@cupel-sh/cli 0.8.0 → 0.8.5

package/bundle/cli.js

@@ -1,55 +1,661 @@
 #!/usr/bin/env node
-import{randomBytes as Hd}from"node:crypto";import{readFileSync as My,renameSync as Ty,writeFileSync as Xd}from"node:fs";import Dy from"node:path";import{fileURLToPath as Ly}from"node:url";var Jd=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function Zd(e){let n=Jd.exec(e);return n===null?null:{kind:"npm",release:[Number(n[1]),Number(n[2]),Number(n[3])]}}function Qd(e,n){for(let t=0;t<3;t+=1){let o=e.release[t]??0,r=n.release[t]??0;if(o!==r)return o<r?-1:1}return 0}var ec=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,nc={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function Zn(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function tc(e){let n=ec.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,o=(t.release??"").split(".");if(o.length===0||o.length>32)return null;let r=[];for(let u of o){let p=Zn(u);if(p===null)return null;r.push(p)}let s=0;if(t.epoch!==void 0){let u=Zn(t.epoch);if(u===null)return null;s=u}let a=null;if(t.preL!==void 0){let u=t.preN===void 0?0:Zn(t.preN);if(u===null)return null;a=[nc[t.preL]??t.preL,u]}let l=null;if(t.postImplicit!==void 0){let u=Zn(t.postImplicit);if(u===null)return null;l=u}else if(t.postL!==void 0){let u=t.postN===void 0?0:Zn(t.postN);if(u===null)return null;l=u}let i=null;if(t.devL!==void 0){let u=t.devN===void 0?0:Zn(t.devN);if(u===null)return null;i=u}let d=t.local===void 0?null:t.local.split(/[-_.]/u).map(u=>/^[0-9]+$/u.test(u)?Number(u):u);return{kind:"PyPI",epoch:s,release:r,pre:a,post:l,dev:i,local:d}}function Qn(e,n){return e===n?0:e<n?-1:1}function Ks(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function oc(e,n){let t=Ks(e),o=Ks(n),r=Math.max(t.length,o.length);for(let s=0;s<r;s+=1){let a=Qn(t[s]??0,o[s]??0);if(a!==0)return a}return 0}function Us(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function rc(e,n){let t=Us(e),o=Us(n);return t!==o?t<o?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:Qn(e.pre[1],n.pre[1])}function sc(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:Qn(e,n)}function ic(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:Qn(e,n)}function ac(e,n){let t=typeof e=="number",o=typeof n=="number";return t&&o?Qn(e,n):!t&&!o?e===n?0:e<n?-1:1:t?1:-1}function lc(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let o=0;o<t;o+=1){let r=e[o],s=n[o];if(r===void 0)return-1;if(s===void 0)return 1;let a=ac(r,s);if(a!==0)return a}return 0}function dc(e,n){let t=Qn(e.epoch,n.epoch);if(t!==0)return t;let o=oc(e.release,n.release);if(o!==0)return o;let r=rc(e,n);if(r!==0)return r;let s=sc(e.post,n.post);if(s!==0)return s;let a=ic(e.dev,n.dev);return a!==0?a:lc(e.local,n.local)}function cc(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=e==="npm"?Zd(n):tc(n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function ht(e,n){let t=cc(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function Qt(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return Qd(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return dc(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function zs(e,n,t){let o=ht(e,n);return!(t.introduced!=="0"&&Qt(o,ht(e,t.introduced))<0||t.fixed!==void 0&&Qt(o,ht(e,t.fixed))>=0||t.lastAffected!==void 0&&Qt(o,ht(e,t.lastAffected))>0)}var Go=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Ln(e,n){return zs(n.ecosystem??"npm",e,n)}function eo(e,n,t){let o=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let i=s.get(l.callSiteId);if(i===void 0)continue;let d=o.get(i.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=o.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:l.resolution})}return a}function uc(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,o)=>t.analyzedVersion<o.analyzedVersion?1:t.analyzedVersion>o.analyzedVersion?-1:0)}function fc(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Ws(e,n,t,o,r,s){if(s<=0)return null;let a=null,l=i=>{(a===null||i.hops<a.hops)&&(a=i)};for(let i of uc(e,n))for(let d of i.edges){if(d.entryExport!==t||d.entryContainer!==o)continue;if(fc(d,r,i.packageName)){l({viaPackages:[],hops:d.hops,provenance:{tool:i.tool,toolVersion:i.toolVersion,analyzedVersion:i.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let u=Ws(e,d.target.calleePackage,d.target.calleeExport,null,r,s-1);u!==null&&l({viaPackages:[d.target.calleePackage,...u.viaPackages],hops:d.hops+u.hops,provenance:u.provenance})}return a}function Ho(e,n,t,o,r,s){let a=null;for(let l of eo(e,n,t)){let i=Ws(r,l.packageName,l.exportName,l.container,o,s);i!==null&&(a===null||i.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:i.viaPackages,totalHops:i.hops,provenance:i.provenance})}return a}function gt(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function et(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function Xo(e){let n=new Map,t=new Map(e.imports.map(o=>[o.id,o]));for(let o of e.importEdges){let r=t.get(o.importId);if(r===void 0)continue;let s=n.get(r.moduleId)??[];s.push(o.resolvedModuleId),n.set(r.moduleId,s)}return n}function pc(e){let n=new Map,t=new Map(e.imports.map(o=>[o.id,o]));for(let o of e.importEdges){let r=t.get(o.importId);if(r===void 0)continue;let s=n.get(o.resolvedModuleId)??[];s.push(r.moduleId),n.set(o.resolvedModuleId,s)}return n}function ln(e){let n=Xo(e),t=new Set,o=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;o.length>0;){let r=o.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let s of n.get(r)??[])t.has(s)||o.push(s)}}return t}function mc(e,n){let t=pc(e),o=new Set,r=[n];for(;r.length>0;){let s=r.pop();if(!(s===void 0||o.has(s))){o.add(s);for(let a of t.get(s)??[])o.has(a)||r.push(a)}}return o}function hc(e,n,t){let o=Xo(e),r=et(e),s=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||s.has(l))continue;s.add(l);let i=r.get(l);if(i===void 0||i.externalSurface===!0||t.has(l))return!0;for(let d of o.get(l)??[])s.has(d)||a.push(d)}return!1}function yt(e,n,t,o=new Set){let r=Xo(e),s=et(e),a=new Set,l=[],i=[n];for(;i.length>0;){let d=i.pop();if(d===void 0||a.has(d))continue;a.add(d);let u=s.get(d);if(u===void 0){l.push({module:d,kind:"absent"});continue}if(t.has(d)){l.push({module:d,kind:"unbounded"});continue}if(u.externalSurface===!0&&!o.has(d)){l.push({module:d,kind:"surface"});continue}for(let p of r.get(d)??[])a.has(p)||i.push(p)}return l}function gc(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),o=et(e),r=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&r.set(a.id,a);let s=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=s.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let i=t.get(a.target.functionId);i===void 0||o.get(i.moduleId)?.externalSurface===!0||r.set(i.id,i)}return[...r.values()]}function qs(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),s=r[0]?.startsWith("@")===!0?2:1;return r.slice(s).join("/")}function yc(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let o=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let a=n.get(s.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(o){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||r.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return a.externalSurface===!0?!0:qs(a.path)===t.sourcePath})}function Vs(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&qs(t.path)===n.sourcePath)}function xc(e,n,t,o){let r=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(a=>{let l=r.get(a);if(l?.name!==o.exportName)return!1;let i=n.get(l.moduleId);return i?.externalSurface===!0&&i.packageName===o.packageName&&t.has(l.moduleId)}))}function Sc(e,n,t){return t.container===null?!0:e.classes.some(o=>{if(o.name!==t.container)return!1;let r=n.get(o.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function bc(e,n,t){let o=new Map(e.callSites.map(i=>[i.id,i.enclosingFunctionId])),r=new Map;for(let i of e.callEdges){let d=o.get(i.callSiteId);if(d===void 0)continue;let u=r.get(d)??[];u.push({to:i.calleeFunctionId,res:i.resolution}),r.set(d,u)}let s=i=>{let d=new Set,u=n.map(p=>({id:p.id,prev:null}));for(let p of u)d.add(p.id);for(;u.length>0;){let p=u.shift();if(p===void 0)break;if(p.id===t){let f=[];for(let m=p;m!==null;m=m.prev)f.unshift(m.id);return f}for(let f of r.get(p.id)??[])f.res!=="unresolved"&&(f.res==="field-based"&&!i||d.has(f.to)||(d.add(f.to),u.push({id:f.to,prev:p})))}return null},a=s(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=s(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function Yo(e){return Gs(e,et(e),ln(e),Hs(e))}function Gs(e,n,t,o){let r=[],s=[],a=new Map(e.functions.map(i=>[i.id,i.moduleId])),l=i=>i!==void 0&&t.has(i)&&o.has(n.get(i)?.packageName??"");for(let i of e.callSites)i.resolution==="unresolved"&&l(a.get(i.enclosingFunctionId))&&r.push(i.range);for(let i of e.imports)!i.specifierIsLiteral&&t.has(i.moduleId)&&s.push({path:n.get(i.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:s}}function Hs(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function kc(e,n){let t=new Map(e.functions.map(r=>[r.id,r])),o=et(e);return n.map(r=>{let s=t.get(r),a=s!==void 0?o.get(s.moduleId):void 0;return{functionId:r,functionName:s?.name,modulePath:a?.path??""}})}function Jo(e){let{graph:n,installed:t,range:o,symbol:r,coverage:s}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},i=U=>({unresolvedSites:U,unresolvedEvidence:{own:U,sets:[]}}),d=Hs(n),u=new Set;for(let U of e.incompleteness)U.reach.kind==="unbounded"&&u.add(U.source);let p=e.incompleteness.some(U=>U.reach.kind==="assumed-bounded")?"loader-assumption":"complete",f=U=>U==="not-reachable"?p:void 0,m=new Map,g=U=>{let X=m.get(U);return X===void 0&&(X=hc(n,U,u),m.set(U,X)),X},y=U=>U.reach.kind==="class-scope"&&r!==null&&r.packageName===U.reach.packageName&&r.container===U.reach.container,b=U=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let X of Go)for(let D of e.incompleteness)if(D.cause===X&&U(D))return{cause:D.cause,source:D.source};return null},x=U=>{let X;return b(D=>D.reach.kind==="unbounded"?!0:D.reach.kind==="class-scope"?y(D):U===void 0||g(D.reach.anchor)?!0:(X??=mc(n,U),X.has(D.reach.anchor)))},I=()=>b(U=>U.reach.kind==="unbounded"?!0:U.reach.kind==="class-scope"?y(U):g(U.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${o.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let w;try{if((t.ecosystem??"npm")!==(o.ecosystem??"npm"))throw new Error("ecosystem mismatch");w=Ln(t.version,o)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:f("unknown"),path:void 0,...l}}if(!w)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${o.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let A=et(n),k=ln(n),h=U=>{if(U.cause!=="dynamic-load"||U.source===null)return a;let X=A.get(U.source);return X===void 0?a:[{path:X.path,start:0,end:0}]},{dispatch:S,load:_}=Gs(n,A,k,d),P=[...S,..._],v={unresolvedSites:_,unresolvedEvidence:{own:a,sets:["load"]}},T={unresolvedSites:P,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},N=U=>{for(let X of k)if(A.get(X)?.packageName===U)return!0;return!1},j=U=>({tier:"unknown",decidedAtStage:U,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:f("unknown"),path:void 0,...l}),O=()=>{if(!N(o.packageName)){if(_.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:f("unknown"),path:void 0,...v};let U=I();return U!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:U.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(U))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:f("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${o.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${o.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}}return null};if(r===null||!r.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(s!==null&&!s.comparedPaths.has(r.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:f("unknown"),path:void 0,...T};let F=yc(n,A,r);if(F===void 0||!k.has(F.moduleId)){if(F===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&xc(n,A,k,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(F===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!Sc(n,A,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...T};let U=O();if(U!==null)return U;if(P.length>0){let C=F!==void 0?A.get(F.moduleId):Vs(n,r),H=F===void 0&&C!==void 0&&C.externalSurface!==!0&&k.has(C.id)&&!d.has(C.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:_.length>0?"dynamic-load":H?"dep-opaque":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...T}}let X=F!==void 0?A.get(F.moduleId):Vs(n,r);if(F===void 0&&X!==void 0&&X.externalSurface!==!0&&k.has(X.id)&&!d.has(X.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...l};let D=X!==void 0?x(X.id):I();return D!==null?{tier:"unknown",decidedAtStage:F===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:D.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(D))}:o.surfaceComplete?{tier:"not-reachable",decidedAtStage:F===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:j(F===void 0?"symbol-reachable":"module-reachable")}let K=bc(n,gc(n),F.id);if(K!==null)return{tier:gt(K.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:no(r),basis:f("reachable-high"),path:kc(n,K.path),...l};if(P.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but unresolved edges exist`,unknownKind:_.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...T};let te=x(F.moduleId);return te!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:te.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(te))}:o.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:j("call-path-confirmed")}function Ec(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function wc(e,n,t){let o=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let s=n.get(r.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(r.enclosingClassId!==void 0?o.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function vc(e,n,t){if(n===t)return[];let o=new Map(e.functions.map(i=>[i.id,i])),r=new Map(e.callSites.map(i=>[i.id,i])),s=new Map;for(let i of e.callEdges){if(i.resolution!=="resolved"&&i.resolution!=="field-based")continue;let d=r.get(i.callSiteId);if(d===void 0)continue;let u=d.enclosingFunctionId;if(!o.has(u)||!o.has(i.calleeFunctionId))continue;let p=s.get(u),f={to:i.calleeFunctionId,label:i.resolution};p===void 0?s.set(u,[f]):p.push(f)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let i=0;i<l.length;i++){let d=l[i];for(let u of s.get(d.at)??[]){if(a.has(u.to))continue;let p=[...d.labels,u.label];if(u.to===t)return p;a.add(u.to),l.push({at:u.to,labels:p})}}return null}function xt(e,n,t,o,r){if(r.length===0)return null;let s=eo(e,n,t);if(s.length===0)return null;let a=wc(e,n,o);for(let l of r){let i=s.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),d=i.find(u=>u.resolution==="resolved")??i[0];if(d!==void 0){if(Ec(l.callee,o))return{tier:gt("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=vc(e,l.callee.realFunctionId,a);if(u!==null)return{tier:gt("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled",...u]}}}}return null}var Xs=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],Ys=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function no(e){return e.verified?"gated":"candidate"}var Zo=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],Qo=["cupel","project"],Ve={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function Js(e){return Ve[e]}import{randomBytes as Hl}from"node:crypto";import{mkdirSync as Xl,readdirSync as ed,readFileSync as Th,realpathSync as Wt,renameSync as Yl,statSync as ps,writeFileSync as Jl}from"node:fs";import mn from"node:path";import{createRequire as Ic}from"node:module";var Ac=Ic(import.meta.url);function _c(){try{return Ac("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function Nc(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var to={open(e,n){let{DatabaseSync:t}=_c(),o=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?o.exec("PRAGMA query_only = ON;"):o.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>o.exec(r),prepare:r=>Nc(o.prepare(r)),close:()=>o.close()}}};function Ae(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function Ee(e){return typeof e=="string"?e:null}function dn(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Rc=`
+var V={"extract.py":`None
+
+import ast
+import json
+import sys
+
+MAX_BYTES = 2 * 1024 * 1024
+MAX_NODES = 200_000
+MAX_PER_KIND = 20_000
+MAX_NAME_CHARS = 512
+
+
+def dotted(node):
+    None
+    parts = []
+    while isinstance(node, ast.Attribute):
+        parts.append(node.attr)
+        node = node.value
+    if not isinstance(node, ast.Name):
+        return None
+    parts.append(node.id)
+    name = ".".join(reversed(parts))
+    return name if len(name) <= MAX_NAME_CHARS else None
+
+
+_LINE_STARTS = [0]
+
+
+def set_line_starts(raw):
+    None
+    global _LINE_STARTS
+    starts = [0]
+    for i, b in enumerate(raw):
+        if b == 0x0A:
+            starts.append(i + 1)
+    _LINE_STARTS = starts
+
+
+def _offset(line, col):
+    if line is None or line < 1 or line > len(_LINE_STARTS):
+        return 0
+    return _LINE_STARTS[line - 1] + (col or 0)
+
+
+def rng(node):
+    None
+    line = getattr(node, "lineno", 0)
+    end_line = getattr(node, "end_lineno", None) or line
+    col = getattr(node, "col_offset", 0)
+    return {
+        "line": line,
+        "endLine": end_line,
+        "col": col,
+        "start": _offset(line, col),
+        "end": _offset(end_line, getattr(node, "end_col_offset", 0)),
+    }
+
+
+_SEQ_CALLS = ("frozenset", "set", "tuple", "list")
+
+
+def string_list(node):
+    None
+    if isinstance(node, ast.Call) and not node.keywords and len(node.args) == 1:
+        callee = node.func.id if isinstance(node.func, ast.Name) else None
+        return string_list(node.args[0]) if callee in _SEQ_CALLS else None
+    if not isinstance(node, (ast.List, ast.Tuple, ast.Set)):
+        return None
+    out = []
+    for elt in node.elts:
+        if not (isinstance(elt, ast.Constant) and isinstance(elt.value, str)):
+            return None
+        out.append(elt.value)
+    return sorted(out) if isinstance(node, ast.Set) else out
+
+
+FUNCTION_NODES_X = (ast.FunctionDef, ast.AsyncFunctionDef)
+
+
+def is_sys_modules_read(node):
+    None
+    if not isinstance(node, ast.Subscript):
+        return False
+    base = dotted(node.value)
+    return base is not None and base.endswith("sys.modules")
+
+
+def literal_prefix(node):
+    None
+    if isinstance(node, ast.JoinedStr):
+        first = node.values[0] if node.values else None
+        if isinstance(first, ast.Constant) and isinstance(first.value, str):
+            return first.value
+        return None
+    if isinstance(node, ast.BinOp) and isinstance(node.op, ast.Add):
+        if isinstance(node.left, ast.Constant) and isinstance(node.left.value, str):
+            return node.left.value
+    return None
+
+
+class Extract(ast.NodeVisitor):
+    None
+
+    def __init__(self):
+        self.imports = []
+        self.functions = []
+        self.classes = []
+        self.calls = []
+        self.escapes = []
+        self.all_names = None
+        self.all_computed = False
+        self.truncated = []
+        self._scope = []
+        self._func = []
+        self._class = []
+        self._guard = []
+        self._bound = {}
+        self._handled = set()
+        self._aliases = set()
+        self._module_defs = set()
+
+    def note_module_defs(self, tree):
+        for node in tree.body:
+            if isinstance(node, FUNCTION_NODES_X):
+                self._module_defs.add(node.name)
+
+
+    def _add(self, bucket, row, what):
+        if len(bucket) >= MAX_PER_KIND:
+            if what not in self.truncated:
+                self.truncated.append(what)
+            return
+        bucket.append(row)
+
+    def _qual(self, name):
+        return ".".join([*self._scope, name]) if self._scope else name
+
+    def _enclosing(self):
+        return self._func[-1] if self._func else None
+
+
+    def _import_row(self, node, module, level, names, star, form="from"):
+        return {
+            "form": form,
+            "module": module,
+            "level": level,
+            "names": names,
+            "star": star,
+            "deferred": self._enclosing() is not None,
+            "enclosingFunction": self._enclosing(),
+            "guards": list(self._guard),
+            "range": rng(node),
+        }
+
+    def visit_Import(self, node):
+        for alias in node.names:
+            self._add(
+                self.imports,
+                self._import_row(
+                    node,
+                    alias.name,
+                    0,
+                    [{"name": alias.name, "asname": alias.asname}],
+                    False,
+                    "import",
+                ),
+                "imports",
+            )
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node):
+        star = any(a.name == "*" for a in node.names)
+        names = [{"name": a.name, "asname": a.asname} for a in node.names if a.name != "*"]
+        self._add(
+            self.imports,
+            self._import_row(node, node.module, node.level or 0, names, star),
+            "imports",
+        )
+        self.generic_visit(node)
+
+
+    def _visit_function(self, node, kind):
+        qual = self._qual(node.name)
+        self._add(
+            self.functions,
+            {
+                "name": node.name,
+                "qualname": qual,
+                "kind": kind,
+                "enclosingClass": self._class[-1] if self._class else None,
+                "enclosingFunction": self._enclosing(),
+                "decorators": [dotted(d.func) if isinstance(d, ast.Call) else dotted(d) for d in node.decorator_list],
+                "range": rng(node),
+            },
+            "functions",
+        )
+        self._scope.append(node.name)
+        self._func.append(qual)
+        self.generic_visit(node)
+        self._func.pop()
+        self._scope.pop()
+
+    def visit_FunctionDef(self, node):
+        self._visit_function(node, "function")
+
+    def visit_AsyncFunctionDef(self, node):
+        self._visit_function(node, "async-function")
+
+    def visit_ClassDef(self, node):
+        qual = self._qual(node.name)
+        self._add(
+            self.classes,
+            {
+                "name": node.name,
+                "qualname": qual,
+                "bases": [dotted(b) for b in node.bases],
+                "decorators": [dotted(d.func) if isinstance(d, ast.Call) else dotted(d) for d in node.decorator_list],
+                "range": rng(node),
+            },
+            "classes",
+        )
+        self._scope.append(node.name)
+        self._class.append(qual)
+        self.generic_visit(node)
+        self._class.pop()
+        self._scope.pop()
+
+
+    def visit_If(self, node):
+        test = node.test
+        name = dotted(test) or (dotted(test.value) if isinstance(test, ast.Attribute) else None)
+        kind = "type-checking" if (name or "").endswith("TYPE_CHECKING") else "conditional"
+        self._guard.append(kind)
+        for child in node.body:
+            self.visit(child)
+        self._guard.pop()
+        for child in node.orelse:
+            self.visit(child)
+
+    def visit_For(self, node):
+        None
+        values = string_list(node.iter)
+        if values is None and isinstance(node.iter, ast.Name):
+            values = self._bound.get(node.iter.id)
+        name = node.target.id if isinstance(node.target, ast.Name) else None
+        shadowed = name is not None and name in self._bound
+        previous = self._bound.get(name) if shadowed else None
+        if name is not None and values is not None:
+            self._bound[name] = list(values)
+        for child in [*node.body, *node.orelse]:
+            self.visit(child)
+        if name is not None and values is not None:
+            if shadowed:
+                self._bound[name] = previous
+            else:
+                self._bound.pop(name, None)
+        self.visit(node.iter)
+
+    def visit_Try(self, node):
+        handles_import_error = any(
+            (dotted(h.type) or "").endswith("ImportError") or (dotted(h.type) or "").endswith("ModuleNotFoundError")
+            for h in node.handlers
+            if h.type is not None
+        )
+        self._guard.append("optional" if handles_import_error else "conditional")
+        for child in node.body:
+            self.visit(child)
+        self._guard.pop()
+        for child in [*node.handlers, *node.orelse, *node.finalbody]:
+            self.visit(child)
+
+
+    def visit_Assign(self, node):
+        for target in node.targets:
+            if isinstance(target, ast.Name) and target.id == "__all__" and not self._scope:
+                names = string_list(node.value)
+                if names is None:
+                    self.all_computed = True
+                else:
+                    self.all_names = names
+            if isinstance(target, ast.Name) and not self._scope:
+                values = string_list(node.value)
+                if values is not None:
+                    self._bound[target.id] = values
+            if isinstance(target, ast.Name) and is_sys_modules_read(node.value):
+                self._aliases.add(target.id)
+            if (
+                isinstance(target, ast.Attribute)
+                and isinstance(node.value, ast.Name)
+                and node.value.id in self._module_defs
+            ):
+                self._add(
+                    self.escapes,
+                    {
+                        "kind": "attr-rebind",
+                        "callee": dotted(target) or target.attr,
+                        "attr": target.attr,
+                        "target": node.value.id,
+                        "enclosingFunction": self._enclosing(),
+                        "range": rng(node),
+                    },
+                    "escapes",
+                )
+            if isinstance(target, ast.Subscript):
+                base = dotted(target.value)
+                if base is not None and base.endswith("sys.modules"):
+                    self._handled.add(id(target))
+                    aliasing = is_sys_modules_read(node.value) or (
+                        isinstance(node.value, ast.Name) and node.value.id in self._aliases
+                    )
+                    if not aliasing:
+                        self._add(
+                            self.escapes,
+                            {
+                                "kind": "sys-modules",
+                                "callee": base,
+                                "target": None,
+                                "enclosingFunction": self._enclosing(),
+                                "range": rng(node),
+                            },
+                            "escapes",
+                        )
+        self.generic_visit(node)
+
+
+    def visit_Call(self, node):
+        callee = dotted(node.func)
+        receiver = None
+        if isinstance(node.func, ast.Attribute):
+            receiver = dotted(node.func.value)
+        self._add(
+            self.calls,
+            {
+                "callee": callee,
+                "attr": node.func.attr if isinstance(node.func, ast.Attribute) else None,
+                "receiver": receiver,
+                "enclosingFunction": self._enclosing(),
+                "argCount": len(node.args),
+                "range": rng(node),
+            },
+            "calls",
+        )
+        self._escape_for(node, callee)
+        self.generic_visit(node)
+
+    def _import_targets(self, first):
+        None
+        if isinstance(first, ast.Constant) and isinstance(first.value, str):
+            return [first.value]
+        if isinstance(first, ast.Name) and first.id in self._bound:
+            return list(self._bound[first.id])
+        prefix = literal_prefix(first)
+        if prefix is not None and "." in prefix:
+            return [prefix.rsplit(".", 1)[0]]
+        return None
+
+    def _escape_for(self, node, callee):
+        if callee is None:
+            return
+        tail = callee.rsplit(".", 1)[-1]
+        first = node.args[0] if node.args else None
+        literal = isinstance(first, ast.Constant) and isinstance(first.value, str)
+        targets = None
+        kind = None
+        if callee.endswith("import_module") or tail == "__import__":
+            targets = self._import_targets(first)
+            if targets is not None:
+                for target in targets:
+                    self._add(
+                        self.escapes,
+                        {
+                            "kind": "import-module-literal",
+                            "callee": callee,
+                            "target": target,
+                            "enclosingFunction": self._enclosing(),
+                            "range": rng(node),
+                        },
+                        "escapes",
+                    )
+                return
+            kind = "loader-escape"
+        elif tail in ("exec", "eval"):
+            kind = "loader-escape"
+        elif tail in ("iter_modules", "walk_packages"):
+            kind = "pkgutil-scan"
+        elif callee.startswith("runpy.") or tail in ("run_module", "run_path"):
+            kind = "runpy"
+        elif tail == "entry_points":
+            kind = "entry-point-load"
+        elif tail == "getattr" and not literal:
+            kind = "dispatch-escape"
+        if kind is None:
+            return
+        row = {
+            "kind": kind,
+            "callee": callee,
+            "target": first.value if literal and kind == "import-module-literal" else None,
+            "enclosingFunction": self._enclosing(),
+            "range": rng(node),
+        }
+        self._add(self.escapes, row, "escapes")
+
+    def visit_Subscript(self, node):
+        if isinstance(node.ctx, ast.Load) or id(node) in self._handled:
+            self.generic_visit(node)
+            return
+        base = dotted(node.value)
+        if base is not None and base.endswith("sys.modules"):
+            self._add(
+                self.escapes,
+                {"kind": "sys-modules", "callee": base, "target": None, "enclosingFunction": self._enclosing(), "range": rng(node)},
+                "escapes",
+            )
+        self.generic_visit(node)
+
+
+def extract(path, max_bytes, max_nodes):
+    try:
+        with open(path, "rb") as fh:
+            raw = fh.read(max_bytes + 1)
+    except OSError as e:
+        return {"path": path, "refused": "unreadable", "detail": type(e).__name__}
+    if len(raw) > max_bytes:
+        return {"path": path, "refused": "oversize", "detail": f">{max_bytes} bytes"}
+    if b"\\x00" in raw:
+        return {"path": path, "refused": "nul-byte"}
+    set_line_starts(raw)
+    try:
+        src = raw.decode("utf-8")
+    except UnicodeDecodeError:
+        try:
+            src = raw.decode("latin-1")
+        except UnicodeDecodeError:
+            return {"path": path, "refused": "undecodable"}
+    try:
+        tree = ast.parse(src, filename=path)
+    except (SyntaxError, ValueError) as e:
+        return {"path": path, "refused": "parse-error", "detail": type(e).__name__}
+    except RecursionError:
+        return {"path": path, "refused": "recursion"}
+    nodes = sum(1 for _ in ast.walk(tree))
+    if nodes > max_nodes:
+        return {"path": path, "refused": "too-many-nodes", "detail": str(nodes)}
+    ex = Extract()
+    ex.note_module_defs(tree)
+    try:
+        ex.visit(tree)
+    except RecursionError:
+        return {"path": path, "refused": "recursion"}
+    return {
+        "path": path,
+        "refused": None,
+        "imports": ex.imports,
+        "functions": ex.functions,
+        "classes": ex.classes,
+        "calls": ex.calls,
+        "escapes": ex.escapes,
+        "all": ex.all_names,
+        "allComputed": ex.all_computed,
+        "truncated": ex.truncated,
+    }
+
+
+def main(argv):
+    def flag(name, default):
+        return int(argv[argv.index(name) + 1]) if name in argv else default
+
+    max_bytes = flag("--max-bytes", MAX_BYTES)
+    max_nodes = flag("--max-nodes", MAX_NODES)
+    out = sys.stdout
+    out.write(
+        json.dumps(
+            {
+                "kind": "header",
+                "interpreter": sys.version.split()[0],
+                "extract": 1,
+                "stdlib": sorted(getattr(sys, "stdlib_module_names", ())),
+            }
+        )
+        + "\\n"
+    )
+    for line in sys.stdin:
+        path = line.rstrip("\\n")
+        if not path:
+            continue
+        row = extract(path, max_bytes, max_nodes)
+        row["kind"] = "file"
+        out.write(json.dumps(row) + "\\n")
+    out.flush()
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
+`,"metadata.py":`None
+
+import configparser
+import json
+import os
+import sys
+
+MAX_BYTES = 4 * 1024 * 1024
+
+
+def read(path, limit=MAX_BYTES):
+    try:
+        with open(path, "rb") as fh:
+            raw = fh.read(limit + 1)
+    except OSError:
+        return None
+    return None if len(raw) > limit else raw
+
+
+def scripts_from_pyproject(root, out):
+    raw = read(os.path.join(root, "pyproject.toml"))
+    if raw is None:
+        return
+    try:
+        import tomllib
+    except ModuleNotFoundError:
+        out["gaps"].append({"file": "pyproject.toml", "why": "no-tomllib"})
+        return
+    try:
+        data = tomllib.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, Exception) as e:
+        out["gaps"].append({"file": "pyproject.toml", "why": f"unparsed:{type(e).__name__}"})
+        return
+    project = data.get("project")
+    if not isinstance(project, dict):
+        out["gaps"].append({"file": "pyproject.toml", "why": "no-project-table"})
+        return
+    name = project.get("name")
+    if isinstance(name, str):
+        out["projectName"] = name
+    for table, kind in (("scripts", "console-script"), ("gui-scripts", "gui-script")):
+        entries = project.get(table)
+        if isinstance(entries, dict):
+            for key, target in entries.items():
+                if isinstance(key, str) and isinstance(target, str):
+                    out["entryPoints"].append(
+                        {"name": key, "target": target, "kind": kind, "file": "pyproject.toml"}
+                    )
+    groups = project.get("entry-points")
+    if isinstance(groups, dict):
+        for group, entries in groups.items():
+            if not isinstance(entries, dict):
+                continue
+            for key, target in entries.items():
+                if isinstance(key, str) and isinstance(target, str):
+                    out["entryPoints"].append(
+                        {
+                            "name": f"{group}:{key}" if isinstance(group, str) else key,
+                            "target": target,
+                            "kind": "entry-point-group",
+                            "file": "pyproject.toml",
+                        }
+                    )
+
+
+def scripts_from_setup_cfg(root, out):
+    raw = read(os.path.join(root, "setup.cfg"))
+    if raw is None:
+        return
+    parser = configparser.ConfigParser(strict=False)
+    try:
+        parser.read_string(raw.decode("utf-8", errors="replace"))
+    except configparser.Error as e:
+        out["gaps"].append({"file": "setup.cfg", "why": f"unparsed:{type(e).__name__}"})
+        return
+    if out.get("projectName") is None and parser.has_option("metadata", "name"):
+        out["projectName"] = parser.get("metadata", "name").strip()
+    if not parser.has_section("options.entry_points"):
+        return
+    for group, block in parser.items("options.entry_points"):
+        for line in (block or "").splitlines():
+            line = line.strip()
+            if not line or "=" not in line:
+                continue
+            key, _, target = line.partition("=")
+            out["entryPoints"].append(
+                {
+                    "name": key.strip(),
+                    "target": target.strip(),
+                    "kind": "console-script" if group == "console_scripts" else "entry-point-group",
+                    "file": "setup.cfg",
+                }
+            )
+
+
+def main(argv):
+    if len(argv) < 2:
+        sys.stderr.write("usage: metadata.py <project-root>\\n")
+        return 2
+    root = argv[1]
+    out = {"projectName": None, "entryPoints": [], "gaps": [], "interpreter": sys.version.split()[0]}
+    scripts_from_pyproject(root, out)
+    scripts_from_setup_cfg(root, out)
+    if os.path.isfile(os.path.join(root, "setup.py")) and not out["entryPoints"]:
+        out["gaps"].append({"file": "setup.py", "why": "executable-metadata-not-read"})
+    sys.stdout.write(json.dumps(out) + "\\n")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv))
+`};import{randomBytes as tc}from"node:crypto";import{readFileSync as Jy,renameSync as Zy,writeFileSync as oc}from"node:fs";import Qy from"node:path";import{fileURLToPath as ex}from"node:url";var ic=/^(\d{1,10})\.(\d{1,10})\.(\d{1,10})$/u;function ac(e){let n=ic.exec(e);return n===null?null:{kind:"npm",release:[Number(n[1]),Number(n[2]),Number(n[3])]}}function lc(e,n){for(let t=0;t<3;t+=1){let o=e.release[t]??0,r=n.release[t]??0;if(o!==r)return o<r?-1:1}return 0}var dc=/^v?(?:(?<epoch>[0-9]+)!)?(?<release>[0-9]+(?:\.[0-9]+)*)(?:[-_.]?(?<preL>a|b|c|rc|alpha|beta|pre|preview)[-_.]?(?<preN>[0-9]+)?)?(?:(?:-(?<postImplicit>[0-9]+))|(?:[-_.]?(?<postL>post|rev|r)[-_.]?(?<postN>[0-9]+)?))?(?:[-_.]?(?<devL>dev)[-_.]?(?<devN>[0-9]+)?)?(?:\+(?<local>[a-z0-9]+(?:[-_.][a-z0-9]+)*))?$/u,cc={a:"a",alpha:"a",b:"b",beta:"b",c:"rc",pre:"rc",preview:"rc",rc:"rc"};function et(e){if(e===void 0)return null;let n=Number(e);return Number.isSafeInteger(n)?n:null}function uc(e){let n=dc.exec(e.toLowerCase());if(n===null||n.groups===void 0)return null;let t=n.groups,o=(t.release??"").split(".");if(o.length===0||o.length>32)return null;let r=[];for(let u of o){let p=et(u);if(p===null)return null;r.push(p)}let s=0;if(t.epoch!==void 0){let u=et(t.epoch);if(u===null)return null;s=u}let a=null;if(t.preL!==void 0){let u=t.preN===void 0?0:et(t.preN);if(u===null)return null;a=[cc[t.preL]??t.preL,u]}let l=null;if(t.postImplicit!==void 0){let u=et(t.postImplicit);if(u===null)return null;l=u}else if(t.postL!==void 0){let u=t.postN===void 0?0:et(t.postN);if(u===null)return null;l=u}let i=null;if(t.devL!==void 0){let u=t.devN===void 0?0:et(t.devN);if(u===null)return null;i=u}let d=t.local===void 0?null:t.local.split(/[-_.]/u).map(u=>/^[0-9]+$/u.test(u)?Number(u):u);return{kind:"PyPI",epoch:s,release:r,pre:a,post:l,dev:i,local:d}}function nt(e,n){return e===n?0:e<n?-1:1}function Ys(e){let n=e.length;for(;n>1&&e[n-1]===0;)n-=1;return e.slice(0,n)}function fc(e,n){let t=Ys(e),o=Ys(n),r=Math.max(t.length,o.length);for(let s=0;s<r;s+=1){let a=nt(t[s]??0,o[s]??0);if(a!==0)return a}return 0}function Js(e){return e.pre!==null?0:e.post===null&&e.dev!==null?-1:1}function pc(e,n){let t=Js(e),o=Js(n);return t!==o?t<o?-1:1:t!==0||e.pre===null||n.pre===null?0:e.pre[0]!==n.pre[0]?e.pre[0]<n.pre[0]?-1:1:nt(e.pre[1],n.pre[1])}function mc(e,n){return e===null&&n===null?0:e===null?-1:n===null?1:nt(e,n)}function hc(e,n){return e===null&&n===null?0:e===null?1:n===null?-1:nt(e,n)}function gc(e,n){let t=typeof e=="number",o=typeof n=="number";return t&&o?nt(e,n):!t&&!o?e===n?0:e<n?-1:1:t?1:-1}function yc(e,n){if(e===null&&n===null)return 0;if(e===null)return-1;if(n===null)return 1;let t=Math.max(e.length,n.length);for(let o=0;o<t;o+=1){let r=e[o],s=n[o];if(r===void 0)return-1;if(s===void 0)return 1;let a=gc(r,s);if(a!==0)return a}return 0}function xc(e,n){let t=nt(e.epoch,n.epoch);if(t!==0)return t;let o=fc(e.release,n.release);if(o!==0)return o;let r=pc(e,n);if(r!==0)return r;let s=mc(e.post,n.post);if(s!==0)return s;let a=hc(e.dev,n.dev);return a!==0?a:yc(e.local,n.local)}function bc(e,n){if(typeof n!="string"||n.length===0||n.length>256)return null;let t=e==="npm"?ac(n):uc(n);return t===null?null:{ecosystem:e,raw:n,parsed:t}}function yt(e,n){let t=bc(e,n);if(t===null)throw new Error(`not a valid ${e} version: ${JSON.stringify(n)}`);return t}function to(e,n){if(e.ecosystem!==n.ecosystem)throw new Error(`cannot compare ${e.ecosystem} with ${n.ecosystem}`);if(e.parsed.kind==="npm"&&n.parsed.kind==="npm")return lc(e.parsed,n.parsed);if(e.parsed.kind==="PyPI"&&n.parsed.kind==="PyPI")return xc(e.parsed,n.parsed);throw new Error("unreachable: ecosystem/parsed mismatch")}function Zs(e,n,t){let o=yt(e,n);return!(t.introduced!=="0"&&to(o,yt(e,t.introduced))<0||t.fixed!==void 0&&to(o,yt(e,t.fixed))>=0||t.lastAffected!==void 0&&to(o,yt(e,t.lastAffected))>0)}var Qo=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function jn(e,n){return Zs(n.ecosystem??"npm",e,n)}function oo(e,n,t){let o=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let i=s.get(l.callSiteId);if(i===void 0)continue;let d=o.get(i.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=o.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:l.resolution})}return a}function Sc(e,n){return(e.get(n)??[]).filter(t=>t.status==="summarized").slice().sort((t,o)=>t.analyzedVersion<o.analyzedVersion?1:t.analyzedVersion>o.analyzedVersion?-1:0)}function kc(e,n,t){return e.target.kind!=="symbol"||t!==n.packageName?!1:e.target.exportName===n.exportName&&e.target.container===n.container&&e.target.symbolKind===n.symbolKind}function Qs(e,n,t,o,r,s){if(s<=0)return null;let a=null,l=i=>{(a===null||i.hops<a.hops)&&(a=i)};for(let i of Sc(e,n))for(let d of i.edges){if(d.entryExport!==t||d.entryContainer!==o)continue;if(kc(d,r,i.packageName)){l({viaPackages:[],hops:d.hops,provenance:{tool:i.tool,toolVersion:i.toolVersion,analyzedVersion:i.analyzedVersion}});continue}if(d.target.kind!=="dep")continue;let u=Qs(e,d.target.calleePackage,d.target.calleeExport,null,r,s-1);u!==null&&l({viaPackages:[d.target.calleePackage,...u.viaPackages],hops:d.hops+u.hops,provenance:u.provenance})}return a}function er(e,n,t,o,r,s){let a=null;for(let l of oo(e,n,t)){let i=Qs(r,l.packageName,l.exportName,l.container,o,s);i!==null&&(a===null||i.hops<a.totalHops)&&(a={tier:"reachable-low",anchorPackage:l.packageName,entryExport:l.exportName,viaPackages:i.viaPackages,totalHops:i.hops,provenance:i.provenance})}return a}function xt(e){switch(e){case"all-resolved":return"reachable-high";case"field-based":return"reachable-medium";case"modeled":return"reachable-low"}}function tt(e){let n=new Map;for(let t of e.modules)n.set(t.id,t);return n}function nr(e){let n=new Map,t=new Map(e.imports.map(o=>[o.id,o]));for(let o of e.importEdges){let r=t.get(o.importId);if(r===void 0)continue;let s=n.get(r.moduleId)??[];s.push(o.resolvedModuleId),n.set(r.moduleId,s)}return n}function Ec(e){let n=new Map,t=new Map(e.imports.map(o=>[o.id,o]));for(let o of e.importEdges){let r=t.get(o.importId);if(r===void 0)continue;let s=n.get(o.resolvedModuleId)??[];s.push(r.moduleId),n.set(o.resolvedModuleId,s)}return n}function cn(e){let n=nr(e),t=new Set,o=e.modules.filter(r=>r.isEntrypoint).map(r=>r.id);for(;o.length>0;){let r=o.pop();if(!(r===void 0||t.has(r))){t.add(r);for(let s of n.get(r)??[])t.has(s)||o.push(s)}}return t}function wc(e,n){let t=Ec(e),o=new Set,r=[n];for(;r.length>0;){let s=r.pop();if(!(s===void 0||o.has(s))){o.add(s);for(let a of t.get(s)??[])o.has(a)||r.push(a)}}return o}function vc(e,n,t){let o=nr(e),r=tt(e),s=new Set,a=[n];for(;a.length>0;){let l=a.pop();if(l===void 0||s.has(l))continue;s.add(l);let i=r.get(l);if(i===void 0||i.externalSurface===!0||t.has(l))return!0;for(let d of o.get(l)??[])s.has(d)||a.push(d)}return!1}function bt(e,n,t,o=new Set){let r=nr(e),s=tt(e),a=new Set,l=[],i=[n];for(;i.length>0;){let d=i.pop();if(d===void 0||a.has(d))continue;a.add(d);let u=s.get(d);if(u===void 0){l.push({module:d,kind:"absent"});continue}if(t.has(d)){l.push({module:d,kind:"unbounded"});continue}if(u.externalSurface===!0&&!o.has(d)){l.push({module:d,kind:"surface"});continue}for(let p of r.get(d)??[])a.has(p)||i.push(p)}return l}function _c(e){let n=new Set(e.modules.filter(a=>a.isEntrypoint).map(a=>a.id)),t=new Map(e.functions.map(a=>[a.id,a])),o=tt(e),r=new Map;for(let a of e.functions)n.has(a.moduleId)&&(a.publicSurfaceReachable||a.name==="<toplevel>")&&r.set(a.id,a);let s=new Map(e.exports.map(a=>[a.id,a]));for(let a of e.exportBindings){if(a.target.kind!=="function")continue;let l=s.get(a.exportId);if(l===void 0||!n.has(l.moduleId))continue;let i=t.get(a.target.functionId);i===void 0||o.get(i.moduleId)?.externalSurface===!0||r.set(i.id,i)}return[...r.values()]}function ni(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return e;let r=e.slice(t+n.length).split("/"),s=r[0]?.startsWith("@")===!0?2:1;return r.slice(s).join("/")}function Ic(e,n,t){if(t.symbolKind==="accessor"||t.symbolKind==="pattern")return;let o=t.symbolKind==="method"||t.symbolKind==="ctor",r=new Map(e.classes.map(s=>[s.id,s]));return e.functions.find(s=>{if(s.name!==t.exportName)return!1;let a=n.get(s.moduleId);if(a===void 0||a.packageName!==t.packageName)return!1;if(o){if(s.kind!==t.symbolKind||s.enclosingClassId===void 0||r.get(s.enclosingClassId)?.name!==t.container)return!1}else if(s.kind!=="function")return!1;return a.externalSurface===!0?!0:ni(a.path)===t.sourcePath})}function ei(e,n){return e.modules.find(t=>t.externalSurface!==!0&&t.packageName===n.packageName&&ni(t.path)===n.sourcePath)}function Ac(e,n,t,o){let r=new Map(e.functions.map(s=>[s.id,s]));return e.callSites.some(s=>s.calleeExprShape!=="member"||s.resolution!=="resolved"?!1:s.resolvedTargetIds.some(a=>{let l=r.get(a);if(l?.name!==o.exportName)return!1;let i=n.get(l.moduleId);return i?.externalSurface===!0&&i.packageName===o.packageName&&t.has(l.moduleId)}))}function Nc(e,n,t){return t.container===null?!0:e.classes.some(o=>{if(o.name!==t.container)return!1;let r=n.get(o.moduleId);return r!==void 0&&r.packageName===t.packageName&&r.externalSurface!==!0})}function Rc(e,n,t){let o=new Map(e.callSites.map(i=>[i.id,i.enclosingFunctionId])),r=new Map;for(let i of e.callEdges){let d=o.get(i.callSiteId);if(d===void 0)continue;let u=r.get(d)??[];u.push({to:i.calleeFunctionId,res:i.resolution}),r.set(d,u)}let s=i=>{let d=new Set,u=n.map(p=>({id:p.id,prev:null}));for(let p of u)d.add(p.id);for(;u.length>0;){let p=u.shift();if(p===void 0)break;if(p.id===t){let f=[];for(let m=p;m!==null;m=m.prev)f.unshift(m.id);return f}for(let f of r.get(p.id)??[])f.res!=="unresolved"&&(f.res==="field-based"&&!i||d.has(f.to)||(d.add(f.to),u.push({id:f.to,prev:p})))}return null},a=s(!1);if(a!==null)return{path:a,usedFieldBased:!1};let l=s(!0);return l!==null?{path:l,usedFieldBased:!0}:null}function tr(e){return ti(e,tt(e),cn(e),oi(e))}function ti(e,n,t,o){let r=[],s=[],a=new Map(e.functions.map(i=>[i.id,i.moduleId])),l=i=>i!==void 0&&t.has(i)&&o.has(n.get(i)?.packageName??"");for(let i of e.callSites)i.resolution==="unresolved"&&l(a.get(i.enclosingFunctionId))&&r.push(i.range);for(let i of e.imports)!i.specifierIsLiteral&&t.has(i.moduleId)&&s.push({path:n.get(i.moduleId)?.path??"",start:0,end:0});return{dispatch:r,load:s}}function oi(e){return new Set(e.modules.filter(n=>n.isEntrypoint).map(n=>n.packageName))}function Pc(e,n){let t=new Map(e.functions.map(r=>[r.id,r])),o=tt(e);return n.map(r=>{let s=t.get(r),a=s!==void 0?o.get(s.moduleId):void 0;return{functionId:r,functionName:s?.name,modulePath:a?.path??""}})}function or(e){let{graph:n,installed:t,range:o,symbol:r,coverage:s}=e,a=[],l={unresolvedSites:a,unresolvedEvidence:{own:a,sets:[]}},i=B=>({unresolvedSites:B,unresolvedEvidence:{own:B,sets:[]}}),d=oi(n),u=new Set;for(let B of e.incompleteness)B.reach.kind==="unbounded"&&u.add(B.source);let p=e.incompleteness.some(B=>B.reach.kind==="assumed-bounded")?"loader-assumption":"complete",f=B=>B==="not-reachable"?p:void 0,m=new Map,g=B=>{let Y=m.get(B);return Y===void 0&&(Y=vc(n,B,u),m.set(B,Y)),Y},y=B=>B.reach.kind==="class-scope"&&r!==null&&r.packageName===B.reach.packageName&&r.container===B.reach.container,S=B=>{if(e.analysisAborted!==null)return{cause:e.analysisAborted,source:null};for(let Y of Qo)for(let L of e.incompleteness)if(L.cause===Y&&B(L))return{cause:L.cause,source:L.source};return null},x=B=>{let Y;return S(L=>L.reach.kind==="unbounded"?!0:L.reach.kind==="class-scope"?y(L):B===void 0||g(L.reach.anchor)?!0:(Y??=wc(n,B),Y.has(L.reach.anchor)))},_=()=>S(B=>B.reach.kind==="unbounded"?!0:B.reach.kind==="class-scope"?y(B):g(B.reach.anchor));if(t===null)return{tier:"not-affected",decidedAtStage:"presence",reason:`${o.packageName} is not installed`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let w;try{if((t.ecosystem??"npm")!==(o.ecosystem??"npm"))throw new Error("ecosystem mismatch");w=jn(t.version,o)}catch{return{tier:"unknown",decidedAtStage:"version-match",reason:`cannot compare version ${JSON.stringify(t.version)} against the advisory range`,unknownKind:"version-undecidable",attribution:void 0,basis:f("unknown"),path:void 0,...l}}if(!w)return{tier:"not-affected",decidedAtStage:"version-match",reason:`${o.packageName}@${t.version} is outside the affected range`,unknownKind:void 0,attribution:void 0,basis:f("not-affected"),path:void 0,...l};let I=tt(n),k=cn(n),h=B=>{if(B.cause!=="dynamic-load"||B.source===null)return a;let Y=I.get(B.source);return Y===void 0?a:[{path:Y.path,start:0,end:0}]},{dispatch:b,load:A}=ti(n,I,k,d),P=[...b,...A],v={unresolvedSites:A,unresolvedEvidence:{own:a,sets:["load"]}},T={unresolvedSites:P,unresolvedEvidence:{own:a,sets:["dispatch","load"]}},N=B=>{for(let Y of k)if(I.get(Y)?.packageName===B)return!0;return!1},j=B=>({tier:"unknown",decidedAtStage:B,reason:`${r?.exportName??"the certified symbols"} not reached from the application's entrypoints, but the advisory's symbol set is known to be incomplete (surface_complete=0) \u2014 a symbol cupel could not name may be reached; cannot confirm it is unreachable`,unknownKind:"incomplete-surface",attribution:void 0,basis:f("unknown"),path:void 0,...l}),$=()=>{if(!N(o.packageName)){if(A.length>0)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is not statically loaded, but a dynamic module load (a non-literal require/import) could pull it`,unknownKind:"dynamic-load",attribution:void 0,basis:f("unknown"),path:void 0,...v};let B=_();return B!==null?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is not statically loaded, but an incompleteness fact (loader escape / analysis cap / opaque module) could hide a load \u2014 cannot confirm it is unreachable`,unknownKind:B.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(B))}:t!==null&&t.outOfGraphExecution.length>0?{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${o.packageName} is never loaded from the application's entrypoints, but it can still execute outside the module graph (${t.outOfGraphExecution.join(", ")}) \u2014 "not loaded as a module" is not "not executed"`,unknownKind:"analysis-cap",attribution:void 0,basis:f("unknown"),path:void 0,...l}:{tier:"not-reachable",decidedAtStage:"symbol-reachable",reason:t?.devOnly===!0?`${o.packageName} is not reachable at runtime \u2014 installed as a dev-only dependency and never loaded from the application's entrypoints (assumes no dependency loader loads it); still a build-time exposure`:`${o.packageName} is installed but never loaded from the application's entrypoints (no static import, no dynamic load, corridor complete)`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}}return null};if(r===null||!r.verified)return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:r===null?"no derived vulnerable symbol for this advisory (package-level only)":"vulnerable symbol is unverified; cannot claim reachability",unknownKind:r===null?"db-gap":"unverified-symbol",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(s!==null&&!s.comparedPaths.has(r.sourcePath))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`derivation did not cover ${r.sourcePath}; symbol reachability undetermined`,unknownKind:"db-gap",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(r.symbolKind==="accessor"||r.symbolKind==="pattern")return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a ${r.symbolKind} symbol; call-graph reachability is not evaluated`,unknownKind:"symbol-unsupported",attribution:void 0,basis:f("unknown"),path:void 0,...T};let D=Ic(n,I,r);if(D===void 0||!k.has(D.moduleId)){if(D===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&Ac(n,I,k,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} may be a static method reached via an ambiguous package-surface member call`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...T};if(D===void 0&&(r.symbolKind==="method"||r.symbolKind==="ctor")&&!Nc(n,I,r))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is a method of the dependency class ${r.container??"?"}, whose body cupel does not analyze \u2014 a sibling method may reach it through an internal edge`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...T};let B=$();if(B!==null)return B;if(P.length>0){let O=D!==void 0?I.get(D.moduleId):ei(n,r),X=D===void 0&&O!==void 0&&O.externalSurface!==!0&&k.has(O.id)&&!d.has(O.packageName);return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} not statically reached, but unresolved dynamic access exists`,unknownKind:A.length>0?"dynamic-load":X?"dep-opaque":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...T}}let Y=D!==void 0?I.get(D.moduleId):ei(n,r);if(D===void 0&&Y!==void 0&&Y.externalSurface!==!0&&k.has(Y.id)&&!d.has(Y.packageName))return{tier:"unknown",decidedAtStage:"symbol-reachable",reason:`${r.exportName} is in a loaded dependency module whose bodies are not analyzed (bodyless CJS/member-export surface) \u2014 cannot confirm it is unreachable`,unknownKind:"dep-opaque",attribution:void 0,basis:f("unknown"),path:void 0,...l};let L=Y!==void 0?x(Y.id):_();return L!==null?{tier:"unknown",decidedAtStage:D===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} not statically reached, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is unreachable`,unknownKind:L.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(L))}:o.surfaceComplete?{tier:"not-reachable",decidedAtStage:D===void 0?"symbol-reachable":"module-reachable",reason:`${r.exportName} is never reached from the application's entrypoints`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:j(D===void 0?"symbol-reachable":"module-reachable")}let K=Rc(n,_c(n),D.id);if(K!==null)return{tier:xt(K.usedFieldBased?"field-based":"all-resolved"),decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is called from an application entrypoint`,unknownKind:void 0,attribution:ro(r),basis:f("reachable-high"),path:Pc(n,K.path),...l};if(P.length>0)return{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but unresolved edges exist`,unknownKind:A.length>0?"dynamic-load":"dispatch",attribution:void 0,basis:f("unknown"),path:void 0,...T};let te=x(D.moduleId);return te!==null?{tier:"unknown",decidedAtStage:"call-path-confirmed",reason:`no resolved call path to ${r.exportName}, but an incompleteness fact can hide a path to its corridor \u2014 cannot confirm it is uncalled`,unknownKind:te.cause,attribution:void 0,basis:f("unknown"),path:void 0,...i(h(te))}:o.surfaceComplete?{tier:"not-reachable",decidedAtStage:"call-path-confirmed",reason:`${r.exportName} is imported but never called from an entrypoint`,unknownKind:void 0,attribution:void 0,basis:f("not-reachable"),path:void 0,...l}:j("call-path-confirmed")}function $c(e,n){return e.packageName===n.packageName&&e.exportName===n.exportName&&e.container===n.container}function Cc(e,n,t){let o=new Map(e.classes.map(r=>[r.id,r.name]));for(let r of e.functions){if(r.name!==t.exportName)continue;let s=n.get(r.moduleId);if(!(s===void 0||s.packageName!==t.packageName||(r.enclosingClassId!==void 0?o.get(r.enclosingClassId)??null:null)!==t.container))return r.id}return null}function Oc(e,n,t){if(n===t)return[];let o=new Map(e.functions.map(i=>[i.id,i])),r=new Map(e.callSites.map(i=>[i.id,i])),s=new Map;for(let i of e.callEdges){if(i.resolution!=="resolved"&&i.resolution!=="field-based")continue;let d=r.get(i.callSiteId);if(d===void 0)continue;let u=d.enclosingFunctionId;if(!o.has(u)||!o.has(i.calleeFunctionId))continue;let p=s.get(u),f={to:i.calleeFunctionId,label:i.resolution};p===void 0?s.set(u,[f]):p.push(f)}let a=new Set([n]),l=[{at:n,labels:[]}];for(let i=0;i<l.length;i++){let d=l[i];for(let u of s.get(d.at)??[]){if(a.has(u.to))continue;let p=[...d.labels,u.label];if(u.to===t)return p;a.add(u.to),l.push({at:u.to,labels:p})}}return null}function St(e,n,t,o,r){if(r.length===0)return null;let s=oo(e,n,t);if(s.length===0)return null;let a=Cc(e,n,o);for(let l of r){let i=s.filter(u=>u.packageName===l.anchor.packageName&&u.exportName===l.anchor.exportName&&u.container===l.anchor.container),d=i.find(u=>u.resolution==="resolved")??i[0];if(d!==void 0){if($c(l.callee,o))return{tier:xt("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled"]};if(l.callee.realFunctionId!==null&&a!==null){let u=Oc(e,l.callee.realFunctionId,a);if(u!==null)return{tier:xt("modeled"),modelId:l.modelId,anchorPackage:l.anchor.packageName,entryExport:l.anchor.exportName,pathLabels:[d.resolution,"modeled",...u]}}}}return null}var ri=["presence","version-match","module-reachable","symbol-reachable","call-path-confirmed"],si=["not-affected","not-reachable","reachable-high","reachable-medium","reachable-low","unknown"];function ro(e){return e.verified?"gated":"candidate"}var rr=["no-entrypoint","analyzer-crash","version-undecidable","db-gap","unverified-symbol","symbol-unsupported","dep-opaque","dynamic-load","dispatch","resolution-divergence","analysis-cap","coverage-gap","incomplete-surface"],sr=["cupel","project"],Ge={"no-entrypoint":"project","dynamic-load":"project",dispatch:"project","analyzer-crash":"cupel","version-undecidable":"cupel","db-gap":"cupel","unverified-symbol":"cupel","symbol-unsupported":"cupel","dep-opaque":"cupel","resolution-divergence":"cupel","analysis-cap":"cupel","coverage-gap":"cupel","incomplete-surface":"cupel"};function ii(e){return Ge[e]}import{randomBytes as od}from"node:crypto";import{mkdirSync as rd,readdirSync as dd,readFileSync as Jh,realpathSync as Vt,renameSync as sd,statSync as ks,writeFileSync as id}from"node:fs";import hn from"node:path";import{createRequire as Mc}from"node:module";var Tc=Mc(import.meta.url);function Dc(){try{return Tc("node:sqlite")}catch{throw new Error("node:sqlite is unavailable on this runtime (needs Node >= 22.13, or 24+). See ADR-013.")}}function Lc(e){return{all:n=>n===void 0?e.all():e.all(n),get:n=>n===void 0?e.get():e.get(n),run:n=>n===void 0?e.run():e.run(n)}}var so={open(e,n){let{DatabaseSync:t}=Dc(),o=n==="readonly"?new t(e,{readOnly:!0}):new t(e);return n==="readonly"?o.exec("PRAGMA query_only = ON;"):o.exec("PRAGMA journal_mode = DELETE;"),{exec:r=>o.exec(r),prepare:r=>Lc(o.prepare(r)),close:()=>o.close()}}};function Ae(e){return typeof e=="string"?e:typeof e=="number"||typeof e=="bigint"?String(e):""}function we(e){return typeof e=="string"?e:null}function un(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):null}var Fc=`
   SELECT a.id AS a_id, a.osv_id, a.cve_id, a.summary, a.severity, a.published, a.source,
          ap.id AS ap_id, ap.advisory_id, ap.ecosystem, ap.package_name,
-         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,Pc=`
+         ap.introduced, ap.fixed, ap.last_affected, ap.fix_commit, ap.repo_url`,jc=`
   FROM affected_package ap
   JOIN advisory a ON a.id = ap.advisory_id
-  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,$c=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
-                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Oc=5,Cc=6;function Mc(e){let n=e>=Cc?"a.details":"NULL AS details",t=e>=Oc?"ap.surface_complete":$c;return`${Rc}, ${n}, ${t}${Pc}`}var Tc="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",Dc="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Lc="SELECT value FROM ingest_meta WHERE key = 'schema_version'",Fc="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem";function St(e,n=to){let t=n.open(e,"readonly"),o=t.prepare(Lc).get(),r=o!==void 0?Ae(o.value):"",s=/^\d+$/u.test(r)?Number(r):0,a=t.prepare(Mc(s)),l=t.prepare(Tc),i=t.prepare(Dc),d=t.prepare(Fc);return{schemaVersion:r,ecosystems(){return d.all({}).map(u=>Ae(u.ecosystem))},advisoriesForPackage(u,p){return a.all({eco:u,name:p}).map(f=>({affected:{id:dn(f.ap_id)??0,advisoryId:Ae(f.advisory_id),ecosystem:Ae(f.ecosystem),packageName:Ae(f.package_name),introduced:Ee(f.introduced),fixed:Ee(f.fixed),lastAffected:Ee(f.last_affected),fixCommit:Ee(f.fix_commit),repoUrl:Ee(f.repo_url),surfaceComplete:dn(f.surface_complete)===1?1:0},advisory:{id:Ae(f.a_id),osvId:Ee(f.osv_id),cveId:Ee(f.cve_id),summary:Ee(f.summary),details:Ee(f.details),severity:Ee(f.severity),published:Ee(f.published),source:Ae(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(u){return l.all({id:u}).map(p=>({id:dn(p.id)??0,affectedPackageId:dn(p.affected_package_id)??0,exportName:Ee(p.export_name),symbolKind:Ae(p.symbol_kind),matchPattern:Ee(p.match_pattern),matchGlobs:Ee(p.match_globs),container:Ee(p.container),sourcePath:Ee(p.source_path),declStart:dn(p.decl_start),declEnd:dn(p.decl_end),astHashBefore:Ee(p.ast_hash_before),astHashAfter:Ee(p.ast_hash_after),derivation:Ae(p.derivation),confidence:Ae(p.confidence),verified:dn(p.verified)===1?1:0}))},aliasesForSymbol(u){return i.all({id:u}).map(p=>({id:dn(p.id)??0,vulnerableSymbolId:dn(p.vulnerable_symbol_id)??0,aliasPath:Ae(p.alias_path),aliasName:Ae(p.alias_name)}))},allModels(){let u;try{u=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
+  WHERE ap.ecosystem = :eco AND ap.package_name = :name`,Bc=`EXISTS (SELECT 1 FROM vulnerable_symbol vs
+                 WHERE vs.affected_package_id = ap.id AND vs.verified = 1) AS surface_complete`,Kc=5,Uc=6;function zc(e){let n=e>=Uc?"a.details":"NULL AS details",t=e>=Kc?"ap.surface_complete":Bc;return`${Fc}, ${n}, ${t}${jc}`}var qc="SELECT * FROM vulnerable_symbol WHERE affected_package_id = :id",Wc="SELECT * FROM symbol_alias WHERE vulnerable_symbol_id = :id",Vc="SELECT value FROM ingest_meta WHERE key = 'schema_version'",Gc="SELECT DISTINCT ecosystem FROM affected_package ORDER BY ecosystem";function kt(e,n=so){let t=n.open(e,"readonly"),o=t.prepare(Vc).get(),r=o!==void 0?Ae(o.value):"",s=/^\d+$/u.test(r)?Number(r):0,a=t.prepare(zc(s)),l=t.prepare(qc),i=t.prepare(Wc),d=t.prepare(Gc);return{schemaVersion:r,ecosystems(){return d.all({}).map(u=>Ae(u.ecosystem))},advisoriesForPackage(u,p){return a.all({eco:u,name:p}).map(f=>({affected:{id:un(f.ap_id)??0,advisoryId:Ae(f.advisory_id),ecosystem:Ae(f.ecosystem),packageName:Ae(f.package_name),introduced:we(f.introduced),fixed:we(f.fixed),lastAffected:we(f.last_affected),fixCommit:we(f.fix_commit),repoUrl:we(f.repo_url),surfaceComplete:un(f.surface_complete)===1?1:0},advisory:{id:Ae(f.a_id),osvId:we(f.osv_id),cveId:we(f.cve_id),summary:we(f.summary),details:we(f.details),severity:we(f.severity),published:we(f.published),source:Ae(f.source)==="osv"?"osv":"ghsa"}}))},symbolsForAffected(u){return l.all({id:u}).map(p=>({id:un(p.id)??0,affectedPackageId:un(p.affected_package_id)??0,exportName:we(p.export_name),symbolKind:Ae(p.symbol_kind),matchPattern:we(p.match_pattern),matchGlobs:we(p.match_globs),container:we(p.container),sourcePath:we(p.source_path),declStart:un(p.decl_start),declEnd:un(p.decl_end),astHashBefore:we(p.ast_hash_before),astHashAfter:we(p.ast_hash_after),derivation:Ae(p.derivation),confidence:Ae(p.confidence),verified:un(p.verified)===1?1:0}))},aliasesForSymbol(u){return i.all({id:u}).map(p=>({id:un(p.id)??0,vulnerableSymbolId:un(p.vulnerable_symbol_id)??0,aliasPath:Ae(p.alias_path),aliasName:Ae(p.alias_name)}))},allModels(){let u;try{u=t.prepare(`SELECT id, package_name, introduced, fixed_before, evidence_ref
                FROM model_package ORDER BY package_name, introduced`).all({})}catch{return[]}let p=t.prepare(`SELECT kind, anchor_export, anchor_container, callee_package, callee_container, callee_export
-           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return u.map(f=>{let m=dn(f.id)??0;return{packageName:Ae(f.package_name),modelId:Ae(f.evidence_ref),introduced:Ae(f.introduced),fixedBefore:Ee(f.fixed_before),evidenceRef:Ae(f.evidence_ref),edges:p.all({id:m}).map(g=>({kind:Ae(g.kind),anchorExport:Ae(g.anchor_export),anchorContainer:Ee(g.anchor_container),calleePackage:Ae(g.callee_package),calleeContainer:Ee(g.callee_container),calleeExport:Ae(g.callee_export)}))}})},close(){t.close()}}}function er(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let p of e)if(p.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${p.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,o=new Map,r=new Map,s=new Map,a=1,l=(p,f,m,g)=>{let y=`${String(m)}:${String(g)}`,b=p.get(y);if(b!==void 0)return b;let x=a;a+=1,p.set(y,x);let I=e[m];if(I===void 0)throw new Error("unreachable: reader index out of range");return f.set(x,{reader:I,id:g}),x},i=e.map(p=>new Set(p.ecosystems?.()??[])),d=p=>{let f=e.map((m,g)=>g).filter(m=>i[m]?.has(p)===!0);return f.length>0?f:e.map((m,g)=>g).filter(m=>e[m]?.ecosystems===void 0)},u=(p,f)=>({...f,id:l(r,s,p,f.id),affectedPackageId:l(t,o,p,f.affectedPackageId)});return{schemaVersion:n.schemaVersion,ecosystems(){let p=new Set;for(let f of i)for(let m of f)p.add(m);return[...p].sort()},advisoriesForPackage(p,f){let m=[];for(let g of d(p)){let y=e[g];if(y!==void 0)for(let b of y.advisoriesForPackage(p,f))m.push({...b,affected:{...b.affected,id:l(t,o,g,b.affected.id)}})}return m},symbolsForAffected(p){let f=o.get(p);if(f===void 0)return[];let m=e.indexOf(f.reader);return f.reader.symbolsForAffected(f.id).map(g=>u(m,g))},aliasesForSymbol(p){let f=s.get(p);if(f===void 0)return[];let m=e.indexOf(f.reader);return f.reader.aliasesForSymbol(f.id).map(g=>({...g,vulnerableSymbolId:l(r,s,m,g.vulnerableSymbolId)}))},allModels(){return e.flatMap(p=>p.allModels?.()??[])},close(){for(let p of e)p.close()}}}var Fn="6";import{realpathSync as kn}from"node:fs";import Xe from"node:path";import{realpathSync as Kn}from"node:fs";import{isBuiltin as hr}from"node:module";import Me from"node:path";import E from"typescript";function nr(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function we(e){let n=nr(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function qe(e){let n=nr(e);if(n.startsWith("@")){let o=n.indexOf("/");if(o===-1)return n;let r=n.indexOf("/",o+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function Zs(e){let n=nr(e),t=qe(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as zc,statSync as tr}from"node:fs";var In=16*1024*1024;function nt(e,n){try{let t=tr(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:zc(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function Oe(e){let n=nt(e,In);return n.kind==="ok"?n.text:null}function cn(e){try{return tr(e).isFile()}catch{return!1}}function Qs(e){try{let n=tr(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Wc,realpathSync as sr}from"node:fs";import ae from"node:path";import oo from"typescript";var si=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Be(e){return si.some(([n])=>e.endsWith(n))}function Vc(e){for(let[n,t]of si)if(e.endsWith(n)){let o=e.slice(0,-n.length);return t.map(r=>o+r)}return[]}var qc=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function ii(e){if(Be(e))return e;for(let[n,t]of qc)if(e.endsWith(n)){let o=e.slice(0,-n.length);for(let r of t){let s=o+r;if(cn(s))return s}return e}return e}var ir=[oo.ModuleKind.CommonJS,oo.ModuleKind.ESNext],ar=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function bt(e,n,t,o,r,s){let a=oo.resolveModuleName(e,n,t,o,void 0,void 0,r).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(s){for(let i of Vc(l))if(cn(i))return i}return l}var ai=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],Gc=[".js",".json",".node"],Hc=["index.js","index.json","index.node"];function ro(e){return!Be(e)&&ai.some(n=>e.endsWith(n))}function li(e){if(cn(e))return e;for(let n of Gc)if(cn(e+n))return e+n;return null}function ei(e){for(let n of Hc){let t=ae.join(e,n);if(cn(t))return t}return null}var di=[".ts",".tsx",".cts",".mts",".jsx"];function Xc(e){for(let n of di)if(cn(e+n))return e+n;return null}function Yc(e){for(let n of di){let t=ae.join(e,"index"+n);if(cn(t))return t}return null}function lr(e){let n=Oe(ae.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let o=ae.join(e,t),r=li(o)??ei(o);if(r!==null)return r}}catch{}return ei(e)}function ci(e){return li(e)??lr(e)??Xc(e)??Yc(e)}function ui(e){return ci(e)!==null}function Jc(e,n){let t=e.split(ae.sep),o=n.split("/"),r=null;for(let a=t.length-o.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&o.every((l,i)=>t[a+1+i]===l)){r=t.slice(0,a+1+o.length).join(ae.sep);break}if(r===null||r==="")return null;let s=Oe(ae.join(r,"package.json"));if(s===null)return null;try{let a=JSON.parse(s),l=a.exports,i=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||i)return null}catch{return null}try{return sr(r)}catch{return null}}function Zc(e,n){let t=ci(ae.join(e,n));if(t===null)return null;let o;try{o=sr(t)}catch{return null}let r=e.endsWith(ae.sep)?e:e+ae.sep;return o!==e&&!o.startsWith(r)||Be(o)||!ai.some(s=>o.endsWith(s))?null:o}function Qc(e,n){let t=Zs(e);return t===""||t.includes("\0")||t.split("/").some(o=>o===""||o==="."||o===".."||o==="node_modules")?null:Zc(n,t)}var jn={kind:"nothing-loads"},or=8192;function rr(e,n){let t=n.get(e);if(t!==void 0)return t;let o,r=null;try{r=Wc(e);let s=new Set,a=!1;for(;;){let l=r.readSync();if(l===null)break;if(s.size>=or){a=!0;break}s.add(l.name)}o={names:s,truncated:a}}catch{o=null}finally{try{r?.closeSync()}catch{}}return n.set(e,o),o}var eu=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function fi(e){return eu.some(n=>e.length>n.length&&e.endsWith(n))}function An(e,n){let t=e.endsWith(ae.sep)?e:e+ae.sep;return n===e||n.startsWith(t)}function ni(e,n){let t;try{t=sr(n)}catch{return{kind:"missing"}}return An(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function ti(e,n){let t=(n+".").toLowerCase(),o=[];for(let r of e){let s=r.toLowerCase();s.length>t.length&&s.startsWith(t)&&o.push(r)}return o}function nu(e,n,t){let o=ae.dirname(n);if(!An(e,o))return null;let r=rr(o,t);if(r===null)return null;let s=ae.basename(n);return r.names.has(s)?s:null}function oi(e,n){let t=e.filter(r=>!fi(r));if(t.length===0)return jn;let o=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${o}") the analyzer cannot parse`,why:"sibling-unparsable"}}function pi(e,n,t,o){let r=e,s=r.indexOf("?");s!==-1&&(r=r.slice(0,s));let a=r.indexOf("#");if(a!==-1&&(r=r.slice(0,a)),r===""||r.includes("\0"))return jn;let l=ae.resolve(ae.dirname(n),r);if(!An(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let i=ni(t,l);if(i.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(i.kind==="ok"){let m=Qs(i.real);if(m==="file"){let b=nu(t,i.real,o);return b!==null&&fi(b)?jn:{kind:"unanalyzable",reason:b===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${b}") the analyzer cannot parse`,why:b===null?"probe-refused":"sibling-unparsable"}}if(m!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let g=rr(i.real,o);if(g===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let y=oi(ti(g.names,"index"),"a directory index");return y.kind==="unanalyzable"?y:g.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:g.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(or)} entries and was not fully probed`,why:"probe-refused"}:jn}let d=ae.basename(l);if(d===""||d==="."||d==="..")return jn;let u=ni(t,ae.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(u.kind==="missing")return jn;let p=rr(u.real,o);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let f=oi(ti(p.names,d),"a sibling file exists");return f.kind==="unanalyzable"?f:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(or)} entries and was not fully probed`,why:"probe-refused"}:jn}function dr(e,n){let t=qe(e),o=ae.dirname(n);for(let r=0;r<64;r+=1){let s=ae.join(o,"node_modules",...t.split("/"));if(Oe(ae.join(s,"package.json"))!==null)return s;let a=ae.dirname(o);if(a===o)return null;o=a}return null}function ri(e,n,t,o,r){let s;for(let a of ir)for(let l of ar){let i={...t,noDtsResolution:!0,customConditions:[...l]},d=bt(e,n,i,o,a,r);if(s===void 0)s=d;else if(s!==d)return null}return s??null}function Ge(e,n,t,o){let r=we(e);if(r==="relative")return bt(e,n,t,o,void 0,!0);if(r==="package-root"){let l=ri(e,n,t,o,!0);if(l!==null)return l;let i=dr(e,n);if(i===null||Oe(ae.join(i,"package.json"))?.includes('"exports"')===!0)return null;let d=lr(i);return d===null||Be(d)?null:An(i,d)?d:null}let s=ri(e,n,t,o,!1);if(s===null)return null;let a=Jc(s,qe(e));return a!==null?Qc(e,a):Be(s)?s:ii(s)}function mi(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function kt(e,n,t,o){let r=we(e);if(r==="relative")return"no-candidate";if(mi(e))return"alias-unmapped";let s=new Set;for(let g of ir)for(let y of ar){let b={...t,noDtsResolution:!0,customConditions:[...y]};s.add(bt(e,n,b,o,g,r==="package-root"))}if(s.size>1)return"divergent-exports";let a=dr(e,n);if(a===null)return"not-installed";let l=Oe(ae.join(a,"package.json"));if(l===null)return"unreadable-manifest";let i;try{i=JSON.parse(l)}catch{return"unreadable-manifest"}if(typeof i!="object"||i===null)return"unreadable-manifest";let d=i,u=d.exports!==void 0&&d.exports!==null,p=typeof d.typesVersions=="object"&&d.typesVersions!==null,[f]=s;if(f!=null)return An(a,f)?!u&&p?"types-versions-remap":Be(f)?"declaration-only":"no-candidate":"out-of-root";let m=bt(e,n,t,o,void 0,!1);if(m!==null&&Be(m))return!u&&p?"types-versions-remap":"declaration-only";if(r==="package-root"&&!u){let g=lr(a);if(g!==null&&!An(a,g))return"out-of-root"}return"no-candidate"}function tt(e,n,t,o){let r=Ge(e,n,t,o);if(r!==null)return[r];let s=we(e);if(s==="relative")return[];let a=new Set;for(let d of ir)for(let u of ar){let p={...t,noDtsResolution:!0,customConditions:[...u]};a.add(bt(e,n,p,o,d,s==="package-root"))}if(a.size<2||a.has(null))return[];let l=dr(e,n);if(l===null)return[];let i=[];for(let d of a){if(d===null)return[];let u=ii(d);if(Be(u)||!An(l,u))return[];i.push(u)}return[...new Set(i)].sort()}function hi(e,n){let t=ae.dirname(e);for(let o=0;o<64;o+=1){let r=Oe(ae.join(t,"package.json"));if(r!==null){try{let a=JSON.parse(r);if(typeof a!="object"||a===null)return!1;let l=a.optionalDependencies;if(typeof l=="object"&&l!==null&&n in l)return!0;let i=a.peerDependenciesMeta;if(typeof i=="object"&&i!==null){let d=i[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let s=ae.dirname(t);if(s===t)return!1;t=s}return!1}function gi(e,n,t){let o=Oe(ae.join(e,"tsconfig.json"));if(o===null)return()=>null;let r=oo.parseConfigFileTextToJson(ae.join(e,"tsconfig.json"),o);if(r.error!==void 0)return()=>null;let s=r.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let a=s.paths;if(typeof a!="object"||a===null)return()=>null;let l=s.baseUrl,i=typeof l=="string"?ae.resolve(e,l):e,d=new Map,u=[];for(let[f,m]of Object.entries(a)){if(!Array.isArray(m))continue;let g=m.filter(b=>typeof b=="string");if(g.length===0)continue;let y=f.indexOf("*");y===-1?d.set(f,g):f.indexOf("*",y+1)===-1&&u.push({prefix:f.slice(0,y),suffix:f.slice(y+1),targets:g})}if(u.sort((f,m)=>m.prefix.length-f.prefix.length),d.size===0&&u.length===0)return()=>null;let p=f=>{let m=d.get(f);if(m!==void 0)return m;for(let g of u){if(f.length<g.prefix.length+g.suffix.length||!f.startsWith(g.prefix)||!f.endsWith(g.suffix))continue;let y=f.slice(g.prefix.length,f.length-g.suffix.length);return g.targets.map(b=>{let x=b.indexOf("*");return x===-1?b:b.slice(0,x)+y+b.slice(x+1)})}return[]};return(f,m)=>{let g=p(f);if(g.length===0||Ge(f,m,n,t)!==null)return null;for(let y of g){let b=ae.resolve(i,y),x=ae.relative(ae.dirname(m),b).split(ae.sep).join("/");if(x==="")continue;x.startsWith(".")||(x=`./${x}`);let I=Ge(x,m,n,t);if(I!==null&&An(e,I))return I}return null}}import{readdirSync as tu,realpathSync as ou}from"node:fs";import Sn from"node:path";import V from"typescript";function Et(e,n){if(V.isIdentifier(e))n.add(e.text);else for(let t of e.elements)V.isBindingElement(t)&&Et(t.name,n)}function ot(e){let n=new Map,t=new Set,o=i=>{n.set(i,(n.get(i)??0)+1)},r=i=>{let d=Ke(i);if(V.isIdentifier(d))t.add(d.text);else if(V.isArrayLiteralExpression(d))for(let u of d.elements)r(u);else if(V.isObjectLiteralExpression(d))for(let u of d.properties)V.isShorthandPropertyAssignment(u)?t.add(u.name.text):V.isPropertyAssignment(u)?r(u.initializer):V.isSpreadAssignment(u)&&r(u.expression);else V.isSpreadElement(d)?r(d.expression):V.isBinaryExpression(d)&&d.operatorToken.kind===V.SyntaxKind.EqualsToken&&r(d.left)},s=i=>{let d=new Set;Et(i,d);for(let u of d)o(u)},a=i=>{V.isVariableDeclaration(i)?s(i.name):V.isFunctionDeclaration(i)&&i.name!==void 0||V.isClassDeclaration(i)&&i.name!==void 0?o(i.name.text):V.isParameter(i)?s(i.name):((V.isFunctionExpression(i)||V.isClassExpression(i))&&i.name!==void 0&&V.isIdentifier(i.name)&&!(i.parent!==void 0&&V.isVariableDeclaration(i.parent)&&i.parent.initializer===i&&V.isIdentifier(i.parent.name)&&i.parent.name.text===i.name.text)||V.isImportClause(i)&&i.name!==void 0||V.isNamespaceImport(i)||V.isImportSpecifier(i)||V.isImportEqualsDeclaration(i))&&o(i.name.text),V.isBinaryExpression(i)&&i.operatorToken.kind>=V.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=V.SyntaxKind.LastAssignment?r(i.left):(V.isPrefixUnaryExpression(i)||V.isPostfixUnaryExpression(i))&&(i.operator===V.SyntaxKind.PlusPlusToken||i.operator===V.SyntaxKind.MinusMinusToken)?r(i.operand):(V.isForOfStatement(i)||V.isForInStatement(i))&&!V.isVariableDeclarationList(i.initializer)&&r(i.initializer),V.forEachChild(i,a)};a(e);let l=new Set(t);for(let[i,d]of n)d>1&&l.add(i);return l}function Bn(e,n,t){let o=ot(e),r=new Map,s=a=>{V.isVariableDeclaration(a)&&V.isIdentifier(a.name)&&a.initializer!==void 0&&!o.has(a.name.text)&&!r.has(a.name.text)&&r.set(a.name.text,a.initializer),V.forEachChild(a,s)};return s(e),{containingFile:n,taintedNames:o,constBindings:r,resolveParamDirs:t}}var ru=1024,su=32,iu=new Set(["filter","sort","slice","reverse"]),au=new Set(["forEach","map","filter","flatMap","find","some","every"]);function Ke(e){let n=e;for(;V.isParenthesizedExpression(n);)n=n.expression;return n}function yi(e,n){return V.isPropertyAccessExpression(e)&&V.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function _n(e,n,t,o){if(t>su)return null;let r=Ke(e);if(V.isStringLiteralLike(r))return r.text;if(V.isTemplateExpression(r)){let s=r.head.text;for(let a of r.templateSpans){let l=_n(a.expression,n,t+1,o);if(l===null)return null;s+=l+a.literal.text}return s}if(V.isBinaryExpression(r)&&r.operatorToken.kind===V.SyntaxKind.PlusToken){let s=_n(r.left,n,t+1,o);if(s===null)return null;let a=_n(r.right,n,t+1,o);return a===null?null:s+a}if(V.isIdentifier(r)){if(r.text==="__dirname")return Sn.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||o.has(r.text))return null;let s=n.constBindings.get(r.text);if(s===void 0)return null;o.add(r.text);let a=_n(s,n,t+1,o);return o.delete(r.text),a}if(V.isCallExpression(r)){let s=yi(r.expression,"join"),a=yi(r.expression,"resolve");if(!s&&!a)return null;let l=[];for(let d of r.arguments){let u=_n(d,n,t+1,o);if(u===null)return null;l.push(u)}let i=l[0];return i===void 0||a&&!Sn.isAbsolute(i)?null:a?Sn.resolve(...l):Sn.join(...l)}return null}function so(e){let n=Ke(e);if(V.isBinaryExpression(n)&&n.operatorToken.kind===V.SyntaxKind.PlusToken)return[...so(n.left),...so(n.right)];if(V.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let o of n.templateSpans)t.push({expr:o.expression}),o.literal.text.length>0&&t.push({lit:o.literal.text});return t}return V.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function bi(e){let n=e,t=0;for(;t++<4096;){let o=n.parent;if(o===void 0)return null;if(V.isForOfStatement(o)&&o.statement===n){let r=o.initializer;if(V.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&V.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let s=xi(o.expression);if(s!==null)return s}}if((V.isArrowFunction(n)||V.isFunctionExpression(n))&&V.isCallExpression(o)&&o.arguments.length>0&&o.arguments[0]===n&&V.isPropertyAccessExpression(o.expression)&&au.has(o.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&V.isIdentifier(r.name)&&r.name.text===e.text){let s=xi(o.expression.expression);if(s!==null)return s}}n=o}return null}function xi(e){let n=Ke(e),t=0;for(;V.isCallExpression(n)&&t++<16;){let o=n.expression;if(V.isPropertyAccessExpression(o)){let r=o.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(iu.has(r)){n=Ke(o.expression);continue}return null}return V.isIdentifier(o)&&o.text==="readdirSync"?n.arguments[0]??null:null}return null}function lu(e,n){let t=so(e);if(t.length<2)return null;let o=t[t.length-1];if(o===void 0||!("expr"in o)||!V.isIdentifier(o.expr))return null;let r=o.expr;if(n.taintedNames.has(r.text))return null;let s="";for(let d=0;d<t.length-1;d+=1){let u=t[d];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let p=_n(u.expr,n,0,new Set);if(p===null)return null;s+=p}}let a=bi(r),l=a===null?null:_n(a,n,0,new Set);if(l===null)return null;let i=Sn.resolve(s);return i!==Sn.resolve(l)?null:i}function du(e){if((V.isFunctionDeclaration(e)||V.isFunctionExpression(e))&&e.name!==void 0&&V.isIdentifier(e.name)||V.isMethodDeclaration(e)&&V.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&V.isVariableDeclaration(n)&&V.isIdentifier(n.name)?n.name.text:null}function cu(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!V.isFunctionLike(t))continue;let o=-1;for(let s=0;s<t.parameters.length;s+=1){let a=t.parameters[s];if(a!==void 0&&V.isIdentifier(a.name)&&a.name.text===n){o=s;break}}if(o<0)continue;let r=du(t);return r===null?null:{fnName:r,paramIndex:o}}return null}function wt(e,n){let t=so(e);if(t.length!==2)return null;let[o,r]=t;if(o===void 0||!("expr"in o)||!V.isIdentifier(o.expr)||r===void 0||!("expr"in r)||!V.isIdentifier(r.expr))return null;let s=o.expr,a=r.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(a.text))return null;let l=bi(a);return l===null||!V.isIdentifier(l)||l.text!==s.text?null:cu(s,s.text)}function uu(e,n){if(n.resolveParamDirs===void 0)return null;let t=wt(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function io(e){for(let n=e.parent;n!==void 0;n=n.parent){if(V.isSourceFile(n))return!0;if(!V.isArrowFunction(n)&&V.isFunctionLike(n))return!1}return!0}function cr(e,n){let t=_n(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let o=lu(e,n);if(o!==null)return{kind:"dir",dir:o};let r=uu(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function ki(e,n){let t;try{t=ou(e)}catch{return null}let o=n.endsWith(Sn.sep)?n:n+Sn.sep;return t===n||t.startsWith(o)?t:null}function Ei(e,n,t,o,r){let s=Ge(e,n,o,r);return s===null||Be(s)||!ro(s)?null:ki(s,t)}function Si(e,n,t,o,r){let s=ki(e,t);if(s===null)return[];let a;try{a=tu(s)}catch{return[]}if(a.length===0||a.length>ru)return[];a.sort();let l=new Set,i=[];for(let d of a){let u=Ei(Sn.join(s,d),n,t,o,r);u!==null&&!l.has(u)&&(l.add(u),i.push(u))}return i}function ao(e,n,t,o,r){let s=cr(e,n);if(s.kind==="const"){if(we(s.value)==="package-root")return[];let a=Ei(s.value,n.containingFile,t,o,r);return a===null?[]:[a]}if(s.kind==="dir")return Si(s.dir,n.containingFile,t,o,r);if(s.kind==="dirs"){let a=new Set,l=[];for(let i of s.dirs)for(let d of Si(i,n.containingFile,t,o,r))a.has(d)||(a.add(d),l.push(d));return l}return[]}import fu from"node:path";import me from"typescript";var pu=32,lo="\0",wi=(e,n)=>`${e}${lo}${n}`,vi=(e,n,t)=>`${e}${lo}${n}${lo}${String(t)}`;function mu(e){let n=new Map,t=new Set,o=(r,s)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,s)};for(let r of e.statements)if(me.isImportDeclaration(r)&&me.isStringLiteralLike(r.moduleSpecifier)){let s=r.moduleSpecifier.text,a=r.importClause;if(a===void 0)continue;a.name!==void 0&&o(a.name.text,{kind:"module",specifier:s});let l=a.namedBindings;if(l!==void 0&&me.isNamespaceImport(l))o(l.name.text,{kind:"module",specifier:s});else if(l!==void 0&&me.isNamedImports(l))for(let i of l.elements)o(i.name.text,{kind:"named",specifier:s,imported:(i.propertyName??i.name).text})}else if(me.isImportEqualsDeclaration(r)&&me.isExternalModuleReference(r.moduleReference)&&me.isStringLiteralLike(r.moduleReference.expression))o(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(me.isFunctionDeclaration(r)&&r.name!==void 0)o(r.name.text,{kind:"local"});else if(me.isVariableStatement(r))for(let s of r.declarationList.declarations){if(s.initializer===void 0)continue;let a=s.initializer;if(me.isIdentifier(s.name))me.isArrowFunction(a)||me.isFunctionExpression(a)?o(s.name.text,{kind:"local"}):Ii(a)&&o(s.name.text,{kind:"module",specifier:Ai(a)});else if(me.isObjectBindingPattern(s.name)&&Ii(a)){let l=Ai(a);for(let i of s.name.elements){if(i.dotDotDotToken!==void 0||!me.isIdentifier(i.name))continue;let d=i.propertyName??i.name;!me.isIdentifier(d)&&!me.isStringLiteralLike(d)||o(i.name.text,{kind:"named",specifier:l,imported:d.text})}}}return n}function Ii(e){return me.isCallExpression(e)&&me.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&me.isStringLiteralLike(e.arguments[0])}function Ai(e){let n=e.arguments[0];return n!==void 0&&me.isStringLiteralLike(n)?n.text:"\0"}function hu(e){let n=e.expression;if(me.isPropertyAccessExpression(n))return n.name.text;if(me.isIdentifier(n))return n.text}function gu(e,n,t,o,r,s){let a=e.expression,l=i=>{let d=`${i}${lo}${n}`,u=s.get(d);if(u!==void 0||s.has(d))return u??null;let p=Ge(i,n,o,r),f=p===null?null:fu.resolve(p);return s.set(d,f),f};if(me.isPropertyAccessExpression(a)&&me.isIdentifier(a.expression)){let i=t.get(a.expression.text);if(i?.kind==="module"){let d=l(i.specifier);return d===null?null:{moduleReal:d,fnName:a.name.text}}return null}if(me.isIdentifier(a)){let i=t.get(a.text);if(i?.kind==="named"){let d=l(i.specifier);return d===null?null:{moduleReal:d,fnName:i.imported}}return i?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function _i(e,n,t,o,r=new Map){if(n.length===0)return()=>null;let s=new Map,a=new Set;for(let i of n){let d=wi(i.definingModuleReal,i.fnName),u=s.get(d);u===void 0&&(u=new Set,s.set(d,u)),u.add(i.paramIndex),a.add(i.fnName)}let l=new Map;for(let i of e){let d=Bn(i.sf,i.real),u=mu(i.sf),p=f=>{if(me.isCallExpression(f)){let m=hu(f);if(m!==void 0&&a.has(m)&&io(f)){let g=gu(f,i.real,u,t,o,r);if(g!==null){let y=s.get(wi(g.moduleReal,g.fnName));if(y!==void 0)for(let b of y){let x=f.arguments[b];if(x===void 0)continue;let I=cr(x,d);if(I.kind==="const"){let w=vi(g.moduleReal,g.fnName,b),A=l.get(w);A===void 0&&(A=new Set,l.set(w,A)),A.add(I.value)}}}}}me.forEachChild(f,p)};p(i.sf)}return(i,d,u)=>{let p=l.get(vi(i,d,u));return p===void 0||p.size===0||p.size>pu?null:[...p].sort()}}var Ce={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:E.ScriptTarget.ES2020,module:E.ModuleKind.CommonJS,moduleResolution:E.ModuleResolutionKind.Node10,types:[]},co=5e3;function Le(e,n){let t;try{t=Kn(n)}catch{t=Me.resolve(n)}let o=e.endsWith(Me.sep)?e:e+Me.sep;return t!==e&&!t.startsWith(o)?null:t===e?"":t.slice(o.length).split(Me.sep).join("/")}function _e(e){let n=e;for(;;)if(E.isParenthesizedExpression(n))n=n.expression;else if(E.isBinaryExpression(n)&&n.operatorToken.kind===E.SyntaxKind.CommaToken)n=n.right;else return n}function bn(e){return E.isPropertyAccessExpression(e)?{receiver:_e(e.expression),name:e.name.text}:E.isElementAccessExpression(e)&&E.isStringLiteralLike(e.argumentExpression)?{receiver:_e(e.expression),name:e.argumentExpression.text}:null}function At(e){let n=_e(e.expression);if(E.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===E.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=bn(n);if(t!==null){if(t.name==="require"&&E.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(E.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let o=e.arguments[1];return{specifierArg:o!==void 0&&E.isArrayLiteralExpression(o)?o.elements[0]:void 0}}}}return null}function Ni(e){let n=[],t=o=>{if(E.isImportDeclaration(o)&&E.isStringLiteralLike(o.moduleSpecifier))n.push({text:o.moduleSpecifier.text,runtime:o.importClause?.isTypeOnly!==!0});else if(E.isImportEqualsDeclaration(o)&&E.isExternalModuleReference(o.moduleReference)&&E.isStringLiteralLike(o.moduleReference.expression))n.push({text:o.moduleReference.expression.text,runtime:!0});else if(E.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&E.isStringLiteralLike(o.moduleSpecifier))n.push({text:o.moduleSpecifier.text,runtime:o.isTypeOnly!==!0});else if(E.isCallExpression(o)){let r=At(o),s=r?.specifierArg;r!==null&&s!==void 0&&E.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}E.forEachChild(o,t)};return t(e),n}function yu(e,n){let t=n===E.ScriptKind.TSX?"__scriptkind_probe.tsx":n===E.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",o=E.createSourceFile(t,e,E.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:a=>a===t?o:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
-`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return E.createProgram({rootNames:[t],options:r,host:s}).getSyntacticDiagnostics(o).length}function gr(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Ri(e){let n=0,t=o=>{(E.isCallExpression(o)||E.isNewExpression(o)||E.isTaggedTemplateExpression(o))&&(n+=1),E.forEachChild(o,t)};return t(e),n}function Oi(e,n){let t=Ni(E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0));if(!gr(e)||!n.includes("<")||!n.includes("require"))return t;let o=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX),r=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Ni(o)){let a=`${s.runtime?"R":"T"}:${s.text}`;r.has(a)||(r.add(a),t.push(s))}return t}function Pi(e,n,t,o,r){if(!n.includes("require")&&!n.includes("import("))return[];let s=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0),a=Bn(s,e,r),l=[],i=new Set;return Ci(s,d=>{for(let u of ao(d,a,t,Ce,o))i.has(u)||(i.add(u),l.push(u))}),l}function Ci(e,n){let t=o=>{if(E.isCallExpression(o)){let r=At(o),s=r?.specifierArg;r!==null&&s!==void 0&&!E.isStringLiteralLike(s)&&n(s)}E.forEachChild(o,t)};t(e)}function xu(e){let n=[];for(let t of e){let o=Bn(t.sf,t.real);Ci(t.sf,r=>{let s=wt(r,o);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var Su=4,ur=co,fr=new Set(["eval","Function","createRequire"]),bu=new Set(["require","eval","Function","createRequire"]),po=new Set(["module","Module","require","process","global","globalThis"]),mo=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function ku(e){return e===E.SyntaxKind.LessThanToken||e===E.SyntaxKind.GreaterThanToken||e===E.SyntaxKind.LessThanEqualsToken||e===E.SyntaxKind.GreaterThanEqualsToken||e===E.SyntaxKind.EqualsEqualsToken||e===E.SyntaxKind.EqualsEqualsEqualsToken||e===E.SyntaxKind.ExclamationEqualsToken||e===E.SyntaxKind.ExclamationEqualsEqualsToken||e===E.SyntaxKind.InstanceOfKeyword||e===E.SyntaxKind.InKeyword}function Eu(e){let n=e.parent;return(E.isParameter(n)||E.isVariableDeclaration(n)||E.isBindingElement(n)||E.isFunctionDeclaration(n)||E.isFunctionExpression(n)||E.isClassDeclaration(n)||E.isClassExpression(n)||E.isPropertyAssignment(n)||E.isPropertyDeclaration(n)||E.isMethodDeclaration(n))&&n.name===e?!0:E.isPropertyAccessExpression(n)&&n.name===e}function wu(e,n){return E.isCallExpression(n)&&n.expression===e||(E.isPropertyAccessExpression(n)||E.isElementAccessExpression(n))&&n.expression===e||E.isTypeOfExpression(n)||E.isVoidExpression(n)||E.isDeleteExpression(n)||E.isPrefixUnaryExpression(n)||E.isPostfixUnaryExpression(n)?!0:E.isBinaryExpression(n)&&ku(n.operatorToken.kind)}function Mi(e){let n=e,t=e.parent;for(;;)if(E.isParenthesizedExpression(t))n=t,t=t.parent;else if(E.isBinaryExpression(t)&&t.operatorToken.kind===E.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!wu(n,t)}function vu(e){return Eu(e)?!1:Mi(e)}function Ti(e){let n=bn(e);if(n!==null&&mo.has(n.name))return!0;if(E.isElementAccessExpression(e)&&!E.isStringLiteralLike(e.argumentExpression)){let t=_e(e.expression);if(E.isIdentifier(t)&&po.has(t.text))return!0}return!1}function vt(e){let n=bn(e);if(n===null||n.name!=="constructor")return!1;let t=bn(n.receiver);return t!==null&&t.name==="constructor"}function Di(e){if(!E.isCallExpression(e))return!1;let n=_e(e.expression);if(!E.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&E.isStringLiteralLike(t)&&t.text==="module"}var Iu={roots:new Map,nodes:new Set,saturated:!1};function Li(e){return E.isSourceFile(e)||E.isFunctionDeclaration(e)||E.isFunctionExpression(e)||E.isArrowFunction(e)||E.isMethodDeclaration(e)||E.isConstructorDeclaration(e)||E.isGetAccessorDeclaration(e)||E.isSetAccessorDeclaration(e)||E.isClassStaticBlockDeclaration(e)||E.isModuleDeclaration(e)}function Fi(e,n){let t=e.parent;for(;t!==void 0;){if(Li(t))return t;t=t.parent}return n}function Au(e){let n=new Set;if(E.isFunctionLike(e))for(let o of e.parameters)for(let r of It(o.name))n.add(r);let t=[e];for(;t.length>0;){let o=t.pop();if(o===void 0)break;if(!(o!==e&&Li(o))){if(E.isVariableDeclaration(o)&&E.isVariableDeclarationList(o.parent)&&!((o.parent.flags&E.NodeFlags.BlockScoped)!==0))for(let s of It(o.name))n.add(s);E.forEachChild(o,r=>{t.push(r)})}}return n}function _u(e,n,t){let o=Fi(e,n);if(E.isSourceFile(o))return n;let r=t.get(o);return r===void 0&&(r=Au(o),t.set(o,r)),r.has(e.text)?o:n}function uo(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let o=n;for(;;){if(t.has(o))return!0;let r=o.parent;if(r===void 0)return!E.isSourceFile(o);o=r}}var Nu=12,Ru=8;function fo(e,n){let t=_e(e);for(;;){if(n.nodes.has(t))return!0;if(E.isIdentifier(t))return po.has(t.text)||uo(n,t);if(E.isCallExpression(t))return Di(t);let o=bn(t);if(o!==null){if(o.name==="constructor")return!0;t=o.receiver;continue}if(E.isElementAccessExpression(t)){t=_e(t.expression);continue}return!1}}function ji(e){let n=bn(_e(e.expression));if(n===null||n.name!=="get"||!E.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function Pu(e,n){let t=ji(e);if(t===null||!fo(t.target,n))return!1;let o=t.key;return o===void 0||!E.isStringLiteralLike(o)?!0:mo.has(o.text)}function pr(e){if(!E.isFunctionExpression(e)&&!E.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,o=r=>{if(!(t||E.isFunctionExpression(r)||E.isFunctionDeclaration(r)||E.isClassLike(r))){if(E.isReturnStatement(r)&&r.expression!==void 0&&_e(r.expression).kind===E.SyntaxKind.ThisKeyword){t=!0;return}E.forEachChild(r,o)}};return o(n),t}function It(e){if(E.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)E.isOmittedExpression(t)||n.push(...It(t.name));return n}function Bi(e){return e.parameters.map(n=>It(n.name))}function $u(e){let n=new Map,t=new Set,o=(s,a)=>{let l={fn:a,slots:Bi(a)},i=n.get(s);i===void 0?n.set(s,[l]):i.push(l),pr(a)&&t.add(s)},r=s=>{if(E.isFunctionDeclaration(s)&&s.name!==void 0)o(s.name.text,s);else if(E.isVariableDeclaration(s)&&E.isIdentifier(s.name)&&s.initializer!==void 0){let a=_e(s.initializer);(E.isFunctionExpression(a)||E.isArrowFunction(a))&&o(s.name.text,a)}E.forEachChild(s,r)};return r(e),{params:n,thisReturning:t}}function Ou(e){let n=new Map,t=new Set,o={roots:n,nodes:t},r=$u(e),s=new Map,a=new Set(r.thisReturning),l=!0;for(let i=0;l;i+=1){if(i>=Nu)return{roots:n,nodes:t,saturated:!0};l=!1;let d=(y,b)=>{b!==""&&!y.has(b)&&(y.add(b),l=!0)},u=(y,b)=>{if(y==="")return;let x=n.get(y);x===void 0&&(x=new Set,n.set(y,x)),x.has(b)||(x.add(b),l=!0)},p=y=>{t.has(y)||(t.add(y),l=!0)},f=(y,b)=>{let x=_e(y.expression);if(E.isIdentifier(x)&&fr.has(x.text)||vt(x)||E.isCallExpression(y)&&Di(y)||pr(x))return!0;let I=bn(x);if(I!==null&&(I.name==="call"||I.name==="apply"||I.name==="bind")){let w=I.receiver;if(pr(w)||t.has(w)||E.isIdentifier(w)&&(uo(o,w)||a.has(w.text)))return!0}if(t.has(x)||(E.isCallExpression(x)||E.isNewExpression(x))&&f(x,b+1)||E.isIdentifier(x)&&(uo(o,x)||a.has(x.text)))return!0;if(E.isCallExpression(y)){let w=ji(y);if(w!==null&&fo(w.target,o))return!0}return!1},m=(y,b)=>{if(b>=Ru)return!0;let x=_e(y);if(t.has(x))return!0;if(E.isIdentifier(x))return po.has(x.text)||uo(o,x);if(E.isBinaryExpression(x)){let I=x.operatorToken.kind;return I===E.SyntaxKind.BarBarToken||I===E.SyntaxKind.AmpersandAmpersandToken||I===E.SyntaxKind.QuestionQuestionToken?m(x.left,b+1)||m(x.right,b+1):!1}return E.isConditionalExpression(x)?m(x.whenTrue,b+1)||m(x.whenFalse,b+1):E.isPropertyAccessExpression(x)||E.isElementAccessExpression(x)?fo(x,o):E.isCallExpression(x)||E.isNewExpression(x)?f(x,b+1):!1},g=(y,b)=>{if((E.isVariableDeclaration(y)||E.isParameter(y)||E.isBindingElement(y))&&y.initializer!==void 0){if(m(y.initializer,0)){let I=Fi(y,e);for(let w of It(y.name))u(w,I)}}else if(E.isBinaryExpression(y)&&y.operatorToken.kind===E.SyntaxKind.EqualsToken&&E.isIdentifier(y.left)&&m(y.right,0))u(y.left.text,_u(y.left,e,s));else if(E.isReturnStatement(y)&&y.expression!==void 0&&b!==void 0&&m(y.expression,0))d(a,b);else if(E.isCallExpression(y)||E.isNewExpression(y)){f(y,0)&&p(y);let I=_e(y.expression),w=bn(I),A=w!==null&&w.name==="call",k=w!==null&&w.name==="apply",h=A||k?w.receiver:I,S=A?1:0,_=[];E.isFunctionExpression(h)||E.isArrowFunction(h)?_.push({fn:h,slots:Bi(h)}):E.isIdentifier(h)&&_.push(...r.params.get(h.text)??[]);let P=y.arguments??[];if(k){let v=P[1]===void 0?void 0:_e(P[1]);for(let{fn:T,slots:N}of _)if(v!==void 0&&E.isArrayLiteralExpression(v))for(let j=0;j<v.elements.length;j+=1){let O=v.elements[j],F=N[j];if(!(O===void 0||F===void 0)&&m(O,0))for(let K of F)u(K,T)}else if(v!==void 0)for(let j of N)for(let O of j)u(O,T)}else for(let{fn:v,slots:T}of _)for(let N=S;N<P.length;N+=1){let j=P[N],O=T[N-S];if(!(j===void 0||O===void 0)&&m(j,0))for(let F of O)u(F,v)}}let x=b;if(E.isFunctionDeclaration(y))x=y.name?.text;else if(E.isFunctionExpression(y)||E.isArrowFunction(y)){let I=y.parent;x=E.isVariableDeclaration(I)&&E.isIdentifier(I.name)?I.name.text:void 0}E.forEachChild(y,I=>g(I,x))};g(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Cu(e){if(E.isIdentifier(e)&&fr.has(e.text)||vt(e))return!0;let n=bn(e);if(n!==null&&(mo.has(n.name)||(n.name==="call"||n.name==="apply")&&(E.isIdentifier(n.receiver)&&fr.has(n.receiver.text)||vt(n.receiver)||(E.isPropertyAccessExpression(n.receiver)||E.isElementAccessExpression(n.receiver))&&Ti(n.receiver))))return!0;if(E.isElementAccessExpression(e)&&!E.isStringLiteralLike(e.argumentExpression)){let t=_e(e.expression);if(E.isIdentifier(t)&&po.has(t.text))return!0}return!1}var Mu=4;function $i(e,n){for(let t of e){if(!E.isStringLiteralLike(t)||n>=Mu)return!0;let o=E.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
+           FROM model_edge WHERE model_package_id = :id ORDER BY id`);return u.map(f=>{let m=un(f.id)??0;return{packageName:Ae(f.package_name),modelId:Ae(f.evidence_ref),introduced:Ae(f.introduced),fixedBefore:we(f.fixed_before),evidenceRef:Ae(f.evidence_ref),edges:p.all({id:m}).map(g=>({kind:Ae(g.kind),anchorExport:Ae(g.anchor_export),anchorContainer:we(g.anchor_container),calleePackage:Ae(g.callee_package),calleeContainer:we(g.callee_container),calleeExport:Ae(g.callee_export)}))}})},close(){t.close()}}}function ir(e){let n=e[0];if(n===void 0)throw new Error("compositeShardReader: at least one shard is required");for(let p of e)if(p.schemaVersion!==n.schemaVersion)throw new Error(`compositeShardReader: shards disagree on schema version (${n.schemaVersion} vs ${p.schemaVersion}); refusing to scan against a mixed schema`);let t=new Map,o=new Map,r=new Map,s=new Map,a=1,l=(p,f,m,g)=>{let y=`${String(m)}:${String(g)}`,S=p.get(y);if(S!==void 0)return S;let x=a;a+=1,p.set(y,x);let _=e[m];if(_===void 0)throw new Error("unreachable: reader index out of range");return f.set(x,{reader:_,id:g}),x},i=e.map(p=>new Set(p.ecosystems?.()??[])),d=p=>{let f=e.map((m,g)=>g).filter(m=>i[m]?.has(p)===!0);return f.length>0?f:e.map((m,g)=>g).filter(m=>e[m]?.ecosystems===void 0)},u=(p,f)=>({...f,id:l(r,s,p,f.id),affectedPackageId:l(t,o,p,f.affectedPackageId)});return{schemaVersion:n.schemaVersion,ecosystems(){let p=new Set;for(let f of i)for(let m of f)p.add(m);return[...p].sort()},advisoriesForPackage(p,f){let m=[];for(let g of d(p)){let y=e[g];if(y!==void 0)for(let S of y.advisoriesForPackage(p,f))m.push({...S,affected:{...S.affected,id:l(t,o,g,S.affected.id)}})}return m},symbolsForAffected(p){let f=o.get(p);if(f===void 0)return[];let m=e.indexOf(f.reader);return f.reader.symbolsForAffected(f.id).map(g=>u(m,g))},aliasesForSymbol(p){let f=s.get(p);if(f===void 0)return[];let m=e.indexOf(f.reader);return f.reader.aliasesForSymbol(f.id).map(g=>({...g,vulnerableSymbolId:l(r,s,m,g.vulnerableSymbolId)}))},allModels(){return e.flatMap(p=>p.allModels?.()??[])},close(){for(let p of e)p.close()}}}var Bn="6";import{realpathSync as En}from"node:fs";import Je from"node:path";import{realpathSync as zn}from"node:fs";import{isBuiltin as kr}from"node:module";import Te from"node:path";import E from"typescript";function ar(e){let n=e.trim().replace(/\\/gu,"/"),t=n.length;for(;t>0&&n.charCodeAt(t-1)===47;)t-=1;return t===n.length?n:n.slice(0,t)}function ve(e){let n=ar(e);if(n===""||n.startsWith(".")||n.startsWith("/"))return"relative";if(n.startsWith("@")){let t=n.indexOf("/");return t===-1||n.indexOf("/",t+1)===-1?"package-root":"package-subpath"}return n.includes("/")?"package-subpath":"package-root"}function He(e){let n=ar(e);if(n.startsWith("@")){let o=n.indexOf("/");if(o===-1)return n;let r=n.indexOf("/",o+1);return r===-1?n:n.slice(0,r)}let t=n.indexOf("/");return t===-1?n:n.slice(0,t)}function ai(e){let n=ar(e),t=He(n);return n.length>t.length+1?n.slice(t.length+1):""}import{readFileSync as Zc,statSync as lr}from"node:fs";var In=16*1024*1024;function ot(e,n){try{let t=lr(e);return t.isFile()?t.size>n?{kind:"too-large",bytes:t.size}:{kind:"ok",text:Zc(e,"utf8")}:{kind:"not-regular"}}catch{return{kind:"not-regular"}}}function Oe(e){let n=ot(e,In);return n.kind==="ok"?n.text:null}function fn(e){try{return lr(e).isFile()}catch{return!1}}function li(e){try{let n=lr(e);return n.isFile()?"file":n.isDirectory()?"dir":"other"}catch{return"other"}}import{opendirSync as Qc,realpathSync as ur}from"node:fs";import le from"node:path";import io from"typescript";var mi=[[".d.mts",[".mjs"]],[".d.cts",[".cjs"]],[".d.ts",[".js",".cjs",".mjs",".jsx"]]];function Ue(e){return mi.some(([n])=>e.endsWith(n))}function eu(e){for(let[n,t]of mi)if(e.endsWith(n)){let o=e.slice(0,-n.length);return t.map(r=>o+r)}return[]}var nu=[[".tsx",[".js",".jsx",".cjs",".mjs"]],[".cts",[".cjs"]],[".mts",[".mjs"]],[".ts",[".js",".cjs",".mjs",".jsx"]]];function hi(e){if(Ue(e))return e;for(let[n,t]of nu)if(e.endsWith(n)){let o=e.slice(0,-n.length);for(let r of t){let s=o+r;if(fn(s))return s}return e}return e}var fr=[io.ModuleKind.CommonJS,io.ModuleKind.ESNext],pr=[[],["node-addons"],["module-sync"],["node-addons","module-sync"]];function Et(e,n,t,o,r,s){let a=io.resolveModuleName(e,n,t,o,void 0,void 0,r).resolvedModule;if(a===void 0)return null;let l=a.resolvedFileName;if(s){for(let i of eu(l))if(fn(i))return i}return l}var gi=[".js",".jsx",".cjs",".mjs",".ts",".tsx",".cts",".mts"],tu=[".js",".json",".node"],ou=["index.js","index.json","index.node"];function ao(e){return!Ue(e)&&gi.some(n=>e.endsWith(n))}function yi(e){if(fn(e))return e;for(let n of tu)if(fn(e+n))return e+n;return null}function di(e){for(let n of ou){let t=le.join(e,n);if(fn(t))return t}return null}var xi=[".ts",".tsx",".cts",".mts",".jsx"];function ru(e){for(let n of xi)if(fn(e+n))return e+n;return null}function su(e){for(let n of xi){let t=le.join(e,"index"+n);if(fn(t))return t}return null}function mr(e){let n=Oe(le.join(e,"package.json"));if(n!==null)try{let t=JSON.parse(n).main;if(typeof t=="string"&&t.length>0){let o=le.join(e,t),r=yi(o)??di(o);if(r!==null)return r}}catch{}return di(e)}function bi(e){return yi(e)??mr(e)??ru(e)??su(e)}function Si(e){return bi(e)!==null}function iu(e,n){let t=e.split(le.sep),o=n.split("/"),r=null;for(let a=t.length-o.length-1;a>=0;a-=1)if(t[a]==="node_modules"&&o.every((l,i)=>t[a+1+i]===l)){r=t.slice(0,a+1+o.length).join(le.sep);break}if(r===null||r==="")return null;let s=Oe(le.join(r,"package.json"));if(s===null)return null;try{let a=JSON.parse(s),l=a.exports,i=typeof l=="string"||Array.isArray(l)||typeof l=="object"&&l!==null;if(a.name!==n||i)return null}catch{return null}try{return ur(r)}catch{return null}}function au(e,n){let t=bi(le.join(e,n));if(t===null)return null;let o;try{o=ur(t)}catch{return null}let r=e.endsWith(le.sep)?e:e+le.sep;return o!==e&&!o.startsWith(r)||Ue(o)||!gi.some(s=>o.endsWith(s))?null:o}function lu(e,n){let t=ai(e);return t===""||t.includes("\0")||t.split("/").some(o=>o===""||o==="."||o===".."||o==="node_modules")?null:au(n,t)}var Kn={kind:"nothing-loads"},dr=8192;function cr(e,n){let t=n.get(e);if(t!==void 0)return t;let o,r=null;try{r=Qc(e);let s=new Set,a=!1;for(;;){let l=r.readSync();if(l===null)break;if(s.size>=dr){a=!0;break}s.add(l.name)}o={names:s,truncated:a}}catch{o=null}finally{try{r?.closeSync()}catch{}}return n.set(e,o),o}var du=[".json",".css",".scss",".sass",".less",".styl",".svg",".png",".jpg",".jpeg",".gif",".webp",".avif",".ico",".bmp",".woff",".woff2",".ttf",".otf",".eot",".mp3",".mp4",".webm",".txt"];function ki(e){return du.some(n=>e.length>n.length&&e.endsWith(n))}function An(e,n){let t=e.endsWith(le.sep)?e:e+le.sep;return n===e||n.startsWith(t)}function ci(e,n){let t;try{t=ur(n)}catch{return{kind:"missing"}}return An(e,t)?{kind:"ok",real:t}:{kind:"escaped"}}function ui(e,n){let t=(n+".").toLowerCase(),o=[];for(let r of e){let s=r.toLowerCase();s.length>t.length&&s.startsWith(t)&&o.push(r)}return o}function cu(e,n,t){let o=le.dirname(n);if(!An(e,o))return null;let r=cr(o,t);if(r===null)return null;let s=le.basename(n);return r.names.has(s)?s:null}function fi(e,n){let t=e.filter(r=>!ki(r));if(t.length===0)return Kn;let o=[...t].sort()[0]??"";return{kind:"unanalyzable",reason:`${n} ("${o}") the analyzer cannot parse`,why:"sibling-unparsable"}}function Ei(e,n,t,o){let r=e,s=r.indexOf("?");s!==-1&&(r=r.slice(0,s));let a=r.indexOf("#");if(a!==-1&&(r=r.slice(0,a)),r===""||r.includes("\0"))return Kn;let l=le.resolve(le.dirname(n),r);if(!An(t,l))return{kind:"unanalyzable",reason:"its target is outside the scan root and was not probed",why:"out-of-root"};let i=ci(t,l);if(i.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target outside the scan root, which was not probed",why:"out-of-root"};if(i.kind==="ok"){let m=li(i.real);if(m==="file"){let S=cu(t,i.real,o);return S!==null&&ki(S)?Kn:{kind:"unanalyzable",reason:S===null?"a file exists at that path under a name its directory listing did not confirm":`a file exists at that path ("${S}") the analyzer cannot parse`,why:S===null?"probe-refused":"sibling-unparsable"}}if(m!=="dir")return{kind:"unanalyzable",reason:"its target exists but is not a regular file",why:"probe-refused"};let g=cr(i.real,o);if(g===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let y=fi(ui(g.names,"index"),"a directory index");return y.kind==="unanalyzable"?y:g.names.has("package.json")?{kind:"unanalyzable",reason:"its target is a directory whose package.json main did not resolve",why:"probe-refused"}:g.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(dr)} entries and was not fully probed`,why:"probe-refused"}:Kn}let d=le.basename(l);if(d===""||d==="."||d==="..")return Kn;let u=ci(t,le.dirname(l));if(u.kind==="escaped")return{kind:"unanalyzable",reason:"a symlink carries its target directory outside the scan root, which was not probed",why:"out-of-root"};if(u.kind==="missing")return Kn;let p=cr(u.real,o);if(p===null)return{kind:"unanalyzable",reason:"its target directory could not be listed",why:"probe-refused"};let f=fi(ui(p.names,d),"a sibling file exists");return f.kind==="unanalyzable"?f:p.truncated?{kind:"unanalyzable",reason:`its target directory exceeds ${String(dr)} entries and was not fully probed`,why:"probe-refused"}:Kn}function hr(e,n){let t=He(e),o=le.dirname(n);for(let r=0;r<64;r+=1){let s=le.join(o,"node_modules",...t.split("/"));if(Oe(le.join(s,"package.json"))!==null)return s;let a=le.dirname(o);if(a===o)return null;o=a}return null}function pi(e,n,t,o,r){let s;for(let a of fr)for(let l of pr){let i={...t,noDtsResolution:!0,customConditions:[...l]},d=Et(e,n,i,o,a,r);if(s===void 0)s=d;else if(s!==d)return null}return s??null}function Xe(e,n,t,o){let r=ve(e);if(r==="relative")return Et(e,n,t,o,void 0,!0);if(r==="package-root"){let l=pi(e,n,t,o,!0);if(l!==null)return l;let i=hr(e,n);if(i===null||Oe(le.join(i,"package.json"))?.includes('"exports"')===!0)return null;let d=mr(i);return d===null||Ue(d)?null:An(i,d)?d:null}let s=pi(e,n,t,o,!1);if(s===null)return null;let a=iu(s,He(e));return a!==null?lu(e,a):Ue(s)?s:hi(s)}function wi(e){let n=e.trim();return n.startsWith("@/")||n==="~"||n.startsWith("~/")||n.startsWith("#")}function wt(e,n,t,o){let r=ve(e);if(r==="relative")return"no-candidate";if(wi(e))return"alias-unmapped";let s=new Set;for(let g of fr)for(let y of pr){let S={...t,noDtsResolution:!0,customConditions:[...y]};s.add(Et(e,n,S,o,g,r==="package-root"))}if(s.size>1)return"divergent-exports";let a=hr(e,n);if(a===null)return"not-installed";let l=Oe(le.join(a,"package.json"));if(l===null)return"unreadable-manifest";let i;try{i=JSON.parse(l)}catch{return"unreadable-manifest"}if(typeof i!="object"||i===null)return"unreadable-manifest";let d=i,u=d.exports!==void 0&&d.exports!==null,p=typeof d.typesVersions=="object"&&d.typesVersions!==null,[f]=s;if(f!=null)return An(a,f)?!u&&p?"types-versions-remap":Ue(f)?"declaration-only":"no-candidate":"out-of-root";let m=Et(e,n,t,o,void 0,!1);if(m!==null&&Ue(m))return!u&&p?"types-versions-remap":"declaration-only";if(r==="package-root"&&!u){let g=mr(a);if(g!==null&&!An(a,g))return"out-of-root"}return"no-candidate"}function rt(e,n,t,o){let r=Xe(e,n,t,o);if(r!==null)return[r];let s=ve(e);if(s==="relative")return[];let a=new Set;for(let d of fr)for(let u of pr){let p={...t,noDtsResolution:!0,customConditions:[...u]};a.add(Et(e,n,p,o,d,s==="package-root"))}if(a.size<2||a.has(null))return[];let l=hr(e,n);if(l===null)return[];let i=[];for(let d of a){if(d===null)return[];let u=hi(d);if(Ue(u)||!An(l,u))return[];i.push(u)}return[...new Set(i)].sort()}function vi(e,n){let t=le.dirname(e);for(let o=0;o<64;o+=1){let r=Oe(le.join(t,"package.json"));if(r!==null){try{let a=JSON.parse(r);if(typeof a!="object"||a===null)return!1;let l=a.optionalDependencies;if(typeof l=="object"&&l!==null&&n in l)return!0;let i=a.peerDependenciesMeta;if(typeof i=="object"&&i!==null){let d=i[n];if(typeof d=="object"&&d!==null)return d.optional===!0}}catch{return!1}return!1}let s=le.dirname(t);if(s===t)return!1;t=s}return!1}function _i(e,n,t){let o=Oe(le.join(e,"tsconfig.json"));if(o===null)return()=>null;let r=io.parseConfigFileTextToJson(le.join(e,"tsconfig.json"),o);if(r.error!==void 0)return()=>null;let s=r.config?.compilerOptions;if(typeof s!="object"||s===null)return()=>null;let a=s.paths;if(typeof a!="object"||a===null)return()=>null;let l=s.baseUrl,i=typeof l=="string"?le.resolve(e,l):e,d=new Map,u=[];for(let[f,m]of Object.entries(a)){if(!Array.isArray(m))continue;let g=m.filter(S=>typeof S=="string");if(g.length===0)continue;let y=f.indexOf("*");y===-1?d.set(f,g):f.indexOf("*",y+1)===-1&&u.push({prefix:f.slice(0,y),suffix:f.slice(y+1),targets:g})}if(u.sort((f,m)=>m.prefix.length-f.prefix.length),d.size===0&&u.length===0)return()=>null;let p=f=>{let m=d.get(f);if(m!==void 0)return m;for(let g of u){if(f.length<g.prefix.length+g.suffix.length||!f.startsWith(g.prefix)||!f.endsWith(g.suffix))continue;let y=f.slice(g.prefix.length,f.length-g.suffix.length);return g.targets.map(S=>{let x=S.indexOf("*");return x===-1?S:S.slice(0,x)+y+S.slice(x+1)})}return[]};return(f,m)=>{let g=p(f);if(g.length===0||Xe(f,m,n,t)!==null)return null;for(let y of g){let S=le.resolve(i,y),x=le.relative(le.dirname(m),S).split(le.sep).join("/");if(x==="")continue;x.startsWith(".")||(x=`./${x}`);let _=Xe(x,m,n,t);if(_!==null&&An(e,_))return _}return null}}import{readdirSync as uu,realpathSync as fu}from"node:fs";import Sn from"node:path";import W from"typescript";function vt(e,n){if(W.isIdentifier(e))n.add(e.text);else for(let t of e.elements)W.isBindingElement(t)&&vt(t.name,n)}function st(e){let n=new Map,t=new Set,o=i=>{n.set(i,(n.get(i)??0)+1)},r=i=>{let d=ze(i);if(W.isIdentifier(d))t.add(d.text);else if(W.isArrayLiteralExpression(d))for(let u of d.elements)r(u);else if(W.isObjectLiteralExpression(d))for(let u of d.properties)W.isShorthandPropertyAssignment(u)?t.add(u.name.text):W.isPropertyAssignment(u)?r(u.initializer):W.isSpreadAssignment(u)&&r(u.expression);else W.isSpreadElement(d)?r(d.expression):W.isBinaryExpression(d)&&d.operatorToken.kind===W.SyntaxKind.EqualsToken&&r(d.left)},s=i=>{let d=new Set;vt(i,d);for(let u of d)o(u)},a=i=>{W.isVariableDeclaration(i)?s(i.name):W.isFunctionDeclaration(i)&&i.name!==void 0||W.isClassDeclaration(i)&&i.name!==void 0?o(i.name.text):W.isParameter(i)?s(i.name):((W.isFunctionExpression(i)||W.isClassExpression(i))&&i.name!==void 0&&W.isIdentifier(i.name)&&!(i.parent!==void 0&&W.isVariableDeclaration(i.parent)&&i.parent.initializer===i&&W.isIdentifier(i.parent.name)&&i.parent.name.text===i.name.text)||W.isImportClause(i)&&i.name!==void 0||W.isNamespaceImport(i)||W.isImportSpecifier(i)||W.isImportEqualsDeclaration(i))&&o(i.name.text),W.isBinaryExpression(i)&&i.operatorToken.kind>=W.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=W.SyntaxKind.LastAssignment?r(i.left):(W.isPrefixUnaryExpression(i)||W.isPostfixUnaryExpression(i))&&(i.operator===W.SyntaxKind.PlusPlusToken||i.operator===W.SyntaxKind.MinusMinusToken)?r(i.operand):(W.isForOfStatement(i)||W.isForInStatement(i))&&!W.isVariableDeclarationList(i.initializer)&&r(i.initializer),W.forEachChild(i,a)};a(e);let l=new Set(t);for(let[i,d]of n)d>1&&l.add(i);return l}function Un(e,n,t){let o=st(e),r=new Map,s=a=>{W.isVariableDeclaration(a)&&W.isIdentifier(a.name)&&a.initializer!==void 0&&!o.has(a.name.text)&&!r.has(a.name.text)&&r.set(a.name.text,a.initializer),W.forEachChild(a,s)};return s(e),{containingFile:n,taintedNames:o,constBindings:r,resolveParamDirs:t}}var pu=1024,mu=32,hu=new Set(["filter","sort","slice","reverse"]),gu=new Set(["forEach","map","filter","flatMap","find","some","every"]);function ze(e){let n=e;for(;W.isParenthesizedExpression(n);)n=n.expression;return n}function Ii(e,n){return W.isPropertyAccessExpression(e)&&W.isIdentifier(e.expression)&&e.expression.text==="path"&&e.name.text===n}function Nn(e,n,t,o){if(t>mu)return null;let r=ze(e);if(W.isStringLiteralLike(r))return r.text;if(W.isTemplateExpression(r)){let s=r.head.text;for(let a of r.templateSpans){let l=Nn(a.expression,n,t+1,o);if(l===null)return null;s+=l+a.literal.text}return s}if(W.isBinaryExpression(r)&&r.operatorToken.kind===W.SyntaxKind.PlusToken){let s=Nn(r.left,n,t+1,o);if(s===null)return null;let a=Nn(r.right,n,t+1,o);return a===null?null:s+a}if(W.isIdentifier(r)){if(r.text==="__dirname")return Sn.dirname(n.containingFile);if(r.text==="__filename")return n.containingFile;if(n.taintedNames.has(r.text)||o.has(r.text))return null;let s=n.constBindings.get(r.text);if(s===void 0)return null;o.add(r.text);let a=Nn(s,n,t+1,o);return o.delete(r.text),a}if(W.isCallExpression(r)){let s=Ii(r.expression,"join"),a=Ii(r.expression,"resolve");if(!s&&!a)return null;let l=[];for(let d of r.arguments){let u=Nn(d,n,t+1,o);if(u===null)return null;l.push(u)}let i=l[0];return i===void 0||a&&!Sn.isAbsolute(i)?null:a?Sn.resolve(...l):Sn.join(...l)}return null}function lo(e){let n=ze(e);if(W.isBinaryExpression(n)&&n.operatorToken.kind===W.SyntaxKind.PlusToken)return[...lo(n.left),...lo(n.right)];if(W.isTemplateExpression(n)){let t=[];n.head.text.length>0&&t.push({lit:n.head.text});for(let o of n.templateSpans)t.push({expr:o.expression}),o.literal.text.length>0&&t.push({lit:o.literal.text});return t}return W.isStringLiteralLike(n)?[{lit:n.text}]:[{expr:n}]}function Ri(e){let n=e,t=0;for(;t++<4096;){let o=n.parent;if(o===void 0)return null;if(W.isForOfStatement(o)&&o.statement===n){let r=o.initializer;if(W.isVariableDeclarationList(r)&&r.declarations.length===1&&r.declarations[0]!==void 0&&W.isIdentifier(r.declarations[0].name)&&r.declarations[0].name.text===e.text){let s=Ai(o.expression);if(s!==null)return s}}if((W.isArrowFunction(n)||W.isFunctionExpression(n))&&W.isCallExpression(o)&&o.arguments.length>0&&o.arguments[0]===n&&W.isPropertyAccessExpression(o.expression)&&gu.has(o.expression.name.text)){let r=n.parameters[0];if(r!==void 0&&W.isIdentifier(r.name)&&r.name.text===e.text){let s=Ai(o.expression.expression);if(s!==null)return s}}n=o}return null}function Ai(e){let n=ze(e),t=0;for(;W.isCallExpression(n)&&t++<16;){let o=n.expression;if(W.isPropertyAccessExpression(o)){let r=o.name.text;if(r==="readdirSync")return n.arguments[0]??null;if(hu.has(r)){n=ze(o.expression);continue}return null}return W.isIdentifier(o)&&o.text==="readdirSync"?n.arguments[0]??null:null}return null}function yu(e,n){let t=lo(e);if(t.length<2)return null;let o=t[t.length-1];if(o===void 0||!("expr"in o)||!W.isIdentifier(o.expr))return null;let r=o.expr;if(n.taintedNames.has(r.text))return null;let s="";for(let d=0;d<t.length-1;d+=1){let u=t[d];if(u===void 0)return null;if("lit"in u)s+=u.lit;else{let p=Nn(u.expr,n,0,new Set);if(p===null)return null;s+=p}}let a=Ri(r),l=a===null?null:Nn(a,n,0,new Set);if(l===null)return null;let i=Sn.resolve(s);return i!==Sn.resolve(l)?null:i}function xu(e){if((W.isFunctionDeclaration(e)||W.isFunctionExpression(e))&&e.name!==void 0&&W.isIdentifier(e.name)||W.isMethodDeclaration(e)&&W.isIdentifier(e.name))return e.name.text;let n=e.parent;return n!==void 0&&W.isVariableDeclaration(n)&&W.isIdentifier(n.name)?n.name.text:null}function bu(e,n){for(let t=e.parent;t!==void 0;t=t.parent){if(!W.isFunctionLike(t))continue;let o=-1;for(let s=0;s<t.parameters.length;s+=1){let a=t.parameters[s];if(a!==void 0&&W.isIdentifier(a.name)&&a.name.text===n){o=s;break}}if(o<0)continue;let r=xu(t);return r===null?null:{fnName:r,paramIndex:o}}return null}function _t(e,n){let t=lo(e);if(t.length!==2)return null;let[o,r]=t;if(o===void 0||!("expr"in o)||!W.isIdentifier(o.expr)||r===void 0||!("expr"in r)||!W.isIdentifier(r.expr))return null;let s=o.expr,a=r.expr;if(n.taintedNames.has(s.text)||n.taintedNames.has(a.text))return null;let l=Ri(a);return l===null||!W.isIdentifier(l)||l.text!==s.text?null:bu(s,s.text)}function Su(e,n){if(n.resolveParamDirs===void 0)return null;let t=_t(e,n);return t===null?null:n.resolveParamDirs(n.containingFile,t.fnName,t.paramIndex)}function co(e){for(let n=e.parent;n!==void 0;n=n.parent){if(W.isSourceFile(n))return!0;if(!W.isArrowFunction(n)&&W.isFunctionLike(n))return!1}return!0}function gr(e,n){let t=Nn(e,n,0,new Set);if(t!==null)return{kind:"const",value:t};let o=yu(e,n);if(o!==null)return{kind:"dir",dir:o};let r=Su(e,n);return r!==null&&r.length>0?{kind:"dirs",dirs:[...r]}:{kind:"opaque"}}function Pi(e,n){let t;try{t=fu(e)}catch{return null}let o=n.endsWith(Sn.sep)?n:n+Sn.sep;return t===n||t.startsWith(o)?t:null}function $i(e,n,t,o,r){let s=Xe(e,n,o,r);return s===null||Ue(s)||!ao(s)?null:Pi(s,t)}function Ni(e,n,t,o,r){let s=Pi(e,t);if(s===null)return[];let a;try{a=uu(s)}catch{return[]}if(a.length===0||a.length>pu)return[];a.sort();let l=new Set,i=[];for(let d of a){let u=$i(Sn.join(s,d),n,t,o,r);u!==null&&!l.has(u)&&(l.add(u),i.push(u))}return i}function uo(e,n,t,o,r){let s=gr(e,n);if(s.kind==="const"){if(ve(s.value)==="package-root")return[];let a=$i(s.value,n.containingFile,t,o,r);return a===null?[]:[a]}if(s.kind==="dir")return Ni(s.dir,n.containingFile,t,o,r);if(s.kind==="dirs"){let a=new Set,l=[];for(let i of s.dirs)for(let d of Ni(i,n.containingFile,t,o,r))a.has(d)||(a.add(d),l.push(d));return l}return[]}import ku from"node:path";import he from"typescript";var Eu=32,fo="\0",Ci=(e,n)=>`${e}${fo}${n}`,Oi=(e,n,t)=>`${e}${fo}${n}${fo}${String(t)}`;function wu(e){let n=new Map,t=new Set,o=(r,s)=>{if(t.has(r)){n.delete(r);return}t.add(r),n.set(r,s)};for(let r of e.statements)if(he.isImportDeclaration(r)&&he.isStringLiteralLike(r.moduleSpecifier)){let s=r.moduleSpecifier.text,a=r.importClause;if(a===void 0)continue;a.name!==void 0&&o(a.name.text,{kind:"module",specifier:s});let l=a.namedBindings;if(l!==void 0&&he.isNamespaceImport(l))o(l.name.text,{kind:"module",specifier:s});else if(l!==void 0&&he.isNamedImports(l))for(let i of l.elements)o(i.name.text,{kind:"named",specifier:s,imported:(i.propertyName??i.name).text})}else if(he.isImportEqualsDeclaration(r)&&he.isExternalModuleReference(r.moduleReference)&&he.isStringLiteralLike(r.moduleReference.expression))o(r.name.text,{kind:"module",specifier:r.moduleReference.expression.text});else if(he.isFunctionDeclaration(r)&&r.name!==void 0)o(r.name.text,{kind:"local"});else if(he.isVariableStatement(r))for(let s of r.declarationList.declarations){if(s.initializer===void 0)continue;let a=s.initializer;if(he.isIdentifier(s.name))he.isArrowFunction(a)||he.isFunctionExpression(a)?o(s.name.text,{kind:"local"}):Mi(a)&&o(s.name.text,{kind:"module",specifier:Ti(a)});else if(he.isObjectBindingPattern(s.name)&&Mi(a)){let l=Ti(a);for(let i of s.name.elements){if(i.dotDotDotToken!==void 0||!he.isIdentifier(i.name))continue;let d=i.propertyName??i.name;!he.isIdentifier(d)&&!he.isStringLiteralLike(d)||o(i.name.text,{kind:"named",specifier:l,imported:d.text})}}}return n}function Mi(e){return he.isCallExpression(e)&&he.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&he.isStringLiteralLike(e.arguments[0])}function Ti(e){let n=e.arguments[0];return n!==void 0&&he.isStringLiteralLike(n)?n.text:"\0"}function vu(e){let n=e.expression;if(he.isPropertyAccessExpression(n))return n.name.text;if(he.isIdentifier(n))return n.text}function _u(e,n,t,o,r,s){let a=e.expression,l=i=>{let d=`${i}${fo}${n}`,u=s.get(d);if(u!==void 0||s.has(d))return u??null;let p=Xe(i,n,o,r),f=p===null?null:ku.resolve(p);return s.set(d,f),f};if(he.isPropertyAccessExpression(a)&&he.isIdentifier(a.expression)){let i=t.get(a.expression.text);if(i?.kind==="module"){let d=l(i.specifier);return d===null?null:{moduleReal:d,fnName:a.name.text}}return null}if(he.isIdentifier(a)){let i=t.get(a.text);if(i?.kind==="named"){let d=l(i.specifier);return d===null?null:{moduleReal:d,fnName:i.imported}}return i?.kind==="local"?{moduleReal:n,fnName:a.text}:null}return null}function Di(e,n,t,o,r=new Map){if(n.length===0)return()=>null;let s=new Map,a=new Set;for(let i of n){let d=Ci(i.definingModuleReal,i.fnName),u=s.get(d);u===void 0&&(u=new Set,s.set(d,u)),u.add(i.paramIndex),a.add(i.fnName)}let l=new Map;for(let i of e){let d=Un(i.sf,i.real),u=wu(i.sf),p=f=>{if(he.isCallExpression(f)){let m=vu(f);if(m!==void 0&&a.has(m)&&co(f)){let g=_u(f,i.real,u,t,o,r);if(g!==null){let y=s.get(Ci(g.moduleReal,g.fnName));if(y!==void 0)for(let S of y){let x=f.arguments[S];if(x===void 0)continue;let _=gr(x,d);if(_.kind==="const"){let w=Oi(g.moduleReal,g.fnName,S),I=l.get(w);I===void 0&&(I=new Set,l.set(w,I)),I.add(_.value)}}}}}he.forEachChild(f,p)};p(i.sf)}return(i,d,u)=>{let p=l.get(Oi(i,d,u));return p===void 0||p.size===0||p.size>Eu?null:[...p].sort()}}var Me={allowJs:!0,checkJs:!1,noEmit:!0,skipLibCheck:!0,target:E.ScriptTarget.ES2020,module:E.ModuleKind.CommonJS,moduleResolution:E.ModuleResolutionKind.Node10,types:[]},po=5e3;function Fe(e,n){let t;try{t=zn(n)}catch{t=Te.resolve(n)}let o=e.endsWith(Te.sep)?e:e+Te.sep;return t!==e&&!t.startsWith(o)?null:t===e?"":t.slice(o.length).split(Te.sep).join("/")}function Ne(e){let n=e;for(;;)if(E.isParenthesizedExpression(n))n=n.expression;else if(E.isBinaryExpression(n)&&n.operatorToken.kind===E.SyntaxKind.CommaToken)n=n.right;else return n}function kn(e){return E.isPropertyAccessExpression(e)?{receiver:Ne(e.expression),name:e.name.text}:E.isElementAccessExpression(e)&&E.isStringLiteralLike(e.argumentExpression)?{receiver:Ne(e.expression),name:e.argumentExpression.text}:null}function Nt(e){let n=Ne(e.expression);if(E.isIdentifier(n)&&n.text==="require")return{specifierArg:e.arguments[0]};if(n.kind===E.SyntaxKind.ImportKeyword)return{specifierArg:e.arguments[0]};let t=kn(n);if(t!==null){if(t.name==="require"&&E.isIdentifier(t.receiver)&&t.receiver.text==="module")return{specifierArg:e.arguments[0]};if(E.isIdentifier(t.receiver)&&t.receiver.text==="require"){if(t.name==="call")return{specifierArg:e.arguments[1]};if(t.name==="apply"){let o=e.arguments[1];return{specifierArg:o!==void 0&&E.isArrayLiteralExpression(o)?o.elements[0]:void 0}}}}return null}function Li(e){let n=[],t=o=>{if(E.isImportDeclaration(o)&&E.isStringLiteralLike(o.moduleSpecifier))n.push({text:o.moduleSpecifier.text,runtime:o.importClause?.isTypeOnly!==!0});else if(E.isImportEqualsDeclaration(o)&&E.isExternalModuleReference(o.moduleReference)&&E.isStringLiteralLike(o.moduleReference.expression))n.push({text:o.moduleReference.expression.text,runtime:!0});else if(E.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&E.isStringLiteralLike(o.moduleSpecifier))n.push({text:o.moduleSpecifier.text,runtime:o.isTypeOnly!==!0});else if(E.isCallExpression(o)){let r=Nt(o),s=r?.specifierArg;r!==null&&s!==void 0&&E.isStringLiteralLike(s)&&n.push({text:s.text,runtime:!0})}E.forEachChild(o,t)};return t(e),n}function Iu(e,n){let t=n===E.ScriptKind.TSX?"__scriptkind_probe.tsx":n===E.ScriptKind.TS?"__scriptkind_probe.ts":"__scriptkind_probe.js",o=E.createSourceFile(t,e,E.ScriptTarget.ES2020,!0,n),r={allowJs:!0,noLib:!0,noResolve:!0,noEmit:!0},s={getSourceFile:a=>a===t?o:void 0,getDefaultLibFileName:()=>"lib.d.ts",writeFile:()=>{},getCurrentDirectory:()=>"",getCanonicalFileName:a=>a,useCaseSensitiveFileNames:()=>!0,getNewLine:()=>`
+`,fileExists:a=>a===t,readFile:a=>a===t?e:void 0};return E.createProgram({rootNames:[t],options:r,host:s}).getSyntacticDiagnostics(o).length}function Er(e){return e.endsWith(".js")||e.endsWith(".jsx")}function Fi(e){let n=0,t=o=>{(E.isCallExpression(o)||E.isNewExpression(o)||E.isTaggedTemplateExpression(o))&&(n+=1),E.forEachChild(o,t)};return t(e),n}function Ki(e,n){let t=Li(E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0));if(!Er(e)||!n.includes("<")||!n.includes("require"))return t;let o=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX),r=new Set(t.map(s=>`${s.runtime?"R":"T"}:${s.text}`));for(let s of Li(o)){let a=`${s.runtime?"R":"T"}:${s.text}`;r.has(a)||(r.add(a),t.push(s))}return t}function ji(e,n,t,o,r){if(!n.includes("require")&&!n.includes("import("))return[];let s=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0),a=Un(s,e,r),l=[],i=new Set;return Ui(s,d=>{for(let u of uo(d,a,t,Me,o))i.has(u)||(i.add(u),l.push(u))}),l}function Ui(e,n){let t=o=>{if(E.isCallExpression(o)){let r=Nt(o),s=r?.specifierArg;r!==null&&s!==void 0&&!E.isStringLiteralLike(s)&&n(s)}E.forEachChild(o,t)};t(e)}function Au(e){let n=[];for(let t of e){let o=Un(t.sf,t.real);Ui(t.sf,r=>{let s=_t(r,o);s!==null&&n.push({definingModuleReal:t.real,fnName:s.fnName,paramIndex:s.paramIndex})})}return n}var Nu=4,yr=po,xr=new Set(["eval","Function","createRequire"]),Ru=new Set(["require","eval","Function","createRequire"]),go=new Set(["module","Module","require","process","global","globalThis"]),yo=new Set(["_load","require","createRequire","eval","getBuiltinModule","dlopen","binding","_linkedBinding","_compile"]);function Pu(e){return e===E.SyntaxKind.LessThanToken||e===E.SyntaxKind.GreaterThanToken||e===E.SyntaxKind.LessThanEqualsToken||e===E.SyntaxKind.GreaterThanEqualsToken||e===E.SyntaxKind.EqualsEqualsToken||e===E.SyntaxKind.EqualsEqualsEqualsToken||e===E.SyntaxKind.ExclamationEqualsToken||e===E.SyntaxKind.ExclamationEqualsEqualsToken||e===E.SyntaxKind.InstanceOfKeyword||e===E.SyntaxKind.InKeyword}function $u(e){let n=e.parent;return(E.isParameter(n)||E.isVariableDeclaration(n)||E.isBindingElement(n)||E.isFunctionDeclaration(n)||E.isFunctionExpression(n)||E.isClassDeclaration(n)||E.isClassExpression(n)||E.isPropertyAssignment(n)||E.isPropertyDeclaration(n)||E.isMethodDeclaration(n))&&n.name===e?!0:E.isPropertyAccessExpression(n)&&n.name===e}function Cu(e,n){return E.isCallExpression(n)&&n.expression===e||(E.isPropertyAccessExpression(n)||E.isElementAccessExpression(n))&&n.expression===e||E.isTypeOfExpression(n)||E.isVoidExpression(n)||E.isDeleteExpression(n)||E.isPrefixUnaryExpression(n)||E.isPostfixUnaryExpression(n)?!0:E.isBinaryExpression(n)&&Pu(n.operatorToken.kind)}function zi(e){let n=e,t=e.parent;for(;;)if(E.isParenthesizedExpression(t))n=t,t=t.parent;else if(E.isBinaryExpression(t)&&t.operatorToken.kind===E.SyntaxKind.CommaToken&&t.right===n)n=t,t=t.parent;else break;return!Cu(n,t)}function Ou(e){return $u(e)?!1:zi(e)}function qi(e){let n=kn(e);if(n!==null&&yo.has(n.name))return!0;if(E.isElementAccessExpression(e)&&!E.isStringLiteralLike(e.argumentExpression)){let t=Ne(e.expression);if(E.isIdentifier(t)&&go.has(t.text))return!0}return!1}function It(e){let n=kn(e);if(n===null||n.name!=="constructor")return!1;let t=kn(n.receiver);return t!==null&&t.name==="constructor"}function Wi(e){if(!E.isCallExpression(e))return!1;let n=Ne(e.expression);if(!E.isIdentifier(n)||n.text!=="require")return!1;let t=e.arguments[0];return t!==void 0&&E.isStringLiteralLike(t)&&t.text==="module"}var Mu={roots:new Map,nodes:new Set,saturated:!1};function Vi(e){return E.isSourceFile(e)||E.isFunctionDeclaration(e)||E.isFunctionExpression(e)||E.isArrowFunction(e)||E.isMethodDeclaration(e)||E.isConstructorDeclaration(e)||E.isGetAccessorDeclaration(e)||E.isSetAccessorDeclaration(e)||E.isClassStaticBlockDeclaration(e)||E.isModuleDeclaration(e)}function Gi(e,n){let t=e.parent;for(;t!==void 0;){if(Vi(t))return t;t=t.parent}return n}function Tu(e){let n=new Set;if(E.isFunctionLike(e))for(let o of e.parameters)for(let r of At(o.name))n.add(r);let t=[e];for(;t.length>0;){let o=t.pop();if(o===void 0)break;if(!(o!==e&&Vi(o))){if(E.isVariableDeclaration(o)&&E.isVariableDeclarationList(o.parent)&&!((o.parent.flags&E.NodeFlags.BlockScoped)!==0))for(let s of At(o.name))n.add(s);E.forEachChild(o,r=>{t.push(r)})}}return n}function Du(e,n,t){let o=Gi(e,n);if(E.isSourceFile(o))return n;let r=t.get(o);return r===void 0&&(r=Tu(o),t.set(o,r)),r.has(e.text)?o:n}function mo(e,n){let t=e.roots.get(n.text);if(t===void 0)return!1;let o=n;for(;;){if(t.has(o))return!0;let r=o.parent;if(r===void 0)return!E.isSourceFile(o);o=r}}var Lu=12,Fu=8;function ho(e,n){let t=Ne(e);for(;;){if(n.nodes.has(t))return!0;if(E.isIdentifier(t))return go.has(t.text)||mo(n,t);if(E.isCallExpression(t))return Wi(t);let o=kn(t);if(o!==null){if(o.name==="constructor")return!0;t=o.receiver;continue}if(E.isElementAccessExpression(t)){t=Ne(t.expression);continue}return!1}}function Hi(e){let n=kn(Ne(e.expression));if(n===null||n.name!=="get"||!E.isIdentifier(n.receiver)||n.receiver.text!=="Reflect")return null;let t=e.arguments[0];return t===void 0?null:{target:t,key:e.arguments[1]}}function ju(e,n){let t=Hi(e);if(t===null||!ho(t.target,n))return!1;let o=t.key;return o===void 0||!E.isStringLiteralLike(o)?!0:yo.has(o.text)}function br(e){if(!E.isFunctionExpression(e)&&!E.isFunctionDeclaration(e))return!1;let n=e.body;if(n===void 0)return!1;let t=!1,o=r=>{if(!(t||E.isFunctionExpression(r)||E.isFunctionDeclaration(r)||E.isClassLike(r))){if(E.isReturnStatement(r)&&r.expression!==void 0&&Ne(r.expression).kind===E.SyntaxKind.ThisKeyword){t=!0;return}E.forEachChild(r,o)}};return o(n),t}function At(e){if(E.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)E.isOmittedExpression(t)||n.push(...At(t.name));return n}function Xi(e){return e.parameters.map(n=>At(n.name))}function Bu(e){let n=new Map,t=new Set,o=(s,a)=>{let l={fn:a,slots:Xi(a)},i=n.get(s);i===void 0?n.set(s,[l]):i.push(l),br(a)&&t.add(s)},r=s=>{if(E.isFunctionDeclaration(s)&&s.name!==void 0)o(s.name.text,s);else if(E.isVariableDeclaration(s)&&E.isIdentifier(s.name)&&s.initializer!==void 0){let a=Ne(s.initializer);(E.isFunctionExpression(a)||E.isArrowFunction(a))&&o(s.name.text,a)}E.forEachChild(s,r)};return r(e),{params:n,thisReturning:t}}function Ku(e){let n=new Map,t=new Set,o={roots:n,nodes:t},r=Bu(e),s=new Map,a=new Set(r.thisReturning),l=!0;for(let i=0;l;i+=1){if(i>=Lu)return{roots:n,nodes:t,saturated:!0};l=!1;let d=(y,S)=>{S!==""&&!y.has(S)&&(y.add(S),l=!0)},u=(y,S)=>{if(y==="")return;let x=n.get(y);x===void 0&&(x=new Set,n.set(y,x)),x.has(S)||(x.add(S),l=!0)},p=y=>{t.has(y)||(t.add(y),l=!0)},f=(y,S)=>{let x=Ne(y.expression);if(E.isIdentifier(x)&&xr.has(x.text)||It(x)||E.isCallExpression(y)&&Wi(y)||br(x))return!0;let _=kn(x);if(_!==null&&(_.name==="call"||_.name==="apply"||_.name==="bind")){let w=_.receiver;if(br(w)||t.has(w)||E.isIdentifier(w)&&(mo(o,w)||a.has(w.text)))return!0}if(t.has(x)||(E.isCallExpression(x)||E.isNewExpression(x))&&f(x,S+1)||E.isIdentifier(x)&&(mo(o,x)||a.has(x.text)))return!0;if(E.isCallExpression(y)){let w=Hi(y);if(w!==null&&ho(w.target,o))return!0}return!1},m=(y,S)=>{if(S>=Fu)return!0;let x=Ne(y);if(t.has(x))return!0;if(E.isIdentifier(x))return go.has(x.text)||mo(o,x);if(E.isBinaryExpression(x)){let _=x.operatorToken.kind;return _===E.SyntaxKind.BarBarToken||_===E.SyntaxKind.AmpersandAmpersandToken||_===E.SyntaxKind.QuestionQuestionToken?m(x.left,S+1)||m(x.right,S+1):!1}return E.isConditionalExpression(x)?m(x.whenTrue,S+1)||m(x.whenFalse,S+1):E.isPropertyAccessExpression(x)||E.isElementAccessExpression(x)?ho(x,o):E.isCallExpression(x)||E.isNewExpression(x)?f(x,S+1):!1},g=(y,S)=>{if((E.isVariableDeclaration(y)||E.isParameter(y)||E.isBindingElement(y))&&y.initializer!==void 0){if(m(y.initializer,0)){let _=Gi(y,e);for(let w of At(y.name))u(w,_)}}else if(E.isBinaryExpression(y)&&y.operatorToken.kind===E.SyntaxKind.EqualsToken&&E.isIdentifier(y.left)&&m(y.right,0))u(y.left.text,Du(y.left,e,s));else if(E.isReturnStatement(y)&&y.expression!==void 0&&S!==void 0&&m(y.expression,0))d(a,S);else if(E.isCallExpression(y)||E.isNewExpression(y)){f(y,0)&&p(y);let _=Ne(y.expression),w=kn(_),I=w!==null&&w.name==="call",k=w!==null&&w.name==="apply",h=I||k?w.receiver:_,b=I?1:0,A=[];E.isFunctionExpression(h)||E.isArrowFunction(h)?A.push({fn:h,slots:Xi(h)}):E.isIdentifier(h)&&A.push(...r.params.get(h.text)??[]);let P=y.arguments??[];if(k){let v=P[1]===void 0?void 0:Ne(P[1]);for(let{fn:T,slots:N}of A)if(v!==void 0&&E.isArrayLiteralExpression(v))for(let j=0;j<v.elements.length;j+=1){let $=v.elements[j],D=N[j];if(!($===void 0||D===void 0)&&m($,0))for(let K of D)u(K,T)}else if(v!==void 0)for(let j of N)for(let $ of j)u($,T)}else for(let{fn:v,slots:T}of A)for(let N=b;N<P.length;N+=1){let j=P[N],$=T[N-b];if(!(j===void 0||$===void 0)&&m(j,0))for(let D of $)u(D,v)}}let x=S;if(E.isFunctionDeclaration(y))x=y.name?.text;else if(E.isFunctionExpression(y)||E.isArrowFunction(y)){let _=y.parent;x=E.isVariableDeclaration(_)&&E.isIdentifier(_.name)?_.name.text:void 0}E.forEachChild(y,_=>g(_,x))};g(e,void 0)}return{roots:n,nodes:t,saturated:!1}}function Uu(e){if(E.isIdentifier(e)&&xr.has(e.text)||It(e))return!0;let n=kn(e);if(n!==null&&(yo.has(n.name)||(n.name==="call"||n.name==="apply")&&(E.isIdentifier(n.receiver)&&xr.has(n.receiver.text)||It(n.receiver)||(E.isPropertyAccessExpression(n.receiver)||E.isElementAccessExpression(n.receiver))&&qi(n.receiver))))return!0;if(E.isElementAccessExpression(e)&&!E.isStringLiteralLike(e.argumentExpression)){let t=Ne(e.expression);if(E.isIdentifier(t)&&go.has(t.text))return!0}return!1}var zu=4;function Bi(e,n){for(let t of e){if(!E.isStringLiteralLike(t)||n>=zu)return!0;let o=E.createSourceFile("<eval>",`async function* __cupel_eval_probe__(){
 ${t.text}
-}`,E.ScriptTarget.Latest,!0),r=o.parseDiagnostics;if(r!==void 0&&r.length>0||Tu(o,n+1,!0))return!0}return!1}function Tu(e,n=0,t=!1){return mr(e,n,t).size>0}function mr(e,n=0,t=!1){let o=new Set,r=t?Iu:Ou(e);if(r.saturated)return o.add("saturated"),o;let s=l=>E.isElementAccessExpression(l)&&!E.isStringLiteralLike(l.argumentExpression)&&fo(_e(l.expression),r),a=l=>{if(t&&(E.isCallExpression(l)||E.isNewExpression(l)||E.isTaggedTemplateExpression(l))){o.add("eval-invocation");return}if(E.isCallExpression(l)){let i=At(l);if(i!==null){let d=i.specifierArg;if(d===void 0||!E.isStringLiteralLike(d)||t){o.add("non-literal-load");return}}else{let d=_e(l.expression);if(E.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if($i(l.arguments,n)){o.add("eval-code");return}}else if(Cu(d)){o.add("loader-callee");return}else if(s(d)){o.add("computed-loader");return}else if(Pu(l,r)){o.add("reflect-get");return}}}else if(E.isNewExpression(l)){let i=_e(l.expression);if(E.isIdentifier(i)&&i.text==="Function"){if($i(l.arguments??[],n)){o.add("function-ctor");return}}else if(vt(i)){o.add("ctor-chain");return}}else if(E.isIdentifier(l)&&bu.has(l.text)&&vu(l)){o.add("captured-loader");return}else if((E.isPropertyAccessExpression(l)||E.isElementAccessExpression(l))&&(Ti(l)||vt(l)||s(l))&&Mi(l)){o.add("captured-member");return}else if(E.isBindingElement(l)){let i=l.propertyName??l.name,d=E.isIdentifier(i)||E.isStringLiteralLike(i)?i.text:E.isComputedPropertyName(i)&&E.isStringLiteralLike(i.expression)?i.expression.text:void 0;if(d!==void 0&&mo.has(d)){o.add("destructured-member");return}}E.forEachChild(l,a)};return a(e),o}function Ki(e,n,t){let o=new Set(mr(t));if(gr(e)&&n.includes("<")&&n.includes("require")){let r=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX);for(let s of mr(r))o.add(s)}return o}function Du(e,n,t){if(hr(e))return!0;let o=t.endsWith(Me.sep)?t:t+Me.sep,r=e.split("/"),s=n;for(;;){let a=Me.join(s,"node_modules",...r),l;try{l=Kn(Me.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(o))return!1;let d=Oe(l);if(d===null)return!1;let u;try{u=JSON.parse(d).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(ui(a))return!1;if(s===t)break;let i=Me.dirname(s);if(i===s||i!==t&&!i.startsWith(o))break;s=i}return!0}function Lu(e,n){let t=n.endsWith(Me.sep)?n:n+Me.sep,o=Me.dirname(e);for(;;){let r=Me.join(o,"package.json"),s;try{s=Kn(r)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let l=Oe(s);if(l!==null)try{let i=JSON.parse(l).name;if(typeof i=="string"&&i.length>0)return i}catch{return null}}if(o===n)break;let a=Me.dirname(o);if(a===o||a!==n&&!a.startsWith(t))break;o=a}return null}function Fu(e,n,t,o,r){let s=[],a=[],l=new Set,i={},d=[],u=[],p=new Set,f=new Set,m=[],g=!1,y=(x,I)=>{let w;try{w=Kn(I)}catch{return!1}let A=Le(e,w);if(A===null)return r.push({code:"out-of-root",path:w,detail:"dependency module resolved outside the app root; not followed"}),!1;let k=!t.has(w)&&!f.has(w);return k&&f.size>=ur?(g=!0,!1):(a.push({from:x,to:{module:A}}),k?(f.add(w),s.push(A),!0):!1)},b=(x,I)=>{if(l.add(I),p.has(I))return;p.add(I);let w=Ge(I,x,Ce,n),A=w!==null?[w]:tt(I,x,Ce,n);A.length>=2&&d.push({path:Le(e,x)??x,specifier:I,candidates:A.map(h=>Le(e,h)??h)});let k=!1;for(let h of A)if(!Be(h)&&(k=!0,y({surface:I},h))){m.push(h);try{let S=Le(e,Kn(h)),_=Lu(h,e);S!==null&&_!==null&&(i[S]=_)}catch{}}k||Du(I,Me.dirname(x),e)||r.push({code:"unresolved-specifier",path:I,reason:kt(I,x,Ce,n),detail:`dependency "${I}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let x of o)b(x.containingFile,x.packageName);for(;m.length>0&&f.size<ur;){let x=m.pop();if(x===void 0)break;let I=Le(e,x);if(I===null)continue;let w=nt(x,In);if(w.kind==="too-large"){r.push({code:"limit-exceeded",path:I,detail:`dependency module over the ${String(In/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(w.kind==="not-regular"){r.push({code:"parse-error",path:I,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let A=E.createSourceFile(x,w.text,E.ScriptTarget.ES2020,!0),k=A.parseDiagnostics;if(k!==void 0&&k.length>0){r.push({code:"dependency-body",path:I,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let h=Ki(x,w.text,A);if(h.size>0){r.push({code:"dependency-body",path:I,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...h].sort()});continue}r.push({code:"dependency-body",path:I,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:I});for(let S of Oi(x,w.text))if(S.runtime)if(we(S.text)==="package-root"){let _=qe(S.text);a.push({from:{module:I},to:{surface:_}}),b(x,_)}else{if(hr(qe(S.text)))continue;let _=Ge(S.text,x,Ce,n),P=_!==null?[_]:tt(S.text,x,Ce,n);if(P.length===0){if(we(S.text)==="package-subpath"){let v=kt(S.text,x,Ce,n);if(v==="no-candidate"||v==="not-installed"&&hi(x,qe(S.text))){u.push({path:I,specifier:S.text,why:v});continue}r.push({code:"unresolved-specifier",path:I,reason:v,detail:`runtime package-subpath import "${S.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}P.length>=2&&d.push({path:I,specifier:S.text,candidates:P.map(v=>Le(e,v)??v)});for(let v of P){if(Be(v)){let T=Le(e,v);r.push({code:T===null?"out-of-root":"declaration-shadow",path:I,detail:T===null?`runtime import "${S.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${S.text}" resolved to the declaration file "${T}" with no co-located runtime module; its code was not analyzed`});continue}y({module:I},v)&&m.push(v)}}}return(g||m.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(ur)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:a,surfacePackages:[...l],entryRealNames:i,conditionUnions:d,provenAbsent:u}}function Ui(e,n,t=!1){let o=Kn(e),r=[],s=[],a=E.createCompilerHost(Ce,!0),l=t?gi(o,Ce,a):()=>null,i=new Set,d=new Set,u=n.map(N=>Me.join(o,N)),p=[],f=new Map,m=new Map,g=new Map,y=new Map,b=new Set,x=(N,j,O)=>{let F=`${String(N.length)}:${N}${j}`;b.has(F)||(b.add(F),r.push({code:"unresolved-specifier",path:N,detail:j,reason:O}))},I=()=>null,w=0,A=(N,j)=>{let O=m.get(N);return O===void 0&&(O=E.createSourceFile(N,j,E.ScriptTarget.ES2020,!0),m.set(N,O)),{real:N,sf:O}};for(;d.size<co;){let N=u.pop();if(N===void 0){if(w>=Su)break;w+=1;let K=[];for(let[D,C]of f)C.includes("readdir")&&(C.includes("require")||C.includes("import("))&&K.push(A(D,C));let te=xu(K);if(te.length===0)break;let U=[];for(let[D,C]of f)U.push(A(D,C));I=_i(U,te,Ce,a,g);let X=!1;for(let D of K){let C=f.get(D.real);if(C!==void 0)for(let H of Pi(D.real,C,o,a,I))d.has(H)||(u.push(H),X=!0)}if(!X)break;continue}let j;try{j=Kn(N)}catch{continue}if(d.has(j))continue;if(d.add(j),Le(o,j)===null){r.push({code:"out-of-root",path:N,detail:"resolved outside app root"});continue}let O=nt(j,In);if(O.kind==="too-large"){r.push({code:"limit-exceeded",path:j,detail:`file is ${String(Math.round(O.bytes/1048576))}MiB, over the ${String(In/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if(O.kind==="not-regular"){r.push({code:"parse-error",path:j,detail:"unreadable or not a regular file"});continue}let F=O.text;i.add(j),f.set(j,F);for(let K of Oi(j,F)){let te=K.runtime?l(K.text,j):null;if(te===null&&we(K.text)==="package-root"){K.runtime&&p.push({containingFile:j,packageName:qe(K.text)});continue}let U=te??Ge(K.text,j,Ce,a),X=U!==null?[U]:K.runtime&&te===null?tt(K.text,j,Ce,a):[];if(X.length===0){if(K.runtime){let D=we(K.text);if(!(D==="package-subpath"&&hr(qe(K.text)))){if(D==="package-subpath")x(j,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,kt(K.text,j,Ce,a));else if(D==="relative"){let C=pi(K.text,j,o,y);C.kind==="unanalyzable"&&x(j,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${C.reason}; a bundler/loader may load a module the analyzer never saw`,C.why)}}}continue}X.length>=2&&s.push({path:Le(o,j)??j,specifier:K.text,candidates:X.map(D=>Le(o,D)??D)});for(let D of X){if(Le(o,D)===null){r.push({code:"out-of-root",path:D,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&Be(D)){r.push({code:"declaration-shadow",path:D,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!ro(D)){r.push({code:"unanalyzable-module",path:D,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}u.push(D)}}for(let K of Pi(j,F,o,a,I))d.has(K)||u.push(K)}d.size>=co&&u.length>0&&r.push({code:"limit-exceeded",path:o,detail:`reachable file set exceeds ${String(co)}; analysis truncated (${String(u.length)}+ files not analyzed)`});let k=Fu(o,a,i,p,r),h=E.createProgram({rootNames:[...i],options:Ce,host:a}),S=new Set,_=new Map;for(let N of h.getSourceFiles()){if(N.isDeclarationFile||h.isSourceFileDefaultLibrary(N)||Le(o,N.fileName)===null||!gr(N.fileName))continue;let j=h.getSyntacticDiagnostics(N).length>0;if(!j&&!N.text.includes("<")||yu(N.text,E.ScriptKind.TSX)!==0)continue;let O=E.createSourceFile(N.fileName,N.text,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX);(j||Ri(O)>Ri(N))&&(S.add(N.fileName),_.set(N.fileName,N.text))}let P=h;if(S.size>0){let N=a.getSourceFile.bind(a);a.getSourceFile=(j,O,F,K)=>{let te=_.get(j);return te!==void 0?E.createSourceFile(j,te,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX):N(j,O,F,K)},P=E.createProgram({rootNames:[...i],options:Ce,host:a,oldProgram:h})}let v=P.getTypeChecker(),T=[];for(let N of P.getSourceFiles()){if(N.isDeclarationFile||P.isSourceFileDefaultLibrary(N)||Le(o,N.fileName)===null)continue;T.push(N);let j=P.getSyntacticDiagnostics(N);if(j.length>0){let K=j[0],te=K!==void 0?E.flattenDiagnosticMessageText(K.messageText," "):"syntax error";r.push({code:"parse-error",path:N.fileName,detail:`${String(j.length)} syntax error(s): ${te}`})}let O=Le(o,N.fileName),F=O===null?null:Ki(N.fileName,N.text,N);O!==null&&F!==null&&F.size>0&&r.push({code:"loader-escape",path:O,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...F].sort()})}return{program:P,checker:v,host:a,options:Ce,appRoot:o,sourceFiles:T,diagnostics:r,depReach:k,conditionUnions:[...s,...k.conditionUnions],provenAbsent:k.provenAbsent,resolveParamDirs:I,toRel:N=>Le(o,N)}}import{opendirSync as ju,statSync as Bu}from"node:fs";import yr from"node:path";var Ku=8192,Uu=2e4,zu=new Set(["node_modules"]),zi=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),Wu=16;function ho(e,n,t,o,r={}){let s=r.maxEntries??Uu,a=r.prune,l=[],i=!1,d=0,u=[{dir:yr.join(e,n),rel:n,depth:0}];for(;u.length>0;){let p=u.pop();if(p===void 0)break;if(p.depth>Wu){i=!0;continue}let f;try{f=ju(p.dir)}catch{i=!0;continue}try{let m=0;for(;;){let g=f.readSync();if(g===null)break;if(m+=1,d+=1,m>Ku||d>s){i=!0;break}let y=p.rel+g.name;if(g.isSymbolicLink()){let b;try{b=Bu(yr.join(p.dir,g.name)).isDirectory()}catch{i=!0;continue}if(b){i=!0;continue}}else if(g.isDirectory()){if(zu.has(g.name)||g.name.startsWith(".")||a?.has(g.name)===!0){i=!0;continue}u.push({dir:yr.join(p.dir,g.name),rel:`${y}/`,depth:p.depth+1});continue}else if(!g.isFile())continue;if(t(y)){if(l.length>=o){i=!0;break}l.push(y)}}}finally{try{f.closeSync()}catch{}}}return{matches:l,truncated:i}}var Vu=64;function Wi(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let o=n.slice(0,t),r=n.slice(t+1);if(o.startsWith("./")&&(o=o.slice(2)),o.startsWith("/")||r.includes("/")||o.split("/").includes("..")||o.includes("\\")||n.includes("\0"))return null;let s=o.slice(0,o.lastIndexOf("/")+1);return ho(e,s,a=>a.length>=o.length+r.length&&a.startsWith(o)&&a.endsWith(r),Vu)}import{existsSync as qu}from"node:fs";import Gu from"node:path";var Hu=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],Xu=["dependencies","devDependencies"];function Yu(e,n){for(let t of Xu){let o=e[t];if(!(typeof o!="object"||o===null||Array.isArray(o))&&Object.hasOwn(o,n))return!0}return!1}function xr(e,n){if(n===null)return null;for(let t of Hu)if(Yu(n,t.dependency)){for(let o of t.configFiles)if(qu(Gu.join(e,o)))return{name:t.name,configFile:o,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function Sr(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var Ju=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],Zu=256,Qu=12e4;function br(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let o=ho(e,"",r=>{let s=r.split("/");for(let a=0;a<s.length-1;a+=1){let l=s[a];if(l!==void 0&&t.has(l))return Ju.some(i=>r.endsWith(i))}return!1},Zu,{maxEntries:Qu,prune:zi});return{roots:o.matches,truncated:o.truncated}}function He(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let o of n){let r=o.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:o}return t}function ef(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function nf(e){let n=!1;for(let t=0;t<e.length;t+=1){let o=e.charAt(t),r=o.codePointAt(0)??0;if(r<32||r===127||r>=128&&r<=159)return null;if(o==="\\"){n=!0;let s=e.charAt(t+1);if(!(s>="a"&&s<="z"||s>="A"&&s<="Z"||s>="0"&&s<="9"||s==="."||s==="_"||s==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(o))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function tf(e){let n=[],t="";for(let o of e){if(o===" "||o==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=o}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var of=/^[A-Za-z_][A-Za-z0-9_]*=/u;function rf(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var sf=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),af=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),lf=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function qi(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function Vi(e){if(qi(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return lf.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:sf.has(t)||n!==-1&&af.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var df=[".js",".cjs",".mjs",".ts",".mts",".cts"];function cf(e){return df.some(n=>e.endsWith(n))}var uf=new Set(["npm","yarn","pnpm"]);function ff(e){let n=e[0];return n===void 0||!uf.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Er(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!ef(n))return kr(n);let t=nf(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let o=kr(t.windows),r=kr(t.posixShell);if(o.kind==="file"){let s=r.kind==="file"?r.specifier:void 0;return s===void 0||s===o.specifier?{kind:"file",specifier:o.specifier}:{kind:"file",specifier:o.specifier,alt:s}}return r.kind==="file"?{kind:"file",specifier:r.specifier}:o}function kr(e){let n=tf(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let s=n[t];if(s===void 0||!of.test(s))break;if(qi(s))return{kind:"unparsed",reason:`environment \`${He(s)}\` preloads another module; the launch surface is more than one file`};let a=s.indexOf("=");if(s.slice(0,a)==="NODE_OPTIONS")for(let l of s.slice(a+1).split(/\s+/u)){if(l===""||!l.startsWith("-"))continue;let i=Vi(l);if(i!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${He(i.token)}\` ${i.why}`}}}let o=n[t];if(o===void 0)return{kind:"unparsed",reason:"no program in the command"};if(ff(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!rf(o))return{kind:"unparsed",reason:`runs \`${He(o)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let s=n[t];if(s===void 0||!s.startsWith("-"))break;let a=Vi(s);if(a!==null)return{kind:"unparsed",reason:`node flag \`${He(a.token)}\` ${a.why}`}}let r=n[t];return r===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:cf(r)?{kind:"file",specifier:r}:{kind:"unparsed",reason:`\`${He(r)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function pf(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var mf=64;function wr(e){let n=e.split(`
-`),t=n.length>64,o=[],r=0;for(let s of n.slice(0,64)){let a=s.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let i=a.slice(l+1).trim();if(i.length===0)continue;let d=a.slice(0,l);if(d.length>mf||!pf(d)){r+=1;continue}o.push({name:d,command:i})}return o.sort((s,a)=>s.name===a.name?0:s.name==="web"?-1:a.name==="web"?1:0),{entries:o,truncated:t,unnamedLines:r}}import{realpathSync as Gi}from"node:fs";import Ue from"node:path";import c from"typescript";var Hi=3;function he(e,n,t){if(e===void 0)return;let o=e[n]??={fired:0,refused:{}};t===null?o.fired+=1:o.refused[t]=(o.refused[t]??0)+1}function Nn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var yo=16,_r=256,vr=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let o=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(o)||(this.moduleFor(n),this.fns.set(o,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let o=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(o)||(this.moduleFor(n),this.classNodes.set(o,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(o,[])),r}methodFor(n,t,o,r){let s=`${n}#${t}.${o}`,a=`pkg:${n}#${t}.${o}`;if(!this.fns.has(s)){let l=this.classFor(n,t);this.fns.set(s,{id:a,moduleId:`pkg:${n}`,name:o,kind:r,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function oa(e,n){let t="node_modules/",o=e.lastIndexOf(t);if(o===-1)return n;let s=e.slice(o+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function Xi(e,n,t){let o=Ue.dirname(e),r=Ue.dirname(n),s=[];for(;;){let l=t.get(o);if(l!==void 0){for(let d of s)t.set(d,l);return l}s.push(o);let i=Oe(Ue.join(o,"package.json"));if(i!==null)try{let d=JSON.parse(i),u={name:d.name??"app",version:d.version??"0.0.0",dir:o};for(let p of s)t.set(p,u);return u}catch{}if(o===r||o===Ue.dirname(o))break;o=Ue.dirname(o)}let a={name:"app",version:"0.0.0",dir:null};for(let l of s)t.set(l,a);return a}function Ir(e){return c.isParenthesizedExpression(e)?Ir(e.expression):c.isStringLiteralLike(e)?e.text:c.isTemplateExpression(e)?e.head.text:c.isBinaryExpression(e)&&e.operatorToken.kind===c.SyntaxKind.PlusToken?Ir(e.left):null}function hf(e){if(!c.isCallExpression(e))return!1;let n=e.expression,t=c.isPropertyAccessExpression(n)?n.name.text:c.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let o=e.arguments[0];return o!==void 0&&c.isIdentifier(o)&&(o.text==="__dirname"||o.text==="__filename")}function ra(e){let n=Ir(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":hf(e)?"relative-bounded":"unknown"}function gf(e){let n=[],t=o=>{if(c.isImportDeclaration(o)&&c.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isImportEqualsDeclaration(o)&&c.isExternalModuleReference(o.moduleReference)&&c.isStringLiteralLike(o.moduleReference.expression))n.push({specifier:o.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&c.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isCallExpression(o)){let r=At(o);if(r!==null){let s=r.specifierArg,a=s!==void 0&&c.isStringLiteralLike(s);n.push({specifier:a?s.text:void 0,specifierIsLiteral:a,dynamic:!0,...s!==void 0&&!a?{computedArg:s,loadPos:o.getStart(e)}:{}})}}c.forEachChild(o,t)};return t(e),n}function yf(e,n,t){let o=new Map,r=Xi(Ue.join(e.appRoot,"package.json"),e.appRoot,o),s=[],a=[],l=[],i=new Map,d=new Set,u=[],p=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&p.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let g=Xi(f.fileName,e.appRoot,o),y=oa(m,r.name),b=m.includes("node_modules/");s.push({id:m,packageName:b&&g.name!==r.name?g.name:y,versionRange:g.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),g.dir===r.dir&&d.add(m);let x=0,I=null;for(let w of gf(f)){let A=`${m}#import${String(x)}`;x+=1;let k=null,h=[];if(w.specifier!==void 0)if(we(w.specifier)==="package-root")k=t.moduleFor(qe(w.specifier));else{let S=Ge(w.specifier,f.fileName,e.options,e.host),_=S!==null?e.toRel(S):null;if(_!==null)k=_;else if(w.specifier!==void 0){let[P,...v]=tt(w.specifier,f.fileName,e.options,e.host).map(T=>e.toRel(T)).filter(T=>T!==null&&p.has(T));P!==void 0&&v.length>=1&&(k=P,h=v.map(T=>T))}}a.push({id:A,moduleId:m,specifier:w.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:w.dynamic,specifierIsLiteral:w.specifierIsLiteral,...k!==null?{resolvedModuleId:k}:{}}),k!==null&&l.push({importId:A,resolvedModuleId:k});for(let S of h)l.push({importId:A,resolvedModuleId:S});if(w.computedArg!==void 0&&w.loadPos!==void 0&&u.push({importId:String(A),path:m,pos:w.loadPos,shape:ra(w.computedArg),text:w.computedArg.getText(f).slice(0,160)}),w.computedArg!==void 0&&w.loadPos!==void 0){I??=Bn(f,f.fileName,e.resolveParamDirs);let S=[];for(let _ of ao(w.computedArg,I,e.appRoot,e.options,e.host)){let P=e.toRel(_);if(P===null||!p.has(P))continue;let v=P,T=`${m}#import${String(x)}`;x+=1,a.push({id:T,moduleId:m,specifier:P,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:v}),l.push({importId:T,resolvedModuleId:v}),S.push(P)}if(S.length>0){let _=wt(w.computedArg,I)!==null||io(w.computedArg),P=i.get(m)??[];P.push({pos:w.loadPos,candidateRels:S,seedable:_}),i.set(m,P)}}}}return{modules:s,imports:a,importEdges:l,computedLoads:i,appOwnedPaths:d,loadSites:u}}function xf(e){let n=Oe(e);if(n===null)return null;let t=c.createSourceFile(e,n,c.ScriptTarget.Latest,!0),o=r=>t.statements.some(s=>c.isFunctionDeclaration(s)?s.name?.text===r:c.isVariableStatement(s)?s.declarationList.declarations.some(a=>c.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&(c.isFunctionExpression(a.initializer)||c.isArrowFunction(a.initializer))):!1);for(let r of t.statements){if(c.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(a=>a.kind===c.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!c.isExpressionStatement(r)||!c.isBinaryExpression(r.expression))continue;let s=r.expression;if(s.operatorToken.kind===c.SyntaxKind.EqualsToken&&Sf(s.left)){if(c.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(c.isIdentifier(s.right)&&o(s.right.text))return s.right.text}}return null}function Sf(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function bf(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let o=d=>"surface"in d?n.moduleFor(d.surface):d.module,r=[],s=new Set;for(let d of e.modules)t.has(d)||s.has(d)||(s.add(d),r.push({id:d,packageName:e.entryRealNames[d]??oa(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],i=0;for(let d of e.edges){let u=o(d.from),p=o(d.to),f=`${String(u)}#depreach${String(i)}`;i+=1,a.push({id:f,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),l.push({importId:f,resolvedModuleId:p})}return{modules:r,imports:a,importEdges:l}}function Yi(e,n,t){let o=e.expression;if(c.isIdentifier(o)&&!t.has(o.text)){let r=n.get(o.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(c.isPropertyAccessExpression(o)&&c.isIdentifier(o.expression)&&!t.has(o.expression.text)){let r=n.get(o.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:o.name.text}}return null}function Un(e){return c.canHaveModifiers(e)&&(c.getModifiers(e)?.some(n=>n.kind===c.SyntaxKind.ExportKeyword)??!1)}function kf(e){let n=new Set,t;for(let o of e.statements){if(c.isExpressionStatement(o)&&c.isBinaryExpression(o.expression)){let r=o.expression;if(r.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(r.left)&&c.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(c.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(c.isObjectLiteralExpression(r.right))for(let s of r.right.properties)c.isShorthandPropertyAssignment(s)?n.add(s.name.text):c.isPropertyAssignment(s)&&c.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(c.isFunctionDeclaration(o)&&o.name!==void 0&&Un(o))n.add(o.name.text);else if(c.isVariableStatement(o)&&Un(o))for(let r of o.declarationList.declarations)c.isIdentifier(r.name)&&n.add(r.name.text);else if(c.isExportDeclaration(o)&&o.exportClause&&c.isNamedExports(o.exportClause))for(let r of o.exportClause.elements)n.add((r.propertyName??r.name).text);else c.isExportAssignment(o)&&c.isIdentifier(o.expression)&&(n.add(o.expression.text),t=o.expression.text)}return{reachableLocals:n,defaultTarget:t}}function Ef(e){for(let n of e.statements){if(c.isFunctionDeclaration(n)&&n.name!==void 0&&Un(n)&&c.getModifiers(n)?.some(t=>t.kind===c.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(c.isExportAssignment(n)&&!n.isExportEquals&&c.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===c.SyntaxKind.EqualsToken&&je(t.left)&&c.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function un(e){if(c.isCallExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&c.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function je(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function tn(e){if(je(e))return!0;if(!c.isPropertyAccessExpression(e)&&!c.isElementAccessExpression(e))return!1;let n=e.expression;return c.isIdentifier(n)&&n.text==="exports"?!0:je(n)}function st(e){return c.isPropertyAccessExpression(e.expression)&&c.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function sa(e){let n=!1,t=o=>{if(!n){if(c.isCallExpression(o)){let r=un(o);if(r!==void 0&&we(r)!=="package-root"){n=!0;return}}c.forEachChild(o,t)}};return t(e),n}function ia(e){let n=new Set,t=r=>r!==void 0&&sa(r),o=r=>{c.isVariableDeclaration(r)&&t(r.initializer)&&Et(r.name,n),c.isBinaryExpression(r)&&r.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),c.forEachChild(r,o)};return o(e),n}function aa(e,n){for(let t of e.properties)c.isShorthandPropertyAssignment(t)?n.add(t.name.text):c.isPropertyAssignment(t)&&c.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function wf(e){let n=new Set;for(let l of e.statements)if(c.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isVariableStatement(l))for(let i of l.declarationList.declarations)c.isIdentifier(i.name)&&i.initializer!==void 0&&(c.isFunctionExpression(i.initializer)||c.isArrowFunction(i.initializer)||c.isObjectLiteralExpression(i.initializer))&&n.add(i.name.text);let t=l=>c.isFunctionExpression(l)||c.isArrowFunction(l)||c.isObjectLiteralExpression(l)||c.isIdentifier(l)&&n.has(l.text),o=new Set,r=l=>{c.isIdentifier(l)?o.add(l.text):c.isObjectLiteralExpression(l)&&aa(l,o)},s=!1,a=l=>{if(!s){if(c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken)if(je(l.left)){r(l.right);let i=l.right;(c.isObjectLiteralExpression(i)?i.properties.every(u=>c.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||c.isPropertyAssignment(u)&&t(u.initializer)):t(i))||(s=!0)}else tn(l.left)&&(t(l.right)||(s=!0));else(c.isCallExpression(l)&&st(l)&&l.arguments[0]!==void 0&&zn(l.arguments[0])||c.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(s=!0);s||c.forEachChild(l,a)}};if(a(e),!s&&o.size>0){for(let l of ua(e))if(o.has(l)){s=!0;break}}return s}function zn(e){return tn(e)||c.isIdentifier(e)&&e.text==="exports"}function la(e){if(!c.isPropertyAccessExpression(e.expression)||!c.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Nr(e){return la(e)&&e.arguments[0]!==void 0&&zn(e.arguments[0])}function vf(e){return la(e)&&e.arguments[0]!==void 0&&c.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function If(e){for(let n of e.declarations??[])if(c.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(c.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Af(e,n,t,o,r){let s=(e.declarations??[]).filter(l=>!c.isSourceFile(l)&&!c.isModuleDeclaration(l));for(let l of s){let i=l.getSourceFile(),d=n.toRel(i.fileName);if(d===null||r.has(d))continue;let u=t.get(`${d}::${String(l.getStart(i,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of s){let i=n.toRel(l.getSourceFile().fileName);if(i===null||r.has(i))continue;let d=o.get(`${i}::${a}`);if(d!==void 0)return d}}function xo(e){return c.isPropertyAccessExpression(e)?e.name.text:c.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Rr=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Pr(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?xo(e):void 0;return n!==void 0&&n!=="__proto__"&&Rr.test(n)?n:void 0}function _f(e){return e!=="__proto__"&&Rr.test(e)}function Ji(e){let n=_e(e);return c.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||je(n)}function Nf(e){if(!c.isArrayLiteralExpression(e)&&!c.isObjectLiteralExpression(e))return!1;let n=!1,t=o=>{n||(tn(o)?n=!0:c.forEachChild(o,t))};return t(e),n}function $r(e){let n=!1,t=new Map,o=r=>{if(!n){if(c.isBinaryExpression(r)&&r.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=c.SyntaxKind.LastAssignment){if(je(r.left)||c.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===c.SyntaxKind.EqualsToken&&Ji(r.right))n=!0;else if(Nf(r.left))n=!0;else if(tn(r.left)){let s=Pr(r.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(c.isCallExpression(r)&&st(r)&&r.arguments[0]!==void 0&&zn(r.arguments[0])||c.isCallExpression(r)&&Nr(r)||c.isCallExpression(r)&&vf(r)||c.isVariableDeclaration(r)&&r.initializer!==void 0&&Ji(r.initializer))&&(n=!0);n||c.forEachChild(r,o)}};return o(e),{surfaceEscapes:n,assignCount:t}}function Or(e){let n=[];for(let t of e.statements){if(!c.isExpressionStatement(t)||!c.isBinaryExpression(t.expression))continue;let o=t.expression;o.operatorToken.kind===c.SyntaxKind.EqualsToken&&(!tn(o.left)||je(o.left)||n.push({bin:o,name:Pr(o.left)}))}return n}function Rf(e){let{surfaceEscapes:n,assignCount:t}=$r(e);if(n)return[];let o=[];for(let{bin:r,name:s}of Or(e))s===void 0||(t.get(s)??0)!==1||(c.isFunctionExpression(r.right)||c.isArrowFunction(r.right))&&o.push({name:s,value:r.right});return o}function Pf(e,n){let{surfaceEscapes:t,assignCount:o}=$r(e);if(t)return[];let r=[];for(let{bin:s,name:a}of Or(e))a===void 0||(o.get(a)??0)!==1||c.isIdentifier(s.right)&&!n.has(s.right.text)&&r.push(s.right.text);return r}function $f(e,n){let{surfaceEscapes:t,assignCount:o}=$r(e);for(let{bin:r,name:s}of Or(e)){let a=r.right;if(!(c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)))continue;let i=c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)&&!n.has(a.text);if(!(!t&&s!==void 0&&(o.get(s)??0)===1&&i))return!0}return!1}function Of(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&c.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function Zi(e){let n=e.parent;return n===void 0?!1:c.isPropertyAccessExpression(n)?n.name===e:c.isQualifiedName(n)?n.right===e:c.isBindingElement(n)||c.isImportSpecifier(n)?n.propertyName===e:c.isExportSpecifier(n)?!0:c.isPropertyAssignment(n)||c.isPropertyDeclaration(n)||c.isPropertySignature(n)||c.isMethodDeclaration(n)||c.isMethodSignature(n)||c.isGetAccessorDeclaration(n)||c.isSetAccessorDeclaration(n)||c.isEnumMember(n)?n.name===e:!1}function Qi(e){for(let n=e.parent;n!==void 0;n=n.parent){if(c.isSourceFile(n))return!0;if(!c.isArrowFunction(n)&&(c.isFunctionLike(n)||c.isClassLike(n)))return!1}return!0}function Cf(e,n){let t=o=>{c.isIdentifier(o)&&(o.text==="exports"||o.text==="module")&&n.add(o),c.forEachChild(o,t)};t(e)}function Mf(e){let n=[],t=new Set;for(let s of e.statements){if(c.isExportDeclaration(s)||c.isExportAssignment(s)||c.isImportDeclaration(s)||c.isImportEqualsDeclaration(s)||Un(s))return null;if(!c.isExpressionStatement(s)||!c.isBinaryExpression(s.expression))continue;let a=s.expression;if(a.operatorToken.kind===c.SyntaxKind.EqualsToken){if(je(a.left))n.push({kind:"whole",value:a.right});else if(tn(a.left)){let l=Pr(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:Of(a.left)})}else continue;Cf(a.left,t)}}let o=!1,r=s=>{if(!o){if(c.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!Zi(s)){o=!0;return}if(s.kind===c.SyntaxKind.ThisKeyword&&Qi(s)){o=!0;return}if(c.isIdentifier(s)&&s.text==="arguments"&&!Zi(s)&&Qi(s)){o=!0;return}c.forEachChild(s,r)}};return r(e),o?null:n}function Ar(e){return c.isIdentifier(e)||c.isStringLiteralLike(e)?e.text:void 0}function ea(e,n,t){return c.isIdentifier(e)?n(e.text):t?.(e)}function Tf(e,n,t,o){let r=new Map,s=Mf(e);if(s===null||s.filter(m=>m.kind==="whole").length>1)return r;let a=s.findIndex(m=>m.kind==="whole"),l=(m,g)=>a>=0&&g>a&&m.kind==="member"&&m.root==="exports",i=s.some(l);if(i){let m=s[a];if(m===void 0||m.kind!=="whole"||!c.isObjectLiteralExpression(m.value))return r}let d=i?s.filter((m,g)=>!l(m,g)):s,u=new Map;for(let m of d)m.kind==="member"&&u.set(m.name,(u.get(m.name)??0)+1);let p=m=>n.has(m)?void 0:t(m),f=(m,g)=>{g===void 0?r.delete(m):r.set(m,g)};for(let m of d){if(m.kind==="member"){f(m.name,(u.get(m.name)??0)>1?void 0:ea(m.value,p,o));continue}r.clear();let g=m.value;if(c.isObjectLiteralExpression(g))for(let y of g.properties){if(c.isSpreadAssignment(y))return new Map;if(c.isShorthandPropertyAssignment(y)){f(y.name.text,p(y.name.text));continue}let b=Ar(y.name);if(b===void 0)return new Map;f(b,c.isPropertyAssignment(y)?ea(y.initializer,p,o):void 0)}}return r}function da(e,n,t,o){let r=new Map,s=l=>l!==void 0&&we(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(c.isVariableDeclaration(l)&&l.initializer!==void 0){let i=l.initializer;if(c.isIdentifier(l.name)&&!o.has(l.name.text)){let d=s(un(i));if(d!==void 0)r.set(l.name.text,{kind:"whole",target:d});else if((c.isPropertyAccessExpression(i)||c.isElementAccessExpression(i))&&c.isCallExpression(i.expression)){let u=s(un(i.expression)),p=xo(i);u!==void 0&&p!==void 0&&r.set(l.name.text,{kind:"member",target:u,member:p})}}else if(c.isObjectBindingPattern(l.name)){let d=s(un(i));if(d!==void 0){for(let u of l.name.elements)if(c.isIdentifier(u.name)&&!o.has(u.name.text)){let p=u.propertyName!==void 0&&c.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;r.set(u.name.text,{kind:"member",target:d,member:p})}}}}c.forEachChild(l,a)};return a(e),r}function Df(e,n,t,o){let r=a=>a!==void 0&&we(a)==="relative"?t.get(`${n}::${a}`):void 0,s=r(un(e));if(s!==void 0)return{kind:"whole",target:s};if(c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)){let a=xo(e);if(a===void 0)return;let l=r(un(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(c.isIdentifier(e.expression)){let i=o.get(e.expression.text);if(i?.kind==="whole")return{kind:"member",target:i.target,member:a}}return}if(c.isIdentifier(e))return o.get(e.text)}function ca(e,n,t,o,r){let s=[],a=!1,l=p=>{if(sa(p))return!0;let f=!1,m=g=>{f||(c.isIdentifier(g)&&r.has(g.text)?f=!0:c.forEachChild(g,m))};return m(p),f},i=(p,f)=>{let m=Df(p,n,t,o);m!==void 0?s.push({source:m,exportedName:f}):l(p)&&(a=!0)},d=p=>{if(c.isObjectLiteralExpression(p)){for(let f of p.properties)if(c.isSpreadAssignment(f))i(f.expression,"default");else if(c.isPropertyAssignment(f)){let m=c.isIdentifier(f.name)||c.isStringLiteralLike(f.name)?f.name.text:"default";i(f.initializer,m)}else if(c.isShorthandPropertyAssignment(f)){let m=o.get(f.name.text);m!==void 0&&s.push({source:m,exportedName:f.name.text})}return}i(p,"default")},u=p=>{if(c.isBinaryExpression(p)&&p.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=c.SyntaxKind.LastAssignment){if(je(p.left)){d(p.right);return}if(tn(p.left)){let f=c.isPropertyAccessExpression(p.left)?p.left.name.text:c.isElementAccessExpression(p.left)&&c.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";i(p.right,f);return}}else if(c.isExportAssignment(p)&&p.isExportEquals){i(p.expression,"default");return}else if(c.isCallExpression(p)&&st(p)&&p.arguments[0]!==void 0&&zn(p.arguments[0])){for(let f of p.arguments.slice(1))d(f);return}c.forEachChild(p,u)};return u(e),{sources:s,residual:a}}function ua(e){let n=new Set,t=r=>{let s=r;for(;c.isPropertyAccessExpression(s)||c.isElementAccessExpression(s);)s=s.expression;return c.isIdentifier(s)?s.text:void 0},o=r=>{let s=fa(r);if(s!==void 0){let a=t(s);a!==void 0&&n.add(a)}c.forEachChild(r,o)};return o(e),n}function fa(e){return c.isBinaryExpression(e)&&e.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=c.SyntaxKind.LastAssignment&&(c.isPropertyAccessExpression(e.left)||c.isElementAccessExpression(e.left))?e.left:void 0}function go(e){if(c.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)c.isBindingElement(t)&&n.push(...go(t.name));return n}function Fe(e){if(c.isIdentifier(e))return[e.text];if(c.isParenthesizedExpression(e)||c.isAsExpression(e)||c.isNonNullExpression(e)||c.isSatisfiesExpression(e)||c.isTypeAssertionExpression(e)||c.isAwaitExpression(e))return Fe(e.expression);if(c.isYieldExpression(e))return e.expression!==void 0?Fe(e.expression):[];if(c.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===c.SyntaxKind.BarBarToken||n===c.SyntaxKind.AmpersandAmpersandToken||n===c.SyntaxKind.QuestionQuestionToken?[...Fe(e.left),...Fe(e.right)]:n===c.SyntaxKind.CommaToken?Fe(e.right):[]}return c.isConditionalExpression(e)?[...Fe(e.whenTrue),...Fe(e.whenFalse)]:c.isArrayLiteralExpression(e)?e.elements.flatMap(n=>c.isSpreadElement(n)?Fe(n.expression):c.isOmittedExpression(n)?[]:Fe(n)):c.isObjectLiteralExpression(e)?e.properties.flatMap(n=>c.isShorthandPropertyAssignment(n)?[n.name.text]:c.isPropertyAssignment(n)?Fe(n.initializer):c.isSpreadAssignment(n)?Fe(n.expression):[]):[]}function pa(e,n){let t=[],o=(l,i)=>{for(let d of l)for(let u of i)d!==u&&t.push({a:d,b:u})},r=l=>c.isIdentifier(l)?[l.text]:c.isArrayLiteralExpression(l)?l.elements.flatMap(r):c.isObjectLiteralExpression(l)?l.properties.flatMap(i=>c.isShorthandPropertyAssignment(i)?[i.name.text]:c.isPropertyAssignment(i)?r(i.initializer):[]):[],s=l=>{c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken?o(r(l.left),Fe(l.right)):c.isVariableDeclaration(l)&&l.initializer!==void 0?o(go(l.name),Fe(l.initializer)):(c.isForOfStatement(l)||c.isForInStatement(l))&&c.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&o(go(l.initializer.declarations[0].name),Fe(l.expression)),c.forEachChild(l,s)};s(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:i,b:d}of t)a.has(i)&&!a.has(d)&&(a.add(d),l=!0),a.has(d)&&!a.has(i)&&(a.add(i),l=!0)}return a}function ma(e,n){let t=l=>{if(!c.isPropertyAccessExpression(l)&&!c.isElementAccessExpression(l))return;let i=l;for(;c.isPropertyAccessExpression(i)||c.isElementAccessExpression(i);)i=i.expression;return c.isIdentifier(i)?i.text:void 0},o=[],r=(l,i)=>{for(let u of Fe(i))o.push({name:l,root:u});let d=t(i);d!==void 0&&o.push({name:l,root:d})},s=l=>{c.isVariableDeclaration(l)&&c.isIdentifier(l.name)&&l.initializer!==void 0?r(l.name.text,l.initializer):c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(l.left)&&r(l.left.text,l.right),c.forEachChild(l,s)};s(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:i,root:d}of o){let u=a.get(d);u!==void 0&&!a.has(i)&&(a.set(i,u),l=!0)}}return a}function ha(e){return pa(e,ua(e))}function Lf(e,n){let t=i=>i>=c.SyntaxKind.FirstAssignment&&i<=c.SyntaxKind.LastAssignment,o=i=>{let d=i.parent;if(d===void 0||!c.isObjectLiteralExpression(d))return!1;let u=d.parent;return u!==void 0&&c.isBinaryExpression(u)&&u.operatorToken.kind===c.SyntaxKind.EqualsToken&&u.right===d&&tn(u.left)?!0:u!==void 0&&c.isCallExpression(u)&&st(u)&&u.arguments[0]!==void 0&&zn(u.arguments[0])&&u.arguments.indexOf(d)>0},r=(i,d)=>{if((c.isFunctionDeclaration(d)||c.isFunctionExpression(d))&&d.name===i||c.isVariableDeclaration(d)&&d.name===i||c.isParameter(d)&&d.name===i||c.isBindingElement(d)&&d.name===i||(c.isCallExpression(d)||c.isNewExpression(d))&&d.expression===i)return!0;if((c.isPropertyAccessExpression(d)||c.isElementAccessExpression(d))&&d.expression===i){let u=d;for(;u.parent!==void 0&&(c.isPropertyAccessExpression(u.parent)||c.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let p=u.parent;return!(p!==void 0&&c.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===u)}return c.isBinaryExpression(d)&&d.operatorToken.kind===c.SyntaxKind.EqualsToken&&d.right===i&&tn(d.left)?!0:c.isShorthandPropertyAssignment(d)&&d.name===i||c.isPropertyAssignment(d)&&d.initializer===i?o(d):!!(c.isExportAssignment(d)&&d.expression===i||c.isExportSpecifier(d))},s=(i,d)=>c.isPropertyAccessExpression(d)&&d.name===i||c.isPropertyAssignment(d)&&d.name===i||(c.isMethodDeclaration(d)||c.isGetAccessorDeclaration(d)||c.isSetAccessorDeclaration(d))&&d.name===i,a=!1,l=(i,d)=>{if(!a){if(c.isIdentifier(i)&&d!==void 0&&n.has(i.text)&&!s(i,d)&&!r(i,d)){a=!0;return}c.forEachChild(i,u=>l(u,i))}};return l(e,void 0),a}function Ff(e){let n=new Set;for(let i of e.statements)if(c.isFunctionDeclaration(i)&&i.name!==void 0)n.add(i.name.text);else if(c.isVariableStatement(i))for(let d of i.declarationList.declarations)c.isIdentifier(d.name)&&d.initializer!==void 0&&(c.isFunctionExpression(d.initializer)||c.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,o=i=>{c.isBinaryExpression(i)&&i.operatorToken.kind===c.SyntaxKind.EqualsToken?(je(i.left)&&(c.isIdentifier(i.right)?t.add(i.right.text):c.isObjectLiteralExpression(i.right)&&aa(i.right,t)),je(i.right)&&c.isIdentifier(i.left)&&t.add(i.left.text)):c.isVariableDeclaration(i)&&c.isIdentifier(i.name)&&i.initializer!==void 0&&je(i.initializer)&&t.add(i.name.text),c.forEachChild(i,o)};if(o(e),t.size>0){if(Lf(e,t))return!0;let i=ma(e,new Map([...t].map(u=>[u,u]))),d=ha(e);for(let u of i.keys())if(d.has(u))return!0}let r=i=>c.isIdentifier(i)&&n.has(i.text),s=i=>i.properties.every(d=>c.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||c.isPropertyAssignment(d)&&r(d.initializer)),a=!1,l=i=>{if(!a){if(c.isBinaryExpression(i)){let d=i.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=c.SyntaxKind.LastAssignment;d&&je(i.left)?i.operatorToken.kind===c.SyntaxKind.EqualsToken&&(r(i.right)||c.isObjectLiteralExpression(i.right)&&s(i.right))||(a=!0):d&&tn(i.left)&&(a=!0)}else c.isCallExpression(i)?(st(i)&&i.arguments[0]!==void 0&&zn(i.arguments[0])||Nr(i))&&(a=!0):(c.isExportAssignment(i)&&i.isExportEquals&&!c.isIdentifier(i.expression)||c.isExportDeclaration(i)&&i.moduleSpecifier!==void 0)&&(a=!0);a||c.forEachChild(i,l)}};return l(e),a}var jf=8;function na(e,n,t){let o=new Set,r=da(e,n,t,ot(e)),s=ca(e,n,t,r,ia(e));for(let{source:a}of s.sources)o.add(a.target);for(let a of e.statements)if(c.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&c.isStringLiteralLike(a.moduleSpecifier)&&we(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&o.add(l)}return o}function Bf(e,n,t,o=new Map){let r=new Set(n.modules.filter(k=>k.isEntrypoint).map(k=>String(k.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(k=>k.externalSurface===!0).map(k=>String(k.id))),a=new Map,l=new Map,i=new Map,d=new Map;for(let k of t){if(k.name==="<toplevel>"){d.set(String(k.moduleId),k);continue}if(a.set(`${String(k.moduleId)}::${String(k.declRange.start)}`,k),k.name!==void 0&&l.set(`${String(k.moduleId)}::${k.name}`,k),k.isExported&&k.name!==void 0){let h=i.get(String(k.moduleId))??[];h.push(k),i.set(String(k.moduleId),h)}}if(o.size>0){let k=new Map(t.map(h=>[String(h.id),h]));for(let[h,S]of o){let _=k.get(String(S));_!==void 0&&!a.has(h)&&a.set(h,_)}}let u=new Map;for(let k of n.imports)k.resolvedModuleId!==void 0&&u.set(`${k.moduleId}::${k.specifier}`,String(k.resolvedModuleId));let p=new Map;for(let k of e.sourceFiles){let h=e.toRel(k.fileName);h!==null&&p.set(h,k)}let f=new Map,m=k=>{let h=f.get(k);if(h!==void 0)return h;let S=p.get(k),_=S===void 0?!0:Ff(S);return f.set(k,_),_},g=new Set,y=(k,h)=>h!==void 0&&we(h)==="relative"?u.get(`${k}::${h}`):void 0,b=k=>{if(c.isIdentifier(k))return k.text;if(c.isPropertyAccessExpression(k)){let h=b(k.expression);return h===void 0?void 0:`${h}.${k.name.text}`}if(c.isElementAccessExpression(k)&&c.isStringLiteralLike(k.argumentExpression)){let h=b(k.expression);return h===void 0?void 0:`${h}.${k.argumentExpression.text}`}},x=k=>{let h=k;for(;c.isPropertyAccessExpression(h)||c.isElementAccessExpression(h);)h=h.expression;return un(h)};for(let k of e.sourceFiles){let h=e.toRel(k.fileName);if(h===null)continue;let S=new Map,_=new Map,P=(N,j)=>{let O=y(h,un(j));if(O!==void 0){if(c.isIdentifier(N))_.set(N.text,O),S.set(N.text,O);else if(c.isObjectBindingPattern(N)||c.isArrayBindingPattern(N))for(let F of go(N))_.set(F,O);else if(c.isPropertyAccessExpression(N)||c.isElementAccessExpression(N)){let F=b(N);F!==void 0&&S.set(F,O)}}},v=N=>{c.isVariableDeclaration(N)&&N.initializer!==void 0?P(N.name,N.initializer):c.isBinaryExpression(N)&&N.operatorToken.kind===c.SyntaxKind.EqualsToken&&P(N.left,N.right),c.forEachChild(N,v)};v(k);let T=N=>{let j=fa(N);if(j!==void 0){let O=j.expression,F=y(h,x(O));F!==void 0&&g.add(F);let K=b(O),te=K!==void 0?S.get(K):void 0;te!==void 0&&g.add(te)}c.forEachChild(N,T)};if(T(k),_.size>0){let N=ma(k,_),j=ha(k);for(let[O,F]of N)j.has(O)&&g.add(F)}}let I=[],w=[],A=[];for(let k of e.sourceFiles){let h=e.toRel(k.fileName);if(h===null||!r.has(h))continue;let S=e.checker.getSymbolAtLocation(k),_=new Set,P=new Set,v=0,T=(D,C)=>{if(s.has(String(D.moduleId))||_.has(String(D.id)))return;_.add(String(D.id));let H=`${h}#reexport:${String(v)}:${C}`;v+=1,I.push({id:H,moduleId:h,exportedName:C,kind:"value",reexportOf:{moduleId:String(D.moduleId),name:D.name??C}}),w.push({exportId:H,target:{kind:"function",functionId:D.id}})},N=D=>{if(If(D))return;let C=D;if((D.flags&c.SymbolFlags.Alias)!==0)try{C=e.checker.getAliasedSymbol(D)}catch{return}let H=Af(C,e,a,l,s);if(H!==void 0){T(H,D.getName());return}if((C.flags&c.SymbolFlags.Module)!==0&&!P.has(C)){P.add(C);try{for(let J of e.checker.getExportsOfModule(C))N(J)}catch{}}};if(S!==void 0)for(let D of e.checker.getExportsOfModule(S))N(D);let j=da(k,h,u,ot(k)),O=ca(k,h,u,j,ia(k)),F=new Set,K=O.residual,te=D=>{let C=p.get(D);D.includes("node_modules/")||C===void 0||wf(C)?K=!0:F.add(D)};for(let{source:D,exportedName:C}of O.sources){let H=i.get(D.target)??[],J=g.has(D.target);if(D.kind==="whole"){for(let G of H)T(G,G.name??C);J?K=!0:(H.length===0||m(D.target))&&te(D.target)}else{let G=H.filter(Y=>Y.name===D.member);for(let Y of G)T(Y,C);J?K=!0:(G.length===0||m(D.target))&&te(D.target)}}let U=new Set,X=[];for(let D of na(k,h,u))X.push({target:D,depth:1});for(;X.length>0;){let D=X.shift();if(D===void 0)break;let{target:C,depth:H}=D;if(U.has(C)||H>jf||(U.add(C),C.split("/").includes("node_modules")))continue;let J=p.get(C);if(J===void 0)continue;let G=d.get(C);G!==void 0&&!m(C)&&T(G,"<load>");for(let Y of na(J,C,u))U.has(Y)||X.push({target:Y,depth:H+1})}$f(k,ot(k))&&(K=!0);for(let D of F)A.push({code:"unresolved-reexport",path:h,detail:`entrypoint whole/member re-exports app-owned relative module ${D} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:D});K&&A.push({code:"unresolved-reexport",path:h,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:I,exportBindings:w,diagnostics:A}}var rt=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),Kf=new Set(["defineProperty","defineProperties","create"]);function Uf(e){let n=!0,t=r=>c.isIdentifier(r)||c.isStringLiteral(r)||c.isNumericLiteral(r)?rt.has(r.text):c.isComputedPropertyName(r)&&c.isStringLiteralLike(r.expression)?rt.has(r.expression.text):!1,o=r=>{if(n){if(c.isNewExpression(r)||c.isForOfStatement(r)||c.isSpreadElement(r)||c.isSpreadAssignment(r)||c.isArrayBindingPattern(r)||c.isGetAccessorDeclaration(r)||c.isSetAccessorDeclaration(r)||c.isYieldExpression(r)&&r.asteriskToken!==void 0||c.canHaveDecorators(r)&&(c.getDecorators(r)?.length??0)>0){n=!1;return}if((c.isPropertyAccessExpression(r)||c.isMethodDeclaration(r)||c.isPropertyAssignment(r))&&t(r.name)||c.isPropertyDeclaration(r)&&t(r.name)||c.isShorthandPropertyAssignment(r)&&t(r.name)||c.isBindingElement(r)&&t(r.propertyName??r.name)||c.isElementAccessExpression(r)&&c.isStringLiteralLike(r.argumentExpression)&&rt.has(r.argumentExpression.text)){n=!1;return}if(c.isCallExpression(r)&&c.isPropertyAccessExpression(r.expression)&&c.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&Kf.has(r.expression.name.text)){n=!1;return}c.forEachChild(r,o)}};return o(e),n}function So(e){if(c.isIdentifier(e)||c.isStringLiteral(e)||c.isNumericLiteral(e))return e.text}function ga(e){let n=t=>c.canHaveDecorators(t)&&(c.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function zf(e){let n=!1,t=new Set,o=[],r=new Map,s=(f,m)=>{let g=r.get(f);g===void 0?r.set(f,[m]):g.push(m)},a=f=>{c.isIdentifier(f)?t.add(f.text):o.push(f)},l=f=>{for(let m of f.properties)c.isShorthandPropertyAssignment(m)?t.add(m.name.text):c.isPropertyAssignment(m)?o.push(m.initializer):n=!0},i=f=>{if(c.isBinaryExpression(f)&&f.operatorToken.kind===c.SyntaxKind.EqualsToken){let m=f.left,g=f.right;je(m)?c.isObjectLiteralExpression(g)?l(g):c.isIdentifier(g)||c.isFunctionExpression(g)||c.isArrowFunction(g)||c.isClassExpression(g)?a(g):n=!0:tn(m)?(c.isElementAccessExpression(m)&&!c.isStringLiteralLike(m.argumentExpression)&&(n=!0),a(g)):c.isIdentifier(m)?s(m.text,g):(c.isPropertyAccessExpression(m)||c.isElementAccessExpression(m))&&c.isIdentifier(m.expression)&&s(m.expression.text,g)}else if(c.isCallExpression(f))(st(f)&&f.arguments[0]!==void 0&&zn(f.arguments[0])||Nr(f))&&(n=!0);else if(c.isVariableDeclaration(f)&&c.isIdentifier(f.name)&&f.initializer!==void 0)s(f.name.text,f.initializer);else if((c.isFunctionDeclaration(f)||c.isClassDeclaration(f))&&f.name!==void 0)s(f.name.text,f),Un(f)&&t.add(f.name.text);else if(c.isExportDeclaration(f)){if(f.exportClause===void 0)n=!0;else if(f.moduleSpecifier===void 0&&c.isNamedExports(f.exportClause))for(let m of f.exportClause.elements)t.add((m.propertyName??m.name).text)}else if(c.isExportAssignment(f))f.isExportEquals&&!c.isIdentifier(f.expression)?n=!0:a(f.expression);else if(c.isVariableStatement(f)&&Un(f))for(let m of f.declarationList.declarations)c.isIdentifier(m.name)&&t.add(m.name.text);c.forEachChild(f,i)};i(e);let d=new Set,u=[...t],p=f=>{let m=g=>{c.isIdentifier(g)&&u.push(g.text),c.forEachChild(g,m)};m(f)};for(let f of o)p(f);for(;u.length>0;){let f=u.pop();if(!(f===void 0||d.has(f))){d.add(f);for(let m of r.get(f)??[])p(m)}}return{names:d,opaque:n}}var Wf=512,Vf=new Set(["get","post","put","patch","delete","options","head"]);function qf(e){for(let n of e.statements){if(c.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(n.expression.left)&&c.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,o=n.expression.left.name.text;if(t==="module"&&o==="exports"||t==="exports"&&o==="default")return n.expression.right}}return null}function Gf(e){let n=new Map,t=qf(e);if(t===null)return n;let o=s=>{for(let a of s.properties)if(c.isPropertyAssignment(a)&&c.isObjectLiteralExpression(a.initializer)){let l=So(a.name);l!==void 0&&n.set(l,a.initializer)}};if(c.isObjectLiteralExpression(t))return o(t),n;if(!c.isIdentifier(t))return n;let r=t.text;for(let s of e.statements)if(c.isVariableStatement(s))for(let a of s.declarationList.declarations)c.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&c.isObjectLiteralExpression(a.initializer)&&o(a.initializer);else if(c.isExpressionStatement(s)&&c.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(s.expression.left)&&c.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===r&&c.isObjectLiteralExpression(s.expression.right)){let a=s.expression.left.name.text;n.set(a,s.expression.right)}return n}function Hf(e){for(let n of e.properties){if(c.isMethodDeclaration(n)&&c.isIdentifier(n.name)&&n.name.text==="handler")return n;if(c.isPropertyAssignment(n)&&c.isIdentifier(n.name)&&n.name.text==="handler"&&(c.isArrowFunction(n.initializer)||c.isFunctionExpression(n.initializer)))return n.initializer}return null}function Xf(e,n){for(let o of e.properties){let r;if(c.isPropertyAssignment(o)||c.isMethodDeclaration(o)?r=So(o.name):c.isShorthandPropertyAssignment(o)&&(r=o.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function Yf(e,n){let t=[],o=new Set,r=(l,i,d)=>{if(t.length>=Wf||l==="__proto__"||!Rr.test(l))return;let u=`${e}#handler:${l}`;o.has(u)||(o.add(u),t.push({id:u,node:i,memberPath:l,idiom:d}))};for(let[l,i]of Gf(n)){let d=Hf(i);d!==null&&Xf(i,d)&&r(l,d,"descriptor-object")}let s=0,a=l=>{if(c.isCallExpression(l)&&c.isPropertyAccessExpression(l.expression)&&c.isIdentifier(l.expression.expression)&&Vf.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&c.isStringLiteralLike(l.arguments[0])){let i=l.expression.name.text;for(let d=1;d<l.arguments.length;d+=1){let u=l.arguments[d];u!==void 0&&(c.isArrowFunction(u)||c.isFunctionExpression(u))&&r(`${i}_${String(s)}_${String(d)}`,u,"router-verb")}s+=1}c.forEachChild(l,a)};return a(n),t}function Jf(e,n,t,o,r,s){let a=`${e}#class:${t}`,l=[],i=new Set;for(let d of o.members){let u,p,f;if(c.isConstructorDeclaration(d))u="constructor",p="ctor",f=!1;else if(c.isMethodDeclaration(d))u=So(d.name),p="method",f=u!==void 0&&!rt.has(u);else continue;if(u===void 0||i.has(u))continue;i.add(u);let m=`${e}#${t}.${u}`;r.push({id:m,moduleId:e,name:u,kind:p,enclosingClassId:a,declRange:Nn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),l.push(m),f&&s.push({start:d.getStart(n,!1),end:d.getEnd(),id:m})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function Zf(e,n,t=[],o=!1,r){let s=[],a=new Map,l=[],{reachableLocals:i,defaultTarget:d}=kf(n),u=ot(n),p=`${e}#<toplevel>`;s.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let f=(h,S)=>{let _=`${e}#${h}`;return s.push({id:_,moduleId:e,name:h,kind:"function",declRange:Nn(e,S,n),isExported:i.has(h),publicSurfaceReachable:i.has(h)}),a.set(h,{kind:"function",functionId:_}),l.push({start:S.getStart(n,!1),end:S.getEnd(),id:_}),_},m=[],g=!e.split("/").includes("node_modules");if(g)for(let h of Pf(n,u))i.add(h);let y=g?zf(n):void 0,b=(h,S,_)=>{y===void 0||y.opaque||y.names.has(h)||Un(_)||ga(S)||m.push(Jf(e,n,h,S,s,l))};for(let h of n.statements)if(c.isFunctionDeclaration(h)&&h.name!==void 0)f(h.name.text,h);else if(c.isClassDeclaration(h)&&h.name!==void 0)b(h.name.text,h,h);else if(c.isVariableStatement(h))for(let S of h.declarationList.declarations){if(c.isObjectBindingPattern(S.name)&&S.initializer!==void 0&&c.isCallExpression(S.initializer)&&c.isIdentifier(S.initializer.expression)&&S.initializer.expression.text==="require"&&S.initializer.arguments.length===1&&S.initializer.arguments[0]!==void 0&&c.isStringLiteralLike(S.initializer.arguments[0])){let P=S.initializer.arguments[0].text;for(let v of S.name.elements){if(v.dotDotDotToken!==void 0||v.initializer!==void 0||!c.isIdentifier(v.name))continue;let T=v.propertyName??v.name;!c.isIdentifier(T)&&!c.isStringLiteralLike(T)||a.set(v.name.text,{kind:"import",specifier:P,form:{named:T.text}})}continue}if(!c.isIdentifier(S.name)||S.initializer===void 0)continue;let _=S.initializer;if(c.isFunctionExpression(_)||c.isArrowFunction(_))f(S.name.text,S);else if(c.isClassExpression(_))b(S.name.text,_,h);else if(c.isCallExpression(_)&&c.isIdentifier(_.expression)&&_.expression.text==="require"&&_.arguments.length===1&&_.arguments[0]!==void 0&&c.isStringLiteralLike(_.arguments[0]))a.set(S.name.text,{kind:"import",specifier:_.arguments[0].text,form:"whole"});else if((c.isPropertyAccessExpression(_)||c.isElementAccessExpression(_))&&xo(_)==="default"&&c.isCallExpression(_.expression)){let P=un(_.expression);P!==void 0&&a.set(S.name.text,{kind:"import",specifier:P,form:"require-default"})}}else if(c.isImportDeclaration(h)&&c.isStringLiteralLike(h.moduleSpecifier)){let S=h.moduleSpecifier.text,_=h.importClause;if(_!==void 0){_.name!==void 0&&a.set(_.name.text,{kind:"import",specifier:S,form:"default"});let P=_.namedBindings;if(P!==void 0&&c.isNamespaceImport(P))a.set(P.name.text,{kind:"import",specifier:S,form:"namespace"});else if(P!==void 0&&c.isNamedImports(P))for(let v of P.elements){let T=(v.propertyName??v.name).text;a.set(v.name.text,{kind:"import",specifier:S,form:{named:T}})}}}else c.isImportEqualsDeclaration(h)&&c.isExternalModuleReference(h.moduleReference)&&c.isStringLiteralLike(h.moduleReference.expression)&&a.set(h.name.text,{kind:"import",specifier:h.moduleReference.expression.text,form:"whole"});let x=new Map,I,w=new Map,A=new Map;if(g)for(let{name:h,value:S}of Rf(n)){let _=`${e}#member-export:${h}`;s.push({id:_,moduleId:e,name:h,kind:c.isArrowFunction(S)?"arrow":"function",declRange:Nn(e,S,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:S.getStart(n,!1),end:S.getEnd(),id:_}),x.set(S.getStart(n,!1),_)}if(o&&g){let h=T=>{let N=Ke(T);return c.isFunctionExpression(N)||c.isArrowFunction(N)?N:void 0},S=(T,N)=>{let j=T;return s.push({id:j,moduleId:e,kind:c.isArrowFunction(N)?"arrow":"function",declRange:Nn(e,N,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:N.getStart(n,!1),end:N.getEnd(),id:j}),x.set(N.getStart(n,!1),j),j},_=[],P=[],v=[];for(let T of n.statements)c.isExportAssignment(T)&&!T.isExportEquals?_.push(T):c.isFunctionDeclaration(T)&&c.getModifiers(T)?.some(N=>N.kind===c.SyntaxKind.DefaultKeyword)===!0?P.push(T):c.isExpressionStatement(T)&&c.isBinaryExpression(T.expression)&&T.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&je(T.expression.left)&&v.push(T.expression);if(_.length+P.length+v.length===1){let T=_[0],N=P[0],j=v[0];if(T!==void 0){let O=h(T.expression);if(O!==void 0){let F=S(`${e}#<default>`,O);I={id:F,esm:!0},A.set(T.getStart(n,!1),F),he(r,"2a-default",null)}}else if(N!==void 0&&N.name===void 0&&N.body!==void 0){let O=S(`${e}#<default>`,N);I={id:O,esm:!0},A.set(N.getStart(n,!1),O),he(r,"2a-default",null)}else if(j!==void 0){let O=h(j.right);if(O!==void 0){let F=S(`${e}#<default>`,O);I={id:F,esm:!1},A.set(j.getStart(n,!1),F),he(r,"2a-default",null)}else if(c.isObjectLiteralExpression(j.right)){let F=j.right,K=[],te=!0;for(let U of F.properties){if(c.isSpreadAssignment(U)){te=!1;break}let X=U.name,D=X===void 0?void 0:Ar(X);if(D===void 0){te=!1;break}K.push(D)}if(te){let U=new Map;for(let X of K)U.set(X,(U.get(X)??0)+1);for(let X of F.properties){if(!c.isPropertyAssignment(X))continue;let D=Ar(X.name),C=h(X.initializer);if(D!==void 0){if(!_f(D)){C!==void 0&&he(r,"2a-member","charset-refused");continue}if((U.get(D)??0)!==1){C!==void 0&&he(r,"2a-member","duplicate-key");continue}if(C!==void 0){let H=S(`${e}#<cjs>.${D}`,C);w.set(D,H),A.set(X.getStart(n,!1),H),he(r,"2a-member",null)}}}}else for(let U of F.properties)c.isPropertyAssignment(U)&&h(U.initializer)!==void 0&&he(r,"2a-member","spread-or-computed-literal")}}}else{for(let T of _)h(T.expression)!==void 0&&he(r,"2a-default","duplicate-default-sources");for(let T of P)T.name===void 0&&he(r,"2a-default","duplicate-default-sources");for(let T of v)if(h(T.right)!==void 0)he(r,"2a-default","duplicate-default-sources");else if(c.isObjectLiteralExpression(T.right))for(let N of T.right.properties)c.isPropertyAssignment(N)&&h(N.initializer)!==void 0&&he(r,"2a-member","duplicate-default-sources")}}for(let h of t)s.push({id:h.id,moduleId:e,name:`handler:${h.memberPath}`,kind:c.isArrowFunction(h.node)?"arrow":"function",declRange:Nn(e,h.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:h.node.getStart(n,!1),end:h.node.getEnd(),id:h.id});l.sort((h,S)=>h.end-h.start-(S.end-S.start));let k=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:s,bindings:a,exportedFunctionId:k,exportedNames:i,tainted:u,fnRanges:l,toplevelId:p,classes:m,mintedByPos:x,mintedDefault:I,mintedMembers:w,mintSeedAliases:A}}function Qf(e){return c.isIdentifier(e)?"identifier":c.isPropertyAccessExpression(e)?"member":c.isElementAccessExpression(e)?"computed-member":e.kind===c.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function ta(e,n){let t=o=>{if(c.isBinaryExpression(o)&&o.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=c.SyntaxKind.LastAssignment){let r=o.left;c.isPropertyAccessExpression(r)&&c.isIdentifier(r.expression)?n(r.expression.text,r.name.text):c.isElementAccessExpression(r)&&c.isIdentifier(r.expression)&&n(r.expression.text,c.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(c.isCallExpression(o)&&c.isPropertyAccessExpression(o.expression)){let r=o.expression,s=o.arguments[0];c.isIdentifier(r.expression)&&s!==void 0&&c.isIdentifier(s)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(s.text,null)}c.forEachChild(o,t)};t(e)}function ep(e){let n=!1,t=o=>{if(!n){if(c.isVariableDeclaration(o)||c.isParameter(o)){let r=new Set;if(Et(o.name,r),r.has("require")){n=!0;return}}else if((c.isFunctionDeclaration(o)||c.isClassDeclaration(o))&&o.name!==void 0&&o.name.text==="require"){n=!0;return}c.forEachChild(o,t)}};return t(e),n}function np(e,n,t,o=new Map,r={}){let s=r.additiveForms===!0,a=r.namelessExports===!0,l=s||a?{}:void 0,i=new Map,d=new Map;for(let h of n.imports)h.resolvedModuleId!==void 0&&d.set(`${h.moduleId}::${h.specifier}`,h.resolvedModuleId);for(let h of e.sourceFiles){let S=e.toRel(h.fileName);S!==null&&i.set(S,Zf(S,h,o.get(S)??[],a,l))}let u=new Map;if(s)for(let h of i.values()){let S=new Map;for(let[_,P]of h.bindings)if(P.kind==="import"&&P.form==="whole"&&we(P.specifier)!=="package-root"){let v=d.get(`${h.rel}::${P.specifier}`);v!==void 0&&S.set(_,String(v))}S.size!==0&&ta(h.sf,(_,P)=>{let v=S.get(_);if(v===void 0)return;let T=u.get(v);if(T!=="*"){if(P===null){u.set(v,"*");return}T===void 0?u.set(v,new Set([P])):T.add(P)}})}let p=new Map;for(let h of i.values())h.exportedFunctionId!==void 0&&p.set(h.rel,h.exportedFunctionId);let f=new Map;for(let h of i.values()){if(h.rel.split("/").includes("node_modules"))continue;let S=Ef(h.sf);if(S===void 0){a&&h.mintedDefault!==void 0&&f.set(h.rel,h.mintedDefault);continue}let _=h.bindings.get(S.name);_?.kind==="function"&&f.set(h.rel,{id:_.functionId,esm:S.esm})}let m=new Map;for(let h of i.values()){let S;for(let _ of h.exportedNames){let P=h.bindings.get(_);P?.kind==="function"&&(S??=new Map,S.set(_,P.functionId))}S!==void 0&&m.set(h.rel,S)}let g=new Map;for(let h of i.values()){if(h.rel.split("/").includes("node_modules"))continue;let S=Tf(h.sf,h.tainted,_=>{let P=h.bindings.get(_);return P?.kind==="function"?P.functionId:void 0},a?_=>{let P=Ke(_);return c.isFunctionExpression(P)||c.isArrowFunction(P)?h.mintedByPos.get(P.getStart(h.sf,!1)):void 0}:void 0);S.size>0&&g.set(h.rel,S)}let y=[],b=[],x=[],I=[],w=[],A=[];for(let h of i.values()){y.push(...h.functions),A.push(...h.classes);for(let R of h.exportedNames){let M=h.bindings.get(R);if(M?.kind==="function"){let B=`${h.rel}#export:${R}`;I.push({id:B,moduleId:h.rel,exportedName:R,kind:"value"}),w.push({exportId:B,target:{kind:"function",functionId:M.functionId}})}}if(a){if(h.mintedDefault!==void 0){let R=`${h.rel}#export:<default>`;I.push({id:R,moduleId:h.rel,exportedName:"default",kind:"value"}),w.push({exportId:R,target:{kind:"function",functionId:h.mintedDefault.id}})}for(let[R,M]of h.mintedMembers){let B=`${h.rel}#export:<cjs>.${R}`;I.push({id:B,moduleId:h.rel,exportedName:R,kind:"value"}),w.push({exportId:B,target:{kind:"function",functionId:M}})}}let S=new Map;for(let[R,M]of h.bindings){if(M.kind==="function"){S.set(R,M);continue}if(we(M.specifier)==="package-root"){let q=qe(M.specifier);typeof M.form=="object"?S.set(R,{kind:"package-export",packageName:q,exportName:M.form.named}):M.form==="require-default"?S.set(R,{kind:"package-default",packageName:q}):S.set(R,{kind:"package-surface",packageName:q})}else{let q=d.get(`${h.rel}::${M.specifier}`);if(q!==void 0&&typeof M.form=="object"){let le=m.get(String(q))?.get(M.form.named);le!==void 0&&S.set(R,{kind:"app-named-fn",functionId:le})}else if(q!==void 0&&M.form==="require-default"){let le=f.get(String(q));le!==void 0&&le.esm&&S.set(R,{kind:"app-default-fn",functionId:le.id})}else q!==void 0&&typeof M.form!="object"&&M.form!=="require-default"&&S.set(R,{kind:"module",resolvedModuleId:q})}}let _=new Map;for(let R of h.functions){if(R.enclosingClassId===void 0||R.name===void 0)continue;let M=_.get(R.enclosingClassId);M===void 0&&(M=new Map,_.set(R.enclosingClassId,M)),M.set(R.name,R.id)}for(let R of h.classes)R.name===void 0||h.tainted.has(R.name)||S.has(R.name)||S.set(R.name,{kind:"app-class",cls:{classId:R.id,className:R.name,memberIds:_.get(R.id)??new Map}});let P=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0&&c.isNewExpression(R.initializer)&&!h.tainted.has(R.name.text)&&!S.has(R.name.text)){let M=Yi(R.initializer,S,h.tainted);M!==null&&S.set(R.name.text,M)}c.forEachChild(R,P)};P(h.sf);let v=R=>{for(let M of h.fnRanges)if(R>=M.start&&R<M.end)return M.id;return h.toplevelId},T=new Map,N=new Map,j=new Map,O=(R,M,B)=>{if(B===null){R.set(M,"*");return}let q=R.get(M);q!=="*"&&(q===void 0?R.set(M,new Set([B])):q.add(B))},F=(R,M)=>{O(T,R,M);let B=S.get(R);B?.kind==="package-surface"?O(N,B.packageName,M):B?.kind==="module"&&O(j,String(B.resolvedModuleId),M)};ta(h.sf,F);let K=new Map,te=256,U=R=>{let M=K.get(R);return M===void 0&&(M=K.size>=te?new Set([R]):pa(h.sf,new Set([R])),K.set(R,M)),M},X=(R,M)=>R==="*"||R!==void 0&&R.has(M),D=(R,M)=>{let B=S.get(R);if(B?.kind==="package-surface"&&X(N.get(B.packageName),M)||B?.kind==="module"&&X(j.get(String(B.resolvedModuleId)),M))return!0;for(let q of U(R))if(X(T.get(q),M))return!0;return!1},C=R=>{if(c.isIdentifier(R)){let M=h.tainted.has(R.text)?void 0:S.get(R.text);return M?.kind==="function"?M.functionId:M?.kind==="module"?p.get(String(M.resolvedModuleId))??null:M?.kind==="package-export"?t.exportFor(M.packageName,M.exportName):null}if(c.isPropertyAccessExpression(R)&&c.isIdentifier(R.expression)){let M=R.expression.text;if(D(M,R.name.text))return null;let B=h.tainted.has(M)?void 0:S.get(M);return B?.kind==="package-surface"?t.exportFor(B.packageName,R.name.text):B?.kind==="package-export"?t.methodFor(B.packageName,B.exportName,R.name.text,"method"):B?.kind==="package-instance"?t.methodFor(B.packageName,B.className,R.name.text,"method"):null}return null},H=R=>{for(let M=R.parent;M!==void 0;M=M.parent)if(!c.isArrowFunction(M)){if(c.isFunctionExpression(M)||c.isFunctionDeclaration(M))return null;if(c.isMethodDeclaration(M)||c.isConstructorDeclaration(M)||c.isGetAccessorDeclaration(M)||c.isSetAccessorDeclaration(M)){let B=M.parent;if(!c.isClassLike(B)||B.name===void 0)return null;let q=h.tainted.has(B.name.text)?void 0:S.get(B.name.text);return q?.kind==="app-class"?q.cls:null}}return null},J=s&&!h.tainted.has("require")&&!ep(h.sf),G=R=>{if(c.isIdentifier(R)){let q=h.tainted.has(R.text)?void 0:S.get(R.text);return q?.kind==="package-surface"||q?.kind==="package-default"?t.exportFor(q.packageName,"default"):q?.kind==="app-named-fn"||q?.kind==="app-default-fn"?q.functionId:q?.kind==="module"?f.get(String(q.resolvedModuleId))?.id??null:q?.kind==="member-value"?q.functionId:null}if(!c.isPropertyAccessExpression(R))return null;let M=R.expression;if(s&&c.isCallExpression(Ke(M))){let q=un(Ke(M));if(q!==void 0)if(!J)he(l,"2b","require-shadow");else if(we(q)==="package-root")he(l,"2b","package-root");else{let le=d.get(`${h.rel}::${q}`);if(le===void 0)he(l,"2b","unresolved-module");else{let ge=R.name.text,Te=u.get(String(le));if(Te==="*"||Te!==void 0&&Te.has(ge))he(l,"2b","module-mutation-gate");else{let Ze=g.get(String(le))?.get(ge);if(Ze!==void 0)return he(l,"2b",null),Ze;if(ge==="default"){let L=f.get(String(le));if(L!==void 0&&L.esm)return he(l,"2b",null),L.id;he(l,"2b","non-esm-default")}else he(l,"2b","unknown-member")}}}return null}let B;if(c.isIdentifier(M)){let q=h.tainted.has(M.text)?void 0:S.get(M.text);if(q?.kind==="app-class"||q?.kind==="app-instance")B=q.cls.memberIds;else if(q?.kind==="object-literal")B=q.obj.members;else if(q?.kind==="module"){let le=g.get(String(q.resolvedModuleId));le?.has(R.name.text)===!0&&!D(M.text,R.name.text)&&(B=le)}}else if(c.isNewExpression(M)){let q=Yi(M,S,h.tainted);q?.kind==="app-instance"&&(B=q.cls.memberIds)}else M.kind===c.SyntaxKind.ThisKeyword&&(B=H(R)?.memberIds);return B?.get(R.name.text)??null},Y=new Map,re=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0&&c.isObjectLiteralExpression(R.initializer)&&!h.tainted.has(R.name.text)&&!S.has(R.name.text)&&!Y.has(R.name.text)){let M=new Map;for(let B of R.initializer.properties)if(c.isPropertyAssignment(B)&&c.isIdentifier(B.name)){let q=C(B.initializer);q!==null&&M.set(B.name.text,q)}Y.set(R.name.text,M)}c.forEachChild(R,re)};re(h.sf);let ne=R=>{if(c.isBinaryExpression(R)&&R.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(R.left)&&c.isIdentifier(R.left.expression)&&!h.tainted.has(R.left.expression.text)){let M=Y.get(R.left.expression.text);if(M!==void 0){let B=C(R.right);B!==null&&M.set(R.left.name.text,B)}}c.forEachChild(R,ne)};ne(h.sf);for(let[R,M]of Y)S.set(R,{kind:"object-literal",obj:{members:M}});let $=(R,M=0)=>{if(M>Hi)return null;let B=Ke(R);if(c.isCallExpression(B)&&c.isPropertyAccessExpression(B.expression)&&B.expression.name.text==="bind")return $(B.expression.expression,M+1);if(c.isIdentifier(B)){let q=C(B);if(q!==null)return q;let le=h.tainted.has(B.text)?void 0:S.get(B.text);return le?.kind==="member-value"?le.functionId:null}return c.isPropertyAccessExpression(B)?C(B)??G(B):null},Z=(R,M=0)=>{if(M>Hi)return"depth-cap";let B=Ke(R);if(c.isCallExpression(B)&&c.isPropertyAccessExpression(B.expression)&&B.expression.name.text==="bind")return Z(B.expression.expression,M+1);if(c.isIdentifier(B))return h.tainted.has(B.text)?"tainted-receiver":"unresolved-receiver";if(c.isPropertyAccessExpression(B)&&c.isIdentifier(B.expression)){if(h.tainted.has(B.expression.text))return"tainted-receiver";if(D(B.expression.text,B.name.text))return"mutated-member"}return"unresolved-receiver"},Q=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0){let M=Ke(R.initializer),B=c.isPropertyAccessExpression(M),q=c.isCallExpression(M)&&c.isPropertyAccessExpression(M.expression)&&M.expression.name.text==="bind";if(B||q){let le=B?"D1":"A2";if(h.tainted.has(R.name.text))he(l,le,"tainted-alias");else if(S.has(R.name.text))he(l,le,"already-bound");else{let ge=$(M);ge!==null?(S.set(R.name.text,{kind:"member-value",functionId:ge}),he(l,le,null)):he(l,le,Z(M))}}}c.forEachChild(R,Q)};s&&Q(h.sf);let ce=0,Mn=R=>{let M,B;if(c.isCallExpression(R)){let q=R.expression,le=c.isIdentifier(q)&&q.text==="require",ge=q.kind===c.SyntaxKind.ImportKeyword;!le&&!ge&&(M=q,B=R.arguments)}else c.isTaggedTemplateExpression(R)&&(M=R.tag);if(M!==void 0){let q=Qf(M),le=R.getStart(h.sf,!1),ge=`${h.rel}#call${String(ce)}`;ce+=1;let Te="unresolved",Ze=[],L=C(M);L!==null&&(Te="resolved",Ze.push(L)),b.push({id:ge,enclosingFunctionId:v(le),calleeExprShape:q,resolvedTargetIds:Ze,resolution:Te,range:Nn(h.rel,R,h.sf)});for(let oe of Ze)x.push({callSiteId:ge,calleeFunctionId:oe,resolution:Te});if(L===null){let oe=G(M);if(oe!==null)x.push({callSiteId:ge,calleeFunctionId:oe,resolution:"field-based"});else if(s&&c.isPropertyAccessExpression(M)&&(M.name.text==="call"||M.name.text==="apply")){let se=$(M.expression);se!==null?(x.push({callSiteId:ge,calleeFunctionId:se,resolution:"field-based"}),he(l,"A3",null)):he(l,"A3",Z(M.expression))}}for(let oe of B??[]){let se=C(oe);if(se!==null)x.push({callSiteId:ge,calleeFunctionId:se,resolution:"field-based"});else{let Ie=G(oe);if(Ie!==null)x.push({callSiteId:ge,calleeFunctionId:Ie,resolution:"field-based"});else if(s){let Ne=$(oe),pe=Ke(oe),Qe=pe!==oe||c.isCallExpression(pe)&&c.isPropertyAccessExpression(pe.expression)&&pe.expression.name.text==="bind";Ne!==null?(x.push({callSiteId:ge,calleeFunctionId:Ne,resolution:"field-based"}),Qe&&he(l,"A2p",null)):Qe&&he(l,"A2p",Z(oe))}}}}c.forEachChild(R,Mn)};Mn(h.sf);for(let R of n.computedLoads.get(h.rel)??[]){let M=R.candidateRels.filter(q=>i.has(q)).map(q=>`${q}#<toplevel>`);if(M.length===0)continue;let B=`${h.rel}#dirload${String(ce)}`;ce+=1,b.push({id:B,enclosingFunctionId:v(R.pos),calleeExprShape:"require",resolvedTargetIds:M,resolution:"field-based",range:{path:h.rel,start:R.pos,end:R.pos}});for(let q of M)x.push({callSiteId:B,calleeFunctionId:q,resolution:"field-based"})}let Yn=0;for(let R of o.get(h.rel)??[]){let M=`${h.rel}#handlerseed${String(Yn)}`;Yn+=1;let B=R.node.getStart(h.sf,!1);b.push({id:M,enclosingFunctionId:h.toplevelId,calleeExprShape:"member",resolvedTargetIds:[R.id],resolution:"field-based",range:{path:h.rel,start:B,end:B}}),x.push({callSiteId:M,calleeFunctionId:R.id,resolution:"field-based"})}}let k=new Map;if(a)for(let h of i.values())for(let[S,_]of h.mintSeedAliases)k.set(`${h.rel}::${String(S)}`,_);return{functions:y,callSites:b,callEdges:x,exports:I,exportBindings:w,classes:A,mintSeedAliases:k,bindingApplicability:l}}function tp(e,n,t){let o=i=>i.length===0||Ue.isAbsolute(i)||i.includes("\\")||/^[a-zA-Z]:/u.test(i)||i.split("/").some(d=>d===".."||d==="");if(o(n)||o(t))return null;let r=e.endsWith(Ue.sep)?e:e+Ue.sep,s;try{s=Gi(Ue.resolve(e,n))}catch{return null}if(!s.startsWith(r))return null;let a=s.endsWith(Ue.sep)?s:s+Ue.sep,l;try{l=Gi(Ue.resolve(s,t))}catch{return null}return l.startsWith(a)?l:null}function ya(e,n,t){let o=`${e}#class:${t}`,r=[],s=[],a=[],l=new Set;return{pushMember(i,d,u,p){if(i==="__proto__"||l.has(i))return;l.add(i);let f=`${e}#${t}.${i}`;r.push({id:f,moduleId:e,name:i,kind:u,enclosingClassId:o,declRange:Nn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),s.push({name:i,id:f,kind:u,body:p})},finish(){return s.length===0?null:{functions:r,classNode:{id:o,moduleId:e,name:t,implementsRefs:[],members:a},members:s}}}}function op(e,n,t,o){if(ga(o)||o.members.length>_r)return null;let r=ya(e,n,t);for(let s of o.members){let a,l,i;if(c.isConstructorDeclaration(s))a="constructor",l="ctor",i=void 0;else if(c.isMethodDeclaration(s))a=So(s.name),l="method",i=a!==void 0&&!rt.has(a)?s.body??void 0:void 0;else continue;a!==void 0&&r.pushMember(a,s,l,i)}return r.finish()}function rp(e,n,t){let o;for(let a of n.statements)if(c.isFunctionDeclaration(a)&&a.name?.text===t){o=a;break}if(o===void 0)return null;let r=[];for(let a of n.statements){if(!c.isExpressionStatement(a))continue;let l=a.expression;if(!c.isBinaryExpression(l)||l.operatorToken.kind!==c.SyntaxKind.EqualsToken)continue;let i=l.left;if(c.isPropertyAccessExpression(i)&&c.isPropertyAccessExpression(i.expression)&&c.isIdentifier(i.expression.expression)&&i.expression.expression.text===t&&i.expression.name.text==="prototype"){let d=i.name.text;c.isFunctionExpression(l.right)?r.push({name:d,fn:l.right,walk:!0}):c.isArrowFunction(l.right)&&r.push({name:d,fn:l.right,walk:!1})}}if(r.length===0||r.length+1>_r)return null;let s=ya(e,n,t);s.pushMember("constructor",o,"ctor",void 0);for(let a of r){let l=a.walk&&!rt.has(a.name)&&c.isFunctionExpression(a.fn)?a.fn.body:void 0;s.pushMember(a.name,a.fn,"method",l)}return s.finish()}function sp(e,n,t){for(let o of n.statements)if(c.isClassDeclaration(o)&&o.name?.text===t)return op(e,n,t,o);return rp(e,n,t)}function ip(e,n,t,o,r){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let a=new Set(t.map(p=>p.packageName)),l=new Set(t.map(p=>p.path)),i=new Set,d=new Set,u=0;for(let p of n){if(!a.has(p.packageName))continue;let f=tp(e.appRoot,p.packageRootRel,p.sourcePath);if(f===null)continue;let m=e.toRel(f);if(m===null)continue;let g=`${m}#${p.container}`;if(d.has(g)||!i.has(m)&&i.size>=yo)continue;let y=Oe(f);if(y===null)continue;let b;try{b=c.createSourceFile(m,y,c.ScriptTarget.Latest,!0,c.ScriptKind.JS)}catch{continue}let x=sp(m,b,p.container);if(x===null)continue;i.add(m),d.add(g);let I=new Map,w=new Map;for(let k of x.members){let h=r.methodFor(p.packageName,p.container,k.name,k.kind);I.set(k.name,h),w.set(h,k.id)}let A=0;for(let k of x.members){if(k.body===void 0)continue;let h=(S,_)=>{if(_&&c.isCallExpression(S)&&c.isPropertyAccessExpression(S.expression)&&S.expression.expression.kind===c.SyntaxKind.ThisKeyword){let T=I.get(S.expression.name.text);if(T!==void 0){let N=`${m}#depclass:${p.container}.${k.name}#c${String(A)}`;A+=1,s.callSites.push({id:N,enclosingFunctionId:k.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:Nn(m,S,b)}),s.callEdges.push({callSiteId:N,calleeFunctionId:T,resolution:"field-based"})}}let P=c.isFunctionExpression(S)||c.isFunctionDeclaration(S)||c.isMethodDeclaration(S)||c.isConstructorDeclaration(S)||c.isGetAccessorDeclaration(S)||c.isSetAccessorDeclaration(S)||c.isClassLike(S),v=c.isArrowFunction(S)?_:P?!1:_;c.forEachChild(S,T=>{h(T,v)})};h(k.body,!0)}for(let k of o){let h=w.get(k.calleeFunctionId);h!==void 0&&s.callEdges.push({callSiteId:k.callSiteId,calleeFunctionId:h,resolution:"field-based"})}if(s.functions.push(...x.functions),s.classes.push(x.classNode),!l.has(m)){l.add(m),s.modules.push({id:m,packageName:p.packageName,versionRange:"",path:m,moduleSystem:"cjs",isEntrypoint:!1});let k=r.moduleFor(p.packageName),h=`${String(k)}#depclass${String(u)}`;u+=1,s.imports.push({id:h,moduleId:k,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:m}),s.importEdges.push({importId:h,resolvedModuleId:m})}s.diagnostics.push({code:"dep-class-corridor",path:m,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(x.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return s}function ap(e,n,t,o){let r=new Set(e.modules.filter(i=>i.isEntrypoint).map(i=>i.packageName)),s=new Map(e.functions.map(i=>[i.id,i.moduleId])),a=new Map;for(let i of e.callSites){if(i.resolution!=="unresolved")continue;let d=s.get(i.enclosingFunctionId);d!==void 0&&a.set(d,(a.get(d)??0)+1)}let l=[];for(let i of e.modules){if(i.externalSurface===!0)continue;let d=n.get(i.path);if(d===void 0||t.has(i.path)||r.has(i.packageName)&&o.has(i.path)&&!i.path.split("/").includes("node_modules"))continue;let u=a.get(i.id)??0;if(u===0&&Uf(d))continue;let p=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:i.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:i.id})}return l}function xa(e,n,t=[],o={},r=!1){let s=new vr,a=yf(e,n,s),l=new Set;for(let A of a.computedLoads.values())for(let k of A)if(k.seedable)for(let h of k.candidateRels)l.add(h);let i=new Map;for(let A of e.sourceFiles){let k=e.toRel(A.fileName);if(k===null||!l.has(k)||k.split("/").includes("node_modules"))continue;let h=Yf(k,A);h.length>0&&i.set(k,h)}let d=i.size===0?a.modules:a.modules.map(A=>i.has(A.path)&&!A.isEntrypoint?{...A,isEntrypoint:!0}:A),u={...a,modules:d},p=np(e,u,s,i,o),f=Bf(e,a,p.functions,p.mintSeedAliases),m=new Set(a.modules.map(A=>A.path)),g=bf(e.depReach,s,m),y=[...u.modules,...g.modules,...s.modules()],b=ip(e,t,y,p.callEdges,s),x=[];if(r){let A="#default",k=new Set;for(let S of p.callEdges){let _=String(S.calleeFunctionId);!_.startsWith("pkg:")||!_.endsWith(A)||k.add(_.slice(4,_.length-A.length))}let h=new Map;for(let S of e.depReach.edges){if(!("surface"in S.from)||"surface"in S.to)continue;let _=S.from.surface;h.set(_,h.has(_)?null:S.to.module)}for(let S of k){let _=h.get(S);if(_==null)continue;let P=xf(Ue.join(e.appRoot,_));if(P===null||P==="default")continue;let v=s.exportFor(S,P),T=`pkg:${S}${A}`;for(let N of p.callEdges)String(N.calleeFunctionId)===T&&x.push({callSiteId:N.callSiteId,calleeFunctionId:v,resolution:"field-based"})}}let I={modules:[...u.modules,...g.modules,...b.modules,...s.modules()],exports:[...p.exports,...f.exports],imports:[...a.imports,...g.imports,...b.imports],functions:[...p.functions,...s.functions(),...b.functions],callSites:[...p.callSites,...b.callSites],classes:[...p.classes,...s.classes(),...b.classes],callEdges:[...p.callEdges,...b.callEdges,...x],importEdges:[...a.importEdges,...g.importEdges,...b.importEdges],exportBindings:[...p.exportBindings,...f.exportBindings],inheritEdges:[]},w=new Map;for(let A of e.sourceFiles){let k=e.toRel(A.fileName);k!==null&&w.set(k,A)}return{graph:I,diagnostics:[...f.diagnostics,...b.diagnostics,...ap(I,w,new Set(e.diagnostics.filter(A=>A.code==="dependency-body").map(A=>A.path)),a.appOwnedPaths)],loadSites:a.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var lp=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,bo=/^[A-Za-z0-9_$.-]{1,128}$/u;function dp(e){return lp.test(e.calleePackage)?bo.test(e.anchorExport)?bo.test(e.calleeExport)?e.anchorContainer!==null&&!bo.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!bo.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function _t(e,n){let t=[],o=[],r=new Map(e.modules.map(d=>[d.id,d])),s=new Map(e.classes.map(d=>[d.id,d.name])),a=(d,u,p)=>e.functions.some(f=>{if(f.name!==u)return!1;let m=r.get(f.moduleId);return m===void 0||m.packageName!==d?!1:(f.enclosingClassId!==void 0?s.get(f.enclosingClassId)??null:null)===p}),l=(d,u,p)=>{for(let f of e.functions){if(f.name!==u)continue;let m=r.get(f.moduleId);if(!(m===void 0||m.packageName!==d||(f.enclosingClassId!==void 0?s.get(f.enclosingClassId)??null:null)!==p))return f.id}return null},i=[...n].sort((d,u)=>d.modelId<u.modelId?-1:d.modelId>u.modelId?1:0);for(let d of i){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=d.edges.map(dp).find(m=>m!==null);if(u!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let p=0,f=0;for(let m of d.edges){if(!a(d.packageName,m.anchorExport,m.anchorContainer)){f+=1;continue}o.push({modelId:d.modelId,kind:m.kind,anchor:{packageName:d.packageName,exportName:m.anchorExport,container:m.anchorContainer},callee:{packageName:m.calleePackage,exportName:m.calleeExport,container:m.calleeContainer,realFunctionId:l(m.calleePackage,m.calleeExport,m.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${d.modelId}: ${String(p)} edge(s) lowered, ${String(f)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(f)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:o,notes:t}}}var cp={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Tr(e){try{let n=Ui(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(l=>l.split(Xe.sep).join("/"))),{graph:o,diagnostics:r,loadSites:s,bindingApplicability:a}=xa(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:o,diagnostics:[...n.diagnostics,...r],loadSites:s,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...a!==void 0?{bindingApplicability:a}:{}}}catch(n){return{graph:cp,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Sa(e,n){let t=512,o=(r,s,a)=>{if(!(t<=0||s>12)){if(t-=1,typeof r=="string"){n(r,a);return}if(Array.isArray(r)){for(let l of r)o(l,s+1,a);return}if(r!==null&&typeof r=="object")for(let[l,i]of Object.entries(r))l==="types"||l==="typings"||o(i,s+1,a||l.includes("*"))}};o(e,0,!1)}function wa(e,n,t,o=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=kn(Xe.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||o&&!cn(r)?null:r===e?"":r.slice(n.length).split(Xe.sep).join("/")}var up=1024*1024,fp=4096;function ba(e,n){let t=e.toLowerCase(),o=0;for(;;){let r=t.indexOf(n,o);if(r===-1)return null;let s=r===0?" ":t[r-1],a=r+n.length;for(;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
+}`,E.ScriptTarget.Latest,!0),r=o.parseDiagnostics;if(r!==void 0&&r.length>0||qu(o,n+1,!0))return!0}return!1}function qu(e,n=0,t=!1){return Sr(e,n,t).size>0}function Sr(e,n=0,t=!1){let o=new Set,r=t?Mu:Ku(e);if(r.saturated)return o.add("saturated"),o;let s=l=>E.isElementAccessExpression(l)&&!E.isStringLiteralLike(l.argumentExpression)&&ho(Ne(l.expression),r),a=l=>{if(t&&(E.isCallExpression(l)||E.isNewExpression(l)||E.isTaggedTemplateExpression(l))){o.add("eval-invocation");return}if(E.isCallExpression(l)){let i=Nt(l);if(i!==null){let d=i.specifierArg;if(d===void 0||!E.isStringLiteralLike(d)||t){o.add("non-literal-load");return}}else{let d=Ne(l.expression);if(E.isIdentifier(d)&&(d.text==="eval"||d.text==="Function")){if(Bi(l.arguments,n)){o.add("eval-code");return}}else if(Uu(d)){o.add("loader-callee");return}else if(s(d)){o.add("computed-loader");return}else if(ju(l,r)){o.add("reflect-get");return}}}else if(E.isNewExpression(l)){let i=Ne(l.expression);if(E.isIdentifier(i)&&i.text==="Function"){if(Bi(l.arguments??[],n)){o.add("function-ctor");return}}else if(It(i)){o.add("ctor-chain");return}}else if(E.isIdentifier(l)&&Ru.has(l.text)&&Ou(l)){o.add("captured-loader");return}else if((E.isPropertyAccessExpression(l)||E.isElementAccessExpression(l))&&(qi(l)||It(l)||s(l))&&zi(l)){o.add("captured-member");return}else if(E.isBindingElement(l)){let i=l.propertyName??l.name,d=E.isIdentifier(i)||E.isStringLiteralLike(i)?i.text:E.isComputedPropertyName(i)&&E.isStringLiteralLike(i.expression)?i.expression.text:void 0;if(d!==void 0&&yo.has(d)){o.add("destructured-member");return}}E.forEachChild(l,a)};return a(e),o}function Yi(e,n,t){let o=new Set(Sr(t));if(Er(e)&&n.includes("<")&&n.includes("require")){let r=E.createSourceFile(e,n,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX);for(let s of Sr(r))o.add(s)}return o}function Wu(e,n,t){if(kr(e))return!0;let o=t.endsWith(Te.sep)?t:t+Te.sep,r=e.split("/"),s=n;for(;;){let a=Te.join(s,"node_modules",...r),l;try{l=zn(Te.join(a,"package.json"))}catch{l=null}if(l!==null){if(!l.startsWith(o))return!1;let d=Oe(l);if(d===null)return!1;let u;try{u=JSON.parse(d).exports}catch{return!1}if(typeof u=="string"||Array.isArray(u)||typeof u=="object"&&u!==null)return!1}if(Si(a))return!1;if(s===t)break;let i=Te.dirname(s);if(i===s||i!==t&&!i.startsWith(o))break;s=i}return!0}function Vu(e,n){let t=n.endsWith(Te.sep)?n:n+Te.sep,o=Te.dirname(e);for(;;){let r=Te.join(o,"package.json"),s;try{s=zn(r)}catch{s=null}if(s!==null&&(s===n||s.startsWith(t))){let l=Oe(s);if(l!==null)try{let i=JSON.parse(l).name;if(typeof i=="string"&&i.length>0)return i}catch{return null}}if(o===n)break;let a=Te.dirname(o);if(a===o||a!==n&&!a.startsWith(t))break;o=a}return null}function Gu(e,n,t,o,r){let s=[],a=[],l=new Set,i={},d=[],u=[],p=new Set,f=new Set,m=[],g=!1,y=(x,_)=>{let w;try{w=zn(_)}catch{return!1}let I=Fe(e,w);if(I===null)return r.push({code:"out-of-root",path:w,detail:"dependency module resolved outside the app root; not followed"}),!1;let k=!t.has(w)&&!f.has(w);return k&&f.size>=yr?(g=!0,!1):(a.push({from:x,to:{module:I}}),k?(f.add(w),s.push(I),!0):!1)},S=(x,_)=>{if(l.add(_),p.has(_))return;p.add(_);let w=Xe(_,x,Me,n),I=w!==null?[w]:rt(_,x,Me,n);I.length>=2&&d.push({path:Fe(e,x)??x,specifier:_,candidates:I.map(h=>Fe(e,h)??h)});let k=!1;for(let h of I)if(!Ue(h)&&(k=!0,y({surface:_},h))){m.push(h);try{let b=Fe(e,zn(h)),A=Vu(h,e);b!==null&&A!==null&&(i[b]=A)}catch{}}k||Wu(_,Te.dirname(x),e)||r.push({code:"unresolved-specifier",path:_,reason:wt(_,x,Me,n),detail:`dependency "${_}" is installed and Node loads an entry for it, but its runtime entry did not resolve here (divergent conditional exports / a typesVersions remap / a declaration-only surface / an unreadable manifest / an out-of-root install); its module was not analyzed (degraded to unbounded)`})};for(let x of o)S(x.containingFile,x.packageName);for(;m.length>0&&f.size<yr;){let x=m.pop();if(x===void 0)break;let _=Fe(e,x);if(_===null)continue;let w=ot(x,In);if(w.kind==="too-large"){r.push({code:"limit-exceeded",path:_,detail:`dependency module over the ${String(In/1048576)}MiB cap; its imports were not followed (degraded to unbounded)`});continue}if(w.kind==="not-regular"){r.push({code:"parse-error",path:_,detail:"dependency module unreadable or not a regular file; its imports were not followed (degraded to unbounded)"});continue}let I=E.createSourceFile(x,w.text,E.ScriptTarget.ES2020,!0),k=I.parseDiagnostics;if(k!==void 0&&k.length>0){r.push({code:"dependency-body",path:_,detail:"dependency module has syntax errors; its tolerant parse may have dropped import/loader nodes \u2014 module reach unbounded (ADR-050 2A parse-cap)"});continue}let h=Yi(x,w.text,I);if(h.size>0){r.push({code:"dependency-body",path:_,detail:"dependency module contains a loader escape (eval / Function / reflective or non-literal loader / captured loader value); its module reach is unbounded (ADR-045 Attack #1 dep-side mirror)",escapes:[...h].sort()});continue}r.push({code:"dependency-body",path:_,detail:"dependency module followed at module-import granularity only; its function bodies are not analyzed (ADR-050 2A, bodyless)",anchor:_});for(let b of Ki(x,w.text))if(b.runtime)if(ve(b.text)==="package-root"){let A=He(b.text);a.push({from:{module:_},to:{surface:A}}),S(x,A)}else{if(kr(He(b.text)))continue;let A=Xe(b.text,x,Me,n),P=A!==null?[A]:rt(b.text,x,Me,n);if(P.length===0){if(ve(b.text)==="package-subpath"){let v=wt(b.text,x,Me,n);if(v==="no-candidate"||v==="not-installed"&&vi(x,He(b.text))){u.push({path:_,specifier:b.text,why:v});continue}r.push({code:"unresolved-specifier",path:_,reason:v,detail:`runtime package-subpath import "${b.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`})}continue}P.length>=2&&d.push({path:_,specifier:b.text,candidates:P.map(v=>Fe(e,v)??v)});for(let v of P){if(Ue(v)){let T=Fe(e,v);r.push({code:T===null?"out-of-root":"declaration-shadow",path:_,detail:T===null?`runtime import "${b.text}" resolved outside the app root; its module was not analyzed`:`runtime import "${b.text}" resolved to the declaration file "${T}" with no co-located runtime module; its code was not analyzed`});continue}y({module:_},v)&&m.push(v)}}}return(g||m.length>0)&&r.push({code:"limit-exceeded",path:e,detail:`dependency module closure hit the ${String(yr)} cap; module-reachability truncated (degraded to unbounded)`}),{modules:s,edges:a,surfacePackages:[...l],entryRealNames:i,conditionUnions:d,provenAbsent:u}}function Ji(e,n,t=!1){let o=zn(e),r=[],s=[],a=E.createCompilerHost(Me,!0),l=t?_i(o,Me,a):()=>null,i=new Set,d=new Set,u=n.map(N=>Te.join(o,N)),p=[],f=new Map,m=new Map,g=new Map,y=new Map,S=new Set,x=(N,j,$)=>{let D=`${String(N.length)}:${N}${j}`;S.has(D)||(S.add(D),r.push({code:"unresolved-specifier",path:N,detail:j,reason:$}))},_=()=>null,w=0,I=(N,j)=>{let $=m.get(N);return $===void 0&&($=E.createSourceFile(N,j,E.ScriptTarget.ES2020,!0),m.set(N,$)),{real:N,sf:$}};for(;d.size<po;){let N=u.pop();if(N===void 0){if(w>=Nu)break;w+=1;let K=[];for(let[L,O]of f)O.includes("readdir")&&(O.includes("require")||O.includes("import("))&&K.push(I(L,O));let te=Au(K);if(te.length===0)break;let B=[];for(let[L,O]of f)B.push(I(L,O));_=Di(B,te,Me,a,g);let Y=!1;for(let L of K){let O=f.get(L.real);if(O!==void 0)for(let X of ji(L.real,O,o,a,_))d.has(X)||(u.push(X),Y=!0)}if(!Y)break;continue}let j;try{j=zn(N)}catch{continue}if(d.has(j))continue;if(d.add(j),Fe(o,j)===null){r.push({code:"out-of-root",path:N,detail:"resolved outside app root"});continue}let $=ot(j,In);if($.kind==="too-large"){r.push({code:"limit-exceeded",path:j,detail:`file is ${String(Math.round($.bytes/1048576))}MiB, over the ${String(In/1048576)}MiB per-file cap; skipped (degraded to unknown)`});continue}if($.kind==="not-regular"){r.push({code:"parse-error",path:j,detail:"unreadable or not a regular file"});continue}let D=$.text;i.add(j),f.set(j,D);for(let K of Ki(j,D)){let te=K.runtime?l(K.text,j):null;if(te===null&&ve(K.text)==="package-root"){K.runtime&&p.push({containingFile:j,packageName:He(K.text)});continue}let B=te??Xe(K.text,j,Me,a),Y=B!==null?[B]:K.runtime&&te===null?rt(K.text,j,Me,a):[];if(Y.length===0){if(K.runtime){let L=ve(K.text);if(!(L==="package-subpath"&&kr(He(K.text)))){if(L==="package-subpath")x(j,`runtime package-subpath import "${K.text}" did not resolve under Node10 (an exports-map/typesVersions subpath Node may load); its module was not analyzed`,wt(K.text,j,Me,a));else if(L==="relative"){let O=Ei(K.text,j,o,y);O.kind==="unanalyzable"&&x(j,`runtime relative import "${K.text}" did not resolve and its absence could not be proven \u2014 ${O.reason}; a bundler/loader may load a module the analyzer never saw`,O.why)}}}continue}Y.length>=2&&s.push({path:Fe(o,j)??j,specifier:K.text,candidates:Y.map(L=>Fe(o,L)??L)});for(let L of Y){if(Fe(o,L)===null){r.push({code:"out-of-root",path:L,detail:`specifier "${K.text}" resolved outside app root`});continue}if(K.runtime&&Ue(L)){r.push({code:"declaration-shadow",path:L,detail:`runtime import "${K.text}" resolved to a declaration file with no co-located runtime module; its code was not analyzed`});continue}if(K.runtime&&!ao(L)){r.push({code:"unanalyzable-module",path:L,detail:`runtime import "${K.text}" resolved to a file the analyzer cannot parse (extensionless/.json/.node); its module was not analyzed`});continue}u.push(L)}}for(let K of ji(j,D,o,a,_))d.has(K)||u.push(K)}d.size>=po&&u.length>0&&r.push({code:"limit-exceeded",path:o,detail:`reachable file set exceeds ${String(po)}; analysis truncated (${String(u.length)}+ files not analyzed)`});let k=Gu(o,a,i,p,r),h=E.createProgram({rootNames:[...i],options:Me,host:a}),b=new Set,A=new Map;for(let N of h.getSourceFiles()){if(N.isDeclarationFile||h.isSourceFileDefaultLibrary(N)||Fe(o,N.fileName)===null||!Er(N.fileName))continue;let j=h.getSyntacticDiagnostics(N).length>0;if(!j&&!N.text.includes("<")||Iu(N.text,E.ScriptKind.TSX)!==0)continue;let $=E.createSourceFile(N.fileName,N.text,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX);(j||Fi($)>Fi(N))&&(b.add(N.fileName),A.set(N.fileName,N.text))}let P=h;if(b.size>0){let N=a.getSourceFile.bind(a);a.getSourceFile=(j,$,D,K)=>{let te=A.get(j);return te!==void 0?E.createSourceFile(j,te,E.ScriptTarget.ES2020,!0,E.ScriptKind.TSX):N(j,$,D,K)},P=E.createProgram({rootNames:[...i],options:Me,host:a,oldProgram:h})}let v=P.getTypeChecker(),T=[];for(let N of P.getSourceFiles()){if(N.isDeclarationFile||P.isSourceFileDefaultLibrary(N)||Fe(o,N.fileName)===null)continue;T.push(N);let j=P.getSyntacticDiagnostics(N);if(j.length>0){let K=j[0],te=K!==void 0?E.flattenDiagnosticMessageText(K.messageText," "):"syntax error";r.push({code:"parse-error",path:N.fileName,detail:`${String(j.length)} syntax error(s): ${te}`})}let $=Fe(o,N.fileName),D=$===null?null:Yi(N.fileName,N.text,N);$!==null&&D!==null&&D.size>0&&r.push({code:"loader-escape",path:$,detail:"module contains a loader escape (eval / Function / reflective or non-literal loader / captured or destructured loader); its module reach is unbounded (ADR-050 2B)",escapes:[...D].sort()})}return{program:P,checker:v,host:a,options:Me,appRoot:o,sourceFiles:T,diagnostics:r,depReach:k,conditionUnions:[...s,...k.conditionUnions],provenAbsent:k.provenAbsent,resolveParamDirs:_,toRel:N=>Fe(o,N)}}import{opendirSync as Hu,statSync as Xu}from"node:fs";import wr from"node:path";var Yu=8192,Ju=2e4,Zu=new Set(["node_modules"]),Zi=new Set(["test","tests","__tests__","__mocks__","fixtures","e2e","dist","build","out","coverage","vendor"]),Qu=16;function xo(e,n,t,o,r={}){let s=r.maxEntries??Ju,a=r.prune,l=[],i=!1,d=0,u=[{dir:wr.join(e,n),rel:n,depth:0}];for(;u.length>0;){let p=u.pop();if(p===void 0)break;if(p.depth>Qu){i=!0;continue}let f;try{f=Hu(p.dir)}catch{i=!0;continue}try{let m=0;for(;;){let g=f.readSync();if(g===null)break;if(m+=1,d+=1,m>Yu||d>s){i=!0;break}let y=p.rel+g.name;if(g.isSymbolicLink()){let S;try{S=Xu(wr.join(p.dir,g.name)).isDirectory()}catch{i=!0;continue}if(S){i=!0;continue}}else if(g.isDirectory()){if(Zu.has(g.name)||g.name.startsWith(".")||a?.has(g.name)===!0){i=!0;continue}u.push({dir:wr.join(p.dir,g.name),rel:`${y}/`,depth:p.depth+1});continue}else if(!g.isFile())continue;if(t(y)){if(l.length>=o){i=!0;break}l.push(y)}}}finally{try{f.closeSync()}catch{}}}return{matches:l,truncated:i}}var ef=64;function Qi(e,n){let t=n.indexOf("*");if(t===-1||n.indexOf("*",t+1)!==-1)return null;let o=n.slice(0,t),r=n.slice(t+1);if(o.startsWith("./")&&(o=o.slice(2)),o.startsWith("/")||r.includes("/")||o.split("/").includes("..")||o.includes("\\")||n.includes("\0"))return null;let s=o.slice(0,o.lastIndexOf("/")+1);return xo(e,s,a=>a.length>=o.length+r.length&&a.startsWith(o)&&a.endsWith(r),ef)}import{existsSync as nf}from"node:fs";import tf from"node:path";var of=[{name:"Astro",dependency:"astro",configFiles:["astro.config.mjs","astro.config.js","astro.config.ts","astro.config.mts"],entryHint:"your route files under src/pages/",rootDirs:["pages","actions"]},{name:"Next.js",dependency:"next",configFiles:["next.config.js","next.config.mjs","next.config.ts","next.config.cjs"],entryHint:"your route files under app/ or pages/",rootDirs:["app","pages"]},{name:"SvelteKit",dependency:"@sveltejs/kit",configFiles:["svelte.config.js","svelte.config.mjs","svelte.config.ts"],entryHint:"your route files under src/routes/",rootDirs:["routes"]},{name:"Nuxt",dependency:"nuxt",configFiles:["nuxt.config.js","nuxt.config.mjs","nuxt.config.ts"],entryHint:"app.vue, or your route files under pages/",rootDirs:["server","pages","middleware","plugins"]},{name:"Remix",dependency:"@remix-run/dev",configFiles:["remix.config.js","remix.config.mjs","vite.config.js","vite.config.ts"],entryHint:"app/root.tsx, or your route files under app/routes/",rootDirs:["app","routes"]},{name:"Vite",dependency:"vite",configFiles:["vite.config.js","vite.config.ts","vite.config.mjs","vite.config.mts"],entryHint:"the module script your index.html loads",rootDirs:[]}],rf=["dependencies","devDependencies"];function sf(e,n){for(let t of rf){let o=e[t];if(!(typeof o!="object"||o===null||Array.isArray(o))&&Object.hasOwn(o,n))return!0}return!1}function vr(e,n){if(n===null)return null;for(let t of of)if(sf(n,t.dependency)){for(let o of t.configFiles)if(nf(tf.join(e,o)))return{name:t.name,configFile:o,entryHint:t.entryHint,rootDirs:t.rootDirs}}return null}function _r(e){return`This looks like ${e.name} (${e.configFile} plus the dependency), and ${e.name} resolves its entry at build time \u2014 there is nothing in package.json for cupel to start from. Pass --entry ${e.entryHint}.`}var af=[".ts",".tsx",".mts",".cts",".js",".jsx",".mjs",".cjs"],lf=256,df=12e4;function Ir(e,n){let t=new Set(n.rootDirs);if(t.size===0)return{roots:[],truncated:!1};let o=xo(e,"",r=>{let s=r.split("/");for(let a=0;a<s.length-1;a+=1){let l=s[a];if(l!==void 0&&t.has(l))return af.some(i=>r.endsWith(i))}return!1},lf,{maxEntries:df,prune:Zi});return{roots:o.matches,truncated:o.truncated}}function Ye(e){let n=e.length<=120?e:`${e.slice(0,120)}\u2026`,t="";for(let o of n){let r=o.codePointAt(0)??0;t+=r<32||r>=127&&r<=159?`\\x${r.toString(16).padStart(2,"0")}`:o}return t}function cf(e){for(let n of e){let t=n.codePointAt(0)??0;if(t<32||t===127||t>=128&&t<=159||"&|;<>$`(){}[]*?~#!\\\"'".includes(n))return!0}return!1}function uf(e){let n=!1;for(let t=0;t<e.length;t+=1){let o=e.charAt(t),r=o.codePointAt(0)??0;if(r<32||r===127||r>=128&&r<=159)return null;if(o==="\\"){n=!0;let s=e.charAt(t+1);if(!(s>="a"&&s<="z"||s>="A"&&s<="Z"||s>="0"&&s<="9"||s==="."||s==="_"||s==="-"))return null;continue}if("&|;<>$`(){}[]*?~#!\"'".includes(o))return null}return n?{windows:e.split("\\").join("/"),posixShell:e.split("\\").join("")}:null}function ff(e){let n=[],t="";for(let o of e){if(o===" "||o==="	"){if(t.length>0){if(n.length>=64)return null;n.push(t),t=""}continue}t+=o}if(t.length>0){if(n.length>=64)return null;n.push(t)}return n}var pf=/^[A-Za-z_][A-Za-z0-9_]*=/u;function mf(e){let n=e.slice(e.lastIndexOf("/")+1);return n==="node"||n==="nodejs"}var ea=new Set(["flask","granian","gunicorn","hypercorn","php","php-fpm","puma","python","python2","python3","rails","ruby","streamlit","unicorn","uvicorn","uwsgi","waitress-serve"]);function hf(e){let n=e.slice(e.lastIndexOf("/")+1);return ea.has(n)||ea.has(n.replace(/[0-9.]+$/u,""))}var gf=new Set(["--abort-on-uncaught-exception","--disallow-code-generation-from-strings","--enable-source-maps","--experimental-json-modules","--experimental-modules","--experimental-vm-modules","--frozen-intrinsics","--harmony","--inspect","--inspect-brk","--no-warnings","--preserve-symlinks","--preserve-symlinks-main","--trace-uncaught","--trace-warnings","--use-strict","--zero-fill-buffers"]),yf=new Set(["--dns-result-order","--heapsnapshot-signal","--inspect-port","--max-http-header-size","--max-old-space-size","--max-semi-space-size","--stack-size","--title","--tls-cipher-list","--trace-event-categories","--unhandled-rejections","--v8-pool-size"]),xf=new Set(["-e","--eval","-p","--print","--run","--env-file","--env-file-if-exists"]);function ta(e){return e.includes("require")||e.includes("import")||e.includes("loader")}function na(e){if(ta(e))return{token:e,why:"preloads another module; the launch surface is more than one file"};let n=e.indexOf("="),t=n===-1?e:e.slice(0,n);return xf.has(t)?{token:t,why:"runs code that is not the script token (or can inject a preload); the entry file cannot be identified"}:gf.has(t)||n!==-1&&yf.has(t)?null:{token:t,why:"is not on cupel's allowlist of flags that provably do not change which file node runs \u2014 the entry file cannot be identified with certainty"}}var bf=[".js",".cjs",".mjs",".ts",".mts",".cts"];function Sf(e){return bf.some(n=>e.endsWith(n))}var kf=new Set(["npm","yarn","pnpm"]);function Ef(e){let n=e[0];return n===void 0||!kf.has(n)?!1:e.length===2?e[1]==="start":e.length===3&&e[1]==="run"&&e[2]==="start"}function Nr(e){let n=e.trim();if(n.length===0)return{kind:"unparsed",reason:"empty command"};if(n.length>4096)return{kind:"unparsed",reason:`command exceeds the ${String(4096)}-byte cap; not parsed`};if(!cf(n))return Ar(n);let t=uf(n);if(t===null)return{kind:"unparsed",reason:"contains shell metacharacters (chaining/expansion/quoting) \u2014 not a plain `node <file>` invocation"};let o=Ar(t.windows),r=Ar(t.posixShell);if(o.kind==="file"){let s=r.kind==="file"?r.specifier:void 0;return s===void 0||s===o.specifier?{kind:"file",specifier:o.specifier}:{kind:"file",specifier:o.specifier,alt:s}}return r.kind==="file"?{kind:"file",specifier:r.specifier}:o}function Ar(e){let n=ff(e);if(n===null)return{kind:"unparsed",reason:"command has more tokens than cupel will consider"};let t=0;for(n[t]==="env"&&(t+=1);t<n.length;t+=1){let s=n[t];if(s===void 0||!pf.test(s))break;if(ta(s))return{kind:"unparsed",reason:`environment \`${Ye(s)}\` preloads another module; the launch surface is more than one file`};let a=s.indexOf("=");if(s.slice(0,a)==="NODE_OPTIONS")for(let l of s.slice(a+1).split(/\s+/u)){if(l===""||!l.startsWith("-"))continue;let i=na(l);if(i!==null)return{kind:"unparsed",reason:`NODE_OPTIONS flag \`${Ye(i.token)}\` ${i.why}`}}}let o=n[t];if(o===void 0)return{kind:"unparsed",reason:"no program in the command"};if(Ef(n.slice(t)))return{kind:"delegates",target:"scripts.start"};if(!mf(o))return hf(o)?{kind:"foreign",binary:o}:{kind:"unparsed",reason:`runs \`${Ye(o)}\`, not node directly \u2014 the entry file cannot be identified`};for(t+=1;t<n.length;t+=1){let s=n[t];if(s===void 0||!s.startsWith("-"))break;let a=na(s);if(a!==null)return{kind:"unparsed",reason:`node flag \`${Ye(a.token)}\` ${a.why}`}}let r=n[t];return r===void 0?{kind:"unparsed",reason:"node is invoked with no script file"}:Sf(r)?{kind:"file",specifier:r}:{kind:"unparsed",reason:`\`${Ye(r)}\` has no .js/.cjs/.mjs/.ts extension \u2014 not confidently a JS entry file`}}function wf(e){for(let n of e)if(!(n>="a"&&n<="z"||n>="A"&&n<="Z"||n>="0"&&n<="9"||n==="_"||n==="-"))return!1;return e.length>0}var vf=64,Rr=64*1024,_f=64;function Pr(e){let n=[],t=!1;for(let o of e.split(/\r?\n/u)){if(n.length>=_f){t=!0;break}let r=/^\s*(CMD|ENTRYPOINT)\s+(.*\S)\s*$/iu.exec(o),s=/^\s*(command|entrypoint):\s*(.*\S)\s*$/u.exec(o),a=r??s;if(a?.[1]===void 0||a[2]===void 0)continue;let l=If(a[2]);l!==null&&n.push({label:a[1].toUpperCase(),command:l})}return{commands:n,truncated:t}}function If(e){let n=e.trim();if(!n.startsWith("["))return n===""?null:n;let t;try{t=JSON.parse(n)}catch{return null}if(!Array.isArray(t))return null;let o=t.filter(r=>typeof r=="string");return o.length===0||o.length!==t.length?null:o.join(" ")}function $r(e){let n=e.split(`
+`),t=n.length>64,o=[],r=0;for(let s of n.slice(0,64)){let a=s.trim();if(a.length===0||a.startsWith("#"))continue;let l=a.indexOf(":");if(l<=0)continue;let i=a.slice(l+1).trim();if(i.length===0)continue;let d=a.slice(0,l);if(d.length>vf||!wf(d)){r+=1;continue}o.push({name:d,command:i})}return o.sort((s,a)=>s.name===a.name?0:s.name==="web"?-1:a.name==="web"?1:0),{entries:o,truncated:t,unnamedLines:r}}import{realpathSync as oa}from"node:fs";import qe from"node:path";import c from"typescript";var ra=3;function ge(e,n,t){if(e===void 0)return;let o=e[n]??={fired:0,refused:{}};t===null?o.fired+=1:o.refused[t]=(o.refused[t]??0)+1}function Rn(e,n,t){return{path:e,start:n.getStart(t,!1),end:n.getEnd()}}var So=16,Tr=256,Cr=class{mods=new Map;fns=new Map;classNodes=new Map;classMembers=new Map;moduleFor(n){let t=`pkg:${n}`;return this.mods.has(n)||this.mods.set(n,{id:t,packageName:n,versionRange:"",path:n,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0}),t}exportFor(n,t){let o=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.fns.has(o)||(this.moduleFor(n),this.fns.set(o,{id:r,moduleId:`pkg:${n}`,name:t,kind:"function",declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0})),r}classFor(n,t){let o=`${n}#${t}`,r=`pkg:${n}#${t}`;return this.classNodes.has(o)||(this.moduleFor(n),this.classNodes.set(o,{id:r,moduleId:`pkg:${n}`,name:t,implementsRefs:[],members:[]}),this.classMembers.set(o,[])),r}methodFor(n,t,o,r){let s=`${n}#${t}.${o}`,a=`pkg:${n}#${t}.${o}`;if(!this.fns.has(s)){let l=this.classFor(n,t);this.fns.set(s,{id:a,moduleId:`pkg:${n}`,name:o,kind:r,enclosingClassId:l,declRange:{path:n,start:0,end:0},isExported:!0,publicSurfaceReachable:!0}),this.classMembers.get(`${n}#${t}`)?.push(a)}return a}modules(){return[...this.mods.values()]}functions(){return[...this.fns.values()]}classes(){return[...this.classNodes.entries()].map(([n,t])=>({...t,members:this.classMembers.get(n)??[]}))}};function pa(e,n){let t="node_modules/",o=e.lastIndexOf(t);if(o===-1)return n;let s=e.slice(o+t.length).split("/");return s[0]?.startsWith("@")&&s.length>=2?`${s[0]}/${s[1]}`:s[0]??n}function sa(e,n,t){let o=qe.dirname(e),r=qe.dirname(n),s=[];for(;;){let l=t.get(o);if(l!==void 0){for(let d of s)t.set(d,l);return l}s.push(o);let i=Oe(qe.join(o,"package.json"));if(i!==null)try{let d=JSON.parse(i),u={name:d.name??"app",version:d.version??"0.0.0",dir:o};for(let p of s)t.set(p,u);return u}catch{}if(o===r||o===qe.dirname(o))break;o=qe.dirname(o)}let a={name:"app",version:"0.0.0",dir:null};for(let l of s)t.set(l,a);return a}function Or(e){return c.isParenthesizedExpression(e)?Or(e.expression):c.isStringLiteralLike(e)?e.text:c.isTemplateExpression(e)?e.head.text:c.isBinaryExpression(e)&&e.operatorToken.kind===c.SyntaxKind.PlusToken?Or(e.left):null}function Af(e){if(!c.isCallExpression(e))return!1;let n=e.expression,t=c.isPropertyAccessExpression(n)?n.name.text:c.isIdentifier(n)?n.text:null;if(t!=="join"&&t!=="resolve")return!1;let o=e.arguments[0];return o!==void 0&&c.isIdentifier(o)&&(o.text==="__dirname"||o.text==="__filename")}function ma(e){let n=Or(e);return n!==null?n.startsWith("./")||n.startsWith("../")?"relative-bounded":n.length>0&&!n.startsWith(".")&&!n.startsWith("/")?"bare":"unknown":Af(e)?"relative-bounded":"unknown"}function Nf(e){let n=[],t=o=>{if(c.isImportDeclaration(o)&&c.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isImportEqualsDeclaration(o)&&c.isExternalModuleReference(o.moduleReference)&&c.isStringLiteralLike(o.moduleReference.expression))n.push({specifier:o.moduleReference.expression.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isExportDeclaration(o)&&o.moduleSpecifier!==void 0&&c.isStringLiteralLike(o.moduleSpecifier))n.push({specifier:o.moduleSpecifier.text,specifierIsLiteral:!0,dynamic:!1});else if(c.isCallExpression(o)){let r=Nt(o);if(r!==null){let s=r.specifierArg,a=s!==void 0&&c.isStringLiteralLike(s);n.push({specifier:a?s.text:void 0,specifierIsLiteral:a,dynamic:!0,...s!==void 0&&!a?{computedArg:s,loadPos:o.getStart(e)}:{}})}}c.forEachChild(o,t)};return t(e),n}function Rf(e,n,t){let o=new Map,r=sa(qe.join(e.appRoot,"package.json"),e.appRoot,o),s=[],a=[],l=[],i=new Map,d=new Set,u=[],p=new Set;for(let f of e.sourceFiles){let m=e.toRel(f.fileName);m!==null&&p.add(m)}for(let f of e.sourceFiles){let m=e.toRel(f.fileName);if(m===null)continue;let g=sa(f.fileName,e.appRoot,o),y=pa(m,r.name),S=m.includes("node_modules/");s.push({id:m,packageName:S&&g.name!==r.name?g.name:y,versionRange:g.version,path:m,moduleSystem:"cjs",isEntrypoint:n.has(m)}),g.dir===r.dir&&d.add(m);let x=0,_=null;for(let w of Nf(f)){let I=`${m}#import${String(x)}`;x+=1;let k=null,h=[];if(w.specifier!==void 0)if(ve(w.specifier)==="package-root")k=t.moduleFor(He(w.specifier));else{let b=Xe(w.specifier,f.fileName,e.options,e.host),A=b!==null?e.toRel(b):null;if(A!==null)k=A;else if(w.specifier!==void 0){let[P,...v]=rt(w.specifier,f.fileName,e.options,e.host).map(T=>e.toRel(T)).filter(T=>T!==null&&p.has(T));P!==void 0&&v.length>=1&&(k=P,h=v.map(T=>T))}}a.push({id:I,moduleId:m,specifier:w.specifier??"<computed>",isNamespace:!1,isDefault:!1,dynamic:w.dynamic,specifierIsLiteral:w.specifierIsLiteral,...k!==null?{resolvedModuleId:k}:{}}),k!==null&&l.push({importId:I,resolvedModuleId:k});for(let b of h)l.push({importId:I,resolvedModuleId:b});if(w.computedArg!==void 0&&w.loadPos!==void 0&&u.push({importId:String(I),path:m,pos:w.loadPos,shape:ma(w.computedArg),text:w.computedArg.getText(f).slice(0,160)}),w.computedArg!==void 0&&w.loadPos!==void 0){_??=Un(f,f.fileName,e.resolveParamDirs);let b=[];for(let A of uo(w.computedArg,_,e.appRoot,e.options,e.host)){let P=e.toRel(A);if(P===null||!p.has(P))continue;let v=P,T=`${m}#import${String(x)}`;x+=1,a.push({id:T,moduleId:m,specifier:P,isNamespace:!1,isDefault:!1,dynamic:!0,specifierIsLiteral:!0,resolvedModuleId:v}),l.push({importId:T,resolvedModuleId:v}),b.push(P)}if(b.length>0){let A=_t(w.computedArg,_)!==null||co(w.computedArg),P=i.get(m)??[];P.push({pos:w.loadPos,candidateRels:b,seedable:A}),i.set(m,P)}}}}return{modules:s,imports:a,importEdges:l,computedLoads:i,appOwnedPaths:d,loadSites:u}}function Pf(e){let n=Oe(e);if(n===null)return null;let t=c.createSourceFile(e,n,c.ScriptTarget.Latest,!0),o=r=>t.statements.some(s=>c.isFunctionDeclaration(s)?s.name?.text===r:c.isVariableStatement(s)?s.declarationList.declarations.some(a=>c.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&(c.isFunctionExpression(a.initializer)||c.isArrowFunction(a.initializer))):!1);for(let r of t.statements){if(c.isFunctionDeclaration(r)&&r.name!==void 0&&r.modifiers?.some(a=>a.kind===c.SyntaxKind.DefaultKeyword)===!0)return r.name.text;if(!c.isExpressionStatement(r)||!c.isBinaryExpression(r.expression))continue;let s=r.expression;if(s.operatorToken.kind===c.SyntaxKind.EqualsToken&&$f(s.left)){if(c.isFunctionExpression(s.right)&&s.right.name!==void 0)return s.right.name.text;if(c.isIdentifier(s.right)&&o(s.right.text))return s.right.text}}return null}function $f(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function Cf(e,n,t){for(let d of e.surfacePackages)n.moduleFor(d);let o=d=>"surface"in d?n.moduleFor(d.surface):d.module,r=[],s=new Set;for(let d of e.modules)t.has(d)||s.has(d)||(s.add(d),r.push({id:d,packageName:e.entryRealNames[d]??pa(d,"app"),versionRange:"",path:d,moduleSystem:"cjs",isEntrypoint:!1}));let a=[],l=[],i=0;for(let d of e.edges){let u=o(d.from),p=o(d.to),f=`${String(u)}#depreach${String(i)}`;i+=1,a.push({id:f,moduleId:u,specifier:"<dep-module-reach>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:p}),l.push({importId:f,resolvedModuleId:p})}return{modules:r,imports:a,importEdges:l}}function ia(e,n,t){let o=e.expression;if(c.isIdentifier(o)&&!t.has(o.text)){let r=n.get(o.text);if(r?.kind==="package-export")return{kind:"package-instance",packageName:r.packageName,className:r.exportName};if(r?.kind==="app-class")return{kind:"app-instance",cls:r.cls}}else if(c.isPropertyAccessExpression(o)&&c.isIdentifier(o.expression)&&!t.has(o.expression.text)){let r=n.get(o.expression.text);if(r?.kind==="package-surface")return{kind:"package-instance",packageName:r.packageName,className:o.name.text}}return null}function qn(e){return c.canHaveModifiers(e)&&(c.getModifiers(e)?.some(n=>n.kind===c.SyntaxKind.ExportKeyword)??!1)}function Of(e){let n=new Set,t;for(let o of e.statements){if(c.isExpressionStatement(o)&&c.isBinaryExpression(o.expression)){let r=o.expression;if(r.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(r.left)&&c.isIdentifier(r.left.expression)&&r.left.expression.text==="module"&&r.left.name.text==="exports"){if(c.isIdentifier(r.right))n.add(r.right.text),t=r.right.text;else if(c.isObjectLiteralExpression(r.right))for(let s of r.right.properties)c.isShorthandPropertyAssignment(s)?n.add(s.name.text):c.isPropertyAssignment(s)&&c.isIdentifier(s.initializer)&&n.add(s.initializer.text)}continue}if(c.isFunctionDeclaration(o)&&o.name!==void 0&&qn(o))n.add(o.name.text);else if(c.isVariableStatement(o)&&qn(o))for(let r of o.declarationList.declarations)c.isIdentifier(r.name)&&n.add(r.name.text);else if(c.isExportDeclaration(o)&&o.exportClause&&c.isNamedExports(o.exportClause))for(let r of o.exportClause.elements)n.add((r.propertyName??r.name).text);else c.isExportAssignment(o)&&c.isIdentifier(o.expression)&&(n.add(o.expression.text),t=o.expression.text)}return{reachableLocals:n,defaultTarget:t}}function Mf(e){for(let n of e.statements){if(c.isFunctionDeclaration(n)&&n.name!==void 0&&qn(n)&&c.getModifiers(n)?.some(t=>t.kind===c.SyntaxKind.DefaultKeyword)===!0)return{name:n.name.text,esm:!0};if(c.isExportAssignment(n)&&!n.isExportEquals&&c.isIdentifier(n.expression))return{name:n.expression.text,esm:!0};if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)){let t=n.expression;if(t.operatorToken.kind===c.SyntaxKind.EqualsToken&&Be(t.left)&&c.isIdentifier(t.right))return{name:t.right.text,esm:!1}}}}function pn(e){if(c.isCallExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="require"&&e.arguments.length===1&&e.arguments[0]!==void 0&&c.isStringLiteralLike(e.arguments[0]))return e.arguments[0].text}function Be(e){return c.isPropertyAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&e.name.text==="exports"?!0:c.isElementAccessExpression(e)&&c.isIdentifier(e.expression)&&e.expression.text==="module"&&c.isStringLiteralLike(e.argumentExpression)&&e.argumentExpression.text==="exports"}function rn(e){if(Be(e))return!0;if(!c.isPropertyAccessExpression(e)&&!c.isElementAccessExpression(e))return!1;let n=e.expression;return c.isIdentifier(n)&&n.text==="exports"?!0:Be(n)}function at(e){return c.isPropertyAccessExpression(e.expression)&&c.isIdentifier(e.expression.expression)&&e.expression.expression.text==="Object"&&e.expression.name.text==="assign"}function ha(e){let n=!1,t=o=>{if(!n){if(c.isCallExpression(o)){let r=pn(o);if(r!==void 0&&ve(r)!=="package-root"){n=!0;return}}c.forEachChild(o,t)}};return t(e),n}function ga(e){let n=new Set,t=r=>r!==void 0&&ha(r),o=r=>{c.isVariableDeclaration(r)&&t(r.initializer)&&vt(r.name,n),c.isBinaryExpression(r)&&r.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(r.left)&&t(r.right)&&n.add(r.left.text),c.forEachChild(r,o)};return o(e),n}function ya(e,n){for(let t of e.properties)c.isShorthandPropertyAssignment(t)?n.add(t.name.text):c.isPropertyAssignment(t)&&c.isIdentifier(t.initializer)&&n.add(t.initializer.text)}function Tf(e){let n=new Set;for(let l of e.statements)if(c.isFunctionDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isClassDeclaration(l)&&l.name!==void 0)n.add(l.name.text);else if(c.isVariableStatement(l))for(let i of l.declarationList.declarations)c.isIdentifier(i.name)&&i.initializer!==void 0&&(c.isFunctionExpression(i.initializer)||c.isArrowFunction(i.initializer)||c.isObjectLiteralExpression(i.initializer))&&n.add(i.name.text);let t=l=>c.isFunctionExpression(l)||c.isArrowFunction(l)||c.isObjectLiteralExpression(l)||c.isIdentifier(l)&&n.has(l.text),o=new Set,r=l=>{c.isIdentifier(l)?o.add(l.text):c.isObjectLiteralExpression(l)&&ya(l,o)},s=!1,a=l=>{if(!s){if(c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken)if(Be(l.left)){r(l.right);let i=l.right;(c.isObjectLiteralExpression(i)?i.properties.every(u=>c.isShorthandPropertyAssignment(u)&&n.has(u.name.text)||c.isPropertyAssignment(u)&&t(u.initializer)):t(i))||(s=!0)}else rn(l.left)&&(t(l.right)||(s=!0));else(c.isCallExpression(l)&&at(l)&&l.arguments[0]!==void 0&&Wn(l.arguments[0])||c.isExportDeclaration(l)&&l.moduleSpecifier!==void 0)&&(s=!0);s||c.forEachChild(l,a)}};if(a(e),!s&&o.size>0){for(let l of ka(e))if(o.has(l)){s=!0;break}}return s}function Wn(e){return rn(e)||c.isIdentifier(e)&&e.text==="exports"}function xa(e){if(!c.isPropertyAccessExpression(e.expression)||!c.isIdentifier(e.expression.expression))return!1;let n=e.expression.expression.text,t=e.expression.name.text;return n==="Object"&&(t==="defineProperty"||t==="defineProperties")||n==="Reflect"&&(t==="defineProperty"||t==="set")}function Dr(e){return xa(e)&&e.arguments[0]!==void 0&&Wn(e.arguments[0])}function Df(e){return xa(e)&&e.arguments[0]!==void 0&&c.isIdentifier(e.arguments[0])&&e.arguments[0].text==="module"}function Lf(e){for(let n of e.declarations??[])if(c.isExportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isExportDeclaration(t)&&t.isTypeOnly)return!0}else if(c.isImportSpecifier(n)){if(n.isTypeOnly)return!0;let t=n.parent.parent;if(c.isImportClause(t)&&t.isTypeOnly)return!0}return!1}function Ff(e,n,t,o,r){let s=(e.declarations??[]).filter(l=>!c.isSourceFile(l)&&!c.isModuleDeclaration(l));for(let l of s){let i=l.getSourceFile(),d=n.toRel(i.fileName);if(d===null||r.has(d))continue;let u=t.get(`${d}::${String(l.getStart(i,!1))}`);if(u!==void 0)return u}let a=e.getName();for(let l of s){let i=n.toRel(l.getSourceFile().fileName);if(i===null||r.has(i))continue;let d=o.get(`${i}::${a}`);if(d!==void 0)return d}}function ko(e){return c.isPropertyAccessExpression(e)?e.name.text:c.isStringLiteralLike(e.argumentExpression)?e.argumentExpression.text:void 0}var Lr=/^[A-Za-z_$][A-Za-z0-9_$]*$/u;function Fr(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?ko(e):void 0;return n!==void 0&&n!=="__proto__"&&Lr.test(n)?n:void 0}function jf(e){return e!=="__proto__"&&Lr.test(e)}function aa(e){let n=Ne(e);return c.isIdentifier(n)&&(n.text==="exports"||n.text==="module")||Be(n)}function Bf(e){if(!c.isArrayLiteralExpression(e)&&!c.isObjectLiteralExpression(e))return!1;let n=!1,t=o=>{n||(rn(o)?n=!0:c.forEachChild(o,t))};return t(e),n}function jr(e){let n=!1,t=new Map,o=r=>{if(!n){if(c.isBinaryExpression(r)&&r.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&r.operatorToken.kind<=c.SyntaxKind.LastAssignment){if(Be(r.left)||c.isIdentifier(r.left)&&r.left.text==="exports")n=!0;else if(r.operatorToken.kind===c.SyntaxKind.EqualsToken&&aa(r.right))n=!0;else if(Bf(r.left))n=!0;else if(rn(r.left)){let s=Fr(r.left);s===void 0?n=!0:t.set(s,(t.get(s)??0)+1)}}else(c.isCallExpression(r)&&at(r)&&r.arguments[0]!==void 0&&Wn(r.arguments[0])||c.isCallExpression(r)&&Dr(r)||c.isCallExpression(r)&&Df(r)||c.isVariableDeclaration(r)&&r.initializer!==void 0&&aa(r.initializer))&&(n=!0);n||c.forEachChild(r,o)}};return o(e),{surfaceEscapes:n,assignCount:t}}function Br(e){let n=[];for(let t of e.statements){if(!c.isExpressionStatement(t)||!c.isBinaryExpression(t.expression))continue;let o=t.expression;o.operatorToken.kind===c.SyntaxKind.EqualsToken&&(!rn(o.left)||Be(o.left)||n.push({bin:o,name:Fr(o.left)}))}return n}function Kf(e){let{surfaceEscapes:n,assignCount:t}=jr(e);if(n)return[];let o=[];for(let{bin:r,name:s}of Br(e))s===void 0||(t.get(s)??0)!==1||(c.isFunctionExpression(r.right)||c.isArrowFunction(r.right))&&o.push({name:s,value:r.right});return o}function Uf(e,n){let{surfaceEscapes:t,assignCount:o}=jr(e);if(t)return[];let r=[];for(let{bin:s,name:a}of Br(e))a===void 0||(o.get(a)??0)!==1||c.isIdentifier(s.right)&&!n.has(s.right.text)&&r.push(s.right.text);return r}function zf(e,n){let{surfaceEscapes:t,assignCount:o}=jr(e);for(let{bin:r,name:s}of Br(e)){let a=r.right;if(!(c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)))continue;let i=c.isFunctionExpression(a)||c.isArrowFunction(a)||c.isIdentifier(a)&&!n.has(a.text);if(!(!t&&s!==void 0&&(o.get(s)??0)===1&&i))return!0}return!1}function qf(e){let n=c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)?e.expression:void 0;return n!==void 0&&c.isIdentifier(n)&&n.text==="exports"?"exports":"module.exports"}function la(e){let n=e.parent;return n===void 0?!1:c.isPropertyAccessExpression(n)?n.name===e:c.isQualifiedName(n)?n.right===e:c.isBindingElement(n)||c.isImportSpecifier(n)?n.propertyName===e:c.isExportSpecifier(n)?!0:c.isPropertyAssignment(n)||c.isPropertyDeclaration(n)||c.isPropertySignature(n)||c.isMethodDeclaration(n)||c.isMethodSignature(n)||c.isGetAccessorDeclaration(n)||c.isSetAccessorDeclaration(n)||c.isEnumMember(n)?n.name===e:!1}function da(e){for(let n=e.parent;n!==void 0;n=n.parent){if(c.isSourceFile(n))return!0;if(!c.isArrowFunction(n)&&(c.isFunctionLike(n)||c.isClassLike(n)))return!1}return!0}function Wf(e,n){let t=o=>{c.isIdentifier(o)&&(o.text==="exports"||o.text==="module")&&n.add(o),c.forEachChild(o,t)};t(e)}function Vf(e){let n=[],t=new Set;for(let s of e.statements){if(c.isExportDeclaration(s)||c.isExportAssignment(s)||c.isImportDeclaration(s)||c.isImportEqualsDeclaration(s)||qn(s))return null;if(!c.isExpressionStatement(s)||!c.isBinaryExpression(s.expression))continue;let a=s.expression;if(a.operatorToken.kind===c.SyntaxKind.EqualsToken){if(Be(a.left))n.push({kind:"whole",value:a.right});else if(rn(a.left)){let l=Fr(a.left);if(l===void 0)return null;n.push({kind:"member",name:l,value:a.right,root:qf(a.left)})}else continue;Wf(a.left,t)}}let o=!1,r=s=>{if(!o){if(c.isIdentifier(s)&&(s.text==="exports"||s.text==="module")&&!t.has(s)&&!la(s)){o=!0;return}if(s.kind===c.SyntaxKind.ThisKeyword&&da(s)){o=!0;return}if(c.isIdentifier(s)&&s.text==="arguments"&&!la(s)&&da(s)){o=!0;return}c.forEachChild(s,r)}};return r(e),o?null:n}function Mr(e){return c.isIdentifier(e)||c.isStringLiteralLike(e)?e.text:void 0}function ca(e,n,t){return c.isIdentifier(e)?n(e.text):t?.(e)}function Gf(e,n,t,o){let r=new Map,s=Vf(e);if(s===null||s.filter(m=>m.kind==="whole").length>1)return r;let a=s.findIndex(m=>m.kind==="whole"),l=(m,g)=>a>=0&&g>a&&m.kind==="member"&&m.root==="exports",i=s.some(l);if(i){let m=s[a];if(m===void 0||m.kind!=="whole"||!c.isObjectLiteralExpression(m.value))return r}let d=i?s.filter((m,g)=>!l(m,g)):s,u=new Map;for(let m of d)m.kind==="member"&&u.set(m.name,(u.get(m.name)??0)+1);let p=m=>n.has(m)?void 0:t(m),f=(m,g)=>{g===void 0?r.delete(m):r.set(m,g)};for(let m of d){if(m.kind==="member"){f(m.name,(u.get(m.name)??0)>1?void 0:ca(m.value,p,o));continue}r.clear();let g=m.value;if(c.isObjectLiteralExpression(g))for(let y of g.properties){if(c.isSpreadAssignment(y))return new Map;if(c.isShorthandPropertyAssignment(y)){f(y.name.text,p(y.name.text));continue}let S=Mr(y.name);if(S===void 0)return new Map;f(S,c.isPropertyAssignment(y)?ca(y.initializer,p,o):void 0)}}return r}function ba(e,n,t,o){let r=new Map,s=l=>l!==void 0&&ve(l)==="relative"?t.get(`${n}::${l}`):void 0,a=l=>{if(c.isVariableDeclaration(l)&&l.initializer!==void 0){let i=l.initializer;if(c.isIdentifier(l.name)&&!o.has(l.name.text)){let d=s(pn(i));if(d!==void 0)r.set(l.name.text,{kind:"whole",target:d});else if((c.isPropertyAccessExpression(i)||c.isElementAccessExpression(i))&&c.isCallExpression(i.expression)){let u=s(pn(i.expression)),p=ko(i);u!==void 0&&p!==void 0&&r.set(l.name.text,{kind:"member",target:u,member:p})}}else if(c.isObjectBindingPattern(l.name)){let d=s(pn(i));if(d!==void 0){for(let u of l.name.elements)if(c.isIdentifier(u.name)&&!o.has(u.name.text)){let p=u.propertyName!==void 0&&c.isIdentifier(u.propertyName)?u.propertyName.text:u.name.text;r.set(u.name.text,{kind:"member",target:d,member:p})}}}}c.forEachChild(l,a)};return a(e),r}function Hf(e,n,t,o){let r=a=>a!==void 0&&ve(a)==="relative"?t.get(`${n}::${a}`):void 0,s=r(pn(e));if(s!==void 0)return{kind:"whole",target:s};if(c.isPropertyAccessExpression(e)||c.isElementAccessExpression(e)){let a=ko(e);if(a===void 0)return;let l=r(pn(e.expression));if(l!==void 0)return{kind:"member",target:l,member:a};if(c.isIdentifier(e.expression)){let i=o.get(e.expression.text);if(i?.kind==="whole")return{kind:"member",target:i.target,member:a}}return}if(c.isIdentifier(e))return o.get(e.text)}function Sa(e,n,t,o,r){let s=[],a=!1,l=p=>{if(ha(p))return!0;let f=!1,m=g=>{f||(c.isIdentifier(g)&&r.has(g.text)?f=!0:c.forEachChild(g,m))};return m(p),f},i=(p,f)=>{let m=Hf(p,n,t,o);m!==void 0?s.push({source:m,exportedName:f}):l(p)&&(a=!0)},d=p=>{if(c.isObjectLiteralExpression(p)){for(let f of p.properties)if(c.isSpreadAssignment(f))i(f.expression,"default");else if(c.isPropertyAssignment(f)){let m=c.isIdentifier(f.name)||c.isStringLiteralLike(f.name)?f.name.text:"default";i(f.initializer,m)}else if(c.isShorthandPropertyAssignment(f)){let m=o.get(f.name.text);m!==void 0&&s.push({source:m,exportedName:f.name.text})}return}i(p,"default")},u=p=>{if(c.isBinaryExpression(p)&&p.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&p.operatorToken.kind<=c.SyntaxKind.LastAssignment){if(Be(p.left)){d(p.right);return}if(rn(p.left)){let f=c.isPropertyAccessExpression(p.left)?p.left.name.text:c.isElementAccessExpression(p.left)&&c.isStringLiteralLike(p.left.argumentExpression)?p.left.argumentExpression.text:"default";i(p.right,f);return}}else if(c.isExportAssignment(p)&&p.isExportEquals){i(p.expression,"default");return}else if(c.isCallExpression(p)&&at(p)&&p.arguments[0]!==void 0&&Wn(p.arguments[0])){for(let f of p.arguments.slice(1))d(f);return}c.forEachChild(p,u)};return u(e),{sources:s,residual:a}}function ka(e){let n=new Set,t=r=>{let s=r;for(;c.isPropertyAccessExpression(s)||c.isElementAccessExpression(s);)s=s.expression;return c.isIdentifier(s)?s.text:void 0},o=r=>{let s=Ea(r);if(s!==void 0){let a=t(s);a!==void 0&&n.add(a)}c.forEachChild(r,o)};return o(e),n}function Ea(e){return c.isBinaryExpression(e)&&e.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&e.operatorToken.kind<=c.SyntaxKind.LastAssignment&&(c.isPropertyAccessExpression(e.left)||c.isElementAccessExpression(e.left))?e.left:void 0}function bo(e){if(c.isIdentifier(e))return[e.text];let n=[];for(let t of e.elements)c.isBindingElement(t)&&n.push(...bo(t.name));return n}function je(e){if(c.isIdentifier(e))return[e.text];if(c.isParenthesizedExpression(e)||c.isAsExpression(e)||c.isNonNullExpression(e)||c.isSatisfiesExpression(e)||c.isTypeAssertionExpression(e)||c.isAwaitExpression(e))return je(e.expression);if(c.isYieldExpression(e))return e.expression!==void 0?je(e.expression):[];if(c.isBinaryExpression(e)){let n=e.operatorToken.kind;return n===c.SyntaxKind.BarBarToken||n===c.SyntaxKind.AmpersandAmpersandToken||n===c.SyntaxKind.QuestionQuestionToken?[...je(e.left),...je(e.right)]:n===c.SyntaxKind.CommaToken?je(e.right):[]}return c.isConditionalExpression(e)?[...je(e.whenTrue),...je(e.whenFalse)]:c.isArrayLiteralExpression(e)?e.elements.flatMap(n=>c.isSpreadElement(n)?je(n.expression):c.isOmittedExpression(n)?[]:je(n)):c.isObjectLiteralExpression(e)?e.properties.flatMap(n=>c.isShorthandPropertyAssignment(n)?[n.name.text]:c.isPropertyAssignment(n)?je(n.initializer):c.isSpreadAssignment(n)?je(n.expression):[]):[]}function wa(e,n){let t=[],o=(l,i)=>{for(let d of l)for(let u of i)d!==u&&t.push({a:d,b:u})},r=l=>c.isIdentifier(l)?[l.text]:c.isArrayLiteralExpression(l)?l.elements.flatMap(r):c.isObjectLiteralExpression(l)?l.properties.flatMap(i=>c.isShorthandPropertyAssignment(i)?[i.name.text]:c.isPropertyAssignment(i)?r(i.initializer):[]):[],s=l=>{c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken?o(r(l.left),je(l.right)):c.isVariableDeclaration(l)&&l.initializer!==void 0?o(bo(l.name),je(l.initializer)):(c.isForOfStatement(l)||c.isForInStatement(l))&&c.isVariableDeclarationList(l.initializer)&&l.initializer.declarations[0]!==void 0&&o(bo(l.initializer.declarations[0].name),je(l.expression)),c.forEachChild(l,s)};s(e);let a=new Set(n);for(let l=!0;l;){l=!1;for(let{a:i,b:d}of t)a.has(i)&&!a.has(d)&&(a.add(d),l=!0),a.has(d)&&!a.has(i)&&(a.add(i),l=!0)}return a}function va(e,n){let t=l=>{if(!c.isPropertyAccessExpression(l)&&!c.isElementAccessExpression(l))return;let i=l;for(;c.isPropertyAccessExpression(i)||c.isElementAccessExpression(i);)i=i.expression;return c.isIdentifier(i)?i.text:void 0},o=[],r=(l,i)=>{for(let u of je(i))o.push({name:l,root:u});let d=t(i);d!==void 0&&o.push({name:l,root:d})},s=l=>{c.isVariableDeclaration(l)&&c.isIdentifier(l.name)&&l.initializer!==void 0?r(l.name.text,l.initializer):c.isBinaryExpression(l)&&l.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isIdentifier(l.left)&&r(l.left.text,l.right),c.forEachChild(l,s)};s(e);let a=new Map(n);for(let l=!0;l;){l=!1;for(let{name:i,root:d}of o){let u=a.get(d);u!==void 0&&!a.has(i)&&(a.set(i,u),l=!0)}}return a}function _a(e){return wa(e,ka(e))}function Xf(e,n){let t=i=>i>=c.SyntaxKind.FirstAssignment&&i<=c.SyntaxKind.LastAssignment,o=i=>{let d=i.parent;if(d===void 0||!c.isObjectLiteralExpression(d))return!1;let u=d.parent;return u!==void 0&&c.isBinaryExpression(u)&&u.operatorToken.kind===c.SyntaxKind.EqualsToken&&u.right===d&&rn(u.left)?!0:u!==void 0&&c.isCallExpression(u)&&at(u)&&u.arguments[0]!==void 0&&Wn(u.arguments[0])&&u.arguments.indexOf(d)>0},r=(i,d)=>{if((c.isFunctionDeclaration(d)||c.isFunctionExpression(d))&&d.name===i||c.isVariableDeclaration(d)&&d.name===i||c.isParameter(d)&&d.name===i||c.isBindingElement(d)&&d.name===i||(c.isCallExpression(d)||c.isNewExpression(d))&&d.expression===i)return!0;if((c.isPropertyAccessExpression(d)||c.isElementAccessExpression(d))&&d.expression===i){let u=d;for(;u.parent!==void 0&&(c.isPropertyAccessExpression(u.parent)||c.isElementAccessExpression(u.parent))&&u.parent.expression===u;)u=u.parent;let p=u.parent;return!(p!==void 0&&c.isBinaryExpression(p)&&t(p.operatorToken.kind)&&p.left===u)}return c.isBinaryExpression(d)&&d.operatorToken.kind===c.SyntaxKind.EqualsToken&&d.right===i&&rn(d.left)?!0:c.isShorthandPropertyAssignment(d)&&d.name===i||c.isPropertyAssignment(d)&&d.initializer===i?o(d):!!(c.isExportAssignment(d)&&d.expression===i||c.isExportSpecifier(d))},s=(i,d)=>c.isPropertyAccessExpression(d)&&d.name===i||c.isPropertyAssignment(d)&&d.name===i||(c.isMethodDeclaration(d)||c.isGetAccessorDeclaration(d)||c.isSetAccessorDeclaration(d))&&d.name===i,a=!1,l=(i,d)=>{if(!a){if(c.isIdentifier(i)&&d!==void 0&&n.has(i.text)&&!s(i,d)&&!r(i,d)){a=!0;return}c.forEachChild(i,u=>l(u,i))}};return l(e,void 0),a}function Yf(e){let n=new Set;for(let i of e.statements)if(c.isFunctionDeclaration(i)&&i.name!==void 0)n.add(i.name.text);else if(c.isVariableStatement(i))for(let d of i.declarationList.declarations)c.isIdentifier(d.name)&&d.initializer!==void 0&&(c.isFunctionExpression(d.initializer)||c.isArrowFunction(d.initializer))&&n.add(d.name.text);let t=new Set,o=i=>{c.isBinaryExpression(i)&&i.operatorToken.kind===c.SyntaxKind.EqualsToken?(Be(i.left)&&(c.isIdentifier(i.right)?t.add(i.right.text):c.isObjectLiteralExpression(i.right)&&ya(i.right,t)),Be(i.right)&&c.isIdentifier(i.left)&&t.add(i.left.text)):c.isVariableDeclaration(i)&&c.isIdentifier(i.name)&&i.initializer!==void 0&&Be(i.initializer)&&t.add(i.name.text),c.forEachChild(i,o)};if(o(e),t.size>0){if(Xf(e,t))return!0;let i=va(e,new Map([...t].map(u=>[u,u]))),d=_a(e);for(let u of i.keys())if(d.has(u))return!0}let r=i=>c.isIdentifier(i)&&n.has(i.text),s=i=>i.properties.every(d=>c.isShorthandPropertyAssignment(d)&&n.has(d.name.text)||c.isPropertyAssignment(d)&&r(d.initializer)),a=!1,l=i=>{if(!a){if(c.isBinaryExpression(i)){let d=i.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&i.operatorToken.kind<=c.SyntaxKind.LastAssignment;d&&Be(i.left)?i.operatorToken.kind===c.SyntaxKind.EqualsToken&&(r(i.right)||c.isObjectLiteralExpression(i.right)&&s(i.right))||(a=!0):d&&rn(i.left)&&(a=!0)}else c.isCallExpression(i)?(at(i)&&i.arguments[0]!==void 0&&Wn(i.arguments[0])||Dr(i))&&(a=!0):(c.isExportAssignment(i)&&i.isExportEquals&&!c.isIdentifier(i.expression)||c.isExportDeclaration(i)&&i.moduleSpecifier!==void 0)&&(a=!0);a||c.forEachChild(i,l)}};return l(e),a}var Jf=8;function ua(e,n,t){let o=new Set,r=ba(e,n,t,st(e)),s=Sa(e,n,t,r,ga(e));for(let{source:a}of s.sources)o.add(a.target);for(let a of e.statements)if(c.isExportDeclaration(a)&&a.moduleSpecifier!==void 0&&c.isStringLiteralLike(a.moduleSpecifier)&&ve(a.moduleSpecifier.text)==="relative"){let l=t.get(`${n}::${a.moduleSpecifier.text}`);l!==void 0&&o.add(l)}return o}function Zf(e,n,t,o=new Map){let r=new Set(n.modules.filter(k=>k.isEntrypoint).map(k=>String(k.id)));if(r.size===0)return{exports:[],exportBindings:[],diagnostics:[]};let s=new Set(n.modules.filter(k=>k.externalSurface===!0).map(k=>String(k.id))),a=new Map,l=new Map,i=new Map,d=new Map;for(let k of t){if(k.name==="<toplevel>"){d.set(String(k.moduleId),k);continue}if(a.set(`${String(k.moduleId)}::${String(k.declRange.start)}`,k),k.name!==void 0&&l.set(`${String(k.moduleId)}::${k.name}`,k),k.isExported&&k.name!==void 0){let h=i.get(String(k.moduleId))??[];h.push(k),i.set(String(k.moduleId),h)}}if(o.size>0){let k=new Map(t.map(h=>[String(h.id),h]));for(let[h,b]of o){let A=k.get(String(b));A!==void 0&&!a.has(h)&&a.set(h,A)}}let u=new Map;for(let k of n.imports)k.resolvedModuleId!==void 0&&u.set(`${k.moduleId}::${k.specifier}`,String(k.resolvedModuleId));let p=new Map;for(let k of e.sourceFiles){let h=e.toRel(k.fileName);h!==null&&p.set(h,k)}let f=new Map,m=k=>{let h=f.get(k);if(h!==void 0)return h;let b=p.get(k),A=b===void 0?!0:Yf(b);return f.set(k,A),A},g=new Set,y=(k,h)=>h!==void 0&&ve(h)==="relative"?u.get(`${k}::${h}`):void 0,S=k=>{if(c.isIdentifier(k))return k.text;if(c.isPropertyAccessExpression(k)){let h=S(k.expression);return h===void 0?void 0:`${h}.${k.name.text}`}if(c.isElementAccessExpression(k)&&c.isStringLiteralLike(k.argumentExpression)){let h=S(k.expression);return h===void 0?void 0:`${h}.${k.argumentExpression.text}`}},x=k=>{let h=k;for(;c.isPropertyAccessExpression(h)||c.isElementAccessExpression(h);)h=h.expression;return pn(h)};for(let k of e.sourceFiles){let h=e.toRel(k.fileName);if(h===null)continue;let b=new Map,A=new Map,P=(N,j)=>{let $=y(h,pn(j));if($!==void 0){if(c.isIdentifier(N))A.set(N.text,$),b.set(N.text,$);else if(c.isObjectBindingPattern(N)||c.isArrayBindingPattern(N))for(let D of bo(N))A.set(D,$);else if(c.isPropertyAccessExpression(N)||c.isElementAccessExpression(N)){let D=S(N);D!==void 0&&b.set(D,$)}}},v=N=>{c.isVariableDeclaration(N)&&N.initializer!==void 0?P(N.name,N.initializer):c.isBinaryExpression(N)&&N.operatorToken.kind===c.SyntaxKind.EqualsToken&&P(N.left,N.right),c.forEachChild(N,v)};v(k);let T=N=>{let j=Ea(N);if(j!==void 0){let $=j.expression,D=y(h,x($));D!==void 0&&g.add(D);let K=S($),te=K!==void 0?b.get(K):void 0;te!==void 0&&g.add(te)}c.forEachChild(N,T)};if(T(k),A.size>0){let N=va(k,A),j=_a(k);for(let[$,D]of N)j.has($)&&g.add(D)}}let _=[],w=[],I=[];for(let k of e.sourceFiles){let h=e.toRel(k.fileName);if(h===null||!r.has(h))continue;let b=e.checker.getSymbolAtLocation(k),A=new Set,P=new Set,v=0,T=(L,O)=>{if(s.has(String(L.moduleId))||A.has(String(L.id)))return;A.add(String(L.id));let X=`${h}#reexport:${String(v)}:${O}`;v+=1,_.push({id:X,moduleId:h,exportedName:O,kind:"value",reexportOf:{moduleId:String(L.moduleId),name:L.name??O}}),w.push({exportId:X,target:{kind:"function",functionId:L.id}})},N=L=>{if(Lf(L))return;let O=L;if((L.flags&c.SymbolFlags.Alias)!==0)try{O=e.checker.getAliasedSymbol(L)}catch{return}let X=Ff(O,e,a,l,s);if(X!==void 0){T(X,L.getName());return}if((O.flags&c.SymbolFlags.Module)!==0&&!P.has(O)){P.add(O);try{for(let Z of e.checker.getExportsOfModule(O))N(Z)}catch{}}};if(b!==void 0)for(let L of e.checker.getExportsOfModule(b))N(L);let j=ba(k,h,u,st(k)),$=Sa(k,h,u,j,ga(k)),D=new Set,K=$.residual,te=L=>{let O=p.get(L);L.includes("node_modules/")||O===void 0||Tf(O)?K=!0:D.add(L)};for(let{source:L,exportedName:O}of $.sources){let X=i.get(L.target)??[],Z=g.has(L.target);if(L.kind==="whole"){for(let H of X)T(H,H.name??O);Z?K=!0:(X.length===0||m(L.target))&&te(L.target)}else{let H=X.filter(J=>J.name===L.member);for(let J of H)T(J,O);Z?K=!0:(H.length===0||m(L.target))&&te(L.target)}}let B=new Set,Y=[];for(let L of ua(k,h,u))Y.push({target:L,depth:1});for(;Y.length>0;){let L=Y.shift();if(L===void 0)break;let{target:O,depth:X}=L;if(B.has(O)||X>Jf||(B.add(O),O.split("/").includes("node_modules")))continue;let Z=p.get(O);if(Z===void 0)continue;let H=d.get(O);H!==void 0&&!m(O)&&T(H,"<load>");for(let J of ua(Z,O,u))B.has(J)||Y.push({target:J,depth:X+1})}zf(k,st(k))&&(K=!0);for(let L of D)I.push({code:"unresolved-reexport",path:h,detail:`entrypoint whole/member re-exports app-owned relative module ${L} whose exact entry surface could not be lifted; capping at unknown, corridor-scoped to that module (ADR-024, ROADMAP R3.3)`,anchor:L});K&&I.push({code:"unresolved-reexport",path:h,detail:"entrypoint has a CJS re-export the analyzer cannot pin to concrete relative functions (computed/dynamic/package-subpath/tainted, or an externally-mutated barrel); capping at unknown, globally (ADR-024, ROADMAP CJS.5)"})}return{exports:_,exportBindings:w,diagnostics:I}}var it=new Set(["valueOf","toString","toJSON","then","catch","finally","next","return","throw"]),Qf=new Set(["defineProperty","defineProperties","create"]);function ep(e){let n=!0,t=r=>c.isIdentifier(r)||c.isStringLiteral(r)||c.isNumericLiteral(r)?it.has(r.text):c.isComputedPropertyName(r)&&c.isStringLiteralLike(r.expression)?it.has(r.expression.text):!1,o=r=>{if(n){if(c.isNewExpression(r)||c.isForOfStatement(r)||c.isSpreadElement(r)||c.isSpreadAssignment(r)||c.isArrayBindingPattern(r)||c.isGetAccessorDeclaration(r)||c.isSetAccessorDeclaration(r)||c.isYieldExpression(r)&&r.asteriskToken!==void 0||c.canHaveDecorators(r)&&(c.getDecorators(r)?.length??0)>0){n=!1;return}if((c.isPropertyAccessExpression(r)||c.isMethodDeclaration(r)||c.isPropertyAssignment(r))&&t(r.name)||c.isPropertyDeclaration(r)&&t(r.name)||c.isShorthandPropertyAssignment(r)&&t(r.name)||c.isBindingElement(r)&&t(r.propertyName??r.name)||c.isElementAccessExpression(r)&&c.isStringLiteralLike(r.argumentExpression)&&it.has(r.argumentExpression.text)){n=!1;return}if(c.isCallExpression(r)&&c.isPropertyAccessExpression(r.expression)&&c.isIdentifier(r.expression.expression)&&r.expression.expression.text==="Object"&&Qf.has(r.expression.name.text)){n=!1;return}c.forEachChild(r,o)}};return o(e),n}function Eo(e){if(c.isIdentifier(e)||c.isStringLiteral(e)||c.isNumericLiteral(e))return e.text}function Ia(e){let n=t=>c.canHaveDecorators(t)&&(c.getDecorators(t)?.length??0)>0;return n(e)||e.members.some(n)}function np(e){let n=!1,t=new Set,o=[],r=new Map,s=(f,m)=>{let g=r.get(f);g===void 0?r.set(f,[m]):g.push(m)},a=f=>{c.isIdentifier(f)?t.add(f.text):o.push(f)},l=f=>{for(let m of f.properties)c.isShorthandPropertyAssignment(m)?t.add(m.name.text):c.isPropertyAssignment(m)?o.push(m.initializer):n=!0},i=f=>{if(c.isBinaryExpression(f)&&f.operatorToken.kind===c.SyntaxKind.EqualsToken){let m=f.left,g=f.right;Be(m)?c.isObjectLiteralExpression(g)?l(g):c.isIdentifier(g)||c.isFunctionExpression(g)||c.isArrowFunction(g)||c.isClassExpression(g)?a(g):n=!0:rn(m)?(c.isElementAccessExpression(m)&&!c.isStringLiteralLike(m.argumentExpression)&&(n=!0),a(g)):c.isIdentifier(m)?s(m.text,g):(c.isPropertyAccessExpression(m)||c.isElementAccessExpression(m))&&c.isIdentifier(m.expression)&&s(m.expression.text,g)}else if(c.isCallExpression(f))(at(f)&&f.arguments[0]!==void 0&&Wn(f.arguments[0])||Dr(f))&&(n=!0);else if(c.isVariableDeclaration(f)&&c.isIdentifier(f.name)&&f.initializer!==void 0)s(f.name.text,f.initializer);else if((c.isFunctionDeclaration(f)||c.isClassDeclaration(f))&&f.name!==void 0)s(f.name.text,f),qn(f)&&t.add(f.name.text);else if(c.isExportDeclaration(f)){if(f.exportClause===void 0)n=!0;else if(f.moduleSpecifier===void 0&&c.isNamedExports(f.exportClause))for(let m of f.exportClause.elements)t.add((m.propertyName??m.name).text)}else if(c.isExportAssignment(f))f.isExportEquals&&!c.isIdentifier(f.expression)?n=!0:a(f.expression);else if(c.isVariableStatement(f)&&qn(f))for(let m of f.declarationList.declarations)c.isIdentifier(m.name)&&t.add(m.name.text);c.forEachChild(f,i)};i(e);let d=new Set,u=[...t],p=f=>{let m=g=>{c.isIdentifier(g)&&u.push(g.text),c.forEachChild(g,m)};m(f)};for(let f of o)p(f);for(;u.length>0;){let f=u.pop();if(!(f===void 0||d.has(f))){d.add(f);for(let m of r.get(f)??[])p(m)}}return{names:d,opaque:n}}var tp=512,op=new Set(["get","post","put","patch","delete","options","head"]);function rp(e){for(let n of e.statements){if(c.isExportAssignment(n)&&n.isExportEquals!==!0)return n.expression;if(c.isExpressionStatement(n)&&c.isBinaryExpression(n.expression)&&n.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(n.expression.left)&&c.isIdentifier(n.expression.left.expression)){let t=n.expression.left.expression.text,o=n.expression.left.name.text;if(t==="module"&&o==="exports"||t==="exports"&&o==="default")return n.expression.right}}return null}function sp(e){let n=new Map,t=rp(e);if(t===null)return n;let o=s=>{for(let a of s.properties)if(c.isPropertyAssignment(a)&&c.isObjectLiteralExpression(a.initializer)){let l=Eo(a.name);l!==void 0&&n.set(l,a.initializer)}};if(c.isObjectLiteralExpression(t))return o(t),n;if(!c.isIdentifier(t))return n;let r=t.text;for(let s of e.statements)if(c.isVariableStatement(s))for(let a of s.declarationList.declarations)c.isIdentifier(a.name)&&a.name.text===r&&a.initializer!==void 0&&c.isObjectLiteralExpression(a.initializer)&&o(a.initializer);else if(c.isExpressionStatement(s)&&c.isBinaryExpression(s.expression)&&s.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(s.expression.left)&&c.isIdentifier(s.expression.left.expression)&&s.expression.left.expression.text===r&&c.isObjectLiteralExpression(s.expression.right)){let a=s.expression.left.name.text;n.set(a,s.expression.right)}return n}function ip(e){for(let n of e.properties){if(c.isMethodDeclaration(n)&&c.isIdentifier(n.name)&&n.name.text==="handler")return n;if(c.isPropertyAssignment(n)&&c.isIdentifier(n.name)&&n.name.text==="handler"&&(c.isArrowFunction(n.initializer)||c.isFunctionExpression(n.initializer)))return n.initializer}return null}function ap(e,n){for(let o of e.properties){let r;if(c.isPropertyAssignment(o)||c.isMethodDeclaration(o)?r=Eo(o.name):c.isShorthandPropertyAssignment(o)&&(r=o.name.text),r==="method"||r==="url"||r==="middlewares")return!0}let t=n.parameters.length;return t>=2&&t<=3}function lp(e,n){let t=[],o=new Set,r=(l,i,d)=>{if(t.length>=tp||l==="__proto__"||!Lr.test(l))return;let u=`${e}#handler:${l}`;o.has(u)||(o.add(u),t.push({id:u,node:i,memberPath:l,idiom:d}))};for(let[l,i]of sp(n)){let d=ip(i);d!==null&&ap(i,d)&&r(l,d,"descriptor-object")}let s=0,a=l=>{if(c.isCallExpression(l)&&c.isPropertyAccessExpression(l.expression)&&c.isIdentifier(l.expression.expression)&&op.has(l.expression.name.text)&&l.arguments.length>=2&&l.arguments[0]!==void 0&&c.isStringLiteralLike(l.arguments[0])){let i=l.expression.name.text;for(let d=1;d<l.arguments.length;d+=1){let u=l.arguments[d];u!==void 0&&(c.isArrowFunction(u)||c.isFunctionExpression(u))&&r(`${i}_${String(s)}_${String(d)}`,u,"router-verb")}s+=1}c.forEachChild(l,a)};return a(n),t}function dp(e,n,t,o,r,s){let a=`${e}#class:${t}`,l=[],i=new Set;for(let d of o.members){let u,p,f;if(c.isConstructorDeclaration(d))u="constructor",p="ctor",f=!1;else if(c.isMethodDeclaration(d))u=Eo(d.name),p="method",f=u!==void 0&&!it.has(u);else continue;if(u===void 0||i.has(u))continue;i.add(u);let m=`${e}#${t}.${u}`;r.push({id:m,moduleId:e,name:u,kind:p,enclosingClassId:a,declRange:Rn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),l.push(m),f&&s.push({start:d.getStart(n,!1),end:d.getEnd(),id:m})}return{id:a,moduleId:e,name:t,implementsRefs:[],members:l}}function cp(e,n,t=[],o=!1,r){let s=[],a=new Map,l=[],{reachableLocals:i,defaultTarget:d}=Of(n),u=st(n),p=`${e}#<toplevel>`;s.push({id:p,moduleId:e,name:"<toplevel>",kind:"function",declRange:{path:e,start:0,end:n.getEnd()},isExported:!1,publicSurfaceReachable:!1});let f=(h,b)=>{let A=`${e}#${h}`;return s.push({id:A,moduleId:e,name:h,kind:"function",declRange:Rn(e,b,n),isExported:i.has(h),publicSurfaceReachable:i.has(h)}),a.set(h,{kind:"function",functionId:A}),l.push({start:b.getStart(n,!1),end:b.getEnd(),id:A}),A},m=[],g=!e.split("/").includes("node_modules");if(g)for(let h of Uf(n,u))i.add(h);let y=g?np(n):void 0,S=(h,b,A)=>{y===void 0||y.opaque||y.names.has(h)||qn(A)||Ia(b)||m.push(dp(e,n,h,b,s,l))};for(let h of n.statements)if(c.isFunctionDeclaration(h)&&h.name!==void 0)f(h.name.text,h);else if(c.isClassDeclaration(h)&&h.name!==void 0)S(h.name.text,h,h);else if(c.isVariableStatement(h))for(let b of h.declarationList.declarations){if(c.isObjectBindingPattern(b.name)&&b.initializer!==void 0&&c.isCallExpression(b.initializer)&&c.isIdentifier(b.initializer.expression)&&b.initializer.expression.text==="require"&&b.initializer.arguments.length===1&&b.initializer.arguments[0]!==void 0&&c.isStringLiteralLike(b.initializer.arguments[0])){let P=b.initializer.arguments[0].text;for(let v of b.name.elements){if(v.dotDotDotToken!==void 0||v.initializer!==void 0||!c.isIdentifier(v.name))continue;let T=v.propertyName??v.name;!c.isIdentifier(T)&&!c.isStringLiteralLike(T)||a.set(v.name.text,{kind:"import",specifier:P,form:{named:T.text}})}continue}if(!c.isIdentifier(b.name)||b.initializer===void 0)continue;let A=b.initializer;if(c.isFunctionExpression(A)||c.isArrowFunction(A))f(b.name.text,b);else if(c.isClassExpression(A))S(b.name.text,A,h);else if(c.isCallExpression(A)&&c.isIdentifier(A.expression)&&A.expression.text==="require"&&A.arguments.length===1&&A.arguments[0]!==void 0&&c.isStringLiteralLike(A.arguments[0]))a.set(b.name.text,{kind:"import",specifier:A.arguments[0].text,form:"whole"});else if((c.isPropertyAccessExpression(A)||c.isElementAccessExpression(A))&&ko(A)==="default"&&c.isCallExpression(A.expression)){let P=pn(A.expression);P!==void 0&&a.set(b.name.text,{kind:"import",specifier:P,form:"require-default"})}}else if(c.isImportDeclaration(h)&&c.isStringLiteralLike(h.moduleSpecifier)){let b=h.moduleSpecifier.text,A=h.importClause;if(A!==void 0){A.name!==void 0&&a.set(A.name.text,{kind:"import",specifier:b,form:"default"});let P=A.namedBindings;if(P!==void 0&&c.isNamespaceImport(P))a.set(P.name.text,{kind:"import",specifier:b,form:"namespace"});else if(P!==void 0&&c.isNamedImports(P))for(let v of P.elements){let T=(v.propertyName??v.name).text;a.set(v.name.text,{kind:"import",specifier:b,form:{named:T}})}}}else c.isImportEqualsDeclaration(h)&&c.isExternalModuleReference(h.moduleReference)&&c.isStringLiteralLike(h.moduleReference.expression)&&a.set(h.name.text,{kind:"import",specifier:h.moduleReference.expression.text,form:"whole"});let x=new Map,_,w=new Map,I=new Map;if(g)for(let{name:h,value:b}of Kf(n)){let A=`${e}#member-export:${h}`;s.push({id:A,moduleId:e,name:h,kind:c.isArrowFunction(b)?"arrow":"function",declRange:Rn(e,b,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:b.getStart(n,!1),end:b.getEnd(),id:A}),x.set(b.getStart(n,!1),A)}if(o&&g){let h=T=>{let N=ze(T);return c.isFunctionExpression(N)||c.isArrowFunction(N)?N:void 0},b=(T,N)=>{let j=T;return s.push({id:j,moduleId:e,kind:c.isArrowFunction(N)?"arrow":"function",declRange:Rn(e,N,n),isExported:!0,publicSurfaceReachable:!0}),l.push({start:N.getStart(n,!1),end:N.getEnd(),id:j}),x.set(N.getStart(n,!1),j),j},A=[],P=[],v=[];for(let T of n.statements)c.isExportAssignment(T)&&!T.isExportEquals?A.push(T):c.isFunctionDeclaration(T)&&c.getModifiers(T)?.some(N=>N.kind===c.SyntaxKind.DefaultKeyword)===!0?P.push(T):c.isExpressionStatement(T)&&c.isBinaryExpression(T.expression)&&T.expression.operatorToken.kind===c.SyntaxKind.EqualsToken&&Be(T.expression.left)&&v.push(T.expression);if(A.length+P.length+v.length===1){let T=A[0],N=P[0],j=v[0];if(T!==void 0){let $=h(T.expression);if($!==void 0){let D=b(`${e}#<default>`,$);_={id:D,esm:!0},I.set(T.getStart(n,!1),D),ge(r,"2a-default",null)}}else if(N!==void 0&&N.name===void 0&&N.body!==void 0){let $=b(`${e}#<default>`,N);_={id:$,esm:!0},I.set(N.getStart(n,!1),$),ge(r,"2a-default",null)}else if(j!==void 0){let $=h(j.right);if($!==void 0){let D=b(`${e}#<default>`,$);_={id:D,esm:!1},I.set(j.getStart(n,!1),D),ge(r,"2a-default",null)}else if(c.isObjectLiteralExpression(j.right)){let D=j.right,K=[],te=!0;for(let B of D.properties){if(c.isSpreadAssignment(B)){te=!1;break}let Y=B.name,L=Y===void 0?void 0:Mr(Y);if(L===void 0){te=!1;break}K.push(L)}if(te){let B=new Map;for(let Y of K)B.set(Y,(B.get(Y)??0)+1);for(let Y of D.properties){if(!c.isPropertyAssignment(Y))continue;let L=Mr(Y.name),O=h(Y.initializer);if(L!==void 0){if(!jf(L)){O!==void 0&&ge(r,"2a-member","charset-refused");continue}if((B.get(L)??0)!==1){O!==void 0&&ge(r,"2a-member","duplicate-key");continue}if(O!==void 0){let X=b(`${e}#<cjs>.${L}`,O);w.set(L,X),I.set(Y.getStart(n,!1),X),ge(r,"2a-member",null)}}}}else for(let B of D.properties)c.isPropertyAssignment(B)&&h(B.initializer)!==void 0&&ge(r,"2a-member","spread-or-computed-literal")}}}else{for(let T of A)h(T.expression)!==void 0&&ge(r,"2a-default","duplicate-default-sources");for(let T of P)T.name===void 0&&ge(r,"2a-default","duplicate-default-sources");for(let T of v)if(h(T.right)!==void 0)ge(r,"2a-default","duplicate-default-sources");else if(c.isObjectLiteralExpression(T.right))for(let N of T.right.properties)c.isPropertyAssignment(N)&&h(N.initializer)!==void 0&&ge(r,"2a-member","duplicate-default-sources")}}for(let h of t)s.push({id:h.id,moduleId:e,name:`handler:${h.memberPath}`,kind:c.isArrowFunction(h.node)?"arrow":"function",declRange:Rn(e,h.node,n),isExported:!1,publicSurfaceReachable:!1}),l.push({start:h.node.getStart(n,!1),end:h.node.getEnd(),id:h.id});l.sort((h,b)=>h.end-h.start-(b.end-b.start));let k=d!==void 0?`${e}#${d}`:void 0;return{rel:e,sf:n,functions:s,bindings:a,exportedFunctionId:k,exportedNames:i,tainted:u,fnRanges:l,toplevelId:p,classes:m,mintedByPos:x,mintedDefault:_,mintedMembers:w,mintSeedAliases:I}}function up(e){return c.isIdentifier(e)?"identifier":c.isPropertyAccessExpression(e)?"member":c.isElementAccessExpression(e)?"computed-member":e.kind===c.SyntaxKind.ImportKeyword?"dynamic-import":"unknown"}function fa(e,n){let t=o=>{if(c.isBinaryExpression(o)&&o.operatorToken.kind>=c.SyntaxKind.FirstAssignment&&o.operatorToken.kind<=c.SyntaxKind.LastAssignment){let r=o.left;c.isPropertyAccessExpression(r)&&c.isIdentifier(r.expression)?n(r.expression.text,r.name.text):c.isElementAccessExpression(r)&&c.isIdentifier(r.expression)&&n(r.expression.text,c.isStringLiteralLike(r.argumentExpression)?r.argumentExpression.text:null)}else if(c.isCallExpression(o)&&c.isPropertyAccessExpression(o.expression)){let r=o.expression,s=o.arguments[0];c.isIdentifier(r.expression)&&s!==void 0&&c.isIdentifier(s)&&(r.expression.text==="Object"&&(r.name.text==="assign"||r.name.text==="defineProperty"||r.name.text==="defineProperties")||r.expression.text==="Reflect"&&r.name.text==="defineProperty")&&n(s.text,null)}c.forEachChild(o,t)};t(e)}function fp(e){let n=!1,t=o=>{if(!n){if(c.isVariableDeclaration(o)||c.isParameter(o)){let r=new Set;if(vt(o.name,r),r.has("require")){n=!0;return}}else if((c.isFunctionDeclaration(o)||c.isClassDeclaration(o))&&o.name!==void 0&&o.name.text==="require"){n=!0;return}c.forEachChild(o,t)}};return t(e),n}function pp(e,n,t,o=new Map,r={}){let s=r.additiveForms===!0,a=r.namelessExports===!0,l=s||a?{}:void 0,i=new Map,d=new Map;for(let h of n.imports)h.resolvedModuleId!==void 0&&d.set(`${h.moduleId}::${h.specifier}`,h.resolvedModuleId);for(let h of e.sourceFiles){let b=e.toRel(h.fileName);b!==null&&i.set(b,cp(b,h,o.get(b)??[],a,l))}let u=new Map;if(s)for(let h of i.values()){let b=new Map;for(let[A,P]of h.bindings)if(P.kind==="import"&&P.form==="whole"&&ve(P.specifier)!=="package-root"){let v=d.get(`${h.rel}::${P.specifier}`);v!==void 0&&b.set(A,String(v))}b.size!==0&&fa(h.sf,(A,P)=>{let v=b.get(A);if(v===void 0)return;let T=u.get(v);if(T!=="*"){if(P===null){u.set(v,"*");return}T===void 0?u.set(v,new Set([P])):T.add(P)}})}let p=new Map;for(let h of i.values())h.exportedFunctionId!==void 0&&p.set(h.rel,h.exportedFunctionId);let f=new Map;for(let h of i.values()){if(h.rel.split("/").includes("node_modules"))continue;let b=Mf(h.sf);if(b===void 0){a&&h.mintedDefault!==void 0&&f.set(h.rel,h.mintedDefault);continue}let A=h.bindings.get(b.name);A?.kind==="function"&&f.set(h.rel,{id:A.functionId,esm:b.esm})}let m=new Map;for(let h of i.values()){let b;for(let A of h.exportedNames){let P=h.bindings.get(A);P?.kind==="function"&&(b??=new Map,b.set(A,P.functionId))}b!==void 0&&m.set(h.rel,b)}let g=new Map;for(let h of i.values()){if(h.rel.split("/").includes("node_modules"))continue;let b=Gf(h.sf,h.tainted,A=>{let P=h.bindings.get(A);return P?.kind==="function"?P.functionId:void 0},a?A=>{let P=ze(A);return c.isFunctionExpression(P)||c.isArrowFunction(P)?h.mintedByPos.get(P.getStart(h.sf,!1)):void 0}:void 0);b.size>0&&g.set(h.rel,b)}let y=[],S=[],x=[],_=[],w=[],I=[];for(let h of i.values()){y.push(...h.functions),I.push(...h.classes);for(let R of h.exportedNames){let M=h.bindings.get(R);if(M?.kind==="function"){let U=`${h.rel}#export:${R}`;_.push({id:U,moduleId:h.rel,exportedName:R,kind:"value"}),w.push({exportId:U,target:{kind:"function",functionId:M.functionId}})}}if(a){if(h.mintedDefault!==void 0){let R=`${h.rel}#export:<default>`;_.push({id:R,moduleId:h.rel,exportedName:"default",kind:"value"}),w.push({exportId:R,target:{kind:"function",functionId:h.mintedDefault.id}})}for(let[R,M]of h.mintedMembers){let U=`${h.rel}#export:<cjs>.${R}`;_.push({id:U,moduleId:h.rel,exportedName:R,kind:"value"}),w.push({exportId:U,target:{kind:"function",functionId:M}})}}let b=new Map;for(let[R,M]of h.bindings){if(M.kind==="function"){b.set(R,M);continue}if(ve(M.specifier)==="package-root"){let G=He(M.specifier);typeof M.form=="object"?b.set(R,{kind:"package-export",packageName:G,exportName:M.form.named}):M.form==="require-default"?b.set(R,{kind:"package-default",packageName:G}):b.set(R,{kind:"package-surface",packageName:G})}else{let G=d.get(`${h.rel}::${M.specifier}`);if(G!==void 0&&typeof M.form=="object"){let de=m.get(String(G))?.get(M.form.named);de!==void 0&&b.set(R,{kind:"app-named-fn",functionId:de})}else if(G!==void 0&&M.form==="require-default"){let de=f.get(String(G));de!==void 0&&de.esm&&b.set(R,{kind:"app-default-fn",functionId:de.id})}else G!==void 0&&typeof M.form!="object"&&M.form!=="require-default"&&b.set(R,{kind:"module",resolvedModuleId:G})}}let A=new Map;for(let R of h.functions){if(R.enclosingClassId===void 0||R.name===void 0)continue;let M=A.get(R.enclosingClassId);M===void 0&&(M=new Map,A.set(R.enclosingClassId,M)),M.set(R.name,R.id)}for(let R of h.classes)R.name===void 0||h.tainted.has(R.name)||b.has(R.name)||b.set(R.name,{kind:"app-class",cls:{classId:R.id,className:R.name,memberIds:A.get(R.id)??new Map}});let P=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0&&c.isNewExpression(R.initializer)&&!h.tainted.has(R.name.text)&&!b.has(R.name.text)){let M=ia(R.initializer,b,h.tainted);M!==null&&b.set(R.name.text,M)}c.forEachChild(R,P)};P(h.sf);let v=R=>{for(let M of h.fnRanges)if(R>=M.start&&R<M.end)return M.id;return h.toplevelId},T=new Map,N=new Map,j=new Map,$=(R,M,U)=>{if(U===null){R.set(M,"*");return}let G=R.get(M);G!=="*"&&(G===void 0?R.set(M,new Set([U])):G.add(U))},D=(R,M)=>{$(T,R,M);let U=b.get(R);U?.kind==="package-surface"?$(N,U.packageName,M):U?.kind==="module"&&$(j,String(U.resolvedModuleId),M)};fa(h.sf,D);let K=new Map,te=256,B=R=>{let M=K.get(R);return M===void 0&&(M=K.size>=te?new Set([R]):wa(h.sf,new Set([R])),K.set(R,M)),M},Y=(R,M)=>R==="*"||R!==void 0&&R.has(M),L=(R,M)=>{let U=b.get(R);if(U?.kind==="package-surface"&&Y(N.get(U.packageName),M)||U?.kind==="module"&&Y(j.get(String(U.resolvedModuleId)),M))return!0;for(let G of B(R))if(Y(T.get(G),M))return!0;return!1},O=R=>{if(c.isIdentifier(R)){let M=h.tainted.has(R.text)?void 0:b.get(R.text);return M?.kind==="function"?M.functionId:M?.kind==="module"?p.get(String(M.resolvedModuleId))??null:M?.kind==="package-export"?t.exportFor(M.packageName,M.exportName):null}if(c.isPropertyAccessExpression(R)&&c.isIdentifier(R.expression)){let M=R.expression.text;if(L(M,R.name.text))return null;let U=h.tainted.has(M)?void 0:b.get(M);return U?.kind==="package-surface"?t.exportFor(U.packageName,R.name.text):U?.kind==="package-export"?t.methodFor(U.packageName,U.exportName,R.name.text,"method"):U?.kind==="package-instance"?t.methodFor(U.packageName,U.className,R.name.text,"method"):null}return null},X=R=>{for(let M=R.parent;M!==void 0;M=M.parent)if(!c.isArrowFunction(M)){if(c.isFunctionExpression(M)||c.isFunctionDeclaration(M))return null;if(c.isMethodDeclaration(M)||c.isConstructorDeclaration(M)||c.isGetAccessorDeclaration(M)||c.isSetAccessorDeclaration(M)){let U=M.parent;if(!c.isClassLike(U)||U.name===void 0)return null;let G=h.tainted.has(U.name.text)?void 0:b.get(U.name.text);return G?.kind==="app-class"?G.cls:null}}return null},Z=s&&!h.tainted.has("require")&&!fp(h.sf),H=R=>{if(c.isIdentifier(R)){let G=h.tainted.has(R.text)?void 0:b.get(R.text);return G?.kind==="package-surface"||G?.kind==="package-default"?t.exportFor(G.packageName,"default"):G?.kind==="app-named-fn"||G?.kind==="app-default-fn"?G.functionId:G?.kind==="module"?f.get(String(G.resolvedModuleId))?.id??null:G?.kind==="member-value"?G.functionId:null}if(!c.isPropertyAccessExpression(R))return null;let M=R.expression;if(s&&c.isCallExpression(ze(M))){let G=pn(ze(M));if(G!==void 0)if(!Z)ge(l,"2b","require-shadow");else if(ve(G)==="package-root")ge(l,"2b","package-root");else{let de=d.get(`${h.rel}::${G}`);if(de===void 0)ge(l,"2b","unresolved-module");else{let ye=R.name.text,De=u.get(String(de));if(De==="*"||De!==void 0&&De.has(ye))ge(l,"2b","module-mutation-gate");else{let en=g.get(String(de))?.get(ye);if(en!==void 0)return ge(l,"2b",null),en;if(ye==="default"){let F=f.get(String(de));if(F!==void 0&&F.esm)return ge(l,"2b",null),F.id;ge(l,"2b","non-esm-default")}else ge(l,"2b","unknown-member")}}}return null}let U;if(c.isIdentifier(M)){let G=h.tainted.has(M.text)?void 0:b.get(M.text);if(G?.kind==="app-class"||G?.kind==="app-instance")U=G.cls.memberIds;else if(G?.kind==="object-literal")U=G.obj.members;else if(G?.kind==="module"){let de=g.get(String(G.resolvedModuleId));de?.has(R.name.text)===!0&&!L(M.text,R.name.text)&&(U=de)}}else if(c.isNewExpression(M)){let G=ia(M,b,h.tainted);G?.kind==="app-instance"&&(U=G.cls.memberIds)}else M.kind===c.SyntaxKind.ThisKeyword&&(U=X(R)?.memberIds);return U?.get(R.name.text)??null},J=new Map,se=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0&&c.isObjectLiteralExpression(R.initializer)&&!h.tainted.has(R.name.text)&&!b.has(R.name.text)&&!J.has(R.name.text)){let M=new Map;for(let U of R.initializer.properties)if(c.isPropertyAssignment(U)&&c.isIdentifier(U.name)){let G=O(U.initializer);G!==null&&M.set(U.name.text,G)}J.set(R.name.text,M)}c.forEachChild(R,se)};se(h.sf);let oe=R=>{if(c.isBinaryExpression(R)&&R.operatorToken.kind===c.SyntaxKind.EqualsToken&&c.isPropertyAccessExpression(R.left)&&c.isIdentifier(R.left.expression)&&!h.tainted.has(R.left.expression.text)){let M=J.get(R.left.expression.text);if(M!==void 0){let U=O(R.right);U!==null&&M.set(R.left.name.text,U)}}c.forEachChild(R,oe)};oe(h.sf);for(let[R,M]of J)b.set(R,{kind:"object-literal",obj:{members:M}});let C=(R,M=0)=>{if(M>ra)return null;let U=ze(R);if(c.isCallExpression(U)&&c.isPropertyAccessExpression(U.expression)&&U.expression.name.text==="bind")return C(U.expression.expression,M+1);if(c.isIdentifier(U)){let G=O(U);if(G!==null)return G;let de=h.tainted.has(U.text)?void 0:b.get(U.text);return de?.kind==="member-value"?de.functionId:null}return c.isPropertyAccessExpression(U)?O(U)??H(U):null},Q=(R,M=0)=>{if(M>ra)return"depth-cap";let U=ze(R);if(c.isCallExpression(U)&&c.isPropertyAccessExpression(U.expression)&&U.expression.name.text==="bind")return Q(U.expression.expression,M+1);if(c.isIdentifier(U))return h.tainted.has(U.text)?"tainted-receiver":"unresolved-receiver";if(c.isPropertyAccessExpression(U)&&c.isIdentifier(U.expression)){if(h.tainted.has(U.expression.text))return"tainted-receiver";if(L(U.expression.text,U.name.text))return"mutated-member"}return"unresolved-receiver"},ee=R=>{if(c.isVariableDeclaration(R)&&c.isIdentifier(R.name)&&R.initializer!==void 0){let M=ze(R.initializer),U=c.isPropertyAccessExpression(M),G=c.isCallExpression(M)&&c.isPropertyAccessExpression(M.expression)&&M.expression.name.text==="bind";if(U||G){let de=U?"D1":"A2";if(h.tainted.has(R.name.text))ge(l,de,"tainted-alias");else if(b.has(R.name.text))ge(l,de,"already-bound");else{let ye=C(M);ye!==null?(b.set(R.name.text,{kind:"member-value",functionId:ye}),ge(l,de,null)):ge(l,de,Q(M))}}}c.forEachChild(R,ee)};s&&ee(h.sf);let ue=0,Dn=R=>{let M,U;if(c.isCallExpression(R)){let G=R.expression,de=c.isIdentifier(G)&&G.text==="require",ye=G.kind===c.SyntaxKind.ImportKeyword;!de&&!ye&&(M=G,U=R.arguments)}else c.isTaggedTemplateExpression(R)&&(M=R.tag);if(M!==void 0){let G=up(M),de=R.getStart(h.sf,!1),ye=`${h.rel}#call${String(ue)}`;ue+=1;let De="unresolved",en=[],F=O(M);F!==null&&(De="resolved",en.push(F)),S.push({id:ye,enclosingFunctionId:v(de),calleeExprShape:G,resolvedTargetIds:en,resolution:De,range:Rn(h.rel,R,h.sf)});for(let re of en)x.push({callSiteId:ye,calleeFunctionId:re,resolution:De});if(F===null){let re=H(M);if(re!==null)x.push({callSiteId:ye,calleeFunctionId:re,resolution:"field-based"});else if(s&&c.isPropertyAccessExpression(M)&&(M.name.text==="call"||M.name.text==="apply")){let ie=C(M.expression);ie!==null?(x.push({callSiteId:ye,calleeFunctionId:ie,resolution:"field-based"}),ge(l,"A3",null)):ge(l,"A3",Q(M.expression))}}for(let re of U??[]){let ie=O(re);if(ie!==null)x.push({callSiteId:ye,calleeFunctionId:ie,resolution:"field-based"});else{let Ie=H(re);if(Ie!==null)x.push({callSiteId:ye,calleeFunctionId:Ie,resolution:"field-based"});else if(s){let Re=C(re),me=ze(re),nn=me!==re||c.isCallExpression(me)&&c.isPropertyAccessExpression(me.expression)&&me.expression.name.text==="bind";Re!==null?(x.push({callSiteId:ye,calleeFunctionId:Re,resolution:"field-based"}),nn&&ge(l,"A2p",null)):nn&&ge(l,"A2p",Q(re))}}}}c.forEachChild(R,Dn)};Dn(h.sf);for(let R of n.computedLoads.get(h.rel)??[]){let M=R.candidateRels.filter(G=>i.has(G)).map(G=>`${G}#<toplevel>`);if(M.length===0)continue;let U=`${h.rel}#dirload${String(ue)}`;ue+=1,S.push({id:U,enclosingFunctionId:v(R.pos),calleeExprShape:"require",resolvedTargetIds:M,resolution:"field-based",range:{path:h.rel,start:R.pos,end:R.pos}});for(let G of M)x.push({callSiteId:U,calleeFunctionId:G,resolution:"field-based"})}let Zn=0;for(let R of o.get(h.rel)??[]){let M=`${h.rel}#handlerseed${String(Zn)}`;Zn+=1;let U=R.node.getStart(h.sf,!1);S.push({id:M,enclosingFunctionId:h.toplevelId,calleeExprShape:"member",resolvedTargetIds:[R.id],resolution:"field-based",range:{path:h.rel,start:U,end:U}}),x.push({callSiteId:M,calleeFunctionId:R.id,resolution:"field-based"})}}let k=new Map;if(a)for(let h of i.values())for(let[b,A]of h.mintSeedAliases)k.set(`${h.rel}::${String(b)}`,A);return{functions:y,callSites:S,callEdges:x,exports:_,exportBindings:w,classes:I,mintSeedAliases:k,bindingApplicability:l}}function mp(e,n,t){let o=i=>i.length===0||qe.isAbsolute(i)||i.includes("\\")||/^[a-zA-Z]:/u.test(i)||i.split("/").some(d=>d===".."||d==="");if(o(n)||o(t))return null;let r=e.endsWith(qe.sep)?e:e+qe.sep,s;try{s=oa(qe.resolve(e,n))}catch{return null}if(!s.startsWith(r))return null;let a=s.endsWith(qe.sep)?s:s+qe.sep,l;try{l=oa(qe.resolve(s,t))}catch{return null}return l.startsWith(a)?l:null}function Aa(e,n,t){let o=`${e}#class:${t}`,r=[],s=[],a=[],l=new Set;return{pushMember(i,d,u,p){if(i==="__proto__"||l.has(i))return;l.add(i);let f=`${e}#${t}.${i}`;r.push({id:f,moduleId:e,name:i,kind:u,enclosingClassId:o,declRange:Rn(e,d,n),isExported:!1,publicSurfaceReachable:!1}),a.push(f),s.push({name:i,id:f,kind:u,body:p})},finish(){return s.length===0?null:{functions:r,classNode:{id:o,moduleId:e,name:t,implementsRefs:[],members:a},members:s}}}}function hp(e,n,t,o){if(Ia(o)||o.members.length>Tr)return null;let r=Aa(e,n,t);for(let s of o.members){let a,l,i;if(c.isConstructorDeclaration(s))a="constructor",l="ctor",i=void 0;else if(c.isMethodDeclaration(s))a=Eo(s.name),l="method",i=a!==void 0&&!it.has(a)?s.body??void 0:void 0;else continue;a!==void 0&&r.pushMember(a,s,l,i)}return r.finish()}function gp(e,n,t){let o;for(let a of n.statements)if(c.isFunctionDeclaration(a)&&a.name?.text===t){o=a;break}if(o===void 0)return null;let r=[];for(let a of n.statements){if(!c.isExpressionStatement(a))continue;let l=a.expression;if(!c.isBinaryExpression(l)||l.operatorToken.kind!==c.SyntaxKind.EqualsToken)continue;let i=l.left;if(c.isPropertyAccessExpression(i)&&c.isPropertyAccessExpression(i.expression)&&c.isIdentifier(i.expression.expression)&&i.expression.expression.text===t&&i.expression.name.text==="prototype"){let d=i.name.text;c.isFunctionExpression(l.right)?r.push({name:d,fn:l.right,walk:!0}):c.isArrowFunction(l.right)&&r.push({name:d,fn:l.right,walk:!1})}}if(r.length===0||r.length+1>Tr)return null;let s=Aa(e,n,t);s.pushMember("constructor",o,"ctor",void 0);for(let a of r){let l=a.walk&&!it.has(a.name)&&c.isFunctionExpression(a.fn)?a.fn.body:void 0;s.pushMember(a.name,a.fn,"method",l)}return s.finish()}function yp(e,n,t){for(let o of n.statements)if(c.isClassDeclaration(o)&&o.name?.text===t)return hp(e,n,t,o);return gp(e,n,t)}function xp(e,n,t,o,r){let s={modules:[],functions:[],classes:[],callSites:[],callEdges:[],imports:[],importEdges:[],diagnostics:[]};if(n.length===0)return s;let a=new Set(t.map(p=>p.packageName)),l=new Set(t.map(p=>p.path)),i=new Set,d=new Set,u=0;for(let p of n){if(!a.has(p.packageName))continue;let f=mp(e.appRoot,p.packageRootRel,p.sourcePath);if(f===null)continue;let m=e.toRel(f);if(m===null)continue;let g=`${m}#${p.container}`;if(d.has(g)||!i.has(m)&&i.size>=So)continue;let y=Oe(f);if(y===null)continue;let S;try{S=c.createSourceFile(m,y,c.ScriptTarget.Latest,!0,c.ScriptKind.JS)}catch{continue}let x=yp(m,S,p.container);if(x===null)continue;i.add(m),d.add(g);let _=new Map,w=new Map;for(let k of x.members){let h=r.methodFor(p.packageName,p.container,k.name,k.kind);_.set(k.name,h),w.set(h,k.id)}let I=0;for(let k of x.members){if(k.body===void 0)continue;let h=(b,A)=>{if(A&&c.isCallExpression(b)&&c.isPropertyAccessExpression(b.expression)&&b.expression.expression.kind===c.SyntaxKind.ThisKeyword){let T=_.get(b.expression.name.text);if(T!==void 0){let N=`${m}#depclass:${p.container}.${k.name}#c${String(I)}`;I+=1,s.callSites.push({id:N,enclosingFunctionId:k.id,calleeExprShape:"member",resolvedTargetIds:[],resolution:"unresolved",range:Rn(m,b,S)}),s.callEdges.push({callSiteId:N,calleeFunctionId:T,resolution:"field-based"})}}let P=c.isFunctionExpression(b)||c.isFunctionDeclaration(b)||c.isMethodDeclaration(b)||c.isConstructorDeclaration(b)||c.isGetAccessorDeclaration(b)||c.isSetAccessorDeclaration(b)||c.isClassLike(b),v=c.isArrowFunction(b)?A:P?!1:A;c.forEachChild(b,T=>{h(T,v)})};h(k.body,!0)}for(let k of o){let h=w.get(k.calleeFunctionId);h!==void 0&&s.callEdges.push({callSiteId:k.callSiteId,calleeFunctionId:h,resolution:"field-based"})}if(s.functions.push(...x.functions),s.classes.push(x.classNode),!l.has(m)){l.add(m),s.modules.push({id:m,packageName:p.packageName,versionRange:"",path:m,moduleSystem:"cjs",isEntrypoint:!1});let k=r.moduleFor(p.packageName),h=`${String(k)}#depclass${String(u)}`;u+=1,s.imports.push({id:h,moduleId:k,specifier:"<dep-class-corridor>",isNamespace:!1,isDefault:!1,dynamic:!1,specifierIsLiteral:!0,resolvedModuleId:m}),s.importEdges.push({importId:h,resolvedModuleId:m})}s.diagnostics.push({code:"dep-class-corridor",path:m,detail:`lowered dependency class ${p.container} (${p.packageName}) \u2014 ${String(x.members.length)} members; the un-analyzed remainder caps this class's method sinks at unknown`,classScope:{packageName:p.packageName,container:p.container}})}return s}function bp(e,n,t,o){let r=new Set(e.modules.filter(i=>i.isEntrypoint).map(i=>i.packageName)),s=new Map(e.functions.map(i=>[i.id,i.moduleId])),a=new Map;for(let i of e.callSites){if(i.resolution!=="unresolved")continue;let d=s.get(i.enclosingFunctionId);d!==void 0&&a.set(d,(a.get(d)??0)+1)}let l=[];for(let i of e.modules){if(i.externalSurface===!0)continue;let d=n.get(i.path);if(d===void 0||t.has(i.path)||r.has(i.packageName)&&o.has(i.path)&&!i.path.split("/").includes("node_modules"))continue;let u=a.get(i.id)??0;if(u===0&&ep(d))continue;let p=u>0?`${String(u)} of its call sites are unresolved`:"it invokes (or exposes) a function body through a form that emits no call site \u2014 `new`, an accessor, the iterator protocol, spread, or a coercion member";l.push({code:"dependency-body",path:i.path,detail:`dependency module analyzed with full bodies (package-subpath/relative/computed entry) but ${p}; its hidden call edges are bounded by its own forward module reach (ADR-069 Finding A)`,anchor:i.id})}return l}function Na(e,n,t=[],o={},r=!1){let s=new Cr,a=Rf(e,n,s),l=new Set;for(let I of a.computedLoads.values())for(let k of I)if(k.seedable)for(let h of k.candidateRels)l.add(h);let i=new Map;for(let I of e.sourceFiles){let k=e.toRel(I.fileName);if(k===null||!l.has(k)||k.split("/").includes("node_modules"))continue;let h=lp(k,I);h.length>0&&i.set(k,h)}let d=i.size===0?a.modules:a.modules.map(I=>i.has(I.path)&&!I.isEntrypoint?{...I,isEntrypoint:!0}:I),u={...a,modules:d},p=pp(e,u,s,i,o),f=Zf(e,a,p.functions,p.mintSeedAliases),m=new Set(a.modules.map(I=>I.path)),g=Cf(e.depReach,s,m),y=[...u.modules,...g.modules,...s.modules()],S=xp(e,t,y,p.callEdges,s),x=[];if(r){let I="#default",k=new Set;for(let b of p.callEdges){let A=String(b.calleeFunctionId);!A.startsWith("pkg:")||!A.endsWith(I)||k.add(A.slice(4,A.length-I.length))}let h=new Map;for(let b of e.depReach.edges){if(!("surface"in b.from)||"surface"in b.to)continue;let A=b.from.surface;h.set(A,h.has(A)?null:b.to.module)}for(let b of k){let A=h.get(b);if(A==null)continue;let P=Pf(qe.join(e.appRoot,A));if(P===null||P==="default")continue;let v=s.exportFor(b,P),T=`pkg:${b}${I}`;for(let N of p.callEdges)String(N.calleeFunctionId)===T&&x.push({callSiteId:N.callSiteId,calleeFunctionId:v,resolution:"field-based"})}}let _={modules:[...u.modules,...g.modules,...S.modules,...s.modules()],exports:[...p.exports,...f.exports],imports:[...a.imports,...g.imports,...S.imports],functions:[...p.functions,...s.functions(),...S.functions],callSites:[...p.callSites,...S.callSites],classes:[...p.classes,...s.classes(),...S.classes],callEdges:[...p.callEdges,...S.callEdges,...x],importEdges:[...a.importEdges,...g.importEdges,...S.importEdges],exportBindings:[...p.exportBindings,...f.exportBindings],inheritEdges:[]},w=new Map;for(let I of e.sourceFiles){let k=e.toRel(I.fileName);k!==null&&w.set(k,I)}return{graph:_,diagnostics:[...f.diagnostics,...S.diagnostics,...bp(_,w,new Set(e.diagnostics.filter(I=>I.code==="dependency-body").map(I=>I.path)),a.appOwnedPaths)],loadSites:a.loadSites,...p.bindingApplicability!==void 0?{bindingApplicability:p.bindingApplicability}:{}}}var Sp=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,wo=/^[A-Za-z0-9_$.-]{1,128}$/u;function kp(e){return Sp.test(e.calleePackage)?wo.test(e.anchorExport)?wo.test(e.calleeExport)?e.anchorContainer!==null&&!wo.test(e.anchorContainer)?`anchorContainer ${JSON.stringify(e.anchorContainer)}`:e.calleeContainer!==null&&!wo.test(e.calleeContainer)?`calleeContainer ${JSON.stringify(e.calleeContainer)}`:null:`calleeExport ${JSON.stringify(e.calleeExport)}`:`anchorExport ${JSON.stringify(e.anchorExport)}`:`calleePackage ${JSON.stringify(e.calleePackage)}`}function Rt(e,n){let t=[],o=[],r=new Map(e.modules.map(d=>[d.id,d])),s=new Map(e.classes.map(d=>[d.id,d.name])),a=(d,u,p)=>e.functions.some(f=>{if(f.name!==u)return!1;let m=r.get(f.moduleId);return m===void 0||m.packageName!==d?!1:(f.enclosingClassId!==void 0?s.get(f.enclosingClassId)??null:null)===p}),l=(d,u,p)=>{for(let f of e.functions){if(f.name!==u)continue;let m=r.get(f.moduleId);if(!(m===void 0||m.packageName!==d||(f.enclosingClassId!==void 0?s.get(f.enclosingClassId)??null:null)!==p))return f.id}return null},i=[...n].sort((d,u)=>d.modelId<u.modelId?-1:d.modelId>u.modelId?1:0);for(let d of i){if(d.edges.length>64){t.push(`model ${d.modelId}: ${String(d.edges.length)} edges over cap ${String(64)} \u2014 dropped WHOLE (all-or-nothing)`);continue}let u=d.edges.map(kp).find(m=>m!==null);if(u!==void 0){t.push(`model ${d.modelId}: hostile/invalid edge field ${u} \u2014 model refused WHOLE`);continue}let p=0,f=0;for(let m of d.edges){if(!a(d.packageName,m.anchorExport,m.anchorContainer)){f+=1;continue}o.push({modelId:d.modelId,kind:m.kind,anchor:{packageName:d.packageName,exportName:m.anchorExport,container:m.anchorContainer},callee:{packageName:m.calleePackage,exportName:m.calleeExport,container:m.calleeContainer,realFunctionId:l(m.calleePackage,m.calleeExport,m.calleeContainer)},resolution:"modeled"}),p+=1}p>0?t.push(`model-edge ${d.modelId}: ${String(p)} edge(s) lowered, ${String(f)} reference-gated`):t.push(`model ${d.modelId}: refused \u2014 no anchor surface in the graph (${String(f)} edge(s) reference-gated); models never mint loadedness`)}return{delta:{records:o,notes:t}}}var Ep={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function zr(e){try{let n=Ji(e.appRoot,e.entrypoints,e.tsconfigPaths===!0),t=new Set(e.entrypoints.map(l=>l.split(Je.sep).join("/"))),{graph:o,diagnostics:r,loadSites:s,bindingApplicability:a}=Na(n,t,e.depClassAnchors??[],e.bindingForms??{},e.callablePackageResolver===!0);return{graph:o,diagnostics:[...n.diagnostics,...r],loadSites:s,conditionUnions:n.conditionUnions,provenAbsent:n.provenAbsent,...a!==void 0?{bindingApplicability:a}:{}}}catch(n){return{graph:Ep,loadSites:[],conditionUnions:[],provenAbsent:[],diagnostics:[{code:"unsupported-syntax",path:e.appRoot,detail:`analysis aborted: ${n instanceof Error?n.message:String(n)}`}]}}}function Ra(e,n){let t=512,o=(r,s,a)=>{if(!(t<=0||s>12)){if(t-=1,typeof r=="string"){n(r,a);return}if(Array.isArray(r)){for(let l of r)o(l,s+1,a);return}if(r!==null&&typeof r=="object")for(let[l,i]of Object.entries(r))l==="types"||l==="typings"||o(i,s+1,a||l.includes("*"))}};o(e,0,!1)}function Ca(e,n,t,o=!1){if(typeof t!="string"||t.length===0||t.endsWith(".d.ts")||t.endsWith(".d.mts")||t.endsWith(".d.cts"))return null;let r;try{r=En(Je.resolve(e,t))}catch{return null}return r!==e&&!r.startsWith(n)||o&&!fn(r)?null:r===e?"":r.slice(n.length).split(Je.sep).join("/")}var wp=1024*1024,vp=4096;function Pa(e,n){let t=e.toLowerCase(),o=0;for(;;){let r=t.indexOf(n,o);if(r===-1)return null;let s=r===0?" ":t[r-1],a=r+n.length;for(;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
 `||e[a]==="\r");)a+=1;if(/[a-z0-9_:-]/i.test(s??" ")||e[a]!=="="){o=r+n.length;continue}for(a+=1;a<e.length&&(e[a]===" "||e[a]==="	"||e[a]===`
-`||e[a]==="\r");)a+=1;let l=e[a];if(l==='"'||l==="'"){let d=e.indexOf(l,a+1);return d===-1?null:e.slice(a+1,d)}let i=a;for(;i<e.length&&!/[\s>]/.test(e[i]??"");)i+=1;return e.slice(a,i)}}function pp(e){let n=[],t=e.toLowerCase(),o=0;for(;;){let r=t.indexOf("<script",o);if(r===-1)break;let s=t[r+7];if(s!==void 0&&/[a-z0-9-]/.test(s)){o=r+7;continue}let a=e.indexOf(">",r);if(a===-1)break;o=a+1;let l=e.slice(r+7,a);if(l.length>fp)continue;let i=ba(l,"type");n.push({module:(i??"").trim().toLowerCase()==="module",src:ba(l,"src")})}return n}function mp(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function hp(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function gp(e){let n=kn(e),t=n.endsWith(Xe.sep)?n:n+Xe.sep,o=new Set,r=[],s=[],a=[],l=[],i=[],d=!1,u=(O,F,K=!1,te)=>{let U=wa(n,t,O);return U===null||U.length===0?"unresolved":o.has(U)?"duplicate":(o.add(U),r.push(U),s.push({source:F,specifier:He(te??(typeof O=="string"?O:"")),entrypoint:U,launch:K}),"added")},p=new Set,f=(O,F,K=!1)=>{let te=u(O,F),U=typeof O=="string"&&O.includes("\\")?u(O.split("\\").join("/"),F,!1,O):"unresolved";if(te!=="unresolved"||U!=="unresolved"||typeof O!="string"||O.trim().length===0||O.endsWith(".d.ts")||O.endsWith(".d.mts")||O.endsWith(".d.cts"))return;if(K&&O.includes("*")){let D=Wi(n,O),C=!1;if(D!==null){for(let H of D.matches)u(H,F,!1,O)!=="unresolved"&&(C=!0);if(!D.truncated&&C)return}l.push({source:F,file:"package.json",detail:`\`${He(O)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let X=`${F}\0${O}`;p.has(X)||(p.add(X),l.push({source:F,file:"package.json",detail:`\`${He(O)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},m=[],g=(O,F)=>{a.push({source:O,file:O,detail:F.detail}),m.push({code:F.code,path:O,detail:`${O} ${F.detail}`})},y,b,x,I=null,w=Cr(n,t,"package.json",In);w.kind==="refused"&&g("package.json",w);try{let O=w.kind==="ok"?JSON.parse(w.text):{};if(I=w.kind==="ok"?O:null,f(O.main,"main"),typeof O.bin=="string")f(O.bin,"bin");else if(O.bin!==null&&typeof O.bin=="object")for(let K of Object.values(O.bin))f(K,"bin");Sa(O.exports,(K,te)=>{f(K,"exports",te)}),typeof O.browser=="string"?f(O.browser,"browser"):Sa(O.browser,K=>{u(K,"browser")});let F=O.scripts;if(F!==null&&typeof F=="object"){let K=F;y=K.start,b=K.prestart,x=K.poststart}}catch{}if(r.length===0)try{kn(Xe.join(n,"index.js")),u("index.js","index.js fallback")}catch{}let A=(O,F)=>{if(typeof O=="string"&&O.trim().length>0){let K=ka(O,F,"package.json",u,a,!1)==="used";return K&&(d=!0),K?"resolved":"gapped"}return O===void 0||typeof O=="string"?"absent":(a.push({source:F,file:"package.json",detail:`${F} is not a string; no entry file could be read from it`}),"gapped")},k=A(y,"scripts.start"),h=A(b,"scripts.prestart"),S=A(x,"scripts.poststart"),_=k==="resolved"&&h!=="gapped"&&S!=="gapped",P=Cr(n,t,"Procfile",65536);if(P.kind==="refused")g("Procfile",P);else if(P.kind==="ok"){let{entries:O,truncated:F,unnamedLines:K}=wr(P.text);F&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),K>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(K)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let te of O)ka(te.command,`Procfile:${te.name}`,"Procfile",u,a,_)==="used"&&(d=!0)}let v=r.length===0,T=Cr(n,t,"index.html",up);if(T.kind==="ok")for(let O of pp(T.text)){if(O.src===null)continue;let F=He(O.src);if(!O.module){i.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${F}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(mp(O.src)){i.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${F}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}u(hp(O.src),"index.html",!1,O.src)==="unresolved"&&a.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${F}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else T.kind==="refused"&&i.push({kind:T.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${T.detail}`,root:""});let N=v?xr(n,I):null;if(N!==null){let O=0;for(let F of br(n,N).roots)u(F,`framework:${N.name}`)==="added"&&(O+=1);O>0&&m.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${N.name}'s directory conventions (recognised via ${N.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let j=O=>O.map(F=>({...F,root:""}));return{entrypoints:r,sources:j(s),gaps:j(a),surfaceGaps:j(l),launchResolved:d,diagnostics:m,framework:N,observations:i}}function Cr(e,n,t,o){let r;try{r=kn(Xe.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=nt(r,o);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(o)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function ka(e,n,t,o,r,s){let a=Er(e);if(a.kind==="delegates")return s?"used":(r.push({source:n,file:t,detail:`\`${He(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(a.kind==="unparsed")return r.push({source:n,file:t,detail:`\`${He(e)}\`: ${a.reason}`}),"gapped";let l=o(a.specifier,n,!0),i=a.alt===void 0?"unresolved":o(a.alt,n,!0);return l==="unresolved"&&i==="unresolved"?(r.push({source:n,file:t,detail:`\`${He(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function it(e,n){return e===""?n:`${e}/${n}`}function va(e,n){let t=kn(e),o=t.endsWith(Xe.sep)?t:t+Xe.sep,r=new Set,s=[],a=[],l=[],i=[],d=[],u=[],p=!1,f=null,m=[...n].sort((g,y)=>g.rel===""?-1:y.rel===""?1:g.rel<y.rel?-1:g.rel>y.rel?1:0);for(let g of m){let y=it(g.rel,"package.json"),b=g.rel===""?".":g.rel,x;try{x=kn(g.abs)}catch{l.push({source:"root",file:y,detail:`root \`${b}\` could not be resolved; not seeded`,root:g.rel});continue}if(x!==t&&!x.startsWith(o)){l.push({source:"root",file:y,detail:`root \`${b}\` resolves outside the scan root; refused, not seeded`,root:g.rel});continue}let I;try{I=gp(x)}catch{l.push({source:"root",file:y,detail:`root \`${b}\` could not be read; not seeded`,root:g.rel});continue}for(let w of I.sources){let A=it(g.rel,w.entrypoint),k,h;try{k=kn(Xe.resolve(t,A)),h=kn(Xe.resolve(x,w.entrypoint))}catch{l.push({source:w.source,file:y,detail:`\`${w.specifier}\` re-based to \`${A}\` did not resolve; not seeded`,root:g.rel});continue}if(!k.startsWith(o)||k!==h){l.push({source:w.source,file:y,detail:`\`${w.specifier}\` re-based to \`${A}\` escapes the scan root or names another file; refused, not seeded`,root:g.rel});continue}r.has(A)||(r.add(A),s.push(A),a.push({...w,entrypoint:A,root:g.rel}))}I.launchResolved&&(p=!0);for(let w of I.gaps)l.push({...w,file:it(g.rel,w.file),root:g.rel});for(let w of I.surfaceGaps)i.push({...w,file:it(g.rel,w.file),root:g.rel});for(let w of I.diagnostics)d.push({...w,path:it(g.rel,w.path)});for(let w of I.observations)u.push({...w,file:it(g.rel,w.file),root:g.rel});g.rel===""&&(f=I.framework)}return{entrypoints:s,sources:a,gaps:l,surfaceGaps:i,launchResolved:p,diagnostics:d,framework:f,observations:u}}function Dr(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let o=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${o}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Lr(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let o=[...new Set(t.slice(0,3).map(r=>r.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${o}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Ia(e,n){let t=kn(e),o=t.endsWith(Xe.sep)?t:t+Xe.sep,r=new Set,s=[],a=[];for(let l of n){let i=wa(t,o,l,!0);if(i===null||i.length===0){a.push(l);continue}r.has(i)||(r.add(i),s.push(i))}return{entrypoints:s,rejected:a}}import{readdirSync as il,readFileSync as qr,realpathSync as Gr,statSync as Dt}from"node:fs";import sn from"node:path";function yp(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let o=t+2;for(;o<e.length&&e.charCodeAt(o)===32;)o+=1;let r=e.charCodeAt(o);return r===38||r===42}function Nt(e,n,t){let o=n.maxLines??2e6,r=n.maxLineBytes??16384,s=!1,a=!1,l=0,i=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let u=e.indexOf(`
-`,d),p=u===-1;p&&(u=e.length);let f=u>d&&e.charCodeAt(u-1)===13?u-1:u;if(i+=1,i>o){s=!0;break}if(f-d>r)l+=1;else{let m=d;for(;m<f&&e.charCodeAt(m)===32;)m+=1;let g=m-d,y=f;for(;y>m&&(e.charCodeAt(y-1)===32||e.charCodeAt(y-1)===9);)y-=1;if(m<y&&e.charCodeAt(m)!==35){let b=e.slice(m,y);if(yp(b)){a=!0;break}t(g,b)}}if(p)break;d=u+1}return{truncated:s||l>0,refusedAnchors:a,oversizeLines:l}}function ko(e){let n=e.charCodeAt(0);if(n===34||n===39){let o=e.indexOf(String.fromCharCode(n),1);if(o===-1)return null;let r=o+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,o+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function at(e){return e.endsWith(":")}function on(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function Eo(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,o=t.indexOf("/");if(n){if(o<=0||t.indexOf("/",o+1)!==-1)return!1}else if(o!==-1)return!1;let r=n?[t.slice(0,o),t.slice(o+1)]:[t];for(let s of r){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let a=0;a<s.length;a+=1){let l=s.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function Rt(e){return Eo(e)?`node_modules/${e}`:""}function Pt(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var wo=2e5,Aa=64,vo=1024,xp=5,Sp=[1,2,3];function bp(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let o=e.slice(t+n.length);if(o==="")return null;let r=o.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function _a(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let o=t.indexOf("@",1);if(o>0){let r=t.slice(0,o),s=t.slice(o+1);if(r.length>0&&s.length>0)return[{name:r,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function lt(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function Na(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Ra(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function Pa(e,n,t,o,r=!1){let s=JSON.stringify([n,t,o]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:o,dev:r})}}function kp(e,n){for(let[t,o]of Object.entries(e)){if(t==="")continue;if(!Ra(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=lt(o);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let a=s.name,l=typeof a=="string"&&a!==""?a:bp(t),i=s.version;if(l===null||typeof i!="string"){r&&(n.unread+=1);continue}let d=s.dev===!0||s.devOptional===!0;for(let u of _a(l,i))Pa(n,u.name,u.version,t,d)}}function $a(e,n,t){let o=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let s=0;s<o.length;s+=1){let a=o[s];if(a===void 0)break;for(let[l,i]of Object.entries(a.deps)){if(!Ra(n))return{depthCapped:r};if(l===""){n.unread+=1;continue}let d=lt(i);if(d===null){n.unread+=1;continue}let u=a.pathSafe&&Eo(l),p=u?`${a.prefix}node_modules/${l}`:"",f=u&&p.length<=vo,m=f?p:"",g=d.version,y=d.dev===!0||a.dev;if(d.link!==!0&&typeof g=="string"&&g!=="")for(let x of _a(l,g))Pa(n,x.name,x.version,m,y);else n.unread+=1;let b=lt(d.dependencies);if(b!==null){if(a.depth+1>t){r=!0;continue}o.push({deps:b,prefix:f?`${m}/`:a.prefix,depth:a.depth+1,pathSafe:f,dev:y})}}}return{depthCapped:r}}function Ep(e,n,t){let o=Na(n.maxEntries),{depthCapped:r}=$a(e,o,t),s=[],a=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),l=new Set,i=[];for(let d of o.deps){if(d.version.includes(":"))continue;let u=JSON.stringify([d.name,d.version]);a.has(u)||l.has(u)||(l.add(u),i.length<xp&&i.push(Pt(d.name,d.version)))}if(l.size>0){let d=l.size-i.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${i.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(o.capped||r)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function Io(e,n={}){let t=[],o;try{o=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=lt(o);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=r.lockfileVersion,a=typeof s=="number"&&Number.isInteger(s)?s:null,l=typeof s=="number"?String(s):"?",i=lt(r.packages),d=lt(r.dependencies);if(i===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!Sp.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??Aa,p=Na(n.maxEntries??wo),f=!1;return i!==null?(kp(i,p),d!==null&&t.push(...Ep(d,p,u))):d!==null&&(f=$a(d,p,u).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),f&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||f}}var wp=["workspace:","link:","portal:","file:","exec:"];function vp(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Ip(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let o=n.slice(0,t),r=n.slice(t+1);if(o.length===0)return[];for(let l of wp)if(r.startsWith(l))return[];if(!r.startsWith("npm:"))return[o];let s=r.slice(4),a=s.indexOf("@",1);if(a>0){let l=s.slice(0,a);return l.length>0?[l]:[o]}return s.length===0||vp(s)?[o]:[o,s]}function Ap(e){if(at(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let o=e.charCodeAt(t);if(o===34||o===39){n===0?n=o:n===o&&(n=0);continue}if(n===0&&o===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function _p(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let o of n.split(",")){let r=o.trim();r.length>0&&t.push(r)}return t}function Np(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let o=t.length;for(;o<n.length&&o<t.length+3;){let s=n.charCodeAt(o);if(s<48||s>57)break;o+=1}let r=n.slice(t.length,o);return r.length>0?r:null}function Oa(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=on(e.slice(8).trim());return t.length>0?t:null}function Fr(e,n={}){let t=[],o=[],r=new Set,s=n.maxEntries??2e5,a=!1,l=null,i=!1,d=[],u=!1,p=-1,f=!1,m=0,g=()=>{d.length>0&&!u&&(m+=1)},y=Nt(e,n,(w,A)=>{if(w===0){g(),d=[],u=!1,p=-1,i=!1;let h=Ap(A);if(h===null)return;let S=on(h.trim());if(S==="__metadata"){a=!0,i=at(A);return}for(let _ of _p(S))d.push(...Ip(_));return}if(i){if(w===2&&l===null){let h=Oa(A);h!==null&&(l=h)}return}if(d.length===0||(p===-1&&(p=w),w!==p||u))return;let k=Oa(A);if(k!==null){u=!0;for(let h of d){let S=JSON.stringify([h,k]);if(!r.has(S)){if(o.length>=s){f=!0;return}r.add(S),o.push({name:h,version:k,lockKey:Rt(h),dev:!1})}}}});g();let b=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(y.refusedAnchors)return{deps:[],diagnostics:[`${b} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};y.oversizeLines>0&&t.push(`${b} has ${String(y.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),f&&t.push(`${b} exceeds ${String(s)} entries; truncated`);let x=l??Np(e),I=x===null?null:Number(x.split(".")[0]);return x!==null&&(I===null||!Number.isInteger(I)||I<1||I>8)&&t.push(`${b} declares unsupported lockfileVersion ${x} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),m>0&&t.push(`${b} has ${String(m)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:o,diagnostics:t,truncated:y.truncated||f}}function jr(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let o=n.indexOf("_");return o!==-1&&(n=n.slice(0,o)),n.trim()}function Br(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Ca(e){let n=on(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let o=n.charCodeAt(0)===47;if(o&&(n=n.slice(1)),n.length===0)return null;if(!o&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),p=n.indexOf("@",1);u>0&&(p===-1||u<p)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let r=n.charCodeAt(0)===64,s=r?n.indexOf("/"):-1;if(r&&s<=0)return null;let a=r?s+1:0,l=-1;for(let u=a;u<n.length;u+=1){let p=n.charCodeAt(u);if(p===47||p===64){l=u;break}}if(l<=a)return null;let i=n.slice(0,l),d=jr(n.slice(l+1));return Br(d)?{name:i,version:d}:null}var Rp=new Set(["packages","snapshots","importers"]),Pp=new Set([5,6,7,8,9]);function $p(e){let n=on(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function _o(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:on(e.slice(0,n).trim()),value:on(t)}}function Kr(e,n={}){let t=[],o=[],r=new Set,s=n.maxEntries??2e5,a="",l=null,i=!1,d=0,u=[],p=(m,g)=>{let y=JSON.stringify([m,g]);if(!r.has(y)){if(o.length>=s){i=!0;return}r.add(y),o.push({name:m,version:g,lockKey:Rt(m),dev:!1})}},f=Nt(e,n,(m,g)=>{if(m===0){let y=ko(g);if(a=y===null?"":on(y.trim()),l=null,a==="lockfileVersion"){let b=_o(g),x=b===null?null:$p(b.value);b!==null&&(x===null||!Pp.has(x))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${b.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if(Rp.has(a)&&!at(g)){let b=_o(g)?.value.trim()??"";b!=="{}"&&b!=="[]"&&(d+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(m!==2)return;let y=ko(g),b=y===null?null:Ca(y);if(b===null){d+=1;return}p(b.name,b.version);return}if(a==="importers"){if(m===6){let y=_o(g);if(y===null){l=g.endsWith(":")?on(g.slice(0,-1).trim()):null;return}l=null;let b=jr(y.value);Br(b)&&p(y.key,b);return}if(m===8&&l!==null){let y=_o(g);if(y===null||y.key!=="version")return;let b=jr(y.value);Br(b)&&p(l,b)}}});return f.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),f.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(f.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),i&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:o,diagnostics:t,truncated:f.truncated||i})}function Da(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var Op=1e6,Ma=2e5,Cp=4096,Mp=65536,Tp=262144,$t=/^[A-Za-z_][A-Za-z0-9_]*$/u;function La(e){if(e.length>Op)return null;let n,t;for(let o of e.split(/\r?\n/u)){if(o==="")break;let r=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(o);if(r===null)continue;let s=r[1]?.toLowerCase();s==="name"&&n===void 0?n=r[2]?.trim():s==="version"&&t===void 0&&(t=r[2]?.trim())}return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}function Fa(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&$t.test(n))}function ja(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let o=e[t];if(o==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=o}return n}function Ba(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Ka(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function Ua(e){let n=e.split(/\r?\n/u);return n.length>Ma?n.slice(0,Ma):n}function za(e){let n=new Set;for(let t of Ua(e)){if(t==="")continue;let o=ja(t).split("/"),r=o[0]??"";if(Ba(r))continue;if(o.length>1){$t.test(r)&&n.add(r);continue}let s=Ka(r);s!==null&&$t.test(s)&&n.add(s)}return[...n].sort((t,o)=>t<o?-1:t>o?1:0)}function Dp(e){let n=e.split("/"),t=n[0]??"";if(Ba(t))return null;let o=n[n.length-1]??"",r=Ka(o);if(r===null)return null;let s=n.slice(0,-1);if(s.some(l=>!$t.test(l)||l==="__pycache__"))return null;let a=r==="__init__"?s:[...s,r];return a.length===0||!$t.test(r==="__init__"?s[s.length-1]??"":r)?null:a}function Wa(e,n=Cp){let t=new Set,o=0,r=0,s=!1;for(let a of Ua(e)){if(a==="")continue;let l=ja(a),i=Dp(l);if(i!==null){o+=1,(l.endsWith(".so")||l.endsWith(".pyd"))&&(r+=1);for(let d=1;d<=Math.min(2,i.length);d+=1){let u=i.slice(0,d).join(".");if(!t.has(u)){if(t.size>=n){s=!0;break}t.add(u)}}}}return{prefixes:[...t].sort((a,l)=>a<l?-1:a>l?1:0),moduleFiles:o,extensionModules:r,capped:s}}function Lp(e){if(e.length>Tp)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let o=t.trim();if(!(o===""||o.startsWith("#")||o.startsWith(";"))){if(o.startsWith("[")){let r=o.slice(1,o.endsWith("]")?-1:void 0).trim();n=r==="console_scripts"||r==="gui_scripts";continue}if(n&&o.includes("="))return!0}}return!1}function Va(e){if(e.length>Mp)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,o=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:o?.editable===!0}}function Ot(e,n){let t=La(e);if(t===null)return null;let o=n.topLevelText!==void 0?Fa(n.topLevelText):[],r=o.length>0?o:n.recordText!==void 0?za(n.recordText):[],s=n.recordText!==void 0?Wa(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},a=n.entryPointsText!==void 0?Lp(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",l=n.directUrlText!==void 0?Va(n.directUrlText)?.editable??!1:!1;return{name:Da(t.name),version:t.version,importNames:r,modulePrefixes:s.prefixes,moduleFiles:s.moduleFiles,editable:l,consoleScripts:a,extensionModules:s.extensionModules,recordKnown:n.recordText!==void 0}}function Ta(e,n,t){let o=e.get(n);o===void 0?e.set(n,[t]):o.includes(t)||o.push(t)}function Ur(e){let n=new Map,t=new Map,o=[];for(let r of e){if(r.importNames.length===0){o.push(r);continue}for(let s of r.importNames)Ta(n,s,r);for(let s of r.modulePrefixes)Ta(t,s,r)}return{byImportName:n,byModulePrefix:t,unmapped:o}}function No(e,n){let t=n.split(".").filter(r=>r.length>0),o=t[0];if(o===void 0)return[];for(let r=Math.min(2,t.length);r>=1;r-=1){let s=e.byModulePrefix.get(t.slice(0,r).join("."));if(s!==void 0&&s.length>0)return s}return e.byImportName.get(o)??[]}import{statSync as rm}from"node:fs";import sm from"node:path";import{lstatSync as Fp,readFileSync as jp,readdirSync as Bp,realpathSync as zr,statSync as Ct}from"node:fs";import Se from"node:path";function Mt(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}var Xa=2e4,Ya=32,Ja=256,Kp=2*1024*1024,Up=256*1024,Za=256,zp=16,Wp=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],Vp=["pyproject.toml","setup.py","setup.cfg"],qp=["requirements.txt","Pipfile"],Gp=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],Qa={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function qa(e,n){try{let t=Ct(e);return!t.isFile()||t.size>n?null:jp(e,"utf8")}catch{return null}}function Rn(e){let n;try{n=Ct(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function Hp(e){try{return Ct(e).isDirectory()}catch{return!1}}function Xp(e,n){let t=0,o=0,r=-1,s=0;for(;o<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(o)))t+=1,o+=1;else if(t<e.length&&e.charAt(t)==="*")r=t,s=o,t+=1;else if(r>=0)t=r+1,s+=1,o=s;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function Yp(e,n){let t=(o,r)=>{if(o===e.length)return r===n.length;let s=e[o]??"";if(s==="**"){for(let l=r;l<=n.length;l+=1)if(t(o+1,l))return!0;return!1}if(r>=n.length)return!1;let a=n[r]??"";return(s.includes("*")||s.includes("?")?Xp(s,a):s===a)?t(o+1,r+1):!1};return t(0,0)}function Jp(e){let n=[],t=qa(Se.join(e,"package.json"),Kp);if(t!==null)try{let a=JSON.parse(t)?.workspaces;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l);else if(typeof a=="object"&&a!==null){let l=a.packages;if(Array.isArray(l))for(let i of l)typeof i=="string"&&n.push(i)}}catch{}let o=qa(Se.join(e,"pnpm-workspace.yaml"),Up);o!==null&&n.push(...Zp(o));let r=[];for(let s of n){if(r.length>=Za)break;let a=s.trim();if(a.length===0)continue;for(;a.startsWith("./");)a=a.slice(2);if(a.startsWith("/")||Se.isAbsolute(a))continue;let l=a.split("/").filter(i=>i.length>0);l.length===0||l.length>zp||l.includes("..")||r.push(l.join("/"))}return r}function Zp(e){let n=[],t=!1;for(let o of e.split(`
-`)){if(n.length>=Za)break;if(/^packages:\s*(#.*)?$/.test(o)){t=!0;continue}if(!t)continue;let r=/^\s+-\s*(.*?)\s*$/.exec(o);if(r===null){o.trim().length>0&&(t=!1);continue}let s=(r[1]??"").trim(),a=s.indexOf(" #");a>=0&&(s=s.slice(0,a).trim()),(s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2)&&(s=s.slice(1,-1)),s.length>0&&n.push(s)}return n}function Ga(e,n){let t=Se.relative(n,e);return t.length===0?!1:t.split(Se.sep).includes("node_modules")}function Ha(e,n){return Se.relative(e,n).split(Se.sep).join("/")}function Wr(e,n){let t=n?.maxDirs??Xa,o=n?.maxDepth??Ya,r=n?.maxRoots??Ja,s=n?.discoverPythonRoots??!0,a;try{a=zr(e)}catch{return{...Qa,observations:[{kind:"refused-unreadable",rel:""}]}}let l=[],i=[],d=new Set([a]),u=0,p=0,f=0,m="complete",g=Jp(a).map(w=>w.split("/")),y=w=>{let A="absent";for(let h of Vp){let S=Rn(Se.join(w,h));if(S==="regular"){A="declared";break}S==="refused"&&(A="refused")}if(A==="absent"&&qp.some(h=>Rn(Se.join(w,h))==="regular")&&(A="listed"),A==="absent")return{candidate:A,witnesses:[]};let k=[];return Gp.some(h=>Rn(Se.join(w,h))==="regular")&&k.push("own-lockfile"),Hp(Se.join(w,".venv"))&&k.push("installed-env"),{candidate:A,witnesses:k}},b=(w,A)=>{let k=y(w);return k.candidate==="absent"?"not-root":(k.candidate!=="listed"&&(p+=1),k.witnesses.length===0&&k.candidate!=="refused"?(k.candidate==="declared"&&i.push({kind:"undeclared-manifest",rel:A}),"not-root"):l.length>=r?"exhausted":(l.push({rel:A,abs:w,witnesses:k.witnesses,manifestRefused:k.candidate==="refused",ecosystem:"PyPI"}),"root"))},x=(w,A)=>{if(A.length===0){let P=Rn(Se.join(w,"package.json"))!=="absent",v=s?y(w):{candidate:"absent",witnesses:[]};return!P&&v.candidate!=="absent"?(l.push({rel:"",abs:w,witnesses:["scan-root",...v.witnesses],manifestRefused:!1,ecosystem:"PyPI"}),"root"):(l.push({rel:"",abs:w,witnesses:["scan-root",...v.witnesses],manifestRefused:!1,...v.witnesses.length>0?{alsoPython:!0}:{}}),"root")}let k=Rn(Se.join(w,"package.json"));if(k==="absent")return s?b(w,A):"not-root";p+=1;let h=[],S=A.split("/");g.some(P=>Yp(P,S))&&h.push("workspace-declared"),Wp.some(P=>Rn(Se.join(w,P))==="regular")&&h.push("own-lockfile");let _=s?y(w):{candidate:"absent",witnesses:[]};for(let P of _.witnesses)h.includes(P)||h.push(P);return h.length===0&&k!=="refused"?(i.push({kind:"undeclared-manifest",rel:A}),"not-root"):l.length>=r?"exhausted":(l.push({rel:A,abs:w,witnesses:h,manifestRefused:k==="refused",..._.witnesses.length>0?{alsoPython:!0}:{}}),"root")},I=[{abs:a,rel:"",depth:0}];for(;I.length>0;){let w=I.pop();if(w===void 0)break;if(u>=t){m="dirs-exhausted";break}u+=1;let A=x(w.abs,w.rel);if(A==="exhausted"){m="roots-exhausted";break}let k=A==="root";if(w.depth>=o){m=m==="complete"?"depth-clamped":m;continue}let h;try{h=Bp(w.abs)}catch{i.push({kind:"refused-unreadable",rel:w.rel});continue}h.sort().reverse();for(let S of h){let _=Se.join(w.abs,S),P=w.rel.length===0?S:`${w.rel}/${S}`,v;try{let j=Fp(_);v=j.isDirectory()||j.isSymbolicLink()&&Ct(_).isDirectory()}catch{continue}if(!v)continue;if(S==="node_modules"){k||i.push({kind:"unenumerated-install",rel:P});continue}if(S.startsWith(".")){f+=1,i.push({kind:"skipped-dot-directory",rel:P}),Rn(Se.join(_,"package.json"))!=="absent"&&i.push({kind:"undeclared-manifest",rel:P});continue}let T;try{T=zr(_)}catch{i.push({kind:"refused-unreadable",rel:P});continue}let N=a.endsWith(Se.sep)?a:a+Se.sep;if(T!==a&&!T.startsWith(N)){i.push({kind:"refused-out-of-root",rel:P});continue}Ga(T,a)||d.has(T)||(d.add(T),I.push({abs:T,rel:Ha(a,T),depth:w.depth+1}))}}for(let w of n?.operatorRoots??[]){let A=typeof w=="string"?w.slice(0,512):"",k=()=>{i.push({kind:"refused-operator-root",rel:A})};if(A.length===0||A.includes("\0")){k();continue}let h;try{h=zr(Se.resolve(a,A))}catch{k();continue}let S=a.endsWith(Se.sep)?a:a+Se.sep;if(h!==a&&(!h.startsWith(S)||Ga(h,a))){k();continue}let _;try{_=Ct(h).isDirectory()}catch{_=!1}if(!_||Rn(Se.join(h,"package.json"))!=="regular"){k();continue}let P=l.findIndex(N=>N.abs===h);if(P>=0){let N=l[P];N!==void 0&&!N.witnesses.includes("operator")&&(l[P]={...N,witnesses:[...N.witnesses,"operator"]});continue}let v=Ha(a,h);l.push({rel:v,abs:h,witnesses:["operator"],manifestRefused:!1});let T=i.findIndex(N=>N.kind==="undeclared-manifest"&&N.rel===v);T>=0&&i.splice(T,1)}return l.sort((w,A)=>w.rel<A.rel?-1:w.rel>A.rel?1:0),i.sort((w,A)=>w.kind!==A.kind?w.kind<A.kind?-1:1:w.rel<A.rel?-1:w.rel>A.rel?1:0),{roots:l,observations:i,budget:m,counts:{dirsWalked:u,manifestsSeen:p,rootsAdmitted:l.length,dotDirectoriesSkipped:f}}}import{lstatSync as el,readdirSync as Qp,readFileSync as em,realpathSync as ol,statSync as rl}from"node:fs";import ze from"node:path";var rn={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},nm=/^python\d+\.\d+$/u;function Pn(e,n){let t;try{t=rl(e)}catch(o){return{why:o?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:em(e,"utf8")}}catch{return{why:"unreadable"}}}function Vr(e,n){let t;try{if(t=ol(n),!rl(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+ze.sep)?t:null}function nl(e,n){return ze.relative(e,n).split(ze.sep).join("/")}function tl(e){try{return Qp(e).sort()}catch{return null}}function tm(e){let n=[],t=[],o=0;for(let r of e.split(/\r?\n/u)){let s=r.trim();if(!(s===""||s.startsWith("#"))){if(/^import[ \t]/u.test(s)){o+=1;let a=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(s);a?.[1]!==void 0&&t.length<rn.maxPthPaths&&t.push(a[1]);continue}n.length<rn.maxPthPaths&&n.push(s)}}return{paths:n,importLines:o,importModules:t}}function om(e){let n=null;for(let t of e.split(/\r?\n/u)){let o=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(o!==null){if(o[1]==="version_info")return o[2]??null;n??=o[2]??null}}return n}function Tt(e,n){let t=n?.envDir??rn.envDir,o=n?.maxDistributions??rn.maxDistributions,r=n?.maxMetadataBytes??rn.maxMetadataBytes,s=n?.maxRecordBytes??rn.maxRecordBytes,a=n?.maxTopLevelBytes??rn.maxTopLevelBytes,l=n?.maxDirectUrlBytes??rn.maxDirectUrlBytes,i=rn.maxEntryPointsBytes,d=t,u=[],p=(P,v,T=null)=>({envRel:d,refused:P,sitePackages:[],interpreter:T,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...u,v],truncated:!1}),f;try{f=ol(e)}catch{return p("absent","the root itself could not be resolved")}let m=ze.join(f,t),g;try{g=el(m)}catch(P){return P?.code==="ENOENT"?p("absent",`${d}: absent`):p("not-a-directory",`${d}: could not be inspected`)}if(!g.isDirectory()&&!g.isSymbolicLink())return p("not-a-directory",`${d}: not a directory`);let y=Vr(f,m);if(y===null)return p("escapes-root",`${d}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let b=Pn(ze.join(y,"pyvenv.cfg"),rn.maxPyvenvCfgBytes),x="text"in b?om(b.text):null;"text"in b||u.push(`${d}/pyvenv.cfg: ${b.why} \u2014 interpreter version unknown`);let I=[];for(let P of["lib","lib64"]){let v=tl(ze.join(y,P));if(v!==null)for(let T of v)nm.test(T)&&I.push(ze.join(y,P,T,"site-packages"))}I.push(ze.join(y,"Lib","site-packages"));let w=[],A=new Set;for(let P of I){let v=Vr(y,P);v===null||A.has(v)||(A.add(v),w.push(v))}if(w.length===0)return p("no-site-packages",`${d}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,x);w.length>1&&u.push(`${d}: ${String(w.length)} site-packages directories; all enumerated`);let k=[],h=[],S=0,_=!1;e:for(let P of w){let v=nl(f,P),T=tl(P);if(T===null){u.push(`${v}: unreadable; nothing enumerated there`);continue}for(let N of T){let j=ze.join(P,N),O=N.endsWith(".dist-info"),F=N.endsWith(".egg-info");if(N.endsWith(".pth")){let G=Pn(j,rn.maxPthBytes);if(!("text"in G)){u.push(`${v}/${N}: ${G.why}; the paths it adds were NOT enumerated`);continue}h.push({name:N,sitePackages:v,...tm(G.text)});continue}if(!O&&!F)continue;if(k.length>=o){_=!0,u.push(`${v}: the distribution cap (${String(o)}) was hit at ${N}; the enumeration is INCOMPLETE`);break e}let K;try{K=el(j)}catch{S+=1,u.push(`${v}/${N}: could not be inspected; not enumerated`);continue}let te=O?"dist-info":"egg-info";if(K.isFile()&&F){let G=Pn(j,r);"text"in G?k.push({dir:N,kind:te,metadata:G.text,entryPointsUnknown:!0}):(S+=1,u.push(`${v}/${N}: ${G.why}; not enumerated`));continue}let U=Vr(y,j);if(U===null){S+=1,u.push(`${v}/${N}: not a directory inside the environment; not enumerated`);continue}let X=O?"METADATA":"PKG-INFO",D=Pn(ze.join(U,X),r);if(!("text"in D)){S+=1,u.push(`${v}/${N}: ${X} ${D.why}; not enumerated`);continue}let C={dir:N,kind:te,metadata:D.text},H=Pn(ze.join(U,"entry_points.txt"),i);"text"in H?C.entryPoints=H.text:H.why!=="absent"&&(C.entryPointsUnknown=!0,u.push(`${v}/${N}/entry_points.txt: ${H.why}; the commands it declares are UNKNOWN`));let J=Pn(ze.join(U,"top_level.txt"),a);if("text"in J?C.topLevel=J.text:J.why!=="absent"&&u.push(`${v}/${N}/top_level.txt: ${J.why}; ignored`),O){let G=Pn(ze.join(U,"RECORD"),s);"text"in G?C.record=G.text:u.push(`${v}/${N}/RECORD: ${G.why}; import names from top_level.txt only`);let Y=Pn(ze.join(U,"direct_url.json"),l);"text"in Y&&(C.directUrl=Y.text)}k.push(C)}}return{envRel:d,refused:null,sitePackages:w.map(P=>nl(f,P)),interpreter:x,distInfos:k,pthFiles:h,unreadable:S,diagnostics:u,truncated:_}}var im=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function am(e,n){for(let t of n)try{if(rm(sm.join(e,t)).isFile())return t}catch{}return null}function sl(e){let n=[],t=[],o=(p,f)=>{t.push({kind:p,detail:f,blindsAnalysis:!1,rootRel:""}),n.push(f)},r=am(e,im),s=Tt(e);if(s.refused!==null){let p=s.refused==="absent"?`no \`${s.envRel}\` is installed`:`\`${s.envRel}\` could not be read (${s.refused})`;return o("no-installed-env",`${r??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:r,diagnostics:[...n,...s.diagnostics],truncated:!1,gaps:t}}let a=[],l=new Set,i=[],d=0;for(let p of s.distInfos){let f=Ot(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(f===null){d+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let m=JSON.stringify([f.name,f.version]);l.has(m)||(l.add(m),f.importNames.length===0&&i.push(f.name),a.push({name:f.name,version:f.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...s.diagnostics);let u=s.unreadable+d;return u>0&&o("installed-env-partial",`${String(u)} entr${u===1?"y":"ies"} under ${s.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(a.length)} enumerated were assessed normally.`),s.truncated&&o("installed-env-partial",`the environment walk under ${s.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),i.length>0&&n.push(`${String(i.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${i.slice(0,5).join(", ")}${i.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:a,source:a.length>0?"installed-env":"none",lockfilePath:r,diagnostics:n,truncated:s.truncated,gaps:t}}var lm=128*1024*1024,dm=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>Io(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>Io(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Fr(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Kr(e,n===void 0?{}:{maxEntries:n})}],cm=[".pnp.cjs",".pnp.data.json",".pnp.js"];function Hr(e,n){let t;try{t=Gr(sn.join(e,n))}catch{return null}let o=e.endsWith(sn.sep)?e:e+sn.sep;return t.startsWith(o)?t:null}function al(e,n){let t=sn.join(e,"package.json"),o;try{o=Gr(t)}catch{return null}if(!o.startsWith(n+sn.sep))return null;try{if(!Dt(o).isFile())return null;let r=JSON.parse(qr(o,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function ll(e,n){try{return Dt(sn.join(e,n)),!0}catch{return!1}}function um(e,n){if(ll(e,"pnpm-workspace.yaml"))return!0;let t=Hr(e,"package.json");if(t===null)return ll(e,"package.json");let o;try{let a=Dt(t);if(!a.isFile()||a.size>n)return!0;o=qr(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(o)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=r[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let s=r.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function dl(e,n){let t=sn.join(e,"node_modules"),o=[],r;try{r=il(t,{withFileTypes:!0})}catch{return o}for(let s of r){let a=s.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let i;try{i=il(sn.join(t,a),{withFileTypes:!0})}catch{continue}for(let d of i){let u=al(sn.join(t,a,d.name),n);u!==null&&o.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${d.name}`,linked:d.isSymbolicLink()||s.isSymbolicLink()})}continue}let l=al(sn.join(t,a),n);l!==null&&o.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:s.isSymbolicLink()})}return o}var fm=5;function pm(e,n,t){let o=Hr(e,n);if(o===null){try{Dt(sn.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=Dt(o)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:qr(o,"utf8")}}catch{return{gap:`${n} could not be read`}}}function mm(e,n){let t=Gr(e),o=[],r=[],s=n?.maxLockfileBytes??lm,a=[],l=new Set,i=[],d=um(t,s),u=null,p=!1,f=(g,y,b)=>{r.push({kind:g,detail:y,blindsAnalysis:b,rootRel:""}),o.push(y)};for(let g of dm){let y=pm(t,g.file,s);if(y===null)continue;if("gap"in y){f("lockfile-unreadable",y.gap,!1);continue}let b=g.parse(y.text,n?.maxLockfileEntries);if(b.truncated&&(p=!0),b.deps.length===0){if(b.diagnostics.length>0||d){let x=b.diagnostics.length>0?b.diagnostics.join("; "):"no entries found";f("lockfile-unparsed",`${g.file} yielded NO dependencies (${x}); its transitive dependency set was not enumerated`,!1)}continue}b.diagnostics.length>0&&f("lockfile-partial",`${g.file} was only partly enumerated (${b.diagnostics.join("; ")})`,!1),u===null&&(u=g.file),i.includes(g.source)||i.push(g.source);for(let x of b.deps){let I=JSON.stringify([x.name,x.version,x.lockKey]);l.has(I)||(l.add(I),a.push({...x,declaredIn:g.file}))}}for(let g of cm)if(Hr(t,g)!==null){f("yarn-pnp",`${g} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let g=i.length===1?i[0]??"none":"multi-lockfile";i.length>1&&o.push(`multiple lockfiles present (${i.join(", ")}); enumerated the UNION of all of them`);let y=new Set(a.map(I=>JSON.stringify([I.name,I.version]))),b=new Set,x=[];for(let I of dl(t,t)){let w=JSON.stringify([I.name,I.version,I.lockKey]);l.has(w)||(l.add(w),a.push({name:I.name,version:I.version,lockKey:I.lockKey,dev:I.dev,declaredIn:""}));let A=JSON.stringify([I.name,I.version]);I.linked||y.has(A)||b.has(A)||(b.add(A),x.length<fm&&x.push(Pt(I.name,I.version)))}if(b.size>0){let I=b.size-x.length;f("lockfile-skew",`node_modules holds ${String(b.size)} package(s) at a (name, version) no lockfile lists (${x.join(", ")}${I>0?`, and ${String(I)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:g,lockfilePath:u,diagnostics:o,truncated:p,gaps:r}}let m=dl(t,t);return m.length>0?(f("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(m.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:m.map(g=>({name:g.name,version:g.version,lockKey:g.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:o,truncated:p,gaps:r}):(d&&f("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:o,truncated:p,gaps:r})}function hm(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function gm(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function ul(e){return e===""||e.split("/").every(gm)}function ym(e,n){if(e===""||n==="")return n;if(!ul(e))return"";let t=`${e}/${n}`;return t.length<=vo?t:""}function cl(e,n){return e===""?n:`${e}: ${n}`}function xm(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function fl(e,n,t){let o=t?.maxUnionEntries??wo,r=n.roots.filter(hm),s=r.some(g=>g.rel==="")?r:[xm(e),...r],a=[],l=[],i=new Set,d=[],u=[],p=!1,f=!1;for(let g of s){let y=g.rel===""?e:g.abs,b=mm(y,t),x=Mt(g)?sl(y):null,I=x===null?b:km(b,x),w=I.diagnostics.map(k=>cl(g.rel,k));!ul(g.rel)&&I.packages.length>0&&w.push(`${g.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(I.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let A={...I,rootRel:g.rel,...g.ecosystem!==void 0?{ecosystem:g.ecosystem}:{},...x!==null?{pythonLockfilePath:x.lockfilePath===null||g.rel===""?x.lockfilePath:`${g.rel}/${x.lockfilePath}`}:{},packages:I.packages.map(k=>({...k,lockKey:ym(g.rel,k.lockKey),declaredIn:k.declaredIn===""||g.rel===""?k.declaredIn:`${g.rel}/${k.declaredIn}`})),lockfilePath:I.lockfilePath===null||g.rel===""?I.lockfilePath:`${g.rel}/${I.lockfilePath}`,gaps:I.gaps.map(k=>({...k,rootRel:g.rel,detail:cl(g.rel,k.detail)})),diagnostics:w};a.push(A),I.truncated&&(p=!0);for(let k of A.packages){let h=JSON.stringify([k.name,k.version,k.lockKey]);if(!i.has(h)){if(l.length>=o){f=!0;break}i.add(h),l.push(k)}}d.push(...A.gaps),u.push(...A.diagnostics)}f&&(p=!0,u.push(`the union of installed sets across ${String(s.length)} roots exceeds its ceiling of ${String(o)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let m=a[0];if(m===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:m.source,lockfilePath:m.lockfilePath,diagnostics:u,truncated:p,gaps:d,perRoot:a}}function Sm(e,n){let t;for(let o of e.perRoot){if(o.rootRel===""){t??=o;continue}n.startsWith(`${o.rootRel}/`)&&(t===void 0||o.rootRel.length>t.rootRel.length)&&(t=o)}return t}function Ro(e,n){return n.declaredIn!==""?n.declaredIn:Sm(e,n.lockKey)?.lockfilePath??null}function pl(e,n){let t=e.perRoot.find(o=>o.rootRel===n.rootRel);return bm.has(n.kind)?t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`:t?.lockfilePath!==void 0&&t.lockfilePath!==null?t.lockfilePath:n.rootRel===""?null:`${n.rootRel}/${t?.ecosystem==="PyPI"?"pyproject.toml":"package.json"}`}var bm=new Set(["no-installed-env","installed-env-partial"]);function km(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function ml(e){let n=new Map;for(let t of e){let o=n.get(t.name)??new Set;o.add(t.version),n.set(t.name,o)}return t=>{let o=n.get(t);if(o===void 0)return;let r=[...o].sort();return r.length===1?r[0]:r}}function Lt(e){return new Set(e.map(n=>n.root))}function dt(e,n){let t=Lt(n);return e.roots.filter(o=>!t.has(o.rel)&&(o.rel===""||o.ecosystem!=="PyPI"))}function Xr(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function Yr(e,n){return dt(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function hl(e){let n=[],t=e.observations.filter(o=>o.kind==="unenumerated-install").map(o=>o.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${Xr(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let o=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(o.dirsWalked)} dirs walked, ${String(o.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function gl(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as sh}from"node:fs";import qn from"node:path";import{spawnSync as Hm}from"node:child_process";import{fileURLToPath as Xm}from"node:url";import{readdirSync as Em,realpathSync as yl,statSync as xl}from"node:fs";import En from"node:path";var Sl=32,wm=512,vm=/^[A-Za-z_][A-Za-z0-9_]*$/u,Im=[".so",".pyd",".dylib"],Po=e=>({resolved:e,failure:null}),ct=e=>({resolved:null,failure:e});function Am(e){if(e.length===0||e.length>wm)return null;let n=e.split(".");return n.length>Sl?null:n.every(t=>vm.test(t))?n:null}function Jr(e){try{return xl(e).isDirectory()}catch{return!1}}function ut(e){try{return xl(e).isFile()}catch{return!1}}function Ft(e,n){let t,o;try{t=yl(n),o=yl(e)}catch{return null}return t===o||t.startsWith(o+En.sep)?t:null}function _m(e,n){let t;try{t=Em(e)}catch{return null}for(let o of t)if(o.startsWith(`${n}.`)&&Im.some(r=>o.endsWith(r))&&ut(En.join(e,o)))return En.join(e,o);return null}function $n(e,n){let t=Am(n);if(t===null)return ct("refused");let o=null,r=!1;for(let[s,a]of e.roots.entries()){let l=a,i=!1;for(let y of t.slice(0,-1)){let b=En.join(l,y);if(ut(En.join(b,"__init__.py"))||Jr(b)){if(!Jr(b)){i=!0;break}l=b;continue}i=!0,ut(`${b}.py`)&&(r=!0);break}if(i)continue;let d=t[t.length-1];if(d===void 0)return ct("refused");let u=En.join(l,d,"__init__.py");if(ut(u)){let y=Ft(a,u);return y===null?ct("escapes-root"):Po({module:n,kind:"package",path:y,rootIndex:s})}let p=En.join(l,`${d}.py`);if(ut(p)){let y=Ft(a,p);return y===null?ct("escapes-root"):Po({module:n,kind:"module",path:y,rootIndex:s})}let f=_m(l,d);if(f!==null){let y=Ft(a,f);return y===null?ct("escapes-root"):Po({module:n,kind:"extension",path:y,rootIndex:s})}let m=En.join(l,d);if(o===null&&Jr(m)){let y=Ft(a,m);y!==null&&(o={module:n,kind:"namespace",path:y,rootIndex:s});continue}let g=En.join(l,`${d}.pyi`);if(o===null&&ut(g)){let y=Ft(a,g);y!==null&&(o={module:n,kind:"stub-only",path:y,rootIndex:s})}}return o!==null?Po(o):ct(r?"not-a-package":"not-found")}function bl(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function $o(e,n,t,o){if(t<1||t>Sl)return{failure:"refused"};let r=bl(e,n),s=r===""?[]:r.split("."),a=t-1;if(a>s.length)return{failure:"beyond-top-level"};let l=s.slice(0,s.length-a),i=o===null||o===""?[]:o.split("."),d=[...l,...i].join(".");return d===""?{failure:"beyond-top-level"}:{dotted:d}}var Zr="<toplevel>";var Nm=new Set(["self","cls"]),Rm=8;function El(e,n){return{path:e,start:n.start,end:n.end}}function kl(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function es(e,n,t,o){let r=[],s=[],a=[],l=[],i=new Map,d=new Map,u=new Map,p=new Map,f=new Map,m=`${n}#${Zr}`;r.push({id:m,moduleId:n,name:Zr,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1});for(let y of e.classes){let b=`${n}#class:${y.qualname}`;u.set(y.qualname,b),f.set(y.qualname,y.bases.filter(x=>x!==null)),s.push({id:b,moduleId:n,name:y.name,implementsRefs:[],members:[]})}for(let y of e.functions){let b=`${n}#${y.qualname}`;i.set(y.qualname,b);let x=y.enclosingClass,I=x===null?void 0:u.get(x),w=x===null&&y.enclosingFunction===null,A=w?kl(y.name,e.all):x!==null&&!x.includes(".")?kl(x,e.all):!1;if(r.push({id:b,moduleId:n,name:y.name,kind:I!==void 0?y.name==="__init__"?"ctor":"method":"function",...I!==void 0?{enclosingClassId:I}:{},declRange:El(t,y.range),isExported:A,publicSurfaceReachable:A}),w&&(d.set(y.name,b),A)){let k=o();a.push({id:k,moduleId:n,exportedName:y.name,kind:"value"}),l.push({exportId:k,target:{kind:"function",functionId:b}})}if(x!==null){let k=p.get(x)??new Map;k.set(y.name,b),p.set(x,k)}}let g=s.map(y=>{let b=[...u.entries()].find(([,I])=>I===y.id)?.[0],x=b===void 0?void 0:p.get(b);return x===void 0?y:{...y,members:[...x.values()]}});return{moduleId:n,functions:r,classes:g,exports:a,exportBindings:l,byQualname:i,topLevel:d,classByName:u,methods:p,baseNames:f,toplevelId:m}}function ns(e){let{decls:n,envs:t}=e,o=[],r=new Map;for(let[f,m]of n){let g=t.get(f);for(let[y,b]of m.baseNames){let x=m.classByName.get(y);if(x!==void 0)for(let I of b){let w=Pm(I,m,g,n);if(w===void 0)continue;o.push({subclassId:x,superclassId:w,relation:"extends"});let A=r.get(w)??[];A.push(x),r.set(w,A)}}}let s=new Map,a=(f,m)=>{let g=s.get(f)??[];g.includes(m)||g.push(m),s.set(f,g)};for(let f of n.values())for(let m of f.methods.values())for(let[g,y]of m)a(g,y);for(let f of e.rebinds??[]){let m=n.get(f.moduleId)?.topLevel.get(f.target);m!==void 0&&a(f.attr,m)}let l=new Map;for(let f of n.values())for(let m of f.classByName.values())l.set(m,f);let i=[],d=[],u=0,p=0;for(let{moduleId:f,path:m,call:g}of e.pending){let y=n.get(f);if(y===void 0)continue;let b=g.enclosingFunction===null?y.toplevelId:y.byQualname.get(g.enclosingFunction)??y.toplevelId,x=$m(g,f,y,t.get(f),n,t,{byMethodName:s,subclassesOf:r,classOwner:l}),I=`py-call:${f}:${String(u)}`;u+=1,x.resolution==="unresolved"&&(p+=1),i.push({id:I,enclosingFunctionId:b,calleeExprShape:g.receiver===null?"identifier":"member",resolvedTargetIds:x.ids,resolution:x.resolution,range:El(m,g.range)});for(let w of x.ids)d.push({callSiteId:I,calleeFunctionId:w,resolution:x.resolution})}return{callSites:i,callEdges:d,inheritEdges:o,unresolved:p}}function Qr(e,n,t,o,r=new Set,s=0){if(s>Rm)return;let a=`${e}${n}`;if(r.has(a))return;r.add(a);let l=t.get(e)?.topLevel.get(n);if(l!==void 0)return l;let i=o.get(e)?.names.get(n);if(i!==void 0)return Qr(i.moduleId,i.name,t,o,r,s+1)}function Pm(e,n,t,o){let r=n.classByName.get(e);if(r!==void 0)return r;let s=t?.names.get(e);if(s!==void 0)return o.get(s.moduleId)?.classByName.get(s.name)}var ft={ids:[],resolution:"unresolved"};function $m(e,n,t,o,r,s,a){if(e.callee===null)return ft;if(e.receiver===null){let u=t.topLevel.get(e.callee);if(u!==void 0)return{ids:[u],resolution:"resolved"};let p=o?.names.get(e.callee);if(p!==void 0){let f=Qr(p.moduleId,p.name,r,s);if(f!==void 0)return{ids:[f],resolution:"resolved"}}return ft}let l=e.attr;if(l===null)return ft;if(Nm.has(e.receiver)&&e.enclosingFunction!==null){let u=e.enclosingFunction.split(".").slice(0,-1).join("."),p=t.classByName.get(u);if(p!==void 0){let f=Om(p,l,a);return f.length===1?{ids:f,resolution:"resolved"}:f.length>1?{ids:f,resolution:"field-based"}:ft}}let i=o?.modules.get(e.receiver);if(i!==void 0){let u=Qr(i,l,r,s);return u!==void 0?{ids:[u],resolution:"resolved"}:ft}let d=a.byMethodName.get(l)??[];return d.length===0||d.length>64?ft:{ids:d,resolution:"field-based"}}function Om(e,n,t){let o=[],r=new Set,s=[e];for(;s.length>0;){let a=s.shift();if(a===void 0||r.has(a))continue;r.add(a);let l=t.classOwner.get(a);if(l!==void 0){let i=[...l.classByName.entries()].find(([,u])=>u===a)?.[0],d=i===void 0?void 0:l.methods.get(i)?.get(n);d!==void 0&&!o.includes(d)&&o.push(d)}for(let i of t.subclassesOf.get(a)??[])s.push(i)}return o}var Cm=5e3,wl=200,vl=100,Il={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function _l(e){return`pkg:${e}`}function fn(e){return e.split(/[\\/]+/u).join("/")}function Al(e,n){let t=e.endsWith("/")?e:`${e}/`,o=fn(n),r=fn(t);return o.startsWith(r)?o.slice(r.length):null}function Nl(e){let n=fn(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let o=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),o].filter(r=>r!=="").join("."),isPackage:!1}}function ts(e){return e.split(".")[0]??e}var Mm="site-packages:";function os(e){let n=e.extract??Oo,t=e.maxModules??Cm,o=(e.externalRoots??[]).map(C=>fn(C).endsWith("/")?fn(C):`${fn(C)}/`),r=C=>{let H=fn(C);return o.find(J=>H.startsWith(J))??null},s=C=>r(C)!==null,a=[],l=new Map,i=[],d=[],u=new Set,p=new Set,f=new Map,m=new Map,g=[],y=new Map,b=[],x=0,I=()=>{let C=`py-export:${String(x)}`;return x+=1,C},w=null,A=!1,k=new Set,h=[];for(let C of e.entryFiles){let H=Al(e.projectRoot,C);if(H===null){a.push({code:"unresolved-import",where:fn(C),detail:"entrypoint lies outside the project root; not analyzed"});continue}u.has(C)||(u.add(C),h.push({file:C,rel:H,isEntry:!0,packageName:"",modulePath:H}))}let S=C=>{let H=_l(C);return l.has(H)||(p.add(C),l.set(H,{id:H,packageName:C,versionRange:"",path:C,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),H},_=0,P=(C,H,J,G)=>{let Y=`py-import:${String(_)}`;_+=1,i.push({id:Y,moduleId:C,specifier:H,...J!==null?{resolvedModuleId:J}:{},isNamespace:!1,isDefault:!1,dynamic:G,specifierIsLiteral:!0}),J!==null&&d.push({importId:Y,resolvedModuleId:J})};for(let C=0;C<vl&&h.length>0;C+=1){let H=h.slice(0,wl);h=h.slice(wl);let J=n(H.map(Y=>Y.file),e.python!==void 0?{python:e.python}:{});if(w??=J.interpreter,k.size===0&&J.stdlib.length>0&&(k=new Set(J.stdlib)),J.refused!==null)return a.push({code:"extract-refused",where:"",detail:`${J.refused}: ${J.diagnostics.join("; ")}`}),{graph:Il,diagnostics:a,interpreter:J.interpreter,counts:{modules:0,surfaces:0}};let G=new Map(J.files.map(Y=>[Y.path,Y]));for(let Y of H){let re=G.get(Y.file),ne=Y.rel,$=Nl(Y.modulePath);if(l.set(ne,{id:ne,packageName:Y.packageName,versionRange:"",path:Y.modulePath,moduleSystem:"dual",isEntrypoint:Y.isEntry}),re===void 0||re.refused!==null){a.push({code:"file-refused",where:Y.rel,detail:re?.refused??"no row was returned for this file"});continue}v(re,ne,$),F(re,Y.rel),f.set(ne,es(re,ne,Y.rel,I)),m.set(ne,O(re,ne,$));for(let Z of re.calls)g.push({moduleId:ne,path:Y.rel,call:Z});for(let Z of re.escapes){if(Z.kind!=="attr-rebind")continue;let Q=Z.attr??null;Q===null||Z.target===null||b.push({moduleId:ne,attr:Q,target:Z.target})}}}function v(C,H,J){for(let G of C.imports){if(G.guards.includes("type-checking"))continue;let Y=[];if(G.level>0){let ne=$o(J.dotted,J.isPackage,G.level,G.module);if("failure"in ne){a.push({code:"unresolved-import",where:C.path,detail:`relative import (level ${String(G.level)}) ${ne.failure}`});continue}Y.push(ne.dotted);for(let $ of G.names)Y.push(`${ne.dotted}.${$.name}`)}else if(G.module!==null){Y.push(G.module);for(let ne of G.names)Y.push(`${G.module}.${ne.name}`)}else continue;let re=!1;for(let ne of Y)T(ne,H,G.deferred)&&(re=!0);if(!re){let ne=Y[0]??"";P(H,ne,null,G.deferred);let $=ts(ne);if(k.has($)||G.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf($)===null)continue;a.push({code:"unresolved-import",where:C.path,detail:`\`${ne}\` did not resolve on the search path`})}}}function T(C,H,J){let G=C.split("."),Y=!1;for(let re=1;re<=G.length;re+=1){let ne=G.slice(0,re).join("."),$=$n(e.paths,ne);$.resolved!==null&&(j($.resolved,H,ne,J),re===G.length&&(Y=!0))}return Y}function N(C){return u.has(C.file)||l.has(C.rel)?!0:u.size>=t?(A||(A=!0,a.push({code:"module-cap",where:C.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(u.add(C.file),h.push(C),!0)}function j(C,H,J,G){if(C.kind==="stub-only")return;let Y=C.kind==="module"||C.kind==="package",re=Al(e.projectRoot,C.path);if(re!==null&&!s(C.path)&&Y){let Q=re;P(H,J,Q,G),y.set(J,Q),N({file:C.path,rel:re,isEntry:!1,packageName:"",modulePath:re});return}let ne=e.distributionOf(ts(J));if(ne===null){P(H,J,null,G),a.push({code:"unresolved-import",where:J,detail:`resolved to ${C.kind} outside the project, but no installed distribution provides \`${ts(J)}\``});return}let $=r(C.path);if(!Y||$===null){P(H,J,S(ne),G);return}let Z=`${Mm}${fn(C.path).slice($.length)}`;P(H,J,Z,G),y.set(J,Z),N({file:C.path,rel:Z,isEntry:!1,packageName:ne,modulePath:fn(C.path).slice($.length)})}function O(C,H,J){let G=new Map,Y=new Map;for(let re of C.imports){if(re.guards.includes("type-checking"))continue;let ne=re.module;if(re.level>0){let $=$o(J.dotted,J.isPackage,re.level,re.module);if("failure"in $)continue;ne=$.dotted}if(ne!==null){if(re.form==="import"){let $=re.names[0]?.asname??null;if($!==null){let ce=y.get(ne);ce!==void 0&&G.set($,ce);continue}let Z=ne.split(".")[0]??ne,Q=y.get(Z)??y.get(ne);Q!==void 0&&G.set(Z,Q);continue}for(let $ of re.names){let Z=$.asname??$.name,Q=y.get(`${ne}.${$.name}`);if(Q!==void 0){G.set(Z,Q);continue}let ce=y.get(ne);ce!==void 0&&Y.set(Z,{moduleId:ce,name:$.name})}}}return G.set("",H),{modules:G,names:Y}}function F(C,H){for(let J of C.escapes)switch(J.kind){case"loader-escape":a.push({code:"loader-escape",where:H,detail:`${J.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":a.push({code:"dynamic-load-set",where:H,detail:`${J.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":a.push({code:"module-registry-write",where:H,detail:`${J.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let G=J.target;if(G===null)break;T(G,H,!0);break}case"dispatch-escape":break}}h.length>0&&a.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(vl)} waves; the graph is INCOMPLETE`});let K=ns({decls:f,envs:m,pending:g,rebinds:b}),te=[...f.values()].flatMap(C=>C.functions),U=[...f.values()].flatMap(C=>C.classes),X=[...f.values()].flatMap(C=>C.exports),D=[...f.values()].flatMap(C=>C.exportBindings);return{graph:{...Il,modules:[...l.values()],imports:i,importEdges:d,functions:te,classes:U,exports:X,exportBindings:D,callSites:K.callSites,callEdges:K.callEdges,inheritEdges:K.inheritEdges},diagnostics:a,interpreter:w,counts:{modules:l.size-p.size,surfaces:p.size}}}import{readdirSync as Tm,readFileSync as Dm,statSync as rs}from"node:fs";import pn from"node:path";import{spawnSync as Lm}from"node:child_process";import{fileURLToPath as Fm}from"node:url";var jm="python3",Bm=256*1024,Km=8*1024*1024,Um=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,zm=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function $l(){return Fm(new URL("../py/metadata.py",import.meta.url))}function jt(e){try{return rs(e).isFile()}catch{return!1}}function Rl(e){try{return rs(e).isDirectory()}catch{return!1}}function Wm(e,n){return pn.relative(e,n).split(pn.sep).join("/")}function Vm(e){let n=e.python??process.env.CUPEL_PYTHON??jm,t=Lm(n,["-I","-S",$l(),e.projectRoot],{encoding:"utf8",maxBuffer:Km,timeout:6e4}),o=i=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:i}]});if(t.error!==void 0||t.status!==0)return o("the declared entry surface could not be read; it is unknown, not empty");let r;try{r=JSON.parse(t.stdout)}catch{return o("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof r!="object"||r===null)return{entries:[],projectName:null,gaps:[]};let s=r,a=(Array.isArray(s.entryPoints)?s.entryPoints:[]).filter(i=>typeof i=="object"&&i!==null&&typeof i.name=="string"&&typeof i.target=="string"&&typeof i.kind=="string"),l=(Array.isArray(s.gaps)?s.gaps:[]).flatMap(i=>{if(typeof i!="object"||i===null)return[];let d=i,u=typeof d.file=="string"?d.file:"",p=typeof d.why=="string"?d.why:"";return[{source:"metadata",declaration:u,detail:p==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":p}]});return{entries:a,gaps:l,projectName:typeof s.projectName=="string"?s.projectName:null}}function Pl(e,n){let t=Um.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let o=t[1]??"",r=$n(e.paths,o);if(r.resolved===null)return{detail:`\`${o}\` ${r.failure??"did not resolve"}`};if(r.resolved.kind==="namespace"||r.resolved.kind==="stub-only")return{detail:`\`${o}\` resolved to a ${r.resolved.kind}, which runs no code`};let s=Wm(e.projectRoot,r.resolved.path);return s.startsWith("..")?{detail:`\`${o}\` resolves outside the project root; not seeded`}:{file:s}}function qm(e){let n=[];jt(pn.join(e,"__main__.py"))&&n.push("__main__.py");let t=(o,r)=>{let s;try{s=Tm(o).sort()}catch{return}for(let a of s){if(a.startsWith("."))continue;let l=pn.join(o,a);Rl(l)&&jt(pn.join(l,"__init__.py"))&&jt(pn.join(l,"__main__.py"))&&n.push(`${r}${a}/__main__.py`)}};return t(e,""),Rl(pn.join(e,"src"))&&t(pn.join(e,"src"),"src/"),n}function Gm(e,n){let t=pn.join(e,"Procfile");if(!jt(t))return[];let o;try{if(rs(t).size>n)return[];o=Dm(t,"utf8")}catch{return[]}let r=[];for(let s of o.split(/\r?\n/u)){let a=zm.exec(s);a?.[1]!==void 0&&r.push(a[1])}return r}function ss(e){let n=[],t=[],o=new Set,r=(l,i,d)=>{let u=`${l} ${i}`;o.has(u)||(o.add(u),n.push({file:l,source:i,declaration:d}))},s=Vm(e);t.push(...s.gaps);for(let l of s.entries){let i=l.kind==="entry-point-group"?"entry-point-group":"console-script",d=Pl(e,l.target);"file"in d?r(d.file,i,`${l.name} = ${l.target}`):t.push({source:i,declaration:`${l.name} = ${l.target}`,detail:d.detail})}for(let l of qm(e.projectRoot))r(l,"dunder-main",l);jt(pn.join(e.projectRoot,"manage.py"))&&r("manage.py","manage-py","manage.py");let a=e.maxProcfileBytes??Bm;for(let l of Gm(e.projectRoot,a)){let i=Pl(e,l);"file"in i?r(i.file,"launch-declaration",l):t.push({source:"launch-declaration",declaration:l,detail:i.detail})}return{entrypoints:n,gaps:t,projectName:s.projectName}}var ik=256*1024*1024;var Ol="CUPEL_PYTHON",Ym=["-I","-S"],Jm="python3",Zm=256*1024*1024,Qm=12e4,eh=512;function nh(){return Xm(new URL("../py/extract.py",import.meta.url))}function be(e,n=eh){return typeof e=="string"&&e.length<=n?e:null}function Vn(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function Bt(e){let n=On(e)?e:{};return{line:Vn(n.line),endLine:Vn(n.endLine),col:Vn(n.col),start:Vn(n.start),end:Vn(n.end)}}function On(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Wn(e){return Array.isArray(e)?e:[]}function pt(e){return Wn(e).map(n=>be(n))}var th=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),oh=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function rh(e){let n=be(e.path,4096);if(n===null)return null;let t=e.refused,o=typeof t=="string"&&oh.has(t)?t:null,r=be(e.detail,200),s=Wn(e.imports).filter(On).map(f=>({form:f.form==="import"?"import":"from",module:be(f.module),level:Vn(f.level),names:Wn(f.names).filter(On).map(m=>({name:be(m.name)??"",asname:be(m.asname)})).filter(m=>m.name!==""),star:f.star===!0,deferred:f.deferred===!0,enclosingFunction:be(f.enclosingFunction),guards:pt(f.guards).filter(m=>m!==null),range:Bt(f.range)})),a=Wn(e.functions).filter(On).flatMap(f=>{let m=be(f.name),g=be(f.qualname);return m===null||g===null?[]:[{name:m,qualname:g,kind:f.kind==="async-function"?"async-function":"function",enclosingClass:be(f.enclosingClass),enclosingFunction:be(f.enclosingFunction),decorators:pt(f.decorators),range:Bt(f.range)}]}),l=Wn(e.classes).filter(On).flatMap(f=>{let m=be(f.name),g=be(f.qualname);return m===null||g===null?[]:[{name:m,qualname:g,bases:pt(f.bases),decorators:pt(f.decorators),range:Bt(f.range)}]}),i=Wn(e.calls).filter(On).map(f=>({callee:be(f.callee),attr:be(f.attr),receiver:be(f.receiver),enclosingFunction:be(f.enclosingFunction),argCount:Vn(f.argCount),range:Bt(f.range)})),d=Wn(e.escapes).filter(On).flatMap(f=>{let m=f.kind,g=be(f.callee);return typeof m!="string"||!th.has(m)||g===null?[]:[{kind:m,callee:g,target:be(f.target),attr:be(f.attr),enclosingFunction:be(f.enclosingFunction),range:Bt(f.range)}]}),u=e.all,p=Array.isArray(u)?pt(u).filter(f=>f!==null):null;return{path:n,refused:o,...r!==null?{detail:r}:{},imports:s,functions:a,classes:l,calls:i,escapes:d,all:p,allComputed:e.allComputed===!0,truncated:pt(e.truncated).filter(f=>f!==null)}}function Oo(e,n={}){let t=n.env??process.env,o=n.python??t[Ol]??Jm,r=[],s=e.filter(m=>!m.includes(`
-`));s.length!==e.length&&r.push(`${String(e.length-s.length)} path(s) carried a newline and were not extracted`);let a=[...Ym,nh()];n.maxBytesPerFile!==void 0&&a.push("--max-bytes",String(n.maxBytesPerFile));let l=Hm(o,a,{input:s.length>0?`${s.join(`
+`||e[a]==="\r");)a+=1;let l=e[a];if(l==='"'||l==="'"){let d=e.indexOf(l,a+1);return d===-1?null:e.slice(a+1,d)}let i=a;for(;i<e.length&&!/[\s>]/.test(e[i]??"");)i+=1;return e.slice(a,i)}}function _p(e){let n=[],t=e.toLowerCase(),o=0;for(;;){let r=t.indexOf("<script",o);if(r===-1)break;let s=t[r+7];if(s!==void 0&&/[a-z0-9-]/.test(s)){o=r+7;continue}let a=e.indexOf(">",r);if(a===-1)break;o=a+1;let l=e.slice(r+7,a);if(l.length>vp)continue;let i=Pa(l,"type");n.push({module:(i??"").trim().toLowerCase()==="module",src:Pa(l,"src")})}return n}function Ip(e){return/^[a-z][a-z0-9+.-]*:/i.test(e)||e.startsWith("//")}function Ap(e){let n=e.search(/[?#]/);return(n===-1?e:e.slice(0,n)).replace(/^\/+/,"")}function Np(e){let n=En(e),t=n.endsWith(Je.sep)?n:n+Je.sep,o=new Set,r=[],s=[],a=[],l=[],i=[],d=!1,u=($,D,K=!1,te)=>{let B=Ca(n,t,$);return B===null||B.length===0?"unresolved":o.has(B)?"duplicate":(o.add(B),r.push(B),s.push({source:D,specifier:Ye(te??(typeof $=="string"?$:"")),entrypoint:B,launch:K}),"added")},p=new Set,f=($,D,K=!1)=>{let te=u($,D),B=typeof $=="string"&&$.includes("\\")?u($.split("\\").join("/"),D,!1,$):"unresolved";if(te!=="unresolved"||B!=="unresolved"||typeof $!="string"||$.trim().length===0||$.endsWith(".d.ts")||$.endsWith(".d.mts")||$.endsWith(".d.cts"))return;if(K&&$.includes("*")){let L=Qi(n,$),O=!1;if(L!==null){for(let X of L.matches)u(X,D,!1,$)!=="unresolved"&&(O=!0);if(!L.truncated&&O)return}l.push({source:D,file:"package.json",detail:`\`${Ye($)}\` is a subpath pattern cupel could not expand completely; the files it names beyond those seeded were NOT analyzed`});return}let Y=`${D}\0${$}`;p.has(Y)||(p.add(Y),l.push({source:D,file:"package.json",detail:`\`${Ye($)}\` did not resolve to a file inside the scan root; the code it names was NOT analyzed`}))},m=[],g=($,D)=>{a.push({source:$,file:$,detail:D.detail}),m.push({code:D.code,path:$,detail:`${$} ${D.detail}`})},y,S,x,_=null,w=vo(n,t,"package.json",In);w.kind==="refused"&&g("package.json",w);try{let $=w.kind==="ok"?JSON.parse(w.text):{};if(_=w.kind==="ok"?$:null,f($.main,"main"),typeof $.bin=="string")f($.bin,"bin");else if($.bin!==null&&typeof $.bin=="object")for(let K of Object.values($.bin))f(K,"bin");Ra($.exports,(K,te)=>{f(K,"exports",te)}),typeof $.browser=="string"?f($.browser,"browser"):Ra($.browser,K=>{u(K,"browser")});let D=$.scripts;if(D!==null&&typeof D=="object"){let K=D;y=K.start,S=K.prestart,x=K.poststart}}catch{}if(r.length===0)try{En(Je.join(n,"index.js")),u("index.js","index.js fallback")}catch{}let I=($,D)=>{if(typeof $=="string"&&$.trim().length>0){let K=Kr($,D,"package.json",u,a,!1)==="used";return K&&(d=!0),K?"resolved":"gapped"}return $===void 0||typeof $=="string"?"absent":(a.push({source:D,file:"package.json",detail:`${D} is not a string; no entry file could be read from it`}),"gapped")},k=I(y,"scripts.start"),h=I(S,"scripts.prestart"),b=I(x,"scripts.poststart"),A=k==="resolved"&&h!=="gapped"&&b!=="gapped",P=vo(n,t,"Procfile",65536);if(P.kind==="refused")g("Procfile",P);else if(P.kind==="ok"){let{entries:$,truncated:D,unnamedLines:K}=$r(P.text);D&&a.push({source:"Procfile",file:"Procfile",detail:"Procfile has more process types than cupel parses; the remainder was not read"}),K>0&&a.push({source:"Procfile",file:"Procfile",detail:`${String(K)} Procfile line(s) declare a process whose name cupel does not accept; their commands were NOT read`});for(let te of $)Kr(te.command,`Procfile:${te.name}`,"Procfile",u,a,A)==="used"&&(d=!0)}for(let $ of["Dockerfile","docker-compose.yml","docker-compose.yaml","compose.yml"]){let D=vo(n,t,$,Rr);if(D.kind==="refused"){g($,D);continue}if(D.kind!=="ok")continue;let{commands:K,truncated:te}=Pr(D.text);te&&a.push({source:$,file:$,detail:`${$} declares more launch commands than cupel parses; the remainder was not read`});for(let B of K)Kr(B.command,`${$}:${B.label}`,$,u,a,A)==="used"&&(d=!0)}let v=r.length===0,T=vo(n,t,"index.html",wp);if(T.kind==="ok")for(let $ of _p(T.text)){if($.src===null)continue;let D=Ye($.src);if(!$.module){i.push({kind:"classic-script",file:"index.html",detail:`index.html loads "${D}" as a classic (non-module) script; not seeded (ADR-071 Step 5, decision 2)`,root:""});continue}if(Ip($.src)){i.push({kind:"external-script",file:"index.html",detail:`index.html loads the module script "${D}" from another origin \u2014 not this repository's code; not seeded`,root:""});continue}u(Ap($.src),"index.html",!1,$.src)==="unresolved"&&a.push({source:"index.html",file:"index.html",detail:`index.html names the module script "${D}", which did not resolve to a file inside the root; the browser would load it and cupel did not analyze it`})}else T.kind==="refused"&&i.push({kind:T.code==="limit-exceeded"?"index-html-oversize":"index-html-refused",file:"index.html",detail:`index.html ${T.detail}`,root:""});let N=v?vr(n,_):null;if(N!==null){let $=0;for(let D of Ir(n,N).roots)u(D,`framework:${N.name}`)==="added"&&($+=1);$>0&&m.push({code:"framework-derived-entry",path:"package.json",detail:`entrypoints were derived from ${N.name}'s directory conventions (recognised via ${N.configFile}), not declared by this project. That set cannot be proven complete, so findings that would read \`not-reachable\` are capped at \`unknown\`; pass \`--entry\` for the files your build actually starts to lift it`})}let j=$=>$.map(D=>({...D,root:""}));return{entrypoints:r,sources:j(s),gaps:j(a),surfaceGaps:j(l),launchResolved:d,diagnostics:m,framework:N,observations:i}}function vo(e,n,t,o){let r;try{r=En(Je.join(e,t))}catch{return{kind:"absent"}}if(!r.startsWith(n))return{kind:"refused",code:"out-of-root",detail:"exists but resolves OUTSIDE the scan root (symlink); it was NOT read, so the declarations it carries were not analyzed"};let s=ot(r,o);return s.kind==="ok"?s:s.kind==="too-large"?{kind:"refused",code:"limit-exceeded",detail:`is ${String(s.bytes)} bytes, over the ${String(o)}-byte cap; it was NOT read`}:{kind:"refused",code:"parse-error",detail:"exists but is not a readable regular file (FIFO/device/directory); it was NOT read"}}function Kr(e,n,t,o,r,s){let a=Nr(e);if(a.kind==="delegates")return s?"used":(r.push({source:n,file:t,detail:`\`${Ye(e)}\`: runs the package \`start\` lifecycle (prestart/start/poststart), which is absent or not fully readable`}),"gapped");if(a.kind==="foreign")return"foreign";if(a.kind==="unparsed")return r.push({source:n,file:t,detail:`\`${Ye(e)}\`: ${a.reason}`}),"gapped";let l=o(a.specifier,n,!0),i=a.alt===void 0?"unresolved":o(a.alt,n,!0);return l==="unresolved"&&i==="unresolved"?(r.push({source:n,file:t,detail:`\`${Ye(a.specifier)}\` did not resolve to a file inside the app root`}),"gapped"):"used"}function lt(e,n){return e===""?n:`${e}/${n}`}function Oa(e,n){let t=En(e),o=t.endsWith(Je.sep)?t:t+Je.sep,r=new Set,s=[],a=[],l=[],i=[],d=[],u=[],p=!1,f=null,m=[...n].sort((g,y)=>g.rel===""?-1:y.rel===""?1:g.rel<y.rel?-1:g.rel>y.rel?1:0);for(let g of m){let y=lt(g.rel,"package.json"),S=g.rel===""?".":g.rel,x;try{x=En(g.abs)}catch{l.push({source:"root",file:y,detail:`root \`${S}\` could not be resolved; not seeded`,root:g.rel});continue}if(x!==t&&!x.startsWith(o)){l.push({source:"root",file:y,detail:`root \`${S}\` resolves outside the scan root; refused, not seeded`,root:g.rel});continue}let _;try{_=Np(x)}catch{l.push({source:"root",file:y,detail:`root \`${S}\` could not be read; not seeded`,root:g.rel});continue}for(let w of _.sources){let I=lt(g.rel,w.entrypoint),k,h;try{k=En(Je.resolve(t,I)),h=En(Je.resolve(x,w.entrypoint))}catch{l.push({source:w.source,file:y,detail:`\`${w.specifier}\` re-based to \`${I}\` did not resolve; not seeded`,root:g.rel});continue}if(!k.startsWith(o)||k!==h){l.push({source:w.source,file:y,detail:`\`${w.specifier}\` re-based to \`${I}\` escapes the scan root or names another file; refused, not seeded`,root:g.rel});continue}r.has(I)||(r.add(I),s.push(I),a.push({...w,entrypoint:I,root:g.rel}))}_.launchResolved&&(p=!0);for(let w of _.gaps)l.push({...w,file:lt(g.rel,w.file),root:g.rel});for(let w of _.surfaceGaps)i.push({...w,file:lt(g.rel,w.file),root:g.rel});for(let w of _.diagnostics)d.push({...w,path:lt(g.rel,w.path)});for(let w of _.observations)u.push({...w,file:lt(g.rel,w.file),root:g.rel});g.rel===""&&(f=_.framework)}return{entrypoints:s,sources:a,gaps:l,surfaceGaps:i,launchResolved:p,diagnostics:d,framework:f,observations:u}}function qr(e){let{gaps:n,launchResolved:t}=e;if(n.length===0||!t)return[];let o=n.slice(0,3).map(r=>r.source).join(", ");return[{code:"unresolved-launch-entry",path:n[0]?.file??"package.json",detail:`${String(n.length)} launch declaration(s) (${o}) name code this project starts but cupel could not resolve to an entry file, while other launch declarations DID seed the analysis; verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, make those commands a direct \`node <file.js>\` invocation cupel can read. \`--entry <file>\` analyzes that code too (so a sink there is still reported), but the cap remains while the command itself is unreadable`}]}function Wr(e,n){let{surfaceGaps:t}=e;if(t.length===0||n===0)return[];let o=[...new Set(t.slice(0,3).map(r=>r.source))].join(", ");return[{code:"unresolved-entry-declaration",path:t[0]?.file??"package.json",detail:`${String(t.length)} package.json entry declaration(s) (${o}) name a file this package owns that cupel could not resolve inside the scan root, while the analysis was seeded from elsewhere; the code they name was NOT analyzed, so verdicts that would be \`not-reachable\` are capped at \`unknown\`. To clear it, point those fields at a file that exists (a Windows-style \`lib\\index.js\` does not resolve on a posix host). \`--entry <file>\` analyzes that code too, but the cap remains while the declaration is unresolvable`}]}function Ma(e,n){let t=En(e),o=t.endsWith(Je.sep)?t:t+Je.sep,r=new Set,s=[],a=[];for(let l of n){let i=Ca(t,o,l,!0);if(i===null||i.length===0){a.push(l);continue}r.has(i)||(r.add(i),s.push(i))}return{entrypoints:s,rejected:a}}import{readdirSync as hl,readFileSync as es,realpathSync as ns,statSync as Ft}from"node:fs";import ln from"node:path";function Rp(e){if(e.startsWith("<<:")||e.startsWith("- &")||e.startsWith("- *"))return!0;let n=e.charCodeAt(0);if(n===38||n===42)return!0;let t=e.indexOf(": ");if(t===-1)return!1;let o=t+2;for(;o<e.length&&e.charCodeAt(o)===32;)o+=1;let r=e.charCodeAt(o);return r===38||r===42}function Pt(e,n,t){let o=n.maxLines??2e6,r=n.maxLineBytes??16384,s=!1,a=!1,l=0,i=0,d=e.charCodeAt(0)===65279?1:0;for(;d<=e.length;){let u=e.indexOf(`
+`,d),p=u===-1;p&&(u=e.length);let f=u>d&&e.charCodeAt(u-1)===13?u-1:u;if(i+=1,i>o){s=!0;break}if(f-d>r)l+=1;else{let m=d;for(;m<f&&e.charCodeAt(m)===32;)m+=1;let g=m-d,y=f;for(;y>m&&(e.charCodeAt(y-1)===32||e.charCodeAt(y-1)===9);)y-=1;if(m<y&&e.charCodeAt(m)!==35){let S=e.slice(m,y);if(Rp(S)){a=!0;break}t(g,S)}}if(p)break;d=u+1}return{truncated:s||l>0,refusedAnchors:a,oversizeLines:l}}function _o(e){let n=e.charCodeAt(0);if(n===34||n===39){let o=e.indexOf(String.fromCharCode(n),1);if(o===-1)return null;let r=o+1;for(;r<e.length&&e.charCodeAt(r)===32;)r+=1;return e.charCodeAt(r)===58?e.slice(0,o+1):null}let t=e.indexOf(":");return t>0?e.slice(0,t):null}function dt(e){return e.endsWith(":")}function sn(e){if(e.length>=2){let n=e.charCodeAt(0);if((n===34||n===39)&&e.charCodeAt(e.length-1)===n)return e.slice(1,-1)}return e}function Io(e){if(e.length===0||e.length>214)return!1;let n=e.charCodeAt(0)===64,t=n?e.slice(1):e,o=t.indexOf("/");if(n){if(o<=0||t.indexOf("/",o+1)!==-1)return!1}else if(o!==-1)return!1;let r=n?[t.slice(0,o),t.slice(o+1)]:[t];for(let s of r){if(s.length===0||s.charCodeAt(0)===46||s.charCodeAt(0)===95)return!1;for(let a=0;a<s.length;a+=1){let l=s.charCodeAt(a);if(!(l>=97&&l<=122||l>=65&&l<=90||l>=48&&l<=57||l===45||l===46||l===95||l===126))return!1}}return!0}function $t(e){return Io(e)?`node_modules/${e}`:""}function Ct(e,n){let t=`${e}@${n}`;return t.length<=96?t:`${t.slice(0,96)}\u2026`}var Ao=2e5,Ta=64,No=1024,Pp=5,$p=[1,2,3];function Cp(e){let n="node_modules/",t=e.lastIndexOf(n);if(t===-1)return null;let o=e.slice(t+n.length);if(o==="")return null;let r=o.split("/");return r[0]?.startsWith("@")?r.length>=2?`${r[0]}/${r[1]}`:null:r[0]??null}function Da(e,n){if(!n.startsWith("npm:"))return[{name:e,version:n}];let t=n.slice(4);if(t.length===0)return[{name:e,version:n}];let o=t.indexOf("@",1);if(o>0){let r=t.slice(0,o),s=t.slice(o+1);if(r.length>0&&s.length>0)return[{name:r,version:s}]}return t===e?[{name:e,version:n}]:[{name:e,version:n},{name:t,version:n}]}function ct(e){return typeof e!="object"||e===null||Array.isArray(e)?null:e}function La(e){return{deps:[],seen:new Set,maxEntries:e,unread:0,visited:0,capped:!1}}function Fa(e){return e.capped?!1:(e.visited+=1,e.visited>e.maxEntries?(e.capped=!0,!1):!0)}function ja(e,n,t,o,r=!1){let s=JSON.stringify([n,t,o]);if(!e.seen.has(s)){if(e.deps.length>=e.maxEntries){e.capped=!0;return}e.seen.add(s),e.deps.push({name:n,version:t,lockKey:o,dev:r})}}function Op(e,n){for(let[t,o]of Object.entries(e)){if(t==="")continue;if(!Fa(n))return;let r=t.startsWith("node_modules/")||t.includes("/node_modules/"),s=ct(o);if(s===null){n.unread+=1;continue}if(s.link===!0)continue;let a=s.name,l=typeof a=="string"&&a!==""?a:Cp(t),i=s.version;if(l===null||typeof i!="string"){r&&(n.unread+=1);continue}let d=s.dev===!0||s.devOptional===!0;for(let u of Da(l,i))ja(n,u.name,u.version,t,d)}}function Ba(e,n,t){let o=[{deps:e,prefix:"",depth:0,pathSafe:!0,dev:!1}],r=!1;for(let s=0;s<o.length;s+=1){let a=o[s];if(a===void 0)break;for(let[l,i]of Object.entries(a.deps)){if(!Fa(n))return{depthCapped:r};if(l===""){n.unread+=1;continue}let d=ct(i);if(d===null){n.unread+=1;continue}let u=a.pathSafe&&Io(l),p=u?`${a.prefix}node_modules/${l}`:"",f=u&&p.length<=No,m=f?p:"",g=d.version,y=d.dev===!0||a.dev;if(d.link!==!0&&typeof g=="string"&&g!=="")for(let x of Da(l,g))ja(n,x.name,x.version,m,y);else n.unread+=1;let S=ct(d.dependencies);if(S!==null){if(a.depth+1>t){r=!0;continue}o.push({deps:S,prefix:f?`${m}/`:a.prefix,depth:a.depth+1,pathSafe:f,dev:y})}}}return{depthCapped:r}}function Mp(e,n,t){let o=La(n.maxEntries),{depthCapped:r}=Ba(e,o,t),s=[],a=new Set(n.deps.map(d=>JSON.stringify([d.name,d.version]))),l=new Set,i=[];for(let d of o.deps){if(d.version.includes(":"))continue;let u=JSON.stringify([d.name,d.version]);a.has(u)||l.has(u)||(l.add(u),i.length<Pp&&i.push(Ct(d.name,d.version)))}if(l.size>0){let d=l.size-i.length;s.push(`package-lock.json carries BOTH a v2/v3 \`packages\` map and a legacy v1 \`dependencies\` tree, and they DISAGREE: ${String(l.size)} install(s) the tree describes are absent from the map (${i.join(", ")}${d>0?`, and ${String(d)} more`:""}). npm 6 installs from the tree and npm 7+ from the map, so what is on disk depends on which npm ran; cupel enumerated the map`)}return(o.capped||r)&&s.push("package-lock.json's legacy `dependencies` tree hit a cap before it could be cross-checked against the `packages` map; a disagreement between the two would not have been seen"),s}function Ro(e,n={}){let t=[],o;try{o=JSON.parse(e)}catch{return{deps:[],diagnostics:["package-lock.json is not valid JSON"],truncated:!1}}let r=ct(o);if(r===null)return{deps:[],diagnostics:["package-lock.json is not an object"],truncated:!1};let s=r.lockfileVersion,a=typeof s=="number"&&Number.isInteger(s)?s:null,l=typeof s=="number"?String(s):"?",i=ct(r.packages),d=ct(r.dependencies);if(i===null&&d===null)return{deps:[],diagnostics:[`package-lock.json (lockfileVersion ${l}) has neither a v2/v3 \`packages\` map nor a v1 \`dependencies\` tree; NO dependency was enumerated`],truncated:!1};(a===null||!$p.includes(a))&&t.push(`package-lock.json declares unsupported lockfileVersion ${l} (cupel knows v1, v2 and v3); its shape may differ, so what was read may be incomplete`);let u=n.maxDepth??Ta,p=La(n.maxEntries??Ao),f=!1;return i!==null?(Op(i,p),d!==null&&t.push(...Mp(d,p,u))):d!==null&&(f=Ba(d,p,u).depthCapped),p.capped&&t.push(`lockfile exceeds ${String(p.maxEntries)} entries; truncated`),f&&t.push(`package-lock.json nests \`dependencies\` deeper than ${String(u)} levels; the deeper subtree(s) were NOT enumerated`),p.unread>0&&t.push(`package-lock.json has ${String(p.unread)} entr(ies) with no version cupel could read (an odd shape or a missing \`version\`); they were not enumerated`),{deps:p.deps,diagnostics:t,truncated:p.capped||f}}var Tp=["workspace:","link:","portal:","file:","exec:"];function Dp(e){let n=e.charCodeAt(0);if(n>=48&&n<=57||n===94||n===126||n===62||n===60||n===61||n===42||n===124)return!0;if(n===118||n===86){let t=e.charCodeAt(1);return t>=48&&t<=57}return!1}function Lp(e){let n=e.trim();if(n.length===0)return[];let t=n.indexOf("@",1);if(t<=0)return[];let o=n.slice(0,t),r=n.slice(t+1);if(o.length===0)return[];for(let l of Tp)if(r.startsWith(l))return[];if(!r.startsWith("npm:"))return[o];let s=r.slice(4),a=s.indexOf("@",1);if(a>0){let l=s.slice(0,a);return l.length>0?[l]:[o]}return s.length===0||Dp(s)?[o]:[o,s]}function Fp(e){if(dt(e))return e.slice(0,-1);let n=0;for(let t=0;t<e.length-1;t+=1){let o=e.charCodeAt(t);if(o===34||o===39){n===0?n=o:n===o&&(n=0);continue}if(n===0&&o===58&&e.charCodeAt(t+1)===32)return e.slice(0,t)}return null}function jp(e){let n=e.replaceAll('"',"").replaceAll("'",""),t=[];for(let o of n.split(",")){let r=o.trim();r.length>0&&t.push(r)}return t}function Bp(e){let n=e.charCodeAt(0)===65279?e.slice(1,64):e.slice(0,64),t="# yarn lockfile v";if(!n.startsWith(t))return null;let o=t.length;for(;o<n.length&&o<t.length+3;){let s=n.charCodeAt(o);if(s<48||s>57)break;o+=1}let r=n.slice(t.length,o);return r.length>0?r:null}function Ka(e){if(!e.startsWith("version"))return null;let n=e.charCodeAt(7);if(n!==58&&n!==32)return null;let t=sn(e.slice(8).trim());return t.length>0?t:null}function Vr(e,n={}){let t=[],o=[],r=new Set,s=n.maxEntries??2e5,a=!1,l=null,i=!1,d=[],u=!1,p=-1,f=!1,m=0,g=()=>{d.length>0&&!u&&(m+=1)},y=Pt(e,n,(w,I)=>{if(w===0){g(),d=[],u=!1,p=-1,i=!1;let h=Fp(I);if(h===null)return;let b=sn(h.trim());if(b==="__metadata"){a=!0,i=dt(I);return}for(let A of jp(b))d.push(...Lp(A));return}if(i){if(w===2&&l===null){let h=Ka(I);h!==null&&(l=h)}return}if(d.length===0||(p===-1&&(p=w),w!==p||u))return;let k=Ka(I);if(k!==null){u=!0;for(let h of d){let b=JSON.stringify([h,k]);if(!r.has(b)){if(o.length>=s){f=!0;return}r.add(b),o.push({name:h,version:k,lockKey:$t(h),dev:!1})}}}});g();let S=a?"yarn.lock (Berry)":"yarn.lock (v1)";if(y.refusedAnchors)return{deps:[],diagnostics:[`${S} uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set`],truncated:!1};y.oversizeLines>0&&t.push(`${S} has ${String(y.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),f&&t.push(`${S} exceeds ${String(s)} entries; truncated`);let x=l??Bp(e),_=x===null?null:Number(x.split(".")[0]);return x!==null&&(_===null||!Number.isInteger(_)||_<1||_>8)&&t.push(`${S} declares unsupported lockfileVersion ${x} (cupel knows v1 and Berry 4-8); its shape may differ, so what was read may be incomplete`),m>0&&t.push(`${S} has ${String(m)} entr(ies) with no version cupel could read (an unusual body shape or a missing \`version\`); they were not enumerated`),{deps:o,diagnostics:t,truncated:y.truncated||f}}function Gr(e){let n=e.trim(),t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let o=n.indexOf("_");return o!==-1&&(n=n.slice(0,o)),n.trim()}function Hr(e){let n=e.charCodeAt(0);return e.length>0&&n>=48&&n<=57}function Ua(e){let n=sn(e.trim());if(n.length===0)return null;let t=n.indexOf("(");t!==-1&&(n=n.slice(0,t));let o=n.charCodeAt(0)===47;if(o&&(n=n.slice(1)),n.length===0)return null;if(!o&&n.charCodeAt(0)!==64){let u=n.indexOf("/"),p=n.indexOf("@",1);u>0&&(p===-1||u<p)&&n.slice(0,u).includes(".")&&n.indexOf("/",u+1)!==-1&&(n=n.slice(u+1))}let r=n.charCodeAt(0)===64,s=r?n.indexOf("/"):-1;if(r&&s<=0)return null;let a=r?s+1:0,l=-1;for(let u=a;u<n.length;u+=1){let p=n.charCodeAt(u);if(p===47||p===64){l=u;break}}if(l<=a)return null;let i=n.slice(0,l),d=Gr(n.slice(l+1));return Hr(d)?{name:i,version:d}:null}var Kp=new Set(["packages","snapshots","importers"]),Up=new Set([5,6,7,8,9]);function zp(e){let n=sn(e.trim()),t=0;for(;t<n.length&&n.charCodeAt(t)>=48&&n.charCodeAt(t)<=57;)t+=1;return t===0||t>6?null:Number(n.slice(0,t))}function $o(e){let n=e.indexOf(":");if(n<=0)return null;let t=e.slice(n+1).trim();return t.length===0?null:{key:sn(e.slice(0,n).trim()),value:sn(t)}}function Xr(e,n={}){let t=[],o=[],r=new Set,s=n.maxEntries??2e5,a="",l=null,i=!1,d=0,u=[],p=(m,g)=>{let y=JSON.stringify([m,g]);if(!r.has(y)){if(o.length>=s){i=!0;return}r.add(y),o.push({name:m,version:g,lockKey:$t(m),dev:!1})}},f=Pt(e,n,(m,g)=>{if(m===0){let y=_o(g);if(a=y===null?"":sn(y.trim()),l=null,a==="lockfileVersion"){let S=$o(g),x=S===null?null:zp(S.value);S!==null&&(x===null||!Up.has(x))&&u.push(`pnpm-lock.yaml declares unsupported lockfileVersion ${S.value} (cupel knows 5.x-9.x); its shape may differ, so what was read may be incomplete`),a="";return}if(Kp.has(a)&&!dt(g)){let S=$o(g)?.value.trim()??"";S!=="{}"&&S!=="[]"&&(d+=1),a=""}return}if(a==="packages"||a==="snapshots"){if(m!==2)return;let y=_o(g),S=y===null?null:Ua(y);if(S===null){d+=1;return}p(S.name,S.version);return}if(a==="importers"){if(m===6){let y=$o(g);if(y===null){l=g.endsWith(":")?sn(g.slice(0,-1).trim()):null;return}l=null;let S=Gr(y.value);Hr(S)&&p(y.key,S);return}if(m===8&&l!==null){let y=$o(g);if(y===null||y.key!=="version")return;let S=Gr(y.value);Hr(S)&&p(l,S)}}});return f.refusedAnchors?{deps:[],diagnostics:["pnpm-lock.yaml uses YAML anchors/aliases (& / * / <<:); cupel refuses to expand them (expansion-bomb shape) and did NOT read the dependency set"],truncated:!1}:(t.push(...u),f.oversizeLines>0&&t.push(`pnpm-lock.yaml has ${String(f.oversizeLines)} over-long line(s) that were not parsed; the dependency set is incomplete`),i&&t.push(`pnpm-lock.yaml exceeds ${String(s)} entries; truncated`),d>0&&t.push(`pnpm-lock.yaml has ${String(d)} entr(ies) with no registry name@version key (git/tarball/link); they were not enumerated`),{deps:o,diagnostics:t,truncated:f.truncated||i})}function Wa(e){return e.toLowerCase().replace(/[-_.]+/gu,"-")}var qp=1e6,za=2e5,Wp=4096,Vp=65536,Gp=262144,Ot=/^[A-Za-z_][A-Za-z0-9_]*$/u;function Va(e){if(e.length>qp)return null;let n,t;for(let o of e.split(/\r?\n/u)){if(o==="")break;let r=/^([A-Za-z][A-Za-z0-9-]*):[ \t]*(.*)$/u.exec(o);if(r===null)continue;let s=r[1]?.toLowerCase();s==="name"&&n===void 0?n=r[2]?.trim():s==="version"&&t===void 0&&(t=r[2]?.trim())}return n===void 0||t===void 0||n===""||t===""?null:{name:n,version:t}}function Ga(e){return e.split(/\r?\n/u).map(n=>n.trim()).filter(n=>n.length>0&&Ot.test(n))}function Ha(e){if(!e.startsWith('"'))return e.split(",")[0]??"";let n="";for(let t=1;t<e.length;t+=1){let o=e[t];if(o==='"'){if(e[t+1]==='"'){n+='"',t+=1;continue}return n}n+=o}return n}function Xa(e){return e===""||e==="."||e===".."||e==="__pycache__"||e.startsWith("__editable__")||e.endsWith(".dist-info")||e.endsWith(".egg-info")||e.endsWith(".data")}function Ya(e){return e.endsWith(".py")?e.slice(0,-3):e.endsWith(".so")||e.endsWith(".pyd")?e.split(".")[0]??null:null}function Ja(e){let n=e.split(/\r?\n/u);return n.length>za?n.slice(0,za):n}function Za(e){let n=new Set;for(let t of Ja(e)){if(t==="")continue;let o=Ha(t).split("/"),r=o[0]??"";if(Xa(r))continue;if(o.length>1){Ot.test(r)&&n.add(r);continue}let s=Ya(r);s!==null&&Ot.test(s)&&n.add(s)}return[...n].sort((t,o)=>t<o?-1:t>o?1:0)}function Hp(e){let n=e.split("/"),t=n[0]??"";if(Xa(t))return null;let o=n[n.length-1]??"",r=Ya(o);if(r===null)return null;let s=n.slice(0,-1);if(s.some(l=>!Ot.test(l)||l==="__pycache__"))return null;let a=r==="__init__"?s:[...s,r];return a.length===0||!Ot.test(r==="__init__"?s[s.length-1]??"":r)?null:a}function Qa(e,n=Wp){let t=new Set,o=0,r=0,s=!1;for(let a of Ja(e)){if(a==="")continue;let l=Ha(a),i=Hp(l);if(i!==null){o+=1,(l.endsWith(".so")||l.endsWith(".pyd"))&&(r+=1);for(let d=1;d<=Math.min(2,i.length);d+=1){let u=i.slice(0,d).join(".");if(!t.has(u)){if(t.size>=n){s=!0;break}t.add(u)}}}}return{prefixes:[...t].sort((a,l)=>a<l?-1:a>l?1:0),moduleFiles:o,extensionModules:r,capped:s}}function Xp(e){if(e.length>Gp)return!0;let n=!1;for(let t of e.split(/\r?\n/u)){let o=t.trim();if(!(o===""||o.startsWith("#")||o.startsWith(";"))){if(o.startsWith("[")){let r=o.slice(1,o.endsWith("]")?-1:void 0).trim();n=r==="console_scripts"||r==="gui_scripts";continue}if(n&&o.includes("="))return!0}}return!1}function el(e){if(e.length>Vp)return null;let n;try{n=JSON.parse(e)}catch{return null}if(typeof n!="object"||n===null||Array.isArray(n))return null;let t=n,o=typeof t.dir_info=="object"&&t.dir_info!==null&&!Array.isArray(t.dir_info)?t.dir_info:null;return{url:typeof t.url=="string"?t.url:null,editable:o?.editable===!0}}function Mt(e,n){let t=Va(e);if(t===null)return null;let o=n.topLevelText!==void 0?Ga(n.topLevelText):[],r=o.length>0?o:n.recordText!==void 0?Za(n.recordText):[],s=n.recordText!==void 0?Qa(n.recordText):{prefixes:[],moduleFiles:0,extensionModules:0,capped:!1},a=n.entryPointsText!==void 0?Xp(n.entryPointsText)?"declared":"none":n.entryPointsUnknown===!0?"unknown":"none",l=n.directUrlText!==void 0?el(n.directUrlText)?.editable??!1:!1;return{name:Wa(t.name),version:t.version,importNames:r,modulePrefixes:s.prefixes,moduleFiles:s.moduleFiles,editable:l,consoleScripts:a,extensionModules:s.extensionModules,recordKnown:n.recordText!==void 0}}function qa(e,n,t){let o=e.get(n);o===void 0?e.set(n,[t]):o.includes(t)||o.push(t)}function Yr(e){let n=new Map,t=new Map,o=[];for(let r of e){if(r.importNames.length===0){o.push(r);continue}for(let s of r.importNames)qa(n,s,r);for(let s of r.modulePrefixes)qa(t,s,r)}return{byImportName:n,byModulePrefix:t,unmapped:o}}function Co(e,n){let t=n.split(".").filter(r=>r.length>0),o=t[0];if(o===void 0)return[];for(let r=Math.min(2,t.length);r>=1;r-=1){let s=e.byModulePrefix.get(t.slice(0,r).join("."));if(s!==void 0&&s.length>0)return s}return e.byImportName.get(o)??[]}import{statSync as gm}from"node:fs";import ym from"node:path";import{lstatSync as Yp,readFileSync as Jp,readdirSync as Zp,realpathSync as Jr,statSync as Tt}from"node:fs";import Se from"node:path";function Dt(e){return e.ecosystem==="PyPI"||e.alsoPython===!0}var rl=2e4,sl=32,il=256,Qp=2*1024*1024,em=256*1024,al=256,nm=16,tm=["package-lock.json","npm-shrinkwrap.json","yarn.lock","pnpm-lock.yaml"],om=["pyproject.toml","setup.py","setup.cfg"],rm=["requirements.txt","Pipfile"],sm=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"],ll={roots:[],observations:[],budget:"not-attempted",counts:{dirsWalked:0,manifestsSeen:0,rootsAdmitted:0,dotDirectoriesSkipped:0}};function nl(e,n){try{let t=Tt(e);return!t.isFile()||t.size>n?null:Jp(e,"utf8")}catch{return null}}function Pn(e){let n;try{n=Tt(e)}catch(t){return t?.code==="ENOENT"?"absent":"refused"}return n.isFile()?"regular":"refused"}function im(e){try{return Tt(e).isDirectory()}catch{return!1}}function am(e,n){let t=0,o=0,r=-1,s=0;for(;o<n.length;)if(t<e.length&&(e.charAt(t)==="?"||e.charAt(t)===n.charAt(o)))t+=1,o+=1;else if(t<e.length&&e.charAt(t)==="*")r=t,s=o,t+=1;else if(r>=0)t=r+1,s+=1,o=s;else return!1;for(;t<e.length&&e.charAt(t)==="*";)t+=1;return t===e.length}function lm(e,n){let t=(o,r)=>{if(o===e.length)return r===n.length;let s=e[o]??"";if(s==="**"){for(let l=r;l<=n.length;l+=1)if(t(o+1,l))return!0;return!1}if(r>=n.length)return!1;let a=n[r]??"";return(s.includes("*")||s.includes("?")?am(s,a):s===a)?t(o+1,r+1):!1};return t(0,0)}function dm(e){let n=[],t=nl(Se.join(e,"package.json"),Qp);if(t!==null)try{let a=JSON.parse(t)?.workspaces;if(Array.isArray(a))for(let l of a)typeof l=="string"&&n.push(l);else if(typeof a=="object"&&a!==null){let l=a.packages;if(Array.isArray(l))for(let i of l)typeof i=="string"&&n.push(i)}}catch{}let o=nl(Se.join(e,"pnpm-workspace.yaml"),em);o!==null&&n.push(...cm(o));let r=[];for(let s of n){if(r.length>=al)break;let a=s.trim();if(a.length===0)continue;for(;a.startsWith("./");)a=a.slice(2);if(a.startsWith("/")||Se.isAbsolute(a))continue;let l=a.split("/").filter(i=>i.length>0);l.length===0||l.length>nm||l.includes("..")||r.push(l.join("/"))}return r}function cm(e){let n=[],t=!1;for(let o of e.split(`
+`)){if(n.length>=al)break;if(/^packages:\s*(#.*)?$/.test(o)){t=!0;continue}if(!t)continue;let r=/^\s+-\s*(.*?)\s*$/.exec(o);if(r===null){o.trim().length>0&&(t=!1);continue}let s=(r[1]??"").trim(),a=s.indexOf(" #");a>=0&&(s=s.slice(0,a).trim()),(s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2)&&(s=s.slice(1,-1)),s.length>0&&n.push(s)}return n}function tl(e,n){let t=Se.relative(n,e);return t.length===0?!1:t.split(Se.sep).includes("node_modules")}function ol(e,n){return Se.relative(e,n).split(Se.sep).join("/")}function Zr(e,n){let t=n?.maxDirs??rl,o=n?.maxDepth??sl,r=n?.maxRoots??il,s=n?.discoverPythonRoots??!0,a;try{a=Jr(e)}catch{return{...ll,observations:[{kind:"refused-unreadable",rel:""}]}}let l=[],i=[],d=new Set([a]),u=0,p=0,f=0,m="complete",g=dm(a).map(w=>w.split("/")),y=w=>{let I="absent";for(let h of om){let b=Pn(Se.join(w,h));if(b==="regular"){I="declared";break}b==="refused"&&(I="refused")}if(I==="absent"&&rm.some(h=>Pn(Se.join(w,h))==="regular")&&(I="listed"),I==="absent")return{candidate:I,witnesses:[]};let k=[];return sm.some(h=>Pn(Se.join(w,h))==="regular")&&k.push("own-lockfile"),im(Se.join(w,".venv"))&&k.push("installed-env"),{candidate:I,witnesses:k}},S=(w,I)=>{let k=y(w);return k.candidate==="absent"?"not-root":(k.candidate!=="listed"&&(p+=1),k.witnesses.length===0&&k.candidate!=="refused"?(k.candidate==="declared"&&i.push({kind:"undeclared-manifest",rel:I}),"not-root"):l.length>=r?"exhausted":(l.push({rel:I,abs:w,witnesses:k.witnesses,manifestRefused:k.candidate==="refused",ecosystem:"PyPI"}),"root"))},x=(w,I)=>{if(I.length===0){let P=Pn(Se.join(w,"package.json"))!=="absent",v=s?y(w):{candidate:"absent",witnesses:[]};return!P&&v.candidate!=="absent"?(l.push({rel:"",abs:w,witnesses:["scan-root",...v.witnesses],manifestRefused:!1,ecosystem:"PyPI"}),"root"):(l.push({rel:"",abs:w,witnesses:["scan-root",...v.witnesses],manifestRefused:!1,...v.witnesses.length>0?{alsoPython:!0}:{}}),"root")}let k=Pn(Se.join(w,"package.json"));if(k==="absent")return s?S(w,I):"not-root";p+=1;let h=[],b=I.split("/");g.some(P=>lm(P,b))&&h.push("workspace-declared"),tm.some(P=>Pn(Se.join(w,P))==="regular")&&h.push("own-lockfile");let A=s?y(w):{candidate:"absent",witnesses:[]};for(let P of A.witnesses)h.includes(P)||h.push(P);return h.length===0&&k!=="refused"?(i.push({kind:"undeclared-manifest",rel:I}),"not-root"):l.length>=r?"exhausted":(l.push({rel:I,abs:w,witnesses:h,manifestRefused:k==="refused",...A.witnesses.length>0?{alsoPython:!0}:{}}),"root")},_=[{abs:a,rel:"",depth:0}];for(;_.length>0;){let w=_.pop();if(w===void 0)break;if(u>=t){m="dirs-exhausted";break}u+=1;let I=x(w.abs,w.rel);if(I==="exhausted"){m="roots-exhausted";break}let k=I==="root";if(w.depth>=o){m=m==="complete"?"depth-clamped":m;continue}let h;try{h=Zp(w.abs)}catch{i.push({kind:"refused-unreadable",rel:w.rel});continue}h.sort().reverse();for(let b of h){let A=Se.join(w.abs,b),P=w.rel.length===0?b:`${w.rel}/${b}`,v;try{let j=Yp(A);v=j.isDirectory()||j.isSymbolicLink()&&Tt(A).isDirectory()}catch{continue}if(!v)continue;if(b==="node_modules"){k||i.push({kind:"unenumerated-install",rel:P});continue}if(b.startsWith(".")){f+=1,i.push({kind:"skipped-dot-directory",rel:P}),Pn(Se.join(A,"package.json"))!=="absent"&&i.push({kind:"undeclared-manifest",rel:P});continue}let T;try{T=Jr(A)}catch{i.push({kind:"refused-unreadable",rel:P});continue}let N=a.endsWith(Se.sep)?a:a+Se.sep;if(T!==a&&!T.startsWith(N)){i.push({kind:"refused-out-of-root",rel:P});continue}tl(T,a)||d.has(T)||(d.add(T),_.push({abs:T,rel:ol(a,T),depth:w.depth+1}))}}for(let w of n?.operatorRoots??[]){let I=typeof w=="string"?w.slice(0,512):"",k=()=>{i.push({kind:"refused-operator-root",rel:I})};if(I.length===0||I.includes("\0")){k();continue}let h;try{h=Jr(Se.resolve(a,I))}catch{k();continue}let b=a.endsWith(Se.sep)?a:a+Se.sep;if(h!==a&&(!h.startsWith(b)||tl(h,a))){k();continue}let A;try{A=Tt(h).isDirectory()}catch{A=!1}if(!A||Pn(Se.join(h,"package.json"))!=="regular"){k();continue}let P=l.findIndex(N=>N.abs===h);if(P>=0){let N=l[P];N!==void 0&&!N.witnesses.includes("operator")&&(l[P]={...N,witnesses:[...N.witnesses,"operator"]});continue}let v=ol(a,h);l.push({rel:v,abs:h,witnesses:["operator"],manifestRefused:!1});let T=i.findIndex(N=>N.kind==="undeclared-manifest"&&N.rel===v);T>=0&&i.splice(T,1)}return l.sort((w,I)=>w.rel<I.rel?-1:w.rel>I.rel?1:0),i.sort((w,I)=>w.kind!==I.kind?w.kind<I.kind?-1:1:w.rel<I.rel?-1:w.rel>I.rel?1:0),{roots:l,observations:i,budget:m,counts:{dirsWalked:u,manifestsSeen:p,rootsAdmitted:l.length,dotDirectoriesSkipped:f}}}import{lstatSync as dl,readdirSync as um,readFileSync as fm,realpathSync as fl,statSync as pl}from"node:fs";import We from"node:path";var an={envDir:".venv",maxDistributions:2e4,maxMetadataBytes:1e6,maxRecordBytes:32*1024*1024,maxTopLevelBytes:256*1024,maxDirectUrlBytes:64*1024,maxPyvenvCfgBytes:64*1024,maxEntryPointsBytes:256*1024,maxPthBytes:256*1024,maxPthPaths:1024},pm=/^python\d+\.\d+$/u;function $n(e,n){let t;try{t=pl(e)}catch(o){return{why:o?.code==="ENOENT"?"absent":"unreadable"}}if(!t.isFile())return{why:"not-regular"};if(t.size>n)return{why:"oversize"};try{return{text:fm(e,"utf8")}}catch{return{why:"unreadable"}}}function Qr(e,n){let t;try{if(t=fl(n),!pl(t).isDirectory())return null}catch{return null}return t===e||t.startsWith(e+We.sep)?t:null}function cl(e,n){return We.relative(e,n).split(We.sep).join("/")}function ul(e){try{return um(e).sort()}catch{return null}}function mm(e){let n=[],t=[],o=0;for(let r of e.split(/\r?\n/u)){let s=r.trim();if(!(s===""||s.startsWith("#"))){if(/^import[ \t]/u.test(s)){o+=1;let a=/^import[ \t]+([A-Za-z_][A-Za-z0-9_.]*)/u.exec(s);a?.[1]!==void 0&&t.length<an.maxPthPaths&&t.push(a[1]);continue}n.length<an.maxPthPaths&&n.push(s)}}return{paths:n,importLines:o,importModules:t}}function hm(e){let n=null;for(let t of e.split(/\r?\n/u)){let o=/^\s*(version_info|version)\s*=\s*(\S+)\s*$/u.exec(t);if(o!==null){if(o[1]==="version_info")return o[2]??null;n??=o[2]??null}}return n}function Lt(e,n){let t=n?.envDir??an.envDir,o=n?.maxDistributions??an.maxDistributions,r=n?.maxMetadataBytes??an.maxMetadataBytes,s=n?.maxRecordBytes??an.maxRecordBytes,a=n?.maxTopLevelBytes??an.maxTopLevelBytes,l=n?.maxDirectUrlBytes??an.maxDirectUrlBytes,i=an.maxEntryPointsBytes,d=t,u=[],p=(P,v,T=null)=>({envRel:d,refused:P,sitePackages:[],interpreter:T,distInfos:[],pthFiles:[],unreadable:0,diagnostics:[...u,v],truncated:!1}),f;try{f=fl(e)}catch{return p("absent","the root itself could not be resolved")}let m=We.join(f,t),g;try{g=dl(m)}catch(P){return P?.code==="ENOENT"?p("absent",`${d}: absent`):p("not-a-directory",`${d}: could not be inspected`)}if(!g.isDirectory()&&!g.isSymbolicLink())return p("not-a-directory",`${d}: not a directory`);let y=Qr(f,m);if(y===null)return p("escapes-root",`${d}: resolves outside the project root (a symlinked environment is not the project's); refused, never followed`);let S=$n(We.join(y,"pyvenv.cfg"),an.maxPyvenvCfgBytes),x="text"in S?hm(S.text):null;"text"in S||u.push(`${d}/pyvenv.cfg: ${S.why} \u2014 interpreter version unknown`);let _=[];for(let P of["lib","lib64"]){let v=ul(We.join(y,P));if(v!==null)for(let T of v)pm.test(T)&&_.push(We.join(y,P,T,"site-packages"))}_.push(We.join(y,"Lib","site-packages"));let w=[],I=new Set;for(let P of _){let v=Qr(y,P);v===null||I.has(v)||(I.add(v),w.push(v))}if(w.length===0)return p("no-site-packages",`${d}: no site-packages directory (lib/pythonX.Y/site-packages or Lib/site-packages)`,x);w.length>1&&u.push(`${d}: ${String(w.length)} site-packages directories; all enumerated`);let k=[],h=[],b=0,A=!1;e:for(let P of w){let v=cl(f,P),T=ul(P);if(T===null){u.push(`${v}: unreadable; nothing enumerated there`);continue}for(let N of T){let j=We.join(P,N),$=N.endsWith(".dist-info"),D=N.endsWith(".egg-info");if(N.endsWith(".pth")){let H=$n(j,an.maxPthBytes);if(!("text"in H)){u.push(`${v}/${N}: ${H.why}; the paths it adds were NOT enumerated`);continue}h.push({name:N,sitePackages:v,...mm(H.text)});continue}if(!$&&!D)continue;if(k.length>=o){A=!0,u.push(`${v}: the distribution cap (${String(o)}) was hit at ${N}; the enumeration is INCOMPLETE`);break e}let K;try{K=dl(j)}catch{b+=1,u.push(`${v}/${N}: could not be inspected; not enumerated`);continue}let te=$?"dist-info":"egg-info";if(K.isFile()&&D){let H=$n(j,r);"text"in H?k.push({dir:N,kind:te,metadata:H.text,entryPointsUnknown:!0}):(b+=1,u.push(`${v}/${N}: ${H.why}; not enumerated`));continue}let B=Qr(y,j);if(B===null){b+=1,u.push(`${v}/${N}: not a directory inside the environment; not enumerated`);continue}let Y=$?"METADATA":"PKG-INFO",L=$n(We.join(B,Y),r);if(!("text"in L)){b+=1,u.push(`${v}/${N}: ${Y} ${L.why}; not enumerated`);continue}let O={dir:N,kind:te,metadata:L.text},X=$n(We.join(B,"entry_points.txt"),i);"text"in X?O.entryPoints=X.text:X.why!=="absent"&&(O.entryPointsUnknown=!0,u.push(`${v}/${N}/entry_points.txt: ${X.why}; the commands it declares are UNKNOWN`));let Z=$n(We.join(B,"top_level.txt"),a);if("text"in Z?O.topLevel=Z.text:Z.why!=="absent"&&u.push(`${v}/${N}/top_level.txt: ${Z.why}; ignored`),$){let H=$n(We.join(B,"RECORD"),s);"text"in H?O.record=H.text:u.push(`${v}/${N}/RECORD: ${H.why}; import names from top_level.txt only`);let J=$n(We.join(B,"direct_url.json"),l);"text"in J&&(O.directUrl=J.text)}k.push(O)}}return{envRel:d,refused:null,sitePackages:w.map(P=>cl(f,P)),interpreter:x,distInfos:k,pthFiles:h,unreadable:b,diagnostics:u,truncated:A}}var xm=["uv.lock","poetry.lock","Pipfile.lock","pdm.lock"];function bm(e,n){for(let t of n)try{if(gm(ym.join(e,t)).isFile())return t}catch{}return null}function ml(e){let n=[],t=[],o=(p,f)=>{t.push({kind:p,detail:f,blindsAnalysis:!1,rootRel:""}),n.push(f)},r=bm(e,xm),s=Lt(e);if(s.refused!==null){let p=s.refused==="absent"?`no \`${s.envRel}\` is installed`:`\`${s.envRel}\` could not be read (${s.refused})`;return o("no-installed-env",`${r??"the Python manifest"} declares a dependency set but ${p}: ZERO distributions were enumerated, so this scan reports nothing about Python dependencies \u2014 it is not a clean bill of health. Install the environment (\`uv sync\`) and re-scan.`),{packages:[],source:"none",lockfilePath:r,diagnostics:[...n,...s.diagnostics],truncated:!1,gaps:t}}let a=[],l=new Set,i=[],d=0;for(let p of s.distInfos){let f=Mt(p.metadata,{...p.topLevel!==void 0?{topLevelText:p.topLevel}:{},...p.record!==void 0?{recordText:p.record}:{},...p.directUrl!==void 0?{directUrlText:p.directUrl}:{}});if(f===null){d+=1,n.push(`${p.dir}: METADATA carries no Name/Version; not enumerated`);continue}let m=JSON.stringify([f.name,f.version]);l.has(m)||(l.add(m),f.importNames.length===0&&i.push(f.name),a.push({name:f.name,version:f.version,lockKey:"",dev:!1,declaredIn:"",ecosystem:"PyPI"}))}n.push(...s.diagnostics);let u=s.unreadable+d;return u>0&&o("installed-env-partial",`${String(u)} entr${u===1?"y":"ies"} under ${s.sitePackages.join(", ")} could not be read as a distribution (see the diagnostics): those distributions are MISSING from this scan; the ${String(a.length)} enumerated were assessed normally.`),s.truncated&&o("installed-env-partial",`the environment walk under ${s.sitePackages.join(", ")} hit its distribution cap: the enumeration is INCOMPLETE, and a partial (possibly false-clean) set is never reported.`),i.length>0&&n.push(`${String(i.length)} distribution(s) carry no import name (distribution-unmapped, Tier-B): ${i.slice(0,5).join(", ")}${i.length>5?", \u2026":""} \u2014 advisories on them are enumerated; their modules cannot be resolved (ADR-109 D5)`),{packages:a,source:a.length>0?"installed-env":"none",lockfilePath:r,diagnostics:n,truncated:s.truncated,gaps:t}}var Sm=128*1024*1024,km=[{file:"package-lock.json",source:"npm-lockfile",parse:(e,n)=>Ro(e,n===void 0?{}:{maxEntries:n})},{file:"npm-shrinkwrap.json",source:"npm-lockfile",parse:(e,n)=>Ro(e,n===void 0?{}:{maxEntries:n})},{file:"yarn.lock",source:"yarn-lockfile",parse:(e,n)=>Vr(e,n===void 0?{}:{maxEntries:n})},{file:"pnpm-lock.yaml",source:"pnpm-lockfile",parse:(e,n)=>Xr(e,n===void 0?{}:{maxEntries:n})}],Em=[".pnp.cjs",".pnp.data.json",".pnp.js"];function ts(e,n){let t;try{t=ns(ln.join(e,n))}catch{return null}let o=e.endsWith(ln.sep)?e:e+ln.sep;return t.startsWith(o)?t:null}function gl(e,n){let t=ln.join(e,"package.json"),o;try{o=ns(t)}catch{return null}if(!o.startsWith(n+ln.sep))return null;try{if(!Ft(o).isFile())return null;let r=JSON.parse(es(o,"utf8"));return typeof r.name!="string"||typeof r.version!="string"?null:{name:r.name,version:r.version}}catch{return null}}function yl(e,n){try{return Ft(ln.join(e,n)),!0}catch{return!1}}function wm(e,n){if(yl(e,"pnpm-workspace.yaml"))return!0;let t=ts(e,"package.json");if(t===null)return yl(e,"package.json");let o;try{let a=Ft(t);if(!a.isFile()||a.size>n)return!0;o=es(t,"utf8")}catch{return!0}let r;try{r=JSON.parse(o)}catch{return!0}for(let a of["dependencies","devDependencies","optionalDependencies","peerDependencies"]){let l=r[a];if(typeof l=="object"&&l!==null&&Object.keys(l).length>0)return!0}let s=r.workspaces;return Array.isArray(s)?s.length>0:typeof s=="object"&&s!==null}function xl(e,n){let t=ln.join(e,"node_modules"),o=[],r;try{r=hl(t,{withFileTypes:!0})}catch{return o}for(let s of r){let a=s.name;if(a.startsWith("."))continue;if(a.startsWith("@")){let i;try{i=hl(ln.join(t,a),{withFileTypes:!0})}catch{continue}for(let d of i){let u=gl(ln.join(t,a,d.name),n);u!==null&&o.push({dev:!1,name:u.name,version:u.version,lockKey:`node_modules/${a}/${d.name}`,linked:d.isSymbolicLink()||s.isSymbolicLink()})}continue}let l=gl(ln.join(t,a),n);l!==null&&o.push({dev:!1,name:l.name,version:l.version,lockKey:`node_modules/${a}`,linked:s.isSymbolicLink()})}return o}var vm=5;function _m(e,n,t){let o=ts(e,n);if(o===null){try{Ft(ln.join(e,n))}catch{return null}return{gap:`${n} resolves outside the scan root (symlink); refused, not read`}}let r;try{r=Ft(o)}catch{return null}if(!r.isFile())return{gap:`${n} is not a regular file; refused, not read`};if(r.size>t)return{gap:`${n} is ${String(r.size)} bytes (> ${String(t)}); skipped before reading to avoid a memory DoS`};try{return{text:es(o,"utf8")}}catch{return{gap:`${n} could not be read`}}}function Im(e,n){let t=ns(e),o=[],r=[],s=n?.maxLockfileBytes??Sm,a=[],l=new Set,i=[],d=wm(t,s),u=null,p=!1,f=(g,y,S)=>{r.push({kind:g,detail:y,blindsAnalysis:S,rootRel:""}),o.push(y)};for(let g of km){let y=_m(t,g.file,s);if(y===null)continue;if("gap"in y){f("lockfile-unreadable",y.gap,!1);continue}let S=g.parse(y.text,n?.maxLockfileEntries);if(S.truncated&&(p=!0),S.deps.length===0){if(S.diagnostics.length>0||d){let x=S.diagnostics.length>0?S.diagnostics.join("; "):"no entries found";f("lockfile-unparsed",`${g.file} yielded NO dependencies (${x}); its transitive dependency set was not enumerated`,!1)}continue}S.diagnostics.length>0&&f("lockfile-partial",`${g.file} was only partly enumerated (${S.diagnostics.join("; ")})`,!1),u===null&&(u=g.file),i.includes(g.source)||i.push(g.source);for(let x of S.deps){let _=JSON.stringify([x.name,x.version,x.lockKey]);l.has(_)||(l.add(_),a.push({...x,declaredIn:g.file}))}}for(let g of Em)if(ts(t,g)!==null){f("yarn-pnp",`${g} present: this project uses Yarn Plug'n'Play, whose dependency code lives in zips cupel does not resolve or read \u2014 NO dependency code was analyzed, so no finding here can be read as not-reachable. Set \`nodeLinker: node-modules\` for a full scan.`,!0);break}if(a.length>0){let g=i.length===1?i[0]??"none":"multi-lockfile";i.length>1&&o.push(`multiple lockfiles present (${i.join(", ")}); enumerated the UNION of all of them`);let y=new Set(a.map(_=>JSON.stringify([_.name,_.version]))),S=new Set,x=[];for(let _ of xl(t,t)){let w=JSON.stringify([_.name,_.version,_.lockKey]);l.has(w)||(l.add(w),a.push({name:_.name,version:_.version,lockKey:_.lockKey,dev:_.dev,declaredIn:""}));let I=JSON.stringify([_.name,_.version]);_.linked||y.has(I)||S.has(I)||(S.add(I),x.length<vm&&x.push(Ct(_.name,_.version)))}if(S.size>0){let _=S.size-x.length;f("lockfile-skew",`node_modules holds ${String(S.size)} package(s) at a (name, version) no lockfile lists (${x.join(", ")}${_>0?`, and ${String(_)} more`:""}): ${u??"the lockfile"} and the installed tree DISAGREE, so cupel enumerated BOTH. A stale lockfile or an \`npm i --no-save\` is the usual cause \u2014 re-install and commit the lockfile so the reviewed set is the installed set.`,!1)}return{packages:a,source:g,lockfilePath:u,diagnostics:o,truncated:p,gaps:r}}let m=xl(t,t);return m.length>0?(f("shallow-node-modules",`no usable lockfile (package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml), so the installed set came from a SHALLOW node_modules scan: ${String(m.length)} top-level package(s), with every transitive dependency missing. Commit a lockfile for a complete scan.`,!1),{packages:m.map(g=>({name:g.name,version:g.version,lockKey:g.lockKey,dev:!1,declaredIn:""})),source:"node-modules",lockfilePath:null,diagnostics:o,truncated:p,gaps:r}):(d&&f("no-enumeration","package.json declares dependencies but there is no lockfile and no readable node_modules: ZERO packages were enumerated, so this scan reports nothing about dependencies \u2014 it is not a clean bill of health. Install the project (or commit a lockfile) and re-scan.",!1),{packages:[],source:"none",lockfilePath:null,diagnostics:o,truncated:p,gaps:r})}function Am(e){return e.rel===""||e.witnesses.includes("own-lockfile")||e.witnesses.includes("operator")||e.witnesses.includes("installed-env")||e.manifestRefused}function Nm(e){if(e.length===0||e==="."||e==="..")return!1;for(let n=0;n<e.length;n+=1){let t=e.charCodeAt(n);if(t<32||t===127||t>=128&&t<=159||t===92)return!1}return!0}function Sl(e){return e===""||e.split("/").every(Nm)}function Rm(e,n){if(e===""||n==="")return n;if(!Sl(e))return"";let t=`${e}/${n}`;return t.length<=No?t:""}function bl(e,n){return e===""?n:`${e}: ${n}`}function Pm(e){return{rel:"",abs:e,witnesses:["scan-root"],manifestRefused:!1}}function kl(e,n,t){let o=t?.maxUnionEntries??Ao,r=n.roots.filter(Am),s=r.some(g=>g.rel==="")?r:[Pm(e),...r],a=[],l=[],i=new Set,d=[],u=[],p=!1,f=!1;for(let g of s){let y=g.rel===""?e:g.abs,S=Im(y,t),x=Dt(g)?ml(y):null,_=x===null?S:Om(S,x),w=_.diagnostics.map(k=>bl(g.rel,k));!Sl(g.rel)&&_.packages.length>0&&w.push(`${g.rel}: its path holds a segment no install key may be built from, so the install location of its ${String(_.packages.length)} row(s) is refused \u2014 dependency-class evidence and execution context for them read fail-closed (ADR-071)`);let I={..._,rootRel:g.rel,...g.ecosystem!==void 0?{ecosystem:g.ecosystem}:{},...x!==null?{pythonLockfilePath:x.lockfilePath===null||g.rel===""?x.lockfilePath:`${g.rel}/${x.lockfilePath}`}:{},packages:_.packages.map(k=>({...k,lockKey:Rm(g.rel,k.lockKey),declaredIn:k.declaredIn===""||g.rel===""?k.declaredIn:`${g.rel}/${k.declaredIn}`})),lockfilePath:_.lockfilePath===null||g.rel===""?_.lockfilePath:`${g.rel}/${_.lockfilePath}`,gaps:_.gaps.map(k=>({...k,rootRel:g.rel,detail:bl(g.rel,k.detail)})),diagnostics:w};a.push(I),_.truncated&&(p=!0);for(let k of I.packages){let h=JSON.stringify([k.name,k.version,k.lockKey]);if(!i.has(h)){if(l.length>=o){f=!0;break}i.add(h),l.push(k)}}d.push(...I.gaps),u.push(...I.diagnostics)}f&&(p=!0,u.push(`the union of installed sets across ${String(s.length)} roots exceeds its ceiling of ${String(o)} distinct rows; truncated \u2014 a partial enumeration is never reported (ADR-071)`));let m=a[0];if(m===void 0)throw new Error("unreachable: the scan root is always enumerated");return{packages:l,source:m.source,lockfilePath:m.lockfilePath,diagnostics:u,truncated:p,gaps:d,perRoot:a}}function $m(e,n){let t;for(let o of e.perRoot){if(o.rootRel===""){t??=o;continue}n.startsWith(`${o.rootRel}/`)&&(t===void 0||o.rootRel.length>t.rootRel.length)&&(t=o)}return t}function Oo(e,n){return n.declaredIn!==""?n.declaredIn:$m(e,n.lockKey)?.lockfilePath??null}function El(e,n){let t=e.perRoot.find(o=>o.rootRel===n.rootRel);return Cm.has(n.kind)?t?.pythonLockfilePath!==void 0&&t.pythonLockfilePath!==null?t.pythonLockfilePath:n.rootRel===""?null:`${n.rootRel}/pyproject.toml`:t?.lockfilePath!==void 0&&t.lockfilePath!==null?t.lockfilePath:n.rootRel===""?null:`${n.rootRel}/${t?.ecosystem==="PyPI"?"pyproject.toml":"package.json"}`}var Cm=new Set(["no-installed-env","installed-env-partial"]);function Om(e,n){return{packages:[...e.packages,...n.packages],source:e.packages.length===0&&n.packages.length>0?n.source:e.source,lockfilePath:e.lockfilePath??n.lockfilePath,diagnostics:[...e.diagnostics,...n.diagnostics],truncated:e.truncated||n.truncated,gaps:[...e.gaps,...n.gaps]}}function wl(e){let n=new Map;for(let t of e){let o=n.get(t.name)??new Set;o.add(t.version),n.set(t.name,o)}return t=>{let o=n.get(t);if(o===void 0)return;let r=[...o].sort();return r.length===1?r[0]:r}}function jt(e){return new Set(e.map(n=>n.root))}function ut(e,n){let t=jt(n);return e.roots.filter(o=>!t.has(o.rel)&&(o.rel===""||o.ecosystem!=="PyPI"))}function os(e){let n=e.slice(0,8),t=e.length-n.length;return n.join(", ")+(t>0?`, \u2026 and ${String(t)} more`:"")}function rs(e,n){return ut(e,n).map(t=>({code:"unanalyzed-project-root",path:t.rel===""?".":t.rel,detail:t.rel===""?`the scan root declares no JavaScript entrypoint of its own (${t.witnesses.join(" + ")}) \u2014 its JavaScript, if any, was not analyzed while a nested root's was; pass \`--entry <file>\` or declare \`main\`, else every npm \`not-reachable\` is capped at \`unknown\` (ADR-071)`:`\`${t.rel}\` is a project root (${t.witnesses.join(" + ")}${t.manifestRefused?", manifest refused":""}) whose JavaScript this scan did not analyze; code there can load any installed npm package, so every npm \`not-reachable\` is capped at \`unknown\` until it is analyzed (ADR-071)`}))}function vl(e){let n=[],t=e.observations.filter(o=>o.kind==="unenumerated-install").map(o=>o.rel);if(t.length>0&&n.push({kind:"unenumerated-install",detail:`${String(t.length)} node_modules director${t.length===1?"y":"ies"} under no admitted project root (${os(t)}) were not enumerated: packages installed there are MISSING from this scan. The enumerated ones were analyzed normally (ADR-071)`,blindsAnalysis:!1,rootRel:""}),e.budget!=="complete"){let o=e.counts;n.push({kind:"root-discovery-truncated",detail:`root discovery did not finish (${e.budget}: ${String(o.dirsWalked)} dirs walked, ${String(o.rootsAdmitted)} roots admitted) \u2014 a project root with its own install location may have been missed, so every \`not-reachable\` is capped at \`unknown\` (ADR-071 Invariant C)`,blindsAnalysis:!0,rootRel:""})}return n}function _l(e){let n=new Set;for(let t of e)t.blindsAnalysis&&n.add(t.kind==="root-discovery-truncated"?"analysis-cap":"resolution-divergence");return[...n]}import{statSync as kh}from"node:fs";import Hn from"node:path";import{spawnSync as fh}from"node:child_process";function Bt(e){{let n=V[e];if(n===void 0)throw new Error(`the bundle does not embed ${e}; this is a cupel build defect`);return["-c",n]}}import{readdirSync as Mm,realpathSync as Il,statSync as Al}from"node:fs";import wn from"node:path";var Nl=32,Tm=512,Dm=/^[A-Za-z_][A-Za-z0-9_]*$/u,Lm=[".so",".pyd",".dylib"],Mo=e=>({resolved:e,failure:null}),ft=e=>({resolved:null,failure:e});function Fm(e){if(e.length===0||e.length>Tm)return null;let n=e.split(".");return n.length>Nl?null:n.every(t=>Dm.test(t))?n:null}function ss(e){try{return Al(e).isDirectory()}catch{return!1}}function pt(e){try{return Al(e).isFile()}catch{return!1}}function Kt(e,n){let t,o;try{t=Il(n),o=Il(e)}catch{return null}return t===o||t.startsWith(o+wn.sep)?t:null}function jm(e,n){let t;try{t=Mm(e)}catch{return null}for(let o of t)if(o.startsWith(`${n}.`)&&Lm.some(r=>o.endsWith(r))&&pt(wn.join(e,o)))return wn.join(e,o);return null}function Cn(e,n){let t=Fm(n);if(t===null)return ft("refused");let o=null,r=!1;for(let[s,a]of e.roots.entries()){let l=a,i=!1;for(let y of t.slice(0,-1)){let S=wn.join(l,y);if(pt(wn.join(S,"__init__.py"))||ss(S)){if(!ss(S)){i=!0;break}l=S;continue}i=!0,pt(`${S}.py`)&&(r=!0);break}if(i)continue;let d=t[t.length-1];if(d===void 0)return ft("refused");let u=wn.join(l,d,"__init__.py");if(pt(u)){let y=Kt(a,u);return y===null?ft("escapes-root"):Mo({module:n,kind:"package",path:y,rootIndex:s})}let p=wn.join(l,`${d}.py`);if(pt(p)){let y=Kt(a,p);return y===null?ft("escapes-root"):Mo({module:n,kind:"module",path:y,rootIndex:s})}let f=jm(l,d);if(f!==null){let y=Kt(a,f);return y===null?ft("escapes-root"):Mo({module:n,kind:"extension",path:y,rootIndex:s})}let m=wn.join(l,d);if(o===null&&ss(m)){let y=Kt(a,m);y!==null&&(o={module:n,kind:"namespace",path:y,rootIndex:s});continue}let g=wn.join(l,`${d}.pyi`);if(o===null&&pt(g)){let y=Kt(a,g);y!==null&&(o={module:n,kind:"stub-only",path:y,rootIndex:s})}}return o!==null?Mo(o):ft(r?"not-a-package":"not-found")}function Rl(e,n){if(n)return e;let t=e.lastIndexOf(".");return t===-1?"":e.slice(0,t)}function To(e,n,t,o){if(t<1||t>Nl)return{failure:"refused"};let r=Rl(e,n),s=r===""?[]:r.split("."),a=t-1;if(a>s.length)return{failure:"beyond-top-level"};let l=s.slice(0,s.length-a),i=o===null||o===""?[]:o.split("."),d=[...l,...i].join(".");return d===""?{failure:"beyond-top-level"}:{dotted:d}}var is="<toplevel>";var Bm=new Set(["self","cls"]),Km=8;function $l(e,n){return{path:e,start:n.start,end:n.end}}function Pl(e,n){return n!==null?n.includes(e):!e.startsWith("_")}function ls(e,n,t,o){let r=[],s=[],a=[],l=[],i=new Map,d=new Map,u=new Map,p=new Map,f=new Map,m=`${n}#${is}`;r.push({id:m,moduleId:n,name:is,kind:"function",declRange:{path:t,start:0,end:0},isExported:!1,publicSurfaceReachable:!1});for(let y of e.classes){let S=`${n}#class:${y.qualname}`;u.set(y.qualname,S),f.set(y.qualname,y.bases.filter(x=>x!==null)),s.push({id:S,moduleId:n,name:y.name,implementsRefs:[],members:[]})}for(let y of e.functions){let S=`${n}#${y.qualname}`;i.set(y.qualname,S);let x=y.enclosingClass,_=x===null?void 0:u.get(x),w=x===null&&y.enclosingFunction===null,I=w?Pl(y.name,e.all):x!==null&&!x.includes(".")?Pl(x,e.all):!1;if(r.push({id:S,moduleId:n,name:y.name,kind:_!==void 0?y.name==="__init__"?"ctor":"method":"function",..._!==void 0?{enclosingClassId:_}:{},declRange:$l(t,y.range),isExported:I,publicSurfaceReachable:I}),w&&(d.set(y.name,S),I)){let k=o();a.push({id:k,moduleId:n,exportedName:y.name,kind:"value"}),l.push({exportId:k,target:{kind:"function",functionId:S}})}if(x!==null){let k=p.get(x)??new Map;k.set(y.name,S),p.set(x,k)}}let g=s.map(y=>{let S=[...u.entries()].find(([,_])=>_===y.id)?.[0],x=S===void 0?void 0:p.get(S);return x===void 0?y:{...y,members:[...x.values()]}});return{moduleId:n,functions:r,classes:g,exports:a,exportBindings:l,byQualname:i,topLevel:d,classByName:u,methods:p,baseNames:f,toplevelId:m}}function ds(e){let{decls:n,envs:t}=e,o=[],r=new Map;for(let[f,m]of n){let g=t.get(f);for(let[y,S]of m.baseNames){let x=m.classByName.get(y);if(x!==void 0)for(let _ of S){let w=Um(_,m,g,n);if(w===void 0)continue;o.push({subclassId:x,superclassId:w,relation:"extends"});let I=r.get(w)??[];I.push(x),r.set(w,I)}}}let s=new Map,a=(f,m)=>{let g=s.get(f)??[];g.includes(m)||g.push(m),s.set(f,g)};for(let f of n.values())for(let m of f.methods.values())for(let[g,y]of m)a(g,y);for(let f of e.rebinds??[]){let m=n.get(f.moduleId)?.topLevel.get(f.target);m!==void 0&&a(f.attr,m)}let l=new Map;for(let f of n.values())for(let m of f.classByName.values())l.set(m,f);let i=[],d=[],u=0,p=0;for(let{moduleId:f,path:m,call:g}of e.pending){let y=n.get(f);if(y===void 0)continue;let S=g.enclosingFunction===null?y.toplevelId:y.byQualname.get(g.enclosingFunction)??y.toplevelId,x=zm(g,f,y,t.get(f),n,t,{byMethodName:s,subclassesOf:r,classOwner:l}),_=`py-call:${f}:${String(u)}`;u+=1,x.resolution==="unresolved"&&(p+=1),i.push({id:_,enclosingFunctionId:S,calleeExprShape:g.receiver===null?"identifier":"member",resolvedTargetIds:x.ids,resolution:x.resolution,range:$l(m,g.range)});for(let w of x.ids)d.push({callSiteId:_,calleeFunctionId:w,resolution:x.resolution})}return{callSites:i,callEdges:d,inheritEdges:o,unresolved:p}}function as(e,n,t,o,r=new Set,s=0){if(s>Km)return;let a=`${e}${n}`;if(r.has(a))return;r.add(a);let l=t.get(e)?.topLevel.get(n);if(l!==void 0)return l;let i=o.get(e)?.names.get(n);if(i!==void 0)return as(i.moduleId,i.name,t,o,r,s+1)}function Um(e,n,t,o){let r=n.classByName.get(e);if(r!==void 0)return r;let s=t?.names.get(e);if(s!==void 0)return o.get(s.moduleId)?.classByName.get(s.name)}var mt={ids:[],resolution:"unresolved"};function zm(e,n,t,o,r,s,a){if(e.callee===null)return mt;if(e.receiver===null){let u=t.topLevel.get(e.callee);if(u!==void 0)return{ids:[u],resolution:"resolved"};let p=o?.names.get(e.callee);if(p!==void 0){let f=as(p.moduleId,p.name,r,s);if(f!==void 0)return{ids:[f],resolution:"resolved"}}return mt}let l=e.attr;if(l===null)return mt;if(Bm.has(e.receiver)&&e.enclosingFunction!==null){let u=e.enclosingFunction.split(".").slice(0,-1).join("."),p=t.classByName.get(u);if(p!==void 0){let f=qm(p,l,a);return f.length===1?{ids:f,resolution:"resolved"}:f.length>1?{ids:f,resolution:"field-based"}:mt}}let i=o?.modules.get(e.receiver);if(i!==void 0){let u=as(i,l,r,s);return u!==void 0?{ids:[u],resolution:"resolved"}:mt}let d=a.byMethodName.get(l)??[];return d.length===0||d.length>64?mt:{ids:d,resolution:"field-based"}}function qm(e,n,t){let o=[],r=new Set,s=[e];for(;s.length>0;){let a=s.shift();if(a===void 0||r.has(a))continue;r.add(a);let l=t.classOwner.get(a);if(l!==void 0){let i=[...l.classByName.entries()].find(([,u])=>u===a)?.[0],d=i===void 0?void 0:l.methods.get(i)?.get(n);d!==void 0&&!o.includes(d)&&o.push(d)}for(let i of t.subclassesOf.get(a)??[])s.push(i)}return o}var Wm=5e3,Cl=200,Ol=100,Ml={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Dl(e){return`pkg:${e}`}function mn(e){return e.split(/[\\/]+/u).join("/")}function Tl(e,n){let t=e.endsWith("/")?e:`${e}/`,o=mn(n),r=mn(t);return o.startsWith(r)?o.slice(r.length):null}function Ll(e){let n=mn(e).split("/"),t=n[n.length-1]??"";if(t==="__init__.py")return{dotted:n.slice(0,-1).join("."),isPackage:!0};let o=t.endsWith(".py")?t.slice(0,-3):t;return{dotted:[...n.slice(0,-1),o].filter(r=>r!=="").join("."),isPackage:!1}}function cs(e){return e.split(".")[0]??e}var Vm="site-packages:";function us(e){let n=e.extract??Do,t=e.maxModules??Wm,o=(e.externalRoots??[]).map(O=>mn(O).endsWith("/")?mn(O):`${mn(O)}/`),r=O=>{let X=mn(O);return o.find(Z=>X.startsWith(Z))??null},s=O=>r(O)!==null,a=[],l=new Map,i=[],d=[],u=new Set,p=new Set,f=new Map,m=new Map,g=[],y=new Map,S=[],x=0,_=()=>{let O=`py-export:${String(x)}`;return x+=1,O},w=null,I=!1,k=new Set,h=[];for(let O of e.entryFiles){let X=Tl(e.projectRoot,O);if(X===null){a.push({code:"unresolved-import",where:mn(O),detail:"entrypoint lies outside the project root; not analyzed"});continue}u.has(O)||(u.add(O),h.push({file:O,rel:X,isEntry:!0,packageName:"",modulePath:X}))}let b=O=>{let X=Dl(O);return l.has(X)||(p.add(O),l.set(X,{id:X,packageName:O,versionRange:"",path:O,moduleSystem:"dual",isEntrypoint:!1,externalSurface:!0})),X},A=0,P=(O,X,Z,H)=>{let J=`py-import:${String(A)}`;A+=1,i.push({id:J,moduleId:O,specifier:X,...Z!==null?{resolvedModuleId:Z}:{},isNamespace:!1,isDefault:!1,dynamic:H,specifierIsLiteral:!0}),Z!==null&&d.push({importId:J,resolvedModuleId:Z})};for(let O=0;O<Ol&&h.length>0;O+=1){let X=h.slice(0,Cl);h=h.slice(Cl);let Z=n(X.map(J=>J.file),e.python!==void 0?{python:e.python}:{});if(w??=Z.interpreter,k.size===0&&Z.stdlib.length>0&&(k=new Set(Z.stdlib)),Z.refused!==null)return a.push({code:"extract-refused",where:"",detail:`${Z.refused}: ${Z.diagnostics.join("; ")}`}),{graph:Ml,diagnostics:a,interpreter:Z.interpreter,counts:{modules:0,surfaces:0}};let H=new Map(Z.files.map(J=>[J.path,J]));for(let J of X){let se=H.get(J.file),oe=J.rel,C=Ll(J.modulePath);if(l.set(oe,{id:oe,packageName:J.packageName,versionRange:"",path:J.modulePath,moduleSystem:"dual",isEntrypoint:J.isEntry}),se===void 0||se.refused!==null){a.push({code:"file-refused",where:J.rel,detail:se?.refused??"no row was returned for this file"});continue}v(se,oe,C),D(se,J.rel),f.set(oe,ls(se,oe,J.rel,_)),m.set(oe,$(se,oe,C));for(let Q of se.calls)g.push({moduleId:oe,path:J.rel,call:Q});for(let Q of se.escapes){if(Q.kind!=="attr-rebind")continue;let ee=Q.attr??null;ee===null||Q.target===null||S.push({moduleId:oe,attr:ee,target:Q.target})}}}function v(O,X,Z){for(let H of O.imports){if(H.guards.includes("type-checking"))continue;let J=[];if(H.level>0){let oe=To(Z.dotted,Z.isPackage,H.level,H.module);if("failure"in oe){a.push({code:"unresolved-import",where:O.path,detail:`relative import (level ${String(H.level)}) ${oe.failure}`});continue}J.push(oe.dotted);for(let C of H.names)J.push(`${oe.dotted}.${C.name}`)}else if(H.module!==null){J.push(H.module);for(let oe of H.names)J.push(`${H.module}.${oe.name}`)}else continue;let se=!1;for(let oe of J)T(oe,X,H.deferred)&&(se=!0);if(!se){let oe=J[0]??"";P(X,oe,null,H.deferred);let C=cs(oe);if(k.has(C)||H.guards.includes("optional")||(e.environmentComplete??!1)&&e.distributionOf(C)===null)continue;a.push({code:"unresolved-import",where:O.path,detail:`\`${oe}\` did not resolve on the search path`})}}}function T(O,X,Z){let H=O.split("."),J=!1;for(let se=1;se<=H.length;se+=1){let oe=H.slice(0,se).join("."),C=Cn(e.paths,oe);C.resolved!==null&&(j(C.resolved,X,oe,Z),se===H.length&&(J=!0))}return J}function N(O){return u.has(O.file)||l.has(O.rel)?!0:u.size>=t?(I||(I=!0,a.push({code:"module-cap",where:O.rel,detail:`the analyzed-module ceiling (${String(t)}) was hit; the graph is INCOMPLETE`})),!1):(u.add(O.file),h.push(O),!0)}function j(O,X,Z,H){if(O.kind==="stub-only")return;let J=O.kind==="module"||O.kind==="package",se=Tl(e.projectRoot,O.path);if(se!==null&&!s(O.path)&&J){let ee=se;P(X,Z,ee,H),y.set(Z,ee),N({file:O.path,rel:se,isEntry:!1,packageName:"",modulePath:se});return}let oe=e.distributionOf(cs(Z));if(oe===null){P(X,Z,null,H),a.push({code:"unresolved-import",where:Z,detail:`resolved to ${O.kind} outside the project, but no installed distribution provides \`${cs(Z)}\``});return}let C=r(O.path);if(!J||C===null){P(X,Z,b(oe),H);return}let Q=`${Vm}${mn(O.path).slice(C.length)}`;P(X,Z,Q,H),y.set(Z,Q),N({file:O.path,rel:Q,isEntry:!1,packageName:oe,modulePath:mn(O.path).slice(C.length)})}function $(O,X,Z){let H=new Map,J=new Map;for(let se of O.imports){if(se.guards.includes("type-checking"))continue;let oe=se.module;if(se.level>0){let C=To(Z.dotted,Z.isPackage,se.level,se.module);if("failure"in C)continue;oe=C.dotted}if(oe!==null){if(se.form==="import"){let C=se.names[0]?.asname??null;if(C!==null){let ue=y.get(oe);ue!==void 0&&H.set(C,ue);continue}let Q=oe.split(".")[0]??oe,ee=y.get(Q)??y.get(oe);ee!==void 0&&H.set(Q,ee);continue}for(let C of se.names){let Q=C.asname??C.name,ee=y.get(`${oe}.${C.name}`);if(ee!==void 0){H.set(Q,ee);continue}let ue=y.get(oe);ue!==void 0&&J.set(Q,{moduleId:ue,name:C.name})}}}return H.set("",X),{modules:H,names:J}}function D(O,X){for(let Z of O.escapes)switch(Z.kind){case"loader-escape":a.push({code:"loader-escape",where:X,detail:`${Z.callee} loads a module this analysis cannot name`});break;case"pkgutil-scan":case"runpy":case"entry-point-load":a.push({code:"dynamic-load-set",where:X,detail:`${Z.callee} loads a set of modules the syntax does not name`});break;case"sys-modules":a.push({code:"module-registry-write",where:X,detail:`${Z.callee} rewrites the module registry at run time`});break;case"import-module-literal":{let H=Z.target;if(H===null)break;T(H,X,!0);break}case"dispatch-escape":break}}h.length>0&&a.push({code:"module-cap",where:"",detail:`the walk did not finish within ${String(Ol)} waves; the graph is INCOMPLETE`});let K=ds({decls:f,envs:m,pending:g,rebinds:S}),te=[...f.values()].flatMap(O=>O.functions),B=[...f.values()].flatMap(O=>O.classes),Y=[...f.values()].flatMap(O=>O.exports),L=[...f.values()].flatMap(O=>O.exportBindings);return{graph:{...Ml,modules:[...l.values()],imports:i,importEdges:d,functions:te,classes:B,exports:Y,exportBindings:L,callSites:K.callSites,callEdges:K.callEdges,inheritEdges:K.inheritEdges},diagnostics:a,interpreter:w,counts:{modules:l.size-p.size,surfaces:p.size}}}import{readdirSync as Gm,readFileSync as jl,statSync as Lo}from"node:fs";import Ke from"node:path";import{spawnSync as Hm}from"node:child_process";var Xm="python3",Ym=256*1024,Jm=8*1024*1024,Bl=/^([A-Za-z_][A-Za-z0-9_.]*)(?::([A-Za-z_][A-Za-z0-9_.]*))?$/u,Zm=/(?:^|\s)([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:\s|$)/u;function On(e){try{return Lo(e).isFile()}catch{return!1}}function Fl(e){try{return Lo(e).isDirectory()}catch{return!1}}function Qm(e,n){return Ke.relative(e,n).split(Ke.sep).join("/")}function eh(e){let n=e.python??process.env.CUPEL_PYTHON??Xm,t=Hm(n,["-I","-S",...Bt("metadata.py"),e.projectRoot],{encoding:"utf8",maxBuffer:Jm,timeout:6e4}),o=i=>({entries:[],projectName:null,gaps:[{source:"metadata",declaration:"pyproject.toml / setup.cfg",detail:i}]});if(t.error!==void 0||t.status!==0)return o("the declared entry surface could not be read; it is unknown, not empty");let r;try{r=JSON.parse(t.stdout)}catch{return o("the declared entry surface came back unreadable; it is unknown, not empty")}if(typeof r!="object"||r===null)return{entries:[],projectName:null,gaps:[]};let s=r,a=(Array.isArray(s.entryPoints)?s.entryPoints:[]).filter(i=>typeof i=="object"&&i!==null&&typeof i.name=="string"&&typeof i.target=="string"&&typeof i.kind=="string"),l=(Array.isArray(s.gaps)?s.gaps:[]).flatMap(i=>{if(typeof i!="object"||i===null)return[];let d=i,u=typeof d.file=="string"?d.file:"",p=typeof d.why=="string"?d.why:"";return[{source:"metadata",declaration:u,detail:p==="executable-metadata-not-read"?"setup.py declares this project's entry points and is a PROGRAM: cupel never runs it, so the declared surface is INCOMPLETE":p}]});return{entries:a,gaps:l,projectName:typeof s.projectName=="string"?s.projectName:null}}function fs(e,n){let t=Bl.exec(n.trim());if(t===null)return{detail:`\`${n}\` is not a module:attr target`};let o=t[1]??"",r=Cn(e.paths,o);if(r.resolved===null)return{detail:`\`${o}\` ${r.failure??"did not resolve"}`};if(r.resolved.kind==="namespace"||r.resolved.kind==="stub-only")return{detail:`\`${o}\` resolved to a ${r.resolved.kind}, which runs no code`};let s=Qm(e.projectRoot,r.resolved.path);return s.startsWith("..")?{detail:`\`${o}\` resolves outside the project root; not seeded`}:{file:s}}function nh(e){let n=[];On(Ke.join(e,"__main__.py"))&&n.push("__main__.py");let t=(o,r)=>{let s;try{s=Gm(o).sort()}catch{return}for(let a of s){if(a.startsWith("."))continue;let l=Ke.join(o,a);Fl(l)&&On(Ke.join(l,"__init__.py"))&&On(Ke.join(l,"__main__.py"))&&n.push(`${r}${a}/__main__.py`)}};return t(e,""),Fl(Ke.join(e,"src"))&&t(Ke.join(e,"src"),"src/"),n}function th(e,n){let t=Ke.join(e,"Procfile");if(!On(t))return[];let o;try{if(Lo(t).size>n)return[];o=jl(t,"utf8")}catch{return[]}let r=[];for(let s of o.split(/\r?\n/u)){let a=Zm.exec(s);a?.[1]!==void 0&&r.push(a[1])}return r}var oh=256*1024,rh=/^\s*(?:CMD|ENTRYPOINT)\s+(.*)$/imu,sh=/^\s*WORKDIR\s+(\S+)\s*$/imu,ih=/^\s*COPY\s+(?:--\S+\s+)*(\S+)\s+(\S+)\s*$/imu,ah=/(?:^|[\s"',[])([A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_.]*)(?:[\s"',\]]|$)/u,lh=/(?:^|[\s"',[])((?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_-]+\.py)(?:[\s"',\]]|$)/u;function dh(e){let n=sh.exec(e)?.[1]?.replace(/\/+$/u,"")??null;if(n===null)return null;for(let t of e.split(/\r?\n/u)){let o=ih.exec(t),r=o?.[1],s=o?.[2]?.replace(/\/+$/u,"");if(r===void 0||s===void 0||s!==n)continue;let a=r.replace(/\/+$/u,"");return a==="."?null:a}return null}function ch(e,n){let t=[],o=s=>{let a=Ke.join(e,s);if(!On(a))return null;try{return Lo(a).size>n?null:jl(a,"utf8")}catch{return null}},r=o("Dockerfile");if(r!==null){let s=dh(r);for(let a of r.split(/\r?\n/u)){let l=rh.exec(a);l?.[1]!==void 0&&t.push({command:l[1],from:"Dockerfile",srcRoot:s})}}for(let s of["docker-compose.yml","docker-compose.yaml","compose.yml","compose.yaml"]){let a=o(s);if(a!==null)for(let l of a.split(/\r?\n/u)){let i=/^\s*(?:command|entrypoint):\s*(.+)$/u.exec(l);i?.[1]!==void 0&&t.push({command:i[1],from:s,srcRoot:null})}}return t}function uh(e,n,t){let o=e.projectRoot,r=lh.exec(n)?.[1];if(r!==void 0){for(let l of t===null?[r]:[Ke.join(t,r),r])if(On(Ke.join(o,l)))return{file:l}}let s=ah.exec(n)?.[1];if(s===void 0)return r===void 0?{detail:`no module:attr target or .py path in \`${n.trim()}\``}:{detail:`\`${r}\` is not a file in this repository`};let a=Bl.exec(s)?.[1]??"";for(let l of t===null?[""]:[t,""])for(let i of[`${a.replace(/\./gu,"/")}.py`,`${a.replace(/\./gu,"/")}/__init__.py`]){let d=l===""?i:Ke.join(l,i);if(On(Ke.join(o,d)))return{file:d}}return fs(e,s)}function ps(e){let n=[],t=[],o=new Set,r=(l,i,d)=>{let u=`${l} ${i}`;o.has(u)||(o.add(u),n.push({file:l,source:i,declaration:d}))},s=eh(e);t.push(...s.gaps);for(let l of s.entries){let i=l.kind==="entry-point-group"?"entry-point-group":"console-script",d=fs(e,l.target);"file"in d?r(d.file,i,`${l.name} = ${l.target}`):t.push({source:i,declaration:`${l.name} = ${l.target}`,detail:d.detail})}for(let l of nh(e.projectRoot))r(l,"dunder-main",l);On(Ke.join(e.projectRoot,"manage.py"))&&r("manage.py","manage-py","manage.py");let a=e.maxProcfileBytes??Ym;for(let l of th(e.projectRoot,a)){let i=fs(e,l);"file"in i?r(i.file,"launch-declaration",l):t.push({source:"launch-declaration",declaration:l,detail:i.detail})}for(let l of ch(e.projectRoot,oh)){let i=uh(e,l.command,l.srcRoot),d=`${l.from}: ${l.command.trim()}`;"file"in i?r(i.file,"launch-declaration",d):t.push({source:"launch-declaration",declaration:d,detail:i.detail})}return{entrypoints:n,gaps:t,projectName:s.projectName}}var yE=256*1024*1024;var Kl="CUPEL_PYTHON",ph=["-I","-S"],mh="python3",hh=256*1024*1024,gh=12e4,yh=512;function ke(e,n=yh){return typeof e=="string"&&e.length<=n?e:null}function Gn(e){return typeof e=="number"&&Number.isFinite(e)?e:0}function Ut(e){let n=Mn(e)?e:{};return{line:Gn(n.line),endLine:Gn(n.endLine),col:Gn(n.col),start:Gn(n.start),end:Gn(n.end)}}function Mn(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Vn(e){return Array.isArray(e)?e:[]}function ht(e){return Vn(e).map(n=>ke(n))}var xh=new Set(["import-module-literal","loader-escape","pkgutil-scan","runpy","entry-point-load","dispatch-escape","attr-rebind","sys-modules"]),bh=new Set(["unreadable","oversize","nul-byte","undecodable","parse-error","recursion","too-many-nodes"]);function Sh(e){let n=ke(e.path,4096);if(n===null)return null;let t=e.refused,o=typeof t=="string"&&bh.has(t)?t:null,r=ke(e.detail,200),s=Vn(e.imports).filter(Mn).map(f=>({form:f.form==="import"?"import":"from",module:ke(f.module),level:Gn(f.level),names:Vn(f.names).filter(Mn).map(m=>({name:ke(m.name)??"",asname:ke(m.asname)})).filter(m=>m.name!==""),star:f.star===!0,deferred:f.deferred===!0,enclosingFunction:ke(f.enclosingFunction),guards:ht(f.guards).filter(m=>m!==null),range:Ut(f.range)})),a=Vn(e.functions).filter(Mn).flatMap(f=>{let m=ke(f.name),g=ke(f.qualname);return m===null||g===null?[]:[{name:m,qualname:g,kind:f.kind==="async-function"?"async-function":"function",enclosingClass:ke(f.enclosingClass),enclosingFunction:ke(f.enclosingFunction),decorators:ht(f.decorators),range:Ut(f.range)}]}),l=Vn(e.classes).filter(Mn).flatMap(f=>{let m=ke(f.name),g=ke(f.qualname);return m===null||g===null?[]:[{name:m,qualname:g,bases:ht(f.bases),decorators:ht(f.decorators),range:Ut(f.range)}]}),i=Vn(e.calls).filter(Mn).map(f=>({callee:ke(f.callee),attr:ke(f.attr),receiver:ke(f.receiver),enclosingFunction:ke(f.enclosingFunction),argCount:Gn(f.argCount),range:Ut(f.range)})),d=Vn(e.escapes).filter(Mn).flatMap(f=>{let m=f.kind,g=ke(f.callee);return typeof m!="string"||!xh.has(m)||g===null?[]:[{kind:m,callee:g,target:ke(f.target),attr:ke(f.attr),enclosingFunction:ke(f.enclosingFunction),range:Ut(f.range)}]}),u=e.all,p=Array.isArray(u)?ht(u).filter(f=>f!==null):null;return{path:n,refused:o,...r!==null?{detail:r}:{},imports:s,functions:a,classes:l,calls:i,escapes:d,all:p,allComputed:e.allComputed===!0,truncated:ht(e.truncated).filter(f=>f!==null)}}function Do(e,n={}){let t=n.env??process.env,o=n.python??t[Kl]??mh,r=[],s=e.filter(m=>!m.includes(`
+`));s.length!==e.length&&r.push(`${String(e.length-s.length)} path(s) carried a newline and were not extracted`);let a=[...ph,...Bt("extract.py")];n.maxBytesPerFile!==void 0&&a.push("--max-bytes",String(n.maxBytesPerFile));let l=fh(o,a,{input:s.length>0?`${s.join(`
 `)}
-`:"",encoding:"utf8",maxBuffer:Zm,timeout:n.timeoutMs??Qm,env:t});if(l.error!==void 0){let m=l.error.code,g=m==="ENOENT";return{refused:g?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],diagnostics:[...r,g?`no Python interpreter: \`${o}\` is not on PATH (set ${Ol} to the interpreter this project runs under)`:`the Python extract could not run (${m??l.error.message})`]}}if(l.status!==0){let m=(l.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],diagnostics:[...r,`the Python extract exited ${String(l.status??"on a signal")}${m!==""?`: ${m}`:""}`]}}let i=(l.stdout??"").split(`
-`).filter(m=>m.trim()!==""),d=null,u=[],p=[];for(let m of i){let g;try{g=JSON.parse(m)}catch{r.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!On(g))continue;if(g.kind==="header"){d=be(g.interpreter,64);let b=g.stdlib;Array.isArray(b)&&(u=b.filter(x=>typeof x=="string"&&x.length<=128));continue}let y=rh(g);if(y===null){r.push("the Python extract emitted a file row without a path; it was skipped");continue}p.push(y)}if(d===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],diagnostics:[...r,"the Python extract did not report an interpreter version"]};let f=s.length-p.length;return f>0&&r.push(`${String(f)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:d,files:p,stdlib:u,diagnostics:r}}var ih="python3",ah={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function lh(e,n,t=o=>Oo([],{python:o}).refused===null){let o=qn.resolve(e,n.envRel);for(let r of["bin/python3","bin/python","Scripts/python.exe"]){let s=qn.join(o,r);try{if(!sh(s).isFile())continue}catch{continue}if(t(s))return s}return ih}function dh(e,n){let t=[e];for(let o of n.sitePackages)t.push(qn.resolve(e,o));for(let o of n.pthFiles)for(let r of o.paths)t.push(qn.isAbsolute(r)?r:qn.resolve(e,o.sitePackages,r));return{roots:[...new Set(t)]}}function ch(e){let n=[];for(let t of e.distInfos){let o=Ot(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});o!==null&&n.push(o)}return n}function uh(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function fh(e,n,t={}){let r=(t.readEnvironment??Tt)(n),s=ch(r),a=Ur(s),l=r.diagnostics.map(x=>x),i=t.python??lh(n,r),d=dh(n,r),u=gh(r,a,d),p=new Map;for(let x of s)p.set(x.name,mh(x,u.distributions));for(let x of u.seen)l.push(`startup hook: ${x}`);for(let x of u.unattributed)l.push(`startup escape: ${x} \u2014 a module runs at interpreter start that no installed distribution claims`);let f=ss({projectRoot:n,paths:d,python:i});for(let x of f.gaps)l.push(`entrypoint \`${x.declaration}\` (${x.source}): ${x.detail}`);if(f.entrypoints.length===0)return l.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,graph:Kt,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:f.gaps,interpreter:null,diagnostics:l,execution:p};let m=os({projectRoot:n,paths:d,entryFiles:f.entrypoints.map(x=>qn.join(n,x.file)),environmentComplete:!r.truncated&&r.refused===null,externalRoots:r.sitePackages.map(x=>qn.resolve(n,x)),distributionOf:uh(a),python:i,...t.maxModules!==void 0?{maxModules:t.maxModules}:{}});for(let x of m.diagnostics)l.push(`${x.code} at ${x.where}: ${x.detail}`);if(m.graph.modules.length===0)return{rootRel:e,graph:Kt,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:f.entrypoints,entrypointGaps:f.gaps,interpreter:m.interpreter,diagnostics:l,execution:p};let g=new Map;for(let x of m.graph.modules)g.set(x.id,x.id),g.set(x.path,x.id);let y=m.graph.modules[0]?.id,b=m.diagnostics.map(x=>({source:g.get(x.where)??y,cause:ah[x.code],reach:{kind:"unbounded"}}));return u.unattributed.length>0&&b.push({source:y,cause:"dynamic-load",reach:{kind:"unbounded"}}),{rootRel:e,graph:m.graph,incompleteness:b,analysisAborted:null,entrypoints:f.entrypoints,entrypointGaps:f.gaps,interpreter:m.interpreter,diagnostics:l,execution:p}}var Kt={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function ph(e){if(e.length===0)return null;let n=[],t=new Map;for(let x of e){let I=x.rootRel===""?".":x.rootRel;for(let w of x.diagnostics)n.push(`${I}: ${w}`);for(let[w,A]of x.execution){let k=t.get(w);t.set(w,k===void 0?A:[...new Set([...k,...A])])}}let o=e.filter(x=>x.analysisAborted===null);if(o.length===0)return{graph:Kt,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let r=[],s=[],a=[],l=[],i=[],d=[],u=[],p=[],f=[],m=[],g=[],y=new Set;for(let x of o){let I=x.rootRel===""?"":`${x.rootRel}::`,w=new Set(x.graph.modules.filter(v=>v.externalSurface===!0).map(v=>v.id)),A=v=>w.has(v)?v:`${I}${v}`,k=v=>`${I}${v}`,h=v=>`${I}${v}`,S=v=>`${I}${v}`,_=v=>`${I}${v}`,P=v=>`${I}${v}`;for(let v of x.graph.modules){if(v.externalSurface===!0){if(y.has(v.id))continue;y.add(v.id),r.push(v);continue}r.push({...v,id:A(v.id)})}for(let v of x.graph.imports)s.push({...v,id:k(v.id),moduleId:A(v.moduleId),...v.resolvedModuleId!==void 0?{resolvedModuleId:A(v.resolvedModuleId)}:{}});for(let v of x.graph.importEdges)a.push({importId:k(v.importId),resolvedModuleId:A(v.resolvedModuleId)});for(let v of x.incompleteness)g.push({...v,source:A(v.source)});for(let v of x.graph.functions)l.push({...v,id:h(v.id),moduleId:A(v.moduleId),...v.enclosingClassId!==void 0?{enclosingClassId:S(v.enclosingClassId)}:{}});for(let v of x.graph.classes)i.push({...v,id:S(v.id),moduleId:A(v.moduleId),members:v.members.map(h)});for(let v of x.graph.exports)d.push({...v,id:P(v.id),moduleId:A(v.moduleId)});for(let v of x.graph.exportBindings)u.push({exportId:P(v.exportId),target:v.target.kind==="function"?{kind:"function",functionId:h(v.target.functionId)}:{kind:"module",moduleId:A(v.target.moduleId)}});for(let v of x.graph.callSites)p.push({...v,id:_(v.id),enclosingFunctionId:h(v.enclosingFunctionId),resolvedTargetIds:v.resolvedTargetIds.map(h)});for(let v of x.graph.callEdges)f.push({...v,callSiteId:_(v.callSiteId),calleeFunctionId:h(v.calleeFunctionId)});for(let v of x.graph.inheritEdges)m.push({...v,subclassId:S(v.subclassId),superclassId:S(v.superclassId)})}let b=r[0]?.id;for(let x of e)x.analysisAborted===null||b===void 0||g.push({source:b,cause:x.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:r,imports:s,importEdges:a,functions:l,classes:i,exports:d,exportBindings:u,callSites:p,callEdges:f,inheritEdges:m},incompleteness:g,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function Cl(e,n={}){let t=e.filter(o=>Mt(o));return t.length===0?null:ph(t.map(o=>fh(o.rel,o.abs,n)))}function mh(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var hh=["sitecustomize","usercustomize"];function gh(e,n,t){let o=new Set,r=[],s=[];for(let a of e.pthFiles){for(let i of a.importModules){let d=No(n,i);for(let p of d)o.add(p.name);let u=$n(t,i);if(u.resolved!==null){s.push(`${a.sitePackages}/${a.name}: \`import ${i}\` runs ${u.resolved.path}`);continue}d.length===0&&r.push(`${a.sitePackages}/${a.name}: \`import ${i}\``)}let l=a.importModules.length;a.importLines>l&&r.push(`${a.sitePackages}/${a.name}: ${String(a.importLines-l)} import line(s) whose module could not be read`)}for(let a of hh){let l=$n(t,a);if(l.resolved===null)continue;let i=No(n,a);for(let d of i)o.add(d.name);i.length===0?r.push(`${l.resolved.path}: \`import ${a}\` runs at every interpreter start`):s.push(`${a}: \`import ${a}\` runs ${l.resolved.path}`)}return{distributions:o,unattributed:r,seen:s}}import{readdirSync as yh,readFileSync as xh}from"node:fs";import Sh from"node:path";var bh=new Set(["summarized","crashed","over-cap"]),kh=new Set(["function","method","ctor"]);function ke(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function is(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Eh(e,n){is(e)||ke(n,"edge is not an object");let{entryPath:t,entryExport:o,entryContainer:r,hops:s}=e;(typeof t!="string"||typeof o!="string")&&ke(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&ke(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&ke(n,"hops must be a non-negative integer");let a=e.target;if(is(a)||ke(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:i,symbolKind:d}=a;return typeof l!="string"&&ke(n,"symbol target exportName"),i!==null&&typeof i!="string"&&ke(n,"symbol target container"),(typeof d!="string"||!kh.has(d))&&ke(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:o,entryContainer:r,target:{kind:"symbol",exportName:l,container:i,symbolKind:d},hops:s}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:i,calleeExport:d}=a;return(typeof l!="string"||l.length===0)&&ke(n,"dep target calleePackage"),i!==null&&typeof i!="string"&&ke(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&ke(n,"dep target calleeExport"),{entryPath:t,entryExport:o,entryContainer:r,target:{kind:"dep",calleePackage:l,calleeSubpath:i,calleeExport:d},hops:s}}ke(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function wh(e,n){is(e)||ke(n,"root is not an object");let{packageName:t,analyzedVersion:o,tool:r,toolVersion:s,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&ke(n,"packageName"),typeof o!="string"&&ke(n,"analyzedVersion"),r!=="jelly"&&ke(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof s!="string"&&ke(n,"toolVersion"),typeof a!="number"&&ke(n,"maxIndirections"),(typeof l!="string"||!bh.has(l))&&ke(n,`status ${JSON.stringify(l)} not in the enum`);let i=e.edges;return Array.isArray(i)||ke(n,"edges is not an array"),l!=="summarized"&&i.length>0&&ke(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:o,tool:r,toolVersion:s,maxIndirections:a,status:l,edges:i.map(d=>Eh(d,n))}}function Ml(e){let n=new Map,t=yh(e).filter(o=>o.endsWith(".summary.json"));for(let o of t){let r=Sh.join(e,o),s;try{s=JSON.parse(xh(r,"utf8"))}catch(i){ke(o,`unparseable JSON: ${i instanceof Error?i.message:String(i)}`)}let a=wh(s,o),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{isBuiltin as Tl}from"node:module";function W(e){let n="";for(let t of e){let o=t.charCodeAt(0),r=o<32||o>=127&&o<=159;n+=r?"\\x"+o.toString(16).padStart(2,"0"):t}return n}var Dl=1024,Ll=4096,Co=8,Fl=512,jl=512,as=8,vh=160,Ih=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),ls=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),Ah=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,_h=/\.[cm]?[jt]sx?$/u;function Bl(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let o=e.lastIndexOf("node_modules/");if(o!==-1){let r=e.slice(o+13).split("/"),s=r[0]??"";return s.startsWith("@")?r[1]===void 0?null:`${s}/${r[1]}`:s===""?null:s}return Ah.test(e)&&!_h.test(e)?e:null}function Nh(e){return W(`${e.code} ${e.path}: ${e.detail}`.slice(0,vh))}function Kl(e){let{graph:n,facts:t,diagnostics:o}=e,r=new Map(n.modules.map($=>[$.id,$])),s=new Map(n.modules.map($=>[$.path,$])),a=ln(n),l=new Set;for(let $ of a){let Z=r.get($);Z!==void 0&&l.add(Z.packageName)}let i=new Map,d=0,u=!1,p=!1,f=$=>$.startsWith(`${e.appRootReal}/`)?$.slice(e.appRootReal.length+1):$;for(let $ of o){if($.code==="limit-exceeded"&&$.path===e.appRootReal){u=!0;continue}let Z=Bl(f($.path),s);if(Z===null){$.code==="out-of-root"&&d++,ls.has($.code)&&(p=!0);continue}let Q=s.get(f($.path));Q!==void 0&&ls.has($.code)&&!Q.path.includes("node_modules/")&&(p=!0);let ce=i.get(Z);ce===void 0?i.set(Z,[$]):ce.push($)}let m=new Map(n.imports.map($=>[$.id,$])),g=new Set;for(let $ of n.importEdges){let Z=m.get($.importId);Z!==void 0&&r.get(Z.moduleId)?.externalSurface===!0&&g.add(Z.moduleId)}let y=[],b=new Set,x=n.modules.filter($=>$.externalSurface===!0);for(let $ of x){let Z=i.get($.packageName)??[],Q=g.has($.id),ce=[],Mn=se=>se.code==="dependency-body"&&se.anchor===void 0&&/syntax/u.test(se.detail),Yn=se=>se.code==="loader-escape"||se.code==="dependency-body"&&se.anchor===void 0&&!/syntax/u.test(se.detail),R=Z.filter(se=>Ih.has(se.code)),M=Z.filter(Yn),B=Z.filter(se=>ls.has(se.code)||Mn(se)),q=Z.filter(se=>se.code==="out-of-root"),le=Q&&R.length===0,ge=M.length===0,Te=!u&&B.length===0,Ze=d===0&&q.length===0;Q||ce.push("(a) the package's entry was never followed to a module");for(let se of[...R,...M,...B,...q]){if(ce.length>=as)break;ce.push(Nh(se))}u&&ce.length<as&&ce.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&ce.length<as&&ce.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let L=["a","b","c","d"].filter(se=>!{a:le,b:ge,c:Te,d:Ze}[se]),oe=L.length===0;oe&&b.add($.id),y.push({packageName:W($.packageName),module:W(String($.id)),inReach:a.has($.id),builtin:Tl($.packageName),followed:Q,d1:{a:le,b:ge,c:Te,d:Ze},failing:L,transparent:oe,evidence:ce})}let I=new Set;for(let $ of t)$.reach.kind==="unbounded"&&I.add($.source);let w=$=>({module:W(String($.module)),kind:$.kind,packageName:r.get($.module)?.packageName??null}),A=new Set(x.filter($=>Tl($.packageName)).map($=>$.id)),k=new Set([...b,...A]),h=[],S=new Map,_=0,P=0,v=0,T=0,N=[],j=new Set;for(let $ of t)$.reach.kind==="unbounded"&&j.add($.cause);for(let $ of t){if($.reach.kind==="class-scope"){N.push({packageName:$.reach.packageName,container:$.reach.container});continue}if($.reach.kind==="unbounded")continue;T++;let Z=$.reach.anchor,Q=S.get(String(Z));Q===void 0&&(Q={today:yt(n,Z,I),d1:yt(n,Z,I,b),d1Builtins:yt(n,Z,I,k)},S.set(String(Z),Q)),Q.d1Builtins.length>0&&v++,Q.today.length>0&&(_++,j.add($.cause)),Q.d1.length>0&&P++,h.length<Ll&&h.push({anchor:W(String(Z)),packageName:W(r.get(Z)?.packageName??""),cause:$.cause,reachKind:$.reach.kind,blockersToday:Q.today.slice(0,Co).map(w),blockersUnderD1:Q.d1.slice(0,Co).map(w),blockedUnderD1Builtins:Q.d1Builtins.length>0,moreToday:Math.max(0,Q.today.length-Co),moreUnderD1:Math.max(0,Q.d1.length-Co)})}let O=o.filter($=>$.anchor===void 0&&$.classScope===void 0),F=new Map(e.loadSites.map($=>[$.importId,$])),K=new Map;for(let $ of e.loadSites){let Z=K.get($.path);Z===void 0?K.set($.path,[$.shape]):Z.push($.shape)}let te=$=>{if($.code!=="loader-escape")return!1;let Z=$.escapes??[];if(Z.length===0||Z.some(ce=>ce!=="non-literal-load"))return!1;let Q=K.get($.path)??[];return Q.length>0&&Q.every(ce=>ce==="relative-bounded")},U=O.slice(0,jl).map($=>({cause:e.causeOf($.code),code:$.code,path:W(f($.path)),attributedPackage:Bl(f($.path),s),...$.escapes!==void 0?{escapes:[...$.escapes]}:{},...$.reason!==void 0?{reason:$.reason}:{},d2Dischargeable:te($)})),X={};for(let $ of O){if($.code!=="unresolved-specifier")continue;let Z=$.reason??"(none)";X[Z]=(X[Z]??0)+1}let D=I.size===0?0:t.filter($=>$.reach.kind==="unbounded").length,C=Math.max(0,D-O.length),H=D-O.filter(te).length,J=[],G=0,Y=0,re=0;for(let $ of n.imports){if($.specifierIsLiteral)continue;re++;let Z=a.has($.moduleId),Q=F.get(String($.id)),ce=Q?.shape??"unrecorded";Z&&(G++,ce==="relative-bounded"&&Y++),J.length<Fl&&J.push({importId:W(String($.id)),path:W(r.get($.moduleId)?.path??""),shape:ce,text:W(Q?.text??""),inReach:Z})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:u,appCapHit:p,unattributedOutOfRoot:d,blindUnbounded:C,unbounded:U,anchors:h,surfaces:y.slice(0,Dl),loads:J,counts:{modules:n.modules.length,reachMods:a.size,surfaces:x.length,surfacesInReach:y.filter($=>$.inReach).length,transparentSurfaces:b.size,builtinSurfaces:A.size,anchors:T,anchorsBlockedToday:_,anchorsBlockedUnderD1:P,anchorsBlockedUnderD1Builtins:v,unbounded:D,loadsInReach:G,loadsRelativeBounded:Y,unresolvedByReason:X,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,y.length-Dl),anchors:Math.max(0,T-Ll),loads:Math.max(0,re-Fl),unbounded:Math.max(0,O.length-jl)}},reachedPackages:l,aborted:e.analysisAborted,unboundedFacts:D,unboundedHard:H,anchorsBlockedToday:_,anchorsBlockedUnderD1:P,anchorsBlockedUnderD1Builtins:v,loadsInReach:G,loadsAllBounded:G>0&&Y===G,d2Eligible:e.rootBudget==="complete"&&!p&&!u,classScope:N,taintCausesToday:j}}var Rh=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),Ph=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Ul(e,n,t,o,r){if(t===null||e.reachedPackages.has(t.packageName))return;let s=e.classScope.some(_=>_.packageName===t.packageName&&_.container===t.container),a=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||s,l=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||l||n.unknownKind!==void 0&&Rh.has(n.unknownKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":a?"taint":o>0?"oog":"unexpected",u=new Set(e.taintCausesToday);s&&u.add("dep-opaque");let p=e.aborted!==null?e.aborted:Ph.find(_=>u.has(_)),f=d==="pre-2b"?n.tier==="unknown"&&(l?n.unknownKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?n.tier==="unknown"&&n.unknownKind==="dynamic-load":d==="taint"?n.tier==="unknown"&&n.unknownKind===p:d==="oog"?n.tier==="unknown"&&n.unknownKind==="analysis-cap":!1,m=t.verified&&r===!0,g=e.aborted===null&&e.unboundedFacts===0&&!s&&o===0,y=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,b=m&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,x=m&&d==="load"&&g&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,I=m&&(d==="load"||d==="taint")&&g&&y&&e.anchorsBlockedUnderD1===0,w=e.aborted===null&&e.unboundedHard===0&&!s&&o===0,A=m&&d==="load"&&w&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,k=m&&(d==="load"||d==="taint")&&w&&y&&e.anchorsBlockedUnderD1===0,h=m&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,S=m&&(d==="load"||d==="taint")&&w&&y&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:f,verified:t.verified,surfaceComplete:r,oog:o,classScoped:s,predicted:{d1:b,d2:x,d1d2:I,d2Amended:A,d1d2Amended:k,d1Builtins:h,d1d2AmendedBuiltins:S}}}import{readFileSync as $h,statSync as Oh}from"node:fs";var cs=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,Mo=/^[A-Za-z0-9_$.-]{1,128}$/u,zl=64,Wl=1024*1024,Vl=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,ql=/^[A-Za-z0-9@_.-]{1,128}$/u;function ve(e){throw new Error(`model claims rejected: ${e}`)}function ds(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Ch(e,n){ds(e)||ve(`${n}: edge is not an object`);let{kind:t,anchorExport:o,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&ve(`${n}: edge kind`),(typeof o!="string"||!Mo.test(o))&&ve(`${n}: anchorExport ${JSON.stringify(o)}`),r!==null&&(typeof r!="string"||!Mo.test(r))&&ve(`${n}: anchorContainer`),(typeof s!="string"||!cs.test(s))&&ve(`${n}: calleePackage ${JSON.stringify(s)}`),a!==null&&(typeof a!="string"||!Mo.test(a))&&ve(`${n}: calleeContainer`),(typeof l!="string"||!Mo.test(l))&&ve(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:o,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}}function Gl(e){let n=Oh(e).size;n>Wl&&ve(`file is ${String(n)} bytes, over the ${String(Wl)} cap`);let t;try{t=JSON.parse($h(e,"utf8"))}catch(r){ve(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||ve("root is not an array"),t.length>zl&&ve(`${String(t.length)} claims over cap ${String(zl)}`);let o=[];for(let r of t){ds(r)||ve("claim is not an object");let{packageName:s,modelId:a,range:l,edges:i}=r;(typeof s!="string"||!cs.test(s))&&ve("packageName"),(typeof a!="string"||!ql.test(a))&&ve("modelId (identifier charset, 1-128 chars)"),o.some(u=>u.model.modelId===a)&&ve(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!ds(l)||typeof l.introduced!="string")&&ve(`${a}: range`),Vl.test(l.introduced)||ve(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let d=l.fixedBefore;d!==null&&typeof d!="string"&&ve(`${a}: fixedBefore`),typeof d=="string"&&!Vl.test(d)&&ve(`${a}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(i)||ve(`${a}: edges`),i.length>64&&ve(`${a}: ${String(i.length)} edges over cap ${String(64)}`),o.push({model:{packageName:s,modelId:a,edges:i.map(u=>Ch(u,a))},introduced:l.introduced,fixedBefore:d})}return o}var Mh=["in-app-purchase@1-v1"];function us(e,n,t){let o=[],r=[],s=[],a=(l,i,d,u)=>{r.push(d),s.push({modelId:u??l.model.modelId,status:i,reason:d,edgeCount:l.model.edges.length})};for(let l of e){if(!cs.test(l.model.packageName)||!ql.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Mh.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let i=n(l.model.packageName);if(typeof i!="string"&&i!==void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} installed at more than one version (${i.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(i===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let d;try{d=Ln(i,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${i} not an exact triple \u2014 inert (never guessed)`);continue}if(!d){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${i} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}o.push(l.model),s.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:o,notes:r,dispositions:s}}var Dh=4,Lh={additiveForms:!0,namelessExports:!0},Fh=new Set(["dep-opaque","dynamic-load","dispatch"]),jh={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function ms(e,n,t){return e.tier==="unknown"&&jh[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&Fh.has(e.unknownKind)&&n!==null&&n.verified}var Bh=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),an=class extends Error{},hs="cupel/coverage-gap",nd={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function zt(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function Zl(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function Ql(e,n,t){let o=new Map(e.modules.map(a=>[a.path,a.id])),r=e.modules[0]?.id;if(r===void 0)return[];let s=n.map(a=>({source:o.get(a.path)??r,cause:nd[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));for(let a of t)s.push({source:r,reach:{kind:"unbounded"},cause:a});return s}function fs(e,n,t,o,r){let s=t.filter(a=>a.exportName!==null&&(o===1||r||a.verified!==1));return s.length>0?s.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function Kh(e,n){let t;try{t=Wt(e)}catch{return!0}let o=3,r=(s,a)=>{if(a>o)return!1;let l;try{l=ed(s)}catch{return!1}for(let i of l){if(i==="node_modules"||i.startsWith("."))continue;let d=mn.join(s,i),u;try{u=ps(d)}catch{continue}if(!u.isDirectory())continue;let p=mn.relative(t,d).split(mn.sep).join("/");try{if(ps(mn.join(d,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(r(d,a+1))return!0}return!1};return r(t,1)}function Uh(e,n){let t="";for(let o of e)o.rel!==""&&n.startsWith(`${o.rel}/`)&&o.rel.length>t.length&&(t=o.rel);return t}function zh(e,n,t){let o=[];if(t&&o.push("nested-app-root"),n==="")return[...o,"manifest-unreadable"];let r;try{if(r=Wt(mn.resolve(e,n)),!r.startsWith(Wt(e)+mn.sep))return[...o,"manifest-unreadable"]}catch{return[...o,"manifest-unreadable"]}let s;try{let u=mn.join(r,"package.json");if(!ps(u).isFile())return[...o,"manifest-unreadable"];s=Th(u,"utf8")}catch{return[...o,"manifest-unreadable"]}let a;try{a=JSON.parse(s)}catch{return[...o,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...o,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&o.push("bin");let i=["preinstall","install","postinstall","prepare","prepublish"],d=l.scripts;if(typeof d=="object"&&d!==null){let u=d;i.some(p=>typeof u[p]=="string")&&o.push("install-script")}return(l.gypfile===!0||Wh(r))&&o.push("native-artifact"),o}function Wh(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=mn.join(e,n),o;try{o=ed(t)}catch{continue}if(o.some(r=>r.endsWith(".node")))return!0}return!1}function Vh(e,n){let t=new Set(["npm",...n.ecosystems?.()??[]]),o=[];for(let r of e.perRoot){let s=new Map;for(let a of r.packages){let l=a.ecosystem??"npm";t.has(l)||s.set(l,(s.get(l)??0)+1)}for(let[a,l]of[...s.entries()].sort())o.push({kind:"ecosystem-uncovered",detail:`${r.rootRel===""?"":`${r.rootRel}: `}${String(l)} ${a} distribution(s) were enumerated but the loaded shard carries no ${a} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${a} shard to assess them (ADR-109 D5).`,blindsAnalysis:!1,rootRel:r.rootRel})}return o}function td(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function qh(e,n,t){return new Map(n.map(o=>[td(o),zh(e,o.lockKey,t)]))}function Gh(e){let n=new Map;for(let t of e){let o=n.get(t.advisory.id);o===void 0?n.set(t.advisory.id,[t]):o.push(t)}return n}function Hh(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(r=>r.packageName===t.name)?e:{...e,tier:"unknown",reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,unknownKind:"symbol-unsupported",basis:void 0,path:void 0}}function Xh(e,n,t,o,r,s,a){let{finding:l}=Ut(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:a(t)},zt(o.advisory.id,t.name,o.affected),null,r,s);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function Ut(e,n,t,o,r,s,a){let l=Jo({graph:e,installed:t,range:o,symbol:r,coverage:null,incompleteness:s,analysisAborted:a});if(n!==null&&r!==null&&ms(l,r,"base")){let i=xt(e,n.modulesById,n.reachMods,r,n.records);if(i!==null)return{finding:l,hit:i}}return{finding:l,hit:null}}function Yh(e,n){let t=new Set,o=[];for(let r of e.packages)if((r.ecosystem??"npm")==="npm")for(let{advisory:s,affected:a}of n.advisoriesForPackage(r.ecosystem??"npm",r.name)){let l=zt(s.id,r.name,a),i;try{i=Ln(r.version,l)}catch{continue}if(i)for(let d of n.symbolsForAffected(a.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let u=`${r.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(u)||(t.add(u),o.push({packageName:r.name,packageRootRel:r.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return o.sort((r,s)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),o.slice(0,yo)}function Jh(e,n,t){let o=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let i=s.get(l.callSiteId);if(i===void 0)continue;let d=o.get(i.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=o.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:d.id})}return a}function Zh(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),o=new Map(e.functions.map(u=>[u.id,u])),r=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&r.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let p=s.get(u.exportId);if(p===void 0||!n.has(p.moduleId))continue;let f=o.get(u.target.functionId);f===void 0||t.get(f.moduleId)?.externalSurface===!0||r.add(f.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let p=a.get(u.callSiteId);if(p===void 0)continue;let f=l.get(p);f===void 0?l.set(p,[u.calleeFunctionId]):f.push(u.calleeFunctionId)}let i=new Set(r),d=[...r];for(;d.length>0;){let u=d.pop();if(u!==void 0)for(let p of l.get(u)??[])i.has(p)||(i.add(p),d.push(p))}return i}function Qh(e,n,t,o){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let s=t.filter(l=>l.packageName===r.anchor.packageName&&l.exportName===r.anchor.exportName&&l.container===r.anchor.container),a=s.find(l=>l.resolution==="resolved")??s[0];if(a!==void 0)return o.has(a.callerFunctionId)}return null}function eg(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let o=new Set(t),r=s=>o.has(s)||o.has(Ve[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&r(s.unknownKind)||s.modelPromotedFromKind!==void 0&&r(s.modelPromotedFromKind))}function gs(e){let n=Wt(e.dir),t=e.reader??(e.shardPathPypi!==void 0?er([St(e.shardPath),St(e.shardPathPypi)]):St(e.shardPath)),o=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(Fn))throw new an(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${Fn})`);let r=null;if(e.summaryShadow!==void 0)try{r=Ml(e.summaryShadow)}catch(L){throw new an(`--summary-shadow facts dir rejected: ${L instanceof Error?L.message:String(L)}`)}let s=null;if(e.modelShadow!==void 0)try{s=Gl(e.modelShadow.claimsPath)}catch(L){throw new an(`--model-shadow claims rejected: ${L instanceof Error?L.message:String(L)}`)}let a=Wr(n,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{}}),l=fl(n,a,e.installedSet);if(l.truncated){let L=l.perRoot.filter(oe=>oe.truncated).map(oe=>oe.rootRel===""?"the scan root":`\`${oe.rootRel}\``);throw new an(`the dependency enumeration hit a hard cap and is incomplete at ${L.length>0?L.join(", "):"the union across roots"} (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let i=Cl(a.roots),d=i?.execution??null,u=ml(l.packages.filter(L=>(L.ecosystem??"npm")==="npm")),p=e.entry??[],f=p.length>0?Ia(n,p):{entrypoints:[],rejected:[]},m=f.rejected,g=va(n,a.roots),y=[...new Set([...g.entrypoints,...f.entrypoints])],b=[...g.sources];for(let L of f.entrypoints)g.entrypoints.includes(L)||b.push({source:"--entry",specifier:L,entrypoint:L,launch:!1,root:Uh(a.roots,L)});let x=[...b];for(let L of i?.roots??[])for(let oe of L.entrypoints)b.push({source:`python:${oe.source}`,specifier:oe.declaration,entrypoint:L.rootRel===""?oe.file:`${L.rootRel}/${oe.file}`,launch:oe.source==="console-script"||oe.source==="launch-declaration",root:L.rootRel});let I=Yh(l,t),w=e.bindingForms??Lh,A=e.callablePackageResolver===!0,k=e.tsconfigPaths!==!1,h=Kh(n,Lt(b)),S=qh(n,l.packages,h),_=L=>(L.ecosystem??"npm")!=="npm"?d?.get(L.name)??["manifest-unreadable"]:S.get(td(L))??["manifest-unreadable"],P=Tr({appRoot:n,entrypoints:y,depClassAnchors:I,bindingForms:w,callablePackageResolver:A,tsconfigPaths:k}),v=P.graph,T=Yo(v),N=[...g.diagnostics,...Dr(g),...Lr(g,y.length),...Yr(a,x),...P.diagnostics],j=Zl(y.length,v),O=L=>l.packages.some(oe=>(oe.ecosystem??"npm")===L),F=i===null?"no-entrypoint":i.analysisAborted,K=(O("npm")?j:null)??(O("PyPI")?F:null)??(O("npm")||O("PyPI")?null:j),te=[...l.gaps,...hl(a),...Vh(l,t)],U=gl(te),X=Ql(v,N,U),D={graph:Kt,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},C=L=>(L.ecosystem??"npm")==="npm"?{graph:v,incompleteness:X,analysisAborted:j,symbolsDecidable:!0}:i===null?D:{...i,symbolsDecidable:!0},H=n;try{H=Wt(n)}catch{}let J=Kl({graph:v,facts:X,diagnostics:N,analysisAborted:j,loadSites:P.loadSites,conditionUnions:P.conditionUnions,provenAbsent:P.provenAbsent,appRootReal:H,rootBudget:a.budget,causeOf:L=>nd[L]}),G=t.allModels?.()??[],Y=us(G.map(L=>({model:{packageName:L.packageName,modelId:L.modelId,edges:L.edges},introduced:L.introduced,fixedBefore:L.fixedBefore})),u),re=Y.models.length>0?_t(v,Y.models).delta:null,ne=re!==null?{records:re.records,reachMods:ln(v),modulesById:new Map(v.modules.map(L=>[L.id,L]))}:null,$=[],Z=new Map,Q=Bh(),ce=[],Mn=[];for(let L of l.packages){let oe=C(L),se=(L.ecosystem??"npm")==="npm"?ne:null;for(let[,Ie]of Gh(t.advisoriesForPackage(L.ecosystem??"npm",L.name))){let Ne=Ie[0];if(Ne!==void 0){let xe=Z.get(Ne.advisory.id),en=Ie.map(De=>De.affected);xe===void 0?Z.set(Ne.advisory.id,{advisory:Ne.advisory,ranges:en}):xe.ranges.push(...en)}let pe=Ie.filter(xe=>Xh(oe.graph,se,L,xe,oe.incompleteness,oe.analysisAborted,_)),Qe=pe.length>0?pe:Ie.slice(0,1),hn=pe.length===0;for(let{advisory:xe,affected:en}of Qe){let De=zt(xe.id,L.name,en),gn=xe.cveId??xe.id,Tn=hn?[]:t.symbolsForAffected(en.id),mt=Tn.filter(ye=>ye.exportName===null),yn=fs(xe.id,L.name,Tn,en.surfaceComplete,o),xn=Ut(oe.graph,se,{name:L.name,version:L.version,...L.ecosystem!==void 0?{ecosystem:L.ecosystem}:{},devOnly:L.dev,outOfGraphExecution:_(L)},De,null,oe.incompleteness,oe.analysisAborted).finding;if(xn.decidedAtStage==="presence"||xn.decidedAtStage==="version-match"){Q[xn.tier]+=1,$.push({...xn,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:De.surfaceComplete,advisoryId:xe.id,displayId:gn,packageName:L.name,version:L.version,ecosystem:L.ecosystem??"npm",symbolName:null,symbolPath:null,severity:xe.severity,packageLocation:Ro(l,L)});continue}for(let ye of yn){let{finding:nn,hit:We}=Ut(oe.graph,se,{name:L.name,version:L.version,...L.ecosystem!==void 0?{ecosystem:L.ecosystem}:{},devOnly:L.dev,outOfGraphExecution:_(L)},De,ye,oe.incompleteness,oe.analysisAborted),z=Hh(nn,oe,L),ee,de;We!==null&&ye!==null&&(ee=We.modelId,de=nn.unknownKind,z={basis:void 0,tier:We.tier,decidedAtStage:nn.decidedAtStage,reason:`boundary model ${We.modelId}: ${We.anchorPackage}.${We.entryExport} reaches ${ye.exportName} [${We.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:no(ye),path:void 0,unresolvedSites:nn.unresolvedSites,unresolvedEvidence:nn.unresolvedEvidence}),Q[z.tier]+=1;let Re=Ul(J,z,ye,_(L).length,De.surfaceComplete),fe={...z,...Re!==void 0?{adr105:Re}:{},modelId:ee,modelPromotedFromKind:de,surfaceComplete:De.surfaceComplete,advisoryId:xe.id,displayId:gn,packageName:L.name,version:L.version,ecosystem:L.ecosystem??"npm",symbolName:ye?.exportName??null,symbolPath:ye?.sourcePath||null,severity:xe.severity,packageLocation:Ro(l,L)};$.push(fe);let ue=new Set(["dep-opaque","dynamic-load","dispatch"]);r!==null&&fe.tier==="unknown"&&fe.decidedAtStage==="symbol-reachable"&&fe.unknownKind!==void 0&&ue.has(fe.unknownKind)&&ye!==null&&ce.push({finding:fe,symbol:ye}),s!==null&&fe.tier==="unknown"&&ye!==null&&Mn.push({finding:fe,symbol:ye})}for(let ye of mt)Q.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:De.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${gn} carries a ${ye.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:xe.id,displayId:gn,packageName:L.name,version:L.version,ecosystem:L.ecosystem??"npm",symbolName:null,symbolPath:null,severity:xe.severity,packageLocation:Ro(l,L)})}}}for(let L of te)Q.unknown+=1,$.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:L.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:hs,displayId:hs,packageName:L.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,severity:null,unknownKind:"coverage-gap",packageLocation:pl(l,L)});let Yn=Q["reachable-high"]+Q["reachable-medium"],R=e.failOnReachable===!0&&Yn>0,M=eg($,Q.unknown,e.failOnUnknown),B=e.requireCompleteDenial===!0&&$.some(L=>L.tier==="not-reachable"&&L.basis==="loader-assumption"),q=R||M||B?2:0,le;if(r!==null){let L=ln(v),oe=new Map(v.modules.map(Ie=>[Ie.id,Ie])),se=[];for(let{finding:Ie,symbol:Ne}of ce){let pe=Ho(v,oe,L,Ne,r,Dh);se.push({advisoryId:Ie.advisoryId,packageName:Ie.packageName,symbolName:Ie.symbolName,unknownKind:Ie.unknownKind??null,wouldPromote:pe!==null,...pe!==null?{anchorPackage:pe.anchorPackage,entryExport:pe.entryExport,viaPackages:pe.viaPackages,totalHops:pe.totalHops}:{}})}le={records:se}}let ge;if(s!==null&&e.modelShadow!==void 0){let L=e.modelShadow.widened===!0?"widened":"base",{models:oe,notes:se,dispositions:Ie}=us(s,u,{shadowConsultDenylisted:!0}),{delta:Ne}=_t(v,oe),pe=ln(v),Qe=new Map(v.modules.map(z=>[z.id,z])),hn=Jh(v,Qe,pe),xe=Zh(v),en=Ne.records.some(z=>hn.some(ee=>ee.packageName===z.anchor.packageName&&ee.exportName===z.anchor.exportName&&ee.container===z.anchor.container)),De=[],gn=Date.now();for(let{finding:z,symbol:ee}of Mn){let de=Ne.records,Re=ms(z,ee,L),fe=Re?xt(v,Qe,pe,ee,de):null,ue=Ne.records.filter($e=>$e.callee.packageName===ee.packageName&&$e.callee.exportName===ee.exportName&&$e.callee.container===ee.container||$e.callee.packageName===ee.packageName&&$e.callee.realFunctionId!==null);De.push({advisoryId:z.advisoryId,packageName:z.packageName,symbolName:z.symbolName,unknownKind:z.unknownKind??null,decidedAtStage:z.decidedAtStage,consultSurface:L,noHitReason:fe!==null?null:Re?en?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:fe!==null?Qh(fe,de,hn,xe):null,verdictBefore:z.tier,verdictAfter:fe!==null?"reachable-low":z.tier,wouldPromote:fe!==null,...fe!==null?{modelId:fe.modelId,anchorPackage:fe.anchorPackage,entryExport:fe.entryExport,pathLabels:fe.pathLabels,calleeBinding:ue.find($e=>$e.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:Re?ue.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${ue[0]?.anchor.packageName??"?"}#${ue[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Tn=Date.now()-gn,mt=Ie.map(z=>{if(z.status!=="active")return{modelId:z.modelId,state:z.status,reason:z.reason,edgesLowered:0,edgesReferenceGated:0};let ee=Ne.records.filter(Re=>Re.modelId===z.modelId).length;if(ee>0)return{modelId:z.modelId,state:"lowered",reason:null,edgesLowered:ee,edgesReferenceGated:z.edgeCount-ee};let de=Ne.notes.find(Re=>Re.startsWith(`model ${z.modelId}:`)||Re.startsWith(`model-edge ${z.modelId}:`));return{modelId:z.modelId,state:"refused",reason:de??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:z.edgeCount}}),yn=De.filter(z=>z.wouldPromote).length,xn=Q.unknown-yn,ye=Q["reachable-high"]+Q["reachable-medium"],nn=z=>({none:0,"fail-on-reachable":ye>0?2:0,"fail-on-unknown":z>0?2:0,both:ye>0||z>0?2:0});ge={records:De,notes:[...se,...Ne.notes],laneStates:mt,exitCodes:{baseline:nn(Q.unknown),withModels:nn(xn)},overlayWallMs:Tn},Xl(mn.dirname(e.modelShadow.outPath),{recursive:!0});let We=`${e.modelShadow.outPath}.tmp-${Hl(8).toString("hex")}`;Jl(We,`${JSON.stringify(ge,null,2)}
-`,{encoding:"utf8",flag:"wx"}),Yl(We,e.modelShadow.outPath)}let Te;if(e.bindingShadow!==void 0){let L=Date.now(),oe=z=>Y.models.length>0?{records:_t(z,Y.models).delta.records,reachMods:ln(z),modulesById:new Map(z.modules.map(ee=>[ee.id,ee]))}:null,se=(z,ee,de,Re)=>{let fe=[];for(let ue of l.packages)for(let{advisory:$e,affected:Dn}of t.advisoriesForPackage(ue.ecosystem??"npm",ue.name)){let Jn=zt($e.id,ue.name,Dn),Yd=fs($e.id,ue.name,t.symbolsForAffected(Dn.id),Dn.surfaceComplete,o);for(let js of Yd){let{finding:Bs,hit:qo}=Ut(z,Re,{name:ue.name,version:ue.version,...ue.ecosystem!==void 0?{ecosystem:ue.ecosystem}:{},devOnly:ue.dev,outOfGraphExecution:_(ue)},Jn,js,ee,de);fe.push({advisoryId:$e.id,packageName:ue.name,symbolName:js?.exportName??null,tier:qo!==null?qo.tier:Bs.tier,unknownKind:qo!==null?null:Bs.unknownKind??null})}}return fe},Ie=z=>{let ee=Tr({appRoot:n,entrypoints:y,depClassAnchors:I,bindingForms:z,callablePackageResolver:A,tsconfigPaths:k}),de=[...g.diagnostics,...Dr(g),...Lr(g,y.length),...Yr(a,x),...ee.diagnostics];return{graph:ee.graph,inc:Ql(ee.graph,de,U),aborted:Zl(y.length,ee.graph),live:oe(ee.graph),applicability:ee.bindingApplicability}},Ne=z=>{let ee=Ie(z);return se(ee.graph,ee.inc,ee.aborted,ee.live)},pe=Ie({}),Qe=se(pe.graph,pe.inc,pe.aborted,pe.live),hn=se(v,X,j,ne);if(hn.length!==Qe.length)throw new an("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let xe=(z,ee)=>ee.tier!==z.tier||ee.unknownKind!==z.unknownKind,en=Qe.some((z,ee)=>{let de=hn[ee];return de!==void 0&&xe(z,de)}),De=en?Ne({additiveForms:!0}):null,gn=en?Ne({namelessExports:!0}):null,Tn=0,mt=Qe.map((z,ee)=>{let de=hn[ee];if(de===void 0||de.advisoryId!==z.advisoryId||de.packageName!==z.packageName||de.symbolName!==z.symbolName)throw new an("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Re={advisoryId:z.advisoryId,packageName:z.packageName,symbolName:z.symbolName,unknownKind:z.unknownKind,verdictBefore:z.tier,verdictAfter:de.tier,wouldPromote:de.tier!==z.tier&&(de.tier==="reachable-high"||de.tier==="reachable-medium"||de.tier==="reachable-low")};if(!xe(z,de)||De===null||gn===null)return Re;Tn+=1;let fe=De[ee],ue=gn[ee],$e=fe!==void 0&&xe(z,fe),Dn=ue!==void 0&&xe(z,ue);return{...Re,attributedArm:$e&&!Dn?"additiveForms":Dn&&!$e?"namelessExports":"both",...fe!==void 0?{verdictArmA:fe.tier}:{},...ue!==void 0?{verdictArmB:ue.tier}:{}}}),yn={...Q};Qe.forEach((z,ee)=>{let de=hn[ee];de!==void 0&&de.tier!==z.tier&&(yn[de.tier]-=1,yn[z.tier]+=1)});let xn=(z,ee)=>({none:0,"fail-on-reachable":z>0?2:0,"fail-on-unknown":ee>0?2:0,both:z>0||ee>0?2:0}),ye;if(Y.models.length>0&&ne!==null){ye=[];for(let z of l.packages)for(let{advisory:ee,affected:de}of t.advisoriesForPackage(z.ecosystem??"npm",z.name)){let Re=zt(ee.id,z.name,de),fe=fs(ee.id,z.name,t.symbolsForAffected(de.id),de.surfaceComplete,o);for(let ue of fe){if(ue===null||!ue.verified)continue;let $e=Ut(pe.graph,pe.live,{name:z.name,version:z.version,...z.ecosystem!==void 0?{ecosystem:z.ecosystem}:{},devOnly:z.dev,outOfGraphExecution:_(z)},Re,ue,pe.inc,pe.aborted);if(!($e.hit===null&&ms($e.finding,ue,"base")))continue;let Jn=xt(v,ne.modulesById,ne.reachMods,ue,ne.records);ye.push({advisoryId:ee.id,packageName:z.name,symbolName:ue.exportName,modelWouldPromote:Jn!==null,...Jn!==null?{modelId:Jn.modelId}:{},anchorCleared:Jn!==null})}}}let nn=$.some(z=>z.modelId!==void 0);Te={records:mt,deltas:Tn,exitCodes:{baseline:xn(yn["reachable-high"]+yn["reachable-medium"],yn.unknown+(nn?1:0)),withBindingForms:xn(Q["reachable-high"]+Q["reachable-medium"],Q.unknown+(nn?1:0))},dualRunWallMs:Date.now()-L,...P.bindingApplicability!==void 0?{applicability:P.bindingApplicability}:{},...ye!==void 0?{modelProbe:ye}:{}},Xl(mn.dirname(e.bindingShadow.outPath),{recursive:!0});let We=`${e.bindingShadow.outPath}.tmp-${Hl(8).toString("hex")}`;Jl(We,`${JSON.stringify(Te,null,2)}
-`,{encoding:"utf8",flag:"wx"}),Yl(We,e.bindingShadow.outPath)}let Ze=G.length>0||Y.notes.length>0?{active:Y.models.length,stored:G.length,promoted:$.filter(L=>L.modelId!==void 0).length,notes:[...Y.notes,...re!==null?re.notes:[]]}:void 0;return{...le!==void 0?{summaryShadow:le}:{},...ge!==void 0?{modelShadow:ge}:{},...Te!==void 0?{bindingShadow:Te}:{},...Ze!==void 0?{modelLane:Ze}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:$,counts:Q,analyzerDiagnostics:N,pythonDiagnostics:i?.diagnostics??[],analysisAborted:K,rejectedEntries:m,entrypointSources:b,entrypointGaps:[...g.gaps,...g.surfaceGaps],entrypointObservations:g.observations,framework:g.framework,unresolved:T,advisories:[...Z.values()],rootSet:a,exitCode:q,adr105:J.report}}finally{e.reader===void 0&&t.close()}}var ng="cupel",tg="reachability-first SCA \u2014 verdict + call path + confidence";function ys(e){return[`${ng} v${e} \u2014 ${tg}`,`cascade: ${Xs.join(" \u2192 ")}`,`verdicts: ${Ys.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
-`)}var og=new Set([...Zo,...Qo]);function wn(e,n,t){let o=e[n+1];if(o===void 0||o.startsWith("--"))throw new Error(`${t} requires a value`);return o}function rg(e){let n=e.split(",").map(r=>r.trim()),t=[...Zo,...Qo].join(", ");if(n.length===0||n.some(r=>r===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let o=[];for(let r of n){if(!og.has(r))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(r)}; valid: ${t}`);o.push(r)}return o}function od(e){let n=".",t,o,r,s=!1,a=!1,l=!1,i=!1,d=!1,u,p,f,m=!1,g=!1,y,b=!1,x=!0,I=!1,w,A=[],k=[];for(let h=0;h<e.length;h+=1){let S=e[h];if(S==="--require-complete-denial"){a=!0;continue}if(S==="--fail-on-reachable")s=!0;else if(S==="--fail-on-unknown")l="all";else if(S!==void 0&&S.startsWith("--fail-on-unknown="))l=rg(S.slice(18));else if(S==="--offline")i=!0;else if(S==="--sarif")t=wn(e,h,"--sarif"),h+=1;else if(S==="--shard")o=wn(e,h,"--shard"),h+=1;else if(S==="--shard-pypi")r=wn(e,h,"--shard-pypi"),h+=1;else if(S==="--entry")A.push(wn(e,h,"--entry")),h+=1;else if(S==="--root")k.push(wn(e,h,"--root")),h+=1;else if(S==="--summary-shadow")u=wn(e,h,"--summary-shadow"),h+=1;else if(S==="--model-shadow")p=wn(e,h,"--model-shadow"),h+=1;else if(S==="--model-shadow-out")f=wn(e,h,"--model-shadow-out"),h+=1;else if(S==="--model-shadow-widened")m=!0;else if(S==="--binding-shadow")g=!0;else if(S==="--binding-shadow-out")y=wn(e,h,"--binding-shadow-out"),h+=1;else if(S==="--x-partial-rows")b=!0;else if(S==="--no-tsconfig-paths")x=!1;else if(S==="--x-tsconfig-paths")x=!0;else if(S==="--push")I=!0;else if(S!==void 0&&S.startsWith("--auth=")){let _=S.slice(7);if(_!=="oidc"&&_!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(_)}`);w=_}else{if(S!==void 0&&S.startsWith("--"))throw new Error(`unknown flag ${S}`);S!==void 0&&!d&&(n=S,d=!0)}}if(p===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(m&&p===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(g!==(y!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(w!==void 0&&!I)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:o,shardPypi:r,failOnReachable:s,requireCompleteDenial:a,failOnUnknown:l,offline:i,entry:A,root:k,summaryShadow:u,modelShadow:p,modelShadowOut:f,modelShadowWidened:m,push:I,auth:w,bindingShadow:g,bindingShadowOut:y,partialRows:b,tsconfigPaths:x}}import{chmodSync as ug,mkdirSync as fg,readFileSync as pg,renameSync as mg,statSync as hg,unlinkSync as gg,writeFileSync as yg}from"node:fs";import{randomBytes as xg}from"node:crypto";import{homedir as Sg}from"node:os";import Hn from"node:path";import{createPublicKey as sg,verify as ig}from"node:crypto";function Ye(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function rd(e,n={}){let t=n.maxBytes??1073741824,o=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((s,a)=>{let l=r(e,n.headers!==void 0?{headers:n.headers}:{},i=>{let d=i.statusCode??0;if(d<200||d>=300){i.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let u=[],p=0;i.on("data",f=>{if(p+=f.length,p>t){i.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(f)}),i.on("end",()=>{s(Buffer.concat(u))}),i.on("error",a)});l.on("error",a),l.setTimeout(o,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(o)}ms`))})})}async function Vt(e,n,t,o,r,s=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((i,d)=>{let u=a(n,{method:e,headers:t},p=>{let f=[],m=0;p.on("data",g=>{if(m+=g.length,m>r){p.destroy(),d(new Error(`${e} to ${l} returned more than ${String(r)} bytes`));return}f.push(g)}),p.on("end",()=>{i({status:p.statusCode??0,body:Buffer.concat(f).toString("utf8")})}),p.on("error",()=>{d(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{d(new Error(`${e} to ${l} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(s)}ms`))}),o!==void 0&&u.write(o),u.end()})}var ie=class extends Error{constructor(n){super(n),this.name="DistError"}},Gn=class extends ie{constructor(n){super(n),this.name="NoCachedShardError"}},ag=Buffer.from("302a300506032b6570032100","hex"),lg=32;function ld(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===lg)try{return sg({key:Buffer.concat([ag,n]),format:"der",type:"spki"})}catch{return}}function xs(e,n,t){for(let o of t){let r=ld(o);if(r!==void 0)try{if(ig(null,e,r,n))return!0}catch{}}return!1}function dd(e){return e.some(n=>ld(n)!==void 0)}var dg=/^[0-9a-f]{64}$/u,cg=/^[a-z0-9-]+$/u;function sd(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new ie(`${n} must be an object`);return e}function id(e,n){if(!Array.isArray(e))throw new ie(`${n} must be an array`);return e}function To(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new ie(`${n} must be an integer`);return e}function Do(e,n){if(typeof e!="string")throw new ie(`${n} must be a string`);return e}function ad(e,n){let t=Do(e,n);if(Number.isNaN(Date.parse(t)))throw new ie(`${n} is not a valid timestamp: ${t}`);return t}function Ss(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new ie("distribution index is not valid JSON")}let o=sd(t,"index"),r=To(o.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new ie(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=To(o.sequence,"sequence");if(s<0)throw new ie("sequence must be non-negative");let a=ad(o.generated,"generated"),l=id(o.shards,"shards"),i;for(let g of l){let y=sd(g,"shard entry"),b=Do(y.ecosystem,"ecosystem");if(!cg.test(b))throw new ie(`ecosystem ${JSON.stringify(b)} is malformed`);if(b===n.ecosystem){i=y;break}}if(i===void 0)throw new ie(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);ad(i.built,"built");let d=To(i.db_schema_version,"db_schema_version");if(d<1)throw new ie("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new ie(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=Do(i.sha256,"sha256");if(!dg.test(u))throw new ie(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let p=To(i.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new ie(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let f=id(i.urls,"urls");if(f.length===0)throw new ie("urls must be a non-empty array");let m=[];for(let g of f){let y=Do(g,"url");try{m.push(Ye(y,n.shardHosts))}catch(b){throw new ie(`refusing shard url ${JSON.stringify(y)}: ${b.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:p,dbSchemaVersion:d,urls:m,sequence:s,generated:a}}var cd="CUPEL_CONFIG_DIR",ud="credentials.json",bs="cpd_",bg="cpl_",kg=bs.length+6+32,Eg=200,wg=/^[A-Za-z0-9_-]+$/u,qt=class extends ie{constructor(n){super(n),this.name="StoredCredentialError"}};function fd(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=Sg();if(process.platform==="darwin")return Hn.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let s=e.APPDATA,a=s!==void 0&&s!==""?s:Hn.join(t,"AppData","Roaming");return Hn.join(a,"cupel")}let o=e.XDG_CONFIG_HOME,r=o!==void 0&&o!==""?o:Hn.join(t,".config");return Hn.join(r,"cupel")}function Lo(e){return Hn.join(fd(e),ud)}function ks(e){let n=e.trim();return n.startsWith(bg)?{ok:!1,reason:"push-token"}:n.startsWith(bs)?n.length<kg||n.length>Eg?{ok:!1,reason:"malformed"}:wg.test(n.slice(bs.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function pd(e,n){let t=fd(e),o=Hn.join(t,ud);fg(t,{recursive:!0,mode:448}),process.platform!=="win32"&&ug(t,448);let r=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),s=`${o}.tmp-${xg(8).toString("hex")}`;return yg(s,`${r}
-`,{flag:"wx",mode:384}),mg(s,o),o}function md(e){let n=Lo(e),t;try{t=hg(n)}catch(a){if(a instanceof Error&&a.code==="ENOENT")return;throw a}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new qt(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let o;try{o=JSON.parse(pg(n,"utf8"))}catch{throw new qt(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let r=typeof o=="object"&&o!==null&&"delivery_token"in o?o.delivery_token:void 0,s=ks(typeof r=="string"?r:"");if(!s.ok)throw new qt(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return s.token}function hd(e){try{return gg(Lo(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var Gt="CUPEL_DELIVERY_TOKEN",Es=class extends ie{constructor(n){super(n),this.name="NoDeliveryTokenError"}},ws=class extends ie{constructor(n){super(n),this.name="DeliveryCredentialError"}};function vg(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function gd(e,n,t=()=>{}){let o=vg(e)??t();return o!==void 0?()=>Promise.resolve(o):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function yd(e){if(e===void 0)throw new Es(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${Gt} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new ws(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Ig="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function Ag(){return new Promise(e=>{let n=process.stdin;process.stderr.write(Ig),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",o=s=>{n.setRawMode(!1),n.pause(),n.removeListener("data",r),process.stderr.write(`
+`:"",encoding:"utf8",maxBuffer:hh,timeout:n.timeoutMs??gh,env:t});if(l.error!==void 0){let m=l.error.code,g=m==="ENOENT";return{refused:g?"no-interpreter":"script-failed",interpreter:null,files:[],stdlib:[],diagnostics:[...r,g?`no Python interpreter: \`${o}\` is not on PATH (set ${Kl} to the interpreter this project runs under)`:`the Python extract could not run (${m??l.error.message})`]}}if(l.status!==0){let m=(l.stderr??"").slice(-400).trim();return{refused:"script-failed",interpreter:null,files:[],stdlib:[],diagnostics:[...r,`the Python extract exited ${String(l.status??"on a signal")}${m!==""?`: ${m}`:""}`]}}let i=(l.stdout??"").split(`
+`).filter(m=>m.trim()!==""),d=null,u=[],p=[];for(let m of i){let g;try{g=JSON.parse(m)}catch{r.push("the Python extract emitted a line that is not JSON; it was skipped");continue}if(!Mn(g))continue;if(g.kind==="header"){d=ke(g.interpreter,64);let S=g.stdlib;Array.isArray(S)&&(u=S.filter(x=>typeof x=="string"&&x.length<=128));continue}let y=Sh(g);if(y===null){r.push("the Python extract emitted a file row without a path; it was skipped");continue}p.push(y)}if(d===null)return{refused:"unreadable-output",interpreter:null,files:[],stdlib:[],diagnostics:[...r,"the Python extract did not report an interpreter version"]};let f=s.length-p.length;return f>0&&r.push(`${String(f)} file(s) asked for produced no row \u2014 treat the extract as incomplete`),{refused:null,interpreter:d,files:p,stdlib:u,diagnostics:r}}var Eh="python3",wh={"loader-escape":"dynamic-load","dynamic-load-set":"dynamic-load","module-registry-write":"dynamic-load","unresolved-import":"resolution-divergence","file-refused":"analysis-cap","module-cap":"analysis-cap","extract-refused":"analysis-cap"};function vh(e,n,t=o=>Do([],{python:o}).refused===null){let o=Hn.resolve(e,n.envRel);for(let r of["bin/python3","bin/python","Scripts/python.exe"]){let s=Hn.join(o,r);try{if(!kh(s).isFile())continue}catch{continue}if(t(s))return s}return Eh}function _h(e,n){let t=[e];for(let o of n.sitePackages)t.push(Hn.resolve(e,o));for(let o of n.pthFiles)for(let r of o.paths)t.push(Hn.isAbsolute(r)?r:Hn.resolve(e,o.sitePackages,r));return{roots:[...new Set(t)]}}function Ih(e){let n=[];for(let t of e.distInfos){let o=Mt(t.metadata,{...t.topLevel!==void 0?{topLevelText:t.topLevel}:{},...t.record!==void 0?{recordText:t.record}:{},...t.directUrl!==void 0?{directUrlText:t.directUrl}:{},...t.entryPoints!==void 0?{entryPointsText:t.entryPoints}:{},...t.entryPointsUnknown===!0?{entryPointsUnknown:!0}:{}});o!==null&&n.push(o)}return n}function Ah(e){return n=>{let t=e.byImportName.get(n);return t===void 0||t.length===0?null:t.length===1?t[0]?.name??null:null}}function Nh(e,n,t={}){let r=(t.readEnvironment??Lt)(n),s=Ih(r),a=Yr(s),l=r.diagnostics.map(x=>x),i=t.python??vh(n,r),d=_h(n,r),u=Ch(r,a,d),p=new Map;for(let x of s)p.set(x.name,Ph(x,u.distributions));for(let x of u.seen)l.push(`startup hook: ${x}`);for(let x of u.unattributed)l.push(`startup escape: ${x} \u2014 a module runs at interpreter start that no installed distribution claims`);let f=ps({projectRoot:n,paths:d,python:i});for(let x of f.gaps)l.push(`entrypoint \`${x.declaration}\` (${x.source}): ${x.detail}`);if(f.entrypoints.length===0)return l.push("no Python entrypoint was found (no console script, `__main__.py`, `manage.py` or launch declaration resolved), so no Python dependency can be reported unreachable"),{rootRel:e,graph:zt,incompleteness:[],analysisAborted:"no-entrypoint",entrypoints:[],entrypointGaps:f.gaps,interpreter:null,diagnostics:l,execution:p};let m=us({projectRoot:n,paths:d,entryFiles:f.entrypoints.map(x=>Hn.join(n,x.file)),environmentComplete:!r.truncated&&r.refused===null,externalRoots:r.sitePackages.map(x=>Hn.resolve(n,x)),distributionOf:Ah(a),python:i,...t.maxModules!==void 0?{maxModules:t.maxModules}:{}});for(let x of m.diagnostics)l.push(`${x.code} at ${x.where}: ${x.detail}`);if(m.graph.modules.length===0)return{rootRel:e,graph:zt,incompleteness:[],analysisAborted:"analyzer-crash",entrypoints:f.entrypoints,entrypointGaps:f.gaps,interpreter:m.interpreter,diagnostics:l,execution:p};let g=new Map;for(let x of m.graph.modules)g.set(x.id,x.id),g.set(x.path,x.id);let y=m.graph.modules[0]?.id,S=m.diagnostics.map(x=>({source:g.get(x.where)??y,cause:wh[x.code],reach:{kind:"unbounded"}}));return u.unattributed.length>0&&S.push({source:y,cause:"dynamic-load",reach:{kind:"unbounded"}}),{rootRel:e,graph:m.graph,incompleteness:S,analysisAborted:null,entrypoints:f.entrypoints,entrypointGaps:f.gaps,interpreter:m.interpreter,diagnostics:l,execution:p}}var zt={modules:[],exports:[],imports:[],functions:[],callSites:[],classes:[],callEdges:[],importEdges:[],exportBindings:[],inheritEdges:[]};function Rh(e){if(e.length===0)return null;let n=[],t=new Map;for(let x of e){let _=x.rootRel===""?".":x.rootRel;for(let w of x.diagnostics)n.push(`${_}: ${w}`);for(let[w,I]of x.execution){let k=t.get(w);t.set(w,k===void 0?I:[...new Set([...k,...I])])}}let o=e.filter(x=>x.analysisAborted===null);if(o.length===0)return{graph:zt,incompleteness:[],analysisAborted:e[0]?.analysisAborted??"no-entrypoint",roots:e,diagnostics:n,execution:t};let r=[],s=[],a=[],l=[],i=[],d=[],u=[],p=[],f=[],m=[],g=[],y=new Set;for(let x of o){let _=x.rootRel===""?"":`${x.rootRel}::`,w=new Set(x.graph.modules.filter(v=>v.externalSurface===!0).map(v=>v.id)),I=v=>w.has(v)?v:`${_}${v}`,k=v=>`${_}${v}`,h=v=>`${_}${v}`,b=v=>`${_}${v}`,A=v=>`${_}${v}`,P=v=>`${_}${v}`;for(let v of x.graph.modules){if(v.externalSurface===!0){if(y.has(v.id))continue;y.add(v.id),r.push(v);continue}r.push({...v,id:I(v.id)})}for(let v of x.graph.imports)s.push({...v,id:k(v.id),moduleId:I(v.moduleId),...v.resolvedModuleId!==void 0?{resolvedModuleId:I(v.resolvedModuleId)}:{}});for(let v of x.graph.importEdges)a.push({importId:k(v.importId),resolvedModuleId:I(v.resolvedModuleId)});for(let v of x.incompleteness)g.push({...v,source:I(v.source)});for(let v of x.graph.functions)l.push({...v,id:h(v.id),moduleId:I(v.moduleId),...v.enclosingClassId!==void 0?{enclosingClassId:b(v.enclosingClassId)}:{}});for(let v of x.graph.classes)i.push({...v,id:b(v.id),moduleId:I(v.moduleId),members:v.members.map(h)});for(let v of x.graph.exports)d.push({...v,id:P(v.id),moduleId:I(v.moduleId)});for(let v of x.graph.exportBindings)u.push({exportId:P(v.exportId),target:v.target.kind==="function"?{kind:"function",functionId:h(v.target.functionId)}:{kind:"module",moduleId:I(v.target.moduleId)}});for(let v of x.graph.callSites)p.push({...v,id:A(v.id),enclosingFunctionId:h(v.enclosingFunctionId),resolvedTargetIds:v.resolvedTargetIds.map(h)});for(let v of x.graph.callEdges)f.push({...v,callSiteId:A(v.callSiteId),calleeFunctionId:h(v.calleeFunctionId)});for(let v of x.graph.inheritEdges)m.push({...v,subclassId:b(v.subclassId),superclassId:b(v.superclassId)})}let S=r[0]?.id;for(let x of e)x.analysisAborted===null||S===void 0||g.push({source:S,cause:x.analysisAborted==="no-entrypoint"?"no-entrypoint":"analysis-cap",reach:{kind:"unbounded"}});return{graph:{modules:r,imports:s,importEdges:a,functions:l,classes:i,exports:d,exportBindings:u,callSites:p,callEdges:f,inheritEdges:m},incompleteness:g,analysisAborted:null,roots:e,diagnostics:n,execution:t}}function Ul(e,n={}){let t=e.filter(o=>Dt(o));return t.length===0?null:Rh(t.map(o=>Nh(o.rel,o.abs,n)))}function Ph(e,n){let t=[];return e.consoleScripts==="declared"&&t.push("bin"),e.extensionModules>0&&t.push("native-artifact"),n.has(e.name)&&t.push("install-script"),(e.consoleScripts==="unknown"||!e.recordKnown)&&t.push("manifest-unreadable"),t}var $h=["sitecustomize","usercustomize"];function Ch(e,n,t){let o=new Set,r=[],s=[];for(let a of e.pthFiles){for(let i of a.importModules){let d=Co(n,i);for(let p of d)o.add(p.name);let u=Cn(t,i);if(u.resolved!==null){s.push(`${a.sitePackages}/${a.name}: \`import ${i}\` runs ${u.resolved.path}`);continue}d.length===0&&r.push(`${a.sitePackages}/${a.name}: \`import ${i}\``)}let l=a.importModules.length;a.importLines>l&&r.push(`${a.sitePackages}/${a.name}: ${String(a.importLines-l)} import line(s) whose module could not be read`)}for(let a of $h){let l=Cn(t,a);if(l.resolved===null)continue;let i=Co(n,a);for(let d of i)o.add(d.name);i.length===0?r.push(`${l.resolved.path}: \`import ${a}\` runs at every interpreter start`):s.push(`${a}: \`import ${a}\` runs ${l.resolved.path}`)}return{distributions:o,unattributed:r,seen:s}}import{readdirSync as Oh,readFileSync as Mh}from"node:fs";import Th from"node:path";var Dh=new Set(["summarized","crashed","over-cap"]),Lh=new Set(["function","method","ctor"]);function Ee(e,n){throw new Error(`summary facts file ${e}: ${n}`)}function ms(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Fh(e,n){ms(e)||Ee(n,"edge is not an object");let{entryPath:t,entryExport:o,entryContainer:r,hops:s}=e;(typeof t!="string"||typeof o!="string")&&Ee(n,"edge entry fields must be strings"),r!==null&&typeof r!="string"&&Ee(n,"entryContainer must be string or null"),(typeof s!="number"||!Number.isInteger(s)||s<0)&&Ee(n,"hops must be a non-negative integer");let a=e.target;if(ms(a)||Ee(n,"edge target missing"),a.kind==="symbol"){let{exportName:l,container:i,symbolKind:d}=a;return typeof l!="string"&&Ee(n,"symbol target exportName"),i!==null&&typeof i!="string"&&Ee(n,"symbol target container"),(typeof d!="string"||!Lh.has(d))&&Ee(n,`symbol target kind ${JSON.stringify(d)}`),{entryPath:t,entryExport:o,entryContainer:r,target:{kind:"symbol",exportName:l,container:i,symbolKind:d},hops:s}}if(a.kind==="dep"){let{calleePackage:l,calleeSubpath:i,calleeExport:d}=a;return(typeof l!="string"||l.length===0)&&Ee(n,"dep target calleePackage"),i!==null&&typeof i!="string"&&Ee(n,"dep target calleeSubpath"),(typeof d!="string"||d.length===0)&&Ee(n,"dep target calleeExport"),{entryPath:t,entryExport:o,entryContainer:r,target:{kind:"dep",calleePackage:l,calleeSubpath:i,calleeExport:d},hops:s}}Ee(n,`unknown target kind ${JSON.stringify(a.kind)}`)}function jh(e,n){ms(e)||Ee(n,"root is not an object");let{packageName:t,analyzedVersion:o,tool:r,toolVersion:s,maxIndirections:a,status:l}=e;(typeof t!="string"||t.length===0)&&Ee(n,"packageName"),typeof o!="string"&&Ee(n,"analyzedVersion"),r!=="jelly"&&Ee(n,`tool ${JSON.stringify(r)} (only 'jelly' exists)`),typeof s!="string"&&Ee(n,"toolVersion"),typeof a!="number"&&Ee(n,"maxIndirections"),(typeof l!="string"||!Dh.has(l))&&Ee(n,`status ${JSON.stringify(l)} not in the enum`);let i=e.edges;return Array.isArray(i)||Ee(n,"edges is not an array"),l!=="summarized"&&i.length>0&&Ee(n,`status='${l}' with edges (CS-W6: edge rows only under summarized)`),{packageName:t,analyzedVersion:o,tool:r,toolVersion:s,maxIndirections:a,status:l,edges:i.map(d=>Fh(d,n))}}function zl(e){let n=new Map,t=Oh(e).filter(o=>o.endsWith(".summary.json"));for(let o of t){let r=Th.join(e,o),s;try{s=JSON.parse(Mh(r,"utf8"))}catch(i){Ee(o,`unparseable JSON: ${i instanceof Error?i.message:String(i)}`)}let a=jh(s,o),l=n.get(a.packageName);l===void 0?n.set(a.packageName,[a]):l.push(a)}return n}import{isBuiltin as ql}from"node:module";function q(e){let n="";for(let t of e){let o=t.charCodeAt(0),r=o<32||o>=127&&o<=159;n+=r?"\\x"+o.toString(16).padStart(2,"0"):t}return n}var Wl=1024,Vl=4096,Fo=8,Gl=512,Hl=512,hs=8,Bh=160,Kh=new Set(["unresolved-specifier","declaration-shadow","unresolved-reexport","unanalyzable-module"]),gs=new Set(["limit-exceeded","parse-error","unsupported-syntax"]),Uh=/^(@[^/@\s]+\/)?[^/@\s.][^/\s]*$/u,zh=/\.[cm]?[jt]sx?$/u;function Xl(e,n){let t=n.get(e);if(t!==void 0)return t.packageName;let o=e.lastIndexOf("node_modules/");if(o!==-1){let r=e.slice(o+13).split("/"),s=r[0]??"";return s.startsWith("@")?r[1]===void 0?null:`${s}/${r[1]}`:s===""?null:s}return Uh.test(e)&&!zh.test(e)?e:null}function qh(e){return q(`${e.code} ${e.path}: ${e.detail}`.slice(0,Bh))}function Yl(e){let{graph:n,facts:t,diagnostics:o}=e,r=new Map(n.modules.map(C=>[C.id,C])),s=new Map(n.modules.map(C=>[C.path,C])),a=cn(n),l=new Set;for(let C of a){let Q=r.get(C);Q!==void 0&&l.add(Q.packageName)}let i=new Map,d=0,u=!1,p=!1,f=C=>C.startsWith(`${e.appRootReal}/`)?C.slice(e.appRootReal.length+1):C;for(let C of o){if(C.code==="limit-exceeded"&&C.path===e.appRootReal){u=!0;continue}let Q=Xl(f(C.path),s);if(Q===null){C.code==="out-of-root"&&d++,gs.has(C.code)&&(p=!0);continue}let ee=s.get(f(C.path));ee!==void 0&&gs.has(C.code)&&!ee.path.includes("node_modules/")&&(p=!0);let ue=i.get(Q);ue===void 0?i.set(Q,[C]):ue.push(C)}let m=new Map(n.imports.map(C=>[C.id,C])),g=new Set;for(let C of n.importEdges){let Q=m.get(C.importId);Q!==void 0&&r.get(Q.moduleId)?.externalSurface===!0&&g.add(Q.moduleId)}let y=[],S=new Set,x=n.modules.filter(C=>C.externalSurface===!0);for(let C of x){let Q=i.get(C.packageName)??[],ee=g.has(C.id),ue=[],Dn=ie=>ie.code==="dependency-body"&&ie.anchor===void 0&&/syntax/u.test(ie.detail),Zn=ie=>ie.code==="loader-escape"||ie.code==="dependency-body"&&ie.anchor===void 0&&!/syntax/u.test(ie.detail),R=Q.filter(ie=>Kh.has(ie.code)),M=Q.filter(Zn),U=Q.filter(ie=>gs.has(ie.code)||Dn(ie)),G=Q.filter(ie=>ie.code==="out-of-root"),de=ee&&R.length===0,ye=M.length===0,De=!u&&U.length===0,en=d===0&&G.length===0;ee||ue.push("(a) the package's entry was never followed to a module");for(let ie of[...R,...M,...U,...G]){if(ue.length>=hs)break;ue.push(qh(ie))}u&&ue.length<hs&&ue.push("(c) the dependency module closure hit its cap \u2014 every follow is truncated"),d>0&&ue.length<hs&&ue.push(`(d) ${String(d)} out-of-root diagnostic(s) no package can be read from`);let F=["a","b","c","d"].filter(ie=>!{a:de,b:ye,c:De,d:en}[ie]),re=F.length===0;re&&S.add(C.id),y.push({packageName:q(C.packageName),module:q(String(C.id)),inReach:a.has(C.id),builtin:ql(C.packageName),followed:ee,d1:{a:de,b:ye,c:De,d:en},failing:F,transparent:re,evidence:ue})}let _=new Set;for(let C of t)C.reach.kind==="unbounded"&&_.add(C.source);let w=C=>({module:q(String(C.module)),kind:C.kind,packageName:r.get(C.module)?.packageName??null}),I=new Set(x.filter(C=>ql(C.packageName)).map(C=>C.id)),k=new Set([...S,...I]),h=[],b=new Map,A=0,P=0,v=0,T=0,N=[],j=new Set;for(let C of t)C.reach.kind==="unbounded"&&j.add(C.cause);for(let C of t){if(C.reach.kind==="class-scope"){N.push({packageName:C.reach.packageName,container:C.reach.container});continue}if(C.reach.kind==="unbounded")continue;T++;let Q=C.reach.anchor,ee=b.get(String(Q));ee===void 0&&(ee={today:bt(n,Q,_),d1:bt(n,Q,_,S),d1Builtins:bt(n,Q,_,k)},b.set(String(Q),ee)),ee.d1Builtins.length>0&&v++,ee.today.length>0&&(A++,j.add(C.cause)),ee.d1.length>0&&P++,h.length<Vl&&h.push({anchor:q(String(Q)),packageName:q(r.get(Q)?.packageName??""),cause:C.cause,reachKind:C.reach.kind,blockersToday:ee.today.slice(0,Fo).map(w),blockersUnderD1:ee.d1.slice(0,Fo).map(w),blockedUnderD1Builtins:ee.d1Builtins.length>0,moreToday:Math.max(0,ee.today.length-Fo),moreUnderD1:Math.max(0,ee.d1.length-Fo)})}let $=o.filter(C=>C.anchor===void 0&&C.classScope===void 0),D=new Map(e.loadSites.map(C=>[C.importId,C])),K=new Map;for(let C of e.loadSites){let Q=K.get(C.path);Q===void 0?K.set(C.path,[C.shape]):Q.push(C.shape)}let te=C=>{if(C.code!=="loader-escape")return!1;let Q=C.escapes??[];if(Q.length===0||Q.some(ue=>ue!=="non-literal-load"))return!1;let ee=K.get(C.path)??[];return ee.length>0&&ee.every(ue=>ue==="relative-bounded")},B=$.slice(0,Hl).map(C=>({cause:e.causeOf(C.code),code:C.code,path:q(f(C.path)),attributedPackage:Xl(f(C.path),s),...C.escapes!==void 0?{escapes:[...C.escapes]}:{},...C.reason!==void 0?{reason:C.reason}:{},d2Dischargeable:te(C)})),Y={};for(let C of $){if(C.code!=="unresolved-specifier")continue;let Q=C.reason??"(none)";Y[Q]=(Y[Q]??0)+1}let L=_.size===0?0:t.filter(C=>C.reach.kind==="unbounded").length,O=Math.max(0,L-$.length),X=L-$.filter(te).length,Z=[],H=0,J=0,se=0;for(let C of n.imports){if(C.specifierIsLiteral)continue;se++;let Q=a.has(C.moduleId),ee=D.get(String(C.id)),ue=ee?.shape??"unrecorded";Q&&(H++,ue==="relative-bounded"&&J++),Z.length<Gl&&Z.push({importId:q(String(C.id)),path:q(r.get(C.moduleId)?.path??""),shape:ue,text:q(ee?.text??""),inReach:Q})}return{report:{adr:"ADR-105",aborted:e.analysisAborted,rootBudget:e.rootBudget,closureCapHit:u,appCapHit:p,unattributedOutOfRoot:d,blindUnbounded:O,unbounded:B,anchors:h,surfaces:y.slice(0,Wl),loads:Z,counts:{modules:n.modules.length,reachMods:a.size,surfaces:x.length,surfacesInReach:y.filter(C=>C.inReach).length,transparentSurfaces:S.size,builtinSurfaces:I.size,anchors:T,anchorsBlockedToday:A,anchorsBlockedUnderD1:P,anchorsBlockedUnderD1Builtins:v,unbounded:L,loadsInReach:H,loadsRelativeBounded:J,unresolvedByReason:Y,conditionUnions:e.conditionUnions.length,provenAbsent:e.provenAbsent.length},truncated:{surfaces:Math.max(0,y.length-Wl),anchors:Math.max(0,T-Vl),loads:Math.max(0,se-Gl),unbounded:Math.max(0,$.length-Hl)}},reachedPackages:l,aborted:e.analysisAborted,unboundedFacts:L,unboundedHard:X,anchorsBlockedToday:A,anchorsBlockedUnderD1:P,anchorsBlockedUnderD1Builtins:v,loadsInReach:H,loadsAllBounded:H>0&&J===H,d2Eligible:e.rootBudget==="complete"&&!p&&!u,classScope:N,taintCausesToday:j}}var Wh=new Set(["unverified-symbol","db-gap","symbol-unsupported","incomplete-surface"]),Vh=["no-entrypoint","dynamic-load","resolution-divergence","analysis-cap","dep-opaque"];function Jl(e,n,t,o,r){if(t===null||e.reachedPackages.has(t.packageName))return;let s=e.classScope.some(A=>A.packageName===t.packageName&&A.container===t.container),a=e.aborted!==null||e.unboundedFacts>0||e.anchorsBlockedToday>0||s,l=t.symbolKind==="method"||t.symbolKind==="ctor",d=!t.verified||t.symbolKind==="accessor"||t.symbolKind==="pattern"||l||n.unknownKind!==void 0&&Wh.has(n.unknownKind)?"pre-2b":n.tier==="not-reachable"?"denial":e.loadsInReach>0?"load":a?"taint":o>0?"oog":"unexpected",u=new Set(e.taintCausesToday);s&&u.add("dep-opaque");let p=e.aborted!==null?e.aborted:Vh.find(A=>u.has(A)),f=d==="pre-2b"?n.tier==="unknown"&&(l?n.unknownKind==="dep-opaque":!0):d==="denial"?n.tier==="not-reachable":d==="load"?n.tier==="unknown"&&n.unknownKind==="dynamic-load":d==="taint"?n.tier==="unknown"&&n.unknownKind===p:d==="oog"?n.tier==="unknown"&&n.unknownKind==="analysis-cap":!1,m=t.verified&&r===!0,g=e.aborted===null&&e.unboundedFacts===0&&!s&&o===0,y=e.loadsInReach===0||e.d2Eligible&&e.loadsAllBounded,S=m&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1===0,x=m&&d==="load"&&g&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,_=m&&(d==="load"||d==="taint")&&g&&y&&e.anchorsBlockedUnderD1===0,w=e.aborted===null&&e.unboundedHard===0&&!s&&o===0,I=m&&d==="load"&&w&&e.d2Eligible&&e.loadsAllBounded&&e.anchorsBlockedToday===0,k=m&&(d==="load"||d==="taint")&&w&&y&&e.anchorsBlockedUnderD1===0,h=m&&d==="taint"&&g&&e.loadsInReach===0&&e.anchorsBlockedUnderD1Builtins===0,b=m&&(d==="load"||d==="taint")&&w&&y&&e.anchorsBlockedUnderD1Builtins===0;return{unloaded:!0,exit:d,agrees:f,verified:t.verified,surfaceComplete:r,oog:o,classScoped:s,predicted:{d1:S,d2:x,d1d2:_,d2Amended:I,d1d2Amended:k,d1Builtins:h,d1d2AmendedBuiltins:b}}}import{readFileSync as Gh,statSync as Hh}from"node:fs";var xs=/^(@[A-Za-z0-9_.-]{1,100}\/)?[A-Za-z0-9_.-]{1,100}$/u,jo=/^[A-Za-z0-9_$.-]{1,128}$/u,Zl=64,Ql=1024*1024,ed=/^(0|\d{1,10}\.\d{1,10}\.\d{1,10})$/u,nd=/^[A-Za-z0-9@_.-]{1,128}$/u;function _e(e){throw new Error(`model claims rejected: ${e}`)}function ys(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Xh(e,n){ys(e)||_e(`${n}: edge is not an object`);let{kind:t,anchorExport:o,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}=e;return t!=="alias"&&t!=="dispatch"&&_e(`${n}: edge kind`),(typeof o!="string"||!jo.test(o))&&_e(`${n}: anchorExport ${JSON.stringify(o)}`),r!==null&&(typeof r!="string"||!jo.test(r))&&_e(`${n}: anchorContainer`),(typeof s!="string"||!xs.test(s))&&_e(`${n}: calleePackage ${JSON.stringify(s)}`),a!==null&&(typeof a!="string"||!jo.test(a))&&_e(`${n}: calleeContainer`),(typeof l!="string"||!jo.test(l))&&_e(`${n}: calleeExport ${JSON.stringify(l)}`),{kind:t,anchorExport:o,anchorContainer:r,calleePackage:s,calleeContainer:a,calleeExport:l}}function td(e){let n=Hh(e).size;n>Ql&&_e(`file is ${String(n)} bytes, over the ${String(Ql)} cap`);let t;try{t=JSON.parse(Gh(e,"utf8"))}catch(r){_e(`unparseable JSON: ${r instanceof Error?r.message:String(r)}`)}Array.isArray(t)||_e("root is not an array"),t.length>Zl&&_e(`${String(t.length)} claims over cap ${String(Zl)}`);let o=[];for(let r of t){ys(r)||_e("claim is not an object");let{packageName:s,modelId:a,range:l,edges:i}=r;(typeof s!="string"||!xs.test(s))&&_e("packageName"),(typeof a!="string"||!nd.test(a))&&_e("modelId (identifier charset, 1-128 chars)"),o.some(u=>u.model.modelId===a)&&_e(`duplicate modelId ${a} \u2014 the V5 promote\u2192claim join must be unambiguous`),(!ys(l)||typeof l.introduced!="string")&&_e(`${a}: range`),ed.test(l.introduced)||_e(`${a}: range.introduced ${JSON.stringify(l.introduced)} is not '0' or an exact x.y.z triple`);let d=l.fixedBefore;d!==null&&typeof d!="string"&&_e(`${a}: fixedBefore`),typeof d=="string"&&!ed.test(d)&&_e(`${a}: range.fixedBefore ${JSON.stringify(d)} is not an exact x.y.z triple`),Array.isArray(i)||_e(`${a}: edges`),i.length>64&&_e(`${a}: ${String(i.length)} edges over cap ${String(64)}`),o.push({model:{packageName:s,modelId:a,edges:i.map(u=>Xh(u,a))},introduced:l.introduced,fixedBefore:d})}return o}var Yh=["in-app-purchase@1-v1"];function bs(e,n,t){let o=[],r=[],s=[],a=(l,i,d,u)=>{r.push(d),s.push({modelId:u??l.model.modelId,status:i,reason:d,edgeCount:l.model.edges.length})};for(let l of e){if(!xs.test(l.model.packageName)||!nd.test(l.model.modelId)){a(l,"refused","model (unprintable id): hostile-shaped packageName/modelId \u2014 refused WHOLE","(unprintable id)");continue}if(t?.shadowConsultDenylisted!==!0&&Yh.includes(l.model.modelId)){a(l,"denylisted",`model ${l.model.modelId}: DENYLISTED (ADR-081 F-081-A a-prime) \u2014 dropped, never consulted`);continue}if(l.model.edges.some(u=>u.kind!=="alias"&&u.kind!=="dispatch")){a(l,"refused",`model ${l.model.modelId}: unknown edge kind \u2014 refused WHOLE`);continue}let i=n(l.model.packageName);if(typeof i!="string"&&i!==void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} installed at more than one version (${i.join(", ")}) \u2014 inert, never guessed (ADR-071)`);continue}if(i===void 0){a(l,"inert",`model ${l.model.modelId}: anchor ${l.model.packageName} not installed \u2014 inert`);continue}let d;try{d=jn(i,{advisoryId:l.model.modelId,packageName:l.model.packageName,introduced:l.introduced,...l.fixedBefore!==null?{fixed:l.fixedBefore}:{},surfaceComplete:!1})}catch{a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${i} not an exact triple \u2014 inert (never guessed)`);continue}if(!d){a(l,"inert",`model ${l.model.modelId}: installed ${l.model.packageName}@${i} outside [${l.introduced}, ${l.fixedBefore??"\u221E"}) \u2014 inert`);continue}o.push(l.model),s.push({modelId:l.model.modelId,status:"active",reason:null,edgeCount:l.model.edges.length})}return{models:o,notes:r,dispositions:s}}var Zh=4,Qh={additiveForms:!0,namelessExports:!0},eg=new Set(["dep-opaque","dynamic-load","dispatch"]),ng={base:new Set(["symbol-reachable"]),widened:new Set(["symbol-reachable","call-path-confirmed"])};function Es(e,n,t){return e.tier==="unknown"&&ng[t].has(e.decidedAtStage)&&e.unknownKind!==void 0&&eg.has(e.unknownKind)&&n!==null&&n.verified}var tg=()=>({"not-affected":0,"not-reachable":0,"reachable-high":0,"reachable-medium":0,"reachable-low":0,unknown:0}),dn=class extends Error{},ws="cupel/coverage-gap",cd={"loader-escape":"dynamic-load","out-of-root":"resolution-divergence","unresolved-specifier":"resolution-divergence","declaration-shadow":"resolution-divergence","unanalyzable-module":"resolution-divergence","unresolved-reexport":"resolution-divergence","limit-exceeded":"analysis-cap","parse-error":"analysis-cap","unsupported-syntax":"analysis-cap","unresolved-launch-entry":"analysis-cap","unresolved-entry-declaration":"analysis-cap","framework-derived-entry":"analysis-cap","unanalyzed-project-root":"no-entrypoint","dependency-body":"dep-opaque","dep-class-corridor":"dep-opaque"};function Wt(e,n,t){return{advisoryId:e,packageName:n,...t.ecosystem==="PyPI"?{ecosystem:"PyPI"}:{},introduced:t.introduced??"0",...t.fixed!==null?{fixed:t.fixed}:{},...t.lastAffected!==null?{lastAffected:t.lastAffected}:{},surfaceComplete:t.surfaceComplete===1}}function ad(e,n){return e===0?"no-entrypoint":n.modules.length===0?"analyzer-crash":null}function ld(e,n,t){let o=new Map(e.modules.map(a=>[a.path,a.id])),r=e.modules[0]?.id;if(r===void 0)return[];let s=n.map(a=>({source:o.get(a.path)??r,cause:cd[a.code],reach:a.classScope!==void 0?{kind:"class-scope",packageName:a.classScope.packageName,container:a.classScope.container}:a.anchor!==void 0?{kind:"via-module",anchor:a.anchor}:{kind:"unbounded"}}));for(let a of t)s.push({source:r,reach:{kind:"unbounded"},cause:a});return s}function Ss(e,n,t,o,r){let s=t.filter(a=>a.exportName!==null&&(o===1||r||a.verified!==1));return s.length>0?s.map(a=>({advisoryId:e,packageName:n,exportName:a.exportName??"",container:a.container,symbolKind:a.symbolKind,sourcePath:a.sourcePath??"",derivation:a.derivation,confidence:a.confidence,verified:a.verified===1})):t.length===0||t.every(a=>a.exportName!==null&&a.verified===1)?[null]:[]}function og(e,n){let t;try{t=Vt(e)}catch{return!0}let o=3,r=(s,a)=>{if(a>o)return!1;let l;try{l=dd(s)}catch{return!1}for(let i of l){if(i==="node_modules"||i.startsWith("."))continue;let d=hn.join(s,i),u;try{u=ks(d)}catch{continue}if(!u.isDirectory())continue;let p=hn.relative(t,d).split(hn.sep).join("/");try{if(ks(hn.join(d,"package.json")).isFile()&&!n.has(p))return!0}catch{}if(r(d,a+1))return!0}return!1};return r(t,1)}function rg(e,n){let t="";for(let o of e)o.rel!==""&&n.startsWith(`${o.rel}/`)&&o.rel.length>t.length&&(t=o.rel);return t}function sg(e,n,t){let o=[];if(t&&o.push("nested-app-root"),n==="")return[...o,"manifest-unreadable"];let r;try{if(r=Vt(hn.resolve(e,n)),!r.startsWith(Vt(e)+hn.sep))return[...o,"manifest-unreadable"]}catch{return[...o,"manifest-unreadable"]}let s;try{let u=hn.join(r,"package.json");if(!ks(u).isFile())return[...o,"manifest-unreadable"];s=Jh(u,"utf8")}catch{return[...o,"manifest-unreadable"]}let a;try{a=JSON.parse(s)}catch{return[...o,"manifest-unreadable"]}if(typeof a!="object"||a===null)return[...o,"manifest-unreadable"];let l=a;(typeof l.bin=="string"||typeof l.bin=="object"&&l.bin!==null)&&o.push("bin");let i=["preinstall","install","postinstall","prepare","prepublish"],d=l.scripts;if(typeof d=="object"&&d!==null){let u=d;i.some(p=>typeof u[p]=="string")&&o.push("install-script")}return(l.gypfile===!0||ig(r))&&o.push("native-artifact"),o}function ig(e){for(let n of["","build/Release","build/Debug","prebuilds","lib/binding"]){let t=hn.join(e,n),o;try{o=dd(t)}catch{continue}if(o.some(r=>r.endsWith(".node")))return!0}return!1}function ag(e,n){let t=new Set(["npm",...n.ecosystems?.()??[]]),o=[];for(let r of e.perRoot){let s=new Map;for(let a of r.packages){let l=a.ecosystem??"npm";t.has(l)||s.set(l,(s.get(l)??0)+1)}for(let[a,l]of[...s.entries()].sort())o.push({kind:"ecosystem-uncovered",detail:`${r.rootRel===""?"":`${r.rootRel}: `}${String(l)} ${a} distribution(s) were enumerated but the loaded shard carries no ${a} advisories: they were NOT assessed, so this is not a clean bill of health for them. Scan with a ${a} shard to assess them (ADR-109 D5).`,blindsAnalysis:!1,rootRel:r.rootRel})}return o}function ud(e){return JSON.stringify([e.ecosystem??"npm",e.name,e.version,e.lockKey])}function lg(e,n,t){return new Map(n.map(o=>[ud(o),sg(e,o.lockKey,t)]))}function dg(e){let n=new Map;for(let t of e){let o=n.get(t.advisory.id);o===void 0?n.set(t.advisory.id,[t]):o.push(t)}return n}function cg(e,n,t){return n.symbolsDecidable||e.tier!=="not-reachable"||!n.graph.modules.some(r=>r.packageName===t.name)?e:{...e,tier:"unknown",reason:`${t.name} is loaded, and cupel does not yet follow calls in this ecosystem's code \u2014 "no call path found" here is a property of the analysis, not of the application`,unknownKind:"symbol-unsupported",basis:void 0,path:void 0}}function ug(e,n,t,o,r,s,a){let{finding:l}=qt(e,n,{name:t.name,version:t.version,...t.ecosystem!==void 0?{ecosystem:t.ecosystem}:{},devOnly:t.dev,outOfGraphExecution:a(t)},Wt(o.advisory.id,t.name,o.affected),null,r,s);return l.decidedAtStage!=="presence"&&l.decidedAtStage!=="version-match"}function qt(e,n,t,o,r,s,a){let l=or({graph:e,installed:t,range:o,symbol:r,coverage:null,incompleteness:s,analysisAborted:a});if(n!==null&&r!==null&&Es(l,r,"base")){let i=St(e,n.modulesById,n.reachMods,r,n.records);if(i!==null)return{finding:l,hit:i}}return{finding:l,hit:null}}function fg(e,n){let t=new Set,o=[];for(let r of e.packages)if((r.ecosystem??"npm")==="npm")for(let{advisory:s,affected:a}of n.advisoriesForPackage(r.ecosystem??"npm",r.name)){let l=Wt(s.id,r.name,a),i;try{i=jn(r.version,l)}catch{continue}if(i)for(let d of n.symbolsForAffected(a.id)){if(d.verified!==1||d.symbolKind!=="method"&&d.symbolKind!=="ctor"||d.container===null||d.sourcePath===null)continue;let u=`${r.lockKey}\0${d.container}\0${d.sourcePath}`;t.has(u)||(t.add(u),o.push({packageName:r.name,packageRootRel:r.lockKey,container:d.container,sourcePath:d.sourcePath}))}}return o.sort((r,s)=>`${r.packageRootRel}\0${r.container}\0${r.sourcePath}`.localeCompare(`${s.packageRootRel}\0${s.container}\0${s.sourcePath}`)),o.slice(0,So)}function pg(e,n,t){let o=new Map(e.functions.map(l=>[l.id,l])),r=new Map(e.classes.map(l=>[l.id,l.name])),s=new Map(e.callSites.map(l=>[l.id,l])),a=[];for(let l of e.callEdges){if(l.resolution!=="resolved"&&l.resolution!=="field-based")continue;let i=s.get(l.callSiteId);if(i===void 0)continue;let d=o.get(i.enclosingFunctionId);if(d===void 0||!t.has(d.moduleId))continue;let u=n.get(d.moduleId);if(u===void 0)continue;let p=o.get(l.calleeFunctionId);if(p===void 0||p.name===void 0)continue;let f=n.get(p.moduleId);f!==void 0&&f.packageName!==u.packageName&&a.push({packageName:f.packageName,exportName:p.name,container:p.enclosingClassId!==void 0?r.get(p.enclosingClassId)??null:null,resolution:l.resolution,callerFunctionId:d.id})}return a}function mg(e){let n=new Set(e.modules.filter(u=>u.isEntrypoint).map(u=>u.id)),t=new Map(e.modules.map(u=>[u.id,u])),o=new Map(e.functions.map(u=>[u.id,u])),r=new Set;for(let u of e.functions)n.has(u.moduleId)&&(u.publicSurfaceReachable||u.name==="<toplevel>")&&r.add(u.id);let s=new Map(e.exports.map(u=>[u.id,u]));for(let u of e.exportBindings){if(u.target.kind!=="function")continue;let p=s.get(u.exportId);if(p===void 0||!n.has(p.moduleId))continue;let f=o.get(u.target.functionId);f===void 0||t.get(f.moduleId)?.externalSurface===!0||r.add(f.id)}let a=new Map(e.callSites.map(u=>[u.id,u.enclosingFunctionId])),l=new Map;for(let u of e.callEdges){if(u.resolution!=="resolved"&&u.resolution!=="field-based")continue;let p=a.get(u.callSiteId);if(p===void 0)continue;let f=l.get(p);f===void 0?l.set(p,[u.calleeFunctionId]):f.push(u.calleeFunctionId)}let i=new Set(r),d=[...r];for(;d.length>0;){let u=d.pop();if(u!==void 0)for(let p of l.get(u)??[])i.has(p)||(i.add(p),d.push(p))}return i}function hg(e,n,t,o){for(let r of n){if(r.modelId!==e.modelId||r.anchor.packageName!==e.anchorPackage||r.anchor.exportName!==e.entryExport)continue;let s=t.filter(l=>l.packageName===r.anchor.packageName&&l.exportName===r.anchor.exportName&&l.container===r.anchor.container),a=s.find(l=>l.resolution==="resolved")??s[0];if(a!==void 0)return o.has(a.callerFunctionId)}return null}function gg(e,n,t){if(t===void 0||t===!1)return!1;if(t===!0||t==="all")return n>0||e.some(s=>s.modelId!==void 0);let o=new Set(t),r=s=>o.has(s)||o.has(Ge[s]??"");return e.some(s=>s.tier==="unknown"&&s.unknownKind!==void 0&&r(s.unknownKind)||s.modelPromotedFromKind!==void 0&&r(s.modelPromotedFromKind))}function vs(e){let n=Vt(e.dir),t=e.reader??(e.shardPathPypi!==void 0?ir([kt(e.shardPath),kt(e.shardPathPypi)]):kt(e.shardPath)),o=e.partialRows===!0;try{if(!/^\d+$/u.test(t.schemaVersion)||Number(t.schemaVersion)>Number(Bn))throw new dn(`shard schema ${JSON.stringify(t.schemaVersion)} is unreadable or newer than this cupel understands (v${Bn})`);let r=null;if(e.summaryShadow!==void 0)try{r=zl(e.summaryShadow)}catch(F){throw new dn(`--summary-shadow facts dir rejected: ${F instanceof Error?F.message:String(F)}`)}let s=null;if(e.modelShadow!==void 0)try{s=td(e.modelShadow.claimsPath)}catch(F){throw new dn(`--model-shadow claims rejected: ${F instanceof Error?F.message:String(F)}`)}let a=Zr(n,{...e.rootDiscovery,...e.root!==void 0?{operatorRoots:e.root}:{}}),l=kl(n,a,e.installedSet);if(l.truncated){let F=l.perRoot.filter(re=>re.truncated).map(re=>re.rootRel===""?"the scan root":`\`${re.rootRel}\``);throw new dn(`the dependency enumeration hit a hard cap and is incomplete at ${F.length>0?F.join(", "):"the union across roots"} (${l.diagnostics.join("; ")}) \u2014 refusing to report a partial (possibly false-clean) scan`)}let i=Ul(a.roots),d=i?.execution??null,u=wl(l.packages.filter(F=>(F.ecosystem??"npm")==="npm")),p=e.entry??[],f=p.length>0?Ma(n,p):{entrypoints:[],rejected:[]},m=f.rejected,g=Oa(n,a.roots),y=[...new Set([...g.entrypoints,...f.entrypoints])],S=[...g.sources];for(let F of f.entrypoints)g.entrypoints.includes(F)||S.push({source:"--entry",specifier:F,entrypoint:F,launch:!1,root:rg(a.roots,F)});let x=[...S];for(let F of i?.roots??[])for(let re of F.entrypoints)S.push({source:`python:${re.source}`,specifier:re.declaration,entrypoint:F.rootRel===""?re.file:`${F.rootRel}/${re.file}`,launch:re.source==="console-script"||re.source==="launch-declaration",root:F.rootRel});let _=fg(l,t),w=e.bindingForms??Qh,I=e.callablePackageResolver===!0,k=e.tsconfigPaths!==!1,h=og(n,jt(S)),b=lg(n,l.packages,h),A=F=>(F.ecosystem??"npm")!=="npm"?d?.get(F.name)??["manifest-unreadable"]:b.get(ud(F))??["manifest-unreadable"],P=zr({appRoot:n,entrypoints:y,depClassAnchors:_,bindingForms:w,callablePackageResolver:I,tsconfigPaths:k}),v=P.graph,T=tr(v),N=[...g.diagnostics,...qr(g),...Wr(g,y.length),...rs(a,x),...P.diagnostics],j=ad(y.length,v),$=F=>l.packages.some(re=>(re.ecosystem??"npm")===F),D=i===null?"no-entrypoint":i.analysisAborted,K=($("npm")?j:null)??($("PyPI")?D:null)??($("npm")||$("PyPI")?null:j),te=[...l.gaps,...vl(a),...ag(l,t)],B=_l(te),Y=ld(v,N,B),L={graph:zt,incompleteness:[],analysisAborted:"no-entrypoint",symbolsDecidable:!1},O=F=>(F.ecosystem??"npm")==="npm"?{graph:v,incompleteness:Y,analysisAborted:j,symbolsDecidable:!0}:i===null?L:{...i,symbolsDecidable:!0},X=n;try{X=Vt(n)}catch{}let Z=Yl({graph:v,facts:Y,diagnostics:N,analysisAborted:j,loadSites:P.loadSites,conditionUnions:P.conditionUnions,provenAbsent:P.provenAbsent,appRootReal:X,rootBudget:a.budget,causeOf:F=>cd[F]}),H=t.allModels?.()??[],J=bs(H.map(F=>({model:{packageName:F.packageName,modelId:F.modelId,edges:F.edges},introduced:F.introduced,fixedBefore:F.fixedBefore})),u),se=J.models.length>0?Rt(v,J.models).delta:null,oe=se!==null?{records:se.records,reachMods:cn(v),modulesById:new Map(v.modules.map(F=>[F.id,F]))}:null,C=[],Q=new Map,ee=tg(),ue=[],Dn=[];for(let F of l.packages){let re=O(F),ie=(F.ecosystem??"npm")==="npm"?oe:null;for(let[,Ie]of dg(t.advisoriesForPackage(F.ecosystem??"npm",F.name))){let Re=Ie[0];if(Re!==void 0){let be=Q.get(Re.advisory.id),tn=Ie.map(Le=>Le.affected);be===void 0?Q.set(Re.advisory.id,{advisory:Re.advisory,ranges:tn}):be.ranges.push(...tn)}let me=Ie.filter(be=>ug(re.graph,ie,F,be,re.incompleteness,re.analysisAborted,A)),nn=me.length>0?me:Ie.slice(0,1),gn=me.length===0;for(let{advisory:be,affected:tn}of nn){let Le=Wt(be.id,F.name,tn),yn=be.cveId??be.id,Ln=gn?[]:t.symbolsForAffected(tn.id),gt=Ln.filter(xe=>xe.exportName===null),xn=Ss(be.id,F.name,Ln,tn.surfaceComplete,o),bn=qt(re.graph,ie,{name:F.name,version:F.version,...F.ecosystem!==void 0?{ecosystem:F.ecosystem}:{},devOnly:F.dev,outOfGraphExecution:A(F)},Le,null,re.incompleteness,re.analysisAborted).finding;if(bn.decidedAtStage==="presence"||bn.decidedAtStage==="version-match"){ee[bn.tier]+=1,C.push({...bn,modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:Le.surfaceComplete,advisoryId:be.id,displayId:yn,packageName:F.name,version:F.version,ecosystem:F.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:be.severity,packageLocation:Oo(l,F)});continue}for(let xe of xn){let{finding:on,hit:Ve}=qt(re.graph,ie,{name:F.name,version:F.version,...F.ecosystem!==void 0?{ecosystem:F.ecosystem}:{},devOnly:F.dev,outOfGraphExecution:A(F)},Le,xe,re.incompleteness,re.analysisAborted),z=cg(on,re,F),ne,ce;Ve!==null&&xe!==null&&(ne=Ve.modelId,ce=on.unknownKind,z={basis:void 0,tier:Ve.tier,decidedAtStage:on.decidedAtStage,reason:`boundary model ${Ve.modelId}: ${Ve.anchorPackage}.${Ve.entryExport} reaches ${xe.exportName} [${Ve.pathLabels.join(" \u2192 ")}]`,unknownKind:void 0,attribution:ro(xe),path:void 0,unresolvedSites:on.unresolvedSites,unresolvedEvidence:on.unresolvedEvidence}),ee[z.tier]+=1;let Pe=Jl(Z,z,xe,A(F).length,Le.surfaceComplete),pe={...z,...Pe!==void 0?{adr105:Pe}:{},modelId:ne,modelPromotedFromKind:ce,surfaceComplete:Le.surfaceComplete,advisoryId:be.id,displayId:yn,packageName:F.name,version:F.version,ecosystem:F.ecosystem??"npm",symbolName:xe?.exportName??null,symbolPath:xe?.sourcePath||null,symbolContainer:xe?.container??null,severity:be.severity,packageLocation:Oo(l,F)};C.push(pe);let fe=new Set(["dep-opaque","dynamic-load","dispatch"]);r!==null&&pe.tier==="unknown"&&pe.decidedAtStage==="symbol-reachable"&&pe.unknownKind!==void 0&&fe.has(pe.unknownKind)&&xe!==null&&ue.push({finding:pe,symbol:xe}),s!==null&&pe.tier==="unknown"&&xe!==null&&Dn.push({finding:pe,symbol:xe})}for(let xe of gt)ee.unknown+=1,C.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:Le.surfaceComplete,tier:"unknown",decidedAtStage:"symbol-reachable",reason:`advisory ${yn} carries a ${xe.symbolKind} pattern symbol; pattern matching is not evaluated yet`,unknownKind:"symbol-unsupported",attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:be.id,displayId:yn,packageName:F.name,version:F.version,ecosystem:F.ecosystem??"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:be.severity,packageLocation:Oo(l,F)})}}}for(let F of te)ee.unknown+=1,C.push({modelId:void 0,modelPromotedFromKind:void 0,surfaceComplete:void 0,tier:"unknown",decidedAtStage:"presence",reason:F.detail,attribution:void 0,basis:void 0,path:void 0,unresolvedSites:[],unresolvedEvidence:{own:[],sets:[]},advisoryId:ws,displayId:ws,packageName:F.kind,version:"",ecosystem:"npm",symbolName:null,symbolPath:null,symbolContainer:null,severity:null,unknownKind:"coverage-gap",packageLocation:El(l,F)});let Zn=ee["reachable-high"]+ee["reachable-medium"],R=e.failOnReachable===!0&&Zn>0,M=gg(C,ee.unknown,e.failOnUnknown),U=e.requireCompleteDenial===!0&&C.some(F=>F.tier==="not-reachable"&&F.basis==="loader-assumption"),G=R||M||U?2:0,de;if(r!==null){let F=cn(v),re=new Map(v.modules.map(Ie=>[Ie.id,Ie])),ie=[];for(let{finding:Ie,symbol:Re}of ue){let me=er(v,re,F,Re,r,Zh);ie.push({advisoryId:Ie.advisoryId,packageName:Ie.packageName,symbolName:Ie.symbolName,unknownKind:Ie.unknownKind??null,wouldPromote:me!==null,...me!==null?{anchorPackage:me.anchorPackage,entryExport:me.entryExport,viaPackages:me.viaPackages,totalHops:me.totalHops}:{}})}de={records:ie}}let ye;if(s!==null&&e.modelShadow!==void 0){let F=e.modelShadow.widened===!0?"widened":"base",{models:re,notes:ie,dispositions:Ie}=bs(s,u,{shadowConsultDenylisted:!0}),{delta:Re}=Rt(v,re),me=cn(v),nn=new Map(v.modules.map(z=>[z.id,z])),gn=pg(v,nn,me),be=mg(v),tn=Re.records.some(z=>gn.some(ne=>ne.packageName===z.anchor.packageName&&ne.exportName===z.anchor.exportName&&ne.container===z.anchor.container)),Le=[],yn=Date.now();for(let{finding:z,symbol:ne}of Dn){let ce=Re.records,Pe=Es(z,ne,F),pe=Pe?St(v,nn,me,ne,ce):null,fe=Re.records.filter(Ce=>Ce.callee.packageName===ne.packageName&&Ce.callee.exportName===ne.exportName&&Ce.callee.container===ne.container||Ce.callee.packageName===ne.packageName&&Ce.callee.realFunctionId!==null);Le.push({advisoryId:z.advisoryId,packageName:z.packageName,symbolName:z.symbolName,unknownKind:z.unknownKind??null,decidedAtStage:z.decidedAtStage,consultSurface:F,noHitReason:pe!==null?null:Pe?tn?"no-key-match-no-continuation":"no-matching-anchor":"not-eligible-base",anchorFunctionEntryReachable:pe!==null?hg(pe,ce,gn,be):null,verdictBefore:z.tier,verdictAfter:pe!==null?"reachable-low":z.tier,wouldPromote:pe!==null,...pe!==null?{modelId:pe.modelId,anchorPackage:pe.anchorPackage,entryExport:pe.entryExport,pathLabels:pe.pathLabels,calleeBinding:fe.find(Ce=>Ce.callee.realFunctionId!==null)?.callee.realFunctionId??"key:any-installed-in-range-copy"}:Pe?fe.length>0?{reason:"model-covers-symbol-but-no-baseline-anchor",nearestBlockedHop:`anchor:${fe[0]?.anchor.packageName??"?"}#${fe[0]?.anchor.exportName??"?"} (no resolved|field-based baseline edge from a reachable module)`}:{reason:"no-model-coverage"}:{}})}let Ln=Date.now()-yn,gt=Ie.map(z=>{if(z.status!=="active")return{modelId:z.modelId,state:z.status,reason:z.reason,edgesLowered:0,edgesReferenceGated:0};let ne=Re.records.filter(Pe=>Pe.modelId===z.modelId).length;if(ne>0)return{modelId:z.modelId,state:"lowered",reason:null,edgesLowered:ne,edgesReferenceGated:z.edgeCount-ne};let ce=Re.notes.find(Pe=>Pe.startsWith(`model ${z.modelId}:`)||Pe.startsWith(`model-edge ${z.modelId}:`));return{modelId:z.modelId,state:"refused",reason:ce??"refused \u2014 no anchor surface in the graph (all edges reference-gated)",edgesLowered:0,edgesReferenceGated:z.edgeCount}}),xn=Le.filter(z=>z.wouldPromote).length,bn=ee.unknown-xn,xe=ee["reachable-high"]+ee["reachable-medium"],on=z=>({none:0,"fail-on-reachable":xe>0?2:0,"fail-on-unknown":z>0?2:0,both:xe>0||z>0?2:0});ye={records:Le,notes:[...ie,...Re.notes],laneStates:gt,exitCodes:{baseline:on(ee.unknown),withModels:on(bn)},overlayWallMs:Ln},rd(hn.dirname(e.modelShadow.outPath),{recursive:!0});let Ve=`${e.modelShadow.outPath}.tmp-${od(8).toString("hex")}`;id(Ve,`${JSON.stringify(ye,null,2)}
+`,{encoding:"utf8",flag:"wx"}),sd(Ve,e.modelShadow.outPath)}let De;if(e.bindingShadow!==void 0){let F=Date.now(),re=z=>J.models.length>0?{records:Rt(z,J.models).delta.records,reachMods:cn(z),modulesById:new Map(z.modules.map(ne=>[ne.id,ne]))}:null,ie=(z,ne,ce,Pe)=>{let pe=[];for(let fe of l.packages)for(let{advisory:Ce,affected:Fn}of t.advisoriesForPackage(fe.ecosystem??"npm",fe.name)){let Qn=Wt(Ce.id,fe.name,Fn),rc=Ss(Ce.id,fe.name,t.symbolsForAffected(Fn.id),Fn.surfaceComplete,o);for(let Hs of rc){let{finding:Xs,hit:Zo}=qt(z,Pe,{name:fe.name,version:fe.version,...fe.ecosystem!==void 0?{ecosystem:fe.ecosystem}:{},devOnly:fe.dev,outOfGraphExecution:A(fe)},Qn,Hs,ne,ce);pe.push({advisoryId:Ce.id,packageName:fe.name,symbolName:Hs?.exportName??null,tier:Zo!==null?Zo.tier:Xs.tier,unknownKind:Zo!==null?null:Xs.unknownKind??null})}}return pe},Ie=z=>{let ne=zr({appRoot:n,entrypoints:y,depClassAnchors:_,bindingForms:z,callablePackageResolver:I,tsconfigPaths:k}),ce=[...g.diagnostics,...qr(g),...Wr(g,y.length),...rs(a,x),...ne.diagnostics];return{graph:ne.graph,inc:ld(ne.graph,ce,B),aborted:ad(y.length,ne.graph),live:re(ne.graph),applicability:ne.bindingApplicability}},Re=z=>{let ne=Ie(z);return ie(ne.graph,ne.inc,ne.aborted,ne.live)},me=Ie({}),nn=ie(me.graph,me.inc,me.aborted,me.live),gn=ie(v,Y,j,oe);if(gn.length!==nn.length)throw new dn("--binding-shadow dual-run row counts diverged; refusing to write a misaligned diff");let be=(z,ne)=>ne.tier!==z.tier||ne.unknownKind!==z.unknownKind,tn=nn.some((z,ne)=>{let ce=gn[ne];return ce!==void 0&&be(z,ce)}),Le=tn?Re({additiveForms:!0}):null,yn=tn?Re({namelessExports:!0}):null,Ln=0,gt=nn.map((z,ne)=>{let ce=gn[ne];if(ce===void 0||ce.advisoryId!==z.advisoryId||ce.packageName!==z.packageName||ce.symbolName!==z.symbolName)throw new dn("--binding-shadow dual-run row identities diverged; refusing to write a misaligned diff");let Pe={advisoryId:z.advisoryId,packageName:z.packageName,symbolName:z.symbolName,unknownKind:z.unknownKind,verdictBefore:z.tier,verdictAfter:ce.tier,wouldPromote:ce.tier!==z.tier&&(ce.tier==="reachable-high"||ce.tier==="reachable-medium"||ce.tier==="reachable-low")};if(!be(z,ce)||Le===null||yn===null)return Pe;Ln+=1;let pe=Le[ne],fe=yn[ne],Ce=pe!==void 0&&be(z,pe),Fn=fe!==void 0&&be(z,fe);return{...Pe,attributedArm:Ce&&!Fn?"additiveForms":Fn&&!Ce?"namelessExports":"both",...pe!==void 0?{verdictArmA:pe.tier}:{},...fe!==void 0?{verdictArmB:fe.tier}:{}}}),xn={...ee};nn.forEach((z,ne)=>{let ce=gn[ne];ce!==void 0&&ce.tier!==z.tier&&(xn[ce.tier]-=1,xn[z.tier]+=1)});let bn=(z,ne)=>({none:0,"fail-on-reachable":z>0?2:0,"fail-on-unknown":ne>0?2:0,both:z>0||ne>0?2:0}),xe;if(J.models.length>0&&oe!==null){xe=[];for(let z of l.packages)for(let{advisory:ne,affected:ce}of t.advisoriesForPackage(z.ecosystem??"npm",z.name)){let Pe=Wt(ne.id,z.name,ce),pe=Ss(ne.id,z.name,t.symbolsForAffected(ce.id),ce.surfaceComplete,o);for(let fe of pe){if(fe===null||!fe.verified)continue;let Ce=qt(me.graph,me.live,{name:z.name,version:z.version,...z.ecosystem!==void 0?{ecosystem:z.ecosystem}:{},devOnly:z.dev,outOfGraphExecution:A(z)},Pe,fe,me.inc,me.aborted);if(!(Ce.hit===null&&Es(Ce.finding,fe,"base")))continue;let Qn=St(v,oe.modulesById,oe.reachMods,fe,oe.records);xe.push({advisoryId:ne.id,packageName:z.name,symbolName:fe.exportName,modelWouldPromote:Qn!==null,...Qn!==null?{modelId:Qn.modelId}:{},anchorCleared:Qn!==null})}}}let on=C.some(z=>z.modelId!==void 0);De={records:gt,deltas:Ln,exitCodes:{baseline:bn(xn["reachable-high"]+xn["reachable-medium"],xn.unknown+(on?1:0)),withBindingForms:bn(ee["reachable-high"]+ee["reachable-medium"],ee.unknown+(on?1:0))},dualRunWallMs:Date.now()-F,...P.bindingApplicability!==void 0?{applicability:P.bindingApplicability}:{},...xe!==void 0?{modelProbe:xe}:{}},rd(hn.dirname(e.bindingShadow.outPath),{recursive:!0});let Ve=`${e.bindingShadow.outPath}.tmp-${od(8).toString("hex")}`;id(Ve,`${JSON.stringify(De,null,2)}
+`,{encoding:"utf8",flag:"wx"}),sd(Ve,e.bindingShadow.outPath)}let en=H.length>0||J.notes.length>0?{active:J.models.length,stored:H.length,promoted:C.filter(F=>F.modelId!==void 0).length,notes:[...J.notes,...se!==null?se.notes:[]]}:void 0;return{...de!==void 0?{summaryShadow:de}:{},...ye!==void 0?{modelShadow:ye}:{},...De!==void 0?{bindingShadow:De}:{},...en!==void 0?{modelLane:en}:{},dir:n,shardSchemaVersion:t.schemaVersion,installed:l,findings:C,counts:ee,analyzerDiagnostics:N,pythonDiagnostics:i?.diagnostics??[],analysisAborted:K,rejectedEntries:m,entrypointSources:S,entrypointGaps:[...g.gaps,...g.surfaceGaps],entrypointObservations:g.observations,framework:g.framework,unresolved:T,advisories:[...Q.values()],rootSet:a,exitCode:G,adr105:Z.report}}finally{e.reader===void 0&&t.close()}}var yg="cupel",xg="reachability-first SCA \u2014 verdict + call path + confidence";function _s(e){return[`${yg} v${e} \u2014 ${xg}`,`cascade: ${ri.join(" \u2192 ")}`,`verdicts: ${si.join(", ")}`,"","usage: cupel scan <dir> [--shard <npm.sqlite>] [--sarif <file>] [--fail-on-reachable] [--fail-on-unknown]","  --shard               path to the npm symbol shard (or set CUPEL_SHARD_NPM)","  --shard-pypi          path to the PyPI shard (or set CUPEL_SHARD_PYPI); Python distributions","                        found in a .venv are assessed against it, else reported as not assessed","  --sarif               also write a SARIF 2.1.0 report","  --fail-on-reachable   exit 2 when any reachable finding is present (for CI)","  --fail-on-unknown     exit 2 when any unknown verdict is present (strict CI)","","       cupel login     store a delivery token for this machine (read from stdin)","       cupel logout    forget it","  On GitHub Actions neither is needed: the workflow authenticates with a token GitHub","  signs per run. Elsewhere a scan fetches the advisory database with the stored token,","  or CUPEL_DELIVERY_TOKEN, or works offline from a shard you already have (--shard)."].join(`
+`)}var bg=new Set([...rr,...sr]);function vn(e,n,t){let o=e[n+1];if(o===void 0||o.startsWith("--"))throw new Error(`${t} requires a value`);return o}function Sg(e){let n=e.split(",").map(r=>r.trim()),t=[...rr,...sr].join(", ");if(n.length===0||n.some(r=>r===""))throw new Error(`--fail-on-unknown= requires a non-empty comma-separated list of: ${t} (or pass the bare --fail-on-unknown to fail on every kind)`);let o=[];for(let r of n){if(!bg.has(r))throw new Error(`unknown --fail-on-unknown selector ${JSON.stringify(r)}; valid: ${t}`);o.push(r)}return o}function fd(e){let n=".",t,o,r,s=!1,a=!1,l=!1,i=!1,d=!1,u,p,f,m=!1,g=!1,y,S=!1,x=!0,_=!1,w,I=[],k=[];for(let h=0;h<e.length;h+=1){let b=e[h];if(b==="--require-complete-denial"){a=!0;continue}if(b==="--fail-on-reachable")s=!0;else if(b==="--fail-on-unknown")l="all";else if(b!==void 0&&b.startsWith("--fail-on-unknown="))l=Sg(b.slice(18));else if(b==="--offline")i=!0;else if(b==="--sarif")t=vn(e,h,"--sarif"),h+=1;else if(b==="--shard")o=vn(e,h,"--shard"),h+=1;else if(b==="--shard-pypi")r=vn(e,h,"--shard-pypi"),h+=1;else if(b==="--entry")I.push(vn(e,h,"--entry")),h+=1;else if(b==="--root")k.push(vn(e,h,"--root")),h+=1;else if(b==="--summary-shadow")u=vn(e,h,"--summary-shadow"),h+=1;else if(b==="--model-shadow")p=vn(e,h,"--model-shadow"),h+=1;else if(b==="--model-shadow-out")f=vn(e,h,"--model-shadow-out"),h+=1;else if(b==="--model-shadow-widened")m=!0;else if(b==="--binding-shadow")g=!0;else if(b==="--binding-shadow-out")y=vn(e,h,"--binding-shadow-out"),h+=1;else if(b==="--x-partial-rows")S=!0;else if(b==="--no-tsconfig-paths")x=!1;else if(b==="--x-tsconfig-paths")x=!0;else if(b==="--push")_=!0;else if(b!==void 0&&b.startsWith("--auth=")){let A=b.slice(7);if(A!=="oidc"&&A!=="token")throw new Error(`--auth must be oidc or token, got ${JSON.stringify(A)}`);w=A}else{if(b!==void 0&&b.startsWith("--"))throw new Error(`unknown flag ${b}`);b!==void 0&&!d&&(n=b,d=!0)}}if(p===void 0!=(f===void 0))throw new Error("--model-shadow and --model-shadow-out must be given together");if(m&&p===void 0)throw new Error("--model-shadow-widened only means something with --model-shadow");if(g!==(y!==void 0))throw new Error("--binding-shadow and --binding-shadow-out must be given together");if(w!==void 0&&!_)throw new Error("--auth only means something with --push");return{dir:n,sarif:t,shard:o,shardPypi:r,failOnReachable:s,requireCompleteDenial:a,failOnUnknown:l,offline:i,entry:I,root:k,summaryShadow:u,modelShadow:p,modelShadowOut:f,modelShadowWidened:m,push:_,auth:w,bindingShadow:g,bindingShadowOut:y,partialRows:S,tsconfigPaths:x}}import{chmodSync as Ag,mkdirSync as Ng,readFileSync as Rg,renameSync as Pg,statSync as $g,unlinkSync as Cg,writeFileSync as Og}from"node:fs";import{randomBytes as Mg}from"node:crypto";import{homedir as Tg}from"node:os";import Yn from"node:path";import{createPublicKey as kg,verify as Eg}from"node:crypto";function Ze(e,n){let t=new URL(e);if(t.protocol!=="https:")throw new Error(`refusing non-https url: ${e}`);if(t.username!==""||t.password!=="")throw new Error(`refusing url carrying userinfo for host ${t.hostname}`);if(t.port!=="")throw new Error(`refusing url with explicit port ${t.port} for host ${t.hostname}`);if(!n.has(t.hostname))throw new Error(`refusing unpinned host ${t.hostname} (allowed: ${[...n].join(", ")})`);if(t.origin!==`https://${t.hostname}`)throw new Error(`refusing non-canonical authority for host ${t.hostname}`);return t}async function pd(e,n={}){let t=n.maxBytes??1073741824,o=n.timeoutMs??3e4,{get:r}=await import("node:https");return await new Promise((s,a)=>{let l=r(e,n.headers!==void 0?{headers:n.headers}:{},i=>{let d=i.statusCode??0;if(d<200||d>=300){i.resume(),a(new Error(`GET ${e} \u2192 HTTP ${String(d)}`));return}let u=[],p=0;i.on("data",f=>{if(p+=f.length,p>t){i.destroy(),a(new Error(`GET ${e} exceeded ${String(t)} bytes`));return}u.push(f)}),i.on("end",()=>{s(Buffer.concat(u))}),i.on("error",a)});l.on("error",a),l.setTimeout(o,()=>{l.destroy(new Error(`GET ${e} timed out after ${String(o)}ms`))})})}async function Gt(e,n,t,o,r,s=3e4){let{request:a}=await import("node:https"),l=new URL(n).hostname;return await new Promise((i,d)=>{let u=a(n,{method:e,headers:t},p=>{let f=[],m=0;p.on("data",g=>{if(m+=g.length,m>r){p.destroy(),d(new Error(`${e} to ${l} returned more than ${String(r)} bytes`));return}f.push(g)}),p.on("end",()=>{i({status:p.statusCode??0,body:Buffer.concat(f).toString("utf8")})}),p.on("error",()=>{d(new Error(`${e} to ${l} failed`))})});u.on("error",()=>{d(new Error(`${e} to ${l} failed`))}),u.setTimeout(s,()=>{u.destroy(new Error(`${e} to ${l} timed out after ${String(s)}ms`))}),o!==void 0&&u.write(o),u.end()})}var ae=class extends Error{constructor(n){super(n),this.name="DistError"}},Xn=class extends ae{constructor(n){super(n),this.name="NoCachedShardError"}},wg=Buffer.from("302a300506032b6570032100","hex"),vg=32;function yd(e){let n;try{n=Buffer.from(e,"base64")}catch{return}if(n.length===vg)try{return kg({key:Buffer.concat([wg,n]),format:"der",type:"spki"})}catch{return}}function Is(e,n,t){for(let o of t){let r=yd(o);if(r!==void 0)try{if(Eg(null,e,r,n))return!0}catch{}}return!1}function xd(e){return e.some(n=>yd(n)!==void 0)}var _g=/^[0-9a-f]{64}$/u,Ig=/^[a-z0-9-]+$/u;function md(e,n){if(typeof e!="object"||e===null||Array.isArray(e))throw new ae(`${n} must be an object`);return e}function hd(e,n){if(!Array.isArray(e))throw new ae(`${n} must be an array`);return e}function Bo(e,n){if(typeof e!="number"||!Number.isInteger(e))throw new ae(`${n} must be an integer`);return e}function Ko(e,n){if(typeof e!="string")throw new ae(`${n} must be a string`);return e}function gd(e,n){let t=Ko(e,n);if(Number.isNaN(Date.parse(t)))throw new ae(`${n} is not a valid timestamp: ${t}`);return t}function As(e,n){let t;try{t=JSON.parse(e.toString("utf8"))}catch{throw new ae("distribution index is not valid JSON")}let o=md(t,"index"),r=Bo(o.schema_version,"schema_version");if(r!==n.supportedIndexSchemaVersion)throw new ae(`index schema_version ${String(r)} is not understood (this cupel speaks ${String(n.supportedIndexSchemaVersion)})`);let s=Bo(o.sequence,"sequence");if(s<0)throw new ae("sequence must be non-negative");let a=gd(o.generated,"generated"),l=hd(o.shards,"shards"),i;for(let g of l){let y=md(g,"shard entry"),S=Ko(y.ecosystem,"ecosystem");if(!Ig.test(S))throw new ae(`ecosystem ${JSON.stringify(S)} is malformed`);if(S===n.ecosystem){i=y;break}}if(i===void 0)throw new ae(`no shard for ecosystem ${JSON.stringify(n.ecosystem)}`);gd(i.built,"built");let d=Bo(i.db_schema_version,"db_schema_version");if(d<1)throw new ae("db_schema_version must be >= 1");if(d>n.supportedDbSchemaVersion)throw new ae(`this shard needs a newer cupel (db_schema_version ${String(d)} > supported ${String(n.supportedDbSchemaVersion)}); upgrade cupel (npm i -g @cupel-sh/cli) or pass an older --shard`);let u=Ko(i.sha256,"sha256");if(!_g.test(u))throw new ae(`sha256 must be 64 lowercase hex, got ${JSON.stringify(u)}`);let p=Bo(i.size_bytes,"size_bytes");if(p<=0||p>n.hardMaxBytes)throw new ae(`size_bytes ${String(p)} out of bounds (0, ${String(n.hardMaxBytes)}]`);let f=hd(i.urls,"urls");if(f.length===0)throw new ae("urls must be a non-empty array");let m=[];for(let g of f){let y=Ko(g,"url");try{m.push(Ze(y,n.shardHosts))}catch(S){throw new ae(`refusing shard url ${JSON.stringify(y)}: ${S.message}`)}}return{ecosystem:n.ecosystem,sha256:u,sizeBytes:p,dbSchemaVersion:d,urls:m,sequence:s,generated:a}}var bd="CUPEL_CONFIG_DIR",Sd="credentials.json",Ns="cpd_",Dg="cpl_",Lg=Ns.length+6+32,Fg=200,jg=/^[A-Za-z0-9_-]+$/u,Ht=class extends ae{constructor(n){super(n),this.name="StoredCredentialError"}};function kd(e){let n=e.CUPEL_CONFIG_DIR;if(n!==void 0&&n!=="")return n;let t=Tg();if(process.platform==="darwin")return Yn.join(t,"Library","Application Support","cupel");if(process.platform==="win32"){let s=e.APPDATA,a=s!==void 0&&s!==""?s:Yn.join(t,"AppData","Roaming");return Yn.join(a,"cupel")}let o=e.XDG_CONFIG_HOME,r=o!==void 0&&o!==""?o:Yn.join(t,".config");return Yn.join(r,"cupel")}function Uo(e){return Yn.join(kd(e),Sd)}function Rs(e){let n=e.trim();return n.startsWith(Dg)?{ok:!1,reason:"push-token"}:n.startsWith(Ns)?n.length<Lg||n.length>Fg?{ok:!1,reason:"malformed"}:jg.test(n.slice(Ns.length))?{ok:!0,token:n}:{ok:!1,reason:"malformed"}:{ok:!1,reason:"malformed"}}function Ed(e,n){let t=kd(e),o=Yn.join(t,Sd);Ng(t,{recursive:!0,mode:448}),process.platform!=="win32"&&Ag(t,448);let r=JSON.stringify({version:1,delivery_token:n,written_at:new Date().toISOString()}),s=`${o}.tmp-${Mg(8).toString("hex")}`;return Og(s,`${r}
+`,{flag:"wx",mode:384}),Pg(s,o),o}function wd(e){let n=Uo(e),t;try{t=$g(n)}catch(a){if(a instanceof Error&&a.code==="ENOENT")return;throw a}if(process.platform!=="win32"&&(t.mode&63)!==0)throw new Ht(`the stored delivery token at ${n} is readable by other users \u2014 run \`chmod 600 ${n}\`, or \`cupel login\` again to rewrite it`);let o;try{o=JSON.parse(Rg(n,"utf8"))}catch{throw new Ht(`the stored delivery token at ${n} is not readable \u2014 run \`cupel login\` again to rewrite it`)}let r=typeof o=="object"&&o!==null&&"delivery_token"in o?o.delivery_token:void 0,s=Rs(typeof r=="string"?r:"");if(!s.ok)throw new Ht(`the stored credential at ${n} is not a delivery token \u2014 run \`cupel login\` with one from app.cupel.sh (Settings \u2192 Tokens)`);return s.token}function vd(e){try{return Cg(Uo(e)),!0}catch(n){if(n instanceof Error&&n.code==="ENOENT")return!1;throw n}}var Xt="CUPEL_DELIVERY_TOKEN",Ps=class extends ae{constructor(n){super(n),this.name="NoDeliveryTokenError"}},$s=class extends ae{constructor(n){super(n),this.name="DeliveryCredentialError"}};function Bg(e){let n=e.CUPEL_DELIVERY_TOKEN;return n===void 0||n===""?void 0:n}function _d(e,n,t=()=>{}){let o=Bg(e)??t();return o!==void 0?()=>Promise.resolve(o):e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!==""?n:void 0}async function Id(e){if(e===void 0)throw new Ps(`no delivery credential \u2014 on GitHub Actions add \`permissions: id-token: write\` to the workflow; elsewhere run \`cupel login\` with a delivery token from app.cupel.sh (Settings \u2192 Tokens), or set ${Xt} in CI; or pass --shard <path> (a local shard needs no account)`);try{return await e()}catch(n){throw new $s(`could not obtain a delivery credential: ${n instanceof Error?n.message:String(n)}`)}}var Kg="Paste a delivery token from app.cupel.sh (Settings \u2192 Tokens); input is hidden: ";function Ug(){return new Promise(e=>{let n=process.stdin;process.stderr.write(Kg),n.setRawMode(!0),n.resume(),n.setEncoding("utf8");let t="",o=s=>{n.setRawMode(!1),n.pause(),n.removeListener("data",r),process.stderr.write(`
 `),s===null&&process.exit(130),e(s)},r=s=>{for(let a of s){if(a==="")return o(null);if(a==="\r"||a===`
-`)return o(t);if(a==="\x7F"||a==="\b"){t=t.slice(0,-1);continue}t+=a}};n.on("data",r)})}async function _g(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function xd(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${W(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
-`),!0)}async function Sd(e){if(xd(e,"login"))return 1;let n=process.stdin.isTTY?await Ag():await _g(),t=ks(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
+`)return o(t);if(a==="\x7F"||a==="\b"){t=t.slice(0,-1);continue}t+=a}};n.on("data",r)})}async function zg(){let e=[];for await(let t of process.stdin)e.push(Buffer.isBuffer(t)?t:Buffer.from(String(t),"utf8"));return Buffer.concat(e).toString("utf8").split(/\r?\n/u).find(t=>t.trim()!=="")??""}function Ad(e,n){let t=e[0];return t===void 0?!1:(process.stderr.write(`cupel ${n}: unknown option '${q(t)}' \u2014 the token is read from standard input, never from an argument (it would land in shell history and \`ps\`)
+`),!0)}async function Nd(e){if(Ad(e,"login"))return 1;let n=process.stdin.isTTY?await Ug():await zg(),t=Rs(n);if(!t.ok)return process.stderr.write(t.reason==="push-token"?`cupel login: that is a push token (cpl_\u2026), which authenticates one repository's findings push and is set as CUPEL_TOKEN in CI. Sign in with a delivery token (cpd_\u2026) from app.cupel.sh \u2014 Settings \u2192 Tokens \u2014 which fetches the advisory database for the whole organisation.
 `:`cupel login: that is not a delivery token. Paste the whole token as shown once on app.cupel.sh (Settings \u2192 Tokens); it starts with cpd_.
-`),1;let o=pd(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${o} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${Gt} in the environment still wins, and \`cupel logout\` forgets it.
-`),0}function bd(e){if(xd(e,"logout"))return 1;let n=Lo(process.env);return hd(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
-`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${cd} would point elsewhere).
-`),0}import ly from"node:path";import{randomBytes as Ng,createHash as Rg}from"node:crypto";import{mkdirSync as Pg,readFileSync as $g,renameSync as Og,writeFileSync as Cg}from"node:fs";import{homedir as Mg}from"node:os";import Xn from"node:path";var vs="latest.json",Is="latest.json.sig";function Fo(e){return Rg("sha256").update(e).digest("hex")}function As(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=Mg();if(process.platform==="darwin")return Xn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,s=r!==void 0&&r!==""?r:Xn.join(n,"AppData","Local");return Xn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,o=t!==void 0&&t!==""?t:Xn.join(n,".cache");return Xn.join(o,"cupel","shards")}function _s(e,n,t){return Xn.join(e,`${n}-${t}.sqlite`)}function jo(e,n){Pg(Xn.dirname(e),{recursive:!0});let t=`${e}.tmp-${Ng(8).toString("hex")}`;Cg(t,n,{flag:"wx"}),Og(t,e)}function Ht(e){try{return $g(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function kd(e,n,t,o){let r=_s(e,n,t),s=Ht(r);if(s===void 0)return;let a=Fo(s);if(a!==t)throw o(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:r,bytes:s}}var Ed="api.cupel.sh",Bo=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),wd=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Ko from"node:path";var Tg="/v1/resolve",Ns=1024*1024,Rs=4096,vd=Ns+Rs+64*1024,Dg=8,Lg=2048,Fg=/^[A-Za-z0-9+/]+={0,2}$/u,jg=3e4,Pe=class extends ie{constructor(n){super(n),this.name="DeliveryRefusedError"}},Xt=class extends Pe{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},Yt=class extends ie{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Jt=class extends ie{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function Bg(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Kg(e){if(typeof e!="string"||e.length===0)throw new Pe("the delivery response carried no index signature");if(e.length>Rs||!Fg.test(e))throw new Pe("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new Pe("the delivery response's index signature is not canonical base64");return n}function Ug(e){if(typeof e!="string"||e.length===0)throw new Pe("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Ns)throw new Pe("the delivery response's index is larger than one can be");return n}function zg(e){if(!Array.isArray(e)||e.length===0)throw new Pe("the delivery response named no shard urls");if(e.length>Dg)throw new Pe("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>Lg)throw new Pe("the delivery response carried a malformed shard url");n.push(t)}return n}function Wg(e,n){throw e===401||e===403?new Pe(`${n} rejected the delivery credential \u2014 check ${Gt} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new Xt(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Jt(`${n} holds nothing newer than the shard index already cached`):e===429?new Yt(`${n} rate-limited the delivery request`):e>=500?new Yt(`${n} answered ${String(e)}`):new Pe(`${n} refused the delivery request with status ${String(e)}`)}async function Id(e,n,t,o,r=jg){let s=Ye(`https://${e}${Tg}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await o(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,r)}catch{throw new Yt(`${e} could not be reached`)}if(l.status!==200&&Wg(l.status,e),Buffer.byteLength(l.body,"utf8")>vd)throw new Pe(`${e} returned a delivery response larger than one can be`);let i;try{i=JSON.parse(l.body)}catch{throw new Pe(`${e} returned a delivery response that is not JSON`)}if(!Bg(i))throw new Pe(`${e} returned a delivery response that is not an object`);return{index:Ug(i.index),sig:Kg(i.signature),shardUrls:zg(i.shardUrls)}}var Ad=async(e,n,t,o)=>await Vt("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,vd,o);var Vg=8,$s=class extends ie{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Ps(e){return`${e.origin}${e.pathname}`}function _d(e,n,t){let o=new Map;for(let a of n)o.set(Ps(a),a);let r=[],s=[];for(let a of e.slice(0,Vg)){let l;try{l=Ye(a,t)}catch(u){s.push(u.message);continue}if(l.hash!==""){s.push("a candidate carried a fragment");continue}let i=o.get(Ps(l));if(i===void 0){s.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${Ps(i)}${l.search}`);r.push(Ye(d.href,t))}if(r.length===0)throw new $s(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return r}var Gg=1,Hg=1024*1024*1024;function Xg(e=Bo){return{async resolve(n){return await Id(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Ad)},async fetchShard(n,t){return Ye(n.href,e),await rd(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Os(e){return e instanceof Error?e.message:String(e)}function Nd(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:Gg,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:Hg}}function Yg(e){let n=Ht(Ko.join(e.cacheDir,vs)),t=Ht(Ko.join(e.cacheDir,Is));if(!(n===void 0||t===void 0)&&xs(n,t,e.pubkeys))try{return Ss(n,Nd(e))}catch{return}}function Rd(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let o=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(o)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Uo(e,n,t){let o=kd(n.cacheDir,e.ecosystem,e.sha256,r=>new ie(r));if(o===void 0)throw new ie(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:o.path,fromCache:!0,warnings:[...t,...Rd(e,n)],sequence:e.sequence}}async function Jg(e,n,t,o){let r=_s(t.cacheDir,e.ecosystem,e.sha256),s=Ht(r);if(s!==void 0&&Fo(s)===e.sha256)return{path:r,downloaded:!1};let a="no shard urls";for(let l of n){let i;try{i=await o.fetchShard(l,e.sizeBytes)}catch(u){a=Os(u);continue}let d=Fo(i);if(d!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return jo(r,i),{path:r,downloaded:!0}}throw new ie(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function Zg(e,n,t){if(e instanceof Pe)throw e;if(e instanceof Jt){if(n===void 0)throw new ie(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Uo(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new Gn(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Os(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Uo(n,t,[`could not refresh the shard index (${Os(e)}); using the cached shard`])}async function Pd(e,n){if(!e.activated)throw new ie("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??Xg(e.shardHosts);if(!dd(e.pubkeys))throw new ie("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let o=Yg(e);if(e.offline){if(o===void 0)throw new Gn(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Uo(o,e,[])}let r=await yd(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:o?.sequence??0})}catch(d){return Zg(d,o,e)}if(!xs(s.index,s.sig,e.pubkeys))throw new ie("shard index signature did not verify against any pinned key");let a=Ss(s.index,Nd(e));if(o!==void 0&&a.sequence<o.sequence)return Uo(o,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(o.sequence)}); keeping the newer cached shard`]);let l=_d(s.shardUrls,a.urls,e.shardHosts),i=await Jg(a,l,e,t);return jo(Ko.join(e.cacheDir,vs),s.index),jo(Ko.join(e.cacheDir,Is),s.sig),{path:i.path,fromCache:!i.downloaded,warnings:Rd(a,e),sequence:a.sequence}}var Qg="https://api.cupel.sh",$d=".actions.githubusercontent.com",ey=8192;function Od(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Je=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function ny(e){let n;try{n=new URL(e).hostname}catch{throw new Je("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=$d.slice(1);if(n!==t&&!n.endsWith($d))throw new Je(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Ye(e,new Set([n]))}catch{throw new Je(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function zo(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,o=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Je("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(o===void 0||o==="")throw new Je("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=ny(t);r.searchParams.set("audience",Qg);let s;try{s=await n(r.href,{authorization:`Bearer ${o}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Je("the ID-token request failed")}if(s.length>ey)throw new Je("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(s)}catch{throw new Je("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new Je("the ID-token response carried no token");return l}async function Cd(e,n,t={}){let o=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!o)throw new Je("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await zo(e,n)};if(o)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await zo(e,n)};throw new Je("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var Cs="api.cupel.sh",ty=`https://${Cs}/v1/findings`,oy=64*1024,Wo=8*1024*1024,ry=3e4,Cn=class extends Error{constructor(n){super(n),this.name="PushError"}};async function Md(e,n,t,o={}){if(e.length>Wo)throw new Cn(`findings payload is ${String(e.length)} bytes, over the ${String(Wo)}-byte limit`);let r=Ye(ty,new Set([Cs])),s;try{s=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,o.timeoutMs??ry)}catch{throw new Cn(`the findings push to ${Cs} failed`)}if(s.body.length>oy)throw new Cn("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new Cn("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new Cn("the control plane rejected the findings payload as malformed"):new Cn(`the findings push was refused with status ${String(s.status)}`)}var sy=64*1024,iy=64*1024,Td=async(e,n,t,o)=>{if(Buffer.byteLength(t,"utf8")>Wo)throw new Error("findings payload is over the size limit");return await Vt("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,iy,o)};async function Vo(e,n){let t=await Vt("GET",e,n,void 0,sy,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var dy=720*60*60*1e3,cy=Number(Fn);function Dd(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function Ld(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new an("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Ms(e){let n=e.ecosystem??"npm",t=await Pd({ecosystem:n,activated:!0,pubkeys:wd,indexHost:Ed,shardHosts:Bo,credential:gd(process.env,()=>zo(process.env,Vo),()=>md(process.env)),cacheDir:n==="npm"?As():ly.join(As(),n),offline:e.offline,now:Date.now(),maxAgeMs:dy,supportedDbSchemaVersion:cy});for(let o of t.warnings)process.stderr.write(`cupel: ${o}
-`);return{path:t.path,sequence:t.sequence}}var uy=9,fy={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64,maxAdvisoryDetails:8e3},vn=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function Ts(e){return{path:e.path,start:e.start,end:e.end}}function py(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new vn(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,o=e.modelPromotedFromKind??null;if(t===null!=(o===null))throw new vn(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new vn(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:Js(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(r=>({functionName:r.functionName??null,modulePath:r.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(Ts),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:o,surfaceComplete:e.surfaceComplete??null}}var my="";function hy(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];return(e.ecosystem==="npm"?n:[...n,e.ecosystem]).join(my)}function gy(e){let n=new Map;for(let t of e){let o=hy(t),r=n.get(o);if(r===void 0){n.set(o,t);continue}if(r.tier!==t.tier||r.unknownKind!==t.unknownKind)throw new vn(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function yy(e){let n=fy,t=(o,r,s)=>{throw new vn(`${o} has ${String(r)} entries, over the ${String(s)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let o of["dispatch","load"]){let r=e.unresolved[o].length;r>n.maxUnresolvedSites&&t(`the app-global ${o} set`,r,n.maxUnresolvedSites)}for(let o of e.findings)o.path!==null&&o.path.length>n.maxPathSteps&&t(`the call path of finding ${o.advisoryId}`,o.path.length,n.maxPathSteps),o.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${o.advisoryId}`,o.unresolvedSites.length,n.maxUnresolvedSites);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let o of e.advisories){if(o.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${o.id}`,o.ranges.length,n.maxAdvisoryRanges),o.summary!==null&&o.summary.length>n.maxStringLength)throw new vn(`the summary of advisory ${o.id} is ${String(o.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(o.details!==null&&o.details.length>n.maxAdvisoryDetails)throw new vn(`the description of advisory ${o.id} is ${String(o.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function xy(e,n){let t=new Set(n.map(o=>o.advisoryId));return e.advisories.filter(o=>t.has(o.advisory.id)).map(o=>({id:o.advisory.id,cveId:o.advisory.cveId,osvId:o.advisory.osvId,summary:o.advisory.summary,details:o.advisory.details??null,severity:o.advisory.severity,published:o.advisory.published,source:o.advisory.source,ranges:o.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function Fd(e,n){let t=gy(e.findings.map(py)),o={version:uy,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(Ts),load:e.unresolved.load.map(Ts)},advisories:xy(e,t)};return yy(o),o}function jd(e){let n=new Set(e.installed.packages.map(o=>o.ecosystem??"npm")),t=["npm","PyPI"].filter(o=>n.has(o));return t.length===0?"npm":t.join("+")}function Sy(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var by={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Bd=4,Ds=3,Ls=10,Kd={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},ky="(symbol set known incomplete)";function Ey(e){let n=(e.path??[]).map(t=>W(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Ud(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function wy(e){let n=e.findings.filter(d=>d.tier==="unknown"&&d.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let d of n){let u=t.get(d.unknownKind)??[];u.push(d),t.set(d.unknownKind,u)}let o={cupel:0,project:0};for(let[d,u]of t)o[Ve[d]]+=u.length;let r=[];r.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(d,u)=>{if(o[d]===0)return;r.push(""),r.push(`   ${u} (${String(o[d])}):`);let p=[...t.entries()].filter(([m])=>Ve[m]===d).sort((m,g)=>g[1].length-m[1].length||m[0].localeCompare(g[0])),f=p.slice(0,Bd);for(let[m,g]of f){let y=d==="project"?[...new Set(g.flatMap(Ud))]:[],b=y.slice(0,Ds).map(W).join(", "),x=y.length>Ds?` (+${String(y.length-Ds)} more files)`:"";r.push(`     ${m.padEnd(21)} ${String(g.length).padStart(4)}  ${Kd[m]}`+(b!==""?`
-       ${b}${x}`:""))}for(let[m,g]of p.slice(Bd))r.push(`     ${m.padEnd(21)} ${String(g.length).padStart(4)}  ${Kd[m]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let d of n)if(Ve[d.unknownKind]==="project")for(let u of Ud(d))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((d,u)=>u[1]-d[1]||d[0].localeCompare(u[0]))[0];l!==void 0&&o.project>0&&(r.push(""),r.push(`   \u279C Start here: ${W(l[0])} appears in ${String(l[1])} of your ${String(o.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let i=n.filter(d=>Ve[d.unknownKind]==="project");if(i.length>0){r.push("");for(let d of i.slice(0,Ls))r.push(`     ${W(d.displayId)}  ${W(d.packageName)}@${W(d.version)}  [${d.unknownKind}] ${W(d.reason)}`);i.length>Ls&&r.push(`     \u2026 and ${String(i.length-Ls)} more`)}return r.push(""),r}function zd(e){let n=[],t=e.counts,o=e.findings.filter(d=>d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low");if(n.push(`cupel scan: ${W(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let d=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+d.map(u=>`${W(u.entrypoint)} [${W(u.source)}]`).join(", ")+(e.entrypointSources.length>d.length?`, \u2026 and ${String(e.entrypointSources.length-d.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let d=new Map;for(let u of e.entrypointObservations)d.set(u.kind,(d.get(u.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...d.entries()].map(([u,p])=>`${String(p)} ${u}`).join(", ")+` (${W(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let d=e.rootSet,u=d.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(d.counts.rootsAdmitted)}): `+u.map(m=>`${W(m.rel===""?".":m.rel)} [${m.witnesses.join("+")}${m.ecosystem==="PyPI"?"; PyPI":m.alsoPython===!0?"; npm+PyPI":""}]`).join(", ")+(d.roots.length>u.length?`, \u2026 and ${String(d.roots.length-u.length)} more`:"")),d.observations.length>0){let m=new Map;for(let g of d.observations)m.set(g.kind,(m.get(g.kind)??0)+1);n.push("    not admitted: "+[...m.entries()].map(([g,y])=>`${String(y)} ${g}`).join(", "))}n.push(`    walk: ${String(d.counts.dirsWalked)} dirs, ${String(d.counts.manifestsSeen)} manifests seen, ${String(d.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${d.budget}`);let p=e.installed.perRoot.filter(m=>m.rootRel!=="");p.length>0&&n.push(`    enumerated (${String(p.length)} nested root${p.length===1?"":"s"}): `+p.slice(0,8).map(m=>`${W(m.rootRel)} (${String(m.packages.length)} packages, ${m.source})`).join(", ")+(p.length>8?`, \u2026 and ${String(p.length-8)} more`:""));let f=dt(d,e.entrypointSources);f.length>0&&n.push(`    NOT analyzed (${String(f.length)}): ${W(Xr(f.map(m=>m.rel===""?".":m.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at unknown until they are analyzed`),d.budget!=="complete"&&d.budget!=="not-attempted"&&n.push(`    the walk did not finish (${d.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at unknown`),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let d of e.entrypointGaps.slice(0,5))n.push(`  - ${W(d.source)} (${W(d.file)}): ${W(d.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(W).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${Sr(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,s=r.find(d=>d.kind==="no-enumeration")??null;s!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${W(s.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=r.filter(d=>d!==s);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let d of a.slice(0,10))n.push(`  - [${W(d.kind)}] ${W(d.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(r.map(d=>d.detail)),i=[...e.analyzerDiagnostics.map(d=>`${W(d.code)}: ${W(d.detail)}`),...e.pythonDiagnostics.map(d=>`python: ${W(d)}`),...e.installed.diagnostics.filter(d=>!l.has(d)).map(W)];if(i.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(i.length)}) \u2014 verdicts are conservative:`);for(let d of i.slice(0,10))n.push(`  - ${d}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}if(o.length>0){n.push(`\u{1F3AF} Reachable (${String(o.length)}) \u2014 fix these:`);for(let d of o)n.push(`  ${by[d.tier]} ${W(d.displayId)}  ${W(d.packageName)}@${W(d.version)}  ${W(d.symbolName??"")}`+(d.surfaceComplete===!1?`  ${ky}`:"")),n.push(`        path: ${Ey(d)}`);n.push("")}return n.push(...wy(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${Sy(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
-`)}import{createHash as vy}from"node:crypto";var Iy="https://json.schemastore.org/sarif-2.1.0.json",Wd="cupel-reachability",Fs=new Set(["dispatch","dynamic-load","coverage-gap"]);function Ay(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var _y=500,Ny=10;function Ry(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function Py(e,n){return`${e}::${n}`}function $y(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Oy(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return vy("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Cy(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Fs.has(e.unknownKind)}var Vd={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function qd(e){let n=[],t=new Map,o=[];for(let i of e.findings){if(!Cy(i))continue;let d=Py(i.displayId,i.packageName);if(!t.has(d)){t.set(d,n.length);let b=$y(i.severity);n.push({id:W(d),properties:{tags:i.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${W(i.packageName)}`]:["security","reachability",`package/${W(i.packageName)}`],...b!==void 0?{"security-severity":b}:{}}})}let u=i.tier==="reachable-high"||i.tier==="reachable-medium"||i.tier==="reachable-low",p=i.path??[],f=p.find(b=>b.modulePath!==""),m=[...new Set(i.unresolvedSites.map(b=>b.path).filter(b=>b!==""))],g=u?f!==void 0?{physicalLocation:{artifactLocation:{uri:W(f.modulePath)}},message:{text:`calls ${W(i.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:W(i.packageLocation??"package-lock.json")}}}:m[0]!==void 0?{physicalLocation:{artifactLocation:{uri:W(m[0])}},message:{text:`unresolved ${W(i.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:W(i.packageLocation??(i.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},y=u?p.map(b=>({physicalLocation:{artifactLocation:{uri:W(b.modulePath||"package-lock.json")}},message:{text:W(b.functionName??"<step>")}})):m.slice(1,Ny+1).map(b=>({physicalLocation:{artifactLocation:{uri:W(b)}},message:{text:"also blocked here"}}));o.push({ruleId:W(d),ruleIndex:t.get(d),level:u?"error":"warning",message:{text:W(`[${i.tier}] ${i.displayId} in ${i.packageName}@${i.version}`+(i.symbolName!==null?` \u2014 reaches ${i.symbolName}`:"")+(i.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${i.reason}`)},locations:[g],...y.length>0?{relatedLocations:y}:{},partialFingerprints:{"cupelReachability/v1":Oy(i)},properties:{tier:i.tier,advisoryId:W(i.advisoryId),...i.surfaceComplete===!1?{surfaceComplete:!1}:{},...i.modelId!==void 0?{modelId:W(i.modelId),modelPromotedFromKind:i.modelPromotedFromKind}:{},...i.unknownKind!==void 0?{unknownKind:i.unknownKind,unknownOwner:Ve[i.unknownKind],unresolvedSiteCount:i.unresolvedSites.length}:{},...i.adr105!==void 0?{adr105:i.adr105}:{}}})}let r=new Map,s=new Map;for(let i of e.findings){if(i.tier!=="unknown"||i.unknownKind===void 0||(r.set(i.unknownKind,(r.get(i.unknownKind)??0)+1),Fs.has(i.unknownKind)))continue;let d=s.get(i.unknownKind)??[];d.length<_y&&d.push({advisory:W(i.displayId),package:W(i.packageName),version:W(i.version)}),s.set(i.unknownKind,d)}let a={cupel:0,project:0};for(let[i,d]of r)a[Ve[i]]+=d;let l={};for(let[i,d]of s){let u=r.get(i)??d.length;l[i]={count:u,owner:Ve[i],note:Vd[i],truncated:u>d.length,advisories:d}}return{$schema:Iy,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Wd},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:W(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(i=>`${i.entrypoint} (${i.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...r.keys()].filter(i=>!Fs.has(i)&&!Ay(i,e.analysisAborted)).sort().map(i=>({descriptor:{id:`unknown-${i}`},level:"warning",message:{text:`${String(r.get(i)??0)} finding(s) are unknown because ${Vd[i]} (owner: ${Ve[i]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${i}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(i=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:W(`${i.source} (${i.file}): ${i.detail}`)}})),...e.rejectedEntries.map(i=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:W(`--entry did not resolve to a file inside the app root: ${i}`)}})),...e.entrypointObservations.map(i=>({descriptor:{id:`entrypoint-observation:${i.kind}`},level:"note",message:{text:W(`${i.detail} (${i.file})`)}})),...e.analyzerDiagnostics.map(i=>({descriptor:{id:i.code},level:"warning",message:{text:W(`${i.detail}${i.reason===void 0?"":` [reason: ${i.reason}]`} (${i.path})`)}})),...e.pythonDiagnostics.map(i=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:W(i)}})),...e.installed.diagnostics.map(i=>({descriptor:{id:"resolve"},level:"warning",message:{text:W(i)}}))]}],results:o,properties:{category:Wd,summary:e.counts,installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(i=>({path:W(i.rootRel),count:i.packages.length,source:i.source}))},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:dt(e.rootSet,e.entrypointSources).length,named:dt(e.rootSet,e.entrypointSources).slice(0,8).map(i=>W(i.rel===""?".":i.rel))},analyzed:[...Lt(e.entrypointSources)].sort().slice(0,64).map(i=>W(i===""?".":i)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(i=>({path:W(i.rel),witnesses:i.witnesses,...i.manifestRefused?{manifestRefused:!0}:{},...i.ecosystem!==void 0?{ecosystem:i.ecosystem}:{},...i.alsoPython===!0?{alsoPython:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(i=>({kind:i.kind,path:W(i.rel)}))}}:{},...Ry(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...r].sort((i,d)=>d[1]-i[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(i=>i.tier==="unknown"&&i.unknownKind==="db-gap").map(i=>({advisory:W(i.displayId),package:W(i.packageName),version:W(i.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(i=>i.adr105!==void 0).map(i=>({advisory:W(i.displayId),package:W(i.packageName),version:W(i.version),symbol:W(i.symbolName??""),tier:i.tier,...i.unknownKind!==void 0?{unknownKind:i.unknownKind}:{},...i.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
-`)});function Gd(){try{let e=My(Ly(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function Fy(e,n){let t=`${JSON.stringify(n,null,2)}
-`,o=`${e}.tmp-${Hd(8).toString("hex")}`;Xd(o,t,{encoding:"utf8",flag:"wx"}),Ty(o,e)}async function jy(e){let n=od(e),t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",o=t?{path:Ld(n.shard),sequence:null}:await Ms({offline:n.offline}),r=o.path,a=Dd(n.shardPypi);if(a===void 0&&!t)try{a=(await Ms({offline:n.offline,ecosystem:"pypi"})).path}catch(i){if(i instanceof Xt||i instanceof Gn)process.stderr.write(`cupel: no PyPI shard available (${i.message}); Python distributions, if any, will be reported as not assessed
-`);else throw i}let l=gs({dir:n.dir,shardPath:r,...a!==void 0?{shardPathPypi:a}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${zd(l)}
-`),l.modelLane!==void 0){let i=l.modelLane.notes.length>0?` (${l.modelLane.notes.map(d=>W(d)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(l.modelLane.active)}/${String(l.modelLane.stored)} active, ${String(l.modelLane.promoted)} promoted to reachable-low${i}
-`)}if(n.summaryShadow!==void 0&&l.summaryShadow!==void 0){let i=Dy.join(n.summaryShadow,"shadow-report.json");Xd(i,`${JSON.stringify(l.summaryShadow,null,2)}
+`),1;let o=Ed(process.env,t.token);return process.stdout.write(`signed in: delivery token stored at ${o} (readable by you alone). \`cupel scan\` uses it outside GitHub Actions; ${Xt} in the environment still wins, and \`cupel logout\` forgets it.
+`),0}function Rd(e){if(Ad(e,"logout"))return 1;let n=Uo(process.env);return vd(process.env)?process.stdout.write(`signed out: removed ${n}. The token itself still works until it is revoked on app.cupel.sh (Settings \u2192 Tokens).
+`):process.stdout.write(`nothing to sign out of: no delivery token stored at ${n} (${bd} would point elsewhere).
+`),0}import vy from"node:path";import{randomBytes as qg,createHash as Wg}from"node:crypto";import{mkdirSync as Vg,readFileSync as Gg,renameSync as Hg,writeFileSync as Xg}from"node:fs";import{homedir as Yg}from"node:os";import Jn from"node:path";var Cs="latest.json",Os="latest.json.sig";function zo(e){return Wg("sha256").update(e).digest("hex")}function Ms(){let e=process.env.CUPEL_CACHE_DIR;if(e!==void 0&&e!=="")return e;let n=Yg();if(process.platform==="darwin")return Jn.join(n,"Library","Caches","cupel","shards");if(process.platform==="win32"){let r=process.env.LOCALAPPDATA,s=r!==void 0&&r!==""?r:Jn.join(n,"AppData","Local");return Jn.join(s,"cupel","shards")}let t=process.env.XDG_CACHE_HOME,o=t!==void 0&&t!==""?t:Jn.join(n,".cache");return Jn.join(o,"cupel","shards")}function Ts(e,n,t){return Jn.join(e,`${n}-${t}.sqlite`)}function qo(e,n){Vg(Jn.dirname(e),{recursive:!0});let t=`${e}.tmp-${qg(8).toString("hex")}`;Xg(t,n,{flag:"wx"}),Hg(t,e)}function Yt(e){try{return Gg(e)}catch(n){if(n instanceof Error&&n.code==="ENOENT")return;throw n}}function Pd(e,n,t,o){let r=Ts(e,n,t),s=Yt(r);if(s===void 0)return;let a=zo(s);if(a!==t)throw o(`cached shard ${r} failed sha256 re-verify (expected ${t}, got ${a})`);return{path:r,bytes:s}}var $d="api.cupel.sh",Wo=new Set(["2b68896688aea5d7cd558798f0d8fbf8.r2.cloudflarestorage.com"]),Cd=["tVK6LxjAkqVPe7fE3w09f3mOSGSI6mWf5BXatNoVv8k="];import Vo from"node:path";var Jg="/v1/resolve",Ds=1024*1024,Ls=4096,Od=Ds+Ls+64*1024,Zg=8,Qg=2048,ey=/^[A-Za-z0-9+/]+={0,2}$/u,ny=3e4,$e=class extends ae{constructor(n){super(n),this.name="DeliveryRefusedError"}},Jt=class extends $e{constructor(n){super(n),this.name="EcosystemUnpublishedError"}},Zt=class extends ae{constructor(n){super(n),this.name="ControlPlaneUnavailableError"}},Qt=class extends ae{constructor(n){super(n),this.name="SequenceFloorRefusedError"}};function ty(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function oy(e){if(typeof e!="string"||e.length===0)throw new $e("the delivery response carried no index signature");if(e.length>Ls||!ey.test(e))throw new $e("the delivery response's index signature is not base64");let n=Buffer.from(e,"base64");if(n.toString("base64")!==e)throw new $e("the delivery response's index signature is not canonical base64");return n}function ry(e){if(typeof e!="string"||e.length===0)throw new $e("the delivery response carried no index");let n=Buffer.from(e,"utf8");if(n.length>Ds)throw new $e("the delivery response's index is larger than one can be");return n}function sy(e){if(!Array.isArray(e)||e.length===0)throw new $e("the delivery response named no shard urls");if(e.length>Zg)throw new $e("the delivery response named more shard urls than one shard has");let n=[];for(let t of e){if(typeof t!="string"||t.length===0||t.length>Qg)throw new $e("the delivery response carried a malformed shard url");n.push(t)}return n}function iy(e,n){throw e===401||e===403?new $e(`${n} rejected the delivery credential \u2014 check ${Xt} or the token \`cupel login\` stored, or that the token has not been revoked in the dashboard (Settings \u2192 Tokens)`):e===404?new Jt(`${n} publishes no shard for this ecosystem \u2014 cannot scan without vulnerability data`):e===409?new Qt(`${n} holds nothing newer than the shard index already cached`):e===429?new Zt(`${n} rate-limited the delivery request`):e>=500?new Zt(`${n} answered ${String(e)}`):new $e(`${n} refused the delivery request with status ${String(e)}`)}async function Md(e,n,t,o,r=ny){let s=Ze(`https://${e}${Jg}`,new Set([e])),a=JSON.stringify({ecosystem:t.ecosystem,sequence_floor:t.sequenceFloor}),l;try{l=await o(s.href,{authorization:`Bearer ${n}`,"content-type":"application/json",accept:"application/json","user-agent":"cupel"},a,r)}catch{throw new Zt(`${e} could not be reached`)}if(l.status!==200&&iy(l.status,e),Buffer.byteLength(l.body,"utf8")>Od)throw new $e(`${e} returned a delivery response larger than one can be`);let i;try{i=JSON.parse(l.body)}catch{throw new $e(`${e} returned a delivery response that is not JSON`)}if(!ty(i))throw new $e(`${e} returned a delivery response that is not an object`);return{index:ry(i.index),sig:oy(i.signature),shardUrls:sy(i.shardUrls)}}var Td=async(e,n,t,o)=>await Gt("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Od,o);var ay=8,js=class extends ae{constructor(n){super(n),this.name="NoUsableShardUrlError"}};function Fs(e){return`${e.origin}${e.pathname}`}function Dd(e,n,t){let o=new Map;for(let a of n)o.set(Fs(a),a);let r=[],s=[];for(let a of e.slice(0,ay)){let l;try{l=Ze(a,t)}catch(u){s.push(u.message);continue}if(l.hash!==""){s.push("a candidate carried a fragment");continue}let i=o.get(Fs(l));if(i===void 0){s.push("a candidate named an object the signed index does not list");continue}let d=new URL(`${Fs(i)}${l.search}`);r.push(Ze(d.href,t))}if(r.length===0)throw new js(`no pre-signed shard url matched the signed index (${s.length===0?"none offered":s.join("; ")})`);return r}var dy=1,cy=1024*1024*1024;function uy(e=Wo){return{async resolve(n){return await Md(n.host,n.token,{ecosystem:n.ecosystem,sequenceFloor:n.sequenceFloor},Td)},async fetchShard(n,t){return Ze(n.href,e),await pd(n.href,{maxBytes:t,timeoutMs:3e4})}}}function Bs(e){return e instanceof Error?e.message:String(e)}function Ld(e){return{ecosystem:e.ecosystem,supportedIndexSchemaVersion:dy,supportedDbSchemaVersion:e.supportedDbSchemaVersion,shardHosts:e.shardHosts,hardMaxBytes:cy}}function fy(e){let n=Yt(Vo.join(e.cacheDir,Cs)),t=Yt(Vo.join(e.cacheDir,Os));if(!(n===void 0||t===void 0)&&Is(n,t,e.pubkeys))try{return As(n,Ld(e))}catch{return}}function Fd(e,n){let t=Date.parse(e.generated);if(Number.isNaN(t)||n.now-t<=n.maxAgeMs)return[];let o=Math.floor((n.now-t)/864e5);return[`the ${e.ecosystem} shard is ${String(o)} days old (built ${e.generated}); its advisory data may be stale \u2014 connect online to refresh`]}function Go(e,n,t){let o=Pd(n.cacheDir,e.ecosystem,e.sha256,r=>new ae(r));if(o===void 0)throw new ae(`the cached index names ${e.ecosystem} shard ${e.sha256} but it is not in the cache \u2014 connect online to repopulate, or pass --shard <path>`);return{path:o.path,fromCache:!0,warnings:[...t,...Fd(e,n)],sequence:e.sequence}}async function py(e,n,t,o){let r=Ts(t.cacheDir,e.ecosystem,e.sha256),s=Yt(r);if(s!==void 0&&zo(s)===e.sha256)return{path:r,downloaded:!1};let a="no shard urls";for(let l of n){let i;try{i=await o.fetchShard(l,e.sizeBytes)}catch(u){a=Bs(u);continue}let d=zo(i);if(d!==e.sha256){a=`sha256 mismatch (expected ${e.sha256}, got ${d})`;continue}return qo(r,i),{path:r,downloaded:!0}}throw new ae(`could not fetch a verified ${e.ecosystem} shard from any mirror: ${a}`)}function my(e,n,t){if(e instanceof $e)throw e;if(e instanceof Qt){if(n===void 0)throw new ae(`the control plane refused to serve an index at or above the requested sequence, and there is no cached ${t.ecosystem} shard \u2014 pass --shard <path>`);return Go(n,t,["the control plane holds nothing newer than the cached shard index; keeping the cached shard"])}if(n===void 0)throw new Xn(`no cached ${t.ecosystem} shard and the delivery seam is unreachable (${Bs(e)}) \u2014 cannot scan without vulnerability data; connect once to populate the cache, or pass --shard <path>`);return Go(n,t,[`could not refresh the shard index (${Bs(e)}); using the cached shard`])}async function jd(e,n){if(!e.activated)throw new ae("zero-config shard delivery is not yet available (ADR-063 token-gated delivery ships in P5) \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let t=n??uy(e.shardHosts);if(!xd(e.pubkeys))throw new ae("zero-config shard delivery is not activated in this build \u2014 pass --shard <path> or set CUPEL_SHARD_NPM");let o=fy(e);if(e.offline){if(o===void 0)throw new Xn(`--offline and no cached ${e.ecosystem} shard \u2014 connect once to populate the cache, or pass --shard <path>`);return Go(o,e,[])}let r=await Id(e.credential),s;try{s=await t.resolve({host:e.indexHost,token:r,ecosystem:e.ecosystem,sequenceFloor:o?.sequence??0})}catch(d){return my(d,o,e)}if(!Is(s.index,s.sig,e.pubkeys))throw new ae("shard index signature did not verify against any pinned key");let a=As(s.index,Ld(e));if(o!==void 0&&a.sequence<o.sequence)return Go(o,e,[`refusing a rolled-back shard index (served sequence ${String(a.sequence)} < cached ${String(o.sequence)}); keeping the newer cached shard`]);let l=Dd(s.shardUrls,a.urls,e.shardHosts),i=await py(a,l,e,t);return qo(Vo.join(e.cacheDir,Cs),s.index),qo(Vo.join(e.cacheDir,Os),s.sig),{path:i.path,fromCache:!i.downloaded,warnings:Fd(a,e),sequence:a.sequence}}var hy="https://api.cupel.sh",Bd=".actions.githubusercontent.com",gy=8192;function Kd(e){return e.kind==="oidc"||/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u.test(e.value)?"oidc":"token"}var Qe=class extends Error{constructor(n){super(n),this.name="PushCredentialError"}};function yy(e){let n;try{n=new URL(e).hostname}catch{throw new Qe("ACTIONS_ID_TOKEN_REQUEST_URL is not a URL")}let t=Bd.slice(1);if(n!==t&&!n.endsWith(Bd))throw new Qe(`refusing to send the ID-token request credential to unpinned host ${n}`);try{return Ze(e,new Set([n]))}catch{throw new Qe(`ACTIONS_ID_TOKEN_REQUEST_URL for host ${n} is not a plain https authority`)}}async function Ho(e,n){let t=e.ACTIONS_ID_TOKEN_REQUEST_URL,o=e.ACTIONS_ID_TOKEN_REQUEST_TOKEN;if(t===void 0||t==="")throw new Qe("ACTIONS_ID_TOKEN_REQUEST_URL is not set \u2014 the workflow needs `permissions: id-token: write`");if(o===void 0||o==="")throw new Qe("ACTIONS_ID_TOKEN_REQUEST_TOKEN is not set \u2014 the workflow needs `permissions: id-token: write`");let r=yy(t);r.searchParams.set("audience",hy);let s;try{s=await n(r.href,{authorization:`Bearer ${o}`,accept:"application/json","user-agent":"cupel"})}catch{throw new Qe("the ID-token request failed")}if(s.length>gy)throw new Qe("the ID-token response was larger than a token can be");let a;try{a=JSON.parse(s)}catch{throw new Qe("the ID-token response was not JSON")}let l=typeof a=="object"&&a!==null?a.value:void 0;if(typeof l!="string"||l.length===0)throw new Qe("the ID-token response carried no token");return l}async function Ud(e,n,t={}){let o=e.CUPEL_TOKEN!==void 0&&e.CUPEL_TOKEN!=="",r=e.ACTIONS_ID_TOKEN_REQUEST_URL!==void 0&&e.ACTIONS_ID_TOKEN_REQUEST_URL!=="";if(t.auth==="token"){if(!o)throw new Qe("--auth=token, but CUPEL_TOKEN is not set");return{kind:"token",value:e.CUPEL_TOKEN??""}}if(t.auth==="oidc")return{kind:"oidc",value:await Ho(e,n)};if(o)return r&&t.warn?.("both CUPEL_TOKEN and GitHub Actions OIDC are available; using CUPEL_TOKEN. Remove the secret to use keyless auth, or pass --auth=oidc."),{kind:"token",value:e.CUPEL_TOKEN??""};if(r)return{kind:"oidc",value:await Ho(e,n)};throw new Qe("no credential for the findings push: set CUPEL_TOKEN, or add `permissions: id-token: write` to the workflow")}var eo="api.cupel.sh",xy=`https://${eo}/v1/findings`,by=64*1024,Xo=8*1024*1024,Sy=3e4,Tn=class extends Error{constructor(n){super(n),this.name="PushError"}};async function zd(e,n,t,o={}){if(e.length>Xo)throw new Tn(`findings payload is ${String(e.length)} bytes, over the ${String(Xo)}-byte limit`);let r=Ze(xy,new Set([eo])),s;try{s=await t(r.href,{authorization:`Bearer ${n}`,"content-type":"application/json","user-agent":"cupel"},e,o.timeoutMs??Sy)}catch{throw new Tn(`the findings push to ${eo} failed`)}if(s.body.length>by)throw new Tn("the control plane returned a response larger than it should");if(!(s.status===202||s.status===200))throw s.status===401||s.status===403?new Tn("the control plane rejected the credential \u2014 check CUPEL_TOKEN, or that the workflow grants `permissions: id-token: write` and the repository is connected in the dashboard"):s.status===400?new Tn("the control plane rejected the findings payload as malformed"):new Tn(`the findings push was refused with status ${String(s.status)}`)}var ky=64*1024,Ey=64*1024,Yo=async(e,n,t,o)=>{if(Buffer.byteLength(t,"utf8")>Xo)throw new Error("findings payload is over the size limit");return await Gt("POST",e,{...n,"content-length":String(Buffer.byteLength(t,"utf8"))},t,Ey,o)};async function Jo(e,n){let t=await Gt("GET",e,n,void 0,ky,15e3);if(t.status!==200)throw new Error(`the ID-token request was refused with status ${String(t.status)}`);return t.body}var _y=720*60*60*1e3,Iy=Number(Bn);function qd(e){let n=process.env.CUPEL_SHARD_PYPI;return e??(n!==void 0&&n!==""?n:void 0)}function Wd(e){let n=process.env.CUPEL_SHARD_NPM,t=e??(n!==void 0&&n!==""?n:void 0);if(t===void 0)throw new dn("no npm shard configured \u2014 pass --shard <path> or set CUPEL_SHARD_NPM (zero-config token-gated delivery ships in P5 \u2014 ADR-063)");return t}async function Ks(e){let n=e.ecosystem??"npm",t=await jd({ecosystem:n,activated:!0,pubkeys:Cd,indexHost:$d,shardHosts:Wo,credential:_d(process.env,()=>Ho(process.env,Jo),()=>wd(process.env)),cacheDir:n==="npm"?Ms():vy.join(Ms(),n),offline:e.offline,now:Date.now(),maxAgeMs:_y,supportedDbSchemaVersion:Iy});for(let o of t.warnings)process.stderr.write(`cupel: ${o}
+`);return{path:t.path,sequence:t.sequence}}var Ay=10,Ny={maxFindings:2e4,maxPathSteps:512,maxUnresolvedSites:131072,maxStringLength:4096,maxReasonLength:8192,maxAdvisories:2e4,maxAdvisoryRanges:64,maxAdvisoryDetails:8e3},_n=class extends Error{constructor(n){super(n),this.name="PayloadError"}};function zs(e){return{path:e.path,start:e.start,end:e.end}}function Ry(e){if(e.tier==="unknown"&&e.unknownKind===void 0)throw new _n(`finding ${e.advisoryId} is unknown with no kind \u2014 an unknown without its kind is a hedge`);let n=e.tier==="unknown"?e.unknownKind:null,t=e.modelId??null,o=e.modelPromotedFromKind??null;if(t===null!=(o===null))throw new _n(`finding ${e.advisoryId} carries half a model provenance \u2014 the model and the kind it promoted from travel together`);if(t!==null&&e.tier!=="reachable-low")throw new _n(`finding ${e.advisoryId} claims model provenance on ${e.tier}; only reachable-low can`);return{advisoryId:e.advisoryId,displayId:e.displayId,packageName:e.packageName,packageVersion:e.version,ecosystem:e.ecosystem,symbolName:e.symbolName,symbolContainer:e.symbolContainer,symbolPath:e.symbolPath,severity:e.severity,tier:e.tier,reason:e.reason,unknownKind:n,unknownOwner:n===null?null:ii(n),basis:e.basis??null,path:e.path===void 0?null:e.path.map(r=>({functionName:r.functionName??null,modulePath:r.modulePath})),unresolvedSites:e.unresolvedEvidence.own.map(zs),unresolvedSets:[...e.unresolvedEvidence.sets],modelId:t,modelPromotedFromKind:o,surfaceComplete:e.surfaceComplete??null}}var Us="";function Py(e){let n=[e.advisoryId,e.packageName,e.packageVersion,e.symbolName??""];if(e.ecosystem==="npm")return n.join(Us);let{symbolContainer:t,symbolPath:o}=e;return t===null&&o===null?[...n,e.ecosystem].join(Us):[...n,e.ecosystem,t??"",o??""].join(Us)}function $y(e){let n=new Map;for(let t of e){let o=Py(t),r=n.get(o);if(r===void 0){n.set(o,t);continue}if(r.tier!==t.tier||r.unknownKind!==t.unknownKind)throw new _n(`the scan produced two different verdicts for ${t.advisoryId} on ${t.packageName}@${t.packageVersion}${t.symbolName===null?"":` (${t.symbolName})`}: ${r.tier} and ${t.tier}. They share one finding identity, so only the second would be stored \u2014 refusing to push rather than let a verdict be dropped. This is a cupel bug; please report it.`)}return[...n.values()]}function Cy(e){let n=Ny,t=(o,r,s)=>{throw new _n(`${o} has ${String(r)} entries, over the ${String(s)} the control plane accepts`)};e.findings.length>n.maxFindings&&t("the findings list",e.findings.length,n.maxFindings);for(let o of["dispatch","load"]){let r=e.unresolved[o].length;r>n.maxUnresolvedSites&&t(`the app-global ${o} set`,r,n.maxUnresolvedSites)}for(let o of e.findings)o.path!==null&&o.path.length>n.maxPathSteps&&t(`the call path of finding ${o.advisoryId}`,o.path.length,n.maxPathSteps),o.unresolvedSites.length>n.maxUnresolvedSites&&t(`the unresolved sites of finding ${o.advisoryId}`,o.unresolvedSites.length,n.maxUnresolvedSites);e.advisories.length>n.maxAdvisories&&t("the advisories list",e.advisories.length,n.maxAdvisories);for(let o of e.advisories){if(o.ranges.length>n.maxAdvisoryRanges&&t(`the ranges of advisory ${o.id}`,o.ranges.length,n.maxAdvisoryRanges),o.summary!==null&&o.summary.length>n.maxStringLength)throw new _n(`the summary of advisory ${o.id} is ${String(o.summary.length)} characters, over the ${String(n.maxStringLength)} the control plane accepts`);if(o.details!==null&&o.details.length>n.maxAdvisoryDetails)throw new _n(`the description of advisory ${o.id} is ${String(o.details.length)} characters, over the ${String(n.maxAdvisoryDetails)} the control plane accepts`)}}function Oy(e,n){let t=new Set(n.map(o=>o.advisoryId));return e.advisories.filter(o=>t.has(o.advisory.id)).map(o=>({id:o.advisory.id,cveId:o.advisory.cveId,osvId:o.advisory.osvId,summary:o.advisory.summary,details:o.advisory.details??null,severity:o.advisory.severity,published:o.advisory.published,source:o.advisory.source,ranges:o.ranges.map(r=>({packageName:r.packageName,introduced:r.introduced,fixed:r.fixed,lastAffected:r.lastAffected}))}))}function Vd(e,n){let t=$y(e.findings.map(Ry)),o={version:Ay,scanId:n.scanId,scannedAt:n.scannedAt,context:{shardSequence:n.shardSequence,shardSchemaVersion:e.shardSchemaVersion,ecosystem:n.ecosystem,analysisAborted:e.analysisAborted,entrypointCount:e.entrypointSources.length,installedPackageCount:e.installed.packages.length},findings:t,unresolved:{dispatch:e.unresolved.dispatch.map(zs),load:e.unresolved.load.map(zs)},advisories:Oy(e,t)};return Cy(o),o}function Gd(e){let n=new Set(e.installed.packages.map(o=>o.ecosystem??"npm")),t=["npm","PyPI"].filter(o=>n.has(o));return t.length===0?"npm":t.join("+")}var My=`https://${eo}/v1/scan-failed`,Ty=400;async function qs(e,n,t,o,r=1e4){try{let s=JSON.stringify({kind:e,detail:n.slice(0,Ty)});await o(My,{authorization:`Bearer ${t}`,"content-type":"application/json","content-length":String(Buffer.byteLength(s,"utf8"))},s,r)}catch{}}function Dy(e){return e.counts["not-reachable"]===0?" (ignorable)":e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?" (assumed: no dependency loader loads them)":" (ignorable)"}var Ly={"reachable-high":"HIGH ","reachable-medium":"MED  ","reachable-low":"LOW  "},Hd=4,Ws=3,Vs=10,Xd={"no-entrypoint":"no entrypoint analyzed \u2014 pass --entry <file> or declare main","analyzer-crash":"cupel's analyzer produced no graph \u2014 please report this","version-undecidable":"installed version is not an exact x.y.z; pin a release to get a verdict","db-gap":"no symbol data for the advisory yet","unverified-symbol":"candidate symbol named but not gate-certified","symbol-unsupported":"the trigger is a property access or pattern, not a call","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze","dynamic-load":"non-literal require/import or loader escape in reach",dispatch:"unresolved call target in reach","resolution-divergence":"cupel may be analyzing a different file than Node runs","analysis-cap":"cupel hit a budget or could not parse a file in reach","coverage-gap":"cupel's dependency enumeration was incomplete \u2014 packages may be missing","incomplete-surface":"the named symbols are not reached, but the advisory's symbol set is known incomplete \u2014 an unnamed one may be"},Fy="(symbol set known incomplete)";function jy(e){let n=(e.path??[]).map(t=>q(t.functionName??"<anon>"));return n.length>0?n.join(" \u2192 "):"(no path)"}function Yd(e){return[...new Set(e.unresolvedSites.map(n=>n.path).filter(n=>n!==""))]}function By(e){let n=e.findings.filter(d=>d.tier==="unknown"&&d.unknownKind!==void 0);if(n.length===0)return[];let t=new Map;for(let d of n){let u=t.get(d.unknownKind)??[];u.push(d),t.set(d.unknownKind,u)}let o={cupel:0,project:0};for(let[d,u]of t)o[Ge[d]]+=u.length;let r=[];r.push(`\u2753 Unknown (${String(n.length)}) \u2014 cupel could NOT decide reachability. This is not a clean result.`);let s=(d,u)=>{if(o[d]===0)return;r.push(""),r.push(`   ${u} (${String(o[d])}):`);let p=[...t.entries()].filter(([m])=>Ge[m]===d).sort((m,g)=>g[1].length-m[1].length||m[0].localeCompare(g[0])),f=p.slice(0,Hd);for(let[m,g]of f){let y=d==="project"?[...new Set(g.flatMap(Yd))]:[],S=y.slice(0,Ws).map(q).join(", "),x=y.length>Ws?` (+${String(y.length-Ws)} more files)`:"";r.push(`     ${m.padEnd(21)} ${String(g.length).padStart(4)}  ${Xd[m]}`+(S!==""?`
+       ${S}${x}`:""))}for(let[m,g]of p.slice(Hd))r.push(`     ${m.padEnd(21)} ${String(g.length).padStart(4)}  ${Xd[m]}`)};s("project","Your code \u2014 a change on your side would produce a real verdict"),s("cupel","cupel's gap \u2014 nothing you can do today");let a=new Map;for(let d of n)if(Ge[d.unknownKind]==="project")for(let u of Yd(d))a.set(u,(a.get(u)??0)+1);let l=[...a.entries()].sort((d,u)=>u[1]-d[1]||d[0].localeCompare(u[0]))[0];l!==void 0&&o.project>0&&(r.push(""),r.push(`   \u279C Start here: ${q(l[0])} appears in ${String(l[1])} of your ${String(o.project)} finding(s), across ${String(a.size)} file(s) total. A finding is decided only once EVERY site it lists resolves.`));let i=n.filter(d=>Ge[d.unknownKind]==="project");if(i.length>0){r.push("");for(let d of i.slice(0,Vs))r.push(`     ${q(d.displayId)}  ${q(d.packageName)}@${q(d.version)}  [${d.unknownKind}] ${q(d.reason)}`);i.length>Vs&&r.push(`     \u2026 and ${String(i.length-Vs)} more`)}return r.push(""),r}function Jd(e){let n=[],t=e.counts,o=e.findings.filter(d=>d.tier==="reachable-high"||d.tier==="reachable-medium"||d.tier==="reachable-low");if(n.push(`cupel scan: ${q(e.dir)}`),n.push(`  ${e.installed.packages.length} installed packages (${e.installed.source}); shard schema v${e.shardSchemaVersion}`),n.push(""),e.entrypointSources.length>0){let d=e.entrypointSources.slice(0,8);n.push(`\u{1F4CD} Entrypoints analyzed (${String(e.entrypointSources.length)}): `+d.map(u=>`${q(u.entrypoint)} [${q(u.source)}]`).join(", ")+(e.entrypointSources.length>d.length?`, \u2026 and ${String(e.entrypointSources.length-d.length)} more`:"")),n.push("")}if(e.entrypointObservations.length>0){let d=new Map;for(let u of e.entrypointObservations)d.set(u.kind,(d.get(u.kind)??0)+1);n.push("\u2139\uFE0F  index.html scripts not seeded: "+[...d.entries()].map(([u,p])=>`${String(p)} ${u}`).join(", ")+` (${q(e.entrypointObservations[0]?.detail??"")}${e.entrypointObservations.length>1?", \u2026":""})`),n.push("")}if(e.rootSet.budget!=="not-attempted"){let d=e.rootSet,u=d.roots.slice(0,8);if(n.push(`\u{1F5C2}  Project roots (${String(d.counts.rootsAdmitted)}): `+u.map(m=>`${q(m.rel===""?".":m.rel)} [${m.witnesses.join("+")}${m.ecosystem==="PyPI"?"; PyPI":m.alsoPython===!0?"; npm+PyPI":""}]`).join(", ")+(d.roots.length>u.length?`, \u2026 and ${String(d.roots.length-u.length)} more`:"")),d.observations.length>0){let m=new Map;for(let g of d.observations)m.set(g.kind,(m.get(g.kind)??0)+1);n.push("    not admitted: "+[...m.entries()].map(([g,y])=>`${String(y)} ${g}`).join(", "))}n.push(`    walk: ${String(d.counts.dirsWalked)} dirs, ${String(d.counts.manifestsSeen)} manifests seen, ${String(d.counts.dotDirectoriesSkipped)} dot-dirs skipped \u2014 budget ${d.budget}`);let p=e.installed.perRoot.filter(m=>m.rootRel!=="");p.length>0&&n.push(`    enumerated (${String(p.length)} nested root${p.length===1?"":"s"}): `+p.slice(0,8).map(m=>`${q(m.rootRel)} (${String(m.packages.length)} packages, ${m.source})`).join(", ")+(p.length>8?`, \u2026 and ${String(p.length-8)} more`:""));let f=ut(d,e.entrypointSources);f.length>0&&n.push(`    NOT analyzed (${String(f.length)}): ${q(os(f.map(m=>m.rel===""?".":m.rel)))} \u2014 code there can load any installed package, so every not-reachable in this scan is capped at unknown until they are analyzed`),d.budget!=="complete"&&d.budget!=="not-attempted"&&n.push(`    the walk did not finish (${d.budget}) \u2014 a root with its own install may have been missed; every not-reachable in this scan is capped at unknown`),n.push("")}if(e.entrypointGaps.length>0){n.push(`\u26A0\uFE0F  Start command(s) cupel could not resolve to an entry file (${String(e.entrypointGaps.length)}) \u2014 that code was NOT analyzed:`);for(let d of e.entrypointGaps.slice(0,5))n.push(`  - ${q(d.source)} (${q(d.file)}): ${q(d.detail)}`);e.entrypointGaps.length>5&&n.push(`  \u2026 and ${String(e.entrypointGaps.length-5)} more`),n.push("   Fix: make it a direct `node <file.js>` invocation cupel can read. --entry <file> analyzes that code too, but verdicts stay capped while the command is unreadable."),n.push("")}e.rejectedEntries.length>0&&(n.push("\u26A0\uFE0F  Ignored --entry (did not resolve to a file inside the app root): "+e.rejectedEntries.map(q).join(", ")),n.push("")),e.analysisAborted==="no-entrypoint"?(n.push("\u{1F6D1} No entrypoint analyzed \u2014 this scan is NOT a clean bill of health."),n.push("   No app entrypoint was found (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command), so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push(e.framework===null?'   Fix: pass --entry <file> (the file your start script or Procfile runs, e.g. --entry server.js), or declare "main" in package.json.':`   ${_r(e.framework)}`),n.push("")):e.analysisAborted==="analyzer-crash"&&(n.push("\u{1F6D1} cupel's analyzer failed on this project \u2014 this scan is NOT a clean bill of health."),n.push("   An entrypoint WAS found, but the analyzer produced no module graph, so cupel analyzed ZERO application code and every finding below is capped at `unknown`, never `not-reachable`."),n.push('   Fix: this is a cupel bug \u2014 please report it at https://github.com/cupel-sh/cupel/issues (the "Analysis incomplete" diagnostics below name the file). `--entry` will not help.'),n.push(""));let r=e.installed.gaps,s=r.find(d=>d.kind==="no-enumeration")??null;s!==null&&(n.push("\u{1F6D1} No dependency enumerated \u2014 this scan is NOT a clean bill of health."),n.push(`   [no-enumeration] ${q(s.detail)}`),n.push("   cupel saw ZERO dependencies, so no advisory could be matched and nothing below is a verdict about your dependencies. Commit a lockfile (package-lock.json, yarn.lock or pnpm-lock.yaml) or install before scanning."),n.push(""));let a=r.filter(d=>d!==s);if(a.length>0){n.push(`\u{1F573}\uFE0F  Dependency enumeration INCOMPLETE (${String(a.length)}) \u2014 packages may be missing from this scan entirely; it is NOT a clean bill of health:`);for(let d of a.slice(0,10))n.push(`  - [${q(d.kind)}] ${q(d.detail)}`);a.length>10&&n.push(`  \u2026 and ${String(a.length-10)} more`),n.push("")}let l=new Set(r.map(d=>d.detail)),i=[...e.analyzerDiagnostics.map(d=>`${q(d.code)}: ${q(d.detail)}`),...e.pythonDiagnostics.map(d=>`python: ${q(d)}`),...e.installed.diagnostics.filter(d=>!l.has(d)).map(q)];if(i.length>0){n.push(`\u26A0\uFE0F  Analysis incomplete (${String(i.length)}) \u2014 verdicts are conservative:`);for(let d of i.slice(0,10))n.push(`  - ${d}`);i.length>10&&n.push(`  \u2026 and ${String(i.length-10)} more`),n.push("")}if(o.length>0){n.push(`\u{1F3AF} Reachable (${String(o.length)}) \u2014 fix these:`);for(let d of o)n.push(`  ${Ly[d.tier]} ${q(d.displayId)}  ${q(d.packageName)}@${q(d.version)}  ${q(d.symbolName??"")}`+(d.surfaceComplete===!1?`  ${Fy}`:"")),n.push(`        path: ${jy(d)}`);n.push("")}return n.push(...By(e)),n.push(`Summary: ${String(t["reachable-high"])} high, ${String(t["reachable-medium"])} medium, ${String(t["reachable-low"])} low (modeled), ${String(t.unknown)} unknown, ${String(t["not-reachable"])} not-reachable${Dy(e)}, ${String(t["not-affected"])} not-affected.`),n.join(`
+`)}import{createHash as Ky}from"node:crypto";var Uy="https://json.schemastore.org/sarif-2.1.0.json",Zd="cupel-reachability",Gs=new Set(["dispatch","dynamic-load","coverage-gap"]);function zy(e,n){return(e==="no-entrypoint"||e==="analyzer-crash")&&n===e}var qy=500,Wy=10;function Vy(e){return e.counts["not-reachable"]===0?{}:e.findings.some(t=>t.tier==="not-reachable"&&t.basis==="loader-assumption")?{denialBasis:{value:"loader-assumption",assumption:"no dynamic loader inside a dependency (a non-literal require/import(), eval/Function, a reflective or captured loader, or a global-object loader) loads this package at runtime"}}:{denialBasis:{value:"complete"}}}function Gy(e,n){return`${e}::${n}`}function Hy(e){switch((e??"").toUpperCase()){case"CRITICAL":return"9.8";case"HIGH":return"7.5";case"MODERATE":case"MEDIUM":return"5.0";case"LOW":return"2.0";default:return}}function Xy(e){let n=e.path?.find(t=>t.modulePath!=="")?.modulePath??e.packageLocation??"";return Ky("sha256").update(`${e.displayId}:${e.packageName}:${e.symbolName??""}:${n}`).digest("hex").slice(0,32)}function Yy(e){return e.tier==="reachable-high"||e.tier==="reachable-medium"||e.tier==="reachable-low"?!0:e.tier!=="unknown"||e.unknownKind===void 0?!1:Gs.has(e.unknownKind)}var Qd={"no-entrypoint":"no application entrypoint was analyzed, so no finding below is a reachability result","analyzer-crash":"cupel's analyzer produced no module graph for this project","version-undecidable":"the installed version could not be compared against the advisory range (not an exact x.y.z)","db-gap":"cupel has no vulnerable-symbol data for these advisories yet (package-level only)","unverified-symbol":"cupel has a named but uncertified candidate symbol for these advisories; the name is in the finding","symbol-unsupported":"the vulnerable trigger is a property access or a pattern, not a call \u2014 cupel's call graph cannot express it","dep-opaque":"the corridor runs through dependency bodies cupel does not analyze (ADR-011 analysis depth)","dynamic-load":"code in reach can load modules cupel cannot enumerate",dispatch:"a call site in reach has no statically resolvable target","resolution-divergence":"cupel may be analyzing a different file than Node runs, or could not follow an import; the per-file diagnostics name each one","analysis-cap":"cupel hit a budget, could not parse a file in reach, or could not read a start command; the per-file diagnostics name each one","incomplete-surface":"cupel certified some of these advisories' symbols and none of them is reached \u2014 but the symbol set is known to be incomplete (ADR-087), so an unnamed symbol may still be; not a clean","coverage-gap":"cupel's dependency enumeration was incomplete, so packages may be missing from this scan entirely \u2014 never read this as clean"};function ec(e){let n=[],t=new Map,o=[];for(let i of e.findings){if(!Yy(i))continue;let d=Gy(i.displayId,i.packageName);if(!t.has(d)){t.set(d,n.length);let S=Hy(i.severity);n.push({id:q(d),properties:{tags:i.unknownKind==="coverage-gap"?["security","coverage-gap",`gap/${q(i.packageName)}`]:["security","reachability",`package/${q(i.packageName)}`],...S!==void 0?{"security-severity":S}:{}}})}let u=i.tier==="reachable-high"||i.tier==="reachable-medium"||i.tier==="reachable-low",p=i.path??[],f=p.find(S=>S.modulePath!==""),m=[...new Set(i.unresolvedSites.map(S=>S.path).filter(S=>S!==""))],g=u?f!==void 0?{physicalLocation:{artifactLocation:{uri:q(f.modulePath)}},message:{text:`calls ${q(i.symbolName??"the vulnerable symbol")}`}}:{physicalLocation:{artifactLocation:{uri:q(i.packageLocation??"package-lock.json")}}}:m[0]!==void 0?{physicalLocation:{artifactLocation:{uri:q(m[0])}},message:{text:`unresolved ${q(i.unknownKind??"access")} in reach`}}:{physicalLocation:{artifactLocation:{uri:q(i.packageLocation??(i.unknownKind==="coverage-gap"?"package.json":"package-lock.json"))}}},y=u?p.map(S=>({physicalLocation:{artifactLocation:{uri:q(S.modulePath||"package-lock.json")}},message:{text:q(S.functionName??"<step>")}})):m.slice(1,Wy+1).map(S=>({physicalLocation:{artifactLocation:{uri:q(S)}},message:{text:"also blocked here"}}));o.push({ruleId:q(d),ruleIndex:t.get(d),level:u?"error":"warning",message:{text:q(`[${i.tier}] ${i.displayId} in ${i.packageName}@${i.version}`+(i.symbolName!==null?` \u2014 reaches ${i.symbolName}`:"")+(i.surfaceComplete===!1?" (symbol set known incomplete)":"")+`. ${i.reason}`)},locations:[g],...y.length>0?{relatedLocations:y}:{},partialFingerprints:{"cupelReachability/v1":Xy(i)},properties:{tier:i.tier,advisoryId:q(i.advisoryId),...i.surfaceComplete===!1?{surfaceComplete:!1}:{},...i.modelId!==void 0?{modelId:q(i.modelId),modelPromotedFromKind:i.modelPromotedFromKind}:{},...i.unknownKind!==void 0?{unknownKind:i.unknownKind,unknownOwner:Ge[i.unknownKind],unresolvedSiteCount:i.unresolvedSites.length}:{},...i.adr105!==void 0?{adr105:i.adr105}:{}}})}let r=new Map,s=new Map;for(let i of e.findings){if(i.tier!=="unknown"||i.unknownKind===void 0||(r.set(i.unknownKind,(r.get(i.unknownKind)??0)+1),Gs.has(i.unknownKind)))continue;let d=s.get(i.unknownKind)??[];d.length<qy&&d.push({advisory:q(i.displayId),package:q(i.packageName),version:q(i.version)}),s.set(i.unknownKind,d)}let a={cupel:0,project:0};for(let[i,d]of r)a[Ge[i]]+=d;let l={};for(let[i,d]of s){let u=r.get(i)??d.length;l[i]={count:u,owner:Ge[i],note:Qd[i],truncated:u>d.length,advisories:d}}return{$schema:Uy,version:"2.1.0",runs:[{tool:{driver:{name:"cupel",informationUri:"https://cupel.sh",rules:n}},automationDetails:{id:Zd},invocations:[{executionSuccessful:e.analysisAborted===null&&e.analyzerDiagnostics.length===0&&e.pythonDiagnostics.length===0&&e.installed.diagnostics.length===0,toolExecutionNotifications:[...e.analysisAborted==="no-entrypoint"?[{descriptor:{id:"no-entrypoint"},level:"error",message:{text:"no app entrypoint analyzed (no --entry; package.json declares no main/bin/exports; no index.js; no usable scripts.start or Procfile command); ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. Pass --entry <file> or declare main."}}]:[],...e.analysisAborted==="analyzer-crash"?[{descriptor:{id:"analyzer-crash"},level:"error",message:{text:"an app entrypoint was found but cupel's analyzer produced NO module graph; ZERO application code was analyzed \u2014 every finding is capped at unknown, not a clean result. This is a cupel bug: please report it (the analyzer diagnostics below name the file)."}}]:[],...e.entrypointSources.length>0?[{descriptor:{id:"entrypoints"},level:"note",message:{text:q(`analyzed ${String(e.entrypointSources.length)} entrypoint(s): `+e.entrypointSources.slice(0,20).map(i=>`${i.entrypoint} (${i.source})`).join(", ")+(e.entrypointSources.length>20?", \u2026":""))}}]:[],...[...r.keys()].filter(i=>!Gs.has(i)&&!zy(i,e.analysisAborted)).sort().map(i=>({descriptor:{id:`unknown-${i}`},level:"warning",message:{text:`${String(r.get(i)??0)} finding(s) are unknown because ${Qd[i]} (owner: ${Ge[i]}). These are counted in counts.unknown and itemised in run.properties.unknown.grouped["${i}"]; they are NOT a clean result.`}})),...e.entrypointGaps.slice(0,20).map(i=>({descriptor:{id:"entry-source-unresolved"},level:"warning",message:{text:q(`${i.source} (${i.file}): ${i.detail}`)}})),...e.rejectedEntries.map(i=>({descriptor:{id:"entry-rejected"},level:"warning",message:{text:q(`--entry did not resolve to a file inside the app root: ${i}`)}})),...e.entrypointObservations.map(i=>({descriptor:{id:`entrypoint-observation:${i.kind}`},level:"note",message:{text:q(`${i.detail} (${i.file})`)}})),...e.analyzerDiagnostics.map(i=>({descriptor:{id:i.code},level:"warning",message:{text:q(`${i.detail}${i.reason===void 0?"":` [reason: ${i.reason}]`} (${i.path})`)}})),...e.pythonDiagnostics.map(i=>({descriptor:{id:"python-analysis"},level:"warning",message:{text:q(i)}})),...e.installed.diagnostics.map(i=>({descriptor:{id:"resolve"},level:"warning",message:{text:q(i)}}))]}],results:o,properties:{category:Zd,summary:e.counts,installed:{count:e.installed.packages.length,byRoot:e.installed.perRoot.slice(0,64).map(i=>({path:q(i.rootRel),count:i.packages.length,source:i.source}))},...e.rootSet.budget!=="not-attempted"?{roots:{budget:e.rootSet.budget,unanalyzed:{count:ut(e.rootSet,e.entrypointSources).length,named:ut(e.rootSet,e.entrypointSources).slice(0,8).map(i=>q(i.rel===""?".":i.rel))},analyzed:[...jt(e.entrypointSources)].sort().slice(0,64).map(i=>q(i===""?".":i)),counts:e.rootSet.counts,admitted:e.rootSet.roots.slice(0,64).map(i=>({path:q(i.rel),witnesses:i.witnesses,...i.manifestRefused?{manifestRefused:!0}:{},...i.ecosystem!==void 0?{ecosystem:i.ecosystem}:{},...i.alsoPython===!0?{alsoPython:!0}:{}})),observations:e.rootSet.observations.slice(0,64).map(i=>({kind:i.kind,path:q(i.rel)}))}}:{},...Vy(e),unknown:{total:e.counts.unknown,byKind:Object.fromEntries([...r].sort((i,d)=>d[1]-i[1])),byOwner:a,grouped:l},dbCoverageGaps:e.findings.filter(i=>i.tier==="unknown"&&i.unknownKind==="db-gap").map(i=>({advisory:q(i.displayId),package:q(i.packageName),version:q(i.version)})),...e.adr105!==void 0?{adr105:{...e.adr105,findings:e.findings.filter(i=>i.adr105!==void 0).map(i=>({advisory:q(i.displayId),package:q(i.packageName),version:q(i.version),symbol:q(i.symbolName??""),tier:i.tier,...i.unknownKind!==void 0?{unknownKind:i.unknownKind}:{},...i.adr105}))}}:{}}}]}}process.removeAllListeners("warning");process.on("warning",e=>{e.name==="ExperimentalWarning"&&/SQLite/u.test(e.message)||process.stderr.write(`${e.name}: ${e.message}
+`)});function nc(){try{let e=Jy(ex(new URL("../package.json",import.meta.url)),"utf8"),n=JSON.parse(e);if(typeof n=="object"&&n!==null&&"version"in n&&typeof n.version=="string")return n.version}catch{}return"0.0.0"}function nx(e,n){let t=`${JSON.stringify(n,null,2)}
+`,o=`${e}.tmp-${tc(8).toString("hex")}`;oc(o,t,{encoding:"utf8",flag:"wx"}),Zy(o,e)}async function tx(e){let n=fd(e),t=n.shard!==void 0||(process.env.CUPEL_SHARD_NPM??"")!=="",o=t?{path:Wd(n.shard),sequence:null}:await Ks({offline:n.offline}),r=o.path,a=qd(n.shardPypi);if(a===void 0&&!t)try{a=(await Ks({offline:n.offline,ecosystem:"pypi"})).path}catch(i){if(i instanceof Jt||i instanceof Xn)process.stderr.write(`cupel: no PyPI shard available (${i.message}); Python distributions, if any, will be reported as not assessed
+`);else throw i}let l=vs({dir:n.dir,shardPath:r,...a!==void 0?{shardPathPypi:a}:{},failOnReachable:n.failOnReachable,requireCompleteDenial:n.requireCompleteDenial,failOnUnknown:n.failOnUnknown,entry:n.entry,root:n.root,...n.summaryShadow!==void 0?{summaryShadow:n.summaryShadow}:{},...n.modelShadow!==void 0&&n.modelShadowOut!==void 0?{modelShadow:{claimsPath:n.modelShadow,outPath:n.modelShadowOut,widened:n.modelShadowWidened}}:{},...n.bindingShadow&&n.bindingShadowOut!==void 0?{bindingShadow:{outPath:n.bindingShadowOut}}:{},...n.partialRows?{partialRows:!0}:{},tsconfigPaths:n.tsconfigPaths});if(process.stdout.write(`${Jd(l)}
+`),l.modelLane!==void 0){let i=l.modelLane.notes.length>0?` (${l.modelLane.notes.map(d=>q(d)).join("; ")})`:"";process.stdout.write(`boundary models: ${String(l.modelLane.active)}/${String(l.modelLane.stored)} active, ${String(l.modelLane.promoted)} promoted to reachable-low${i}
+`)}if(n.summaryShadow!==void 0&&l.summaryShadow!==void 0){let i=Qy.join(n.summaryShadow,"shadow-report.json");oc(i,`${JSON.stringify(l.summaryShadow,null,2)}
 `),process.stdout.write(`summary-shadow: ${String(l.summaryShadow.records.length)} counterfactual record(s) -> ${i}
 `)}if(l.modelShadow!==void 0&&n.modelShadowOut!==void 0){let i=l.modelShadow.records.filter(d=>d.wouldPromote).length;process.stdout.write(`model-shadow: ${String(i)}/${String(l.modelShadow.records.length)} wouldPromote -> ${n.modelShadowOut}
 `)}if(l.bindingShadow!==void 0&&n.bindingShadowOut!==void 0&&process.stdout.write(`binding-shadow: ${String(l.bindingShadow.deltas)}/${String(l.bindingShadow.records.length)} verdict delta(s) -> ${n.bindingShadowOut}
-`),n.sarif!==void 0&&Fy(n.sarif,qd(l)),n.push){let i=Fd(l,{scanId:Hd(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:jd(l),shardSequence:o.sequence}),d=await Cd(process.env,Vo,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
-`)});try{await Md(JSON.stringify(i),d.value,Td)}catch(p){let f=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${f}
-`),l.exitCode===0?1:l.exitCode}let u=o.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(i.findings.length)} finding(s) to api.cupel.sh (${Od(d)})${u}
-`)}return l.exitCode}async function By(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await jy(e.slice(1))}catch(t){let o=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${o}
-`),1}if(e[0]==="login")return await Sd(e.slice(1));if(e[0]==="logout")return bd(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${ys(Gd())}
-`),0):(process.stderr.write(`cupel: unknown command '${W(n)}'
-`),process.stderr.write(`${ys(Gd())}
-`),1)}By().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
+`),n.sarif!==void 0&&nx(n.sarif,ec(l)),n.push){let i=await Ud(process.env,Jo,{...n.auth!==void 0?{auth:n.auth}:{},warn:p=>process.stderr.write(`cupel: ${p}
+`)}),d;try{d=Vd(l,{scanId:tc(16).toString("hex"),scannedAt:new Date().toISOString(),ecosystem:Gd(l),shardSequence:o.sequence})}catch(p){let f=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${f}
+`),await qs("push-refused",f,i.value,Yo),l.exitCode===0?1:l.exitCode}try{await zd(JSON.stringify(d),i.value,Yo)}catch(p){let f=p instanceof Error?p.message:String(p);return process.stderr.write(`cupel: ${f}
+`),await qs("scan-error",f,i.value,Yo),l.exitCode===0?1:l.exitCode}let u=o.sequence===null?" \u2014 shard version unverified, shown as unknown on the dashboard":"";process.stdout.write(`pushed ${String(d.findings.length)} finding(s) to api.cupel.sh (${Kd(i)})${u}
+`)}return l.exitCode}async function ox(){let e=process.argv.slice(2);if(e[0]==="scan")try{return await tx(e.slice(1))}catch(t){let o=t instanceof Error?t.message:String(t);return process.stderr.write(`cupel scan: ${o}
+`),1}if(e[0]==="login")return await Nd(e.slice(1));if(e[0]==="logout")return Rd(e.slice(1));let n=e[0];return n===void 0||n==="help"||n==="--help"||n==="-h"?(process.stdout.write(`${_s(nc())}
+`),0):(process.stderr.write(`cupel: unknown command '${q(n)}'
+`),process.stderr.write(`${_s(nc())}
+`),1)}ox().then(e=>{process.exit(e)},e=>{let n=e instanceof Error?e.message:String(e);process.stderr.write(`cupel: ${n}
 `),process.exit(1)});