(T.isSourceFile(n))return!0;if(!T.isArrowFunction(n)&&T.isFunctionLike(n))return!1}return!0}function Zt(e,n){let t=on(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let r=cl(e,n);if(r!==null)return{kind:"dir",dir:r};let i=pl(e,n);return i!==null&&i.length>0?{kind:"dirs",dirs:[...i]}:{kind:"opaque"}}function Di(e,n){let t;try{t=sl(e)}catch{return null}let r=n.endsWith(Qe.sep)?n:n+Qe.sep;return t===n||t.startsWith(r)?t:null}function Fi(e,n,t,r,i){let s=Te(e,n,r,i);return s===null||Be(s)||!it(s)?null:Di(s,t)}function Li(e,n,t,r,i){let s=Di(e,t);if(s===null)return[];let a;try{a=il(s)}catch{return[]}if(a.length===0||a.length>ol)return[];a.sort();let l=new Set,o=[];for(let c of a){let u=Fi(Qe.join(s,c),n,t,r,i);u!==null&&!l.has(u)&&(l.add(u),o.push(u))}return o}function at(e,n,t,r,i){let s=Zt(e,n);if(s.kind==="const"){if(ue(s.value)==="package-root")return[];let a=Fi(s.value,n.containingFile,t,r,i);return a===null?[]:[a]}if(s.kind==="dir")return Li(s.dir,n.containingFile,t,r,i);if(s.kind==="dirs"){let a=new Set,l=[];for(let o of s.dirs)for(let c of Li(o,n.containingFile,t,r,i))a.has(c)||(a.add(c),l.push(c));return l}return[]}import ml from"node:path";import ne from"typescript";var hl=32,lt="\0",ji=(e,n)=>`${e}${lt}${n}`,Ki=(e,n,t)=>`${e}${lt}${n}${lt}${String(t)}`;function gl(e){let n=new Map,t=new Set,r=(i,s)=>{if(t.has(i)){n.delete(i);return}t.add(i),n.set(i,s)};for(let i of e.statements)if(ne.isImportDeclaration(i)&&ne.isStringLiteralLike(i.moduleSpecifier)){let s=i.moduleSpecifier.text,a=i.importClause;if(a===void 0)continue;a.name!==void 0&&r(a.name.text,{kind:"module",specifier:s});let l=a.namedBindings;if(l!==void 0&&ne.isNamespaceImport(l))r(l.name.text,{kind:"module",specifier:s});else if(l!==void 0&&ne.isNamedImports(l))for(let o of l.elements)r(o.name.text,{kind:"named",specifier:s,imported:(o.propertyName??o.name).text})}else if(ne.isImportEqualsDeclaration(i)&&ne.isExternalModuleReference(i.moduleReference)&&ne.isStringLiteralLike(i.moduleReference.expression))r(i.name.text,{kind:"module",specifier:i.moduleReference.expression.text});else if(ne.isFunctionDeclaration(i)&&i.name!==void 0)r(i.name.text,{kind:"local"});else if(ne.isVariableStatement(i))for(let s of i.declarationList.declarations){if(s.initializer===void 0)continue;let a=s.initializer;if(ne.isIdentifier(s.name))ne.isArrowFunction(a)||ne.isFunctionExpression(a)?r(s.name.text,{kind:"local"}):Bi(a)&&r(s.name.text,{kind:"module",specifier:zi(a)});else if(ne.isObjectBindingPattern(s.name)&&Bi(a)){let l=zi(a);for(let o of s.name.elements){if(o.dotDotDotToken!==void 0||!ne.isIdentifier(o.name))continue;let c=o.propertyName??o.name;!ne.isIdentifier(c)&&!ne.isStringLiteralLike(c)||r(o.name.text,{kind:"named",specifier:l,imported:c.text})}}}return n}function Bi(e){return ne.isCallExpression(e)&&ne.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&ne.isStringLiteralLike(e.arguments[0])}function zi(e){let n=e.arguments[0];return n!==void 0&&ne.isStringLiteralLike(n)?n.text:"\0"}function yl(e){let n=e.expression;if(ne.isPropertyAccessExpression(n))return n.name.text;if(ne.isIdentifier(n))return n.text}function xl(e,n,t,r,i,s){let a=e.expression,l=o=>{let c=`${o}${lt}${n}`,u=s.get(c);if(u!==void 0||s.has(c))return u??null;let f=Te(o,n,r,i),p=f===null?null:ml.resolve(f);return s.set(c,p),p};if(ne.isPropertyAccessExpression(a)&&ne.isIdentifier(a.expression)){let o=t.get(a.expression.text);if(o?.kind==="module"){let c=l(o.specifier);return c===null?null:{moduleReal:c,fnName:a.name.text}}return null}if(ne.isIdentifier(a)){let o=t.get(a.text);if(o?.kind==="named"){let c=l(o.specifier);return c===null?null:{moduleReal:c,fnName:o.imported}}return o?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function Ui(e,n,t,r,i=new Map){if(n.length===0)return()=>null;let s=new Map,a=new Set;for(let o of n){let c=ji(o.definingModuleReal,o.fnName),u=s.get(c);u===void 0&&(u=new Set,s.set(c,u)),u.add(o.paramIndex),a.add(o.fnName)}let l=new Map;for(let o of e){let c=hn(o.sf,o.real),u=gl(o.sf),f=p=>{if(ne.isCallExpression(p)){let h=yl(p);if(h!==void 0&&a.has(h)&&ot(p)){let S=xl(p,o.real,u,t,r,i);if(S!==null){let x=s.get(ji(S.moduleReal,S.fnName));if(x!==void 0)for(let y of x){let v=p.arguments[y];if(v===void 0)continue;let C=Zt(v,c);if(C.kind==="const"){let $=Ki(S.moduleReal,S.fnName,y),N=l.get($);N===void 0&&(N=new Set,l.set($,N)),N.add(C.value)}}}}}ne.forEachChild(p,f)};f(o.sf)}return(o,c,u)=>{let f=l.get(Ki(o,c,u));return f===void 0||f.size===0||f.size>hl?null:[...f].sort()}}var Xe={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:g.ScriptTarget.ES2020,module:g.ModuleKind.CommonJS,moduleResolution:g.ModuleResolutionKind.Node10,types:[]},dt=5e3;function Je(e,n){let t;try{t=gn(n)}catch{t=Se.resolve(n)}let r=e.endsWith(Se.sep)?e:e+Se.sep;return t!==e&&!t.startsWith(r)?null:t===e?"":t.slice(r.length).split(Se.sep).join("/")}function le(e){let n=e;for(;;)if(g.isParenthesizedExpression(n))n=n.expression;else if(g.isBinaryExpression(n)&&n.operatorToken.kind===g.SyntaxKind.CommaToken)n=n.right;else return n}function en(e){return g.isPropertyAccessExpression(e)?{receiver:le(e.expression),name:e.name.text}:g.isElementAccessExpression(e)&&g.isStringLiteralLike(e.argumentExpression)?{receiver:le(e.expression),name:e.argumentExpression.text}:null}function Fn(e){let n=le(e.expression);if(g.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===g.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=en(n);if(t!==null){if(t.name==="require"&&g.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(g.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let r=e.arguments[1];return{specifierArg:r!==void 0&&g.isArrayLiteralExpression(r)?r.elements[0]:void 0}}}}return null}function Vi(e){let n=[],t=r=>{if(g.isImportDeclaration(r)&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.importClause?.isTypeOnly!==!0});else if(g.isImportEqualsDeclaration(r)&&g.isExternalModuleReference(r.moduleReference)&&g.isStringLiteralLike(r.moduleReference.expression))n.push({text:r.moduleReference.expression.text,runtime:!0});else if(g.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&g.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.isTypeOnly!==!0});else if(g.isCallExpression(r)){let i=Fn(r),s=i?.specifierArg;i!==null&&s!==void 0&&g.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}g.forEachChild(r,t)};return t(e),n}function bl(e,n){let t=n===g.ScriptKind.TSX?"__scriptkind_probe.tsx":n===g.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",r=g.createSourceFile(t,e,g.ScriptTarget.ES2020,!0,n),i={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:a=>a===t?r:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return g.createProgram({rootNames:[t],options:i,host:s}).getSyntacticDiagnostics(r).length}function rr(e){return e.endsWith(".js")||e.endsWith(".jsx")}function qi(e){let n=0,t=r=>{(g.isCallExpression(r)||g.isNewExpression(r)||g.isTaggedTemplateExpression(r))&&(n+=1),g.forEachChild(r,t)};return t(e),n}function Gi(e,n){let t=Vi(g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0));if(!rr(e)||!n.includes("<")||!n.includes("require"))return t;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX),i=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Vi(r)){let a=`${s.runtime?"R":"T"}:${s.text}`;i.has(a)||(i.add(a),t.push(s))}return t}function Hi(e,n,t,r,i){if(!n.includes("require")&&!n.includes("import("))return[];let s=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0),a=hn(s,e,i),l=[],o=new Set;return Xi(s,c=>{for(let u of at(c,a,t,Xe,r))o.has(u)||(o.add(u),l.push(u))}),l}function Xi(e,n){let t=r=>{if(g.isCallExpression(r)){let i=Fn(r),s=i?.specifierArg;i!==null&&s!==void 0&&!g.isStringLiteralLike(s)&&n(s)}g.forEachChild(r,t)};t(e)}function kl(e){let n=[];for(let t of e){let r=hn(t.sf,t.real);Xi(t.sf,i=>{let s=Ln(i,r);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var El=4,Qt=dt,er=new Set(["eval","Function","createRequire"]),wl=new Set(["require","eval","Function","createRequire"]),ft=new Set(["module","Module","require","process","global","globalThis"]),pt=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function vl(e){return e===g.SyntaxKind.LessThanToken||e===g.SyntaxKind.GreaterThanToken||e===g.SyntaxKind.LessThanEqualsToken||e===g.SyntaxKind.GreaterThanEqualsToken||e===g.SyntaxKind.EqualsEqualsToken||e===g.SyntaxKind.EqualsEqualsEqualsToken||e===g.SyntaxKind.ExclamationEqualsToken||e===g.SyntaxKind.ExclamationEqualsEqualsToken||e===g.SyntaxKind.InstanceOfKeyword||e===g.SyntaxKind.InKeyword}function Il(e){let n=e.parent;return(g.isParameter(n)||g.isVariableDeclaration(n)||g.isBindingElement(n)||g.isFunctionDeclaration(n)||g.isFunctionExpression(n)||g.isClassDeclaration(n)||g.isClassExpression(n)||g.isPropertyAssignment(n)||g.isPropertyDeclaration(n)||g.isMethodDeclaration(n))&&n.name===e?!0:g.isPropertyAccessExpression(n)&&n.name===e}function Al(e,n){return g.isCallExpression(n)&&n.expression===e||(g.isPropertyAccessExpression(n)||g.isElementAccessExpression(n))&&n.expression===e||g.isTypeOfExpression(n)||g.isVoidExpression(n)||g.isDeleteExpression(n)||g.isPrefixUnaryExpression(n)||g.isPostfixUnaryExpression(n)?!0:g.isBinaryExpression(n)&&vl(n.operatorToken.kind)}function Ji(e){let n=e,t=e.parent;for(;;)if(g.isParenthesizedExpression(t))n=t,t=t.parent;else if(g.isBinaryExpression(t)&&t.operatorToken.kind===g.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Al(n,t)}function _l(e){return Il(e)?!1:Ji(e)}function Yi(e){let n=en(e);if(n!==null&&pt.has(n.name))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=le(e.expression);if(g.isIdentifier(t)&&ft.has(t.text))return!0}return!1}function Tn(e){let n=en(e);if(n===null||n.name!=="constructor")return!1;let t=en(n.receiver);return t!==null&&t.name==="constructor"}function Zi(e){if(!g.isCallExpression(e))return!1;let n=le(e.expression);if(!g.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&g.isStringLiteralLike(t)&&t.text==="module"}var Nl={roots:new Map,nodes:new Set,saturated:!1};function Qi(e){return g.isSourceFile(e)||g.isFunctionDeclaration(e)||g.isFunctionExpression(e)||g.isArrowFunction(e)||g.isMethodDeclaration(e)||g.isConstructorDeclaration(e)||g.isGetAccessorDeclaration(e)||g.isSetAccessorDeclaration(e)||g.isClassStaticBlockDeclaration(e)||g.isModuleDeclaration(e)}function es(e,n){let t=e.parent;for(;t!==void 0;){if(Qi(t))return t;t=t.parent}return n}function Cl(e){let n=new Set;if(g.isFunctionLike(e))for(let r of e.parameters)for(let i of Dn(r.name))n.add(i);let t=[e];for(;t.length>0;){let r=t.pop();if(r===void 0)break;if(!(r!==e&&Qi(r))){if(g.isVariableDeclaration(r)&&g.isVariableDeclarationList(r.parent)&&!((r.parent.flags&g.NodeFlags.BlockScoped)!==0))for(let s of Dn(r.name))n.add(s);g.forEachChild(r,i=>{t.push(i)})}}return n}function Ol(e,n,t){let r=es(e,n);if(g.isSourceFile(r))return n;let i=t.get(r);return i===void 0&&(i=Cl(r),t.set(r,i)),i.has(e.text)?r:n}function ct(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let r=n;for(;;){if(t.has(r))return!0;let i=r.parent;if(i===void 0)return!g.isSourceFile(r);r=i}}var Rl=12,$l=8;function ut(e,n){let t=le(e);for(;;){if(n.nodes.has(t))return!0;if(g.isIdentifier(t))return ft.has(t.text)||ct(n,t);if(g.isCallExpression(t))return Zi(t);let r=en(t);if(r!==null){if(r.name==="constructor")return!0;t=r.receiver;continue}if(g.isElementAccessExpression(t)){t=le(t.expression);continue}return!1}}function ns(e){let n=en(le(e.expression));if(n===null||n.name!=="get"||!g.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function Ml(e,n){let t=ns(e);if(t===null||!ut(t.target,n))return!1;let r=t.key;return r===void 0||!g.isStringLiteralLike(r)?!0:pt.has(r.text)}function nr(e){if(!g.isFunctionExpression(e)&&!g.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,r=i=>{if(!(t||g.isFunctionExpression(i)||g.isFunctionDeclaration(i)||g.isClassLike(i))){if(g.isReturnStatement(i)&&i.expression!==void 0&&le(i.expression).kind===g.SyntaxKind.ThisKeyword){t=!0;return}g.forEachChild(i,r)}};return r(n),t}function Dn(e){if(g.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)g.isOmittedExpression(t)||n.push(...Dn(t.name));return n}function ts(e){return e.parameters.map(n=>Dn(n.name))}function Pl(e){let n=new Map,t=new Set,r=(s,a)=>{let l={fn:a,slots:ts(a)},o=n.get(s);o===void 0?n.set(s,[l]):o.push(l),nr(a)&&t.add(s)},i=s=>{if(g.isFunctionDeclaration(s)&&s.name!==void 0)r(s.name.text,s);else if(g.isVariableDeclaration(s)&&g.isIdentifier(s.name)&&s.initializer!==void 0){let a=le(s.initializer);(g.isFunctionExpression(a)||g.isArrowFunction(a))&&r(s.name.text,a)}g.forEachChild(s,i)};return i(e),{params:n,thisReturning:t}}function Ll(e){let n=new Map,t=new Set,r={roots:n,nodes:t},i=Pl(e),s=new Map,a=new Set(i.thisReturning),l=!0;for(let o=0;l;o+=1){if(o>=Rl)return{roots:n,nodes:t,saturated:!0};l=!1;let c=(x,y)=>{y!==""&&!x.has(y)&&(x.add(y),l=!0)},u=(x,y)=>{if(x==="")return;let v=n.get(x);v===void 0&&(v=new Set,n.set(x,v)),v.has(y)||(v.add(y),l=!0)},f=x=>{t.has(x)||(t.add(x),l=!0)},p=(x,y)=>{let v=le(x.expression);if(g.isIdentifier(v)&&er.has(v.text)||Tn(v)||g.isCallExpression(x)&&Zi(x)||nr(v))return!0;let C=en(v);if(C!==null&&(C.name==="call"||C.name==="apply"||C.name==="bind")){let $=C.receiver;if(nr($)||t.has($)||g.isIdentifier($)&&(ct(r,$)||a.has($.text)))return!0}if(t.has(v)||(g.isCallExpression(v)||g.isNewExpression(v))&&p(v,y+1)||g.isIdentifier(v)&&(ct(r,v)||a.has(v.text)))return!0;if(g.isCallExpression(x)){let $=ns(x);if($!==null&&ut($.target,r))return!0}return!1},h=(x,y)=>{if(y>=$l)return!0;let v=le(x);if(t.has(v))return!0;if(g.isIdentifier(v))return ft.has(v.text)||ct(r,v);if(g.isBinaryExpression(v)){let C=v.operatorToken.kind;return C===g.SyntaxKind.BarBarToken||C===g.SyntaxKind.AmpersandAmpersandToken||C===g.SyntaxKind.QuestionQuestionToken?h(v.left,y+1)||h(v.right,y+1):!1}return g.isConditionalExpression(v)?h(v.whenTrue,y+1)||h(v.whenFalse,y+1):g.isPropertyAccessExpression(v)||g.isElementAccessExpression(v)?ut(v,r):g.isCallExpression(v)||g.isNewExpression(v)?p(v,y+1):!1},S=(x,y)=>{if((g.isVariableDeclaration(x)||g.isParameter(x)||g.isBindingElement(x))&&x.initializer!==void 0){if(h(x.initializer,0)){let C=es(x,e);for(let $ of Dn(x.name))u($,C)}}else if(g.isBinaryExpression(x)&&x.operatorToken.kind===g.SyntaxKind.EqualsToken&&g.isIdentifier(x.left)&&h(x.right,0))u(x.left.text,Ol(x.left,e,s));else if(g.isReturnStatement(x)&&x.expression!==void 0&&y!==void 0&&h(x.expression,0))c(a,y);else if(g.isCallExpression(x)||g.isNewExpression(x)){p(x,0)&&f(x);let C=le(x.expression),$=en(C),N=$!==null&&$.name==="call",b=$!==null&&$.name==="apply",m=N||b?$.receiver:C,E=N?1:0,_=[];g.isFunctionExpression(m)||g.isArrowFunction(m)?_.push({fn:m,slots:ts(m)}):g.isIdentifier(m)&&_.push(...i.params.get(m.text)??[]);let F=x.arguments??[];if(b){let O=F[1]===void 0?void 0:le(F[1]);for(let{fn:I,slots:A}of _)if(O!==void 0&&g.isArrayLiteralExpression(O))for(let j=0;j<O.elements.length;j+=1){let z=O.elements[j],M=A[j];if(!(z===void 0||M===void 0)&&h(z,0))for(let J of M)u(J,I)}else if(O!==void 0)for(let j of A)for(let z of j)u(z,I)}else for(let{fn:O,slots:I}of _)for(let A=E;A<F.length;A+=1){let j=F[A],z=I[A-E];if(!(j===void 0||z===void 0)&&h(j,0))for(let M of z)u(M,O)}}let v=y;if(g.isFunctionDeclaration(x))v=x.name?.text;else if(g.isFunctionExpression(x)||g.isArrowFunction(x)){let C=x.parent;v=g.isVariableDeclaration(C)&&g.isIdentifier(C.name)?C.name.text:void 0}g.forEachChild(x,C=>S(C,v))};S(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Tl(e){if(g.isIdentifier(e)&&er.has(e.text)||Tn(e))return!0;let n=en(e);if(n!==null&&(pt.has(n.name)||(n.name==="call"||n.name==="apply")&&(g.isIdentifier(n.receiver)&&er.has(n.receiver.text)||Tn(n.receiver)||(g.isPropertyAccessExpression(n.receiver)||g.isElementAccessExpression(n.receiver))&&Yi(n.receiver))))return!0;if(g.isElementAccessExpression(e)&&!g.isStringLiteralLike(e.argumentExpression)){let t=le(e.expression);if(g.isIdentifier(t)&&ft.has(t.text))return!0}return!1}var Dl=4;function Wi(e,n){for(let t of e){if(!g.isStringLiteralLike(t)||n>=Dl)return!0;let r=g.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,_d=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
+                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Nd=5,Rd=6;function Cd(e){let n=e>=Rd?"a.details":"NULL AS details",t=e>=Nd?"ap.surface_complete":_d;return`${Id}, ${n}, ${t}${Ad}`}var Od="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",Pd="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",$d="SELECT value FROM ingest_meta WHERE key = 'schema_version'",Md="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem";function Zn(e,n=Nt){let t=n.open(e,"readonly"),r=t.prepare($d).get(),o=r!==void 0?be(r.value):"",i=/^\d+$/u.test(o)?Number(o):0,a=t.prepare(Cd(i)),l=t.prepare(Od),s=t.prepare(Pd),d=t.prepare(Md);return{schemaVersion:o,ecosystems(){return d.all({}).map(u=>be(u.ecosystem))},advisoriesForPackage(u,p){return a.all({eco:u,name:p}).map(f=>({affected:{id:Qe(f.ap_id)??0,advisoryId:be(f.advisory_id),ecosystem:be(f.ecosystem),packageName:be(f.package_name),introduced:ge(f.introduced),fixed:ge(f.fixed),lastAffected:ge(f.last_affected),fixCommit:ge(f.fix_commit),repoUrl:ge(f.repo_url),surfaceComplete:Qe(f.surface_complete)===1?1:0},advisory:{id:be(f.a_id),osvId:ge(f.osv_id),cveId:ge(f.cve_id),summary:ge(f.summary),details:ge(f.details),severity:ge(f.severity),published:ge(f.published),source:be(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(u){return l.all({id:u}).map(p=>({id:Qe(p.id)??0,affectedPackageId:Qe(p.affected_package_id)??0,exportName:ge(p.export_name),symbolKind:be(p.symbol_kind),matchPattern:ge(p.match_pattern),matchGlobs:ge(p.match_globs),container:ge(p.container),sourcePath:ge(p.source_path),declStart:Qe(p.decl_start),declEnd:Qe(p.decl_end),astHashBefore:ge(p.ast_hash_before),astHashAfter:ge(p.ast_hash_after),derivation:be(p.derivation),confidence:be(p.confidence),verified:Qe(p.verified)===1?1:0}))},aliasesForSymbol(u){return s.all({id:u}).map(p=>({id:Qe(p.id)??0,vulnerableSymbolId:Qe(p.vulnerable_symbol_id)??0,aliasPath:be(p.alias_path),aliasName:be(p.alias_name)}))},allModels(){let u;try{u=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+               FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let p=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return u.map(f=>{let h=Qe(f.id)??0;return{packageName:be(f.package_name),modelId:be(f.evidence_ref),introduced:be(f.introduced),fixedBefore:ge(f.fixed_before),evidenceRef:be(f.evidence_ref),edges:p.all({id:h}).map(g=>({kind:be(g.kind),anchorExport:be(g.anchor_export),anchorContainer:ge(g.anchor_container),calleePackage:be(g.callee_package),calleeContainer:ge(g.callee_container),calleeExport:be(g.callee_export)}))}})},close(){t.close()}}}function kr(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let p of e)if(p.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${p.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,r=new Map,o=new Map,i=new Map,a=1,l=(p,f,h,g)=>{let S=`${String(h)}:${String(g)}`,E=p.get(S);if(E!==void 0)return E;let w=a;a+=1,p.set(S,w);let I=e[h];if(I===void 0)throw new Error("unreachable: reader index out of range");return f.set(w,{reader:I,id:g}),w},s=e.map(p=>new Set(p.ecosystems?.()??[])),d=p=>{let f=e.map((h,g)=>g).filter(h=>s[h]?.has(p)===!0);return f.length>0?f:e.map((h,g)=>g).filter(h=>e[h]?.ecosystems===void 0)},u=(p,f)=>({...f,id:l(o,i,p,f.id),affectedPackageId:l(t,r,p,f.affectedPackageId)});return{schemaVersion:n.schemaVersion,ecosystems(){let p=new Set;for(let f of s)for(let h of f)p.add(h);return[...p].sort()},advisoriesForPackage(p,f){let h=[];for(let g of d(p)){let S=e[g];if(S!==void 0)for(let E of S.advisoriesForPackage(p,f))h.push({...E,affected:{...E.affected,id:l(t,r,g,E.affected.id)}})}return h},symbolsForAffected(p){let f=r.get(p);if(f===void 0)return[];let h=e.indexOf(f.reader);return f.reader.symbolsForAffected(f.id).map(g=>u(h,g))},aliasesForSymbol(p){let f=i.get(p);if(f===void 0)return[];let h=e.indexOf(f.reader);return f.reader.aliasesForSymbol(f.id).map(g=>({...g,vulnerableSymbolId:l(o,i,h,g.vulnerableSymbolId)}))},allModels(){return e.flatMap(p=>p.allModels?.()??[])},close(){for(let p of e)p.close()}}}var wn="6";import{realpathSync as dn}from"node:fs";import ze from"node:path";import{realpathSync as An}from"node:fs";import{isBuiltin as Tr}from"node:module";import Re from"node:path";import b from"typescript";function Er(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function ye(e){let n=Er(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function je(e){let n=Er(e);if(n.startsWith("@")){let r=n.indexOf("/");if(r===-1)return n;let o=n.indexOf("/",r+1);return o===-1?n:n.slice(0,o)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function pi(e){let n=Er(e),t=je(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as jd,statSync as wr}from"node:fs";var pn=16*1024*1024;function Fn(e,n){try{let t=wr(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:jd(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function _e(e){let n=Fn(e,pn);return n.kind==="ok"?n.text:null}function en(e){try{return wr(e).isFile()}catch{return!1}}function mi(e){try{let n=wr(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Kd,realpathSync as Ar}from"node:fs";import re from"node:path";import Rt from"typescript";var bi=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Me(e){return bi.some(([n])=>e.endsWith(n))}function Bd(e){for(let[n,t]of bi)if(e.endsWith(n)){let r=e.slice(0,-n.length);return t.map(o=>r+o)}return[]}var zd=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function ki(e){if(Me(e))return e;for(let[n,t]of zd)if(e.endsWith(n)){let r=e.slice(0,-n.length);for(let o of t){let i=r+o;if(en(i))return i}return e}return e}var _r=[Rt.ModuleKind.CommonJS,Rt.ModuleKind.ESNext],Nr=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function Qn(e,n,t,r,o,i){let a=Rt.resolveModuleName(e,n,t,r,void 0,void 0,o).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(i){for(let s of Bd(l))if(en(s))return s}return l}var Ei=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],Ud=[".js",".json",".node"],Vd=["index.js","index.json","index.node"];function Ct(e){return!Me(e)&&Ei.some(n=>e.endsWith(n))}function wi(e){if(en(e))return e;for(let n of Ud)if(en(e+n))return e+n;return null}function hi(e){for(let n of Vd){let t=re.join(e,n);if(en(t))return t}return null}var vi=[".ts",".tsx",".cts",".mts",".jsx"];function Wd(e){for(let n of vi)if(en(e+n))return e+n;return null}function qd(e){for(let n of vi){let t=re.join(e,"index"+n);if(en(t))return t}return null}function Rr(e){let n=_e(re.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let r=re.join(e,t),o=wi(r)??hi(r);if(o!==null)return o}}catch{}return hi(e)}function Ii(e){return wi(e)??Rr(e)??Wd(e)??qd(e)}function Ai(e){return Ii(e)!==null}function Gd(e,n){let t=e.split(re.sep),r=n.split("/"),o=null;for(let a=t.length-r.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&r.every((l,s)=>t[a+1+s]===l)){o=t.slice(0,a+1+r.length).join(re.sep);break}if(o===null||o==="")return null;let i=_e(re.join(o,"package.json"));if(i===null)return null;try{let a=JSON.parse(i),l=a.exports,s=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||s)return null}catch{return null}try{return Ar(o)}catch{return null}}function Hd(e,n){let t=Ii(re.join(e,n));if(t===null)return null;let r;try{r=Ar(t)}catch{return null}let o=e.endsWith(re.sep)?e:e+re.sep;return r!==e&&!r.startsWith(o)||Me(r)||!Ei.some(i=>r.endsWith(i))?null:r}function Xd(e,n){let t=pi(e);return t===""||t.includes("\0")||t.split("/").some(r=>r===""||r==="."||r===".."||r==="node_modules")?null:Hd(n,t)}var vn={kind:"nothing-loads"},vr=8192;function Ir(e,n){let t=n.get(e);if(t!==void 0)return t;let r,o=null;try{o=Kd(e);let i=new Set,a=!1;for(;;){let l=o.readSync();if(l===null)break;if(i.size>=vr){a=!0;break}i.add(l.name)}r={names:i,truncated:a}}catch{r=null}finally{try{o?.closeSync()}catch{}}return n.set(e,r),r}var Yd=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function _i(e){return Yd.some(n=>e.length>n.length&&e.endsWith(n))}function mn(e,n){let t=e.endsWith(re.sep)?e:e+re.sep;return n===e||n.startsWith(t)}function gi(e,n){let t;try{t=Ar(n)}catch{return{kind:"missing"}}return mn(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function yi(e,n){let t=(n+".").toLowerCase(),r=[];for(let o of e){let i=o.toLowerCase();i.length>t.length&&i.startsWith(t)&&r.push(o)}return r}function Jd(e,n,t){let r=re.dirname(n);if(!mn(e,r))return null;let o=Ir(r,t);if(o===null)return null;let i=re.basename(n);return o.names.has(i)?i:null}function xi(e,n){let t=e.filter(o=>!_i(o));if(t.length===0)return vn;let r=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${r}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Ni(e,n,t,r){let o=e,i=o.indexOf("?");i!==-1&&(o=o.slice(0,i));let a=o.indexOf("#");if(a!==-1&&(o=o.slice(0,a)),o===""||o.includes("\0"))return vn;let l=re.resolve(re.dirname(n),o);if(!mn(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let s=gi(t,l);if(s.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(s.kind==="ok"){let h=mi(s.real);if(h==="file"){let E=Jd(t,s.real,r);return E!==null&&_i(E)?vn:{kind:"unanalyzable",reason:E===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${E}") the analyzer cannot parse`,why:E===null?"probe-refused":"sibling-unparsable"}}if(h!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let g=Ir(s.real,r);if(g===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let S=xi(yi(g.names,"index"),"a directory index");return S.kind==="unanalyzable"?S:g.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:g.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(vr)} entries and was not fully probed`,why:"probe-refused"}:vn}let d=re.basename(l);if(d===""||d==="."||d==="..")return vn;let u=gi(t,re.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(u.kind==="missing")return vn;let p=Ir(u.real,r);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let f=xi(yi(p.names,d),"a sibling file exists");return f.kind==="unanalyzable"?f:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(vr)} entries and was not fully probed`,why:"probe-refused"}:vn}function Cr(e,n){let t=je(e),r=re.dirname(n);for(let o=0;o<64;o+=1){let i=re.join(r,"node_modules",...t.split("/"));if(_e(re.join(i,"package.json"))!==null)return i;let a=re.dirname(r);if(a===r)return null;r=a}return null}function Si(e,n,t,r,o){let i;for(let a of _r)for(let l of Nr){let s={...t,noDtsResolution:!0,customConditions:[...l]},d=Qn(e,n,s,r,a,o);if(i===void 0)i=d;else if(i!==d)return null}return i??null}function Ke(e,n,t,r){let o=ye(e);if(o==="relative")return Qn(e,n,t,r,void 0,!0);if(o==="package-root"){let l=Si(e,n,t,r,!0);if(l!==null)return l;let s=Cr(e,n);if(s===null||_e(re.join(s,"package.json"))?.includes('"exports"')===!0)return null;let d=Rr(s);return d===null||Me(d)?null:mn(s,d)?d:null}let i=Si(e,n,t,r,!1);if(i===null)return null;let a=Gd(i,je(e));return a!==null?Xd(e,a):Me(i)?i:ki(i)}function Ri(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function et(e,n,t,r){let o=ye(e);if(o==="relative")return"no-candidate";if(Ri(e))return"alias-unmapped";let i=new Set;for(let g of _r)for(let S of Nr){let E={...t,noDtsResolution:!0,customConditions:[...S]};i.add(Qn(e,n,E,r,g,o==="package-root"))}if(i.size>1)return"divergent-exports";let a=Cr(e,n);if(a===null)return"not-installed";let l=_e(re.join(a,"package.json"));if(l===null)return"unreadable-manifest";let s;try{s=JSON.parse(l)}catch{return"unreadable-manifest"}if(typeof s!="object"||s===null)return"unreadable-manifest";let d=s,u=d.exports!==void 0&&d.exports!==null,p=typeof d.typesVersions=="object"&&d.typesVersions!==null,[f]=i;if(f!=null)return mn(a,f)?!u&&p?"types-versions-remap":Me(f)?"declaration-only":"no-candidate":"out-of-root";let h=Qn(e,n,t,r,void 0,!1);if(h!==null&&Me(h))return!u&&p?"types-versions-remap":"declaration-only";if(o==="package-root"&&!u){let g=Rr(a);if(g!==null&&!mn(a,g))return"out-of-root"}return"no-candidate"}function jn(e,n,t,r){let o=Ke(e,n,t,r);if(o!==null)return[o];let i=ye(e);if(i==="relative")return[];let a=new Set;for(let d of _r)for(let u of Nr){let p={...t,noDtsResolution:!0,customConditions:[...u]};a.add(Qn(e,n,p,r,d,i==="package-root"))}if(a.size<2||a.has(null))return[];let l=Cr(e,n);if(l===null)return[];let s=[];for(let d of a){if(d===null)return[];let u=ki(d);if(Me(u)||!mn(l,u))return[];s.push(u)}return[...new Set(s)].sort()}function Ci(e,n){let t=re.dirname(e);for(let r=0;r<64;r+=1){let o=_e(re.join(t,"package.json"));if(o!==null){try{let a=JSON.parse(o);if(typeof a!="object"||a===null)return!1;let l=a.optionalDependencies;if(typeof l=="object"&&l!==null&&n in l)return!0;let s=a.peerDependenciesMeta;if(typeof s=="object"&&s!==null){let d=s[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let i=re.dirname(t);if(i===t)return!1;t=i}return!1}function Oi(e,n,t){let r=_e(re.join(e,"tsconfig.json"));if(r===null)return()=>null;let o=Rt.parseConfigFileTextToJson(re.join(e,"tsconfig.json"),r);if(o.error!==void 0)return()=>null;let i=o.config?.compilerOptions;if(typeof i!="object"||i===null)return()=>null;let a=i.paths;if(typeof a!="object"||a===null)return()=>null;let l=i.baseUrl,s=typeof l=="string"?re.resolve(e,l):e,d=new Map,u=[];for(let[f,h]of Object.entries(a)){if(!Array.isArray(h))continue;let g=h.filter(E=>typeof E=="string");if(g.length===0)continue;let S=f.indexOf("*");S===-1?d.set(f,g):f.indexOf("*",S+1)===-1&&u.push({prefix:f.slice(0,S),suffix:f.slice(S+1),targets:g})}if(u.sort((f,h)=>h.prefix.length-f.prefix.length),d.size===0&&u.length===0)return()=>null;let p=f=>{let h=d.get(f);if(h!==void 0)return h;for(let g of u){if(f.length<g.prefix.length+g.suffix.length||!f.startsWith(g.prefix)||!f.endsWith(g.suffix))continue;let S=f.slice(g.prefix.length,f.length-g.suffix.length);return g.targets.map(E=>{let w=E.indexOf("*");return w===-1?E:E.slice(0,w)+S+E.slice(w+1)})}return[]};return(f,h)=>{let g=p(f);if(g.length===0||Ke(f,h,n,t)!==null)return null;for(let S of g){let E=re.resolve(s,S),w=re.relative(re.dirname(h),E).split(re.sep).join("/");if(w==="")continue;w.startsWith(".")||(w=`./${w}`);let I=Ke(w,h,n,t);if(I!==null&&mn(e,I))return I}return null}}import{readdirSync as Zd,realpathSync as Qd}from"node:fs";import an from"node:path";import V from"typescript";function nt(e,n){if(V.isIdentifier(e))n.add(e.text);else for(let t of e.elements)V.isBindingElement(t)&&nt(t.name,n)}function Kn(e){let n=new Map,t=new Set,r=s=>{n.set(s,(n.get(s)??0)+1)},o=s=>{let d=De(s);if(V.isIdentifier(d))t.add(d.text);else if(V.isArrayLiteralExpression(d))for(let u of d.elements)o(u);else if(V.isObjectLiteralExpression(d))for(let u of d.properties)V.isShorthandPropertyAssignment(u)?t.add(u.name.text):V.isPropertyAssignment(u)?o(u.initializer):V.isSpreadAssignment(u)&&o(u.expression);else V.isSpreadElement(d)?o(d.expression):V.isBinaryExpression(d)&&d.operatorToken.kind===V.SyntaxKind.EqualsToken&&o(d.left)},i=s=>{let d=new Set;nt(s,d);for(let u of d)r(u)},a=s=>{V.isVariableDeclaration(s)?i(s.name):V.isFunctionDeclaration(s)&&s.name!==void 0||V.isClassDeclaration(s)&&s.name!==void 0?r(s.name.text):V.isParameter(s)?i(s.name):((V.isFunctionExpression(s)||V.isClassExpression(s))&&s.name!==void 0&&V.isIdentifier(s.name)&&!(s.parent!==void 0&&V.isVariableDeclaration(s.parent)&&s.parent.initializer===s&&V.isIdentifier(s.parent.name)&&s.parent.name.text===s.name.text)||V.isImportClause(s)&&s.name!==void 0||V.isNamespaceImport(s)||V.isImportSpecifier(s)||V.isImportEqualsDeclaration(s))&&r(s.name.text),V.isBinaryExpression(s)&&s.operatorToken.kind>=V.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=V.SyntaxKind.LastAssignment?o(s.left):(V.isPrefixUnaryExpression(s)||V.isPostfixUnaryExpression(s))&&(s.operator===V.SyntaxKind.PlusPlusToken||s.operator===V.SyntaxKind.MinusMinusToken)?o(s.operand):(V.isForOfStatement(s)||V.isForInStatement(s))&&!V.isVariableDeclarationList(s.initializer)&&o(s.initializer),V.forEachChild(s,a)};a(e);let l=new Set(t);for(let[s,d]of n)d>1&&l.add(s);return l}function In(e,n,t){let r=Kn(e),o=new Map,i=a=>{V.isVariableDeclaration(a)&&V.isIdentifier(a.name)&&a.initializer!==void 0&&!r.has(a.name.text)&&!o.has(a.name.text)&&o.set(a.name.text,a.initializer),V.forEachChild(a,i)};return i(e),{containingFile:n,taintedNames:r,constBindings:o,resolveParamDirs:t}}var ec=1024,nc=32,tc=new Set(["filter","sort","slice","reverse"]),rc=new Set(["forEach","map","filter","flatMap","find","some","every"]);function De(e){let n=e;for(;V.isParenthesizedExpression(n);)n=n.expression;return n}function Pi(e,n){return V.isPropertyAccessExpression(e)&&V.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function hn(e,n,t,r){if(t>nc)return null;let o=De(e);if(V.isStringLiteralLike(o))return o.text;if(V.isTemplateExpression(o)){let i=o.head.text;for(let a of o.templateSpans){let l=hn(a.expression,n,t+1,r);if(l===null)return null;i+=l+a.literal.text}return i}if(V.isBinaryExpression(o)&&o.operatorToken.kind===V.SyntaxKind.PlusToken){let i=hn(o.left,n,t+1,r);if(i===null)return null;let a=hn(o.right,n,t+1,r);return a===null?null:i+a}if(V.isIdentifier(o)){if(o.text==="__dirname")return an.dirname(n.containingFile);if(o.text==="__filename")return n.containingFile;if(n.taintedNames.has(o.text)||r.has(o.text))return null;let i=n.constBindings.get(o.text);if(i===void 0)return null;r.add(o.text);let a=hn(i,n,t+1,r);return r.delete(o.text),a}if(V.isCallExpression(o)){let i=Pi(o.expression,"join"),a=Pi(o.expression,"resolve");if(!i&&!a)return null;let l=[];for(let d of o.arguments){let u=hn(d,n,t+1,r);if(u===null)return null;l.push(u)}let s=l[0];return s===void 0||a&&!an.isAbsolute(s)?null:a?an.resolve(...l):an.join(...l)}return null}function Ot(e){let n=De(e);if(V.isBinaryExpression(n)&&n.operatorToken.kind===V.SyntaxKind.PlusToken)return[...Ot(n.left),...Ot(n.right)];if(V.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let r of n.templateSpans)t.push({expr:r.expression}),r.literal.text.length>0&&t.push({lit:r.literal.text});return t}return V.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Di(e){let n=e,t=0;for(;t++<4096;){let r=n.parent;if(r===void 0)return null;if(V.isForOfStatement(r)&&r.statement===n){let o=r.initializer;if(V.isVariableDeclarationList(o)&&o.declarations.length===1&&o.declarations[0]!==void 0&&V.isIdentifier(o.declarations[0].name)&&o.declarations[0].name.text===e.text){let i=$i(r.expression);if(i!==null)return i}}if((V.isArrowFunction(n)||V.isFunctionExpression(n))&&V.isCallExpression(r)&&r.arguments.length>0&&r.arguments[0]===n&&V.isPropertyAccessExpression(r.expression)&&rc.has(r.expression.name.text)){let o=n.parameters[0];if(o!==void 0&&V.isIdentifier(o.name)&&o.name.text===e.text){let i=$i(r.expression.expression);if(i!==null)return i}}n=r}return null}function $i(e){let n=De(e),t=0;for(;V.isCallExpression(n)&&t++<16;){let r=n.expression;if(V.isPropertyAccessExpression(r)){let o=r.name.text;if(o==="readdirSync")return n.arguments[0]??null;if(tc.has(o)){n=De(r.expression);continue}return null}return V.isIdentifier(r)&&r.text==="readdirSync"?n.arguments[0]??null:null}return null}function oc(e,n){let t=Ot(e);if(t.length<2)return null;let r=t[t.length-1];if(r===void 0||!("expr"in r)||!V.isIdentifier(r.expr))return null;let o=r.expr;if(n.taintedNames.has(o.text))return null;let i="";for(let d=0;d<t.length-1;d+=1){let u=t[d];if(u===void 0)return null;if("lit"in u)i+=u.lit;else{let p=hn(u.expr,n,0,new Set);if(p===null)return null;i+=p}}let a=Di(o),l=a===null?null:hn(a,n,0,new Set);if(l===null)return null;let s=an.resolve(i);return s!==an.resolve(l)?null:s}function ic(e){if((V.isFunctionDeclaration(e)||V.isFunctionExpression(e))&&e.name!==void 0&&V.isIdentifier(e.name)||V.isMethodDeclaration(e)&&V.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&V.isVariableDeclaration(n)&&V.isIdentifier(n.name)?n.name.text:null}function sc(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!V.isFunctionLike(t))continue;let r=-1;for(let i=0;i<t.parameters.length;i+=1){let a=t.parameters[i];if(a!==void 0&&V.isIdentifier(a.name)&&a.name.text===n){r=i;break}}if(r<0)continue;let o=ic(t);return o===null?null:{fnName:o,paramIndex:r}}return null}function tt(e,n){let t=Ot(e);if(t.length!==2)return null;let[r,o]=t;if(r===void 0||!("expr"in r)||!V.isIdentifier(r.expr)||o===void 0||!("expr"in o)||!V.isIdentifier(o.expr))return null;let i=r.expr,a=o.expr;if(n.taintedNames.has(i.text)||n.taintedNames.has(a.text))return null;let l=Di(a);return l===null||!V.isIdentifier(l)||l.text!==i.text?null:sc(i,i.text)}function ac(e,n){if(n.resolveParamDirs===void 0)return null;let t=tt(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function Pt(e){for(let n=e.parent;n!==void 0;n=n.parent){if(V.isSourceFile(n))return!0;if(!V.isArrowFunction(n)&&V.isFunctionLike(n))return!1}return!0}function Or(e,n){let t=hn(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let r=oc(e,n);if(r!==null)return{kind:"dir",dir:r};let o=ac(e,n);return o!==null&&o.length>0?{kind:"dirs",dirs:[...o]}:{kind:"opaque"}}function Ti(e,n){let t;try{t=Qd(e)}catch{return null}let r=n.endsWith(an.sep)?n:n+an.sep;return t===n||t.startsWith(r)?t:null}function Li(e,n,t,r,o){let i=Ke(e,n,r,o);return i===null||Me(i)||!Ct(i)?null:Ti(i,t)}function Mi(e,n,t,r,o){let i=Ti(e,t);if(i===null)return[];let a;try{a=Zd(i)}catch{return[]}if(a.length===0||a.length>ec)return[];a.sort();let l=new Set,s=[];for(let d of a){let u=Li(an.join(i,d),n,t,r,o);u!==null&&!l.has(u)&&(l.add(u),s.push(u))}return s}function $t(e,n,t,r,o){let i=Or(e,n);if(i.kind==="const"){if(ye(i.value)==="package-root")return[];let a=Li(i.value,n.containingFile,t,r,o);return a===null?[]:[a]}if(i.kind==="dir")return Mi(i.dir,n.containingFile,t,r,o);if(i.kind==="dirs"){let a=new Set,l=[];for(let s of i.dirs)for(let d of Mi(s,n.containingFile,t,r,o))a.has(d)||(a.add(d),l.push(d));return l}return[]}import lc from"node:path";import ae from"typescript";var dc=32,Mt="\0",Fi=(e,n)=>`${e}${Mt}${n}`,ji=(e,n,t)=>`${e}${Mt}${n}${Mt}${String(t)}`;function cc(e){let n=new Map,t=new Set,r=(o,i)=>{if(t.has(o)){n.delete(o);return}t.add(o),n.set(o,i)};for(let o of e.statements)if(ae.isImportDeclaration(o)&&ae.isStringLiteralLike(o.moduleSpecifier)){let i=o.moduleSpecifier.text,a=o.importClause;if(a===void 0)continue;a.name!==void 0&&r(a.name.text,{kind:"module",specifier:i});let l=a.namedBindings;if(l!==void 0&&ae.isNamespaceImport(l))r(l.name.text,{kind:"module",specifier:i});else if(l!==void 0&&ae.isNamedImports(l))for(let s of l.elements)r(s.name.text,{kind:"named",specifier:i,imported:(s.propertyName??s.name).text})}else if(ae.isImportEqualsDeclaration(o)&&ae.isExternalModuleReference(o.moduleReference)&&ae.isStringLiteralLike(o.moduleReference.expression))r(o.name.text,{kind:"module",specifier:o.moduleReference.expression.text});else if(ae.isFunctionDeclaration(o)&&o.name!==void 0)r(o.name.text,{kind:"local"});else if(ae.isVariableStatement(o))for(let i of o.declarationList.declarations){if(i.initializer===void 0)continue;let a=i.initializer;if(ae.isIdentifier(i.name))ae.isArrowFunction(a)||ae.isFunctionExpression(a)?r(i.name.text,{kind:"local"}):Ki(a)&&r(i.name.text,{kind:"module",specifier:Bi(a)});else if(ae.isObjectBindingPattern(i.name)&&Ki(a)){let l=Bi(a);for(let s of i.name.elements){if(s.dotDotDotToken!==void 0||!ae.isIdentifier(s.name))continue;let d=s.propertyName??s.name;!ae.isIdentifier(d)&&!ae.isStringLiteralLike(d)||r(s.name.text,{kind:"named",specifier:l,imported:d.text})}}}return n}function Ki(e){return ae.isCallExpression(e)&&ae.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&ae.isStringLiteralLike(e.arguments[0])}function Bi(e){let n=e.arguments[0];return n!==void 0&&ae.isStringLiteralLike(n)?n.text:"\0"}function uc(e){let n=e.expression;if(ae.isPropertyAccessExpression(n))return n.name.text;if(ae.isIdentifier(n))return n.text}function fc(e,n,t,r,o,i){let a=e.expression,l=s=>{let d=`${s}${Mt}${n}`,u=i.get(d);if(u!==void 0||i.has(d))return u??null;let p=Ke(s,n,r,o),f=p===null?null:lc.resolve(p);return i.set(d,f),f};if(ae.isPropertyAccessExpression(a)&&ae.isIdentifier(a.expression)){let s=t.get(a.expression.text);if(s?.kind==="module"){let d=l(s.specifier);return d===null?null:{moduleReal:d,fnName:a.name.text}}return null}if(ae.isIdentifier(a)){let s=t.get(a.text);if(s?.kind==="named"){let d=l(s.specifier);return d===null?null:{moduleReal:d,fnName:s.imported}}return s?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function zi(e,n,t,r,o=new Map){if(n.length===0)return()=>null;let i=new Map,a=new Set;for(let s of n){let d=Fi(s.definingModuleReal,s.fnName),u=i.get(d);u===void 0&&(u=new Set,i.set(d,u)),u.add(s.paramIndex),a.add(s.fnName)}let l=new Map;for(let s of e){let d=In(s.sf,s.real),u=cc(s.sf),p=f=>{if(ae.isCallExpression(f)){let h=uc(f);if(h!==void 0&&a.has(h)&&Pt(f)){let g=fc(f,s.real,u,t,r,o);if(g!==null){let S=i.get(Fi(g.moduleReal,g.fnName));if(S!==void 0)for(let E of S){let w=f.arguments[E];if(w===void 0)continue;let I=Or(w,d);if(I.kind==="const"){let v=ji(g.moduleReal,g.fnName,E),_=l.get(v);_===void 0&&(_=new Set,l.set(v,_)),_.add(I.value)}}}}}ae.forEachChild(f,p)};p(s.sf)}return(s,d,u)=>{let p=l.get(ji(s,d,u));return p===void 0||p.size===0||p.size>dc?null:[...p].sort()}}var Ne={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:b.ScriptTarget.ES2020,module:b.ModuleKind.CommonJS,moduleResolution:b.ModuleResolutionKind.Node10,types:[]},Dt=5e3;function Oe(e,n){let t;try{t=An(n)}catch{t=Re.resolve(n)}let r=e.endsWith(Re.sep)?e:e+Re.sep;return t!==e&&!t.startsWith(r)?null:t===e?"":t.slice(r.length).split(Re.sep).join("/")}function ke(e){let n=e;for(;;)if(b.isParenthesizedExpression(n))n=n.expression;else if(b.isBinaryExpression(n)&&n.operatorToken.kind===b.SyntaxKind.CommaToken)n=n.right;else return n}function ln(e){return b.isPropertyAccessExpression(e)?{receiver:ke(e.expression),name:e.name.text}:b.isElementAccessExpression(e)&&b.isStringLiteralLike(e.argumentExpression)?{receiver:ke(e.expression),name:e.argumentExpression.text}:null}function it(e){let n=ke(e.expression);if(b.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===b.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=ln(n);if(t!==null){if(t.name==="require"&&b.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(b.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let r=e.arguments[1];return{specifierArg:r!==void 0&&b.isArrayLiteralExpression(r)?r.elements[0]:void 0}}}}return null}function Ui(e){let n=[],t=r=>{if(b.isImportDeclaration(r)&&b.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.importClause?.isTypeOnly!==!0});else if(b.isImportEqualsDeclaration(r)&&b.isExternalModuleReference(r.moduleReference)&&b.isStringLiteralLike(r.moduleReference.expression))n.push({text:r.moduleReference.expression.text,runtime:!0});else if(b.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&b.isStringLiteralLike(r.moduleSpecifier))n.push({text:r.moduleSpecifier.text,runtime:r.isTypeOnly!==!0});else if(b.isCallExpression(r)){let o=it(r),i=o?.specifierArg;o!==null&&i!==void 0&&b.isStringLiteralLike(i)&&n.push({text:i.text,runtime:!0})}b.forEachChild(r,t)};return t(e),n}function pc(e,n){let t=n===b.ScriptKind.TSX?"__scriptkind_probe.tsx":n===b.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",r=b.createSourceFile(t,e,b.ScriptTarget.ES2020,!0,n),o={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},i={getSourceFile:a=>a===t?r:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return b.createProgram({rootNames:[t],options:o,host:i}).getSyntacticDiagnostics(r).length}function Lr(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Vi(e){let n=0,t=r=>{(b.isCallExpression(r)||b.isNewExpression(r)||b.isTaggedTemplateExpression(r))&&(n+=1),b.forEachChild(r,t)};return t(e),n}function Gi(e,n){let t=Ui(b.createSourceFile(e,n,b.ScriptTarget.ES2020,!0));if(!Lr(e)||!n.includes("<")||!n.includes("require"))return t;let r=b.createSourceFile(e,n,b.ScriptTarget.ES2020,!0,b.ScriptKind.TSX),o=new Set(t.map(i=>`${i.runtime?"R":"T"}:${i.text}`));for(let i of Ui(r)){let a=`${i.runtime?"R":"T"}:${i.text}`;o.has(a)||(o.add(a),t.push(i))}return t}function Wi(e,n,t,r,o){if(!n.includes("require")&&!n.includes("import("))return[];let i=b.createSourceFile(e,n,b.ScriptTarget.ES2020,!0),a=In(i,e,o),l=[],s=new Set;return Hi(i,d=>{for(let u of $t(d,a,t,Ne,r))s.has(u)||(s.add(u),l.push(u))}),l}function Hi(e,n){let t=r=>{if(b.isCallExpression(r)){let o=it(r),i=o?.specifierArg;o!==null&&i!==void 0&&!b.isStringLiteralLike(i)&&n(i)}b.forEachChild(r,t)};t(e)}function mc(e){let n=[];for(let t of e){let r=In(t.sf,t.real);Hi(t.sf,o=>{let i=tt(o,r);i!==null&&n.push({definingModuleReal:t.real,fnName:i.fnName,paramIndex:i.paramIndex})})}return n}var hc=4,Pr=Dt,$r=new Set(["eval","Function","createRequire"]),gc=new Set(["require","eval","Function","createRequire"]),Ft=new Set(["module","Module","require","process","global","globalThis"]),jt=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function yc(e){return e===b.SyntaxKind.LessThanToken||e===b.SyntaxKind.GreaterThanToken||e===b.SyntaxKind.LessThanEqualsToken||e===b.SyntaxKind.GreaterThanEqualsToken||e===b.SyntaxKind.EqualsEqualsToken||e===b.SyntaxKind.EqualsEqualsEqualsToken||e===b.SyntaxKind.ExclamationEqualsToken||e===b.SyntaxKind.ExclamationEqualsEqualsToken||e===b.SyntaxKind.InstanceOfKeyword||e===b.SyntaxKind.InKeyword}function xc(e){let n=e.parent;return(b.isParameter(n)||b.isVariableDeclaration(n)||b.isBindingElement(n)||b.isFunctionDeclaration(n)||b.isFunctionExpression(n)||b.isClassDeclaration(n)||b.isClassExpression(n)||b.isPropertyAssignment(n)||b.isPropertyDeclaration(n)||b.isMethodDeclaration(n))&&n.name===e?!0:b.isPropertyAccessExpression(n)&&n.name===e}function Sc(e,n){return b.isCallExpression(n)&&n.expression===e||(b.isPropertyAccessExpression(n)||b.isElementAccessExpression(n))&&n.expression===e||b.isTypeOfExpression(n)||b.isVoidExpression(n)||b.isDeleteExpression(n)||b.isPrefixUnaryExpression(n)||b.isPostfixUnaryExpression(n)?!0:b.isBinaryExpression(n)&&yc(n.operatorToken.kind)}function Xi(e){let n=e,t=e.parent;for(;;)if(b.isParenthesizedExpression(t))n=t,t=t.parent;else if(b.isBinaryExpression(t)&&t.operatorToken.kind===b.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Sc(n,t)}function bc(e){return xc(e)?!1:Xi(e)}function Yi(e){let n=ln(e);if(n!==null&&jt.has(n.name))return!0;if(b.isElementAccessExpression(e)&&!b.isStringLiteralLike(e.argumentExpression)){let t=ke(e.expression);if(b.isIdentifier(t)&&Ft.has(t.text))return!0}return!1}function rt(e){let n=ln(e);if(n===null||n.name!=="constructor")return!1;let t=ln(n.receiver);return t!==null&&t.name==="constructor"}function Ji(e){if(!b.isCallExpression(e))return!1;let n=ke(e.expression);if(!b.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&b.isStringLiteralLike(t)&&t.text==="module"}var kc={roots:new Map,nodes:new Set,saturated:!1};function Zi(e){return b.isSourceFile(e)||b.isFunctionDeclaration(e)||b.isFunctionExpression(e)||b.isArrowFunction(e)||b.isMethodDeclaration(e)||b.isConstructorDeclaration(e)||b.isGetAccessorDeclaration(e)||b.isSetAccessorDeclaration(e)||b.isClassStaticBlockDeclaration(e)||b.isModuleDeclaration(e)}function Qi(e,n){let t=e.parent;for(;t!==void 0;){if(Zi(t))return t;t=t.parent}return n}function Ec(e){let n=new Set;if(b.isFunctionLike(e))for(let r of e.parameters)for(let o of ot(r.name))n.add(o);let t=[e];for(;t.length>0;){let r=t.pop();if(r===void 0)break;if(!(r!==e&&Zi(r))){if(b.isVariableDeclaration(r)&&b.isVariableDeclarationList(r.parent)&&!((r.parent.flags&b.NodeFlags.BlockScoped)!==0))for(let i of ot(r.name))n.add(i);b.forEachChild(r,o=>{t.push(o)})}}return n}function wc(e,n,t){let r=Qi(e,n);if(b.isSourceFile(r))return n;let o=t.get(r);return o===void 0&&(o=Ec(r),t.set(r,o)),o.has(e.text)?r:n}function Tt(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let r=n;for(;;){if(t.has(r))return!0;let o=r.parent;if(o===void 0)return!b.isSourceFile(r);r=o}}var vc=12,Ic=8;function Lt(e,n){let t=ke(e);for(;;){if(n.nodes.has(t))return!0;if(b.isIdentifier(t))return Ft.has(t.text)||Tt(n,t);if(b.isCallExpression(t))return Ji(t);let r=ln(t);if(r!==null){if(r.name==="constructor")return!0;t=r.receiver;continue}if(b.isElementAccessExpression(t)){t=ke(t.expression);continue}return!1}}function es(e){let n=ln(ke(e.expression));if(n===null||n.name!=="get"||!b.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function Ac(e,n){let t=es(e);if(t===null||!Lt(t.target,n))return!1;let r=t.key;return r===void 0||!b.isStringLiteralLike(r)?!0:jt.has(r.text)}function Mr(e){if(!b.isFunctionExpression(e)&&!b.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,r=o=>{if(!(t||b.isFunctionExpression(o)||b.isFunctionDeclaration(o)||b.isClassLike(o))){if(b.isReturnStatement(o)&&o.expression!==void 0&&ke(o.expression).kind===b.SyntaxKind.ThisKeyword){t=!0;return}b.forEachChild(o,r)}};return r(n),t}function ot(e){if(b.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)b.isOmittedExpression(t)||n.push(...ot(t.name));return n}function ns(e){return e.parameters.map(n=>ot(n.name))}function _c(e){let n=new Map,t=new Set,r=(i,a)=>{let l={fn:a,slots:ns(a)},s=n.get(i);s===void 0?n.set(i,[l]):s.push(l),Mr(a)&&t.add(i)},o=i=>{if(b.isFunctionDeclaration(i)&&i.name!==void 0)r(i.name.text,i);else if(b.isVariableDeclaration(i)&&b.isIdentifier(i.name)&&i.initializer!==void 0){let a=ke(i.initializer);(b.isFunctionExpression(a)||b.isArrowFunction(a))&&r(i.name.text,a)}b.forEachChild(i,o)};return o(e),{params:n,thisReturning:t}}function Nc(e){let n=new Map,t=new Set,r={roots:n,nodes:t},o=_c(e),i=new Map,a=new Set(o.thisReturning),l=!0;for(let s=0;l;s+=1){if(s>=vc)return{roots:n,nodes:t,saturated:!0};l=!1;let d=(S,E)=>{E!==""&&!S.has(E)&&(S.add(E),l=!0)},u=(S,E)=>{if(S==="")return;let w=n.get(S);w===void 0&&(w=new Set,n.set(S,w)),w.has(E)||(w.add(E),l=!0)},p=S=>{t.has(S)||(t.add(S),l=!0)},f=(S,E)=>{let w=ke(S.expression);if(b.isIdentifier(w)&&$r.has(w.text)||rt(w)||b.isCallExpression(S)&&Ji(S)||Mr(w))return!0;let I=ln(w);if(I!==null&&(I.name==="call"||I.name==="apply"||I.name==="bind")){let v=I.receiver;if(Mr(v)||t.has(v)||b.isIdentifier(v)&&(Tt(r,v)||a.has(v.text)))return!0}if(t.has(w)||(b.isCallExpression(w)||b.isNewExpression(w))&&f(w,E+1)||b.isIdentifier(w)&&(Tt(r,w)||a.has(w.text)))return!0;if(b.isCallExpression(S)){let v=es(S);if(v!==null&&Lt(v.target,r))return!0}return!1},h=(S,E)=>{if(E>=Ic)return!0;let w=ke(S);if(t.has(w))return!0;if(b.isIdentifier(w))return Ft.has(w.text)||Tt(r,w);if(b.isBinaryExpression(w)){let I=w.operatorToken.kind;return I===b.SyntaxKind.BarBarToken||I===b.SyntaxKind.AmpersandAmpersandToken||I===b.SyntaxKind.QuestionQuestionToken?h(w.left,E+1)||h(w.right,E+1):!1}return b.isConditionalExpression(w)?h(w.whenTrue,E+1)||h(w.whenFalse,E+1):b.isPropertyAccessExpression(w)||b.isElementAccessExpression(w)?Lt(w,r):b.isCallExpression(w)||b.isNewExpression(w)?f(w,E+1):!1},g=(S,E)=>{if((b.isVariableDeclaration(S)||b.isParameter(S)||b.isBindingElement(S))&&S.initializer!==void 0){if(h(S.initializer,0)){let I=Qi(S,e);for(let v of ot(S.name))u(v,I)}}else if(b.isBinaryExpression(S)&&S.operatorToken.kind===b.SyntaxKind.EqualsToken&&b.isIdentifier(S.left)&&h(S.right,0))u(S.left.text,wc(S.left,e,i));else if(b.isReturnStatement(S)&&S.expression!==void 0&&E!==void 0&&h(S.expression,0))d(a,E);else if(b.isCallExpression(S)||b.isNewExpression(S)){f(S,0)&&p(S);let I=ke(S.expression),v=ln(I),_=v!==null&&v.name==="call",k=v!==null&&v.name==="apply",m=_||k?v.receiver:I,y=_?1:0,A=[];b.isFunctionExpression(m)||b.isArrowFunction(m)?A.push({fn:m,slots:ns(m)}):b.isIdentifier(m)&&A.push(...o.params.get(m.text)??[]);let C=S.arguments??[];if(k){let T=C[1]===void 0?void 0:ke(C[1]);for(let{fn:P,slots:R}of A)if(T!==void 0&&b.isArrayLiteralExpression(T))for(let F=0;F<T.elements.length;F+=1){let O=T.elements[F],L=R[F];if(!(O===void 0||L===void 0)&&h(O,0))for(let K of L)u(K,P)}else if(T!==void 0)for(let F of R)for(let O of F)u(O,P)}else for(let{fn:T,slots:P}of A)for(let R=y;R<C.length;R+=1){let F=C[R],O=P[R-y];if(!(F===void 0||O===void 0)&&h(F,0))for(let L of O)u(L,T)}}let w=E;if(b.isFunctionDeclaration(S))w=S.name?.text;else if(b.isFunctionExpression(S)||b.isArrowFunction(S)){let I=S.parent;w=b.isVariableDeclaration(I)&&b.isIdentifier(I.name)?I.name.text:void 0}b.forEachChild(S,I=>g(I,w))};g(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Rc(e){if(b.isIdentifier(e)&&$r.has(e.text)||rt(e))return!0;let n=ln(e);if(n!==null&&(jt.has(n.name)||(n.name==="call"||n.name==="apply")&&(b.isIdentifier(n.receiver)&&$r.has(n.receiver.text)||rt(n.receiver)||(b.isPropertyAccessExpression(n.receiver)||b.isElementAccessExpression(n.receiver))&&Yi(n.receiver))))return!0;if(b.isElementAccessExpression(e)&&!b.isStringLiteralLike(e.argumentExpression)){let t=ke(e.expression);if(b.isIdentifier(t)&&Ft.has(t.text))return!0}return!1}var Cc=4;function qi(e,n){for(let t of e){if(!b.isStringLiteralLike(t)||n>=Cc)return!0;let r=b.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,g.ScriptTarget.Latest,!0),i=r.parseDiagnostics;if(i!==void 0&&i.length>0||tr(r,n+1,!0))return!0}return!1}function tr(e,n=0,t=!1){let r=!1,i=t?Nl:Ll(e);if(i.saturated)return!0;let s=l=>g.isElementAccessExpression(l)&&!g.isStringLiteralLike(l.argumentExpression)&&ut(le(l.expression),i),a=l=>{if(!r){if(t&&(g.isCallExpression(l)||g.isNewExpression(l)||g.isTaggedTemplateExpression(l))){r=!0;return}if(g.isCallExpression(l)){let o=Fn(l);if(o!==null){let c=o.specifierArg;if(c===void 0||!g.isStringLiteralLike(c)||t){r=!0;return}}else{let c=le(l.expression);if(g.isIdentifier(c)&&(c.text==="eval"||c.text==="Function")){if(Wi(l.arguments,n)){r=!0;return}}else if(Tl(c)){r=!0;return}else if(s(c)){r=!0;return}else if(Ml(l,i)){r=!0;return}}}else if(g.isNewExpression(l)){let o=le(l.expression);if(g.isIdentifier(o)&&o.text==="Function"){if(Wi(l.arguments??[],n)){r=!0;return}}else if(Tn(o)){r=!0;return}}else if(g.isIdentifier(l)&&wl.has(l.text)&&_l(l)){r=!0;return}else if((g.isPropertyAccessExpression(l)||g.isElementAccessExpression(l))&&(Yi(l)||Tn(l)||s(l))&&Ji(l)){r=!0;return}else if(g.isBindingElement(l)){let o=l.propertyName??l.name,c=g.isIdentifier(o)||g.isStringLiteralLike(o)?o.text:g.isComputedPropertyName(o)&&g.isStringLiteralLike(o.expression)?o.expression.text:void 0;if(c!==void 0&&pt.has(c)){r=!0;return}}g.forEachChild(l,a)}};return a(e),r}function rs(e,n,t){if(tr(t))return!0;if(!rr(e)||!n.includes("<")||!n.includes("require"))return!1;let r=g.createSourceFile(e,n,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);return tr(r)}function Fl(e,n,t){if(Sl(e))return!0;let r=t.endsWith(Se.sep)?t:t+Se.sep,i=e.split("/"),s=n;for(;;){let a=Se.join(s,"node_modules",...i),l;try{l=gn(Se.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(r))return!1;let c=_e(l);if(c===null)return!1;let u;try{u=JSON.parse(c).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(Ci(a))return!1;if(s===t)break;let o=Se.dirname(s);if(o===s||o!==t&&!o.startsWith(r))break;s=o}return!0}function jl(e,n){let t=n.endsWith(Se.sep)?n:n+Se.sep,r=Se.dirname(e);for(;;){let i=Se.join(r,"package.json"),s;try{s=gn(i)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let l=_e(s);if(l!==null)try{let o=JSON.parse(l).name;if(typeof o=="string"&&o.length>0)return o}catch{return null}}if(r===n)break;let a=Se.dirname(r);if(a===r||a!==n&&!a.startsWith(t))break;r=a}return null}function Kl(e,n,t,r,i){let s=[],a=[],l=new Set,o={},c=new Set,u=new Set,f=[],p=!1,h=(x,y)=>{let v;try{v=gn(y)}catch{return!1}let C=Je(e,v);if(C===null)return i.push({code:"out-of-root",path:v,detail:"dependency module resolved outside the app root; not followed"}),!1;let $=!t.has(v)&&!u.has(v);return $&&u.size>=Qt?(p=!0,!1):(a.push({from:x,to:{module:C}}),$?(u.add(v),s.push(C),!0):!1)},S=(x,y)=>{if(l.add(y),c.has(y))return;c.add(y);let v=Te(y,x,Xe,n);if(v!==null&&!Be(v)){if(h({surface:y},v)){f.push(v);try{let C=Je(e,gn(v)),$=jl(v,e);C!==null&&$!==null&&(o[C]=$)}catch{}}return}Fl(y,Se.dirname(x),e)||i.push({code:"unresolved-specifier",path:y,detail:`dependency "${y}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let x of r)S(x.containingFile,x.packageName);for(;f.length>0&&u.size<Qt;){let x=f.pop();if(x===void 0)break;let y=Je(e,x);if(y===null)continue;let v=wn(x,sn);if(v.kind==="too-large"){i.push({code:"limit-exceeded",path:y,detail:`dependency module over the ${String(sn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(v.kind==="not-regular"){i.push({code:"parse-error",path:y,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let C=g.createSourceFile(x,v.text,g.ScriptTarget.ES2020,!0),$=C.parseDiagnostics;if($!==void 0&&$.length>0){i.push({code:"dependency-body",path:y,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}if(rs(x,v.text,C)){i.push({code:"dependency-body",path:y,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)"});continue}i.push({code:"dependency-body",path:y,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:y});for(let N of Gi(x,v.text))if(N.runtime)if(ue(N.text)==="package-root"){let b=We(N.text);a.push({from:{module:y},to:{surface:b}}),S(x,b)}else{let b=Te(N.text,x,Xe,n);if(b===null){ue(N.text)==="package-subpath"&&i.push({code:"unresolved-specifier",path:y,detail:`runtime package-subpath import "${N.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`});continue}if(Be(b)){let m=Je(e,b);i.push({code:m===null?"out-of-root":"declaration-shadow",path:y,detail:m===null?`runtime import "${N.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${N.text}" resolved to the declaration file "${m}" with no co-located runtime module; its code was not analyzed`});continue}h({module:y},b)&&f.push(b)}}return(p||f.length>0)&&i.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(Qt)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:a,surfacePackages:[...l],entryRealNames:o}}function is(e,n,t=!1){let r=gn(e),i=[],s=g.createCompilerHost(Xe,!0),a=t?$i(r,Xe,s):()=>null,l=new Set,o=new Set,c=n.map(I=>Se.join(r,I)),u=[],f=new Map,p=new Map,h=new Map,S=new Map,x=new Set,y=(I,A)=>{let j=`${String(I.length)}:${I}${A}`;x.has(j)||(x.add(j),i.push({code:"unresolved-specifier",path:I,detail:A}))},v=()=>null,C=0,$=(I,A)=>{let j=p.get(I);return j===void 0&&(j=g.createSourceFile(I,A,g.ScriptTarget.ES2020,!0),p.set(I,j)),{real:I,sf:j}};for(;o.size<dt;){let I=c.pop();if(I===void 0){if(C>=El)break;C+=1;let M=[];for(let[V,D]of f)D.includes("readdir")&&(D.includes("require")||D.includes("import("))&&M.push($(V,D));let J=kl(M);if(J.length===0)break;let H=[];for(let[V,D]of f)H.push($(V,D));v=Ui(H,J,Xe,s,h);let K=!1;for(let V of M){let D=f.get(V.real);if(D!==void 0)for(let W of Hi(V.real,D,r,s,v))o.has(W)||(c.push(W),K=!0)}if(!K)break;continue}let A;try{A=gn(I)}catch{continue}if(o.has(A))continue;if(o.add(A),Je(r,A)===null){i.push({code:"out-of-root",path:I,detail:"resolved outside app root"});continue}let j=wn(A,sn);if(j.kind==="too-large"){i.push({code:"limit-exceeded",path:A,detail:`file is ${String(Math.round(j.bytes/1048576))}MiB, over the ${String(sn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(j.kind==="not-regular"){i.push({code:"parse-error",path:A,detail:"unreadable or not a regular file"});continue}let z=j.text;l.add(A),f.set(A,z);for(let M of Gi(A,z)){let J=M.runtime?a(M.text,A):null;if(J===null&&ue(M.text)==="package-root"){M.runtime&&u.push({containingFile:A,packageName:We(M.text)});continue}let H=J??Te(M.text,A,Xe,s);if(H===null){if(M.runtime){let K=ue(M.text);if(K==="package-subpath")y(A,`runtime package-subpath import "${M.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`);else if(K==="relative"){let V=Ri(M.text,A,r,S);V.kind==="unanalyzable"&&y(A,`runtime relative import "${M.text}" did not resolve and its absence could not be proven \u2014 ${V.reason}; a bundler/loader may load a module the analyzer never saw`)}}continue}if(Je(r,H)===null){i.push({code:"out-of-root",path:H,detail:`specifier "${M.text}" resolved outside app root`});continue}if(M.runtime&&Be(H)){i.push({code:"declaration-shadow",path:H,detail:`runtime import "${M.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(M.runtime&&!it(H)){i.push({code:"unanalyzable-module",path:H,detail:`runtime import "${M.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}c.push(H)}for(let M of Hi(A,z,r,s,v))o.has(M)||c.push(M)}o.size>=dt&&c.length>0&&i.push({code:"limit-exceeded",path:r,detail:`reachable file set exceeds ${String(dt)}; analysis truncated (${String(c.length)}+ files not analyzed)`});let N=Kl(r,s,l,u,i),b=g.createProgram({rootNames:[...l],options:Xe,host:s}),m=new Set,E=new Map;for(let I of b.getSourceFiles()){if(I.isDeclarationFile||b.isSourceFileDefaultLibrary(I)||Je(r,I.fileName)===null||!rr(I.fileName))continue;let A=b.getSyntacticDiagnostics(I).length>0;if(!A&&!I.text.includes("<")||bl(I.text,g.ScriptKind.TSX)!==0)continue;let j=g.createSourceFile(I.fileName,I.text,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX);(A||qi(j)>qi(I))&&(m.add(I.fileName),E.set(I.fileName,I.text))}let _=b;if(m.size>0){let I=s.getSourceFile.bind(s);s.getSourceFile=(A,j,z,M)=>{let J=E.get(A);return J!==void 0?g.createSourceFile(A,J,g.ScriptTarget.ES2020,!0,g.ScriptKind.TSX):I(A,j,z,M)},_=g.createProgram({rootNames:[...l],options:Xe,host:s,oldProgram:b})}let F=_.getTypeChecker(),O=[];for(let I of _.getSourceFiles()){if(I.isDeclarationFile||_.isSourceFileDefaultLibrary(I)||Je(r,I.fileName)===null)continue;O.push(I);let A=_.getSyntacticDiagnostics(I);if(A.length>0){let z=A[0],M=z!==void 0?g.flattenDiagnosticMessageText(z.messageText," "):"syntax error";i.push({code:"parse-error",path:I.fileName,detail:`${String(A.length)} syntax error(s): ${M}`})}let j=Je(r,I.fileName);j!==null&&rs(I.fileName,I.text,I)&&i.push({code:"loader-escape",path:j,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)"})}return{program:_,checker:F,host:s,options:Xe,appRoot:r,sourceFiles:O,diagnostics:i,depReach:N,resolveParamDirs:v,toRel:I=>Je(r,I)}}import{opendirSync as Bl,statSync as zl}from"node:fs";import ir from"node:path";var Ul=8192,Vl=2e4,ql=new Set(["node_modules"]),ss=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),Hl=16;function mt(e,n,t,r,i={}){let s=i.maxEntries??Vl,a=i.prune,l=[],o=!1,c=0,u=[{dir:ir.join(e,n),rel:n,depth:0}];for(;u.length>0;){let f=u.pop();if(f===void 0)break;if(f.depth>Hl){o=!0;continue}let p;try{p=Bl(f.dir)}catch{o=!0;continue}try{let h=0;for(;;){let S=p.readSync();if(S===null)break;if(h+=1,c+=1,h>Ul||c>s){o=!0;break}let x=f.rel+S.name;if(S.isSymbolicLink()){let y;try{y=zl(ir.join(f.dir,S.name)).isDirectory()}catch{o=!0;continue}if(y){o=!0;continue}}else if(S.isDirectory()){if(ql.has(S.name)||S.name.startsWith(".")||a?.has(S.name)===!0){o=!0;continue}u.push({dir:ir.join(f.dir,S.name),rel:`${x}/`,depth:f.depth+1});continue}else if(!S.isFile())continue;if(t(x)){if(l.length>=r){o=!0;break}l.push(x)}}}finally{try{p.closeSync()}catch{}}}return{matches:l,truncated:o}}var Wl=64;function os(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let r=n.slice(0,t),i=n.slice(t+1);if(r.startsWith("./")&&(r=r.slice(2)),r.startsWith("/")||i.includes("/")||r.split("/").includes("..")||r.includes("\\")||n.includes("\0"))return null;let s=r.slice(0,r.lastIndexOf("/")+1);return mt(e,s,a=>a.length>=r.length+i.length&&a.startsWith(r)&&a.endsWith(i),Wl)}import{existsSync as Gl}from"node:fs";import Xl from"node:path";var Jl=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],Yl=["dependencies","devDependencies"];function Zl(e,n){for(let t of Yl){let r=e[t];if(!(typeof r!="object"||r===null||Array.isArray(r))&&Object.hasOwn(r,n))return!0}return!1}function sr(e,n){if(n===null)return null;for(let t of Jl)if(Zl(n,t.dependency)){for(let r of t.configFiles)if(Gl(Xl.join(e,r)))return{name:t.name,configFile:r,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function or(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var Ql=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],ed=256,nd=12e4;function ar(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let r=mt(e,"",i=>{let s=i.split("/");for(let a=0;a<s.length-1;a+=1){let l=s[a];if(l!==void 0&&t.has(l))return Ql.some(o=>i.endsWith(o))}return!1},ed,{maxEntries:nd,prune:ss});return{roots:r.matches,truncated:r.truncated}}function De(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let r of n){let i=r.codePointAt(0)??0;t+=i<32||i>=127&&i<=159?`\\x${i.toString(16).padStart(2,"0")}`:r}return t}function td(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function rd(e){let n=!1;for(let t=0;t<e.length;t+=1){let r=e.charAt(t),i=r.codePointAt(0)??0;if(i<32||i===127||i>=128&&i<=159)return null;if(r==="\\"){n=!0;let s=e.charAt(t+1);if(!(s>="a"&&s<="z"||s>="A"&&s<="Z"||s>="0"&&s<="9"||s==="."||s==="_"||s==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(r))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function id(e){let n=[],t="";for(let r of e){if(r===" "||r==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=r}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var sd=/^[A-Za-z_][A-Za-z0-9_]*=/u;function od(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var ad=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),ld=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),dd=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function ls(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function as(e){if(ls(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return dd.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:ad.has(t)||n!==-1&&ld.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var cd=[".js",".cjs",".mjs",".ts",".mts",".cts"];function ud(e){return cd.some(n=>e.endsWith(n))}var fd=new Set(["npm","yarn","pnpm"]);function pd(e){let n=e[0];return n===void 0||!fd.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function dr(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!td(n))return lr(n);let t=rd(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let r=lr(t.windows),i=lr(t.posixShell);if(r.kind==="file"){let s=i.kind==="file"?i.specifier:void 0;return s===void 0||s===r.specifier?{kind:"file",specifier:r.specifier}:{kind:"file",specifier:r.specifier,alt:s}}return i.kind==="file"?{kind:"file",specifier:i.specifier}:r}function lr(e){let n=id(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let s=n[t];if(s===void 0||!sd.test(s))break;if(ls(s))return{kind:"unparsed",reason:`environment \`${De(s)}\` preloads another module; the launch surface is more than one file`};let a=s.indexOf("=");if(s.slice(0,a)==="NODE_OPTIONS")for(let l of s.slice(a+1).split(/\s+/u)){if(l===""||!l.startsWith("-"))continue;let o=as(l);if(o!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${De(o.token)}\` ${o.why}`}}}let r=n[t];if(r===void 0)return{kind:"unparsed",reason:"no program in the command"};if(pd(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!od(r))return{kind:"unparsed",reason:`runs \`${De(r)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let s=n[t];if(s===void 0||!s.startsWith("-"))break;let a=as(s);if(a!==null)return{kind:"unparsed",reason:`node flag \`${De(a.token)}\` ${a.why}`}}let i=n[t];return i===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:ud(i)?{kind:"file",specifier:i}:{kind:"unparsed",reason:`\`${De(i)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function md(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var hd=64;function cr(e){let n=e.split(`
-`),t=n.length>64,r=[],i=0;for(let s of n.slice(0,64)){let a=s.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let o=a.slice(l+1).trim();if(o.length===0)continue;let c=a.slice(0,l);if(c.length>hd||!md(c)){i+=1;continue}r.push({name:c,command:o})}return r.sort((s,a)=>s.name===a.name?0:s.name==="web"?-1:a.name==="web"?1:0),{entries:r,truncated:t,unnamedLines:i}}import{realpathSync as ds}from"node:fs";import Ce from"node:path";import d from"typescript";var cs=3;function te(e,n,t){if(e===void 0)return;let r=e[n]??={fired:0,refused:{}};t===null?r.fired+=1:r.refused[t]=(r.refused[t]??0)+1}function an(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var gt=16,pr=256,ur=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.fns.has(r)||(this.moduleFor(n),this.fns.set(r,{id:i,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),i}classFor(n,t){let r=`${n}#${t}`,i=`pkg:${n}#${t}`;return this.classNodes.has(r)||(this.moduleFor(n),this.classNodes.set(r,{id:i,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(r,[])),i}methodFor(n,t,r,i){let s=`${n}#${t}.${r}`,a=`pkg:${n}#${t}.${r}`;if(!this.fns.has(s)){let l=this.classFor(n,t);this.fns.set(s,{id:a,moduleId:`pkg:${n}`,name:r,kind:i,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function Ss(e,n){let t="node_modules/",r=e.lastIndexOf(t);if(r===-1)return n;let s=e.slice(r+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function us(e,n,t){let r=Ce.dirname(e),i=Ce.dirname(n),s=[];for(;;){let l=t.get(r);if(l!==void 0){for(let c of s)t.set(c,l);return l}s.push(r);let o=_e(Ce.join(r,"package.json"));if(o!==null)try{let c=JSON.parse(o),u={name:c.name??"app",version:c.version??"0.0.0",dir:r};for(let f of s)t.set(f,u);return u}catch{}if(r===i||r===Ce.dirname(r))break;r=Ce.dirname(r)}let a={name:"app",version:"0.0.0",dir:null};for(let l of s)t.set(l,a);return a}function gd(e){let n=[],t=r=>{if(d.isImportDeclaration(r)&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isImportEqualsDeclaration(r)&&d.isExternalModuleReference(r.moduleReference)&&d.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&d.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(d.isCallExpression(r)){let i=Fn(r);if(i!==null){let s=i.specifierArg,a=s!==void 0&&d.isStringLiteralLike(s);n.push({specifier:a?s.text:void 0,specifierIsLiteral:a,dynamic:!0,...s!==void 0&&!a?{computedArg:s,loadPos:r.getStart(e)}:{}})}}d.forEachChild(r,t)};return t(e),n}function yd(e,n,t){let r=new Map,i=us(Ce.join(e.appRoot,"package.json"),e.appRoot,r),s=[],a=[],l=[],o=new Map,c=new Set,u=new Set;for(let f of e.sourceFiles){let p=e.toRel(f.fileName);p!==null&&u.add(p)}for(let f of e.sourceFiles){let p=e.toRel(f.fileName);if(p===null)continue;let h=us(f.fileName,e.appRoot,r),S=Ss(p,i.name),x=p.includes("node_modules/");s.push({id:p,packageName:x&&h.name!==i.name?h.name:S,versionRange:h.version,path:p,moduleSystem:"cjs",isEntrypoint:n.has(p)}),h.dir===i.dir&&c.add(p);let y=0,v=null;for(let C of gd(f)){let $=`${p}#import${String(y)}`;y+=1;let N=null;if(C.specifier!==void 0)if(ue(C.specifier)==="package-root")N=t.moduleFor(We(C.specifier));else{let b=Te(C.specifier,f.fileName,e.options,e.host),m=b!==null?e.toRel(b):null;m!==null&&(N=m)}if(a.push({id:$,moduleId:p,specifier:C.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:C.dynamic,specifierIsLiteral:C.specifierIsLiteral,...N!==null?{resolvedModuleId:N}:{}}),N!==null&&l.push({importId:$,resolvedModuleId:N}),C.computedArg!==void 0&&C.loadPos!==void 0){v??=hn(f,f.fileName,e.resolveParamDirs);let b=[];for(let m of at(C.computedArg,v,e.appRoot,e.options,e.host)){let E=e.toRel(m);if(E===null||!u.has(E))continue;let _=E,F=`${p}#import${String(y)}`;y+=1,a.push({id:F,moduleId:p,specifier:E,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:_}),l.push({importId:F,resolvedModuleId:_}),b.push(E)}if(b.length>0){let m=Ln(C.computedArg,v)!==null||ot(C.computedArg),E=o.get(p)??[];E.push({pos:C.loadPos,candidateRels:b,seedable:m}),o.set(p,E)}}}}return{modules:s,imports:a,importEdges:l,computedLoads:o,appOwnedPaths:c}}function xd(e){let n=_e(e);if(n===null)return null;let t=d.createSourceFile(e,n,d.ScriptTarget.Latest,!0),r=i=>t.statements.some(s=>d.isFunctionDeclaration(s)?s.name?.text===i:d.isVariableStatement(s)?s.declarationList.declarations.some(a=>d.isIdentifier(a.name)&&a.name.text===i&&a.initializer!==void 0&&(d.isFunctionExpression(a.initializer)||d.isArrowFunction(a.initializer))):!1);for(let i of t.statements){if(d.isFunctionDeclaration(i)&&i.name!==void 0&&i.modifiers?.some(a=>a.kind===d.SyntaxKind.DefaultKeyword)===!0)return i.name.text;if(!d.isExpressionStatement(i)||!d.isBinaryExpression(i.expression))continue;let s=i.expression;if(s.operatorToken.kind===d.SyntaxKind.EqualsToken&&Sd(s.left)){if(d.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(d.isIdentifier(s.right)&&r(s.right.text))return s.right.text}}return null}function Sd(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function bd(e,n,t){for(let c of e.surfacePackages)n.moduleFor(c);let r=c=>"surface"in c?n.moduleFor(c.surface):c.module,i=[],s=new Set;for(let c of e.modules)t.has(c)||s.has(c)||(s.add(c),i.push({id:c,packageName:e.entryRealNames[c]??Ss(c,"app"),versionRange:"",path:c,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],o=0;for(let c of e.edges){let u=r(c.from),f=r(c.to),p=`${String(u)}#depreach${String(o)}`;o+=1,a.push({id:p,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:f}),l.push({importId:p,resolvedModuleId:f})}return{modules:i,imports:a,importEdges:l}}function fs(e,n,t){let r=e.expression;if(d.isIdentifier(r)&&!t.has(r.text)){let i=n.get(r.text);if(i?.kind==="package-export")return{kind:"package-instance",packageName:i.packageName,className:i.exportName};if(i?.kind==="app-class")return{kind:"app-instance",cls:i.cls}}else if(d.isPropertyAccessExpression(r)&&d.isIdentifier(r.expression)&&!t.has(r.expression.text)){let i=n.get(r.expression.text);if(i?.kind==="package-surface")return{kind:"package-instance",packageName:i.packageName,className:r.name.text}}return null}function yn(e){return d.canHaveModifiers(e)&&(d.getModifiers(e)?.some(n=>n.kind===d.SyntaxKind.ExportKeyword)??!1)}function kd(e){let n=new Set,t;for(let r of e.statements){if(d.isExpressionStatement(r)&&d.isBinaryExpression(r.expression)){let i=r.expression;if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(i.left)&&d.isIdentifier(i.left.expression)&&i.left.expression.text==="module"&&i.left.name.text==="exports"){if(d.isIdentifier(i.right))n.add(i.right.text),t=i.right.text;else if(d.isObjectLiteralExpression(i.right))for(let s of i.right.properties)d.isShorthandPropertyAssignment(s)?n.add(s.name.text):d.isPropertyAssignment(s)&&d.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(d.isFunctionDeclaration(r)&&r.name!==void 0&&yn(r))n.add(r.name.text);else if(d.isVariableStatement(r)&&yn(r))for(let i of r.declarationList.declarations)d.isIdentifier(i.name)&&n.add(i.name.text);else if(d.isExportDeclaration(r)&&r.exportClause&&d.isNamedExports(r.exportClause))for(let i of r.exportClause.elements)n.add((i.propertyName??i.name).text);else d.isExportAssignment(r)&&d.isIdentifier(r.expression)&&(n.add(r.expression.text),t=r.expression.text)}return{reachableLocals:n,defaultTarget:t}}function Ed(e){for(let n of e.statements){if(d.isFunctionDeclaration(n)&&n.name!==void 0&&yn(n)&&d.getModifiers(n)?.some(t=>t.kind===d.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(d.isExportAssignment(n)&&!n.isExportEquals&&d.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===d.SyntaxKind.EqualsToken&&ve(t.left)&&d.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function Ye(e){if(d.isCallExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&d.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function ve(e){return d.isPropertyAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:d.isElementAccessExpression(e)&&d.isIdentifier(e.expression)&&e.expression.text==="module"&&d.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function ze(e){if(ve(e))return!0;if(!d.isPropertyAccessExpression(e)&&!d.isElementAccessExpression(e))return!1;let n=e.expression;return d.isIdentifier(n)&&n.text==="exports"?!0:ve(n)}function An(e){return d.isPropertyAccessExpression(e.expression)&&d.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function bs(e){let n=!1,t=r=>{if(!n){if(d.isCallExpression(r)){let i=Ye(r);if(i!==void 0&&ue(i)!=="package-root"){n=!0;return}}d.forEachChild(r,t)}};return t(e),n}function ks(e){let n=new Set,t=i=>i!==void 0&&bs(i),r=i=>{d.isVariableDeclaration(i)&&t(i.initializer)&&Pn(i.name,n),d.isBinaryExpression(i)&&i.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(i.left)&&t(i.right)&&n.add(i.left.text),d.forEachChild(i,r)};return r(e),n}function Es(e,n){for(let t of e.properties)d.isShorthandPropertyAssignment(t)?n.add(t.name.text):d.isPropertyAssignment(t)&&d.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function wd(e){let n=new Set;for(let l of e.statements)if(d.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(d.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(d.isVariableStatement(l))for(let o of l.declarationList.declarations)d.isIdentifier(o.name)&&o.initializer!==void 0&&(d.isFunctionExpression(o.initializer)||d.isArrowFunction(o.initializer)||d.isObjectLiteralExpression(o.initializer))&&n.add(o.name.text);let t=l=>d.isFunctionExpression(l)||d.isArrowFunction(l)||d.isObjectLiteralExpression(l)||d.isIdentifier(l)&&n.has(l.text),r=new Set,i=l=>{d.isIdentifier(l)?r.add(l.text):d.isObjectLiteralExpression(l)&&Es(l,r)},s=!1,a=l=>{if(!s){if(d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken)if(ve(l.left)){i(l.right);let o=l.right;(d.isObjectLiteralExpression(o)?o.properties.every(u=>d.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||d.isPropertyAssignment(u)&&t(u.initializer)):t(o))||(s=!0)}else ze(l.left)&&(t(l.right)||(s=!0));else(d.isCallExpression(l)&&An(l)&&l.arguments[0]!==void 0&&xn(l.arguments[0])||d.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(s=!0);s||d.forEachChild(l,a)}};if(a(e),!s&&r.size>0){for(let l of As(e))if(r.has(l)){s=!0;break}}return s}function xn(e){return ze(e)||d.isIdentifier(e)&&e.text==="exports"}function ws(e){if(!d.isPropertyAccessExpression(e.expression)||!d.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function mr(e){return ws(e)&&e.arguments[0]!==void 0&&xn(e.arguments[0])}function vd(e){return ws(e)&&e.arguments[0]!==void 0&&d.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Id(e){for(let n of e.declarations??[])if(d.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(d.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(d.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Ad(e,n,t,r,i){let s=(e.declarations??[]).filter(l=>!d.isSourceFile(l)&&!d.isModuleDeclaration(l));for(let l of s){let o=l.getSourceFile(),c=n.toRel(o.fileName);if(c===null||i.has(c))continue;let u=t.get(`${c}::${String(l.getStart(o,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of s){let o=n.toRel(l.getSourceFile().fileName);if(o===null||i.has(o))continue;let c=r.get(`${o}::${a}`);if(c!==void 0)return c}}function yt(e){return d.isPropertyAccessExpression(e)?e.name.text:d.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var hr=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function gr(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?yt(e):void 0;return n!==void 0&&n!=="__proto__"&&hr.test(n)?n:void 0}function _d(e){return e!=="__proto__"&&hr.test(e)}function ps(e){let n=le(e);return d.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||ve(n)}function Nd(e){if(!d.isArrayLiteralExpression(e)&&!d.isObjectLiteralExpression(e))return!1;let n=!1,t=r=>{n||(ze(r)?n=!0:d.forEachChild(r,t))};return t(e),n}function yr(e){let n=!1,t=new Map,r=i=>{if(!n){if(d.isBinaryExpression(i)&&i.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(ve(i.left)||d.isIdentifier(i.left)&&i.left.text==="exports")n=!0;else if(i.operatorToken.kind===d.SyntaxKind.EqualsToken&&ps(i.right))n=!0;else if(Nd(i.left))n=!0;else if(ze(i.left)){let s=gr(i.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(d.isCallExpression(i)&&An(i)&&i.arguments[0]!==void 0&&xn(i.arguments[0])||d.isCallExpression(i)&&mr(i)||d.isCallExpression(i)&&vd(i)||d.isVariableDeclaration(i)&&i.initializer!==void 0&&ps(i.initializer))&&(n=!0);n||d.forEachChild(i,r)}};return r(e),{surfaceEscapes:n,assignCount:t}}function xr(e){let n=[];for(let t of e.statements){if(!d.isExpressionStatement(t)||!d.isBinaryExpression(t.expression))continue;let r=t.expression;r.operatorToken.kind===d.SyntaxKind.EqualsToken&&(!ze(r.left)||ve(r.left)||n.push({bin:r,name:gr(r.left)}))}return n}function Cd(e){let{surfaceEscapes:n,assignCount:t}=yr(e);if(n)return[];let r=[];for(let{bin:i,name:s}of xr(e))s===void 0||(t.get(s)??0)!==1||(d.isFunctionExpression(i.right)||d.isArrowFunction(i.right))&&r.push({name:s,value:i.right});return r}function Od(e,n){let{surfaceEscapes:t,assignCount:r}=yr(e);if(t)return[];let i=[];for(let{bin:s,name:a}of xr(e))a===void 0||(r.get(a)??0)!==1||d.isIdentifier(s.right)&&!n.has(s.right.text)&&i.push(s.right.text);return i}function Rd(e,n){let{surfaceEscapes:t,assignCount:r}=yr(e);for(let{bin:i,name:s}of xr(e)){let a=i.right;if(!(d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isIdentifier(a)))continue;let o=d.isFunctionExpression(a)||d.isArrowFunction(a)||d.isIdentifier(a)&&!n.has(a.text);if(!(!t&&s!==void 0&&(r.get(s)??0)===1&&o))return!0}return!1}function $d(e){let n=d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&d.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function ms(e){let n=e.parent;return n===void 0?!1:d.isPropertyAccessExpression(n)?n.name===e:d.isQualifiedName(n)?n.right===e:d.isBindingElement(n)||d.isImportSpecifier(n)?n.propertyName===e:d.isExportSpecifier(n)?!0:d.isPropertyAssignment(n)||d.isPropertyDeclaration(n)||d.isPropertySignature(n)||d.isMethodDeclaration(n)||d.isMethodSignature(n)||d.isGetAccessorDeclaration(n)||d.isSetAccessorDeclaration(n)||d.isEnumMember(n)?n.name===e:!1}function hs(e){for(let n=e.parent;n!==void 0;n=n.parent){if(d.isSourceFile(n))return!0;if(!d.isArrowFunction(n)&&(d.isFunctionLike(n)||d.isClassLike(n)))return!1}return!0}function Md(e,n){let t=r=>{d.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&n.add(r),d.forEachChild(r,t)};t(e)}function Pd(e){let n=[],t=new Set;for(let s of e.statements){if(d.isExportDeclaration(s)||d.isExportAssignment(s)||d.isImportDeclaration(s)||d.isImportEqualsDeclaration(s)||yn(s))return null;if(!d.isExpressionStatement(s)||!d.isBinaryExpression(s.expression))continue;let a=s.expression;if(a.operatorToken.kind===d.SyntaxKind.EqualsToken){if(ve(a.left))n.push({kind:"whole",value:a.right});else if(ze(a.left)){let l=gr(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:$d(a.left)})}else continue;Md(a.left,t)}}let r=!1,i=s=>{if(!r){if(d.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!ms(s)){r=!0;return}if(s.kind===d.SyntaxKind.ThisKeyword&&hs(s)){r=!0;return}if(d.isIdentifier(s)&&s.text==="arguments"&&!ms(s)&&hs(s)){r=!0;return}d.forEachChild(s,i)}};return i(e),r?null:n}function fr(e){return d.isIdentifier(e)||d.isStringLiteralLike(e)?e.text:void 0}function gs(e,n,t){return d.isIdentifier(e)?n(e.text):t?.(e)}function Ld(e,n,t,r){let i=new Map,s=Pd(e);if(s===null||s.filter(h=>h.kind==="whole").length>1)return i;let a=s.findIndex(h=>h.kind==="whole"),l=(h,S)=>a>=0&&S>a&&h.kind==="member"&&h.root==="exports",o=s.some(l);if(o){let h=s[a];if(h===void 0||h.kind!=="whole"||!d.isObjectLiteralExpression(h.value))return i}let c=o?s.filter((h,S)=>!l(h,S)):s,u=new Map;for(let h of c)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let f=h=>n.has(h)?void 0:t(h),p=(h,S)=>{S===void 0?i.delete(h):i.set(h,S)};for(let h of c){if(h.kind==="member"){p(h.name,(u.get(h.name)??0)>1?void 0:gs(h.value,f,r));continue}i.clear();let S=h.value;if(d.isObjectLiteralExpression(S))for(let x of S.properties){if(d.isSpreadAssignment(x))return new Map;if(d.isShorthandPropertyAssignment(x)){p(x.name.text,f(x.name.text));continue}let y=fr(x.name);if(y===void 0)return new Map;p(y,d.isPropertyAssignment(x)?gs(x.initializer,f,r):void 0)}}return i}function vs(e,n,t,r){let i=new Map,s=l=>l!==void 0&&ue(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(d.isVariableDeclaration(l)&&l.initializer!==void 0){let o=l.initializer;if(d.isIdentifier(l.name)&&!r.has(l.name.text)){let c=s(Ye(o));if(c!==void 0)i.set(l.name.text,{kind:"whole",target:c});else if((d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o))&&d.isCallExpression(o.expression)){let u=s(Ye(o.expression)),f=yt(o);u!==void 0&&f!==void 0&&i.set(l.name.text,{kind:"member",target:u,member:f})}}else if(d.isObjectBindingPattern(l.name)){let c=s(Ye(o));if(c!==void 0){for(let u of l.name.elements)if(d.isIdentifier(u.name)&&!r.has(u.name.text)){let f=u.propertyName!==void 0&&d.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;i.set(u.name.text,{kind:"member",target:c,member:f})}}}}d.forEachChild(l,a)};return a(e),i}function Td(e,n,t,r){let i=a=>a!==void 0&&ue(a)==="relative"?t.get(`${n}::${a}`):void 0,s=i(Ye(e));if(s!==void 0)return{kind:"whole",target:s};if(d.isPropertyAccessExpression(e)||d.isElementAccessExpression(e)){let a=yt(e);if(a===void 0)return;let l=i(Ye(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(d.isIdentifier(e.expression)){let o=r.get(e.expression.text);if(o?.kind==="whole")return{kind:"member",target:o.target,member:a}}return}if(d.isIdentifier(e))return r.get(e.text)}function Is(e,n,t,r,i){let s=[],a=!1,l=f=>{if(bs(f))return!0;let p=!1,h=S=>{p||(d.isIdentifier(S)&&i.has(S.text)?p=!0:d.forEachChild(S,h))};return h(f),p},o=(f,p)=>{let h=Td(f,n,t,r);h!==void 0?s.push({source:h,exportedName:p}):l(f)&&(a=!0)},c=f=>{if(d.isObjectLiteralExpression(f)){for(let p of f.properties)if(d.isSpreadAssignment(p))o(p.expression,"default");else if(d.isPropertyAssignment(p)){let h=d.isIdentifier(p.name)||d.isStringLiteralLike(p.name)?p.name.text:"default";o(p.initializer,h)}else if(d.isShorthandPropertyAssignment(p)){let h=r.get(p.name.text);h!==void 0&&s.push({source:h,exportedName:p.name.text})}return}o(f,"default")},u=f=>{if(d.isBinaryExpression(f)&&f.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&f.operatorToken.kind<=d.SyntaxKind.LastAssignment){if(ve(f.left)){c(f.right);return}if(ze(f.left)){let p=d.isPropertyAccessExpression(f.left)?f.left.name.text:d.isElementAccessExpression(f.left)&&d.isStringLiteralLike(f.left.argumentExpression)?f.left.argumentExpression.text:"default";o(f.right,p);return}}else if(d.isExportAssignment(f)&&f.isExportEquals){o(f.expression,"default");return}else if(d.isCallExpression(f)&&An(f)&&f.arguments[0]!==void 0&&xn(f.arguments[0])){for(let p of f.arguments.slice(1))c(p);return}d.forEachChild(f,u)};return u(e),{sources:s,residual:a}}function As(e){let n=new Set,t=i=>{let s=i;for(;d.isPropertyAccessExpression(s)||d.isElementAccessExpression(s);)s=s.expression;return d.isIdentifier(s)?s.text:void 0},r=i=>{let s=_s(i);if(s!==void 0){let a=t(s);a!==void 0&&n.add(a)}d.forEachChild(i,r)};return r(e),n}function _s(e){return d.isBinaryExpression(e)&&e.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=d.SyntaxKind.LastAssignment&&(d.isPropertyAccessExpression(e.left)||d.isElementAccessExpression(e.left))?e.left:void 0}function ht(e){if(d.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)d.isBindingElement(t)&&n.push(...ht(t.name));return n}function we(e){if(d.isIdentifier(e))return[e.text];if(d.isParenthesizedExpression(e)||d.isAsExpression(e)||d.isNonNullExpression(e)||d.isSatisfiesExpression(e)||d.isTypeAssertionExpression(e)||d.isAwaitExpression(e))return we(e.expression);if(d.isYieldExpression(e))return e.expression!==void 0?we(e.expression):[];if(d.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===d.SyntaxKind.BarBarToken||n===d.SyntaxKind.AmpersandAmpersandToken||n===d.SyntaxKind.QuestionQuestionToken?[...we(e.left),...we(e.right)]:n===d.SyntaxKind.CommaToken?we(e.right):[]}return d.isConditionalExpression(e)?[...we(e.whenTrue),...we(e.whenFalse)]:d.isArrayLiteralExpression(e)?e.elements.flatMap(n=>d.isSpreadElement(n)?we(n.expression):d.isOmittedExpression(n)?[]:we(n)):d.isObjectLiteralExpression(e)?e.properties.flatMap(n=>d.isShorthandPropertyAssignment(n)?[n.name.text]:d.isPropertyAssignment(n)?we(n.initializer):d.isSpreadAssignment(n)?we(n.expression):[]):[]}function Ns(e,n){let t=[],r=(l,o)=>{for(let c of l)for(let u of o)c!==u&&t.push({a:c,b:u})},i=l=>d.isIdentifier(l)?[l.text]:d.isArrayLiteralExpression(l)?l.elements.flatMap(i):d.isObjectLiteralExpression(l)?l.properties.flatMap(o=>d.isShorthandPropertyAssignment(o)?[o.name.text]:d.isPropertyAssignment(o)?i(o.initializer):[]):[],s=l=>{d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken?r(i(l.left),we(l.right)):d.isVariableDeclaration(l)&&l.initializer!==void 0?r(ht(l.name),we(l.initializer)):(d.isForOfStatement(l)||d.isForInStatement(l))&&d.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&r(ht(l.initializer.declarations[0].name),we(l.expression)),d.forEachChild(l,s)};s(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:o,b:c}of t)a.has(o)&&!a.has(c)&&(a.add(c),l=!0),a.has(c)&&!a.has(o)&&(a.add(o),l=!0)}return a}function Cs(e,n){let t=l=>{if(!d.isPropertyAccessExpression(l)&&!d.isElementAccessExpression(l))return;let o=l;for(;d.isPropertyAccessExpression(o)||d.isElementAccessExpression(o);)o=o.expression;return d.isIdentifier(o)?o.text:void 0},r=[],i=(l,o)=>{for(let u of we(o))r.push({name:l,root:u});let c=t(o);c!==void 0&&r.push({name:l,root:c})},s=l=>{d.isVariableDeclaration(l)&&d.isIdentifier(l.name)&&l.initializer!==void 0?i(l.name.text,l.initializer):d.isBinaryExpression(l)&&l.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isIdentifier(l.left)&&i(l.left.text,l.right),d.forEachChild(l,s)};s(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:o,root:c}of r){let u=a.get(c);u!==void 0&&!a.has(o)&&(a.set(o,u),l=!0)}}return a}function Os(e){return Ns(e,As(e))}function Dd(e,n){let t=o=>o>=d.SyntaxKind.FirstAssignment&&o<=d.SyntaxKind.LastAssignment,r=o=>{let c=o.parent;if(c===void 0||!d.isObjectLiteralExpression(c))return!1;let u=c.parent;return u!==void 0&&d.isBinaryExpression(u)&&u.operatorToken.kind===d.SyntaxKind.EqualsToken&&u.right===c&&ze(u.left)?!0:u!==void 0&&d.isCallExpression(u)&&An(u)&&u.arguments[0]!==void 0&&xn(u.arguments[0])&&u.arguments.indexOf(c)>0},i=(o,c)=>{if((d.isFunctionDeclaration(c)||d.isFunctionExpression(c))&&c.name===o||d.isVariableDeclaration(c)&&c.name===o||d.isParameter(c)&&c.name===o||d.isBindingElement(c)&&c.name===o||(d.isCallExpression(c)||d.isNewExpression(c))&&c.expression===o)return!0;if((d.isPropertyAccessExpression(c)||d.isElementAccessExpression(c))&&c.expression===o){let u=c;for(;u.parent!==void 0&&(d.isPropertyAccessExpression(u.parent)||d.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let f=u.parent;return!(f!==void 0&&d.isBinaryExpression(f)&&t(f.operatorToken.kind)&&f.left===u)}return d.isBinaryExpression(c)&&c.operatorToken.kind===d.SyntaxKind.EqualsToken&&c.right===o&&ze(c.left)?!0:d.isShorthandPropertyAssignment(c)&&c.name===o||d.isPropertyAssignment(c)&&c.initializer===o?r(c):!!(d.isExportAssignment(c)&&c.expression===o||d.isExportSpecifier(c))},s=(o,c)=>d.isPropertyAccessExpression(c)&&c.name===o||d.isPropertyAssignment(c)&&c.name===o||(d.isMethodDeclaration(c)||d.isGetAccessorDeclaration(c)||d.isSetAccessorDeclaration(c))&&c.name===o,a=!1,l=(o,c)=>{if(!a){if(d.isIdentifier(o)&&c!==void 0&&n.has(o.text)&&!s(o,c)&&!i(o,c)){a=!0;return}d.forEachChild(o,u=>l(u,o))}};return l(e,void 0),a}function Fd(e){let n=new Set;for(let o of e.statements)if(d.isFunctionDeclaration(o)&&o.name!==void 0)n.add(o.name.text);else if(d.isVariableStatement(o))for(let c of o.declarationList.declarations)d.isIdentifier(c.name)&&c.initializer!==void 0&&(d.isFunctionExpression(c.initializer)||d.isArrowFunction(c.initializer))&&n.add(c.name.text);let t=new Set,r=o=>{d.isBinaryExpression(o)&&o.operatorToken.kind===d.SyntaxKind.EqualsToken?(ve(o.left)&&(d.isIdentifier(o.right)?t.add(o.right.text):d.isObjectLiteralExpression(o.right)&&Es(o.right,t)),ve(o.right)&&d.isIdentifier(o.left)&&t.add(o.left.text)):d.isVariableDeclaration(o)&&d.isIdentifier(o.name)&&o.initializer!==void 0&&ve(o.initializer)&&t.add(o.name.text),d.forEachChild(o,r)};if(r(e),t.size>0){if(Dd(e,t))return!0;let o=Cs(e,new Map([...t].map(u=>[u,u]))),c=Os(e);for(let u of o.keys())if(c.has(u))return!0}let i=o=>d.isIdentifier(o)&&n.has(o.text),s=o=>o.properties.every(c=>d.isShorthandPropertyAssignment(c)&&n.has(c.name.text)||d.isPropertyAssignment(c)&&i(c.initializer)),a=!1,l=o=>{if(!a){if(d.isBinaryExpression(o)){let c=o.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=d.SyntaxKind.LastAssignment;c&&ve(o.left)?o.operatorToken.kind===d.SyntaxKind.EqualsToken&&(i(o.right)||d.isObjectLiteralExpression(o.right)&&s(o.right))||(a=!0):c&&ze(o.left)&&(a=!0)}else d.isCallExpression(o)?(An(o)&&o.arguments[0]!==void 0&&xn(o.arguments[0])||mr(o))&&(a=!0):(d.isExportAssignment(o)&&o.isExportEquals&&!d.isIdentifier(o.expression)||d.isExportDeclaration(o)&&o.moduleSpecifier!==void 0)&&(a=!0);a||d.forEachChild(o,l)}};return l(e),a}var jd=8;function ys(e,n,t){let r=new Set,i=vs(e,n,t,vn(e)),s=Is(e,n,t,i,ks(e));for(let{source:a}of s.sources)r.add(a.target);for(let a of e.statements)if(d.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&d.isStringLiteralLike(a.moduleSpecifier)&&ue(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&r.add(l)}return r}function Kd(e,n,t,r=new Map){let i=new Set(n.modules.filter(b=>b.isEntrypoint).map(b=>String(b.id)));if(i.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(b=>b.externalSurface===!0).map(b=>String(b.id))),a=new Map,l=new Map,o=new Map,c=new Map;for(let b of t){if(b.name==="<toplevel>"){c.set(String(b.moduleId),b);continue}if(a.set(`${String(b.moduleId)}::${String(b.declRange.start)}`,b),b.name!==void 0&&l.set(`${String(b.moduleId)}::${b.name}`,b),b.isExported&&b.name!==void 0){let m=o.get(String(b.moduleId))??[];m.push(b),o.set(String(b.moduleId),m)}}if(r.size>0){let b=new Map(t.map(m=>[String(m.id),m]));for(let[m,E]of r){let _=b.get(String(E));_!==void 0&&!a.has(m)&&a.set(m,_)}}let u=new Map;for(let b of n.imports)b.resolvedModuleId!==void 0&&u.set(`${b.moduleId}::${b.specifier}`,String(b.resolvedModuleId));let f=new Map;for(let b of e.sourceFiles){let m=e.toRel(b.fileName);m!==null&&f.set(m,b)}let p=new Map,h=b=>{let m=p.get(b);if(m!==void 0)return m;let E=f.get(b),_=E===void 0?!0:Fd(E);return p.set(b,_),_},S=new Set,x=(b,m)=>m!==void 0&&ue(m)==="relative"?u.get(`${b}::${m}`):void 0,y=b=>{if(d.isIdentifier(b))return b.text;if(d.isPropertyAccessExpression(b)){let m=y(b.expression);return m===void 0?void 0:`${m}.${b.name.text}`}if(d.isElementAccessExpression(b)&&d.isStringLiteralLike(b.argumentExpression)){let m=y(b.expression);return m===void 0?void 0:`${m}.${b.argumentExpression.text}`}},v=b=>{let m=b;for(;d.isPropertyAccessExpression(m)||d.isElementAccessExpression(m);)m=m.expression;return Ye(m)};for(let b of e.sourceFiles){let m=e.toRel(b.fileName);if(m===null)continue;let E=new Map,_=new Map,F=(A,j)=>{let z=x(m,Ye(j));if(z!==void 0){if(d.isIdentifier(A))_.set(A.text,z),E.set(A.text,z);else if(d.isObjectBindingPattern(A)||d.isArrayBindingPattern(A))for(let M of ht(A))_.set(M,z);else if(d.isPropertyAccessExpression(A)||d.isElementAccessExpression(A)){let M=y(A);M!==void 0&&E.set(M,z)}}},O=A=>{d.isVariableDeclaration(A)&&A.initializer!==void 0?F(A.name,A.initializer):d.isBinaryExpression(A)&&A.operatorToken.kind===d.SyntaxKind.EqualsToken&&F(A.left,A.right),d.forEachChild(A,O)};O(b);let I=A=>{let j=_s(A);if(j!==void 0){let z=j.expression,M=x(m,v(z));M!==void 0&&S.add(M);let J=y(z),H=J!==void 0?E.get(J):void 0;H!==void 0&&S.add(H)}d.forEachChild(A,I)};if(I(b),_.size>0){let A=Cs(b,_),j=Os(b);for(let[z,M]of A)j.has(z)&&S.add(M)}}let C=[],$=[],N=[];for(let b of e.sourceFiles){let m=e.toRel(b.fileName);if(m===null||!i.has(m))continue;let E=e.checker.getSymbolAtLocation(b),_=new Set,F=new Set,O=0,I=(D,W)=>{if(s.has(String(D.moduleId))||_.has(String(D.id)))return;_.add(String(D.id));let se=`${m}#reexport:${String(O)}:${W}`;O+=1,C.push({id:se,moduleId:m,exportedName:W,kind:"value",reexportOf:{moduleId:String(D.moduleId),name:D.name??W}}),$.push({exportId:se,target:{kind:"function",functionId:D.id}})},A=D=>{if(Id(D))return;let W=D;if((D.flags&d.SymbolFlags.Alias)!==0)try{W=e.checker.getAliasedSymbol(D)}catch{return}let se=Ad(W,e,a,l,s);if(se!==void 0){I(se,D.getName());return}if((W.flags&d.SymbolFlags.Module)!==0&&!F.has(W)){F.add(W);try{for(let Fe of e.checker.getExportsOfModule(W))A(Fe)}catch{}}};if(E!==void 0)for(let D of e.checker.getExportsOfModule(E))A(D);let j=vs(b,m,u,vn(b)),z=Is(b,m,u,j,ks(b)),M=new Set,J=z.residual,H=D=>{let W=f.get(D);D.includes("node_modules/")||W===void 0||wd(W)?J=!0:M.add(D)};for(let{source:D,exportedName:W}of z.sources){let se=o.get(D.target)??[],Fe=S.has(D.target);if(D.kind==="whole"){for(let Ie of se)I(Ie,Ie.name??W);Fe?J=!0:(se.length===0||h(D.target))&&H(D.target)}else{let Ie=se.filter(be=>be.name===D.member);for(let be of Ie)I(be,W);Fe?J=!0:(Ie.length===0||h(D.target))&&H(D.target)}}let K=new Set,V=[];for(let D of ys(b,m,u))V.push({target:D,depth:1});for(;V.length>0;){let D=V.shift();if(D===void 0)break;let{target:W,depth:se}=D;if(K.has(W)||se>jd||(K.add(W),W.split("/").includes("node_modules")))continue;let Fe=f.get(W);if(Fe===void 0)continue;let Ie=c.get(W);Ie!==void 0&&!h(W)&&I(Ie,"<load>");for(let be of ys(Fe,W,u))K.has(be)||V.push({target:be,depth:se+1})}Rd(b,vn(b))&&(J=!0);for(let D of M)N.push({code:"unresolved-reexport",path:m,detail:`entrypoint whole/member re-exports app-owned relative module ${D} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:D});J&&N.push({code:"unresolved-reexport",path:m,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:C,exportBindings:$,diagnostics:N}}var In=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),Bd=new Set(["defineProperty","defineProperties","create"]);function zd(e){let n=!0,t=i=>d.isIdentifier(i)||d.isStringLiteral(i)||d.isNumericLiteral(i)?In.has(i.text):d.isComputedPropertyName(i)&&d.isStringLiteralLike(i.expression)?In.has(i.expression.text):!1,r=i=>{if(n){if(d.isNewExpression(i)||d.isForOfStatement(i)||d.isSpreadElement(i)||d.isSpreadAssignment(i)||d.isArrayBindingPattern(i)||d.isGetAccessorDeclaration(i)||d.isSetAccessorDeclaration(i)||d.isYieldExpression(i)&&i.asteriskToken!==void 0||d.canHaveDecorators(i)&&(d.getDecorators(i)?.length??0)>0){n=!1;return}if((d.isPropertyAccessExpression(i)||d.isMethodDeclaration(i)||d.isPropertyAssignment(i))&&t(i.name)||d.isPropertyDeclaration(i)&&t(i.name)||d.isShorthandPropertyAssignment(i)&&t(i.name)||d.isBindingElement(i)&&t(i.propertyName??i.name)||d.isElementAccessExpression(i)&&d.isStringLiteralLike(i.argumentExpression)&&In.has(i.argumentExpression.text)){n=!1;return}if(d.isCallExpression(i)&&d.isPropertyAccessExpression(i.expression)&&d.isIdentifier(i.expression.expression)&&i.expression.expression.text==="Object"&&Bd.has(i.expression.name.text)){n=!1;return}d.forEachChild(i,r)}};return r(e),n}function xt(e){if(d.isIdentifier(e)||d.isStringLiteral(e)||d.isNumericLiteral(e))return e.text}function Rs(e){let n=t=>d.canHaveDecorators(t)&&(d.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Ud(e){let n=!1,t=new Set,r=[],i=new Map,s=(p,h)=>{let S=i.get(p);S===void 0?i.set(p,[h]):S.push(h)},a=p=>{d.isIdentifier(p)?t.add(p.text):r.push(p)},l=p=>{for(let h of p.properties)d.isShorthandPropertyAssignment(h)?t.add(h.name.text):d.isPropertyAssignment(h)?r.push(h.initializer):n=!0},o=p=>{if(d.isBinaryExpression(p)&&p.operatorToken.kind===d.SyntaxKind.EqualsToken){let h=p.left,S=p.right;ve(h)?d.isObjectLiteralExpression(S)?l(S):d.isIdentifier(S)||d.isFunctionExpression(S)||d.isArrowFunction(S)||d.isClassExpression(S)?a(S):n=!0:ze(h)?(d.isElementAccessExpression(h)&&!d.isStringLiteralLike(h.argumentExpression)&&(n=!0),a(S)):d.isIdentifier(h)?s(h.text,S):(d.isPropertyAccessExpression(h)||d.isElementAccessExpression(h))&&d.isIdentifier(h.expression)&&s(h.expression.text,S)}else if(d.isCallExpression(p))(An(p)&&p.arguments[0]!==void 0&&xn(p.arguments[0])||mr(p))&&(n=!0);else if(d.isVariableDeclaration(p)&&d.isIdentifier(p.name)&&p.initializer!==void 0)s(p.name.text,p.initializer);else if((d.isFunctionDeclaration(p)||d.isClassDeclaration(p))&&p.name!==void 0)s(p.name.text,p),yn(p)&&t.add(p.name.text);else if(d.isExportDeclaration(p)){if(p.exportClause===void 0)n=!0;else if(p.moduleSpecifier===void 0&&d.isNamedExports(p.exportClause))for(let h of p.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(d.isExportAssignment(p))p.isExportEquals&&!d.isIdentifier(p.expression)?n=!0:a(p.expression);else if(d.isVariableStatement(p)&&yn(p))for(let h of p.declarationList.declarations)d.isIdentifier(h.name)&&t.add(h.name.text);d.forEachChild(p,o)};o(e);let c=new Set,u=[...t],f=p=>{let h=S=>{d.isIdentifier(S)&&u.push(S.text),d.forEachChild(S,h)};h(p)};for(let p of r)f(p);for(;u.length>0;){let p=u.pop();if(!(p===void 0||c.has(p))){c.add(p);for(let h of i.get(p)??[])f(h)}}return{names:c,opaque:n}}var Vd=512,qd=new Set(["get","post","put","patch","delete","options","head"]);function Hd(e){for(let n of e.statements){if(d.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(d.isExpressionStatement(n)&&d.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(n.expression.left)&&d.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,r=n.expression.left.name.text;if(t==="module"&&r==="exports"||t==="exports"&&r==="default")return n.expression.right}}return null}function Wd(e){let n=new Map,t=Hd(e);if(t===null)return n;let r=s=>{for(let a of s.properties)if(d.isPropertyAssignment(a)&&d.isObjectLiteralExpression(a.initializer)){let l=xt(a.name);l!==void 0&&n.set(l,a.initializer)}};if(d.isObjectLiteralExpression(t))return r(t),n;if(!d.isIdentifier(t))return n;let i=t.text;for(let s of e.statements)if(d.isVariableStatement(s))for(let a of s.declarationList.declarations)d.isIdentifier(a.name)&&a.name.text===i&&a.initializer!==void 0&&d.isObjectLiteralExpression(a.initializer)&&r(a.initializer);else if(d.isExpressionStatement(s)&&d.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(s.expression.left)&&d.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===i&&d.isObjectLiteralExpression(s.expression.right)){let a=s.expression.left.name.text;n.set(a,s.expression.right)}return n}function Gd(e){for(let n of e.properties){if(d.isMethodDeclaration(n)&&d.isIdentifier(n.name)&&n.name.text==="handler")return n;if(d.isPropertyAssignment(n)&&d.isIdentifier(n.name)&&n.name.text==="handler"&&(d.isArrowFunction(n.initializer)||d.isFunctionExpression(n.initializer)))return n.initializer}return null}function Xd(e,n){for(let r of e.properties){let i;if(d.isPropertyAssignment(r)||d.isMethodDeclaration(r)?i=xt(r.name):d.isShorthandPropertyAssignment(r)&&(i=r.name.text),i==="method"||i==="url"||i==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Jd(e,n){let t=[],r=new Set,i=(l,o,c)=>{if(t.length>=Vd||l==="__proto__"||!hr.test(l))return;let u=`${e}#handler:${l}`;r.has(u)||(r.add(u),t.push({id:u,node:o,memberPath:l,idiom:c}))};for(let[l,o]of Wd(n)){let c=Gd(o);c!==null&&Xd(o,c)&&i(l,c,"descriptor-object")}let s=0,a=l=>{if(d.isCallExpression(l)&&d.isPropertyAccessExpression(l.expression)&&d.isIdentifier(l.expression.expression)&&qd.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&d.isStringLiteralLike(l.arguments[0])){let o=l.expression.name.text;for(let c=1;c<l.arguments.length;c+=1){let u=l.arguments[c];u!==void 0&&(d.isArrowFunction(u)||d.isFunctionExpression(u))&&i(`${o}_${String(s)}_${String(c)}`,u,"router-verb")}s+=1}d.forEachChild(l,a)};return a(n),t}function Yd(e,n,t,r,i,s){let a=`${e}#class:${t}`,l=[],o=new Set;for(let c of r.members){let u,f,p;if(d.isConstructorDeclaration(c))u="constructor",f="ctor",p=!1;else if(d.isMethodDeclaration(c))u=xt(c.name),f="method",p=u!==void 0&&!In.has(u);else continue;if(u===void 0||o.has(u))continue;o.add(u);let h=`${e}#${t}.${u}`;i.push({id:h,moduleId:e,name:u,kind:f,enclosingClassId:a,declRange:an(e,c,n),isExported:!1,publicSurfaceReachable:!1}),l.push(h),p&&s.push({start:c.getStart(n,!1),end:c.getEnd(),id:h})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function Zd(e,n,t=[],r=!1,i){let s=[],a=new Map,l=[],{reachableLocals:o,defaultTarget:c}=kd(n),u=vn(n),f=`${e}#<toplevel>`;s.push({id:f,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let p=(m,E)=>{let _=`${e}#${m}`;return s.push({id:_,moduleId:e,name:m,kind:"function",declRange:an(e,E,n),isExported:o.has(m),publicSurfaceReachable:o.has(m)}),a.set(m,{kind:"function",functionId:_}),l.push({start:E.getStart(n,!1),end:E.getEnd(),id:_}),_},h=[],S=!e.split("/").includes("node_modules");if(S)for(let m of Od(n,u))o.add(m);let x=S?Ud(n):void 0,y=(m,E,_)=>{x===void 0||x.opaque||x.names.has(m)||yn(_)||Rs(E)||h.push(Yd(e,n,m,E,s,l))};for(let m of n.statements)if(d.isFunctionDeclaration(m)&&m.name!==void 0)p(m.name.text,m);else if(d.isClassDeclaration(m)&&m.name!==void 0)y(m.name.text,m,m);else if(d.isVariableStatement(m))for(let E of m.declarationList.declarations){if(d.isObjectBindingPattern(E.name)&&E.initializer!==void 0&&d.isCallExpression(E.initializer)&&d.isIdentifier(E.initializer.expression)&&E.initializer.expression.text==="require"&&E.initializer.arguments.length===1&&E.initializer.arguments[0]!==void 0&&d.isStringLiteralLike(E.initializer.arguments[0])){let F=E.initializer.arguments[0].text;for(let O of E.name.elements){if(O.dotDotDotToken!==void 0||O.initializer!==void 0||!d.isIdentifier(O.name))continue;let I=O.propertyName??O.name;!d.isIdentifier(I)&&!d.isStringLiteralLike(I)||a.set(O.name.text,{kind:"import",specifier:F,form:{named:I.text}})}continue}if(!d.isIdentifier(E.name)||E.initializer===void 0)continue;let _=E.initializer;if(d.isFunctionExpression(_)||d.isArrowFunction(_))p(E.name.text,E);else if(d.isClassExpression(_))y(E.name.text,_,m);else if(d.isCallExpression(_)&&d.isIdentifier(_.expression)&&_.expression.text==="require"&&_.arguments.length===1&&_.arguments[0]!==void 0&&d.isStringLiteralLike(_.arguments[0]))a.set(E.name.text,{kind:"import",specifier:_.arguments[0].text,form:"whole"});else if((d.isPropertyAccessExpression(_)||d.isElementAccessExpression(_))&&yt(_)==="default"&&d.isCallExpression(_.expression)){let F=Ye(_.expression);F!==void 0&&a.set(E.name.text,{kind:"import",specifier:F,form:"require-default"})}}else if(d.isImportDeclaration(m)&&d.isStringLiteralLike(m.moduleSpecifier)){let E=m.moduleSpecifier.text,_=m.importClause;if(_!==void 0){_.name!==void 0&&a.set(_.name.text,{kind:"import",specifier:E,form:"default"});let F=_.namedBindings;if(F!==void 0&&d.isNamespaceImport(F))a.set(F.name.text,{kind:"import",specifier:E,form:"namespace"});else if(F!==void 0&&d.isNamedImports(F))for(let O of F.elements){let I=(O.propertyName??O.name).text;a.set(O.name.text,{kind:"import",specifier:E,form:{named:I}})}}}else d.isImportEqualsDeclaration(m)&&d.isExternalModuleReference(m.moduleReference)&&d.isStringLiteralLike(m.moduleReference.expression)&&a.set(m.name.text,{kind:"import",specifier:m.moduleReference.expression.text,form:"whole"});let v=new Map,C,$=new Map,N=new Map;if(S)for(let{name:m,value:E}of Cd(n)){let _=`${e}#member-export:${m}`;s.push({id:_,moduleId:e,name:m,kind:d.isArrowFunction(E)?"arrow":"function",declRange:an(e,E,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:E.getStart(n,!1),end:E.getEnd(),id:_}),v.set(E.getStart(n,!1),_)}if(r&&S){let m=I=>{let A=Ne(I);return d.isFunctionExpression(A)||d.isArrowFunction(A)?A:void 0},E=(I,A)=>{let j=I;return s.push({id:j,moduleId:e,kind:d.isArrowFunction(A)?"arrow":"function",declRange:an(e,A,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:A.getStart(n,!1),end:A.getEnd(),id:j}),v.set(A.getStart(n,!1),j),j},_=[],F=[],O=[];for(let I of n.statements)d.isExportAssignment(I)&&!I.isExportEquals?_.push(I):d.isFunctionDeclaration(I)&&d.getModifiers(I)?.some(A=>A.kind===d.SyntaxKind.DefaultKeyword)===!0?F.push(I):d.isExpressionStatement(I)&&d.isBinaryExpression(I.expression)&&I.expression.operatorToken.kind===d.SyntaxKind.EqualsToken&&ve(I.expression.left)&&O.push(I.expression);if(_.length+F.length+O.length===1){let I=_[0],A=F[0],j=O[0];if(I!==void 0){let z=m(I.expression);if(z!==void 0){let M=E(`${e}#<default>`,z);C={id:M,esm:!0},N.set(I.getStart(n,!1),M),te(i,"2a-default",null)}}else if(A!==void 0&&A.name===void 0&&A.body!==void 0){let z=E(`${e}#<default>`,A);C={id:z,esm:!0},N.set(A.getStart(n,!1),z),te(i,"2a-default",null)}else if(j!==void 0){let z=m(j.right);if(z!==void 0){let M=E(`${e}#<default>`,z);C={id:M,esm:!1},N.set(j.getStart(n,!1),M),te(i,"2a-default",null)}else if(d.isObjectLiteralExpression(j.right)){let M=j.right,J=[],H=!0;for(let K of M.properties){if(d.isSpreadAssignment(K)){H=!1;break}let V=K.name,D=V===void 0?void 0:fr(V);if(D===void 0){H=!1;break}J.push(D)}if(H){let K=new Map;for(let V of J)K.set(V,(K.get(V)??0)+1);for(let V of M.properties){if(!d.isPropertyAssignment(V))continue;let D=fr(V.name),W=m(V.initializer);if(D!==void 0){if(!_d(D)){W!==void 0&&te(i,"2a-member","charset-refused");continue}if((K.get(D)??0)!==1){W!==void 0&&te(i,"2a-member","duplicate-key");continue}if(W!==void 0){let se=E(`${e}#<cjs>.${D}`,W);$.set(D,se),N.set(V.getStart(n,!1),se),te(i,"2a-member",null)}}}}else for(let K of M.properties)d.isPropertyAssignment(K)&&m(K.initializer)!==void 0&&te(i,"2a-member","spread-or-computed-literal")}}}else{for(let I of _)m(I.expression)!==void 0&&te(i,"2a-default","duplicate-default-sources");for(let I of F)I.name===void 0&&te(i,"2a-default","duplicate-default-sources");for(let I of O)if(m(I.right)!==void 0)te(i,"2a-default","duplicate-default-sources");else if(d.isObjectLiteralExpression(I.right))for(let A of I.right.properties)d.isPropertyAssignment(A)&&m(A.initializer)!==void 0&&te(i,"2a-member","duplicate-default-sources")}}for(let m of t)s.push({id:m.id,moduleId:e,name:`handler:${m.memberPath}`,kind:d.isArrowFunction(m.node)?"arrow":"function",declRange:an(e,m.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:m.node.getStart(n,!1),end:m.node.getEnd(),id:m.id});l.sort((m,E)=>m.end-m.start-(E.end-E.start));let b=c!==void 0?`${e}#${c}`:void 0;return{rel:e,sf:n,functions:s,bindings:a,exportedFunctionId:b,exportedNames:o,tainted:u,fnRanges:l,toplevelId:f,classes:h,mintedByPos:v,mintedDefault:C,mintedMembers:$,mintSeedAliases:N}}function Qd(e){return d.isIdentifier(e)?"identifier":d.isPropertyAccessExpression(e)?"member":d.isElementAccessExpression(e)?"computed-member":e.kind===d.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function xs(e,n){let t=r=>{if(d.isBinaryExpression(r)&&r.operatorToken.kind>=d.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=d.SyntaxKind.LastAssignment){let i=r.left;d.isPropertyAccessExpression(i)&&d.isIdentifier(i.expression)?n(i.expression.text,i.name.text):d.isElementAccessExpression(i)&&d.isIdentifier(i.expression)&&n(i.expression.text,d.isStringLiteralLike(i.argumentExpression)?i.argumentExpression.text:null)}else if(d.isCallExpression(r)&&d.isPropertyAccessExpression(r.expression)){let i=r.expression,s=r.arguments[0];d.isIdentifier(i.expression)&&s!==void 0&&d.isIdentifier(s)&&(i.expression.text==="Object"&&(i.name.text==="assign"||i.name.text==="defineProperty"||i.name.text==="defineProperties")||i.expression.text==="Reflect"&&i.name.text==="defineProperty")&&n(s.text,null)}d.forEachChild(r,t)};t(e)}function ec(e){let n=!1,t=r=>{if(!n){if(d.isVariableDeclaration(r)||d.isParameter(r)){let i=new Set;if(Pn(r.name,i),i.has("require")){n=!0;return}}else if((d.isFunctionDeclaration(r)||d.isClassDeclaration(r))&&r.name!==void 0&&r.name.text==="require"){n=!0;return}d.forEachChild(r,t)}};return t(e),n}function nc(e,n,t,r=new Map,i={}){let s=i.additiveForms===!0,a=i.namelessExports===!0,l=s||a?{}:void 0,o=new Map,c=new Map;for(let m of n.imports)m.resolvedModuleId!==void 0&&c.set(`${m.moduleId}::${m.specifier}`,m.resolvedModuleId);for(let m of e.sourceFiles){let E=e.toRel(m.fileName);E!==null&&o.set(E,Zd(E,m,r.get(E)??[],a,l))}let u=new Map;if(s)for(let m of o.values()){let E=new Map;for(let[_,F]of m.bindings)if(F.kind==="import"&&F.form==="whole"&&ue(F.specifier)!=="package-root"){let O=c.get(`${m.rel}::${F.specifier}`);O!==void 0&&E.set(_,String(O))}E.size!==0&&xs(m.sf,(_,F)=>{let O=E.get(_);if(O===void 0)return;let I=u.get(O);if(I!=="*"){if(F===null){u.set(O,"*");return}I===void 0?u.set(O,new Set([F])):I.add(F)}})}let f=new Map;for(let m of o.values())m.exportedFunctionId!==void 0&&f.set(m.rel,m.exportedFunctionId);let p=new Map;for(let m of o.values()){if(m.rel.split("/").includes("node_modules"))continue;let E=Ed(m.sf);if(E===void 0){a&&m.mintedDefault!==void 0&&p.set(m.rel,m.mintedDefault);continue}let _=m.bindings.get(E.name);_?.kind==="function"&&p.set(m.rel,{id:_.functionId,esm:E.esm})}let h=new Map;for(let m of o.values()){let E;for(let _ of m.exportedNames){let F=m.bindings.get(_);F?.kind==="function"&&(E??=new Map,E.set(_,F.functionId))}E!==void 0&&h.set(m.rel,E)}let S=new Map;for(let m of o.values()){if(m.rel.split("/").includes("node_modules"))continue;let E=Ld(m.sf,m.tainted,_=>{let F=m.bindings.get(_);return F?.kind==="function"?F.functionId:void 0},a?_=>{let F=Ne(_);return d.isFunctionExpression(F)||d.isArrowFunction(F)?m.mintedByPos.get(F.getStart(m.sf,!1)):void 0}:void 0);E.size>0&&S.set(m.rel,E)}let x=[],y=[],v=[],C=[],$=[],N=[];for(let m of o.values()){x.push(...m.functions),N.push(...m.classes);for(let k of m.exportedNames){let w=m.bindings.get(k);if(w?.kind==="function"){let R=`${m.rel}#export:${k}`;C.push({id:R,moduleId:m.rel,exportedName:k,kind:"value"}),$.push({exportId:R,target:{kind:"function",functionId:w.functionId}})}}if(a){if(m.mintedDefault!==void 0){let k=`${m.rel}#export:<default>`;C.push({id:k,moduleId:m.rel,exportedName:"default",kind:"value"}),$.push({exportId:k,target:{kind:"function",functionId:m.mintedDefault.id}})}for(let[k,w]of m.mintedMembers){let R=`${m.rel}#export:<cjs>.${k}`;C.push({id:R,moduleId:m.rel,exportedName:k,kind:"value"}),$.push({exportId:R,target:{kind:"function",functionId:w}})}}let E=new Map;for(let[k,w]of m.bindings){if(w.kind==="function"){E.set(k,w);continue}if(ue(w.specifier)==="package-root"){let P=We(w.specifier);typeof w.form=="object"?E.set(k,{kind:"package-export",packageName:P,exportName:w.form.named}):w.form==="require-default"?E.set(k,{kind:"package-default",packageName:P}):E.set(k,{kind:"package-surface",packageName:P})}else{let P=c.get(`${m.rel}::${w.specifier}`);if(P!==void 0&&typeof w.form=="object"){let Y=h.get(String(P))?.get(w.form.named);Y!==void 0&&E.set(k,{kind:"app-named-fn",functionId:Y})}else if(P!==void 0&&w.form==="require-default"){let Y=p.get(String(P));Y!==void 0&&Y.esm&&E.set(k,{kind:"app-default-fn",functionId:Y.id})}else P!==void 0&&typeof w.form!="object"&&w.form!=="require-default"&&E.set(k,{kind:"module",resolvedModuleId:P})}}let _=new Map;for(let k of m.functions){if(k.enclosingClassId===void 0||k.name===void 0)continue;let w=_.get(k.enclosingClassId);w===void 0&&(w=new Map,_.set(k.enclosingClassId,w)),w.set(k.name,k.id)}for(let k of m.classes)k.name===void 0||m.tainted.has(k.name)||E.has(k.name)||E.set(k.name,{kind:"app-class",cls:{classId:k.id,className:k.name,memberIds:_.get(k.id)??new Map}});let F=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0&&d.isNewExpression(k.initializer)&&!m.tainted.has(k.name.text)&&!E.has(k.name.text)){let w=fs(k.initializer,E,m.tainted);w!==null&&E.set(k.name.text,w)}d.forEachChild(k,F)};F(m.sf);let O=k=>{for(let w of m.fnRanges)if(k>=w.start&&k<w.end)return w.id;return m.toplevelId},I=new Map,A=new Map,j=new Map,z=(k,w,R)=>{if(R===null){k.set(w,"*");return}let P=k.get(w);P!=="*"&&(P===void 0?k.set(w,new Set([R])):P.add(R))},M=(k,w)=>{z(I,k,w);let R=E.get(k);R?.kind==="package-surface"?z(A,R.packageName,w):R?.kind==="module"&&z(j,String(R.resolvedModuleId),w)};xs(m.sf,M);let J=new Map,H=256,K=k=>{let w=J.get(k);return w===void 0&&(w=J.size>=H?new Set([k]):Ns(m.sf,new Set([k])),J.set(k,w)),w},V=(k,w)=>k==="*"||k!==void 0&&k.has(w),D=(k,w)=>{let R=E.get(k);if(R?.kind==="package-surface"&&V(A.get(R.packageName),w)||R?.kind==="module"&&V(j.get(String(R.resolvedModuleId)),w))return!0;for(let P of K(k))if(V(I.get(P),w))return!0;return!1},W=k=>{if(d.isIdentifier(k)){let w=m.tainted.has(k.text)?void 0:E.get(k.text);return w?.kind==="function"?w.functionId:w?.kind==="module"?f.get(String(w.resolvedModuleId))??null:w?.kind==="package-export"?t.exportFor(w.packageName,w.exportName):null}if(d.isPropertyAccessExpression(k)&&d.isIdentifier(k.expression)){let w=k.expression.text;if(D(w,k.name.text))return null;let R=m.tainted.has(w)?void 0:E.get(w);return R?.kind==="package-surface"?t.exportFor(R.packageName,k.name.text):R?.kind==="package-export"?t.methodFor(R.packageName,R.exportName,k.name.text,"method"):R?.kind==="package-instance"?t.methodFor(R.packageName,R.className,k.name.text,"method"):null}return null},se=k=>{for(let w=k.parent;w!==void 0;w=w.parent)if(!d.isArrowFunction(w)){if(d.isFunctionExpression(w)||d.isFunctionDeclaration(w))return null;if(d.isMethodDeclaration(w)||d.isConstructorDeclaration(w)||d.isGetAccessorDeclaration(w)||d.isSetAccessorDeclaration(w)){let R=w.parent;if(!d.isClassLike(R)||R.name===void 0)return null;let P=m.tainted.has(R.name.text)?void 0:E.get(R.name.text);return P?.kind==="app-class"?P.cls:null}}return null},Fe=s&&!m.tainted.has("require")&&!ec(m.sf),Ie=k=>{if(d.isIdentifier(k)){let P=m.tainted.has(k.text)?void 0:E.get(k.text);return P?.kind==="package-surface"||P?.kind==="package-default"?t.exportFor(P.packageName,"default"):P?.kind==="app-named-fn"||P?.kind==="app-default-fn"?P.functionId:P?.kind==="module"?p.get(String(P.resolvedModuleId))?.id??null:P?.kind==="member-value"?P.functionId:null}if(!d.isPropertyAccessExpression(k))return null;let w=k.expression;if(s&&d.isCallExpression(Ne(w))){let P=Ye(Ne(w));if(P!==void 0)if(!Fe)te(l,"2b","require-shadow");else if(ue(P)==="package-root")te(l,"2b","package-root");else{let Y=c.get(`${m.rel}::${P}`);if(Y===void 0)te(l,"2b","unresolved-module");else{let re=k.name.text,ge=u.get(String(Y));if(ge==="*"||ge!==void 0&&ge.has(re))te(l,"2b","module-mutation-gate");else{let Oe=S.get(String(Y))?.get(re);if(Oe!==void 0)return te(l,"2b",null),Oe;if(re==="default"){let ye=p.get(String(Y));if(ye!==void 0&&ye.esm)return te(l,"2b",null),ye.id;te(l,"2b","non-esm-default")}else te(l,"2b","unknown-member")}}}return null}let R;if(d.isIdentifier(w)){let P=m.tainted.has(w.text)?void 0:E.get(w.text);if(P?.kind==="app-class"||P?.kind==="app-instance")R=P.cls.memberIds;else if(P?.kind==="object-literal")R=P.obj.members;else if(P?.kind==="module"){let Y=S.get(String(P.resolvedModuleId));Y?.has(k.name.text)===!0&&!D(w.text,k.name.text)&&(R=Y)}}else if(d.isNewExpression(w)){let P=fs(w,E,m.tainted);P?.kind==="app-instance"&&(R=P.cls.memberIds)}else w.kind===d.SyntaxKind.ThisKeyword&&(R=se(k)?.memberIds);return R?.get(k.name.text)??null},be=new Map,dn=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0&&d.isObjectLiteralExpression(k.initializer)&&!m.tainted.has(k.name.text)&&!E.has(k.name.text)&&!be.has(k.name.text)){let w=new Map;for(let R of k.initializer.properties)if(d.isPropertyAssignment(R)&&d.isIdentifier(R.name)){let P=W(R.initializer);P!==null&&w.set(R.name.text,P)}be.set(k.name.text,w)}d.forEachChild(k,dn)};dn(m.sf);let cn=k=>{if(d.isBinaryExpression(k)&&k.operatorToken.kind===d.SyntaxKind.EqualsToken&&d.isPropertyAccessExpression(k.left)&&d.isIdentifier(k.left.expression)&&!m.tainted.has(k.left.expression.text)){let w=be.get(k.left.expression.text);if(w!==void 0){let R=W(k.right);R!==null&&w.set(k.left.name.text,R)}}d.forEachChild(k,cn)};cn(m.sf);for(let[k,w]of be)E.set(k,{kind:"object-literal",obj:{members:w}});let un=(k,w=0)=>{if(w>cs)return null;let R=Ne(k);if(d.isCallExpression(R)&&d.isPropertyAccessExpression(R.expression)&&R.expression.name.text==="bind")return un(R.expression.expression,w+1);if(d.isIdentifier(R)){let P=W(R);if(P!==null)return P;let Y=m.tainted.has(R.text)?void 0:E.get(R.text);return Y?.kind==="member-value"?Y.functionId:null}return d.isPropertyAccessExpression(R)?W(R)??Ie(R):null},B=(k,w=0)=>{if(w>cs)return"depth-cap";let R=Ne(k);if(d.isCallExpression(R)&&d.isPropertyAccessExpression(R.expression)&&R.expression.name.text==="bind")return B(R.expression.expression,w+1);if(d.isIdentifier(R))return m.tainted.has(R.text)?"tainted-receiver":"unresolved-receiver";if(d.isPropertyAccessExpression(R)&&d.isIdentifier(R.expression)){if(m.tainted.has(R.expression.text))return"tainted-receiver";if(D(R.expression.text,R.name.text))return"mutated-member"}return"unresolved-receiver"},ke=k=>{if(d.isVariableDeclaration(k)&&d.isIdentifier(k.name)&&k.initializer!==void 0){let w=Ne(k.initializer),R=d.isPropertyAccessExpression(w),P=d.isCallExpression(w)&&d.isPropertyAccessExpression(w.expression)&&w.expression.name.text==="bind";if(R||P){let Y=R?"D1":"A2";if(m.tainted.has(k.name.text))te(l,Y,"tainted-alias");else if(E.has(k.name.text))te(l,Y,"already-bound");else{let re=un(w);re!==null?(E.set(k.name.text,{kind:"member-value",functionId:re}),te(l,Y,null)):te(l,Y,B(w))}}}d.forEachChild(k,ke)};s&&ke(m.sf);let fe=0,de=k=>{let w,R;if(d.isCallExpression(k)){let P=k.expression,Y=d.isIdentifier(P)&&P.text==="require",re=P.kind===d.SyntaxKind.ImportKeyword;!Y&&!re&&(w=P,R=k.arguments)}else d.isTaggedTemplateExpression(k)&&(w=k.tag);if(w!==void 0){let P=Qd(w),Y=k.getStart(m.sf,!1),re=`${m.rel}#call${String(fe)}`;fe+=1;let ge="unresolved",Oe=[],ye=W(w);ye!==null&&(ge="resolved",Oe.push(ye)),y.push({id:re,enclosingFunctionId:O(Y),calleeExprShape:P,resolvedTargetIds:Oe,resolution:ge,range:an(m.rel,k,m.sf)});for(let Z of Oe)v.push({callSiteId:re,calleeFunctionId:Z,resolution:ge});if(ye===null){let Z=Ie(w);if(Z!==null)v.push({callSiteId:re,calleeFunctionId:Z,resolution:"field-based"});else if(s&&d.isPropertyAccessExpression(w)&&(w.name.text==="call"||w.name.text==="apply")){let xe=un(w.expression);xe!==null?(v.push({callSiteId:re,calleeFunctionId:xe,resolution:"field-based"}),te(l,"A3",null)):te(l,"A3",B(w.expression))}}for(let Z of R??[]){let xe=W(Z);if(xe!==null)v.push({callSiteId:re,calleeFunctionId:xe,resolution:"field-based"});else{let he=Ie(Z);if(he!==null)v.push({callSiteId:re,calleeFunctionId:he,resolution:"field-based"});else if(s){let Le=un(Z),Re=Ne(Z),q=Re!==Z||d.isCallExpression(Re)&&d.isPropertyAccessExpression(Re.expression)&&Re.expression.name.text==="bind";Le!==null?(v.push({callSiteId:re,calleeFunctionId:Le,resolution:"field-based"}),q&&te(l,"A2p",null)):q&&te(l,"A2p",B(Z))}}}}d.forEachChild(k,de)};de(m.sf);for(let k of n.computedLoads.get(m.rel)??[]){let w=k.candidateRels.filter(P=>o.has(P)).map(P=>`${P}#<toplevel>`);if(w.length===0)continue;let R=`${m.rel}#dirload${String(fe)}`;fe+=1,y.push({id:R,enclosingFunctionId:O(k.pos),calleeExprShape:"require",resolvedTargetIds:w,resolution:"field-based",range:{path:m.rel,start:k.pos,end:k.pos}});for(let P of w)v.push({callSiteId:R,calleeFunctionId:P,resolution:"field-based"})}let je=0;for(let k of r.get(m.rel)??[]){let w=`${m.rel}#handlerseed${String(je)}`;je+=1;let R=k.node.getStart(m.sf,!1);y.push({id:w,enclosingFunctionId:m.toplevelId,calleeExprShape:"member",resolvedTargetIds:[k.id],resolution:"field-based",range:{path:m.rel,start:R,end:R}}),v.push({callSiteId:w,calleeFunctionId:k.id,resolution:"field-based"})}}let b=new Map;if(a)for(let m of o.values())for(let[E,_]of m.mintSeedAliases)b.set(`${m.rel}::${String(E)}`,_);return{functions:x,callSites:y,callEdges:v,exports:C,exportBindings:$,classes:N,mintSeedAliases:b,bindingApplicability:l}}function tc(e,n,t){let r=o=>o.length===0||Ce.isAbsolute(o)||o.includes("\\")||/^[a-zA-Z]:/u.test(o)||o.split("/").some(c=>c===".."||c==="");if(r(n)||r(t))return null;let i=e.endsWith(Ce.sep)?e:e+Ce.sep,s;try{s=ds(Ce.resolve(e,n))}catch{return null}if(!s.startsWith(i))return null;let a=s.endsWith(Ce.sep)?s:s+Ce.sep,l;try{l=ds(Ce.resolve(s,t))}catch{return null}return l.startsWith(a)?l:null}function $s(e,n,t){let r=`${e}#class:${t}`,i=[],s=[],a=[],l=new Set;return{pushMember(o,c,u,f){if(o==="__proto__"||l.has(o))return;l.add(o);let p=`${e}#${t}.${o}`;i.push({id:p,moduleId:e,name:o,kind:u,enclosingClassId:r,declRange:an(e,c,n),isExported:!1,publicSurfaceReachable:!1}),a.push(p),s.push({name:o,id:p,kind:u,body:f})},finish(){return s.length===0?null:{functions:i,classNode:{id:r,moduleId:e,name:t,implementsRefs:[],members:a},members:s}}}}function rc(e,n,t,r){if(Rs(r)||r.members.length>pr)return null;let i=$s(e,n,t);for(let s of r.members){let a,l,o;if(d.isConstructorDeclaration(s))a="constructor",l="ctor",o=void 0;else if(d.isMethodDeclaration(s))a=xt(s.name),l="method",o=a!==void 0&&!In.has(a)?s.body??void 0:void 0;else continue;a!==void 0&&i.pushMember(a,s,l,o)}return i.finish()}function ic(e,n,t){let r;for(let a of n.statements)if(d.isFunctionDeclaration(a)&&a.name?.text===t){r=a;break}if(r===void 0)return null;let i=[];for(let a of n.statements){if(!d.isExpressionStatement(a))continue;let l=a.expression;if(!d.isBinaryExpression(l)||l.operatorToken.kind!==d.SyntaxKind.EqualsToken)continue;let o=l.left;if(d.isPropertyAccessExpression(o)&&d.isPropertyAccessExpression(o.expression)&&d.isIdentifier(o.expression.expression)&&o.expression.expression.text===t&&o.expression.name.text==="prototype"){let c=o.name.text;d.isFunctionExpression(l.right)?i.push({name:c,fn:l.right,walk:!0}):d.isArrowFunction(l.right)&&i.push({name:c,fn:l.right,walk:!1})}}if(i.length===0||i.length+1>pr)return null;let s=$s(e,n,t);s.pushMember("constructor",r,"ctor",void 0);for(let a of i){let l=a.walk&&!In.has(a.name)&&d.isFunctionExpression(a.fn)?a.fn.body:void 0;s.pushMember(a.name,a.fn,"method",l)}return s.finish()}function sc(e,n,t){for(let r of n.statements)if(d.isClassDeclaration(r)&&r.name?.text===t)return rc(e,n,t,r);return ic(e,n,t)}function oc(e,n,t,r,i){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let a=new Set(t.map(f=>f.packageName)),l=new Set(t.map(f=>f.path)),o=new Set,c=new Set,u=0;for(let f of n){if(!a.has(f.packageName))continue;let p=tc(e.appRoot,f.packageRootRel,f.sourcePath);if(p===null)continue;let h=e.toRel(p);if(h===null)continue;let S=`${h}#${f.container}`;if(c.has(S)||!o.has(h)&&o.size>=gt)continue;let x=_e(p);if(x===null)continue;let y;try{y=d.createSourceFile(h,x,d.ScriptTarget.Latest,!0,d.ScriptKind.JS)}catch{continue}let v=sc(h,y,f.container);if(v===null)continue;o.add(h),c.add(S);let C=new Map,$=new Map;for(let b of v.members){let m=i.methodFor(f.packageName,f.container,b.name,b.kind);C.set(b.name,m),$.set(m,b.id)}let N=0;for(let b of v.members){if(b.body===void 0)continue;let m=(E,_)=>{if(_&&d.isCallExpression(E)&&d.isPropertyAccessExpression(E.expression)&&E.expression.expression.kind===d.SyntaxKind.ThisKeyword){let I=C.get(E.expression.name.text);if(I!==void 0){let A=`${h}#depclass:${f.container}.${b.name}#c${String(N)}`;N+=1,s.callSites.push({id:A,enclosingFunctionId:b.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:an(h,E,y)}),s.callEdges.push({callSiteId:A,calleeFunctionId:I,resolution:"field-based"})}}let F=d.isFunctionExpression(E)||d.isFunctionDeclaration(E)||d.isMethodDeclaration(E)||d.isConstructorDeclaration(E)||d.isGetAccessorDeclaration(E)||d.isSetAccessorDeclaration(E)||d.isClassLike(E),O=d.isArrowFunction(E)?_:F?!1:_;d.forEachChild(E,I=>{m(I,O)})};m(b.body,!0)}for(let b of r){let m=$.get(b.calleeFunctionId);m!==void 0&&s.callEdges.push({callSiteId:b.callSiteId,calleeFunctionId:m,resolution:"field-based"})}if(s.functions.push(...v.functions),s.classes.push(v.classNode),!l.has(h)){l.add(h),s.modules.push({id:h,packageName:f.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let b=i.moduleFor(f.packageName),m=`${String(b)}#depclass${String(u)}`;u+=1,s.imports.push({id:m,moduleId:b,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),s.importEdges.push({importId:m,resolvedModuleId:h})}s.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${f.container} (${f.packageName}) \u2014 ${String(v.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:f.packageName,container:f.container}})}return s}function ac(e,n,t,r){let i=new Set(e.modules.filter(o=>o.isEntrypoint).map(o=>o.packageName)),s=new Map(e.functions.map(o=>[o.id,o.moduleId])),a=new Map;for(let o of e.callSites){if(o.resolution!=="unresolved")continue;let c=s.get(o.enclosingFunctionId);c!==void 0&&a.set(c,(a.get(c)??0)+1)}let l=[];for(let o of e.modules){if(o.externalSurface===!0)continue;let c=n.get(o.path);if(c===void 0||t.has(o.path)||i.has(o.packageName)&&r.has(o.path)&&!o.path.split("/").includes("node_modules"))continue;let u=a.get(o.id)??0;if(u===0&&zd(c))continue;let f=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:o.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${f}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:o.id})}return l}function Ms(e,n,t=[],r={},i=!1){let s=new ur,a=yd(e,n,s),l=new Set;for(let N of a.computedLoads.values())for(let b of N)if(b.seedable)for(let m of b.candidateRels)l.add(m);let o=new Map;for(let N of e.sourceFiles){let b=e.toRel(N.fileName);if(b===null||!l.has(b)||b.split("/").includes("node_modules"))continue;let m=Jd(b,N);m.length>0&&o.set(b,m)}let c=o.size===0?a.modules:a.modules.map(N=>o.has(N.path)&&!N.isEntrypoint?{...N,isEntrypoint:!0}:N),u={...a,modules:c},f=nc(e,u,s,o,r),p=Kd(e,a,f.functions,f.mintSeedAliases),h=new Set(a.modules.map(N=>N.path)),S=bd(e.depReach,s,h),x=[...u.modules,...S.modules,...s.modules()],y=oc(e,t,x,f.callEdges,s),v=[];if(i){let N="#default",b=new Set;for(let E of f.callEdges){let _=String(E.calleeFunctionId);!_.startsWith("pkg:")||!_.endsWith(N)||b.add(_.slice(4,_.length-N.length))}let m=new Map;for(let E of e.depReach.edges){if(!("surface"in E.from)||"surface"in E.to)continue;let _=E.from.surface;m.set(_,m.has(_)?null:E.to.module)}for(let E of b){let _=m.get(E);if(_==null)continue;let F=xd(Ce.join(e.appRoot,_));if(F===null||F==="default")continue;let O=s.exportFor(E,F),I=`pkg:${E}${N}`;for(let A of f.callEdges)String(A.calleeFunctionId)===I&&v.push({callSiteId:A.callSiteId,calleeFunctionId:O,resolution:"field-based"})}}let C={modules:[...u.modules,...S.modules,...y.modules,...s.modules()],exports:[...f.exports,...p.exports],imports:[...a.imports,...S.imports,...y.imports],functions:[...f.functions,...s.functions(),...y.functions],callSites:[...f.callSites,...y.callSites],classes:[...f.classes,...s.classes(),...y.classes],callEdges:[...f.callEdges,...y.callEdges,...v],importEdges:[...a.importEdges,...S.importEdges,...y.importEdges],exportBindings:[...f.exportBindings,...p.exportBindings],inheritEdges:[]},$=new Map;for(let N of e.sourceFiles){let b=e.toRel(N.fileName);b!==null&&$.set(b,N)}return{graph:C,diagnostics:[...p.diagnostics,...y.diagnostics,...ac(C,$,new Set(e.diagnostics.filter(N=>N.code==="dependency-body").map(N=>N.path)),a.appOwnedPaths)],...f.bindingApplicability!==void 0?{bindingApplicability:f.bindingApplicability}:{}}}var lc=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,St=/^[A-Za-z0-9_$.-]{1,128}$/u;function dc(e){return lc.test(e.calleePackage)?St.test(e.anchorExport)?St.test(e.calleeExport)?e.anchorContainer!==null&&!St.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!St.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function jn(e,n){let t=[],r=[],i=new Map(e.modules.map(c=>[c.id,c])),s=new Map(e.classes.map(c=>[c.id,c.name])),a=(c,u,f)=>e.functions.some(p=>{if(p.name!==u)return!1;let h=i.get(p.moduleId);return h===void 0||h.packageName!==c?!1:(p.enclosingClassId!==void 0?s.get(p.enclosingClassId)??null:null)===f}),l=(c,u,f)=>{for(let p of e.functions){if(p.name!==u)continue;let h=i.get(p.moduleId);if(!(h===void 0||h.packageName!==c||(p.enclosingClassId!==void 0?s.get(p.enclosingClassId)??null:null)!==f))return p.id}return null},o=[...n].sort((c,u)=>c.modelId<u.modelId?-1:c.modelId>u.modelId?1:0);for(let c of o){if(c.edges.length>64){t.push(`model ${c.modelId}: ${String(c.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=c.edges.map(dc).find(h=>h!==null);if(u!==void 0){t.push(`model ${c.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let f=0,p=0;for(let h of c.edges){if(!a(c.packageName,h.anchorExport,h.anchorContainer)){p+=1;continue}r.push({modelId:c.modelId,kind:h.kind,anchor:{packageName:c.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:l(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),f+=1}f>0?t.push(`model-edge ${c.modelId}: ${String(f)} edge(s) lowered, ${String(p)} reference-gated`):t.push(`model ${c.modelId}: refused \u2014 no anchor surface in the graph (${String(p)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:r,notes:t}}}var cc={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function br(e){try{let n=is(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(a=>a.split(nn.sep).join("/"))),{graph:r,diagnostics:i,bindingApplicability:s}=Ms(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:r,diagnostics:[...n.diagnostics,...i],...s!==void 0?{bindingApplicability:s}:{}}}catch(n){return{graph:cc,diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Ps(e,n){let t=512,r=(i,s,a)=>{if(!(t<=0||s>12)){if(t-=1,typeof i=="string"){n(i,a);return}if(Array.isArray(i)){for(let l of i)r(l,s+1,a);return}if(i!==null&&typeof i=="object")for(let[l,o]of Object.entries(i))l==="types"||l==="typings"||r(o,s+1,a||l.includes("*"))}};r(e,0,!1)}function Fs(e,n,t,r=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let i;try{i=Kn(nn.resolve(e,t))}catch{return null}return i!==e&&!i.startsWith(n)||r&&!Ge(i)?null:i===e?"":i.slice(n.length).split(nn.sep).join("/")}function js(e){let n=Kn(e),t=n.endsWith(nn.sep)?n:n+nn.sep,r=new Set,i=[],s=[],a=[],l=[],o=!1,c=(O,I,A=!1,j)=>{let z=Fs(n,t,O);return z===null||z.length===0?"unresolved":r.has(z)?"duplicate":(r.add(z),i.push(z),s.push({source:I,specifier:De(j??(typeof O=="string"?O:"")),entrypoint:z,launch:A}),"added")},u=new Set,f=(O,I,A=!1)=>{let j=c(O,I),z=typeof O=="string"&&O.includes("\\")?c(O.split("\\").join("/"),I,!1,O):"unresolved";if(j!=="unresolved"||z!=="unresolved"||typeof O!="string"||O.trim().length===0||O.endsWith(".d.ts")||O.endsWith(".d.mts")||O.endsWith(".d.cts"))return;if(A&&O.includes("*")){let J=os(n,O),H=!1;if(J!==null){for(let K of J.matches)c(K,I,!1,O)!=="unresolved"&&(H=!0);if(!J.truncated&&H)return}l.push({source:I,file:"package.json",detail:`\`${De(O)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let M=`${I}\0${O}`;u.has(M)||(u.add(M),l.push({source:I,file:"package.json",detail:`\`${De(O)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},p=[],h=(O,I)=>{a.push({source:O,file:O,detail:I.detail}),p.push({code:I.code,path:O,detail:`${O} ${I.detail}`})},S,x,y,v=null,C=Ls(n,t,"package.json",sn);C.kind==="refused"&&h("package.json",C);try{let O=C.kind==="ok"?JSON.parse(C.text):{};if(v=C.kind==="ok"?O:null,f(O.main,"main"),typeof O.bin=="string")f(O.bin,"bin");else if(O.bin!==null&&typeof O.bin=="object")for(let A of Object.values(O.bin))f(A,"bin");Ps(O.exports,(A,j)=>{f(A,"exports",j)}),typeof O.browser=="string"?f(O.browser,"browser"):Ps(O.browser,A=>{c(A,"browser")});let I=O.scripts;if(I!==null&&typeof I=="object"){let A=I;S=A.start,x=A.prestart,y=A.poststart}}catch{}if(i.length===0)try{Kn(nn.join(n,"index.js")),c("index.js","index.js fallback")}catch{}let $=(O,I)=>{if(typeof O=="string"&&O.trim().length>0){let A=Ts(O,I,"package.json",c,a,!1)==="used";return A&&(o=!0),A?"resolved":"gapped"}return O===void 0||typeof O=="string"?"absent":(a.push({source:I,file:"package.json",detail:`${I} is not a string; no entry file could be read from it`}),"gapped")},N=$(S,"scripts.start"),b=$(x,"scripts.prestart"),m=$(y,"scripts.poststart"),E=N==="resolved"&&b!=="gapped"&&m!=="gapped",_=Ls(n,t,"Procfile",65536);if(_.kind==="refused")h("Procfile",_);else if(_.kind==="ok"){let{entries:O,truncated:I,unnamedLines:A}=cr(_.text);I&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),A>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(A)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let j of O)Ts(j.command,`Procfile:${j.name}`,"Procfile",c,a,E)==="used"&&(o=!0)}let F=i.length===0?sr(n,v):null;if(F!==null){for(let O of ar(n,F).roots)c(O,`framework:${F.name}`);i.length>0&&p.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${F.name}'s directory conventions (recognised via ${F.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}return{entrypoints:i,sources:s,gaps:a,surfaceGaps:l,launchResolved:o,diagnostics:p,framework:F}}function Ls(e,n,t,r){let i;try{i=Kn(nn.join(e,t))}catch{return{kind:"absent"}}if(!i.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=wn(i,r);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(r)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Ts(e,n,t,r,i,s){let a=dr(e);if(a.kind==="delegates")return s?"used":(i.push({source:n,file:t,detail:`\`${De(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(a.kind==="unparsed")return i.push({source:n,file:t,detail:`\`${De(e)}\`: ${a.reason}`}),"gapped";let l=r(a.specifier,n,!0),o=a.alt===void 0?"unresolved":r(a.alt,n,!0);return l==="unresolved"&&o==="unresolved"?(i.push({source:n,file:t,detail:`\`${De(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function kr(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let r=n.slice(0,3).map(i=>i.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${r}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Er(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let r=[...new Set(t.slice(0,3).map(i=>i.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${r}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Ks(e,n){let t=Kn(e),r=t.endsWith(nn.sep)?t:t+nn.sep,i=new Set,s=[],a=[];for(let l of n){let o=Fs(t,r,l,!0);if(o===null||o.length===0){a.push(l);continue}i.has(o)||(i.add(o),s.push(o))}return{entrypoints:s,rejected:a}}import{readdirSync as Js,readFileSync as _r,realpathSync as Nr,statSync as Vn}from"node:fs";import Ve from"node:path";function uc(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let r=t+2;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;let i=e.charCodeAt(r);return i===38||i===42}function Bn(e,n,t){let r=n.maxLines??2e6,i=n.maxLineBytes??16384,s=!1,a=!1,l=0,o=0,c=e.charCodeAt(0)===65279?1:0;for(;c<=e.length;){let u=e.indexOf(`
-`,c),f=u===-1;f&&(u=e.length);let p=u>c&&e.charCodeAt(u-1)===13?u-1:u;if(o+=1,o>r){s=!0;break}if(p-c>i)l+=1;else{let h=c;for(;h<p&&e.charCodeAt(h)===32;)h+=1;let S=h-c,x=p;for(;x>h&&(e.charCodeAt(x-1)===32||e.charCodeAt(x-1)===9);)x-=1;if(h<x&&e.charCodeAt(h)!==35){let y=e.slice(h,x);if(uc(y)){a=!0;break}t(S,y)}}if(f)break;c=u+1}return{truncated:s||l>0,refusedAnchors:a,oversizeLines:l}}function bt(e){let n=e.charCodeAt(0);if(n===34||n===39){let r=e.indexOf(String.fromCharCode(n),1);if(r===-1)return null;let i=r+1;for(;i<e.length&&e.charCodeAt(i)===32;)i+=1;return e.charCodeAt(i)===58?e.slice(0,r+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function _n(e){return e.endsWith(":")}function Ue(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function kt(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,r=t.indexOf("/");if(n){if(r<=0||t.indexOf("/",r+1)!==-1)return!1}else if(r!==-1)return!1;let i=n?[t.slice(0,r),t.slice(r+1)]:[t];for(let s of i){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let a=0;a<s.length;a+=1){let l=s.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function zn(e){return kt(e)?`node_modules/${e}`:""}function Un(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Bs=2e5,zs=64,fc=1024,pc=5,mc=[1,2,3];function hc(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let r=e.slice(t+n.length);if(r==="")return null;let i=r.split("/");return i[0]?.startsWith("@")?i.length>=2?`${i[0]}/${i[1]}`:null:i[0]??null}function Us(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let r=t.indexOf("@",1);if(r>0){let i=t.slice(0,r),s=t.slice(r+1);if(i.length>0&&s.length>0)return[{name:i,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function Nn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Vs(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function qs(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Hs(e,n,t,r,i=!1){let s=JSON.stringify([n,t,r]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:r,dev:i})}}function gc(e,n){for(let[t,r]of Object.entries(e)){if(t==="")continue;if(!qs(n))return;let i=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=Nn(r);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let a=s.name,l=typeof a=="string"&&a!==""?a:hc(t),o=s.version;if(l===null||typeof o!="string"){i&&(n.unread+=1);continue}let c=s.dev===!0||s.devOptional===!0;for(let u of Us(l,o))Hs(n,u.name,u.version,t,c)}}function Ws(e,n,t){let r=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],i=!1;for(let s=0;s<r.length;s+=1){let a=r[s];if(a===void 0)break;for(let[l,o]of Object.entries(a.deps)){if(!qs(n))return{depthCapped:i};if(l===""){n.unread+=1;continue}let c=Nn(o);if(c===null){n.unread+=1;continue}let u=a.pathSafe&&kt(l),f=u?`${a.prefix}node_modules/${l}`:"",p=u&&f.length<=fc,h=p?f:"",S=c.version,x=c.dev===!0||a.dev;if(c.link!==!0&&typeof S=="string"&&S!=="")for(let v of Us(l,S))Hs(n,v.name,v.version,h,x);else n.unread+=1;let y=Nn(c.dependencies);if(y!==null){if(a.depth+1>t){i=!0;continue}r.push({deps:y,prefix:p?`${h}/`:a.prefix,depth:a.depth+1,pathSafe:p,dev:x})}}}return{depthCapped:i}}function yc(e,n,t){let r=Vs(n.maxEntries),{depthCapped:i}=Ws(e,r,t),s=[],a=new Set(n.deps.map(c=>JSON.stringify([c.name,c.version]))),l=new Set,o=[];for(let c of r.deps){if(c.version.includes(":"))continue;let u=JSON.stringify([c.name,c.version]);a.has(u)||l.has(u)||(l.add(u),o.length<pc&&o.push(Un(c.name,c.version)))}if(l.size>0){let c=l.size-o.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${o.join(", ")}${c>0?`, and ${String(c)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(r.capped||i)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function Et(e,n={}){let t=[],r;try{r=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let i=Nn(r);if(i===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=i.lockfileVersion,a=typeof s=="number"&&Number.isInteger(s)?s:null,l=typeof s=="number"?String(s):"?",o=Nn(i.packages),c=Nn(i.dependencies);if(o===null&&c===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!mc.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??zs,f=Vs(n.maxEntries??Bs),p=!1;return o!==null?(gc(o,f),c!==null&&t.push(...yc(c,f,u))):c!==null&&(p=Ws(c,f,u).depthCapped),f.capped&&t.push(`lockfile exceeds ${String(f.maxEntries)} entries; truncated`),p&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),f.unread>0&&t.push(`package-lock.json has ${String(f.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:f.deps,diagnostics:t,truncated:f.capped||p}}var xc=["workspace:","link:","portal:","file:","exec:"];function Sc(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function bc(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let r=n.slice(0,t),i=n.slice(t+1);if(r.length===0)return[];for(let l of xc)if(i.startsWith(l))return[];if(!i.startsWith("npm:"))return[r];let s=i.slice(4),a=s.indexOf("@",1);if(a>0){let l=s.slice(0,a);return l.length>0?[l]:[r]}return s.length===0||Sc(s)?[r]:[r,s]}function kc(e){if(_n(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let r=e.charCodeAt(t);if(r===34||r===39){n===0?n=r:n===r&&(n=0);continue}if(n===0&&r===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function Ec(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let r of n.split(",")){let i=r.trim();i.length>0&&t.push(i)}return t}function wc(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let r=t.length;for(;r<n.length&&r<t.length+3;){let s=n.charCodeAt(r);if(s<48||s>57)break;r+=1}let i=n.slice(t.length,r);return i.length>0?i:null}function Gs(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Ue(e.slice(8).trim());return t.length>0?t:null}function wr(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,a=!1,l=null,o=!1,c=[],u=!1,f=-1,p=!1,h=0,S=()=>{c.length>0&&!u&&(h+=1)},x=Bn(e,n,($,N)=>{if($===0){S(),c=[],u=!1,f=-1,o=!1;let m=kc(N);if(m===null)return;let E=Ue(m.trim());if(E==="__metadata"){a=!0,o=_n(N);return}for(let _ of Ec(E))c.push(...bc(_));return}if(o){if($===2&&l===null){let m=Gs(N);m!==null&&(l=m)}return}if(c.length===0||(f===-1&&(f=$),$!==f||u))return;let b=Gs(N);if(b!==null){u=!0;for(let m of c){let E=JSON.stringify([m,b]);if(!i.has(E)){if(r.length>=s){p=!0;return}i.add(E),r.push({name:m,version:b,lockKey:zn(m),dev:!1})}}}});S();let y=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(x.refusedAnchors)return{deps:[],diagnostics:[`${y} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};x.oversizeLines>0&&t.push(`${y} has ${String(x.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),p&&t.push(`${y} exceeds ${String(s)} entries; truncated`);let v=l??wc(e),C=v===null?null:Number(v.split(".")[0]);return v!==null&&(C===null||!Number.isInteger(C)||C<1||C>8)&&t.push(`${y} declares unsupported lockfileVersion ${v} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${y} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:r,diagnostics:t,truncated:x.truncated||p}}function vr(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.indexOf("_");return r!==-1&&(n=n.slice(0,r)),n.trim()}function Ir(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Xs(e){let n=Ue(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.charCodeAt(0)===47;if(r&&(n=n.slice(1)),n.length===0)return null;if(!r&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),f=n.indexOf("@",1);u>0&&(f===-1||u<f)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let i=n.charCodeAt(0)===64,s=i?n.indexOf("/"):-1;if(i&&s<=0)return null;let a=i?s+1:0,l=-1;for(let u=a;u<n.length;u+=1){let f=n.charCodeAt(u);if(f===47||f===64){l=u;break}}if(l<=a)return null;let o=n.slice(0,l),c=vr(n.slice(l+1));return Ir(c)?{name:o,version:c}:null}var vc=new Set(["packages","snapshots","importers"]),Ic=new Set([5,6,7,8,9]);function Ac(e){let n=Ue(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function vt(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Ue(e.slice(0,n).trim()),value:Ue(t)}}function Ar(e,n={}){let t=[],r=[],i=new Set,s=n.maxEntries??2e5,a="",l=null,o=!1,c=0,u=[],f=(h,S)=>{let x=JSON.stringify([h,S]);if(!i.has(x)){if(r.length>=s){o=!0;return}i.add(x),r.push({name:h,version:S,lockKey:zn(h),dev:!1})}},p=Bn(e,n,(h,S)=>{if(h===0){let x=bt(S);if(a=x===null?"":Ue(x.trim()),l=null,a==="lockfileVersion"){let y=vt(S),v=y===null?null:Ac(y.value);y!==null&&(v===null||!Ic.has(v))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${y.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if(vc.has(a)&&!_n(S)){let y=vt(S)?.value.trim()??"";y!=="{}"&&y!=="[]"&&(c+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(h!==2)return;let x=bt(S),y=x===null?null:Xs(x);if(y===null){c+=1;return}f(y.name,y.version);return}if(a==="importers"){if(h===6){let x=vt(S);if(x===null){l=S.endsWith(":")?Ue(S.slice(0,-1).trim()):null;return}l=null;let y=vr(x.value);Ir(y)&&f(x.key,y);return}if(h===8&&l!==null){let x=vt(S);if(x===null||x.key!=="version")return;let y=vr(x.value);Ir(y)&&f(l,y)}}});return p.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),p.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(p.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),o&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),c>0&&t.push(`pnpm-lock.yaml has ${String(c)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:r,diagnostics:t,truncated:p.truncated||o})}var _c=128*1024*1024,Nc=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>Et(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>Et(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>wr(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Ar(e,n===void 0?{}:{maxEntries:n})}],Cc=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Cr(e,n){let t;try{t=Nr(Ve.join(e,n))}catch{return null}let r=e.endsWith(Ve.sep)?e:e+Ve.sep;return t.startsWith(r)?t:null}function Ys(e,n){let t=Ve.join(e,"package.json"),r;try{r=Nr(t)}catch{return null}if(!r.startsWith(n+Ve.sep))return null;try{if(!Vn(r).isFile())return null;let i=JSON.parse(_r(r,"utf8"));return typeof i.name!="string"||typeof i.version!="string"?null:{name:i.name,version:i.version}}catch{return null}}function Zs(e,n){try{return Vn(Ve.join(e,n)),!0}catch{return!1}}function Oc(e,n){if(Zs(e,"pnpm-workspace.yaml"))return!0;let t=Cr(e,"package.json");if(t===null)return Zs(e,"package.json");let r;try{let a=Vn(t);if(!a.isFile()||a.size>n)return!0;r=_r(t,"utf8")}catch{return!0}let i;try{i=JSON.parse(r)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=i[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let s=i.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function Qs(e,n){let t=Ve.join(e,"node_modules"),r=[],i;try{i=Js(t,{withFileTypes:!0})}catch{return r}for(let s of i){let a=s.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let o;try{o=Js(Ve.join(t,a),{withFileTypes:!0})}catch{continue}for(let c of o){let u=Ys(Ve.join(t,a,c.name),n);u!==null&&r.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${c.name}`,linked:c.isSymbolicLink()||s.isSymbolicLink()})}continue}let l=Ys(Ve.join(t,a),n);l!==null&&r.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:s.isSymbolicLink()})}return r}var Rc=5;function $c(e,n,t){let r=Cr(e,n);if(r===null){try{Vn(Ve.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let i;try{i=Vn(r)}catch{return null}if(!i.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(i.size>t)return{gap:`${n} is ${String(i.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:_r(r,"utf8")}}catch{return{gap:`${n} could not be read`}}}function eo(e,n){let t=Nr(e),r=[],i=[],s=n?.maxLockfileBytes??_c,a=[],l=new Set,o=[],c=Oc(t,s),u=null,f=!1,p=(S,x,y)=>{i.push({kind:S,detail:x,blindsAnalysis:y}),r.push(x)};for(let S of Nc){let x=$c(t,S.file,s);if(x===null)continue;if("gap"in x){p("lockfile-unreadable",x.gap,!1);continue}let y=S.parse(x.text,n?.maxLockfileEntries);if(y.truncated&&(f=!0),y.deps.length===0){if(y.diagnostics.length>0||c){let v=y.diagnostics.length>0?y.diagnostics.join("; "):"no entries found";p("lockfile-unparsed",`${S.file} yielded NO dependencies (${v}); its transitive dependency set was not enumerated`,!1)}continue}y.diagnostics.length>0&&p("lockfile-partial",`${S.file} was only partly enumerated (${y.diagnostics.join("; ")})`,!1),u===null&&(u=S.file),o.includes(S.source)||o.push(S.source);for(let v of y.deps){let C=JSON.stringify([v.name,v.version,v.lockKey]);l.has(C)||(l.add(C),a.push(v))}}for(let S of Cc)if(Cr(t,S)!==null){p("yarn-pnp",`${S} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let S=o.length===1?o[0]??"none":"multi-lockfile";o.length>1&&r.push(`multiple lockfiles present (${o.join(", ")}); enumerated the UNION of all of them`);let x=new Set(a.map(C=>JSON.stringify([C.name,C.version]))),y=new Set,v=[];for(let C of Qs(t,t)){let $=JSON.stringify([C.name,C.version,C.lockKey]);l.has($)||(l.add($),a.push({name:C.name,version:C.version,lockKey:C.lockKey,dev:C.dev}));let N=JSON.stringify([C.name,C.version]);C.linked||x.has(N)||y.has(N)||(y.add(N),v.length<Rc&&v.push(Un(C.name,C.version)))}if(y.size>0){let C=y.size-v.length;p("lockfile-skew",`node_modules holds ${String(y.size)} package(s) at a (name, version) no lockfile lists (${v.join(", ")}${C>0?`, and ${String(C)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:S,lockfilePath:u,diagnostics:r,truncated:f,gaps:i}}let h=Qs(t,t);return h.length>0?(p("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(S=>({name:S.name,version:S.version,lockKey:S.lockKey,dev:!1})),source:"node-modules",lockfilePath:null,diagnostics:r,truncated:f,gaps:i}):(c&&p("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:r,truncated:f,gaps:i})}import{readdirSync as Mc,readFileSync as Pc}from"node:fs";import Lc from"node:path";var Tc=new Set(["summarized","crashed","over-cap"]),Dc=new Set(["function","method","ctor"]);function ie(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function Or(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Fc(e,n){Or(e)||ie(n,"edge is not an object");let{entryPath:t,entryExport:r,entryContainer:i,hops:s}=e;(typeof t!="string"||typeof r!="string")&&ie(n,"edge entry fields must be strings"),i!==null&&typeof i!="string"&&ie(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&ie(n,"hops must be a non-negative integer");let a=e.target;if(Or(a)||ie(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:o,symbolKind:c}=a;return typeof l!="string"&&ie(n,"symbol target exportName"),o!==null&&typeof o!="string"&&ie(n,"symbol target container"),(typeof c!="string"||!Dc.has(c))&&ie(n,`symbol target kind ${JSON.stringify(c)}`),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"symbol",exportName:l,container:o,symbolKind:c},hops:s}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:o,calleeExport:c}=a;return(typeof l!="string"||l.length===0)&&ie(n,"dep target calleePackage"),o!==null&&typeof o!="string"&&ie(n,"dep target calleeSubpath"),(typeof c!="string"||c.length===0)&&ie(n,"dep target calleeExport"),{entryPath:t,entryExport:r,entryContainer:i,target:{kind:"dep",calleePackage:l,calleeSubpath:o,calleeExport:c},hops:s}}ie(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function jc(e,n){Or(e)||ie(n,"root is not an object");let{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&ie(n,"packageName"),typeof r!="string"&&ie(n,"analyzedVersion"),i!=="jelly"&&ie(n,`tool ${JSON.stringify(i)} (only 'jelly' exists)`),typeof s!="string"&&ie(n,"toolVersion"),typeof a!="number"&&ie(n,"maxIndirections"),(typeof l!="string"||!Tc.has(l))&&ie(n,`status ${JSON.stringify(l)} not in the enum`);let o=e.edges;return Array.isArray(o)||ie(n,"edges is not an array"),l!=="summarized"&&o.length>0&&ie(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:r,tool:i,toolVersion:s,maxIndirections:a,status:l,edges:o.map(c=>Fc(c,n))}}function no(e){let n=new Map,t=Mc(e).filter(r=>r.endsWith(".summary.json"));for(let r of t){let i=Lc.join(e,r),s;try{s=JSON.parse(Pc(i,"utf8"))}catch(o){ie(r,`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}let a=jc(s,r),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{readFileSync as Kc,statSync as Bc}from"node:fs";var $r=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,It=/^[A-Za-z0-9_$.-]{1,128}$/u,to=64,ro=1024*1024,io=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,so=/^[A-Za-z0-9@_.-]{1,128}$/u;function ae(e){throw new Error(`model claims rejected: ${e}`)}function Rr(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function zc(e,n){Rr(e)||ae(`${n}: edge is not an object`);let{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&ae(`${n}: edge kind`),(typeof r!="string"||!It.test(r))&&ae(`${n}: anchorExport ${JSON.stringify(r)}`),i!==null&&(typeof i!="string"||!It.test(i))&&ae(`${n}: anchorContainer`),(typeof s!="string"||!$r.test(s))&&ae(`${n}: calleePackage ${JSON.stringify(s)}`),a!==null&&(typeof a!="string"||!It.test(a))&&ae(`${n}: calleeContainer`),(typeof l!="string"||!It.test(l))&&ae(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:r,anchorContainer:i,calleePackage:s,calleeContainer:a,calleeExport:l}}function oo(e){let n=Bc(e).size;n>ro&&ae(`file is ${String(n)} bytes, over the ${String(ro)} cap`);let t;try{t=JSON.parse(Kc(e,"utf8"))}catch(i){ae(`unparseable JSON: ${i instanceof Error?i.message:String(i)}`)}Array.isArray(t)||ae("root is not an array"),t.length>to&&ae(`${String(t.length)} claims over cap ${String(to)}`);let r=[];for(let i of t){Rr(i)||ae("claim is not an object");let{packageName:s,modelId:a,range:l,edges:o}=i;(typeof s!="string"||!$r.test(s))&&ae("packageName"),(typeof a!="string"||!so.test(a))&&ae("modelId (identifier charset, 1-128 chars)"),r.some(u=>u.model.modelId===a)&&ae(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!Rr(l)||typeof l.introduced!="string")&&ae(`${a}: range`),io.test(l.introduced)||ae(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let c=l.fixedBefore;c!==null&&typeof c!="string"&&ae(`${a}: fixedBefore`),typeof c=="string"&&!io.test(c)&&ae(`${a}: range.fixedBefore ${JSON.stringify(c)} is not an exact x.y.z triple`),Array.isArray(o)||ae(`${a}: edges`),o.length>64&&ae(`${a}: ${String(o.length)} edges over cap ${String(64)}`),r.push({model:{packageName:s,modelId:a,edges:o.map(u=>zc(u,a))},introduced:l.introduced,fixedBefore:c})}return r}var Uc=["in-app-purchase@1-v1"];function Mr(e,n,t){let r=[],i=[],s=[],a=(l,o,c,u)=>{i.push(c),s.push({modelId:u??l.model.modelId,status:o,reason:c,edgeCount:l.model.edges.length})};for(let l of e){if(!$r.test(l.model.packageName)||!so.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Uc.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let o=n(l.model.packageName);if(o===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let c;try{c=fn(o,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${o} not an exact triple \u2014 inert (never guessed)`);continue}if(!c){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${o} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}r.push(l.model),s.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:r,notes:i,dispositions:s}}var Vc=4,qc={additiveForms:!0,namelessExports:!0},Hc=new Set(["dep-opaque","dynamic-load","dispatch"]),Wc={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Lr(e,n,t){return e.tier==="unknown"&&Wc[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&Hc.has(e.unknownKind)&&n!==null&&n.verified}var Gc=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),qe=class extends Error{},Tr="cupel/coverage-gap",Xc={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function Hn(e,n,t){return{advisoryId:e,packageName:n,introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function fo(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function po(e,n,t){let r=new Map(e.modules.map(a=>[a.path,a.id])),i=e.modules[0]?.id;if(i===void 0)return[];let s=n.map(a=>({source:r.get(a.path)??i,cause:Xc[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));return t&&s.push({source:i,reach:{kind:"unbounded"},cause:"resolution-divergence"}),s}function Pr(e,n,t,r,i){let s=t.filter(a=>a.exportName!==null&&(r===1||i||a.verified!==1));return s.length>0?s.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function Jc(e){let n;try{n=_t(e)}catch{return!0}try{if(At(Ze.join(n,"pnpm-workspace.yaml")).isFile())return!0}catch{}try{let s=JSON.parse(ho(Ze.join(n,"package.json"),"utf8"))?.workspaces;if(Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null)return!0}catch{}let t=3,r=(i,s)=>{if(s>t)return!1;let a;try{a=mo(i)}catch{return!1}for(let l of a){if(l==="node_modules"||l.startsWith("."))continue;let o=Ze.join(i,l),c;try{c=At(o)}catch{continue}if(c.isDirectory()){try{if(At(Ze.join(o,"package.json")).isFile())return!0}catch{}if(r(o,s+1))return!0}}return!1};return r(n,1)}function Yc(e,n,t){let r=[];if(t&&r.push("nested-app-root"),n==="")return[...r,"manifest-unreadable"];let i;try{if(i=_t(Ze.resolve(e,n)),!i.startsWith(_t(e)+Ze.sep))return[...r,"manifest-unreadable"]}catch{return[...r,"manifest-unreadable"]}let s;try{let u=Ze.join(i,"package.json");if(!At(u).isFile())return[...r,"manifest-unreadable"];s=ho(u,"utf8")}catch{return[...r,"manifest-unreadable"]}let a;try{a=JSON.parse(s)}catch{return[...r,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...r,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&r.push("bin");let o=["preinstall","install","postinstall","prepare","prepublish"],c=l.scripts;if(typeof c=="object"&&c!==null){let u=c;o.some(f=>typeof u[f]=="string")&&r.push("install-script")}return(l.gypfile===!0||Zc(i))&&r.push("native-artifact"),r}function Zc(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=Ze.join(e,n),r;try{r=mo(t)}catch{continue}if(r.some(i=>i.endsWith(".node")))return!0}return!1}function Qc(e){let n=new Map;for(let t of e){let r=n.get(t.advisory.id);r===void 0?n.set(t.advisory.id,[t]):r.push(t)}return n}function eu(e,n,t,r,i,s,a){let{finding:l}=qn(e,n,{name:t.name,version:t.version,devOnly:t.dev,outOfGraphExecution:a(t.name)},Hn(r.advisory.id,t.name,r.affected),null,i,s);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function qn(e,n,t,r,i,s,a){let l=Ut({graph:e,installed:t,range:r,symbol:i,coverage:null,incompleteness:s,analysisAborted:a});if(n!==null&&i!==null&&Lr(l,i,"base")){let o=$n(e,n.modulesById,n.reachMods,i,n.records);if(o!==null)return{finding:l,hit:o}}return{finding:l,hit:null}}function nu(e,n){let t=new Set,r=[];for(let i of e.packages)for(let{advisory:s,affected:a}of n.advisoriesForPackage("npm",i.name)){let l=Hn(s.id,i.name,a),o;try{o=fn(i.version,l)}catch{continue}if(o)for(let c of n.symbolsForAffected(a.id)){if(c.verified!==1||c.symbolKind!=="method"&&c.symbolKind!=="ctor"||c.container===null||c.sourcePath===null)continue;let u=`${i.lockKey}\0${c.container}\0${c.sourcePath}`;t.has(u)||(t.add(u),r.push({packageName:i.name,packageRootRel:i.lockKey,container:c.container,sourcePath:c.sourcePath}))}}return r.sort((i,s)=>`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),r.slice(0,gt)}function tu(e,n,t){let r=new Map(e.functions.map(l=>[l.id,l])),i=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let o=s.get(l.callSiteId);if(o===void 0)continue;let c=r.get(o.enclosingFunctionId);if(c===void 0||!t.has(c.moduleId))continue;let u=n.get(c.moduleId);if(u===void 0)continue;let f=r.get(l.calleeFunctionId);if(f===void 0||f.name===void 0)continue;let p=n.get(f.moduleId);p!==void 0&&p.packageName!==u.packageName&&a.push({packageName:p.packageName,exportName:f.name,container:f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:c.id})}return a}function ru(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),r=new Map(e.functions.map(u=>[u.id,u])),i=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&i.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let f=s.get(u.exportId);if(f===void 0||!n.has(f.moduleId))continue;let p=r.get(u.target.functionId);p===void 0||t.get(p.moduleId)?.externalSurface===!0||i.add(p.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let f=a.get(u.callSiteId);if(f===void 0)continue;let p=l.get(f);p===void 0?l.set(f,[u.calleeFunctionId]):p.push(u.calleeFunctionId)}let o=new Set(i),c=[...i];for(;c.length>0;){let u=c.pop();if(u!==void 0)for(let f of l.get(u)??[])o.has(f)||(o.add(f),c.push(f))}return o}function iu(e,n,t,r){for(let i of n){if(i.modelId!==e.modelId||i.anchor.packageName!==e.anchorPackage||i.anchor.exportName!==e.entryExport)continue;let s=t.filter(l=>l.packageName===i.anchor.packageName&&l.exportName===i.anchor.exportName&&l.container===i.anchor.container),a=s.find(l=>l.resolution==="resolved")??s[0];if(a!==void 0)return r.has(a.callerFunctionId)}return null}function su(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let r=new Set(t),i=s=>r.has(s)||r.has($e[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&i(s.unknownKind)||s.modelPromotedFromKind!==void 0&&i(s.modelPromotedFromKind))}function Dr(e){let n=_t(e.dir),t=e.reader??Ht(e.shardPath),r=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(pn))throw new qe(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${pn})`);let i=null;if(e.summaryShadow!==void 0)try{i=no(e.summaryShadow)}catch(B){throw new qe(`--summary-shadow facts dir rejected: ${B instanceof Error?B.message:String(B)}`)}let s=null;if(e.modelShadow!==void 0)try{s=oo(e.modelShadow.claimsPath)}catch(B){throw new qe(`--model-shadow claims rejected: ${B instanceof Error?B.message:String(B)}`)}let a=eo(n);if(a.truncated)throw new qe(`the dependency enumeration hit a hard cap and is incomplete (${a.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`);let l=e.entry??[],o=l.length>0?Ks(n,l):{entrypoints:[],rejected:[]},c=o.rejected,u=js(n),f=[...new Set([...u.entrypoints,...o.entrypoints])],p=[...u.sources];for(let B of o.entrypoints)u.entrypoints.includes(B)||p.push({source:"--entry",specifier:B,entrypoint:B,launch:!1});let h=nu(a,t),S=e.bindingForms??qc,x=e.callablePackageResolver===!0,y=e.tsconfigPaths===!0,v=Jc(n),C=new Map(a.packages.map(B=>[B.name,Yc(n,B.lockKey,v)])),$=B=>C.get(B)??["manifest-unreadable"],N=br({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:S,callablePackageResolver:x,tsconfigPaths:y}),b=N.graph,m=zt(b),E=[...u.diagnostics,...kr(u),...Er(u,f.length),...N.diagnostics],_=fo(f.length,b),F=a.gaps.some(B=>B.blindsAnalysis),O=po(b,E,F),I=t.allModels?.()??[],A=Mr(I.map(B=>({model:{packageName:B.packageName,modelId:B.modelId,edges:B.edges},introduced:B.introduced,fixedBefore:B.fixedBefore})),B=>a.packages.find(ke=>ke.name===B)?.version),j=A.models.length>0?jn(b,A.models).delta:null,z=j!==null?{records:j.records,reachMods:rn(b),modulesById:new Map(b.modules.map(B=>[B.id,B]))}:null,M=[],J=new Map,H=Gc(),K=[],V=[];for(let B of a.packages)for(let[,ke]of Qc(t.advisoriesForPackage("npm",B.name))){let fe=ke[0];if(fe!==void 0){let w=J.get(fe.advisory.id),R=ke.map(P=>P.affected);w===void 0?J.set(fe.advisory.id,{advisory:fe.advisory,ranges:R}):w.ranges.push(...R)}let de=ke.filter(w=>eu(b,z,B,w,O,_,$)),je=de.length>0?de:ke.slice(0,1),k=de.length===0;for(let{advisory:w,affected:R}of je){let P=Hn(w.id,B.name,R),Y=w.cveId??w.id,re=k?[]:t.symbolsForAffected(R.id),ge=re.filter(Z=>Z.exportName===null),Oe=Pr(w.id,B.name,re,R.surfaceComplete,r),ye=qn(b,z,{name:B.name,version:B.version,devOnly:B.dev,outOfGraphExecution:$(B.name)},P,null,O,_).finding;if(ye.decidedAtStage==="presence"||ye.decidedAtStage==="version-match"){H[ye.tier]+=1,M.push({...ye,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:P.surfaceComplete,advisoryId:w.id,displayId:Y,packageName:B.name,version:B.version,symbolName:null,symbolPath:null,severity:w.severity,packageLocation:a.lockfilePath});continue}for(let Z of Oe){let{finding:xe,hit:he}=qn(b,z,{name:B.name,version:B.version,devOnly:B.dev,outOfGraphExecution:$(B.name)},P,Z,O,_),Le=xe,Re,q;he!==null&&Z!==null&&(Re=he.modelId,q=xe.unknownKind,Le={basis:void 0,tier:he.tier,decidedAtStage:xe.decidedAtStage,reason:`boundary model ${he.modelId}: ${he.anchorPackage}.${he.entryExport} reaches ${Z.exportName} [${he.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:nt(Z),path:void 0,unresolvedSites:xe.unresolvedSites,unresolvedEvidence:xe.unresolvedEvidence}),H[Le.tier]+=1;let L={...Le,modelId:Re,modelPromotedFromKind:q,surfaceComplete:P.surfaceComplete,advisoryId:w.id,displayId:Y,packageName:B.name,version:B.version,symbolName:Z?.exportName??null,symbolPath:Z?.sourcePath||null,severity:w.severity,packageLocation:a.lockfilePath};M.push(L);let G=new Set(["dep-opaque","dynamic-load","dispatch"]);i!==null&&L.tier==="unknown"&&L.decidedAtStage==="symbol-reachable"&&L.unknownKind!==void 0&&G.has(L.unknownKind)&&Z!==null&&K.push({finding:L,symbol:Z}),s!==null&&L.tier==="unknown"&&Z!==null&&V.push({finding:L,symbol:Z})}for(let Z of ge)H.unknown+=1,M.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:P.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${Y} carries a ${Z.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:w.id,displayId:Y,packageName:B.name,version:B.version,symbolName:null,symbolPath:null,severity:w.severity,packageLocation:a.lockfilePath})}}for(let B of a.gaps)H.unknown+=1,M.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:B.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Tr,displayId:Tr,packageName:B.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:a.lockfilePath});let D=H["reachable-high"]+H["reachable-medium"],W=e.failOnReachable===!0&&D>0,se=su(M,H.unknown,e.failOnUnknown),Fe=e.requireCompleteDenial===!0&&M.some(B=>B.tier==="not-reachable"&&B.basis==="loader-assumption"),Ie=W||se||Fe?2:0,be;if(i!==null){let B=rn(b),ke=new Map(b.modules.map(de=>[de.id,de])),fe=[];for(let{finding:de,symbol:je}of K){let k=Bt(b,ke,B,je,i,Vc);fe.push({advisoryId:de.advisoryId,packageName:de.packageName,symbolName:de.symbolName,unknownKind:de.unknownKind??null,wouldPromote:k!==null,...k!==null?{anchorPackage:k.anchorPackage,entryExport:k.entryExport,viaPackages:k.viaPackages,totalHops:k.totalHops}:{}})}be={records:fe}}let dn;if(s!==null&&e.modelShadow!==void 0){let B=e.modelShadow.widened===!0?"widened":"base",ke=new Map(a.packages.map(L=>[L.name,L.version])),{models:fe,notes:de,dispositions:je}=Mr(s,L=>ke.get(L),{shadowConsultDenylisted:!0}),{delta:k}=jn(b,fe),w=rn(b),R=new Map(b.modules.map(L=>[L.id,L])),P=tu(b,R,w),Y=ru(b),re=k.records.some(L=>P.some(G=>G.packageName===L.anchor.packageName&&G.exportName===L.anchor.exportName&&G.container===L.anchor.container)),ge=[],Oe=Date.now();for(let{finding:L,symbol:G}of V){let Ke=k.records,pe=Lr(L,G,B),Q=pe?$n(b,R,w,G,Ke):null,Ae=k.records.filter(Ee=>Ee.callee.packageName===G.packageName&&Ee.callee.exportName===G.exportName&&Ee.callee.container===G.container||Ee.callee.packageName===G.packageName&&Ee.callee.realFunctionId!==null);ge.push({advisoryId:L.advisoryId,packageName:L.packageName,symbolName:L.symbolName,unknownKind:L.unknownKind??null,decidedAtStage:L.decidedAtStage,consultSurface:B,noHitReason:Q!==null?null:pe?re?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Q!==null?iu(Q,Ke,P,Y):null,verdictBefore:L.tier,verdictAfter:Q!==null?"reachable-low":L.tier,wouldPromote:Q!==null,...Q!==null?{modelId:Q.modelId,anchorPackage:Q.anchorPackage,entryExport:Q.entryExport,pathLabels:Q.pathLabels,calleeBinding:Ae.find(Ee=>Ee.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:pe?Ae.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${Ae[0]?.anchor.packageName??"?"}#${Ae[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let ye=Date.now()-Oe,Z=je.map(L=>{if(L.status!=="active")return{modelId:L.modelId,state:L.status,reason:L.reason,edgesLowered:0,edgesReferenceGated:0};let G=k.records.filter(pe=>pe.modelId===L.modelId).length;if(G>0)return{modelId:L.modelId,state:"lowered",reason:null,edgesLowered:G,edgesReferenceGated:L.edgeCount-G};let Ke=k.notes.find(pe=>pe.startsWith(`model ${L.modelId}:`)||pe.startsWith(`model-edge ${L.modelId}:`));return{modelId:L.modelId,state:"refused",reason:Ke??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:L.edgeCount}}),xe=ge.filter(L=>L.wouldPromote).length,he=H.unknown-xe,Le=H["reachable-high"]+H["reachable-medium"],Re=L=>({none:0,"fail-on-reachable":Le>0?2:0,"fail-on-unknown":L>0?2:0,both:Le>0||L>0?2:0});dn={records:ge,notes:[...de,...k.notes],laneStates:Z,exitCodes:{baseline:Re(H.unknown),withModels:Re(he)},overlayWallMs:ye},lo(Ze.dirname(e.modelShadow.outPath),{recursive:!0});let q=`${e.modelShadow.outPath}.tmp-${ao(8).toString("hex")}`;uo(q,`${JSON.stringify(dn,null,2)}
-`,{encoding:"utf8",flag:"wx"}),co(q,e.modelShadow.outPath)}let cn;if(e.bindingShadow!==void 0){let B=Date.now(),ke=q=>A.models.length>0?{records:jn(q,A.models).delta.records,reachMods:rn(q),modulesById:new Map(q.modules.map(L=>[L.id,L]))}:null,fe=(q,L,G,Ke)=>{let pe=[];for(let Q of a.packages)for(let{advisory:Ae,affected:Ee}of t.advisoriesForPackage("npm",Q.name)){let En=Hn(Ae.id,Q.name,Ee),la=Pr(Ae.id,Q.name,t.symbolsForAffected(Ee.id),Ee.surfaceComplete,r);for(let ii of la){let{finding:si,hit:jt}=qn(q,Ke,{name:Q.name,version:Q.version,devOnly:Q.dev,outOfGraphExecution:$(Q.name)},En,ii,L,G);pe.push({advisoryId:Ae.id,packageName:Q.name,symbolName:ii?.exportName??null,tier:jt!==null?jt.tier:si.tier,unknownKind:jt!==null?null:si.unknownKind??null})}}return pe},de=q=>{let L=br({appRoot:n,entrypoints:f,depClassAnchors:h,bindingForms:q,callablePackageResolver:x,tsconfigPaths:y}),G=[...u.diagnostics,...kr(u),...Er(u,f.length),...L.diagnostics];return{graph:L.graph,inc:po(L.graph,G,F),aborted:fo(f.length,L.graph),live:ke(L.graph),applicability:L.bindingApplicability}},je=q=>{let L=de(q);return fe(L.graph,L.inc,L.aborted,L.live)},k=de({}),w=fe(k.graph,k.inc,k.aborted,k.live),R=fe(b,O,_,z);if(R.length!==w.length)throw new qe("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let P=(q,L)=>L.tier!==q.tier||L.unknownKind!==q.unknownKind,Y=w.some((q,L)=>{let G=R[L];return G!==void 0&&P(q,G)}),re=Y?je({additiveForms:!0}):null,ge=Y?je({namelessExports:!0}):null,Oe=0,ye=w.map((q,L)=>{let G=R[L];if(G===void 0||G.advisoryId!==q.advisoryId||G.packageName!==q.packageName||G.symbolName!==q.symbolName)throw new qe("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Ke={advisoryId:q.advisoryId,packageName:q.packageName,symbolName:q.symbolName,unknownKind:q.unknownKind,verdictBefore:q.tier,verdictAfter:G.tier,wouldPromote:G.tier!==q.tier&&(G.tier==="reachable-high"||G.tier==="reachable-medium"||G.tier==="reachable-low")};if(!P(q,G)||re===null||ge===null)return Ke;Oe+=1;let pe=re[L],Q=ge[L],Ae=pe!==void 0&&P(q,pe),Ee=Q!==void 0&&P(q,Q);return{...Ke,attributedArm:Ae&&!Ee?"additiveForms":Ee&&!Ae?"namelessExports":"both",...pe!==void 0?{verdictArmA:pe.tier}:{},...Q!==void 0?{verdictArmB:Q.tier}:{}}}),Z={...H};w.forEach((q,L)=>{let G=R[L];G!==void 0&&G.tier!==q.tier&&(Z[G.tier]-=1,Z[q.tier]+=1)});let xe=(q,L)=>({none:0,"fail-on-reachable":q>0?2:0,"fail-on-unknown":L>0?2:0,both:q>0||L>0?2:0}),he;if(A.models.length>0&&z!==null){he=[];for(let q of a.packages)for(let{advisory:L,affected:G}of t.advisoriesForPackage("npm",q.name)){let Ke=Hn(L.id,q.name,G),pe=Pr(L.id,q.name,t.symbolsForAffected(G.id),G.surfaceComplete,r);for(let Q of pe){if(Q===null||!Q.verified)continue;let Ae=qn(k.graph,k.live,{name:q.name,version:q.version,devOnly:q.dev,outOfGraphExecution:$(q.name)},Ke,Q,k.inc,k.aborted);if(!(Ae.hit===null&&Lr(Ae.finding,Q,"base")))continue;let En=$n(b,z.modulesById,z.reachMods,Q,z.records);he.push({advisoryId:L.id,packageName:q.name,symbolName:Q.exportName,modelWouldPromote:En!==null,...En!==null?{modelId:En.modelId}:{},anchorCleared:En!==null})}}}let Le=M.some(q=>q.modelId!==void 0);cn={records:ye,deltas:Oe,exitCodes:{baseline:xe(Z["reachable-high"]+Z["reachable-medium"],Z.unknown+(Le?1:0)),withBindingForms:xe(H["reachable-high"]+H["reachable-medium"],H.unknown+(Le?1:0))},dualRunWallMs:Date.now()-B,...N.bindingApplicability!==void 0?{applicability:N.bindingApplicability}:{},...he!==void 0?{modelProbe:he}:{}},lo(Ze.dirname(e.bindingShadow.outPath),{recursive:!0});let Re=`${e.bindingShadow.outPath}.tmp-${ao(8).toString("hex")}`;uo(Re,`${JSON.stringify(cn,null,2)}
-`,{encoding:"utf8",flag:"wx"}),co(Re,e.bindingShadow.outPath)}let un=I.length>0||A.notes.length>0?{active:A.models.length,stored:I.length,promoted:M.filter(B=>B.modelId!==void 0).length,notes:[...A.notes,...j!==null?j.notes:[]]}:void 0;return{...be!==void 0?{summaryShadow:be}:{},...dn!==void 0?{modelShadow:dn}:{},...cn!==void 0?{bindingShadow:cn}:{},...un!==void 0?{modelLane:un}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:a,findings:M,counts:H,analyzerDiagnostics:E,analysisAborted:_,rejectedEntries:c,entrypointSources:p,entrypointGaps:[...u.gaps,...u.surfaceGaps],framework:u.framework,unresolved:m,advisories:[...J.values()],exitCode:Ie}}finally{e.reader===void 0&&t.close()}}var ou="cupel",au="reachability-first SCA \u2014 verdict + call path + confidence";function Fr(e){return[`${ou} v${e} \u2014 ${au}`,`cascade: ${fi.join(" \u2192 ")}`,`verdicts: ${pi.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
-`)}var lu=new Set([...Vt,...qt]);function Sn(e,n,t){let r=e[n+1];if(r===void 0||r.startsWith("--"))throw new Error(`${t} requires a value`);return r}function du(e){let n=e.split(",").map(i=>i.trim()),t=[...Vt,...qt].join(", ");if(n.length===0||n.some(i=>i===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let r=[];for(let i of n){if(!lu.has(i))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(i)}; valid: ${t}`);r.push(i)}return r}function go(e){let n=".",t,r,i=!1,s=!1,a=!1,l=!1,o=!1,c,u,f,p=!1,h=!1,S,x=!1,y=!1,v,C=[];for(let $=0;$<e.length;$+=1){let N=e[$];if(N==="--require-complete-denial"){s=!0;continue}if(N==="--fail-on-reachable")i=!0;else if(N==="--fail-on-unknown")a="all";else if(N!==void 0&&N.startsWith("--fail-on-unknown="))a=du(N.slice(18));else if(N==="--offline")l=!0;else if(N==="--sarif")t=Sn(e,$,"--sarif"),$+=1;else if(N==="--shard")r=Sn(e,$,"--shard"),$+=1;else if(N==="--entry")C.push(Sn(e,$,"--entry")),$+=1;else if(N==="--summary-shadow")c=Sn(e,$,"--summary-shadow"),$+=1;else if(N==="--model-shadow")u=Sn(e,$,"--model-shadow"),$+=1;else if(N==="--model-shadow-out")f=Sn(e,$,"--model-shadow-out"),$+=1;else if(N==="--model-shadow-widened")p=!0;else if(N==="--binding-shadow")h=!0;else if(N==="--binding-shadow-out")S=Sn(e,$,"--binding-shadow-out"),$+=1;else if(N==="--x-partial-rows")x=!0;else if(N==="--push")y=!0;else if(N!==void 0&&N.startsWith("--auth=")){let b=N.slice(7);if(b!=="oidc"&&b!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(b)}`);v=b}else{if(N!==void 0&&N.startsWith("--"))throw new Error(`unknown flag ${N}`);N!==void 0&&!o&&(n=N,o=!0)}}if(u===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(p&&u===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(h!==(S!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(v!==void 0&&!y)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:r,failOnReachable:i,requireCompleteDenial:s,failOnUnknown:a,offline:l,entry:C,summaryShadow:c,modelShadow:u,modelShadowOut:f,modelShadowWidened:p,push:y,auth:v,bindingShadow:h,bindingShadowOut:S,partialRows:x}}function U(e){let n="";for(let t of e){let r=t.charCodeAt(0),i=r<32||r>=127&&r<=159;n+=i?"\\x"+r.toString(16).padStart(2,"0"):t}return n}import{chmodSync as gu,mkdirSync as yu,readFileSync as xu,renameSync as Su,statSync as bu,unlinkSync as ku,writeFileSync as Eu}from"node:fs";import{randomBytes as wu}from"node:crypto";import{homedir as vu}from"node:os";import bn from"node:path";import{createPublicKey as cu,verify as uu}from"node:crypto";function Me(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function yo(e,n={}){let t=n.maxBytes??1073741824,r=n.timeoutMs??3e4,{get:i}=await import("node:https");return await new Promise((s,a)=>{let l=i(e,n.headers!==void 0?{headers:n.headers}:{},o=>{let c=o.statusCode??0;if(c<200||c>=300){o.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(c)}`));return}let u=[],f=0;o.on("data",p=>{if(f+=p.length,f>t){o.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(p)}),o.on("end",()=>{s(Buffer.concat(u))}),o.on("error",a)});l.on("error",a),l.setTimeout(r,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(r)}ms`))})})}async function Wn(e,n,t,r,i,s=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((o,c)=>{let u=a(n,{method:e,headers:t},f=>{let p=[],h=0;f.on("data",S=>{if(h+=S.length,h>i){f.destroy(),c(new Error(`${e} to ${l} returned more than ${String(i)} bytes`));return}p.push(S)}),f.on("end",()=>{o({status:f.statusCode??0,body:Buffer.concat(p).toString("utf8")})}),f.on("error",()=>{c(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{c(new Error(`${e} to ${l} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(s)}ms`))}),r!==void 0&&u.write(r),u.end()})}var X=class extends Error{constructor(n){super(n),this.name="DistError"}},fu=Buffer.from("302a300506032b6570032100","hex"),pu=32;function ko(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===pu)try{return cu({key:Buffer.concat([fu,n]),format:"der",type:"spki"})}catch{return}}function jr(e,n,t){for(let r of t){let i=ko(r);if(i!==void 0)try{if(uu(null,e,i,n))return!0}catch{}}return!1}function Eo(e){return e.some(n=>ko(n)!==void 0)}var mu=/^[0-9a-f]{64}$/u,hu=/^[a-z0-9-]+$/u;function xo(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new X(`${n} must be an object`);return e}function So(e,n){if(!Array.isArray(e))throw new X(`${n} must be an array`);return e}function Nt(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new X(`${n} must be an integer`);return e}function Ct(e,n){if(typeof e!="string")throw new X(`${n} must be a string`);return e}function bo(e,n){let t=Ct(e,n);if(Number.isNaN(Date.parse(t)))throw new X(`${n} is not a valid timestamp: ${t}`);return t}function Kr(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new X("distribution index is not valid JSON")}let r=xo(t,"index"),i=Nt(r.schema_version,"schema_version");if(i!==n.supportedIndexSchemaVersion)throw new X(`index schema_version ${String(i)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=Nt(r.sequence,"sequence");if(s<0)throw new X("sequence must be non-negative");let a=bo(r.generated,"generated"),l=So(r.shards,"shards"),o;for(let S of l){let x=xo(S,"shard entry"),y=Ct(x.ecosystem,"ecosystem");if(!hu.test(y))throw new X(`ecosystem ${JSON.stringify(y)} is malformed`);if(y===n.ecosystem){o=x;break}}if(o===void 0)throw new X(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);bo(o.built,"built");let c=Nt(o.db_schema_version,"db_schema_version");if(c<1)throw new X("db_schema_version must be >= 1");if(c>n.supportedDbSchemaVersion)throw new X(`this shard needs a newer cupel (db_schema_version ${String(c)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=Ct(o.sha256,"sha256");if(!mu.test(u))throw new X(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let f=Nt(o.size_bytes,"size_bytes");if(f<=0||f>n.hardMaxBytes)throw new X(`size_bytes ${String(f)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let p=So(o.urls,"urls");if(p.length===0)throw new X("urls must be a non-empty array");let h=[];for(let S of p){let x=Ct(S,"url");try{h.push(Me(x,n.shardHosts))}catch(y){throw new X(`refusing shard url ${JSON.stringify(x)}: ${y.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:f,dbSchemaVersion:c,urls:h,sequence:s,generated:a}}var wo="CUPEL_CONFIG_DIR",vo="credentials.json",Br="cpd_",Iu="cpl_",Au=Br.length+6+32,_u=200,Nu=/^[A-Za-z0-9_-]+$/u,Gn=class extends X{constructor(n){super(n),this.name="StoredCredentialError"}};function Io(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=vu();if(process.platform==="darwin")return bn.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let s=e.APPDATA,a=s!==void 0&&s!==""?s:bn.join(t,"AppData","Roaming");return bn.join(a,"cupel")}let r=e.XDG_CONFIG_HOME,i=r!==void 0&&r!==""?r:bn.join(t,".config");return bn.join(i,"cupel")}function Ot(e){return bn.join(Io(e),vo)}function zr(e){let n=e.trim();return n.startsWith(Iu)?{ok:!1,reason:"push-token"}:n.startsWith(Br)?n.length<Au||n.length>_u?{ok:!1,reason:"malformed"}:Nu.test(n.slice(Br.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function Ao(e,n){let t=Io(e),r=bn.join(t,vo);yu(t,{recursive:!0,mode:448}),process.platform!=="win32"&&gu(t,448);let i=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),s=`${r}.tmp-${wu(8).toString("hex")}`;return Eu(s,`${i}
-`,{flag:"wx",mode:384}),Su(s,r),r}function _o(e){let n=Ot(e),t;try{t=bu(n)}catch(a){if(a instanceof Error&&a.code==="ENOENT")return;throw a}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new Gn(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let r;try{r=JSON.parse(xu(n,"utf8"))}catch{throw new Gn(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let i=typeof r=="object"&&r!==null&&"delivery_token"in r?r.delivery_token:void 0,s=zr(typeof i=="string"?i:"");if(!s.ok)throw new Gn(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return s.token}function No(e){try{return ku(Ot(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var Xn="CUPEL_DELIVERY_TOKEN",Ur=class extends X{constructor(n){super(n),this.name="NoDeliveryTokenError"}},Vr=class extends X{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Cu(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function Co(e,n,t=()=>{}){let r=Cu(e)??t();return r!==void 0?()=>Promise.resolve(r):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function Oo(e){if(e===void 0)throw new Ur(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${Xn} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new Vr(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Ou="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function Ru(){return new Promise(e=>{let n=process.stdin;process.stderr.write(Ou),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",r=s=>{n.setRawMode(!1),n.pause(),n.removeListener("data",i),process.stderr.write(`
-`),s===null&&process.exit(130),e(s)},i=s=>{for(let a of s){if(a==="")return r(null);if(a==="\r"||a===`
-`)return r(t);if(a==="\x7F"||a==="\b"){t=t.slice(0,-1);continue}t+=a}};n.on("data",i)})}async function $u(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function Ro(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${U(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
-`),!0)}async function $o(e){if(Ro(e,"login"))return 1;let n=process.stdin.isTTY?await Ru():await $u(),t=zr(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
+}`,b.ScriptTarget.Latest,!0),o=r.parseDiagnostics;if(o!==void 0&&o.length>0||Oc(r,n+1,!0))return!0}return!1}function Oc(e,n=0,t=!1){return Dr(e,n,t).size>0}function Dr(e,n=0,t=!1){let r=new Set,o=t?kc:Nc(e);if(o.saturated)return r.add("saturated"),r;let i=l=>b.isElementAccessExpression(l)&&!b.isStringLiteralLike(l.argumentExpression)&&Lt(ke(l.expression),o),a=l=>{if(t&&(b.isCallExpression(l)||b.isNewExpression(l)||b.isTaggedTemplateExpression(l))){r.add("eval-invocation");return}if(b.isCallExpression(l)){let s=it(l);if(s!==null){let d=s.specifierArg;if(d===void 0||!b.isStringLiteralLike(d)||t){r.add("non-literal-load");return}}else{let d=ke(l.expression);if(b.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if(qi(l.arguments,n)){r.add("eval-code");return}}else if(Rc(d)){r.add("loader-callee");return}else if(i(d)){r.add("computed-loader");return}else if(Ac(l,o)){r.add("reflect-get");return}}}else if(b.isNewExpression(l)){let s=ke(l.expression);if(b.isIdentifier(s)&&s.text==="Function"){if(qi(l.arguments??[],n)){r.add("function-ctor");return}}else if(rt(s)){r.add("ctor-chain");return}}else if(b.isIdentifier(l)&&gc.has(l.text)&&bc(l)){r.add("captured-loader");return}else if((b.isPropertyAccessExpression(l)||b.isElementAccessExpression(l))&&(Yi(l)||rt(l)||i(l))&&Xi(l)){r.add("captured-member");return}else if(b.isBindingElement(l)){let s=l.propertyName??l.name,d=b.isIdentifier(s)||b.isStringLiteralLike(s)?s.text:b.isComputedPropertyName(s)&&b.isStringLiteralLike(s.expression)?s.expression.text:void 0;if(d!==void 0&&jt.has(d)){r.add("destructured-member");return}}b.forEachChild(l,a)};return a(e),r}function ts(e,n,t){let r=new Set(Dr(t));if(Lr(e)&&n.includes("<")&&n.includes("require")){let o=b.createSourceFile(e,n,b.ScriptTarget.ES2020,!0,b.ScriptKind.TSX);for(let i of Dr(o))r.add(i)}return r}function Pc(e,n,t){if(Tr(e))return!0;let r=t.endsWith(Re.sep)?t:t+Re.sep,o=e.split("/"),i=n;for(;;){let a=Re.join(i,"node_modules",...o),l;try{l=An(Re.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(r))return!1;let d=_e(l);if(d===null)return!1;let u;try{u=JSON.parse(d).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(Ai(a))return!1;if(i===t)break;let s=Re.dirname(i);if(s===i||s!==t&&!s.startsWith(r))break;i=s}return!0}function $c(e,n){let t=n.endsWith(Re.sep)?n:n+Re.sep,r=Re.dirname(e);for(;;){let o=Re.join(r,"package.json"),i;try{i=An(o)}catch{i=null}if(i!==null&&(i===n||i.startsWith(t))){let l=_e(i);if(l!==null)try{let s=JSON.parse(l).name;if(typeof s=="string"&&s.length>0)return s}catch{return null}}if(r===n)break;let a=Re.dirname(r);if(a===r||a!==n&&!a.startsWith(t))break;r=a}return null}function Mc(e,n,t,r,o){let i=[],a=[],l=new Set,s={},d=[],u=[],p=new Set,f=new Set,h=[],g=!1,S=(w,I)=>{let v;try{v=An(I)}catch{return!1}let _=Oe(e,v);if(_===null)return o.push({code:"out-of-root",path:v,detail:"dependency module resolved outside the app root; not followed"}),!1;let k=!t.has(v)&&!f.has(v);return k&&f.size>=Pr?(g=!0,!1):(a.push({from:w,to:{module:_}}),k?(f.add(v),i.push(_),!0):!1)},E=(w,I)=>{if(l.add(I),p.has(I))return;p.add(I);let v=Ke(I,w,Ne,n),_=v!==null?[v]:jn(I,w,Ne,n);_.length>=2&&d.push({path:Oe(e,w)??w,specifier:I,candidates:_.map(m=>Oe(e,m)??m)});let k=!1;for(let m of _)if(!Me(m)&&(k=!0,S({surface:I},m))){h.push(m);try{let y=Oe(e,An(m)),A=$c(m,e);y!==null&&A!==null&&(s[y]=A)}catch{}}k||Pc(I,Re.dirname(w),e)||o.push({code:"unresolved-specifier",path:I,reason:et(I,w,Ne,n),detail:`dependency "${I}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let w of r)E(w.containingFile,w.packageName);for(;h.length>0&&f.size<Pr;){let w=h.pop();if(w===void 0)break;let I=Oe(e,w);if(I===null)continue;let v=Fn(w,pn);if(v.kind==="too-large"){o.push({code:"limit-exceeded",path:I,detail:`dependency module over the ${String(pn/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(v.kind==="not-regular"){o.push({code:"parse-error",path:I,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let _=b.createSourceFile(w,v.text,b.ScriptTarget.ES2020,!0),k=_.parseDiagnostics;if(k!==void 0&&k.length>0){o.push({code:"dependency-body",path:I,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let m=ts(w,v.text,_);if(m.size>0){o.push({code:"dependency-body",path:I,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...m].sort()});continue}o.push({code:"dependency-body",path:I,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:I});for(let y of Gi(w,v.text))if(y.runtime)if(ye(y.text)==="package-root"){let A=je(y.text);a.push({from:{module:I},to:{surface:A}}),E(w,A)}else{if(Tr(je(y.text)))continue;let A=Ke(y.text,w,Ne,n),C=A!==null?[A]:jn(y.text,w,Ne,n);if(C.length===0){if(ye(y.text)==="package-subpath"){let T=et(y.text,w,Ne,n);if(T==="no-candidate"||T==="not-installed"&&Ci(w,je(y.text))){u.push({path:I,specifier:y.text,why:T});continue}o.push({code:"unresolved-specifier",path:I,reason:T,detail:`runtime package-subpath import "${y.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}C.length>=2&&d.push({path:I,specifier:y.text,candidates:C.map(T=>Oe(e,T)??T)});for(let T of C){if(Me(T)){let P=Oe(e,T);o.push({code:P===null?"out-of-root":"declaration-shadow",path:I,detail:P===null?`runtime import "${y.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${y.text}" resolved to the declaration file "${P}" with no co-located runtime module; its code was not analyzed`});continue}S({module:I},T)&&h.push(T)}}}return(g||h.length>0)&&o.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(Pr)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:i,edges:a,surfacePackages:[...l],entryRealNames:s,conditionUnions:d,provenAbsent:u}}function rs(e,n,t=!1){let r=An(e),o=[],i=[],a=b.createCompilerHost(Ne,!0),l=t?Oi(r,Ne,a):()=>null,s=new Set,d=new Set,u=n.map(R=>Re.join(r,R)),p=[],f=new Map,h=new Map,g=new Map,S=new Map,E=new Set,w=(R,F,O)=>{let L=`${String(R.length)}:${R}${F}`;E.has(L)||(E.add(L),o.push({code:"unresolved-specifier",path:R,detail:F,reason:O}))},I=()=>null,v=0,_=(R,F)=>{let O=h.get(R);return O===void 0&&(O=b.createSourceFile(R,F,b.ScriptTarget.ES2020,!0),h.set(R,O)),{real:R,sf:O}};for(;d.size<Dt;){let R=u.pop();if(R===void 0){if(v>=hc)break;v+=1;let K=[];for(let[$,q]of f)q.includes("readdir")&&(q.includes("require")||q.includes("import("))&&K.push(_($,q));let G=mc(K);if(G.length===0)break;let B=[];for(let[$,q]of f)B.push(_($,q));I=zi(B,G,Ne,a,g);let W=!1;for(let $ of K){let q=f.get($.real);if(q!==void 0)for(let H of Wi($.real,q,r,a,I))d.has(H)||(u.push(H),W=!0)}if(!W)break;continue}let F;try{F=An(R)}catch{continue}if(d.has(F))continue;if(d.add(F),Oe(r,F)===null){o.push({code:"out-of-root",path:R,detail:"resolved outside app root"});continue}let O=Fn(F,pn);if(O.kind==="too-large"){o.push({code:"limit-exceeded",path:F,detail:`file is ${String(Math.round(O.bytes/1048576))}MiB, over the ${String(pn/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(O.kind==="not-regular"){o.push({code:"parse-error",path:F,detail:"unreadable or not a regular file"});continue}let L=O.text;s.add(F),f.set(F,L);for(let K of Gi(F,L)){let G=K.runtime?l(K.text,F):null;if(G===null&&ye(K.text)==="package-root"){K.runtime&&p.push({containingFile:F,packageName:je(K.text)});continue}let B=G??Ke(K.text,F,Ne,a),W=B!==null?[B]:K.runtime&&G===null?jn(K.text,F,Ne,a):[];if(W.length===0){if(K.runtime){let $=ye(K.text);if(!($==="package-subpath"&&Tr(je(K.text)))){if($==="package-subpath")w(F,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,et(K.text,F,Ne,a));else if($==="relative"){let q=Ni(K.text,F,r,S);q.kind==="unanalyzable"&&w(F,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${q.reason}; a bundler/loader may load a module the analyzer never saw`,q.why)}}}continue}W.length>=2&&i.push({path:Oe(r,F)??F,specifier:K.text,candidates:W.map($=>Oe(r,$)??$)});for(let $ of W){if(Oe(r,$)===null){o.push({code:"out-of-root",path:$,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&Me($)){o.push({code:"declaration-shadow",path:$,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!Ct($)){o.push({code:"unanalyzable-module",path:$,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}u.push($)}}for(let K of Wi(F,L,r,a,I))d.has(K)||u.push(K)}d.size>=Dt&&u.length>0&&o.push({code:"limit-exceeded",path:r,detail:`reachable file set exceeds ${String(Dt)}; analysis truncated (${String(u.length)}+ files not analyzed)`});let k=Mc(r,a,s,p,o),m=b.createProgram({rootNames:[...s],options:Ne,host:a}),y=new Set,A=new Map;for(let R of m.getSourceFiles()){if(R.isDeclarationFile||m.isSourceFileDefaultLibrary(R)||Oe(r,R.fileName)===null||!Lr(R.fileName))continue;let F=m.getSyntacticDiagnostics(R).length>0;if(!F&&!R.text.includes("<")||pc(R.text,b.ScriptKind.TSX)!==0)continue;let O=b.createSourceFile(R.fileName,R.text,b.ScriptTarget.ES2020,!0,b.ScriptKind.TSX);(F||Vi(O)>Vi(R))&&(y.add(R.fileName),A.set(R.fileName,R.text))}let C=m;if(y.size>0){let R=a.getSourceFile.bind(a);a.getSourceFile=(F,O,L,K)=>{let G=A.get(F);return G!==void 0?b.createSourceFile(F,G,b.ScriptTarget.ES2020,!0,b.ScriptKind.TSX):R(F,O,L,K)},C=b.createProgram({rootNames:[...s],options:Ne,host:a,oldProgram:m})}let T=C.getTypeChecker(),P=[];for(let R of C.getSourceFiles()){if(R.isDeclarationFile||C.isSourceFileDefaultLibrary(R)||Oe(r,R.fileName)===null)continue;P.push(R);let F=C.getSyntacticDiagnostics(R);if(F.length>0){let K=F[0],G=K!==void 0?b.flattenDiagnosticMessageText(K.messageText," "):"syntax error";o.push({code:"parse-error",path:R.fileName,detail:`${String(F.length)} syntax error(s): ${G}`})}let O=Oe(r,R.fileName),L=O===null?null:ts(R.fileName,R.text,R);O!==null&&L!==null&&L.size>0&&o.push({code:"loader-escape",path:O,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...L].sort()})}return{program:C,checker:T,host:a,options:Ne,appRoot:r,sourceFiles:P,diagnostics:o,depReach:k,conditionUnions:[...i,...k.conditionUnions],provenAbsent:k.provenAbsent,resolveParamDirs:I,toRel:R=>Oe(r,R)}}import{opendirSync as Dc,statSync as Tc}from"node:fs";import Fr from"node:path";var Lc=8192,Fc=2e4,jc=new Set(["node_modules"]),os=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),Kc=16;function Kt(e,n,t,r,o={}){let i=o.maxEntries??Fc,a=o.prune,l=[],s=!1,d=0,u=[{dir:Fr.join(e,n),rel:n,depth:0}];for(;u.length>0;){let p=u.pop();if(p===void 0)break;if(p.depth>Kc){s=!0;continue}let f;try{f=Dc(p.dir)}catch{s=!0;continue}try{let h=0;for(;;){let g=f.readSync();if(g===null)break;if(h+=1,d+=1,h>Lc||d>i){s=!0;break}let S=p.rel+g.name;if(g.isSymbolicLink()){let E;try{E=Tc(Fr.join(p.dir,g.name)).isDirectory()}catch{s=!0;continue}if(E){s=!0;continue}}else if(g.isDirectory()){if(jc.has(g.name)||g.name.startsWith(".")||a?.has(g.name)===!0){s=!0;continue}u.push({dir:Fr.join(p.dir,g.name),rel:`${S}/`,depth:p.depth+1});continue}else if(!g.isFile())continue;if(t(S)){if(l.length>=r){s=!0;break}l.push(S)}}}finally{try{f.closeSync()}catch{}}}return{matches:l,truncated:s}}var Bc=64;function is(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let r=n.slice(0,t),o=n.slice(t+1);if(r.startsWith("./")&&(r=r.slice(2)),r.startsWith("/")||o.includes("/")||r.split("/").includes("..")||r.includes("\\")||n.includes("\0"))return null;let i=r.slice(0,r.lastIndexOf("/")+1);return Kt(e,i,a=>a.length>=r.length+o.length&&a.startsWith(r)&&a.endsWith(o),Bc)}import{existsSync as zc}from"node:fs";import Uc from"node:path";var Vc=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],Wc=["dependencies","devDependencies"];function qc(e,n){for(let t of Wc){let r=e[t];if(!(typeof r!="object"||r===null||Array.isArray(r))&&Object.hasOwn(r,n))return!0}return!1}function jr(e,n){if(n===null)return null;for(let t of Vc)if(qc(n,t.dependency)){for(let r of t.configFiles)if(zc(Uc.join(e,r)))return{name:t.name,configFile:r,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function Kr(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var Gc=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],Hc=256,Xc=12e4;function Br(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let r=Kt(e,"",o=>{let i=o.split("/");for(let a=0;a<i.length-1;a+=1){let l=i[a];if(l!==void 0&&t.has(l))return Gc.some(s=>o.endsWith(s))}return!1},Hc,{maxEntries:Xc,prune:os});return{roots:r.matches,truncated:r.truncated}}function Be(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let r of n){let o=r.codePointAt(0)??0;t+=o<32||o>=127&&o<=159?`\\x${o.toString(16).padStart(2,"0")}`:r}return t}function Yc(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function Jc(e){let n=!1;for(let t=0;t<e.length;t+=1){let r=e.charAt(t),o=r.codePointAt(0)??0;if(o<32||o===127||o>=128&&o<=159)return null;if(r==="\\"){n=!0;let i=e.charAt(t+1);if(!(i>="a"&&i<="z"||i>="A"&&i<="Z"||i>="0"&&i<="9"||i==="."||i==="_"||i==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(r))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function Zc(e){let n=[],t="";for(let r of e){if(r===" "||r==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=r}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var Qc=/^[A-Za-z_][A-Za-z0-9_]*=/u;function eu(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var nu=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),tu=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),ru=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function as(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function ss(e){if(as(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return ru.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:nu.has(t)||n!==-1&&tu.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var ou=[".js",".cjs",".mjs",".ts",".mts",".cts"];function iu(e){return ou.some(n=>e.endsWith(n))}var su=new Set(["npm","yarn","pnpm"]);function au(e){let n=e[0];return n===void 0||!su.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Ur(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!Yc(n))return zr(n);let t=Jc(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let r=zr(t.windows),o=zr(t.posixShell);if(r.kind==="file"){let i=o.kind==="file"?o.specifier:void 0;return i===void 0||i===r.specifier?{kind:"file",specifier:r.specifier}:{kind:"file",specifier:r.specifier,alt:i}}return o.kind==="file"?{kind:"file",specifier:o.specifier}:r}function zr(e){let n=Zc(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let i=n[t];if(i===void 0||!Qc.test(i))break;if(as(i))return{kind:"unparsed",reason:`environment \`${Be(i)}\` preloads another module; the launch surface is more than one file`};let a=i.indexOf("=");if(i.slice(0,a)==="NODE_OPTIONS")for(let l of i.slice(a+1).split(/\s+/u)){if(l===""||!l.startsWith("-"))continue;let s=ss(l);if(s!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Be(s.token)}\` ${s.why}`}}}let r=n[t];if(r===void 0)return{kind:"unparsed",reason:"no program in the command"};if(au(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!eu(r))return{kind:"unparsed",reason:`runs \`${Be(r)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let i=n[t];if(i===void 0||!i.startsWith("-"))break;let a=ss(i);if(a!==null)return{kind:"unparsed",reason:`node flag \`${Be(a.token)}\` ${a.why}`}}let o=n[t];return o===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:iu(o)?{kind:"file",specifier:o}:{kind:"unparsed",reason:`\`${Be(o)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function lu(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var du=64;function Vr(e){let n=e.split(`
+`),t=n.length>64,r=[],o=0;for(let i of n.slice(0,64)){let a=i.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let s=a.slice(l+1).trim();if(s.length===0)continue;let d=a.slice(0,l);if(d.length>du||!lu(d)){o+=1;continue}r.push({name:d,command:s})}return r.sort((i,a)=>i.name===a.name?0:i.name==="web"?-1:a.name==="web"?1:0),{entries:r,truncated:t,unnamedLines:o}}import{realpathSync as ls}from"node:fs";import Te from"node:path";import c from"typescript";var ds=3;function le(e,n,t){if(e===void 0)return;let r=e[n]??={fired:0,refused:{}};t===null?r.fired+=1:r.refused[t]=(r.refused[t]??0)+1}function gn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var zt=16,Hr=256,Wr=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let r=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.fns.has(r)||(this.moduleFor(n),this.fns.set(r,{id:o,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),o}classFor(n,t){let r=`${n}#${t}`,o=`pkg:${n}#${t}`;return this.classNodes.has(r)||(this.moduleFor(n),this.classNodes.set(r,{id:o,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(r,[])),o}methodFor(n,t,r,o){let i=`${n}#${t}.${r}`,a=`pkg:${n}#${t}.${r}`;if(!this.fns.has(i)){let l=this.classFor(n,t);this.fns.set(i,{id:a,moduleId:`pkg:${n}`,name:r,kind:o,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function xs(e,n){let t="node_modules/",r=e.lastIndexOf(t);if(r===-1)return n;let i=e.slice(r+t.length).split("/");return i[0]?.startsWith("@")&&i.length>=2?`${i[0]}/${i[1]}`:i[0]??n}function cs(e,n,t){let r=Te.dirname(e),o=Te.dirname(n),i=[];for(;;){let l=t.get(r);if(l!==void 0){for(let d of i)t.set(d,l);return l}i.push(r);let s=_e(Te.join(r,"package.json"));if(s!==null)try{let d=JSON.parse(s),u={name:d.name??"app",version:d.version??"0.0.0",dir:r};for(let p of i)t.set(p,u);return u}catch{}if(r===o||r===Te.dirname(r))break;r=Te.dirname(r)}let a={name:"app",version:"0.0.0",dir:null};for(let l of i)t.set(l,a);return a}function qr(e){return c.isParenthesizedExpression(e)?qr(e.expression):c.isStringLiteralLike(e)?e.text:c.isTemplateExpression(e)?e.head.text:c.isBinaryExpression(e)&&e.operatorToken.kind===c.SyntaxKind.PlusToken?qr(e.left):null}function cu(e){if(!c.isCallExpression(e))return!1;let n=e.expression,t=c.isPropertyAccessExpression(n)?n.name.text:c.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let r=e.arguments[0];return r!==void 0&&c.isIdentifier(r)&&(r.text==="__dirname"||r.text==="__filename")}function Ss(e){let n=qr(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":cu(e)?"relative-bounded":"unknown"}function uu(e){let n=[],t=r=>{if(c.isImportDeclaration(r)&&c.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isImportEqualsDeclaration(r)&&c.isExternalModuleReference(r.moduleReference)&&c.isStringLiteralLike(r.moduleReference.expression))n.push({specifier:r.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isExportDeclaration(r)&&r.moduleSpecifier!==void 0&&c.isStringLiteralLike(r.moduleSpecifier))n.push({specifier:r.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isCallExpression(r)){let o=it(r);if(o!==null){let i=o.specifierArg,a=i!==void 0&&c.isStringLiteralLike(i);n.push({specifier:a?i.text:void 0,specifierIsLiteral:a,dynamic:!0,...i!==void 0&&!a?{computedArg:i,loadPos:r.getStart(e)}:{}})}}c.forEachChild(r,t)};return t(e),n}function fu(e,n,t){let r=new Map,o=cs(Te.join(e.appRoot,"package.json"),e.appRoot,r),i=[],a=[],l=[],s=new Map,d=new Set,u=[],p=new Set;for(let f of e.sourceFiles){let h=e.toRel(f.fileName);h!==null&&p.add(h)}for(let f of e.sourceFiles){let h=e.toRel(f.fileName);if(h===null)continue;let g=cs(f.fileName,e.appRoot,r),S=xs(h,o.name),E=h.includes("node_modules/");i.push({id:h,packageName:E&&g.name!==o.name?g.name:S,versionRange:g.version,path:h,moduleSystem:"cjs",isEntrypoint:n.has(h)}),g.dir===o.dir&&d.add(h);let w=0,I=null;for(let v of uu(f)){let _=`${h}#import${String(w)}`;w+=1;let k=null,m=[];if(v.specifier!==void 0)if(ye(v.specifier)==="package-root")k=t.moduleFor(je(v.specifier));else{let y=Ke(v.specifier,f.fileName,e.options,e.host),A=y!==null?e.toRel(y):null;if(A!==null)k=A;else if(v.specifier!==void 0){let[C,...T]=jn(v.specifier,f.fileName,e.options,e.host).map(P=>e.toRel(P)).filter(P=>P!==null&&p.has(P));C!==void 0&&T.length>=1&&(k=C,m=T.map(P=>P))}}a.push({id:_,moduleId:h,specifier:v.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:v.dynamic,specifierIsLiteral:v.specifierIsLiteral,...k!==null?{resolvedModuleId:k}:{}}),k!==null&&l.push({importId:_,resolvedModuleId:k});for(let y of m)l.push({importId:_,resolvedModuleId:y});if(v.computedArg!==void 0&&v.loadPos!==void 0&&u.push({importId:String(_),path:h,pos:v.loadPos,shape:Ss(v.computedArg),text:v.computedArg.getText(f).slice(0,160)}),v.computedArg!==void 0&&v.loadPos!==void 0){I??=In(f,f.fileName,e.resolveParamDirs);let y=[];for(let A of $t(v.computedArg,I,e.appRoot,e.options,e.host)){let C=e.toRel(A);if(C===null||!p.has(C))continue;let T=C,P=`${h}#import${String(w)}`;w+=1,a.push({id:P,moduleId:h,specifier:C,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:T}),l.push({importId:P,resolvedModuleId:T}),y.push(C)}if(y.length>0){let A=tt(v.computedArg,I)!==null||Pt(v.computedArg),C=s.get(h)??[];C.push({pos:v.loadPos,candidateRels:y,seedable:A}),s.set(h,C)}}}}return{modules:i,imports:a,importEdges:l,computedLoads:s,appOwnedPaths:d,loadSites:u}}function pu(e){let n=_e(e);if(n===null)return null;let t=c.createSourceFile(e,n,c.ScriptTarget.Latest,!0),r=o=>t.statements.some(i=>c.isFunctionDeclaration(i)?i.name?.text===o:c.isVariableStatement(i)?i.declarationList.declarations.some(a=>c.isIdentifier(a.name)&&a.name.text===o&&a.initializer!==void 0&&(c.isFunctionExpression(a.initializer)||c.isArrowFunction(a.initializer))):!1);for(let o of t.statements){if(c.isFunctionDeclaration(o)&&o.name!==void 0&&o.modifiers?.some(a=>a.kind===c.SyntaxKind.DefaultKeyword)===!0)return o.name.text;if(!c.isExpressionStatement(o)||!c.isBinaryExpression(o.expression))continue;let i=o.expression;if(i.operatorToken.kind===c.SyntaxKind.EqualsToken&&mu(i.left)){if(c.isFunctionExpression(i.right)&&i.right.name!==void 0)return i.right.name.text;if(c.isIdentifier(i.right)&&r(i.right.text))return i.right.text}}return null}function mu(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function hu(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let r=d=>"surface"in d?n.moduleFor(d.surface):d.module,o=[],i=new Set;for(let d of e.modules)t.has(d)||i.has(d)||(i.add(d),o.push({id:d,packageName:e.entryRealNames[d]??xs(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],s=0;for(let d of e.edges){let u=r(d.from),p=r(d.to),f=`${String(u)}#depreach${String(s)}`;s+=1,a.push({id:f,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),l.push({importId:f,resolvedModuleId:p})}return{modules:o,imports:a,importEdges:l}}function us(e,n,t){let r=e.expression;if(c.isIdentifier(r)&&!t.has(r.text)){let o=n.get(r.text);if(o?.kind==="package-export")return{kind:"package-instance",packageName:o.packageName,className:o.exportName};if(o?.kind==="app-class")return{kind:"app-instance",cls:o.cls}}else if(c.isPropertyAccessExpression(r)&&c.isIdentifier(r.expression)&&!t.has(r.expression.text)){let o=n.get(r.expression.text);if(o?.kind==="package-surface")return{kind:"package-instance",packageName:o.packageName,className:r.name.text}}return null}function _n(e){return c.canHaveModifiers(e)&&(c.getModifiers(e)?.some(n=>n.kind===c.SyntaxKind.ExportKeyword)??!1)}function gu(e){let n=new Set,t;for(let r of e.statements){if(c.isExpressionStatement(r)&&c.isBinaryExpression(r.expression)){let o=r.expression;if(o.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(o.left)&&c.isIdentifier(o.left.expression)&&o.left.expression.text==="module"&&o.left.name.text==="exports"){if(c.isIdentifier(o.right))n.add(o.right.text),t=o.right.text;else if(c.isObjectLiteralExpression(o.right))for(let i of o.right.properties)c.isShorthandPropertyAssignment(i)?n.add(i.name.text):c.isPropertyAssignment(i)&&c.isIdentifier(i.initializer)&&n.add(i.initializer.text)}continue}if(c.isFunctionDeclaration(r)&&r.name!==void 0&&_n(r))n.add(r.name.text);else if(c.isVariableStatement(r)&&_n(r))for(let o of r.declarationList.declarations)c.isIdentifier(o.name)&&n.add(o.name.text);else if(c.isExportDeclaration(r)&&r.exportClause&&c.isNamedExports(r.exportClause))for(let o of r.exportClause.elements)n.add((o.propertyName??o.name).text);else c.isExportAssignment(r)&&c.isIdentifier(r.expression)&&(n.add(r.expression.text),t=r.expression.text)}return{reachableLocals:n,defaultTarget:t}}function yu(e){for(let n of e.statements){if(c.isFunctionDeclaration(n)&&n.name!==void 0&&_n(n)&&c.getModifiers(n)?.some(t=>t.kind===c.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(c.isExportAssignment(n)&&!n.isExportEquals&&c.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===c.SyntaxKind.EqualsToken&&$e(t.left)&&c.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function nn(e){if(c.isCallExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&c.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function $e(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function qe(e){if($e(e))return!0;if(!c.isPropertyAccessExpression(e)&&!c.isElementAccessExpression(e))return!1;let n=e.expression;return c.isIdentifier(n)&&n.text==="exports"?!0:$e(n)}function zn(e){return c.isPropertyAccessExpression(e.expression)&&c.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function bs(e){let n=!1,t=r=>{if(!n){if(c.isCallExpression(r)){let o=nn(r);if(o!==void 0&&ye(o)!=="package-root"){n=!0;return}}c.forEachChild(r,t)}};return t(e),n}function ks(e){let n=new Set,t=o=>o!==void 0&&bs(o),r=o=>{c.isVariableDeclaration(o)&&t(o.initializer)&&nt(o.name,n),c.isBinaryExpression(o)&&o.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(o.left)&&t(o.right)&&n.add(o.left.text),c.forEachChild(o,r)};return r(e),n}function Es(e,n){for(let t of e.properties)c.isShorthandPropertyAssignment(t)?n.add(t.name.text):c.isPropertyAssignment(t)&&c.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function xu(e){let n=new Set;for(let l of e.statements)if(c.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isVariableStatement(l))for(let s of l.declarationList.declarations)c.isIdentifier(s.name)&&s.initializer!==void 0&&(c.isFunctionExpression(s.initializer)||c.isArrowFunction(s.initializer)||c.isObjectLiteralExpression(s.initializer))&&n.add(s.name.text);let t=l=>c.isFunctionExpression(l)||c.isArrowFunction(l)||c.isObjectLiteralExpression(l)||c.isIdentifier(l)&&n.has(l.text),r=new Set,o=l=>{c.isIdentifier(l)?r.add(l.text):c.isObjectLiteralExpression(l)&&Es(l,r)},i=!1,a=l=>{if(!i){if(c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken)if($e(l.left)){o(l.right);let s=l.right;(c.isObjectLiteralExpression(s)?s.properties.every(u=>c.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||c.isPropertyAssignment(u)&&t(u.initializer)):t(s))||(i=!0)}else qe(l.left)&&(t(l.right)||(i=!0));else(c.isCallExpression(l)&&zn(l)&&l.arguments[0]!==void 0&&Nn(l.arguments[0])||c.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(i=!0);i||c.forEachChild(l,a)}};if(a(e),!i&&r.size>0){for(let l of As(e))if(r.has(l)){i=!0;break}}return i}function Nn(e){return qe(e)||c.isIdentifier(e)&&e.text==="exports"}function ws(e){if(!c.isPropertyAccessExpression(e.expression)||!c.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Xr(e){return ws(e)&&e.arguments[0]!==void 0&&Nn(e.arguments[0])}function Su(e){return ws(e)&&e.arguments[0]!==void 0&&c.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function bu(e){for(let n of e.declarations??[])if(c.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(c.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function ku(e,n,t,r,o){let i=(e.declarations??[]).filter(l=>!c.isSourceFile(l)&&!c.isModuleDeclaration(l));for(let l of i){let s=l.getSourceFile(),d=n.toRel(s.fileName);if(d===null||o.has(d))continue;let u=t.get(`${d}::${String(l.getStart(s,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of i){let s=n.toRel(l.getSourceFile().fileName);if(s===null||o.has(s))continue;let d=r.get(`${s}::${a}`);if(d!==void 0)return d}}function Ut(e){return c.isPropertyAccessExpression(e)?e.name.text:c.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Yr=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Jr(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?Ut(e):void 0;return n!==void 0&&n!=="__proto__"&&Yr.test(n)?n:void 0}function Eu(e){return e!=="__proto__"&&Yr.test(e)}function fs(e){let n=ke(e);return c.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||$e(n)}function wu(e){if(!c.isArrayLiteralExpression(e)&&!c.isObjectLiteralExpression(e))return!1;let n=!1,t=r=>{n||(qe(r)?n=!0:c.forEachChild(r,t))};return t(e),n}function Zr(e){let n=!1,t=new Map,r=o=>{if(!n){if(c.isBinaryExpression(o)&&o.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=c.SyntaxKind.LastAssignment){if($e(o.left)||c.isIdentifier(o.left)&&o.left.text==="exports")n=!0;else if(o.operatorToken.kind===c.SyntaxKind.EqualsToken&&fs(o.right))n=!0;else if(wu(o.left))n=!0;else if(qe(o.left)){let i=Jr(o.left);i===void 0?n=!0:t.set(i,(t.get(i)??0)+1)}}else(c.isCallExpression(o)&&zn(o)&&o.arguments[0]!==void 0&&Nn(o.arguments[0])||c.isCallExpression(o)&&Xr(o)||c.isCallExpression(o)&&Su(o)||c.isVariableDeclaration(o)&&o.initializer!==void 0&&fs(o.initializer))&&(n=!0);n||c.forEachChild(o,r)}};return r(e),{surfaceEscapes:n,assignCount:t}}function Qr(e){let n=[];for(let t of e.statements){if(!c.isExpressionStatement(t)||!c.isBinaryExpression(t.expression))continue;let r=t.expression;r.operatorToken.kind===c.SyntaxKind.EqualsToken&&(!qe(r.left)||$e(r.left)||n.push({bin:r,name:Jr(r.left)}))}return n}function vu(e){let{surfaceEscapes:n,assignCount:t}=Zr(e);if(n)return[];let r=[];for(let{bin:o,name:i}of Qr(e))i===void 0||(t.get(i)??0)!==1||(c.isFunctionExpression(o.right)||c.isArrowFunction(o.right))&&r.push({name:i,value:o.right});return r}function Iu(e,n){let{surfaceEscapes:t,assignCount:r}=Zr(e);if(t)return[];let o=[];for(let{bin:i,name:a}of Qr(e))a===void 0||(r.get(a)??0)!==1||c.isIdentifier(i.right)&&!n.has(i.right.text)&&o.push(i.right.text);return o}function Au(e,n){let{surfaceEscapes:t,assignCount:r}=Zr(e);for(let{bin:o,name:i}of Qr(e)){let a=o.right;if(!(c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)))continue;let s=c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)&&!n.has(a.text);if(!(!t&&i!==void 0&&(r.get(i)??0)===1&&s))return!0}return!1}function _u(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&c.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function ps(e){let n=e.parent;return n===void 0?!1:c.isPropertyAccessExpression(n)?n.name===e:c.isQualifiedName(n)?n.right===e:c.isBindingElement(n)||c.isImportSpecifier(n)?n.propertyName===e:c.isExportSpecifier(n)?!0:c.isPropertyAssignment(n)||c.isPropertyDeclaration(n)||c.isPropertySignature(n)||c.isMethodDeclaration(n)||c.isMethodSignature(n)||c.isGetAccessorDeclaration(n)||c.isSetAccessorDeclaration(n)||c.isEnumMember(n)?n.name===e:!1}function ms(e){for(let n=e.parent;n!==void 0;n=n.parent){if(c.isSourceFile(n))return!0;if(!c.isArrowFunction(n)&&(c.isFunctionLike(n)||c.isClassLike(n)))return!1}return!0}function Nu(e,n){let t=r=>{c.isIdentifier(r)&&(r.text==="exports"||r.text==="module")&&n.add(r),c.forEachChild(r,t)};t(e)}function Ru(e){let n=[],t=new Set;for(let i of e.statements){if(c.isExportDeclaration(i)||c.isExportAssignment(i)||c.isImportDeclaration(i)||c.isImportEqualsDeclaration(i)||_n(i))return null;if(!c.isExpressionStatement(i)||!c.isBinaryExpression(i.expression))continue;let a=i.expression;if(a.operatorToken.kind===c.SyntaxKind.EqualsToken){if($e(a.left))n.push({kind:"whole",value:a.right});else if(qe(a.left)){let l=Jr(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:_u(a.left)})}else continue;Nu(a.left,t)}}let r=!1,o=i=>{if(!r){if(c.isIdentifier(i)&&(i.text==="exports"||i.text==="module")&&!t.has(i)&&!ps(i)){r=!0;return}if(i.kind===c.SyntaxKind.ThisKeyword&&ms(i)){r=!0;return}if(c.isIdentifier(i)&&i.text==="arguments"&&!ps(i)&&ms(i)){r=!0;return}c.forEachChild(i,o)}};return o(e),r?null:n}function Gr(e){return c.isIdentifier(e)||c.isStringLiteralLike(e)?e.text:void 0}function hs(e,n,t){return c.isIdentifier(e)?n(e.text):t?.(e)}function Cu(e,n,t,r){let o=new Map,i=Ru(e);if(i===null||i.filter(h=>h.kind==="whole").length>1)return o;let a=i.findIndex(h=>h.kind==="whole"),l=(h,g)=>a>=0&&g>a&&h.kind==="member"&&h.root==="exports",s=i.some(l);if(s){let h=i[a];if(h===void 0||h.kind!=="whole"||!c.isObjectLiteralExpression(h.value))return o}let d=s?i.filter((h,g)=>!l(h,g)):i,u=new Map;for(let h of d)h.kind==="member"&&u.set(h.name,(u.get(h.name)??0)+1);let p=h=>n.has(h)?void 0:t(h),f=(h,g)=>{g===void 0?o.delete(h):o.set(h,g)};for(let h of d){if(h.kind==="member"){f(h.name,(u.get(h.name)??0)>1?void 0:hs(h.value,p,r));continue}o.clear();let g=h.value;if(c.isObjectLiteralExpression(g))for(let S of g.properties){if(c.isSpreadAssignment(S))return new Map;if(c.isShorthandPropertyAssignment(S)){f(S.name.text,p(S.name.text));continue}let E=Gr(S.name);if(E===void 0)return new Map;f(E,c.isPropertyAssignment(S)?hs(S.initializer,p,r):void 0)}}return o}function vs(e,n,t,r){let o=new Map,i=l=>l!==void 0&&ye(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(c.isVariableDeclaration(l)&&l.initializer!==void 0){let s=l.initializer;if(c.isIdentifier(l.name)&&!r.has(l.name.text)){let d=i(nn(s));if(d!==void 0)o.set(l.name.text,{kind:"whole",target:d});else if((c.isPropertyAccessExpression(s)||c.isElementAccessExpression(s))&&c.isCallExpression(s.expression)){let u=i(nn(s.expression)),p=Ut(s);u!==void 0&&p!==void 0&&o.set(l.name.text,{kind:"member",target:u,member:p})}}else if(c.isObjectBindingPattern(l.name)){let d=i(nn(s));if(d!==void 0){for(let u of l.name.elements)if(c.isIdentifier(u.name)&&!r.has(u.name.text)){let p=u.propertyName!==void 0&&c.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;o.set(u.name.text,{kind:"member",target:d,member:p})}}}}c.forEachChild(l,a)};return a(e),o}function Ou(e,n,t,r){let o=a=>a!==void 0&&ye(a)==="relative"?t.get(`${n}::${a}`):void 0,i=o(nn(e));if(i!==void 0)return{kind:"whole",target:i};if(c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)){let a=Ut(e);if(a===void 0)return;let l=o(nn(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(c.isIdentifier(e.expression)){let s=r.get(e.expression.text);if(s?.kind==="whole")return{kind:"member",target:s.target,member:a}}return}if(c.isIdentifier(e))return r.get(e.text)}function Is(e,n,t,r,o){let i=[],a=!1,l=p=>{if(bs(p))return!0;let f=!1,h=g=>{f||(c.isIdentifier(g)&&o.has(g.text)?f=!0:c.forEachChild(g,h))};return h(p),f},s=(p,f)=>{let h=Ou(p,n,t,r);h!==void 0?i.push({source:h,exportedName:f}):l(p)&&(a=!0)},d=p=>{if(c.isObjectLiteralExpression(p)){for(let f of p.properties)if(c.isSpreadAssignment(f))s(f.expression,"default");else if(c.isPropertyAssignment(f)){let h=c.isIdentifier(f.name)||c.isStringLiteralLike(f.name)?f.name.text:"default";s(f.initializer,h)}else if(c.isShorthandPropertyAssignment(f)){let h=r.get(f.name.text);h!==void 0&&i.push({source:h,exportedName:f.name.text})}return}s(p,"default")},u=p=>{if(c.isBinaryExpression(p)&&p.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=c.SyntaxKind.LastAssignment){if($e(p.left)){d(p.right);return}if(qe(p.left)){let f=c.isPropertyAccessExpression(p.left)?p.left.name.text:c.isElementAccessExpression(p.left)&&c.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";s(p.right,f);return}}else if(c.isExportAssignment(p)&&p.isExportEquals){s(p.expression,"default");return}else if(c.isCallExpression(p)&&zn(p)&&p.arguments[0]!==void 0&&Nn(p.arguments[0])){for(let f of p.arguments.slice(1))d(f);return}c.forEachChild(p,u)};return u(e),{sources:i,residual:a}}function As(e){let n=new Set,t=o=>{let i=o;for(;c.isPropertyAccessExpression(i)||c.isElementAccessExpression(i);)i=i.expression;return c.isIdentifier(i)?i.text:void 0},r=o=>{let i=_s(o);if(i!==void 0){let a=t(i);a!==void 0&&n.add(a)}c.forEachChild(o,r)};return r(e),n}function _s(e){return c.isBinaryExpression(e)&&e.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=c.SyntaxKind.LastAssignment&&(c.isPropertyAccessExpression(e.left)||c.isElementAccessExpression(e.left))?e.left:void 0}function Bt(e){if(c.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)c.isBindingElement(t)&&n.push(...Bt(t.name));return n}function Pe(e){if(c.isIdentifier(e))return[e.text];if(c.isParenthesizedExpression(e)||c.isAsExpression(e)||c.isNonNullExpression(e)||c.isSatisfiesExpression(e)||c.isTypeAssertionExpression(e)||c.isAwaitExpression(e))return Pe(e.expression);if(c.isYieldExpression(e))return e.expression!==void 0?Pe(e.expression):[];if(c.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===c.SyntaxKind.BarBarToken||n===c.SyntaxKind.AmpersandAmpersandToken||n===c.SyntaxKind.QuestionQuestionToken?[...Pe(e.left),...Pe(e.right)]:n===c.SyntaxKind.CommaToken?Pe(e.right):[]}return c.isConditionalExpression(e)?[...Pe(e.whenTrue),...Pe(e.whenFalse)]:c.isArrayLiteralExpression(e)?e.elements.flatMap(n=>c.isSpreadElement(n)?Pe(n.expression):c.isOmittedExpression(n)?[]:Pe(n)):c.isObjectLiteralExpression(e)?e.properties.flatMap(n=>c.isShorthandPropertyAssignment(n)?[n.name.text]:c.isPropertyAssignment(n)?Pe(n.initializer):c.isSpreadAssignment(n)?Pe(n.expression):[]):[]}function Ns(e,n){let t=[],r=(l,s)=>{for(let d of l)for(let u of s)d!==u&&t.push({a:d,b:u})},o=l=>c.isIdentifier(l)?[l.text]:c.isArrayLiteralExpression(l)?l.elements.flatMap(o):c.isObjectLiteralExpression(l)?l.properties.flatMap(s=>c.isShorthandPropertyAssignment(s)?[s.name.text]:c.isPropertyAssignment(s)?o(s.initializer):[]):[],i=l=>{c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken?r(o(l.left),Pe(l.right)):c.isVariableDeclaration(l)&&l.initializer!==void 0?r(Bt(l.name),Pe(l.initializer)):(c.isForOfStatement(l)||c.isForInStatement(l))&&c.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&r(Bt(l.initializer.declarations[0].name),Pe(l.expression)),c.forEachChild(l,i)};i(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:s,b:d}of t)a.has(s)&&!a.has(d)&&(a.add(d),l=!0),a.has(d)&&!a.has(s)&&(a.add(s),l=!0)}return a}function Rs(e,n){let t=l=>{if(!c.isPropertyAccessExpression(l)&&!c.isElementAccessExpression(l))return;let s=l;for(;c.isPropertyAccessExpression(s)||c.isElementAccessExpression(s);)s=s.expression;return c.isIdentifier(s)?s.text:void 0},r=[],o=(l,s)=>{for(let u of Pe(s))r.push({name:l,root:u});let d=t(s);d!==void 0&&r.push({name:l,root:d})},i=l=>{c.isVariableDeclaration(l)&&c.isIdentifier(l.name)&&l.initializer!==void 0?o(l.name.text,l.initializer):c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(l.left)&&o(l.left.text,l.right),c.forEachChild(l,i)};i(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:s,root:d}of r){let u=a.get(d);u!==void 0&&!a.has(s)&&(a.set(s,u),l=!0)}}return a}function Cs(e){return Ns(e,As(e))}function Pu(e,n){let t=s=>s>=c.SyntaxKind.FirstAssignment&&s<=c.SyntaxKind.LastAssignment,r=s=>{let d=s.parent;if(d===void 0||!c.isObjectLiteralExpression(d))return!1;let u=d.parent;return u!==void 0&&c.isBinaryExpression(u)&&u.operatorToken.kind===c.SyntaxKind.EqualsToken&&u.right===d&&qe(u.left)?!0:u!==void 0&&c.isCallExpression(u)&&zn(u)&&u.arguments[0]!==void 0&&Nn(u.arguments[0])&&u.arguments.indexOf(d)>0},o=(s,d)=>{if((c.isFunctionDeclaration(d)||c.isFunctionExpression(d))&&d.name===s||c.isVariableDeclaration(d)&&d.name===s||c.isParameter(d)&&d.name===s||c.isBindingElement(d)&&d.name===s||(c.isCallExpression(d)||c.isNewExpression(d))&&d.expression===s)return!0;if((c.isPropertyAccessExpression(d)||c.isElementAccessExpression(d))&&d.expression===s){let u=d;for(;u.parent!==void 0&&(c.isPropertyAccessExpression(u.parent)||c.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let p=u.parent;return!(p!==void 0&&c.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===u)}return c.isBinaryExpression(d)&&d.operatorToken.kind===c.SyntaxKind.EqualsToken&&d.right===s&&qe(d.left)?!0:c.isShorthandPropertyAssignment(d)&&d.name===s||c.isPropertyAssignment(d)&&d.initializer===s?r(d):!!(c.isExportAssignment(d)&&d.expression===s||c.isExportSpecifier(d))},i=(s,d)=>c.isPropertyAccessExpression(d)&&d.name===s||c.isPropertyAssignment(d)&&d.name===s||(c.isMethodDeclaration(d)||c.isGetAccessorDeclaration(d)||c.isSetAccessorDeclaration(d))&&d.name===s,a=!1,l=(s,d)=>{if(!a){if(c.isIdentifier(s)&&d!==void 0&&n.has(s.text)&&!i(s,d)&&!o(s,d)){a=!0;return}c.forEachChild(s,u=>l(u,s))}};return l(e,void 0),a}function $u(e){let n=new Set;for(let s of e.statements)if(c.isFunctionDeclaration(s)&&s.name!==void 0)n.add(s.name.text);else if(c.isVariableStatement(s))for(let d of s.declarationList.declarations)c.isIdentifier(d.name)&&d.initializer!==void 0&&(c.isFunctionExpression(d.initializer)||c.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,r=s=>{c.isBinaryExpression(s)&&s.operatorToken.kind===c.SyntaxKind.EqualsToken?($e(s.left)&&(c.isIdentifier(s.right)?t.add(s.right.text):c.isObjectLiteralExpression(s.right)&&Es(s.right,t)),$e(s.right)&&c.isIdentifier(s.left)&&t.add(s.left.text)):c.isVariableDeclaration(s)&&c.isIdentifier(s.name)&&s.initializer!==void 0&&$e(s.initializer)&&t.add(s.name.text),c.forEachChild(s,r)};if(r(e),t.size>0){if(Pu(e,t))return!0;let s=Rs(e,new Map([...t].map(u=>[u,u]))),d=Cs(e);for(let u of s.keys())if(d.has(u))return!0}let o=s=>c.isIdentifier(s)&&n.has(s.text),i=s=>s.properties.every(d=>c.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||c.isPropertyAssignment(d)&&o(d.initializer)),a=!1,l=s=>{if(!a){if(c.isBinaryExpression(s)){let d=s.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&s.operatorToken.kind<=c.SyntaxKind.LastAssignment;d&&$e(s.left)?s.operatorToken.kind===c.SyntaxKind.EqualsToken&&(o(s.right)||c.isObjectLiteralExpression(s.right)&&i(s.right))||(a=!0):d&&qe(s.left)&&(a=!0)}else c.isCallExpression(s)?(zn(s)&&s.arguments[0]!==void 0&&Nn(s.arguments[0])||Xr(s))&&(a=!0):(c.isExportAssignment(s)&&s.isExportEquals&&!c.isIdentifier(s.expression)||c.isExportDeclaration(s)&&s.moduleSpecifier!==void 0)&&(a=!0);a||c.forEachChild(s,l)}};return l(e),a}var Mu=8;function gs(e,n,t){let r=new Set,o=vs(e,n,t,Kn(e)),i=Is(e,n,t,o,ks(e));for(let{source:a}of i.sources)r.add(a.target);for(let a of e.statements)if(c.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&c.isStringLiteralLike(a.moduleSpecifier)&&ye(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&r.add(l)}return r}function Du(e,n,t,r=new Map){let o=new Set(n.modules.filter(k=>k.isEntrypoint).map(k=>String(k.id)));if(o.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let i=new Set(n.modules.filter(k=>k.externalSurface===!0).map(k=>String(k.id))),a=new Map,l=new Map,s=new Map,d=new Map;for(let k of t){if(k.name==="<toplevel>"){d.set(String(k.moduleId),k);continue}if(a.set(`${String(k.moduleId)}::${String(k.declRange.start)}`,k),k.name!==void 0&&l.set(`${String(k.moduleId)}::${k.name}`,k),k.isExported&&k.name!==void 0){let m=s.get(String(k.moduleId))??[];m.push(k),s.set(String(k.moduleId),m)}}if(r.size>0){let k=new Map(t.map(m=>[String(m.id),m]));for(let[m,y]of r){let A=k.get(String(y));A!==void 0&&!a.has(m)&&a.set(m,A)}}let u=new Map;for(let k of n.imports)k.resolvedModuleId!==void 0&&u.set(`${k.moduleId}::${k.specifier}`,String(k.resolvedModuleId));let p=new Map;for(let k of e.sourceFiles){let m=e.toRel(k.fileName);m!==null&&p.set(m,k)}let f=new Map,h=k=>{let m=f.get(k);if(m!==void 0)return m;let y=p.get(k),A=y===void 0?!0:$u(y);return f.set(k,A),A},g=new Set,S=(k,m)=>m!==void 0&&ye(m)==="relative"?u.get(`${k}::${m}`):void 0,E=k=>{if(c.isIdentifier(k))return k.text;if(c.isPropertyAccessExpression(k)){let m=E(k.expression);return m===void 0?void 0:`${m}.${k.name.text}`}if(c.isElementAccessExpression(k)&&c.isStringLiteralLike(k.argumentExpression)){let m=E(k.expression);return m===void 0?void 0:`${m}.${k.argumentExpression.text}`}},w=k=>{let m=k;for(;c.isPropertyAccessExpression(m)||c.isElementAccessExpression(m);)m=m.expression;return nn(m)};for(let k of e.sourceFiles){let m=e.toRel(k.fileName);if(m===null)continue;let y=new Map,A=new Map,C=(R,F)=>{let O=S(m,nn(F));if(O!==void 0){if(c.isIdentifier(R))A.set(R.text,O),y.set(R.text,O);else if(c.isObjectBindingPattern(R)||c.isArrayBindingPattern(R))for(let L of Bt(R))A.set(L,O);else if(c.isPropertyAccessExpression(R)||c.isElementAccessExpression(R)){let L=E(R);L!==void 0&&y.set(L,O)}}},T=R=>{c.isVariableDeclaration(R)&&R.initializer!==void 0?C(R.name,R.initializer):c.isBinaryExpression(R)&&R.operatorToken.kind===c.SyntaxKind.EqualsToken&&C(R.left,R.right),c.forEachChild(R,T)};T(k);let P=R=>{let F=_s(R);if(F!==void 0){let O=F.expression,L=S(m,w(O));L!==void 0&&g.add(L);let K=E(O),G=K!==void 0?y.get(K):void 0;G!==void 0&&g.add(G)}c.forEachChild(R,P)};if(P(k),A.size>0){let R=Rs(k,A),F=Cs(k);for(let[O,L]of R)F.has(O)&&g.add(L)}}let I=[],v=[],_=[];for(let k of e.sourceFiles){let m=e.toRel(k.fileName);if(m===null||!o.has(m))continue;let y=e.checker.getSymbolAtLocation(k),A=new Set,C=new Set,T=0,P=($,q)=>{if(i.has(String($.moduleId))||A.has(String($.id)))return;A.add(String($.id));let H=`${m}#reexport:${String(T)}:${q}`;T+=1,I.push({id:H,moduleId:m,exportedName:q,kind:"value",reexportOf:{moduleId:String($.moduleId),name:$.name??q}}),v.push({exportId:H,target:{kind:"function",functionId:$.id}})},R=$=>{if(bu($))return;let q=$;if(($.flags&c.SymbolFlags.Alias)!==0)try{q=e.checker.getAliasedSymbol($)}catch{return}let H=ku(q,e,a,l,i);if(H!==void 0){P(H,$.getName());return}if((q.flags&c.SymbolFlags.Module)!==0&&!C.has(q)){C.add(q);try{for(let Ee of e.checker.getExportsOfModule(q))R(Ee)}catch{}}};if(y!==void 0)for(let $ of e.checker.getExportsOfModule(y))R($);let F=vs(k,m,u,Kn(k)),O=Is(k,m,u,F,ks(k)),L=new Set,K=O.residual,G=$=>{let q=p.get($);$.includes("node_modules/")||q===void 0||xu(q)?K=!0:L.add($)};for(let{source:$,exportedName:q}of O.sources){let H=s.get($.target)??[],Ee=g.has($.target);if($.kind==="whole"){for(let he of H)P(he,he.name??q);Ee?K=!0:(H.length===0||h($.target))&&G($.target)}else{let he=H.filter(ve=>ve.name===$.member);for(let ve of he)P(ve,q);Ee?K=!0:(he.length===0||h($.target))&&G($.target)}}let B=new Set,W=[];for(let $ of gs(k,m,u))W.push({target:$,depth:1});for(;W.length>0;){let $=W.shift();if($===void 0)break;let{target:q,depth:H}=$;if(B.has(q)||H>Mu||(B.add(q),q.split("/").includes("node_modules")))continue;let Ee=p.get(q);if(Ee===void 0)continue;let he=d.get(q);he!==void 0&&!h(q)&&P(he,"<load>");for(let ve of gs(Ee,q,u))B.has(ve)||W.push({target:ve,depth:H+1})}Au(k,Kn(k))&&(K=!0);for(let $ of L)_.push({code:"unresolved-reexport",path:m,detail:`entrypoint whole/member re-exports app-owned relative module ${$} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:$});K&&_.push({code:"unresolved-reexport",path:m,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:I,exportBindings:v,diagnostics:_}}var Bn=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),Tu=new Set(["defineProperty","defineProperties","create"]);function Lu(e){let n=!0,t=o=>c.isIdentifier(o)||c.isStringLiteral(o)||c.isNumericLiteral(o)?Bn.has(o.text):c.isComputedPropertyName(o)&&c.isStringLiteralLike(o.expression)?Bn.has(o.expression.text):!1,r=o=>{if(n){if(c.isNewExpression(o)||c.isForOfStatement(o)||c.isSpreadElement(o)||c.isSpreadAssignment(o)||c.isArrayBindingPattern(o)||c.isGetAccessorDeclaration(o)||c.isSetAccessorDeclaration(o)||c.isYieldExpression(o)&&o.asteriskToken!==void 0||c.canHaveDecorators(o)&&(c.getDecorators(o)?.length??0)>0){n=!1;return}if((c.isPropertyAccessExpression(o)||c.isMethodDeclaration(o)||c.isPropertyAssignment(o))&&t(o.name)||c.isPropertyDeclaration(o)&&t(o.name)||c.isShorthandPropertyAssignment(o)&&t(o.name)||c.isBindingElement(o)&&t(o.propertyName??o.name)||c.isElementAccessExpression(o)&&c.isStringLiteralLike(o.argumentExpression)&&Bn.has(o.argumentExpression.text)){n=!1;return}if(c.isCallExpression(o)&&c.isPropertyAccessExpression(o.expression)&&c.isIdentifier(o.expression.expression)&&o.expression.expression.text==="Object"&&Tu.has(o.expression.name.text)){n=!1;return}c.forEachChild(o,r)}};return r(e),n}function Vt(e){if(c.isIdentifier(e)||c.isStringLiteral(e)||c.isNumericLiteral(e))return e.text}function Os(e){let n=t=>c.canHaveDecorators(t)&&(c.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function Fu(e){let n=!1,t=new Set,r=[],o=new Map,i=(f,h)=>{let g=o.get(f);g===void 0?o.set(f,[h]):g.push(h)},a=f=>{c.isIdentifier(f)?t.add(f.text):r.push(f)},l=f=>{for(let h of f.properties)c.isShorthandPropertyAssignment(h)?t.add(h.name.text):c.isPropertyAssignment(h)?r.push(h.initializer):n=!0},s=f=>{if(c.isBinaryExpression(f)&&f.operatorToken.kind===c.SyntaxKind.EqualsToken){let h=f.left,g=f.right;$e(h)?c.isObjectLiteralExpression(g)?l(g):c.isIdentifier(g)||c.isFunctionExpression(g)||c.isArrowFunction(g)||c.isClassExpression(g)?a(g):n=!0:qe(h)?(c.isElementAccessExpression(h)&&!c.isStringLiteralLike(h.argumentExpression)&&(n=!0),a(g)):c.isIdentifier(h)?i(h.text,g):(c.isPropertyAccessExpression(h)||c.isElementAccessExpression(h))&&c.isIdentifier(h.expression)&&i(h.expression.text,g)}else if(c.isCallExpression(f))(zn(f)&&f.arguments[0]!==void 0&&Nn(f.arguments[0])||Xr(f))&&(n=!0);else if(c.isVariableDeclaration(f)&&c.isIdentifier(f.name)&&f.initializer!==void 0)i(f.name.text,f.initializer);else if((c.isFunctionDeclaration(f)||c.isClassDeclaration(f))&&f.name!==void 0)i(f.name.text,f),_n(f)&&t.add(f.name.text);else if(c.isExportDeclaration(f)){if(f.exportClause===void 0)n=!0;else if(f.moduleSpecifier===void 0&&c.isNamedExports(f.exportClause))for(let h of f.exportClause.elements)t.add((h.propertyName??h.name).text)}else if(c.isExportAssignment(f))f.isExportEquals&&!c.isIdentifier(f.expression)?n=!0:a(f.expression);else if(c.isVariableStatement(f)&&_n(f))for(let h of f.declarationList.declarations)c.isIdentifier(h.name)&&t.add(h.name.text);c.forEachChild(f,s)};s(e);let d=new Set,u=[...t],p=f=>{let h=g=>{c.isIdentifier(g)&&u.push(g.text),c.forEachChild(g,h)};h(f)};for(let f of r)p(f);for(;u.length>0;){let f=u.pop();if(!(f===void 0||d.has(f))){d.add(f);for(let h of o.get(f)??[])p(h)}}return{names:d,opaque:n}}var ju=512,Ku=new Set(["get","post","put","patch","delete","options","head"]);function Bu(e){for(let n of e.statements){if(c.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(n.expression.left)&&c.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,r=n.expression.left.name.text;if(t==="module"&&r==="exports"||t==="exports"&&r==="default")return n.expression.right}}return null}function zu(e){let n=new Map,t=Bu(e);if(t===null)return n;let r=i=>{for(let a of i.properties)if(c.isPropertyAssignment(a)&&c.isObjectLiteralExpression(a.initializer)){let l=Vt(a.name);l!==void 0&&n.set(l,a.initializer)}};if(c.isObjectLiteralExpression(t))return r(t),n;if(!c.isIdentifier(t))return n;let o=t.text;for(let i of e.statements)if(c.isVariableStatement(i))for(let a of i.declarationList.declarations)c.isIdentifier(a.name)&&a.name.text===o&&a.initializer!==void 0&&c.isObjectLiteralExpression(a.initializer)&&r(a.initializer);else if(c.isExpressionStatement(i)&&c.isBinaryExpression(i.expression)&&i.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(i.expression.left)&&c.isIdentifier(i.expression.left.expression)&&i.expression.left.expression.text===o&&c.isObjectLiteralExpression(i.expression.right)){let a=i.expression.left.name.text;n.set(a,i.expression.right)}return n}function Uu(e){for(let n of e.properties){if(c.isMethodDeclaration(n)&&c.isIdentifier(n.name)&&n.name.text==="handler")return n;if(c.isPropertyAssignment(n)&&c.isIdentifier(n.name)&&n.name.text==="handler"&&(c.isArrowFunction(n.initializer)||c.isFunctionExpression(n.initializer)))return n.initializer}return null}function Vu(e,n){for(let r of e.properties){let o;if(c.isPropertyAssignment(r)||c.isMethodDeclaration(r)?o=Vt(r.name):c.isShorthandPropertyAssignment(r)&&(o=r.name.text),o==="method"||o==="url"||o==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Wu(e,n){let t=[],r=new Set,o=(l,s,d)=>{if(t.length>=ju||l==="__proto__"||!Yr.test(l))return;let u=`${e}#handler:${l}`;r.has(u)||(r.add(u),t.push({id:u,node:s,memberPath:l,idiom:d}))};for(let[l,s]of zu(n)){let d=Uu(s);d!==null&&Vu(s,d)&&o(l,d,"descriptor-object")}let i=0,a=l=>{if(c.isCallExpression(l)&&c.isPropertyAccessExpression(l.expression)&&c.isIdentifier(l.expression.expression)&&Ku.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&c.isStringLiteralLike(l.arguments[0])){let s=l.expression.name.text;for(let d=1;d<l.arguments.length;d+=1){let u=l.arguments[d];u!==void 0&&(c.isArrowFunction(u)||c.isFunctionExpression(u))&&o(`${s}_${String(i)}_${String(d)}`,u,"router-verb")}i+=1}c.forEachChild(l,a)};return a(n),t}function qu(e,n,t,r,o,i){let a=`${e}#class:${t}`,l=[],s=new Set;for(let d of r.members){let u,p,f;if(c.isConstructorDeclaration(d))u="constructor",p="ctor",f=!1;else if(c.isMethodDeclaration(d))u=Vt(d.name),p="method",f=u!==void 0&&!Bn.has(u);else continue;if(u===void 0||s.has(u))continue;s.add(u);let h=`${e}#${t}.${u}`;o.push({id:h,moduleId:e,name:u,kind:p,enclosingClassId:a,declRange:gn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),l.push(h),f&&i.push({start:d.getStart(n,!1),end:d.getEnd(),id:h})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function Gu(e,n,t=[],r=!1,o){let i=[],a=new Map,l=[],{reachableLocals:s,defaultTarget:d}=gu(n),u=Kn(n),p=`${e}#<toplevel>`;i.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let f=(m,y)=>{let A=`${e}#${m}`;return i.push({id:A,moduleId:e,name:m,kind:"function",declRange:gn(e,y,n),isExported:s.has(m),publicSurfaceReachable:s.has(m)}),a.set(m,{kind:"function",functionId:A}),l.push({start:y.getStart(n,!1),end:y.getEnd(),id:A}),A},h=[],g=!e.split("/").includes("node_modules");if(g)for(let m of Iu(n,u))s.add(m);let S=g?Fu(n):void 0,E=(m,y,A)=>{S===void 0||S.opaque||S.names.has(m)||_n(A)||Os(y)||h.push(qu(e,n,m,y,i,l))};for(let m of n.statements)if(c.isFunctionDeclaration(m)&&m.name!==void 0)f(m.name.text,m);else if(c.isClassDeclaration(m)&&m.name!==void 0)E(m.name.text,m,m);else if(c.isVariableStatement(m))for(let y of m.declarationList.declarations){if(c.isObjectBindingPattern(y.name)&&y.initializer!==void 0&&c.isCallExpression(y.initializer)&&c.isIdentifier(y.initializer.expression)&&y.initializer.expression.text==="require"&&y.initializer.arguments.length===1&&y.initializer.arguments[0]!==void 0&&c.isStringLiteralLike(y.initializer.arguments[0])){let C=y.initializer.arguments[0].text;for(let T of y.name.elements){if(T.dotDotDotToken!==void 0||T.initializer!==void 0||!c.isIdentifier(T.name))continue;let P=T.propertyName??T.name;!c.isIdentifier(P)&&!c.isStringLiteralLike(P)||a.set(T.name.text,{kind:"import",specifier:C,form:{named:P.text}})}continue}if(!c.isIdentifier(y.name)||y.initializer===void 0)continue;let A=y.initializer;if(c.isFunctionExpression(A)||c.isArrowFunction(A))f(y.name.text,y);else if(c.isClassExpression(A))E(y.name.text,A,m);else if(c.isCallExpression(A)&&c.isIdentifier(A.expression)&&A.expression.text==="require"&&A.arguments.length===1&&A.arguments[0]!==void 0&&c.isStringLiteralLike(A.arguments[0]))a.set(y.name.text,{kind:"import",specifier:A.arguments[0].text,form:"whole"});else if((c.isPropertyAccessExpression(A)||c.isElementAccessExpression(A))&&Ut(A)==="default"&&c.isCallExpression(A.expression)){let C=nn(A.expression);C!==void 0&&a.set(y.name.text,{kind:"import",specifier:C,form:"require-default"})}}else if(c.isImportDeclaration(m)&&c.isStringLiteralLike(m.moduleSpecifier)){let y=m.moduleSpecifier.text,A=m.importClause;if(A!==void 0){A.name!==void 0&&a.set(A.name.text,{kind:"import",specifier:y,form:"default"});let C=A.namedBindings;if(C!==void 0&&c.isNamespaceImport(C))a.set(C.name.text,{kind:"import",specifier:y,form:"namespace"});else if(C!==void 0&&c.isNamedImports(C))for(let T of C.elements){let P=(T.propertyName??T.name).text;a.set(T.name.text,{kind:"import",specifier:y,form:{named:P}})}}}else c.isImportEqualsDeclaration(m)&&c.isExternalModuleReference(m.moduleReference)&&c.isStringLiteralLike(m.moduleReference.expression)&&a.set(m.name.text,{kind:"import",specifier:m.moduleReference.expression.text,form:"whole"});let w=new Map,I,v=new Map,_=new Map;if(g)for(let{name:m,value:y}of vu(n)){let A=`${e}#member-export:${m}`;i.push({id:A,moduleId:e,name:m,kind:c.isArrowFunction(y)?"arrow":"function",declRange:gn(e,y,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:y.getStart(n,!1),end:y.getEnd(),id:A}),w.set(y.getStart(n,!1),A)}if(r&&g){let m=P=>{let R=De(P);return c.isFunctionExpression(R)||c.isArrowFunction(R)?R:void 0},y=(P,R)=>{let F=P;return i.push({id:F,moduleId:e,kind:c.isArrowFunction(R)?"arrow":"function",declRange:gn(e,R,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:R.getStart(n,!1),end:R.getEnd(),id:F}),w.set(R.getStart(n,!1),F),F},A=[],C=[],T=[];for(let P of n.statements)c.isExportAssignment(P)&&!P.isExportEquals?A.push(P):c.isFunctionDeclaration(P)&&c.getModifiers(P)?.some(R=>R.kind===c.SyntaxKind.DefaultKeyword)===!0?C.push(P):c.isExpressionStatement(P)&&c.isBinaryExpression(P.expression)&&P.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&$e(P.expression.left)&&T.push(P.expression);if(A.length+C.length+T.length===1){let P=A[0],R=C[0],F=T[0];if(P!==void 0){let O=m(P.expression);if(O!==void 0){let L=y(`${e}#<default>`,O);I={id:L,esm:!0},_.set(P.getStart(n,!1),L),le(o,"2a-default",null)}}else if(R!==void 0&&R.name===void 0&&R.body!==void 0){let O=y(`${e}#<default>`,R);I={id:O,esm:!0},_.set(R.getStart(n,!1),O),le(o,"2a-default",null)}else if(F!==void 0){let O=m(F.right);if(O!==void 0){let L=y(`${e}#<default>`,O);I={id:L,esm:!1},_.set(F.getStart(n,!1),L),le(o,"2a-default",null)}else if(c.isObjectLiteralExpression(F.right)){let L=F.right,K=[],G=!0;for(let B of L.properties){if(c.isSpreadAssignment(B)){G=!1;break}let W=B.name,$=W===void 0?void 0:Gr(W);if($===void 0){G=!1;break}K.push($)}if(G){let B=new Map;for(let W of K)B.set(W,(B.get(W)??0)+1);for(let W of L.properties){if(!c.isPropertyAssignment(W))continue;let $=Gr(W.name),q=m(W.initializer);if($!==void 0){if(!Eu($)){q!==void 0&&le(o,"2a-member","charset-refused");continue}if((B.get($)??0)!==1){q!==void 0&&le(o,"2a-member","duplicate-key");continue}if(q!==void 0){let H=y(`${e}#<cjs>.${$}`,q);v.set($,H),_.set(W.getStart(n,!1),H),le(o,"2a-member",null)}}}}else for(let B of L.properties)c.isPropertyAssignment(B)&&m(B.initializer)!==void 0&&le(o,"2a-member","spread-or-computed-literal")}}}else{for(let P of A)m(P.expression)!==void 0&&le(o,"2a-default","duplicate-default-sources");for(let P of C)P.name===void 0&&le(o,"2a-default","duplicate-default-sources");for(let P of T)if(m(P.right)!==void 0)le(o,"2a-default","duplicate-default-sources");else if(c.isObjectLiteralExpression(P.right))for(let R of P.right.properties)c.isPropertyAssignment(R)&&m(R.initializer)!==void 0&&le(o,"2a-member","duplicate-default-sources")}}for(let m of t)i.push({id:m.id,moduleId:e,name:`handler:${m.memberPath}`,kind:c.isArrowFunction(m.node)?"arrow":"function",declRange:gn(e,m.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:m.node.getStart(n,!1),end:m.node.getEnd(),id:m.id});l.sort((m,y)=>m.end-m.start-(y.end-y.start));let k=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:i,bindings:a,exportedFunctionId:k,exportedNames:s,tainted:u,fnRanges:l,toplevelId:p,classes:h,mintedByPos:w,mintedDefault:I,mintedMembers:v,mintSeedAliases:_}}function Hu(e){return c.isIdentifier(e)?"identifier":c.isPropertyAccessExpression(e)?"member":c.isElementAccessExpression(e)?"computed-member":e.kind===c.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function ys(e,n){let t=r=>{if(c.isBinaryExpression(r)&&r.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=c.SyntaxKind.LastAssignment){let o=r.left;c.isPropertyAccessExpression(o)&&c.isIdentifier(o.expression)?n(o.expression.text,o.name.text):c.isElementAccessExpression(o)&&c.isIdentifier(o.expression)&&n(o.expression.text,c.isStringLiteralLike(o.argumentExpression)?o.argumentExpression.text:null)}else if(c.isCallExpression(r)&&c.isPropertyAccessExpression(r.expression)){let o=r.expression,i=r.arguments[0];c.isIdentifier(o.expression)&&i!==void 0&&c.isIdentifier(i)&&(o.expression.text==="Object"&&(o.name.text==="assign"||o.name.text==="defineProperty"||o.name.text==="defineProperties")||o.expression.text==="Reflect"&&o.name.text==="defineProperty")&&n(i.text,null)}c.forEachChild(r,t)};t(e)}function Xu(e){let n=!1,t=r=>{if(!n){if(c.isVariableDeclaration(r)||c.isParameter(r)){let o=new Set;if(nt(r.name,o),o.has("require")){n=!0;return}}else if((c.isFunctionDeclaration(r)||c.isClassDeclaration(r))&&r.name!==void 0&&r.name.text==="require"){n=!0;return}c.forEachChild(r,t)}};return t(e),n}function Yu(e,n,t,r=new Map,o={}){let i=o.additiveForms===!0,a=o.namelessExports===!0,l=i||a?{}:void 0,s=new Map,d=new Map;for(let m of n.imports)m.resolvedModuleId!==void 0&&d.set(`${m.moduleId}::${m.specifier}`,m.resolvedModuleId);for(let m of e.sourceFiles){let y=e.toRel(m.fileName);y!==null&&s.set(y,Gu(y,m,r.get(y)??[],a,l))}let u=new Map;if(i)for(let m of s.values()){let y=new Map;for(let[A,C]of m.bindings)if(C.kind==="import"&&C.form==="whole"&&ye(C.specifier)!=="package-root"){let T=d.get(`${m.rel}::${C.specifier}`);T!==void 0&&y.set(A,String(T))}y.size!==0&&ys(m.sf,(A,C)=>{let T=y.get(A);if(T===void 0)return;let P=u.get(T);if(P!=="*"){if(C===null){u.set(T,"*");return}P===void 0?u.set(T,new Set([C])):P.add(C)}})}let p=new Map;for(let m of s.values())m.exportedFunctionId!==void 0&&p.set(m.rel,m.exportedFunctionId);let f=new Map;for(let m of s.values()){if(m.rel.split("/").includes("node_modules"))continue;let y=yu(m.sf);if(y===void 0){a&&m.mintedDefault!==void 0&&f.set(m.rel,m.mintedDefault);continue}let A=m.bindings.get(y.name);A?.kind==="function"&&f.set(m.rel,{id:A.functionId,esm:y.esm})}let h=new Map;for(let m of s.values()){let y;for(let A of m.exportedNames){let C=m.bindings.get(A);C?.kind==="function"&&(y??=new Map,y.set(A,C.functionId))}y!==void 0&&h.set(m.rel,y)}let g=new Map;for(let m of s.values()){if(m.rel.split("/").includes("node_modules"))continue;let y=Cu(m.sf,m.tainted,A=>{let C=m.bindings.get(A);return C?.kind==="function"?C.functionId:void 0},a?A=>{let C=De(A);return c.isFunctionExpression(C)||c.isArrowFunction(C)?m.mintedByPos.get(C.getStart(m.sf,!1)):void 0}:void 0);y.size>0&&g.set(m.rel,y)}let S=[],E=[],w=[],I=[],v=[],_=[];for(let m of s.values()){S.push(...m.functions),_.push(...m.classes);for(let x of m.exportedNames){let N=m.bindings.get(x);if(N?.kind==="function"){let D=`${m.rel}#export:${x}`;I.push({id:D,moduleId:m.rel,exportedName:x,kind:"value"}),v.push({exportId:D,target:{kind:"function",functionId:N.functionId}})}}if(a){if(m.mintedDefault!==void 0){let x=`${m.rel}#export:<default>`;I.push({id:x,moduleId:m.rel,exportedName:"default",kind:"value"}),v.push({exportId:x,target:{kind:"function",functionId:m.mintedDefault.id}})}for(let[x,N]of m.mintedMembers){let D=`${m.rel}#export:<cjs>.${x}`;I.push({id:D,moduleId:m.rel,exportedName:x,kind:"value"}),v.push({exportId:D,target:{kind:"function",functionId:N}})}}let y=new Map;for(let[x,N]of m.bindings){if(N.kind==="function"){y.set(x,N);continue}if(ye(N.specifier)==="package-root"){let j=je(N.specifier);typeof N.form=="object"?y.set(x,{kind:"package-export",packageName:j,exportName:N.form.named}):N.form==="require-default"?y.set(x,{kind:"package-default",packageName:j}):y.set(x,{kind:"package-surface",packageName:j})}else{let j=d.get(`${m.rel}::${N.specifier}`);if(j!==void 0&&typeof N.form=="object"){let Y=h.get(String(j))?.get(N.form.named);Y!==void 0&&y.set(x,{kind:"app-named-fn",functionId:Y})}else if(j!==void 0&&N.form==="require-default"){let Y=f.get(String(j));Y!==void 0&&Y.esm&&y.set(x,{kind:"app-default-fn",functionId:Y.id})}else j!==void 0&&typeof N.form!="object"&&N.form!=="require-default"&&y.set(x,{kind:"module",resolvedModuleId:j})}}let A=new Map;for(let x of m.functions){if(x.enclosingClassId===void 0||x.name===void 0)continue;let N=A.get(x.enclosingClassId);N===void 0&&(N=new Map,A.set(x.enclosingClassId,N)),N.set(x.name,x.id)}for(let x of m.classes)x.name===void 0||m.tainted.has(x.name)||y.has(x.name)||y.set(x.name,{kind:"app-class",cls:{classId:x.id,className:x.name,memberIds:A.get(x.id)??new Map}});let C=x=>{if(c.isVariableDeclaration(x)&&c.isIdentifier(x.name)&&x.initializer!==void 0&&c.isNewExpression(x.initializer)&&!m.tainted.has(x.name.text)&&!y.has(x.name.text)){let N=us(x.initializer,y,m.tainted);N!==null&&y.set(x.name.text,N)}c.forEachChild(x,C)};C(m.sf);let T=x=>{for(let N of m.fnRanges)if(x>=N.start&&x<N.end)return N.id;return m.toplevelId},P=new Map,R=new Map,F=new Map,O=(x,N,D)=>{if(D===null){x.set(N,"*");return}let j=x.get(N);j!=="*"&&(j===void 0?x.set(N,new Set([D])):j.add(D))},L=(x,N)=>{O(P,x,N);let D=y.get(x);D?.kind==="package-surface"?O(R,D.packageName,N):D?.kind==="module"&&O(F,String(D.resolvedModuleId),N)};ys(m.sf,L);let K=new Map,G=256,B=x=>{let N=K.get(x);return N===void 0&&(N=K.size>=G?new Set([x]):Ns(m.sf,new Set([x])),K.set(x,N)),N},W=(x,N)=>x==="*"||x!==void 0&&x.has(N),$=(x,N)=>{let D=y.get(x);if(D?.kind==="package-surface"&&W(R.get(D.packageName),N)||D?.kind==="module"&&W(F.get(String(D.resolvedModuleId)),N))return!0;for(let j of B(x))if(W(P.get(j),N))return!0;return!1},q=x=>{if(c.isIdentifier(x)){let N=m.tainted.has(x.text)?void 0:y.get(x.text);return N?.kind==="function"?N.functionId:N?.kind==="module"?p.get(String(N.resolvedModuleId))??null:N?.kind==="package-export"?t.exportFor(N.packageName,N.exportName):null}if(c.isPropertyAccessExpression(x)&&c.isIdentifier(x.expression)){let N=x.expression.text;if($(N,x.name.text))return null;let D=m.tainted.has(N)?void 0:y.get(N);return D?.kind==="package-surface"?t.exportFor(D.packageName,x.name.text):D?.kind==="package-export"?t.methodFor(D.packageName,D.exportName,x.name.text,"method"):D?.kind==="package-instance"?t.methodFor(D.packageName,D.className,x.name.text,"method"):null}return null},H=x=>{for(let N=x.parent;N!==void 0;N=N.parent)if(!c.isArrowFunction(N)){if(c.isFunctionExpression(N)||c.isFunctionDeclaration(N))return null;if(c.isMethodDeclaration(N)||c.isConstructorDeclaration(N)||c.isGetAccessorDeclaration(N)||c.isSetAccessorDeclaration(N)){let D=N.parent;if(!c.isClassLike(D)||D.name===void 0)return null;let j=m.tainted.has(D.name.text)?void 0:y.get(D.name.text);return j?.kind==="app-class"?j.cls:null}}return null},Ee=i&&!m.tainted.has("require")&&!Xu(m.sf),he=x=>{if(c.isIdentifier(x)){let j=m.tainted.has(x.text)?void 0:y.get(x.text);return j?.kind==="package-surface"||j?.kind==="package-default"?t.exportFor(j.packageName,"default"):j?.kind==="app-named-fn"||j?.kind==="app-default-fn"?j.functionId:j?.kind==="module"?f.get(String(j.resolvedModuleId))?.id??null:j?.kind==="member-value"?j.functionId:null}if(!c.isPropertyAccessExpression(x))return null;let N=x.expression;if(i&&c.isCallExpression(De(N))){let j=nn(De(N));if(j!==void 0)if(!Ee)le(l,"2b","require-shadow");else if(ye(j)==="package-root")le(l,"2b","package-root");else{let Y=d.get(`${m.rel}::${j}`);if(Y===void 0)le(l,"2b","unresolved-module");else{let Z=x.name.text,te=u.get(String(Y));if(te==="*"||te!==void 0&&te.has(Z))le(l,"2b","module-mutation-gate");else{let ue=g.get(String(Y))?.get(Z);if(ue!==void 0)return le(l,"2b",null),ue;if(Z==="default"){let de=f.get(String(Y));if(de!==void 0&&de.esm)return le(l,"2b",null),de.id;le(l,"2b","non-esm-default")}else le(l,"2b","unknown-member")}}}return null}let D;if(c.isIdentifier(N)){let j=m.tainted.has(N.text)?void 0:y.get(N.text);if(j?.kind==="app-class"||j?.kind==="app-instance")D=j.cls.memberIds;else if(j?.kind==="object-literal")D=j.obj.members;else if(j?.kind==="module"){let Y=g.get(String(j.resolvedModuleId));Y?.has(x.name.text)===!0&&!$(N.text,x.name.text)&&(D=Y)}}else if(c.isNewExpression(N)){let j=us(N,y,m.tainted);j?.kind==="app-instance"&&(D=j.cls.memberIds)}else N.kind===c.SyntaxKind.ThisKeyword&&(D=H(x)?.memberIds);return D?.get(x.name.text)??null},ve=new Map,Sn=x=>{if(c.isVariableDeclaration(x)&&c.isIdentifier(x.name)&&x.initializer!==void 0&&c.isObjectLiteralExpression(x.initializer)&&!m.tainted.has(x.name.text)&&!y.has(x.name.text)&&!ve.has(x.name.text)){let N=new Map;for(let D of x.initializer.properties)if(c.isPropertyAssignment(D)&&c.isIdentifier(D.name)){let j=q(D.initializer);j!==null&&N.set(D.name.text,j)}ve.set(x.name.text,N)}c.forEachChild(x,Sn)};Sn(m.sf);let Gn=x=>{if(c.isBinaryExpression(x)&&x.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(x.left)&&c.isIdentifier(x.left.expression)&&!m.tainted.has(x.left.expression.text)){let N=ve.get(x.left.expression.text);if(N!==void 0){let D=q(x.right);D!==null&&N.set(x.left.name.text,D)}}c.forEachChild(x,Gn)};Gn(m.sf);for(let[x,N]of ve)y.set(x,{kind:"object-literal",obj:{members:N}});let M=(x,N=0)=>{if(N>ds)return null;let D=De(x);if(c.isCallExpression(D)&&c.isPropertyAccessExpression(D.expression)&&D.expression.name.text==="bind")return M(D.expression.expression,N+1);if(c.isIdentifier(D)){let j=q(D);if(j!==null)return j;let Y=m.tainted.has(D.text)?void 0:y.get(D.text);return Y?.kind==="member-value"?Y.functionId:null}return c.isPropertyAccessExpression(D)?q(D)??he(D):null},J=(x,N=0)=>{if(N>ds)return"depth-cap";let D=De(x);if(c.isCallExpression(D)&&c.isPropertyAccessExpression(D.expression)&&D.expression.name.text==="bind")return J(D.expression.expression,N+1);if(c.isIdentifier(D))return m.tainted.has(D.text)?"tainted-receiver":"unresolved-receiver";if(c.isPropertyAccessExpression(D)&&c.isIdentifier(D.expression)){if(m.tainted.has(D.expression.text))return"tainted-receiver";if($(D.expression.text,D.name.text))return"mutated-member"}return"unresolved-receiver"},oe=x=>{if(c.isVariableDeclaration(x)&&c.isIdentifier(x.name)&&x.initializer!==void 0){let N=De(x.initializer),D=c.isPropertyAccessExpression(N),j=c.isCallExpression(N)&&c.isPropertyAccessExpression(N.expression)&&N.expression.name.text==="bind";if(D||j){let Y=D?"D1":"A2";if(m.tainted.has(x.name.text))le(l,Y,"tainted-alias");else if(y.has(x.name.text))le(l,Y,"already-bound");else{let Z=M(N);Z!==null?(y.set(x.name.text,{kind:"member-value",functionId:Z}),le(l,Y,null)):le(l,Y,J(N))}}}c.forEachChild(x,oe)};i&&oe(m.sf);let ie=0,rn=x=>{let N,D;if(c.isCallExpression(x)){let j=x.expression,Y=c.isIdentifier(j)&&j.text==="require",Z=j.kind===c.SyntaxKind.ImportKeyword;!Y&&!Z&&(N=j,D=x.arguments)}else c.isTaggedTemplateExpression(x)&&(N=x.tag);if(N!==void 0){let j=Hu(N),Y=x.getStart(m.sf,!1),Z=`${m.rel}#call${String(ie)}`;ie+=1;let te="unresolved",ue=[],de=q(N);de!==null&&(te="resolved",ue.push(de)),E.push({id:Z,enclosingFunctionId:T(Y),calleeExprShape:j,resolvedTargetIds:ue,resolution:te,range:gn(m.rel,x,m.sf)});for(let fe of ue)w.push({callSiteId:Z,calleeFunctionId:fe,resolution:te});if(de===null){let fe=he(N);if(fe!==null)w.push({callSiteId:Z,calleeFunctionId:fe,resolution:"field-based"});else if(i&&c.isPropertyAccessExpression(N)&&(N.name.text==="call"||N.name.text==="apply")){let ne=M(N.expression);ne!==null?(w.push({callSiteId:Z,calleeFunctionId:ne,resolution:"field-based"}),le(l,"A3",null)):le(l,"A3",J(N.expression))}}for(let fe of D??[]){let ne=q(fe);if(ne!==null)w.push({callSiteId:Z,calleeFunctionId:ne,resolution:"field-based"});else{let on=he(fe);if(on!==null)w.push({callSiteId:Z,calleeFunctionId:on,resolution:"field-based"});else if(i){let sn=M(fe),Le=De(fe),ce=Le!==fe||c.isCallExpression(Le)&&c.isPropertyAccessExpression(Le.expression)&&Le.expression.name.text==="bind";sn!==null?(w.push({callSiteId:Z,calleeFunctionId:sn,resolution:"field-based"}),ce&&le(l,"A2p",null)):ce&&le(l,"A2p",J(fe))}}}}c.forEachChild(x,rn)};rn(m.sf);for(let x of n.computedLoads.get(m.rel)??[]){let N=x.candidateRels.filter(j=>s.has(j)).map(j=>`${j}#<toplevel>`);if(N.length===0)continue;let D=`${m.rel}#dirload${String(ie)}`;ie+=1,E.push({id:D,enclosingFunctionId:T(x.pos),calleeExprShape:"require",resolvedTargetIds:N,resolution:"field-based",range:{path:m.rel,start:x.pos,end:x.pos}});for(let j of N)w.push({callSiteId:D,calleeFunctionId:j,resolution:"field-based"})}let bn=0;for(let x of r.get(m.rel)??[]){let N=`${m.rel}#handlerseed${String(bn)}`;bn+=1;let D=x.node.getStart(m.sf,!1);E.push({id:N,enclosingFunctionId:m.toplevelId,calleeExprShape:"member",resolvedTargetIds:[x.id],resolution:"field-based",range:{path:m.rel,start:D,end:D}}),w.push({callSiteId:N,calleeFunctionId:x.id,resolution:"field-based"})}}let k=new Map;if(a)for(let m of s.values())for(let[y,A]of m.mintSeedAliases)k.set(`${m.rel}::${String(y)}`,A);return{functions:S,callSites:E,callEdges:w,exports:I,exportBindings:v,classes:_,mintSeedAliases:k,bindingApplicability:l}}function Ju(e,n,t){let r=s=>s.length===0||Te.isAbsolute(s)||s.includes("\\")||/^[a-zA-Z]:/u.test(s)||s.split("/").some(d=>d===".."||d==="");if(r(n)||r(t))return null;let o=e.endsWith(Te.sep)?e:e+Te.sep,i;try{i=ls(Te.resolve(e,n))}catch{return null}if(!i.startsWith(o))return null;let a=i.endsWith(Te.sep)?i:i+Te.sep,l;try{l=ls(Te.resolve(i,t))}catch{return null}return l.startsWith(a)?l:null}function Ps(e,n,t){let r=`${e}#class:${t}`,o=[],i=[],a=[],l=new Set;return{pushMember(s,d,u,p){if(s==="__proto__"||l.has(s))return;l.add(s);let f=`${e}#${t}.${s}`;o.push({id:f,moduleId:e,name:s,kind:u,enclosingClassId:r,declRange:gn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),i.push({name:s,id:f,kind:u,body:p})},finish(){return i.length===0?null:{functions:o,classNode:{id:r,moduleId:e,name:t,implementsRefs:[],members:a},members:i}}}}function Zu(e,n,t,r){if(Os(r)||r.members.length>Hr)return null;let o=Ps(e,n,t);for(let i of r.members){let a,l,s;if(c.isConstructorDeclaration(i))a="constructor",l="ctor",s=void 0;else if(c.isMethodDeclaration(i))a=Vt(i.name),l="method",s=a!==void 0&&!Bn.has(a)?i.body??void 0:void 0;else continue;a!==void 0&&o.pushMember(a,i,l,s)}return o.finish()}function Qu(e,n,t){let r;for(let a of n.statements)if(c.isFunctionDeclaration(a)&&a.name?.text===t){r=a;break}if(r===void 0)return null;let o=[];for(let a of n.statements){if(!c.isExpressionStatement(a))continue;let l=a.expression;if(!c.isBinaryExpression(l)||l.operatorToken.kind!==c.SyntaxKind.EqualsToken)continue;let s=l.left;if(c.isPropertyAccessExpression(s)&&c.isPropertyAccessExpression(s.expression)&&c.isIdentifier(s.expression.expression)&&s.expression.expression.text===t&&s.expression.name.text==="prototype"){let d=s.name.text;c.isFunctionExpression(l.right)?o.push({name:d,fn:l.right,walk:!0}):c.isArrowFunction(l.right)&&o.push({name:d,fn:l.right,walk:!1})}}if(o.length===0||o.length+1>Hr)return null;let i=Ps(e,n,t);i.pushMember("constructor",r,"ctor",void 0);for(let a of o){let l=a.walk&&!Bn.has(a.name)&&c.isFunctionExpression(a.fn)?a.fn.body:void 0;i.pushMember(a.name,a.fn,"method",l)}return i.finish()}function ef(e,n,t){for(let r of n.statements)if(c.isClassDeclaration(r)&&r.name?.text===t)return Zu(e,n,t,r);return Qu(e,n,t)}function nf(e,n,t,r,o){let i={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return i;let a=new Set(t.map(p=>p.packageName)),l=new Set(t.map(p=>p.path)),s=new Set,d=new Set,u=0;for(let p of n){if(!a.has(p.packageName))continue;let f=Ju(e.appRoot,p.packageRootRel,p.sourcePath);if(f===null)continue;let h=e.toRel(f);if(h===null)continue;let g=`${h}#${p.container}`;if(d.has(g)||!s.has(h)&&s.size>=zt)continue;let S=_e(f);if(S===null)continue;let E;try{E=c.createSourceFile(h,S,c.ScriptTarget.Latest,!0,c.ScriptKind.JS)}catch{continue}let w=ef(h,E,p.container);if(w===null)continue;s.add(h),d.add(g);let I=new Map,v=new Map;for(let k of w.members){let m=o.methodFor(p.packageName,p.container,k.name,k.kind);I.set(k.name,m),v.set(m,k.id)}let _=0;for(let k of w.members){if(k.body===void 0)continue;let m=(y,A)=>{if(A&&c.isCallExpression(y)&&c.isPropertyAccessExpression(y.expression)&&y.expression.expression.kind===c.SyntaxKind.ThisKeyword){let P=I.get(y.expression.name.text);if(P!==void 0){let R=`${h}#depclass:${p.container}.${k.name}#c${String(_)}`;_+=1,i.callSites.push({id:R,enclosingFunctionId:k.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:gn(h,y,E)}),i.callEdges.push({callSiteId:R,calleeFunctionId:P,resolution:"field-based"})}}let C=c.isFunctionExpression(y)||c.isFunctionDeclaration(y)||c.isMethodDeclaration(y)||c.isConstructorDeclaration(y)||c.isGetAccessorDeclaration(y)||c.isSetAccessorDeclaration(y)||c.isClassLike(y),T=c.isArrowFunction(y)?A:C?!1:A;c.forEachChild(y,P=>{m(P,T)})};m(k.body,!0)}for(let k of r){let m=v.get(k.calleeFunctionId);m!==void 0&&i.callEdges.push({callSiteId:k.callSiteId,calleeFunctionId:m,resolution:"field-based"})}if(i.functions.push(...w.functions),i.classes.push(w.classNode),!l.has(h)){l.add(h),i.modules.push({id:h,packageName:p.packageName,versionRange:"",path:h,moduleSystem:"cjs",isEntrypoint:!1});let k=o.moduleFor(p.packageName),m=`${String(k)}#depclass${String(u)}`;u+=1,i.imports.push({id:m,moduleId:k,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:h}),i.importEdges.push({importId:m,resolvedModuleId:h})}i.diagnostics.push({code:"dep-class-corridor",path:h,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(w.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return i}function tf(e,n,t,r){let o=new Set(e.modules.filter(s=>s.isEntrypoint).map(s=>s.packageName)),i=new Map(e.functions.map(s=>[s.id,s.moduleId])),a=new Map;for(let s of e.callSites){if(s.resolution!=="unresolved")continue;let d=i.get(s.enclosingFunctionId);d!==void 0&&a.set(d,(a.get(d)??0)+1)}let l=[];for(let s of e.modules){if(s.externalSurface===!0)continue;let d=n.get(s.path);if(d===void 0||t.has(s.path)||o.has(s.packageName)&&r.has(s.path)&&!s.path.split("/").includes("node_modules"))continue;let u=a.get(s.id)??0;if(u===0&&Lu(d))continue;let p=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:s.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:s.id})}return l}function $s(e,n,t=[],r={},o=!1){let i=new Wr,a=fu(e,n,i),l=new Set;for(let _ of a.computedLoads.values())for(let k of _)if(k.seedable)for(let m of k.candidateRels)l.add(m);let s=new Map;for(let _ of e.sourceFiles){let k=e.toRel(_.fileName);if(k===null||!l.has(k)||k.split("/").includes("node_modules"))continue;let m=Wu(k,_);m.length>0&&s.set(k,m)}let d=s.size===0?a.modules:a.modules.map(_=>s.has(_.path)&&!_.isEntrypoint?{..._,isEntrypoint:!0}:_),u={...a,modules:d},p=Yu(e,u,i,s,r),f=Du(e,a,p.functions,p.mintSeedAliases),h=new Set(a.modules.map(_=>_.path)),g=hu(e.depReach,i,h),S=[...u.modules,...g.modules,...i.modules()],E=nf(e,t,S,p.callEdges,i),w=[];if(o){let _="#default",k=new Set;for(let y of p.callEdges){let A=String(y.calleeFunctionId);!A.startsWith("pkg:")||!A.endsWith(_)||k.add(A.slice(4,A.length-_.length))}let m=new Map;for(let y of e.depReach.edges){if(!("surface"in y.from)||"surface"in y.to)continue;let A=y.from.surface;m.set(A,m.has(A)?null:y.to.module)}for(let y of k){let A=m.get(y);if(A==null)continue;let C=pu(Te.join(e.appRoot,A));if(C===null||C==="default")continue;let T=i.exportFor(y,C),P=`pkg:${y}${_}`;for(let R of p.callEdges)String(R.calleeFunctionId)===P&&w.push({callSiteId:R.callSiteId,calleeFunctionId:T,resolution:"field-based"})}}let I={modules:[...u.modules,...g.modules,...E.modules,...i.modules()],exports:[...p.exports,...f.exports],imports:[...a.imports,...g.imports,...E.imports],functions:[...p.functions,...i.functions(),...E.functions],callSites:[...p.callSites,...E.callSites],classes:[...p.classes,...i.classes(),...E.classes],callEdges:[...p.callEdges,...E.callEdges,...w],importEdges:[...a.importEdges,...g.importEdges,...E.importEdges],exportBindings:[...p.exportBindings,...f.exportBindings],inheritEdges:[]},v=new Map;for(let _ of e.sourceFiles){let k=e.toRel(_.fileName);k!==null&&v.set(k,_)}return{graph:I,diagnostics:[...f.diagnostics,...E.diagnostics,...tf(I,v,new Set(e.diagnostics.filter(_=>_.code==="dependency-body").map(_=>_.path)),a.appOwnedPaths)],loadSites:a.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var rf=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,Wt=/^[A-Za-z0-9_$.-]{1,128}$/u;function of(e){return rf.test(e.calleePackage)?Wt.test(e.anchorExport)?Wt.test(e.calleeExport)?e.anchorContainer!==null&&!Wt.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!Wt.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function st(e,n){let t=[],r=[],o=new Map(e.modules.map(d=>[d.id,d])),i=new Map(e.classes.map(d=>[d.id,d.name])),a=(d,u,p)=>e.functions.some(f=>{if(f.name!==u)return!1;let h=o.get(f.moduleId);return h===void 0||h.packageName!==d?!1:(f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null)===p}),l=(d,u,p)=>{for(let f of e.functions){if(f.name!==u)continue;let h=o.get(f.moduleId);if(!(h===void 0||h.packageName!==d||(f.enclosingClassId!==void 0?i.get(f.enclosingClassId)??null:null)!==p))return f.id}return null},s=[...n].sort((d,u)=>d.modelId<u.modelId?-1:d.modelId>u.modelId?1:0);for(let d of s){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=d.edges.map(of).find(h=>h!==null);if(u!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let p=0,f=0;for(let h of d.edges){if(!a(d.packageName,h.anchorExport,h.anchorContainer)){f+=1;continue}r.push({modelId:d.modelId,kind:h.kind,anchor:{packageName:d.packageName,exportName:h.anchorExport,container:h.anchorContainer},callee:{packageName:h.calleePackage,exportName:h.calleeExport,container:h.calleeContainer,realFunctionId:l(h.calleePackage,h.calleeExport,h.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${d.modelId}: ${String(p)} edge(s) lowered, ${String(f)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(f)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:r,notes:t}}}var sf={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function to(e){try{let n=rs(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(l=>l.split(ze.sep).join("/"))),{graph:r,diagnostics:o,loadSites:i,bindingApplicability:a}=$s(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:r,diagnostics:[...n.diagnostics,...o],loadSites:i,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...a!==void 0?{bindingApplicability:a}:{}}}catch(n){return{graph:sf,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Ms(e,n){let t=512,r=(o,i,a)=>{if(!(t<=0||i>12)){if(t-=1,typeof o=="string"){n(o,a);return}if(Array.isArray(o)){for(let l of o)r(l,i+1,a);return}if(o!==null&&typeof o=="object")for(let[l,s]of Object.entries(o))l==="types"||l==="typings"||r(s,i+1,a||l.includes("*"))}};r(e,0,!1)}function Fs(e,n,t,r=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let o;try{o=dn(ze.resolve(e,t))}catch{return null}return o!==e&&!o.startsWith(n)||r&&!en(o)?null:o===e?"":o.slice(n.length).split(ze.sep).join("/")}var af=1024*1024,lf=4096;function Ds(e,n){let t=e.toLowerCase(),r=0;for(;;){let o=t.indexOf(n,r);if(o===-1)return null;let i=o===0?" ":t[o-1],a=o+n.length;for(;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
+`||e[a]==="\r");)a+=1;if(/[a-z0-9_:-]/i.test(i??" ")||e[a]!=="="){r=o+n.length;continue}for(a+=1;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
+`||e[a]==="\r");)a+=1;let l=e[a];if(l==='"'||l==="'"){let d=e.indexOf(l,a+1);return d===-1?null:e.slice(a+1,d)}let s=a;for(;s<e.length&&!/[\s>]/.test(e[s]??"");)s+=1;return e.slice(a,s)}}function df(e){let n=[],t=e.toLowerCase(),r=0;for(;;){let o=t.indexOf("<script",r);if(o===-1)break;let i=t[o+7];if(i!==void 0&&/[a-z0-9-]/.test(i)){r=o+7;continue}let a=e.indexOf(">",o);if(a===-1)break;r=a+1;let l=e.slice(o+7,a);if(l.length>lf)continue;let s=Ds(l,"type");n.push({module:(s??"").trim().toLowerCase()==="module",src:Ds(l,"src")})}return n}function cf(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function uf(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function ff(e){let n=dn(e),t=n.endsWith(ze.sep)?n:n+ze.sep,r=new Set,o=[],i=[],a=[],l=[],s=[],d=!1,u=(O,L,K=!1,G)=>{let B=Fs(n,t,O);return B===null||B.length===0?"unresolved":r.has(B)?"duplicate":(r.add(B),o.push(B),i.push({source:L,specifier:Be(G??(typeof O=="string"?O:"")),entrypoint:B,launch:K}),"added")},p=new Set,f=(O,L,K=!1)=>{let G=u(O,L),B=typeof O=="string"&&O.includes("\\")?u(O.split("\\").join("/"),L,!1,O):"unresolved";if(G!=="unresolved"||B!=="unresolved"||typeof O!="string"||O.trim().length===0||O.endsWith(".d.ts")||O.endsWith(".d.mts")||O.endsWith(".d.cts"))return;if(K&&O.includes("*")){let $=is(n,O),q=!1;if($!==null){for(let H of $.matches)u(H,L,!1,O)!=="unresolved"&&(q=!0);if(!$.truncated&&q)return}l.push({source:L,file:"package.json",detail:`\`${Be(O)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let W=`${L}\0${O}`;p.has(W)||(p.add(W),l.push({source:L,file:"package.json",detail:`\`${Be(O)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},h=[],g=(O,L)=>{a.push({source:O,file:O,detail:L.detail}),h.push({code:L.code,path:O,detail:`${O} ${L.detail}`})},S,E,w,I=null,v=eo(n,t,"package.json",pn);v.kind==="refused"&&g("package.json",v);try{let O=v.kind==="ok"?JSON.parse(v.text):{};if(I=v.kind==="ok"?O:null,f(O.main,"main"),typeof O.bin=="string")f(O.bin,"bin");else if(O.bin!==null&&typeof O.bin=="object")for(let K of Object.values(O.bin))f(K,"bin");Ms(O.exports,(K,G)=>{f(K,"exports",G)}),typeof O.browser=="string"?f(O.browser,"browser"):Ms(O.browser,K=>{u(K,"browser")});let L=O.scripts;if(L!==null&&typeof L=="object"){let K=L;S=K.start,E=K.prestart,w=K.poststart}}catch{}if(o.length===0)try{dn(ze.join(n,"index.js")),u("index.js","index.js fallback")}catch{}let _=(O,L)=>{if(typeof O=="string"&&O.trim().length>0){let K=Ts(O,L,"package.json",u,a,!1)==="used";return K&&(d=!0),K?"resolved":"gapped"}return O===void 0||typeof O=="string"?"absent":(a.push({source:L,file:"package.json",detail:`${L} is not a string; no entry file could be read from it`}),"gapped")},k=_(S,"scripts.start"),m=_(E,"scripts.prestart"),y=_(w,"scripts.poststart"),A=k==="resolved"&&m!=="gapped"&&y!=="gapped",C=eo(n,t,"Procfile",65536);if(C.kind==="refused")g("Procfile",C);else if(C.kind==="ok"){let{entries:O,truncated:L,unnamedLines:K}=Vr(C.text);L&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),K>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(K)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let G of O)Ts(G.command,`Procfile:${G.name}`,"Procfile",u,a,A)==="used"&&(d=!0)}let T=o.length===0,P=eo(n,t,"index.html",af);if(P.kind==="ok")for(let O of df(P.text)){if(O.src===null)continue;let L=Be(O.src);if(!O.module){s.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${L}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(cf(O.src)){s.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${L}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}u(uf(O.src),"index.html",!1,O.src)==="unresolved"&&a.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${L}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else P.kind==="refused"&&s.push({kind:P.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${P.detail}`,root:""});let R=T?jr(n,I):null;if(R!==null){let O=0;for(let L of Br(n,R).roots)u(L,`framework:${R.name}`)==="added"&&(O+=1);O>0&&h.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${R.name}'s directory conventions (recognised via ${R.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let F=O=>O.map(L=>({...L,root:""}));return{entrypoints:o,sources:F(i),gaps:F(a),surfaceGaps:F(l),launchResolved:d,diagnostics:h,framework:R,observations:s}}function eo(e,n,t,r){let o;try{o=dn(ze.join(e,t))}catch{return{kind:"absent"}}if(!o.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let i=Fn(o,r);return i.kind==="ok"?i:i.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(i.bytes)} bytes, over the ${String(r)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Ts(e,n,t,r,o,i){let a=Ur(e);if(a.kind==="delegates")return i?"used":(o.push({source:n,file:t,detail:`\`${Be(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(a.kind==="unparsed")return o.push({source:n,file:t,detail:`\`${Be(e)}\`: ${a.reason}`}),"gapped";let l=r(a.specifier,n,!0),s=a.alt===void 0?"unresolved":r(a.alt,n,!0);return l==="unresolved"&&s==="unresolved"?(o.push({source:n,file:t,detail:`\`${Be(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function Un(e,n){return e===""?n:`${e}/${n}`}function js(e,n){let t=dn(e),r=t.endsWith(ze.sep)?t:t+ze.sep,o=new Set,i=[],a=[],l=[],s=[],d=[],u=[],p=!1,f=null,h=[...n].sort((g,S)=>g.rel===""?-1:S.rel===""?1:g.rel<S.rel?-1:g.rel>S.rel?1:0);for(let g of h){let S=Un(g.rel,"package.json"),E=g.rel===""?".":g.rel,w;try{w=dn(g.abs)}catch{l.push({source:"root",file:S,detail:`root \`${E}\` could not be resolved; not seeded`,root:g.rel});continue}if(w!==t&&!w.startsWith(r)){l.push({source:"root",file:S,detail:`root \`${E}\` resolves outside the scan root; refused, not seeded`,root:g.rel});continue}let I;try{I=ff(w)}catch{l.push({source:"root",file:S,detail:`root \`${E}\` could not be read; not seeded`,root:g.rel});continue}for(let v of I.sources){let _=Un(g.rel,v.entrypoint),k,m;try{k=dn(ze.resolve(t,_)),m=dn(ze.resolve(w,v.entrypoint))}catch{l.push({source:v.source,file:S,detail:`\`${v.specifier}\` re-based to \`${_}\` did not resolve; not seeded`,root:g.rel});continue}if(!k.startsWith(r)||k!==m){l.push({source:v.source,file:S,detail:`\`${v.specifier}\` re-based to \`${_}\` escapes the scan root or names another file; refused, not seeded`,root:g.rel});continue}o.has(_)||(o.add(_),i.push(_),a.push({...v,entrypoint:_,root:g.rel}))}I.launchResolved&&(p=!0);for(let v of I.gaps)l.push({...v,file:Un(g.rel,v.file),root:g.rel});for(let v of I.surfaceGaps)s.push({...v,file:Un(g.rel,v.file),root:g.rel});for(let v of I.diagnostics)d.push({...v,path:Un(g.rel,v.path)});for(let v of I.observations)u.push({...v,file:Un(g.rel,v.file),root:g.rel});g.rel===""&&(f=I.framework)}return{entrypoints:i,sources:a,gaps:l,surfaceGaps:s,launchResolved:p,diagnostics:d,framework:f,observations:u}}function ro(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let r=n.slice(0,3).map(o=>o.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${r}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function oo(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let r=[...new Set(t.slice(0,3).map(o=>o.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${r}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Ks(e,n){let t=dn(e),r=t.endsWith(ze.sep)?t:t+ze.sep,o=new Set,i=[],a=[];for(let l of n){let s=Fs(t,r,l,!0);if(s===null||s.length===0){a.push(l);continue}o.has(s)||(o.add(s),i.push(s))}return{entrypoints:i,rejected:a}}import{readdirSync as ba,readFileSync as go,realpathSync as yo,statSync as ft}from"node:fs";import He from"node:path";function pf(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let r=t+2;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;let o=e.charCodeAt(r);return o===38||o===42}function at(e,n,t){let r=n.maxLines??2e6,o=n.maxLineBytes??16384,i=!1,a=!1,l=0,s=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let u=e.indexOf(`
+`,d),p=u===-1;p&&(u=e.length);let f=u>d&&e.charCodeAt(u-1)===13?u-1:u;if(s+=1,s>r){i=!0;break}if(f-d>o)l+=1;else{let h=d;for(;h<f&&e.charCodeAt(h)===32;)h+=1;let g=h-d,S=f;for(;S>h&&(e.charCodeAt(S-1)===32||e.charCodeAt(S-1)===9);)S-=1;if(h<S&&e.charCodeAt(h)!==35){let E=e.slice(h,S);if(pf(E)){a=!0;break}t(g,E)}}if(p)break;d=u+1}return{truncated:i||l>0,refusedAnchors:a,oversizeLines:l}}function qt(e){let n=e.charCodeAt(0);if(n===34||n===39){let r=e.indexOf(String.fromCharCode(n),1);if(r===-1)return null;let o=r+1;for(;o<e.length&&e.charCodeAt(o)===32;)o+=1;return e.charCodeAt(o)===58?e.slice(0,r+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function Vn(e){return e.endsWith(":")}function Ge(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function Gt(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,r=t.indexOf("/");if(n){if(r<=0||t.indexOf("/",r+1)!==-1)return!1}else if(r!==-1)return!1;let o=n?[t.slice(0,r),t.slice(r+1)]:[t];for(let i of o){if(i.length===0||i.charCodeAt(0)===46||i.charCodeAt(0)===95)return!1;for(let a=0;a<i.length;a+=1){let l=i.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function lt(e){return Gt(e)?`node_modules/${e}`:""}function dt(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Ht=2e5,Bs=64,Xt=1024,mf=5,hf=[1,2,3];function gf(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let r=e.slice(t+n.length);if(r==="")return null;let o=r.split("/");return o[0]?.startsWith("@")?o.length>=2?`${o[0]}/${o[1]}`:null:o[0]??null}function zs(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let r=t.indexOf("@",1);if(r>0){let o=t.slice(0,r),i=t.slice(r+1);if(o.length>0&&i.length>0)return[{name:o,version:i}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function Wn(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Us(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Vs(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Ws(e,n,t,r,o=!1){let i=JSON.stringify([n,t,r]);if(!e.seen.has(i)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(i),e.deps.push({name:n,version:t,lockKey:r,dev:o})}}function yf(e,n){for(let[t,r]of Object.entries(e)){if(t==="")continue;if(!Vs(n))return;let o=t.startsWith("node_modules/")||t.includes("/node_modules/"),i=Wn(r);if(i===null){n.unread+=1;continue}if(i.link===!0)continue;let a=i.name,l=typeof a=="string"&&a!==""?a:gf(t),s=i.version;if(l===null||typeof s!="string"){o&&(n.unread+=1);continue}let d=i.dev===!0||i.devOptional===!0;for(let u of zs(l,s))Ws(n,u.name,u.version,t,d)}}function qs(e,n,t){let r=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],o=!1;for(let i=0;i<r.length;i+=1){let a=r[i];if(a===void 0)break;for(let[l,s]of Object.entries(a.deps)){if(!Vs(n))return{depthCapped:o};if(l===""){n.unread+=1;continue}let d=Wn(s);if(d===null){n.unread+=1;continue}let u=a.pathSafe&&Gt(l),p=u?`${a.prefix}node_modules/${l}`:"",f=u&&p.length<=Xt,h=f?p:"",g=d.version,S=d.dev===!0||a.dev;if(d.link!==!0&&typeof g=="string"&&g!=="")for(let w of zs(l,g))Ws(n,w.name,w.version,h,S);else n.unread+=1;let E=Wn(d.dependencies);if(E!==null){if(a.depth+1>t){o=!0;continue}r.push({deps:E,prefix:f?`${h}/`:a.prefix,depth:a.depth+1,pathSafe:f,dev:S})}}}return{depthCapped:o}}function xf(e,n,t){let r=Us(n.maxEntries),{depthCapped:o}=qs(e,r,t),i=[],a=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),l=new Set,s=[];for(let d of r.deps){if(d.version.includes(":"))continue;let u=JSON.stringify([d.name,d.version]);a.has(u)||l.has(u)||(l.add(u),s.length<mf&&s.push(dt(d.name,d.version)))}if(l.size>0){let d=l.size-s.length;i.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${s.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(r.capped||o)&&i.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),i}function Yt(e,n={}){let t=[],r;try{r=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let o=Wn(r);if(o===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let i=o.lockfileVersion,a=typeof i=="number"&&Number.isInteger(i)?i:null,l=typeof i=="number"?String(i):"?",s=Wn(o.packages),d=Wn(o.dependencies);if(s===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!hf.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??Bs,p=Us(n.maxEntries??Ht),f=!1;return s!==null?(yf(s,p),d!==null&&t.push(...xf(d,p,u))):d!==null&&(f=qs(d,p,u).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),f&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||f}}var Sf=["workspace:","link:","portal:","file:","exec:"];function bf(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function kf(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let r=n.slice(0,t),o=n.slice(t+1);if(r.length===0)return[];for(let l of Sf)if(o.startsWith(l))return[];if(!o.startsWith("npm:"))return[r];let i=o.slice(4),a=i.indexOf("@",1);if(a>0){let l=i.slice(0,a);return l.length>0?[l]:[r]}return i.length===0||bf(i)?[r]:[r,i]}function Ef(e){if(Vn(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let r=e.charCodeAt(t);if(r===34||r===39){n===0?n=r:n===r&&(n=0);continue}if(n===0&&r===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function wf(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let r of n.split(",")){let o=r.trim();o.length>0&&t.push(o)}return t}function vf(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let r=t.length;for(;r<n.length&&r<t.length+3;){let i=n.charCodeAt(r);if(i<48||i>57)break;r+=1}let o=n.slice(t.length,r);return o.length>0?o:null}function Gs(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=Ge(e.slice(8).trim());return t.length>0?t:null}function io(e,n={}){let t=[],r=[],o=new Set,i=n.maxEntries??2e5,a=!1,l=null,s=!1,d=[],u=!1,p=-1,f=!1,h=0,g=()=>{d.length>0&&!u&&(h+=1)},S=at(e,n,(v,_)=>{if(v===0){g(),d=[],u=!1,p=-1,s=!1;let m=Ef(_);if(m===null)return;let y=Ge(m.trim());if(y==="__metadata"){a=!0,s=Vn(_);return}for(let A of wf(y))d.push(...kf(A));return}if(s){if(v===2&&l===null){let m=Gs(_);m!==null&&(l=m)}return}if(d.length===0||(p===-1&&(p=v),v!==p||u))return;let k=Gs(_);if(k!==null){u=!0;for(let m of d){let y=JSON.stringify([m,k]);if(!o.has(y)){if(r.length>=i){f=!0;return}o.add(y),r.push({name:m,version:k,lockKey:lt(m),dev:!1})}}}});g();let E=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(S.refusedAnchors)return{deps:[],diagnostics:[`${E} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};S.oversizeLines>0&&t.push(`${E} has ${String(S.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),f&&t.push(`${E} exceeds ${String(i)} entries; truncated`);let w=l??vf(e),I=w===null?null:Number(w.split(".")[0]);return w!==null&&(I===null||!Number.isInteger(I)||I<1||I>8)&&t.push(`${E} declares unsupported lockfileVersion ${w} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),h>0&&t.push(`${E} has ${String(h)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:r,diagnostics:t,truncated:S.truncated||f}}function so(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.indexOf("_");return r!==-1&&(n=n.slice(0,r)),n.trim()}function ao(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Hs(e){let n=Ge(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let r=n.charCodeAt(0)===47;if(r&&(n=n.slice(1)),n.length===0)return null;if(!r&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),p=n.indexOf("@",1);u>0&&(p===-1||u<p)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let o=n.charCodeAt(0)===64,i=o?n.indexOf("/"):-1;if(o&&i<=0)return null;let a=o?i+1:0,l=-1;for(let u=a;u<n.length;u+=1){let p=n.charCodeAt(u);if(p===47||p===64){l=u;break}}if(l<=a)return null;let s=n.slice(0,l),d=so(n.slice(l+1));return ao(d)?{name:s,version:d}:null}var If=new Set(["packages","snapshots","importers"]),Af=new Set([5,6,7,8,9]);function _f(e){let n=Ge(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function Zt(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:Ge(e.slice(0,n).trim()),value:Ge(t)}}function lo(e,n={}){let t=[],r=[],o=new Set,i=n.maxEntries??2e5,a="",l=null,s=!1,d=0,u=[],p=(h,g)=>{let S=JSON.stringify([h,g]);if(!o.has(S)){if(r.length>=i){s=!0;return}o.add(S),r.push({name:h,version:g,lockKey:lt(h),dev:!1})}},f=at(e,n,(h,g)=>{if(h===0){let S=qt(g);if(a=S===null?"":Ge(S.trim()),l=null,a==="lockfileVersion"){let E=Zt(g),w=E===null?null:_f(E.value);E!==null&&(w===null||!Af.has(w))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${E.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if(If.has(a)&&!Vn(g)){let E=Zt(g)?.value.trim()??"";E!=="{}"&&E!=="[]"&&(d+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(h!==2)return;let S=qt(g),E=S===null?null:Hs(S);if(E===null){d+=1;return}p(E.name,E.version);return}if(a==="importers"){if(h===6){let S=Zt(g);if(S===null){l=g.endsWith(":")?Ge(g.slice(0,-1).trim()):null;return}l=null;let E=so(S.value);ao(E)&&p(S.key,E);return}if(h===8&&l!==null){let S=Zt(g);if(S===null||S.key!=="version")return;let E=so(S.value);ao(E)&&p(l,E)}}});return f.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),f.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(f.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),s&&t.push(`pnpm-lock.yaml exceeds ${String(i)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:r,diagnostics:t,truncated:f.truncated||s})}function Ys(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var Nf=1e6,Xs=2e5,Rf=4096,Cf=65536,ct=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Js(e){if(e.length>Nf)return null;let n,t;for(let r of e.split(/\r?\n/u)){if(r==="")break;let o=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(r);if(o===null)continue;let i=o[1]?.toLowerCase();i==="name"&&n===void 0?n=o[2]?.trim():i==="version"&&t===void 0&&(t=o[2]?.trim())}return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}function Zs(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&ct.test(n))}function Qs(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let r=e[t];if(r==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=r}return n}function ea(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function na(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function ta(e){let n=e.split(/\r?\n/u);return n.length>Xs?n.slice(0,Xs):n}function ra(e){let n=new Set;for(let t of ta(e)){if(t==="")continue;let r=Qs(t).split("/"),o=r[0]??"";if(ea(o))continue;if(r.length>1){ct.test(o)&&n.add(o);continue}let i=na(o);i!==null&&ct.test(i)&&n.add(i)}return[...n].sort((t,r)=>t<r?-1:t>r?1:0)}function Of(e){let n=e.split("/"),t=n[0]??"";if(ea(t))return null;let r=n[n.length-1]??"",o=na(r);if(o===null)return null;let i=n.slice(0,-1);if(i.some(l=>!ct.test(l)||l==="__pycache__"))return null;let a=o==="__init__"?i:[...i,o];return a.length===0||!ct.test(o==="__init__"?i[i.length-1]??"":o)?null:a}function oa(e,n=Rf){let t=new Set,r=0,o=!1;for(let i of ta(e)){if(i==="")continue;let a=Of(Qs(i));if(a!==null){r+=1;for(let l=1;l<=Math.min(2,a.length);l+=1){let s=a.slice(0,l).join(".");if(!t.has(s)){if(t.size>=n){o=!0;break}t.add(s)}}}}return{prefixes:[...t].sort((i,a)=>i<a?-1:i>a?1:0),moduleFiles:r,capped:o}}function ia(e){if(e.length>Cf)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,r=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:r?.editable===!0}}function co(e,n){let t=Js(e);if(t===null)return null;let r=n.topLevelText!==void 0?Zs(n.topLevelText):[],o=r.length>0?r:n.recordText!==void 0?ra(n.recordText):[],i=n.recordText!==void 0?oa(n.recordText):{prefixes:[],moduleFiles:0,capped:!1},a=n.directUrlText!==void 0?ia(n.directUrlText)?.editable??!1:!1;return{name:Ys(t.name),version:t.version,importNames:o,modulePrefixes:i.prefixes,moduleFiles:i.moduleFiles,editable:a}}import{statSync as Jf}from"node:fs";import Zf from"node:path";import{lstatSync as Pf,readFileSync as $f,readdirSync as Mf,realpathSync as uo,statSync as ut}from"node:fs";import pe from"node:path";function fo(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}var da=2e4,ca=32,ua=256,Df=2*1024*1024,Tf=256*1024,fa=256,Lf=16,Ff=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],jf=["pyproject.toml","setup.py","setup.cfg"],Kf=["requirements.txt","Pipfile"],Bf=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],pa={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function sa(e,n){try{let t=ut(e);return!t.isFile()||t.size>n?null:$f(e,"utf8")}catch{return null}}function yn(e){let n;try{n=ut(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function zf(e){try{return ut(e).isDirectory()}catch{return!1}}function Uf(e,n){let t=0,r=0,o=-1,i=0;for(;r<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(r)))t+=1,r+=1;else if(t<e.length&&e.charAt(t)==="*")o=t,i=r,t+=1;else if(o>=0)t=o+1,i+=1,r=i;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function Vf(e,n){let t=(r,o)=>{if(r===e.length)return o===n.length;let i=e[r]??"";if(i==="**"){for(let l=o;l<=n.length;l+=1)if(t(r+1,l))return!0;return!1}if(o>=n.length)return!1;let a=n[o]??"";return(i.includes("*")||i.includes("?")?Uf(i,a):i===a)?t(r+1,o+1):!1};return t(0,0)}function Wf(e){let n=[],t=sa(pe.join(e,"package.json"),Df);if(t!==null)try{let a=JSON.parse(t)?.workspaces;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l);else if(typeof a=="object"&&a!==null){let l=a.packages;if(Array.isArray(l))for(let s of l)typeof s=="string"&&n.push(s)}}catch{}let r=sa(pe.join(e,"pnpm-workspace.yaml"),Tf);r!==null&&n.push(...qf(r));let o=[];for(let i of n){if(o.length>=fa)break;let a=i.trim();if(a.length===0)continue;for(;a.startsWith("./");)a=a.slice(2);if(a.startsWith("/")||pe.isAbsolute(a))continue;let l=a.split("/").filter(s=>s.length>0);l.length===0||l.length>Lf||l.includes("..")||o.push(l.join("/"))}return o}function qf(e){let n=[],t=!1;for(let r of e.split(`
+`)){if(n.length>=fa)break;if(/^packages:\s*(#.*)?$/.test(r)){t=!0;continue}if(!t)continue;let o=/^\s+-\s*(.*?)\s*$/.exec(r);if(o===null){r.trim().length>0&&(t=!1);continue}let i=(o[1]??"").trim(),a=i.indexOf(" #");a>=0&&(i=i.slice(0,a).trim()),(i.startsWith('"')&&i.endsWith('"')&&i.length>=2||i.startsWith("'")&&i.endsWith("'")&&i.length>=2)&&(i=i.slice(1,-1)),i.length>0&&n.push(i)}return n}function aa(e,n){let t=pe.relative(n,e);return t.length===0?!1:t.split(pe.sep).includes("node_modules")}function la(e,n){return pe.relative(e,n).split(pe.sep).join("/")}function po(e,n){let t=n?.maxDirs??da,r=n?.maxDepth??ca,o=n?.maxRoots??ua,i=n?.discoverPythonRoots??!0,a;try{a=uo(e)}catch{return{...pa,observations:[{kind:"refused-unreadable",rel:""}]}}let l=[],s=[],d=new Set([a]),u=0,p=0,f=0,h="complete",g=Wf(a).map(v=>v.split("/")),S=v=>{let _="absent";for(let m of jf){let y=yn(pe.join(v,m));if(y==="regular"){_="declared";break}y==="refused"&&(_="refused")}if(_==="absent"&&Kf.some(m=>yn(pe.join(v,m))==="regular")&&(_="listed"),_==="absent")return{candidate:_,witnesses:[]};let k=[];return Bf.some(m=>yn(pe.join(v,m))==="regular")&&k.push("own-lockfile"),zf(pe.join(v,".venv"))&&k.push("installed-env"),{candidate:_,witnesses:k}},E=(v,_)=>{let k=S(v);return k.candidate==="absent"?"not-root":(k.candidate!=="listed"&&(p+=1),k.witnesses.length===0&&k.candidate!=="refused"?(k.candidate==="declared"&&s.push({kind:"undeclared-manifest",rel:_}),"not-root"):l.length>=o?"exhausted":(l.push({rel:_,abs:v,witnesses:k.witnesses,manifestRefused:k.candidate==="refused",ecosystem:"PyPI"}),"root"))},w=(v,_)=>{if(_.length===0){let C=yn(pe.join(v,"package.json"))!=="absent",T=i?S(v):{candidate:"absent",witnesses:[]};return!C&&T.candidate!=="absent"?(l.push({rel:"",abs:v,witnesses:["scan-root",...T.witnesses],manifestRefused:!1,ecosystem:"PyPI"}),"root"):(l.push({rel:"",abs:v,witnesses:["scan-root",...T.witnesses],manifestRefused:!1,...T.witnesses.length>0?{alsoPython:!0}:{}}),"root")}let k=yn(pe.join(v,"package.json"));if(k==="absent")return i?E(v,_):"not-root";p+=1;let m=[],y=_.split("/");g.some(C=>Vf(C,y))&&m.push("workspace-declared"),Ff.some(C=>yn(pe.join(v,C))==="regular")&&m.push("own-lockfile");let A=i?S(v):{candidate:"absent",witnesses:[]};for(let C of A.witnesses)m.includes(C)||m.push(C);return m.length===0&&k!=="refused"?(s.push({kind:"undeclared-manifest",rel:_}),"not-root"):l.length>=o?"exhausted":(l.push({rel:_,abs:v,witnesses:m,manifestRefused:k==="refused",...A.witnesses.length>0?{alsoPython:!0}:{}}),"root")},I=[{abs:a,rel:"",depth:0}];for(;I.length>0;){let v=I.pop();if(v===void 0)break;if(u>=t){h="dirs-exhausted";break}u+=1;let _=w(v.abs,v.rel);if(_==="exhausted"){h="roots-exhausted";break}let k=_==="root";if(v.depth>=r){h=h==="complete"?"depth-clamped":h;continue}let m;try{m=Mf(v.abs)}catch{s.push({kind:"refused-unreadable",rel:v.rel});continue}m.sort().reverse();for(let y of m){let A=pe.join(v.abs,y),C=v.rel.length===0?y:`${v.rel}/${y}`,T;try{let F=Pf(A);T=F.isDirectory()||F.isSymbolicLink()&&ut(A).isDirectory()}catch{continue}if(!T)continue;if(y==="node_modules"){k||s.push({kind:"unenumerated-install",rel:C});continue}if(y.startsWith(".")){f+=1,s.push({kind:"skipped-dot-directory",rel:C}),yn(pe.join(A,"package.json"))!=="absent"&&s.push({kind:"undeclared-manifest",rel:C});continue}let P;try{P=uo(A)}catch{s.push({kind:"refused-unreadable",rel:C});continue}let R=a.endsWith(pe.sep)?a:a+pe.sep;if(P!==a&&!P.startsWith(R)){s.push({kind:"refused-out-of-root",rel:C});continue}aa(P,a)||d.has(P)||(d.add(P),I.push({abs:P,rel:la(a,P),depth:v.depth+1}))}}for(let v of n?.operatorRoots??[]){let _=typeof v=="string"?v.slice(0,512):"",k=()=>{s.push({kind:"refused-operator-root",rel:_})};if(_.length===0||_.includes("\0")){k();continue}let m;try{m=uo(pe.resolve(a,_))}catch{k();continue}let y=a.endsWith(pe.sep)?a:a+pe.sep;if(m!==a&&(!m.startsWith(y)||aa(m,a))){k();continue}let A;try{A=ut(m).isDirectory()}catch{A=!1}if(!A||yn(pe.join(m,"package.json"))!=="regular"){k();continue}let C=l.findIndex(R=>R.abs===m);if(C>=0){let R=l[C];R!==void 0&&!R.witnesses.includes("operator")&&(l[C]={...R,witnesses:[...R.witnesses,"operator"]});continue}let T=la(a,m);l.push({rel:T,abs:m,witnesses:["operator"],manifestRefused:!1});let P=s.findIndex(R=>R.kind==="undeclared-manifest"&&R.rel===T);P>=0&&s.splice(P,1)}return l.sort((v,_)=>v.rel<_.rel?-1:v.rel>_.rel?1:0),s.sort((v,_)=>v.kind!==_.kind?v.kind<_.kind?-1:1:v.rel<_.rel?-1:v.rel>_.rel?1:0),{roots:l,observations:s,budget:h,counts:{dirsWalked:u,manifestsSeen:p,rootsAdmitted:l.length,dotDirectoriesSkipped:f}}}import{lstatSync as ma,readdirSync as Gf,readFileSync as Hf,realpathSync as ya,statSync as xa}from"node:fs";import Ue from"node:path";var Rn={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024},Xf=/^python\d+\.\d+$/u;function Cn(e,n){let t;try{t=xa(e)}catch(r){return{why:r?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:Hf(e,"utf8")}}catch{return{why:"unreadable"}}}function mo(e,n){let t;try{if(t=ya(n),!xa(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+Ue.sep)?t:null}function ha(e,n){return Ue.relative(e,n).split(Ue.sep).join("/")}function ga(e){try{return Gf(e).sort()}catch{return null}}function Yf(e){let n=null;for(let t of e.split(/\r?\n/u)){let r=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(r!==null){if(r[1]==="version_info")return r[2]??null;n??=r[2]??null}}return n}function ho(e,n){let t=n?.envDir??Rn.envDir,r=n?.maxDistributions??Rn.maxDistributions,o=n?.maxMetadataBytes??Rn.maxMetadataBytes,i=n?.maxRecordBytes??Rn.maxRecordBytes,a=n?.maxTopLevelBytes??Rn.maxTopLevelBytes,l=n?.maxDirectUrlBytes??Rn.maxDirectUrlBytes,s=t,d=[],u=(A,C,T=null)=>({envRel:s,refused:A,sitePackages:[],interpreter:T,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...d,C],truncated:!1}),p;try{p=ya(e)}catch{return u("absent","the root itself could not be resolved")}let f=Ue.join(p,t),h;try{h=ma(f)}catch(A){return A?.code==="ENOENT"?u("absent",`${s}: absent`):u("not-a-directory",`${s}: could not be inspected`)}if(!h.isDirectory()&&!h.isSymbolicLink())return u("not-a-directory",`${s}: not a directory`);let g=mo(p,f);if(g===null)return u("escapes-root",`${s}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let S=Cn(Ue.join(g,"pyvenv.cfg"),Rn.maxPyvenvCfgBytes),E="text"in S?Yf(S.text):null;"text"in S||d.push(`${s}/pyvenv.cfg: ${S.why} \u2014 interpreter version unknown`);let w=[];for(let A of["lib","lib64"]){let C=ga(Ue.join(g,A));if(C!==null)for(let T of C)Xf.test(T)&&w.push(Ue.join(g,A,T,"site-packages"))}w.push(Ue.join(g,"Lib","site-packages"));let I=[],v=new Set;for(let A of w){let C=mo(g,A);C===null||v.has(C)||(v.add(C),I.push(C))}if(I.length===0)return u("no-site-packages",`${s}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,E);I.length>1&&d.push(`${s}: ${String(I.length)} site-packages directories; all enumerated`);let _=[],k=[],m=0,y=!1;e:for(let A of I){let C=ha(p,A),T=ga(A);if(T===null){d.push(`${C}: unreadable; nothing enumerated there`);continue}for(let P of T){let R=Ue.join(A,P),F=P.endsWith(".dist-info"),O=P.endsWith(".egg-info");if(P.endsWith(".pth")){let H=Cn(R,0);("text"in H||H.why==="oversize")&&k.push(P);continue}if(!F&&!O)continue;if(_.length>=r){y=!0,d.push(`${C}: the distribution cap (${String(r)}) was hit at ${P}; the enumeration is INCOMPLETE`);break e}let L;try{L=ma(R)}catch{m+=1,d.push(`${C}/${P}: could not be inspected; not enumerated`);continue}let K=F?"dist-info":"egg-info";if(L.isFile()&&O){let H=Cn(R,o);"text"in H?_.push({dir:P,kind:K,metadata:H.text}):(m+=1,d.push(`${C}/${P}: ${H.why}; not enumerated`));continue}let G=mo(g,R);if(G===null){m+=1,d.push(`${C}/${P}: not a directory inside the environment; not enumerated`);continue}let B=F?"METADATA":"PKG-INFO",W=Cn(Ue.join(G,B),o);if(!("text"in W)){m+=1,d.push(`${C}/${P}: ${B} ${W.why}; not enumerated`);continue}let $={dir:P,kind:K,metadata:W.text},q=Cn(Ue.join(G,"top_level.txt"),a);if("text"in q?$.topLevel=q.text:q.why!=="absent"&&d.push(`${C}/${P}/top_level.txt: ${q.why}; ignored`),F){let H=Cn(Ue.join(G,"RECORD"),i);"text"in H?$.record=H.text:d.push(`${C}/${P}/RECORD: ${H.why}; import names from top_level.txt only`);let Ee=Cn(Ue.join(G,"direct_url.json"),l);"text"in Ee&&($.directUrl=Ee.text)}_.push($)}}return{envRel:s,refused:null,sitePackages:I.map(A=>ha(p,A)),interpreter:E,distInfos:_,pthFiles:k,unreadable:m,diagnostics:d,truncated:y}}var Qf=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function ep(e,n){for(let t of n)try{if(Jf(Zf.join(e,t)).isFile())return t}catch{}return null}function Sa(e){let n=[],t=[],r=(p,f)=>{t.push({kind:p,detail:f,blindsAnalysis:!1,rootRel:""}),n.push(f)},o=ep(e,Qf),i=ho(e);if(i.refused!==null){let p=i.refused==="absent"?`no \`${i.envRel}\` is installed`:`\`${i.envRel}\` could not be read (${i.refused})`;return r("no-installed-env",`${o??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:o,diagnostics:[...n,...i.diagnostics],truncated:!1,gaps:t}}let a=[],l=new Set,s=[],d=0;for(let p of i.distInfos){let f=co(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(f===null){d+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let h=JSON.stringify([f.name,f.version]);l.has(h)||(l.add(h),f.importNames.length===0&&s.push(f.name),a.push({name:f.name,version:f.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...i.diagnostics);let u=i.unreadable+d;return u>0&&r("installed-env-partial",`${String(u)} entr${u===1?"y":"ies"} under ${i.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(a.length)} enumerated were assessed normally.`),i.truncated&&r("installed-env-partial",`the environment walk under ${i.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),s.length>0&&n.push(`${String(s.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${s.slice(0,5).join(", ")}${s.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:a,source:a.length>0?"installed-env":"none",lockfilePath:o,diagnostics:n,truncated:i.truncated,gaps:t}}var np=128*1024*1024,tp=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>Yt(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>Yt(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>io(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>lo(e,n===void 0?{}:{maxEntries:n})}],rp=[".pnp.cjs",".pnp.data.json",".pnp.js"];function xo(e,n){let t;try{t=yo(He.join(e,n))}catch{return null}let r=e.endsWith(He.sep)?e:e+He.sep;return t.startsWith(r)?t:null}function ka(e,n){let t=He.join(e,"package.json"),r;try{r=yo(t)}catch{return null}if(!r.startsWith(n+He.sep))return null;try{if(!ft(r).isFile())return null;let o=JSON.parse(go(r,"utf8"));return typeof o.name!="string"||typeof o.version!="string"?null:{name:o.name,version:o.version}}catch{return null}}function Ea(e,n){try{return ft(He.join(e,n)),!0}catch{return!1}}function op(e,n){if(Ea(e,"pnpm-workspace.yaml"))return!0;let t=xo(e,"package.json");if(t===null)return Ea(e,"package.json");let r;try{let a=ft(t);if(!a.isFile()||a.size>n)return!0;r=go(t,"utf8")}catch{return!0}let o;try{o=JSON.parse(r)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=o[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let i=o.workspaces;return Array.isArray(i)?i.length>0:typeof i=="object"&&i!==null}function wa(e,n){let t=He.join(e,"node_modules"),r=[],o;try{o=ba(t,{withFileTypes:!0})}catch{return r}for(let i of o){let a=i.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let s;try{s=ba(He.join(t,a),{withFileTypes:!0})}catch{continue}for(let d of s){let u=ka(He.join(t,a,d.name),n);u!==null&&r.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${d.name}`,linked:d.isSymbolicLink()||i.isSymbolicLink()})}continue}let l=ka(He.join(t,a),n);l!==null&&r.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:i.isSymbolicLink()})}return r}var ip=5;function sp(e,n,t){let r=xo(e,n);if(r===null){try{ft(He.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let o;try{o=ft(r)}catch{return null}if(!o.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(o.size>t)return{gap:`${n} is ${String(o.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:go(r,"utf8")}}catch{return{gap:`${n} could not be read`}}}function ap(e,n){let t=yo(e),r=[],o=[],i=n?.maxLockfileBytes??np,a=[],l=new Set,s=[],d=op(t,i),u=null,p=!1,f=(g,S,E)=>{o.push({kind:g,detail:S,blindsAnalysis:E,rootRel:""}),r.push(S)};for(let g of tp){let S=sp(t,g.file,i);if(S===null)continue;if("gap"in S){f("lockfile-unreadable",S.gap,!1);continue}let E=g.parse(S.text,n?.maxLockfileEntries);if(E.truncated&&(p=!0),E.deps.length===0){if(E.diagnostics.length>0||d){let w=E.diagnostics.length>0?E.diagnostics.join("; "):"no entries found";f("lockfile-unparsed",`${g.file} yielded NO dependencies (${w}); its transitive dependency set was not enumerated`,!1)}continue}E.diagnostics.length>0&&f("lockfile-partial",`${g.file} was only partly enumerated (${E.diagnostics.join("; ")})`,!1),u===null&&(u=g.file),s.includes(g.source)||s.push(g.source);for(let w of E.deps){let I=JSON.stringify([w.name,w.version,w.lockKey]);l.has(I)||(l.add(I),a.push({...w,declaredIn:g.file}))}}for(let g of rp)if(xo(t,g)!==null){f("yarn-pnp",`${g} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let g=s.length===1?s[0]??"none":"multi-lockfile";s.length>1&&r.push(`multiple lockfiles present (${s.join(", ")}); enumerated the UNION of all of them`);let S=new Set(a.map(I=>JSON.stringify([I.name,I.version]))),E=new Set,w=[];for(let I of wa(t,t)){let v=JSON.stringify([I.name,I.version,I.lockKey]);l.has(v)||(l.add(v),a.push({name:I.name,version:I.version,lockKey:I.lockKey,dev:I.dev,declaredIn:""}));let _=JSON.stringify([I.name,I.version]);I.linked||S.has(_)||E.has(_)||(E.add(_),w.length<ip&&w.push(dt(I.name,I.version)))}if(E.size>0){let I=E.size-w.length;f("lockfile-skew",`node_modules holds ${String(E.size)} package(s) at a (name, version) no lockfile lists (${w.join(", ")}${I>0?`, and ${String(I)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:g,lockfilePath:u,diagnostics:r,truncated:p,gaps:o}}let h=wa(t,t);return h.length>0?(f("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(h.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:h.map(g=>({name:g.name,version:g.version,lockKey:g.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:r,truncated:p,gaps:o}):(d&&f("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:r,truncated:p,gaps:o})}function lp(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function dp(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function Ia(e){return e===""||e.split("/").every(dp)}function cp(e,n){if(e===""||n==="")return n;if(!Ia(e))return"";let t=`${e}/${n}`;return t.length<=Xt?t:""}function va(e,n){return e===""?n:`${e}: ${n}`}function up(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function Aa(e,n,t){let r=t?.maxUnionEntries??Ht,o=n.roots.filter(lp),i=o.some(g=>g.rel==="")?o:[up(e),...o],a=[],l=[],s=new Set,d=[],u=[],p=!1,f=!1;for(let g of i){let S=g.rel===""?e:g.abs,E=ap(S,t),w=fo(g)?Sa(S):null,I=w===null?E:mp(E,w),v=I.diagnostics.map(k=>va(g.rel,k));!Ia(g.rel)&&I.packages.length>0&&v.push(`${g.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(I.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let _={...I,rootRel:g.rel,...g.ecosystem!==void 0?{ecosystem:g.ecosystem}:{},...w!==null?{pythonLockfilePath:w.lockfilePath===null||g.rel===""?w.lockfilePath:`${g.rel}/${w.lockfilePath}`}:{},packages:I.packages.map(k=>({...k,lockKey:cp(g.rel,k.lockKey),declaredIn:k.declaredIn===""||g.rel===""?k.declaredIn:`${g.rel}/${k.declaredIn}`})),lockfilePath:I.lockfilePath===null||g.rel===""?I.lockfilePath:`${g.rel}/${I.lockfilePath}`,gaps:I.gaps.map(k=>({...k,rootRel:g.rel,detail:va(g.rel,k.detail)})),diagnostics:v};a.push(_),I.truncated&&(p=!0);for(let k of _.packages){let m=JSON.stringify([k.name,k.version,k.lockKey]);if(!s.has(m)){if(l.length>=r){f=!0;break}s.add(m),l.push(k)}}d.push(..._.gaps),u.push(..._.diagnostics)}f&&(p=!0,u.push(`the union of installed sets across ${String(i.length)} roots exceeds its ceiling of ${String(r)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let h=a[0];if(h===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:h.source,lockfilePath:h.lockfilePath,diagnostics:u,truncated:p,gaps:d,perRoot:a}}function fp(e,n){let t;for(let r of e.perRoot){if(r.rootRel===""){t??=r;continue}n.startsWith(`${r.rootRel}/`)&&(t===void 0||r.rootRel.length>t.rootRel.length)&&(t=r)}return t}function Qt(e,n){return n.declaredIn!==""?n.declaredIn:fp(e,n.lockKey)?.lockfilePath??null}function _a(e,n){let t=e.perRoot.find(r=>r.rootRel===n.rootRel);return pp.has(n.kind)?t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`:t?.lockfilePath!==void 0&&t.lockfilePath!==null?t.lockfilePath:n.rootRel===""?null:`${n.rootRel}/${t?.ecosystem==="PyPI"?"pyproject.toml":"package.json"}`}var pp=new Set(["no-installed-env","installed-env-partial"]);function mp(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function Na(e){let n=new Map;for(let t of e){let r=n.get(t.name)??new Set;r.add(t.version),n.set(t.name,r)}return t=>{let r=n.get(t);if(r===void 0)return;let o=[...r].sort();return o.length===1?o[0]:o}}function pt(e){return new Set(e.map(n=>n.root))}function qn(e,n){let t=pt(n);return e.roots.filter(r=>!t.has(r.rel)&&(r.rel===""||r.ecosystem!=="PyPI"))}function So(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function bo(e,n){return qn(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its code, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) this scan did not analyze; code there can load any installed package, so every \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function Ra(e){let n=[],t=e.observations.filter(r=>r.kind==="unenumerated-install").map(r=>r.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${So(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let r=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(r.dirsWalked)} dirs walked, ${String(r.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function Ca(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{readdirSync as hp,readFileSync as gp}from"node:fs";import yp from"node:path";var xp=new Set(["summarized","crashed","over-cap"]),Sp=new Set(["function","method","ctor"]);function me(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function ko(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function bp(e,n){ko(e)||me(n,"edge is not an object");let{entryPath:t,entryExport:r,entryContainer:o,hops:i}=e;(typeof t!="string"||typeof r!="string")&&me(n,"edge entry fields must be strings"),o!==null&&typeof o!="string"&&me(n,"entryContainer must be string or null"),(typeof i!="number"||!Number.isInteger(i)||i<0)&&me(n,"hops must be a non-negative integer");let a=e.target;if(ko(a)||me(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:s,symbolKind:d}=a;return typeof l!="string"&&me(n,"symbol target exportName"),s!==null&&typeof s!="string"&&me(n,"symbol target container"),(typeof d!="string"||!Sp.has(d))&&me(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:r,entryContainer:o,target:{kind:"symbol",exportName:l,container:s,symbolKind:d},hops:i}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:s,calleeExport:d}=a;return(typeof l!="string"||l.length===0)&&me(n,"dep target calleePackage"),s!==null&&typeof s!="string"&&me(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&me(n,"dep target calleeExport"),{entryPath:t,entryExport:r,entryContainer:o,target:{kind:"dep",calleePackage:l,calleeSubpath:s,calleeExport:d},hops:i}}me(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function kp(e,n){ko(e)||me(n,"root is not an object");let{packageName:t,analyzedVersion:r,tool:o,toolVersion:i,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&me(n,"packageName"),typeof r!="string"&&me(n,"analyzedVersion"),o!=="jelly"&&me(n,`tool ${JSON.stringify(o)} (only 'jelly' exists)`),typeof i!="string"&&me(n,"toolVersion"),typeof a!="number"&&me(n,"maxIndirections"),(typeof l!="string"||!xp.has(l))&&me(n,`status ${JSON.stringify(l)} not in the enum`);let s=e.edges;return Array.isArray(s)||me(n,"edges is not an array"),l!=="summarized"&&s.length>0&&me(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:r,tool:o,toolVersion:i,maxIndirections:a,status:l,edges:s.map(d=>bp(d,n))}}function Oa(e){let n=new Map,t=hp(e).filter(r=>r.endsWith(".summary.json"));for(let r of t){let o=yp.join(e,r),i;try{i=JSON.parse(gp(o,"utf8"))}catch(s){me(r,`unparseable JSON: ${s instanceof Error?s.message:String(s)}`)}let a=kp(i,r),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{isBuiltin as Pa}from"node:module";function U(e){let n="";for(let t of e){let r=t.charCodeAt(0),o=r<32||r>=127&&r<=159;n+=o?"\\x"+r.toString(16).padStart(2,"0"):t}return n}var $a=1024,Ma=4096,er=8,Da=512,Ta=512,Eo=8,Ep=160,wp=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),wo=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),vp=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,Ip=/\.[cm]?[jt]sx?$/u;function La(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let r=e.lastIndexOf("node_modules/");if(r!==-1){let o=e.slice(r+13).split("/"),i=o[0]??"";return i.startsWith("@")?o[1]===void 0?null:`${i}/${o[1]}`:i===""?null:i}return vp.test(e)&&!Ip.test(e)?e:null}function Ap(e){return U(`${e.code} ${e.path}: ${e.detail}`.slice(0,Ep))}function Fa(e){let{graph:n,facts:t,diagnostics:r}=e,o=new Map(n.modules.map(M=>[M.id,M])),i=new Map(n.modules.map(M=>[M.path,M])),a=Ze(n),l=new Set;for(let M of a){let J=o.get(M);J!==void 0&&l.add(J.packageName)}let s=new Map,d=0,u=!1,p=!1,f=M=>M.startsWith(`${e.appRootReal}/`)?M.slice(e.appRootReal.length+1):M;for(let M of r){if(M.code==="limit-exceeded"&&M.path===e.appRootReal){u=!0;continue}let J=La(f(M.path),i);if(J===null){M.code==="out-of-root"&&d++,wo.has(M.code)&&(p=!0);continue}let oe=i.get(f(M.path));oe!==void 0&&wo.has(M.code)&&!oe.path.includes("node_modules/")&&(p=!0);let ie=s.get(J);ie===void 0?s.set(J,[M]):ie.push(M)}let h=new Map(n.imports.map(M=>[M.id,M])),g=new Set;for(let M of n.importEdges){let J=h.get(M.importId);J!==void 0&&o.get(J.moduleId)?.externalSurface===!0&&g.add(J.moduleId)}let S=[],E=new Set,w=n.modules.filter(M=>M.externalSurface===!0);for(let M of w){let J=s.get(M.packageName)??[],oe=g.has(M.id),ie=[],rn=ne=>ne.code==="dependency-body"&&ne.anchor===void 0&&/syntax/u.test(ne.detail),bn=ne=>ne.code==="loader-escape"||ne.code==="dependency-body"&&ne.anchor===void 0&&!/syntax/u.test(ne.detail),x=J.filter(ne=>wp.has(ne.code)),N=J.filter(bn),D=J.filter(ne=>wo.has(ne.code)||rn(ne)),j=J.filter(ne=>ne.code==="out-of-root"),Y=oe&&x.length===0,Z=N.length===0,te=!u&&D.length===0,ue=d===0&&j.length===0;oe||ie.push("(a) the package's entry was never followed to a module");for(let ne of[...x,...N,...D,...j]){if(ie.length>=Eo)break;ie.push(Ap(ne))}u&&ie.length<Eo&&ie.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&ie.length<Eo&&ie.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let de=["a","b","c","d"].filter(ne=>!{a:Y,b:Z,c:te,d:ue}[ne]),fe=de.length===0;fe&&E.add(M.id),S.push({packageName:U(M.packageName),module:U(String(M.id)),inReach:a.has(M.id),builtin:Pa(M.packageName),followed:oe,d1:{a:Y,b:Z,c:te,d:ue},failing:de,transparent:fe,evidence:ie})}let I=new Set;for(let M of t)M.reach.kind==="unbounded"&&I.add(M.source);let v=M=>({module:U(String(M.module)),kind:M.kind,packageName:o.get(M.module)?.packageName??null}),_=new Set(w.filter(M=>Pa(M.packageName)).map(M=>M.id)),k=new Set([...E,..._]),m=[],y=new Map,A=0,C=0,T=0,P=0,R=[],F=new Set;for(let M of t)M.reach.kind==="unbounded"&&F.add(M.cause);for(let M of t){if(M.reach.kind==="class-scope"){R.push({packageName:M.reach.packageName,container:M.reach.container});continue}if(M.reach.kind==="unbounded")continue;P++;let J=M.reach.anchor,oe=y.get(String(J));oe===void 0&&(oe={today:Yn(n,J,I),d1:Yn(n,J,I,E),d1Builtins:Yn(n,J,I,k)},y.set(String(J),oe)),oe.d1Builtins.length>0&&T++,oe.today.length>0&&(A++,F.add(M.cause)),oe.d1.length>0&&C++,m.length<Ma&&m.push({anchor:U(String(J)),packageName:U(o.get(J)?.packageName??""),cause:M.cause,reachKind:M.reach.kind,blockersToday:oe.today.slice(0,er).map(v),blockersUnderD1:oe.d1.slice(0,er).map(v),blockedUnderD1Builtins:oe.d1Builtins.length>0,moreToday:Math.max(0,oe.today.length-er),moreUnderD1:Math.max(0,oe.d1.length-er)})}let O=r.filter(M=>M.anchor===void 0&&M.classScope===void 0),L=new Map(e.loadSites.map(M=>[M.importId,M])),K=new Map;for(let M of e.loadSites){let J=K.get(M.path);J===void 0?K.set(M.path,[M.shape]):J.push(M.shape)}let G=M=>{if(M.code!=="loader-escape")return!1;let J=M.escapes??[];if(J.length===0||J.some(ie=>ie!=="non-literal-load"))return!1;let oe=K.get(M.path)??[];return oe.length>0&&oe.every(ie=>ie==="relative-bounded")},B=O.slice(0,Ta).map(M=>({cause:e.causeOf(M.code),code:M.code,path:U(f(M.path)),attributedPackage:La(f(M.path),i),...M.escapes!==void 0?{escapes:[...M.escapes]}:{},...M.reason!==void 0?{reason:M.reason}:{},d2Dischargeable:G(M)})),W={};for(let M of O){if(M.code!=="unresolved-specifier")continue;let J=M.reason??"(none)";W[J]=(W[J]??0)+1}let $=I.size===0?0:t.filter(M=>M.reach.kind==="unbounded").length,q=Math.max(0,$-O.length),H=$-O.filter(G).length,Ee=[],he=0,ve=0,Sn=0;for(let M of n.imports){if(M.specifierIsLiteral)continue;Sn++;let J=a.has(M.moduleId),oe=L.get(String(M.id)),ie=oe?.shape??"unrecorded";J&&(he++,ie==="relative-bounded"&&ve++),Ee.length<Da&&Ee.push({importId:U(String(M.id)),path:U(o.get(M.moduleId)?.path??""),shape:ie,text:U(oe?.text??""),inReach:J})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:u,appCapHit:p,unattributedOutOfRoot:d,blindUnbounded:q,unbounded:B,anchors:m,surfaces:S.slice(0,$a),loads:Ee,counts:{modules:n.modules.length,reachMods:a.size,surfaces:w.length,surfacesInReach:S.filter(M=>M.inReach).length,transparentSurfaces:E.size,builtinSurfaces:_.size,anchors:P,anchorsBlockedToday:A,anchorsBlockedUnderD1:C,anchorsBlockedUnderD1Builtins:T,unbounded:$,loadsInReach:he,loadsRelativeBounded:ve,unresolvedByReason:W,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,S.length-$a),anchors:Math.max(0,P-Ma),loads:Math.max(0,Sn-Da),unbounded:Math.max(0,O.length-Ta)}},reachedPackages:l,aborted:e.analysisAborted,unboundedFacts:$,unboundedHard:H,anchorsBlockedToday:A,anchorsBlockedUnderD1:C,anchorsBlockedUnderD1Builtins:T,loadsInReach:he,loadsAllBounded:he>0&&ve===he,d2Eligible:e.rootBudget==="complete"&&!p&&!u,classScope:R,taintCausesToday:F}}var _p=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),Np=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function ja(e,n,t,r,o){if(t===null||e.reachedPackages.has(t.packageName))return;let i=e.classScope.some(A=>A.packageName===t.packageName&&A.container===t.container),a=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||i,l=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||l||n.unknownKind!==void 0&&_p.has(n.unknownKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":a?"taint":r>0?"oog":"unexpected",u=new Set(e.taintCausesToday);i&&u.add("dep-opaque");let p=e.aborted!==null?e.aborted:Np.find(A=>u.has(A)),f=d==="pre-2b"?n.tier==="unknown"&&(l?n.unknownKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?n.tier==="unknown"&&n.unknownKind==="dynamic-load":d==="taint"?n.tier==="unknown"&&n.unknownKind===p:d==="oog"?n.tier==="unknown"&&n.unknownKind==="analysis-cap":!1,h=t.verified&&o===!0,g=e.aborted===null&&e.unboundedFacts===0&&!i&&r===0,S=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,E=h&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,w=h&&d==="load"&&g&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,I=h&&(d==="load"||d==="taint")&&g&&S&&e.anchorsBlockedUnderD1===0,v=e.aborted===null&&e.unboundedHard===0&&!i&&r===0,_=h&&d==="load"&&v&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,k=h&&(d==="load"||d==="taint")&&v&&S&&e.anchorsBlockedUnderD1===0,m=h&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,y=h&&(d==="load"||d==="taint")&&v&&S&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:f,verified:t.verified,surfaceComplete:o,oog:r,classScoped:i,predicted:{d1:E,d2:w,d1d2:I,d2Amended:_,d1d2Amended:k,d1Builtins:m,d1d2AmendedBuiltins:y}}}import{readFileSync as Rp,statSync as Cp}from"node:fs";var Io=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,nr=/^[A-Za-z0-9_$.-]{1,128}$/u,Ka=64,Ba=1024*1024,za=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,Ua=/^[A-Za-z0-9@_.-]{1,128}$/u;function xe(e){throw new Error(`model claims rejected: ${e}`)}function vo(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Op(e,n){vo(e)||xe(`${n}: edge is not an object`);let{kind:t,anchorExport:r,anchorContainer:o,calleePackage:i,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&xe(`${n}: edge kind`),(typeof r!="string"||!nr.test(r))&&xe(`${n}: anchorExport ${JSON.stringify(r)}`),o!==null&&(typeof o!="string"||!nr.test(o))&&xe(`${n}: anchorContainer`),(typeof i!="string"||!Io.test(i))&&xe(`${n}: calleePackage ${JSON.stringify(i)}`),a!==null&&(typeof a!="string"||!nr.test(a))&&xe(`${n}: calleeContainer`),(typeof l!="string"||!nr.test(l))&&xe(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:r,anchorContainer:o,calleePackage:i,calleeContainer:a,calleeExport:l}}function Va(e){let n=Cp(e).size;n>Ba&&xe(`file is ${String(n)} bytes, over the ${String(Ba)} cap`);let t;try{t=JSON.parse(Rp(e,"utf8"))}catch(o){xe(`unparseable JSON: ${o instanceof Error?o.message:String(o)}`)}Array.isArray(t)||xe("root is not an array"),t.length>Ka&&xe(`${String(t.length)} claims over cap ${String(Ka)}`);let r=[];for(let o of t){vo(o)||xe("claim is not an object");let{packageName:i,modelId:a,range:l,edges:s}=o;(typeof i!="string"||!Io.test(i))&&xe("packageName"),(typeof a!="string"||!Ua.test(a))&&xe("modelId (identifier charset, 1-128 chars)"),r.some(u=>u.model.modelId===a)&&xe(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!vo(l)||typeof l.introduced!="string")&&xe(`${a}: range`),za.test(l.introduced)||xe(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let d=l.fixedBefore;d!==null&&typeof d!="string"&&xe(`${a}: fixedBefore`),typeof d=="string"&&!za.test(d)&&xe(`${a}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(s)||xe(`${a}: edges`),s.length>64&&xe(`${a}: ${String(s.length)} edges over cap ${String(64)}`),r.push({model:{packageName:i,modelId:a,edges:s.map(u=>Op(u,a))},introduced:l.introduced,fixedBefore:d})}return r}var Pp=["in-app-purchase@1-v1"];function Ao(e,n,t){let r=[],o=[],i=[],a=(l,s,d,u)=>{o.push(d),i.push({modelId:u??l.model.modelId,status:s,reason:d,edgeCount:l.model.edges.length})};for(let l of e){if(!Io.test(l.model.packageName)||!Ua.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Pp.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let s=n(l.model.packageName);if(typeof s!="string"&&s!==void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} installed at more than one version (${s.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(s===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let d;try{d=En(s,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${s} not an exact triple \u2014 inert (never guessed)`);continue}if(!d){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${s} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}r.push(l.model),i.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:r,notes:o,dispositions:i}}var Mp=4,Dp={additiveForms:!0,namelessExports:!0},Tp=new Set(["dep-opaque","dynamic-load","dispatch"]),Lp={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Ro(e,n,t){return e.tier==="unknown"&&Lp[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&Tp.has(e.unknownKind)&&n!==null&&n.verified}var Fp=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),Xe=class extends Error{},Co="cupel/coverage-gap",Za={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function ht(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Xa(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Ya(e,n,t){let r=new Map(e.modules.map(a=>[a.path,a.id])),o=e.modules[0]?.id;if(o===void 0)return[];let i=n.map(a=>({source:r.get(a.path)??o,cause:Za[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));for(let a of t)i.push({source:o,reach:{kind:"unbounded"},cause:a});return i}function _o(e,n,t,r,o){let i=t.filter(a=>a.exportName!==null&&(r===1||o||a.verified!==1));return i.length>0?i.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function jp(e,n){let t;try{t=gt(e)}catch{return!0}let r=3,o=(i,a)=>{if(a>r)return!1;let l;try{l=Ja(i)}catch{return!1}for(let s of l){if(s==="node_modules"||s.startsWith("."))continue;let d=tn.join(i,s),u;try{u=No(d)}catch{continue}if(!u.isDirectory())continue;let p=tn.relative(t,d).split(tn.sep).join("/");try{if(No(tn.join(d,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(o(d,a+1))return!0}return!1};return o(t,1)}function Kp(e,n){let t="";for(let r of e)r.rel!==""&&n.startsWith(`${r.rel}/`)&&r.rel.length>t.length&&(t=r.rel);return t}function Bp(e,n,t){let r=[];if(t&&r.push("nested-app-root"),n==="")return[...r,"manifest-unreadable"];let o;try{if(o=gt(tn.resolve(e,n)),!o.startsWith(gt(e)+tn.sep))return[...r,"manifest-unreadable"]}catch{return[...r,"manifest-unreadable"]}let i;try{let u=tn.join(o,"package.json");if(!No(u).isFile())return[...r,"manifest-unreadable"];i=$p(u,"utf8")}catch{return[...r,"manifest-unreadable"]}let a;try{a=JSON.parse(i)}catch{return[...r,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...r,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&r.push("bin");let s=["preinstall","install","postinstall","prepare","prepublish"],d=l.scripts;if(typeof d=="object"&&d!==null){let u=d;s.some(p=>typeof u[p]=="string")&&r.push("install-script")}return(l.gypfile===!0||zp(o))&&r.push("native-artifact"),r}function zp(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=tn.join(e,n),r;try{r=Ja(t)}catch{continue}if(r.some(o=>o.endsWith(".node")))return!0}return!1}function Up(e,n){let t=new Set(["npm",...n.ecosystems?.()??[]]),r=[];for(let o of e.perRoot){let i=new Map;for(let a of o.packages){let l=a.ecosystem??"npm";t.has(l)||i.set(l,(i.get(l)??0)+1)}for(let[a,l]of[...i.entries()].sort())r.push({kind:"ecosystem-uncovered",detail:`${o.rootRel===""?"":`${o.rootRel}: `}${String(l)} ${a} distribution(s) were enumerated but the loaded shard carries no ${a} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${a} shard to assess them (ADR-109 D5).`,blindsAnalysis:!1,rootRel:o.rootRel})}return r}function Qa(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function Vp(e,n,t){return new Map(n.map(r=>[Qa(r),Bp(e,r.lockKey,t)]))}function Wp(e){let n=new Map;for(let t of e){let r=n.get(t.advisory.id);r===void 0?n.set(t.advisory.id,[t]):r.push(t)}return n}function qp(e,n,t,r,o,i,a){let{finding:l}=mt(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:a(t)},ht(r.advisory.id,t.name,r.affected),null,o,i);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function mt(e,n,t,r,o,i,a){let l=xr({graph:e,installed:t,range:r,symbol:o,coverage:null,incompleteness:i,analysisAborted:a});if(n!==null&&o!==null&&Ro(l,o,"base")){let s=Jn(e,n.modulesById,n.reachMods,o,n.records);if(s!==null)return{finding:l,hit:s}}return{finding:l,hit:null}}function Gp(e,n){let t=new Set,r=[];for(let o of e.packages)if((o.ecosystem??"npm")==="npm")for(let{advisory:i,affected:a}of n.advisoriesForPackage(o.ecosystem??"npm",o.name)){let l=ht(i.id,o.name,a),s;try{s=En(o.version,l)}catch{continue}if(s)for(let d of n.symbolsForAffected(a.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let u=`${o.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(u)||(t.add(u),r.push({packageName:o.name,packageRootRel:o.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return r.sort((o,i)=>`${o.packageRootRel}\0${o.container}\0${o.sourcePath}`.localeCompare(`${i.packageRootRel}\0${i.container}\0${i.sourcePath}`)),r.slice(0,zt)}function Hp(e,n,t){let r=new Map(e.functions.map(l=>[l.id,l])),o=new Map(e.classes.map(l=>[l.id,l.name])),i=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let s=i.get(l.callSiteId);if(s===void 0)continue;let d=r.get(s.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=r.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?o.get(p.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:d.id})}return a}function Xp(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),r=new Map(e.functions.map(u=>[u.id,u])),o=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&o.add(u.id);let i=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let p=i.get(u.exportId);if(p===void 0||!n.has(p.moduleId))continue;let f=r.get(u.target.functionId);f===void 0||t.get(f.moduleId)?.externalSurface===!0||o.add(f.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let p=a.get(u.callSiteId);if(p===void 0)continue;let f=l.get(p);f===void 0?l.set(p,[u.calleeFunctionId]):f.push(u.calleeFunctionId)}let s=new Set(o),d=[...o];for(;d.length>0;){let u=d.pop();if(u!==void 0)for(let p of l.get(u)??[])s.has(p)||(s.add(p),d.push(p))}return s}function Yp(e,n,t,r){for(let o of n){if(o.modelId!==e.modelId||o.anchor.packageName!==e.anchorPackage||o.anchor.exportName!==e.entryExport)continue;let i=t.filter(l=>l.packageName===o.anchor.packageName&&l.exportName===o.anchor.exportName&&l.container===o.anchor.container),a=i.find(l=>l.resolution==="resolved")??i[0];if(a!==void 0)return r.has(a.callerFunctionId)}return null}function Jp(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(i=>i.modelId!==void 0);let r=new Set(t),o=i=>r.has(i)||r.has(Fe[i]??"");return e.some(i=>i.tier==="unknown"&&i.unknownKind!==void 0&&o(i.unknownKind)||i.modelPromotedFromKind!==void 0&&o(i.modelPromotedFromKind))}function Oo(e){let n=gt(e.dir),t=e.reader??(e.shardPathPypi!==void 0?kr([Zn(e.shardPath),Zn(e.shardPathPypi)]):Zn(e.shardPath)),r=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(wn))throw new Xe(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${wn})`);let o=null;if(e.summaryShadow!==void 0)try{o=Oa(e.summaryShadow)}catch(x){throw new Xe(`--summary-shadow facts dir rejected: ${x instanceof Error?x.message:String(x)}`)}let i=null;if(e.modelShadow!==void 0)try{i=Va(e.modelShadow.claimsPath)}catch(x){throw new Xe(`--model-shadow claims rejected: ${x instanceof Error?x.message:String(x)}`)}let a=po(n,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{}}),l=Aa(n,a,e.installedSet);if(l.truncated){let x=l.perRoot.filter(N=>N.truncated).map(N=>N.rootRel===""?"the scan root":`\`${N.rootRel}\``);throw new Xe(`the dependency enumeration hit a hard cap and is incomplete at ${x.length>0?x.join(", "):"the union across roots"} (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let s=Na(l.packages.filter(x=>(x.ecosystem??"npm")==="npm")),d=e.entry??[],u=d.length>0?Ks(n,d):{entrypoints:[],rejected:[]},p=u.rejected,f=js(n,a.roots),h=[...new Set([...f.entrypoints,...u.entrypoints])],g=[...f.sources];for(let x of u.entrypoints)f.entrypoints.includes(x)||g.push({source:"--entry",specifier:x,entrypoint:x,launch:!1,root:Kp(a.roots,x)});let S=Gp(l,t),E=e.bindingForms??Dp,w=e.callablePackageResolver===!0,I=e.tsconfigPaths!==!1,v=jp(n,pt(g)),_=Vp(n,l.packages,v),k=x=>_.get(Qa(x))??["manifest-unreadable"],m=to({appRoot:n,entrypoints:h,depClassAnchors:S,bindingForms:E,callablePackageResolver:w,tsconfigPaths:I}),y=m.graph,A=yr(y),C=[...f.diagnostics,...ro(f),...oo(f,h.length),...bo(a,g),...m.diagnostics],T=Xa(h.length,y),P=[...l.gaps,...Ra(a),...Up(l,t)],R=Ca(P),F=Ya(y,C,R),O=n;try{O=gt(n)}catch{}let L=Fa({graph:y,facts:F,diagnostics:C,analysisAborted:T,loadSites:m.loadSites,conditionUnions:m.conditionUnions,provenAbsent:m.provenAbsent,appRootReal:O,rootBudget:a.budget,causeOf:x=>Za[x]}),K=t.allModels?.()??[],G=Ao(K.map(x=>({model:{packageName:x.packageName,modelId:x.modelId,edges:x.edges},introduced:x.introduced,fixedBefore:x.fixedBefore})),s),B=G.models.length>0?st(y,G.models).delta:null,W=B!==null?{records:B.records,reachMods:Ze(y),modulesById:new Map(y.modules.map(x=>[x.id,x]))}:null,$=[],q=new Map,H=Fp(),Ee=[],he=[];for(let x of l.packages)for(let[,N]of Wp(t.advisoriesForPackage(x.ecosystem??"npm",x.name))){let D=N[0];if(D!==void 0){let te=q.get(D.advisory.id),ue=N.map(de=>de.affected);te===void 0?q.set(D.advisory.id,{advisory:D.advisory,ranges:ue}):te.ranges.push(...ue)}let j=N.filter(te=>qp(y,W,x,te,F,T,k)),Y=j.length>0?j:N.slice(0,1),Z=j.length===0;for(let{advisory:te,affected:ue}of Y){let de=ht(te.id,x.name,ue),fe=te.cveId??te.id,ne=Z?[]:t.symbolsForAffected(ue.id),on=ne.filter(ce=>ce.exportName===null),sn=_o(te.id,x.name,ne,ue.surfaceComplete,r),Le=mt(y,W,{name:x.name,version:x.version,...x.ecosystem!==void 0?{ecosystem:x.ecosystem}:{},devOnly:x.dev,outOfGraphExecution:k(x)},de,null,F,T).finding;if(Le.decidedAtStage==="presence"||Le.decidedAtStage==="version-match"){H[Le.tier]+=1,$.push({...Le,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:de.surfaceComplete,advisoryId:te.id,displayId:fe,packageName:x.name,version:x.version,symbolName:null,symbolPath:null,severity:te.severity,packageLocation:Qt(l,x)});continue}for(let ce of sn){let{finding:Ye,hit:Ce}=mt(y,W,{name:x.name,version:x.version,...x.ecosystem!==void 0?{ecosystem:x.ecosystem}:{},devOnly:x.dev,outOfGraphExecution:k(x)},de,ce,F,T),Je=Ye,fn,z;Ce!==null&&ce!==null&&(fn=Ce.modelId,z=Ye.unknownKind,Je={basis:void 0,tier:Ce.tier,decidedAtStage:Ye.decidedAtStage,reason:`boundary model ${Ce.modelId}: ${Ce.anchorPackage}.${Ce.entryExport} reaches ${ce.exportName} [${Ce.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:_t(ce),path:void 0,unresolvedSites:Ye.unresolvedSites,unresolvedEvidence:Ye.unresolvedEvidence}),H[Je.tier]+=1;let X=ja(L,Je,ce,k(x).length,de.surfaceComplete),Q={...Je,...X!==void 0?{adr105:X}:{},modelId:fn,modelPromotedFromKind:z,surfaceComplete:de.surfaceComplete,advisoryId:te.id,displayId:fe,packageName:x.name,version:x.version,symbolName:ce?.exportName??null,symbolPath:ce?.sourcePath||null,severity:te.severity,packageLocation:Qt(l,x)};$.push(Q);let Ie=new Set(["dep-opaque","dynamic-load","dispatch"]);o!==null&&Q.tier==="unknown"&&Q.decidedAtStage==="symbol-reachable"&&Q.unknownKind!==void 0&&Ie.has(Q.unknownKind)&&ce!==null&&Ee.push({finding:Q,symbol:ce}),i!==null&&Q.tier==="unknown"&&ce!==null&&he.push({finding:Q,symbol:ce})}for(let ce of on)H.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:de.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${fe} carries a ${ce.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:te.id,displayId:fe,packageName:x.name,version:x.version,symbolName:null,symbolPath:null,severity:te.severity,packageLocation:Qt(l,x)})}}for(let x of P)H.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:x.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:Co,displayId:Co,packageName:x.kind,version:"",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:_a(l,x)});let ve=H["reachable-high"]+H["reachable-medium"],Sn=e.failOnReachable===!0&&ve>0,Gn=Jp($,H.unknown,e.failOnUnknown),M=e.requireCompleteDenial===!0&&$.some(x=>x.tier==="not-reachable"&&x.basis==="loader-assumption"),J=Sn||Gn||M?2:0,oe;if(o!==null){let x=Ze(y),N=new Map(y.modules.map(j=>[j.id,j])),D=[];for(let{finding:j,symbol:Y}of Ee){let Z=hr(y,N,x,Y,o,Mp);D.push({advisoryId:j.advisoryId,packageName:j.packageName,symbolName:j.symbolName,unknownKind:j.unknownKind??null,wouldPromote:Z!==null,...Z!==null?{anchorPackage:Z.anchorPackage,entryExport:Z.entryExport,viaPackages:Z.viaPackages,totalHops:Z.totalHops}:{}})}oe={records:D}}let ie;if(i!==null&&e.modelShadow!==void 0){let x=e.modelShadow.widened===!0?"widened":"base",{models:N,notes:D,dispositions:j}=Ao(i,s,{shadowConsultDenylisted:!0}),{delta:Y}=st(y,N),Z=Ze(y),te=new Map(y.modules.map(z=>[z.id,z])),ue=Hp(y,te,Z),de=Xp(y),fe=Y.records.some(z=>ue.some(X=>X.packageName===z.anchor.packageName&&X.exportName===z.anchor.exportName&&X.container===z.anchor.container)),ne=[],on=Date.now();for(let{finding:z,symbol:X}of he){let Q=Y.records,Ie=Ro(z,X,x),Se=Ie?Jn(y,te,Z,X,Q):null,se=Y.records.filter(Ae=>Ae.callee.packageName===X.packageName&&Ae.callee.exportName===X.exportName&&Ae.callee.container===X.container||Ae.callee.packageName===X.packageName&&Ae.callee.realFunctionId!==null);ne.push({advisoryId:z.advisoryId,packageName:z.packageName,symbolName:z.symbolName,unknownKind:z.unknownKind??null,decidedAtStage:z.decidedAtStage,consultSurface:x,noHitReason:Se!==null?null:Ie?fe?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:Se!==null?Yp(Se,Q,ue,de):null,verdictBefore:z.tier,verdictAfter:Se!==null?"reachable-low":z.tier,wouldPromote:Se!==null,...Se!==null?{modelId:Se.modelId,anchorPackage:Se.anchorPackage,entryExport:Se.entryExport,pathLabels:Se.pathLabels,calleeBinding:se.find(Ae=>Ae.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:Ie?se.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${se[0]?.anchor.packageName??"?"}#${se[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let sn=Date.now()-on,Le=j.map(z=>{if(z.status!=="active")return{modelId:z.modelId,state:z.status,reason:z.reason,edgesLowered:0,edgesReferenceGated:0};let X=Y.records.filter(Ie=>Ie.modelId===z.modelId).length;if(X>0)return{modelId:z.modelId,state:"lowered",reason:null,edgesLowered:X,edgesReferenceGated:z.edgeCount-X};let Q=Y.notes.find(Ie=>Ie.startsWith(`model ${z.modelId}:`)||Ie.startsWith(`model-edge ${z.modelId}:`));return{modelId:z.modelId,state:"refused",reason:Q??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:z.edgeCount}}),ce=ne.filter(z=>z.wouldPromote).length,Ye=H.unknown-ce,Ce=H["reachable-high"]+H["reachable-medium"],Je=z=>({none:0,"fail-on-reachable":Ce>0?2:0,"fail-on-unknown":z>0?2:0,both:Ce>0||z>0?2:0});ie={records:ne,notes:[...D,...Y.notes],laneStates:Le,exitCodes:{baseline:Je(H.unknown),withModels:Je(Ye)},overlayWallMs:sn},qa(tn.dirname(e.modelShadow.outPath),{recursive:!0});let fn=`${e.modelShadow.outPath}.tmp-${Wa(8).toString("hex")}`;Ha(fn,`${JSON.stringify(ie,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Ga(fn,e.modelShadow.outPath)}let rn;if(e.bindingShadow!==void 0){let x=Date.now(),N=z=>G.models.length>0?{records:st(z,G.models).delta.records,reachMods:Ze(z),modulesById:new Map(z.modules.map(X=>[X.id,X]))}:null,D=(z,X,Q,Ie)=>{let Se=[];for(let se of l.packages)for(let{advisory:Ae,affected:kn}of t.advisoriesForPackage(se.ecosystem??"npm",se.name)){let Mn=ht(Ae.id,se.name,kn),ql=_o(Ae.id,se.name,t.symbolsForAffected(kn.id),kn.surfaceComplete,r);for(let ei of ql){let{finding:ni,hit:pr}=mt(z,Ie,{name:se.name,version:se.version,...se.ecosystem!==void 0?{ecosystem:se.ecosystem}:{},devOnly:se.dev,outOfGraphExecution:k(se)},Mn,ei,X,Q);Se.push({advisoryId:Ae.id,packageName:se.name,symbolName:ei?.exportName??null,tier:pr!==null?pr.tier:ni.tier,unknownKind:pr!==null?null:ni.unknownKind??null})}}return Se},j=z=>{let X=to({appRoot:n,entrypoints:h,depClassAnchors:S,bindingForms:z,callablePackageResolver:w,tsconfigPaths:I}),Q=[...f.diagnostics,...ro(f),...oo(f,h.length),...bo(a,g),...X.diagnostics];return{graph:X.graph,inc:Ya(X.graph,Q,R),aborted:Xa(h.length,X.graph),live:N(X.graph),applicability:X.bindingApplicability}},Y=z=>{let X=j(z);return D(X.graph,X.inc,X.aborted,X.live)},Z=j({}),te=D(Z.graph,Z.inc,Z.aborted,Z.live),ue=D(y,F,T,W);if(ue.length!==te.length)throw new Xe("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let de=(z,X)=>X.tier!==z.tier||X.unknownKind!==z.unknownKind,fe=te.some((z,X)=>{let Q=ue[X];return Q!==void 0&&de(z,Q)}),ne=fe?Y({additiveForms:!0}):null,on=fe?Y({namelessExports:!0}):null,sn=0,Le=te.map((z,X)=>{let Q=ue[X];if(Q===void 0||Q.advisoryId!==z.advisoryId||Q.packageName!==z.packageName||Q.symbolName!==z.symbolName)throw new Xe("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Ie={advisoryId:z.advisoryId,packageName:z.packageName,symbolName:z.symbolName,unknownKind:z.unknownKind,verdictBefore:z.tier,verdictAfter:Q.tier,wouldPromote:Q.tier!==z.tier&&(Q.tier==="reachable-high"||Q.tier==="reachable-medium"||Q.tier==="reachable-low")};if(!de(z,Q)||ne===null||on===null)return Ie;sn+=1;let Se=ne[X],se=on[X],Ae=Se!==void 0&&de(z,Se),kn=se!==void 0&&de(z,se);return{...Ie,attributedArm:Ae&&!kn?"additiveForms":kn&&!Ae?"namelessExports":"both",...Se!==void 0?{verdictArmA:Se.tier}:{},...se!==void 0?{verdictArmB:se.tier}:{}}}),ce={...H};te.forEach((z,X)=>{let Q=ue[X];Q!==void 0&&Q.tier!==z.tier&&(ce[Q.tier]-=1,ce[z.tier]+=1)});let Ye=(z,X)=>({none:0,"fail-on-reachable":z>0?2:0,"fail-on-unknown":X>0?2:0,both:z>0||X>0?2:0}),Ce;if(G.models.length>0&&W!==null){Ce=[];for(let z of l.packages)for(let{advisory:X,affected:Q}of t.advisoriesForPackage(z.ecosystem??"npm",z.name)){let Ie=ht(X.id,z.name,Q),Se=_o(X.id,z.name,t.symbolsForAffected(Q.id),Q.surfaceComplete,r);for(let se of Se){if(se===null||!se.verified)continue;let Ae=mt(Z.graph,Z.live,{name:z.name,version:z.version,...z.ecosystem!==void 0?{ecosystem:z.ecosystem}:{},devOnly:z.dev,outOfGraphExecution:k(z)},Ie,se,Z.inc,Z.aborted);if(!(Ae.hit===null&&Ro(Ae.finding,se,"base")))continue;let Mn=Jn(y,W.modulesById,W.reachMods,se,W.records);Ce.push({advisoryId:X.id,packageName:z.name,symbolName:se.exportName,modelWouldPromote:Mn!==null,...Mn!==null?{modelId:Mn.modelId}:{},anchorCleared:Mn!==null})}}}let Je=$.some(z=>z.modelId!==void 0);rn={records:Le,deltas:sn,exitCodes:{baseline:Ye(ce["reachable-high"]+ce["reachable-medium"],ce.unknown+(Je?1:0)),withBindingForms:Ye(H["reachable-high"]+H["reachable-medium"],H.unknown+(Je?1:0))},dualRunWallMs:Date.now()-x,...m.bindingApplicability!==void 0?{applicability:m.bindingApplicability}:{},...Ce!==void 0?{modelProbe:Ce}:{}},qa(tn.dirname(e.bindingShadow.outPath),{recursive:!0});let fn=`${e.bindingShadow.outPath}.tmp-${Wa(8).toString("hex")}`;Ha(fn,`${JSON.stringify(rn,null,2)}
+`,{encoding:"utf8",flag:"wx"}),Ga(fn,e.bindingShadow.outPath)}let bn=K.length>0||G.notes.length>0?{active:G.models.length,stored:K.length,promoted:$.filter(x=>x.modelId!==void 0).length,notes:[...G.notes,...B!==null?B.notes:[]]}:void 0;return{...oe!==void 0?{summaryShadow:oe}:{},...ie!==void 0?{modelShadow:ie}:{},...rn!==void 0?{bindingShadow:rn}:{},...bn!==void 0?{modelLane:bn}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:$,counts:H,analyzerDiagnostics:C,analysisAborted:T,rejectedEntries:p,entrypointSources:g,entrypointGaps:[...f.gaps,...f.surfaceGaps],entrypointObservations:f.observations,framework:f.framework,unresolved:A,advisories:[...q.values()],rootSet:a,exitCode:J,adr105:L.report}}finally{e.reader===void 0&&t.close()}}var Zp="cupel",Qp="reachability-first SCA \u2014 verdict + call path + confidence";function Po(e){return[`${Zp} v${e} \u2014 ${Qp}`,`cascade: ${ci.join(" \u2192 ")}`,`verdicts: ${ui.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
+`)}var em=new Set([...Sr,...br]);function cn(e,n,t){let r=e[n+1];if(r===void 0||r.startsWith("--"))throw new Error(`${t} requires a value`);return r}function nm(e){let n=e.split(",").map(o=>o.trim()),t=[...Sr,...br].join(", ");if(n.length===0||n.some(o=>o===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let r=[];for(let o of n){if(!em.has(o))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(o)}; valid: ${t}`);r.push(o)}return r}function el(e){let n=".",t,r,o,i=!1,a=!1,l=!1,s=!1,d=!1,u,p,f,h=!1,g=!1,S,E=!1,w=!0,I=!1,v,_=[],k=[];for(let m=0;m<e.length;m+=1){let y=e[m];if(y==="--require-complete-denial"){a=!0;continue}if(y==="--fail-on-reachable")i=!0;else if(y==="--fail-on-unknown")l="all";else if(y!==void 0&&y.startsWith("--fail-on-unknown="))l=nm(y.slice(18));else if(y==="--offline")s=!0;else if(y==="--sarif")t=cn(e,m,"--sarif"),m+=1;else if(y==="--shard")r=cn(e,m,"--shard"),m+=1;else if(y==="--shard-pypi")o=cn(e,m,"--shard-pypi"),m+=1;else if(y==="--entry")_.push(cn(e,m,"--entry")),m+=1;else if(y==="--root")k.push(cn(e,m,"--root")),m+=1;else if(y==="--summary-shadow")u=cn(e,m,"--summary-shadow"),m+=1;else if(y==="--model-shadow")p=cn(e,m,"--model-shadow"),m+=1;else if(y==="--model-shadow-out")f=cn(e,m,"--model-shadow-out"),m+=1;else if(y==="--model-shadow-widened")h=!0;else if(y==="--binding-shadow")g=!0;else if(y==="--binding-shadow-out")S=cn(e,m,"--binding-shadow-out"),m+=1;else if(y==="--x-partial-rows")E=!0;else if(y==="--no-tsconfig-paths")w=!1;else if(y==="--x-tsconfig-paths")w=!0;else if(y==="--push")I=!0;else if(y!==void 0&&y.startsWith("--auth=")){let A=y.slice(7);if(A!=="oidc"&&A!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(A)}`);v=A}else{if(y!==void 0&&y.startsWith("--"))throw new Error(`unknown flag ${y}`);y!==void 0&&!d&&(n=y,d=!0)}}if(p===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(h&&p===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(g!==(S!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(v!==void 0&&!I)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:r,shardPypi:o,failOnReachable:i,requireCompleteDenial:a,failOnUnknown:l,offline:s,entry:_,root:k,summaryShadow:u,modelShadow:p,modelShadowOut:f,modelShadowWidened:h,push:I,auth:v,bindingShadow:g,bindingShadowOut:S,partialRows:E,tsconfigPaths:w}}import{chmodSync as lm,mkdirSync as dm,readFileSync as cm,renameSync as um,statSync as fm,unlinkSync as pm,writeFileSync as mm}from"node:fs";import{randomBytes as hm}from"node:crypto";import{homedir as gm}from"node:os";import Pn from"node:path";import{createPublicKey as tm,verify as rm}from"node:crypto";function Ve(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function nl(e,n={}){let t=n.maxBytes??1073741824,r=n.timeoutMs??3e4,{get:o}=await import("node:https");return await new Promise((i,a)=>{let l=o(e,n.headers!==void 0?{headers:n.headers}:{},s=>{let d=s.statusCode??0;if(d<200||d>=300){s.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let u=[],p=0;s.on("data",f=>{if(p+=f.length,p>t){s.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(f)}),s.on("end",()=>{i(Buffer.concat(u))}),s.on("error",a)});l.on("error",a),l.setTimeout(r,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(r)}ms`))})})}async function yt(e,n,t,r,o,i=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((s,d)=>{let u=a(n,{method:e,headers:t},p=>{let f=[],h=0;p.on("data",g=>{if(h+=g.length,h>o){p.destroy(),d(new Error(`${e} to ${l} returned more than ${String(o)} bytes`));return}f.push(g)}),p.on("end",()=>{s({status:p.statusCode??0,body:Buffer.concat(f).toString("utf8")})}),p.on("error",()=>{d(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{d(new Error(`${e} to ${l} failed`))}),u.setTimeout(i,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(i)}ms`))}),r!==void 0&&u.write(r),u.end()})}var ee=class extends Error{constructor(n){super(n),this.name="DistError"}},On=class extends ee{constructor(n){super(n),this.name="NoCachedShardError"}},om=Buffer.from("302a300506032b6570032100","hex"),im=32;function il(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===im)try{return tm({key:Buffer.concat([om,n]),format:"der",type:"spki"})}catch{return}}function $o(e,n,t){for(let r of t){let o=il(r);if(o!==void 0)try{if(rm(null,e,o,n))return!0}catch{}}return!1}function sl(e){return e.some(n=>il(n)!==void 0)}var sm=/^[0-9a-f]{64}$/u,am=/^[a-z0-9-]+$/u;function tl(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new ee(`${n} must be an object`);return e}function rl(e,n){if(!Array.isArray(e))throw new ee(`${n} must be an array`);return e}function tr(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new ee(`${n} must be an integer`);return e}function rr(e,n){if(typeof e!="string")throw new ee(`${n} must be a string`);return e}function ol(e,n){let t=rr(e,n);if(Number.isNaN(Date.parse(t)))throw new ee(`${n} is not a valid timestamp: ${t}`);return t}function Mo(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new ee("distribution index is not valid JSON")}let r=tl(t,"index"),o=tr(r.schema_version,"schema_version");if(o!==n.supportedIndexSchemaVersion)throw new ee(`index schema_version ${String(o)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let i=tr(r.sequence,"sequence");if(i<0)throw new ee("sequence must be non-negative");let a=ol(r.generated,"generated"),l=rl(r.shards,"shards"),s;for(let g of l){let S=tl(g,"shard entry"),E=rr(S.ecosystem,"ecosystem");if(!am.test(E))throw new ee(`ecosystem ${JSON.stringify(E)} is malformed`);if(E===n.ecosystem){s=S;break}}if(s===void 0)throw new ee(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);ol(s.built,"built");let d=tr(s.db_schema_version,"db_schema_version");if(d<1)throw new ee("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new ee(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=rr(s.sha256,"sha256");if(!sm.test(u))throw new ee(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let p=tr(s.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new ee(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let f=rl(s.urls,"urls");if(f.length===0)throw new ee("urls must be a non-empty array");let h=[];for(let g of f){let S=rr(g,"url");try{h.push(Ve(S,n.shardHosts))}catch(E){throw new ee(`refusing shard url ${JSON.stringify(S)}: ${E.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:p,dbSchemaVersion:d,urls:h,sequence:i,generated:a}}var al="CUPEL_CONFIG_DIR",ll="credentials.json",Do="cpd_",ym="cpl_",xm=Do.length+6+32,Sm=200,bm=/^[A-Za-z0-9_-]+$/u,xt=class extends ee{constructor(n){super(n),this.name="StoredCredentialError"}};function dl(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=gm();if(process.platform==="darwin")return Pn.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let i=e.APPDATA,a=i!==void 0&&i!==""?i:Pn.join(t,"AppData","Roaming");return Pn.join(a,"cupel")}let r=e.XDG_CONFIG_HOME,o=r!==void 0&&r!==""?r:Pn.join(t,".config");return Pn.join(o,"cupel")}function or(e){return Pn.join(dl(e),ll)}function To(e){let n=e.trim();return n.startsWith(ym)?{ok:!1,reason:"push-token"}:n.startsWith(Do)?n.length<xm||n.length>Sm?{ok:!1,reason:"malformed"}:bm.test(n.slice(Do.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function cl(e,n){let t=dl(e),r=Pn.join(t,ll);dm(t,{recursive:!0,mode:448}),process.platform!=="win32"&&lm(t,448);let o=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),i=`${r}.tmp-${hm(8).toString("hex")}`;return mm(i,`${o}
+`,{flag:"wx",mode:384}),um(i,r),r}function ul(e){let n=or(e),t;try{t=fm(n)}catch(a){if(a instanceof Error&&a.code==="ENOENT")return;throw a}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new xt(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let r;try{r=JSON.parse(cm(n,"utf8"))}catch{throw new xt(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let o=typeof r=="object"&&r!==null&&"delivery_token"in r?r.delivery_token:void 0,i=To(typeof o=="string"?o:"");if(!i.ok)throw new xt(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return i.token}function fl(e){try{return pm(or(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var St="CUPEL_DELIVERY_TOKEN",Lo=class extends ee{constructor(n){super(n),this.name="NoDeliveryTokenError"}},Fo=class extends ee{constructor(n){super(n),this.name="DeliveryCredentialError"}};function km(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function pl(e,n,t=()=>{}){let r=km(e)??t();return r!==void 0?()=>Promise.resolve(r):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function ml(e){if(e===void 0)throw new Lo(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${St} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new Fo(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Em="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function wm(){return new Promise(e=>{let n=process.stdin;process.stderr.write(Em),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",r=i=>{n.setRawMode(!1),n.pause(),n.removeListener("data",o),process.stderr.write(`
+`),i===null&&process.exit(130),e(i)},o=i=>{for(let a of i){if(a==="")return r(null);if(a==="\r"||a===`
+`)return r(t);if(a==="\x7F"||a==="\b"){t=t.slice(0,-1);continue}t+=a}};n.on("data",o)})}async function vm(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function hl(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${U(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
+`),!0)}async function gl(e){if(hl(e,"login"))return 1;let n=process.stdin.isTTY?await wm():await vm(),t=To(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
 `:`cupel login: that is not a delivery token. Paste the whole token as shown once on app.cupel.sh (Settings \u2192 Tokens); it starts with cpd_.
-`),1;let r=Ao(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${r} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${Xn} in the environment still wins, and \`cupel logout\` forgets it.
-`),0}function Mo(e){if(Ro(e,"logout"))return 1;let n=Ot(process.env);return No(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
-`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${wo} would point elsewhere).
-`),0}import{randomBytes as Mu,createHash as Pu}from"node:crypto";import{mkdirSync as Lu,readFileSync as Tu,renameSync as Du,writeFileSync as Fu}from"node:fs";import{homedir as ju}from"node:os";import kn from"node:path";var qr="latest.json",Hr="latest.json.sig";function Rt(e){return Pu("sha256").update(e).digest("hex")}function Po(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=ju();if(process.platform==="darwin")return kn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let i=process.env.LOCALAPPDATA,s=i!==void 0&&i!==""?i:kn.join(n,"AppData","Local");return kn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,r=t!==void 0&&t!==""?t:kn.join(n,".cache");return kn.join(r,"cupel","shards")}function Wr(e,n,t){return kn.join(e,`${n}-${t}.sqlite`)}function $t(e,n){Lu(kn.dirname(e),{recursive:!0});let t=`${e}.tmp-${Mu(8).toString("hex")}`;Fu(t,n,{flag:"wx"}),Du(t,e)}function Jn(e){try{return Tu(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function Lo(e,n,t,r){let i=Wr(e,n,t),s=Jn(i);if(s===void 0)return;let a=Rt(s);if(a!==t)throw r(`cached shard ${i} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:i,bytes:s}}var To="api.cupel.sh",Mt=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Do=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Pt from"node:path";var Ku="/v1/resolve",Gr=1024*1024,Xr=4096,Fo=Gr+Xr+64*1024,Bu=8,zu=2048,Uu=/^[A-Za-z0-9+/]+={0,2}$/u,Vu=3e4,me=class extends X{constructor(n){super(n),this.name="DeliveryRefusedError"}},Yn=class extends X{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Zn=class extends X{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function qu(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Hu(e){if(typeof e!="string"||e.length===0)throw new me("the delivery response carried no index signature");if(e.length>Xr||!Uu.test(e))throw new me("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new me("the delivery response's index signature is not canonical base64");return n}function Wu(e){if(typeof e!="string"||e.length===0)throw new me("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Gr)throw new me("the delivery response's index is larger than one can be");return n}function Gu(e){if(!Array.isArray(e)||e.length===0)throw new me("the delivery response named no shard urls");if(e.length>Bu)throw new me("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>zu)throw new me("the delivery response carried a malformed shard url");n.push(t)}return n}function Xu(e,n){throw e===401||e===403?new me(`${n} rejected the delivery credential \u2014 check ${Xn} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new me(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Zn(`${n} holds nothing newer than the shard index already cached`):e===429?new Yn(`${n} rate-limited the delivery request`):e>=500?new Yn(`${n} answered ${String(e)}`):new me(`${n} refused the delivery request with status ${String(e)}`)}async function jo(e,n,t,r,i=Vu){let s=Me(`https://${e}${Ku}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await r(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,i)}catch{throw new Yn(`${e} could not be reached`)}if(l.status!==200&&Xu(l.status,e),Buffer.byteLength(l.body,"utf8")>Fo)throw new me(`${e} returned a delivery response larger than one can be`);let o;try{o=JSON.parse(l.body)}catch{throw new me(`${e} returned a delivery response that is not JSON`)}if(!qu(o))throw new me(`${e} returned a delivery response that is not an object`);return{index:Wu(o.index),sig:Hu(o.signature),shardUrls:Gu(o.shardUrls)}}var Ko=async(e,n,t,r)=>await Wn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Fo,r);var Ju=8,Yr=class extends X{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Jr(e){return`${e.origin}${e.pathname}`}function Bo(e,n,t){let r=new Map;for(let a of n)r.set(Jr(a),a);let i=[],s=[];for(let a of e.slice(0,Ju)){let l;try{l=Me(a,t)}catch(u){s.push(u.message);continue}if(l.hash!==""){s.push("a candidate carried a fragment");continue}let o=r.get(Jr(l));if(o===void 0){s.push("a candidate named an object the signed index does not list");continue}let c=new URL(`${Jr(o)}${l.search}`);i.push(Me(c.href,t))}if(i.length===0)throw new Yr(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return i}var Zu=1,Qu=1024*1024*1024;function ef(e=Mt){return{async resolve(n){return await jo(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Ko)},async fetchShard(n,t){return Me(n.href,e),await yo(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Zr(e){return e instanceof Error?e.message:String(e)}function zo(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Zu,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:Qu}}function nf(e){let n=Jn(Pt.join(e.cacheDir,qr)),t=Jn(Pt.join(e.cacheDir,Hr));if(!(n===void 0||t===void 0)&&jr(n,t,e.pubkeys))try{return Kr(n,zo(e))}catch{return}}function Uo(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let r=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(r)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Lt(e,n,t){let r=Lo(n.cacheDir,e.ecosystem,e.sha256,i=>new X(i));if(r===void 0)throw new X(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:r.path,fromCache:!0,warnings:[...t,...Uo(e,n)],sequence:e.sequence}}async function tf(e,n,t,r){let i=Wr(t.cacheDir,e.ecosystem,e.sha256),s=Jn(i);if(s!==void 0&&Rt(s)===e.sha256)return{path:i,downloaded:!1};let a="no shard urls";for(let l of n){let o;try{o=await r.fetchShard(l,e.sizeBytes)}catch(u){a=Zr(u);continue}let c=Rt(o);if(c!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${c})`;continue}return $t(i,o),{path:i,downloaded:!0}}throw new X(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function rf(e,n,t){if(e instanceof me)throw e;if(e instanceof Zn){if(n===void 0)throw new X(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Lt(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new X(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Zr(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Lt(n,t,[`could not refresh the shard index (${Zr(e)}); using the cached shard`])}async function Vo(e,n){if(!e.activated)throw new X("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??ef(e.shardHosts);if(!Eo(e.pubkeys))throw new X("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let r=nf(e);if(e.offline){if(r===void 0)throw new X(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Lt(r,e,[])}let i=await Oo(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:i,ecosystem:e.ecosystem,sequenceFloor:r?.sequence??0})}catch(c){return rf(c,r,e)}if(!jr(s.index,s.sig,e.pubkeys))throw new X("shard index signature did not verify against any pinned key");let a=Kr(s.index,zo(e));if(r!==void 0&&a.sequence<r.sequence)return Lt(r,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(r.sequence)}); keeping the newer cached shard`]);let l=Bo(s.shardUrls,a.urls,e.shardHosts),o=await tf(a,l,e,t);return $t(Pt.join(e.cacheDir,qr),s.index),$t(Pt.join(e.cacheDir,Hr),s.sig),{path:o.path,fromCache:!o.downloaded,warnings:Uo(a,e),sequence:a.sequence}}var sf="https://api.cupel.sh",qo=".actions.githubusercontent.com",of=8192,Pe=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function af(e){let n;try{n=new URL(e).hostname}catch{throw new Pe("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=qo.slice(1);if(n!==t&&!n.endsWith(qo))throw new Pe(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Me(e,new Set([n]))}catch{throw new Pe(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Tt(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,r=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Pe("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(r===void 0||r==="")throw new Pe("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let i=af(t);i.searchParams.set("audience",sf);let s;try{s=await n(i.href,{authorization:`Bearer ${r}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Pe("the ID-token request failed")}if(s.length>of)throw new Pe("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(s)}catch{throw new Pe("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new Pe("the ID-token response carried no token");return l}async function Ho(e,n,t={}){let r=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",i=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!r)throw new Pe("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Tt(e,n)};if(r)return i&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(i)return{kind:"oidc",value:await Tt(e,n)};throw new Pe("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Qr="api.cupel.sh",lf=`https://${Qr}/v1/findings`,df=64*1024,Dt=8*1024*1024,cf=3e4,ln=class extends Error{constructor(n){super(n),this.name="PushError"}};async function Wo(e,n,t,r={}){if(e.length>Dt)throw new ln(`findings payload is ${String(e.length)} bytes, over the ${String(Dt)}-byte limit`);let i=Me(lf,new Set([Qr])),s;try{s=await t(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,r.timeoutMs??cf)}catch{throw new ln(`the findings push to ${Qr} failed`)}if(s.body.length>df)throw new ln("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new ln("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new ln("the control plane rejected the findings payload as malformed"):new ln(`the findings push was refused with status ${String(s.status)}`)}var uf=64*1024,ff=64*1024,Go=async(e,n,t,r)=>{if(Buffer.byteLength(t,"utf8")>Dt)throw new Error("findings payload is over the size limit");return await Wn("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,ff,r)};async function Ft(e,n){let t=await Wn("GET",e,n,void 0,uf,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var mf=720*60*60*1e3,hf=Number(pn);function Xo(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new qe("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Jo(e){let n=await Vo({ecosystem:"npm",activated:!0,pubkeys:Do,indexHost:To,shardHosts:Mt,credential:Co(process.env,()=>Tt(process.env,Ft),()=>_o(process.env)),cacheDir:Po(),offline:e.offline,now:Date.now(),maxAgeMs:mf,supportedDbSchemaVersion:hf});for(let t of n.warnings)process.stderr.write(`cupel: ${t}
-`);return{path:n.path,sequence:n.sequence}}var gf=8,yf={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64,maxAdvisoryDetails:8e3},tn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function ei(e){return{path:e.path,start:e.start,end:e.end}}function xf(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new tn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,r=e.modelPromotedFromKind??null;if(t===null!=(r===null))throw new tn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new tn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:mi(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(i=>({functionName:i.functionName??null,modulePath:i.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(ei),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null}}var Sf="";function bf(e){return[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""].join(Sf)}function kf(e){let n=new Map;for(let t of e){let r=bf(t),i=n.get(r);if(i===void 0){n.set(r,t);continue}if(i.tier!==t.tier||i.unknownKind!==t.unknownKind)throw new tn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${i.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Ef(e){let n=yf,t=(r,i,s)=>{throw new tn(`${r} has ${String(i)} entries, over the ${String(s)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let r of["dispatch","load"]){let i=e.unresolved[r].length;i>n.maxUnresolvedSites&&t(`the app-global ${r} set`,i,n.maxUnresolvedSites)}for(let r of e.findings)r.path!==null&&r.path.length>n.maxPathSteps&&t(`the call path of finding ${r.advisoryId}`,r.path.length,n.maxPathSteps),r.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${r.advisoryId}`,r.unresolvedSites.length,n.maxUnresolvedSites);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let r of e.advisories){if(r.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${r.id}`,r.ranges.length,n.maxAdvisoryRanges),r.summary!==null&&r.summary.length>n.maxStringLength)throw new tn(`the summary of advisory ${r.id} is ${String(r.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(r.details!==null&&r.details.length>n.maxAdvisoryDetails)throw new tn(`the description of advisory ${r.id} is ${String(r.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function wf(e,n){let t=new Set(n.map(r=>r.advisoryId));return e.advisories.filter(r=>t.has(r.advisory.id)).map(r=>({id:r.advisory.id,cveId:r.advisory.cveId,osvId:r.advisory.osvId,summary:r.advisory.summary,details:r.advisory.details??null,severity:r.advisory.severity,published:r.advisory.published,source:r.advisory.source,ranges:r.ranges.map(i=>({packageName:i.packageName,introduced:i.introduced,fixed:i.fixed,lastAffected:i.lastAffected}))}))}function Yo(e,n){let t=kf(e.findings.map(xf)),r={version:gf,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(ei),load:e.unresolved.load.map(ei)},advisories:wf(e,t)};return Ef(r),r}function vf(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var If={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Zo=4,ni=3,ti=10,Qo={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},Af="(symbol set known incomplete)";function _f(e){let n=(e.path??[]).map(t=>U(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function ea(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function Nf(e){let n=e.findings.filter(c=>c.tier==="unknown"&&c.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let c of n){let u=t.get(c.unknownKind)??[];u.push(c),t.set(c.unknownKind,u)}let r={cupel:0,project:0};for(let[c,u]of t)r[$e[c]]+=u.length;let i=[];i.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(c,u)=>{if(r[c]===0)return;i.push(""),i.push(`   ${u} (${String(r[c])}):`);let f=[...t.entries()].filter(([h])=>$e[h]===c).sort((h,S)=>S[1].length-h[1].length||h[0].localeCompare(S[0])),p=f.slice(0,Zo);for(let[h,S]of p){let x=c==="project"?[...new Set(S.flatMap(ea))]:[],y=x.slice(0,ni).map(U).join(", "),v=x.length>ni?` (+${String(x.length-ni)} more files)`:"";i.push(`     ${h.padEnd(21)} ${String(S.length).padStart(4)}  ${Qo[h]}`+(y!==""?`
-       ${y}${v}`:""))}for(let[h,S]of f.slice(Zo))i.push(`     ${h.padEnd(21)} ${String(S.length).padStart(4)}  ${Qo[h]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let c of n)if($e[c.unknownKind]==="project")for(let u of ea(c))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((c,u)=>u[1]-c[1]||c[0].localeCompare(u[0]))[0];l!==void 0&&r.project>0&&(i.push(""),i.push(`   \u279C Start here: ${U(l[0])} appears in ${String(l[1])} of your ${String(r.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let o=n.filter(c=>$e[c.unknownKind]==="project");if(o.length>0){i.push("");for(let c of o.slice(0,ti))i.push(`     ${U(c.displayId)}  ${U(c.packageName)}@${U(c.version)}  [${c.unknownKind}] ${U(c.reason)}`);o.length>ti&&i.push(`     \u2026 and ${String(o.length-ti)} more`)}return i.push(""),i}function na(e){let n=[],t=e.counts,r=e.findings.filter(c=>c.tier==="reachable-high"||c.tier==="reachable-medium"||c.tier==="reachable-low");if(n.push(`cupel scan: ${U(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let c=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+c.map(u=>`${U(u.entrypoint)} [${U(u.source)}]`).join(", ")+(e.entrypointSources.length>c.length?`, \u2026 and ${String(e.entrypointSources.length-c.length)} more`:"")),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let c of e.entrypointGaps.slice(0,5))n.push(`  - ${U(c.source)} (${U(c.file)}): ${U(c.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(U).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${or(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let i=e.installed.gaps,s=i.find(c=>c.kind==="no-enumeration")??null;s!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${U(s.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=i.filter(c=>c!==s);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let c of a.slice(0,10))n.push(`  - [${U(c.kind)}] ${U(c.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(i.map(c=>c.detail)),o=[...e.analyzerDiagnostics.map(c=>`${U(c.code)}: ${U(c.detail)}`),...e.installed.diagnostics.filter(c=>!l.has(c)).map(U)];if(o.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(o.length)}) \u2014 verdicts are conservative:`);for(let c of o.slice(0,10))n.push(`  - ${c}`);o.length>10&&n.push(`  \u2026 and ${String(o.length-10)} more`),n.push("")}if(r.length>0){n.push(`\u{1F3AF} Reachable (${String(r.length)}) \u2014 fix these:`);for(let c of r)n.push(`  ${If[c.tier]} ${U(c.displayId)}  ${U(c.packageName)}@${U(c.version)}  ${U(c.symbolName??"")}`+(c.surfaceComplete===!1?`  ${Af}`:"")),n.push(`        path: ${_f(c)}`);n.push("")}return n.push(...Nf(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${vf(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as Cf}from"node:crypto";var Of="https://json.schemastore.org/sarif-2.1.0.json",ta="cupel-reachability",ri=new Set(["dispatch","dynamic-load","coverage-gap"]);function Rf(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var $f=500,Mf=10;function Pf(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function Lf(e,n){return`${e}::${n}`}function Tf(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Df(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Cf("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Ff(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:ri.has(e.unknownKind)}var ra={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function ia(e){let n=[],t=new Map,r=[];for(let o of e.findings){if(!Ff(o))continue;let c=Lf(o.displayId,o.packageName);if(!t.has(c)){t.set(c,n.length);let y=Tf(o.severity);n.push({id:U(c),properties:{tags:o.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${U(o.packageName)}`]:["security","reachability",`package/${U(o.packageName)}`],...y!==void 0?{"security-severity":y}:{}}})}let u=o.tier==="reachable-high"||o.tier==="reachable-medium"||o.tier==="reachable-low",f=o.path??[],p=f.find(y=>y.modulePath!==""),h=[...new Set(o.unresolvedSites.map(y=>y.path).filter(y=>y!==""))],S=u?p!==void 0?{physicalLocation:{artifactLocation:{uri:U(p.modulePath)}},message:{text:`calls ${U(o.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:U(o.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:U(h[0])}},message:{text:`unresolved ${U(o.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:U(o.packageLocation??(o.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},x=u?f.map(y=>({physicalLocation:{artifactLocation:{uri:U(y.modulePath||"package-lock.json")}},message:{text:U(y.functionName??"<step>")}})):h.slice(1,Mf+1).map(y=>({physicalLocation:{artifactLocation:{uri:U(y)}},message:{text:"also blocked here"}}));r.push({ruleId:U(c),ruleIndex:t.get(c),level:u?"error":"warning",message:{text:U(`[${o.tier}] ${o.displayId} in ${o.packageName}@${o.version}`+(o.symbolName!==null?` \u2014 reaches ${o.symbolName}`:"")+(o.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${o.reason}`)},locations:[S],...x.length>0?{relatedLocations:x}:{},partialFingerprints:{"cupelReachability/v1":Df(o)},properties:{tier:o.tier,advisoryId:U(o.advisoryId),...o.surfaceComplete===!1?{surfaceComplete:!1}:{},...o.modelId!==void 0?{modelId:U(o.modelId),modelPromotedFromKind:o.modelPromotedFromKind}:{},...o.unknownKind!==void 0?{unknownKind:o.unknownKind,unknownOwner:$e[o.unknownKind],unresolvedSiteCount:o.unresolvedSites.length}:{}}})}let i=new Map,s=new Map;for(let o of e.findings){if(o.tier!=="unknown"||o.unknownKind===void 0||(i.set(o.unknownKind,(i.get(o.unknownKind)??0)+1),ri.has(o.unknownKind)))continue;let c=s.get(o.unknownKind)??[];c.length<$f&&c.push({advisory:U(o.displayId),package:U(o.packageName),version:U(o.version)}),s.set(o.unknownKind,c)}let a={cupel:0,project:0};for(let[o,c]of i)a[$e[o]]+=c;let l={};for(let[o,c]of s){let u=i.get(o)??c.length;l[o]={count:u,owner:$e[o],note:ra[o],truncated:u>c.length,advisories:c}}return{$schema:Of,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:ta},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:U(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(o=>`${o.entrypoint} (${o.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...i.keys()].filter(o=>!ri.has(o)&&!Rf(o,e.analysisAborted)).sort().map(o=>({descriptor:{id:`unknown-${o}`},level:"warning",message:{text:`${String(i.get(o)??0)} finding(s) are unknown because ${ra[o]} (owner: ${$e[o]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${o}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(o=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:U(`${o.source} (${o.file}): ${o.detail}`)}})),...e.rejectedEntries.map(o=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:U(`--entry did not resolve to a file inside the app root: ${o}`)}})),...e.analyzerDiagnostics.map(o=>({descriptor:{id:o.code},level:"warning",message:{text:U(`${o.detail} (${o.path})`)}})),...e.installed.diagnostics.map(o=>({descriptor:{id:"resolve"},level:"warning",message:{text:U(o)}}))]}],results:r,properties:{category:ta,summary:e.counts,...Pf(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...i].sort((o,c)=>c[1]-o[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(o=>o.tier==="unknown"&&o.unknownKind==="db-gap").map(o=>({advisory:U(o.displayId),package:U(o.packageName),version:U(o.version)}))}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function sa(){try{let e=jf(zf(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Uf(e,n){let t=`${JSON.stringify(n,null,2)}
-`,r=`${e}.tmp-${oa(8).toString("hex")}`;aa(r,t,{encoding:"utf8",flag:"wx"}),Kf(r,e)}async function Vf(e){let n=go(e),r=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!==""?{path:Xo(n.shard),sequence:null}:await Jo({offline:n.offline}),i=r.path,s=Dr({dir:n.dir,shardPath:i,failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{}});if(process.stdout.write(`${na(s)}
-`),s.modelLane!==void 0){let a=s.modelLane.notes.length>0?` (${s.modelLane.notes.map(l=>U(l)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(s.modelLane.active)}/${String(s.modelLane.stored)} active, ${String(s.modelLane.promoted)} promoted to reachable-low${a}
-`)}if(n.summaryShadow!==void 0&&s.summaryShadow!==void 0){let a=Bf.join(n.summaryShadow,"shadow-report.json");aa(a,`${JSON.stringify(s.summaryShadow,null,2)}
-`),process.stdout.write(`summary-shadow: ${String(s.summaryShadow.records.length)} counterfactual record(s) -> ${a}
-`)}if(s.modelShadow!==void 0&&n.modelShadowOut!==void 0){let a=s.modelShadow.records.filter(l=>l.wouldPromote).length;process.stdout.write(`model-shadow: ${String(a)}/${String(s.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
-`)}if(s.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(s.bindingShadow.deltas)}/${String(s.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),n.sarif!==void 0&&Uf(n.sarif,ia(s)),n.push){let a=Yo(s,{scanId:oa(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:r.sequence}),l=await Ho(process.env,Ft,{...n.auth!==void 0?{auth:n.auth}:{},warn:c=>process.stderr.write(`cupel: ${c}
-`)});try{await Wo(JSON.stringify(a),l.value,Go)}catch(c){let u=c instanceof Error?c.message:String(c);return process.stderr.write(`cupel: ${u}
-`),s.exitCode===0?1:s.exitCode}let o=r.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(a.findings.length)} finding(s) to api.cupel.sh (${l.kind})${o}
-`)}return s.exitCode}async function qf(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Vf(e.slice(1))}catch(t){let r=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${r}
-`),1}if(e[0]==="login")return await $o(e.slice(1));if(e[0]==="logout")return Mo(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${Fr(sa())}
+`),1;let r=cl(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${r} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${St} in the environment still wins, and \`cupel logout\` forgets it.
+`),0}function yl(e){if(hl(e,"logout"))return 1;let n=or(process.env);return fl(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
+`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${al} would point elsewhere).
+`),0}import ih from"node:path";import{randomBytes as Im,createHash as Am}from"node:crypto";import{mkdirSync as _m,readFileSync as Nm,renameSync as Rm,writeFileSync as Cm}from"node:fs";import{homedir as Om}from"node:os";import $n from"node:path";var jo="latest.json",Ko="latest.json.sig";function ir(e){return Am("sha256").update(e).digest("hex")}function Bo(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=Om();if(process.platform==="darwin")return $n.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let o=process.env.LOCALAPPDATA,i=o!==void 0&&o!==""?o:$n.join(n,"AppData","Local");return $n.join(i,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,r=t!==void 0&&t!==""?t:$n.join(n,".cache");return $n.join(r,"cupel","shards")}function zo(e,n,t){return $n.join(e,`${n}-${t}.sqlite`)}function sr(e,n){_m($n.dirname(e),{recursive:!0});let t=`${e}.tmp-${Im(8).toString("hex")}`;Cm(t,n,{flag:"wx"}),Rm(t,e)}function bt(e){try{return Nm(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function xl(e,n,t,r){let o=zo(e,n,t),i=bt(o);if(i===void 0)return;let a=ir(i);if(a!==t)throw r(`cached shard ${o} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:o,bytes:i}}var Sl="api.cupel.sh",ar=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),bl=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import lr from"node:path";var Pm="/v1/resolve",Uo=1024*1024,Vo=4096,kl=Uo+Vo+64*1024,$m=8,Mm=2048,Dm=/^[A-Za-z0-9+/]+={0,2}$/u,Tm=3e4,we=class extends ee{constructor(n){super(n),this.name="DeliveryRefusedError"}},kt=class extends we{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},Et=class extends ee{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},wt=class extends ee{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function Lm(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Fm(e){if(typeof e!="string"||e.length===0)throw new we("the delivery response carried no index signature");if(e.length>Vo||!Dm.test(e))throw new we("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new we("the delivery response's index signature is not canonical base64");return n}function jm(e){if(typeof e!="string"||e.length===0)throw new we("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Uo)throw new we("the delivery response's index is larger than one can be");return n}function Km(e){if(!Array.isArray(e)||e.length===0)throw new we("the delivery response named no shard urls");if(e.length>$m)throw new we("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>Mm)throw new we("the delivery response carried a malformed shard url");n.push(t)}return n}function Bm(e,n){throw e===401||e===403?new we(`${n} rejected the delivery credential \u2014 check ${St} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new kt(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new wt(`${n} holds nothing newer than the shard index already cached`):e===429?new Et(`${n} rate-limited the delivery request`):e>=500?new Et(`${n} answered ${String(e)}`):new we(`${n} refused the delivery request with status ${String(e)}`)}async function El(e,n,t,r,o=Tm){let i=Ve(`https://${e}${Pm}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await r(i.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,o)}catch{throw new Et(`${e} could not be reached`)}if(l.status!==200&&Bm(l.status,e),Buffer.byteLength(l.body,"utf8")>kl)throw new we(`${e} returned a delivery response larger than one can be`);let s;try{s=JSON.parse(l.body)}catch{throw new we(`${e} returned a delivery response that is not JSON`)}if(!Lm(s))throw new we(`${e} returned a delivery response that is not an object`);return{index:jm(s.index),sig:Fm(s.signature),shardUrls:Km(s.shardUrls)}}var wl=async(e,n,t,r)=>await yt("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,kl,r);var zm=8,qo=class extends ee{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Wo(e){return`${e.origin}${e.pathname}`}function vl(e,n,t){let r=new Map;for(let a of n)r.set(Wo(a),a);let o=[],i=[];for(let a of e.slice(0,zm)){let l;try{l=Ve(a,t)}catch(u){i.push(u.message);continue}if(l.hash!==""){i.push("a candidate carried a fragment");continue}let s=r.get(Wo(l));if(s===void 0){i.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${Wo(s)}${l.search}`);o.push(Ve(d.href,t))}if(o.length===0)throw new qo(`no pre-signed shard url matched the signed index (${i.length===0?"none offered":i.join("; ")})`);return o}var Vm=1,Wm=1024*1024*1024;function qm(e=ar){return{async resolve(n){return await El(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},wl)},async fetchShard(n,t){return Ve(n.href,e),await nl(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Go(e){return e instanceof Error?e.message:String(e)}function Il(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Vm,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:Wm}}function Gm(e){let n=bt(lr.join(e.cacheDir,jo)),t=bt(lr.join(e.cacheDir,Ko));if(!(n===void 0||t===void 0)&&$o(n,t,e.pubkeys))try{return Mo(n,Il(e))}catch{return}}function Al(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let r=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(r)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function dr(e,n,t){let r=xl(n.cacheDir,e.ecosystem,e.sha256,o=>new ee(o));if(r===void 0)throw new ee(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:r.path,fromCache:!0,warnings:[...t,...Al(e,n)],sequence:e.sequence}}async function Hm(e,n,t,r){let o=zo(t.cacheDir,e.ecosystem,e.sha256),i=bt(o);if(i!==void 0&&ir(i)===e.sha256)return{path:o,downloaded:!1};let a="no shard urls";for(let l of n){let s;try{s=await r.fetchShard(l,e.sizeBytes)}catch(u){a=Go(u);continue}let d=ir(s);if(d!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return sr(o,s),{path:o,downloaded:!0}}throw new ee(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function Xm(e,n,t){if(e instanceof we)throw e;if(e instanceof wt){if(n===void 0)throw new ee(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return dr(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new On(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Go(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return dr(n,t,[`could not refresh the shard index (${Go(e)}); using the cached shard`])}async function _l(e,n){if(!e.activated)throw new ee("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??qm(e.shardHosts);if(!sl(e.pubkeys))throw new ee("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let r=Gm(e);if(e.offline){if(r===void 0)throw new On(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return dr(r,e,[])}let o=await ml(e.credential),i;try{i=await t.resolve({host:e.indexHost,token:o,ecosystem:e.ecosystem,sequenceFloor:r?.sequence??0})}catch(d){return Xm(d,r,e)}if(!$o(i.index,i.sig,e.pubkeys))throw new ee("shard index signature did not verify against any pinned key");let a=Mo(i.index,Il(e));if(r!==void 0&&a.sequence<r.sequence)return dr(r,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(r.sequence)}); keeping the newer cached shard`]);let l=vl(i.shardUrls,a.urls,e.shardHosts),s=await Hm(a,l,e,t);return sr(lr.join(e.cacheDir,jo),i.index),sr(lr.join(e.cacheDir,Ko),i.sig),{path:s.path,fromCache:!s.downloaded,warnings:Al(a,e),sequence:a.sequence}}var Ym="https://api.cupel.sh",Nl=".actions.githubusercontent.com",Jm=8192;function Rl(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var We=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function Zm(e){let n;try{n=new URL(e).hostname}catch{throw new We("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=Nl.slice(1);if(n!==t&&!n.endsWith(Nl))throw new We(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Ve(e,new Set([n]))}catch{throw new We(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function cr(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,r=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new We("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(r===void 0||r==="")throw new We("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let o=Zm(t);o.searchParams.set("audience",Ym);let i;try{i=await n(o.href,{authorization:`Bearer ${r}`,accept:"application/json","user-agent":"cupel"})}catch{throw new We("the ID-token request failed")}if(i.length>Jm)throw new We("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(i)}catch{throw new We("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new We("the ID-token response carried no token");return l}async function Cl(e,n,t={}){let r=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",o=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!r)throw new We("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await cr(e,n)};if(r)return o&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(o)return{kind:"oidc",value:await cr(e,n)};throw new We("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Ho="api.cupel.sh",Qm=`https://${Ho}/v1/findings`,eh=64*1024,ur=8*1024*1024,nh=3e4,xn=class extends Error{constructor(n){super(n),this.name="PushError"}};async function Ol(e,n,t,r={}){if(e.length>ur)throw new xn(`findings payload is ${String(e.length)} bytes, over the ${String(ur)}-byte limit`);let o=Ve(Qm,new Set([Ho])),i;try{i=await t(o.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,r.timeoutMs??nh)}catch{throw new xn(`the findings push to ${Ho} failed`)}if(i.body.length>eh)throw new xn("the control plane returned a response larger than it should");if(!(i.status===202||i.status===200))throw i.status===401||i.status===403?new xn("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):i.status===400?new xn("the control plane rejected the findings payload as malformed"):new xn(`the findings push was refused with status ${String(i.status)}`)}var th=64*1024,rh=64*1024,Pl=async(e,n,t,r)=>{if(Buffer.byteLength(t,"utf8")>ur)throw new Error("findings payload is over the size limit");return await yt("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,rh,r)};async function fr(e,n){let t=await yt("GET",e,n,void 0,th,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var sh=720*60*60*1e3,ah=Number(wn);function $l(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function Ml(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new Xe("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Xo(e){let n=e.ecosystem??"npm",t=await _l({ecosystem:n,activated:!0,pubkeys:bl,indexHost:Sl,shardHosts:ar,credential:pl(process.env,()=>cr(process.env,fr),()=>ul(process.env)),cacheDir:n==="npm"?Bo():ih.join(Bo(),n),offline:e.offline,now:Date.now(),maxAgeMs:sh,supportedDbSchemaVersion:ah});for(let r of t.warnings)process.stderr.write(`cupel: ${r}
+`);return{path:t.path,sequence:t.sequence}}var lh=8,dh={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64,maxAdvisoryDetails:8e3},un=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Yo(e){return{path:e.path,start:e.start,end:e.end}}function ch(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new un(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,r=e.modelPromotedFromKind??null;if(t===null!=(r===null))throw new un(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new un(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:fi(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(o=>({functionName:o.functionName??null,modulePath:o.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(Yo),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:r,surfaceComplete:e.surfaceComplete??null}}var uh="";function fh(e){return[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""].join(uh)}function ph(e){let n=new Map;for(let t of e){let r=fh(t),o=n.get(r);if(o===void 0){n.set(r,t);continue}if(o.tier!==t.tier||o.unknownKind!==t.unknownKind)throw new un(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${o.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function mh(e){let n=dh,t=(r,o,i)=>{throw new un(`${r} has ${String(o)} entries, over the ${String(i)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let r of["dispatch","load"]){let o=e.unresolved[r].length;o>n.maxUnresolvedSites&&t(`the app-global ${r} set`,o,n.maxUnresolvedSites)}for(let r of e.findings)r.path!==null&&r.path.length>n.maxPathSteps&&t(`the call path of finding ${r.advisoryId}`,r.path.length,n.maxPathSteps),r.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${r.advisoryId}`,r.unresolvedSites.length,n.maxUnresolvedSites);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let r of e.advisories){if(r.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${r.id}`,r.ranges.length,n.maxAdvisoryRanges),r.summary!==null&&r.summary.length>n.maxStringLength)throw new un(`the summary of advisory ${r.id} is ${String(r.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(r.details!==null&&r.details.length>n.maxAdvisoryDetails)throw new un(`the description of advisory ${r.id} is ${String(r.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function hh(e,n){let t=new Set(n.map(r=>r.advisoryId));return e.advisories.filter(r=>t.has(r.advisory.id)).map(r=>({id:r.advisory.id,cveId:r.advisory.cveId,osvId:r.advisory.osvId,summary:r.advisory.summary,details:r.advisory.details??null,severity:r.advisory.severity,published:r.advisory.published,source:r.advisory.source,ranges:r.ranges.map(o=>({packageName:o.packageName,introduced:o.introduced,fixed:o.fixed,lastAffected:o.lastAffected}))}))}function Dl(e,n){let t=ph(e.findings.map(ch)),r={version:lh,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(Yo),load:e.unresolved.load.map(Yo)},advisories:hh(e,t)};return mh(r),r}function gh(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var yh={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Tl=4,Jo=3,Zo=10,Ll={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},xh="(symbol set known incomplete)";function Sh(e){let n=(e.path??[]).map(t=>U(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Fl(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function bh(e){let n=e.findings.filter(d=>d.tier==="unknown"&&d.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let d of n){let u=t.get(d.unknownKind)??[];u.push(d),t.set(d.unknownKind,u)}let r={cupel:0,project:0};for(let[d,u]of t)r[Fe[d]]+=u.length;let o=[];o.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let i=(d,u)=>{if(r[d]===0)return;o.push(""),o.push(`   ${u} (${String(r[d])}):`);let p=[...t.entries()].filter(([h])=>Fe[h]===d).sort((h,g)=>g[1].length-h[1].length||h[0].localeCompare(g[0])),f=p.slice(0,Tl);for(let[h,g]of f){let S=d==="project"?[...new Set(g.flatMap(Fl))]:[],E=S.slice(0,Jo).map(U).join(", "),w=S.length>Jo?` (+${String(S.length-Jo)} more files)`:"";o.push(`     ${h.padEnd(21)} ${String(g.length).padStart(4)}  ${Ll[h]}`+(E!==""?`
+       ${E}${w}`:""))}for(let[h,g]of p.slice(Tl))o.push(`     ${h.padEnd(21)} ${String(g.length).padStart(4)}  ${Ll[h]}`)};i("project","Your code \u2014 a change on your side would produce a real verdict"),i("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let d of n)if(Fe[d.unknownKind]==="project")for(let u of Fl(d))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((d,u)=>u[1]-d[1]||d[0].localeCompare(u[0]))[0];l!==void 0&&r.project>0&&(o.push(""),o.push(`   \u279C Start here: ${U(l[0])} appears in ${String(l[1])} of your ${String(r.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let s=n.filter(d=>Fe[d.unknownKind]==="project");if(s.length>0){o.push("");for(let d of s.slice(0,Zo))o.push(`     ${U(d.displayId)}  ${U(d.packageName)}@${U(d.version)}  [${d.unknownKind}] ${U(d.reason)}`);s.length>Zo&&o.push(`     \u2026 and ${String(s.length-Zo)} more`)}return o.push(""),o}function jl(e){let n=[],t=e.counts,r=e.findings.filter(d=>d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low");if(n.push(`cupel scan: ${U(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let d=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+d.map(u=>`${U(u.entrypoint)} [${U(u.source)}]`).join(", ")+(e.entrypointSources.length>d.length?`, \u2026 and ${String(e.entrypointSources.length-d.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let d=new Map;for(let u of e.entrypointObservations)d.set(u.kind,(d.get(u.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...d.entries()].map(([u,p])=>`${String(p)} ${u}`).join(", ")+` (${U(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let d=e.rootSet,u=d.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(d.counts.rootsAdmitted)}): `+u.map(h=>`${U(h.rel===""?".":h.rel)} [${h.witnesses.join("+")}${h.ecosystem==="PyPI"?"; PyPI":h.alsoPython===!0?"; npm+PyPI":""}]`).join(", ")+(d.roots.length>u.length?`, \u2026 and ${String(d.roots.length-u.length)} more`:"")),d.observations.length>0){let h=new Map;for(let g of d.observations)h.set(g.kind,(h.get(g.kind)??0)+1);n.push("    not admitted: "+[...h.entries()].map(([g,S])=>`${String(S)} ${g}`).join(", "))}n.push(`    walk: ${String(d.counts.dirsWalked)} dirs, ${String(d.counts.manifestsSeen)} manifests seen, ${String(d.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${d.budget}`);let p=e.installed.perRoot.filter(h=>h.rootRel!=="");p.length>0&&n.push(`    enumerated (${String(p.length)} nested root${p.length===1?"":"s"}): `+p.slice(0,8).map(h=>`${U(h.rootRel)} (${String(h.packages.length)} packages, ${h.source})`).join(", ")+(p.length>8?`, \u2026 and ${String(p.length-8)} more`:""));let f=qn(d,e.entrypointSources);f.length>0&&n.push(`    NOT analyzed (${String(f.length)}): ${U(So(f.map(h=>h.rel===""?".":h.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at unknown until they are analyzed`),d.budget!=="complete"&&d.budget!=="not-attempted"&&n.push(`    the walk did not finish (${d.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at unknown`),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let d of e.entrypointGaps.slice(0,5))n.push(`  - ${U(d.source)} (${U(d.file)}): ${U(d.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(U).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${Kr(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let o=e.installed.gaps,i=o.find(d=>d.kind==="no-enumeration")??null;i!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${U(i.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=o.filter(d=>d!==i);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let d of a.slice(0,10))n.push(`  - [${U(d.kind)}] ${U(d.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(o.map(d=>d.detail)),s=[...e.analyzerDiagnostics.map(d=>`${U(d.code)}: ${U(d.detail)}`),...e.installed.diagnostics.filter(d=>!l.has(d)).map(U)];if(s.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(s.length)}) \u2014 verdicts are conservative:`);for(let d of s.slice(0,10))n.push(`  - ${d}`);s.length>10&&n.push(`  \u2026 and ${String(s.length-10)} more`),n.push("")}if(r.length>0){n.push(`\u{1F3AF} Reachable (${String(r.length)}) \u2014 fix these:`);for(let d of r)n.push(`  ${yh[d.tier]} ${U(d.displayId)}  ${U(d.packageName)}@${U(d.version)}  ${U(d.symbolName??"")}`+(d.surfaceComplete===!1?`  ${xh}`:"")),n.push(`        path: ${Sh(d)}`);n.push("")}return n.push(...bh(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${gh(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as kh}from"node:crypto";var Eh="https://json.schemastore.org/sarif-2.1.0.json",Kl="cupel-reachability",Qo=new Set(["dispatch","dynamic-load","coverage-gap"]);function wh(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var vh=500,Ih=10;function Ah(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function _h(e,n){return`${e}::${n}`}function Nh(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Rh(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return kh("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Ch(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Qo.has(e.unknownKind)}var Bl={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function zl(e){let n=[],t=new Map,r=[];for(let s of e.findings){if(!Ch(s))continue;let d=_h(s.displayId,s.packageName);if(!t.has(d)){t.set(d,n.length);let E=Nh(s.severity);n.push({id:U(d),properties:{tags:s.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${U(s.packageName)}`]:["security","reachability",`package/${U(s.packageName)}`],...E!==void 0?{"security-severity":E}:{}}})}let u=s.tier==="reachable-high"||s.tier==="reachable-medium"||s.tier==="reachable-low",p=s.path??[],f=p.find(E=>E.modulePath!==""),h=[...new Set(s.unresolvedSites.map(E=>E.path).filter(E=>E!==""))],g=u?f!==void 0?{physicalLocation:{artifactLocation:{uri:U(f.modulePath)}},message:{text:`calls ${U(s.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:U(s.packageLocation??"package-lock.json")}}}:h[0]!==void 0?{physicalLocation:{artifactLocation:{uri:U(h[0])}},message:{text:`unresolved ${U(s.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:U(s.packageLocation??(s.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},S=u?p.map(E=>({physicalLocation:{artifactLocation:{uri:U(E.modulePath||"package-lock.json")}},message:{text:U(E.functionName??"<step>")}})):h.slice(1,Ih+1).map(E=>({physicalLocation:{artifactLocation:{uri:U(E)}},message:{text:"also blocked here"}}));r.push({ruleId:U(d),ruleIndex:t.get(d),level:u?"error":"warning",message:{text:U(`[${s.tier}] ${s.displayId} in ${s.packageName}@${s.version}`+(s.symbolName!==null?` \u2014 reaches ${s.symbolName}`:"")+(s.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${s.reason}`)},locations:[g],...S.length>0?{relatedLocations:S}:{},partialFingerprints:{"cupelReachability/v1":Rh(s)},properties:{tier:s.tier,advisoryId:U(s.advisoryId),...s.surfaceComplete===!1?{surfaceComplete:!1}:{},...s.modelId!==void 0?{modelId:U(s.modelId),modelPromotedFromKind:s.modelPromotedFromKind}:{},...s.unknownKind!==void 0?{unknownKind:s.unknownKind,unknownOwner:Fe[s.unknownKind],unresolvedSiteCount:s.unresolvedSites.length}:{},...s.adr105!==void 0?{adr105:s.adr105}:{}}})}let o=new Map,i=new Map;for(let s of e.findings){if(s.tier!=="unknown"||s.unknownKind===void 0||(o.set(s.unknownKind,(o.get(s.unknownKind)??0)+1),Qo.has(s.unknownKind)))continue;let d=i.get(s.unknownKind)??[];d.length<vh&&d.push({advisory:U(s.displayId),package:U(s.packageName),version:U(s.version)}),i.set(s.unknownKind,d)}let a={cupel:0,project:0};for(let[s,d]of o)a[Fe[s]]+=d;let l={};for(let[s,d]of i){let u=o.get(s)??d.length;l[s]={count:u,owner:Fe[s],note:Bl[s],truncated:u>d.length,advisories:d}}return{$schema:Eh,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Kl},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:U(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(s=>`${s.entrypoint} (${s.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...o.keys()].filter(s=>!Qo.has(s)&&!wh(s,e.analysisAborted)).sort().map(s=>({descriptor:{id:`unknown-${s}`},level:"warning",message:{text:`${String(o.get(s)??0)} finding(s) are unknown because ${Bl[s]} (owner: ${Fe[s]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${s}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(s=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:U(`${s.source} (${s.file}): ${s.detail}`)}})),...e.rejectedEntries.map(s=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:U(`--entry did not resolve to a file inside the app root: ${s}`)}})),...e.entrypointObservations.map(s=>({descriptor:{id:`entrypoint-observation:${s.kind}`},level:"note",message:{text:U(`${s.detail} (${s.file})`)}})),...e.analyzerDiagnostics.map(s=>({descriptor:{id:s.code},level:"warning",message:{text:U(`${s.detail}${s.reason===void 0?"":` [reason: ${s.reason}]`} (${s.path})`)}})),...e.installed.diagnostics.map(s=>({descriptor:{id:"resolve"},level:"warning",message:{text:U(s)}}))]}],results:r,properties:{category:Kl,summary:e.counts,installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(s=>({path:U(s.rootRel),count:s.packages.length,source:s.source}))},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:qn(e.rootSet,e.entrypointSources).length,named:qn(e.rootSet,e.entrypointSources).slice(0,8).map(s=>U(s.rel===""?".":s.rel))},analyzed:[...pt(e.entrypointSources)].sort().slice(0,64).map(s=>U(s===""?".":s)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(s=>({path:U(s.rel),witnesses:s.witnesses,...s.manifestRefused?{manifestRefused:!0}:{},...s.ecosystem!==void 0?{ecosystem:s.ecosystem}:{},...s.alsoPython===!0?{alsoPython:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(s=>({kind:s.kind,path:U(s.rel)}))}}:{},...Ah(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...o].sort((s,d)=>d[1]-s[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(s=>s.tier==="unknown"&&s.unknownKind==="db-gap").map(s=>({advisory:U(s.displayId),package:U(s.packageName),version:U(s.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(s=>s.adr105!==void 0).map(s=>({advisory:U(s.displayId),package:U(s.packageName),version:U(s.version),symbol:U(s.symbolName??""),tier:s.tier,...s.unknownKind!==void 0?{unknownKind:s.unknownKind}:{},...s.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function Ul(){try{let e=Oh(Mh(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Dh(e,n){let t=`${JSON.stringify(n,null,2)}
+`,r=`${e}.tmp-${Vl(8).toString("hex")}`;Wl(r,t,{encoding:"utf8",flag:"wx"}),Ph(r,e)}async function Th(e){let n=el(e),t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",r=t?{path:Ml(n.shard),sequence:null}:await Xo({offline:n.offline}),o=r.path,a=$l(n.shardPypi);if(a===void 0&&!t)try{a=(await Xo({offline:n.offline,ecosystem:"pypi"})).path}catch(s){if(s instanceof kt||s instanceof On)process.stderr.write(`cupel: no PyPI shard available (${s.message}); Python distributions, if any, will be reported as not assessed
+`);else throw s}let l=Oo({dir:n.dir,shardPath:o,...a!==void 0?{shardPathPypi:a}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${jl(l)}
+`),l.modelLane!==void 0){let s=l.modelLane.notes.length>0?` (${l.modelLane.notes.map(d=>U(d)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(l.modelLane.active)}/${String(l.modelLane.stored)} active, ${String(l.modelLane.promoted)} promoted to reachable-low${s}
+`)}if(n.summaryShadow!==void 0&&l.summaryShadow!==void 0){let s=$h.join(n.summaryShadow,"shadow-report.json");Wl(s,`${JSON.stringify(l.summaryShadow,null,2)}
+`),process.stdout.write(`summary-shadow: ${String(l.summaryShadow.records.length)} counterfactual record(s) -> ${s}
+`)}if(l.modelShadow!==void 0&&n.modelShadowOut!==void 0){let s=l.modelShadow.records.filter(d=>d.wouldPromote).length;process.stdout.write(`model-shadow: ${String(s)}/${String(l.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
+`)}if(l.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(l.bindingShadow.deltas)}/${String(l.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
+`),n.sarif!==void 0&&Dh(n.sarif,zl(l)),n.push){let s=Dl(l,{scanId:Vl(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:"npm",shardSequence:r.sequence}),d=await Cl(process.env,fr,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
+`)});try{await Ol(JSON.stringify(s),d.value,Pl)}catch(p){let f=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${f}
+`),l.exitCode===0?1:l.exitCode}let u=r.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(s.findings.length)} finding(s) to api.cupel.sh (${Rl(d)})${u}
+`)}return l.exitCode}async function Lh(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await Th(e.slice(1))}catch(t){let r=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${r}
+`),1}if(e[0]==="login")return await gl(e.slice(1));if(e[0]==="logout")return yl(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${Po(Ul())}
 `),0):(process.stderr.write(`cupel: unknown command '${U(n)}'
-`),process.stderr.write(`${Fr(sa())}
-`),1)}qf().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`),process.stderr.write(`${Po(Ul())}
+`),1)}Lh().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});